From 1081b26c735043611b9f08ea15267992d43f12c3 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:30:39 +0000
Subject: [PATCH 001/104] dev2: fleet kit to move Railway sites onto dev2 and
 deploy them on merge

dev2-site reads the truth from Railway (services, domains, volumes, database
variables), renders the box files from templates, provisions ~/www/<site> over
ssh, copies Postgres through Railway's ssh endpoint into the shared cluster,
issues the certificate over Porkbun DNS-01 before DNS moves, flips Porkbun,
stops and disconnects the Railway service, and merges the per-repo
deploy-dev2.yml. First site through it: bg0ne.com.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc |  Bin 0 -> 89070 bytes
 dev2/dev2-site                            |  794 ++++++
 dev2/sites.json                           | 2753 +++++++++++++++++++++
 dev2/sites.overrides.json                 |    1 +
 dev2/templates/deploy-app.sh              |  110 +
 dev2/templates/deploy-dev2.yml            |   60 +
 dev2/templates/nginx-vhost.conf           |   45 +
 7 files changed, 3763 insertions(+)
 create mode 100644 dev2/__pycache__/dev2-sitecpython-312.pyc
 create mode 100755 dev2/dev2-site
 create mode 100644 dev2/sites.json
 create mode 100644 dev2/sites.overrides.json
 create mode 100755 dev2/templates/deploy-app.sh
 create mode 100644 dev2/templates/deploy-dev2.yml
 create mode 100644 dev2/templates/nginx-vhost.conf

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..763b89e4ec7d78c02e20df28700254f27900c1fc
GIT binary patch
literal 89070
zcmd443s_rMmM*9#0zCln#!vAw$mU^e`~c$zFWcA-wgErD#vnKXgaP3rVT>#i*X`=B
zAaP&Im2_F|I1{-l^96UgJEXhj7QQz<Ayug<SKm9+M;0!K%JX%mZ)Wbz^f&XllA5WG
zyJu?twU5q`z^b^a``+)HW3$iJKKs4bUVH7e)?WMHn@oBIp8fm(&CpMNtWf+%`XN2K
zi08{8twM22!6`ZwoRU)wD?63!t?E>>x299W-r7zrdna@zu(z&L$KHvZiR_)!nZ(}u
zPCa`YIt}b?>@>2ssnf*X$(<>7?T|&PM)W;Y5cNyG-x9M(`W}7T)4#72e@XAojNg)a
zOEi__vuAMX@2kXLomszEI*ptz`}azxmDA<?mUP>t+C|@pSrz>y`G$5$zUZ4v;B-<6
za*wS0J<=y~NmBaG^}k0tJ!g>9ZQzWZ8#$AG<C_XD`7L#)<#%r>mm=3Xk4x>$=ggf2
zTv}%#m)=?Qd*qTK=dy{*>@4Q8zNzRe;j-acxg5BgxpQ3ZH<g`Rxbxf^yi2(*ZY|zr
z+y!nO-sRkS#H!#nz}?Digj>m3;BMpc;BM#g;Z||oTmj<l;0p0;Cszb_7q<!SZmx$b
z#+Pc9!k#eXj*gDx<4UCZan^p-Z;iG2cZ#(|j#c_Kd6mhr%D*O7g&b>Zzp7u`xreJn
zduq9DaQAZC;qK$A;O^&kz&*h2gj>h$f?NMvMkoHP+bzRN16PgIja&`fCT<VhgIq1#
zL)>1thq--lo4NgPk8lUz9_8xb9^>lazQi@aZQ&Z>9_MUa6Z-rFcM!i$a);oya);rz
zam{esxnAxFzMtZb;@4^J7~C`5OK{I}EpR)y<8V8<6L8OQC*hvwTH$taZE!De?Qpxf
zQ*e8@({OFv8MwXNS-5>%2VBl>=Q=NzC=`4mMwI)0WU!TrN!6sv+Gl$;L7~ud_RHJK
zTn@Lr#xml(Y`54ftv1K-gl)2H(CKp9ISYNWI7i)13q`fqMmftxyM4^!a3f%B*g5GK
z9l&?Xh@Bs>m+SQwJaVQM-ag=Px%o*7UGebt-f_pUn7ylf$b}sGdFO~!x~0TDXt%ie
zardBgRhGlZ&~mP<?4koz85{79I!EnZ*Z7#N*XFW&-Q&E=*|jQ(YtT7isil_eTm7Za
z*5B_$J;blkDvE6@qn4CUjtpB$wphwX9aqL|eHUGpMrYqeJKygZwp%TZQ43X-w~skX
zEjAZA@I>pXLdJOKWrxdwCax;w<%)@kiHb-dK2vEm7W?SsQcIt6WX$QZmqt3-;_Bla
zV{ZB9Mf+r_#bxi~?QYkq(zxE$#Y9@g+1#v;q$;}xZ9E3JZ+IL7&0Dsh%(2Opqi_N+
zFu>ba7jfA+JU(J~JzoyXAp$@aF&1(ib=ybXE))wOifwX5B%jp{U|=O>evY^IcZn?!
zA!duk<+kx|f;k3}CFpb-0dd4Ew!S{+_^5j|)b!brWL5XGT#wn^#V$+JXdgd0=C)jR
zVEml?#oqBzOJhr0+1AQZORv4($=m5Cn<CG322GTBS&t4lMz3Iy_{-?s-eJIurEH(2
za@(%*t@u}2Q#<D5-Kzl-aUK1WQg#6IvGLwvM_-qvZ=4@y?PL?uJ;*!92L>%-86{(m
z(NPR#WRjLzoIGm@s=T@%xY0PnMjg>V>=?7yQT(KZbB@>m);71?6_Jcr4HO^26fU=O
zOsX;KQ{K*Si3AAZ$c!)`*ka)vE`Y?Sz0WOA9Lt2w-8Z-@cZN__WXtllh?qv~3TgJ9
zXtk6yG*cJ>1z{x#Ci-pT!){A2ZyW7<4wH;H26!8=+jC%H8y>be`&kjTUSP#inletF
zv-72x=&tb*Tko)aRdq2F9e|QZUS(yIm>=xn?89~xLLe%22*HG-4-rb7qr;OHTR+Xe
zNNucoeJg;EAw$4-Ww{9D4wnUJgd6X31CP`oHw3ty&S49^ku}Q*p+Ls&L5$o44{S$K
zfT&CLgtgh&iZOt@Bj1r4t#Vuj@T@?;TPRZ(YHc4G8%7_wfNh+>ZM?mVA0O2N+p)?}
z2`IeRd8ORa=BB<JLrWNh4kJ^V^O*7FfPLF=1*WarUO{uVtbf>UcSjH(L;mIZ&uMvT
z2`9-Vdi0c!xHfn)L_fxY=N()mG@RVnbb4ENTYFu5Q+H!?t0(ujmK9E7Q4b$)YxiVQ
z70S_o{_){qRI2Y{Ik0V5$6_>}@R+u3FR$KFzHQs?^2%LRVV!N%J?I>r^dwXaI!Ejk
z9t~k_Puj~BF21iKHXBd57$cH^A@@GsHZhDy&VDMSLRzOP%7NuQ2I*%R*Xt?Vv6buH
zwrj`kGW(9*Tg$3!{X5HgtG8B_ZQr@GcV}<!HruYsUdJ_~Lg6u^oi5j4g@fz1bK7?8
zsI2znL<&6+TOlg4FR~qBt3S3_3N`+|tcP<;;g-K~O0VKg#ak+OWb>g=3~5-36%MDm
zul_!z#{)7#Vb!#F67+lb?%ii;zo!aoXhjTb`>~)5-cyIQV?0oPSnZm0g%ezEz!`r}
z8CH+D23%CG<ykTfga{BcykYgQbAV6Br&|2Evf*4)T(|oM{C)mYzT@``-rIa{^L*pa
zlk2|3C&hp5hH2UCZRe9v7LQ(6@TqXbs`F{^hBc#3Ox!GZ_tKY0g~xs4{x*M;uj_vL
zdu#5knXmeJ$^kwD5&mmeIO$AXYfE#>p&HBAR(it5kMcRF&pxU&dC<$_zR5s(Kr3W!
zy5II*=e^E(_s>%r#ahb{ftWJ<4CBYY6n@+hNCK>Z5?%dxmEVs*rvz!brq<Tuty1f(
z8s3C7d@?yHaKak<6^GlZ;?3+wpA%?;>Ta=!qow8?c77cK_T$f$59gZVi6&|KkgvhF
zW4huU^}G7J`nkf#nq42Hf0*+iXQA+~Hi$hCTRQ>-HiH7FU2G3{716mPZ6<ien&8x&
z#;X|6PAS~ff9#3dVue@5X}xN%#;d)b@cl@sQwd%r|C%>pC{aoqeRH~t*mCn;w?PWy
z6643j#y2TC+vC<%<yDN9aQY$Y)m4w1`j<U!ngi?^qA9TI@hYU2OJj#}4X6=;|ElMT
z(xp-=I3s7`lGgzDuy{0=Ry}gO6fxdgiBjJGO6gVe#`w9nA?G%QHPus3i>Zys=@D84
zOW5uK<PkO{SSzjNmR38q3?Pbtpq%4wO9?($EfYjY^x4Mn$zC4TU}rJ-OjYI#CyqJB
z?EN5nJgTz3cB?k5b&QUUyTcl{{faxB97)lQj3`tM93R%X9V2!G@C1vVRH-7A2^QTF
zkJ?&e2`lkmA67UDpZ(@HEsm}K@SERQjbT0Z45L_|M*DyoQLV7vHQo#K4#L3|R%00s
zV;!c-6R3xcXebrc#Pd!*tQm4TMuBT>V_~gpaM*q&ti3c2Y{d{U)rLmYstc?8M!2xH
zZ_wU%k<UX=SQlvnUx;5kF}T9YF&8oE7&??Dlgc&7??zxf{#;d<3fB~$>CC=@H(ZOl
zwaY1)KDWPfHe=Q$ByXQqKS@lxkvx;^a|McKxrJTAi8i5&TTHZHtNTP}^qFt1ySXl4
zeq_#nlDtM(Up8xdZ}{Hu?1lO59}fv9+ZRuFEFSE9;1YWJmU;$*J%fvm;l&YtY2-?9
z<ci>#3OQa5^}O;F)4EOtw@%eSuO`(&)vxLGlIoY@>kE3d(YKT0>y)aKew|XCqgSKq
zJiQuJUG(Zwb<@kH>ZM$4DhK64FXUoVIqBPo_`0OJOusIvCg|0px<apRY_RcK=TTv$
zO1Vn@q^qh=vNudu-q<~}ThMF@)WZ?6i;NS{mBc1x*yR8`vDk%JmcSz_!X%h0+9<BU
zs;%}a2XtN)VGiI84U*yk^y^vxHyEgm_~|j#6OH{6KxHpTQ;)epq`})o=-j()Ygl=}
zs%AjI??3`J_Q0kz$~@H((5@K=<;oN1Z&f@OMPLBJa4la$QOG%pKNoNm;aY=fdfdnP
zkI%LX+YdghdbmkAadNTsoN)5IaJWn8?iG^zmNRk#nRB{dsg=g+rwXOE`uQ#*RL8pL
z-@<cC0TfUM;zd0aSu7AJKb%TJ6`VR3q3Afx3u9^{F%#a>jw(6bls39dc{M<<D&&&j
z)xu4B0Xml#Fbq+GS8-n-Lpm9(Mo;}2qS1kzh-{L#vy2P}G6LmXGU~*>f2`DkH<871
z#0br8E%&I)oIo8l47ohhSjq-0pZ^9AzX{Fd!TM2n3=D^0LsK?l@fe8O0wGSh-&3+d
zY_V#9BF2UtZgJEqDdjde)&w8}aqk}1jM?0SVa*638m)6;6i`4kT38Lgixw&oIfx6b
z4lvgZ{Kp^0hvWEj+2CAL{4b5o(+xiDEyGQNzaf-r37CVa1wu+;pm8?yy|wq&&b5WC
z)${p5>t3N`-@GlTKk$&h*6>85o7VUY{zm`KfH|-|P!zcOgB?HI^ZuTBcW8T~u&qf*
zKKO9p=bF<ZsKkN+0VM;K6YyX*!4;n&!o{l|5<jed-15rLW}Wgam9)NLcBxvPY1!Td
z9jJ1;_(r7WE8v8a<Q<7s8P>3!3soyZhv?ZpsGE9}Z$WT7{#-<tTvOa>ef!MqGjE^2
zeg3|6UNd)j{?y!s(E3IpD?*CJZQLCsjYSn$gd_2$lu<MhkDMQpWG~1;dZJ_(zrjtU
zFMEcV{6_jEzTGmR5KSYM+@|m<9FXJOQL&B!8hHtc0B3Idn9HhT?dAzLuwDx%fO2!W
zU0Aii2MlY5oi;A4agNzXBMEuJAS;MDJ;mu}J;|TKNBVPB!vUU2O!HNR5_7KAJ;^J0
zH~Vh(yBqFqm{Tt1ZM$A|qk5+Ljdp+D>t{lS^@65tAwxLP8r<CmuLwS|fI)-Lz~?mj
zGq#80fsb2**z6%x9lK3(%e@>O8BXIt+$mMGhl%u)fNO_hN*yKXhKS@`^>~5txP<$<
zC`JKZlZmuwWKJfQKx(mnQW?sa&EHUJG==0tePp@Iin#H}K2^LnMoXGh6eudObD99b
z*P&42-}U`h)E$ZmrB&bZ`2u<uyGOnWMTZj^By>A3dNk$kk+HCH;&TFK>>Crn?ga;l
zFUC*DH3VAq41&UmBesin&cVC*WB4S37R@QX6;4>gjUyW^V|Ngt0~8k4fqgM->$77E
z!N5}G0<FeM>vz#G5;7A}ncii)Y>$9hKfavBpUVk{whjs3I{J;HZzKh@bDGDR9Z&Qb
zzV?uQjsJ8|UjVd~WSZ{tZNI+3UwMan+i}}5tD3EwvpwFhdp_^O;s?bGg&&mN*g%;a
z{>I_yHeb=ACg)E6+naB14z%6hJl7uDT=RI%o?ojK`kd(v&s?<X{cv;rM)i+2YU@jM
zeX(##Ri^J>{-1DS;WP?wfG0V{?}`axQpDMM#KQ>E?2osF;FR~})flkL)?=@d7LoXn
z>y={z`e;YT9xr0Y!W9@0VIA1u&QZ<<7)c}o*fj>WIAMHi5<?AP73U5og82;w-3Tb@
zQRjph(F4IjSUv9U3nw{TPVjg~Z0>Nv_!vdyX|yHy&=A@RYeC}kHogxZRzZno#KvFb
zX?f|Qj|6vskEC>8V<;*2TK#?gy{q@GzW2(#S3clBy!znkhp#+%B~)>IsiGrT(INB=
z3l$xqiV^=d|G@1%0e5h1=`x_A`5VpC_C-y`8$*GN0RK2^^YhD_jGtyvVC=ZZj2ywn
zswW=ScgrLE{1y(_Na<A$5rnOJz90GBr&^6$+Mb*7lL~Rh-&3|&6L>a1k0N>Os@dN3
z(ureW<+X)1yxqoG!B85tfeUO$ycNh_gSk4)69%=>r!qLy-=^!mHwI<~ZVb;1->D98
zq2w)#Nu_g2%(qPsHvPMjrKD2)f0R@z&Za+4txHsYl&GyU>u5;jhkAlx{dX{9VtX|%
z)|ZKfD5(%{qaLsKIGH|_=8g28!s;1!4yhdS20QL|FdC%Ufwf;=54_6gwq5$pA9NF^
zjXmxR$u|^d13p9q@u~;#uy$1tesWqaLCRlh%h3Ag<4JHM#Uc1|(<X&ILmMPt^ev^}
zbTsN0F*1C+J5TyPlrQ<BZw`6`11e5`U)BOxv5LvqFq$Gt&Hw*mERAySsJtqd!CfTP
zlru?RlwcTvzDjQKWPu?Zk;YU28TLB{7-cFF>B(;AMf+&el`+UCTy-KNBCPE6By8Eb
zwPx$q&r7kGVoel<IpKtfL8ooR(T?pw0g4P8AW#Ftp`G&Z6k#VK2{Bl%H5Tw8EIpCL
z7BFxfqdnGiw)XOENWW^ThxK;IP)9l1NQTt|b}(Bg(q<}24Q?@ik$w_)F>Iopkc^o5
zUJ6TM2;ObOlCB{yzlEZgl0y`<RSkwl{{R>-SH`fSJ1@FuCd;dNB0tg1YRz9qFkyHX
zEt$X_`s5qd8S5L3chcU@zMZ|4yCs;rMJR0y<u-*f4u<rHt~D&{O*e{XihY~>`62!K
zC4F8{pC{yRo2v`ycVe}dc^^-b&2Qx2+H!NtQreba+Lqad_m18>I<KBT8!9~*N;|Za
zb~2cDGL+U9N^YN4FYENz+i!Htbi8)XzddN$@JP2I!YlD71$GPBrSt8N6YHNOr`>SO
zIPPe~?ZMLeis1SRVe8@0`sPs1kx=qcWE7`%fwGW(>$QeY49Rb(g^WFmskO_7<ZDO7
zb%gpwdSs@<8ic+G<6#9>iYz&izL#Jz-u6kFwV*ztG_bs`H!8aR9yG8fy7t7QDdOTe
zusS$(6u(L3kN|_z5Ei<lj?%_c+9bsb%8=;`sY^hWXt~7uG6jq^Fd@o5jm!E>ka}WD
zw|X_?^sneHEBMiv9OB>~ua46bs+IFe;!?axmlZA}mr8GbFBror&g{W>F$}oFE#uaB
zIFm~QzrsxT(t}k>$`x4f>+xnfmjS$)c|S|S<e=6c$6%jqZxY&<Lo8cthk-ii0V`I=
z<x=hYK;yS5G>VuMYof89+Xwt>kt!&N9U*x&Vp%gM-nvu>HpNsT2R$#&=uI3VLB^^F
zJQ@?e#965%h(Sw;`K)?N<4_JL9m*+P2X;wQi7zK!|AqLTP)<ZB7wg&<kR)KELPQ=;
zx@_YeBn5VPN(SBTF;`7RMK2_Yy-pj?NvN1f{2*c;8@x1Jae13ZS8s>L1#j`B+Qz_e
z>9dh6w}SS(&ytu}lvoA8VWv8$y*PP?hehxh!Kxz-in8{}F}p{93aGQJZU6y9A(2u?
zST_iI$<Dhzzk(hB;-<9%n`+_&yTUq<#4g)_-J_+7TArzZvtLF8Phz{%X#rP!(v#fc
zbX%lC?Hqp&pFbzkhJS^eYjE26Z@~4KBusA`bJSQI7GMni+w>u0#fJfGn=IpFk%b_v
zrA-)wfOe5pt%Wpx0IX<eGz>d>X*-5a#U4!8DtZ`t4(srlcmQk}0rk!J+DV7o+fOu+
zm#1Onslog-9Pkz(Qyz<15XupXJ>tKn7&j;e$^p~g4mLxtlbeKG*G)_{Z2eGvSc&Bb
zeDSc-&g4ffLW)>8B2PquG;nE{C(z;X=kfyfv2++xZq&@wU=!H<7snUUf?16rL(`Js
zSkQ1RWN5k8_#{2YpZ%SE)4C_g88=2}MwgNcgUN+L(Q)B)=kmr)?_BwwCon9m-!3$r
z5eE2Qs+D%7TPY+LeyLEVj4P+rPc`bKR^=0O_N@&!H!PWpgXZE{^<0}^E?zWO&!7C5
z`>Eq22N<b89$ru{nX8{BD2y3C*UbJWX<4^6-`wnP3*_AH3Z-qCZdgvq^|u96EJ9(`
zygFF8XF>O{SZF`>vn`JfoO+U)aZ7(w@2?E#X7lbEum@R8ExYe|@8x?h&rd!q5%#qS
z+~DI1hj7vLByB@r{j6)QYOY~+a`vLIu_lzZM=<VLPD%6aoVofaam~|QMMnOw)+h|w
zLN?Z*azRu6>vTn0jbN_+$0sS7H@q|6rIeyzO3@bzCEB)}zSciE+ccN=!%gpRn#-9_
zo3H!u;Ddwz?(jnULf?Fgu;(RVbBnOyxUl|&kaqHq8vgOAnvy+pZN(^jv?Z@`kLpLp
zti}rMkMa}Y|F}ZixI5|NDjoUvtUsvN{v@a5pjP`oXtnV7#V&lbDADgPDW}+lkEG#X
zv8XuJ9eKMcZds+J4`df)-xnA%C@CDPX=CD~ywXB@)a#PG)~hnMD1rQD2&ym5TutFv
zDda;A-Z@H|F%)1gjVOlD50`Zc?08~)@qY>@taLFb#_T2tBuZz@!GY2t$K~KwQaVOZ
zI&zu(Um(FB;Lk-<f<QJ|NO3M_=J;K+>A{q;FTriESgxo6@EL0{CdPW@^8PyXvbJ9N
zJhhOFJXoiF4A06=V<HNyztR0CIOPgX=T#Eld>~5Es-v`aJV7Xz<W)!cY4P?`65ne|
z<JGv5qr5UsPyG4lx&#VY6PJQ8NNW-X(%2%Rxf(PmoFJ0Vo}{uej-MoD7YP0w^fNMY
z9#dIa%(&5)$f$WzFPwL6CiHyXwWZ{I+ZL;*P{N8}iIXB62y+X=ji93`q6J(B3q!YH
ziteWJQ(EhqkDaOO=x%E}+<mmEBdp>{XorQPZ!oNUiIKTs?EtjD#;jWYJtX1hD4j7<
ziEg%KzDGgIkyT=uumNB}%z2`|`M*M(Z{g3?2Zv~2<Fvz{8AzPnGUxuF`{705+=b=j
z^?q02=-fI0L-Ky0B*OvawT90U^*54cl7zIPfa`w!dyV%RLy47;<r$3E`-F_$^Xul5
zg|tJ9$%mH>#v8k4cKIq_s}VGr&ofwQgUUdO=zXaE%Q7xvrHD_wO?Ny}6U@^HDZ+?A
z71YjEoQ_M3Zsh<}3V?@lAO%Bi@a%1e-V%+9jUTuys!U<5T~Kfufta)#Vo~TWVP3^(
z#4=4rD8||Oa#2*m<Z94+;vIeN!%zY|YM*Q%Nh$=(dui7+<}MqxPk7R4q>qB_G)j?N
z2O;g*>sb>~;kiiR-K0Y3>W%=5C##L=4AzkfRWp`;{<3X&@Aj>p<YUf(V^HH7-pe#0
z`2P-l1VQw$Cj||OB|5;kI*M;1bA@I;|8L-cnNIvRk{U~GT)|e+N1y|3=NAx>R!)~4
z&NaoSMzgO<$lWvFE;OB8>^Qg7(G%?GS?ahL?6~+8vQT9+Njf`~M@ZD!p*%{jM&&Wp
zvN2Ui+dK;~P5naSf2a`7bqhATFmMH*uPU2V04w7`#8qk!szmV6pg8G~IWav5S&3;x
z^o(7A>Q0p70bC#=X--3wXrtnWwof$xinI%eeo709p2_xZs;(z#5IUu8W7I17CLrx<
z@x1xFq4Uzh(Haa(p7m;sVq-}^IMD8z!qHNu5m0mWcSrP7)~j}I!0x&_3h~-i2XvyL
zC^zo1K)Dy3NUqL3g$F|_uLb;{p?P8DXxI=_0Z>Sk2`MFk6#R3<0H0095B&R-M9V4}
zR&s1fc}{Sb3;>A9k$;FZuj9{k5DqXzq5<P(8d5E%W%?TeeRJBNaVHj!q}|u*KHX>u
ztPgIinA1JlxI1L14sP7-&zr8B?tiUW*tk1rs1`KUUp+EZGtTK9;}(sl80yVTx47ie
zuysGk=X1cGU7I6w;Cwll0d{`WHXK%s4S4e6M?PQ94^K><FCVqLJ;~?GC2hL%AiTqg
z(l1XYh)ma|VHDv#Uk-f<mlL@=!&>HjmbyCYX9;5iW#IM3SJ&DJG!qMp(oO<AEX5EZ
zvsI7u9lPCbh2lK+eN!szhl#jm4^}$j<FZHEak-S&v!jxsc)MZ{D6%M$S6(l78>Ku@
z4mc{T91UPz6OZ!<9(n{>qNE(~@(2;Hdb~11W%8PCjpDjZqu^A?KND?8@IoyKdsF3g
zC>+J`=VhK|ze?H(a_Rv^Kk=!+tJk(RH8!^amVbug_`fFS-;?t{!Xd~VwOf-w&e+{h
ztO0TEigJheA5y$|if3x9?<Pgg?xW2ujcsAIjpMLFLYLakL8C<ry2sTW*3$6+S6F#5
zth|gh^h#Jm0T5(Eo&0%q7DL~#&E<mPbvM_`|IaAoyZCdx3I||sOnI&8TGMiBCP}Wp
zW17)SE2k@;fSS&`)3%tB7uXHW1`;g#&iXGc8u0sXbBbmTPuKf2%PHm?lQWZk^B;LB
zdD6`!f8iS`cQb#fRpf4Zs#BOZd}&mecTQ`T4Jp1IukH<GymNWh{=F$7uj<j7s;6pv
z`_y3eZJUm+pOJw>&0@6i>hU8MC^_XfiG}>N;3xs61PT}+Rm*cQza2S$IR@vbLWv^0
ziZ0NQQ%WvIdKi`deqDi=6<3tJ2~tRGZ;%~(qA4#czN5UQ1gBxE2B%a0Oby8(^ha?z
z!QpzA8bJv%M!+^)WEg6PofCE*il?gbt^6m*a>a6%REs?_7=ipg&w3C%SY9c+@>-^h
z?Ali@e<md9s)F;M75{KeAtd((+iVYQ(-U_J{I)kYy<K{{^v!Z1rQ}gcvrxAG<LwKV
ze!NpCYYwF}Bi>gGq5Z3>ol0!R)!0ji6R=ogH)~b$Kc{@Dv63(`S_}R^Bbacsi&!{}
zBo8L{3T<bX+PZ^n-HUCuP;zg`&?{(q#dT5cGeno=KAi}qF~LfwjI4Cv-!o}VY<wi4
zCn|3M#>n(4u@2^F2pa*HxRjINCCB8mC6Z4Z5Q^2Rq0>bX93o>hu{2hqMglIBxS5q$
zh7#2%QO!fqQCyFqD-c^Ua%3%dQGRGaTtZOh!=cP#R_11usX?9^aq~u!cA^jD)gK%l
z!d0LHR`{Sk^(>`)d`u>+z_bY~%Ne!)Oam40a#5vEwYeO?nrH{QnQ%Z$M$68hKv|DY
zsjwhuPU*xm6)yg#C>eS+ICA40!D4M2gKAy^5FheeO|2(Ge;SfS;3Re)gZ~wh(lYLP
z7tS@sCu{OT$%k$i`%cc9NzquSYI<xv`06Ep@wG!j@}W-*Y5ppxoP`W0Z%+8~0(tKi
z-z}ak_+IH;UMPP%_SnZB9DA7cxc0=Wb-syfje_CiCpv?#(Qm$aX!^n@xt5UW?Coq{
z-K_FG<2~ct>Bl9t3nzbi{-g6k>*>c$XI{1Wv#%W#OlOykX^)KSp`(2%Xvh;Zd0%~D
zP^27Ie)V^TlVAOv=`0h@{b5%92F)D}oO`+T1)7i4W^yw%<ZjBUFVTFo*9`YZDH^yd
zP>>AjLuhg=hKsi^p#1}|UL3%Yaa{zQ<B33{U=2*DZh59ZcfnTX*;-cJwI!@9!;(b{
z5Z0#gUjFaM2VEAN$ig(A#IM+Cu5k^I5Ae?r`hdP{f<qJBbYthtPG1?cthslG?hbu#
zIAqwq1VYJBJzo$q>=QKmo}cL&q@^l<xeSM9y2O5ntL-MQy<#kmX7<;okm&$9g(|A;
z7EezA`g2N&O5v50F}iVaV}nMBiJgF%r(+m{^yol6Acv$$z10A^0DwMVX9{a1{2g<8
z4weiI_VGlhRYdSVreB$SIHW?N+Pspd##_EwBKgXsK&wb-e2VV#n0Gp^^y6fYOFo3*
zF-h^tM(l2zCs|JK813h6z~^IQ;K6(osm0OPLPG$@h`@Wn(GSS0Mh5u*2On4RUi2(+
zH}4#_^FS+#4=9EM&NT%DFt1ko@^4hkRQQWS`us=wl0YwHOU9H}n|<4E?4Q~1-x)IG
zKQd5o;}c!dx2}BSijdlYt@xs@TNoUU1o;yE1&g{3fr(|EK}gAeq{|OD=hK6mYK5j#
z%ZAkF0SU{32uO5>;ai$-6~@k`=)wTufQ;~onG<EgIOKs8H&-GG<q`;yLewmiu<@8R
z@kr1p!748i`B8yRJcXnfakWhBN@=C{sM0}7Rlk32GSCe6NICJpdu^UeE9Eh&=5!7P
zgbHdbbvo*)q3lR8F)s->Ve!@UsRpqObs;J-w&DriqY7PEb~8yKmGb?z>iSwNa$2O)
z4ni^YdrA*#HKj#wU<x)WeA+HR;gn7iF-;|U6FCE=6h{zcC-p(O0A)iIHkAYs4--Xk
zMv5c<GSRQsRoBx|mL9S6Ung2Yo`xI7J`n%N)fCy17^aL~BbOW@8;o89h>#R)#?@2C
zDFcv@0T4(O5qrFPsVApQUK85Oc}-jj)nO_bElWWgQe)fDHHa^%-qc9l%`3j0#W%Cp
zEPk6x^QLiW^xd1xPEaVXo4qMRvI>G&KDmgOPVok!iWhm&uaZwLll74NOYFTgE`xG#
z7s#>GxJ(L(AYIwO0G9=3Mucz!Dcp%I7qIGpVk#Xi&88I6X!(>~zd?I4ycuG9Ue(NK
zxSZG+H!>pxVLIYvdNU(^BDGm0+ft-(j6x>HGz&4a(9c`FS&@FGluWEA*43ei3zKW2
zy@OHDj$yiFd$YN<R4<w7lKng7xbFAKkwlzRIZ=TldQ0s2Wb_L2$?W1>Hwatt@#ac>
z%{I$xrq*&8k*Rf4>%F;OKTo?ZqCBIU)Q;HWHM+4W5+7-~Loa5yE2Yq(ZIUng<~Dkb
zQtYV>-VJ=Zcb&`Z-7vHx8b|VR7OAdN>t2v+-pX82kF(zOAcfDpFz5BxM>Gm=`cORh
zUgupe^(Ed6%H70{Vh=_%pT=0KqxAc0VW!~sid`tj&cQsT!d5*}?V@nwUE^Kru9l)j
zN87z8PFQp-bK~XC6-nhkKhk_9;3ZCtxFT+oG`>T7r81*$3Gegf-<Dn~6UPt~T=AV`
z>9<nhQ(aflScz+fgkfpT;7X_}oK?oK8WF=zZN%5Fi;vL+tQfsgd<)`ljLDzyh{nBN
zsy|9%ctNTY(n8%Jf=BXxzqEkPXxe<F&BKbN>cW`38dD-hctwd*1>StruP|ogTj(w1
z3aI_4O_JnCIu;h`kxXwPYDpX4qNzf6oz$LbO}~=c{LMrvTN)XuZ7_Jzh}Lg{!pjzK
z!Rtz{6c|Qa3zb}%gl!OB?oEbUA<Yo@w@Ppce}PmJ_zU4Lq?*E?3qNaF4DO_DJaFew
zgH*rho2!)Sg?`KQW{a)C<~196ZTsiug&td-*LLK!JyORi_^TrR9q{jn_*3C$YcR^*
z3IEPW_%3e|T2mYu8w5@jdyB<B!&}78#bQeQW~JcGa^-g4(V|VDXV9i%<Xeq=tHpfb
zt0AA)g50GQj<9iN%&g9n`Um4i>s+I|N$NddCN^$T3@PWxO1x?4kQ6ie=JrUj#Whi?
z!|#)3P=(D7t$ZSVkQwQLOmVg%oWTO#B0W>fdH~oMJ&@_$#O=MK{%@62CEk*u=4ibn
zpH~$R`*;hYs-jZ;Aq<u1Q0l~0Pi%@QE6R!!CrW*y^=9N}{rXr_o4uP|8SW!eQS{rZ
zMPKN>n>mXIRG}QAysr0ZhhCCmM&Dl9=n%@=>@DFENr=Vm10$MfT!Yu(wMH1x25-q_
zB_P@4wR#zK>n-sbDE9R%V9OG)tPAKDuqW7zgguCv`D&s2xK!G7A+W&y_*ek5EysOQ
ziYZ|Ls2HuEDHO*Q{sV8tQgA56r@j6ml%ZOsbVKcuFZv!j6ZK2Jm=vH~S3g6Yt3#rz
z?@-tC-?+N_^%4}gFG%0rJ(7=WxTA9SNx$57$%nJGU!y!F<tV+m#yje%EiwBvd1n+g
zY6eBR(wKc-zf@B6?cL%n<t+D`B$^GQUOGhE=T#4PP%8K9j<&?$1(`93aXJ)Ld4{}L
zW`kh&0c;{Z?h(m1G%ER`Z>-3Q`-i3VJzA4V%vr`t)W}T5q==90apcfU*_R#bgCZO;
zjMxJOw@p(?ZmaZr1<XaLFtlZZHwkTs5!YaEl*`oEl3q>%{CPO+=w42WDzZIS!)RUO
z`3hs}7fBnfbFustEqYG9?<bLCKFuwjldaHEBl9GpjhTpel#CcLTPUz>#JHTLlGz|S
ztu0$Dl5|;C7%8!hVY3tw*-k`tZ6;v8#|1l0_7d4g`ZN<(NhIr9C2l2+2{O7Qsp7=@
z4hgJO(|DhyZ_SbO+AHG3WZewmu5+C4vtK19mxXb?rXnqOU5#`_BkKs)Rk1^+VEKob
z#j8R|CX6T2TPw<g1erBSw5}AlN|BOKot2dvA=61Ga59n14e?M*YIAt(FV%}>F_$OQ
z6Hb!57DwVmjV2fWF@4dp<BpKCk!>T$-4&m&1H0z)-4GgnegGTn&u?H|`TR!)IRAm1
zzs~`4?I)Dd7*iEjSml8F4F&6wf5hw!<F|)(5vx(*lvNE3n__Zk=E6yGE5k{0!@{N&
zEdyVdO5sxhN_-X^ND^6-AwP~7=?SMw`ACDyLktcv<ce_#Cy2upPL9Nmj8|A$;W5=%
zBmj2RSUfcn*Rf=OjV${<K*H|>CFew*b9q_U76`XRmHenI+{%Oxo=PUkVj^=f+5Q)$
zBl#$S9b;GW|3uZ-oH*Xv&N!~tWQZqvnGOo+hCoQh{9>Q5G0-q(Cb2qMTGoC(je1MP
z_2O(*Z#R>+@}E-1+EJ3g0xkdnq=d#7P~ZN)__TtxuR#ElF4n;F$4Xhgn1)3i=Rr6H
z;6yQllSTB75br6RG9o9;h{_4YHj&C|%RO-J`On~EXNH)XM1(hcO+1(Wzv7!`BNSX9
z3=|F1#gPa88j)OiaQ;CQ2(CYJFDp<tS2=h3{ptnf!lsXsLff0~*zRS0<w``XKS*7x
zd_%WZDV`<NMWzFTThjFFhJs#l3}Di499d&X4?-f*gFya&M_%ES$e2fDJ}$nHI<JVF
zPw|~EhA*s#5eXckfby^lI$%-wr4bPmu()~jGoPHlN75BB*^m$zuu(*(Q8Y4UL2Pe>
zXc!J%H0A`a8>V|m9R=eG#VCv`nfBtk!3akZ`H@GHMA0#$$>fpJC_(~kP|9N}jWLaF
zWK^*&n^ZFCuZoRo3vWdsv11xmI{z6X3Q|?!+Jc%zMl|c#N2eE*zDxeBo0E^S_XJJ`
zF5m5#%bPp+zBO31CzQSCqtl{b_Yc->RC<PMED!`pDBeOsK01*vPJh{08kQ>ry0Dg%
zG2D*RE2Hi`7S~0`*cci5fR+MT<6`Kse5D;LW~FNscKA5El^;Ykd7^hnyPNdFfC?dn
z2pdV7P3Fp|@1ge%(@A^++Qpxz1jTSXdNFshG6xa)FDQIF_1|u0REg=0hK*;Aw;pXf
zQP<Ga-P{<XB}SBOIO+IlXqGiMHnpufz!OevZ93H4*52B||0l}!o8&yABpNcPLU0WG
zPR!O?I02mnVJO7+SWGyke99AljM*Gw$`$dnI{1G}QAl3GWaF>}WgiXe94^i=0Luiw
zqM{&s8{z*CiuQ~gf;9dTeb66lZiPAsLuiW>`oEDwGLPtSBA&=Oo+vrqNe<~WFtZjs
zNej@Q(Bb1BQ(!kaJrtNoh=R2*5n6&{z-snzQVT|ykr&o7h;R7;EL9V(aFRTtP$M7a
zL=7!H1pZt%;XxN0DyTBqqgq_BS2TLr#gk}{DKC(2ijxzyITP4=g{&{z@#o-wMAgx_
zF83h_l~6ju8fYiFMQO4IE02q58;E1RL^(z${|78B2F1l!qI<&$3^H*pz{!sd+D2Ur
zZ}Ge66GYe0)91I5U)cwZG91X7WI8jKc^w5pRUYObks*`ol5%_xIbZYiNZ&*idSfi^
z<q3s+Ot}^56^gGQCDrJJ#B+<9^G}kDSYwk9BrM}NRjpvMK+Q~_znotN9c4Xqm8<E!
zXL(OOy&IL+>OU*r`rg33f%iu5jegLvSbpdY4QbolDZDfJX2oLa=7+7<nx7O~-<`NS
z@$SoaU;e@1V)6d#g^@E~Ij^@Y>I)VI9`Xxa5XKdi%x2#`zf`n4ShRbws3v4S7A&d>
zDCcb-+8@{#4*u1MFVA=Ib*oTRbM1&=KDMk$ew0=l)YM)(vTRJg*7PJfbsBn)$<vo-
zj!Y|;YxmBN25Vn>IPj?UbSULau=e!aC7;r_iBy4Zrof`b&bzs@JA--Kf~nht+SAh-
zA?3{ShWxjOZV%lVUQ9V~d-x{jv-!=lwz=9+`TlP!{lkw^4m?U}`MB|6#*dFoYd%Ry
z_nlo%PV-gH4B#M`Iej`|IW67Se6!R)v6xmoUB8@_13Wh*popyPbB7kQYJIBZj4a>f
zn@4<5zR&P=2h)pY(;uam&JHf8W-X=W1yi9e5IB0bd@etfx??G|Hkeww(EBj!BiQ3P
z6FhiU=;;;u9KoI;;i5CxGlr2mpkl^%>P2%q2UIO8%-BxRh)$2nM(Uuws!L=<r$@z;
z5uF~<Ue0B_zNDB}=-a+Y)&HeXm_4dr>J-^~q5hO!@>H)#O@n?ET6E-QSwQzVtpqJf
z#ZiNs`supm;u68SCs<rNf96qfQz-pnu(&CZ_t5-s=g)G5w%%ZKpD-{KY98{{`TAdP
z7K)pu8-?_XpQLB|bCy#xd?#<}kjLgNv(5KPA8oFk&tJ0E1+8@p6++voMeFHM`kA2h
zbf6BY2VXxbSWgGj&j^=z!Q~BJnnD|RWg|7LUe!oOf-XS^7Hyyx0*{Esh0d!kP)}S^
zc2hIYDSN~y-74YYuyF3Y&}9#u>qm5ofW(mq89l1$#wWQ&0o$zR?f}kO)Xj149}4Bx
z`Z7OTQxvd=)|Ad1oo@6MEf*9E#$s478(Pj>bL;%g^WVAPQ$ESY=)Kdnm~EZi{Ujsn
zR`bnfVZ%A0>q01_+o${_J>&M7Ipq&^@9XB3f2j`)$WdBx7$lT&+NTVsXZ%U$ob87L
z?+?t|{&MKvnx_UuR^d~l!eqX2bmnN_(0t9qlMmfLJ0o1^7JB-F7X}tDT@}1jXvZtc
zL)4Bb<zZ?sFZM;d>J)X!Y4ioYwF4^9dF?7Y1@_^E&TCT*(KmV_@FGA3$=d)b%LRpj
zvv>DADyW*vU&^lz=2y=bhw|$mx>4{_&k%#bVPWJ_@FFj`FNb<2mNyp6Wq!QoVN<BC
zb+M~Qu=R(!2A<S3E}Z&l$44CxFNc~=FP=TOSaTj<mTW^o8-Vzd;2ICvE-%?$4%%ME
zaP=zdRDo0PcHHfly}Veo6E!-dItrjv=N?o2-wL(qCDqeBMY{EuC5m;HP|D8RRX$sw
zGI08C^_(_Tume-Hil*_-Pw+K$*X>5%r9fSv|8DbKW~gxIx6S^>X|0gD>z4_N4f!E+
z{q1(Y@|_D9V#oW(9v9VpJI~)fogkR&Kf%|uL$^7<`F{DldA|C=y2qOje!J4oP3xdt
zj{`x|bx+c1o;Ket4W(C1H-2I%4rQFUtMgaRR?eROel-&9e2}|fdzkQ%BUF9-+b09M
z=_VoL#FI7aLqyWT39UKu@MLgJ%k<HwDpO`MX1`zaR877O#k1zwo%eFZUsVSd@)jCD
zDi(ho1u*q6@29D`{!0Jp+tp9CNc8C@9ET-H6@Tq*SU9<G`J)c;*NHPiN2hSEH`vj~
z0&q~tye4pIHut;U(Ati>-ay`b<%cy7YJ`Jl9`8B(Cv^dDaBas^9kP9zs4(ZxUYg7O
zQ*WrC>z;QuZ~oGUo(CS`$hpV+&wsaW)*CG7dYVKr^$K$)kfrA4z*B?x+p-y*(RpvL
z^m|Xea-nkJ%ttj+zzJoCQs_J<oVN!%`=vk!xQK##90NZAPyk?#E9+I_N9b#=M?f=B
z96)sAar#O>5Vuj)q?%REZn~F*uCIEKjY%^3Gr$>;<v`FjD7f6hxHssU3T=EDu_+PK
zB8R6Ys%tX(1D)A%yY^{{_<MKt{JQsF0h}BLTE*duH76+n{Xp^tV4WxHErF~z&&}37
zT3_~qj5*tU!uyWD+=vlR`e^tO(DdoEOHJLuCQQ=4P!lKE`-4pb!q7!w_)2hS^3l*M
z!qh96dqd)!r5Ex&3`j@AhM>HUUoVN398#i|u%D(pK{eQR0*d>J!XgIoY{12VmIqiE
zyCm>egJa&%8bS(G<6pAsf4Xt=7rAKMbkoyy3RBvRV>8G6xo@w(y*}WcZ4KpaT{KoM
zr)T*lZq_cP7X;G_U>PbulwLO7xSXDItNLcOA2_-2QTpy#&3lRW66dl)CA$Il>DfSe
zP`1rl;~xrUmCP2-<=wN+7Q)on(4(x9Wn<QjmYEiR)uPcdR|pGq33tnWky*u-KELMM
z)dBNt(RVk@H!heT9Gc6VyYv@1Xk6BgPuFamZt@krcJ%2kMOx06yA^4<G~u#Bw0D5>
zIQ<w7&H0u7O}CSLS1}FQ6c6k{dn=ehxvcYSG3!!&p+(xKhg6Cb^RJGn6zev;z329x
zxA))Pe}CJ1d+zOdZ~wjhp|yLK);0y#Ha(ma);3{2EDnzY550^d66kMEc~JEvBj-+5
zK>M!YuHk#8P;PlBqXMLlp%SNYVE1CsuU<@A7f`-a^=|du>e;rry!pDv1^X71Kh=Gt
zd#L%?w3M_CwAJ<P)8ntzOqcqG-pL8*g~Tn3n$jm4<Mp#krj0?<#z6aA;i75RW6kcb
zzBs2+q`jp4>I*EtXO&<5BIUqWU*sq<h7ppW$Uq1%I4xHH@LBrCN5<ZFIFKg^_Z+k5
z=3#DQ{@?@a{Mv<=gw{6L?-RD1THJIRB*V|ocKxGZ?ER-N)+kbUeHF$Z@=9w^eicqT
zMBdDkth{xd2r20L>I)6cjjz5)B)I?eCWU^zkhJcZ>m!hhKTgiNP@(y8kq++1#;glf
z2_Nq=U8qj{iB<#mr&XyJ_9s5n>d37$c54!Uw#L|<r2pBL^zLNM-;|ho6bXN`Qv+8}
zn0mAcLb8V3ob(=jf>5d<cV~J}N<vVtA-6=|laUzQZXkER25u-Nt0&hO+N2?OM^?`U
z<DyYR?#>N81xBFotvw~iC;K<|l&SwVIjMWE?r*c#cJJ2x?QSjnpO$HRcCIuyqD6~H
z>*~wz!hv2ET=9vg;}}o7F{<w*@u6WZB1y_+g?1M>ZjroY9V#gV8Y=QJfai0Ra%NiM
zo?_bRLP1|N&K$7;A)jEz87h&t(qm0rwZr81f#PRp*j8;Y*+!q~t%>`DL@5v6jug50
zlgzw8krHRhZtR=ccc*00Q1DKhU~OG2YNK<w%(&N`lGiVU426QGkY(r5i52Bmuq%i$
z$@)AIIseQ09H+{Z#G(QxUKO<u2c0;%W8;paJU((XoH&(wncp2f(imgJiFEo+(fE=t
zI&NRDHy6!cDo1)l#zOWY)wWI4(QIJ3SnJ$mWSp5}=Pb0(Wj4R10RjgZo5UK}FT{De
z5we`l%o$2{z)SVC0dzSn*goT<eK=z0oS0XZQIZ8%z;Se2Y?jD%1eChmf}?b}N`Z#~
zavalRCBR5OE<F&9@0ZY?y3~SG@564G8U()@as*Ph?v9vO74J`AEHWv`RZ6_>Zh4<x
zin}AaBkVV^l3Xu@5F#Ix48DUE2HXG4aC|9_$zSQFQ{!Zd5pZuU7kAAh*^JmB;~U`@
z?f>c8nqkGLyOBRhL5I+%j8Cx&<iVo(Gy1*@&WeKz$;4rbR+Jw^1{-N$IuP@k;#Yb_
zlHrDKMt8$FV|?R`xP=TDW_Ji1Dnp6eVD=7rqZ8kl_}0tcc-d!L)a5)eruxjU9hz49
zPTo3u^Q>r&?7n99<o9)<4O<s8D{)Tq+TrJwMrFiAjKWxj(eL9oJ)~a@E*=Aa2zAX-
z<xwfr%ec1^m_gG&5<4CmlX8Vvb_eo?)f-Ml6U!@de>dVcvl<o=yldhram!*bQB^LI
z7N-wl>Ly#QAYm4>RUuDCoK=Q32re;JBnUI-Ni8C)t&E0}vBAN!RPY<<=K=UUrtwjB
zkdt9WizjW5r6-CGiG$Pw_A6mBHkcw0jq$J6AvO4$jECDx-w7mE=o5>8_7cUzch@vL
zV3g?7UfT>_h0ZYT^6i@O26b!SX_?zTH}QV$f+o1VDO7k+Sby+SQ>rg}=KPY$5;R$U
zZpsHc!eE^4n5p$wJu++*DVFaZpG#XRs0kL-%x@1B>|am?3mO*Op@O4}?Vww^P`mxn
zOLkC1$pxRm5NDZR<GUhktP~QrJ=Sc09%Rx{JBC-^Q2kbrkwAdrt$Ly$a0AE3m|l|z
z3URH`^XuZ7m63oZo<e#=jIbqMI_RA2f>w}v3Sjn4(!W(h$3&_H*sCjyHNucAr;sGn
ze3lBw%%cYDfTh9CTKz=I-sDxGB&%3b)PyD(t$9;JCziP+_J-*y_J(m2_J);g_J$Q~
z_J-aK-sZPrw8E&yOgB*#%@>n~9d;3O$1kQYES7;^Y=Vg;;TO}H;8k22G|tk+a-(Yt
zzB4^mX);HqVY*nK74evMYy5aCdy2IImW#P8n&`+;i<L+v>bgRvEo;U?8y4Cy(N@Kj
zCd=-z{^rCU{Ff#1Dp^7epEWl!l}WC$f+WzO1_Zuea&Tg?owUG94H7#IXW(FVnVn&P
z#e;|scb!FiIN!i0$KV`!X-74a-oj}}cJ4u(+b2+9I6=HWgc&J;oi6T~2}>gmBu4Ik
z@#vhR>@uRT8aKFj3~+FX1`{oK60r8ctSXPa9E1kU<{{sJ=1B`oAHri77$y|(<Veiz
zs02(D^pG`g*CC_<nlWXIJDiXyKd>uk+5*m|A>GH%><d_z4Qu?pL4##B7bgyU^)q|?
zQ=b@2chdc>Z)U@KRhE!df<tq#3L;W<B#2<m^{8vNSBdtCiKXmO?c3o|)mHPLqC|Lh
zgf$TBy5Oq{Ylt0<_?6o{S`d|E&aiTlwUSA#_^p(sER>{fAj$<aCquOV3Hgcqa9TgZ
zI@lV6!55x2o+m0w>?19Il(La=FOHu$CtNJns`FU<VTwo&vC&;>V7MqEF5W!5>#ldH
zxF%R!vshdkGF$;yGLW~>{?m>hbu6}m57irL?Sm1OV5<Y{s-=<3!I8_M*2~vh{FRT5
z>xJT4I)ZiO3sr(P{g=s#oOK~X*G;!C@10$<Rj`RtwODZAqk|7Cf7~pbJhgQ4eDLJ?
zP~&-=+;UU0F1p6xw69_M7>!mS&A%47otxbj=)ks2H?NxY&R5Q#UZ|fxx^U@X7A)RA
zGze|&!l^Fdf=vLL?;Q~IgNqu+FHGiX<&#8{&kXizu7A5P#eXTnq23lqMqbLfLa+^4
zehYOA13x<QpiO8$Bb@CNYR`e4$@pzpHHL$>kx<v@qpop*9~UlP5zbEvlb*$^#P*Om
z#f<xLKy{qB4PG!7u%q-U&k&oTUBzB!MHcE+CEHG)gMD`Fg}Z=}5rqTW5b3&9{q$=<
zWE-AWU8G+ZRm1ceQH|2esT!wrBQVpB5=K;wY6N;z%qF{6)u6^Vj~F<tYNBr`2i0Ig
zCmmALqL=oWCh2;cFXOe2>7%~Of_}qe&Bm|3$W<68u~$u17%wPY*#M<LX_G?pk;z1E
zL2;8-^CN=>?h5=OZ#e`ch{Z2aED>+Xidm}SUXvkXC9<yykfcWngE|u+ReWAhicA4v
z@gjlPsz=I^S#f=?6i`U&7N(lOgpnY1*!*fmCj6g}L(~hyOE@k^(=GP6922t91#SFg
ze5s?a)rd~Qpd^TBHqUH^!RErZt+%bOch8<&)K@HOw*H{#1I>r}2l|g|9&&%<_?aWr
za26A6ad+S2ZQS!j3AK$8CI7^T5(%G^mVqlf+CvCu%ONnd8h&O&0)B0*N*~Ug#vxl^
z^)k}W^7(!Z%4836Nbssj$t-%9N($q2Z)sMC#-(a?QvNKTL@DohWJbIVB2L?hR_m!A
zvV!6ZY~s-nu6mFU<sj3~xY7hF=O8*7Kptsdke|$4h-UhN6y|75$p;%AvQ0jzPoVHw
z=Y^#Yk(LMfpeIs`H>~bi>budx7nB*l)p2?c_5g`mU=OY?QDRJS6-jLWV)n_iD&7Ss
zFQ^IOl~s>dhBMA|KUtdXD2J#g_HfXUfwe%TH-R&AX#+CcfUHWu20y(;TrX)pdQxdu
z&ot1=*yUj*Ot;6AW!*!2T=6C`x_>~tAdzi$V3Zq6vL`{j`U<}wn-3cyww7<w@+3A4
zJ4Z>)k8UHNYoU~U2TBX82IyoozS&{1rVKWfE?G??BdDG}C$_aVbhjQq-X1oJm&dur
z`}-YNV%SH2K+&|M5Wurtwy4uU%B;{{a==mu7!<ql3x<^b3@_GD$m00{wz)#tP$+cq
z-I%DPJOOh%gpi3hfk%=}lkpxHf$OF+{tz(_5;h|8fsSq(r%%sRUu*otkn%>l#P=l&
zpp|oH-mjS}7523YnWq-bry*Hnw$!%2p7M?6YYo#GPf~NHJ$|#l%D+i4<-Ic)=!7&Q
zV=iHi6AJcxoH*}+z_M!T==tDL2n72=M>*k$UD(_I#FTR5%*>exZ+6pc`mA>L<g9zP
zU$E>5nRb4l`cU^kx3v36aQBgir-k;jLR-hf{h{6GU{uG{rM%YkA5Cdk%_Hoxy)%17
z+oo@?yS)x_#Vl~!9~&y?^ZsHtt#j$07Hpa=e^jvh`rvdY^kOpn2|>fg4|+cwcrdWE
z??iCl3FIzxb_pF9n9z?Cy6wWr{?NVw98<-<u*6pd%cvTEyZ@k&Sg@!ml&qtxZs~67
zZlyrdtqG+TiH6cO3DcVCejFKh2iig1WC*&Qi<(_9fpP8V^T=CXHXAWqvCF1tElRw#
zjEsH`$Xow-C|cTCViF{@@K*^6aJtvw0oe_0yozU<va+E|o|N*45=(dF!obM&Ctnd<
zDH%w`E?v04jH$dtV)HY|ww*wRxC2<gaN&vDcgo)%Xb&93wI`>A9S3nRKV&$(WM~N*
zT0({sg6726G`R+O-NHQz*lXYrXV>d&6N;?GCoWr&cs8pZ@MvVp0G4OuuW{2;cdvR@
zSc_?h;<RXZyaT>chfisk&6w?Mg^;o9Q1Yrm@Dr;p-KwI&bv99(POvir{BD6FdYsiD
zYV->jPg{#TuJ6F1$v=j2zmf*p(~Eoe+>O{y^|_re=GM>K>7rIq4H@@4N`^(q0%rwO
zY{9yOIX022$gV^pO;}P)mTr3$e=|;FgLt7-xmD#c#^w|KMHxbGD`i!F;pCP1!EzgM
zE+hGQRQdZonfd!+NbX$C-Y&fIOU_-$@7iL`7tO>a#h}Crv{>XZwv+D)IX@(4o*YuB
z0y6w5`DfsSRsExk*$B(XxU5PIZYoc@LC+&X15FC>P03sxe-l7>hJgAH5f_%g^u}uq
zzep~hRy{E$-#9dLhzaq`{`!z{BhU>D-b~C)+<1BBWxs7P#S$oi@nYD2V@BCu8=Y4F
zBK`1m!;{oBW(%h^p!Saoh1J5Ent5CZb6~nIoRaE4Nq3+GPQKacEAaJwy9Bm!GMbf7
zlN2cxkdYcwBn!q7DioDcC}bq@-?JG5Dh=<|PgD@XH$^QJ#-q98(O@q~A+Pk&Qlq?4
zX{DAZ7T7+CFu`z5nJPj*z2NG_|6+BLae-7DMnB2cnqJV(IQZcODdP4FuCmfd>@%qz
zWKRM+383fe7(L7!eWN__JZ5pyRKx_OlS*5~guOQ=@L7_4Ni+XCa(R{^|Bi`;4azq$
zPBAm-B>kl61YWE>VHmNnf)^W3>4y<1=;lfYf&UH)p>3Y)4I~DYpwkoUT}auusI$D&
z`tF&#XWqSV_reeAe|YHqLq9zB{;>t~LW6MlY_PE-RMojybWY#~guyF8Zc^x){DlcT
zdTGHX`Bwhh#kY&e{t)ye@}Ttd*ibfS`_n75U>{a~7UlB4(R*v)=D@Ato5N5;xd=V6
ztOJX>I^jqU*3{>h7n!Z!i7Jy(k*}XDE^r9}rt+33-s&1__#Y@-_m&#yH?f5&5<W{2
zP0GnvX?u(@0cGOe@b9VriGKx}61Q!GbHxUz7a<@ZiJpsHcTIHqpdZGcL}QnKg8rvA
zMD7_|E-ZSt>2A|(*<#^t!LUxyj4l|VigEd89ZN4=2)=ZIZW`kTLN5&p#~gxVMA$cq
zC}KCo;uPBF(chOta9-R^U|wc|%8rkD<Q-FlX-Z6HT;wLQX5Ym6OnVbAm>G;b2^(Sr
zTl{Ni86&=*B}#^-S)YL(p*{k@GICeM@PlJ3;Z+~W38s|!w~^5Zb<;j11E?nHZ)DD7
zPEUoB);~(B52VvoNrJT|l(z>z=Uvz8mrbNhlW^1FI~Pa`Xaqx1fENr_L1TR$sAw<5
zdP@N7JC;lXc;VCPN1F2xlTs@7M8%Vk{lvHJBy&;GkIC5g$k+(@l<nQ+eAQ7ph4{45
z-Mkbtx(8>yA9GJqRP;*Bc-l`g3*+k8-Bgqn9hZ_Z#gv$goqwv-#(0+FhcczF(f12d
z#M>LHu=h)S4yWe*OLH2njL9J<T0_YfPm;%(WBO-}6f^pkXhUgTyq_ldaKv1u^M*(^
zw(0?82neQ!&9ykxE|)IF0OHCR&E{YyOdS1q<~_J9PTofoX9HXegP1?)QE~LMxg3mt
zu2+jA?`uT<$AD~@M5(~t0(nx3XzjoqD2Rq)-yXp%WP-(~bdAM8=US=0fafA9&5(Qu
zPzphP)=4n|{g4O8j7wTHmgF0<O1|iuTQB7>l^8XI5tC1x@s(2~fd-G)-y5VDJS;(S
z8;BL*P2x5ZH6HCt99^`a|MI+=0j)Rbe!kQnFKk6TNXLPGDgBf_ruOlAp)A^Z$rm*%
z!}q#r&1cWhR>>EAbA@i~Tf`@tDxQH338JIsA%=EJDWh*`cJiBI^M!GV2z20ZERHh|
zRYy}uKA4h_;hv73LiiX-gTt@IQ@Y>37haGeZohkVQmImHplGy5u49Q5ic#Gwg%U4H
zO2xRN#wk<Oj09(u(!`yeuo)=MT`7mSv9@3*8tIL=-%Ddmq9n)QmjhBAqwjxCuW)5t
zxiqp|#r>^PUC;|M^!#)4bvH<Li>{8+1+Op!@j|%q#)yZXgPU#Gd4TYpN_j!;;>@8J
zq=*kaDN=o<F{hnJ6h|<83o}OCc5ljn%;|*aw+*7-l~@_ZD7YOl44)>cm!fZJM!Jmd
zLsBTWQz}`h7_~f?=Puy+-CQ+SBS9T#ggr6-+PAa=znxCdaC?z{A1<`sPkfBGRKF$e
z0j`d#=Ngc&D12`OPrHdb$Q|Mi56D*OhrXsoWa7$oB&PP1WAmyUkHFN!(G@K@_LiD^
ziED{z&+!=liMO;c4pz)K=PK?b6aZR1=r*p6+yVK<sjshBOi#CaQ>hQ4{q1g+MnNi-
zJLOHqs;c(tye6;e{^{>W<QkYaD@Pj&0o)nxEY=Pk*Kxm7f+D&We)WNKn0A<!Zj@Ph
z<D^e{eNy`JyXG(7{Bo`(oFH-p84u8t)E422Tg2^)A8q3a5qdOG9JAnJD~B5_?gkj#
zw!>f`KLz9+PQZ;WxE;%*Wtu_aZbw%R!^1fCCmyJFgFod8CpR3cJJs0KedKt3cVlxa
zjsYf+(PGCHi2lKsro&mD6eqU6EFW<%<w;!?P{z)Dh7)P0MA`C-R6A8!JroI8H7Yzu
zTb!2YcDlwAIbTS;d(!0-k2yMUTUXyjm!*XC@aS-(rFYyh3<KlxHDGkc%^FS|jl}e1
z!mvFvv0KsW7_E?k`9GpANNZ_6i=&4}+q!W>ZfkpY!%K}}Ez8iOEh_`(9h;g$RP>pi
zBnys#Q73Qr7%!YJ-!J78R@yv9eV)9l*Ykf&{b7~9Tg21iIB*FSRXJA7-k<kVMH0Ka
zNk^}{JFM^Su5YbtX*djja(DOPrn+P8hr3U;9_#M*=%^Nh<GteO(1z31&U=ua9fG&2
zJ?2P+3TZ>?;@_ape@=B$mDP!w76#lM;l$zVVcZ?ysf>}WK$bG%aM#E(7K?3|xRaA~
z7c{%#nJFLAl@t`ugM3DvWujULplifq#Guz$L<q2WzDdVO2_`5x)7I4MTg4OPkvQlT
z$aP%weQew{xJQi5IqlHI#05aTlNN{DWgqS@x6tJXQk&?OgkqN-nX@`MuUN=51G_At
zV$eBaudt2cwxZF=3Yf61@cbBHIX3K^ECY9@+y(CG#Gs>ZP=p#}f_$0CNi^iZYQs3K
z7<(~WNM^`vE-MS|26G;8=LQUxTMkJFU{O<j->{?1?S!TXYlJu#NdH6b%yPZH!C59=
zYGmii>Y<|Az~-9eAl=(!*->6;sU-j#8=gEsP2inljy{ra?Zb&jbPon_JgnRz3JX+Y
zJii~K`YfT09q;wvjlDHTzlnY9(PN8UIyyemi<>p3Y4{V%&u#50M<~XR8S<wjy*8KK
zqbn<OJKV!|kNLR~V{xEn>PdJBimEP)XN$$z-!IQKoG6YAaY;{{zAx&rmRssLPV7Af
z0_Y<!UT8q%@$?k3p0-(}Ia4N|ERMkk%re0E1STUoGPdU}(Vp)iXp7VJJxKEO?RUNt
zGhz&zoQn)VgOjs&$=7Cy7?3)?LiCpP;k(tNKGAA{6^00=#bpNb=+<zG6d(y*?oy~e
zh9!500um*tBE>2?vHlFb4(@)R{U8`hP%2bdi$vT_az2sUMB*D!s<<29aYrm}hazoc
z+@N)lqaQI0!)p|mHV<K4<ZORf4-F%V1tg8L&m)AZdl7*#&>5c)C+P>r-Hu`0Moe>p
z{{#BUw1XM@@rU$to}4H*{{j8%A%`}@jD^GQJ>^O6$rIy?C)t#E*4Yi8)hy~WF`f|P
zWU~HIP2hH|iO3QrvWmEVT!jk>E8$y6XCWjZk7kfqMgI*l#<AvpQKy;u-9_7SNJ>{e
zlH3%>q@`iugNS{JQv4Zqix7e(8mGl84pX3+oQOl0ufelyO1^Pw=9F*uYu%4b)$b%j
zAewb=GGwW~c96u0RyweGv)Q-D-z%#(<4oJ^;kiZ}tx^k#wTqg)5HU_`Az(Y{*WrrX
zD|1<bZug?5`bm;`DJeIYlpEL~9$}j`%vB0`I~Mx~m-<J7{Ub~Lu3*1w(S3QzeKqL5
z`fEDf6*=S;ImFsPibGA}p{^6EbEIiBt~^f%IR}(ost>k(xa+~L4{IOPK2$!e7Eaq1
z_w?dZ<RoLCYJ~KS=!Km7#6z$2LYBO$UX7TI>SJnrYgC^h?IU`jfJSu(z4}z06h(hd
zeXU-)9J=+J$CgX1?`iL8XGa!GYHy|pjZoe?Eu85Jp1QDfsy}$DAIDsUVQ1*nn9zPn
zsOPU8igu1Z&_qJkxrqf8jyU%}JS#Mw7IbG8HD{lyEZXDBC&{_~{MVe*>L;dk{?<Tx
z$W%0~3a6NH?SYWmwP?KXBrWGwDNYl6LTQ^HrFGozrGwT><p+Z02ZXw_q4Ew0bkefk
z;BR?uB1%48G?qp}Am7W2DVr7=9wrAH&&;ZY(gVSgI>?NCYTp?QYw_$hA*Fn-;jwY|
z6Lb2l?3>xQ*4<o(52Yb<#dLkFAgLFZEWFeEuH&v_F6HBlh29_M{B-?C>wmm)v9*1v
z^>ncH^x~#7PcqR8f8QHjkZqga%f6Q_RMst8>u+@}n{fpCNqXk3T{m~#+IMr`JNaY>
z{oT^LrL+9pwov}g#q?btqziio7poml(%1WK=z;X2nM8=Fd!LxhLRvw{RJdd+4Vp@4
zJH;cFAydPW>1fb&^x-j~vnOP-EtwoalS3HtV2q~#OBl!GdKDyOxG2dmV|b(f)}fn+
zZXLUM3~bbnIYTI;cESBP@ffnlRiVW<i&^*bf$G_dAMAZ-4(&M_N;~$jZ_(5$oTgKg
zOYE{8!Pd9f!7Z6uf05CM)4@?e+nwIG2W}6%J$!q3cH68ww4v&8%8noK^E(y_AF3WU
z32n%tOQ^Z<cvm+B2boRE&r;039sa_ADsXsqL`bU*rR-fwX$Yn?ET%N!sDNN@d~9s`
z3<IV0xd9M4fS&aWnukUi<b?KaG_*%KK<aXXY6rcB)MEt9gX&B4Ye3D@i&sx3;B`pp
zp;zkF1VFaQn}BY?(Yh*sn*TIY0LYm?IX^M)nBOZHnims~K<~kqfuc_b&WdPZzGUGL
z!1hd^V81AgObDr0LZ-<j(<?#KD^gE?0(dp2``Z0gsPFE%lXI8f?^sC0{dR3QtBQ1^
z0>47}@G#BM11fe@`xWulq9d5-sO2S0^ySR;fh_SPXW*)^4Qi5+bIwB7Afh;w?6{|e
zor#=My+X+vFnyt4IHl^KZfH|YQed~*M!zh*)ERblua^DLLO~<5Pm2ScX`J@gDurD;
zL?7sd=Ge8vh@dc~d<Mkn@@?}KPIoRQ<`5b^36laHetm$S-}P{(aG^&S9TTp4A16-X
zLN3;!X8)1d#5wDHt6(_rQ2X=5mS1mCWEI@(diHChBDqZ&G`0TYuQuTDNc_mp*fl>t
z+10q|REpxS*Qd4bQ2%vBqaHv0r|Ps*D)rwO>gb1%#ljYMXxsPe7Hbj_^jM`mWz;>^
zF@H+dsUr0X%}1;QqHG`l4@pw4sW|1RK34Ni+9$@!1L8?$Vc=gjMDBv038s|sWTT`K
zBJC98epg5Ds%AS~HMx+#=vo-*<4HYte)K$_U(n^ny+q#guEMY~Kde0OQJts1d>D?}
zj07?Ac3SKqxcY=bY59#+xeh1M*`rJ2I6K5Y#^Ok_7}qgGf*d9}W!f>Ly3-agzj+!<
zq<EK%kXbUDw`eGxI|-u<hGd`lRxUJhs{&aebIFo<YtX!PE`81(GS>zTwezl^p<d9`
zi&7a4a+My)V#J=mj8LXYqKWPGc%nRsZz7EdctqPG#=EsJCJrE#GLODvB<pmakd`BJ
zmuZmU$nu$(xU#}NxIg7E$q19>#4EmDMOqsow~x~@KE$_S+A>}aGH;0gMwE{ZbLp}q
zDOy^b)<F8j_>gE#ln;PAjN}8664ao6+0lar@s8F(+h68wQfr_enE+Fi&{1S><@H^V
z9x)U7aw`vLa0wmyG@tZgNTwi~u5`=1Yv>ZHBIZF=5p$s`E;$!X;`Dcrf_!prg{;q*
zNp$|wKcg>B{jPn%uf<)&3GpOVQV(Oqlf?G(T4*3fMisDN#uqJ8M?=zBNP0|21`B~X
zdl43pDvR~YNiJIoyMBh+8W$dNBv=)tt1wdjHIRV5$E^7On0ptnxXv?8kh(z?MNt&@
zo1j1-KnM`J3kgXGkdVYh+;5T)Z~%c2NT&)UN`<7Py&G_}E!1(3OC7n55<hDctDoR*
z?-P`EKgLOVf@iXuQ>v1Yt2Mis-po#CXLiPkGuyGJpU%GDe{KaT$##<2-6QdzOa14+
zo&WOv-{t+}9uU<3qVQ!>&;wJcg&~uLhZ-);&1MB~!xF#?Om`Bb5IaJ78x94P8T3X7
zX;vt&&2n8vvgEwfGq>S^B5eV8%`gOi#o(U3u;;^w$#5%Ng5igxQK>oUT4e@FsgzNL
zlyxvsN@B45;nM~N(;C6qM{?DY$XAdEU?!sjaIOg5dXix?kVxG$-i5(Uma9SHLcoF(
zkb>YHfe)eJ;lZ?Wcnr?&q&VOgfaSt={{;RhgKp8AV4{#uIIb9ARFaQOu#4=-pP{0O
zz-J$z5P>KeH?oH|Ge5y2{@)^SnV7pc@)ie=JmDvgk`pmH6L1urTbrw!0+G0{Xl@2f
zRux@WRkTzbu4t|f=y&eezKsFpf#b!)^<EzgPaO_$Nr2~u8>WEzGs-5GVdw##PdxA1
zzI$(hCSYQ&&nQdfhUKegziR^)_PdgGG`sDQ@7bE9yvPa~Ap>p^?4fEd`k8j4#FZo&
zqH7zhv*ktygNN}98J`4<vdLiw%y8FWY7%cqg&+%P${Dg4{5U^GVhr(%|Ic*w5(UH%
z35n%JYXtL>^Evoiv=oYJH%1Y^ifvo_>FvL!;64RUD4<m}U>Jq-O^1W{#PU8=+<^kM
zkor{*8iN17kmeisbG!}dh@`LfG$wIw;?=9SuYP0t!<byrfg3p|-49d9NEngNci?W$
z1hb~BH*@dhE=2mXw=Z@)vBl2lW-49|Cr@pg07GIl&BTA@@?6eWuY0z=zU$7e`C@-s
zDUcaFaj&P`N%>~lhw-_yRd9NENpcSNSl+h?TY-i0c+*j#t_L=i-a1Y==MXMmd35f|
zlaw@1y*H&0yP}Fe3IEs-mayp)pd!?208C_!nX7#H%F~>prNotOE5jd@3+Dh<bH#gZ
z3gqN*tpw1~Mx^X<n9Sgm+CgMzCk$ukrdz9|iUa|;g7PPQ)%Ah`lQ+AeMcen1-cI_f
z6z`@o;b0@Ee(%AyCn-gg*6naARK3@lz0f{ixuCgsM7eKM?uGc>UhD4V?4`J+#)pY4
z!Xv!UNfEwv<YNn}2t~fwxK|TyC(K><+43IQiWau5#_aIM?D#MSDB|Q^ZyDSCrHb!|
z3o*OkM2`@+ZWqj@y}cj)toJ|KP_o=4q}K>Fuqm3xPTDOZn9zyc0jq}|o}e9jEw=G^
zSSvOVo!DJBMX43{_HK~;?7czpJ!VsMQ6%BrnnBS($we)DRm1FtqTO_3nbyK9px(5o
z`=04-(>rFrW&hje`+DpfN?|~yn=5^#({t$?r{?M(MQ>a*Ke8~4uxhAeF<*hLK69Ff
z^P02gD+P0&pwIjC6R35SGoPG4KA2jw)40Y}HAzHhRr};0(6zr7_BHL-3||ZXS_G)+
z&>Ba<nliAA;IuCrW}(DIYg?$*F_>C@Ih+fZ<6@0~G8akahIB7SaH%s|uw24t!e$}{
z4P4|)rfFEgLDB>x)!EQ$WQybnDKaYNfmN1Y0tqrq1U$!@TnBncPia9*z$Vf-;u$4~
zeNFqE)D>M1W#vcftUu%wm6a+UD`tpzT(s&u;z7b&5}gbAV}qVb%1l)G?AeHr6mXK9
zI%*X<hC-#_YovstV`kO0G)3Brq}B7J(aKaAMQ-JPK<z{m$o~^RxLRqxra67>EU&U?
z*Kuf-Nx#_M1f0qV2m+L40IcPH-~kQ|6uW9R+Q%TOx<aWF%bs8;?by0tsRjV0!`@Qc
z%y`In`N}Zv@oMR|-Njq+ue2=ZYQ@Qu42*HQ*d=4|I?DQkHx4v~$KmgjWK7b3YIrql
zHZtTV0l)w{fHv41|2Z*rvk_|rj?amwpEV*y14|dak?@W}_~6rpE=9yF413ms0=Tt&
z*>hr>RF$?+TUb?TZA21y26tH1id^ncYik9vG~qe<MzT_xgWJlj=XX9Qw&IK(id1C6
z1!(4J!*k+VK#;S+OWy+5Y{P+a1u0|Q%)%fsiNl$<JtrNTT&L%@bgUW!s=#seE-j36
zNMF&ljaGanDlCf>7k}udJK?6c%wAjqS(Efol>-21*-R0cxCz4pGdxj4qtt<&EH*F7
zn#$}GW1}D|ih#0BP_67YBB_Y?k5n=!72M14;Bx*%y_MOsUE8vyyot8M0~!VRCqJ!k
zfGoGVzO76WO*%nxxh#|>iS-~#Ll&Fqmf?iTi5J<kLyo92-bdp;ie8X#u*+PrbZ560
zp(UheB_g5(0b27vqlzD-2oMB;PIB~&kIC7H6slByD$y9QSWrO7Bqd;CCXO56Ty2!V
z==cz(g(3NEj)#MCzRXSnup(+LDWUO;lm<kTR|z+zhyb<GE<3kg$Yww)EGiys&$drP
z6}y58*@QxhwxXqUbr?Z`S+v|D0gEVxks2&uU`@pn{JTgPTG0U*&T0=(QQ@<l{|Wu1
zp@318JgywHgrW{OZqUIfN4^NZxH2X35$Th>F~}fZY=j@t>tP6f19pwkbjvtv1Y?ey
zYx9)OrTdK;(la6M=!$mP2~1GGu}+S+&*Sh6KrI_4K*DC|9uEp<h6LL=zj0W3Yx`n@
zu)RvCx+>V*ej}{tW9KSft+`#}nSRjn-LCsx?;74SKQu2N_3f$k71aq_>V*vr{`iw0
z!R$Wk)%@G}!iEzo4FZhEPMs0bdi=3xVWRdV%5tk_wr1{(KPu<%5>n<gp3>L%+}R^+
z+9UF?m&|~{Yh1qi{uvS`<g`9cYny8!8@KkC%cOUOgbsgHr(8<g_+ucw$J598X9TVY
zlJDZn1T3tF$S6A^p0t+#C0a}TK+H;i3a@;oXYpgHmDeKk9Dx!ud*N5gTR+1Ky##oI
z@lS~4VwaQ0GJCS8sCV=tHUzBGy=W{e<E%TIrBy_Idw@r0%q}7^HO2%PK+^rxfJ1zY
zetQ9OL!Lb?9qL>66noLp;ePhx*!aLCu!GUzvrn_4$iq?^3`JrEXiHjFLLqzpdyS-R
z>qpWyj3ie=P{ypDEK70!rmJrep|thl&aDs4D-Jwn^k5W+3EOymLf?Rf1v7sL8cA#r
z(UNu6e%5Y3bm)+{_ljOSc=&(BtMB2@k&ED;NYC7SD{(e)E{f@y7tN<bu{_c|b7Zz)
zH8RZ`nFdetalXi0fZ4!Yu6Hhcc6g>+NWLJL#-5m(g;oGfYD|5a8x{Ykk1|}+{4$J%
zsbPjFaIyE!_r5uBZ(yOpw`o86bLac}AL~y-wm9Ry*)ya0$Y_<2c6;Z;?+kmo7xY3}
z(URsp!$X5`pvkwV`O%(Ep}li;_ZjbQ3{8ME40(Ib`F0NrmnMbjYgjR^X)0+?KqpZA
zRU-6agSL_O1lKf8Km!dkH4_?Q^oE~B7-@GUjTgj@Z8u>5Vd^j_L#V)S+$_`ojbGpI
z$?=*q1bxP{+VsSWWYm5w+VJ_d2XI*n@`(=c&7~{Q_rV-s@#nBm^rmWmOd9gC1|wi@
zUYrt5qw5ZpXmQj95kCq?RgL~RX<OBp@|Bu4?NJ_t%jJZYm`#o&!sdv2`W%3AB%@HP
zTN|vY?I!Dr7*|UJl$!>)Z98|C?j=MqJ0X>k!J9q*=&-Y9q7O?S6gHrOLhxhqk5H^Q
ziPa9ogZ*6Z=pd=20H6%IUbt`$6f*;jfEGGKW=Z{pu*&#$l(2>GK<J8u7EKWzLf3++
zgF%4@B6+DCP&E;y4*a+A!Ci@>+EGz2n^qi>0>>f58Z0o0N(Cp7rYN1K0nFD@&`1GO
z4EPFC5sjgBOkqs~Os~T4>&!#M!uF6U;6LG=zr&y7j}Q%f6YNuoJ)-lpz#}cJd?iC-
zJiBX}FJH{@nRlyCVXfrJ@tZT(N<15GH_TW0;tLiH%lgO0YLffaLhz`cABH@dU)mv5
z!lw9)(AgtYoE7>8;onv;U+^2po?{A398@+c-ZA~|HYOrk*;}Y69q8@KXko;yWS0lx
zRtH;IMf$*ONMx8ly*hH(Rsxs^z<AJzE?#kMe9a`MPgV+?iT1M+DnUAA8X-myr)Yjc
zquRoXM(+d@>2f+2@XE_RH<beL1w!Sc=mR^FRoMo(^HS<4J<tQh664wy>{dt}Z-^l}
z5(P{Y+pB9NXejzRIDiTfI`;&*UBvx5mk4_c+6J-%oPG^PyOajwQ-?#d9XxC4_s}h;
z?7Wet8M8u?5?|qg$hpGpZRj+Vy}6@A#Zq`q+%J%y+bGY=Qaw{3(@7>N*K^WLl}m{D
zS<JE})VB+cMb=MgYE4Bat8yxE%^SL&!4@P|q_9CvK`k@4fxam$E3hRL5Be@{gZyQt
z&0NMvmi(J~<}!!KZ;PGYhSVV{$PFwx{mr81kSmy&Te~RYa46-qaM^fM9$y=A&78)f
z2j-A-D=rsLm;+^8Z*p4@=D8yg=D%i{j#gzDTmiS)nIo47zZb5#%OL9=xXYq&3&yCl
z&ap9CB=uvZ^tY^%%ml4WPK!g1rXrPNge^2?5;!Hc-qzg=hZXt;CO@%Gvzp>pNQ<Fq
zzfmq7%391yQsT^$pN-_pSL)eq6<bbjE4J-cN`7+-bmN0-YzV%?92TS6`9Ri1HQ)N0
zmMe9~s9ZSpn=u@hs27a$C~h0IlhPAxL8I5kdWrO%<<!|Ij-8GRDn%?Sg;wqnDAD%U
z^lM9Wvl_K3l-s}^&ED97a_<Z-cTfy7i?QqZF;r*0+-|ug**kmi&fYbt(t64c)zPjh
z<w9x8f}TsgT}~0d?h9s$sP-RnkCtOj$2)h*`M`<u{@~FtvRnQ|J-;PghO!Nke}fau
z;NDdp+!NM~gad1SJGkcV(3-n7{fS%qUd5W2hd-wuD|0_uX>B@{U*gTGHF;LQmZFYg
z=RUc;L~9Cll^)V_#~vJ)V@@Y>CxTmF{w6PK_dzXJ>rO;ir>2U#dbKoz+CgHYVYXm>
zJ_!z~)$%lOC%Hzr!fulL!BDt6`9ZT>BJh|oTR4@T$F(?Vv0%ptalh6bBNgi&;MN^4
z*8}a_D(AD7Nf&HQB+j;68#wN8<WB1on*l?w8((0}d(i%tL@kkB29p45r=uk3Mcp*!
zLCAtT>P0Sg2FNd0<Vl6~%unHg$mff&GjLzK=x;_-po(?*C-hbYF|C>6G5AWL#<{+;
z037DQpJpZs*v=EL4#>g-k{a~bz-7BE#3jA{0_f=cD>NAYuPOKir3nXSc5+~5cjYrz
zPsFFd)&Q7_V9G(}OePV%V1R=YE;*00yXwI;gf1^>%-hE=L*X7!8NI{>fXk-==US*?
zwohQF$_n~$G4afx8$SSXE2;eRh13FDC@7{N4?#e`ee2e(JZ+{$F#wr5@b@TSsE4HJ
zETXQFq?fT}L`=jf+`0^8;85;LiEOGq*-$Q<j*B}BrfltsBI|`n(fXm>6&WeB?aN&;
zk%wE4)mHUD9^Q7Wvbwq4Wr>t5BTiPd)QCc1LP{KWx)Q;1a}w-x5oa&DVBfZT=T3Xk
zxSc;pg)qttNyZm)#jTCIb@%Sw_RmamoDxKrxk~!2yHIuJmG8fxnl3Zc%t?!#v5@fN
zj;*ew5|P;pb#akxNAChWz-5uPU~~^P{%Gk{$s!@3--;r-l2jE0`aDv;TkNjg#FrHr
zRIDcv>k-(|QYQ97;-aed4S1K;9vo7A@x_TgSHjvV?%ukUTEi7#7xndBaV5pr3GRc)
zWCCUp(!&kxVM*@<3@LbUOF7z+Irc#wLtV?2_uQW^jB|E0l$?(JIT7Kr>7u>p(h)GT
zL&mVX-Sz=wW_Lx}4;+wFO9&a)WtMib(D)wXKVu(9+Qx3-9lb~RAK+0Ss;ateTTgRy
zP0xwy&Oi*iJ5k@zUf)v#E_pNaycIC9$E3_48d-#kJ8#}g-T5K)?h5Ke(w3TS)?pB#
zwvsIT+Gl48ZB};fGy*Za0wzVe1wL~as3vjruz|w_Yc#fitOMzzh))>MwYRs6HULbA
z;U)Tk_MM{hvcIG&QZNve`kCnfA%HOCCs8|}*k2+(Ss5Y+%vIGVYa2RySS3s8b!gK8
zMU(<s^hM46N_vSl;6bYYpVF^;C^$hu6@q|~>_?cQi4(U4DM7ma{S=8+@k5Fkj&2A>
zc!1cnq!tkf7xCK}5|G#me~$bD5mLVvfzhIwfJH_{cfhQI^>wCK@eyTkl+xDrPXd~i
z64mtZbCik>JwISz2-qUeUN_l0>YxS1{=7qE9$E;5R{2PL3O>=#k)T5l49a!319wM6
zb$(yQc2DfnXxmIHv;rhE0l}Op;*f2gYlL5`&bbpF=Nrf7_W`n0zc9Jj4h7@Mhn)m}
zDj1LX^~axpS0`(7@UKtanVcW<XYPE*A?&;6-+f*BRfx^=M&vDOzZd>?_~JGH)*~yI
zeme2NgwV?Q8wN-p_X<$pa_&UTO$qiIf^hpFX~hJ-UlaUd;1u0U>IbGi;3Opj{B8f8
z%!Mpr%YN_X@}*15=?|~_q8gw+AlX5b`79ZaEcx@BVE>S4pHF}i!8TuF@mCsd9Gz)<
z8ksQH_v+y7K~I-2G5=BGz6Z5SwznF5k^33b^wzG~U2|KA`I5GIVcU0i-QTsi*;iQp
zsPN>E(pP$am?<>1`qJ7SrCk)dE<%34-)l^M0%*Cm*|xbFpJl@%OWnNf&4hai^H;u|
ziJN!o!AWg<f3I&x-HjtM^VZ@sWjr$Neq-}O<D$-&y<@S_o4p$r3eoAFMktaW@kJNj
zIQk?ZnegR36P}@^ilx!-H~8{vA2uvrqVM)r%2I<jzt)>k>r1G+Q4fDEXp>!cQaom1
zWBF3=a`?mHrS27r&~}PoX-}UMhRH9JcbJE!3>wo3PbfGY(YDa3T68GYDr3Pig$-;s
z>9-;6Fr8vYv^S2EDM`2xoBtqf!Lr!$ZsF1f_{PyMPXZ0bxiToUoFW4U{TX5yPtBe}
zn{WA!)t}yW-#QQdlOHF%pRhb7G_`zK(YjReXN^KdtEX|n`Y654Z)qc#T=1}kMEIFm
zNL-kDH{rdshiRf49Qaxi_M8;r8y_2+h%?--`MD)|rp{x#yU$Z3MCRY9e5yCk90ij4
zq^Cnj*t8J7sPpT0C~WJemK0Bxr}j?CLa9(x?k$8Hm*t%IBYc(`SQNyPjfQRhFbWGl
zL%!H;vk|aV=zR)Sx1Lb@V85W5-*nI9xw?=eB$g~DF2y}ImP3Ildc&`c#56xnFog4F
zA$iNf;9|dDU#1jB*sw!L*ts~l<nZgMh&QX|GJR25^W1#f!T|yJ@JE&_{rZ}xdgIN?
zx$v)_m?;;MOWx7J<<scf4Zf{aLP@ny?G{Yae*LwdN5asDMxrk=6ZMUZhAMm8tlJlv
zz8ab3jm+{zZd{El@J1H+A`7WK*muf%V4j~|ta>+X$+F!3lkSx|p>x!K;fgRy`c5uj
z17kdOh~K;&phS2`Fu-^?D4N#{z+V_1^3dGDLzf8WJEc8B+V@9v7s#$=OgBY$7j!N<
zxpZB6JnYt=)q~gHtsm6?Qas_eA^nIRO#W{Dc|GpB^rLhd)jQ|~r~W$KIrN7NI2|&a
zAx3|X0owd@V%q$4!f)pdW2DsIV;HBqGlq+Fx@d6G3s((C$SlHTILeG9!cWo3cAAVN
z3}?d0QpN&=#MAE_6RZc82mDdBm@blX-*7HeetU|X82a*d3yFJ#eRV4nLRqWO(eH<u
zL;JYEPa}mxaN~sJc(`#w{)u(kSrht6Ke1q|=JGw&^E(!jMUS?ExqP|#L*p@YRYd!_
z-Z--lwmg?_UtUeh^Csmj=zK|Agv27DsDt@;>h*T^Auqwi`Sk<n3p2KvU9%~3C+4}u
zUCTUNP6?d@-nK#El4JGKW$&fSD8v+`CnyBD%lj3b*oUkUhjOd7jee_vUKV62h7LIV
zDG4ip=OJjpZD`jxNQUs^*r;Y}<jOXCbG(t3Ipx42Au@!I;361wh_E45Q3EzaI%q{m
zOp{RRJMtD90s?(KTSZ-IjAqI^a}wmr(I$BFkTo&O^Xx9G-Hn}q6C`iBy=ZV-5#*QR
zYF}B~+T2pzMDl*oFpor-qSQ1NWemi@$t%Fx`5yQlk+nzpbd=1BKSwsA5NsrTM+zxB
z-sxVfTh0`c8hz%bRda{e+~G5K3HmNkTqM;7Z(xzZpALVYbRl?gJ2(|BoKP^&5CfsS
zbfC@jfCLD8ps@WIG!<(bAbK$XH2c7nfqr|@Ft$zhi;hd!0kqm36Bm1lNa^Y2pe$rB
zItQJB{@zihK!go~E7e}qVK1sc(@okN>U-dAwxJ2e;0-6sOBt~TvkKOdQ74b~R5sMN
zR2-`Zb*K<dFoxG5C$=eEV_#uJgR(67EVN84wdP?|LuyS==7aQwXkphGe-F3XGve*R
z;&Q>)GbWrFNB_Ji8UQ7;5z~wgiSZM~Ajl2v+GmAxO0WAD$l&?HIk_dl(%lVKD}5h!
zgc8qj@HrtvPKOfJ$^BDiyp7NoUw3edVFkXFp`QP@)blW=!uSNV1|xB0+`I45)8A0=
z_Y^Qn^A3?+^zkJyT+(kQO0x$>v;0P+K&d$B+d!lX)!Ci1JLgiM!}!SDepe)+E-W^S
zzQ5ipd065rJK@W$UCnIrW;O}UZNAKQLErvtTau`Q_1v%G>T6lSefP@%hpiXtfc+tY
zYv|5{nZ_rny&k{FY-WfX6u|FwAm5_V2AJ47iHVKUP3xfO$e7Taj?7bF@Db%EMR_ZH
zdFb)09wHTGbiout&B=u8NTP-@s?5P6mFE~VC}JP<9WVl(6H8I8l!Oe?A$x`5LqpWf
zdO1rqdYQ=@)Nr<!jHLf1_b?S$h|E)N98rZ)D!3IFd%g;-x?Qbps930L92Y+lLZr(j
zyu@_Q<UHk(f;SRpv*3OwDOe{D>YFjtb`TZWaAJo#PpyIBP9^|uX2c=4b}F>hBvC?e
znyOGqE&~KjNpk93I!kARs!2CO1z2||ZyEt^mB9>_GJ?{`WNFydG=c>-0Ky`u@E~}U
zv0+u517Qf&V`K2U7!9-yU3WMNgL2GKjgekdUX+!_M6~+#SZ=w&r3sxI#*x}ao7CLa
z)GSZ_n&`LMP;g8D3Cjo6Oo1Evnh@96<tpK>kd<W1YY|-0-5}jUm8~t0DToO%8_|Kh
zbHyvt_~we~L*ZP)&eFG+XU%Do%4iM|cPqW4#Eo=EhMI{1x+JZT7<CD#W9V4hf?|>S
z^>zr&cCgy*bSgrg5r~A=A0tKUpMcy{-za|e*HFM^a_%GBpN+4AAfd%~zh;<@Qkmfd
ze-zZRaq`;$5;7z9zBONKzdH(jI7oYzD|e!2iN^?WF4i4xMaWHkf7-$w2sJyXY;)%>
zIe}2A1wo9N+!ndi%31nK+`%<vK15~aHoRtVA!&#XiAl*0cQglBrU#Ys_eZ}{1T<)s
zDppse*S%<bLC6OofOv4#&I<Y3t<J<pTxRTDj>3OaP4E~G8TZ(E^mI5gP*;}Y^4CQf
z)h~1+=xK1tYn_MX5{zKhUVn@bM`zsuxHPHt=sR&059;JrfjIG)9NBq7z8WFzlXVAx
zred7O<%c8n@|Aj))5I!k>(`!x$lx?;Gi`I*MjF*v@)f6O2LFlnW&#r-E84`<vF=!i
zUN8?#$GPLU1}I2qZW@E;s*~<GeDy{^tSaW3Yv!yb`aO95yO{@ZOmHhUJDcQ^Af=Yi
z>F3IrK-^Z=<JvH%1-E0oJN`v|h)+@b(2HZrUkWo(6ofeKBscn;`BLpO9qQX$C&Y)(
zuW{FxsBt&;4G9lU$=^2=Ridn&iS9%`nL8b79^lS^N=Q^G6S=G~#_X9+`U92qEXtas
zmK8!fWkv{|U!Y0(g=aSIEXK67I<d5+>**9{tK5gUKGZEaRLgMvay_4|`E+Vf3LH{M
z`O+z*QH$P6m#A8d<>_>HTBvo-t*DB)Q(yc$Q4^qr^W498N`pjAp8z$zVLDyy|3S26
zqTDtZR|C#=r8Ni97O5kh^1XVN``NQ?i4=x{MfL6tm_bq@yv1&0I(<50I@8%Lr{hjX
z>~ro6gv0Jkgd@SL-pzE(6{nTB64ej>1MO|t;a18WROa(vzRXm{Tj{s#l46QcDXo3l
z?oLPBMKYBW`*iw)QPq4&5yt8iKX^9fDqRuK;w=bhFGvDf@{Y%UfYQU#Ko*VyILuW^
zjxGDnLK=3F?0#f;v6HY50>6Zi#YU&>`Hq1BdsB5qRb4f6s37wMN}LnCW4wSbrNlQP
zaAg6cO?g+cIKV3t5XJTlko>}q{J}<mgkS_d9PIpNdTXO7Vr3p$pC?)kM5^9h`7Fwi
zh$#L)P(TB+ACHuS*4FL#`=kxQpK4Bks-%7WX*>D?sWdSsrn6eM>x&HnP>_C+d!-aZ
zb8~}R^Di{7Y9Q9n)`R=?7rM)u`&uR#sfWe#XUGH$qo3m>x?|8^2K<<$m?@bh{5$;U
zN+ID0*Qc5z?1%E`z?F;qfeci^u?2B{^ABW`AVk;S**MoIxoYDcWo>(hBad$n_x{!R
zO1y7Z-OWpPHh#+NX8$OoK=Z8#l!AJ<YvVJm&vaTz&@DH4{%2YUKZ9F~_Uo**HsL~P
zD{v&#wvuXZmTS-Fp}?X7x>l`tFawAGoEqDy#za?%6>b~zj$D94d!Zft#-7LRXL0+f
zLyzCTYPD%xaRtmgZH#aXFZ2R|5na=jFLoQXUp%kxxJ*@0(<d&L-9?Uonc&}X4(h-h
zz|R=}j^x1@0o+>KY0)9<6iVUR3LHJ^vHj@G&iu^<VnpOkO8G2l$o`>Uj9cQel;;IB
z_`lU<6S3mxxfm_m6_ZU022fIlZ3-J@awJZT<uWNRK-4^N1s-P|u078y1CoYJo3sy5
z0tZ?LW=O0M5aYqDA<wl>K_WcY3+p}>eIFDRn8hG7(3il}7=Rss^H_891Eb@;oa-z{
z55#1FGe{}g`+FfR<^~|qW>9!*f8A$?>cklE|DZ$wsqNY~VOl8H8y=fkYOVyz0hU^F
z>f###qa4u{FJHk3U%BM>(T52yBRl>QSIj|&V-(`^fpUJ}(ge`Yz<FdWv;U1Ii=R<I
z`X)ho8B7`B-{4umtT2VE4)fP3)u<BEg(%@BE&!L4|3^IfEIPL{_d+h$l3SBom)qRs
zG8EIVB6E4evq}O%3Al)vNs;ZYWc%cBF99$X^CFTXX>O2TEm2u!Sj8$R&(2YAvh8vT
zMMuD)CD=%@3$e?KP-KTv!w|Z_TK;USJv-;B2!l`t3m37sO=pv42Tz0jvkl;TqcEh=
zaF~Ww9km~9X6#h^LoTB|uOE6c2kb|Fakd4MoR+5@91p^r^xvT<Z!hZ4#Yi-;$_?Rh
z*o~KpD_pwb(m|KbUUzu-A27MNj<TPz+&Cs2fMgsVpKxGRVZOylB?3OW*oc%DA1V+*
zGO#{)@~EoU;Yvd*kYNx&9x;s3lb8mNID%bu5)+&BiGb;dRvjj$bkKKzxek5LGG6V1
zWu?2RY2`$VM(y%9C#?rp=9yDm;XXS8_E+7}QeEGCtf3yJdHJWB3kv|?5OHzz;t*Ka
zE_o=xgmD0}dUX8ZK?cJqj$RlRnzH3_<BC*c@ih4p$33VRt;!f#_eH^RFMi?oFG6lk
z_<t(`Y$bdj?T7Db`?dp{O7Wqc=yCR<G5fZyd=GuWyf)^LmXx93B2}E(01WFGp8%?&
zeUj!09uSBHt{c+4gZY4_6=muJx}(Ek@3)UYr;3VCKRN&}J76E9aX(f(KFpQ(7fY{+
zzld|xSn-(S;+iRneQXw&6t~Lr_&hs+IM4}zaZ&0*|Ci(uaxZ?iT_Pk&grs8vbuRh_
zGzYC&?TFjYRy$(7D61XugR%NEw|}4zKoe?TGf1l*_`y>;TJsC^E~C^Gd9K(zS~G$d
zgKTEXSs%PC1~kquvnbZmqL_tpiHl-t(+9hjdp#ZVz4OgN{yxayw=ebi(<(mLB`u9{
z2^v?7Tq0T=QKqf1MU_P|NAm1>uA}NSvVKlsZMsIH^MV;;O)DxCR$p){=7}^zD9dk|
za>vdh9{g{jIo2Iq7+|N+0CY$#53kx&T1IW@*nGu^oO+O6pCS&kDaAF>T>;JLmucq)
zYUho3Pi*IyqxVbZ8<!g2Yk%1OH=Tgy0(hY(&eQv9=KYdSKLJ@D_SJ+EjVGx@!;J6#
zzibG87mCjBreF_M0)JtWyTi|;xLBo$W5g;AF<G0YPU{`NCXAfNO{KPqFf%H($H_j9
zPXC2YwOT+HuC|@_wlUwr{oHEX0N(kOFGJ2QlSE3aBPfY%V?&Hoqm&^A!2zt=Fsq7(
z%JP>!whbRUj6OC$i5T}a{C|fN|Gy*nGPP`^R!P81;-}56etT@u_D26g)|-QGkA3<H
zqbL)SG#Di07Mi9hLR4^>U?45dd#DtqK6+?(ow4U%=1I>JBb~HHCkE&Rd7TpVMXTzY
z?Sw}Q?LLW~!v0F8rm#XntV~Lxv>4E8HPm~NC|HP$9R+JT(jTJH_;S?#OE+2b+9un7
z>Vq>Yns=L*ZSS>xaOP9~0Dgw^E)(R3BH_r;k*M_;X3~XWEaV^^3QAP1J5j^#CHj7c
z5d`$u<v96De0x!oj>M0mQXYxQnS@t`y#>ZP!TR!-=yjTB_(2N(hJwGO;5-GR6kMQS
zjDm3lz!rA$gU(?n#*tW46*BW%>2{d{rhmse)(N_;q9BUO@R+W?hag}imtgqlJpYiM
zeV>9%igJ|7UroWkr)S9&I1xbK@B}^m3wqE`K?iQ3LpS7LTW%)Y4rni477hA{qXz`|
zAs}WsfFR8GV@t>uWD(gI8SkJNda|;IXTR}&=F~5sqbB?grGB4&HnFv*2QzpeT>31U
zONc(?<gwcYv=Xj*`U3_^zn|ZM@&|N%y&V5t`ccy-%8>K%m?<gPKktxigTuugEZ>e7
z3F*Vp9Knp}*MI`AQS1xS%)6_D_wmF#Q=an+>5IKf`nQJ`J2CSdJWPr$8!AakpHiiL
zl9=R)_>&P|<gVKzbGG@4`N4a~7UO+6J6|rH8@W*_MDF^?9Q}$;NZh@oS=#i_w0L!S
z%gQC8vFii(%9wEKI?_t0ptNj<;oDx6Ys2|^#v^mheCeAz@9kVj@on7xXye{Rel`1$
zH~Y|XoG-h2x!0Rr1C>LQ#YcN@1j5M{pQ#nL%@L*>E>huee0|Sc@5}q|#=W7Nul%;r
z;}QyLS6Y7B`9Y_b?OuItW4^jEp;pvDknD?VsBV>_?#>CVgYGh%RJzm&?GsDPoNcxZ
zN?;~JQO+QMV1i0MJhwwgs)RrG;rDBo4+xErx3@x%&f9!iXgVVpd;I#dPfh7i;Jb17
z*WqE&i9&MCO6-b$r9w!o_gNZNEv;TltIyI7ZNCW1T-;ZupBiI?xSaW>`6?lQk6_#D
zH<rCyB~$`)xSib0R&+kz-$m%8Q$TRldyWd09KSL5i8bz)>t)y7b3$IP&_CeI7+lR5
z^=6FvGJw50@hD>gc*2BcDkL@vF-`ucW-^2>d%5gsRJ@RIS(v)&k8-1)*JVrVZmRWl
z0%O&Of9=>;j(M^dQkM@u$=bQtx7e~|dw1_r;d0x`;guaiLywSo_Ln-1wNLZwFpZ&K
z^K*Ul%%!=+*(p!9U%%n!=0rHOO}~A8K_hG~^MWpFg0^87ys+Z?J)>%;UEcA&(Pue^
z#<0ZQ>YDBHL;(=_k)>fF@w=(_Qy1%e1&49BJWLS?ayZ`82>pkvcdovE{m%6V{CBV3
zzxv(l_pkdh53Xj`cr$B+W1YUtE+L~^=sqi$dqp)>z*><TbNYVybGzp9h16~D>|HE`
znyPbYP%u{e^#Inoh6XsKt)^v`w7Ia%N=jX|+9uMOI;4f=IkgefiHvU5qDYaJTlus3
zuWWyXp`E>Pe8IWc=F8ddi!1j<9uO+e`g=!&v*(5L4#9ava7+nPE}`P8H}Wd!;Dz6C
z%vI0td92^UG>|;0^HuY^grv<rbK$DF)N3yFnYUB%jWau60o3j{QasylZ}2#Tn2qz>
z1yi11pZ_!>a%RULP0j6i6p?f{PS`N$PZ>fT1!JyXzv*eDWoA%F9tgtWp7ah*3YV|?
z2HnEIw2(*$y+=Vppx)*>EvXI00QUL(z4OAh7NM=v-+g+uyT{wz<KJ}FXY2KDIy(<w
zFv3svWc}%8VbfW!t=AXX2k)eom>CTLx<z@->7H|}J8y@Y;`YU1!FFgl+i$G?k#l8)
z)Y&?^h1ye(kDdnbTC@$L1LJnkV|@@ce@)nV+JB~h^~|vM43M2ieP=ERr^ishaUg)>
zbVl1pr_-W3V!w8R?vf@cyr!)rRYP-?4(hq^2RZeXsh6(4QYC}L`Qvk+*b;6WzA^cg
z<FB~pv*wT7D_CgqCsA(@jHQ14wvV-8wr1^(V^1;Q6FmnX>|ZDr_H_BX&#rb4db@%3
zJ?!fq5xVdhc_D?gW8Kh>MUK%&sINrVQddEUE)rdjPVrIOsTs?vG1ZIzv_<fxHu;TB
zLZ1_0v-C~m`nLN!POo<Kd!gLN4f;BUg!Xg7xd|b0Qn+@V>Qli!Nz~0Qk6y4}@Q*oG
z$ELhvq?>tF#JnEYu&H@W9Kw~_lhhiS3@ahJiLSeVw?-+QqLiXyyfH@?Hh#C@e!*hZ
zgA!lNQD4;28`b{CRurFTO<|m09lzoozamUc`^T@LI`kB$CY)9hKH5>{i|l^;$ik(i
zf%k?V4zFnbdUR#rr^6o%3mu*RdenEI3rKtux27-+*uL)ew7%YXr*r<&H%~n>Z(ck?
z3qyC1CacHv#zt>$_2R(yM&BNNXUvydjY(d}I<gELiWa}V_3z>mp=b+Sx|!a)`gx7V
zF<-Dyv9Nt%cuBKJUtnJ+)i0xqsNfXf?rm2!Bdgx1TnPX6iFf0?`%kU3{`Axbr+#wA
zxBrxH?<udF+Vwmd4_DqxSA<Kv;G7^_!1JSm`}(iM-~Ml?MIMG)Brx^OyFdL^y(TQS
zPxI-o($S1eOOoDq<Y0||-)!mHqJKX{kMO4llDkTcAMVQU+NEF3%taVTuypN<T|+|B
zPDO{mPyPYH@1}aCilsxV6G~QQ+6RhAOlFot01K9}csL{FD^9QC@M2S~_{qg}_-h6(
z;(<{XE8=}cwTKI{w+~hll5&rfw~4S!GZ#d;{u0n<VBbzL0$bsm!uAB{M-B)cKu-?X
z6*^s^>CX>bblOJ&*d%($k?HzKqJ`klVRV3{*9ZS7m%%jc8=z=ph%#}pU<>_3mR?|j
z@uDFa>@u*0ATKq@b_}dy;y#=kALSe@L8AR}BQZmZ8Liv`hFTq3imw7G<<j+oE5{7!
zj@vhFlAKf{F=h(|tyJmBdh00cHDI~HAebaeCT8s>6>Yc!N%Mb-Ok8<XLg_JBttcIp
z366;H>>M7*4fh$qH`%iyuCE^O6s&|q@bSlp$~{g2qp!{MERupms)Q2(Dx{FY!MnCV
zG!c$cx<v1G;k8!$Ifn7pjWDRPn=C<YCG?Ru_pF*Xc+DGtwA6NQ?_!nTyqD>=N8B{e
zIqq)v<bsy8&F{LG0@e4z2_az;!?gl?Sd3RgwHBjQFm3begNAMGV|~`M`igPLo(&lf
z!ryJkK%T@j5aogJVh9SvW}uCb{OKjBElFBPcTt~$!VustB!7^!^lRBu1`v(d2E^A5
zkyeEr@uABXN{Y)NhCDbR{}fX;$dJ`YSw|_86sunc9Y;}XhFr3zse_kOU<)xM%_tH(
z<XS>26`zd`G7EKwSB1@KPRB|{vJr6iX%T;AT3bd|BME*2M%UERIN+>O9qN(L2V{`i
zm=esmj-q#PZDIOk(Rd=E(*ekW%-wBj{MQt{7HDL}hH@yc>eD#mS=I<fsJE^=f<PjS
zT%4*+7%Hw@BKdoxO!2CQfZRIruUvvNRn81C6U91wZVs$P<TUVJ((m|Q^6&Uw%4=2^
ziVY1rby8QsB}`oEgEYCOp>zUeZl7EO4SES_`Fvh~lFW?tiWD1t6jJQ;ATwiTcq-yq
zZKbJb3dM9qV%n9^vQz<&E23?DbOQY9&$RY@J{gf=4Ow?s65TO@3(o-cn6a{kCNdI=
zxFRs8+lwmg5PuZ)4-yI=zZE}%F_b6&l438qLcd_1?mtI1n?+6b-a`Iz2VoS_<UL_8
zf)s-<q(n<8peeW@CWuACCQim8QD#q($3at)$R^oJSEUqeqhOf=#t>m#j8Ab}5UI|$
zBI_ZHGW&>P_MpN6stb7d4rtj=_VdJgVB7@<Ezs(oU$osb(;O|gVh_@xKL<_YU)FN(
z$>zd^W8c~0i{5>I%X}j+y9#bcd3qmN?F(DH(Yu9a>^yrPHTQv7+ILv%ZSGs?6-F<t
zj$ZPPUK04L!t`~}NEbi`2}9?=^d5Y8Z28jn4`70)XG;f!=01>8coTG`^|1EFQ2^|L
z98dShZ+f6#Xk3`Q-??P+=O11^@-#MOHXM-8jZdwqo>I@LI|mmkgyI9<EeEmbw^q;S
z$>?iH@rkX)V$*SN-+a-6YiZ+B0<73H%Z2Yp3kMrkoU~DH?i64v)6c<eiMM}L=(`|9
zjron^PoizN&dr{C#c_A%>-+BPdl0#}V`=w~cK&$Z`}>G7aq5F>zREMg;U1x9NZ5PM
zmp|-F8u3M+e-cylV0fW>$+VoaoVYyYZ){s_JmqaXC7cFy*?{--ps#UAI4SxkVRU$<
z_9zjhhqa8UPy^61G+>hmfZU`#P0c|kL^-4Fq0?D7AjiWqFr*_YTYHWkHj4Ii!?35p
z-GqpW?9?(iWS6+psnQ+OVdGJyYY_bzHIQx9NnInInsgoX@TBP7s7lvG4=Z)ubn4cf
zqLcNsj&|>-bu&6}6>c`o={y~N%O=t1j?Ys3p|Rv+b68yJucN{YCdu6B*kgUhr@yj=
zS@(R3qT<^!bjOF$M>YEQZMjFojcW*9>b-2$4xo?!p;m3^Nb8aAx&vCl`<Ui47+vcR
zz_lTNIuI-Wxv>;G4oSl}w9|v&SfpVL3j}rUT}wE#IXyxpvavoGUkhHfl{Hw6<BS$d
z%GOr0Uy!XPB2@x=1nc<v1Fm?bIzpq;K)}!sEN@Begw;Mlj*nF_nhQ%+Ab?N<xQLk4
zK+`ozjsth*Qd*!aXqjh+To$bCIyerOXau4zfEO!Hn16%Un2mEle}Q~1MpTI&@E~J8
zWCtr>;^N!$L8tToOpzHKZCwi#U_UY(gI0jZXeTmeQtaWgAOH5ZuE?5!-cjc{a?|LN
zUa@n-<Z%)jN&u1rg%8(&6oWKQK*vuwFHS(cp%0AxK)7g94M}j6cm-pB5V{2xb*>NS
zi1KA~J)7LkG)FTMnk@pQR2nwJ({~ej=T2O~y5|Jd<uB-IKLrEy;(c5>Xc=Jhw>Wi2
zGQKQp6n+qq#_;EOj5sfvxt~Nv6LaZN<XO=gS=dnQODw_d;<oSYdVAMWzHfUa?v^k8
zc;fwum5v`?#|`{riRPVoGK4$e9(A6H`MP%s7dI^R3dTczJ+UEfp1<4gX$3cgF>qnI
zJ^t>%d*>gXU)kt8P%o4>2x%vUj?==>d4J?6rD&SjI5RLaI8*4?Cq9XY^KAD<WW1pR
zkg4C^rtZCK7Pfz=FA>Rj)J{35IoO2o2p3<|V@gnd8bMR6KSG%dsy=U~!&IEOP>{|+
zM2yni<&OQbent-?9PLZSX%H0X+B!}z6H4qJ#JGGvt((>Yc3SJ!t-**38puHD(vkm-
z0%N@^2X0ugvm6{Af>%Y!Rb~maZ@2+SreK`U07$5pC<iqPjlEC)C4xWIkOmy~1n76u
znps^a8LcXk!yZN&hoIwwAob*;^ETLmNMl*a4;Mj=h^j%>yT=WNng(u|K>Ly8ogJYX
zHB@S_pkr2Fa^s>QboBuPpa>=g_(Moawtp+YwJ4rpQk}m=$qMuV1Jg&~e?UJf6cN)Y
z!^n~J@@P=HQZU5N_f3p3kPcNl4|J1@#?eW{fl}Vz*%INyA;$Kq;kIF}_Z!BU3ehV>
ziyzJqG|Zdd&|A^-6#;9E$Mz@rFwu@p!oD^p_Lghbb?e&fHP68O;XA`VYrbI2XI&V&
zBVxt@E3l_e9B!@esW^Fz0c=FeMG_G-0*P{j=IY9(>J~YktAQz8veFZr2GjQYA|1t^
zuXG~fSD;rx_iA*spddm;rx5*FHc|66Q_w;|Is!EN09~^g?Fp^|TE}@tZz}VWBrl4R
zt3hSsFQPRsQ;YWE9keKcOGeB_h^$N@t-@zKOfDs(Zkc9HujI^K`bM75n0lk)*II+2
z;FnQh;GUX<v@O1<qWcbEd!<l)+E;Ss27jaCqbSSm>{lE@+NeM20%0Ea&Fs8U`|M^v
z2HCP%Vh6(CjcicSB|~k$<)sW~)^S6sb1Mrfr)NfHiEMFa@yTdGP6JD)Y3(mVnla5#
z7;Ves0U@6;T$PQwy!B$JRoLV+BugcA7~Ltv0imphQq)%wT0vNt))=(dkU2XDn^pC3
zMP=ed1VDUVI<Wj(LZ!_`Lrq%ytok<0{({rClE-x}MkOyoZp4+AL|ohF#8u4C5I2??
zZpF!82~VJsqL_{*yk_ANxugfl3Yi0+OfNL<u);(!f{{9;(8>-KVGg8DaLrObr<~fg
z$d4#nI%|s!EX)9zr?jw&_P8d8Ocs+26{VOjD!bf+P|8fD>{466s8RbMdksOhv7QHk
zFB%_<y4T%w`yUawtR--bUc%f=lt2{|8kv;?ymNSP7%GI&8G|w!Uw{(1wu4OTzc9dj
zNuLzwKVr@nZ7qdvuEQ|_R^)n?ZGos|d4`bwvGbO6`iiAwN~AM^9s$k^I&OoG=32Xg
zkTu|xV?qgzkicph>Z;3`UZ9<HA02k+%MOp0W9xnZ<lkh;7-mAo3Rtu0pyhNs{yrh=
zC`GFU^C2mYsd_D;=nZvYr4cUayJSG$g{hJkXk9vJWY&Xus*r-X{yDPYe~ciQkt!<r
zq!GCX6$z)hSShOHUq>4U>5$pV-p*TSoU6QRc-?%*JYVt6Xdx-jADjPno}@#Todfmi
zwd$+D)7ol>E;$$(>zYemg`{Pw9Qv&CqqPfDx$EfjzEV*U`^w;3i?HqXQSc`Q#`^gw
zu;Yu0xG`woj5!GXpVnl%D_+s2IZ)!faFKoOB3BN4(ho_Rjc)iQP?Q^Y+Jj<QDb_yH
zpLW_y_t~e93>&eJ<NK%|Mp5^KN@{;Ud_}nStgET0HY#@<rHi5PB0g9VH9u3NrBMbY
zOQ`&y+rZ(<u;@Ag&<G{Ulj4g5&_^Y>XpvFx+FwFSySSHr5ml}6S?zg_DF8}b=y#4{
z??L+4qUV;ppuXv{jRWHzW6XYK=hnT@b44rdT%Xz4IJsaia!m9wOA81IIB@s}NDq{^
z=bajZYM?!jV4rv=?Oo{H!;RDS$|3Wq4$|&}v|gYS!;fEJYxsYnUP%kNsJ~M}x3rZB
zL{?PR!7oM~Jh`deSk&qvnjuI=U<}&Uu-Sx22!0%C!pk=+1{`i{IfuB@A)yxA=^zj{
zJ4U(p^HX@|CHy&h5v<$lJdKWhWyh=Kx62_W*n2M>cuu=MNcm~z2bn_WDc`ZvLT}%r
zV|~K#1z~JlxH#z@yDR{iW{9MphqVeg{4eRQo|q`-;3JkftKRi6WyvgTtMZmsBW?@O
zCGcx@J8@XzJ1Devf+YovsIS+5rTRw24gQJEu1G4ZTW$bvCqjr!_3U_k@14E#?Y^`k
zA+=a2#?GnFukR-f0w@z)^gE`#G1JJPLd@P)Ps|=egZ7Cj>Q?e>vX{oS&sOF$l|gMp
zl*AV<)GU+<J3IWHXI48oZzuRvgTBrop+n>$F{PNp;30vva~Qz)tZsG01geK*7X?2I
zjuOj}$#$FI`4)FwB2TANcbe`_i|&AVorCV2K;1zqyzVO9T>_p0PHtT<Vd?bg`{~31
zbq7)UMAV&L8Fj}^za>pmSZz2?7&<M64#LnecN&6(>~q%^n!QO|-`Tj>|4zQxG_l8j
zvh%0=KG-L;6TrW>z1Mf5PdMH$^iK$r*MtdD|2YJAX*hL@qWmryS?Da4&elt!d_$j(
zWW{kaZ9-E1Lh?eSu<e|XFzhppteP%*O&5J8-miD4+s-2kNgwJ<pCu?2KGYA;|NehN
zP<{!r5j-zNREu#Y9geslA~76JQB~r|sFD@1+XR^xB*{^PwxJ|3T%??eLYCO%{M0ju
z$~gHB@tG`0CQ)Aa9-IV(a%QTMvM+oaaOooomrBkboi~QF$?wT$aOD)v6$nYSWr&=V
zWmoZB!i!4-vMzBA$4(_2b&&O_sV2i&TZ&48t@$pgLGjXpuG53AH-sh_<rrLsTrb9N
z%X~h0CsJTZA_eBKuc!5**DgP<7)A#cO%hHJV_Wcxw2nmeVCO3O66@&^5n*F`7%C|+
zmg+0&0L#?FC@+dxSJBaPxS^`Erzc>9`<9-*ac(N0+qL6@D@t@`#!|PtqRD<nb*{wI
z&WDkjj1>sFl&A($=w$%2MKIi<9WP)*ckS5W+AvriTo+RIE$W>FIY>5AC9b>sNO8B@
zUNm6O8ML1U%qPkH$I3xWh$;foPsM$`=ZkXkv8azZ2kp6Aw{!NKu>yL5gHAwsPJaGa
zVQE1D-Hwsf6wo_+DaD+@&~NSo1}?IekytO-sjwnt6I2tCBSh(dR2zlai-S^J^Kn>(
z05OT$a3!u?6j5xvBIi20kW%_BH1PqR3w_7}tH{$-=mLI%nwm(0fMsl)QKUW0o=4<v
z(za0aZn2rJ7_Go~1~kS+$V?}$V5oJ1C=JHv#2gLXSNcFQr$$=!O|<H>V(_%&{|Wva
z1TFcyEc@#ha`@r&W}WxNjryW50QRu<<ZA7iN3~~OswA|*f`zPwBlimy(iZE57y#x~
z3Ea8gJT+T|m~5YU<EpvPYc5<kE-It?%!gOa$Gzs`D+m1DK^|zjhkfReRWt83)Bee+
zIYJ9m4U_<}7S~|)#S%#;JZ#i5BBDmyNlS867sZI`qX-D`d%p;c=YaSIzc{p4=qEbi
zw<(BkaH`fF*Wq1<_5_`xYIUNH;udI4Cf=T!J3pVXs9D_fwrSz&Qub2Idz}wEmoNLk
zk==h%IN2x|oBaCbrvNmpnrl#)w*x}#j>SR0zFb;_OXL)g-M)6pv;zVmoVs*pi6rRI
z_0nCtu8&TAx<*>*oAk|eYSDKQNzkP4rn^S{DLS3fHxU(JYbGMV&|*;6-lLE8>Cdjb
z#O`3Mod1L_@Vl+Nm;=}8ZGfjqo4j?$8YvG+X5dH!(izg&kaROnqf<j8BP^846t5i$
z8;b%Hh8P+VPNHVnfsLSUNE__3oSbs1E^j#N5S)*HO9QP3yh#!tIB^EL6C@<)`E-mZ
zj2!WvLYetPZlqyP6PF6s#w1Cn^pH+Pa0!#py?|Q|qYH8nNN*G^3^@<zClHEHlH14w
zKpZQ43i1wFFNc;(#qVh-R}jPc=6|n;1`F8PHn~ikf;#|OfyO;M<hBo;HXp%lkZVcn
z(zB~n9a7;L>Msd;S{PHpWrEe;fMa}ga=>LM+p%MN8RikN1F*RUcapdpE|a>w|DW()
zK)Zb_eDGX$Mde;4ZUKCraRbx*Yxqe-J!bYsfT+`K3uv|zRNaoPr4(!z@y$tFAfO#T
zAJ8AcuE%8q()ln{zc^+@i}j{}*{HiLF#i}HoU#vMRT<#;G0Hhyd<OYFt4b@?ho(jt
z1~8LYo|xsLwZf-##dHMNK8nqlrl1+KpML*yB+B2U*_b#6fe5J~c%mx;`l0c0&OwSC
z@<vLUQ<>OEED28&>Rp;t$yM08Np-D8zvTZ*gpkdh-v}LflLY~xuHHNaP2J@5*Uf)s
zzMZ{L2>iIXrRpE$EvE>(Pe5OOCgLfa|L*eaoX=S>L+yLVa{Tf&A=W8$^ibG;9(n-6
z`7vSqk}$>#y$(FYtS}8dR7?vol{DqW9HSWzA?CK26WSR)6xE?J-w5>HGQpbr$a-)g
zelbHRIEY^Wj>*kNLc!h`HKze$Db&^HIEI(1xu0_{XYq)Tg^fh_YJ1<K_CD|a2J*+e
z@4R3ceQdk{5p{GbxXw}0Hyv{a{nm}jlr-;r^Xj**&NV#NS1cJ3JUcr@p{d#I^fP?M
z-)(mKZ@_5&68nN-LdOG}_Vf{&CpcXwXDM*H8)61hQ46{7V0kd+M_nj}u-l+&tcBV)
zs3>(nU#Ni;Ntr`N;?c_M4wWSxieVh87EUtbVF&cyq?wg7J_vRuqZ?7Eb2+X$(?b7E
zdm3plcDn)dxuPY79S_a<keG+c7sy2zXLKNr#hD>q(_JtY$?sPmmcPzvm(w1}mao+F
zNUnM<Uj@BEQ{1{Elv5kIE+d8OBIA}*TvVZ^R$#Qy$iM-Fz9R7oOoIsM21u>Hlh!EX
z2vLjc4%JZ$XT#phz{L$IY<;-|SfANHIW??0+vQ|NcF0%iIk*gR8uA(1Z@cA~Zj(A9
z<+S-&w<(kZ7l;#-{xha=o8Z1l)RV*)2i>4|8<^ln%O#AFHe;BIkOrqrQm-(Bb>hO_
zJQa?cfJs*_mqR^s3JMJ$qoN$S^|XEmV_(53SESp7v3wZ0o89J+B~~0}xtUN3lH26x
z#7vP($fZsaPSBP$UnR|La7RL9Vdhe3o6Kz(ir_LHWXdguF<gZ)Tq@TB-_g$A$WliD
zm(6V)GRnDtZlSVcmHhm&!?_e{|C)&FqPdy&xi!e8?|?dNT~i{l4halZ(SS7JnCdkx
zXq`=5I+q)wMh&RZLAge({nw6XMNGxCAoY687&p`KPKEN0EO3bk8hQWi$7-dVzk25K
z9^}g{|DZq~sYHWq3@b%TT?YNz39b*T$zNR2b%wzze)IFW2EX{{-~RTu{5bk_3-3bc
zGRhJk-h*64flxT@-z)5V2_^vkI6dy7;5=>v+EEApeY{8%O+Nqu91Qd$pxNx&RA#?C
zJj(U=@|=hRQ(@l>%i6ICSo}}Xrky;-fZUowS^>Rt>LLI^0)~p(V-?K-LnZMV0-B0|
zz5+);%U^JX7Zp*Y&kRLH0KkywKQ9&Jn<$72kDbm@uphQ=b;a~Z;2lLG?Nl7lwRE(&
ztm_{0=jiQW1Yoe6Nv1J4I!rJpvV)2c`)F~Ke3)K5gldZ}T~E+0^8;B$S0sPpNzp}Q
z!81znJl&2`aDjp`3dSj@rbca{tFsjBp+FVsGsOv_J4NH%|4dh^I_gE-7DNS+nxMsC
zS?U4{!y(d{db;MX(3cAD>+L^3agk{Tz>~~Czk}aHHCVtq4E0-~JrzcN1a0ZjF8u$9
z1n%R{@s9}B(Vkz3kN-Iv`l#p|)qiJ+2We`Jy>(?4ejZ+rxDzq2`(_l3BAbQe0-tsB
zjDDed7496i>|bhG-sanKWOYlOcT3$$@8c~e3H3kW=dfEm@s$&=XkU%E9r0?^?Wnt*
z3kF|I@lyO_{edU(DX*Tmed5)+StDTC`$(_!+?;c6&~w=1e0}Q9)I#hxr#<5fZSNdi
z+$%(t`;7;l+TsXj;MMfo>34@05*BwXZd%g3oBdwl!$QJa{z>*v3qL6QX~_pbUhY~g
z>-Uzyip%LMn-KO+3X@lbt!|%fdM5m-#WuIev(azKfT~sFo9*}7A2cndELAP%tQdu@
zjlQBLe{S=tCF3cqIbk_<H{LV&&2*o26I5Tf>{@ib+v4AHc*e=v#5BLdZ_QtU0uzb`
zO_$U(kMqw8Zf{?(35EL}^e^VTHN4QZly(1%P_Tcdip)c=&tCU9KpDT$0<GIhp`=yV
z+~&`17tZzzou`?T>L+pWukO6P)06m(^7#s1T<${FcXRLOE{4BVB<$;Yw7KhPe4+>W
zF2uvGu>)>25+6>j<OxYlLRZg+@n>PgmzWA8K8tnE#I_9jh5mPTFCATO6|5(KpT9l}
zVbiX~ON;$NPMI&RZ0XW_6Aver+x~i5IN9nu*s5f;QYEys|Em*1X$2|XdP{0x2Pj;;
zBDhF)a9DecI4Q};DJ0!mXd)+cXqA%K<|^j4&kf#f_Z$;!n?8)n`&B|%Z2ZTTu!QVi
zXRGS0)o<``UcGnq&FlBBzr%m;>f2Ypcm3__zPzKWd5zw@MxmP%@)~`410U)K|8YZD
zbf(vm@fjN<|1u@BZlmFU-e{;RGOZCl)8>usC<Kg<FSDaicG~h9qr0nRZXKDm332GK
zx_%9-YmmklQ#+AuG9rLN$?P~lSD1pau2oYp<Pk}$J<eu!)=HdviPA$3praVxwuMmz
z(Ts91n}QVWI4cMAZSlQf1qTGw8`Yd0Wd9-l4hqkfN^~<^4{|I;T*n2M?dD!RK=f5L
zJ}w2ROQm{F>WVW?&?vK5ot1qCYL(7Py@n^TF-+C1&A}{>T~fTtomY1)q4qp7mj<l>
zo{U@vpqy?BDskfHwg+rN*0x75)i;);@?b)h3vHMjtgYJ#s(D&}O@H%4@qAfxIZRyN
z*VQx^d?TCkP12s9Hc?G7EkRU+m@e!<_N>pLAfsM1=pavNP|ux0@}jFSvhZ+4OMn}I
z=x_pvj9~@_A+u#L=peY12h*7B?wAKR=KuLJ;ZmsfAYzi+kz|1}5YgOP2}fwn0VDH_
zcC7v=d9NbZPIMV{to~TbF%Sz~bQjTHfje9nn`^79PqIgqO%=^G)m4G$`s(VcW|C?&
zHMCXKx=Jog02d3kfB8AXTv@Xd0)e5df~%rx@CE2<Ho*)1<Ul@tM1+EAR~*kC!2XV@
z?@|=|FNjSj$}vcr*#+i0G!;;J_+l6x;J<@8;PW%8>>cYL7*#WhgnKVM01L|gixs5r
z+7Y^_5^Q6Y(x7q@SBJUjY1dxXv}$uBx%^%z4?>d$x`?CWV?zKtA+=O;s>T3Tq|aC2
zihCyMGCSjceHJAXR8&csDMllZr;_qCU_`p4n68*K;qU2+Ht(Y0VX&_B8MF_hPZ(Z?
zqLU~wy<&*!kn-!H{P=ee|A+W<kSDNp<j0egRL|Z!=~&?0_j|lC<>b4?w!HuSOuzNy
zjE>g%F;Ams>dq-oJ>&$Hi{bZAER+j-+JvZfzp>+~EpuKozvZ5F(FTo0Z)w$X|4PpL
z!ynpCVu7{B%q7oW#X6IDl>Df~z`8?guoXRxPZE-kVU=oXhS7<)sdMF^Kfc?4x>w*X
z3s<HD*ER1ITB<5UH3dmqVG7Pz@bHT0SE*Vw6{!(dv*W-Q_$5gg7{0(!(NRl_=yR!G
z(?&LvXW+zzG*%lmAIE4-bsB&>2r)-i;#V9(bNdHVLQSVXs>^@sEVAf>!93nLtvRFp
zI4LZqQS<9mb>XXjtl#*XUt7bHbAA=3vlTr_+Vo)KLhoCfzPsiAmbZ$%Nqd%#uVk&%
zd{F4!-}*E;O-Qc;&ITZcgpN~y7+SgRPww&e4hZLX!Qm7pro0Z9aCKU6PYaG~0#CIb
zf(a0E?*mKlX==t@$9(BGC+E3&hsW(t-SXStd>nyX|0^s@V$vTOYv0HLtwKmPf8DlR
zwcNaPYN=kxJF%Kw`zX8izY50M&m5)bK=0>nsnqI!5T9PPTl+(;scJ{W56u;sRV5KW
zDly>ZN4rhcxrV<DORcsW{?=~5^_rF0j1<_){2_YK*CM~n+8m@~{iS6Qw3>p?4s9m!
zQ2B0a)=WK<90bk7s-h^T@EWi_{}a~dAlpsw?zE8m>tvaPx*vbhdd93$m9;@G8Mpw7
zohE1DEJIqNI<Wpkr;6yja0>o%B)kY%8CS%juDrqaBAT$V2de7iOr+@Pf&)&tyqd~u
z4XjHO<h)tDxR;Dve291^w~4m}wIEhv&=HBVwBJ|wO5i^j9UbZ_$6AI~-efLiC_LB>
z678<=Lxb8c9WtE_U#$H?v_OVjE82696|T!cDhC{ON31JJlH39#G)1mEIJ=ta&3^{1
zqwqInYLQD)IX1Av$&&1FmS{0b!ZZ)?&%r@5XFu7*Kv%Kk4Y-VT1N;yf$^T+MG88>P
z>L-T>F0&oHD~kXl2evS`g|v)qq5BC(CE-6djgO9E?>Iy0pY1LdW7><=xb}SU>6-Z6
zrw>A%jimX6;!5`RB_($D@`U3wej!}K{Om2+1qJGzJ-dJ@7%<VyFKFNf!t1J=j#gK>
zqI*Y~>sC9<mRmE*DI)O^KOu%_5TY;^YC_4K)lSNob--*6f-z%YfcGVEU}ljS&III+
z5b(h1v@o%}L#TEB8(N>}TS^GQ38%b;-SfS$UEKA`d0dLnW`7iI14?1Qe5}3)^a#1R
zY7T@qwpO=-Qi(WOU0=nhnCgy`)s-#PRe!h|@_$XmqefCJEB+mBTraHB|GKV9@%`S-
zee;cTjh;=fbmQ_<{%;Ti)rlbST5D5vz*JdLUs+vSi`tl4j@4CH^)$4$1gsU6Ex_dL
zX{v5)J=TN|X%m}R61b6d7~?ht46JcoMrfX1n&^cmSu4~{0qg4=DCz@XZT~sR*QtT^
zKUcWe4|yv};fg3KV(zGZK~jf;=yhT{(P)biEO+sHkl^kx-7=QS|3OzX6nvWkCxQZV
z5ObxUp3(>tvAI@|E39^%Jpq$43}7$<HBJn%K)57Kd>65psiewXIV5UHGJOg5CjY-6
zlAj{pK<d9)N8p5%?diXse&g^*X3I^75Vyr|Eh4dhK8ep}tbTp+Q%mgJwm<HK&%~J6
zxhhZ2eE5QPp+?x%DRlQ@iRLuNN$MZZ)DLX6ItcA-O{5io@DqeBx*5Zh?7TM%?-efe
z`?9w!_AO;Ec6hVPm-uCkkagH=%z({qrziZ0IeISt<%4&tgsf73`nI>LpT;KmSjR``
zi#-KtqAlLXx(z~~t$!x`BeU(5?LrFtX2OqS-(upTQApbBk1PAgnn(`#^br3Yoo`x5
z6?PsGtVdTS9!Is3L~;jUpC;$|g*|XBI=FmJh;8s$Pp(?qyw*0KwL>_?J+gBCK{y$6
z_y?Wd$*b$rS}_S$Vp=?oI!pE|k+YF=+x~}WkVnx;zfM-EqtLnxkj0A>M6LeI?d@Mg
zKLD>DsfouR8I|bR9#%9tF>*T98f%bv+kj?KbrawSJzU-0;x0l3alxHYwI#)!$r+>O
z!$qnRs}Q-GRTKs(*C;2A4R#<ciz<!7U9^gvfIDk&%0m|D;i-}~=ts!w6~m*zI!tmF
zStbVwgI4r8g+2C0=o~20HaTyMjU;E5e8=Qwuy7OKaWgFs&;&tz{F~b$eTriA$~Tc-
zw*01gcHF}A9Q9tl8p)Hd)U)af#o-L{4Mf|Vbw?;~LNfgWYEY4xadGMjA0*o#y+m5Y
z)*a{_iPSsfcR&RtskI&1xh^`zlpc*J@-a1z{2Q0dBq+h9Qe;P<mG;VSjFib&>RF*f
z!qCoUYG<4oeaNNaU)qCo**X1m1k5VK*O=STGQ<u!6}ev1T5um?K<_BhG&x4FzDbZQ
zN41j9kYl24GN0Ruc4|e&UCW{?ptcw#j2F=9B-P}y={fLSObp+}NR%*A-YCU31;qw+
zx-PbfV#{?we^lsqlFyKpB@knbiYEvYa5Hiwy6s(BRTLKxya{W82&2(YS7cwpe}#fS
zrl6Ao64~&7MOQzjfOJ;)lgQo`QN~ml?Eye;Kwk!ygOHsRfQfG>;RX}B0EL`HC<I3j
zRY^cmLnm^8?*$?fG;=IRC>nt=DHcJZ_D;O4HG@|!AGCK*mDHcM^E@(k#WL2%8oQt)
zEwEICP*AdoCIBV=76o5LK;j2(JfK4%pgB4WFnTB4x$lK_k!&emEQ3A4o|~T>h6M<$
zPzIf>OlK7ZORzDV0Ft)@`GeKyEZ7yK9m6ZYBh2+hfyl(*Td6o+`kkRAk?(7sAT*do
zHnUY=nu|=+h5;Zkxd-Duuq7Ic`tT^>j(X`OMl(F3+8BF!xZ!>$G-F?)9B8=!uBQ`p
z0K9@bfF(O6k{?<0D@_5S)y3b_l?vHJ^ac|cJ&PGaAC~7Sn4;j1QH6jOVi}@W8J6ku
z;X<U=<v&6}|2_U3M5n%x!iY}3yG5|%!JS3R!`;i=_YW@Qyc2#ugV+G=eSYqe(8dcB
z1eI6;<Uo)S699*M5}kNAQm|~CAAE35$lbk^_oKbSUT_XN{9T;TFz}>g>tg)<%S$=m
zxjr*`x87?hT&`N#>2K;3j(0tYPWNXN3zm|_ym$8srPV7|e`mjNlmnx{GN`#x4GUdc
z(wx)Nx*D?)8bfhOq5ubAmLPYAZtwG&GobG?^{uIQa+Y$I5|=J7^DBApUj<jhd$dD1
z(kblj@^9-FP7lx<J6|rJkAE}yTgi(#-z$2%XmwkqcU$Fht$$nN)40S}_uk&S8n@9K
zx6vP$`-Vd(Z1d-}KefisP0zQy*?F&X;nHHteYY=nzmQWdls5_qO+IV$s<qQ=?etl@
zSFOEXYp>7RFAR-5vX1yi31;+?h!c1L`lL@S39A+e5;Er-=O^!VE><naucUh`T7|Qm
zaPG4AEcxv{23r!GT1ESavoMT6Ge-|-XS5$dQ)=5yNRyJ_0)5jRlh2a<vi4(Jm@Vhm
zu`2m;+^^3hO0aaMZFcWWp^#8d_$FWvt(<4TC_}6LqXdjX7BxT;bO{%TyVWc^2JR&;
zS2J)HK?Gjc^b<>p?hvJ3+d!v7+6p=mzzL!p5}8*N1u>-;#_%4ZxU^U4<c7j4(sXI7
zh_D=lgJ{I0JN!1GW#ElNBI?PocAU~2(q0r_ucDaJ3uBsUdY#iS$I|_pqx8C|Mh7;N
z;h64IWI&nInO+b*7#Bp<q$jR~Mb%^_uGvLlKPbs*Fn0b>ydVy?^dkKRBhw_%6$)jC
z+@xa-FDRIM5jH|)T6e689kh;MEn;#XoJG&5MoC&^q7_P7t(dHbu89W)-Vx{n@Q%!K
z7C`Y*Eg>v~3qtR%<*5YmF|3g5NFG7gNM@``dWv5-NM?3p^;UQr$cJh0g4)5XLx-rT
zpi-oe%w)mjIZpf)n%4>Pm8xk2+BfzYNr>T^;pPR%DR5RLAqDZ$da5pmCmm3*XFwrL
z6@Wa*NFGuoOcFu`AA~mxado4;=CeyrK5Szp#P9-Fw77UmPE0seFv2gOlH$@s4wqap
zidaP4!#*Pz+45rkKHK=py!~k=909U7d&=>DNqLPT8_56JGRqb>w#=rZ33*zWMD+tA
z_kwuyj3dt&^lXD0zJ7yynqDM0YLPcj$_wJwH3-N=Tz2`Vi1jJ{9RCrKUbv=2BzpSh
zlkS}NMigM?-TarE-|fc`uGF;B1b46vIMCKxdtTo2O0$qs;7{26Bss-Xa3>0YpQHC1
zyw?3fbUBcow!ClkMmI37d$+gglsEd+jiXFy08D-%Is<rvDR<nSF}&3aE<cc)geXE%
z2B@oGI|zBZW+mr?h~-SbrP1FEes=HU=01pxqZ6>gC@@DgkM$dV^J^XBPVaal=MBd~
z>9;2rxCO_&do_E9H+u)T(mOt5e4Zaz(hu*`{$QV}GS~1!eNv^}@I$)+*Tg1J4n-`S
z4gxcHx(Q{4%xTmuA$=V22&J_CKr5^MOq2SzB7&9Q!DI;)c(@YB*P(-0V4;*8fpvl|
zL`Nu9QFR;nAV`J$IVmX$VT73yN>MZzGxRwzBIVLBs3wJ3E0&N#b&DBXA{eE`%W<#~
z{W4ot8Y}F;doikt8}4jQyYv%Q6)x79t=<h9F{$pAR7!#15V}QFV5aA`NYEw_EfS)>
zZhde)Z|;Nge(3KQFSpzm%*!U%Mm=*0T;hWuwsPnaIdkMUf=l+CQYlJ{zelN3)-ukY
zQ!3*6vf~SsN-=o&JxaCV3$+!t#b3BoiXh?lC{^YcDwV>v_yTRE2qL~<sY3K&=aw(g
z3R!=Eew_VGD}?Ip8=r|4s_Z1rX2%z3tDOJW%KpVh>ei5D4-3U$l37AbKnQYi{h<<L
z5&^eMjsXHL14{Ln4aFl!Ra#kF<aUviOv0~)!(=FI8s{L=Ew`SZLlSUgqK7BMA?RZc
zIQseFi=?U%u!0vMI%Vl$KCKu=CZRLGgykz>RA{jQB8W6>gUpliCMk`QyDBD9VA3qO
z?Kn4nnP&_amCeF9EbCY*btsL<lX;&qfjc#zRQEXfi2-Pfh7-4Be2i!O8A5#vXb$2r
z5UqGP6(L>?$u8gpj_?wSM3YNm-cUg#10rJM1R~`9`JdB|C@nEYM7l16@dg6X75oq|
zQpcPp;f`d04@7|3Fy0T7+q9<M%T;O{)eMYYJR-MJAi9_1dH^kPk-g*yMAE%@6Nmyv
zb`Li&*gG-mg!d7uTonC`qO*+n8a(1BDPYVJl}|E-LayV9h^!QXv|G<R`G}qoi3rc2
zR0>MpA$}UBB*Ms4nu`h|0@~h-{BNkeiCw8OIYip@J9y?GIl4%PidrH(Axf|y9PC6#
zB?3^OCflmX?lsxx&%b-w-*I-e!|m;G`%Tj@eu|7*jZE`Krp+fT#tV^Ya9;u(1AWBT
z>c3JySLV}atm+HB`oafpK@Wtx{ZEYMThX)8bCW(}#*K=3&70Bpq8G0C?R%E8-Yb4s
zyprlKBdv(lHqP6|`OjSx5Vl=<l9&#690_>~o8K7~3M!Y+`<u@S)zAyM;2(Dh{j}M>
zE^-8piW}-{nv?LSl6JRUNXT7?_V1|?@{X+>^|zi8PV{`D(<Jn2L~h5=qO7;-XX`yX
zd{Oop&3x9I#rKLA6aCq8aSksPKQ3$d*g$W593BP;3M#zQXH36Q;pu&S?9SLin?Ga6
zV(<6H-X2@-6x#b2$NalEVQ^>_;*vq9|H?H1;ox<--dB7^JL>&RMhS2Wu~h6Y>k>|#
zUOhG9JvHJVyCNVwH6_1#*=NketF|{Y?qw{7`?Gd0+1|@|m;ntHp>J#{!@qYNu=}f*
zfWJ>*{8a$D5ZDzD01r8h=VhNNoH|F@4-4l<SI<v*&rczVYnmFZz^+C$$CM=8K4T7w
z(fj7uy|KkM|EB#*z3+`Z9P^(%voz*E&?DzG<uhg>TIrhy?j2a%<lne=sr0=A4-Y`e
zwQF$cfPdeRFg&t4eEI+B>uO@#D5CJb_1a#q*S~VH6VfD2+&FgnM{t_|AC)8xA-Ez~
zP^U#zsFFHO5U`{%q*A&Os*)8Tw--ndD3RdMBPZa3gv6znpiNgOCKghU<QB#U4&}gm
zv!MwGkgU)1^LBoAciw2eoq2D2hWMEeaBmC#jiOBvbEbe*-=tkRf{;VP20x<Z(2gsz
z7W9XCvo^nR5X*^$r%n5>-bKya6!mV}%+KuP7q;_cGyVM|b><ha+?oHale@)uTIT|;
ztbD~@qxYkJeGm@;7NbV=UgVSGcsx4#NJ@Tj{p-ff$*-C=X4hw*m{QVS*ldMEFUN(g
zxF_RvY@Lo|T#lbzP7D*zN#<v+T|4k*n{;L~*-Qp){$&v~9Y<t_n;}SwnLVOFlCY=H
zfL`EX?KBD`r?ovAxt#ap`{8FvVw~V5g6|M^-L_S|_iRHo4@niZP$p5U+D{Z+B{4sq
z9-W(c6CD`7dkZa3X<t(IAi*-q(7Z4?_s-;eo?4F7?G$QFX=G@8$R=S6B-lrV^%8tY
zQL;>Ev$$gvrPIdtNlz~|S|L~>k!LAXN6<sjVS;Z-c!AQ0&aju<e6`IrT?eIg5sVOI
z2>6<PnnLpgMA>K`6VQBY`_lS>LO&8bMA&tcy8-NpW>L~_1iusDdm(T?#~OZSKx3o?
zG#P3)2=WAcK08$HcPY&vxKHpY!RG`U1YGg|LLu66r~OIr7XhCPYN(SZ2pS1En?6CI
zLpGgTAmZ}{83V8>bvi|G$fk2jnokg1jngwCdyvSYC#j+c^(c(6EBBxQ?^|<IecBT&
z0Q1ngDysW^2LSvbMM0{Z6ChX?j+F&(S@7_mzbvR_!B-YSWkD$m0iJd2vD>p!ST3yG
zS-x{m`>b%kuoF#eM-vZZEBc(}Zq=od>Mve2E*8g(G5p|s+frL}4~?L9qrKQ;^q}*l
zIdsmW%m0!y>)I^!JPO(u@2IugYVDe~vADjtv9!K~_N>i;D^}fAOMOH4JVv2WW0Y(2
zZnL@HQU~x#MJ=X`RPl^)X02-TlBJ||cgY{sy(QVddVBS)wY2G~*Bu8fvHdQXwXNhH
zNG|#NP%coTtEE62f-j^irErA2^z4M=+u^u*vcn2@>Vc9kp({)l-~#Ll1G~atMFbdu
zipvd&N?3%>itK>bfhhtE0TV^Y0&_{w!xRx(m<;d&<|z=U!~$@ZHHcUalb!Gk^E+Tz
ztSAoX+7Ak@pgz7bu{>c0yDVq-_gPcAP;v(TNlRPKwr}Q5oL>*qPFT){%~4Z2dnB#d
zawZ?No6_?~(i$yid^3-7`(9T_)O{?dVC6A@>)1{gG_W8*KZQap_$ojryNP``xi1U&
z{1Qf@c*;11pAmAFlF;2ulEKF!E=aSWAL>~>z!dgQg&?Z|cm)f@j<T2&<9>j*F)l)i
z$tk!5>?%0$R#cQKXlCbQP{%slC>Bn@Ws$vxujCcHrGPq`AzsESyKyHZTLc+f81bTb
ztsBm<uos(ItwJlSk>NOH;N7f_!3|*P0K{2C2veJa@S=moJy6T4Ly+2U5+rqX@sXqI
QS4qA*jAve?YCcT<2J4o&C;$Ke

literal 0
HcmV?d00001

diff --git a/dev2/dev2-site b/dev2/dev2-site
new file mode 100755
index 0000000..18af391
--- /dev/null
+++ b/dev2/dev2-site
@@ -0,0 +1,794 @@
+#!/usr/bin/env python3
+"""
+dev2-site: move a Railway-hosted site onto dev2 and keep it deploying on merge.
+
+    dev2-site registry                 rebuild sites.json from Railway (the truth)
+    dev2-site list [--kind pg|none|supabase|turso]
+    dev2-site show <site>
+    dev2-site scaffold <site>          deploy-dev2.yml (+ .nixpacks Dockerfile) in the repo, as a PR
+    dev2-site provision <site>         ~/www/<site> on dev2: env, compose, deploy script, deploy key, secrets
+    dev2-site db <site>                database in the shared cluster + copy from Railway Postgres
+    dev2-site volumes <site>           copy Railway volume contents into ~/www/<site>/volumes
+    dev2-site deploy <site> [ref]      build + start on dev2 (as the deploy account)
+    dev2-site cert <site>              Let's Encrypt via Porkbun DNS-01, before DNS moves
+    dev2-site vhost <site>             nginx server block -> 127.0.0.1:<port>
+    dev2-site verify <site> [--public] curl the site through nginx (pinned to dev2, or via DNS)
+    dev2-site dns <site>               flip every domain at Porkbun to dev2
+    dev2-site railway-stop <site>      remove Railway deployments + disconnect the repo watch
+    dev2-site merge <site>             merge the scaffold PR (CI then deploys the default branch)
+    dev2-site migrate <site>           all of the above, in order, resumable
+    dev2-site retire <site> --yes      delete the Railway services (only after migrate)
+
+Run from dev1. dev2 is production: this tool is the only thing that writes to it,
+and everything it writes is derived from Railway + these templates, so a re-run
+reproduces the box. State per site lives in ~/.local/state/dev2-fleet/<site>.json.
+"""
+import argparse
+import datetime as dt
+import json
+import os
+import re
+import secrets
+import shlex
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+import urllib.request
+
+HERE = os.path.dirname(os.path.realpath(__file__))
+TEMPLATES = os.path.join(HERE, "templates")
+REGISTRY = os.path.join(HERE, "sites.json")
+OVERRIDES = os.path.join(HERE, "sites.overrides.json")
+STATE_DIR = os.path.expanduser(os.environ.get("DEV2_STATE_DIR", "~/.local/state/dev2-fleet"))
+
+DEV2_HOST = os.environ.get("DEV2_HOST", "dev2.profullstack.com")
+DEV2_IP = os.environ.get("DEV2_IP", "23.95.228.174")
+DEPLOY_USER = "anthony"
+WWW = f"/home/{DEPLOY_USER}/www"
+SRC_ROOT = os.path.expanduser("~/src/profullstack")
+CLUSTER_ENV = "/home/anthony/www/crawlproof.com/supabase/.env"  # the shared Supabase cluster
+PG_CONTAINER = "supabase-db"
+WORKSPACE_ID = "50db2758-e580-4af6-b904-366b6bb2a71b"
+FIRST_PORT = 3200
+RAILWAY_SSH_KEY = os.path.expanduser("~/.ssh/id_ed25519")
+ACME_EMAIL = "anthony@profullstack.com"
+
+# ------------------------------------------------------------------ utils
+
+def log(msg): print(f"\n===> {msg}", file=sys.stderr, flush=True)
+def note(msg): print(f"     {msg}", file=sys.stderr, flush=True)
+def warn(msg): print(f"WARNING: {msg}", file=sys.stderr, flush=True)
+def die(msg, code=1):
+    print(f"ERROR: {msg}", file=sys.stderr, flush=True); sys.exit(code)
+
+def sh(cmd, check=True, input=None, capture=True, env=None, timeout=None):
+    """Run a command (list or string). Returns stdout (str) when capture."""
+    if isinstance(cmd, str):
+        cmd = ["bash", "-o", "pipefail", "-c", cmd]
+    p = subprocess.run(cmd, input=input, text=True, capture_output=capture, env=env, timeout=timeout)
+    if check and p.returncode != 0:
+        raise RuntimeError(f"command failed ({p.returncode}): {cmd if isinstance(cmd, str) else ' '.join(map(shlex.quote, cmd))}\n{(p.stdout or '')[-1500:]}\n{(p.stderr or '')[-2000:]}")
+    return p.stdout if capture else ""
+
+def ssh(user, cmd, input=None, check=True, timeout=None):
+    return sh(["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=20", f"{user}@{DEV2_HOST}", cmd],
+              input=input, check=check, timeout=timeout)
+
+def ssh_put(content, path, mode="0644", owner=None, user="root"):
+    """Write a file on dev2 from stdin (no scp, no temp file on the box)."""
+    own = f"-o {owner.split(':')[0]} -g {owner.split(':')[-1]} " if owner else ""
+    ssh(user, f"install -m {mode} {own}/dev/stdin {shlex.quote(path)}", input=content)
+
+def state_path(site): return os.path.join(STATE_DIR, f"{site}.json")
+def load_state(site):
+    p = state_path(site)
+    return json.load(open(p)) if os.path.exists(p) else {"site": site, "steps": {}}
+def save_state(site, st):
+    os.makedirs(STATE_DIR, mode=0o700, exist_ok=True)
+    tmp = state_path(site) + ".tmp"
+    with open(tmp, "w") as f: json.dump(st, f, indent=1); f.write("\n")
+    os.chmod(tmp, 0o600); os.replace(tmp, state_path(site))
+def mark(site, step, **extra):
+    st = load_state(site); st["steps"][step] = dt.datetime.now(dt.timezone.utc).isoformat(timespec="seconds")
+    st.update(extra); save_state(site, st)
+
+def tmpl(name):
+    with open(os.path.join(TEMPLATES, name)) as f: return f.read()
+
+# ---------------------------------------------------------------- railway
+
+def rw_token():
+    cfg = json.load(open(os.path.expanduser("~/.railway/config.json")))
+    exp = cfg.get("user", {}).get("tokenExpiresAt", 0)
+    if isinstance(exp, str):
+        exp = int(dt.datetime.fromisoformat(exp.replace("Z", "+00:00")).timestamp())
+    if exp < time.time() + 300:
+        subprocess.run(["railway", "whoami"], capture_output=True)
+        cfg = json.load(open(os.path.expanduser("~/.railway/config.json")))
+    tok = cfg.get("user", {}).get("accessToken")
+    if not tok: die("no Railway token: run `railway login`")
+    return tok
+
+def gql(query, variables=None, retries=4):
+    body = json.dumps({"query": query, "variables": variables or {}}).encode()
+    for attempt in range(retries):
+        req = urllib.request.Request("https://backboard.railway.com/graphql/v2", data=body, headers={
+            "Authorization": f"Bearer {rw_token()}", "Content-Type": "application/json", "User-Agent": "dev2-site"})
+        try:
+            with urllib.request.urlopen(req, timeout=120) as r: out = json.load(r)
+        except urllib.error.HTTPError as e:
+            out = {"errors": [{"message": f"http {e.code}: {e.read()[:300]!r}"}]}
+        if "errors" in out:
+            msg = json.dumps(out["errors"])
+            if "Too many" in msg or "Not Authorized" in msg and attempt < retries - 1:
+                time.sleep(5 * (attempt + 1)); subprocess.run(["railway", "whoami"], capture_output=True); continue
+            raise RuntimeError(f"railway api: {msg[:800]}")
+        return out["data"]
+    raise RuntimeError("railway api: gave up")
+
+def rw_variables(pid, eid, sid):
+    return gql("query($p:String!,$e:String!,$s:String!){variables(projectId:$p,environmentId:$e,serviceId:$s)}",
+               {"p": pid, "e": eid, "s": sid})["variables"] or {}
+
+def rw_ssh_user(pid, eid, service_name):
+    out = sh(["railway", "ssh", "config", "--dry-run", "-i", RAILWAY_SSH_KEY, "--project", pid,
+              "--environment", eid, "--service", service_name])
+    m = re.search(r"^\s*User\s+(\S+)", out, re.M)
+    if not m: die(f"railway ssh config gave no User for {service_name}")
+    return m.group(1)
+
+def rw_ssh_cmd(user, remote_cmd):
+    """The ssh argv that runs remote_cmd inside a Railway container."""
+    return ["ssh", "-o", "StrictHostKeyChecking=accept-new", "-o", f"UserKnownHostsFile={os.path.expanduser('~/.ssh/known_hosts_railway')}",
+            "-o", "ServerAliveInterval=30", "-o", "LogLevel=ERROR", "-i", RAILWAY_SSH_KEY, "-l", user, "ssh.railway.com", remote_cmd]
+
+def rw_deployments(pid, eid, sid, first=10):
+    d = gql("query($p:String!,$e:String!,$s:String!,$n:Int!){deployments(first:$n,input:{projectId:$p,environmentId:$e,serviceId:$s}){edges{node{id status createdAt}}}}",
+            {"p": pid, "e": eid, "s": sid, "n": first})
+    return [e["node"] for e in d["deployments"]["edges"]]
+
+# --------------------------------------------------------------- registry
+
+DB_HOST_KINDS = (
+    (re.compile(r"postgres(ql)?://[^\s]*railway\.internal"), "pg"),
+    (re.compile(r"postgres(ql)?://[^\s]*\.rlwy\.net"), "pg"),
+    (re.compile(r"\.supabase\.co"), "supabase"),
+    (re.compile(r"libsql://|\.turso\.io"), "turso"),
+    (re.compile(r"postgres(ql)?://"), "pg-ext"),
+)
+
+def classify_db(vars_):
+    kinds = set()
+    for k, v in vars_.items():
+        if not isinstance(v, str): continue
+        if re.search(r"REDIS", k): continue
+        for rx, kind in DB_HOST_KINDS:
+            if rx.search(v):
+                kinds.add(kind); break
+    for pref in ("pg", "supabase", "turso", "pg-ext"):
+        if pref in kinds: return pref, sorted(kinds)
+    return "none", []
+
+def uses_redis(vars_):
+    return any("redis" in str(v).lower() and "railway.internal" in str(v) for v in vars_.values())
+
+def primary_domain(domains):
+    customs = [d for d in domains if not d.endswith(".up.railway.app")]
+    if not customs: return None
+    apex = [d for d in customs if d.count(".") == 1 and not d.startswith("www.")]
+    if apex: return apex[0]
+    nonwww = [d for d in customs if not d.startswith("www.") and not d.startswith("*.")]
+    return (nonwww or customs)[0]
+
+def slug(name):
+    return re.sub(r"[^a-z0-9]+", "-", name.lower()).strip("-")
+
+def infra_role(src):
+    img = (src or {}).get("image") or ""
+    repo = (src or {}).get("repo") or ""
+    if re.match(r"(ghcr\.io/railwayapp-templates/postgres|postgres:|.*supabase-postgres)", img): return "pg"
+    if re.match(r"redis", img): return "redis"
+    if repo == "6ixfalls/supabase" or "postgres-meta" in img: return "supabase-infra"
+    return "app"
+
+def cmd_registry(args):
+    log("Reading every project, service, domain, volume and database variable from Railway")
+    ws = gql("query($w:String!){workspace(workspaceId:$w){projects{edges{node{id name environments{edges{node{id name}}} services{edges{node{id name serviceInstances{edges{node{environmentId source{repo image} domains{serviceDomains{domain} customDomains{domain}}}}}}}} volumes{edges{node{id name volumeInstances{edges{node{serviceId environmentId mountPath currentSizeMB}}}}}}}}}}}",
+             {"w": WORKSPACE_ID})["workspace"]["projects"]["edges"]
+    overrides = json.load(open(OVERRIDES)) if os.path.exists(OVERRIDES) else {}
+    old = json.load(open(REGISTRY)) if os.path.exists(REGISTRY) else {"sites": {}}
+    used_ports = {s["port"] for s in old["sites"].values() if s.get("port")}
+    used_ports |= {3010, 3020, 3100, 5432, 6379, 6543, 8000}
+    sites = {}
+    for pe in ws:
+        p = pe["node"]
+        envs = {e["node"]["id"]: e["node"]["name"] for e in p["environments"]["edges"]}
+        prod = [k for k, v in envs.items() if v == "production"] or list(envs)
+        if not prod: continue
+        eid = prod[0]
+        mounts = {}
+        for ve in p["volumes"]["edges"]:
+            for vi in ve["node"]["volumeInstances"]["edges"]:
+                n = vi["node"]
+                if n["environmentId"] != eid: continue
+                mounts.setdefault(n["serviceId"], []).append({"name": ve["node"]["name"], "id": ve["node"]["id"], "mountPath": n["mountPath"], "sizeMB": round(n["currentSizeMB"] or 0)})
+        svcs = []
+        for se in p["services"]["edges"]:
+            s = se["node"]
+            inst = [i["node"] for i in s["serviceInstances"]["edges"] if i["node"]["environmentId"] == eid]
+            if not inst: continue
+            i = inst[0]
+            doms = [d["domain"] for d in (i["domains"] or {}).get("customDomains", [])] + [d["domain"] for d in (i["domains"] or {}).get("serviceDomains", [])]
+            try: vars_ = rw_variables(p["id"], eid, s["id"])
+            except RuntimeError as e: warn(f"{p['name']}/{s['name']}: variables: {e}"); vars_ = {}
+            kind, kinds = classify_db(vars_)
+            db_host = redis_host = None
+            for v in vars_.values():
+                if not isinstance(v, str): continue
+                m = re.search(r"postgres(?:ql)?://[^@\s]*@([a-z0-9.-]+\.railway\.internal)", v)
+                if m and not db_host: db_host = m.group(1)
+                m = re.search(r"redis://[^@\s]*@?([a-z0-9.-]+\.railway\.internal)", v)
+                if m and not redis_host: redis_host = m.group(1)
+            svcs.append({"db_host": db_host, "redis_host": redis_host, "id": s["id"], "name": s["name"], "role": infra_role(i["source"]), "repo": (i["source"] or {}).get("repo"),
+                         "image": (i["source"] or {}).get("image"), "domains": doms, "volumes": mounts.get(s["id"], []),
+                         "db": kind, "db_kinds": kinds, "redis": uses_redis(vars_), "nvars": len(vars_),
+                         "port_var": vars_.get("PORT") if isinstance(vars_.get("PORT"), str) and vars_.get("PORT", "").isdigit() else None})
+        apps = [s for s in svcs if s["role"] == "app"]
+        infra = [s for s in svcs if s["role"] != "app"]
+        # One site per app service that has a custom domain; same-repo, domain-less
+        # app services in the same project ride along as companions (workers).
+        fronts = [s for s in apps if primary_domain(s["domains"])]
+        orphans = [s for s in apps if not primary_domain(s["domains"])]
+        for s in fronts:
+            site = primary_domain(s["domains"])
+            comps = [o for o in orphans if o["repo"] and o["repo"] == s["repo"]]
+            shared_repo = sum(1 for f in fronts if f["repo"] == s["repo"]) > 1
+            entry = {
+                "site": site, "project": p["name"], "project_id": p["id"], "environment_id": eid,
+                "service": s["name"], "service_id": s["id"], "repo": s["repo"], "image": s["image"],
+                "domains": [d for d in s["domains"] if not d.endswith(".up.railway.app")],
+                "railway_domains": [d for d in s["domains"] if d.endswith(".up.railway.app")],
+                "db": s["db"], "db_kinds": s["db_kinds"], "redis": s["redis"], "volumes": s["volumes"], "port_var": s["port_var"],
+                "companions": [{"name": c["name"], "id": c["id"], "volumes": c["volumes"], "db": c["db"], "redis": c["redis"]} for c in comps],
+                "db_host": s["db_host"], "redis_host": s["redis_host"],
+                # Data services that belong to this site: in a one-app project all of them,
+                # otherwise the ones whose internal hostname (service name slug) the app points at.
+                "infra": [{"name": i["name"], "id": i["id"], "role": i["role"], "image": i["image"], "volumes": i["volumes"]} for i in infra
+                          if len(fronts) == 1 or slug(i["name"]) in {(s["db_host"] or "").split(".")[0], (s["redis_host"] or "").split(".")[0]}],
+                "shared_repo": shared_repo,
+            }
+            entry.update(overrides.get(site, {}))
+            prev = old["sites"].get(site, {})
+            port = entry.get("port") or prev.get("port")
+            if not port:
+                port = FIRST_PORT
+                while port in used_ports: port += 1
+            used_ports.add(port); entry["port"] = port
+            for k in ("status", "notes", "moved_at"):
+                if k in prev and k not in entry: entry[k] = prev[k]
+            sites[site] = entry
+        for o in orphans:
+            if not any(o["repo"] and o["repo"] == f["repo"] for f in fronts):
+                note(f"{p['name']}/{o['name']}: app service with no custom domain and no same-repo front; skipped (add to sites.overrides.json to include)")
+    reg = {"generated_at": dt.datetime.now(dt.timezone.utc).isoformat(timespec="seconds"), "dev2": {"host": DEV2_HOST, "ip": DEV2_IP},
+           "sites": dict(sorted(sites.items()))}
+    with open(REGISTRY, "w") as f: json.dump(reg, f, indent=1); f.write("\n")
+    log(f"{len(sites)} sites -> {REGISTRY}")
+    cmd_list(argparse.Namespace(kind=None, status=None))
+
+def registry():
+    if not os.path.exists(REGISTRY): die("no sites.json: run `dev2-site registry`")
+    return json.load(open(REGISTRY))
+
+SITES_D = os.path.join(HERE, "sites.d")
+
+def with_overrides(s):
+    """sites.d/<site>.json is merged over the registry entry: one small file per site,
+    so parallel migrations never edit a shared file. Keys are the entry's keys
+    (port, health_path, start_command, companion_commands, env_overrides, pg_service,
+    db, db_host, infra, branch, max_body, notes)."""
+    p = os.path.join(SITES_D, f"{s['site']}.json")
+    if os.path.exists(p):
+        s = dict(s); s.update(json.load(open(p)))
+    return s
+
+def site(name):
+    reg = registry()
+    if name in reg["sites"]: return with_overrides(reg["sites"][name])
+    # allow a service name or a repo tail
+    for s in reg["sites"].values():
+        if s["service"] == name or (s["repo"] or "").split("/")[-1] == name: return with_overrides(s)
+    die(f"unknown site {name!r}; `dev2-site list`")
+
+def cmd_list(args):
+    reg = registry()
+    rows = [with_overrides(s) for s in reg["sites"].values() if (not args.kind or with_overrides(s)["db"] == args.kind)]
+    def status(s):
+        st = load_state(s["site"])["steps"]
+        if "retire" in st: return "retired"
+        if "verify-public" in st: return "on-dev2"
+        if "dns" in st: return "dns-flipped"
+        if st: return f"{len(st)} steps"
+        return "-"
+    rows = [s for s in rows if not getattr(args, "status", None) or status(s) == args.status]
+    print(f"{'site':<34} {'port':>5} {'db':<9} {'redis':<5} {'vols':<4} {'comp':<4} {'status':<12} repo")
+    for s in rows:
+        print(f"{s['site']:<34} {s['port']:>5} {s['db']:<9} {'y' if s['redis'] else '-':<5} {len(s['volumes']) or '-':<4} {len(s['companions']) or '-':<4} {status(s):<12} {s['repo'] or s['image']}")
+    print(f"{len(rows)} sites")
+
+def cmd_show(args):
+    print(json.dumps(site(args.site), indent=1)); print(json.dumps(load_state(args.site), indent=1))
+
+# ------------------------------------------------------------ local repo
+
+def checkout_dir(s):
+    repo = s["repo"]
+    if not repo: die(f"{s['site']} is image-only ({s['image']}); nothing to scaffold")
+    org, name = repo.split("/")
+    cands = [f"{SRC_ROOT}/{name}", f"{SRC_ROOT}/{name}.com", f"{SRC_ROOT}/{name.removesuffix('.com')}",
+             os.path.expanduser(f"~/src/{org}/{name}"), os.path.expanduser(f"~/src/{name}")]
+    for c in cands:
+        if os.path.isdir(os.path.join(c, ".git")): return c
+    dest = f"{SRC_ROOT}/{name}" if org == "profullstack" else os.path.expanduser(f"~/src/{org}/{name}")
+    log(f"Cloning {repo} -> {dest}")
+    os.makedirs(os.path.dirname(dest), exist_ok=True)
+    sh(["gh", "repo", "clone", repo, dest, "--", "-q"])
+    return dest
+
+def default_branch(repo):
+    return sh(["gh", "api", f"repos/{repo}", "--jq", ".default_branch"]).strip()
+
+def repo_config(d):
+    """rootDirectory-free reading of railway.json/toml for healthcheckPath, dockerfilePath, startCommand."""
+    cfg = {}
+    for fn in ("railway.json", "railway.toml"):
+        p = os.path.join(d, fn)
+        if not os.path.exists(p): continue
+        txt = open(p).read()
+        for key in ("healthcheckPath", "dockerfilePath", "startCommand"):
+            m = re.search(rf'"?{key}"?\s*[:=]\s*"([^"]+)"', txt)
+            if m: cfg[key] = m.group(1)
+    return cfg
+
+def find_dockerfile(d, cfg):
+    if cfg.get("dockerfilePath") and os.path.exists(os.path.join(d, cfg["dockerfilePath"])): return cfg["dockerfilePath"]
+    for c in ("Dockerfile", "docker/Dockerfile", "apps/web/Dockerfile"):
+        if os.path.exists(os.path.join(d, c)): return c
+    if os.path.exists(os.path.join(d, ".nixpacks", "Dockerfile")): return ".nixpacks/Dockerfile"
+    return None
+
+def workflow_name(s):
+    return "deploy-dev2.yml" if not s.get("shared_repo") else f"deploy-dev2-{s['site'].replace('.', '-')}.yml"
+
+def health_url(s, cfg):
+    hp = s.get("health_path") or cfg.get("healthcheckPath") or "/"
+    return f"https://{s['site']}{hp}", hp
+
+def cmd_scaffold(args):
+    s = site(args.site)
+    d = checkout_dir(s)
+    branch = s.get("branch") or default_branch(s["repo"])
+    log(f"Scaffold {s['site']}: {s['repo']}@{branch} in {d}")
+    sh(["git", "-C", d, "fetch", "-q", "origin", branch])
+    wt = tempfile.mkdtemp(prefix=f"dev2-{s['site']}-", dir=os.path.join(d, ".claude", "worktrees") if os.path.isdir(os.path.join(d, ".claude", "worktrees")) else os.environ.get("CLAUDE_JOB_DIR", tempfile.gettempdir()))
+    os.rmdir(wt)
+    wbranch = f"ops/dev2-deploy" if not s.get("shared_repo") else f"ops/dev2-deploy-{s['site'].replace('.', '-')}"
+    sh(["git", "-C", d, "worktree", "add", "-q", "-B", wbranch, wt, f"origin/{branch}"])
+    try:
+        cfg = repo_config(wt)
+        df = find_dockerfile(wt, cfg)
+        if not df:
+            log("No Dockerfile: generating one with nixpacks (the same builder Railway used)")
+            nix = shutil.which("nixpacks") or os.path.expanduser("~/.local/bin/nixpacks")
+            env = dict(os.environ)
+            if cfg.get("startCommand"): env["NIXPACKS_START_CMD"] = cfg["startCommand"]
+            sh([nix, "build", wt, "--out", wt], env=env)
+            gi = os.path.join(wt, ".gitignore")
+            if os.path.exists(gi) and re.search(r"^\.?nixpacks", open(gi).read(), re.M):
+                with open(gi, "a") as f: f.write("\n!.nixpacks\n")
+            df = ".nixpacks/Dockerfile"
+            if not os.path.exists(os.path.join(wt, df)): die("nixpacks produced no .nixpacks/Dockerfile")
+        hurl, hp = health_url(s, cfg)
+        wf = tmpl("deploy-dev2.yml").replace("__SITE__", s["site"]).replace("__BRANCH__", branch).replace("__HEALTH_URL__", hurl)
+        os.makedirs(os.path.join(wt, ".github", "workflows"), exist_ok=True)
+        with open(os.path.join(wt, ".github", "workflows", workflow_name(s)), "w") as f: f.write(wf)
+        for path in (".github/workflows", ".nixpacks", ".gitignore"):
+            if os.path.exists(os.path.join(wt, path)): sh(["git", "-C", wt, "add", "-A", path])
+        if not sh(["git", "-C", wt, "status", "--porcelain"]).strip():
+            note("nothing to commit: scaffold already on the branch")
+        else:
+            sh(["git", "-C", wt, "commit", "-q", "--no-verify", "-m", f"ops: deploy {s['site']} to dev2 on merge\n\nRailway deployed this on push; dev2 does not by itself. The workflow ssh's\nto the box and runs /home/anthony/www/{s['site']}/deploy-app.sh, which builds\nthe image from this checkout and restarts the compose stack. Generated by\ncli-tools dev2/dev2-site scaffold.\n\nCo-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>"])
+        sh(["git", "-C", wt, "push", "-q", "-u", "origin", f"+{wbranch}"])
+        pr = sh(["gh", "pr", "list", "--repo", s["repo"], "--head", wbranch, "--json", "url,number", "--jq", ".[0].url"]).strip()
+        if not pr:
+            pr = sh(["gh", "pr", "create", "--repo", s["repo"], "--head", wbranch, "--base", branch, "--title", f"ops: deploy {s['site']} to dev2 on merge",
+                     "--body", f"Moves {s['site']} off Railway onto dev2 (`/home/anthony/www/{s['site']}`). Adds the merge-to-deploy workflow" + (" and a nixpacks-generated Dockerfile" if df == ".nixpacks/Dockerfile" else "") + ".\n\nGenerated by cli-tools `dev2/dev2-site scaffold`.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)"]).strip()
+        note(f"PR {pr}")
+        mark(s["site"], "scaffold", pr=pr, scaffold_branch=wbranch, branch=branch, dockerfile=df, health_path=hp, checkout=d)
+    finally:
+        sh(["git", "-C", d, "worktree", "remove", "--force", wt], check=False)
+
+# --------------------------------------------------------------- render
+
+def env_quote(v):
+    s = "" if v is None else str(v)
+    if not re.search(r'[\n\r"#]|^\s|\s$', s): return s
+    return '"' + s.replace("\\", "\\\\").replace('"', '\\"') + '"'
+
+def render_env(vars_, s, st, service_name=None):
+    """Railway's rendered variables, minus Railway, with the data services re-pointed."""
+    out = {}
+    for k, v in sorted(vars_.items()):
+        if k.startswith("RAILWAY_"): continue
+        if k in ("PORT",) and not s.get("port_var"): continue
+        out[k] = v
+    if s["db"] == "pg" and st.get("database_url"):
+        for k, v in list(out.items()):
+            if isinstance(v, str) and re.search(r"postgres(ql)?://", v) and ("railway.internal" in v or ".rlwy.net" in v):
+                out[k] = st["database_url"]
+        for k in ("PGHOST", "PGPORT", "PGUSER", "PGPASSWORD", "PGDATABASE"):
+            if k in out:
+                out[k] = {"PGHOST": DEV2_HOST, "PGPORT": "5432", "PGUSER": st["db_user"], "PGPASSWORD": st["db_password"], "PGDATABASE": st["db_name"]}[k]
+    if s["redis"]:
+        for k, v in list(out.items()):
+            if isinstance(v, str) and "redis" in v.lower() and "railway.internal" in v:
+                out[k] = "redis://redis:6379"
+            if k in ("REDISHOST",): out[k] = "redis"
+            if k in ("REDISPORT",): out[k] = "6379"
+            if k in ("REDISPASSWORD", "REDIS_PASSWORD"): out[k] = ""
+            if k in ("REDISUSER",): out[k] = "default"
+    for k, v in (s.get("env_overrides") or {}).items(): out[k] = v
+    lines = [f"# {s['site']}{' ' + service_name if service_name else ''}: rendered by dev2-site provision from Railway on {dt.datetime.now(dt.timezone.utc).isoformat(timespec='seconds')}"]
+    lines += [f"{k}={env_quote(v)}" for k, v in out.items()]
+    return "\n".join(lines) + "\n", out
+
+def render_compose(s, st, app_port_inside):
+    df = st.get("dockerfile") or "Dockerfile"
+    img = s["site"].replace(".", "-")
+    y = [f"# {s['site']} on dev2: rendered by cli-tools dev2/dev2-site provision. Re-run provision to change.",
+         "# nginx on the host terminates TLS and proxies to 127.0.0.1:${APP_PORT}.", "services:"]
+    def service(name, envfile, command=None, ports=True, vols=()):
+        y.append(f"  {name}:")
+        y.append(f"    build:\n      context: ./app\n      dockerfile: {df}")
+        y.append(f"    image: {img}-{name}:latest\n    restart: unless-stopped\n    env_file: {envfile}")
+        y.append(f"    environment:\n      PORT: \"{app_port_inside}\"\n      HOST: \"0.0.0.0\"\n      NODE_ENV: production")
+        if command: y.append(f"    command: {json.dumps(shlex.split(command))}")
+        if ports: y.append(f"    ports:\n      - \"127.0.0.1:${{APP_PORT}}:{app_port_inside}\"")
+        if vols:
+            y.append("    volumes:")
+            for v in vols: y.append(f"      - ./volumes/{v['name']}:{v['mountPath']}")
+        if s["redis"]:
+            y.append("    depends_on:\n      redis:\n        condition: service_started")
+        y.append("    logging:\n      driver: json-file\n      options: { max-size: \"50m\", max-file: \"3\" }")
+    service("app", "app.env", command=s.get("start_command"), vols=s["volumes"])
+    for c in s["companions"]:
+        service(c["name"], f"{c['name']}.env", command=(s.get("companion_commands") or {}).get(c["name"]), ports=False, vols=c.get("volumes", []))
+    if s["redis"]:
+        y.append("  redis:\n    image: redis:8-alpine\n    restart: unless-stopped\n    command: [\"redis-server\", \"--appendonly\", \"yes\", \"--maxmemory\", \"1gb\", \"--maxmemory-policy\", \"noeviction\"]\n    volumes:\n      - redisdata:/data\n    logging:\n      driver: json-file\n      options: { max-size: \"20m\", max-file: \"2\" }")
+        y.append("volumes:\n  redisdata:")
+    return "\n".join(y) + "\n"
+
+# -------------------------------------------------------------- provision
+
+def deploy_key(repo):
+    """One ed25519 key per repo (GitHub secrets are per repo). Private half stays in state."""
+    slug = repo.replace("/", "__")
+    path = os.path.join(STATE_DIR, "deploy-keys", slug)
+    if not os.path.exists(path):
+        os.makedirs(os.path.dirname(path), mode=0o700, exist_ok=True)
+        sh(["ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", f"github-actions-deploy@{repo}", "-f", path])
+    return path
+
+def cmd_provision(args):
+    s = site(args.site); st = load_state(s["site"])
+    root = f"{WWW}/{s['site']}"
+    log(f"Provision {s['site']} -> {DEV2_HOST}:{root} (port {s['port']})")
+    if s["db"] == "pg" and not st.get("database_url"): die("run `dev2-site db` first (the app env needs the new DATABASE_URL)")
+    if s["db"] in ("supabase", "turso") and not st.get("database_url") and not s.get("env_overrides"):
+        warn(f"db kind {s['db']}: app.env keeps pointing at the current {s['db']} until its own migration; set env_overrides in sites.overrides.json when ready")
+    vars_ = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
+    inside = s.get("port_var") or "3000"
+    app_env, merged = render_env(vars_, s, st)
+    cfg = repo_config(st.get("checkout") or checkout_dir(s))
+    if not st.get("dockerfile"):
+        st["dockerfile"] = find_dockerfile(st.get("checkout") or checkout_dir(s), cfg) or ".nixpacks/Dockerfile"
+    branch = st.get("branch") or s.get("branch") or default_branch(s["repo"])
+    hp = st.get("health_path") or health_url(s, cfg)[1]
+    compose = render_compose(s, st, inside)
+    build_services = " ".join(["app"] + [c["name"] for c in s["companions"]])
+    deploy_env = f"SITE={s['site']}\nREPO=https://github.com/{s['repo']}.git\nBRANCH={branch}\nAPP_PORT={s['port']}\nBUILD_SERVICES={build_services}\nHEALTH_PATH={hp}\n"
+    ssh("root", f"install -d -m 2755 -o {DEPLOY_USER} -g {DEPLOY_USER} {root} {root}/volumes")
+    for v in s["volumes"] + [v for c in s["companions"] for v in c.get("volumes", [])]:
+        ssh("root", f"install -d -m 0777 {root}/volumes/{shlex.quote(v['name'])}")
+    own = f"{DEPLOY_USER}:{DEPLOY_USER}"
+    ssh_put(app_env, f"{root}/app.env", "0600", own)
+    for c in s["companions"]:
+        cv = rw_variables(s["project_id"], s["environment_id"], c["id"])
+        cenv, _ = render_env(cv, s, st, c["name"])
+        ssh_put(cenv, f"{root}/{c['name']}.env", "0600", own)
+    ssh_put(deploy_env, f"{root}/deploy.env", "0640", own)
+    ssh_put(compose, f"{root}/docker-compose.app.yml", "0640", own)
+    ssh_put(tmpl("deploy-app.sh"), f"{root}/deploy-app.sh", "0755", own)
+    note(f"{len(merged)} variables in app.env, {len(s['companions'])} companion env files, compose + deploy-app.sh installed")
+    # Deploy key + GitHub secrets
+    key = deploy_key(s["repo"])
+    pub = open(key + ".pub").read().strip()
+    ssh("root", f"install -d -m 700 -o {DEPLOY_USER} -g {DEPLOY_USER} /home/{DEPLOY_USER}/.ssh; touch /home/{DEPLOY_USER}/.ssh/authorized_keys; chown {DEPLOY_USER}:{DEPLOY_USER} /home/{DEPLOY_USER}/.ssh/authorized_keys; chmod 600 /home/{DEPLOY_USER}/.ssh/authorized_keys; grep -qF {shlex.quote(pub)} /home/{DEPLOY_USER}/.ssh/authorized_keys || echo {shlex.quote(pub)} >> /home/{DEPLOY_USER}/.ssh/authorized_keys")
+    known = sh(["ssh-keyscan", "-t", "ed25519,rsa", DEV2_HOST], check=False)
+    for name, val in (("DEV2_SSH_KEY", open(key).read()), ("DEV2_KNOWN_HOSTS", known), ("DEV2_HOST", DEV2_HOST), ("DEV2_USER", DEPLOY_USER)):
+        sh(["gh", "secret", "set", name, "--repo", s["repo"]], input=val)
+    note(f"deploy key {os.path.basename(key)} authorized on dev2; DEV2_* secrets set on {s['repo']}")
+    mark(s["site"], "provision", root=root, branch=branch, health_path=hp, dockerfile=st["dockerfile"], checkout=st.get("checkout") or checkout_dir(s))
+
+# ------------------------------------------------------------------- db
+
+def cluster_pg_password():
+    return ssh("root", f"grep '^POSTGRES_PASSWORD=' {CLUSTER_ENV} | cut -d= -f2-").strip()
+
+def pg_admin(sql, db="postgres"):
+    return ssh("root", f"docker exec -i {PG_CONTAINER} psql -U supabase_admin -h localhost -d {shlex.quote(db)} -X -At -v ON_ERROR_STOP=1", input=sql)
+
+def db_name_for(s):
+    return s.get("db_name") or re.sub(r"[^a-z0-9]+", "_", s["site"].lower()).strip("_")
+
+def cmd_db(args):
+    s = site(args.site); st = load_state(s["site"])
+    if s["db"] != "pg": die(f"{s['site']} db kind is {s['db']}; `db` copies Railway Postgres only (see README for supabase/turso)")
+    pgs = [i for i in s["infra"] if i["role"] == "pg"]
+    if not pgs: die(f"no Postgres service found beside {s['site']} in project {s['project']}; set infra in sites.overrides.json")
+    want = s.get("pg_service") or (s.get("db_host") or "").split(".")[0]
+    pg = next((p for p in pgs if p["name"] == want or slug(p["name"]) == want), None)
+    if pg is None:
+        if len(pgs) > 1: die(f"{len(pgs)} Postgres services in the project ({', '.join(p['name'] for p in pgs)}) and none matches {want!r}; set pg_service in sites.overrides.json")
+        pg = pgs[0]
+    db = db_name_for(s)
+    log(f"Database {db} in the shared cluster, copied from Railway {s['project']}/{pg['name']}")
+    pw = cluster_pg_password()
+    # The app connects as `postgres` (the only role pg_hba lets in from another compose
+    # network); isolation is one database per app, same as nichedb and rssamplifier.
+    exists = pg_admin(f"select count(*) from pg_database where datname='{db}'").strip()
+    if exists == "0":
+        pg_admin(f'create database "{db}" owner postgres'); note(f"created database {db}")
+    else:
+        note(f"database {db} exists")
+        if not args.force and pg_admin("select count(*) from pg_tables where schemaname='public'", db).strip() != "0":
+            die(f"{db} already has tables; re-run with --force to drop and reload")
+        if args.force:
+            pg_admin("drop schema public cascade; create schema public; grant all on schema public to postgres, public", db); note("dropped public schema")
+    st.update({"db_name": db, "db_user": "postgres", "db_password": pw,
+               "database_url": f"postgres://postgres:{pw}@{DEV2_HOST}:5432/{db}?sslmode=require"})
+    save_state(s["site"], st)
+    # Dump inside the Railway container (pg_dump matches the server there) and stream to dev2.
+    user = rw_ssh_user(s["project_id"], s["environment_id"], pg["name"])
+    pgvars = rw_variables(s["project_id"], s["environment_id"], pg["id"])
+    src_db = pgvars.get("PGDATABASE") or pgvars.get("POSTGRES_DB") or "railway"
+    dump = f"/root/dumps/{db}-{dt.datetime.now(dt.timezone.utc).strftime('%Y%m%dT%H%M%SZ')}.dump"
+    ssh("root", "install -d -m 700 /root/dumps")
+    log(f"pg_dump {src_db} via ssh.railway.com -> {DEV2_HOST}:{dump}")
+    remote = f"PGPASSWORD=\"$PGPASSWORD\" pg_dump -Fc --no-owner --no-privileges -h localhost -U \"${{PGUSER:-postgres}}\" -d {shlex.quote(src_db)}"
+    cmd = " ".join(map(shlex.quote, rw_ssh_cmd(user, remote))) + f" | ssh -o BatchMode=yes root@{DEV2_HOST} 'cat > {dump}'"
+    sh(cmd, capture=False, timeout=6 * 3600)
+    size = ssh("root", f"stat -c%s {dump}").strip()
+    note(f"dump {int(size)/1e6:.1f} MB")
+    if int(size) < 1000: die("dump is suspiciously small; check the Railway ssh user and PG variables")
+    log("pg_restore into the cluster")
+    toc = ssh("root", f"docker run --rm -i -v /root/dumps:/dumps:ro postgres:17 pg_restore -l /dumps/{os.path.basename(dump)}", check=False)
+    ext = sorted({m.group(1) for m in re.finditer(r"^\d+; \d+ \d+ EXTENSION - (\S+)", toc, re.M)})
+    for e in ext:
+        if e in ("plpgsql",): continue
+        pg_admin(f'create extension if not exists "{e}" cascade', db); note(f"extension {e}")
+    out = ssh("root", f"docker exec -i {PG_CONTAINER} pg_restore -U postgres -h localhost -d {shlex.quote(db)} --no-owner --no-privileges --exit-on-error < {dump} 2>&1 | tail -n 20", check=False)
+    if out.strip(): note(out.strip())
+    st["dump"] = dump; save_state(s["site"], st)
+    log("Verifying row counts (source vs target)")
+    count_sql = "select relname from pg_class c join pg_namespace n on n.oid=c.relnamespace where n.nspname='public' and c.relkind='r' order by 1"
+    tables = ssh("root", f"docker exec -i {PG_CONTAINER} psql -U postgres -h localhost -d {shlex.quote(db)} -X -At", input=count_sql).split()
+    q = " union all ".join(f"select '{t}', count(*) from \"{t}\"" for t in tables) if tables else "select 'none', 0"
+    tgt = ssh("root", f"docker exec -i {PG_CONTAINER} psql -U postgres -h localhost -d {shlex.quote(db)} -X -At -F' '", input=q)
+    src = sh(rw_ssh_cmd(user, f"PGPASSWORD=\"$PGPASSWORD\" psql -h localhost -U \"${{PGUSER:-postgres}}\" -d {shlex.quote(src_db)} -X -At -F' '"), input=q)
+    tgt_c = dict(l.split(" ", 1) for l in tgt.split("\n") if l.strip()); src_c = dict(l.split(" ", 1) for l in src.split("\n") if l.strip())
+    bad = [(t, src_c.get(t), tgt_c.get(t)) for t in tables if src_c.get(t) != tgt_c.get(t)]
+    note(f"{len(tables)} tables, {sum(int(v) for v in tgt_c.values())} rows on dev2")
+    for t, a, b in bad: warn(f"{t}: source {a} vs dev2 {b} (writes continue on Railway until DNS moves; re-run db --force at cutover if the gap matters)")
+    mark(s["site"], "db", db_tables=len(tables), db_rows=sum(int(v) for v in tgt_c.values()), db_mismatch=[t for t, _, _ in bad])
+
+def cmd_refresh_db(args):
+    """Re-copy the database seconds before DNS moves (writes kept landing on Railway
+    while the box was being set up), then restart the app so no connection holds
+    the old schema."""
+    s = site(args.site)
+    cmd_db(argparse.Namespace(site=s["site"], force=True))
+    ssh(DEPLOY_USER, f"cd {WWW}/{s['site']} && docker compose -f docker-compose.app.yml --env-file deploy.env restart", timeout=600)
+    note("app restarted on the refreshed database")
+    mark(s["site"], "refresh-db")
+
+def cmd_volumes(args):
+    s = site(args.site); st = load_state(s["site"])
+    root = f"{WWW}/{s['site']}"
+    targets = [(s["service"], v) for v in s["volumes"]] + [(c["name"], v) for c in s["companions"] for v in c.get("volumes", [])]
+    if not targets: note("no volumes"); mark(s["site"], "volumes"); return
+    for svc, v in targets:
+        user = rw_ssh_user(s["project_id"], s["environment_id"], svc)
+        log(f"Volume {v['name']} ({v['sizeMB']} MB) from {svc}:{v['mountPath']} -> {root}/volumes/{v['name']}")
+        cmd = " ".join(map(shlex.quote, rw_ssh_cmd(user, f"tar -C {shlex.quote(v['mountPath'])} -cf - ."))) + \
+              f" | ssh -o BatchMode=yes root@{DEV2_HOST} 'tar -C {root}/volumes/{shlex.quote(v['name'])} -xf - && chmod -R a+rwX {root}/volumes/{shlex.quote(v['name'])} && du -sh {root}/volumes/{shlex.quote(v['name'])}'"
+        note(sh(cmd, timeout=6 * 3600).strip())
+    mark(s["site"], "volumes")
+
+# ----------------------------------------------------------- box steps
+
+def cmd_deploy(args):
+    s = site(args.site); st = load_state(s["site"])
+    ref = args.ref or st.get("scaffold_branch") or st.get("branch") or s.get("branch") or "main"
+    log(f"Deploy {s['site']} @ {ref} on dev2 (as {DEPLOY_USER})")
+    out = ssh(DEPLOY_USER, f"{WWW}/{s['site']}/deploy-app.sh {shlex.quote(ref)}", check=False, timeout=3600)
+    print(out[-4000:])
+    if "Healthy on" not in out: die("deploy did not report healthy; see output above")
+    mark(s["site"], "deploy", deployed_ref=ref)
+
+def porkbun_keys():
+    f = os.path.expanduser("~/.config/cli-tools/credentials.json")
+    c = json.load(open(f))
+    def get(*names):
+        for n in names:
+            v = c.get(n)
+            if isinstance(v, dict): v = v.get("value")
+            if v: return v
+        return os.environ.get(names[-1])
+    k, sk = get("porkbun", "PORKBUN_API_KEY"), get("porkbun_secret", "PORKBUN_SECRET_API_KEY")
+    if not (k and sk): die("no Porkbun keys in ~/.config/cli-tools/credentials.json (cli-tools config pull)")
+    return k, sk
+
+def cmd_cert(args):
+    s = site(args.site)
+    domains = list(dict.fromkeys(s["domains"] + ([f"www.{s['site']}"] if s["site"].count(".") == 1 and f"www.{s['site']}" not in s["domains"] else [])))
+    k, sk = porkbun_keys()
+    cert_dir = f"/etc/nginx/ssl/{s['site']}"
+    log(f"Certificate for {', '.join(domains)} (acme.sh, Porkbun DNS-01, issued before DNS moves)")
+    ssh("root", "test -x /root/.acme.sh/acme.sh || curl -fsSL https://get.acme.sh | env HOME=/root sh -s email=" + ACME_EMAIL + " >/dev/null")
+    ds = " ".join(f"-d {shlex.quote(d)}" for d in domains)
+    out = ssh("root", f"install -d -m 0750 {cert_dir} && env HOME=/root PORKBUN_API_KEY={shlex.quote(k)} PORKBUN_SECRET_API_KEY={shlex.quote(sk)} /root/.acme.sh/acme.sh --issue --server letsencrypt --dns dns_porkbun {ds} --force >/tmp/acme-{s['site']}.log 2>&1 || {{ tail -n 25 /tmp/acme-{s['site']}.log; exit 1; }}", check=False, timeout=1800)
+    if out.strip() and "Cert success" not in out: die(out)
+    ssh("root", f"env HOME=/root /root/.acme.sh/acme.sh --install-cert -d {shlex.quote(domains[0])} --fullchain-file {cert_dir}/fullchain.pem --key-file {cert_dir}/privkey.pem --reloadcmd 'systemctl reload nginx' >/dev/null")
+    note(ssh("root", f"openssl x509 -in {cert_dir}/fullchain.pem -noout -subject -enddate | tr '\\n' ' '").strip())
+    mark(s["site"], "cert", cert_domains=domains)
+
+def cmd_vhost(args):
+    s = site(args.site)
+    domains = list(dict.fromkeys(s["domains"] + ([f"www.{s['site']}"] if s["site"].count(".") == 1 else [])))
+    ssh("root", f"test -s /etc/nginx/ssl/{s['site']}/fullchain.pem") if not args.no_cert_check else None
+    conf = tmpl("nginx-vhost.conf").replace("__SITE__", s["site"]).replace("__APP_PORT__", str(s["port"])).replace("__SERVER_NAMES__", " ".join(domains)).replace("__MAX_BODY__", s.get("max_body", "64m"))
+    log(f"nginx vhost {s['site']} -> 127.0.0.1:{s['port']} ({', '.join(domains)})")
+    ssh_put(conf, f"/tmp/dev2-site-{s['site']}.conf", "0644")
+    ssh("root", f"f=/etc/nginx/sites-available/{s['site']}; if [ -e $f ]; then n=1; while [ -e $f.bak-$(printf %03d $n) ]; do n=$((n+1)); done; cp -a $f $f.bak-$(printf %03d $n); fi; install -m 0644 /tmp/dev2-site-{s['site']}.conf $f && ln -sf $f /etc/nginx/sites-enabled/{s['site']} && nginx -t 2>&1 | tail -n1 && systemctl reload nginx")
+    mark(s["site"], "vhost")
+
+def cmd_verify(args):
+    s = site(args.site); st = load_state(s["site"])
+    hp = st.get("health_path") or "/"
+    ok = True
+    for d in s["domains"]:
+        resolve = [] if args.public else ["--resolve", f"{d}:443:{DEV2_IP}"]
+        code = sh(["curl", "-sk", "-o", "/dev/null", "-m", "30", "-w", "%{http_code}", *resolve, f"https://{d}{hp}"], check=False).strip()
+        good = code[:1] in ("2", "3") or code in ("401", "403")
+        ok &= good
+        note(f"{d}{hp} -> {code} {'ok' if good else 'FAIL'}{' (pinned to dev2)' if not args.public else ''}")
+    if not ok: die("verify failed")
+    mark(s["site"], "verify-public" if args.public else "verify")
+
+def cmd_dns(args):
+    s = site(args.site)
+    domains = list(dict.fromkeys(s["domains"] + ([f"www.{s['site']}"] if s["site"].count(".") == 1 else [])))
+    zones = {}
+    for d in domains:
+        zone = ".".join(d.split(".")[-2:]); zones.setdefault(zone, []).append(d)
+    os.makedirs(os.path.join(STATE_DIR, "dns"), exist_ok=True)
+    for zone, ds in zones.items():
+        log(f"Porkbun {zone}: {', '.join(ds)} -> A {DEV2_IP}")
+        backup = os.path.join(STATE_DIR, "dns", f"{zone}.{dt.datetime.now(dt.timezone.utc).strftime('%Y%m%dT%H%M%SZ')}.json")
+        with open(backup, "w") as f: f.write(sh(["porkbun", "ls", zone, "--json"]))
+        recs = json.load(open(backup))
+        recs = recs.get("records", recs) if isinstance(recs, dict) else recs
+        for d in ds:
+            host = "@" if d == zone else d[: -len(zone) - 1]
+            if host.startswith("*"): note(f"{d}: wildcard; set A * manually if needed"); host = "*"
+            for r in recs:
+                if r.get("name") == d and r.get("type") in ("ALIAS", "CNAME", "A", "AAAA"):
+                    sh(["porkbun", "rm", zone, host, "--type", r["type"], "--yes"], check=False)
+            sh(["porkbun", "set", zone, host, "A", DEV2_IP, "--ttl", "600"])
+            for r in recs:
+                if r.get("name") == f"_railway-verify.{d}" and r.get("type") == "TXT":
+                    sh(["porkbun", "rm", zone, f"_railway-verify.{host}" if host != "@" else "_railway-verify", "--type", "TXT", "--yes"], check=False)
+            note(f"{d} -> A {DEV2_IP}")
+    mark(s["site"], "dns", dns_flipped=dt.datetime.now(dt.timezone.utc).isoformat(timespec="seconds"))
+
+def cmd_railway_stop(args):
+    s = site(args.site)
+    for svc in [{"name": s["service"], "id": s["service_id"]}] + s["companions"]:
+        log(f"Railway: stop {s['project']}/{svc['name']} and disconnect its repo watch")
+        for d in rw_deployments(s["project_id"], s["environment_id"], svc["id"]):
+            if d["status"] in ("SUCCESS", "BUILDING", "DEPLOYING", "INITIALIZING", "WAITING", "SLEEPING", "CRASHED", "NEEDS_APPROVAL"):
+                try:
+                    gql("mutation($id:String!){deploymentRemove(id:$id)}", {"id": d["id"]}); note(f"removed deployment {d['id'][:8]} ({d['status']})")
+                except RuntimeError as e:
+                    if "not stoppable" in str(e).lower() or "BUILDING" in d["status"]:
+                        gql("mutation($id:String!){deploymentCancel(id:$id)}", {"id": d["id"]}); note(f"cancelled {d['id'][:8]}")
+                    else: warn(str(e)[:200])
+        try:
+            gql("mutation($id:String!){serviceDisconnect(id:$id){id}}", {"id": svc["id"]}); note("repo disconnected (a push no longer redeploys on Railway)")
+        except RuntimeError as e: warn(f"serviceDisconnect: {str(e)[:200]}")
+    mark(s["site"], "railway-stop")
+
+def cmd_merge(args):
+    s = site(args.site); st = load_state(s["site"])
+    pr = st.get("pr")
+    if not pr: die("no scaffold PR in state")
+    log(f"Merging {pr}")
+    for _ in range(60):
+        state = sh(["gh", "pr", "view", pr, "--json", "state,mergeable,statusCheckRollup", "--jq", "[.state, .mergeable, ([.statusCheckRollup[]? | .conclusion // .status] | join(\",\"))] | join(\" \")"]).strip()
+        st_, mergeable, checks = (state.split(" ") + ["", ""])[:3]
+        if st_ == "MERGED": note("already merged"); break
+        pending = any(c in checks for c in ("IN_PROGRESS", "QUEUED", "PENDING", "EXPECTED"))
+        failed = any(c in checks for c in ("FAILURE", "CANCELLED", "TIMED_OUT", "ACTION_REQUIRED"))
+        if failed: die(f"checks failed on {pr}: {checks}")
+        if not pending:
+            sh(["gh", "pr", "merge", pr, "--squash", "--delete-branch"], check=False)
+            if sh(["gh", "pr", "view", pr, "--json", "state", "--jq", ".state"]).strip() == "MERGED": note("merged"); break
+            sh(["gh", "pr", "merge", pr, "--squash", "--delete-branch", "--admin"], check=False)
+        time.sleep(20)
+    mark(s["site"], "merge")
+
+def cmd_migrate(args):
+    s = site(args.site); st = load_state(s["site"])
+    steps = [("scaffold", cmd_scaffold), ("db", cmd_db) if s["db"] == "pg" else None, ("provision", cmd_provision), ("volumes", cmd_volumes),
+             ("deploy", cmd_deploy), ("cert", cmd_cert), ("vhost", cmd_vhost), ("verify", cmd_verify),
+             ("refresh-db", cmd_refresh_db) if s["db"] == "pg" else None, ("dns", cmd_dns),
+             ("railway-stop", cmd_railway_stop), ("merge", cmd_merge), ("verify-public", cmd_verify)]
+    for step in filter(None, steps):
+        name, fn = step
+        if name in st["steps"] and not args.redo: note(f"{name}: done {st['steps'][name]}"); continue
+        if name == "dns" and not args.yes and not args.__dict__.get("no_confirm"):
+            if not sys.stdin.isatty(): die("dns flip needs --yes when non-interactive")
+            if input(f"Flip DNS for {', '.join(s['domains'])} to dev2 now? [y/N] ").strip().lower() != "y": die("stopped before DNS")
+        ns = argparse.Namespace(site=s["site"], ref=None, force=(name == "refresh-db"), public=(name == "verify-public"), no_cert_check=False, redo=False, yes=True)
+        fn(ns)
+        st = load_state(s["site"])
+    mark(s["site"], "migrated")
+    log(f"{s['site']} is on dev2. Railway services left for `dev2-site retire {s['site']} --yes`: {', '.join([s['service']] + [c['name'] for c in s['companions']] + [i['name'] for i in s['infra']])}")
+
+def cmd_retire(args):
+    s = site(args.site); st = load_state(s["site"])
+    if "verify-public" not in st["steps"] and not args.force: die("site not verified public on dev2; refuse to delete Railway services (or --force)")
+    if not args.yes: die("--yes required")
+    targets = [{"name": s["service"], "id": s["service_id"]}] + s["companions"] + s["infra"]
+    for t in targets:
+        log(f"Railway: delete {s['project']}/{t['name']}")
+        try: gql("mutation($id:String!){serviceDelete(id:$id)}", {"id": t["id"]}); note("deleted")
+        except RuntimeError as e: warn(str(e)[:200])
+    mark(s["site"], "retire")
+
+# ----------------------------------------------------------------- main
+
+def main():
+    ap = argparse.ArgumentParser(prog="dev2-site", description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    sub = ap.add_subparsers(dest="cmd", required=True)
+    sub.add_parser("registry").set_defaults(fn=cmd_registry)
+    p = sub.add_parser("list"); p.add_argument("--kind"); p.add_argument("--status"); p.set_defaults(fn=cmd_list)
+    for name, fn in (("show", cmd_show), ("scaffold", cmd_scaffold), ("provision", cmd_provision), ("volumes", cmd_volumes), ("cert", cmd_cert),
+                     ("dns", cmd_dns), ("railway-stop", cmd_railway_stop), ("merge", cmd_merge)):
+        p = sub.add_parser(name); p.add_argument("site"); p.set_defaults(fn=fn)
+    p = sub.add_parser("db"); p.add_argument("site"); p.add_argument("--force", action="store_true"); p.set_defaults(fn=cmd_db)
+    p = sub.add_parser("deploy"); p.add_argument("site"); p.add_argument("ref", nargs="?"); p.set_defaults(fn=cmd_deploy)
+    p = sub.add_parser("vhost"); p.add_argument("site"); p.add_argument("--no-cert-check", action="store_true"); p.set_defaults(fn=cmd_vhost)
+    p = sub.add_parser("verify"); p.add_argument("site"); p.add_argument("--public", action="store_true"); p.set_defaults(fn=cmd_verify)
+    p = sub.add_parser("refresh-db"); p.add_argument("site"); p.set_defaults(fn=cmd_refresh_db)
+    p = sub.add_parser("migrate"); p.add_argument("site"); p.add_argument("--yes", action="store_true"); p.add_argument("--redo", action="store_true"); p.set_defaults(fn=cmd_migrate)
+    p = sub.add_parser("retire"); p.add_argument("site"); p.add_argument("--yes", action="store_true"); p.add_argument("--force", action="store_true"); p.set_defaults(fn=cmd_retire)
+    args = ap.parse_args()
+    try: args.fn(args)
+    except RuntimeError as e: die(str(e))
+
+if __name__ == "__main__":
+    main()
diff --git a/dev2/sites.json b/dev2/sites.json
new file mode 100644
index 0000000..1b24ac9
--- /dev/null
+++ b/dev2/sites.json
@@ -0,0 +1,2753 @@
+{
+ "generated_at": "2026-09-25T09:22:59+00:00",
+ "dev2": {
+  "host": "dev2.profullstack.com",
+  "ip": "23.95.228.174"
+ },
+ "sites": {
+  "advis0r.com": {
+   "site": "advis0r.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "advis0r.com",
+   "service_id": "ffa577ce-ae37-4fe8-8981-46e1a751119d",
+   "repo": "profullstack/advis0r.com",
+   "image": null,
+   "domains": [
+    "advis0r.com",
+    "www.advis0r.com"
+   ],
+   "railway_domains": [
+    "advis0r.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3277
+  },
+  "agenticjobs.work": {
+   "site": "agenticjobs.work",
+   "project": "agenticjobs",
+   "project_id": "a14390f1-b9be-42ed-9b1b-a190c951f42d",
+   "environment_id": "f6ccb1aa-844d-4ed6-8ad5-6051bfb21000",
+   "service": "web",
+   "service_id": "a63f1af8-014e-4e98-9a2f-39da42810d84",
+   "repo": "profullstack/agenticjobs",
+   "image": null,
+   "domains": [
+    "www.agenticjobs.work",
+    "agenticjobs.work"
+   ],
+   "railway_domains": [],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": "postgres.railway.internal",
+   "redis_host": null,
+   "infra": [
+    {
+     "name": "Postgres",
+     "id": "18bdb97c-3b41-4edd-a0c4-a319f9559f5f",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume",
+       "id": "6df559c8-3b43-46c8-8678-315b168bc80e",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 1146
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3214
+  },
+  "aiornot.vote": {
+   "site": "aiornot.vote",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "aiornot.vote",
+   "service_id": "db027ffb-534d-4247-b730-86ece253b1a7",
+   "repo": "profullstack/aiornot.vote",
+   "image": null,
+   "domains": [
+    "aiornot.vote",
+    "www.aiornot.vote"
+   ],
+   "railway_domains": [
+    "aiornot.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "aiornot.vote-volume",
+     "id": "7dc3bc20-a3cd-4f72-8697-d745f008127c",
+     "mountPath": "/data",
+     "sizeMB": 1510
+    }
+   ],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3269
+  },
+  "app.logicsrc.com": {
+   "site": "app.logicsrc.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "app.logicsrc.com",
+   "service_id": "262dd5a9-a0e2-4593-8971-f89ba9b8d463",
+   "repo": "profullstack/logicsrc",
+   "image": null,
+   "domains": [
+    "app.logicsrc.com"
+   ],
+   "railway_domains": [
+    "logicsrc-credentials-production.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": true,
+   "port": 3229
+  },
+  "app.moshcode.sh": {
+   "site": "app.moshcode.sh",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "moshcode",
+   "service_id": "a42fe297-0c08-44d6-b522-bb5144fdf3ef",
+   "repo": "moshcoder/moshcode",
+   "image": null,
+   "domains": [
+    "app.moshcode.sh",
+    "pit.moshcode.sh"
+   ],
+   "railway_domains": [
+    "app-moshcode.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3253
+  },
+  "avenasea.com": {
+   "site": "avenasea.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "avenasea.com",
+   "service_id": "10cad33c-4ea1-4985-bc4e-616077870184",
+   "repo": "avenasea/avenasea-web",
+   "image": null,
+   "domains": [
+    "avenasea.com",
+    "www.avenasea.com"
+   ],
+   "railway_domains": [
+    "avenaseacom-production.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3224
+  },
+  "b1dz.com": {
+   "site": "b1dz.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "b1dz.com",
+   "service_id": "5287943c-f7c4-4b03-94c3-ba87cd3e9ec3",
+   "repo": "profullstack/b1dz.com",
+   "image": null,
+   "domains": [
+    "b1dz.com",
+    "www.b1dz.com"
+   ],
+   "railway_domains": [
+    "web-production-2ff45.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3240
+  },
+  "bbs.hqtui.com": {
+   "site": "bbs.hqtui.com",
+   "project": "bbs.hqtui.com",
+   "project_id": "8b87e9fd-9fb5-4bdd-adbb-08e898013716",
+   "environment_id": "dac3c02b-909b-4e94-9738-36ff209111ab",
+   "service": "bbs",
+   "service_id": "ee0b6928-56e6-4e90-803d-6229fc35ba32",
+   "repo": "profullstack/tsbb",
+   "image": null,
+   "domains": [
+    "bbs.hqtui.com"
+   ],
+   "railway_domains": [],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "bbs-volume",
+     "id": "51e0252d-3066-4fea-91fa-96eabab44cf8",
+     "mountPath": "/app/data",
+     "sizeMB": 1400
+    }
+   ],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3218
+  },
+  "bg0ne.com": {
+   "site": "bg0ne.com",
+   "project": "bg0ne.com",
+   "project_id": "c1682f92-c096-459b-b52d-420e31c1768f",
+   "environment_id": "0bf0cc6c-23ec-4f23-bed5-0072b6750ae9",
+   "service": "bg0ne",
+   "service_id": "4c9ccb38-21dd-4ae8-b384-64eb51958fa9",
+   "repo": "profullstack/bg0ne.com",
+   "image": null,
+   "domains": [
+    "bg0ne.com",
+    "www.bg0ne.com"
+   ],
+   "railway_domains": [],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": "postgres.railway.internal",
+   "redis_host": null,
+   "infra": [
+    {
+     "name": "Postgres",
+     "id": "fae6babd-240d-448e-98ff-5e73d1aef6b4",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume",
+       "id": "c0d89f21-22b5-479d-b653-de22b838595d",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 884
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3201
+  },
+  "bl0ggers.com": {
+   "site": "bl0ggers.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "bl0ggers.com",
+   "service_id": "ab99794c-c03e-4917-bc3f-87eff2551a5e",
+   "repo": "profullstack/bl0ggers",
+   "image": null,
+   "domains": [
+    "bl0ggers.com",
+    "*.bl0ggers.com"
+   ],
+   "railway_domains": [
+    "bl0ggers-production.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3257
+  },
+  "brisk.news": {
+   "site": "brisk.news",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "brisk.news",
+   "service_id": "5043992d-20e9-4ff6-8993-d65986a503cd",
+   "repo": "profullstack/brisk.news",
+   "image": null,
+   "domains": [
+    "www.brisk.news",
+    "brisk.news"
+   ],
+   "railway_domains": [
+    "brisknews-production.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": true,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": "redis.railway.internal",
+   "infra": [
+    {
+     "name": "Redis",
+     "id": "b4cbc724-fa68-4513-acf6-c06f3cc9346f",
+     "role": "redis",
+     "image": "redis:8.2.9",
+     "volumes": [
+      {
+       "name": "redis-volume",
+       "id": "39dde17d-9ffd-410c-91da-85d54cf6efd9",
+       "mountPath": "/data",
+       "sizeMB": 1591
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3238
+  },
+  "bufferoverride.com": {
+   "site": "bufferoverride.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "bufferoverride",
+   "service_id": "91b06d88-9d05-41a2-8c1f-a77402bc1f8f",
+   "repo": "profullstack/bufferoverride",
+   "image": null,
+   "domains": [
+    "bufferoverride.com",
+    "www.bufferoverride.com"
+   ],
+   "railway_domains": [
+    "bufferoverride.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "bufferoverride-volume",
+     "id": "3700e8a9-b9e3-4ec5-9c1d-3cfbb1751adc",
+     "mountPath": "/data",
+     "sizeMB": 791
+    }
+   ],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3251
+  },
+  "c0mpute.com": {
+   "site": "c0mpute.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "c0mpute.com",
+   "service_id": "a4c2fc8a-a78b-4bd9-967c-8137fca11904",
+   "repo": "profullstack/c0mpute",
+   "image": null,
+   "domains": [
+    "c0mpute.com",
+    "www.c0mpute.com"
+   ],
+   "railway_domains": [
+    "c0mpute.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3254
+  },
+  "c0ncerts.com": {
+   "site": "c0ncerts.com",
+   "project": "Concert Platform",
+   "project_id": "1805cbb5-ea36-49d0-955e-42a4c56b15c3",
+   "environment_id": "7035b33a-895d-439d-b00e-5b9efeb6c8fc",
+   "service": "c0ncerts.com",
+   "service_id": "93bbb1e2-ea95-4e1b-8f20-32e5aeee77e1",
+   "repo": "profullstack/c0ncerts.com",
+   "image": null,
+   "domains": [
+    "c0ncerts.com",
+    "www.c0ncerts.com"
+   ],
+   "railway_domains": [
+    "c0ncerts.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": "8080",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3278
+  },
+  "c0upons.com": {
+   "site": "c0upons.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "c0upons.com",
+   "service_id": "2aaba4f5-f5c8-41c3-8e01-efcacd14b604",
+   "repo": "profullstack/c0upons",
+   "image": null,
+   "domains": [
+    "www.c0upons.com",
+    "c0upons.com"
+   ],
+   "railway_domains": [
+    "c0upons.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3231
+  },
+  "chovy.com": {
+   "site": "chovy.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "chovy-ai",
+   "service_id": "4da42bd8-c973-4705-aae3-2a606430f8ac",
+   "repo": "profullstack/chovy-ai",
+   "image": null,
+   "domains": [
+    "www.chovy.com",
+    "chovy.com"
+   ],
+   "railway_domains": [
+    "chovy.up.railway.app"
+   ],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "chovy-ai-volume",
+     "id": "4b33b294-1dbe-4210-8503-eb57b1aff121",
+     "mountPath": "/data",
+     "sizeMB": 801
+    }
+   ],
+   "port_var": null,
+   "companions": [],
+   "db_host": "postgres.railway.internal",
+   "redis_host": null,
+   "infra": [
+    {
+     "name": "Postgres",
+     "id": "815793bb-9f7b-4703-9bc2-1f170dccb836",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume",
+       "id": "9fddd62a-78b2-4327-af9d-fe0ffcdc700d",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 1164
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3237
+  },
+  "cigarunderground.org": {
+   "site": "cigarunderground.org",
+   "project": "cigarunderground.org",
+   "project_id": "20ba700a-93f7-4c4a-a248-9a429b24201b",
+   "environment_id": "6beedd07-a61a-47e8-bee4-4d5ddff618c7",
+   "service": "cigarunderground.org",
+   "service_id": "97be88d1-56ba-4df0-9365-b066d1febdf6",
+   "repo": "profullstack/cigarunderground.org",
+   "image": null,
+   "domains": [
+    "cigarunderground.org",
+    "www.cigarunderground.org"
+   ],
+   "railway_domains": [],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": "3000",
+   "companions": [],
+   "db_host": "postgres.railway.internal",
+   "redis_host": null,
+   "infra": [
+    {
+     "name": "Postgres",
+     "id": "5e383fc6-82db-4674-9801-f87c7ab9fa59",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume",
+       "id": "eaedafc5-a246-445f-8c89-a1f8b9795c08",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 866
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3203
+  },
+  "coinpayportal.com": {
+   "site": "coinpayportal.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "coinpayportal.com",
+   "service_id": "e8b5a637-b1de-4d54-a75c-e1c3e93e7bb4",
+   "repo": "profullstack/coinpayportal",
+   "image": null,
+   "domains": [
+    "www.coinpayportal.com",
+    "mta-sts.coinpayportal.com",
+    "coinpayportal.com"
+   ],
+   "railway_domains": [
+    "coinpayportal-production.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "coinpayportal-volume",
+     "id": "d30af3d8-6360-4826-97c3-3557c5701aaa",
+     "mountPath": "/mnt/files",
+     "sizeMB": 1120
+    }
+   ],
+   "port_var": "8080",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3273
+  },
+  "communitygardensasappleseeds.info": {
+   "site": "communitygardensasappleseeds.info",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "communitygardensasappleseeds.info",
+   "service_id": "54672478-27cc-4d57-a176-79e381b9da09",
+   "repo": "profullstack/communitygardens-web",
+   "image": null,
+   "domains": [
+    "www.communitygardensasappleseeds.info",
+    "communitygardensasappleseeds.info"
+   ],
+   "railway_domains": [
+    "communitygardensasappleseedsinfo-production.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "communitygardensasappleseeds.info-volume",
+     "id": "3625af85-e519-42a8-a676-eaf604066568",
+     "mountPath": "/data/db",
+     "sizeMB": 181
+    }
+   ],
+   "port_var": "9420",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3241
+  },
+  "cryptoshot.space": {
+   "site": "cryptoshot.space",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "cryptoshot.space",
+   "service_id": "c74cdf0b-bc45-4a8d-9611-e45fd363781c",
+   "repo": "profullstack/cryptoshot.space",
+   "image": null,
+   "domains": [
+    "cryptoshot.space",
+    "www.cryptoshot.space"
+   ],
+   "railway_domains": [
+    "places-production-758c.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": "8080",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3265
+  },
+  "d0rz.com": {
+   "site": "d0rz.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "d0rz.com",
+   "service_id": "25b2c41d-2973-4496-a39c-9a0537c6da76",
+   "repo": "profullstack/d0rz",
+   "image": null,
+   "domains": [
+    "d0rz.com",
+    "www.d0rz.com"
+   ],
+   "railway_domains": [
+    "d0rzcom-production.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3228
+  },
+  "d1sks.com": {
+   "site": "d1sks.com",
+   "project": "d1sks.com",
+   "project_id": "9f17fa49-126b-4248-acaf-1458b0f1ba7b",
+   "environment_id": "a04222ee-b94e-4348-b677-356d8f046939",
+   "service": "d1sks.com",
+   "service_id": "b3dd4d0e-f229-4271-ba40-a0f49e2a33c2",
+   "repo": "profullstack/d1sks.com",
+   "image": null,
+   "domains": [
+    "d1sks.com",
+    "www.d1sks.com"
+   ],
+   "railway_domains": [],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": "3000",
+   "companions": [],
+   "db_host": "postgres.railway.internal",
+   "redis_host": null,
+   "infra": [
+    {
+     "name": "Postgres",
+     "id": "c82c3180-0cc4-4f96-a69a-48fc553d8c81",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume",
+       "id": "8130599b-09ed-497a-a5f5-71b314888c0c",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 861
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3207
+  },
+  "d3vices.com": {
+   "site": "d3vices.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "d3vices.com",
+   "service_id": "619d6906-9ea7-46c1-add6-7fffec3d6202",
+   "repo": "profullstack/d3vices.com",
+   "image": null,
+   "domains": [
+    "d3vices.com",
+    "www.d3vices.com"
+   ],
+   "railway_domains": [
+    "d3vicescom-production.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": "8080",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3242
+  },
+  "demo.movie": {
+   "site": "demo.movie",
+   "project": "demo.movie",
+   "project_id": "ecbe6ee4-1b5d-4c36-b7c1-18dd5d763505",
+   "environment_id": "1579b73a-a06b-4dd6-a40e-92c1d16cf243",
+   "service": "demo.movie",
+   "service_id": "e591be59-2fa5-43bd-8ef6-0c8b7b378838",
+   "repo": "profullstack/demo.movie",
+   "image": null,
+   "domains": [
+    "demo.movie"
+   ],
+   "railway_domains": [],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "demo.movie-volume",
+     "id": "97e1dc15-f2f1-4f1a-abb5-cf3b0bffa1fd",
+     "mountPath": "/data",
+     "sizeMB": 1127
+    }
+   ],
+   "port_var": "3000",
+   "companions": [],
+   "db_host": "postgres.railway.internal",
+   "redis_host": null,
+   "infra": [
+    {
+     "name": "Postgres",
+     "id": "867f948b-0cc2-4a15-aecb-f3d54253fdd1",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume",
+       "id": "fc0bbef1-b92b-498c-aabc-f2157b8fbc70",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 872
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3200
+  },
+  "diskpush.com": {
+   "site": "diskpush.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "diskpush-web",
+   "service_id": "f956b101-4919-480c-bf30-51fe2e5b01e9",
+   "repo": "profullstack/diskpush",
+   "image": null,
+   "domains": [
+    "diskpush.com",
+    "www.diskpush.com"
+   ],
+   "railway_domains": [
+    "diskpush-web-production.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3275
+  },
+  "feedback.profullstack.com": {
+   "site": "feedback.profullstack.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "feedback.profullstack.com",
+   "service_id": "949f4453-745c-47e1-9294-65600f34aafa",
+   "repo": "profullstack/feedback.profullstack.com",
+   "image": null,
+   "domains": [
+    "feedback.profullstack.com"
+   ],
+   "railway_domains": [
+    "feedbackprofullstackcom-production.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3252
+  },
+  "fleetsysops.com": {
+   "site": "fleetsysops.com",
+   "project": "fleetsysops.com",
+   "project_id": "f76db785-d53c-40eb-b4b5-f9ac4176c2b9",
+   "environment_id": "c02ff655-fa72-4e10-a182-0f309f72d073",
+   "service": "fleetsysops.com",
+   "service_id": "bcd92cae-b3a9-4624-ae96-6fdf45f7a75a",
+   "repo": "profullstack/fleetsysops.com",
+   "image": null,
+   "domains": [
+    "www.fleetsysops.com",
+    "fleetsysops.com"
+   ],
+   "railway_domains": [],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": "3000",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3206
+  },
+  "g1tz.hqtui.com": {
+   "site": "g1tz.hqtui.com",
+   "project": "g1tz",
+   "project_id": "0cb66bef-6093-4ed3-9934-b6a1ae86b2e9",
+   "environment_id": "892fcfb1-8a6a-42e1-8d24-d67d42a796aa",
+   "service": "g1tz",
+   "service_id": "6f2addf8-c4e4-41da-a35b-2efc629f4aa2",
+   "repo": "profullstack/g1tz",
+   "image": null,
+   "domains": [
+    "g1tz.hqtui.com"
+   ],
+   "railway_domains": [],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "g1tz-volume",
+     "id": "8ba1417a-d840-437b-853b-9b591643179e",
+     "mountPath": "/data",
+     "sizeMB": 793
+    }
+   ],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3205
+  },
+  "genrewatch.com": {
+   "site": "genrewatch.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "genrewatch.com",
+   "service_id": "d500ee4f-8e1a-4e47-8121-bf1b3f21a10a",
+   "repo": "profullstack/genrewatch.com",
+   "image": null,
+   "domains": [
+    "genrewatch.com",
+    "www.genrewatch.com"
+   ],
+   "railway_domains": [
+    "genrewatchcom-production.up.railway.app"
+   ],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": true,
+   "volumes": [],
+   "port_var": "8080",
+   "companions": [
+    {
+     "name": "genrewatch-worker",
+     "id": "920af9df-d6da-4b26-a9f6-4cf3aeac1935",
+     "volumes": [],
+     "db": "pg",
+     "redis": true
+    }
+   ],
+   "db_host": "postgres-ivty.railway.internal",
+   "redis_host": "redis-wssw.railway.internal",
+   "infra": [
+    {
+     "name": "Redis-wSsW",
+     "id": "1517a765-b3e7-41b7-b57d-3eb29af2506d",
+     "role": "redis",
+     "image": "redis:8.2",
+     "volumes": [
+      {
+       "name": "redis-volume-uVea",
+       "id": "6e4965b8-813e-485c-ae58-64cd17309369",
+       "mountPath": "/data",
+       "sizeMB": 1062
+      }
+     ]
+    },
+    {
+     "name": "Postgres-iVtY",
+     "id": "2683bc3d-9755-421e-950f-8de56c097528",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume-RlJf",
+       "id": "536c1ed5-73cd-44f6-be61-c8cdf3165d82",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 3410
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3267
+  },
+  "getprivacycode.com": {
+   "site": "getprivacycode.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "getprivacycode",
+   "service_id": "296a85da-6cf6-4928-9c07-bceb25c8440a",
+   "repo": "profullstack/getprivacycode",
+   "image": null,
+   "domains": [
+    "www.getprivacycode.com",
+    "getprivacycode.com"
+   ],
+   "railway_domains": [
+    "getprivacycode.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3230
+  },
+  "goingbroke.now": {
+   "site": "goingbroke.now",
+   "project": "goingbroke.now",
+   "project_id": "270a98e2-8b37-4448-8740-eb3f62c101cb",
+   "environment_id": "d24710e5-d75d-4ab3-a8d2-188c6e3b63b2",
+   "service": "goingbroke.now",
+   "service_id": "6ad8dd57-b92d-4c22-9bc5-fce5199a1a1f",
+   "repo": "profullstack/goingbroke.now",
+   "image": null,
+   "domains": [
+    "www.goingbroke.now",
+    "goingbroke.now"
+   ],
+   "railway_domains": [
+    "goingbroke-web-production.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3221
+  },
+  "hqtui.com": {
+   "site": "hqtui.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "hqtui",
+   "service_id": "041faa6b-9aae-4937-a847-e14f89cf8ef2",
+   "repo": "profullstack/hqtui",
+   "image": null,
+   "domains": [
+    "hqtui.com"
+   ],
+   "railway_domains": [
+    "hqtui-production.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3222
+  },
+  "icemap.app": {
+   "site": "icemap.app",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "icemap.app",
+   "service_id": "be75d792-eef1-4972-ac9e-1addba108ec7",
+   "repo": "profullstack/icemap.app",
+   "image": null,
+   "domains": [
+    "www.icemap.app",
+    "icemap.app"
+   ],
+   "railway_domains": [
+    "icemapapp-production.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": "8080",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3262
+  },
+  "infernetprotocol.com": {
+   "site": "infernetprotocol.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "infernetprotocol.com",
+   "service_id": "1f89ec5b-d30d-4808-be19-9ac10c188903",
+   "repo": "InfernetProtocol/infernet-protocol",
+   "image": null,
+   "domains": [
+    "infernetprotocol.com",
+    "www.infernetprotocol.com"
+   ],
+   "railway_domains": [
+    "infernet.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": "8080",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3227
+  },
+  "installer.pairux.com": {
+   "site": "installer.pairux.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "installer.pairux.com",
+   "service_id": "b115e7d5-bb2b-4d91-8c8c-f742080d7ca0",
+   "repo": "profullstack/pairux.com",
+   "image": null,
+   "domains": [
+    "installer.pairux.com"
+   ],
+   "railway_domains": [],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": true,
+   "port": 3258
+  },
+  "launch.anapp.now": {
+   "site": "launch.anapp.now",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "launch.anapp.now",
+   "service_id": "7797ad26-923b-40d0-b4f4-3e521297742c",
+   "repo": "profullstack/launch.anapp.now",
+   "image": null,
+   "domains": [
+    "launch.anapp.now"
+   ],
+   "railway_domains": [],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3245
+  },
+  "logicsrc.com": {
+   "site": "logicsrc.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "logicsrc",
+   "service_id": "e77a59ca-2ec7-4641-ae6b-b166db856291",
+   "repo": "profullstack/logicsrc",
+   "image": null,
+   "domains": [
+    "logicsrc.com",
+    "www.logicsrc.com"
+   ],
+   "railway_domains": [
+    "logicsrc.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": true,
+   "port": 3272
+  },
+  "makedemo.app": {
+   "site": "makedemo.app",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "makedemo.app",
+   "service_id": "4c954ea9-20ee-4ceb-8e7c-e69684f057ec",
+   "repo": "profullstack/makedemo",
+   "image": null,
+   "domains": [
+    "www.makedemo.app",
+    "makedemo.app"
+   ],
+   "railway_domains": [
+    "makedemo.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3236
+  },
+  "marksyncr.com": {
+   "site": "marksyncr.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "marksyncr.com",
+   "service_id": "b7bb1d44-e198-42b3-9ad6-7a2f87040a4d",
+   "repo": "profullstack/marksyncr.com",
+   "image": null,
+   "domains": [
+    "www.marksyncr.com",
+    "marksyncr.com"
+   ],
+   "railway_domains": [
+    "web-production-4f64.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3260
+  },
+  "media2markdown.com": {
+   "site": "media2markdown.com",
+   "project": "media2markdown",
+   "project_id": "f1f3621f-be27-43d8-9469-0bf337163cf8",
+   "environment_id": "8a9c1902-5193-45c2-8f85-e77a477d5bfb",
+   "service": "media2markdown",
+   "service_id": "c93bf09f-8ee3-47e4-a583-65a76e5cd4e1",
+   "repo": null,
+   "image": null,
+   "domains": [
+    "media2markdown.com",
+    "www.media2markdown.com"
+   ],
+   "railway_domains": [
+    "media2markdown-production.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3217
+  },
+  "mediaanalyzer.pro": {
+   "site": "mediaanalyzer.pro",
+   "project": "mediaanalyzer.pro",
+   "project_id": "995b8b85-2c92-4e68-a957-342b74522179",
+   "environment_id": "bcfb5ae7-88dd-4a2c-923d-2fe599c8b61b",
+   "service": "mediaanalyzer.pro",
+   "service_id": "9bfa5a89-f57f-4d75-b0ec-01d61090ae48",
+   "repo": "profullstack/mediaanalyzer.pro",
+   "image": null,
+   "domains": [
+    "www.mediaanalyzer.pro",
+    "mediaanalyzer.pro"
+   ],
+   "railway_domains": [],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": "3000",
+   "companions": [],
+   "db_host": "postgres.railway.internal",
+   "redis_host": null,
+   "infra": [
+    {
+     "name": "Postgres",
+     "id": "001274d0-fccb-4f4e-b02d-ac366ac28f05",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume",
+       "id": "58b11232-a943-4943-86ff-bbfc920e1527",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 1017
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3202
+  },
+  "meshhook.com": {
+   "site": "meshhook.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "meshhook",
+   "service_id": "e44067bd-39b6-4a72-891e-b53c4fb6917c",
+   "repo": "profullstack/meshhook",
+   "image": null,
+   "domains": [
+    "www.meshhook.com",
+    "meshhook.com"
+   ],
+   "railway_domains": [
+    "meshhook.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3271
+  },
+  "moshcode.sh": {
+   "site": "moshcode.sh",
+   "project": "moshcode-sh",
+   "project_id": "340108c8-1509-43ae-af15-0cb1cb92201c",
+   "environment_id": "ef18b7c3-e566-4b15-a0cc-17c8fa04b26f",
+   "service": "moshcode-sh",
+   "service_id": "2897bb88-3553-4d67-9b26-54f9c92ef7ca",
+   "repo": "moshcoder/moshcode.sh",
+   "image": null,
+   "domains": [
+    "moshcode.sh",
+    "www.moshcode.sh"
+   ],
+   "railway_domains": [
+    "moshcode-sh-production.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": "3000",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3204
+  },
+  "moshcoding.com": {
+   "site": "moshcoding.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "moshcoding.com",
+   "service_id": "0aca36d5-e800-4099-ba55-10f89c65ce3a",
+   "repo": "moshcoder/moshcoding",
+   "image": null,
+   "domains": [
+    "moshcoding.com",
+    "www.moshcoding.com",
+    "moshscript.com",
+    "www.moshscript.com",
+    "moshcoders.com",
+    "www.moshcoders.com"
+   ],
+   "railway_domains": [
+    "moshcoding.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "moshcoding.com-volume",
+     "id": "1356dbe9-c42d-4593-a2da-739bedcb3b2f",
+     "mountPath": "/data",
+     "sizeMB": 836
+    }
+   ],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3223
+  },
+  "mynaposter.com": {
+   "site": "mynaposter.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "mynaposter.com",
+   "service_id": "b8230632-901f-4d2e-a259-a1dd929ab6b6",
+   "repo": "profullstack/mynaposter",
+   "image": null,
+   "domains": [
+    "mynaposter.com",
+    "www.mynaposter.com"
+   ],
+   "railway_domains": [
+    "mynaposter-web-production.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [
+    {
+     "name": "mynaposter-api",
+     "id": "103a1a67-1f34-4d81-a0d1-3470a4266790",
+     "volumes": [],
+     "db": "pg",
+     "redis": false
+    }
+   ],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3261
+  },
+  "naallo.com": {
+   "site": "naallo.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "naallo.com",
+   "service_id": "b5a3e003-efa2-4abd-bf89-9726959273ab",
+   "repo": "profullstack/naallo",
+   "image": null,
+   "domains": [
+    "www.naallo.com",
+    "naallo.com"
+   ],
+   "railway_domains": [
+    "naallocom-production.up.railway.app",
+    "naallocom-production-4ec0.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3259
+  },
+  "nightcell7.com": {
+   "site": "nightcell7.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "nightcell7",
+   "service_id": "902a2a45-f1b6-4e5b-b0ee-7e4aa2aff895",
+   "repo": "profullstack/nightcell7",
+   "image": null,
+   "domains": [
+    "www.nightcell7.com",
+    "nightcell7.com"
+   ],
+   "railway_domains": [
+    "nightcell7.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": true,
+   "volumes": [],
+   "port_var": "8080",
+   "companions": [],
+   "db_host": null,
+   "redis_host": "redis.railway.internal",
+   "infra": [
+    {
+     "name": "Redis",
+     "id": "b4cbc724-fa68-4513-acf6-c06f3cc9346f",
+     "role": "redis",
+     "image": "redis:8.2.9",
+     "volumes": [
+      {
+       "name": "redis-volume",
+       "id": "39dde17d-9ffd-410c-91da-85d54cf6efd9",
+       "mountPath": "/data",
+       "sizeMB": 1591
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3250
+  },
+  "nixamp.com": {
+   "site": "nixamp.com",
+   "project": "nixamp",
+   "project_id": "2b76bfa5-97fd-4c14-8a9c-e5434ee41cd4",
+   "environment_id": "9b73cdb5-8338-4644-8786-34ce2396f65f",
+   "service": "nixamp-web",
+   "service_id": "4f0b85e7-41e4-485e-a114-631ae75c74a7",
+   "repo": "profullstack/nixamp",
+   "image": null,
+   "domains": [
+    "www.nixamp.com",
+    "nixamp.com",
+    "www.backtoschool.help",
+    "backtoschool.help"
+   ],
+   "railway_domains": [
+    "nixamp-web-production.up.railway.app"
+   ],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": "postgres.railway.internal",
+   "redis_host": null,
+   "infra": [
+    {
+     "name": "Postgres-9wpC",
+     "id": "93ac8cea-8825-4a3a-b9ef-6723d92d4a9b",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume-ohPc",
+       "id": "dc0003af-aee0-4d37-a79d-bec7ed6586ec",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 845
+      }
+     ]
+    },
+    {
+     "name": "Postgres-ew1o",
+     "id": "b7c6bea5-d8e8-458a-91cc-5330e3b5df55",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume-654u",
+       "id": "18c24886-1c76-49fc-99fd-ac86681bc1e8",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 845
+      }
+     ]
+    },
+    {
+     "name": "Postgres",
+     "id": "c643a46e-bc18-4fd0-abfd-a67ee48eae1f",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume",
+       "id": "9ccd40d5-b7e0-4e8e-9ba1-29139b1835ae",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 1141
+      }
+     ]
+    },
+    {
+     "name": "Postgres-Cypz",
+     "id": "e8cf5d29-b3e9-4c46-bfcd-df30f2b8fccc",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume-Fpi-",
+       "id": "4af2c93a-2a8f-4718-9873-145d658dec37",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 1107
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3216
+  },
+  "obscura.openmcp.logicsrc.com": {
+   "site": "obscura.openmcp.logicsrc.com",
+   "project": "openmcp",
+   "project_id": "18ad173b-dc9c-402c-8b98-a4ed280c6cb0",
+   "environment_id": "a4164fa9-8459-4483-bc62-c52beeece729",
+   "service": "openmcp",
+   "service_id": "df82e9da-33c6-434f-b915-c5526b58ac16",
+   "repo": null,
+   "image": "node:24-bookworm-slim",
+   "domains": [
+    "obscura.openmcp.logicsrc.com",
+    "openmcp.logicsrc.com"
+   ],
+   "railway_domains": [
+    "openmcp-production.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "openmcp-volume",
+     "id": "9591caf5-71ae-4bbd-8c49-79d6f74e3208",
+     "mountPath": "/data",
+     "sizeMB": 1065
+    }
+   ],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3213
+  },
+  "openaccess.logicsrc.com": {
+   "site": "openaccess.logicsrc.com",
+   "project": "openaccess",
+   "project_id": "1f0f952f-1270-4480-a586-7980ae0d71ea",
+   "environment_id": "d6d01a2e-6a4c-4d0c-b73c-b6942aad0fc2",
+   "service": "openaccess",
+   "service_id": "3e3b78e2-f5a0-4994-a97c-2af1fd0a436b",
+   "repo": null,
+   "image": "node:24-alpine",
+   "domains": [
+    "openaccess.logicsrc.com"
+   ],
+   "railway_domains": [],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "openaccess-volume",
+     "id": "bc9857ae-4d10-444a-a12d-f16f7e6d9e94",
+     "mountPath": "/data",
+     "sizeMB": 1065
+    }
+   ],
+   "port_var": "8791",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3212
+  },
+  "opensocial.chat": {
+   "site": "opensocial.chat",
+   "project": "opensocial",
+   "project_id": "007ac72c-ab2e-4208-a409-203acbb5b36c",
+   "environment_id": "b2470c69-7308-411e-afa1-1e2fbdaf877c",
+   "service": "opensocial",
+   "service_id": "8c63f03e-6101-4300-a198-5ac1175ac627",
+   "repo": null,
+   "image": null,
+   "domains": [
+    "opensocial.chat"
+   ],
+   "railway_domains": [
+    "opensocial-production.up.railway.app"
+   ],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": "3100",
+   "companions": [],
+   "db_host": "postgres-13bf.railway.internal",
+   "redis_host": null,
+   "infra": [
+    {
+     "name": "redis",
+     "id": "889a35dd-f168-47f1-b9c5-8a088c5c07a8",
+     "role": "redis",
+     "image": "redis:7-alpine",
+     "volumes": []
+    },
+    {
+     "name": "postgres",
+     "id": "a773b321-5782-4cd0-ab9d-80bad72846f0",
+     "role": "pg",
+     "image": "postgres:17-alpine",
+     "volumes": []
+    }
+   ],
+   "shared_repo": false,
+   "port": 3210
+  },
+  "opensourcelegends.com": {
+   "site": "opensourcelegends.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "opensourcelegends.com",
+   "service_id": "3826f326-47fb-4ad5-aeb2-8fce6d7022b6",
+   "repo": "profullstack/opensourcelegends.com",
+   "image": null,
+   "domains": [
+    "www.opensourcelegends.com",
+    "opensourcelegends.com"
+   ],
+   "railway_domains": [
+    "opensourcelegends.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3232
+  },
+  "outreachgraph.com": {
+   "site": "outreachgraph.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "outreachgraph.com",
+   "service_id": "84358cda-e67c-4133-8275-40be706ff5f1",
+   "repo": "profullstack/outreachgraph",
+   "image": null,
+   "domains": [
+    "outreachgraph.com",
+    "www.outreachgraph.com"
+   ],
+   "railway_domains": [
+    "outreachgraph.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3248
+  },
+  "p0dcasters.com": {
+   "site": "p0dcasters.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "p0dcasters",
+   "service_id": "4c7743d5-d77a-4e36-a21e-96cb26a47bef",
+   "repo": "profullstack/p0dcasters",
+   "image": null,
+   "domains": [
+    "p0dcasters.com"
+   ],
+   "railway_domains": [
+    "p0dcasters-production.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3235
+  },
+  "pairux.com": {
+   "site": "pairux.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "pairux.com",
+   "service_id": "e992e4d9-ccc6-41e4-9964-c3743a060339",
+   "repo": "profullstack/pairux.com",
+   "image": null,
+   "domains": [
+    "www.pairux.com",
+    "pairux.com"
+   ],
+   "railway_domains": [
+    "pairuxcom-production.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": true,
+   "port": 3274
+  },
+  "phonenumbers.bot": {
+   "site": "phonenumbers.bot",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "phonenumbers.bot",
+   "service_id": "d788ac23-dcff-411d-a617-1821e7de26df",
+   "repo": "profullstack/phonenumbers.bot",
+   "image": null,
+   "domains": [
+    "www.phonenumbers.bot",
+    "phonenumbers.bot"
+   ],
+   "railway_domains": [
+    "phonenumbersbot-production.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3268
+  },
+  "postammo.com": {
+   "site": "postammo.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "postammo.com",
+   "service_id": "780f555f-3bd5-4aa9-b39e-741ada071cb1",
+   "repo": "profullstack/postammo.com",
+   "image": null,
+   "domains": [
+    "www.postammo.com",
+    "postammo.com"
+   ],
+   "railway_domains": [
+    "postammocom-production.up.railway.app",
+    "postammocom-production-cb78.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": "8080",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3246
+  },
+  "profullstack.com": {
+   "site": "profullstack.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "profullstack.com",
+   "service_id": "82d1ee66-dd81-4399-bb2b-73f862e3d63b",
+   "repo": "profullstack/profullstack-web",
+   "image": null,
+   "domains": [
+    "profullstack.com",
+    "www.profullstack.com"
+   ],
+   "railway_domains": [
+    "profullstack-web-production.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": "9450",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3247
+  },
+  "qaaas.dev": {
+   "site": "qaaas.dev",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "qaaas.dev",
+   "service_id": "d29ccdec-8a71-468a-a9aa-c3ca336e09a7",
+   "repo": "profullstack/qaaas.dev",
+   "image": null,
+   "domains": [
+    "www.qaaas.dev",
+    "qaaas.dev"
+   ],
+   "railway_domains": [
+    "qaaasdev-production.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": "8080",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3266
+  },
+  "qrypt.chat": {
+   "site": "qrypt.chat",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "qrypt.chat",
+   "service_id": "51064b81-862c-4807-8a98-b39920b07e94",
+   "repo": "profullstack/qryptchat-web",
+   "image": null,
+   "domains": [
+    "qrypt.chat",
+    "www.qrypt.chat"
+   ],
+   "railway_domains": [],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "qrypt.chat-volume",
+     "id": "4686da3e-5f3e-4dc5-a978-7d29cb9b2655",
+     "mountPath": "/var/lib/tor/hidden_service",
+     "sizeMB": 149
+    }
+   ],
+   "port_var": "8080",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3239
+  },
+  "r4ck.dev": {
+   "site": "r4ck.dev",
+   "project": "r4ck.dev",
+   "project_id": "1dc5c231-3265-4364-9af5-2cf78e49b5ba",
+   "environment_id": "ed427967-4a95-49be-99aa-df50d63396a4",
+   "service": "r4ck.dev",
+   "service_id": "f5403a69-0928-4b9a-a124-61992c4bba66",
+   "repo": "profullstack/r4ck.dev",
+   "image": null,
+   "domains": [
+    "www.r4ck.dev",
+    "r4ck.dev"
+   ],
+   "railway_domains": [],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": "3000",
+   "companions": [],
+   "db_host": "postgres.railway.internal",
+   "redis_host": null,
+   "infra": [
+    {
+     "name": "Postgres",
+     "id": "a97aad71-cee6-4d22-a843-499fce794de0",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume",
+       "id": "3a1a006c-a5a7-4407-a675-204b9c12db32",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 1150
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3208
+  },
+  "readm3.com": {
+   "site": "readm3.com",
+   "project": "readm3",
+   "project_id": "d0006e18-8efd-414d-b892-49e790f412d6",
+   "environment_id": "15239234-70ef-4711-b772-599746e1bcd5",
+   "service": "readm3",
+   "service_id": "1c17f152-cbaa-4f7a-ab61-2886dbdd71b7",
+   "repo": "profullstack/readm3",
+   "image": null,
+   "domains": [
+    "readm3.com",
+    "www.readm3.com"
+   ],
+   "railway_domains": [
+    "readm3-production.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "readm3-volume",
+     "id": "1a841205-164f-4c51-8042-a53368016814",
+     "mountPath": "/data",
+     "sizeMB": 796
+    }
+   ],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3211
+  },
+  "recipepdfs.com": {
+   "site": "recipepdfs.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "recipepdfs.com",
+   "service_id": "c55ab9d4-2219-4114-9868-d484b95c5dd6",
+   "repo": "profullstack/recipepdfs.com",
+   "image": null,
+   "domains": [
+    "www.recipepdfs.com",
+    "recipepdfs.com"
+   ],
+   "railway_domains": [
+    "recipepdfscom-production.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [],
+   "port_var": "8080",
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3263
+  },
+  "reeleel.com": {
+   "site": "reeleel.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "reeleel",
+   "service_id": "1bdbef00-a8a1-4618-9f57-00d9b62622ba",
+   "repo": "profullstack/reeleel",
+   "image": null,
+   "domains": [
+    "www.reeleel.com",
+    "reeleel.com"
+   ],
+   "railway_domains": [
+    "reeleel.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "reeleel-volume",
+     "id": "4fd6fc14-bc49-4600-a067-58f7f8227ab7",
+     "mountPath": "/data",
+     "sizeMB": 6189
+    }
+   ],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3226
+  },
+  "ringhuman.com": {
+   "site": "ringhuman.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "ringhuman.com",
+   "service_id": "3a674a4e-a95d-4e2a-bc40-27c965c19ecc",
+   "repo": "profullstack/ringhuman.com",
+   "image": null,
+   "domains": [
+    "ringhuman.com",
+    "www.ringhuman.com"
+   ],
+   "railway_domains": [
+    "ringhumancom.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3233
+  },
+  "saasrow.com": {
+   "site": "saasrow.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "saasrow-web",
+   "service_id": "f9899f2e-493e-43b2-a1fe-c757d844e047",
+   "repo": "profullstack/saasrow-web",
+   "image": null,
+   "domains": [
+    "www.saasrow.com",
+    "saasrow.com"
+   ],
+   "railway_domains": [
+    "saasrow-web-production.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3276
+  },
+  "sh1pt.com": {
+   "site": "sh1pt.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "sh1pt.com",
+   "service_id": "72b41681-f139-45e3-a4b6-3972a628761b",
+   "repo": "profullstack/sh1pt",
+   "image": null,
+   "domains": [
+    "www.sh1pt.com",
+    "sh1pt.com"
+   ],
+   "railway_domains": [
+    "sh1ptcom-production.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3244
+  },
+  "sinkstate.com": {
+   "site": "sinkstate.com",
+   "project": "sinkstate",
+   "project_id": "56fbc164-6d3d-4e46-acea-6b4f332ec6af",
+   "environment_id": "f00b8b53-13d9-4526-bc16-22532abe33c8",
+   "service": "sinkstate",
+   "service_id": "3e298e05-2757-4d7c-92af-8eba08cf7a19",
+   "repo": "profullstack/sinkstate",
+   "image": null,
+   "domains": [
+    "sinkstate.com"
+   ],
+   "railway_domains": [
+    "sinkstate-production.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3219
+  },
+  "smshub.dev": {
+   "site": "smshub.dev",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "smshub.dev",
+   "service_id": "a9c818d5-2784-4137-8932-a33bcbd064cf",
+   "repo": "profullstack/smshub",
+   "image": null,
+   "domains": [
+    "smshub.dev",
+    "www.smshub.dev"
+   ],
+   "railway_domains": [
+    "smshub-production-65a6.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3256
+  },
+  "sorrycheck.com": {
+   "site": "sorrycheck.com",
+   "project": "sorrycheck",
+   "project_id": "a645aa8a-c5aa-4e37-bc40-c04ffeb7abd6",
+   "environment_id": "72061725-bbd5-4284-841d-a4ff1145e859",
+   "service": "sorrycheck",
+   "service_id": "2e48d286-0127-4530-8067-f00dd24395f1",
+   "repo": "profullstack/sorrycheck",
+   "image": null,
+   "domains": [
+    "sorrycheck.com"
+   ],
+   "railway_domains": [
+    "sorrycheck-production.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3220
+  },
+  "threatcrush.com": {
+   "site": "threatcrush.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "threatcrush.com",
+   "service_id": "dc38426b-e3db-4526-b0e4-913810a431bb",
+   "repo": "profullstack/threatcrush",
+   "image": null,
+   "domains": [
+    "www.threatcrush.com",
+    "threatcrush.com"
+   ],
+   "railway_domains": [
+    "threatcrush-production.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3270
+  },
+  "tipoffwatch.com": {
+   "site": "tipoffwatch.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "tipoffwatch.com",
+   "service_id": "1af0d67d-2204-4c26-99d8-e2765464bc8a",
+   "repo": "profullstack/tipoffwatch.com",
+   "image": null,
+   "domains": [
+    "tipoffwatch.com"
+   ],
+   "railway_domains": [
+    "tipoffwatch.up.railway.app"
+   ],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": true,
+   "volumes": [],
+   "port_var": "8080",
+   "companions": [],
+   "db_host": "postgres-q7ea.railway.internal",
+   "redis_host": "redis-g3yk.railway.internal",
+   "infra": [
+    {
+     "name": "Postgres-q7ea",
+     "id": "19103667-0f74-4494-82f6-f1fc9db5d951",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume-iLQ4",
+       "id": "c308610d-58e4-4c8b-bef2-7a8173cf1a3f",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 3782
+      }
+     ]
+    },
+    {
+     "name": "Redis-g3Yk",
+     "id": "b0a4bdf4-582a-4daf-b268-51952fc255e9",
+     "role": "redis",
+     "image": "redis:8.10.1",
+     "volumes": [
+      {
+       "name": "redis-volume-1uCi",
+       "id": "c6380555-a444-4ab0-b18e-0ec81349b94a",
+       "mountPath": "/data",
+       "sizeMB": 1210
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3225
+  },
+  "tronbrowser.dev": {
+   "site": "tronbrowser.dev",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "tronbrowser.dev",
+   "service_id": "c621b6d1-eb39-41ba-a3ef-303ba7de20d5",
+   "repo": "profullstack/tronbrowser.dev",
+   "image": null,
+   "domains": [
+    "tronbrowser.dev",
+    "www.tronbrowser.dev"
+   ],
+   "railway_domains": [
+    "tronbrowser.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "tronbrowser.dev-volume",
+     "id": "e45333b0-dc74-4ada-aa97-cc86b0254992",
+     "mountPath": "/var/lib/tor/hidden_service",
+     "sizeMB": 1060
+    }
+   ],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3264
+  },
+  "tsbb.dev": {
+   "site": "tsbb.dev",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "tsbb",
+   "service_id": "a5434b3a-b418-4a7d-82d9-c8cbfcf136a9",
+   "repo": "profullstack/tsbb",
+   "image": null,
+   "domains": [
+    "tsbb.dev",
+    "www.tsbb.dev"
+   ],
+   "railway_domains": [
+    "tsbb.up.railway.app"
+   ],
+   "db": "turso",
+   "db_kinds": [
+    "turso"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3255
+  },
+  "ugig.net": {
+   "site": "ugig.net",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "ugig.net",
+   "service_id": "86b45c1d-4a7b-4063-8694-74e646a2ccb9",
+   "repo": "profullstack/ugig.net",
+   "image": null,
+   "domains": [
+    "ugig.net",
+    "www.ugig.net"
+   ],
+   "railway_domains": [
+    "ugignet-production.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3249
+  },
+  "vu1nz.com": {
+   "site": "vu1nz.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "vu1nz.com",
+   "service_id": "4169ee16-78e0-460d-8e06-a3feff6c2324",
+   "repo": "profullstack/vu1nz.com",
+   "image": null,
+   "domains": [
+    "vu1nz.com",
+    "www.vu1nz.com"
+   ],
+   "railway_domains": [
+    "vu1nzcom-production.up.railway.app"
+   ],
+   "db": "none",
+   "db_kinds": [],
+   "redis": false,
+   "volumes": [
+    {
+     "name": "vu1nz.com-volume",
+     "id": "abfba90b-d5b0-4a1a-9c86-b71e41b3e88a",
+     "mountPath": "/app/data",
+     "sizeMB": 1067
+    }
+   ],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3234
+  },
+  "w3bs.org": {
+   "site": "w3bs.org",
+   "project": "w3bs",
+   "project_id": "0e7a6bd2-79be-4a92-86d3-6a15ef3dec79",
+   "environment_id": "ea846dc0-96dd-43d6-be9f-cb00fb16eaf5",
+   "service": "w3bs",
+   "service_id": "571bb8cd-8ebc-4929-954d-97452e078a4c",
+   "repo": "profullstack/w3bs.org",
+   "image": null,
+   "domains": [
+    "w3bs.org",
+    "www.w3bs.org",
+    "prompt.w3bs.org",
+    "browse.w3bs.org",
+    "specs.w3bs.org"
+   ],
+   "railway_domains": [],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": "postgres.railway.internal",
+   "redis_host": null,
+   "infra": [
+    {
+     "name": "Postgres",
+     "id": "4350856e-bd50-49e1-8457-132d5db21030",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume",
+       "id": "dbf40f23-444c-4165-ba97-7d8a386c1f80",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 862
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3209
+  },
+  "watchnews.now": {
+   "site": "watchnews.now",
+   "project": "watchnews.now",
+   "project_id": "46002072-eb98-49cd-8eba-2d1d6b09d1a3",
+   "environment_id": "10459e11-1a4d-4d71-890a-f4a1173b6201",
+   "service": "watchnews.now",
+   "service_id": "f6196b0e-98ee-4b77-9d99-152832e4997b",
+   "repo": "profullstack/watchnews.now",
+   "image": null,
+   "domains": [
+    "www.watchnews.now",
+    "watchnews.now"
+   ],
+   "railway_domains": [],
+   "db": "pg",
+   "db_kinds": [
+    "pg"
+   ],
+   "redis": true,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": "postgres.railway.internal",
+   "redis_host": "redis.railway.internal",
+   "infra": [
+    {
+     "name": "Postgres",
+     "id": "23bdde3e-9d16-4a45-b1b1-b3fc9fbafc0d",
+     "role": "pg",
+     "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+     "volumes": [
+      {
+       "name": "postgres-volume",
+       "id": "0283a6e2-aa2d-43e3-8ae9-a8f35aa0d347",
+       "mountPath": "/var/lib/postgresql/data",
+       "sizeMB": 3872
+      }
+     ]
+    },
+    {
+     "name": "Redis",
+     "id": "77628875-109a-4264-b55d-70eed867673c",
+     "role": "redis",
+     "image": "redis:8.2",
+     "volumes": [
+      {
+       "name": "redis-volume",
+       "id": "24e869be-b04b-404a-8c4c-8c29531449c9",
+       "mountPath": "/data",
+       "sizeMB": 1060
+      }
+     ]
+    }
+   ],
+   "shared_repo": false,
+   "port": 3215
+  },
+  "weedforcrypto.com": {
+   "site": "weedforcrypto.com",
+   "project": "Profullstack, Inc.",
+   "project_id": "e12258c5-050a-462d-a54c-b4c98939fe6f",
+   "environment_id": "1070bfbd-cea8-4c0b-ae98-338694fcb11e",
+   "service": "weedforcrypto",
+   "service_id": "63cf71c9-a1ee-47e8-8391-2c3e44390f0e",
+   "repo": "profullstack/weedforcrypto",
+   "image": null,
+   "domains": [
+    "www.weedforcrypto.com",
+    "weedforcrypto.com"
+   ],
+   "railway_domains": [
+    "weedforcrypto-production.up.railway.app"
+   ],
+   "db": "supabase",
+   "db_kinds": [
+    "supabase"
+   ],
+   "redis": false,
+   "volumes": [],
+   "port_var": null,
+   "companions": [],
+   "db_host": null,
+   "redis_host": null,
+   "infra": [],
+   "shared_repo": false,
+   "port": 3243
+  }
+ }
+}
diff --git a/dev2/sites.overrides.json b/dev2/sites.overrides.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/dev2/sites.overrides.json
@@ -0,0 +1 @@
+{}
diff --git a/dev2/templates/deploy-app.sh b/dev2/templates/deploy-app.sh
new file mode 100755
index 0000000..05ac592
--- /dev/null
+++ b/dev2/templates/deploy-app.sh
@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+#
+# Deploy one site under /home/anthony/www/<site> on dev2. GitHub Actions calls
+# this over ssh on every merge; you run it by hand to roll forward or back.
+#
+#   deploy-app.sh <git-sha|ref>       build that revision and switch to it
+#   deploy-app.sh --rollback          go back to the previously deployed sha
+#   deploy-app.sh --status            what is deployed and healthy right now
+#
+# Everything site-specific comes from deploy.env beside this script (written by
+# cli-tools/dev2/dev2-site provision): REPO, APP_PORT, BUILD_SERVICES,
+# HEALTH_PATH. Builds happen on the box because NEXT_PUBLIC_*-style values are
+# baked in at build time and live only in app.env here.
+#
+set -euo pipefail
+
+ROOT=${ROOT:-$(cd "$(dirname "$(readlink -f "$0")")" && pwd)}
+APP_DIR="$ROOT/app"
+STATE="$ROOT/.deploy-state"
+# shellcheck disable=SC1091
+. "$ROOT/deploy.env"
+: "${REPO:?deploy.env needs REPO}"
+: "${APP_PORT:?deploy.env needs APP_PORT}"
+BUILD_SERVICES=${BUILD_SERVICES:-app}
+HEALTH_PATH=${HEALTH_PATH:-/}
+HEALTH_TIMEOUT=${HEALTH_TIMEOUT:-300}
+
+log() { printf '\n===> %s\n' "$*"; }
+die() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
+
+compose() { (cd "$ROOT" && docker compose -f docker-compose.app.yml --env-file "$ROOT/deploy.env" "$@"); }
+
+health() {
+  local i
+  for i in $(seq 1 "$((HEALTH_TIMEOUT / 5))"); do
+    # Any HTTP answer counts: a 3xx redirect or a 401 from the app is alive.
+    if curl -sS -m 5 -o /dev/null -w '%{http_code}' "http://127.0.0.1:${APP_PORT}${HEALTH_PATH}" | grep -Eq '^[1-4]'; then return 0; fi
+    sleep 5
+  done
+  return 1
+}
+
+case "${1:-}" in
+  --status)
+    compose ps
+    curl -sS -m 5 -o /dev/null -w 'app http %{http_code} in %{time_total}s\n' "http://127.0.0.1:${APP_PORT}${HEALTH_PATH}" || echo "app not answering"
+    [ -f "$STATE" ] && cat "$STATE"
+    exit 0
+    ;;
+  --rollback)
+    [ -f "$STATE" ] || die "no deploy state to roll back to"
+    # shellcheck disable=SC1090
+    . "$STATE"
+    [ -n "${PREVIOUS_SHA:-}" ] || die "no PREVIOUS_SHA recorded"
+    log "Rolling back to $PREVIOUS_SHA"
+    exec "$0" "$PREVIOUS_SHA"
+    ;;
+esac
+
+TARGET=${1:?usage: deploy-app.sh <git-sha|ref> | --rollback | --status}
+
+[ -f "$ROOT/app.env" ] || die "missing $ROOT/app.env (the app's secrets)"
+
+CURRENT=""
+[ -d "$APP_DIR/.git" ] && CURRENT=$(git -C "$APP_DIR" rev-parse HEAD 2>/dev/null || echo "")
+
+if [ ! -d "$APP_DIR/.git" ]; then
+  log "First deploy: cloning $REPO"
+  git clone --filter=blob:none "$REPO" "$APP_DIR"
+fi
+
+log "Fetching $TARGET"
+git -C "$APP_DIR" fetch --all --tags --prune -q
+
+# Resolve to a sha first: `checkout --detach <missing ref>` gives a useless
+# error, and a bare branch name only resolves as origin/<name>.
+SHA=$(git -C "$APP_DIR" rev-parse --verify --quiet "origin/$TARGET^{commit}" \
+   || git -C "$APP_DIR" rev-parse --verify --quiet "$TARGET^{commit}" \
+   || true)
+[ -n "$SHA" ] || die "cannot resolve '$TARGET' to a commit"
+git -C "$APP_DIR" checkout -q --detach "$SHA"
+log "At $SHA"
+
+log "Building $BUILD_SERVICES"
+# shellcheck disable=SC2086
+compose build $BUILD_SERVICES
+
+log "Starting"
+compose up -d --remove-orphans
+
+if health; then
+  log "Healthy on 127.0.0.1:$APP_PORT$HEALTH_PATH"
+  {
+    echo "DEPLOYED_SHA=$SHA"
+    echo "PREVIOUS_SHA=$CURRENT"
+    echo "DEPLOYED_AT=$(date -u +%FT%TZ)"
+  } > "$STATE"
+  compose ps
+else
+  log "UNHEALTHY after ${HEALTH_TIMEOUT}s - last 60 lines:"
+  compose logs --tail 60 || true
+  if [ -n "$CURRENT" ] && [ "$CURRENT" != "$SHA" ]; then
+    log "Restoring $CURRENT"
+    git -C "$APP_DIR" checkout -q --detach "$CURRENT"
+    # shellcheck disable=SC2086
+    compose build $BUILD_SERVICES && compose up -d
+    health && log "Restored to $CURRENT" || log "ROLLBACK ALSO UNHEALTHY - site is down"
+  fi
+  die "deploy of $SHA failed health check"
+fi
diff --git a/dev2/templates/deploy-dev2.yml b/dev2/templates/deploy-dev2.yml
new file mode 100644
index 0000000..1b19d01
--- /dev/null
+++ b/dev2/templates/deploy-dev2.yml
@@ -0,0 +1,60 @@
+# Ship every merge to dev2, where __SITE__ runs since it left Railway (which
+# deployed on merge by itself). The box pulls the merged commit, rebuilds the
+# image(s) from this repo and restarts the compose stack under
+# /home/anthony/www/__SITE__. Generated by cli-tools/dev2/dev2-site scaffold.
+name: Deploy to dev2
+
+on:
+  push:
+    branches: [__BRANCH__]
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Git ref to deploy (defaults to the pushed commit)
+        required: false
+        type: string
+
+concurrency:
+  group: deploy-dev2
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      # ${{ }} values go through env, never straight into a run: body.
+      - name: Resolve target revision
+        id: rev
+        env:
+          REF: ${{ inputs.ref || github.sha }}
+        run: echo "sha=$REF" >> "$GITHUB_OUTPUT"
+
+      - name: Set up ssh
+        env:
+          SSH_KEY: ${{ secrets.DEV2_SSH_KEY }}
+          KNOWN_HOSTS: ${{ secrets.DEV2_KNOWN_HOSTS }}
+        run: |
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          printf '%s\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Deploy
+        env:
+          DEV2_USER: ${{ secrets.DEV2_USER }}
+          DEV2_HOST: ${{ secrets.DEV2_HOST }}
+          SHA: ${{ steps.rev.outputs.sha }}
+        run: |
+          ssh -o BatchMode=yes "$DEV2_USER@$DEV2_HOST" \
+            /home/anthony/www/__SITE__/deploy-app.sh "$SHA"
+
+      - name: Verify the site answers
+        run: |
+          for i in $(seq 1 10); do
+            code=$(curl -s -o /dev/null -w '%{http_code}' "__HEALTH_URL__" || true)
+            case "$code" in 2*|3*|401|403) echo "__SITE__ $code"; exit 0;; esac
+            echo "attempt $i: $code"; sleep 10
+          done
+          echo "__SITE__ never answered"; exit 1
diff --git a/dev2/templates/nginx-vhost.conf b/dev2/templates/nginx-vhost.conf
new file mode 100644
index 0000000..eef5994
--- /dev/null
+++ b/dev2/templates/nginx-vhost.conf
@@ -0,0 +1,45 @@
+# __SITE__: managed by cli-tools/dev2/dev2-site vhost. Do not hand-edit; re-run
+# `dev2-site vhost __SITE__` after changing the template.
+# The app runs in Docker on 127.0.0.1:__APP_PORT__; nginx is its only public face.
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name __SERVER_NAMES__;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /var/www/acme;
+        default_type "text/plain";
+    }
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+    server_name __SERVER_NAMES__;
+
+    ssl_certificate     /etc/nginx/ssl/__SITE__/fullchain.pem;
+    ssl_certificate_key /etc/nginx/ssl/__SITE__/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_prefer_server_ciphers off;
+
+    client_max_body_size __MAX_BODY__;
+
+    location / {
+        proxy_pass http://127.0.0.1:__APP_PORT__;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_read_timeout 300s;
+        proxy_buffering off;
+    }
+}

From 971cbc789bfe9ca815a36fc233b0aa71adb5cd31 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:35:16 +0000
Subject: [PATCH 002/104] dev2: README for the fleet kit

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/README.md | 94 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)
 create mode 100644 dev2/README.md

diff --git a/dev2/README.md b/dev2/README.md
new file mode 100644
index 0000000..b5c6159
--- /dev/null
+++ b/dev2/README.md
@@ -0,0 +1,94 @@
+# dev2-site: Railway -> dev2, and deploy-on-merge afterwards
+
+`dev2/dev2-site` moves one Railway-hosted site at a time onto **dev2**
+(`dev2.profullstack.com`, 23.95.228.174), our production box, and leaves the
+repo deploying there on every merge. It is the generalisation of the kits that
+moved crawlproof.com (`crawlproof.com/ops/selfhost`), nichedb.dev
+(`niche-db/ops/selfhost-supabase`) and rssamplifier.com.
+
+Run it from dev1. **dev2 is production: this tool is the only thing that should
+write to it.** Everything it writes is derived from Railway plus the templates
+here, so re-running a step reproduces the box instead of drifting from it.
+
+```
+dev2-site registry               rebuild sites.json from Railway (projects, services, domains, volumes, DB variables)
+dev2-site list [--kind pg|none|supabase|turso] [--status on-dev2]
+dev2-site show <site>            registry entry + this site's state
+dev2-site migrate <site> --yes   the whole move, resumable; each step below is also a subcommand
+```
+
+| step | what it does |
+| --- | --- |
+| `scaffold` | in the app repo: `.github/workflows/deploy-dev2.yml` (+ `.nixpacks/Dockerfile` from nixpacks when the repo has no Dockerfile, the same builder Railway used) on branch `ops/dev2-deploy`, pushed, PR opened |
+| `db` | (kind `pg`) database in the shared Supabase cluster on dev2 (one database per app, role `postgres`, like nichedb and rssamplifier); `pg_dump -Fc` inside the Railway Postgres container over `ssh.railway.com`, streamed to dev2, `pg_restore`, extensions pre-created, row counts compared |
+| `provision` | `/home/anthony/www/<site>/`: `app.env` rendered from Railway's variables (RAILWAY_* dropped, DATABASE_URL / PG* / REDIS_URL re-pointed), one `<worker>.env` per companion service, `deploy.env`, `docker-compose.app.yml`, `deploy-app.sh`; one deploy key per repo authorised for `anthony`; `DEV2_*` secrets set on the repo |
+| `volumes` | Railway volume contents tar-streamed into `volumes/<name>`, bind-mounted at the same path |
+| `deploy` | `deploy-app.sh <ref>` as `anthony`: build on the box, `compose up`, health on `127.0.0.1:<port><health_path>` |
+| `cert` | acme.sh, Let's Encrypt, **Porkbun DNS-01**, every custom domain (+ www), into `/etc/nginx/ssl/<site>/`; issued before DNS moves so there is no TLS gap |
+| `vhost` | nginx server block -> `127.0.0.1:<port>` |
+| `verify` | curl each domain `--resolve`d to dev2; `--public` after the flip |
+| `refresh-db` | (kind `pg`) re-copies the database seconds before the flip and restarts the app, so writes that landed on Railway during setup are not lost |
+| `dns` | Porkbun: ALIAS/CNAME to Railway removed, `A -> 23.95.228.174` for every domain, `_railway-verify` TXT removed; the zone is backed up as JSON first |
+| `railway-stop` | `deploymentRemove` + `serviceDisconnect` (or the next push silently redeploys on Railway) |
+| `merge` | merges the scaffold PR; CI deploys the default branch to dev2 |
+| `retire` | `--yes`: `serviceDelete` for the app, companions and data services. Only after `verify --public` |
+
+## Layout on the box (every site the same)
+
+```
+/home/anthony/www/<site>/
+├── app/                     git checkout the deploy builds from
+├── app.env                  the app's environment (0600, anthony)
+├── <worker>.env             one per companion service
+├── deploy.env               SITE REPO BRANCH APP_PORT BUILD_SERVICES HEALTH_PATH
+├── docker-compose.app.yml   app (+ companions) (+ redis)
+├── deploy-app.sh            what CI calls over ssh; --status, --rollback
+├── volumes/<name>/          Railway volumes
+└── .deploy-state
+```
+
+Ports are allocated once in `sites.json` from 3200 upwards (3010 nichedb, 3020
+rssamplifier, 3100 crawlproof predate the kit). nginx is the only public face.
+
+## Per-site overrides
+
+`sites.d/<site>.json` is merged over the registry entry at load time. One
+small file per site, so parallel migrations never edit a shared file:
+
+```json
+{ "health_path": "/healthz", "port_var": "8080", "start_command": "bun run start",
+  "companion_commands": { "genrewatch-worker": "bun run worker" },
+  "env_overrides": { "SITE_URL": "https://example.com" },
+  "pg_service": "Postgres-iVtY", "max_body": "256m", "branch": "master" }
+```
+
+## Database kinds
+
+- `pg`: Railway Postgres -> shared cluster (above). Done by the kit.
+- `none`: nothing to move.
+- `supabase`: the app keeps talking to Supabase cloud after the move; the
+  database moves in a second pass onto a per-app self-hosted stack (see
+  `crawlproof.com/ops/selfhost` for the shape: `setup-supabase.sh`,
+  `pull-cloud.sh`, `load-selfhost.sh`, `sync-storage.mjs`). Then
+  `env_overrides` + `provision` + `deploy` re-point the app.
+- `turso`: the app keeps talking to Turso after the move; the database moves
+  in a second pass with a Postgres port of the app's db layer (the pattern is
+  rssamplifier.com `packages/db/src/pg.js`: serve the libSQL surface over pg).
+
+## State
+
+`~/.local/state/dev2-fleet/<site>.json` (steps done, database url, PR, dump
+path), `deploy-keys/` (private halves; GitHub holds the copies), `dns/` (zone
+backups before each flip).
+
+## Traps already met
+
+- Railway's `usage`/`variables` API rate-limits and tokens last an hour; the
+  kit refreshes through `railway whoami`.
+- A repo that squash-merged a branch makes a new PR from the same branch name
+  CONFLICTING and CI silently never runs: rebase or use a fresh branch.
+- `git add` with one missing pathspec stages nothing; the kit adds paths one
+  by one.
+- A duplicate standalone project (`tipoffwatch`) exists beside the live
+  megaproject service (`tipoffwatch.com`); the registry keys by custom domain,
+  so the duplicate is not a site.

From 840334cb976dd64262a27a9e9f70308fe2075a66 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:41:39 +0000
Subject: [PATCH 003/104] dev2-site: clone private repos over ssh with a
 read-only deploy key; show deploy stderr

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 89070 -> 90797 bytes
 dev2/dev2-site                            |  16 +-
 dev2/sites.d/agenticjobs.work.json        |   5 +
 dev2/sites.d/cigarunderground.org.json    |   3 +
 dev2/sites.d/genrewatch.com.json          |   3 +
 dev2/templates/supabase-load.sh           |  77 +++++++
 dev2/templates/supabase-pull.sh           |  57 ++++++
 dev2/templates/supabase-stack.sh          | 239 ++++++++++++++++++++++
 dev2/templates/sync-storage.mjs           | 143 +++++++++++++
 9 files changed, 541 insertions(+), 2 deletions(-)
 create mode 100644 dev2/sites.d/agenticjobs.work.json
 create mode 100644 dev2/sites.d/cigarunderground.org.json
 create mode 100644 dev2/sites.d/genrewatch.com.json
 create mode 100755 dev2/templates/supabase-load.sh
 create mode 100755 dev2/templates/supabase-pull.sh
 create mode 100755 dev2/templates/supabase-stack.sh
 create mode 100644 dev2/templates/sync-storage.mjs

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 763b89e4ec7d78c02e20df28700254f27900c1fc..e493dd13b5ca67761db5a29ef0b4e5454e6e67a8 100644
GIT binary patch
delta 15475
zcmaKT33yx8vA@sN;(f`E6Fa%ttt7UyC(gduNlX$av7L>ODzdI*E0!hYT-lBl2L&iC
zOKDOrRN+rTLuub5C8eQ$-~e3+ElbN%_dyH2k5bl_v_PSKyoS({|NQ34mTY)W->1>N
zXPGl+&di*db4DNZI==s;qu|;6{G1H>{Cf4n`)B>)!Gd#n;!@Akd43^A8Wjb{CZba2
z0}Lae3j(SfLC~~^!cm_bWBj3DiWp@adu^og_53a6**jO)*VWdoU!pe3|D$iGM}}mv
zaeLuZ>icM6Vkz3X?6QD<WFbHikKsEQh`JOxoL{_Q&8I8$s3u9UX#t-sHNI9<DMt1D
zsOS}?8ogYZrp?=?nGSD@&)X^|p>L+w6N$D<pPWi>avF+6M9-vO)%sX-QuG#C)$_`T
z)q=<xJIXIq<JwU(HvxrQ*x!@rslu~^fXiXp+jXCm3s5q+osI^Kosr9>XtLC}II5bc
zT|RoDa85^w%jg=Tjz!lxm)&&ekzgQdwVjLVc}CBeNmG{7qiG9whIA)ArIVbg>n-j`
zdsNmMpNt75SEBoh{mvTno^8B$Md@%}uN*z<iTd0TPqamDF~$|Ul5KYv-(Oq@^bS4h
zi|DRQxdlBp0n`|!W7Wy1m5T`sVt!6A?9tqeRPHeLja^5x`uDMMA=VkwOQy{%qxOL#
zBrmQU#${%;d0Ks1K<aWc@bMtq@zh`(ESW6oj1wir{giq-d`ZmBJx`aM5n0=)p(~rl
zIW)d%UNc_ol8Ls1Xw%_47?mEWQH5?N00vnrYH#z%R@rX+X}p`}yRxd-*f-&aH9W30
zLuxH&6EL$IYc_A)w7RjT!L&=CM{_A8;+{62^aHEHSd%!TZIPfn)U#8aY!l0kLz9<_
zDaIp{m&6-@tPx=F0A`NwV8j#BAStG;*%y^F&}b$B(-sItWe~4zc+L0Aa9cnR`@^!$
z6O~?+Wk&;TK4NrR#I)m4&O-BYfKmc38_B!B*|bfhQA}Gj+^XBCcz^|2veQk4zL31t
zFs6J;%XD<=o3=PBfs;fxEOj%J2GBjtzL=vW8jYxzlqIT+6Ovd~V>qm~c|u*Wg1T^2
zUELmS3Clptr^&0S`T|5;9s#(PK%=~lU@TvH0>MsCm+FZGmZ$-hsF4OLMy6F5AG-2H
zgYhrd{K8wQ&dh9=!El6#Y&2HQ7+qdMWwHz4Ce%9gpwAacn|LLal4Ko4i(|(1GiFVI
zjnH96XyVC_wOqF513`JF=Y<(<$|y*&yq|z6ba{+^PYZd**jipXl654HSk>W?0Z&uV
zr^_DW+VZ6&H9szY$9V)Dmm2p~9L&PRNlU7XvdSqNu>hu{S%%vqE{8meRu7^mkCwV4
z;Pts#guaI&(Kf^)n7K3@)R!&DPmDxmghtDn{j8Hsg=+k6c3eDc?4C1jRZ3RBj3Ign
zkQrjDkRyF<WQpBm@&-w1P7*nl%k##6%#pP4)90!pKEMO{0FxCmb2VQi818EGg`zs?
zlGg0gVcs>L`~e1XrsgGoh%OF4sd3a48ng0qCaHi%PQxgFL4C0P`Z@wfdY+oMSy}u`
zdX&!sJO}Us0Sp=Pxw1{0?u(j^K-AZ!rxZn=L%T<ejSK5X@LJ`1gC1QE_`BR%lYGrM
zyD*V7XkX7CW9W-spTO$n2!=a-^0Z<q6|<#DC<b_B$i+95zKoKzO)ZC(LU&8DQ@Xrh
zjI5eLOj}uXREVpMUoBZKo-y*5P94p|7er)$YzvJZZu0~}^5dQjORo`?ppqug-X!0`
z6WLT5h`5A|4H?L;2iu$Fr^d(2=7~}Fx|R#!GG?r(cQRkzFs@s%eAx}ug=cL#$P{>6
zpy#^ulEr9imY)INAT`ekg#6Oumf@gJ+Kf+EbP(xs<(}bUkMY8`V)3N$?zXBco&r&M
zzEDR%hC|kRD*;W$jH-HHE@+g)h#R!4pRO+x9~u8y-$gUu)Ua|G#*_a-Z~N9Q^^LS^
zooE<W$BogAOeV%1XeB>F`w@i8RJ0~DOKWns211%H-#}wWh?Gn>vm#*`g}%ut81%B?
zXuN6`qkxLlohHjB-vJ(2U>4TojE}Hl%Rd@>cT6#U(72d3k9Qka#Qy@^g-IKeTo+wV
z1@3787+aRnlbPcUw~;{(ghM)MZED^i*y_M-C*gH6z<bnnP)nv5{NPCvp_7I2-R;N9
zKz^N^L4DGRH%0jKr1v=k=)d2Xw{u!N6Qk_KJ2uW(j;fRV>uUK5mGt~ol+Opw#d0K`
z&k!*4c5bQP*syi=+8TFlb#lK(Wj!jhx9q5?udl7HX^;&l9N3l2tooYuwGEB+yXCv6
zU@3dicxC6*cn{uTSY<K5YXCC<ph-#n!_#8`HV}M)o=jWN7cw&gx)x|A&*ft-(%akQ
z2Wa*wz*+!_ikx+|^$m?~7NOsu^iKd|0D{Js-y1$nM(}(9fcF+BJ(+eb;El@PqHrI8
z$M}z3E8}dvps<=7f}~6E&{QHm_Ejt^ZzoaL<?qnRBw*SjGOSq^+SwLvhrLreeDn>-
zpK-n3;iV$oXNrJn4}?g4pW$-Sa$Uk&Sc~yWM#f6=_rL>|j~{a*Pb8wtxuC*H+c=PC
zhGnG16VlmPk&98~fb8ky*FCs<WNsEpY|_^({YKyJg~?rrOg7n|<^YY}CAFThSG}3L
zCba`#edS6FU5cl{%gdrCN1=kvRMr3<zp=u<gls~W|7xYR4h=RENP1_o1_kT~Wj553
z59F?9Ig%SN4wi1nI3$(e|L5Jpg3ds+#U1V-$09)Px(pbr0)ERf_dFKJ7Gqh`D}a_&
z-32TY@VeS~ZNF=|ACCb57Ecx(%#+lK_0)?h3_ZyDS^TXts$1`%DVnVhDNY_|s&Pl?
z1}D#Uo1uo+&$tLwirj%ws|i*AJlJ(ibMoYT;~U}7bY>(pj|Yg^md%?l*=xtb#gr8b
zV#=~A`GzqqGCdB|Yz^cbbl}<ji^^h7OPO6+k|)RWVwJ`;%}nwKJ<+IS1-AkqCd?r>
z0nNaCVPZRVZZ*V@khN$iYI~lK6x-IocCsZQdsTpE7LdE}#C*WiX+r|?^qnsYLZ`Qc
zJ7uR)7KJk(j+WX=c^2pwD^dfxN?TsDuRI(IcBy6ZU&iUq5;4Jes<TR5b=$#WC(Gkn
zW5U6bcuHL1u+VN!=0UQ6Sr*KV(o8C2{|NCExl|9(5A%&e9ofw5P3l69vo806Rdy1n
z=;x!hJP!22?NK+z_zJaL*YoJX1Bl@!94a<yVw-Zh(cMP==q2N>*u-*-Cof@8!Q-Vf
zqCoTcJ?+7$yGeRN-WGX_aUr&V*fHTynGy$cDGo`^4k}}5%62?;0l){4j{v|@(!5|o
z<jn+3#UEmoAvgVC)U>twy5x_k{PT0lmA**W?G1<gfo5qC^*iaS8&4g+nMm1o%^!sL
zx-sWSjsFfRzBIBT6rcdZ+p1SqhrO*7vIK%YT7I_eDO%ZZfMC+40g{-rgLKI(^wU;N
z`)5BUdE9vQ$URB#>b7f}#XRHEwUgJfG`)wZLGokvimtXGsS^+Cr4n+jv7qU^&F>7$
zRzJC9mRo$n*moTT!^U^7JAUP@G!eD~m$DFo=u0XqSzc*{fRRXM>9Dxi5*bW!PK(bI
zB(p;?guKW2>h&9mNiSaiNzRoJ-&l5o*W>qxgPLk-z@1bmm!Zb420|)DWP#`<rF<><
zwLbE*<TXT!>7+2HIS`6DG+)Qua(U4heRL5`yzc1qBFx#$!c?Nt=aauNZa5kjM-9iZ
zGBMStI94eV#+L~GKjZ7iR#qIsy!KEJmn}A|f<|g-Z>sEPgD$^`>azr5O8IIzzvt6q
zKNFU;DiJAH8PD8SCT=!9x~)`PG761<BQNn`;~Qm<g2F;QIjw$4y%(i9Y3p{k5x#xW
zhJ_e>sx@^ehqXet;EA0HD1(_r-gX3HL!n@+hL<!UzZPw08^60<jbmY19_4Y2=G0r-
zqk*95=xhlP=QudwErVq(r3fkIcoYac0BkMp0qR3|g+-7j@CwDWe1dj*at*T#Aus<1
zmRp{v(it@~JCjOkiG}7jZKMf&$YUza0d^csdke(k6v$ON{nk$RsPXt6W7Brqepbqt
zdOo=02`91n!4uOK5Al02cM@<D<gsL@?H6V?c^d8m?Kl&A#V9<vn<OxB^6&PtiI`Ct
z06U_;q|RoZ=81ZmJi3ns_IcoY)A;hY{o)PdFW=rxgV)?!Zf#oAjf3|tUT^t{=qZ-7
zf9M)vc|$Lv>xTfWb*nJU47?7Z+<~&UjQD$F_N6&kub?^GgDlInVHRU2ls^La9>DJa
zFlEyb420;EAd8;W<j3+cC;|;ptmq~V$Par$-+944_B>F-Hd$gfU?t@HJv&ZcP{c}O
z)tMS`(fG=lr^RoLy6;c3f{!ui@rDuq{<lij;4!sz%>@~723)xmtt@$<wB`UBFkyw{
zcd-lTCWnoj4*4roDF8epSRg%jfb1jqSP?`;&xr>rgp+sq%SPW1O2&+!wzS6ojm|s*
z@8vPWc6MSB7k)fY^G477v$Y~#2BK_rjh54IPuV}oQ%LeR#oGS?0``Bfr=`)#WP-c<
z)P1VDYSk)>y9G(^!fg!Gslp}d^;7!lkf(nh>G|h_Q)s8_nb`A$sDK}3DsFcy8PS*1
z2BXVegtJlZCK$`1;|3Hq(?QEM#;}J*IobdEt}*MONxN9LQ`-e7x6bNVnOQ%tqXGEz
zlk73O2A`r)4S^vB*^2+&*x)W3|Mt+a67bkdy$3!e^kk#&-%Ik053XNg6n-+R=iI|#
zTjsc8D&0TX5bH+76>akU&@%emm2pxzT%b+q7MehdyE3$?-30_4RKk7ed0KZi!Rb_z
znQT+molhmM?i_+MP8J?6j80{A1hkpjtmw4<H>xim^ftcRHj4`BhhW9Y?0!N-2BEJ6
zdiquITb*$<?`V<n@S~I0S2kz#x2w+BYtP6yT-06k4cph8_KdHU+B3Yi!$pVlV%%ph
zY3kvkLFCNlvF1cwM&WNtl<p#9#bXl}q*Lffr|_ih@USS30r}JI<j!+XD%!m6VaDx`
zEsD<varcAC^f^2{iim(e-NU;@x6+-bP2?6tCO%garw@-fJTeXE2*x?kk{Gezq#gM0
zPxcWRU#qcar1dD|9t(+zMe+1zX-#su$znA5;ucW^q5RRR?oY}L_gO-HmJaGOr@v)%
zUjI{fX0lHvWMo-%p3(QCaW%_N+WS$7jOc=a#!1=fuRA;{x@e$ol(qs()nB*2D)Esj
z#wz=l@^Ad`=s}COGJS1^$kM7ob*l%xtr_$-Xoa=G{nid@X{)y6#904o{;<IfYf?2+
z*A42l{$z2#e6k#;DcjmKWjj13y1bta+6JvwyE0A5HlDO;o3zc%4z2FYmVRu9ujn4V
zf2GA3t(3LniVh*C4#G1|+p2BrPO??2@5iY%XpPO;{cNV?8CX?qds=C_;{IRE9ygd7
zJ5FZy6PaAOGHquonQd8_63X;d?;kR`-f?Z$AQtZK9z(WhkQRi5mO*5v6L{62K6?he
z4PN7`*^2FD_$A=h+$Zz<DJHD(bhP^hA@U4*8;rIoHElwYT1~H}X}&1-8U8fe2d!eU
z<{!!m9KmGt^TMxa&E3TWTT&?KEs!F_ulVg``o<;g$=Ji=(gxq4?blkn$EKFP+1Wkr
zOfWTD7|FEdZ;P&CDnY>-0*Pv;C^F{VI>K1-ll+;XegVRI^sgFCc71;zs^`5z3mYeX
zTI-G6pJ~;IjIInXIS5|ma9*eN#D=*u!*!s}a#^sI#&WjGa7RF=b3#?du=TB^{;^E8
z3<plC#36twTq(~^{+F@g@!H&Hsg-rE{ho2+@f+i_(6t<(5&+(yX`eTH_H6kC-q~47
z;0cbcwXfcdCq$dpal>UiS*{2u$hG2#3i1ic<v*!u%z;yz<*}Tc`kJj<mQ(erSRSH{
zoHg~UjZ^36iZbKH^OK5Jp?6kgM>yC{H$HNN;do-ca~Q_D*t7D9uZy@uq%3a)xQX#r
zvI}uDo--@<?5&{Jb@EBP=2&|?+zI&`(DxX6{RCBG5HzV)y;{Z*6wWhUv2xt3S?34I
zTI#KONFp^g8djt67N5F45Z%z;q#^*0l~h)c$5NRZNmr*$Q+?i+uo`YPm2j(sAjgJ(
zu32R)%fGy`CEVt#jE%Qytzdd7jnnRJQK$Hqs)VL9q{b#CU)sW2TwOSOHorF0_-gq9
zb^4b!g!QNz8$D$@m8;#|DjocXqJDL{RbHK=s(7lSt3oxkEL6IkoHdltW35J4D}iX&
zItsAVYrcTk)yYP2Y8CM5TX4YA<<qIOfi4idQH-$B*R>Wm+JR8B>hXGgk!X3y*O`+u
zU0tz)NQ-5)_D?uyjnEpR>A72|tG-lC%_l{qN>gf8=dK|Bc2tJigF$sC%`fR9Qb-g^
zn-C8&sPO>*Y=kA2o7PSK3qp|V)8;N%FsEvk)IG-Eem1+1qD7xq((UJeLR!`sOMkvG
zZX=(=5_^_-Rs|@9Yl@|YIIS{mJ9qB1VpRuv-T=VSBeogY1Mnea&j8>M7s08#1>hb4
z_{`Sf6Z^PJsfU?cU9)vle9Lb4_J*2z$?*kT2w4lj5h))_<19{I2H1{@E`Un_RRC)N
z23%${3qc*9Xth&?t0XOQ<*<rpi&JFNX@x3A?8)Krn}LK?{}hcwxe7^7AMt@%(9|9X
z(#f24ov54Hq%dwzFyPTC)aPqEj=K;D$qm4)csoqHmtrwfxaDm?VT;gp6dZL5h3RJ9
zbg*Dp$7{9@k1eQ|7%#j(LABzId>jPQF}Y>;<OEuvw+V~x$Vwd8AjTVcpN;JCKXpdL
zKXhh{7=PSz%6Vtt<?)rj9$$IZcDC`w@k{zjm-ZDcJ5u|~h%1f{JHGJF;^VoemfqKO
zU+cMH=jNQ-@krIVnUC-7YuMdae^uXAzCM3*UrXrM{&1f!LXqqNu|}bvwaPa9tWoOm
zQ?Km9k4N$1XP=_sCtFke_#NKd)Bem)mH6wqc{lF3sp{q2l3(YR9B()^<;C3TN2*`V
z&A%~vZ2NKlscok^?%926<9+RYB@51Woa^c<sO{Uf<E7l4N2*`R%=v29wO!XAIyUFp
zYmPVmI&<QySvfaWADec3)_soq^s_rocc0t!_<?6epYQ6c-_y6Zqc6AfrL2RmX65ze
zFMBC#`Kw>@^u?Q6h?q7a|Gz<g9Y|ZFY{AbKr2&PFiW_eY)@1f6%_wY9bQCr#QT#-e
ztv32;729lo&&Y6#dfPwnv&;68^}~f%p~;tQO}4+Gu*vr2^<S$#HX?pY?a{iM>R!w%
zIpzG$p;K*r^J*T~9^cV7e$zAlz8$+?vR_5LT5Lhv#aHc_H#(1%omhIjyl;BV&s%9R
z>Kk5aboVvvqb44)7L-&goAHyJNS(!UpAtf$riAemRysgQr|l3E)M4w!Z?|o=gMNms
zanS4>YaMB$QE^!#CcWKaL8IaU9*@$5La&9qsUNvS-7p<hj;LbHfA&)8dXeGUEI#>r
zUPkFoq34lAKRrBemo4WP`RcAL<I3lJ!e*R(ZvHAuzt?Ws-q2W6@2;uaVQDOG<<hQ3
zMtFnmlszKdk!H$@(RDhM)8r%)_i@IQ=V#Kf<ksg85yI!5-?I^}2W6Zv-n^~r-D|hh
zHLk9$OSc=8E@IOu(Ew5Tz#TJmE{o86v^KgTo=&*O8}bD@o#afEmtVMh8&pfuB4^04
zRLeH6|KOHS&ptubTL5fy?gDoD_9tQG(#0z5jhpgCq>C_2G@km^S~?EM>AN>Sw+{WR
zV<+R>?{_+JH6^DQqh4DeW*Qq`TaY^m1$+YVo^i`-hsqJ{)X|A6j0Hvb@1Xx;0;avw
zL)Te|BvmzecJfE#>|e%<8Akmd*3cdC9e-$>T#gy=)u)o`n$8Qlu|=O*M)m98b;7}t
zv7W!aeq4xU#*J^Pwakk*QT!Ibe*vUiC-zcar!q5l>z0Pb_4T-<S|g7TO|iU684gD)
zwRXB$tE98qkKP<dE0_P)dM7(<0po!`jWwcgZ57jvC*NA&Ttt23wA<c(n{LJ5c{@Pa
zJ6qn7VxRHEJFkj0#<%|1HR-oBPVySpnu{r-UoewhJ-h!jPE_!X5S+ET(~7lD*ca#-
z3^YaX3wrJ`&c9nlPT8^7ijCZN{iSjln715Y1%WT@@$iMsVwGY4^PcgYKriH1=tsUy
z;0v1XHBS8bVhI|`wZQtnG;<rjq7|t&KKP5v%i@9!*V<fpo5e&ZF$4Kkyc5nwH3ZGt
zkD)Fs*VeShptXZ!(M#8VXz2iG2KWg;4~`(?d<1D`(e0+6)0v=FX&W$tKY1R2w^*L!
zz!ocuFye1f3;i&&a92UDrIe4N>@k3;XtDv)vku^0lobQ;raUP=bXVR@t!R^M*5xm`
zJ6@GYr**A^z{zw*nmJ>^N%<E@H`&L9R^kn({+V{2lA@4&<>d<<(*};+4|F(1HM70A
zY<81@FrCKH_X}qV4C073N8MgZ5+ST!xrE3zZA~7!pGKu<vP?pS@r(CojvK)vVr!=1
z_fpF#^wk?Ep1GKKqg0gk%=%zV_7zycMmoOamAsN##B5%=^_XDn`NwwgP2<6TEW3)U
zfIwbJqsWZ_ya0tLD*(VMTD($HtV$O#v%tEc_DdgSFM%J_&10;;h#aFwFFs<6^C+z0
zBQO9Tcc#LZoKRTp4?zYLJeIkGqY_F!qr1go>PA@*o7cEhWW=c)c}YGW=0MC2LZNrD
z%&14I<!jYgmRj!htL18iTxk65pNryi&}0$7H>sVgDCJOE(`5M`n5!kABQbTBahAfA
zS9l&3EX^#GFvhq#$K)PBRm#0H@k*}SI`ZU*G`ii@X=mv0a<&!=%NJ&;<$|UCOz{!b
zt@PD(g`KXRyw46R%Bv!IP+IiRZ^R^#qvf7-YI$1znS#V+A;wHD)H22n99D@8t*F~h
zCos8D%#lCZutb$2O4Z@rwlgF8&jk?+yGACX-p4VadlMasm_A#8bsPp4_6J~e&|aap
zs4)ix4b$eV3ltTwnOjKM<+Q|8ir8nZJd6m^8vK^8&Rk{rVo75mOR<)4BrOi>XY$@V
z#Z@qZwP?t-H)Zia9oPq!L24AEucE)4h-?sQ;%S@cE_kNBZ`}62y-j_=$V)i~5?kzI
zju_Q@tzFoZ^{Z*v{;ifyVv`nw4b3ye1?1vlXVp0|#JcpMRUODLP40p>B%XDO@!~6q
zKRX58`6Q|{#hvbywfZs;HvlvOa0r3Og$DMcfMxJ^^h7x)t=3g6giNJR^7ucGjv88<
z+Cw->*JTGy@%qHFEU};F@$Xq;yKNM?hUvE~d}i=|VpyJ-E-DjMd7?_#5_+CEAf{up
zNqm+k_DmjNKG}+Q(Ek|%=^8HonCQ+Isz~&n%ome|Xz4v)ASMcHbyq=1U|-4ll5R3#
ze+3p$XYC8DLRf4wXZ706HSU_tt7|u<*?8!WwaW}BAf-p7)QKkrzQ}gMX=c%Wg4_LB
zlG4d^OBk}K7JS0Tid;B_0WD>mIvwl1wMgt&h))-Xi?@`qU&tqnU`u>FO01muLrf^o
z?OwfgE9WP<-PZX|k=soHB4ty#>sD_jpTjMuC)}gO%Dg7bwh}-nz26%xwhm>FJcLSc
z#>@}VWj^L$<)pJ39KzsU0KTnbma#mrx^NiE3Sl3@7mDsEEnrBVb2fBgSO<cAc{2@r
zH+}WDMPg5x*xvhxE5vQWK8l7)T%IdN_uevA{7;ftj=G`bjhwO<%PyxQ8a*8B@WmWU
z=FgwEghr$5)0nNC<WnUKvFw4<0@(|eDf4F2-F0UyZ|Wgj+*8hi<~uCEMOD^05uaj_
zcP!?bVjjHY`LpK$6wR}a)Yy5-B61UjrDALx-e@eJ(uXLsQ}t6KF{K)ZF^<zJBdc3S
zO{@$au!}b5_NHLKD{)R~xeP2_ELeO>z+9xH4Z@OUtWV(;<FfFZnbx!y`6Mo;OnY-U
ztm)bG$O4uUGB!FEDKbI5?*pUD1<dq>-p@+KFr=MK>?!VbO%U%o<Nuq~UHI(s<;yZc
zG&D-22*k3sT6(U^J24N)6(tT){@-d<E}$3A*5X70d4OI`C8*0EQAZH&rN~9+j0RK8
zh)r9fcG8i7m-6A4CXP)LB_fvi{xq>D7pHdC*~_WKU#E%1%>j(GpMXnH4sb|!`-6c<
z#HYC?Sv($4^pqr9n<KnJxf<x!0I<E|`@tGiYzBA{fF;?Pa{A;(%!I9=2lc#{rpzOo
zVO9b5H9tg?0sFv7fv&u?Wdv_cM~sq&b!!dnc$U|IJ<cXdhiQ)_GXSJ-j#rmep!GC$
z;?QwmUFpHHADO(LP_iD5qaW(sUM4<sEM(UO$F}6o$3PIrA@F5l1@%^*`w~@;h9jz+
z3H<Ez#1c1Eh$%$_zKzvse&WX!;`CUy8`xZ9WEG;^H-dz7`GdrfO7R@q*h_iIG}dyU
z?w5IH=Py9S831Mt=WDV7c?)I504(r>_EE4MHr`6ucF+?~-<o$3=G~t*t7p@I@)7Fr
ztKOGpiwO=Z5#iCqCkw=^Je&@j_KtwBQ~oG1XCdt|Hz#&46#nF2SrSh!6rNd~7zlCT
z>0}7G551gh`t%_|WMb-K+E*?lqKm}sr2`%1<23#kw)}HqJvuy*2rL%0;?6|RVlh1q
z!A7bz{l6vVtg!x)G6D?FEHCHK`vN%UDi~rptPO~ndJ-hFG_vhr`DXV12^BX1d<TFz
zo0}$s@cZ)QqeOt^tv{deRf(zd&V&A3s$(`YNbcussOdi(%|7`eHF_Nlk5G4Z<EQk#
zQ6;V>3(~t{sc5rrVoUc^Ah)7;kdRM3tTe*_p1J_O3Sa=Z0bo|-IXpcF0P`ugCH}Ee
zG&p&``Y5q=l^84ZMC&S1GKvRbCkqjSydB`i#EDhH9Uttsb84$AnM4H_Prd}q98BPt
zP{M6xPmDKU-iO#ma(uvA#e&5Xrxe*h5OLdY(TREeGCi4DZrbO)QQBs2$cR%-A&rBz
z)dC?pG}S3nvddbxNg#kXO<ppV{!~bVg<|vbc`tn%s&oL>=VLSnQz5N~luE>c1OE9G
zYxOKGVF$g9vhhgD<ZDFg-|4IWo*ncFz01~!pW3Yhmn6HL>xF;Rfc22yr`FaD&fLVc
z>&58YbZhbL^<r)uhJ{iheL-K8_Pk!SZ=)hId8rMLSBN(?Fw3&9Lu>(C05%9Ltj;0A
zD!u54SaZmqH;R*1kT*Cwr4P`*<=&uX4qI<<gSawFd?V4jRm_MlAkHDiyaD7=dhvmF
zYN>H*E1evHn{pL_n6tbbDgUvoa<XBbXgmF-gwsn|oKr%~@;gLedA=<1KgS^S&$Y1h
zxude(=Mss1+eG#l7JbO9DOS?vMV`8(@cpZaBiqENxljZQoAe8y5|q`JT)BHuNwg8o
z^cO2a?;0<!Ogz0!XmJgL<<Vu7o3PRS82vGeGiy7k+!FPal*b9p5Q(-F0fER+$%nKs
zFU_0?{qeyE{Pg!Dpk?#T3px`<hyJ^$cp~x>NGA^7QX*<C<NZ|jxnxn<4EzAYd*81Y
z?KUe-)zMhjSXYPCBm(j)R9z=+1YJtq1v|zP7jiHJtS+tGJXHDR2lQhd4YZ*$2*5iu
zZ}NQRl4)JzP^vpBpT#t0;R&iLpQ6{e^{1@@avXz!rV7XiCGN_*QO_R2b<_y5;|b#L
zh|qbY9=hG8eM3!sjiuEG(RwA2uK?gk3W1pwGqI0>eav$EIJo4vGEPn6aw2BI=RnKR
zg$|CbKTXMQRItfslf%lw>}TW8et9jhZUJB$*Ni7NC+x7_idR;-9z5}})_FW(U$*XU
z0&&{RUqaby02cs02KW@f23jC$tTM6%Pe=r}v^*tne2;YtD)?H9Z?sO}^&SAWyqv)I
zAzt}{>oT4oqH#XPw$A1Ftd31I4r$U%GzV)e#)uazI}OJtWun>2vD~t7VVU@>+5Ndc
m87!l#)Apcmg+xY|$msq3F7ZvpIZy0T{uWAf?GXn!`1t>)IvUXc

delta 13748
zcmaKT3w)H-wQu&!Wb%Fh;Soq+LI`1iB)ne&AwYNtgqVbvsKaFDn`F#nX4u~(A!Fiz
z;<<Xu@wK%>tJGt??XT2F)l`F4PpOYeZR^2T4}7PdQjagxTCJX=Qj2%}*Eh*bqW6Bk
zU)JpB+Iz3P*4k^Wz4PGn=^qWI=l?b@FFTFC+S<pje*W1<@=xT7=)eoPJ|V`b>ik>F
zvZzkx0u&O^1p$W~OVF?dLlI3*P=CswA&S(shl*8c!Os6*`yRIp%1P>uf(mN?WI_BA
z;C9+%9{tFCfC9#=9q>n-7CDA9o{(45EtGU5hP8VAnk-RA3Ts5sz*B{1EbGzBnPFHx
zon9l|)2?|sWEuKqc--Mgm(=78%E<~8iLjnQzYg;=*J07y<+6b@<LU%WYw~!Xn5GVm
zpR*Mx<l>>8G@oTirxS3d8@4W8lX4MCMz+(@fUz@jxdKgAs4vE^r`fKWuteBrqGXop
zo#>d1t_@C`k*<dW{)pLjKB^a}fr-;+tfZu24fO<dJEc;moT2OOu5edGZc<-P3?`_5
zXp&}MkKQ%v!%3xMd5^O7h&!UW!tO}BY*15*or$(r75}(+8_=ig5iP7cGh_pLZUI=Y
zN+&zYQ7e}c7(x8(K*;TNF;clh?VG&8UPMhimfK$~8aO$bn5JG;mdu<}NrnD{f=HFk
zIE~CscZcTnOI>aSULLFksU~%xq+D!Mcb60o&Dh<oB}VWKyioFh$ZVvB&MX@5nyJed
z`jD|np1ci{H`28O5$Tp5s?co&Kqzx(ZJln}AtUPDsV-Xg{@07uzG;uv^SI_pskN*j
zU}Uw_Z)@CI*HYhX*rew6IxWQB?oLf=z?#Z_wn%3<Afp4j9OYKAQe9KNN|dW7%2&ji
zfUFr{<N!vtb|CBydciS<wM~miCmPKrU|9XZi0nW%fNY*mhC2Ov$QP2G?ucwfSysf~
zsS&|D!-fq>IS0+>0+bMNT8Zy{ZHBdsMlr0BP={`%;$aeG${rULYC(BKsTqGKCcLHM
zO>2yW!A>k3lDd&W1L*EHEt=jQiG&>&EGr!HT0#=dYzc)No$g?7G`}GfanyB1+C$PG
z)x2^qRi6i|%NW2x0xj|o!Dyaz`vX1hUWYsEU*YgOXg2b8R1~FDsE?hwqDlS3xv1a>
z)fpLGG7t*WB%9Tm*%PX!P?<aca3gBd^?;^@Qx;xLrNmh`qs1-i`q^{EnD~C17?;C5
zZ*AKjkoOO~G`rI>9t<ph3M4|8x6to#A@5g>Ri#DTG?%E;?UsIbYe3WGqv}xACB!IC
zSG{fLWvx&@sXma2wUU4=Q?qJjYyr)U^fnpl3Om!~&nPD!Mo}*9Znxi~xtME?qeyg)
zQU*p24F}0(<?*zN*Mw=b%z3}HvzC~q&d!U8$JCzrQ`RKe^Lh;NI04c?tPrxL)=7%j
zMcQrzV`e9iQ@K2;em-B)URN$~h}bX<<byn|ppoO%!huk4rxuLpBtG6YO@}u3YVsir
zWKXV3K7uakK9bysA-qh=Z)l@@8aV}{JVkvJ{plMB931%d!flpizoDdj5#YA~zbAkp
zgPJqTu<BaGNcTsyPCY3bauDrKs4YvH#_?X|cmi%+_xpNX-d6dBdU#1Zq034O#wva3
zxoIp>>48v>CXZVTOZ7Z?mQW1SNXcb4l>PxFq?d-yux#22-6csi>GC~Qw0yRyCkA#e
z?-pXO`nMIU#0x6#l8OmDh5WGelS-i(ggV{+p!{rL(<Rr68qAay(bX#7M2b|Z^oN~7
z_Kq6NrU$y(<OTKLD;J8Q`<$zUn5AZ~Zn86N&Z+BGuUdJSy70=4bkYExc8IqwJ)|f)
z+vGohZ-jJb`-48|cF9mclNR;&)!nq`vUcxSak+ZwvSRU^dhfF3lb*+<a<yQ$UxtF_
zo?HB0*{hZ}X*rmqEF_B1L4LexmiSn`($q^U-`ZR|2II-E(A(Cyy{Ux`t-G72G;m{d
zBTb2Mhg->y(S9u9GA!O!Bh%aJ>hK4>x;%%*=|K`S-N+1wWCSuN%Q5IhmELmsTt)#g
zYdB5{O}+&@P`u2ri4`9-&(pWnl{;sspS3KbGvmFM)v@=1yC9)j68oad8Ngiua1LlH
zF{f-#sFU=tKNQqSa+B-Egv}1zwhY<n03T4-5iNPfpa(CKCOTcHAMLnx7N*}Iozy3F
z@`ea~bLyw<?db1U3wO<o*)hr$$m6_>W;=9}0o_rx+Cj4ZA1Gf4oXg}mr0*wS<nG$u
zw57SRZe6`=^ZLYbjmpbVnYDdqeN)rs_4UoN35COlk&)R{zj1SOOVb|tE-IMIUQuUu
zRm2`e9{N;H0(b*p_<TypAj+NuuwcUPQOd9ew4jmU*S-EWGF(36BE73q{sql00IUVr
zkBaOKo12<jT+BkRq4XVq2>>1OZPlW53Lhk}aSWT+?}^CQQRf2Kr+&V>HpY4jqUv>l
zeRK)R8J4id28yZQZN%WZJcCYW8B<t>yryopcZRy4=`7tE{rTlHT(5U~s7Tig;Wupl
zAPMaYTu!pBOXvx63;vx<V>0rva^{MsxRE;?*5!Q6!cJ#4kY|KsxZNGp*)ow!QI!sk
z)5(~7WKU5}21=|_Ym=Hfy=O_{{2^sc+NaG=qxVYBz~sx{%vqb%{n%Bx8bg;LHF8s#
z;bajiSUF`5<I&V=-wM(My}m0f9ox|0QUVE6Os+=(8$B7#o5|pDt!M6$8!-+xY}7c!
zi=h8EZNdB=f27?N>Lx3~Pd2)2S8Mz}Qzs9c^xMQ_=I<(?WdWZBEK`wPqyF=1=PC`!
zb^vBdW*DrKgovfH6;&8|gw8YRyG^a{xRb`}{JMDH(~i3>b{=bnx-)o#ombqb9HEV~
zKL<LC+<}qT5xSwZc!1SHAYm!Wh3d9Yu#$-hnd3pC)|Cqv$(iVj&5K%AFOFJPE|=%j
z%y4B4s96uldFa3^{EEt=c2kU<v>&M8wXrZ`sYV7FfbK{{vS^#04^J#zZb9qeHAA`f
z=-g_Q6(KjFq1ZI=`*5*!Ewm=<5Ykk6NHddsA1S5-mQF_zkf)w|nP5D<J=7z+)vU+{
zVwO;()LP1`K)-0A!>>E&uxrz*Lcu_<W0w3%9q%a-Q`N6~mWw^NA1JmnPp(zd4wS@_
zEDLjm&T>)=l9|lZU00zrgUZ-Cf+Ix+)r0iIbR!=}w(*{m$dIM1OBYCGBc_Uc(_PDD
z4=>aeabb)bsO5%%ClBn0^EU08VpSjAntctrTgd>8s=K0PRTxixi9rRAmr96yujX@i
z1tP9i=?;3@<xT2*bTN@*+BLH*F%Xv=kL2ngHm0<+Aawu$r@uS_03Au|f*O%G5il&i
zAd3yz<p&~$wL|NbPf__d*OVi*aLDBe1%3WDc^l1s7yaq#*Zu#SrgGV}e-h$|nt!m~
zr>OWsQFYKy9)+hvuUQ}RbZFA&4`{UgtksiqW#xehlROPii77imo{Rz?9ny4i4q=kt
zRewBqFU#>YVu8AFsC*rB(g#=;xISvD?(GbaDDi-;R6<5IHZzs3c|9T7;Ui<rG>E^i
z_FYFFu=>$;M=$*jErRvHg-rMx`ihzw=2hAqV5I3XXP6Xh509K}cDv>dklG=KLEfYO
z*Y#TxO5nrm&t+c<_KjvWd)z)>DByLN5^$6X<t3=GIs8EfxnTat1xwXBvT8N5uw*|?
z$FP%M)8-FG)4f{vf-3pBnsCcfT71JTm4#Thk%{F*q^8N&)D5@9#6PR_TW5(Gs`}O%
zai_Y9;8At+t+mxrtnG5@;j~7_RMSZ9U9B}kq|oIZsD6k*)KXO^7Y_XW)@Oyut(LHq
zwd&OEv&4<+liN#0R28TnlYRKOx^318%&<UDENh5U??q{L%D&yLLU&Bxv>1a|m`jIn
zn7ecnQfx**7>rD^wZmW=^8Grz$fPj&LA0$=XYX*tu(`~S^1B$#uD5qZ`~f4qr`=DK
zW7mX_4d%6^AS8w32_V=9z}n&-ppGI7jUc~|ECkcE1|pPljxiM>v%n_iTVAN8Ct_su
z3<)VUBpcIbSV<B%x?@<{{A@BBwsx?_4=`OzkIy{qPN<W2PEI*-he#=39{A|aXY54g
zNA8}v4E{rkG-K_=<Y!UJ+?{e>7+GX(xb}A;0QR~nIJSqx)PL+#+bjoGR0+T)C@gy;
z*XxeBTiv?GO#3_F`?EUyL!UUOKKS7t8od6#D)Z2qsSez?Y^!M@qNiBJmZ5W;X%W4G
zu73q!$*aXM-)5_^IrS#mnfBF=*U^$yL8fWhFm-VV%3lB+2RH+O)f(vme~=;qnUr=U
zKGVb?*E2{?qKg(U|1uE#KQGxP|0_^KEtwoQtR&?713QnOw}{nh%>(t~bM;RTydYjx
z4G+#VJ&p<JaZbe^yr-lN$>gauAJbS%z?nlX%8G|d>%(Zk6DuIIi!DGG*=uBT$lsw#
z0Pu<=rSzQPX&=OAx(!tWcRy4uI9NqK$LXJyOoZ7_+xrPR^9X#5_bThdWrbY$x8a&|
z1B)KsEMk?Il(nJ7wDfIB^(T1=3Hl~U`za8x`GeyuWv)C;P<NkWpTn_c%^H)s`3dU6
zY79|0;dAQsOZw9*2z+&L;HyVw&>=TaHt>w7h8bm8T&`%sm9L_+MVGq>XN%lTFq%zq
z1{AhYP^Djud2GC$&9D2^+{dQx25YAXJZ5gj<yekcG!M}L9PuP|%vQk#G+Iw!ls+~c
ze;3ZSuhfqpyR`&Hl!tl`e~^4D{eAlLtoX~tVwpPmb@jlB$3xbbD5m1O(!Aw;!aF6A
zp3#>@B^6YXktmtjmq#U)ec1$O9n0&_kCYGL_By?@BQu6_R6l1#Zfc*E%1k)-Sl0cJ
zVERNFVXrDqqkuLg92jPO+AX=a6sQlMEZ<nwmNwLIecF|_w6y+$zJlAVN9?w=Bc--9
zkF~#`KNmWTYDs1E7mS!rH4j-6sf_QND@rVV1uF83vc;)WOi!KSF>8NeWDX{Uug}iC
z=N+?n=l2z=7k{yI$^y*pevps8{xK2gaQ^znsFJ6OV`KZrrSu=m{VjdD-m(Po79O(!
z*Zs5(d?M{gy)7-JM?UvhL?bRvZI#j@hg&T9_7(_}rA4X$@p+ftpV)csw2V3}AAuIE
z#$N<-&R<`~P#@Z>6)EM3tx2i9<d|(JC(<Gdsk>VE^n~$65gdB_^%Z$nVsGvj>T=8E
z_{sGmOKDF}iS>^ku}iB`_h1y$tR7KUJ0iDcL~g`RdPnxF8`09bHo*|;cfZOTGqUBn
zl&T%;M|7({Ry@Rtv|iXS{CPKcH+nZkph5U+vw1f^aOqIX{t4bKsRS`ep$eyG#(Wm<
z*1ib@w<SAMt|2+7&*HNYUr$L(yMlzJe`5cnlwr4f8@-qHP4qSmiEEp^Z_)$JLjx0U
zk$gmkx7gbfSvfStt5;KM%up`zdv#rWev=rtv}kBki2-&D;l3+v#AdG>>Pz*kHoQBP
z?U~JDmuh&Xw4NlgC(XIL!90YZ9HZHdGSuzYDcs|by-;SDK{UfL3lRhddvu0yCXZ=(
zMm_w@=A0L)l^LQuuWZlW7@LExa{;OWaI_n?h4bdklTgi)kH0&Sx)*>o<=sf_1s?Vt
zFCt|gE|@_&obFZ8;_RmS#_g+y3}DkztR~f86U~L)n7y{Cu3_CKmH%9gs8p+;n_gIp
z-kCMsp+FbK>*ZJ#er}Py5M%xKz)zpMSyV)G5;~vEo1nZvHPIZ+yI}F+`OD`@-Mv9R
zLq+O4r{)z)c9874=8<$A@iHd(1Q6A!7f)@8rP0ot%i)#q60un4bd$VrDGlqcUAs(!
zlC6!yz`-WoB%~e%_zO_NnPDf5ElA0B=shUI>1KL}D}XO&eSPEB?R#81nq&1%63Rg?
z0N4Zoi8f6{_{#DtfTWH2C2C>TCXX~D6ZRH6n`~4Trx=wUwB$7+$Ya<|Q^LrAZ9#^O
zp-NxO48Zv?Y48IYjBXMWXR-^q{MIgifZS&@;;)kt&f#=6i_W6sMj*C$x(%BL7==sT
zihkB`SF4fU5u_VE)7!Ony90W$I`mnI!!!Z%;FeS1%4A$wOgr%w_0(<l_`No<U|`a3
z9}u21<0c&)b9Bk~ijU@;E?;%RebWAf|HR%?d8c<?aeBv<r>|^3?Z5hT$Nrc7@^rgS
zG1-Wyx6sc9OACJLEj#eD!{Wh@*W$yE$I^zMHj5uWW3L|A`uks6)H^R<D5*(vZWCXA
zYELWOCG=cc*9&8Fn+vi}EpRj!seimeAr9qvb<rAg57%wo(cDts<f?DjX`1zjiKc|8
z#(4r=bY&-9;WoOG)OB)<yt0HAS)l&?)j8zJSzja0RI%6gZmFZ8=$eo5<~DA0t=rzv
zQn$Gwl{e^)&Z^T@4=nA}U=GEY+gxsMCk5!s2=`c3@jAT3{jU#R_GirJf3QX4!Q|U8
zNWyVu@8t_ry$Qff^*vywzoFZL913ZJsa$kHC(8-Lc-8xdb!3x0{fGPVa)2$NPgKWS
zyX^BZSh+g&)?zVRU3_bCP8kZ=4EsQ>e*2oLUh2?5Uhf6^B{S<S^j}KAu=Thpq=-Y`
z;Yb*;Z>xEqOr_{c`a5eWI=|_i&hkpE00bs0cDQRQ9i-XEp+0}-M|S8$**oyVcaI8j
ziMr&xLt|R}3B~6C&HyB}9V?bMsLaS|+}_->u?c~~wS3zb&8?B4P^8A&MbXU~4hdYy
zuh>)3S>bJ|*i^BtqWSV@dNpcgnmT!Yqn$OcU%5Y;tSaAc6y)W+zu3M6tF2H2@4qFU
zQAa=U)7mT_O5svnAO2C)siwd5PJfk#PsG*DB^n~~EeqT_ko(aTQO(L0YPaFI#oWHN
zl%X_;V~D`F^xUo@e_bB`;W#l_{p&}*Qn>^qT?(*_z_)hrf4ohsP=g=uo!SlTLf$|>
z^1ldtOY_Ur_D{YjK|{F;SiilQqZxyZr&jN!eQ_}D^vWxKbJZ#FRP)I(zuftotG<-0
z)xCdnwljA@^_psy74BNf(k&Y9zgaP|ArHPZH8UiOMIh;8Q_v$MJ(?NkWzFpa%BKNX
zX?LiqPbbEVObST*__`Sqn4*v8A$t;lH7>7y3$p70axvoTNI{&8OoW!`PD9EkQ1&Fi
zG&JF$K|MI`U6k>e!HRl1D{80d&atN64IZ?H+jI$Mn&pck|2<|DZl(I<)1nw|3Jkk>
zEy`~)44Y23)VK}zaKO#5f<!+>f4I6vmIoICE>a$bom_Le`!&RVYTg!+WFeCSOevR#
zF7l+u<&leM#)h@k?Ug@6rD!#k$1Ez=rxQAL__Ok{V|flx-*h{<i>f9KJn`A8tV!6m
z7LrijzV%cdwR$KrHC5$b+(D5e@5PmMT!k)jGbnN?08>2&W!V4|2#aI_S&}E&FvF=o
zUo1+$oZ9VB7cS!3xAW^KtZj^z#U8G%>4+xHknCW{F=R>%OMNtBCtDZv1b_m*lc*bA
zN^M)~bl_crgDoh@o;w><0yCQ#|7WY1DCWg~WED$S%t6t7fIDf%&cdX@V6KC?c6c!+
z+i_H?CO(Gl?>C*qI+-n*yP$+|ZGrheh$`j?KD*B%%cpTh#4RbPuG3-A?cpnOxrko_
zOyoVu!JZ7Q)J0Qs4c=uF_gXB5U~e>DxI&B@yeUJJiM7Yly*b|82l9rzrG8rkV#!~h
z&71E{n@paCnHOo^f<9ZfkU5cwi6&{@!uUs-qSP^_&-%dFA*W5G^`<$;B}~(&v6Oq`
zbFxIG^CHsNplCsjX+czx4N|SQJ2v<W^I3H*Cd{%TeqEN>7vufhK?S%)@|n>GrX8~h
zGYs=e(ss&2Z#K%9brM$$NkVGaC<w%;8wR>61s}6fBYo5;NPkxS^)whEQ{&fVi~iix
zQyNe2zVdWi$7|VvcwUZ}FNy|hbA;8haSb6HI#ivQ0Si0pi05gsc<zKVROf3rGrWd<
z9D2HwIPVU}Z^{!>MKu1CJVDX5xFuhF&y`d(*8_1AKr=uK09Hx^Ye+MrouL%n@O79$
zZ?KhvzBQ()l}mm=M{8FQkqcdhX@x!U3;E(|T8CC3c38)gA(R@_VuSv}_`i)6mBJbS
ze5_b5(&F>SiT!k*J@nV&_*3J=-tuAE51q*fU=GVE5WXE>Q6wDVJA-?RM7a>HgR$|%
zdFJNUf+0XHQk*1kJh6|^39~a*I%|0BwUJ%7Zd<*pep}t<ttsjm5@T-pu$0k7R8oL=
zQJ{+q5l$nMjso1H%#{>Q)lFW2TM0VhGfBmlMQAB|sng-XEfdAn7NXPR#p1s#lfRWt
z7$Ge_P$FvQJd6e9x?FXQjeG~}a+%Ioq07}=-$Xaou7<j8WL>yOmz0)@+FW>^(g|=;
z47Qhw#?j=FU8n?QjJzOSn_vy*vp<%CC<bo@;D|1hjQN43g&hi(2iqvRkhM-1FhhKp
zSbG*kVN7>>hz`WVH0<s4r@tlQmrWE);*B+8+TgKi;&zJ54bCeQ1(q=^rR+CBvRmZG
z@y2pdcEvQBPBe?eyt^jY6$r@3KorZud2|oZ6V0u-27Vyj|9G{2d5o$|UyYqevU0@&
zLo9@~yJ+5gfQ6<*3xmh7ggW9cm5a$S*p<;dx{Re4G7cZT!J=1ML5yNI%Sew7YY-L>
z!%pr<!0(ZEkZM@pnrBT?YtZ!<VM$THKS1^fb^y$6WJpa91-h4Nl7a?gjkJYAUOkJF
z%s@#dVx3}6MS_TTgOF8%Rm$K~GsIY;p(-0F9(=Dtyl0R7zqsoB#jn5qT83y2EfSY4
z(ac6ujvewS)&ahuD_D9%QRk2~l;OK?zLJq0lr<~?T|P-2F>w$1A3EO+8De&H<_bp-
z`E?$*^j;F*UL{IIZ#+;Xmgc~3HofG#;ty4cWwCaQ<R{=1^p+~9yL<tEIIMYxJmg_P
zPI9X0>aIn{H9%Jf!20Yel(F@+6{%MMm{WOQI*<(jbOHnc)S6GzWA#`Y>%Dy_<NZr2
zL{_}a^lTXZ6-|aUf(%pEnVYh)ptg}7rRP|B;uQqa@&E{CZ>6iou5jXZg@~rhWg=}}
zn*0fMVwZ4urzv4-j0`?N=rP2P3Bz&v(?5?lP83TANn)N!U&29g#8b#R@5R*E+kkNr
z&2KWF53X?Nkx<wnXM;`<CD|L_v{=k2oP#t6WVqA9c;8}id@}2di$FjcA;NvbFzn<{
z<F!k~?^wTH$W1&GssidEd0<kX!X)koU?No`#meJNq$UBd%1AvzucBp{7ppKVM<1bu
zpuo_xBt44;ls~5q&km}kVp_U+-E$&-Vx^dy%fT31w_od#PsTr9N$1Or@ky(MFY!`1
zet4B|&+Wz>;O!kxIErlh*jerAqg=)KnALQqyb)ixTHH}O+)@4l`(PzJNvG0m`JZun
zEp>Q0KC4!27DwZ<R#e8o^mxif&xfP-YV*Z!0bz({R8_HaeZGiLIrB$p74z_6qTY=u
zC-ur&WSPA0Aax_aeE>|^oD^<^m6t0|V58YhKNX*`MpVpu3iHpQx+K3P&T>}L^fb0j
zlP^)D*U<2wP`~`l5r2Ay$Qb;WHR1}W=zr9SPTN*igHHkb@Ex7ZqAuoZ4i8c|vgILw
zn*sI!K<CH-q+S4kZk3Jk$2W*(J0Dgb#|t)!$wJ0wZxkitc@Q?RVD!sd0IrMg-6&i!
z=6*1{$@>TsI1_i(Fz@8csA7Kr@gE7Bm8~#7efbb#1u9|jvw$&Y@yh8nl0N`{>t)n2
zv0tH-k?EpC-V>oS_HY`7?D?@hHrMM9QUFY+2PwVg#+6|Ld}6XC@g}lKuLL{Ay6Kxn
zc_XSM01NcZv<AaM3IJ>>;lt_KREeD{H@DAJ6l|S$(xV4rGkKP#`Y!$HZ^Zw_Mkniq
zP2!}@467ul{rooJ8$YZ)<WH!v8CsnmU(+Ba<fLi~cY|0EgN~qwCt5&@(0TYM+6SnJ
zlwa~N<PG8j5419M?<ifs8h{l7Gpl_Rv&t*c5q{#R2eMNW`j8JlinY=mwfrMB`;z|j
z4^4Y|uwlEX%oMlAyLXA%u|-5B_=|@zae6|uzl-{K`6&@aia=J9P8@MnRd`$(&8#AA
z=8kmH173d4!+f3OW@hA3oXaa`*8dd-p??twNzE0JU7AzGr|lM56IlkpyoRWyBaZBK
zN&fetc<pX6egPx`!zQc;$OgS4NNnK`P)T#6IfqP2PnDbF|Fm0pW4IGEa@}69i?C4$
zn_j;2OQvqDiFrQB?!AO&6l<Fj0dHiq2%JS3sA^<~>4~WZ{JKdhR^+_3v)2(}>7PU_
z?y&p<Y>Gfzl2^?QWksGr6()<Cn<w4C4`3gBV2|jsn$LpLTN+v#8gL&>Kpv#(297E_
zEe+>w7)zW7$4ls6+PNxf;PlD!z{LW^XF8wmd}?n&TMn9Jm|=N(UWlSopw1km@&TTu
zY?=8gKA+w>1pKYl;1PN#C6A$=?TAD1UtKAt##oGdP`VmORsmd(EZi{DLt=}A{cScj
zk^zTn(PRoH%ki3($Zi0590<Bm!8)E*3`+-7nYBF|;hR{`G@vyrH6K!}KiE7!f-DQ!
zqeyZ5=_FD(iOq03S+Md|6uklP9>8Y+7XU1n3pmPrWY>li-q)F8&3qMO#<~H8Hv!xR
z@Ld3Yc5)9=%y#@bf-fuhPU0(6Fe{c|nPmVRQ)89PN;j#J*)wBqg>zu)W!OBVl2;PM
zX~b%c`IDIlx|n0gu5UcxT-h1&b_KN6^6!?xqb~7%i@j3pw)|~pd|9j5Z!4m8|6h3{
BDsTV*

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 18af391..6df9e6b 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -498,7 +498,10 @@ def cmd_provision(args):
     hp = st.get("health_path") or health_url(s, cfg)[1]
     compose = render_compose(s, st, inside)
     build_services = " ".join(["app"] + [c["name"] for c in s["companions"]])
-    deploy_env = f"SITE={s['site']}\nREPO=https://github.com/{s['repo']}.git\nBRANCH={branch}\nAPP_PORT={s['port']}\nBUILD_SERVICES={build_services}\nHEALTH_PATH={hp}\n"
+    # The box clones over ssh with a read-only GitHub deploy key (private repos have
+    # no https path for the deploy account); the alias keeps one key per repo.
+    key_alias = f"github.com-{s['repo'].replace('/', '__')}"
+    deploy_env = f"SITE={s['site']}\nREPO=git@{key_alias}:{s['repo']}.git\nBRANCH={branch}\nAPP_PORT={s['port']}\nBUILD_SERVICES={build_services}\nHEALTH_PATH={hp}\n"
     ssh("root", f"install -d -m 2755 -o {DEPLOY_USER} -g {DEPLOY_USER} {root} {root}/volumes")
     for v in s["volumes"] + [v for c in s["companions"] for v in c.get("volumes", [])]:
         ssh("root", f"install -d -m 0777 {root}/volumes/{shlex.quote(v['name'])}")
@@ -516,6 +519,15 @@ def cmd_provision(args):
     key = deploy_key(s["repo"])
     pub = open(key + ".pub").read().strip()
     ssh("root", f"install -d -m 700 -o {DEPLOY_USER} -g {DEPLOY_USER} /home/{DEPLOY_USER}/.ssh; touch /home/{DEPLOY_USER}/.ssh/authorized_keys; chown {DEPLOY_USER}:{DEPLOY_USER} /home/{DEPLOY_USER}/.ssh/authorized_keys; chmod 600 /home/{DEPLOY_USER}/.ssh/authorized_keys; grep -qF {shlex.quote(pub)} /home/{DEPLOY_USER}/.ssh/authorized_keys || echo {shlex.quote(pub)} >> /home/{DEPLOY_USER}/.ssh/authorized_keys")
+    # The same key pair, read-only on the repo, lets the box fetch it.
+    slug = s["repo"].replace("/", "__")
+    have = sh(["gh", "api", f"repos/{s['repo']}/keys", "--jq", ".[].key"], check=False)
+    if pub.split()[1] not in have:
+        sh(["gh", "repo", "deploy-key", "add", key + ".pub", "--repo", s["repo"], "--title", "dev2 deploy (dev2-site)"])
+        note("read-only deploy key added to the GitHub repo")
+    ssh_put(open(key).read(), f"/home/{DEPLOY_USER}/.ssh/deploy-keys/{slug}", "0600", own) if ssh("root", f"install -d -m 700 -o {DEPLOY_USER} -g {DEPLOY_USER} /home/{DEPLOY_USER}/.ssh/deploy-keys && echo ok").strip() == "ok" else None
+    ssh("root", f"f=/home/{DEPLOY_USER}/.ssh/config; touch $f; chown {DEPLOY_USER}:{DEPLOY_USER} $f; chmod 600 $f; grep -q '^Host {key_alias}$' $f || printf 'Host {key_alias}\n  HostName github.com\n  User git\n  IdentityFile ~/.ssh/deploy-keys/{slug}\n  IdentitiesOnly yes\n  StrictHostKeyChecking accept-new\n\n' >> $f")
+    ssh("root", f"k=/home/{DEPLOY_USER}/.ssh/known_hosts; grep -q '^github.com ' $k 2>/dev/null || ssh-keyscan github.com >> $k 2>/dev/null; chown {DEPLOY_USER}:{DEPLOY_USER} $k")
     known = sh(["ssh-keyscan", "-t", "ed25519,rsa", DEV2_HOST], check=False)
     for name, val in (("DEV2_SSH_KEY", open(key).read()), ("DEV2_KNOWN_HOSTS", known), ("DEV2_HOST", DEV2_HOST), ("DEV2_USER", DEPLOY_USER)):
         sh(["gh", "secret", "set", name, "--repo", s["repo"]], input=val)
@@ -623,7 +635,7 @@ def cmd_deploy(args):
     s = site(args.site); st = load_state(s["site"])
     ref = args.ref or st.get("scaffold_branch") or st.get("branch") or s.get("branch") or "main"
     log(f"Deploy {s['site']} @ {ref} on dev2 (as {DEPLOY_USER})")
-    out = ssh(DEPLOY_USER, f"{WWW}/{s['site']}/deploy-app.sh {shlex.quote(ref)}", check=False, timeout=3600)
+    out = ssh(DEPLOY_USER, f"{WWW}/{s['site']}/deploy-app.sh {shlex.quote(ref)} 2>&1", check=False, timeout=3600)
     print(out[-4000:])
     if "Healthy on" not in out: die("deploy did not report healthy; see output above")
     mark(s["site"], "deploy", deployed_ref=ref)
diff --git a/dev2/sites.d/agenticjobs.work.json b/dev2/sites.d/agenticjobs.work.json
new file mode 100644
index 0000000..18ab30c
--- /dev/null
+++ b/dev2/sites.d/agenticjobs.work.json
@@ -0,0 +1,5 @@
+{
+ "env_overrides": {
+  "OBSCURA_MCP_URL": ""
+ }
+}
diff --git a/dev2/sites.d/cigarunderground.org.json b/dev2/sites.d/cigarunderground.org.json
new file mode 100644
index 0000000..7b65c28
--- /dev/null
+++ b/dev2/sites.d/cigarunderground.org.json
@@ -0,0 +1,3 @@
+{
+ "health_path": "/healthz"
+}
diff --git a/dev2/sites.d/genrewatch.com.json b/dev2/sites.d/genrewatch.com.json
new file mode 100644
index 0000000..5121b1b
--- /dev/null
+++ b/dev2/sites.d/genrewatch.com.json
@@ -0,0 +1,3 @@
+{
+ "companion_commands": {"genrewatch-worker": "bun apps/web/src/main.js"}
+}
diff --git a/dev2/templates/supabase-load.sh b/dev2/templates/supabase-load.sh
new file mode 100755
index 0000000..1208d5f
--- /dev/null
+++ b/dev2/templates/supabase-load.sh
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Load a supabase-pull.sh dump into a site's self-hosted stack on dev2. Run as root on dev2.
+#   DUMP=/root/dumps/<site>-supabase  DBC=<slug>-supabase-db  CLOUD_REF=<ref>  NEW_HOST=supabase.<site>
+# From crawlproof.com/ops/selfhost/migrate/load-selfhost.sh, made generic: the
+# absolute-storage-URL rewrite scans every text/json column instead of a fixed list.
+set -euo pipefail
+: "${DUMP:?}" "${DBC:?}" "${CLOUD_REF:?}" "${NEW_HOST:?}"
+POST_ONLY=${POST_ONLY:-0}
+log() { printf '\n===> %s\n' "$*" >&2; }
+die() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
+[ -d "$DUMP" ] || die "no dump at $DUMP"
+psql_db() { docker exec -i "$DBC" psql -U postgres -h localhost -d postgres -X "$@"; }
+psql_admin() { docker exec -i "$DBC" psql -U supabase_admin -h localhost -d postgres -X "$@"; }
+strict() { psql_db -v ON_ERROR_STOP=1 "$@"; }
+docker exec "$DBC" pg_isready -U postgres -h localhost >/dev/null || die "$DBC not ready"
+
+log "Snapshot BEFORE"
+strict -At -c "select 'tables='||(select count(*) from information_schema.tables where table_schema='public')||' users='||(select count(*) from auth.users)"
+
+if [ "$POST_ONLY" = 0 ]; then
+  log "Extensions the cloud had"
+  while read -r e; do [ -n "$e" ] || continue; case $e in plpgsql|pg_graphql|pgsodium|supabase_vault|pg_stat_statements|pgjwt) continue;; esac
+    psql_admin -v ON_ERROR_STOP=1 -c "create extension if not exists \"$e\" cascade" >/dev/null 2>&1 && echo "    $e" || echo "    $e: NOT AVAILABLE (dump may fail on objects using it)"; done < "$DUMP/extensions.txt"
+  log "Schema"
+  grep -qE 'CREATE SCHEMA "?(auth|storage)"?' "$DUMP/schema.sql" && die "schema.sql contains auth/storage DDL"
+  psql_admin -f /dev/stdin < "$DUMP/schema.sql" > "$DUMP/schema.load.log" 2>&1 || true
+  echo "    schema errors: $(grep -c '^ERROR' "$DUMP/schema.load.log" || true)"; grep '^ERROR' "$DUMP/schema.load.log" | sort | uniq -c | sort -rn | head -15 | sed 's/^/    /' || true
+  log "Data (auth before app schemas)"
+  a=$(grep -m1 -n 'COPY "auth"' "$DUMP/data.sql" | cut -d: -f1 || echo 0); p=$(grep -m1 -n 'COPY "public"' "$DUMP/data.sql" | cut -d: -f1 || echo 0); a=${a:-0}; p=${p:-0}
+  if [ "$a" -gt 0 ] && [ "$p" -gt 0 ] && [ "$a" -gt "$p" ]; then die "data.sql has public before auth"; fi
+  psql_admin -f /dev/stdin < "$DUMP/data.sql" > "$DUMP/data.load.log" 2>&1 || true
+  echo "    data errors: $(grep -c '^ERROR' "$DUMP/data.load.log" || true)"; grep '^ERROR' "$DUMP/data.load.log" | sort | uniq -c | sort -rn | head -15 | sed 's/^/    /' || true
+  log "Grants for anon/authenticated/service_role"
+  psql_admin -f /dev/stdin < "$DUMP/grants.sql" > "$DUMP/grants.load.log" 2>&1 || true
+  echo "    grant errors: $(grep -c '^ERROR' "$DUMP/grants.load.log" || true)"
+  log "Ownership: app schemas to postgres (they were created by supabase_admin)"
+  psql_admin -At -v ON_ERROR_STOP=1 <<'SQL'
+do $$ declare r record; begin
+  for r in select nspname from pg_namespace where nspname not in ('pg_catalog','information_schema','pg_toast','auth','storage','realtime','_realtime','supabase_functions','supabase_migrations','graphql','graphql_public','extensions','vault','pgsodium','pgsodium_masks','cron','net','pgbouncer','_analytics','_supavisor') and nspname not like 'pg_%' loop
+    execute format('alter schema %I owner to postgres', r.nspname);
+    execute (select coalesce(string_agg(format('alter table %I.%I owner to postgres', schemaname, tablename), '; '), 'select 1') from pg_tables where schemaname=r.nspname);
+    execute (select coalesce(string_agg(format('alter sequence %I.%I owner to postgres', sequence_schema, sequence_name), '; '), 'select 1') from information_schema.sequences where sequence_schema=r.nspname);
+    execute (select coalesce(string_agg(format('alter view %I.%I owner to postgres', schemaname, viewname), '; '), 'select 1') from pg_views where schemaname=r.nspname);
+    execute (select coalesce(string_agg(format('alter function %s owner to postgres', p.oid::regprocedure), '; '), 'select 1') from pg_proc p join pg_namespace n on n.oid=p.pronamespace where n.nspname=r.nspname and p.prokind in ('f','p'));
+  end loop; end $$;
+SQL
+fi
+
+log "Buckets"
+while IFS=$'\t' read -r id name pub limit mimes; do [ -n "$id" ] || continue; case "$pub" in t|true) ps=true;; *) ps=false;; esac
+  strict -c "insert into storage.buckets (id, name, public) values ('$id','$name',$ps) on conflict (id) do update set public=excluded.public" >/dev/null; done < "$DUMP/buckets.tsv"
+
+log "Rewriting absolute https://$CLOUD_REF.supabase.co URLs to https://$NEW_HOST in every text/json column"
+strict -At <<SQL
+do \$\$ declare r record; n bigint; total bigint := 0; begin
+  for r in select table_schema s, table_name t, column_name c, data_type d from information_schema.columns
+           where table_schema not in ('pg_catalog','information_schema','auth','storage','realtime','_realtime','supabase_functions','supabase_migrations','graphql','graphql_public','extensions','vault','pgsodium','cron','net','_analytics','_supavisor')
+             and data_type in ('text','character varying','jsonb','json')
+             and (table_schema, table_name) in (select schemaname, tablename from pg_tables) loop
+    if r.d in ('jsonb','json') then
+      execute format('update %I.%I set %I = replace(%I::text, %L, %L)::%s where %I::text like %L', r.s, r.t, r.c, r.c, 'https://$CLOUD_REF.supabase.co', 'https://$NEW_HOST', r.d, r.c, '%$CLOUD_REF.supabase.co%');
+    else
+      execute format('update %I.%I set %I = replace(%I, %L, %L) where %I like %L', r.s, r.t, r.c, r.c, 'https://$CLOUD_REF.supabase.co', 'https://$NEW_HOST', r.c, '%$CLOUD_REF.supabase.co%');
+    end if;
+    get diagnostics n = row_count; if n > 0 then raise notice '% rows in %.%.%', n, r.s, r.t, r.c; total := total + n; end if;
+  end loop; raise notice 'rewrote % rows', total; end \$\$;
+SQL
+
+log "Realtime publication"; psql_db -f /dev/stdin < "$DUMP/realtime.sql" 2>&1 | sed 's/^/    /' || true
+log "pg_cron jobs"; psql_db -f /dev/stdin < "$DUMP/cron-jobs.sql" > "$DUMP/cron.load.log" 2>&1 || true
+strict -At -c "select count(*)||' cron jobs active' from cron.job where active" 2>/dev/null || true
+
+log "Snapshot AFTER (vs the cloud's estimates in counts-estimate.tsv)"
+strict -At -F$'\t' -c "select n.nspname||'.'||c.relname, c.reltuples::bigint from pg_class c join pg_namespace n on n.oid=c.relnamespace where c.relkind='r' and n.nspname='public' order by 1" > "$DUMP/counts-after.tsv" || true
+strict -At -c "select 'tables='||(select count(*) from information_schema.tables where table_schema='public')||' users='||(select count(*) from auth.users)||' identities='||(select count(*) from auth.identities)||' size='||pg_size_pretty(pg_database_size(current_database()))"
+strict -c "analyze" >/dev/null 2>&1 || true
+log "Loaded."
diff --git a/dev2/templates/supabase-pull.sh b/dev2/templates/supabase-pull.sh
new file mode 100755
index 0000000..0fb0886
--- /dev/null
+++ b/dev2/templates/supabase-pull.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Dump a Supabase CLOUD project so it can be loaded into a self-hosted stack.
+# Read-only against the cloud; run as root on dev2 (pg_dump through postgres:17).
+#   CLOUD_DB_URL=postgres://postgres.<ref>:<pw>@aws-x-<region>.pooler.supabase.com:5432/postgres  OUT=/root/dumps/<site>-supabase
+# From crawlproof.com/ops/selfhost/migrate/pull-cloud.sh, made generic: every
+# non-system schema is dumped, not just public.
+set -euo pipefail
+: "${CLOUD_DB_URL:?}" "${OUT:?}"
+PG_IMAGE=${PG_IMAGE:-postgres:17}
+log() { printf '\n===> %s\n' "$*" >&2; }
+mkdir -p "$OUT"; chmod 700 "$OUT"
+pg() { docker run --rm -i --network host "$PG_IMAGE" "$@"; }
+psqlc() { pg psql "$CLOUD_DB_URL" -At -X -v ON_ERROR_STOP=1 "$@"; }
+
+log "Schemas"
+SYS="'pg_catalog','information_schema','pg_toast','auth','storage','realtime','_realtime','supabase_functions','supabase_migrations','graphql','graphql_public','extensions','vault','pgsodium','pgsodium_masks','cron','net','pgbouncer','_analytics','_supavisor','pgmq','pgtle','repack','topology','tiger','tiger_data'"
+psqlc -c "select nspname from pg_namespace where nspname not in ($SYS) and nspname not like 'pg_%' order by 1" > "$OUT/schemas.txt"
+tr '\n' ' ' < "$OUT/schemas.txt"; echo
+SCHEMA_ARGS=(); while read -r s; do [ -n "$s" ] && SCHEMA_ARGS+=(--schema="$s"); done < "$OUT/schemas.txt"
+
+log "Extensions in use"
+psqlc -c "select extname from pg_extension where extname not in ('plpgsql') order by 1" > "$OUT/extensions.txt"
+
+log "Schema DDL (app schemas only; auth/storage structure belongs to the stack's own services)"
+pg pg_dump --dbname="$CLOUD_DB_URL" --schema-only --no-owner --no-privileges --quote-all-identifiers "${SCHEMA_ARGS[@]}" > "$OUT/schema.sql"
+
+log "Data (auth + app schemas + storage buckets)"
+pg pg_dump --dbname="$CLOUD_DB_URL" --data-only --no-owner --no-privileges --quote-all-identifiers --disable-triggers \
+  --schema=auth "${SCHEMA_ARGS[@]}" --schema=storage \
+  --exclude-table-data='storage.objects' --exclude-table-data='storage.migrations' --exclude-table-data='storage.s3_multipart_uploads*' --exclude-table-data='storage.prefixes' \
+  --exclude-table-data='auth.schema_migrations' --exclude-table-data='auth.audit_log_entries' --exclude-table-data='auth.refresh_tokens' --exclude-table-data='auth.sessions' --exclude-table-data='auth.flow_state' \
+  ${EXCLUDE_TABLE_DATA:-} > "$OUT/data.sql"
+
+log "Grants and RLS policies (the schema dump drops privileges; PostgREST needs them back)"
+psqlc -c "select 'grant '||privilege_type||' on '||quote_ident(table_schema)||'.'||quote_ident(table_name)||' to '||quote_ident(grantee)||';' from information_schema.role_table_grants where grantee in ('anon','authenticated','service_role') and table_schema not in ($SYS) order by 1" > "$OUT/grants.sql"
+psqlc -c "select 'grant '||privilege_type||' on '||quote_ident(routine_schema)||'.'||quote_ident(routine_name)||' to '||quote_ident(grantee)||';' from information_schema.role_routine_grants where grantee in ('anon','authenticated','service_role') and routine_schema not in ($SYS) order by 1" >> "$OUT/grants.sql" || true
+psqlc -c "select 'grant usage, select on all sequences in schema '||quote_ident(nspname)||' to anon, authenticated, service_role;' from pg_namespace where nspname not in ($SYS) and nspname not like 'pg_%'" >> "$OUT/grants.sql"
+
+log "pg_cron jobs"
+psqlc -c "select 'select cron.schedule(' || quote_literal(jobname) || ', ' || quote_literal(schedule) || ', ' || quote_literal(command) || ');' from cron.job where active order by jobid" > "$OUT/cron-jobs.sql" 2>/dev/null || : > "$OUT/cron-jobs.sql"
+
+log "Realtime publication"
+psqlc -c "select 'alter publication supabase_realtime add table ' || string_agg(format('%I.%I', schemaname, tablename), ', ') || ';' from pg_publication_tables where pubname='supabase_realtime'" > "$OUT/realtime.sql" || : > "$OUT/realtime.sql"
+
+log "Storage inventory + buckets"
+psqlc -F$'\t' -c "select b.id, b.public, o.name, coalesce((o.metadata->>'size')::bigint,0), coalesce(o.metadata->>'mimetype','application/octet-stream') from storage.buckets b join storage.objects o on o.bucket_id=b.id order by b.id, o.name" > "$OUT/storage-inventory.tsv"
+psqlc -F$'\t' -c "select id, name, public, coalesce(file_size_limit::text,''), coalesce(array_to_string(allowed_mime_types,','),'') from storage.buckets order by id" > "$OUT/buckets.tsv"
+
+log "Row counts (for the load to compare against)"
+psqlc -F$'\t' -c "select n.nspname||'.'||c.relname, c.reltuples::bigint from pg_class c join pg_namespace n on n.oid=c.relnamespace where c.relkind='r' and (n.nspname in (select nspname from pg_namespace where nspname not in ($SYS) and nspname not like 'pg_%') or (n.nspname='auth' and c.relname in ('users','identities'))) order by 1" > "$OUT/counts-estimate.tsv"
+
+{
+  echo "dumped_at=$(date -u +%FT%TZ)"; echo "schema_bytes=$(stat -c%s "$OUT/schema.sql")"; echo "data_bytes=$(stat -c%s "$OUT/data.sql")"
+  echo "storage_objects=$(wc -l < "$OUT/storage-inventory.tsv")"; echo "storage_bytes=$(awk -F'\t' '{s+=$4} END{print s+0}' "$OUT/storage-inventory.tsv")"
+  echo "cron_jobs=$(grep -c '^select cron.schedule' "$OUT/cron-jobs.sql" || true)"; echo "auth_users=$(grep -c '' <(psqlc -c 'select id from auth.users'))"
+} > "$OUT/MANIFEST"
+log "Done: $OUT"; cat "$OUT/MANIFEST"
diff --git a/dev2/templates/supabase-stack.sh b/dev2/templates/supabase-stack.sh
new file mode 100755
index 0000000..4bb9440
--- /dev/null
+++ b/dev2/templates/supabase-stack.sh
@@ -0,0 +1,239 @@
+#!/usr/bin/env bash
+#
+# Stand up ONE self-hosted Supabase stack for one site on dev2, beside the
+# others. Run as root ON dev2 by `dev2-site supabase-stack <site>`, which passes
+# everything below in the environment. Idempotent: re-running keeps the
+# generated secrets and data and only rewrites the overlay before restarting.
+#
+# Derived from crawlproof.com/ops/selfhost/server/setup-supabase.sh. What differs:
+# every stack gets its own compose project name, container names, ports and
+# subnet, so twenty of them coexist on the box; Postgres is sized small (many
+# stacks share the RAM); the system/backup/alarm parts are not here (the box is
+# already set up).
+#
+#   SITE            example.com            SLUG example-com
+#   ROOT            /home/anthony/www/example.com
+#   STUDIO_DOMAIN   supabase.example.com   SITE_URL https://example.com
+#   API_PORT DB_PORT POOLER_PORT            host ports (loopback for API/pooler, public+firewalled for DB)
+#   SUBNET GATEWAY                          172.31.N.0/24 and .1
+#   SMTP_PASS SMTP_SENDER SMTP_ADMIN        optional (Resend)
+#   SUPABASE_REF    self-hosted/v0.8.2
+set -euo pipefail
+
+: "${SITE:?}" "${SLUG:?}" "${ROOT:?}" "${STUDIO_DOMAIN:?}" "${SITE_URL:?}" "${API_PORT:?}" "${DB_PORT:?}" "${POOLER_PORT:?}" "${SUBNET:?}" "${GATEWAY:?}"
+SUPABASE_REF=${SUPABASE_REF:-self-hosted/v0.8.2}
+PROJECT=supabase
+DIR="$ROOT/$PROJECT"
+DB_DOMAIN=${DB_DOMAIN:-dev2.profullstack.com}
+PG_UID=100; PG_GID=101
+ALLOW_IPS=${ALLOW_IPS:-67.205.189.229}
+
+log() { printf '\n===> %s\n' "$*" >&2; }
+warn() { printf 'WARNING: %s\n' "$*" >&2; }
+die() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
+backup() { local f=$1 n=1; [ -e "$f" ] || return 0; while [ -e "$f.bak-$(printf %03d $n)" ]; do n=$((n+1)); done; cp -a "$f" "$f.bak-$(printf %03d $n)"; }
+set_env() { local k=$1 v=$2; if grep -q "^$k=" "$DIR/.env"; then awk -v k="$k" -v v="$v" 'BEGIN{FS="="} $1==k {print k "=" v; next} {print}' "$DIR/.env" > "$DIR/.env.tmp" && mv "$DIR/.env.tmp" "$DIR/.env"; else printf '%s=%s\n' "$k" "$v" >> "$DIR/.env"; fi; }
+get_env() { grep "^$1=" "$DIR/.env" | head -n1 | cut -d= -f2-; }
+compose() { (cd "$DIR" && docker compose "$@"); }
+DBC="$SLUG-supabase-db"
+sql_admin() { docker exec -i "$DBC" psql -U supabase_admin -h localhost -d postgres -v ON_ERROR_STOP=1 -X -q -At "$@"; }
+
+# ------------------------------------------------------------ 1. the files
+install -d -m 2750 -o root -g root "$ROOT" 2>/dev/null || true
+if [ -f "$DIR/.env" ] && [ -f "$DIR/docker-compose.yml" ]; then
+  log "Supabase project already at $DIR; keeping its secrets"
+else
+  log "Supabase $SUPABASE_REF into $DIR"
+  tmp=$(mktemp -d)
+  curl -fsSL "https://raw.githubusercontent.com/supabase/supabase/$SUPABASE_REF/docker/setup.sh" -o "$tmp/setup.sh"
+  slog="$ROOT/$PROJECT-setup.log"; (umask 077 && : > "$slog")
+  if ! (cd "$ROOT" && bash "$tmp/setup.sh" --ref "$SUPABASE_REF" -p "$PROJECT" -y --skip-deps) >> "$slog" 2>&1; then
+    grep -E '^(===>|ERROR|WARNING)' "$slog" | tail -n 20 >&2
+    die "Supabase setup.sh failed; log (contains secrets): $slog"
+  fi
+  rm -rf "$tmp"
+fi
+chown root:root "$DIR"; chmod 2750 "$DIR"
+
+log "Configuring .env"
+backup "$DIR/.env"
+set_env SUPABASE_PUBLIC_URL "https://$STUDIO_DOMAIN"
+set_env API_EXTERNAL_URL "https://$STUDIO_DOMAIN"
+set_env SITE_URL "$SITE_URL"
+set_env ADDITIONAL_REDIRECT_URLS "${SITE_URL}/**,https://www.${SITE}/**,http://localhost:3000/**"
+set_env POOLER_TENANT_ID "$SLUG"
+set_env STUDIO_DEFAULT_ORGANIZATION "Profullstack"
+set_env STUDIO_DEFAULT_PROJECT "$SITE"
+set_env API_GW_HTTP_PORT "$API_PORT"
+set_env KONG_HTTP_PORT "$API_PORT"
+set_env POSTGRES_PORT 5432
+set_env POOLER_PROXY_PORT_TRANSACTION "$POOLER_PORT"
+set_env DISABLE_SIGNUP false
+set_env ENABLE_EMAIL_SIGNUP true
+set_env ENABLE_EMAIL_AUTOCONFIRM false
+if [ -n "${SMTP_PASS:-}" ]; then
+  set_env SMTP_HOST smtp.resend.com; set_env SMTP_PORT 465; set_env SMTP_USER resend; set_env SMTP_PASS "$SMTP_PASS"
+  set_env SMTP_SENDER_NAME "${SMTP_SENDER:-$SITE}"; set_env SMTP_ADMIN_EMAIL "${SMTP_ADMIN:-noreply@$SITE}"
+else
+  warn "SMTP_PASS not set; GoTrue cannot send mail until it is"
+fi
+set_env COMPOSE_FILE "docker-compose.yml:docker-compose.$SLUG.yml"
+set_env COMPOSE_PROJECT_NAME "$SLUG-supabase"
+chmod 600 "$DIR/.env"
+
+# ------------------------------------------------------------- 2. postgres
+V="$DIR/volumes/$SLUG"; mkdir -p "$V/tls"
+if [ ! -s "$V/tls/server.key" ]; then
+  log "Self-signed TLS for $DB_DOMAIN"
+  openssl req -x509 -nodes -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -days 3650 -subj "/CN=$DB_DOMAIN" -addext "subjectAltName=DNS:$DB_DOMAIN" -keyout "$V/tls/server.key" -out "$V/tls/server.crt" 2>/dev/null
+fi
+cat > "$V/pg_hba.conf" <<HBA
+# $SITE: managed by cli-tools dev2/templates/supabase-stack.sh
+local   all  supabase_admin                          trust
+local   all  all                                     peer map=supabase_map
+host    all  all            127.0.0.1/32             trust
+host    all  all            ::1/128                  trust
+hostssl all  postgres       ${GATEWAY}/32            scram-sha-256
+host    all  all            ${GATEWAY}/32            reject
+host    all  all            ${SUBNET}                scram-sha-256
+hostssl all  postgres       0.0.0.0/0                scram-sha-256
+hostssl all  postgres       ::/0                     scram-sha-256
+host    all  all            0.0.0.0/0                reject
+host    all  all            ::/0                     reject
+HBA
+cat > "$V/$SLUG.conf" <<CONF
+# $SITE: managed by cli-tools dev2/templates/supabase-stack.sh. One of many stacks on
+# this box, so sized small; raise per site if it earns it.
+hba_file = '/etc/$SLUG/pg_hba.conf'
+ssl = on
+ssl_cert_file = '/etc/$SLUG/tls/server.crt'
+ssl_key_file = '/etc/$SLUG/tls/server.key'
+max_connections = 120
+shared_buffers = ${PG_SHARED_BUFFERS:-512MB}
+effective_cache_size = ${PG_EFFECTIVE_CACHE:-2GB}
+maintenance_work_mem = 256MB
+work_mem = 16MB
+wal_buffers = 16MB
+max_wal_size = 2GB
+checkpoint_completion_target = 0.9
+random_page_cost = 1.1
+effective_io_concurrency = 200
+max_worker_processes = 8
+max_parallel_workers = 4
+max_parallel_workers_per_gather = 2
+cron.database_name = 'postgres'
+CONF
+chmod 755 "$V" "$V/tls"; chmod 644 "$V/pg_hba.conf" "$V/$SLUG.conf" "$V/tls/server.crt"; chmod 600 "$V/tls/server.key"
+chown "$PG_UID:$PG_GID" "$V/tls/server.key" "$V/tls/server.crt"
+
+log "Overlay docker-compose.$SLUG.yml (own project name, container names, ports, subnet)"
+{
+  echo "# $SITE: managed by cli-tools dev2/templates/supabase-stack.sh"
+  echo "name: $SLUG-supabase"
+  echo "services:"
+  for svc in studio api-gw auth rest realtime storage imgproxy meta functions db supavisor; do
+    echo "  $svc:"
+    echo "    container_name: $SLUG-supabase-$svc"
+    case $svc in
+      realtime) echo "    networks:"; echo "      default:"; echo "        aliases: [realtime-dev.supabase-realtime, realtime]" ;;
+      api-gw)   echo "    networks:"; echo "      default:"; echo "        aliases: [envoy, kong]"; echo "    ports: !override"; echo "      - \"127.0.0.1:${API_PORT}:8000/tcp\"" ;;
+      supavisor) echo "    ports: !override"; echo "      - \"127.0.0.1:${POOLER_PORT}:6543\"" ;;
+      db) echo "    shm_size: 512m"; echo "    ports: !override"; echo "      - \"${DB_PORT}:5432\""; echo "    volumes:"
+          echo "      - ./volumes/$SLUG/$SLUG.conf:/etc/postgresql-custom/conf.d/zz-$SLUG.conf:ro,z"
+          echo "      - ./volumes/$SLUG/pg_hba.conf:/etc/$SLUG/pg_hba.conf:ro,z"
+          echo "      - ./volumes/$SLUG/tls:/etc/$SLUG/tls:ro,z" ;;
+    esac
+  done
+  echo "networks:"
+  echo "  default:"
+  echo "    ipam:"
+  echo "      config:"
+  echo "        - subnet: $SUBNET"
+  echo "          gateway: $GATEWAY"
+} > "$DIR/docker-compose.$SLUG.yml"
+
+# ---------------------------------------------------------------- 3. start
+log "Starting $SLUG-supabase"
+compose up -d --wait 2>/dev/null || compose up -d
+compose restart db >/dev/null
+for i in $(seq 1 90); do docker exec "$DBC" pg_isready -U postgres -h localhost >/dev/null 2>&1 && break; sleep 2; done
+docker exec "$DBC" pg_isready -U postgres -h localhost >/dev/null || die "$DBC never became ready"
+
+log "Repairing the v0.8.x bootstrap gaps (role passwords, auth/storage owners, graphql_public, _realtime, _supabase)"
+pw=$(get_env POSTGRES_PASSWORD)
+sql_admin <<SQL
+do \$\$ declare r text; begin
+  foreach r in array array['postgres','authenticator','supabase_auth_admin','supabase_storage_admin','supabase_admin','supabase_replication_admin','supabase_read_only_user','supabase_etl_admin','pgbouncer'] loop
+    if exists (select 1 from pg_roles where rolname = r) then execute format('alter role %I with password %L', r, '$pw'); end if;
+  end loop; end \$\$;
+SQL
+sql_admin -c "select 1 from pg_database where datname='_supabase'" | grep -q 1 || sql_admin -c "create database _supabase with owner postgres"
+docker exec -i "$DBC" psql -U supabase_admin -h localhost -d _supabase -v ON_ERROR_STOP=1 -X <<'SQL'
+create schema if not exists _supavisor authorization postgres;
+create schema if not exists _analytics authorization postgres;
+grant all on database _supabase to postgres, supabase_admin;
+SQL
+sql_admin <<'SQL'
+create schema if not exists graphql_public;
+create schema if not exists _realtime;
+alter schema _realtime owner to supabase_admin;
+grant all on schema _realtime to supabase_admin, postgres;
+grant usage on schema graphql_public to anon, authenticated, service_role, authenticator;
+do $$ declare r record; begin
+  execute 'alter schema auth owner to supabase_auth_admin';
+  for r in select 'alter function '||p.oid::regprocedure||' owner to supabase_auth_admin' as cmd from pg_proc p join pg_namespace n on n.oid=p.pronamespace where n.nspname='auth' loop execute r.cmd; end loop;
+  for r in select 'alter table auth.'||quote_ident(tablename)||' owner to supabase_auth_admin' as cmd from pg_tables where schemaname='auth' loop execute r.cmd; end loop;
+  execute 'alter schema storage owner to supabase_storage_admin';
+  for r in select 'alter function '||p.oid::regprocedure||' owner to supabase_storage_admin' as cmd from pg_proc p join pg_namespace n on n.oid=p.pronamespace where n.nspname='storage' loop execute r.cmd; end loop;
+  for r in select 'alter table storage.'||quote_ident(tablename)||' owner to supabase_storage_admin' as cmd from pg_tables where schemaname='storage' loop execute r.cmd; end loop;
+  execute 'grant anon, authenticated, service_role to authenticator';
+  execute 'grant anon, authenticated, service_role to postgres';
+  execute 'grant service_role to supabase_storage_admin';
+end $$;
+grant usage on schema public to anon, authenticated, service_role;
+grant usage on schema storage to anon, authenticated, service_role;
+SQL
+compose restart auth rest storage realtime supavisor >/dev/null 2>&1 || true
+
+log "Extensions"
+sql_admin <<'SQL'
+create extension if not exists "uuid-ossp" with schema extensions;
+create extension if not exists pgcrypto with schema extensions;
+create extension if not exists pg_stat_statements with schema extensions;
+create extension if not exists pg_net with schema extensions;
+create extension if not exists pg_cron;
+grant usage on schema cron to postgres;
+grant all privileges on all tables in schema cron to postgres;
+SQL
+for e in ${EXTENSIONS:-}; do sql_admin -c "create extension if not exists \"$e\" cascade" 2>/dev/null || warn "extension $e not available in this image"; done
+
+log "Firewall: $DB_PORT reachable from $ALLOW_IPS, loopback and the docker networks only"
+while iptables -D DOCKER-USER -p tcp --dport "$DB_PORT" -j DROP 2>/dev/null; do :; done
+for ip in $ALLOW_IPS 127.0.0.1 172.16.0.0/12; do while iptables -D DOCKER-USER -s "$ip" -p tcp --dport "$DB_PORT" -j ACCEPT 2>/dev/null; do :; done; done
+iptables -I DOCKER-USER 1 -p tcp --dport "$DB_PORT" -j DROP
+iptables -I DOCKER-USER 1 -s 172.16.0.0/12 -p tcp --dport "$DB_PORT" -j ACCEPT
+iptables -I DOCKER-USER 1 -s 127.0.0.1 -p tcp --dport "$DB_PORT" -j ACCEPT
+for ip in $ALLOW_IPS; do iptables -I DOCKER-USER 1 -s "$ip" -p tcp --dport "$DB_PORT" -j ACCEPT; done
+mkdir -p /etc/iptables && iptables-save > /etc/iptables/rules.v4
+
+log "Checks"
+sql_admin -c "select 'ssl='||current_setting('ssl')||' shared_buffers='||current_setting('shared_buffers')||' hba='||current_setting('hba_file')||' version='||current_setting('server_version')"
+[ "$(sql_admin -c "select has_schema_privilege('anon','public','usage')")" = t ] || die "anon lost USAGE on public"
+for i in $(seq 1 30); do code=$(curl -s -o /dev/null -w '%{http_code}' -H "apikey: $(get_env ANON_KEY)" "http://127.0.0.1:$API_PORT/rest/v1/" || true); [ "$code" = 200 ] && break; sleep 3; done
+echo "gateway http://127.0.0.1:$API_PORT/rest/v1/ -> $code"
+(umask 077; cat > "$DIR/$SLUG-connection.env" <<ENV
+# $SITE self-hosted Supabase (written by supabase-stack.sh). Keep secret.
+SELFHOST_SUPABASE_URL=https://${STUDIO_DOMAIN}
+SELFHOST_ANON_KEY=$(get_env ANON_KEY)
+SELFHOST_SERVICE_ROLE_KEY=$(get_env SERVICE_ROLE_KEY)
+SELFHOST_JWT_SECRET=$(get_env JWT_SECRET)
+SELFHOST_POSTGRES_PASSWORD=${pw}
+SELFHOST_DATABASE_URL=postgres://postgres:${pw}@${DB_DOMAIN}:${DB_PORT}/postgres?sslmode=require
+SELFHOST_DB_PORT=${DB_PORT}
+SELFHOST_API_PORT=${API_PORT}
+SELFHOST_POOLER_PORT=${POOLER_PORT}
+SELFHOST_DASHBOARD_USERNAME=$(get_env DASHBOARD_USERNAME)
+SELFHOST_DASHBOARD_PASSWORD=$(get_env DASHBOARD_PASSWORD)
+ENV
+)
+log "Done: $SLUG-supabase up; connection in $DIR/$SLUG-connection.env"
diff --git a/dev2/templates/sync-storage.mjs b/dev2/templates/sync-storage.mjs
new file mode 100644
index 0000000..e9dff09
--- /dev/null
+++ b/dev2/templates/sync-storage.mjs
@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+//
+// Copy every Storage object from a Supabase CLOUD project (generic; from crawlproof.com/ops/selfhost) into
+// the self-hosted stack, keeping bucket and path identical so the public URLs
+// differ only in host.
+//
+// Uploads go through the Storage API rather than straight onto the disk the
+// storage service mounts: the API is what writes storage.objects, and rows
+// written by hand would describe files the backend cannot serve.
+//
+// Usage:
+//   CLOUD_URL=https://<ref>.supabase.co \
+//   CLOUD_SERVICE_KEY=... \
+//   SELF_URL=https://supabase.crawlproof.com \
+//   SELF_SERVICE_KEY=... \
+//   node ops/selfhost/migrate/sync-storage.mjs <dumpdir> [--concurrency 8] [--dry-run]
+//
+// Resumable: an object already present in the destination with the same size
+// is skipped, so a re-run after a failure only moves what is missing.
+
+import { readFileSync, appendFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const args = process.argv.slice(2);
+const dump = args.find((a) => !a.startsWith('--'));
+const dryRun = args.includes('--dry-run');
+const concurrency = Number(
+  (args.find((a) => a.startsWith('--concurrency')) || '--concurrency=8').split('=')[1] ||
+    args[args.indexOf('--concurrency') + 1] ||
+    8,
+);
+
+const CLOUD_URL = (process.env.CLOUD_URL || '').replace(/\/$/, '');
+const CLOUD_SERVICE_KEY = process.env.CLOUD_SERVICE_KEY || '';
+const SELF_URL = (process.env.SELF_URL || '').replace(/\/$/, '');
+const SELF_SERVICE_KEY = process.env.SELF_SERVICE_KEY || '';
+
+if (!dump) die('usage: sync-storage.mjs <dumpdir>');
+for (const [k, v] of Object.entries({ CLOUD_URL, CLOUD_SERVICE_KEY, SELF_URL, SELF_SERVICE_KEY })) {
+  if (!v) die(`missing env: ${k}`);
+}
+
+function die(msg) {
+  console.error(`ERROR: ${msg}`);
+  process.exit(1);
+}
+
+const inventory = readFileSync(join(dump, 'storage-inventory.tsv'), 'utf8')
+  .split('\n')
+  .filter(Boolean)
+  .map((line) => {
+    const [bucket, isPublic, name, size, mime] = line.split('\t');
+    return { bucket, public: isPublic === 't', name, size: Number(size || 0), mime };
+  });
+
+const failLog = join(dump, 'storage-sync-failures.log');
+const totalBytes = inventory.reduce((n, o) => n + o.size, 0);
+console.log(
+  `${inventory.length} objects, ${(totalBytes / 1024 ** 3).toFixed(2)} GB, concurrency ${concurrency}${dryRun ? ' (dry run)' : ''}`,
+);
+
+let done = 0;
+let skipped = 0;
+let failed = 0;
+let movedBytes = 0;
+const started = Date.now();
+
+async function headSelf(o) {
+  // A HEAD through the authenticated object path works for public and private
+  // buckets alike, so resume does not depend on the bucket being public.
+  const res = await fetch(`${SELF_URL}/storage/v1/object/${o.bucket}/${encodeURI(o.name)}`, {
+    method: 'HEAD',
+    headers: { Authorization: `Bearer ${SELF_SERVICE_KEY}` },
+  });
+  if (!res.ok) return null;
+  return Number(res.headers.get('content-length') || 0);
+}
+
+async function downloadCloud(o) {
+  const res = await fetch(`${CLOUD_URL}/storage/v1/object/${o.bucket}/${encodeURI(o.name)}`, {
+    headers: { Authorization: `Bearer ${CLOUD_SERVICE_KEY}` },
+  });
+  if (!res.ok) throw new Error(`download ${res.status}`);
+  return Buffer.from(await res.arrayBuffer());
+}
+
+async function uploadSelf(o, body) {
+  // x-upsert makes a re-run idempotent instead of 409-ing on what is already there.
+  const res = await fetch(`${SELF_URL}/storage/v1/object/${o.bucket}/${encodeURI(o.name)}`, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${SELF_SERVICE_KEY}`,
+      'Content-Type': o.mime || 'application/octet-stream',
+      'x-upsert': 'true',
+    },
+    body,
+  });
+  if (!res.ok) throw new Error(`upload ${res.status} ${(await res.text()).slice(0, 200)}`);
+}
+
+async function one(o) {
+  try {
+    const existing = await headSelf(o);
+    if (existing !== null && existing === o.size && o.size > 0) {
+      skipped += 1;
+      return;
+    }
+    if (dryRun) return;
+    const body = await downloadCloud(o);
+    await uploadSelf(o, body);
+    movedBytes += o.size;
+  } catch (err) {
+    failed += 1;
+    appendFileSync(failLog, `${o.bucket}\t${o.name}\t${err.message}\n`);
+  } finally {
+    done += 1;
+    if (done % 100 === 0 || done === inventory.length) {
+      const secs = (Date.now() - started) / 1000;
+      console.log(
+        `${done}/${inventory.length} moved=${(movedBytes / 1024 ** 3).toFixed(2)}GB skipped=${skipped} failed=${failed} ${(done / secs).toFixed(1)}/s`,
+      );
+    }
+  }
+}
+
+// Fixed pool of workers pulling from one shared cursor — a Promise.all over
+// chunks would stall every worker on the slowest object in each chunk.
+let cursor = 0;
+async function worker() {
+  while (cursor < inventory.length) {
+    const o = inventory[cursor++];
+    await one(o);
+  }
+}
+await Promise.all(Array.from({ length: concurrency }, worker));
+
+console.log(
+  `\ndone: ${done} objects, ${(movedBytes / 1024 ** 3).toFixed(2)} GB moved, ${skipped} already present, ${failed} failed`,
+);
+if (failed) {
+  console.log(`failures logged to ${failLog} — re-run to retry just those`);
+  process.exit(1);
+}

From e194cad5c07df9f9c1f48afa3b512fe64d40fde0 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:42:10 +0000
Subject: [PATCH 004/104] dev2-site: write remote files via temp + mv

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 90797 -> 90835 bytes
 dev2/dev2-site                            |   7 ++++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index e493dd13b5ca67761db5a29ef0b4e5454e6e67a8..ac7b24ff7f752aac6272899ed91dc0681cf67e6e 100644
GIT binary patch
delta 9128
zcmZ`<34D~*wa=ZIZ!(Y&K!{;U;LAc_0x>MI1R+4m7J&ds*p=yIW|9oaEZ%PdVT6W)
z3w^%2U3_2rQ=h2ySFjY}O*LrsC*o2-tFgGfueOMy7B^b4E?D)Q|M_APs4qWrIN!bJ
z-h1x3|Fhg1fBUR<;#sZV^ZokuO{1SPa~|0cJlJpcrCI&y%SpfI_7gG9mj(&1XREfw
zDRYCu>>MOUn)i4_<_gCa?as8I^KLCFg08LZghtZ*v&9wExX-=CK@weZTinE_bGrxh
z?#wM|`}+I_3(=2A+uYZik*rZeaz?gK*At;gTyF@sg!KB55e|m*L=*k`Wn(BY4t!Mi
z(|?IrBplEqv5le2l702!Vm;6l+Z5I1Xqxc6>#{^7F1^Gi2en50MzcPC>Qol;C-e$E
znT39PP$U-A?Fk|q_0onyJ*jc$ULgx;e6`mpC(^%i637)qyy@ytPC>i4#?p96Bb^#`
z`$rBU-by!&CSSZYAs5isQu;ME5ZRV?+SBirjGtxPI`@QU=(aikTVAnq!(G|;4FBcu
z-78KE9oso%+@3jm{CjE-xL(eje7JJkyf<CxJ6)Xv3U|-hJ!yCJK;41)hw=~2IW*}|
z@bKi^!=sN5>#SSRS-Y}x<+{$RuI^m7zB9|$*%*Dz6;oS&I$Zs9NJvzw_lHc<meA@e
z)X1Ul4qZ%~r5TA(-0-GLw96|&DplSvT`X1=!}7H{YFL>H4m%<S{RrZoP+QnY_+rg+
z7JaJexg$qnjOB^=n?u2{G~^=sv?r?tw_LU57Sd#Q<(6n6YFLwcK6j7sz!2U(vQAw)
zqI?+Iy)Mc6xS)@vh1wF*FYDEdBZg=Ob+1o-IAXNO;3>aXQZEoeHCw+_+e`xWsdf4<
zoY~8Xl{Fx}MLk7D!(esUOvLKfAPFu;tRW^Nep*J&FIueKL_Liuv*>GA^;Tk&p1N2}
zkNBgTlUdcVgg&P=(G-*6WGE=tQui4^T>b>4ok*SBMl{(^`ok@o{F`-uJUm?w>x5`|
zn|jNeE0(KoyqEXK8diF%Y>CA~QCXvAmkf7rqBeP>@|Wbge-8F$wWH)p?LlIV)SpVC
zjsbfyNEq^F`j=q%pjuWsUOPx1*QKs6%@g7$>i)~NinS`gtb8ckR6c|OnMO!%3<pBK
zs6P^tdz4XDs69>{J5zU-Jt4&J)S3yy2iS(hnC&1BtLr9|X-^V+OX|>sU1A}YmivfU
zB5Gv>L-Cf_=13@-Fz9@OjUmHwMPtE`{4Gg%-LiXec>qJS20}x^5<$6F?V41i{ec>H
zrJk6y(lOvDvGN$magY~O;gkaRBVaq!qA5Y`O=9m){cg%ZA>L38)5^sGwR_sC{8y>j
z5JYs_v--9gA;TvLc7}YPnjcCHDSt$eDPEdBQ#_~oT`^rdN6r6}T6{%P48{DG(`c=i
zr@#^JWjO8?vQ3?wk*$42ZI7kCnz2K;S-X>Jd&SHVJE&FiK#h<RX!1H~1{tuN;Yg$W
zm-<UZo+e14CsN;4ym*ONqh4G-R6MQzw!D1EGgu=t6x|q>v8Zh`M>t4}mDhwa+AwW@
z8Yr{X-kLGutol>UX3~3c?JW1d(D${vt+u$DB_M0LWUM75?Jo461sO;aSdL)5<q6jN
zn#0kcAx}bBi*EEw!}7#qGT|du7GR}slvcNP98UoNSMN=uSoRL)34-914Z<tMu5D~x
zd0Jh)vPgWX4%AI0_x)R4Mf(}*w)%Hr+!u^R{Nbn}3o&~U2v(QH(5i1B7K!_#;aJr0
zYO-g$P}v^9vN}HVK|Y|N7f7<sUt>ayAyxB*dSJz^W3Yj0ImT}5R^Jk_A5#7jwSDDp
z+>Mx}NljW+?AEZ>I^|oHQ*WVlBIcPU2ZM*pS(&Sr)-0-BHs?q4d{uM1q9Hn$p|j7@
zmGf$9s^-qCl^2E?%TqINK~-&C%^LY0q!~6Zt2b7SYKNoBGLWGlZ-SJ7j0LeV5AIPA
zV2P1zIa@+eD?Mxk!;RsD1d0LOi2Mj*z$)Q4-a=h*@O|f3)zsGcmMyKRlP4hYE=UfM
zbh!a+vno9|WH`qxH+@^KU^tMFub^u^h)?})^{jUGbU0Pe2kaOU=CT~|kemh~4n!`3
zv>{)|_ZvhkS6s$|cF1u@Vy%b`j*TJu4a=vv-`E(SCL?5tu;n7WB;<44PVg}#JX-Qe
zyq1<WD^2zQ;`c1%kH-x;9$L65W@Ga7n2b0133iJybPBpOfX$E-)WJ1_Gu&u#%21;W
zs?If4T7bTvO^sOl*NpjBVnihfPE*dL9+?O3!oy^6$!v5CB4T-HGD>-JvkcLQVX4Xn
z<(S8-S5ddOZ!eULhkSZ%Ro%Q=-&}i@1y}`#bkQnahuo)zg-2;kB%r6}hPMfdB_uWu
zgx%DOQF-)v<~#aPr#2MNfd&#IY@E#lhb@qQu#?rJ0ms<o4R)ZkZ3UG}QVW|GIBhp5
zRCh$Lck@P;Dm}KK<a12qkjVJ5k|u(R;OmJP4kCKjbQ9HWu{<$ZJrr9}01x8%lg=5F
zF6Vkn;tZ0GipfdGjB<HW6~{-nV{Z0jS%v|;KX`Z2tsCJ)$ncVt(ZTM+fWR)TbgJ_F
ziG*ZFm06gCHPhrGNOx}+0dkYUQU*}2<HrtT3n8e1PE5TV&vuSM^pop|P`u$8`S^c{
zRyGFqPibM1%1Y#k%G9{TkDYm}FM5*$^su3aBmTxvX)M~ZSsz2Odhe!Ok*A*9R4!KE
z-ZsK9Pbj@@`0^gOA-P%_oLNdh#Ev&tqcxq{I764y7ZqV_aI9uIW3rJCmGJFHZ1<`E
zY%3KDQjfKzJ3L=PTu=%+mMj!2QXePRI_j`7Dye$b<+YYkt6d9mrEy`zp%vkcawieX
z(GX=vx15Q#gyn1wZI-`RcWx~ft5Zj|zU(OGsMa$(PmCo9eBG0fmXB^L7Qxh8+lC4;
zL7o3;VG&#P11tj+Bwd$nj<gWAcsf6|P*Jl_&DmZcnpJT7Ukicw^PZ+eB5q7CE8{bv
zokE%xV*Bh=p&g?{G<DOCIT@G2Sjj%M0e?e7tR<-1XK1RoZ=NJRSC`&0m6WKyW%K~7
zZ+SMwWOG7>Lh?lF`dgL=%Gf7v9W5rNzP|MZAu3WwZ|@WttnLj!%?@?{u41>nWA)Om
z65&_pcjdL?I3@cvo1n*{wdi0g9|GqC;Q(_lX4{NU9J;&<pEyAd(b6E!JJ3cn?~ko{
zKM7fmO$jS~Q@!*@15I6r6jc9p$AE0)Y|GU|rKH?#3pP;M{`)(o2$}lyjt|^Zd$jUn
zdIv{qJ2doiWvdT`bKf<su|!C|LG$cR4Z6EZ8#9tvPULp3MnPm{2K@<tz26A=u;}yD
zB;Qik-Pa&ast@nGktzh^{+Y||R10x2Q;xyHgX}ExGUPu2;bX7B0wwsoC=GIoI)#o6
zAe^_xLNj(8iV~bL*h=*fcno9@h@Fzu++UT72U7A^uej`k#JS7QQ_J^$>~LCQy86++
zO2Wkr`#!OYuxw0yQnml~p4{1Bdtw1!^AKRY8C11R-(Ntb=+*m&xzixFPi@^lLX1;)
z?Jp9~rk>iLCB!$X^P$`vE>;}!pAfnRgu`8%avsPZz>S}G_nb^!exOFo7()$o_v!Wq
z$$GF~d3xfn`~u@RH~7H41d^tX92~2CP3+;+rw9Mx$b;)x4xcaCRjZeh4;ykNnV?Rt
zy8Yqm>3&$l1~fRVV&B&o$qdfzn3<!I(+<;LL8wygd^k@_Bj~)Ddhp@nnN!(IuwJt7
zG8x+#HmKIqWfFtWp*39}gBn8TWMBzz7n0O(j#RskVaDU?yCXjzP=WztK}tc2)m=}I
zn84BYzwynndNjnp0kMrqTrz{oqNdjR%P94iQfd3)(}_!xF1@r-PkPEW##&k<Awv#S
z@n<e~_s2Y6r5=3dSs_lO;?MPUh;P-kN2}bOm~pl`ess}X7wt>J;Uus66u2WqyhS}J
z!E&xzwaSj%3{pNY_U@sW=%8A2tRMqtVO!O&ZaAjbFF+SNehxU~E(s&{3dkG>U~kFU
zy!&u051fs20|$uQUIBuk&q}|lJje5fB7EEWb1+CpK@_74pifmCAA9*5)Jy4PQ`B+<
zHd?L#xx6KO@^(_ja>nUCgcGJ<;-|VzYmSm20sije6<R)N`flp2<J&#Lr2;4ByII#U
z>Y)>bS`qc-s@G5an!4IwStn+zKfh9<<1Wy<RG>>pqt73Vgrm|+14gDsz3LIg|Ae}^
z^lb-s%?3Y5tS``Y3gk;w`&zy>mZS<&n_qjspY6_AKps`ir&qaA7Rmy3^z>xmRo|YT
zoS~zEi>41$#k<!IXrpPWDRp3blseu~$KK5qr`7m>j1Xg$_Fg4jxE8(_DJ+8`?1c{d
zJ~WNwdvAhnLKsu3zIg8eHy|(DQun?8N3pyIybQ9psLRS&wzRfxK@AGPN`4<mW|qlV
zEKwG0r6RSAQ{efmQENs;Mg{9eEgZFERP9=NV?wWVsl#U$xY>Qe%Kyo*)aVZ^A&Qmb
zBPrIa){ovKE7yG7p4&@VOC)|k)itTiPjrzD@2TGFuu~1tMf^Kz&e=g-R=7$f&OVk~
zf&I?{nN8#eX1hv-|GtDCk2?OoZbU0hN%{IZ`bWO~!**J)mj2_*TnNf}nDvLn^dDof
zY?At0+LznXI%iyUZ2eL3c<teVPp&++{wq0O-TSGxoudpFr0i+zbJz$yJm7(d{fUDZ
zaAG?rfXQI%$*}Yk5tD(CU52yshM?W!AO}J0Tm!BJBmxp8qN>h~Y=078?4Z2sZU>bE
zu@c{*0A0(|Kv!_8Wu-iX5s!k5h6tAmbAcPKZik|SUAo|6mtKvnIpd9nM9SrmX=#r5
zCb>*~bZ%%nu4<NBh9XGUlkwp)=tYX^wOBy%g~<u4?8R8*M5|8#H!`1bO^fBG<lRC+
zaUR;8iN=Kd4xC1uFF=<`8Sn+<3{ux}*879<AT$y6wwI2lW}_fYZU1bdwx0M=sYgGX
z*=Gn2r;aKMKBUFeo^%GN0LxQZ->wk5RPfswler5+WEJ**CCC*tOb$R>e-I9gYz{}4
zIn=A)>YAVW>Qm>x9p|d&N!ag@UF{^;lL`7pWBT_IzuO^`=_@%2=;s|&q36&rdemJ~
z>DBS_r*npqoccLoY35F+$Q9Gf2b^N+_({;J9Ap=1>K)LN0&ImDgxy-p$IVQa$Q#cn
zVQeu}5Gm<u$hVYz*l;}vhwL}N`OGygF;i=xWm-D!bcyR-VzHUuM@(=#uyUTcx{vse
z)x2}SA2-?tJ4_D7a5f(sl5N=YB+VBZ_7yg1*FC96gBHxb$DH0*jMO5;U)!<1uQ=^k
zuz^fO_aWX}307dxGS-ix%SEqB^pI%qrQWV3QHK~VlBKKGHv6u%!~9u4F+$vE?&&Aa
zmG^kccFf47RnN;Tl%y3=$lA-kP8>ZHG?Q&!$rAb6CQ|RZj`LaKurr(AyVx2ZK%UEj
z56zb@5u?Qf^NUMFxp0{i28mB|-a$9&=L_SQIeoCu#V<P64Hkt$gge@^MZOrx6LKkv
z-I4<nIJjc^7_)3LpS)CfD{zu_72kd4REG8(EUO0H<wjE2@=%;f_~=$gFLMT2x;RJZ
z+BWLBtz%J+sMd!4;8rl)Wu|gPjc}WkV^(GaXo#Eu;^=716U#;Rh1$w3==<3G;|MWi
z@@9<pgK#;`5s{CQ!NNrd!@<>CZ*$m4QJ8TPO>+<Z8mEQ1JV#71mz9Z;9e0lu_c;gh
zid+%F`|9Lbb6KHSCDxjI3PpkFV?JLfW-n(UV3beMa#KOk5)Mc=TDo1q_VONF_UWZa
zJtTM20<sUb^qhHBk(iqC3*z@euTo*&>k=b69xoDuJuCh{>z(<Qo=9Yz)x4Hy(zA@N
zdiAYTlbV<xmZZ0a(h7Z!E~nCmtU~h|5NVDo74t=#*-|QI*k$3p=KfMKt-bp?;}!J$
z9W{InE#Y`P6!aF@L7^KvU8jNB*!Wz^&BC5$gRm!DjowO-MId}5;`3osZ9rQyNDBz3
zpmyXSxdhtQg5wJ%+qB1*O3=Y)&B>6jSlvLCG3xbZ_A)l?XKBe;lw28ZV!6P}c3Q)7
z*ZTv_t#NiqdQb@kJcgVK^?z-CbeSmZyN`q(p<m+*b6Jj<+CfM;qD|pD35s_rF4~|B
z*FuQT$*dat&mq%wBN2=1(u>LL0?J%CSrqlE{&~<ubIWA0cNjw-VKCV*N`HC5*f^4x
zJYde6B3@Vz#GTLVdWJ4VH$_^8A)E6LP~t%lwnG^>c8gQshJyTCYz)zA_9Mn#Gdxv{
z(jKFR&JHz|!lYQ-k(wbUig8@hp!V9^^>B^|Xt@JTp+K{7(etx8utMaU+AJ}^tgH~%
z=XH;jPr-st(xN+Ro@Qb3q3NDQQR!)O%q&qQOjFJhSF{g?8PZEjxrRQ2{du!`B_uw0
zb}Qcco!DHD(=iI!2=AifMv(hJc>fu_U{R0O$8bDcmcK}=(tC5lXO5dK^28DI%GshQ
z;}vQ>MZd;2p`QFqH=igH=^eXgi{sj2w*HeCZx`s8E{jC%C%+Bgk{~-lc7dS$V}F&8
zg8L&#3==FhADJ&|-5mPPn*A4usdnV!%!MjL-U0G6bKL^rYiINUY&Q0AC-8Q?0o6f?
zSJ1@;2re@c`BozDNrYsH;3pAjB+3m5fJ>ab#8&CaIoyJB?sc@V8Q(y&$4B8kkns7)
z?acCpqPUt<#3?M-Q{}+KT#){I6|fXt*MP9U+)6514tmiBoaAbu4wmHPWCS8XUnJZp
z{iMN3TJ|&gHU47mc2RUbzfc_Rdfw<V*|SSTLw2_(%Kgxotuo%6T`exn=<Rv_YB90A
zKNd|7hFU@i`itfv$VaG&Vg(;1+m4OR;KIJ`>iR+Rg=#S*p8@2)7(hXYp@x)uO>L>r
zGu|fNO;|TRO0$D_^-?j~BW^J_t`c+lg|MKI*uShWpIIgHi+V7_a6vrpg%4J((Co8X
zjLcz70TY&(MbVk66G>(BPIK03kv$OzOL|I6yK)h*W~F~`&0nF@U0O<iH>AJ+LWdEu
z%DiE<2>Jr_Wo7z<K_AUVZwS$ZTnH65fiRSMP{aVb5HU8;7+x143nwVwHmlZ%lJYNb
z^3yIje%p|!+yCu<ACOHL3Nol;-x|^CT#MqztJPK4Rnz~CK$NbwH&S;sSC?K#^%>M;
zUU8-`mO$Jg8&4(yZ-YFGxfr9IX*lO_D!CG}kC@k9EsBRDOjud;$k!6Czf6X%X${dI
zKkkA+rTO^PV$8~o;Ag@lGeEZE6Gft(hB&!#A<TKLr_gVQNFg-fThSHxoDcFaCfI6D
zUoQ&U7l2;^!VnCBV^`V??j{fp?FYf}1&#}E#C(gNJ?MWFk$*zxn;`FloCEm^L|{1_
zvi-+~MsQ6aj4V28^Uv$W<?Z~6lLk%sxO;Ate9Po$!ttUfnxIy_IHX*J4I2WG!(k$d
qprEEGG6o7{L%l&nEYA${W}ol~(P8?8Pq<woE<Vld_}7ocLGgbP)%ubE

delta 9122
zcmZ`<3v`sl^=EeX+bmfE;Y}cqB@bYMB_i*4coUHzNg$xoWwW~pTlU3#n*a+ofc3>W
z{-qA}!(+A7M=L_3bgMyHwN&lF7uAAVzj~-t(9$9mh1Oz)|NY%BO@JcjaG7uB&Ye4V
ze)lo69C=my`Kwya8#y`IUFgp{GoSnJ$bC5#{rbD<%T9m4JV3<gvdJ!eA+gD>dfr~x
zEo9H5&WE~$99GB3kk;Ped{~Q%P}Xf)3Um3-CP&D%$wti1O&Zazs%y_8wWzV{fQPy~
z?A+94Z}y&cR?%gH+uJQYOLgmC)Z!TyPk8iTa-@g;O@(7gPeUXc_9Wt-)atOOKC#|A
zDsA^AJf@f|ZM4n>hsW3GIdzHt$f5Kty+qRPNL)_^qEU}8=1IHDL*eFfJr#<?J-dZ0
zCWb1n!_@R-G?J22FzI@bF+^-$r+TY@af>~%F0MPN!^3}MZ)%!Zy1v?<Y)Z*W`dUnX
z^#GC0U5?MGynFU`&2ay~y>s@FT+gna@8p)e-J^8ZoG1G}J!to!XKIdkC+#nO$2;xq
zVbk{q-pQ^wBsb6g(2;ewW4n9joSox$_1raPSJ|$OzZ};#W#5$jsUtaK=DdCV+_$^W
zJJk4|W10HNmO<)?0bwy$x%0+oSh-fs&O4b`MJ?J#DxB24SrYy7Mv%E`=0K0AQZpib
zduB%yfsmi9kqXOYG`KW#_rTwZKJzfu6<#0FQ~t!7v}05%mQ*YAi;5t?bj1Q|!l8)N
z<s!&q$xG3yQ4i&pkmQ&0hii@0u{?7o|4HFmLQQX1xlBD$IB6jIy$;FBIiQ@Wh1aKK
zK!()W!U0+n4X?~}FB&S`EV5nW3Quu<0}bgoRgcHAxP!Ec%8k?$$b8SU)84m+nz9z;
z^0^~QO9w{L86#rmG{{6Oq9+;>G8Rb5po)~<sNG8=4VeR_UpqvLdd^#T<E_+jO2eeh
zAX|vk%B@7xIWiE5t_y7N1d@@-o`{EFDisF$TrtoXXbyXtlHT5A6wmOn)mXvIYLd}J
zG8|_eY2Q*Nq}g>rZS75S(UkebBsYNE19nZ1hQmoY5*<E}aw6Vrc^}%_)lY}tpzTF7
zbAEW-mb-_VrqJbf`j>#bSLwd%v<!XRo_W$&AjD?%yHU4^Th*NMNqNs;+CEI^riW#7
zBpCL`1F^7tN<C0sqP<81cV%8Ie?f@n)TYsca;-zaobQ9Qsh^E5*A7zi|1y6Xy+b&$
zv}{#PV+Id?nwnmx>{vklf;vpCfzXmNMM&;ZZDUHc*QirvJ{q&kmis#9z5((k$YC{a
ze6e#sn$N5F_>gvtnvZ7QAHPosQ{6Lhl6YFZJh4u^uLeyTq@AL{*36Vi&k5St7n7%n
zL+ZLIleP2Iy)ToPk``ki$+YWD_3~r1$Q@)P=@l|fU%DXjUo7d-rbhWSbv&QRpLV-&
zvR=p46Vs;^-a);R1!)AC;A*d(B+8&^kHi|~#rtOzXm*nH>rC;C!@a~U>g<v{@v3rH
zPa5z$nrL<l$D1QE5s!uADc!V1LNcvxtq!}Pf$T{WWq<W%^)PW(ov+?N+ep;Ra9+gN
zH|m!)LzXZHcuj{)M8nb=!uVN`-Xy@Zh3ZXLsNTOO5)bL}IGD9~b3p2*E18ffKQ(13
zR=Pw(s_=_`YG&=skt_*7uiD+kYnLY>4n8JZiRcKw9?xd>H2I0zysT9GOC715K<@2c
zI=$uZG;H>0hrB<Ohy^I9$}%i61O!URVbn6SgNax&5RW9{x>sYnTf2tl)&%A)#%Br0
zX_|TkC#(Jq1Y!=US|Ze;rQ3&L166Xk)z_iEDH7LGzNdO(*&b&EQogH})eULM!dffw
zJ&Z^?+oMNPVcp}K?(y2>hv***$rEKCwBcxGx4OmE3u|tgIeV_Za!z|N#b7lCyDnZf
zx4OD=&fFS#WgIeH)pO@p*3?$7kbea?!|90nx~{AR?#W&)ktyXdkl`RBKrAmn>sKHE
znFQiZdo&z3vm$yZ(nvW9Xa~e&@(kF3VL2N_Vjz27Wpz!h|E9&&wenr`ehShbBsvik
zQBlT05+F&CwICXZlZfdEMS>~$9==zB1k?x1XS4t&W_FVv4*7vHUBaTKEg6<97eT>v
z5cqZZ0VbLJos@}?6?vSoL=$^NbJ(<zhrG<=dUKGRL=T%HVmgqg<st4Tgz55q$l;^;
zW0x)iy2wt<yueI>WKx&ctEX4=9bE<1iBL!b{&YD8Z4soX8&Am%rXwlC&C-QVy9_tV
z26cW#r52*^S2DA2KIWd+8S`+uat4ja0<^9?T!x?Qi-F!mOcx2GtSL9h2AYwVX>3ro
zxvb1W8m8dgDfc??XVp~J&aLs!VGPLySOv#+)hdL@R?639T7(#iGLgt;QNZ{eg$eA)
zUd$@O=S*rT=b9lip@GB<3wMkOY=Jz8gHI4cIK_5<@mS8z+Jbm9u{HDUPF|=?9f;rI
z<e?>MZesp|ufSmAqCw6fK~RypWC-#u%hK#c=>fr5$R8!cjG7uv1Orih`Y03~P5M}M
zG_kZ8p2j6X+CFv6SgTaS*`#gL$E9skC&}Y#VRC2-*5nu<M`Hr-`y1*@J1yt+y4dR0
zb{Qwwy_wY*rnOR%Rgv8xgf-UWjS$me21M9(I&<j&e`j$gE5WFNj?Vlu+1EY~ag(D5
zMJkrauy_c)Y$Oy@lxDDiPJjQKW?Zm?zB;i^uA|<WnI)-J_5$7qW~FmI5#1As1scP?
zL_E5|GmMhJ;dS|<Nd0}?q?I=li)m|IO^}Wz;^DN-=euC@t@Y+uz{L5QuA1uE{_4ex
zYt3#l97{BZ^`?e~$ok7*hZJsV2p&=bf>wO<t1avM<hSA*>X`O~Y-E(sVgY28RchaQ
zpO}~V^ZG2C>jJUR?k=h`=@L<!>9z4@TP-X?Ro<2OwqU&!V!5u_kJj@b2x(N7!n@@*
zBBre&&Vj?Ur`D%T`<n0u`GWe*Z9_y|=F{8Wu?^v{*(sg968aOGJA{yy$2JcU!Hl*g
zPlz$9XlqF+AIE7d1NcxayCD`Ou(G%y^-!(Usv5Qyi|?v?wjL{i3te!nPNkCi<nnSp
zOxh{9X(6`HHnr{cG7-x>bNftpKNu_BwI&#7Xh=ju9_#QQR9W|p5nrh(_e~%r^!tY9
zVtv!KE+N;XWH>C}%{+DAB0;snSKEh*u^G<~-V~xD^V$7x3pcBKCn+KCP=|I5aauc8
z=XMMiK~?m_f_g5&I8d+&IxX61<pZ>u41jRN`U#|M#HSzRNBG1ET3MipTHc<PEAajf
zsYia;Z=`i5p$5|)C-{^R6G1P+1%l~VO@*x7MRH8rx(2#XeDuTdVr{1X1AlY&@6-pz
zB}1E7sZ|YlxJdjsGx6a{ZP;KaFbst21yovQw@@Gzs1N92KSaNUIe$^RA8ioFRqkVV
zQPHvUv1u(<_6EC{##x)nYtBkX!2dZ2A8Q3<Un`GlVEGs%3i7R~?~f3`;Br|>hYiyg
zu}%IO<S7s<t*OZ4KJj?Qc>JitIy?(&ndaS}*)%zW7*)gGS%ik&d(T)!Uw=qHt{(mQ
zkMn1t*%>;nhgkTr*G*O8%GP44c{jHXblSkys&=&&ic#vN)>83G=0t0EF&6b)I*ZcY
zD9W>D4uw>z_9)-Q$Yrf!$tKTX?phEInrSuUnZdc-dA?)hc&6@|YB7~dDMzPkNLH`i
z4r~Ipz&|mMGtVlteh*?(C-;reE>QEOOy6IewH3gROq<`Ic89{rXkvqp99oylN#R<#
zLX|vQH5vH0I$SJ5ALE*#x)q`)Q6KppM@cSj=Bho<7HF4f>`$4uo_)RB1ojy$n9jaQ
zCYmEU6`LNJ#$?z(o#h#Z3dLjPd*N-zojUy6D(4$m@l93y^1ZnuF~J8?4l+!=^m5^7
zUiJ}ubI9jc1em?unh@`%Dr|LA{U|cLPyR=Be<jsZR$#zY-kgXw#lpJmt#-UJ*4Yzc
zzRDba<y9fx&FuJHwoQDaetf9X`3DG`rOq5$DC}zTYXiN!Bjga%URPIVg=hvZ<D0!Y
z4|6i=w%3Z?FuN7YgX*c*JoS|rVu$BC56Mo#T-LRC14h~ZVOgtGw4w}snl3mYUj{ia
z<X;vT`0(wN+vWRe<m&}_2odrz$mLLwg+ePq_sLbN{`C=K+3y!Xq%GKNI)Xr`@XPy&
z-?S&`LWZ-XP(l}FQ(F_KCl!MH!Plp2MYO_+jN^^1E;7blN9H+M*Wv2OkrJ(##s;ac
zkNk{=9y@xAn58Zq9WKh$@OKAlLusrqQ~9n-4EYx{8wgEdNJ`OcHV#ey#t?^q3u@ha
zgEcR44bD9L-lsX1_gW!I-FKqSc|EpPs!pF6Cq}5^ljGdQ=-@)@w5mV3F*i-Jswg{P
zCxp<G>a&yi;uF>LOraRAyr0aX+g$XMScwmcuy5I{Th>J4zoJI6=8RN>K7GOs9CPMP
zU#AxTbwK9hPoEL)PH6U2kDTgv-DZ-I?p7`niBx&0iR#;O&TbdFm#rv^m4#}{7L+Y2
ztGPL?jl!t3s}rZ@+h%mh`2O~l5T$C!X(?8z2Ty-U25kPUCI2$zOp&^VYRfa%o$&}S
zT%c;V%|Z|26tz#%Kc<LYW6~{Z=RXeQPsQ%1flMcIO}2YKUnDBjpFY2(a2;d{c_;lN
zPY}5V`%0ys{VE@fayF!X3!7j4^ov3<N4@%mx240ItbE8|fcB;%j<+ZF4@5Z$Fj&q8
zph+OAGgHzlMnVSZ(FU9v2;Q>fiy#@0Z_6nv_GMAaL2$6c@#Z=lPUd0}&SJo)>1v=$
zJl#a4Jb)R$0x1Ivr~G*U$6wKx2f{8|e6@?NASQCLMqMJca<DTsTXLPOR=MZ$=-`K+
z%ddZdhD<xQkBb^7G_z|ES2Dl8HflO48%M*sDb`Xw)|iq4GBs-X=?X=UAO4`6Oj?=t
z`T*VMFevIRj~hkZdNIjV`_2tiAHANX-Z<AoTS>j8nLnSK)^z|*qm~K-K9w7&KWz_E
z<y54`UR)|3P}?p}9mhkMB5%Nk7lKTInmy3h9fTtr@88zGfA#f6kG6`&0vXSxk&b#6
z!rsJB4V<v76iAZN+4O?^-{{=oUFoc49I!nXY*c&a(X#X|uxOUogGWOTClkrpn{$i9
zXtj%cG2VE?E+({$hE@|m9w7PNTx)-b;g-UTx(=-^*znT=BX2bLIQ@@7>mUeYj3I*v
zh`S@~(2AkXP;BCp^02YRA*N_yT7OO3L5H}*A*zh|UBzgpfJ#Ni_qvL0RxNC$6&Y@@
zq9W_Sc4Z59H%4ZQ0r_m%_6t(yifbV2DPvW(DAJ<TPPctOTb!`Xp9%fiqb%253|7YY
zA<`M|=}0L$U-GSr5T%3epn0B-SEf6Rr*lN1xYIbCBfgx}=^@|87P&~OMQbStQXs9!
z?^SHs52%A44%Wz3#)a-;u+~iK-QMQuA%0`;%P(aNhtrtLiTpF;d@nInlp6)T#Ux=j
z>UxVW`k%xwZWC9=9b;7=;SomLmOi3Hh}CUR^c90e5euxqkzlvvxP%cda{d7+&Bn=o
z!aE%&XGNWkqo-SH=RvY+&|Nl>!lsMjOUh4IGkVk0$<jCW7apyJMz*)D?Jugdf!Ev$
zrrV7V@<p|986ykCGIu>qk>wzw?cM^hL|ER?p{?AAF(_*0#1npAHMlw)Tw}S}Mo8rP
zYy?`2P_{CIh06;Dh~x5|7!^gL#J!CKKSF=?6T+w{7fah-E)tL0d$O^(jDknj%Ckmu
ziKr8|8iz|nF=>6aL{uzcCiWOCW;&@#h(?0^24#g#wk8{rOCZ*PuADf7Rw&ADu?wFr
z?C+4VwNy;d3~E2w_F}1+==v5YxP79q_(4d3&FDFSUIAx%<TwbyyN$dBWUaA~ZondK
z-0u@pt(t9@anvU!c3w=p!gPn?y1yYBNhZS~Z?P2xu3>k}sK`QcCKTpUn=#Lo?_3OU
zHGBjuwmaV9u9;+7k{DSCZP_^j_~gLR={4+@e1@FvJ_kz&B>BP5+wC$-0%xX{re_Ad
z{RIwf`8`_0bk+xgYnqbncR?8rx^y`Sd)RICDi<Z%9%6d7ZF0G|sEy~Si*lMOg*4XW
z8W>?X-M!lSC1tWlPbHEbIRYZA>c@zW6Q!5c<2-4s@#r|Q+sV)t#**=(x8rGA$+$F5
z6dT*di=TZ5__@%n{ZZNnsT4FBRBXT3u>M{U-gr4$jPH-p$^&6UT@m(RRDNIBW6*8B
zOnaU>e&6=|1d4#7s_lcR;(F0*9j2m&+TH$)zRD<=F7m`DM)nMf6sL?8)5VU04lel{
zl5y1=HFFxvr;A);$_&v<{MM+NAu7d##?BdHN=t8=kk0b?0-;zWehQoMcE2pY@UgN-
z@ID`gI(+=>FN`tXF+cs@gVD!9c(d-y4xQcS0FHrc=eKB8dRR{Rjp_<fAPySI3Q?*Z
zq27<$9;^`m(r#qizJv)KH+h*u<JKcx1g#AqcY!DnKS&ZY_M`PCNCKZrj1T9D8YjoB
zv&OjjVnSb*&M5~~g4_Xex3Oiu@V8u<%q1#yZ~Nm5$B&~B$pr*%6B21rB4J6yQi&KP
z5fvoL1qr-LoU6p%Oeg)OjQZ<6^swFDN4LvQaXFas`zdW2{sm%46<e3F(^;j!rtGc%
zo358&NC#m@*iI^%Hu}+I6?9!8jGYdVZ~S9{aB0VAy)WDTvp}3^e^O|-(BBt{hAAB$
zC4UYDxuU`T)43h~6beVfsqhsZMa!l~8e+WYXFOUZ`nSNN%q)vBB-<b<MqLyG*y?OV
zwmQQK2C!n#Rqn%1!#>1da$XIlASR+v<SMiCH*;g+V$oYWP6JxoO^d}sm-vD4qdGA&
z2XEGNqk?f{h4HsKF}So7P>iLkz{Bd68Rg4G(RUbd0E{VSP$Z_BLsAh8@TGhBeDQ=2
zdCq6$IiNA^^7-0x3~*^?#UhOoKZQSrL8s3r!y)>a7%COY8;rfnMaUnbFSA=96!MdB
zy4%yQ3H&&W_gu-a>qH!b?Mif6pkydsg+d&<JZ>abh~WeO4V2)P*a;QOvU})7w2xah
zf)}J$+aFelCi_5?G+wQ?s<x`iYbQ##(K~6lipqk(O3~Yg*h6L=Lw()`c?Q!Nv-|=U
z#X_7ZIRET7ezH;w8H6}tcBj|4Xrz9W46khp)6W`@fOW3%mz84Jvh`@sz_zD@aFvE?
z&nhc9cWGeZwABMka^c<rmcjVsYt1x#&If4&^Cn}}cSLauml%uD!ARtb7P}T#Cih~1
zk(fb?Z(s+}LWDQ@9fJN_h&+m}V<4wM&Vzgn!oQ^9Ag!MZR-=Vq3M}l?aT>xe#<uXY
z$|dykk#=4Q`I^Ylh2uwObV1R1b%?p@{H<dKAI=X^1(h*H737c0e@L3zHI@i9MZ?o&
Wm$n!Dq>$521=APVZN&kxPy9c^N9s2K

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 6df9e6b..395b898 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -77,9 +77,10 @@ def ssh(user, cmd, input=None, check=True, timeout=None):
               input=input, check=check, timeout=timeout)
 
 def ssh_put(content, path, mode="0644", owner=None, user="root"):
-    """Write a file on dev2 from stdin (no scp, no temp file on the box)."""
-    own = f"-o {owner.split(':')[0]} -g {owner.split(':')[-1]} " if owner else ""
-    ssh(user, f"install -m {mode} {own}/dev/stdin {shlex.quote(path)}", input=content)
+    """Write a file on dev2 from stdin: temp file beside the target, then an atomic move."""
+    q = shlex.quote(path)
+    chown = f" && chown {shlex.quote(owner)} {q}.tmp" if owner else ""
+    ssh(user, f"umask 077 && cat > {q}.tmp && chmod {mode} {q}.tmp{chown} && mv -f {q}.tmp {q}", input=content)
 
 def state_path(site): return os.path.join(STATE_DIR, f"{site}.json")
 def load_state(site):

From 56ee9c5505b744a3b83fa42fc2aa0a7151c36d03 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:43:33 +0000
Subject: [PATCH 005/104] dev2-site: per-site self-hosted Supabase (stack,
 pull, load, storage, cutover) + proxied gateway hosts

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 90835 -> 113530 bytes
 dev2/dev2-site                            | 169 +++++++++++++++++++++-
 2 files changed, 166 insertions(+), 3 deletions(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index ac7b24ff7f752aac6272899ed91dc0681cf67e6e..7d734058185710e362d0aa581060280910afc11f 100644
GIT binary patch
delta 31599
zcmb8Y2|!!NwJ@x?k^o8U`)0W8md%dwf{krf8!zm}27_h66(AM~t^^nvB9bPrxN&Qo
zn^xqH-QaG)jhm2<wkCaTL%Ncs?ZuGVQQg<}d+Cz2uSuNrwQ-kx=gifHlh?jqiO-!o
zGk4ZAXU;am+V_=r|JyJ4<)9$741Sg6U+;VQ?#19(^5(^?;XsaX%s^;ch(XzxDm<GR
z;poUF5em;+N+pSiHAFr|@Kc%0{cMY(IaVLe3^zn^@~0Rnxh=*wTH%R~^^I0~qT}4v
z2=7hPI=5pBgz0ZZ2!A6{%1w~$joHHlDU*C-QaLrJ@syR!1-7wVkb!+%#sy!Nx25=&
zEqs&FM5S_}ZE0LsTRIosmcd1|W%}l@bDlo7WpPn$o4M!*Wo=q62H+Mh7T{K{hl_iV
zv}JR>Ts%B;I3t$;&s?sLON3`0w+V9Pb4dUTxMYBZ91F0BO98lzO9fcW^>b;EcRQC3
zZ#%dQfIGQNfFZlM0WJ%YN*I~JuWwW+3yBauFApbD=tUYD{zRnkwmi%g7o~8g?pB26
z?coZbm{P6~;9jl>;682}!2Mh?z%p(-z;bQ}zzW)Lm^wR5-A>N{R&u)_v5G4JSk3JQ
zc!1jj@E}(Tu!h?U@DR5T;9+h*z$084z@uC_z*?>XU>#Qpu$~*_s-PncTs6Ekat8o5
zaR&i5b2R{uaVG8%q_=P#hvD@&cLd-G?kK=kt`=Y$R|oJUR}ZkAYXI26H3B@vH38Id
z%>Ykx#{lZN7J!}Hae!Ui34k2e3ed1|X4^bi+s&D|lTddL*ACfwxekCv?i9d2PN(nZ
zPD5yb(*qpjIsuxvE`Vl^131JP01g{?uDgG;OvVSmL=8VB;k}H=#+h+OJEZ@FpG>Ca
z45NiP7NgZr!Va1juPUblNU2a5yg>E}{~7#MvQL-|`7_zSI1_qUPAV2}M<g@k$l~9k
z5*Sjy7#r(H$W<XZE?HR%g|`S5alZ~Z3L&S`Vl@m|wEldpup@p8IV$WkMun*d%z92|
zvFfb`{utyszBnBpz-aJOz8OKI@OWYxWPUzzi?SOc+7|zqI8OrVA*faH$Ar%&?TW{E
zt%9euD6kf%(s0Jg>-jF>oupW$6_Ry}!O2;KGz;6=>_h`ZSa8X+EFS?6r@}foG{D;+
z*tK{cJ1f^TLXdAl&@7~+=f?MAZ~%ZasGBzr8ZG8-Ge4-e@|}V){fP2Br1UO+BYjAr
zzUyCZ(DMeKy(?_f=8(HWr?!dQCwyI-bmS!DdP9jN*%3?uXy)$+Xba-?#(^>YIIABr
zmas-v4#}U!gvbpEJ^E1tJ2Iq=fKg$$Y-_}7o&F>IfO*JZqRoYl^SqgNstz_c*H>YX
zPlQbT83faqU1=FG7>4+4jL1Qd2SBUlKZW57!k4xjQa%kq>*Albn3&M7K+s7n`~`Sk
zCH&KZB`06`HF$YwaXx1gA$H*hxs&9iP?@(Y?*BkEzla|MS`7TCvCE({=?4w`HQ_UP
zY070tIJfxiyl)Y*Buo@!_<ansKPNm{kf;1E1ZNh1R`4kC!wUHYVWcP}<yi=7{diBY
z{8u5usq8lL7ORtR{8xnQMd`|yA@bA0FN>ZecNeF(JxxMi!4iIq;3o)Hh3f68e&4|0
zzYC`Aobp!?{KDeR?avbObK%_1UF2EeyE~5)r;xBKLHP$rTv*(_>+1wMb*H41yd>oB
zE>Zpkq8As<yT{1(s|p?qbIL6vo&0Yw1bEFGhqQzrhc^puG;XZ242<;fA3(&vFD90L
zjQG)}y)JxlZz+&hXb>$(324;StCd5Ee3w&h9PHs4B9MKFN`ENp+l#6DejHBPgm)U^
z$PWcg<F42h_|zF_FpU~{vuV&^vRa&sk>kgO_C|vS+rUS`hkSzYO5<kop75u}ap;S=
zX`erX(S!(JYszS#SunFx!J7vRP$f+R@E(>B1Fueo>vRTiow|ObiL>ypV`imkRL@(S
z0Yhfqs)HcE8NZVQ5R&dh3uVn^*|a1?_1dd4t(^ZI7KaOtUjSeM%!XArMVB4_hA`EV
zPTm*Rns>ko*Bskx|05(jLtIF&<IID4qshW+v63waun~MVgq-Rw^Wc!)WHg&BS|uHN
zsoU6c=>wWK6JN6syak_b$Vr<{FbThbre+ag<=D(->_9D_E5&)5?<D4rYJ7z7#g?c1
zda+qXq2+jHo(2nS$M?+uY-$$isD;hh%W4_^7Z|@2OWw&xV)$v{spE;;8X)LY)wNVL
zHr7;DHSs>w2U7wXs}9sOH8-~MzsGMV>iksr>+uXbu0*<k`8W*y3c(fxTM<Y|kD+fN
zKy=~}!JYB}gURV{v~b2Aqm@VGMsyzJ-@$B%uYl7-1CTU~VRdy)V^g!PzOJ#EzlAy8
zL=Xc&_`->Jb_m}nRfDYq(1|m4S^3v6QitHQ@Y;!ecAR^sdc<Pjbci|@9*4=v3>o;H
zn2C}Z1)#Krzm4xd$LxwB-pok^#c$9&Lh*dm;A8;rzfaRGqg{ad7K4)*oeIDcEB_LW
z2eh&9PArFx_s?XqSQ+m{gy(4{{m_tw-!44U8dY!<v+ltLDG{kG{0<D0E+D2RD?g46
zF^uwo7%ArsJ-k8qQ)`XV2=6~wtZ4h4W)IFEUjgs@CJb$yK8i_v6eiHUCIE^sLR-iA
ze)u9`v8P*L0Q>*io0dY$If~`rz~562pw9wqnHfqGWJp;w8mCAUMYclxfUY_%ew8Nt
zqc67%%jPksgfoXRgpC6<rzD~mBYak*M6&1>O2O8}!TtksKU#rS_=f2rKRQbFLY4Wz
z!M|cb4BfB!gHRAQ4Xf?~;JdF<RJX-;4RX2x=yL9!0dtprz_K?N_xlmcc46IoEESgn
zt<omnQ?!lG!h&$DZOq<c8?$E@|GIE^D9es@(uK+w;|CskW%H9(m^Ofpr_^0K@7Q~%
ze~$s`vhuVkd@vS5Tdd?8uo%xUAQ>F9&|DToW)^=Em8!*zN`ys=|2-5XuSViVmpG6U
zS|XkB%NR=s=@^7yJHQHjw}Sv22TQMcjGu&*ip2)&X?YUu2YzJ>WsMfrIH>P2<d{tZ
z<LqW6)jt_aAZfzy$9A!;kjKgN^a73!m`w&7laq6o$r;uLNjP^{s63MygL|q|i3^+O
z^C2t|nN!03XCf2n3}JOnxtZ^wSO8_|k+d6xXU}Mr=OOLj;xEqJB;*0%x-C!j4=4fp
z0lU##wj||6NN!mSKikGM;{X8jbqH%HM?mYM*xQV+XAo?pKEU?j;^fZ(a5CK{y6&BF
z>lv$4-ftM^pBI)VQ<aZF9j%MMois7zQK4n3iaah{no0!u0>1RtMk~T90hv98LMQ%X
zDpmPeD8aC(yg!bR9YXR0Y3X!EkoNP4K{iG1_}~EGD=o4UVt}hz5V{{oQhpA;91zYu
z@Y-epLVOy4y8*pc>yV`+FON<vWW~>*RyvmFgim}dML7@o%!>;jE7L^d;M!D8UHa~B
z^8m+6$ndz}e<3;QK}d4?nRy_%CYzG-*Zg0F-4}L1D=inYLa~9)fH5=QZ{-aJ{+96N
z3wH8pVav=3a#{G;OdgpN7H9V5-Vep_ZL|%xuv{SCy(67@_*M4+V(%qPzK*S6a?1Ff
zi|obk67>UEH8aHXmBN2LvYE^*Mhh)u^9vXoVsW)q*U9TmUA_F5F;>l)yZQ}$w-MNa
zF9?r5stu)Mi0B~=+eP6=k8UL&7v6s~!;VA9<FxTO@=iZX?}*hn;8c$F8lgPIN1hTi
zI%i&#@S@2#G0SNLly>59QbwFVg>g73JmMkUZ+I(&v|-ZHrE_qQ&OdE7GiG)AkGVP`
zp&8fhl$(ra_zd_A){c?#Ax=dvaLoLZ*j#3;TSDL$gkOI;NBJ{|vn<AZ=1spH-lk#?
z0bzcQjlep637k^}dzNl^#0=8QFW}=Vi#spZC^u(dtFsYM&IQ>%XCSAy>O1uogAQvK
zv9w<cS3lQHUKc_?|8dv=W<OtgK;k1XJ1M371F-sZEBz_ve-{Bo+)6Ba3%=g7(bIkS
zH^P+@oAQS+85>1cCy+-cM$l11I?aC@!8HWZmMa*)pjG}E@_%X3@r9QZ@hkZ0;|Mk`
zA^yF^vsZKE<gdcjYd-`QdiX1u64#l4d0!Vk_mw9St1;-MiiKDUZb4cNu&EtSZ}J<%
z3_lm9o{rk`Qw;hcplut6kVOL@0R4sE6#gVSTqr#MbUOLL;_FWblWoXy+WcV?&xILq
z2Em2`3@Pm1gFw(EevaY)hK16a=$0`qWG<wH(#XGiQeIy?zR*a@av=gFNDo!uX%F(D
z88C3(G5ZI8NB3I;hP+K57v6j}Q^_zg*$azN|K}a12FZt$(dld&&M-7!9?t<HXW@@S
zfzA90fHt+o(u<KjAh{uR0AddKYv2ltiwkza`mN>ZZhlRu`&w!-U1eSZi0$GJBcRKQ
zu9RtP&@PAr@`Qwl|3LWC*HV@K(4?O){^)Bj1@58Ki0!he>v{92(E_|P%THn6yBO=w
zZbsgWl{g)u^&&6-e}%R0)M&gy)w@F0cc<<7_-O%xA_R!=PDN3Eem?&qzEcFcj3Hc~
zQlq|rA-aFkeI92~+Ru?Gv1ufVmJ9Qk!z-ZWca=>w%~ho~wYssYzOEFK_uB%I?y1Wg
z%Y@wT8Ay!q==ZkyQ)x!VEdJzspCV;Q@c2(5xB$SW%%ej;gJJ*NlO4J6TFt+Lub}8~
z&yB>{eh0t${^vjY1BOvD!raP1@~ZI0O1(W0+9LIWc7XN_`>0L#?)Xmm@#Dv(4VSJ$
zic6HH#o<g*Rvnj@L@g;bMUu(mzRJ%dK=hHe(oXzhHvp%mva0@wu=HX~hYjP9>!u70
zj}t3tNa$`$X(UcRU1#3S(iwm>hsxoUcqaM~Pf7-8*PKH3OPk`5XiB}L#L*v_VKa#G
z2BGt%t+3KR^-}bvS!k$JJ_NGw2ap?RDX1iz%6^l1%mhpOg_rg!wa~ENEGk}pAb<o4
zA788XqfN^d*4EOL*^stL`0Lt}ko5WWe<NC9%d7Fq0*GZ7YhIO;{NLj^+{JdJWB(9k
zfytsnNh$K*F$tw^X;Zi&O#C!aSp-?r7BBzww?S0V<i*>&g7A8i-*zl>v+#%4i%Fi4
z`s-p16$R+(dQ0g1_1RFwy;@*&ut%_Zekc6buM^1|Lf9XZNVcH;O*x3q1HTze+lehg
zLUEOmq*@eRe0KwoXYrd{A>p@a<XvIkZ|~ROa-*!4EnlenUF_n2{`L~F(@wsDDQ_b9
zzX-f*iQ@8aA<n6(uWM>P&{)-^t1PD~qq~85yxDBc<3>PA$)gO--QbMYjKK`9Ipbi)
z(Tt`xn=%(ud7M_;CKQVF0|RUh$L0*OJM!~cC_wnf8=#k3%zpC%A+HGE{JjxcocRZy
z=oTOQLkmg$IaDo)zpj2diS;9T*|wPfN0w-DE!RRuI>|`lJs%Bx#77;%>|5VRJd6W*
z1i?`NADQiwZyzOf!q475nKTL&0OR!#Jow*!^nmLG%R7Hb#Eg6+mij+r(+gj^lSG<?
z@88jOQCf(6y2N!*1jE)l6(-ai9)zH@5{t0FNX&@1%Ok3K`4Lb?nfWe*B(2d!kD5q+
z8Nt_J6HXKc-%YlE7hmbpq@D1R@i;8(HB3d^b_R5Vo&}TzJWqL|Z(%|nW}yt!A#Bp`
zF)j`PUCgQXF6L9%1^G~qg{P_}<UX8AW@wCW5JKOJBRXNrdx@b`{*_}lzk(%Q6I$L&
zDN@p`)*jeILHOspbX|N6)a{ga>N$Q16G^AECU-%!B^ACDo_#M~_~lFf!prZ4DElEc
zbMY7Nm8xQKY@4-=L>XHl-X`w?Za7WY_K#y^R`|p}_7v0M$4~e=D4MTFfaH#k#kd#>
z@RjzGarIL8>pxhf3DUY2*$=W6owN|Tz+&)wx-Cl^J$!0Yo6PK}d0=GFVDT<4n|}+9
zV(&5_Uu}ZVKtXe~T+5<Tm!;bvPuUo{D+W29mXkzM>3CUAcG&k~tEv#pLiyTIFXfjS
zOmT?PXKb~E1d$k`yLADEC?8aWA&L_eV<=+a>H!@rN{l|-2CiX=?*wkcaleA>R^nnA
zy#9iMJfzUj{{Ij^`Ld%yMY8-<m_N;Np9&iNhU0M+8I+_S#B<bKbW4PkHi`~39r74Q
zwwlByVxxi7-qQpd7J1EaT1}FbXCXXs{XsQZBjoP&6M-a@92kP?-2|HQqY|!S7k`3D
z3eXsW4%k99HlDu7EDFeh+?~YPJ?MBQh$N9|$B%=^-}63(UsL9>2}8{Ya36(w3>c;Z
zjXW#pe)@TX<8ClXQT`h=?jZ*oLe2^udsO6i!ZWXKMpa~wtWtJ?bTK`$E~dj@CYvM^
zU@*ibbdfo)QphG5h>>yfIN_o#Mo1`8Z{d{GJfh<KXguV6Ty~l1Aturzo0MB|(&*3X
zC*=2R3XyUCSlWaf_vZ=5aXOSl+MA#@0{<q-7%-5wv8qu6KhE}=Emj;2*4k^JN()wR
zvWyvc3u`u&uw5e-D<Gju=b6opjg7J9ZpZ>g0mGSW2yiU5YN(Mf2Hn^hqk*GkTG-84
zV$;YF6)@NyJ6Kb|nxM^f`b+sNd@14y#TY6JBiZKPM(`d0_YB^_2r66PGy*|_Re{VC
zaK@Ae#to0R0C38ob?!-&)Fhzv2ihg6Z0(@4eHbR>5%_1ZL;fk*+kUc?)F+i!lyk;4
zHva~@eW6@rx32~6SY@}*7ECuxk3QTA5mQxS;Er3VX>-+Av`^+;$y-QUOWnSdawB#3
zbn{HgO!Y<WOoFJ{w5m>84xg&HtqFNl;Rw1IG^?LeJvK1kw3?K^P`sKHzjG~g*P5n8
zRFu4bM=1;1NmV+tfn|9L$EQL_G?{nk3rU{ii4@>Njy|Z~>7CW5ptbmGho(=;Cl#Cr
zUl0o>l~%wZ>Bq@Ag^)58C7k}M$`6dT%FA-$o%2y?ew@EG(47g9f(t<S6cmU*BI8u>
zStP@$9c&nhi$Gb2{y0BQGogf%0)=0EHc9w$bPx%`kfT0}sCS}ScmnGQaU(E<Lw&+w
zmxH))F5+6`Q@FU`H|am&-xndg^U3&VK7@;!@E;|-#u_Ch0<QXFbLD<qG*;3w!EiB%
z$WOt{;}1%YrLBphF#fW?w+B`vbM$BRZG8gGnRwY_PM2zTJRMFn^;kCjxtq*wnqaOa
zJtdc7!2l`KCfC|R@(k9lJQJu%&g5Av1Crv!7FuE8t;TL+7a%qZdoIhDI5tI)T_n(P
zJc8Vbp<4Qvprnn=gyVE1VaeR}`y)vjA!FCS7)6pvP>{3^5JCBWbNo7*X!la?h4Shi
z0uFMYmlon8k;LSO;45bU?D<w5DA~Y7Vgd4aB!;kQ0;D_!|15ui5uB3U4hWoXzR-HE
z_2H1IvfIJ&vjq>EuPb87JA|<+9K$KVbiHMbdE{e(J(NmKGF}{<Anr*3+9kiB=#o?F
z6^|G>A)jC%R?)@ux+$7sLLpJKM<_)Ds-qYs7IHprLJl-85onweG1;-2N@8|JSXI)1
z16~3G!(=FNW?;7cyz^!v9N?+X-1<L7gyEC~Re(FcL!U|#6FHSN#9bPssD1H==1_1N
zF3_P*Ad%_`rMpu!h2es*|HZ*vh#Rlm&q+V*V#f+}SFy1TQeA*m;9TH%C4p!HxiGAA
z(jQiWzi@FR#^2SSk7%FbBiaWJ81BJywKr%&A-rRa(gbti?)K0WI~M^S7BIc|!}ScS
z%MTWnYv}1Zk4ES-BKOot^TZ&W@JDD1f>QjTl-LcW#Cg-szod}47Hl$nz{R_VAEqnX
zJ>U>d;1cN|+r5Jfv72DYx)w7`rf11Qg-Jf;Bwv<utalY|K#vrke5pR+G@o#~4`GOs
zS$&r|#Vjtvktrw1;d0msGi&*27(!_?3Us`dND`HFF*^Q~NYWyogVs6&b-J?pdTMRb
z>G(iL_9n8^9)JdAu&JMY182agC@v@*w8i4yHm>6h;6PwC4jRlORu;4mmfg1Qk4o8&
zNow3X@h9Z~$=K)HjX4JNe2+obHDEND>{eYb)MDUuog>}dxMA;Pw{Pp;ZIi3hSX(d}
z_X-Mk<mSVF1tpT*uT<@BGOZHL9|jY<Ghb?f>-A(wNk@r0PRdVB=BzDO%Eue5BfN>-
zU6fzIx>eEX$VQ~|hT#!|#R|$q<8Jk&+7?JjCOe9WEI)*!44ybLUUmJGn@An8yNDj;
zogRh+XOPLPqhzeB*U;53ao>n}d?$jf2qZNVOo}7`9l$s%fDNRPPAHOI$&!bZ(y8b&
zn?Uv2InZwjfOi;fJC3=FQBa{Bgf^7F0xfwG{#goO8@PvN-U<%6U^r)(saXq7x)Gc{
zmpXOec6{dC@TI)<;HJm&W*X)jUd&qC-uPnHa>K&#QuN~ZO4jQ3#v3_}pBSFan>w%>
z+;r<m{mmn%ZX7xFpyQQf@}m7`L6Otsc5t{Dk+Bw>c{4bBH8^{|Z7FOmc=uA-YVh7^
z`K{pC*`g<QKel_$wotIp^6aj)gwmS{RjUbA%ck{~R<Z4**xtF?*0t8cttA+4CJe47
z3<4WvCS?pfDws-qR56E{ckt~911j6Zqs*TH9%J4CP6!^5p@re_(arQ=Qa96&+3^99
z1I#Es&M^1k$K8ybma$)sWgL`4K7f#3Bk#h8L0+fCI_i~>5>l^(9s~r=_|1mRZhtIp
zH8fSsC|(UM{-%7XY^nRX12z91yc$})61f_BRIG1W4Q*NtXqr~Q7h-6W*m7JvacZ?i
zw;HO0g1blyHY$ulRSR=Y@wQ499QB@BrVMb*vgDgN@85}$?PwzJuLU<*aO-?deQ=xK
z3-Z8&dBHD)C@>s}a3xO(@Omq-T1*&aK&c81<+f)2J;!JoDaiUZE_|jaAJm>>w!n<D
zi0Yus<qVVj7a>W~*6}ADKTadDnkhucEJV04$2;)#=@I<e56FYDdmMx)S_c*F5!s!7
zpsN}%cJXMOmZWgH*&{iWWPgg$Dxb~13zJX-#)koF@-I0aNGCg#Peb_n^>3$>dcv6e
za04$v*3t2UOcDZyI`VIk3~U_@BT<ihOcl;CoGjkMN=+&!<j5&1l|8@)3dt$)$kK%g
zxf7chYoPF}&n5~(hA4+Ui>MO4zKERSn#a?SfPB#xg{++8ZTK<*TTg!=q#(!W&jnx$
zguyX&61=LcvF;4Owfgz&0vl^nb8`AQvBnE2S2j6*%aDjbYrOm0K9)LE)__B$@WkH&
z91ELCq~q}hqRxdnG?x|bU1QSUit|B#6aHMFdz&nlO$JN^^l626>=9u|QRt5g0!CKJ
zg*Z%Fl0kBW*xQNweZP0N*8QARSqt3XPN=LXL(`wT7CwAJ<w!YBfTIp|_-!Fs+AvcX
z?5Hy94tG}Xwy2SD;Wo7lCTCJTp%w~Wh;-B)gAVbbRuqQmZ$bgxi@eOZ8vq=81mso$
zPf`v$wq`;@s}r^^sRJhzC@ccA73+$1^lc$(I~OyGk=a(?UIRNlq2}TyG+Z?9l3aX`
zKbLSV(cKRsJ6{Rgz3&&B=od-e+2oQrwkN>bFxn_Ucx+T(v8(+unIro+QDOVSxfJZp
zWyaOY1m9M+bE&TA{0+5A?F{RO;p3H1fEo(`mN1Qr<5EAO)pgM7je`gH=LpCqX;G!_
zCIQ2cPCG6CU!fY)w-0%|pp0vo?#^Dza=emFvQBTVrJg)*{NsZUKHx`Tm4XW$KwCgP
zm_a*7z@qUuR7y8La1DT+xs2s2a2?lRbQ^;E;nm3uSorTE<?!bXU1lEm_&u0*($Sei
z^2oU3ksPu^gH{6mRgAyxSkEClJ1BAK#Rww+Epci%lSS7(U>q7Ua9Y+!vdG6whw=L=
z1k|2%2;)v607P<GaHwT35?}q$Y-ex7wl?GYX#~3vc$Fbr@RjOV=uS@cltBM|%%l7e
zylMk|=o#ITl{Ro1u(%v#FwCQH?)2-_clD2ee+zsBE)a&U0GF!ZDMxr7NlW_<WcnWb
zvwRD{JsY%JsCguhTw^rfXOoX?QNFT8d1Tx5nnLmxvz;pB&@u!n;c;vu)oi1N&KBG#
z`8$@dpz|1F`8*sVNmuSL6_fPPd(`1O9iJ;ESN$kkqjEHC2M_NbK!Y3~6q8iPC$^I(
zPvOMe4Rkq<<zT7qt$>d0%UJ)@2q@vt!w{}C$(DeaDRDNw3NRjOko*h2;s8T^hEjxx
z|G56#4$y^3-Y_pX{$mfx4txMw?^KK$4P*Rw9nqyEi_AFomXaTZQ<XHe7`Xl59Gmu%
zI8e^1_mLFx7f0(}^5`Z{F8(G|aF3Ijl=FQ@Hh%D$qjn#uA&)y|_mM0+A}2Z@f=q1l
zqb@ZDJ`qZ=`RC;5xk01p4eYu$_?{h6+V$wDJc0eD7)JL*imh~f-o%7y1Ybg61pua7
zuRM%fWFY?n&KkATyzV%(ABg!a$IyO~u6z?3@z(Xn_LDy=kI)741I&oZXh|&{4e63A
z&lwDT3c+OrUq&#902em@6Ab+)0^H*HddKZ*(v(8k+V`LVwn)}$X3>{|1@qHB_T+e8
zZ3oMbJL(UR#3))ZRbQeCnnx<jf7WsT0iv^S)D-h*A962U$~T}J0N;-vpe>6>odS=_
zPaZ{l%Cqvw4e+Ro=5dAah#5R~+vx{x6R5)fFN~pM`A3Wn(1E(3%L)?BgEEKiAjzzy
zBTg+@UKKcwGv&2EtP8HkBpv}>N}quyIvG&2fo2#;3USOTNTTDdgCxN3Pf#Btzy9}w
z<Ud_HV%O;X{wV3*?OBvOE^Ep5iUVK^^(;xwFkk>Ri|?Yu(av^|?Ihaqxmprq$Cd2#
zmojqvkFg~5bON$Nhn<ch9d@cy!4Z%|h<jEbU3YXDQVjFE2gCSb{1D9$)KXzV77nBc
zmUZl`BN58KKtkm8`Z^Lu4%uSw%geR66rg$ft}cVcl4CXZ8%$j;1rvNLlc6+%@9#bW
zt#!z(0HvQ5%94J<2N~&(--VD!VSiZwGbtC!GK&P=mz4pRnF%t%+@D63bM;TD8A-bp
zkIE8`nULcyi7J&#4Df9VEKDfPOcN>}if{}uL=k$;qd)_`NNEjmOl6To1+pf>-;)dN
z+JIVHqFcrTH*imH&>EgMT9C)jK#}}K0AO1YF#ITn<xamrgS8htB|nXEpFwZ~hm2Y&
z0_j%b3~VX~sk%njTz9ytR&vjx_&0~SuOP604k6uWE@SAk2tJRX2>`fZmt*)Y7Ceuk
zhY@@k!BYUdQ{$5H{4AY1=mh^a_#gvD+;SCi!TzBRK0mRhPQ0m3SyiX3snc$%wX16F
zntH1pw7Kfg3%TcVZ>rf<H7lm=TUIQMiYe7AqvH7F+kk-N5VPKX`eu9gYJ0cX)4$d}
zaI@XA+HP5IAA#h0rkS}_TDjb`T(z`MY&WfH&2P(Pnv{2CL^DjLDqdHGTu3^XbW@eQ
zs!E=d&o_#y<aJg4LfJRD=Z()9Q&z~o58PDc!~Zu_`FAa-!TnBBRC%fVJEh7BKmRTw
zEM!O8Pe8Oo28IEGxQkdT{g9`e1jE7vK^Yp@YUv63HTtduKAnb;R|kcQ?|T5et1c;<
zzyMTBT`!CQtW0K{hyt(zwb=X%b`<6o7399b$v}bx18;s_;WitSTL5Z%>gGVre11b_
z^y3B(tdUNW0bEIXTt)!GAHk*Ra?$)gG|yK_>I{IHl3a2bn5V5cR|Ak|N_HziHJy1*
z_2{A1fTXFiTM;p{DHmII&TX4dxw3P?x}<;h%*t``*a`7u`|7cFvAIL+=oAlkiTt=|
z!|5tx%29wkOUhB4wUG*ZR4`Te7$()27I*+(lm{5$^sWSENGAL!BUOdxxg>*(el1yG
zf2tC`bScuID<LYds%RCpl6Sygp@|Z$`5T6=Ko5}sxjpawp;OfPUIG2d!#*M7G$nhK
zcZ^;fogJKST1Z)_epY)u@7cVy!iu$+%9}BVR$~sW6s^V7iJ^7WUAGHx*Yi`!WF->m
zSOE)=FX?b213al+i8da-^GHX`1OqBXq$ipns?DXE+kHSEii*?Zkye%P)~3Wr(8YT6
z<{)WA06r;%CvszinLbtIBl7c63fcKGw=Ngt0>%-#jU=XmF4*q^=mKb&+gx@FKhP8V
zaeh<=(Fn!GDe^?9<yW6g&hS(L(n-;T95lw;6|ycl=!gAmkx->_LMEwKg(nhJ>NCU=
z2BIhNMx92Zf@P176~Uv{1-lta3`t&1Bgmn+O6bokg256{!x(8W3BrMwJtaU@O5w`p
zL_es+T_-#5X$BHpJXQAebyfIefEBkE`r|?#1j8F0;`;v#-^PWyC8|lqM1ZAXLc!Nr
zliiuEtUJVox%2V4j=kBW(D7y_xD(Y~Q>ooDhbffK07T`ZBx^Zn&2)cl3GwM?#DqT;
z8RhN|iA>n{?Ie`Iwm?gB+#i9`7Bj}cijM_BFu+LMNCFDlJjX&2m<~UbI|20ah}!T2
zQP|t-MCdihq)2}8H=*J-;gGsJh4L+zgfWwv50wc@Uw4^^KwXRxjR`Cw04Stg<NSP;
zs)S4N$hUr6DwYO_m4;7&IiCvX7&z(2ZQ?=)Vh6(}gFsSFr#;M=2yze*$&)4mxXf!=
z?lwW+H&18)YA^dw22T)_qoY**69E&!6M<5#L0jAnqcPHnLACvo50d!E^)565gNbXc
z0tzuM<13gvCPC>;4Y3r#U14U@4^+`Pww{Us^9YBE;66ha=u8dW>{gcRWQX(?3%JyB
z@FtN|u(8@L)@;c~01d6+b(m#gUHlRYr(lfw&H*^%ffia!2OmW6;>MFXENr^DUiSm)
zCud8gyZk=zD&BljpJVGdTbMtoZTIZ=?Xclf7dhD4Lz<4&mz9?_*{i?>NY_|Z?TmEA
zRO#v)>kd^_G}G8XPb}oIsXWCxRp2Z>!hw#w+g9FX9s#dpliA7+8N2$y=ImoK_8kT4
z3*qf2_RlVLaI-B@yPLHbtgNS4)@Wks371?>vei*J+ZiThfWt%X;q+-abfvzmsp)uK
zV`Y~MvjL%CCxCxN@bBIG034Qq&jakV9mRl^JBXK6n;>3h%{}cv%_2D<RFvYyq0N?t
zk_1&)l3>0RX#Wgx5Kyq}P{_vRUy+Xyt-_{pvx_+1`vHG!so?Eqh2tHT&HGA*2ei@*
zohs?rsx8@k^3;BK?ym(?IBq49@c0c3DWD4<;c^5?wglLQ=s*Y;TO#bcaUW`d_}|I?
z0tRuJEchhzV(xOoI<hmp>wSZ-wwoZ<D(RA|m}=$@zE$HUd6=P!<5s2(BM-yleCLJU
zbG>5Bo+bUw;QcS=zHbSIq92GVC9{fBavA=8E}@jvI+a6kV9UV&e+=>tiQp9DK^32A
zpf*+8h25|Ua(K|8jDcr4o09`WVX)@7XAq?=oO?ZMGJtCWppUheH;?r6egx99oAG=N
z3kQC139#ryV9%zwXYGY!4(=ke*%1@099TM@WyE&DsWKz1CZkpR2C6Y_Di?BE@@(OG
zZZGOQcM(oyeOYtGK{%4;TDP{HbjVqEPIqOy!3PQZ^G{lBi^)UFg|Ww{8p>7S;kMvI
z&=?O^CJ1l;F}|Dg=y*BeA(X_0Y?}bt7>aCiXOO!!I_vn5!RcS$SaY<jv9*@}5@OFD
zz&>B5jDG|By%BrL5qnY~o??#}dg!t0nc+G8lZGpX`MR~tJ<F=K%$i5T9;<$z+FTxp
zOCy*3)8O<5d_oUD*`o4*Bd31I``|p2K|fGx<wp$sS0RVfZ@|!_?;58n8Yj3_8+9;c
zwn+DaD9N+uxx=}Vo0JyH1^t)8q6dQ*s?Kb|CB@r{3O)Ip3cbl}@}337V}`)7s-Pdd
z8h|s<LnFW=-We>t;Wt>fn}VQK3{R5UAx@hpdC~qJyL8VgJPEy!j=B95Qk|;qk%0kv
zuu^gtqKYyqjJ}4+@*(pOe*!!1->bLK^Fec1Xb`r`f5b#R`kf(Q0kr7G4HjL`fZg1w
zA8`6x3|(N8vp9pOY>BS?wErmPP-)*82vGyZ&Rl8LAvKe{1G^!l4e@dAa$?fY5j+n7
zb#L9S!*5h+(Sap?fGvd6XU0K379Dt;3S3A|W@N}I$EwlzF1+>WD6o&Z2o0}=9-uMJ
zQU_p4_Ih9}*n;*vmOP&#X75?uQo1y}ocNr5EwFB?>K2>vWZ;#+F9g2_tauf3C3v>r
zt6P>Dz9)aRu=178pY*@jFSgl%_LMUf%zw*db)=G637amvaNyj5nX*qFf)tFJJ~S6>
zpQ=Q5zKXe}2$(HK^Vy|RC^V>td93u}wwZz%{d}2NFmNM#V14+kI57!n`=QW3K^LI}
zc&h=6*`M(NRx;@UrMEDhNcuR&fH`ZJZsrpWv!y`(pj^nM>|v%VZ>cpGGS1mEW;7sG
z-cT3KF;Dtk@tZrl#uiOgyrv1htqGpCKD=v|d}8mVA~B_Fo$C|(&1>9{*fk7g^Q0E5
zsAKB!(ZC$Xg6o(Q_*Tob;-i&0g%4JT?Myt)+zJjy!uxO^nA%jD3(@DI#ZY_NnkxN<
zs%BpKjOwaNEIhcjxn`;yJV2l{Ao432KgoVE`<2{x=^GT*!RXPdr|M*;%3jk1T}=6A
z&-c1lde-;0T*`bR`?2hs@wuz<x%0!%j9ndD7=FsO9$zB1cie36T5azVIm23e_e>*v
z_w$gXFUZBr@@0F`at0K8kQ_&wV8#hKG&QAFemf}gW>D&CQ0iRaT2SURb2}h-CT_N9
zHbYD<5JL(V4lMPpq>80S*8^(T>zm=r7E+JBY#<HH?VyMm<D7hUL`>f;M($Y)DxInZ
zcdJ#TJ8PkbR;tCO<`-+$G%YX(8hgl$>fFAm%G+BD7HXEdmX3+#$Hl@E>swpbG-In<
zTj%s*$ElkgovR=sb{W??`b5*{TF2;g*)#{Z)G#xCv3)f#McmptRVix5ey-SbE0CRw
zm{ZO*%<)g2xpHQKSqh&!vzE0-%q(4MSh6m4FV~9drm2cs3crun++Sm#tyt(>NfY&k
zn|kA_-YE7Bt?6-oYZz*LtzjA@ylTLyY-CR3=-0p`!2E=CVwaU&%xy*R^zcmdx$)W5
zb!dSmbn3|a?`}n`e*awtaqj&)NwPo?iBNg`<*36EelN&!0e(jrSaLWn;5*@=2-Bhw
zmM8$eD33dwtax#g24M9DMu&wGV0p^kebgTfiHC)no53VnIB}D;dl_>O2|T`LUXLKJ
ze}*>>8C^~ZCKjrcKs^-bmo!j5{h{i?ox=H}o{9?q^Oy>mcnGWA&L<GoOvEU-Kvx2I
z!f?S-_;R4|Uk`2$w1&Bglv%@t<grBI`G+FmW)ijV^`1}#da?+=N{P$``3p!D{=hDn
zAcfH7#hU02ySX+#44ii06CwMWI>1CG{NaOS;rG|IauBvK!R{>!#@!E?dw+O>zZ4e*
zS#dL@KQ5Y!ahD0BmgbJPX1GIKth-HM!;1F`U0j0C*d)@i+2ob+9(TN2MM7$+iInxp
z2sSm(@TK|;UmAqnqnGX-JuU;nnXXaI0>Lo(k<Y2n#<&@UL<Ohq%Mq>=M}QF-y4=Qj
z1R$xaU@~?Mr~3&L91oJ9Z}+!OsGz)TkSlYp<+{5!skS1j(jS)xm4NW<pAS-_x~~9D
z$wJ`k;lj6j)JHZHRp8Tq8TAx$VHH<M$EV2a?*oFRR~&`ATEGVBDOfQX2r3Gc0r!H-
z8mKuZ0=Z%w19)zCJ$JaCJ6+FR_~c41`4~8@#lpc~W(slVBIB()rLI7h-PiW`%(sM#
zPfSOqd$ah=Rw-C=VIRfcWRMGSKmV=Bz=<IDfbvN~&O}nW7rnhn?kpx^l!3$=j8l}z
z?L|AjR3wPcAujJ?X#He}FjO7Qar@lgO;Du>wGW4YGhPBHTbRiZ7!4N&ar?QlOY$D7
z8=MH{_97$Y+YYYWT@fgaL#;tlr7~IH9z>a_;E7PK;##G9#$kbkN|sY$w?ZXceK_21
zEpvb39uls~T_mg(FO{fvrvoA#peTRPS2Hs%3DVH`F<F|d0JLpmunt>6NCUB|=#0Eo
z20~R$t)!EqrXG4)%w7!RWK(%WEn8fZVW2w)y_CRt+2gTHT{_WjYYWYB=LL`FAtPHt
zRh%}zY!uB)Z0c;cP+mg0Bgx4Li77vc%u+C%mZ_?(q{{BYRjs_;4zc$L;L^c5dO!xG
z*N-?LgC}h82AqDQ)fVP%4%igIRGMq)wc!~WpDcMF%HdSx!%-Vv16A9>2HkYz*nv`b
zHrCZOmr^UIEre}qK2}*%r>m?xT2@nAY71xapquVk<B?Lg4FFCipvoSvT`0AwSd`Xi
zFo><Mt2<KF=z0wRfv&u^ism^`)?9VGthJOUFd#M!+jP{}46bw_YnR#r*{T!GRkcku
zb+t{U)PKgQ26u9U36B9<Y<T$sYun1gX|dja*+I5&Z)O2MibIQ52I}!fMWl9k^N2|4
zC?eUtB9bM@C77#FPYwdQ67}R%PzOgtm(Y|6LX(0DP0G89($dnsv@cHo<7JJtHMIwv
z%Bsf3y2e^K5d>Q}sDPmjAC{al=t+BO4Fb<Wyj`fPpNiloVO%VrrF02V5fiJ)d9x`C
z1=sgHyJy*Nz39NoF7ZU`i+jb6Zn3X_wWD7&kBYXlH_T@rErYBs(JD2Ye9=Ff*c9N7
z%-Yl*1jw_6<beEW0(BCMDIQGSu<I*f;Yj)olkYHrb`UHFZskRQaQ~C6f+y$Wh2*#6
zbRN>>8lF6_0)zh(><dnkMs-ECpx>thau_22^{8wZlnxve+$ki<GDx?YwR0|Isbaa{
z8wXb!e$xJ8yV%z8>d{lv`U^ehdS<$23oe);%lp(u@_?$CoDVA|pN%Od&akGcBh?4t
z(3-BSwystO3(y(oiE659Y^kZJ(lr9|(xeC}$qv~M9dFh(RaG=rH9O-yA9zl`xs^rE
zC{J1?+%!{O)<jnfxFe#PpGW%zNNAlpq%KYk1U$lIFub@WNfa)F;Jt6m3UOV$9gHQI
zKGfsYRfWL2M`8y_OY$+1Tu8hgtd9fo!FfS?v?374eHK?l8{*|j1h^XR25%$}Hns_|
z5pHqHWou#mm9X~Hp6j+)bjW0F@uxxec$#`h(h#_qoCbvo$5~k0VQn_5TR`dNGIr(+
zfuzgkdEfCuE#G(Wh2TLQ=^NEGVl{)moHhl?wOuA%<Uyrl&p=A{T51n$!oD;kKn;jw
z2>cj^9z;OpaO#orHGJKTfO?9e;Y&IhRfwS?1o;Sp0XWt4f|&uM$zZp5C1lAtW)R1+
z0ki55oJL>;u;Ju?7sh^o;P057ipNS2&N&O{BnGWR(s6g>0O=uj>XT}6GX0}~B5(<f
z-r5Vthd6Lr1+62vzX-qibW(D-mu|RM2!9Z;>L~oP5T)Z2a16@sA21zx|Jcly8~%xx
zx<Eo1z0x{&czyyrEV<_nEbS6gtJagMZ->XtrU+Xu_0A1H-anlILQ+ul%<ydV#qpVb
zQIiUylEPn9r_GhkbziBO+dbd85V_zdZm(V*SvmH?#Ii|jZWB+Q27zYvWVhJXBlZl7
z{20hC<HTNuQj0}0tMSCwtX2(DG~_t~mQcu2EvXEvm==sw9j9W>3FdZS=!KedHIH(a
z3ZK~V*p8bCIjaddVs7(V!m+jJmbJj+pcv4EUf6YRml&0?rpcVD{NAAz>-w?Q^~$z+
z>oaHUSI;c@ujlO-PjmB%+y6|x;9JTK&9?b;01Hyrr~Smx!gWQ_ZH4B1r5KjJ7MLMs
z)vRn^S2W%V409j!nXR7NHkUc?cg-?y0B_ueh0$kQ7wm_Z>?_ulZm}7)rlQfj+A}0}
z4~xTRp_h}=uv9PyaReqw4R(D349D;|#5CcfSrY5pK&*!>&5RBsn?NLl$7yB|A120v
z4=Wh%Ad88a#J53k$c4v!cBUGI>;v*6_&6#*hCaCm<SqDCEvEwbartR{)62W@(IX$i
zEPDAczMYoy_~5}J0b=KU@(Km$J?@j&C?E?yAnlN%Rspp9K6xF!P0H)>QLkuMzy}=)
zdnbO;q3Fdg@BxWN#Q;Vc6~h>b4~XOy7L4Q-V;G4Kh&-dHM1NskQKbY$3a>b<gvc7@
zVT?2?j^Lw1aTFul6}9-#)G5(2A2i)PtC($?trG1iN5tr(;_;K~>UKy`sHW2|XwPX^
zBPM1oPu%y|ee212YY|}MpIBE+qV{EUHu6%}?6J8N53ctuMK1X*nZ=meHBB9?1Xa*#
zkZ#WUr2UG0J!|J$kZw(-n<{sS_Ot2pRZE=MbWCh9t~T|(4dlu$Dagy24xAo4ImO&!
zQ^mBMtL(0oMzMZi^(eYzyG+g1QmzV|ZaE1-Ee=thW?tVQ?7t3bgv0kAe$;<1{Z&QQ
z?ch+{=q?PL8@RM%Zg@WW%J^LWLX?=kV=Z{+l>NZ%jI1Y*UpfBdsVk=z4y<SFIUji;
z?p)lX+h+ZR(sfnJaw;^QO{IFM@rBfNws<YFZj~*bEm#VBKI*xsrO|)iw35EItM-uw
zku6@0tP|T$i+yHsXk@i-6dLaG9&aW`5Z{`}QS4>ZQD&-qYW)7Ax9zH+>7E(Ox+-CI
z_zUSzYOiSL%NNK}%B!hh33$Hext?Y2n}au13AYsi(_z!w&&7$6>FbINN^iEz7tFU@
z-8H{eEUpvln^&;97NW;`Ko<o{Hc*4Sf5%@IRZo7QN)S~EcP*%ae<drfc9-HuM1fF~
zx}|on{KtEhb^iYJFx}Q@ppN$%#5u+-ljw=h!6sp0Qxv!oYnpsC8=M@)KDWRG=b*sU
zF8$Eo#z$89C*N>zP)JBNN6D4oPn|cBD4ZOPMAz!oPizu4k5TVs;pVwW;X;Yp4&pQD
zOT3n8(1|cy0JZ@nAC=ep8Q#>?tH;-W+AHtE!6u)!CA-_~BTIYaOAZe?!64y}B*=V(
zW(^nWRaf+-3okqrl}1lAxrYN95l+SKhz<Ebk_T68wvt5oM}gc;z{eV*9Q|8}O667?
zR0{7LjbovJn9KfL?6o*|3*b=IR;eu@NykftBtRhw&=9z^0(LIZ*MA+2)9x=oN~H4z
zr}yL^I=$x%rWO_tA5|@hgXO>$+0-7vE{FQ#+M+Aro&uw(N3tb)?XX}V0G4D5H+8(0
zM7qf!`(FuaZkYvdMzDo$V2)5`Oa7l^Hsqcl1D_4^V+%tesNzUn!LdrTx1u!0$6<n!
ztvd!1RwT$!6-SO$R_TEI1TGf2P)U|@T-!_HO&-w)P*~#WkqL6K?iyg-36*RZTU1Vt
z;Y`=S2xrKFOMwOqImm35O1CcX2R~A#N#DSmV6&-2!$b4D5)CZm`v^THVvx2eowTvp
z;WP)Nq4^M2xt+8jO~EYh^QBOmGu+i09c>L|eQjI*xhyCRTxhQ(3wqAQ3*uW9zA|5^
zbbywV$IC#{Q{jn2D*1uBl1hH*9?4G&<0F~N{CITPq4G^F|7+x_(W2p0pbW?tV$w&8
zeeNMrOZO~!#t2<%E&E|6BmpPl%!j1DBC)YaYzB9x<6`597fVG@v-k9_w)cu~Q`6|!
zje#*=@h>Bf%=_mN<H7en_~35P22=xs7z!YG1BW)2w;}qnayvE{YM0n-G|))$N<YS-
zuN6Ot0EI%{jGzs>9El;ch~LXn-@{E)CLCF6z6?vYLI|vEzOK4Zx5NU&6#$ldF1G_S
z8(vE1k|lIFWPBr((}zR$d1ycQ?By0OaN?dLD~7e)=Gi(S_~it<B5=B4hIz2=(iVvU
zUW?D00nRP<Qp{Y~<MFeBbBC_+&z!w__8I$C`#1UL&pvndc{^C0^6GBpomkB~A+{RV
z^7_Qweo;MuJOr@9>|FTV;Va1^Td)xMRpY|RWwM;M93=)ESXUf`49GC<U03Xr7)E<o
z+FD?`n0a6&dR<XZxf3x~doAOctyi}$bS@>WZa=uTrAE{qTFHQOPAel~bMLy*bkk^E
zHCn}yGdD*jS4Spc1>jnNWnlo*5^zcercYWHeYjTorIS|%X1^RbCD(GQlvC!<j<3j~
z!T0bOl^%Vh21_%NL-;r(x8fsa1fgAi0J%5KLB$4^>5LD{bY@L`MjXFS97mIzri^my
z<zSR>?cy_a^G!ch6iAL~j;wMLCA=CM?qD;?X5lMe4-e!Ra2iWPb`e~m@F>uiqt)9$
zjS%HEB7n99mH!G~6T|roIK1K6aKVVcI93Wtn((*tD!o_R$ay@X@I0@3BY|xp1h9?%
z=%F5l^K)&ZAwFAbD1_;rM)xv?i*V(MoDhDsKg!NCToky_M$?T-bI(Q<;VvKarSbP{
zNl~6OmwAIr@NUR(m^@KZMuNjeJuVC?*;3<k3B1C(MZbBr*RHpKTLNp#E@9E}!MzeB
zZ6EdM@kHU`VCn6{wtyobWaHjN%Ld(^(FD#Bv<_RKccbGveYPT$%Rjso*{vS+QI0DI
z-HW7c53iSFD~}zmFNH0rvb>_y7UNqw?p3f=fzMAVwX1{5u(s;B4mB{PJa!XwfT%^$
z)zuzpEp?ItejkvQ4V2yPQFVT(9rsXn<IL|i&^v4`918GKHcE-87J<?(uMz-t0!|hB
z59sh_OX<!`7on>5rBpCYw;?az08RhrgbFL?Pe8U&%*ql${c;i<@7z62ZiR$h7(F*S
zqyOairL?)AdHsBonBOiYb-WsX3LJui_q-0&Wb;hnjPYXWOx|4dJTt%RYS5g0VL%M1
zSXY2xPDRoW5tv!kT<Towm7KZc1trj!xMv3!bYdkO2R$X~`c~Wf#gp~{abQ#&8;A9K
z7R=f}U(OKf?m8y<@Kl2p64F{hA^~dC3Wq;|u;2r7HcG<!ATxwn8kk{x3^OMw328^z
zEjOXWs4>eW5|TD;nC_n5x~_<J(}>i#nYvdM=@N+m((U=7k{^ai_U>OCLtt%`XhrHq
zT5;&3Xoc??xbx{7D1`!6wddvl2-8bYU=0UcR>HLsk@-HvL*-^>>EAoRhQJSOcwiv%
z6hSY#$b<-LaddwG<sl^rMT+62A?Sd=6QU_0@n*do0GzFdU~rLmI3Eg#hMe?b3kb(f
z$OIA|2_gU&2TXDNwFEaU1A}P{Z5IHqt13`9teXDZ<`K^4z#dSUO)e^<l&B0PFbU8{
zeh&gvN%GAAY?~^~L*qy>KpkhN`Z#kZ`W;$aR}bNbuzV>ULEk%xmZU>=)D~_w!C_c*
zwbQepV79`g*l-vgZtp|Qp%!S&xTy=zJYl)HgMF3{v%4EI*!wJeFcN~O9D|F5Y%n~e
zdVCSVHIDV<aVu~^ty{`tA8kpPh&ox1;R2i*eNMvD?xTykEy|M<O0iQtFfE3T5;esn
zOSg_vDh!@ygW!G!ZtQrsDZS%{wJF$~Q5U^6me4EEFydamenUt5;ObT!8yu4o-VB7E
zGn5n-+H>>+AbA+*JL}28x(Y=de%A=k!`YE>7A!Mp>|iHY7<ITv&BSiYH!i~w2x|Gb
z>y<QI!w>iI{!5Ao;*FPyqr_3;Q>71i{Lq0IN*$?Alaff!ff(1Ri^vVkoU28AJ51FS
z{Il34el9==eK{70<%y3bmPrM##up-`Y$ZS{MRgWX$lX^%#H^i5>gB>^;|rzBd1Awe
z7%;l782bon`OCl*pp+-C<cTSTVqx?8v9_DXPOlyVWhVHpjIHX=tQ{K{o9#BBX=e#_
zv1w!4k=%7iq_B<Y#Wy2kLc-X_nDMPuB8)>!6%xT}`C&Pb&}w-DYS!=pSsLZd_&6pv
zU}U4b8(Fhzc@IWb$$RmkF(UCqWtM1<-LWKJ7+I=Z4qvW$VbgL5B-fL1tjh+PJ}BMB
z9KwR|0g>a(VSF5xci<!D6vAFm=^;tx-6Z+JLvC6OT9-^vCH>E|SpIG}_5C>Xk<_^5
z{~t95+N3~21y4$o;Ym3$4|P+3^%`u>!aJ#W3_*QphI9mZ?l|)E(&`C6D~b~I=Vqp;
z@fuz7eTh5+w+X?~AZr+?SQ1k?l~1A?ybv_-?(&3yV^jW5$%WE~;?sRH;b|&Y7I!^(
zvY;=9diaCWe=rZcsI(hk)xgq53EyH=Nqo=*To1#AV0Y2ul4heDgezOLkb5nl#FdTm
zot|vr_z`52a}l1nNKaf8bO@S=HK8I!ZIAFF{vI6=7t>$qs+FGNrp3j=r*X7hbQ`3F
zhxz!vAlnV;0OR4*ylZPlZ<Yx^JTqZoX2^LJyum#Id!UK%7OIdj)<j`4D^Ym692^^9
zx0ZhHZ3xOr@NsMikTTOF`oR+(2MRcik>zl1CW)C|osT!w-4g2DpfbV{0_^<0M5D*M
z;frKK3I9}FBDTx73~rNq-oP<I?LEKWmrWfLRCxH{TCy7fp|9$`JUX{<s-PS;{}lYs
zT?Fj21?~>|47$hXA3BTI&$t~?(l{_Jmq&(Ki`*Z%wrod7HHlMOi`~(}^6g|tZ9MT$
zx|ZSYtosRdBI%_+Pd=7QffMJjHR8`FXQ>ne-j?nX87>R24~tLYHX{a&%C2cY{GEhN
z1s;zczTVqUZmUoE``qPo*<6mbOnCl<#C*W=Em*WW8w^4&EUmn2`R-8#|C=iJhZCAd
z4$~ux0WJ@z0wMWRF?Kp+T%o&Zz60$uphZxZn}OTri=pEw_xgGOZkD^eJ&J8#Z8YQz
znSp1a9^l~d&4NK3xfhGe$-|Cb9+ZVCVNsMpt0QmZ3>I+Xa9=?To*ncS-fUL7!XsOa
zM?9&GbHrqU+iAFw0dzGtY*ZA&35+iI`zLIlxl_9TZk!#X2OP|hl^-*L=Xt-uZWsc8
za&X86#*4NKuBg-I(j6L(G<u{#9$oV#j%^=?_98&G?Ox9j%B2PRvPU+R=QIcZBbW?&
zVF{JJ@Js>h^t8ZuEQ?m+<qb9NnzW2F!sC?hV+mJ#!+a@bMpYQt`Ta2Lj{rRYY;`5H
zYdHFFLy>V5T<3wCllV$IO#;{A-QZ3SZu?*zWs!vhX0oeSZvv|@h^^?P@2MX?mCW4l
zLfQA&vZ<d(tu4jlt8c;c0u%vYntcv}z&*=-7QEBYF8Svifq{XBQ^tsTH;-cB^**tP
zppvR}%Q5$)yC;nbxo-Wi@3c!Ya?ytvN27;#w7Zx`x9@sM!47uFGCaWAPOv#;RyGG7
zU2H0#D;@zte9HCW+-5*6yspu8J19+sD0U3+3l0H+lgFqb^<M6<*mYUWI&|)CsNJJH
zaGBg~Ily#|A(M-jKEkBHW6b1ngvw<rHXKT_)#B<Ihl3O*xK*D$4Zi1ai9I+2xXx(9
zq{6TxW^>@T(`nYju_d@2j~?H^So_AKNZMR&#z(TJUqj4A$N78R>i>>$od|%La@{<Q
zM9Ie$ARk}7Ci_NwZ9>pYeG7CLJdGd{!D|TUv3l>ZcY3z|X~Y1e$UeL=ie%DlyH*Ho
zxYVKxlPEikj`U8(JW8GE;Y|D}UyW<y0D?mX%yta`byh*b;{Hj0jAbLo?3yGV&y1gk
zf0l0mn3BEcCsPFpVK2u3)7<|rnC1cUPhIX+8ZZuqMmaPWHIATjifJ-ka61HC1uiwM
zhosEyycHBY4Ibv9GYRL+Vo=iTfT-Cz&#!6<ZihuUqA%K`XLrpt&TFpd#Ps5YQ(|o8
zN`Tk^n(L0$hErm_POLsHc5-WBhMQr7t6_uUutl`mfrsTKi|Mdr9WQ67)4Q3}A-CJ$
zHj7hhY6I9wVWz`%%yc<wQYOz$&bF<GY@X-E!irUUUgdo1Eltpc?dP_O;i>DIw0Qyt
zsq^=*=9JyoT(-ijl&&6ZT`u%w$ynE9&KE2&Vo~*K{(&1?53F>G4f@sE&Xw?68n|^T
z^9H253YceTRPm~&cq#Sy%;z$flh;ccq)WHfTG~aO{)W9pFZO~1ziqYmtk`9s`FF2s
zc7w9GaYgfj?#BM+^_DjAluqn8EuPkkon4}ygFYJI$QV4@$q1@dkCRcTDrhF`{Epf3
znev%oq3Z1zSy<A0u`=lK|7`g^aNGXBu>8jFn{9le<*}Bzx`oEIO*_T-eM{v4z<O(6
zRm6a?`+sS@^*>)U%|E<jS}R6ubGbeowl9q>TYotI!uWavT-MdL)^Kv|K)YDoAqJdU
zSLkjl!XDjxGdz7YJbgZ8zWS<mJ$&1`q8R+z&!4#&lCla2Mvd7E+<M6Fb;X_!B`jrp
zuVh6p*0;Q9T&n;j{pr;Ty;!1O59wN0aJT$bAGeR*KRRt%_uq6oKqCh3To2fFJ2-46
zQ%tN|uRnIP{^V-Cqz@ZhZ8xpeo5i{z81-R7C8q@HFVQS-MUg3_O+GEh8#0^d4Vfoz
z1f|YauLq?0icjlci3e3(!F0>HUDI2|sPg5)ZOi>H>=VnIpwwnU4~M9_sM(rh{v0J!
zC$6H!IuKU-O8Azed*nabqpbDwcj)U$G&7~b)8*G6uP5`$Bre^W54q^Co8dCNmr8Ym
zDZo+HNG_60#}mg$1<7*!ycupb+2$x~B3sF3DN-v%ZkHmr(8#c@UhiWr`&!OZaz{!N
zTsK-GWy-}&Mn`-T$s~I)DoQQ`SKW6$nV?ioDErEgYj$iuPC^sP-7QOp!_<?0UKY=K
zz@a}*b|~^{`9~a=j+4T~hhZCa!rzk`9)VqfqksPhuCd3vLHJ6?o5x9_o!-3Sy>I1H
zNMz~e>%Cir?#k3-_hl?jjcNmf4v&U`HOmjTIkSnU7q#Hl?Iimk8ZLE)qfzwI7Vvq@
zF`0AFb1g@@N)T^xu?6ISV_K&jZ(hR-U7Y@d#vUFt?)*0})ep}Wa&YVtiS%g%cw7mb
zfA2YR$hTm$2Fe2EG5xbhd>h6D<@hRT_#Z);z+d1=HvSIwo?b?h&eu7vogkdui2Vu#
z|2ZAB8ZHEfKk8MBxh4_N%U-<qya-sv#yef4t6=CRh4&Tu-2H-AtxyLsx?@no8C6P4
zx7DNGg@;Q@LSRtoaWJgj!hgmw)k@;x>CTES?cNJrB&*$5gyqS|Fn$EfM(`{YW4TXp
z{Z=da0+SG(xxTqXjM^>ktzU2K7E629B74sTOe>~4Z#ll+Ml$VkS(K6dGC*@7_+0Re
zeJvnss%$>&nWU>pOMdIxeam4#OnM<ntnU>2$Ci`U%g%szE9g4Tf~OSh6ZnADc~m;`
z<a#?xbj+=PRbGeK&0~2MyErlm1&&GzaC|_42PK~?*V`zVpIrrtG1|3&EzrWUXKJt3
zE^S}WE?+MDVeJdGVpHe3aR6+u%eCv3|3f3G--@S^ol=>Ow38&k@pwD=_`Vy8u*PWF
zjc8S4sr*KAWaCcxjh#ve<7GVfcLjAiSS%-D2DHlN+UD9?tsEfub6$c$hnqMY`VJCd
zAH{S+&j$maE<aEOSuFezPAz3%sQs2&aw+3OJtV(@vzmfgsG9EvqFFY^p}CCz5x!1i
zC=IjBLC6{GIyLCJ)l>4ZoQ8~!H#-R1GKRS;@H-HlWzt_&`U!@p$>lJnDiNSQ(B}&M
zhcL@l#3TA=1j_Ig?*ieU!+bN2)2HATsagylLx4vVsr^{``%CBX^=Sl@J6y)lcM-e{
zz)Al&2>ykrn;7*g1b;yA7X%+5@W+~P=}CW=jdF-4e5C}(y#PT%I**YT5qSQNl=OF>
z<}r@0Px@z!=pRpEusif`pU^ey{i6&;n9z^FgaDnwrAwReW_WrV`MuXS(N%8uT;0Ue
z)eP$u{!$nMdZv?Vu&L=#i<8A7K#x$LwN95ga*TAfB66Y705?75V)LVLC?Wtj1NID>
zQIy@wKLD8_O=dYImpN8+q=-aZe_uxgCPYbg-w6&Rg?AEz$)-E3<1?Kk+5C2rEHwPW
z*ts!j6BkqWtc8?L1-`3Lki+CoAVUr?cLHQ^FXbJ$UOMdUZL)~isgOI01k%OaDN#dV
uu>mCGPNbS_z7v}Qx2xPa1UH~>c{^VQR(#tHdE9G?fQPC<;j4(Jt^I#aSabUT

delta 13014
zcmb_?d3;nwwtv^{zMW2YR+5l~ES(MLKvp(cLQEhm3IUS{5{0Id>LeYK?oi!HND~aW
zjO(aa>h=8`6h|FJP|<b>F7s2zZPcF%<NEISer}@<jyo=+<MPfqH=P8Y&L8i+n@_%7
zx9U{Ysj9P8)&1^k>q}3n3D3pH+fDEst3A}kpV^&|!Mb)&+p2g~t+$M&r4?e?iO*=!
z?vd2Al>N*oi~hExj+PeAII$AGc~iN0zhdOKO#at|mNCNge@&>45oU}MYUgccDHgBV
zHCt9rOVO5`#!{q3NmH{=$eP4$Ja(*Z&Ix65NQqC$<#8=}Jl>mkgNY~XF}FA;Hn07m
zhuKqG@_ABA0Z(oz<da&8cuGt0L>g%~JBFw7w3can@&%@r={z0K#WMg)_}M)30@gBv
zpTo1@cP8J+r@(J1-^8=ww~XfiRXNWEtl)WomD~wf#q$AY@dCiv+|3Jtb`CFsx4FC+
za2}rucnaUlr$Nbl#bohXyF&7@#1w64KZ~_<SG%H^qIoGL(PbOY*FN9Oa%~f-WR7JL
zqc*C`$LK5Cm3FmdA+Ln)7V#>;YCa2aF`o@s!{-2=%I5;s@_B%DqZ2dy^I~zz*g`Df
z^MQORUjSIo7XmKhivXANYQPnIG2lvG19%!g74URk3%H8c0j}mt02}yHz%|^%>tPPo
z@@4RL244=?$X5)*PZM7W*vwn`X+Ur$KONrI@l}B9`D(zkcmv=Dz6P*`uLV4tp8<Fd
zZv@=Pn*cZQW<WPT6L2$M2k7DJ0bBW5fNgvOAoqHC%a-XTld!>@^Zh9J4)|xLL1j>J
zwM8adZ?LgN^1g(FtXj4u-p>}xjHGW^O(ZG#bTg}qoRgZTu+t+$lcy+bP2~CvD`PHs
zQ)ZsJ8d^D1KA!nr;wnh#YB1#O4Z32)YB`cs!dA&gd}+z{?tq88gCS4IE1H37UBouU
zrZ}*wXhJwcPRS_*;+mWi)e9LLBL18^m~9OtU9qBB=H|`M!hDxSP%jqjMOVGsLc$|j
z<<`6mH3-F<B3I;1W2{LYa?Z@=kP$=;cREE1{OFcYPj9yvgk)>vN9Xls#~F|mjR;Nh
z=AyE!E=+C#(Bs=hpvM;sv<F0w2l|l5idLzYK}knsL2<9e9*(K=dW2Uv!}5MtDGSSY
zTup3;oLiE+ss*Tyso2uF2*Uu)VkclYUU+=n1D-*rr`NZ@>2sQ)csCZLo>0)?>GwMO
zdR-|nD|<_3H)6MXOrPiu^m_foE(~0VfY4)CG&irU$E3&xA~Aq)5t6IHZm+jj%*2dR
zgmM6vUHlr;SIDU|PE+rMWH8b<!>=UmgQU)a;tKfP$HblTcxi=tFT7k3nO>H|*tv39
z`3}}1pD3T7c{gN>d$2-W&@1|VZC<zE)8iF)$jKFj>cdcQab$7D9~iq|eqUK^JrBu$
zFQ-+NtB*kP%E;MO*Dxz~C=ST4X65JK1xc4xj5R9`LWZuk`$RCLGcNYYd9#bury=ti
zxq0^OEF7`Txtk^Z30rsu;aP<LC!d;IU_FG%5&6knuD$`uTO#Y{-OJePGIsuac2F*v
zzn;A!Z<s$t{QwH@i99s_5Q9O9h1KjSd2rzZ^*ChT7x{GI0GkVPhK=dwU|*|v8&e?H
z!q@9!VjH{#(bGhwD%joEA-;u-2P40!KA%~MwKrvPO?BS+kZUxgf*7@Ry3Ej`Xw%KU
zo(}Q7N$#r2RvEPQhsbYhUYNu-$gPc;>~VQn<NS;#psF6{_4oTkz~AHbhl0A|<6@h9
zqtWX?9z-Hk6lro*({%Q!>}wi?v3%N86Z1Wm{nI4pG#8&iBuK1VM4;OXT~Zmqr<h8H
z7IcNT>Nei$-s1D~pm-CBRe!%n1a(_)K!n_o6b0DT4^Sj;{9>|vthsh3wS=PHu+QW&
zi+8a(R5)<}APABTTDOzbPW<)i^+oI-vgyoupx~FCxp?>(l<JA2GVkVr9*@r-6ouGF
z5d!icrXp|lwm?s>$L|aHgD#b3-WWA9Zd4#zC%)z*d<a!fpd`-!i49^M;547f73;2=
zj{G->=|<id_c{yw4DXX<@%sJN4s4`TzPf&Dxr$w#jqhMkO<}t;=nHv+&eFwBmm+k`
zufm2;5viEIQ_eUmd-hsL>alCq)i*Y-Tw32GCfFV<u{G8&U)j{$xIw&+bx3fI%I#+r
z52GHE`ie|Uy@61IFayC5c}zWkfWjnDymfQ8*RRL;g51~P3kei$6y_fB5t5;_f<*Ur
zLs2iL?aNj+HZ{A~u4!x*FCoQy2<ZTd=#oc|XJ-pCX;vh*a9>+Uyo?l^5ZrRZhMHkq
zc-`I?^l~@KO;F%0=}NCxoPtDTV=N%gLGc>CzmDXVUJ>AiHL>;t`bfz8y}ANI{}`1A
z``bY7gI=BabPGsHNIXUPAT&Yo3bsSj{i?~7VG`qF@DLGsdV7PSLYB9rRjxwPxyX=;
zA{7*sm}YHYN&O))h>Upqg%vZ+!rLLZ>}y%6w!!<8k;hy9=2(QwC#vCH<Y4N=)gw6)
zX;?sx#s*FJfY(9cg&J9r589;yvcKI|m{092$98buPihCG=K%Q2Vzm<poRMR`oh*%H
zZ6;PAm2+XO9C_}RvRZ6gAf+KP^_W8DK*-5Hv|`2tbu{c1`A>q9$j4ijo2}GAp<EES
z&`PtkMm`x>zT#_aNFiq}>YyQH4ZCgynCMhV(!&{TJ>1<5LoQp?9cc4(2N##2v+oPe
zk<Gnl7N9mzmtpgwS+m77YzXH%tSp`rRu;_{Z_4L-rwwDDq^6=AE6{jRb;DLe!CWw}
zSU?&=>yD$>V>-OhS4a>mA^{sAj#Y6wQjbjo+Q5MzQ3X+$o%k3gY6TLih*gpPt!d_E
zXxT`^!I)5swBY}Sxim=_#DFir4kr2n8_q+pGcX_qprkHxG_={AOXI*=;UuRo==Ak?
zI=rO;fA^qsI@;+q+orG_xn<jY=UG6bD;=F6qul|&H>{MFey5afb;TPpS1+H~HZ>g`
zs;;753sC`S!^UisY%n#ORtUS(%>mItQUGmv(5|~><)BOb6>zmY;vRgBu^~BcdwJ|X
zfEdOBt|+iQSG^31&x~BXy+vup34qA!H0+@cf%+opZNgUyHBK}>5c8pOii-hsrQJ_@
zubV^LLb`d2cThZ}?K;R(Q*?*$_6FQ-0e`!%LrCcItVqYXeuZ5jU)@>Hu9exlvZs>$
z8}FR@MGio=$NGRVZQ50!UJots$c4Ky8LN~xomW^y3xtk9pg@H!WrIE4AimV32XY|7
zIUwIZFIW8y)Z8Lt&;R%7zlM~^0r<|=84C3V7nGONI>XdpHRzS5_F`$jAYZ*1==_n2
z3u+ycajwI$O>Lg`_CPmx8nU6ui>}N|I~S;QYe0bc^@mmN?XM~oU(1KCoCjPUzj9g<
zGN{`I0%A)@c)j8!S#s4dyHehH)mcoF=H2D&|HxUpYs$7GXB&uzaB>-#^3J~2a;(+f
zjlz5#79RuvVW|~Wk-fVgXZ9iNTIm&HvFwr4*`<-|<T^I}LCj4Ij`Hem6&`<Er?>@k
z?L5%7#Vgu<5F*?tQ?GR;(Hx?*7}Iu{Tz%~fwo49PTRiLmW@y<2&b)37cJ_sQ-MTu^
z>4Wwt-Xr@)Yc?(+<5F`N8*n3#DaGlepj>RkJX{okVoBad1R>>0HZ+;mU?r_Tv8@b*
z^q7Isff!Q9+jX<ww@nm7HBcoV#U#3=6QXCa7ui(?+6{SrkX^T(<)*}u#*R*kco{p7
zXxDvcoj1<82U$?aVHxIBfsE*$A{IQFduv|+Ha4$A<-L)^dseE`^RS(%2o%*|M5xDc
zPsr2i33}bg%yW<>-jc3c+S!}(s#`7s_mFXG^(rICKyp@1!3FFB$k84}`cDu@ju&Iw
zCHQ($6hL13Z7d+SJ(IX1<pt|W4wGiF6)7G>xC6oP$nw~&F7-2L`L;;<ZO>Y=9>Y$q
zMIdn)Qz`Lr<e&RW&FpLGy6b87s{H(}sYXPahO}?Wg1c|ZJ{6PWMzacgK@a6}KnVLE
zcjs8QBEjod-;-AIBBo3T#2VVupabZg^z6jPu+lSS%{@iz$q2tEfzAE_D8ez|;>%zK
z^muSL5UYZ3?*VgX#CnSO3LB-4$f0bLzdM+pM44ZYmAn~w?O-FToemig^p6<{K?5L@
zV;lE;;v1|--q?+)an^&f>%OV#KOytc$hG%<uB=3BqAPB9*ulNM-GRYUFo8j_4!CX>
z>ydYRFxZKi9k8iGV*#cf#M#TM=FF*_59-_?$k*Q{U;KT+91qku*%+UWd8B2eIOjnd
zVm{=7wIY}Et(<zOKsAB1z7bh{=-IeMw2H`A*uGW-`h7u&tDPc@^^Rk1jB`3hZcZZ(
zVy<!F6@QUUkFRt*gFQZr@R7Xz@r#E`u<8tiQUnxu-7>49qC)%;-${NnOrg3OOx=hn
z@~#vG;3^v4ejB914#U8e!8(?TAAmHhHmz)~uMXSojrD8SR73Hp;W#vd_PWMedG`}u
zmMl}BoE?*h&3?-wYo5G<)uR0q7b9FkO_bBrUyA9Nva>gq!Rs>dB);0m*Tx8YAHrJy
z_m<qJ73D`JozJXbN2KqWwZj&eMPn2+02&#N(N#1a59sFg>(?9Zn6!{&DF+9biEu9h
zYL{U=$+)5g73g)v%?KzyhNJZ$@j?LIv9x~eDtXGY=^F<zFCC!{>2P6<!xQqwWHNF2
zNzKM(MYo~Np)ESu((DPgl&k;^?G<_8*_=$Yp~fipLJxWjhROlh<-6rO&(45-bi#9!
zbFRh`b1!U*zXfVAt#DeQt6Thm0Y7MV?Q@GA`M}tFKowMNS~b|%$Q{pZvN4N{d3l+Y
zxSTGVUM^INfGk^XfBAMODtzTvtWe(hN|x$^+`Py$ub5fIUvZRQAxqhiY4~H+&`>hY
z-(b<(2-NBg^7~h_)fqrq5XpJ%gLpcQ8W-WPOnI-#T7hjA$nN*%!0FX*-<y--#0*k2
zGH+1Zq&WxJ<g4G`n1mwP03iSl6qM>++4Fuj`>WjjNiLfq_q|^S8}5(Z?<p)t?#O;9
z#y<EIpg$o-HtLkh8$KvxLHWoByBw&66rY7F<cojHh_wCfH>`^W{0^49i|`kOaTOyG
ze+%+-$J#Yb&C46>o7_w5=#VKKS1tm9P&w~|txY+FJ>Ml1Zz%35=FP<`idPpmwS?6&
zEETxg;T-L%5X+S3eduDxBL_ablCdY{qK|xRs{GwYf^CXqe!Pwqyb4{7?vRaf=`8d!
zquLNT_=%IbP^BC8DaKNup@;Olkf*cmpQ&_?%=qlV?8P{7H3+8y{481g=c`$rJp1#r
zbNiq%h}<rKAMp;r&ya7D$3Oo^HWG?@Z1oq&Hp{8UbJ;Rkf85ncCJ}>qBNic*MecQr
zAI}y^(a;G9lq*BGQEml_>3Ea^$5jE*<~6o-r2Ag1^DqLbJ^JEw`SJ0*;YTo!)RabY
z8ot&cBx8%@>QT6LTRR-bz^Q@|hq3elglR}ZvDH#w(bxuMVgV_3!O4n!7LLQ*+YuBP
ze~>2Vs?s|k*2=5C%w(J7onK}r(N5WnW8H^DcgR=2%%AlWBy}~^0S*;T2}GN_O)P@G
zb#tqSi+izI)@mqa1!M;cfLvC7l_fVn7b8#qDpB18xy2FpSJkl@IKj;jJ<&w3g8Z<#
z4FcsHdH;`RvTLOMr$uw92&;&dIIPnU(DaEU%u7Tdt4E_$Mn@^P|KwCXP}UmR`_oKI
zD>Xt|m5lYtMH@~ZS_<3!0cU@pyRXL^9M`CD%sR?)ey6}rEFG%BNzUpzmlMx^o#YY)
zMKt6gRjtgzve_xx=@vF`couR6R~ja94Ycn{8utPQ!z4&!TpN;*ien;Ss>Bq9M6)nO
zGC^WPf`Qfyj%smlIU({OGyOV}L*$_`l`T};q5tlYT9sXBanSf5#VWUGM`PJED_pIB
zP-{QN0@FTiik<Zs8zU5UJmY9LEGaQX6HQZ|s2#AgjBJ|f(f#uQ?6Vc28=JgCd&|!9
z96gZU4*$W|OlaiuMqCbdH)G+E*W*|cTiyknz}A_jp#<xa*pjsW35zUn#t5gzK|1C!
zLTe1Df)=24j-4EyuazgTTy~MxkidQ@KM&iXkkUA^$5(W(&<~wFQfIG01{@e|5pFG<
z$nw<z;PC=&Zz9_sp9Do__&+`yQ0{zft`f4yw}-Q}@BfY2)FH-|OnJuJ>GI)M?Q^+>
z?n)+eBOhwrVA`Vq4MT<NXCn5*k`Cr)9VYFwB$m2hhZ4f@m7e{hzvloOJIp&Q+)DjG
zF1EKr4aJWVn0O4g$=?4+l}Gm5ZE(vMyT`nr$<OakDYSD(Xi}6c3<(~G7`>%pCLWI!
z6`r8ooWe5GlB2ZT&J%}JXe%j{rX?sWTYK~hX4hU&Sdo^Q${e#M4OyWyWt=6RIw765
zC!SB{=?60Q<Ep^3BW5T@dJ0nI&bMM6i9B;C1}4H0nxYM-vNZYK{dU#PvqrmGHKgz<
zI9K~&S@D66vWb}-!rVPE;{yocGSU;8$b24AI`^36qk556p2i$JFG?8Yljjd92MYG%
zy21muSteIugK@e|DnVYI;?2K9c{s7$8)_@}!=8Lwc`(>r9!^@~6(L`{uMMuIoM6SB
zqEfpwjm>8k?TIw@Mf$r?i;f&l^f%h`lbMrUKk~_BR>+udWKsspWBH?IfHr3+@L<Kk
zlu-2fF}5?HEzV@F#i-zhzZtU-usIvocRHI#K^FZWHo6TwOUMo9J#bVX1pT`$lR1ZX
zLdkCU526j+X?nvJcX9KT8!p*!S>n#xHxedYGh3_PUA;GX@BEvy|CIcvxzA+2nD<QH
zkqzg(v~uGSPwSsowjS~I9PtN^^!6Y14;<;)cBEtQGdQtQmMHMER9UTjj&BY4)5#i?
zgG&!5AD;U_=3&Q?s-;IO>ob9>Sy_k01?!dLCR6HJh>07Nk-ufK&za?qz}COkvFuSD
z`(;fs?@)&1TXWJD1XCvHiIvAh7awHG25JIb;p1l<1R#`Xyn&j;?q^!fE|wL?;Yb9u
z8w&O-l#>f8l@g_cvbc$oI!a^Z@jRg`O`b87BHy|{RvF7q9AaJRbdCL84s%pRyWe3B
zVJr0TNzo2R^@}=ybSh69Z*mwiCW9V~Y6$Q?CECD{nWs-^B4dx4XO0W`3A2$kfo{r#
zboPXF&d+Mw98;8p=SD|C8kG0T8YC>*W+zyZT~1b*dLPPooZDTyb}d~UxZT349d@!)
zTydmg&i>9oFyss;;MGWF)x5F__^VtX+F->*C4w^IDqw5aaH8Qr$23O_VJRw&9`A?4
zLezk^PH)>5BQh9-0^vcJflz^PJ_5P3<(LWrz=r-rt<o)c>=^Yj#^J9X+t$;;-NdT6
z47$Au{(~5c|98~tWJNjB*>yC3%S$QUFD3NsT&{H&v6swmSYosbrm}~%zU6F^_Umg{
z?8y1k*w-wXEEa7rF_LK(pK6!7SS1_L9(J*;@|z&f*tgOK+NJ2MN@ug+*F3wT5@D9H
znWvp~tfrQ*%B%oX(yjeo;cFj+pn`h95I~%-tu0}bE65g+8KRvk&06e)S!+ewz0in=
z#T9u<yRL-Ib6gMUeK<{}%<%r-l&~4h@|N{~uJl^_OqR^da%*9#_Vgx}F8}aqY!bI}
zQ`VR(*`dnEa?@3{BdX5w(_h6|FJECXg;KPex3X*{G>QD3tf);Z%zzQl!^b=hw;dS!
z+J>2i%rf7VU9{A6m9i0t$yKX6tm94z%m;c=2aiLp<i`W{TzHKS<wjcuUv8bC#p9i)
zOz522Fo&GlP#MeKeJE84IpvENWh-6N<<=`wr1OUurE3P673U@vTLwKO?y*F5en(8G
zG}_xx3{Q%x>m1V#+mNlRTyEW&l3W?3;K^WsRGy+Gm9t{UtY|iTg9KzX6B>##9sS)A
z8=4oT9*PZ(`u*`(LrfZqmG?ddu|}$PM>(4|Bh8;YWZ|X|29NX%snNC^CT<Da;rh$8
z!#-s1s>Y#JO^%j|q)^RR9SaOLeUB0?gNSA_)QMec+E{0jFI<wPZN4487aF3NEXXd;
zkVh{`AI^-D^Q?Zjgt>fXXyW*%45>qQh&UWP6Rk4O>4@RE2lArx#!Qzl1#y{J!$~#r
z$5)jX@WKvTv=@*QWN0;nL5?9u*L?ZPB`L&L5-%Ep0qjvQVgx>>Aa~wz?utkAD^BRm
z;4f_pOt(;>1v|C?9&9Sl=EXn5?Hb_r#0dlW)9$Qfg=w{8^Em3{c+9_+vL(0_@zV}W
zkB;qtOY>K;X~QMIZ1<1-_|s26iC!=S&0;%X*tQlfAzJ(308xYf$(qAG9oYF=r<jMP
zVkKs8KoIb%E8RiyFjUlIgtsjqAd*=GWjZSfPhH>~@OASxkEYIoC~BKlJPS+=p3jLR
zSp8<LV-`E5d+cc3#dHVv2i@)6zTRFhcNP4i?=Tz#?&n1f!l?+f3E7AZ*CCvaa1?=j
z2UsxU=saV1HIAYQ-`xoF5zauM?MDfw$mh@@0Ugbg9Yqr=0syYK33e1?I$aIJwO(-a
z3LDd67^lYC>S^23*E@Pw0n-x{^B8PZ#O>PN*{pEm0U$aA|G{qn{<odd$osR|0mboD
zX5Q*T_4z_|b?L~SdF)eVE^VRlTo+Dqw&9rQ01Efi;e<xxL#74JU?|Y*6fT@s<48;U
z;{sNcbkeC+mG<=lwl9y|KJH7y;L}4?x7X7OcTNW}ul%}2Y_hgxA?#58|3Y^ACUjNb
z#f^R?Qi>f#{TD6N)5y}D2sG>En4)0dZA_ug8zI2NU91=SG42odY40v##p;8QabzUE
zn&qj+<@bYHRUMldhbPForQhcr5D#lzb!-~DRJ*#4JwJ&Km+-7_-{?0lZf)xlmdXCA
zZCc9m*@xO)OV~9zV^rcX=-{L;N({=sYdf*R<JxbRvXxBJK3WR;hcb^J8o^#9Y^57?
zuSmtYi774h@E)K47!KW)Fwu?UK*@E}tlWUFB&q+v6p22~&wKcK5yEc~$j>__$Y(3$
z#tFP5G!AxN&~B_}#q5vT6ZNb}eHoZ|d*tJK_KmuVLWoC@aO`eNBtW@wbKixjFv7(M
z*C1?0K+_=}z|`{y7?+4OTE!~X)JTyaDo8lh845V@uG9(V$u-Wi2g@5aItAVcg(sl|
zfVw+dy|7L5I+r#yEo+7=XJUs=Ch&AgT#Imt_R1>e9zO99NZ{G8YxIt`87F~m`{>{a
zkE{hArwBaP5V*ObP*7l?BXEl)PzeRfi@?dyt#Db2r*p4i4$biEm~C^zMy)Lbf$;ez
zEwY+TZJ>2{8@n4n-69h~OZi`pdDbB1Rs_<ytAJ-+fv=<RbVR__aE8jV6MEp{96zOe
z6T19T89AeYy*qjWG&-#{O{{%ffyLd(Bx)|rK{#nleYv;W3;W&^6!<SqtZFzB`;9S*
zxj2mVdmsx;+IR#>^G%|MLpRLlNeW47NLon(XFW;a1jmYav`D9qK{UQ_`r~wJmp8K%
z$2(A9g`IuyBRXSpYR@*azbkDfZSOpms$|D#H@2{%k=?hl->KT0x3hFO*6`fUmS|re
zV5?Y#mVX<A<2!BFW|k@+t+i=uPi3mSS4q)+eHTlfG8g)yr^qC7A=*Qwp(nIZd*CiM
z&r;kVuGGG~i&eE>h?4=|o^0*&2`{H_P~cVomqy@*C2TD%#gFI0wo))t_|=PUp>IG)
zNyb%!wBjT+pxGondP2MWZkDx)^asURXEosH;FL_j0WRuNII*<UA1KAGP^qyMLgm6v
z;WDP%*G6il$3$i0RxAY0fMfWE71u6TtkllAhw<Sy98a8wb2l^&XQJ>0)CwHT00Jq+
zxIU07oGAN(RE87<w@VXr1m#iSs_FJ#_<+!h?FWsCBKu6jGDF*VklC}ofyp+$3>y=4
zLpt{1XCi4yo!Aya3QE8d^T_WGvRf7H<9k`2cI*A@qT%N!C9f_rJzo^t;4nX5n%ZDB
zzhG4%jXH>56uRB8NO<z&Qkxr^8yZ|@K)A-a2-<9*dk~k>a129S7dvK0ZqRH)ojE|@
zY8Rg(1EjNCu&@h(-2Z8qI<yQ>j|qC)gcrVbqr=?iaQ<duX(GZ?_=+Z1Pk<Z$ZeME|
zijWt+3;PWg*CCvzefxV>xUL`5)kwbx;XHiBb5bL~pb&-5hbcOt(^@(fA4ZZw<dd!j
z7UJtNgx_NWJ2Y_!oC-v&CgVFUx|AT>Gl+SYA&|n}iz&LTcmz}ET8+y;{2=7dnDqw2
z2MEUzzC~cz6UvhDRaOV4IuS^yqY^c25_Hvh8J6JJKJ?j$@tMcX_(}qY-%c2pqjU#q
z!ZDE$j^DP-z&sK?vd81rdH@SfGTGx2TZ`tJEG0=Mi4=+m9zTPbo{k--;c!v_blaky
z0PpMeE*1>L4$9ybQ%gO}=8UX5%yujGI9ByVwvFX{k*a<4Aj`}BA}g7dd^Xi&iMu%b
UXLIJiTWl9D`^;>zWKo;{2_x>1G5`Po

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 395b898..014b55d 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -35,6 +35,7 @@ import subprocess
 import sys
 import tempfile
 import time
+import urllib.parse
 import urllib.request
 
 HERE = os.path.dirname(os.path.realpath(__file__))
@@ -654,9 +655,16 @@ def porkbun_keys():
     if not (k and sk): die("no Porkbun keys in ~/.config/cli-tools/credentials.json (cli-tools config pull)")
     return k, sk
 
+def site_domains(s):
+    """Every hostname the site answers on: custom domains, www of an apex, and extra
+    proxied hosts (the Supabase gateway)."""
+    extra = [p["host"] for p in s.get("proxies") or []]
+    www = [f"www.{s['site']}"] if s["site"].count(".") == 1 else []
+    return list(dict.fromkeys(s["domains"] + www + extra))
+
 def cmd_cert(args):
     s = site(args.site)
-    domains = list(dict.fromkeys(s["domains"] + ([f"www.{s['site']}"] if s["site"].count(".") == 1 and f"www.{s['site']}" not in s["domains"] else [])))
+    domains = site_domains(s)
     k, sk = porkbun_keys()
     cert_dir = f"/etc/nginx/ssl/{s['site']}"
     log(f"Certificate for {', '.join(domains)} (acme.sh, Porkbun DNS-01, issued before DNS moves)")
@@ -670,9 +678,15 @@ def cmd_cert(args):
 
 def cmd_vhost(args):
     s = site(args.site)
-    domains = list(dict.fromkeys(s["domains"] + ([f"www.{s['site']}"] if s["site"].count(".") == 1 else [])))
+    proxies = s.get("proxies") or []
+    domains = [d for d in site_domains(s) if d not in {p["host"] for p in proxies}]
     ssh("root", f"test -s /etc/nginx/ssl/{s['site']}/fullchain.pem") if not args.no_cert_check else None
     conf = tmpl("nginx-vhost.conf").replace("__SITE__", s["site"]).replace("__APP_PORT__", str(s["port"])).replace("__SERVER_NAMES__", " ".join(domains)).replace("__MAX_BODY__", s.get("max_body", "64m"))
+    for p in proxies:  # one more server block per proxied host, same certificate
+        blk = tmpl("nginx-vhost.conf").split("server {", 2)[2]  # the 443 block only
+        blk = "server {" + blk.replace("__SITE__", s["site"]).replace("__APP_PORT__", str(p["port"])).replace("__SERVER_NAMES__", p["host"]).replace("__MAX_BODY__", p.get("max_body", "512m")).replace("proxy_read_timeout 300s;", "proxy_read_timeout 3600s;\n        proxy_send_timeout 3600s;\n        large_client_header_buffers 8 64k;")
+        conf += "\n# " + p["host"] + " -> 127.0.0.1:" + str(p["port"]) + "\n" + blk
+        conf += "\nserver {\n    listen 80;\n    listen [::]:80;\n    server_name " + p["host"] + ";\n    return 301 https://$host$request_uri;\n}\n"
     log(f"nginx vhost {s['site']} -> 127.0.0.1:{s['port']} ({', '.join(domains)})")
     ssh_put(conf, f"/tmp/dev2-site-{s['site']}.conf", "0644")
     ssh("root", f"f=/etc/nginx/sites-available/{s['site']}; if [ -e $f ]; then n=1; while [ -e $f.bak-$(printf %03d $n) ]; do n=$((n+1)); done; cp -a $f $f.bak-$(printf %03d $n); fi; install -m 0644 /tmp/dev2-site-{s['site']}.conf $f && ln -sf $f /etc/nginx/sites-enabled/{s['site']} && nginx -t 2>&1 | tail -n1 && systemctl reload nginx")
@@ -693,7 +707,7 @@ def cmd_verify(args):
 
 def cmd_dns(args):
     s = site(args.site)
-    domains = list(dict.fromkeys(s["domains"] + ([f"www.{s['site']}"] if s["site"].count(".") == 1 else [])))
+    domains = site_domains(s)
     zones = {}
     for d in domains:
         zone = ".".join(d.split(".")[-2:]); zones.setdefault(zone, []).append(d)
@@ -782,6 +796,150 @@ def cmd_retire(args):
         except RuntimeError as e: warn(str(e)[:200])
     mark(s["site"], "retire")
 
+# --------------------------------------------------------------- supabase
+# Second pass for db kind `supabase`: a self-hosted stack per site beside the app,
+# the cloud project dumped into it, storage objects copied, the app re-pointed.
+
+SB_API_TOKEN = os.path.expanduser("~/.supabase/access-token")
+
+def sb_api(path, method="GET", body=None):
+    tok = open(SB_API_TOKEN).read().strip()
+    req = urllib.request.Request(f"https://api.supabase.com/v1/{path}", method=method, data=json.dumps(body).encode() if body is not None else None,
+                                 headers={"Authorization": f"Bearer {tok}", "Content-Type": "application/json"})
+    with urllib.request.urlopen(req, timeout=60) as r: return json.load(r)
+
+def sb_ports(s):
+    n = s["port"] - FIRST_PORT
+    return {"api": 8200 + n, "db": 5500 + n, "pooler": 6600 + n, "subnet": f"172.31.{100 + n}.0/24", "gateway": f"172.31.{100 + n}.1"}
+
+def sb_slug(s): return re.sub(r"[^a-z0-9]+", "-", s["site"].lower()).strip("-")
+
+def sb_cloud(s, st):
+    """Cloud project ref + db password + pooler host, from the app's Railway variables and the management API."""
+    vars_ = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
+    refs = {m.group(1) for v in vars_.values() if isinstance(v, str) for m in re.finditer(r"https?://([a-z]{20})\.supabase\.co", v)}
+    refs |= {v for k, v in vars_.items() if k in ("SUPABASE_DB_REF", "SUPABASE_PROJECT_REF", "SUPABASE_REF") and isinstance(v, str) and re.fullmatch(r"[a-z]{20}", v)}
+    ref = s.get("cloud_ref") or st.get("cloud_ref")
+    if not ref:
+        if len(refs) != 1: die(f"could not pick one Supabase project ref from the app's variables ({sorted(refs)}); set cloud_ref in sites.d/{s['site']}.json")
+        ref = refs.pop()
+    pw = st.get("cloud_db_password") or vars_.get("SUPABASE_DB_PASSWORD")
+    m = next((re.match(r"postgres(?:ql)?://([^:]+):([^@]+)@", v) for v in vars_.values() if isinstance(v, str) and "supabase.co" in v and "postgres" in v), None)
+    if not pw and m: pw = urllib.parse.unquote(m.group(2)) if hasattr(urllib, "parse") else m.group(2)
+    if not pw:
+        if not args_yes_global: die(f"no SUPABASE_DB_PASSWORD for {ref}; re-run with --reset-password to set a new one through the management API (apps use API keys, not this password, unless a variable carries it)")
+        pw = secrets.token_urlsafe(24)
+        sb_api(f"projects/{ref}/database/password", "PATCH", {"password": pw}); note("cloud database password reset through the management API")
+    pooler = sb_api(f"projects/{ref}/config/database/pooler")
+    prim = next((p for p in pooler if p.get("database_type") == "PRIMARY"), pooler[0])
+    host = prim["db_host"]
+    keys = {k["id"]: k["api_key"] for k in sb_api(f"projects/{ref}/api-keys?reveal=true") if k.get("type") == "legacy"}
+    import urllib.parse as up
+    url = f"postgres://postgres.{ref}:{up.quote(pw, safe='')}@{host}:5432/postgres"
+    st.update({"cloud_ref": ref, "cloud_db_password": pw, "cloud_db_url": url, "cloud_anon_key": keys.get("anon"), "cloud_service_key": keys.get("service_role")})
+    save_state(s["site"], st)
+    return vars_
+
+args_yes_global = False
+
+def cmd_supabase_stack(args):
+    s = site(args.site); st = load_state(s["site"])
+    if s["db"] != "supabase": die(f"{s['site']} db kind is {s['db']}")
+    slug, ports = sb_slug(s), sb_ports(s)
+    host = f"supabase.{s['site']}"
+    log(f"Self-hosted Supabase for {s['site']}: {slug}-supabase, api :{ports['api']}, db :{ports['db']}, pooler :{ports['pooler']}, {ports['subnet']}")
+    creds = json.load(open(os.path.expanduser("~/.config/cli-tools/credentials.json")))
+    smtp = creds.get("RESEND_API_KEY"); smtp = smtp.get("value") if isinstance(smtp, dict) else smtp
+    vars_ = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
+    smtp = vars_.get("RESEND_API_KEY") or smtp or ""
+    ssh("root", "install -d -m 700 /root/dev2-kit")
+    ssh_put(tmpl("supabase-stack.sh"), "/root/dev2-kit/supabase-stack.sh", "0700")
+    env = f"SITE={s['site']} SLUG={slug} ROOT={WWW}/{s['site']} STUDIO_DOMAIN={host} SITE_URL=https://{s['site']} API_PORT={ports['api']} DB_PORT={ports['db']} POOLER_PORT={ports['pooler']} SUBNET={ports['subnet']} GATEWAY={ports['gateway']} SMTP_PASS={shlex.quote(smtp)} EXTENSIONS={shlex.quote(' '.join(s.get('extensions') or []))}"
+    out = ssh("root", f"env {env} bash /root/dev2-kit/supabase-stack.sh 2>&1", timeout=3600)
+    print("\n".join(l for l in out.splitlines() if l.startswith("===>") or "gateway" in l or "WARNING" in l or "ERROR" in l))
+    conn = ssh("root", f"cat {WWW}/{s['site']}/supabase/{slug}-connection.env")
+    kv = dict(l.split("=", 1) for l in conn.splitlines() if "=" in l and not l.startswith("#"))
+    st.update({"sb_slug": slug, "sb_ports": ports, "sb_host": host, "sb_anon_key": kv["SELFHOST_ANON_KEY"], "sb_service_key": kv["SELFHOST_SERVICE_ROLE_KEY"],
+               "sb_jwt_secret": kv["SELFHOST_JWT_SECRET"], "sb_pg_password": kv["SELFHOST_POSTGRES_PASSWORD"], "sb_database_url": kv["SELFHOST_DATABASE_URL"]})
+    save_state(s["site"], st)
+    # The gateway hostname joins the site: cert, vhost and dns pick it up from sites.d.
+    os.makedirs(SITES_D, exist_ok=True)
+    sd_path = os.path.join(SITES_D, f"{s['site']}.json")
+    sd = json.load(open(sd_path)) if os.path.exists(sd_path) else {}
+    sd["proxies"] = [p for p in sd.get("proxies", []) if p.get("host") != host] + [{"host": host, "port": ports["api"], "max_body": "512m"}]
+    with open(sd_path, "w") as f: json.dump(sd, f, indent=1); f.write("\n")
+    mark(s["site"], "supabase-stack")
+    log(f"Stack up. Next: `dev2-site cert {s['site']}` + `vhost` + `dns` (adds {host}), then supabase-pull / supabase-load / supabase-storage / supabase-cutover")
+
+def cmd_supabase_pull(args):
+    global args_yes_global; args_yes_global = getattr(args, "reset_password", False)
+    s = site(args.site); st = load_state(s["site"])
+    sb_cloud(s, st); st = load_state(s["site"])
+    out = f"/root/dumps/{sb_slug(s)}-supabase-{dt.datetime.now(dt.timezone.utc).strftime('%Y%m%dT%H%M%SZ')}"
+    log(f"Dumping cloud project {st['cloud_ref']} -> {DEV2_HOST}:{out}")
+    ssh("root", "install -d -m 700 /root/dev2-kit /root/dumps")
+    ssh_put(tmpl("supabase-pull.sh"), "/root/dev2-kit/supabase-pull.sh", "0700")
+    res = ssh("root", f"env CLOUD_DB_URL={shlex.quote(st['cloud_db_url'])} OUT={out} EXCLUDE_TABLE_DATA={shlex.quote(' '.join('--exclude-table-data=' + t for t in (s.get('exclude_table_data') or [])))} bash /root/dev2-kit/supabase-pull.sh 2>&1", timeout=6 * 3600)
+    print("\n".join(l for l in res.splitlines() if l.startswith("===>") or "=" in l[:20] or "ERROR" in l or "WARN" in l)[-3000:])
+    mark(s["site"], "supabase-pull", sb_dump=out)
+
+def cmd_supabase_load(args):
+    s = site(args.site); st = load_state(s["site"])
+    for k in ("sb_dump", "sb_slug", "cloud_ref", "sb_host"):
+        if not st.get(k): die(f"state has no {k}: run supabase-stack and supabase-pull first")
+    log(f"Loading {st['sb_dump']} into {st['sb_slug']}-supabase-db")
+    ssh_put(tmpl("supabase-load.sh"), "/root/dev2-kit/supabase-load.sh", "0700")
+    res = ssh("root", f"env DUMP={st['sb_dump']} DBC={st['sb_slug']}-supabase-db CLOUD_REF={st['cloud_ref']} NEW_HOST={st['sb_host']} POST_ONLY={'1' if args.post_only else '0'} bash /root/dev2-kit/supabase-load.sh 2>&1", timeout=6 * 3600)
+    print(res[-6000:])
+    mark(s["site"], "supabase-load")
+
+def cmd_supabase_storage(args):
+    s = site(args.site); st = load_state(s["site"])
+    for k in ("sb_dump", "cloud_ref", "cloud_service_key", "sb_service_key", "sb_ports"):
+        if not st.get(k): die(f"state has no {k}")
+    log(f"Copying storage objects from {st['cloud_ref']} into the {st['sb_slug']} stack (node in a container on dev2)")
+    ssh_put(tmpl("sync-storage.mjs"), "/root/dev2-kit/sync-storage.mjs", "0600")
+    # The self-hosted gateway is reached on loopback (no TLS needed from the box itself).
+    env = f"-e CLOUD_URL=https://{st['cloud_ref']}.supabase.co -e CLOUD_SERVICE_KEY={shlex.quote(st['cloud_service_key'])} -e SELF_URL=http://127.0.0.1:{st['sb_ports']['api']} -e SELF_SERVICE_KEY={shlex.quote(st['sb_service_key'])}"
+    res = ssh("root", f"docker run --rm --network host {env} -v {st['sb_dump']}:/dump -v /root/dev2-kit/sync-storage.mjs:/sync.mjs:ro node:22-alpine node /sync.mjs /dump --concurrency {args.concurrency} 2>&1 | tail -n 40", timeout=12 * 3600)
+    print(res)
+    mark(s["site"], "supabase-storage")
+
+def cmd_supabase_cutover(args):
+    """Re-point the app at the self-hosted stack: env overrides, provision, deploy, verify,
+    then unschedule the cloud project's cron jobs (they would otherwise keep calling the site)."""
+    s = site(args.site); st = load_state(s["site"])
+    for k in ("cloud_ref", "sb_host", "sb_anon_key", "sb_service_key", "sb_database_url", "sb_pg_password"):
+        if not st.get(k): die(f"state has no {k}")
+    vars_ = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
+    ov = {}
+    for k, v in vars_.items():
+        if not isinstance(v, str): continue
+        nv = v
+        if f"{st['cloud_ref']}.supabase.co" in nv:
+            nv = re.sub(rf"https?://{st['cloud_ref']}\.supabase\.co", f"https://{st['sb_host']}", nv).replace(f"{st['cloud_ref']}.supabase.co", st["sb_host"])
+            if nv.startswith("postgres"): nv = st["sb_database_url"]
+        if st.get("cloud_anon_key") and v == st["cloud_anon_key"]: nv = st["sb_anon_key"]
+        if st.get("cloud_service_key") and v == st["cloud_service_key"]: nv = st["sb_service_key"]
+        if k == "SUPABASE_DB_PASSWORD": nv = st["sb_pg_password"]
+        if k in ("SUPABASE_JWT_SECRET", "JWT_SECRET") and st.get("sb_jwt_secret") and len(v) > 20: nv = st["sb_jwt_secret"]
+        if k in ("SUPABASE_DB_REF", "SUPABASE_PROJECT_REF") and v == st["cloud_ref"]: warn(f"{k}={v}: the app derives URLs from the ref; it needs a code change to use SUPABASE_URL")
+        if nv != v: ov[k] = nv
+    sd_path = os.path.join(SITES_D, f"{s['site']}.json")
+    sd = json.load(open(sd_path)) if os.path.exists(sd_path) else {}
+    sd["env_overrides"] = {**sd.get("env_overrides", {}), **ov}
+    with open(sd_path, "w") as f: json.dump(sd, f, indent=1); f.write("\n")
+    log(f"{len(ov)} variables re-pointed in sites.d/{s['site']}.json: {', '.join(sorted(ov))}")
+    cmd_provision(argparse.Namespace(site=s["site"]))
+    cmd_deploy(argparse.Namespace(site=s["site"], ref=None))
+    cmd_verify(argparse.Namespace(site=s["site"], public=("dns" in load_state(s["site"])["steps"])))
+    if st.get("cloud_db_url"):
+        log("Unscheduling the CLOUD project's cron jobs")
+        out = ssh("root", f"docker run --rm -i --network host postgres:17 psql {shlex.quote(st['cloud_db_url'])} -At -X -c \"select cron.unschedule(jobname) from cron.job where active\" 2>&1 | tail -n 5", check=False)
+        note(out.strip() or "none")
+    mark(s["site"], "supabase-cutover")
+    log(f"{s['site']} now runs on its own Supabase. Cloud project {st['cloud_ref']} stays until `retire` (delete it in the dashboard or with the management API).")
+
 # ----------------------------------------------------------------- main
 
 def main():
@@ -798,6 +956,11 @@ def main():
     p = sub.add_parser("verify"); p.add_argument("site"); p.add_argument("--public", action="store_true"); p.set_defaults(fn=cmd_verify)
     p = sub.add_parser("refresh-db"); p.add_argument("site"); p.set_defaults(fn=cmd_refresh_db)
     p = sub.add_parser("migrate"); p.add_argument("site"); p.add_argument("--yes", action="store_true"); p.add_argument("--redo", action="store_true"); p.set_defaults(fn=cmd_migrate)
+    for name, fn in (("supabase-stack", cmd_supabase_stack), ("supabase-cutover", cmd_supabase_cutover)):
+        p = sub.add_parser(name); p.add_argument("site"); p.set_defaults(fn=fn)
+    p = sub.add_parser("supabase-pull"); p.add_argument("site"); p.add_argument("--reset-password", action="store_true"); p.set_defaults(fn=cmd_supabase_pull)
+    p = sub.add_parser("supabase-load"); p.add_argument("site"); p.add_argument("--post-only", action="store_true"); p.set_defaults(fn=cmd_supabase_load)
+    p = sub.add_parser("supabase-storage"); p.add_argument("site"); p.add_argument("--concurrency", type=int, default=8); p.set_defaults(fn=cmd_supabase_storage)
     p = sub.add_parser("retire"); p.add_argument("site"); p.add_argument("--yes", action="store_true"); p.add_argument("--force", action="store_true"); p.set_defaults(fn=cmd_retire)
     args = ap.parse_args()
     try: args.fn(args)

From 599e60df850ecef16e54ed4748de57a1a317d325 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:45:27 +0000
Subject: [PATCH 006/104] dev2: README for the Supabase second pass and private
 repos

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/README.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/dev2/README.md b/dev2/README.md
index b5c6159..158ea9e 100644
--- a/dev2/README.md
+++ b/dev2/README.md
@@ -32,6 +32,11 @@ dev2-site migrate <site> --yes   the whole move, resumable; each step below is a
 | `railway-stop` | `deploymentRemove` + `serviceDisconnect` (or the next push silently redeploys on Railway) |
 | `merge` | merges the scaffold PR; CI deploys the default branch to dev2 |
 | `retire` | `--yes`: `serviceDelete` for the app, companions and data services. Only after `verify --public` |
+| `supabase-stack` | (kind `supabase`, second pass) a self-hosted Supabase stack of its own under `~/www/<site>/supabase` (compose project `<slug>-supabase`, api `8200+n`, db `5500+n`, pooler `6600+n`, subnet `172.31.(100+n).0/24`, `n = port-3200`), public host `supabase.<site>` added to the site's cert/vhost/dns via `sites.d` |
+| `supabase-pull` | dumps the cloud project through its session pooler (password from the app's `SUPABASE_DB_PASSWORD`, or `--reset-password` through the management API) into `/root/dumps/<slug>-supabase-<ts>` |
+| `supabase-load` | loads it (extensions, schema, data, grants, buckets, absolute storage-URL rewrite over every text/json column, realtime, cron) |
+| `supabase-storage` | copies every Storage object through the two Storage APIs (node in a container on dev2; resumable) |
+| `supabase-cutover` | re-points the app (`env_overrides`: URLs, keys, db password), provision + deploy + verify, unschedules the cloud cron jobs |
 
 ## Layout on the box (every site the same)
 
@@ -47,6 +52,11 @@ dev2-site migrate <site> --yes   the whole move, resumable; each step below is a
 └── .deploy-state
 ```
 
+The box clones over ssh with a **read-only GitHub deploy key** (the same per-repo
+key CI uses to reach dev2), under an alias `github.com-<org>__<repo>` in
+`/home/anthony/.ssh/config`; https cloning fails for private repos because the
+deploy account has no GitHub credential.
+
 Ports are allocated once in `sites.json` from 3200 upwards (3010 nichedb, 3020
 rssamplifier, 3100 crawlproof predate the kit). nginx is the only public face.
 

From 177fc383d2ff83d952cdb9adf1ee0a115ee524cf Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:45:47 +0000
Subject: [PATCH 007/104] dev2-site: public verify waits out resolver caches

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 113530 -> 113742 bytes
 dev2/dev2-site                            |   7 +++++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 7d734058185710e362d0aa581060280910afc11f..9ee4030ab345d5b64e14010faeb836b8b53e59f0 100644
GIT binary patch
delta 2099
zcmZ8h4RBOf6@K5_-N*i9H$O`f5|XeKDr{gWkhSeJKN6C(G=xAx0+|*Gux|;GWS8Fk
zfh=KCTPktVN<y68XoRG6v>>2y6kc?6Y{x3pI=byRRn|_O&ZxCBbsE4*1)-kvXheN8
z``vTT`Sv^a+<VWx@el3SA8Vf1-EOBs-|K5Hd|~kB7d_`a=vgw_l<Tm@RYe(n@^_EQ
z^b$O1yQnCKY_ismLb-S;{HC>D)$I}Jjx%5dMX6Ulzk_IV;%;+FpgVP!o~65WkDjgP
z=(%0?e(famynfrb(r+18j$1~cd(X~2qskR)uxNq3->xgVqgc`Nlga_atWd~PkW>yi
z`W>;X(Uy3DJ*Gm56vlH$TZT$TKbdxZ7Rs}`tV+Liz>)G$dTTs?HvMcGecph5T+xgA
z9YWQMY02})M>oX_%VVluLbFm@$eh_CNbNONi@D;3vpRa2yf2?Bukxd;bio<g82+I2
zDZ1~!Xa0q9zaLAT?`Kh1JWe1d{HQJRs~N1$pn^tAaOEn7iubcQ{7*j`i``-a^V=B?
z6J)e~iCsP2A)(2Z26*!aIq)q8UXdteh|51(kuQhJF|YD8J4y&L)~;w&kMV)}{__bh
zN1UNvy)zjW-Mjn56cu35FSZS``XCm_>*c5!C@h%_zEpX#@@uVAwQm*PKlsSo-u&U@
zSYlE?wSIc;bo}MEOEu|&1L<uc#;$03-xKMmNXHUskxYm8lXFH<YSo9;zbnezN7U<t
z8`LW%UL)M74%YwPTR5hU<qkhMmP&j5Z+h!awM}hL2kHjvFK3r|$AS};U#~oEdpj%V
zXyca~hsATvGY)0m12ay=;gT;dL#39hc#5y&8Gl-ar{>^?Mpp&4!SyPYa*@mVi7L}Y
zC^r5YL|W4>kt=oI^HnI2dn@5I-l;@6Y;ThHUBg|C2@N;pxjLM%UMAP*l`UR*v<{{C
zmwd7w3-JeevK}|_7kQ!q_aY--ZNOsN2gJN;{EbX4|18;}mmx{lU%bKApXFzoa2n@i
zx(P2W=WP}d2411y%z_m%+V1Y2cvy%J*<&8*jC^qePT8)L!)9!1MyCzGkW-tn7in42
zh6R|BRc#2lZV;i+LZyD7@X7g%U$)_vir>mhTd|dv?(4ux+ifB(HQGDyeb}r-USYT&
zLl8EN?A6A@k7L@78sn1?A}ShWWH&l+L0;UAUd=@ektHAM!t=<MZ*<{)+?Mt|*rLKB
zckIC$+cIJVjc@M3DVGb(eu!&OjgB}xAW~NXGc<H0Np!pMy(BgPJEVF5uV|cJSdG^X
zU=3y`*(of7t&t*|j0X<lgdHyV*3*a=tsqw_Hyla&>Y6sT*LT*h?QCytsuuHQ=rCSJ
z!dUza@=&^pH9w;LZx-+ILMmvUv2LwxZ5Ba`d?JY=dHXP(Us4|X68a17Vfx)(<6?wn
zk+&+aP&ORFYPHTHUvbi(jvc{rTN{OYjh`Js!jjW^he~{NkE-OlA*}bXH>LTyBk`z@
zn)QVtG+>2%ZwSFWrlp*|=7z1E>o#s~s}@x<@GPdSo5?T7kD$!i6Wytc$7tGT<UWT+
zOR<^5lrJT(sA1sq6I*0r7>i~l&1~^KVb1vNVH`)PTsMNnu*%*M_)sIiGJ=(8HGVn*
z8?aga{20nz+eznX`o#v!mM=5rjiSv_ai<v0QO#hctYvEr!xn~>e7jdMR4};Y#5b_S
zUuBYb%T0O-PfdxtOLv<T`61EsKF2nnkY5#cwjFZmar{a<#|ra}8^`f6FeR@|pfP71
z#~)<~^SgFdP6kmdFCT-)9ZJNb^oEHrMUNU!P2wZB_G#lC`VQI$xF=KgK;YBole;rB
zr?<OH?4)-4F$c9kK!o+ESj+mm7+MHYIqZ&w<AHrUW3l~Fp^FZ7yGSY;iwB~So<6aS
zJ?=mt6pe%uw1!BiPyB{7siX@uh^vq--^FCp|2DhW%dvwDFEHGF6u8+1UwyM2!MDx4
z4&oUun-5IfkkwPzg&!D`Q@Cb@kY7EId$33vJltz!&QpuGn2P_G)YRt3Lfm5D7vauT
oGMjK2Yn#1broWrnOd6K&7+8+OhHDz{s+tFDan&cU{s@Er22DsR#Q*>R

delta 1932
zcmZ8heNa?Y6o0?R?qk`N<wHe5gf%2tWXCVG!Y?2(zW^~*QXA8K2q^5*-35eJ%|>#a
zutAvV*dV4&O{R@$nUBeTv>f}xvdw177^`ute;QN#D)J+{=OJVDX72Bvd(OG%ciz3{
z+;jcfoj)|^+1OaSBELC>$Jd{|v(@>D6Sd>)4ylQf<K|VGv;+&OJ|8Z+HV(<wZHltV
z+F2G%qKqtLXX!RQMz`w@eTW{bJN39KTS$8wdVI**rG%ool<ufq&=WpL?7TK6wew_w
zZPBLaP_(Y-LsJxeSfjEL0SgqV8Q!RDvV|-mTZ>Z?Sb}kq-24Uu=}DpJE=3;^vI$im
z>4To!rO@>(jLg+j<Z6_piavyaJy6<SwJ0G=z!6M%7)H@kA6bJ#$#BCxdh{W6a6_}A
zr~P~7PN(~BWYL6d6hw)Y3i+~;L_4yv;7PkEmb=7K26-AvuU6l%wzkGAG}b)D@HfK<
zhS3Z`3GNt58IP=~sZ#E>RQdgSAV!L=!A}fjgWX%FuWqaqHS3ziVVRsEN5BJ02qB&J
zjK{1kaS83yc2C_m_JHF^c~9=iVJA075`&S7)r{T^k=nY*24BSgV#FsRYXVZ)Cyx__
z>Mccye_H)h;(YbGi8m!KRKu1FaYNe++sncmcjraoGSA1&J}~S^TEsnDT5R^PzQZ0?
zFWQE*BOGX-+&-4VImp%=iZkW<5ThptuSCNzrsrZ6te?qTPaAutqEEvaW9JN%!Wxmf
zpNva0@s@^u+Bye&@jbbUFa>{6c@f6o2Wl+BUHn2~E;4a}cF)CF>u++`HRF^Nwc!V)
zEb15<<?V{ES-MPj7U6vyqIZh%UJjp=@G)=(f++<@=+)NM)CMbs_?<Q8ZCs_M5*%>c
zmI_stci>0WJXvFYDe|m1P20+`0q3Z%9O<}9@k`-#^h@7i?0ZFFUzf3WDekK{PkSn`
z9Czqe1twbWNvBN1{Tx1ql>?7AF0DW=tQILxFj7{b$A;;~w>o?(3aPLP6*xv+RjAWq
zq=&GRvl?$8mfo$#G~A<$)mWxJP${<t`Bt~|m}E59$h;j7_)qc}6eFhrP5?B$5q)yX
zX_7%#8m&!O3_MTYZNw>!>4j=^HzOZ|i_0y@fOVd<6dR5Z_Sz6b2e%=J97=D+2qe=J
ztvCr`^tU1rV<vEj+w$Z~#IMXdNv?Y>%L|s2h{<d!ruZrhr~K{m_5!qSJ3>h=Q!lG|
zphY-;VTqz|axsRI!<eiVMA0d`Bw80nj&+GNuQw=+hN$?(1Fq8FJeE94ZNow*Yg;r|
zjW6hT2@5r}p-3isq7Au;?ABs;l@u*sJ+JiH@|hx!uoFF&GN~tj7-{jf{x!O&kjq9n
z0xq+Y(u|nb@px2<NoO*Rl14Fufp1Tg)BIh?7>sTb2dgWYeDf}JV-%%!U@TNB=zt3|
zXl(~3VzJTL0V_~OZ+0Tvu}a2yS&qP#hm==3Q64j8;J=t-I)h0$o26L{<qQ+K%qKBS
zVThqXH^#a1*p$yVV7jO9(hTt^bqDKa(dW`VaVE=rVQy7uEJxG5ZhWcn6DN|5b9>Pb
z9HuY!VSzT6?a$DN{jvwVQf@Pr?Z@p{?P05xeTb!7xC>is9?!#<j{C7Ux~`^5tdR}&
zDH}D9M^x&5k<ZayU?`Q)63^;DWzbW<CJ<=y3tcQ@wL^yT2ZA2IueMpNU`?#Y<MsQz
z4MJ4<yv^b(8B^wdOitnkDDw#RE&6YJiw$ghiD5s(qi2BITX2O7{vE*;W|n|x<)Y-9
z5&e{K6l-zR2p+{v3+k!*I3APr`5I3d#^K|#lgrGA|06YH^P3><GH~M$)Qs6{ZjNo%
gze)dy*(CMSM?H{FrtxzRE~%OWg}9MIXHFpe59<H*bN~PV

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 014b55d..0a87145 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -698,8 +698,11 @@ def cmd_verify(args):
     ok = True
     for d in s["domains"]:
         resolve = [] if args.public else ["--resolve", f"{d}:443:{DEV2_IP}"]
-        code = sh(["curl", "-sk", "-o", "/dev/null", "-m", "30", "-w", "%{http_code}", *resolve, f"https://{d}{hp}"], check=False).strip()
-        good = code[:1] in ("2", "3") or code in ("401", "403")
+        for attempt in range(12 if args.public else 1):  # resolvers cache the old record for up to TTL 600
+            code = sh(["curl", "-sk", "-o", "/dev/null", "-m", "30", "-w", "%{http_code}", *resolve, f"https://{d}{hp}"], check=False).strip()
+            good = code[:1] in ("2", "3") or code in ("401", "403")
+            if good or not args.public: break
+            time.sleep(15)
         ok &= good
         note(f"{d}{hp} -> {code} {'ok' if good else 'FAIL'}{' (pinned to dev2)' if not args.public else ''}")
     if not ok: die("verify failed")

From b918330d083b75bc225d51ee05b426bf9cf6f29f Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:50:39 +0000
Subject: [PATCH 008/104] dev2-site firewall: allow every Docker address pool
 on the data ports

With dozens of compose networks Docker moves to 192.168.x/20 pools, which an
allowlist of 172.16.0.0/12 alone drops (CONNECT_TIMEOUT to :5432 from the app).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 113742 -> 115277 bytes
 dev2/dev2-site                            |  13 +++++++++++++
 dev2/sites.d/coinpayportal.com.json       |   1 +
 dev2/sites.d/threatcrush.com.json         |   9 +++++++++
 dev2/templates/firewall-data-ports.sh     |  22 ++++++++++++++++++++++
 dev2/templates/supabase-stack.sh          |   4 +++-
 6 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 dev2/sites.d/coinpayportal.com.json
 create mode 100644 dev2/sites.d/threatcrush.com.json
 create mode 100755 dev2/templates/firewall-data-ports.sh

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 9ee4030ab345d5b64e14010faeb836b8b53e59f0..2c1ea8a5b5ac33d44d5acd594a69da90ac09cee0 100644
GIT binary patch
delta 3236
zcma)82~1qa8GiqJZ*T5nx#4kpF$<W(2h@byb$noh!8Rtwi)WW*jaf4L0JDJ-M<8RF
z#K)5|seCl3P60!G)Rh;tZfiGfRi#OajUCw*RUN5nYc;A!8%u7|w4Hf)p>5hYBfam<
z{Qp1y|II)1=6~-$(Y`mN3;I=Hppm2P&z09)ga0@g6b%bkGPOdC6U7WcQ#NWxvGi?4
zE)+-KIp}~=Bdm<;K&f=J8l??!O>0m(#kDAd;yQHj>ZsrW=scxK0=FV*_GwWQRXCJ~
z{K^%3rhvubxTZGLg_@}gCwhTu+tFT%F4RKt0NQ6$?rW0Lkb{n}-GkZ=tl&7T=Q%r`
zTAa=S*T?tqmKU#@wI?>ml_hc9qvJ6YerlrdE`vWsQ&<~$^=6&ppQQ9K7y{1l97i|=
zP8a~?<CpT4Mn{;4V`NbFB*wErP$#r;Ron{$95=xC^U8~<k%7FQu?I#YmGAZ^8syNY
z9F$vjiTpkR!h>Y(QxVtCPw`5g)2tm3`UO{{ax*ww`OyakJ)Paw53VRBd38i15-3#;
zi46Vjfg2qZIhl#nhBR`VzuymjtJB=sB|^Z-34RNtMLP29S0E`@?>9vTWSkNf4XA0V
z-}FBwnUwdABnbhoaFRR;;gOalqpYP~obutZaMH~~uu|&O51!^w;8|gcrjj*(FuEN<
zmSFFeI=j`@)z#4_$xge3Y_iST<;JpP>*#RzcC>qB$>GLQQDH&8Wa~tdy~mFGr26hI
zTdU1umprm<|A9=8gjyvwD+h<u!-6-`Fc0*e))pr7Sg?f(y>T_|*xpOsO72bx*?aO;
z$Et;d11PyqCGz7TkOsYG$5Tt|5*<&D$LUSa#csEp%jQ}Sw9C2w+w6guw<a&oYqWRv
zNZV@bcGR!OnUs$=Poj*S(ldPwvRG1nX~wFp7BhaHPQ?`rj<A(&Vk^_Jw4ip3KW6ee
z2K5YfFvw#t#NZx-2nP2VlrY%9z{?<rK|X^52CEpXq+l5o@pcyKa|U)M-cP|JQjloF
z;k5H0VE;kX;$J`hoMtbIo*T~-s(YDx7#KQI^K$ik#)|Q_v9|GpV+X&#@lHnRXx;Iq
zqfKWFcLGyxRNM}%8G(DIfaAqSi%+!OH6_l6Mv|D5F=q+~&-3HDG2M8;Sitn|8JLrb
z=i*A{LccaraW6RZc+b(E6Rx|#$!`{ouNzx8QFqxmxp$`OmbLtDYQ=(%3)%pm=sAsk
z)|h_YG12htgKxIX>Wl7(tLH`Ch;}w4|BhHNFPcWHW<xD=0a>%z^|K9o?ugCvqG2?3
z#PNpld{OCm$ymvR=hC6cL)V4tl|M88QuB7g+}hf?+--BI+h<ei7C5dRDtY>fs^b63
zai(hiF~@0YcpOQW?~AR2-GYgu=}2WM`G_N-{UG_yH9&*F^8$Ii3vx9gRTcUyyI}%M
z_-{0QDir%ZY=T12n5eeY7uyUodU)P9hoF;(?WCd&exVJaDjZ6JobWnCkhh$$nimD~
z8z(e?juf;*xh9WVl==GFVZvn6G3#RHUQe>SVYLQ-N(W@98;UgeGuHh{H@pM}Qqltp
z^p)KUyTIie?uBgt9pr;Ua8t*~P<Fm^eefJCjeh5a6wqv?x@MoLAI|9^gj^T`ng5I@
z(lD4oB5Q`>1|0T18HO-OE@ECD(<8MN|AFyYL&p!qo#k~~@mi+ZLPFXgl9U~Rba;h0
zjzGUTQ<c+{;syq6UDza$TZNEJVn!gJ-yo2iMu;Jf5y;l;qUt^$8G&vgq;b)d+N<d*
zBk`lKDTqnETB*HLc1zeqx<{d!vAsSD1!2t2Ym~ND?`-*cZT*h*xQxK7FeC1ya^fC=
z#E=fR4dK0XI7}ap1Z-CmeTLT{Lx@%5si9J+5?3%#H?@guJPE0O?`mXr%hBlHI0<JV
zg~XqNv=r6!HJTf5q-3>A_0^keTI#Fo8aGx}w`{83y&hMP)>DuNjXvcRXaIJSZz_;w
zYNcV0Gctou$$X^14nx7>k{N|^1}d3q)~jOB#2}A-+N&58FbE-@vyf>iW2!Q?IjVUw
z8>%jr7Zt{2Rpf1I9#+ZvY%eW54rKix^7pfFiyrm&&(Y6AyP3(hkf<>z*0j_9X<y?Q
zJQCm?QuY=+B9G!BLa9AwB;ym18f@@a1y)2|;j9J*8~rk%C2~=w1k4yn-xNffWp=Tt
zZCbZ%M<%}mts)AS(+G^y<ElC$=f>&LrnAb4brl%2%OO;acG<ngjH0Ha$-o3`36Al5
z{Sxz76gM5u%#%ssBxEZ&BSy^<|1UUC^gB-`?@;UDq^}S`TAovU0gC@?LDA&#1u&D}
zPC`_0%Co(Nr!sH;I{a_TPFsqS$;!tU(u&e$Rw>lx;8BKLND`*LnBL&bXLHc3Sc*k{
zFio>y`3iHgmgh8Mx|iyaS^4aVq1ke=pEt5j=S&G?Z~~Hu`6A8Q!$}I+@|PZn|C_O;
zgOUuT<XaOEDR8cG<?uqRc0kjwaaGcPws3ML2@EOpH-}5*<SIXpG!7>YXk}K2)h2Hw
zuU>>TkVk%g5o(PO^!}<!A}+!8!W#A!IT$oh@P=5e^zYU#Tf1x?Pp=yz+|0x#EB$Hm
z$X0h}M<3ot#LHlTbdqx!Tmmi5<n_zYEU~*9vkwuot5Utn@Gzx-**$_efrMQFoAw4B
zc-|m=S74j((iPY)nk}JqCEV>2Lw$-cCq~pK2y+RV`V?Zm2DO5Wdx`TJtpqE`G4{&x
zUAzYG!g}^YKwVN07_e%$cp<9AB##Z%+g;_fOh;wXPQEt-*~X*Ph+a;d2l@Uu1E26(
nBh>JJi6-+ugvR(N$Xdwf#DEd+Z6W5qs2{Fb5I8YbEx`W*7Xm}`

delta 2007
zcma)7YfKbZ6rOKpcLY|b<*~|p<sl+0u7W~|h@eZQTCod)Masimd>{`yyPEP++hStz
zQFT*~{-9cIjCR3dK*lE2=%1!7wMl8xM%$#?{;-<H^20WbZMF9fF8ISnCz<cwbMHCl
zJLlZFXRdZl`T8$4WF$B^NaD{(;ZVb#zYm4Xz@76csuH=8MRuVwoo!-Ke6+L8ESirQ
ztifBPq(yIGiCkL9lDeeIY?jP1ht1;n0&5)Dr?`Qp!{&H2du`@g?+rOEqtXXKB1x4S
zSPNUnZ8x$iuD^-B#&I*N=Gee$>b9_2KJ#8P$H&!cY{Qn>lB5O5QvK_`adQb$tK2H5
zZXJkG53ZDRBD`l^(F0$&*h77!0xK2seOZ#G>oM!luE_t$bgUY4%@6q6Z2f9A&S2X0
z0QdTutu30zt(g=_%FuV!A`51f&*$r()Zt<P7VBCAnq@fYW+OgREqqIxN_|Z@g6C*i
zGZxAZWa?<f8h}QdQD9Ev8d>^`7M!tIAhdHip(fKv8`o{KQGPdUq_$&$dfnv6b~tEB
zJKCYpa688M(AR;rsMgg^tOjbSVh65F5%KT<_4u90$AnbB3kfj4#P?R~``*O+0kBY7
zH#~BNLLYR)ifFpnjmy}kx9&wKV&@4jfAGq$(r$^6GP!)+R8insrDZAJpT;7obT5*z
zoo?+zM?`|qewo)<TO&YZrK$ABew1M;UEPl&a~WT1(q|mNHf5U2*cM<EXc6@s!io^F
z+NRnzH+x!a-1yH!aEjpa4kI&E=(PpeRyiwbmY0;4<!OuPt;4uzD&^}mwjXiR8e8g^
zR>{Ry{<>}O9vq3&yS<pDL>Y7jQ!L-p77GvusFl-~N08`uZV-Dm)eG{6N6>><>LDa0
z7^(+&CE6lv_Ig{Xb7fIYsnb<nywq8<!ue{RwwQh)IN;L5kHQR;Qq(cbu~c)0xB2Vd
zIUY;XF_Z;njwdY0^8^^N6o}ap0p$W5oJyM~AX9*a?wv$R>LNo)oP?nsBSgc+WKO|`
z3N1T@l+b)J7YCOrYXM>&NS&wf4Wjju53y8Mmy5MxI(izp=6XJVSO5MrZY$VDS3bgR
zQ>WY^dv9(Jr#n6bnIJuq4$MUm<@6$w>=_88&wZF0!YrQfM;A=mAX8N_?Bwmm0{V`F
z_vh_lG7BSHABriy4}lY&Ls*#qUi;mvEP`2kr_+gk%tR7h_94yNfA%RRku0h=+AyJS
z`;Z<S<M--M;fX}C6GYygAB{v3gX5mbGJe969-c!wRULmUDUqt97c=R-kC7{Ke*$?Z
zOAs!6{A|QCnSA1;XLCOyLRpf>F|H%=!m?z~eEPK?`Hz>>d-t8ElqY4vDYC{Z>QkO#
zk~(2Rzn|wB-aYYHhEGf=&6DE~l%@CDeG1(;hj`=~guxllP}l!0%H$V8$pf$|QbRr!
z)FDdkG<TRA3TWnWgn6qMT5PRSqU0&`hmj;{ah<Bi>6bk((%L~}V=f&WL<!v<#IU7M
zT!HlhUZMUAu!gPW^EQj!zO}{ev9~lgwrW*$?E+Hyx2O!EfwUo1+C&G{#EsEJM>9H(
zwwu#v;=XJ5W%_Lhb?P7&+&idL$7=mk9oZ(U>3Nq`8np(x@|4l|a955pnqzk5QP40-
z6t|{P)iCeRiL_G;$@<A*e1#nGL(={gAbvyRJ<I6sX@bk>xkfmXkr+YLlkXDJgSxm9
tZy=JpTEBS-_hkCv3d&=wm^0>(OjGx?jVh7XOaZ%##uUjErA2Vf{{Y)f5DEYQ

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 0a87145..f69b92d 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -788,6 +788,18 @@ def cmd_migrate(args):
     mark(s["site"], "migrated")
     log(f"{s['site']} is on dev2. Railway services left for `dev2-site retire {s['site']} --yes`: {', '.join([s['service']] + [c['name'] for c in s['companions']] + [i['name'] for i in s['infra']])}")
 
+def cmd_firewall(args):
+    """Re-apply the data-port allowlist for 5432 and every Supabase stack's db port."""
+    ports = {5432}
+    for f in os.listdir(STATE_DIR) if os.path.isdir(STATE_DIR) else []:
+        if f.endswith(".json"):
+            st = json.load(open(os.path.join(STATE_DIR, f)))
+            if st.get("sb_ports"): ports.add(st["sb_ports"]["db"])
+    log(f"Firewall on dev2 for ports {sorted(ports)}")
+    ssh("root", "install -d -m 700 /root/dev2-kit")
+    ssh_put(tmpl("firewall-data-ports.sh"), "/root/dev2-kit/firewall-data-ports.sh", "0700")
+    print(ssh("root", f"env PORTS={shlex.quote(' '.join(map(str, sorted(ports))))} bash /root/dev2-kit/firewall-data-ports.sh 2>&1"))
+
 def cmd_retire(args):
     s = site(args.site); st = load_state(s["site"])
     if "verify-public" not in st["steps"] and not args.force: die("site not verified public on dev2; refuse to delete Railway services (or --force)")
@@ -949,6 +961,7 @@ def main():
     ap = argparse.ArgumentParser(prog="dev2-site", description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
     sub = ap.add_subparsers(dest="cmd", required=True)
     sub.add_parser("registry").set_defaults(fn=cmd_registry)
+    sub.add_parser("firewall").set_defaults(fn=cmd_firewall)
     p = sub.add_parser("list"); p.add_argument("--kind"); p.add_argument("--status"); p.set_defaults(fn=cmd_list)
     for name, fn in (("show", cmd_show), ("scaffold", cmd_scaffold), ("provision", cmd_provision), ("volumes", cmd_volumes), ("cert", cmd_cert),
                      ("dns", cmd_dns), ("railway-stop", cmd_railway_stop), ("merge", cmd_merge)):
diff --git a/dev2/sites.d/coinpayportal.com.json b/dev2/sites.d/coinpayportal.com.json
new file mode 100644
index 0000000..8114183
--- /dev/null
+++ b/dev2/sites.d/coinpayportal.com.json
@@ -0,0 +1 @@
+{ "health_path": "/api/health" }
diff --git a/dev2/sites.d/threatcrush.com.json b/dev2/sites.d/threatcrush.com.json
new file mode 100644
index 0000000..5fcf90d
--- /dev/null
+++ b/dev2/sites.d/threatcrush.com.json
@@ -0,0 +1,9 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.threatcrush.com",
+   "port": 8270,
+   "max_body": "512m"
+  }
+ ]
+}
diff --git a/dev2/templates/firewall-data-ports.sh b/dev2/templates/firewall-data-ports.sh
new file mode 100755
index 0000000..5fdd968
--- /dev/null
+++ b/dev2/templates/firewall-data-ports.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Allowlist for the data ports Docker publishes on dev2 (the shared cluster's 5432
+# and every per-site Supabase stack's 55xx): reachable from dev1, loopback and the
+# box's own Docker networks only. Docker publishes ports ahead of ufw, so this lives
+# in the DOCKER-USER chain. Run as root on dev2 by `dev2-site firewall`; idempotent.
+#
+# Docker's default address pools are 172.17-172.31.0.0/16 AND 192.168.0.0/16 (in
+# /20s). With dozens of compose networks the 172.16/12 range runs out and new
+# projects land in 192.168.x, which an allowlist of 172.16.0.0/12 alone drops:
+# the app then sees CONNECT_TIMEOUT to dev2.profullstack.com:5432.
+set -euo pipefail
+PORTS=${PORTS:-5432}
+ALLOW=${ALLOW:-67.205.189.229}
+SOURCES="$ALLOW 127.0.0.1 172.16.0.0/12 192.168.0.0/16 10.0.0.0/8"
+for port in $PORTS; do
+  while iptables -D DOCKER-USER -p tcp --dport "$port" -j DROP 2>/dev/null; do :; done
+  for src in $SOURCES; do while iptables -D DOCKER-USER -s "$src" -p tcp --dport "$port" -j ACCEPT 2>/dev/null; do :; done; done
+  iptables -I DOCKER-USER 1 -p tcp --dport "$port" -j DROP
+  for src in $SOURCES; do iptables -I DOCKER-USER 1 -s "$src" -p tcp --dport "$port" -j ACCEPT; done
+done
+mkdir -p /etc/iptables && iptables-save > /etc/iptables/rules.v4
+iptables -L DOCKER-USER -n --line-numbers | head -n 40
diff --git a/dev2/templates/supabase-stack.sh b/dev2/templates/supabase-stack.sh
index 4bb9440..2ca5892 100755
--- a/dev2/templates/supabase-stack.sh
+++ b/dev2/templates/supabase-stack.sh
@@ -209,9 +209,11 @@ for e in ${EXTENSIONS:-}; do sql_admin -c "create extension if not exists \"$e\"
 
 log "Firewall: $DB_PORT reachable from $ALLOW_IPS, loopback and the docker networks only"
 while iptables -D DOCKER-USER -p tcp --dport "$DB_PORT" -j DROP 2>/dev/null; do :; done
-for ip in $ALLOW_IPS 127.0.0.1 172.16.0.0/12; do while iptables -D DOCKER-USER -s "$ip" -p tcp --dport "$DB_PORT" -j ACCEPT 2>/dev/null; do :; done; done
+for ip in $ALLOW_IPS 127.0.0.1 172.16.0.0/12 192.168.0.0/16 10.0.0.0/8; do while iptables -D DOCKER-USER -s "$ip" -p tcp --dport "$DB_PORT" -j ACCEPT 2>/dev/null; do :; done; done
 iptables -I DOCKER-USER 1 -p tcp --dport "$DB_PORT" -j DROP
 iptables -I DOCKER-USER 1 -s 172.16.0.0/12 -p tcp --dport "$DB_PORT" -j ACCEPT
+iptables -I DOCKER-USER 1 -s 192.168.0.0/16 -p tcp --dport "$DB_PORT" -j ACCEPT
+iptables -I DOCKER-USER 1 -s 10.0.0.0/8 -p tcp --dport "$DB_PORT" -j ACCEPT
 iptables -I DOCKER-USER 1 -s 127.0.0.1 -p tcp --dport "$DB_PORT" -j ACCEPT
 for ip in $ALLOW_IPS; do iptables -I DOCKER-USER 1 -s "$ip" -p tcp --dport "$DB_PORT" -j ACCEPT; done
 mkdir -p /etc/iptables && iptables-save > /etc/iptables/rules.v4

From 15bb4fd84b388db822fd809d6cfeae11c207cc38 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:51:14 +0000
Subject: [PATCH 009/104] dev2-site: https clone for public repos; deploy key
 only when private

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 115277 -> 116043 bytes
 dev2/dev2-site                            |  17 ++++++++++++-----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 2c1ea8a5b5ac33d44d5acd594a69da90ac09cee0..f488971ed7c16296896bcb455bd271462d28dd37 100644
GIT binary patch
delta 7003
zcmahu4OElYl9_}ANFX4f^6w|&PtX90f1s!+pcDlZ1qB5IU-&1%n}8C6Xl-{}#i#gH
zF1AuptF_O%rA=$B&;IvqTdmz#ZLwMH>pSmkZTq^dt-ijt9(C{Bm_mBa?&h3tzI*4+
z%$+-PXXf577a#Gzu+u-}LU6EJ#(rVhryDNI;KdNj7Wh@#vE@4Kb{N|K6JUpw*---f
z98Yvyk;9XY`mIC``=x8!a^Rqpuw8^hj(^?01K_Bn*>N47kiOor44!k$c*LfGM;)j3
z$N_q#!M$tYX(_NL1rAH;JqzJssl6v&)ekZmIpgT>`4A^*kfuYA<DgUmQ{H9+?hs40
zp{B;%Bvw`tgQ>cXoJ6czG*>qoNlkr|ksOnv_a|$1qm)P30?0n8c>h#*OzPU7q<Rvu
zhol$w=Y&3oO&bzaAUG=d^(MkeN!ObeaRNokH`kEGID*q!MoB9#L`W?cRMO5~EnIUP
z=oS3o3&+`hHG4^aex?|Hc0?Wf$S?W>6nhZC3S|Bs!5swuaKIn`p@7dF|2&llFyx4R
zVH?0*sedq4br;F+IW7<GfYAHco`JxKU`VQYDHRkB`ci@d9+l3%5)G%MPhQD^$EBFl
zX%HY4p8lhJcCZ9@=Thxj2;09EVjTu&gJOzx0-Kfp!~}7Im}mzvCW`f+lJ(2QiQ=SM
zr8xQdDJSJUgV8iK9|E<y#wjvcr&dhjls(tSc8PLv>Pfjr2(opC*tH}`oMsPsN+v3Y
z1&aE9r71v6_Q5DRL&X$^0nemjsy&o(O}7U!ID_H+AK=sM!3;Cgu4Zsne{kn0tIji{
ztWYM-7Ux)#9(0-J;#{9zyj{U?9+=)A=v5VDOne54XKw-D*|I%Bd%~psf0~e!Q7iM(
zWy?1Bu@#5e!+I3mDnD6woS&>((HYhmgxi9RvY9)>ep3gvna5|GPqnEKFSmzDap%U*
z8mXUhq<;O1&T#8=ul9Bo=gnl+UtkZHEa&EQEkxZ;Dm)aO5!UeEXd~=km)nEH@tlHb
ziNE#C6`i9y$Bd9Un#=r+l38O>zaPp!`G5yx-8p`;5gem9M;6m!v7D)~{j~_KUBhup
z5XVvRkzzK675?~84jalvq4fG8hz+&-dq>%XORaOH7ha1AS=R68#e&S5F2UKTxUtrG
z9w|)DSTPUH>ZNJOq*(@t?l~PH4So^O)fwqy=Z8kx@poR&_ZeI6(_7)w^YMo0%U9q-
z35DFHvGz!>er#pF3`Lwm??bWDN64!FDDT$dTQDYy1yT0MAnJ_z-=k72?pLt5T<wiZ
zkKsC_?U4-&xv8W#-tg~=ZUZtYQ05~hMqDG7c<n2evQ5teU0f@!s}1z7hxufd*B4^h
z2&^~SaC`s1X4iT|FymDA`w!=i$r~|ukd)zlHq!Cl$sV}8OEmbHt;!z7l8eu-HGwE&
z3XfE++J{H<>G}HE$kS5|hqWkMtm_XRc8oQBq}X~NK@C1VU$Kq-{#0m%h`C~u*esf?
z0bXm?`gs!R1Bb<m=Ko{y(KT|h#U9JxreO)JN32QGf4?<0Kdv+0$F~;IYL6TCX|2j0
z|9tE4VlZWm@N1hj+pASWu4LF14taF^Aqbx{*6Raijm_Q-f>!t9nYHu1tZbYoZE=fq
z>g_yem;U*7Tt3T+n`IMZ)<s^bL>bBLj9~>K*&6J{4NDfwtxJBx#&~BD*Nd`fnY8H$
z5Be&m%myD7hIeR%mjz_&WTLDyW^2q|=>E{t+6<dzTNLYLn?YwQ@YLA}EM3{uMa0}z
zZ>cw%1hO5g=N&2iopJCtY27=;a9cX{&XMTzh~_o=X>8#v?A*e@F{%FD*k-Z=+j|h~
zMbN{5Eg-pt)VCR|#$0ld_1%6}(rUD6YU{0atyRg@=4L%nveazzW0*yx3t7VJtkxDw
zMoP*sQOd8%;=I*4nKqSrRZdZ1rY%4keD^4TWA&f^08?zrltyE_#pa(}z9E^lY--Wi
z(qwMevo^WPEJ@x$eg0iad~bP|UZ}SS4|Ea?CQ(>gZ(Y_}B@kmxtHme^2EoHDFlJ#&
z{oMQa@7vOK^8};GP}O7{F=!EL%tWx(83i+`WslHoXf*OZF}9e6me#7K`f6MG@5C?n
zm5;0zqt#k(s%3MaFwTrBa{g(8#mv!F<}E^Xli6gn2<A2;5x9*U=J#F!P)QR%crsec
ztmtvcF<dNn6FN*cN&4)A<m8_b$xm?naCZp1`w;M>oC29s(NgIM?nzV6r^f^!ay9n1
zAjn7R6l_hENnPh-!^V-7h#EvxH3F@4>ilFC-xen%_xXf4{|9z<2Qp(;8k*`27Iy$H
zu(FjjNvaEp(+)5RZUtK_xz8lH{pt*Cai_4UY&4lSn@Bsh6>Wwl%Q$w5949qjh*ayD
zVqY>w%NfU>3x9#G+X1qWQF{~nlmlZ<z==uE1rBt$#-$CGoGEjSTIMQRb46P+q+NeW
zyZ*Aa!c|pwNn5vV>D92fKEr_OK>bjB%BA>}LB-(e%kdemxOuM7`P=e7n>BxL#NPV7
z<pVG<ejxX-ZXo7F_N9>NuIy6R+I6n7jhEIMT%}d6sv6hg+LhauT@8=y8`U@aKvbV*
zV9trTCz1y9&eWV)`)0Xo<tkV4x=Sm|Tt(%s@+MbvhpWkclO07MU(R03<puc4mlxuz
zP`(mhVXGWJT?|spyD3)&w!pO@?OwmVHGNGdat71RjCpbXo00ENf4}5|bXQ5G%V2Yb
zbX*CtUkeI#jaqaiD2th*5~{$FcBxd}wFYFm74XZgFj-tF{CqoE78?7bOwMF}7Bc3b
zqHoi{m;>#7jV@iumC`a-`TEPH8(bAtu8L|`sW?>HaH+K6a%q#Rq?xH?f?Cupu1<bi
zCX1?<^Z86eLFSKx%y(`oQRc6fMCPjZ!h+T=P@ne~)+qv_KTepqE>QMaU|?CK;<K=M
zW#I~UxRSN2Ws>k|g!KC50?<mqSIo*(=FmiG`;})|U-!vj<t)~p?D&sQ6rlMQx7e>t
zGMOS>|1>e-2>P8pGJ)WU&#e)wDouuFV<ihlGKcXcIVKG43V}4~g)awTzO?biBADek
zd_$Bca#7!)yuTy(8-i2>(-DkD@Rg+dW)V}O;hUwZI}Bl~mo(o;J1%|G0&r1U{B1qV
za6JF*2LPW-ZQm^fgX8pfwE&_NfAefmA)A~OAy_G=Sq%^&ef~o<8w>wo1r$q$A1KsF
zzx;4lRe~fpq)j(cpiY{0D;`Rv{9CI+QFju73q@;?S<<OnTOmf8b~}NsrSSG!aVr?w
zt*A1H<W;7b8>+|@B+O*MlE7nQpiCLJ$YT~&b+cG0RuMBB#c;6{`^#iM)0GDxmJV)*
z0LQ+6#0A0zY4G0RXrv*9xcnjnc<Ln4h>MaM@6T2e)@*PbzrWQ_k0v282zZ4EL88fw
z+~#jJ5JA60umuSE>KZ{WB$H)yr60_RU5qq&2>KYIF4R+T*5Djb^cg=W0WH1b2TL`Z
z8I6@a7K>ckdtrvNO9`v|RPW<tC+SciOa?W*9|$KjTs5v_6n#kz$*`6FRSk*iF2=kA
z1q{*g<sdjyG~kwli>kGd2YZ~WwXgz|I~hT@^LPjt<;p#*eZUzS23-nRK=+P@bkI7_
zj|LsUv(DRNU;;pgGcpn;feJ~<PMRGB#qc=oi-I&IWvBtCD++e0G~GCyiK=R8jR4tj
z)_GEZcF^F0$N~gvXG#K;1MH!@Cctv&rdKDxJmoPq^l#3{MEFq&$EYR=avyqwiE+!*
zQf+emW?Rt24oviw)n?JyNshB2PZ`z8-7v!qY3!|-nK~Uo+SegyRPGq`2??i9CBc3b
z-p5&c_EcD`e3?!6y0ddCC<8JcW_Vjbk(o4BwX%}`6tbYEHkF`XAY=(-DeI6tM3*6W
zly%+mCJT9&o=XFp2CF&w1V>(@Su<e+TiKzRuo^1p?U_&qy>!DYSfqTPaed@GG7E-O
zaoiYchOh;j%vQl-HMg{2O(h>P9M#W<1bSvZ{0eQ<kqIfvPZ{<r=Z#EARKnXdXbDUU
z!UKleudUv=nQ4)|gzbqQXVVgh2Dw~8AIpY*zw3-i+WuuYou317a)pAH=YRlzq4pfu
zG@2hklol&Hjo4Jl{7vGiJQo@@_?^NNPv6ijxiAqvr%&fXqV^_}_X~S0+Zcf-ew^Rt
z!jLlaJ><|K_z;Z{$%x2U?Ao!l55Zvsg9tVuXv5J@u=REC3TChcv|<Hhg>FU61_Uo6
zI6_}o0bPaHkl2g}3}1rLL2!o?+;;@`4MA@bj81}9CTK5$`npx@Q;yY0$SuT-MeT0W
z&H}Ikr9T$1t$T;zgPci)FjK{%uW}9i2_B;{C18SkbY}@9DS=(9<DIWEi~`QnDP_<&
z{tC*%#H$M$5yD*UIL{0(m%&_BE0V3CKbFBnr5}@$<cuwc2@1GM7gazhsAyjWq$&g0
z$UNu83Sh}|51q9Uveb8x5kZ!7+eU~1I6@B^AW|8^NOPR88Xz|SvU?j~6aAtIl(ek@
zw!qWQ?;GGO_&<xbTEvrXDy*e{ZGyFMmS!|VD%_!s%`jgT!K9GU^i(qxK_$J{3^O9|
zgMiz=&R{WEt%MA4AJS|S%!UBkVS?ov?iT~9rJ*02AWJ!u30dllG{XuFq|+K3Wa;p*
zYg0`V#3~`frk*CWn9XcI3mHU%6Y{_h!q#@`vO&Z+Oiv?9P8#Zs7b?OJZ}+I81JYIZ
zktmoh?qCTdn4ar^YOqnk4&AJG$_}yYkig3eP2I{;(<Z9wWHIv-g{=_fJ7l4yTj4Dg
zT9DkO@m)|p34`7f)59t25Sve@@T9LG96v}8b-^26K5-j71W}ZIaI0e5BWydgDpxUy
z)z0qi&=L@q%eZZ7y``0fvcY21lciL<lYQpk7WdpEP^Ok<>;xm+rvp1-EF{u1JK<6J
z@&^kk-o*m$G1|Th7C{z0yNe~zJX~?KboajkrMmB@&_+9G=$dYrosf>J`H6`vAb&?g
z&0~GHUuo8=0x}<myvE@&AE!6E!9IE_4)8CEyzZbMNeJDt8{$~D>fOy;o=-3ChFs-(
zHnPnb`3GoKgqCqC1bivkw7&=PwTNXIvfgAh3rxmOJ&@yZn3iVkgOntswW)=IoYKl=
zg~h8gNj4%hLJ{j!78WdDm+6M-WC_!pUfKl$J-ZKr*<#<{2gI+Ok<y#HAwIOp%&L49
z>vprpA^<Ch@y?wROj1O1wYWx;*ci!0z+<O^p6`VTVGk7G3i9hj2)*CSl1(VxKw%+F
zqWu&SCvy(Ic}EL+qfnf)Jh!qqXH`kwlAOx?oOPKVxmx-ag{e^HjOYU;Ksk**07;q}
zHf1mB)#cHv`2egAO!F8CwaG!i^~%H6G6WR}hR<4j<44fjM<5{?iyF5Q$wq&2o{31#
z<qR)!3>QYTkHX}!OR<ga*U8B!Y=<HEi9UQ3%HTG=eiU-_JouKg;9@k~_dK3?4lWvj
z<vBNz7Cyt0g_dr62A+V6&e6vp9!B%TJA5wU+4p6->^MB6D#H0z(!S%6p=@UDBhI1Y
z@LllOZnhY_;cRNHCq|JpvaSvYrPp4Dsa?Ec4A%)>B1Y5%Ts>FRQ&dorn$<{Rti&s`
z4%{k3wUu4ZJp~3=<A#L{tuz@(t%VmGTZmq7GV802#Hz2ZGgde9>SGJg>)8z}iCsr|
zA#(dS*VhtO1j(CBh)t!}GhNN(AzV`ff^~H86&RDYk+p3a#%s1%^=4C3I}s5Rtk+kY
zP1UW07){mf<g&*NXHorI^p{tlRSpW;avEZ~cnupaU%YbpmMTw$<CgthNy8dNFwqdS
zFTu#<5kVfse2IIIV103`TMWcvtmG!3xRv+~m6s%{cCw=Zr4yYnPTh|35WMFsaKd%J
z=>x1?z!R@dUhp-3@zufC_^%CV<88hj@qD#3XLW(jN;>HJbC9rP8qPce$u8q;)3C)4
zULRriG3+KI$pCA)wd|VPR9}^h8^UO@lEpauIDP9J%vtP0`bQ9f-;Rh9feL}==#A?B
z3ttbm(hy`}cR7Mrk?ska@fw`y;@5e8llS~TgX2dL@QXcn!57%&9{~70KLCYsx1?eV
zFI)WP<Z%W+Pz)b8@W4#?@%MKJj|Yw{WW#vqAlzYiaNvF+{@B7g@5xTQ2+hPUPsZG_
k!#?Hi<bH0agRiq=-EQaA*WqcoDg)Naf3#EkTX5-r0K|77`Tzg`

delta 6421
zcmaJl3s{p^vY9_5AtbyMM4pX+P|)xwt*_RKU{I<k1?vNgH1G#Rkibb$i9y6i>)u))
z{gtCtytZqr_0h7;u0gkV)w_Mzt8VG`xv_q|-TSru+PiJ7eYmyN-kB34Nx%JWzK{9O
zoS8E-XJ*dKIh_AD-NlW%=<|`05i0zBReEB1&rQ|uq8+QjrEFMz8Mb(=U6%mXD^u4j
zfE}KlYu=GykEeMplVGRv;W`WKRnmK9*zb9)cLTsPiebZLP?XO%%!0$7yEeKEu+ejT
zn*^{+8Q8uE`W5|-d^n&?-Z2e&m98CW+I^r>F|Vh8#|2WdTq%U@o_)#!xbrL$e9?{u
zYh$CmRj#XN*0zRa><G<9$o7U78*6NCwXuUr(ylzi7Lu|NH^6o%)w{;QV@l7iT<sp3
z-LJg3%aU}MhAv`QO5hnnZ_+4%U)cch+W(^Q5hbUuDDDu_eA22$Rzh=Rh9g$#y%?u#
z?2Cg-o;`gg9em_D)gOT$<<*1LaLtqW>|er?&XLT$1S)9Z*93kd@SO*ae6NPfo@>W5
z0p9bZytoeFXQh9jK>IVX-|)OWumNIj()ca{HUjS{jV~2|<l!%+t6`&Z>JLe9OnLVY
z7TByLpC|&IGVjC@DaEM#^2;P{GQbG#Rzr%%>Rqlj%IR*9lM_+*@(jhga%7JrXB?Ff
z#ou04ztkNiXCem>$6l2@)*XdV6Ig@eEVmwEHqPj7@!aW-#F-p-1j5|@=<aCeSRoF9
zJWd|(%nD#gH-}(pZnbjxkNS+fetp0OP@&{}l8j#yeP^h)8MnnK`j;~-`Aw<--wai4
zm`c?h<Br*(-l7dtZAlGNHK@B|x{VY`q~;Pe#F7HH8Z9W~L#yEqh*5UDJm#KY(=@@R
z^{cyMo#ueyZmn2)SHC0|xnq^jUY^)<H<@-+?dRwo;T(CJcZ3_<lG`Yc5gceF{T@aa
zcaQ9j3z9if$h^&orrpyYM)Hr|S_7&rmM~S&ifFN70$MR~Q7~H&i$SnVB9?#6;mr3N
zgt3`?6myAwV$Bp>b1!c0?0=-?xpe^&T6LeZ$j>$$k|65T{xIdt$8n1ORBUp*bK-5z
zc=>(`M1WI?-4dr1Tn^{!*8mOlJ)=TmGcDNpzsi#05Zd$*tRw^r385Uit~7*mhRA~C
zQ33mKpP}p)!B7~?P!=L#W`ANJ7e&qnovG5GGu55ooEmV7JWDQ@9|$^2v-{QZ9J!)N
zBhNiHFCeXZw0qR@X}q!!l6vG+aS}$a1U5EAPO@AnKj^;YWVtFJQ?8chH|YbL0+qAy
zw(f_5W`ob?|L6IUp*~sAuRAJn_Zmo2{`<0Czp&*_tVQ`wvjTq_sgDoH7okRa&!P~2
zEp{hheF;hMHjq_lW3V+fA#0X|V4=}{SX8E30hf|&xvoDl;6swyb9?LK<VQjTSwpZ;
zvGue^|4I}x9J&TsmTk`PfXt?_kdP(HjlsDuTtT%VkoG-|lHBA@M7V5N24c;_mNZI@
zVOX}3Z`F#V?&Kitv*hJ+i#usJ&`nx*^0C%oOR4+?1$%|FIAG~=YE?Y<AVe#jTjNUI
zx8sB!YYXHJMJ5nG-1f}CVx)^sAluz)x85D$mgLci%D~AaUN9c?O7zJj=~%n6;?JoT
zEWE2!IURHT4K4#Kiz}j%*;h6@n(b{SwvO7?b(+<g?rgU+r->O6^Fa>FA<_lZ$o{T4
zUa5v}mDgW+#`*@$iniHLBkJvVtw3;)z!GB5CZHzt9s*s6x(rRt&SjnTc@6dzW)_Bl
zysoJ(pKqD!iioJPRL+}<<YJdG4?l|WwcmouGw|A0C}HbKz*Yj=5V$n?Ew(NP+fHL$
z-jdopM9bI(LL+2bd#k<6j5F*5GT=XH)vHS5xjCM-Z~PuWqZFNgD#?hd{YDFW#YSjL
zIho35=kqeJ(IRmL5x0~5gzg|9?jjN`E>KD@OfJ{aa6ai-O+Z{rCevs(aX&z#5(K{R
zdaJ|MW?f-pPDFE3*n>nLAbJA<qw?y7Y_0I(A?50Y^awp}pw8ObY;`Dw7c;YWBfC%C
z-dWFnA#q{LtSfCkO-q}7Rhw|EPrcIG>PW%6&K=5cFUA{k(5_E$jYAX8d-EWTH-|%<
z=lhGtpy!HKH8O3t^?-Iy^ZRM}Z>8lAs0Zf1oi=4C_1>YF`_`3zFmm+n*xeKMB<?mG
zxc6|^;g-SJ!NS1>Cnpb%J5xJUy?CgqW~jzC)Yvq%tnIBv`;e{uib~Z1B@%v0r3dL#
zB303+N_vDoR;htLk4Q3o^s>}Q-w{oojv=GE@Wb$k%`>)V?H+$vbJ#Jk;Cc7pqB9-m
zMxE^%s#-EsyK=~|>Yeb_ABG!;BJX=AeCmfwt)9WR7fNX}L6uVhKYnXer7i@A5uNh-
z2;(Ak#2b;OMd9JfbMMJuR1ELiHRI6}sY=iLhY-*H;Au@E;wI0<57c1zUy8wXa(||B
z>2I0v^pn06O%c*FJY#&1N5gpK_~!#KNm=?uG30sv{R>&j6iYs*bzczpJAncMg#_XW
ze5Pc7S&Yh-eK`}Zdj`JT25><s{<;}O9QpbUfXj;Wn`uzv`TaLd0JTcWx2FuVQ74;2
zphEfh+kBjj{jLJ$DRtj*s8g<ecSBo6#LxJdM2J_Se@FtWlKVp%R4e5_RK<|RERME8
zdu4^n(I3`AqLO<p9rBfmYiCo-aoVS@x5{h~4fH`h%Ou9h2ps8{GU-aiKVzd>5Y3{g
zYMn~;PaYEmsr<!_p!011XR00+^A`Y~P9i2YkG5G!;9k-?n&uLCvjh_~Z8&c59+Y5h
zn3>86OC}(yOC+&TO>pU)R%SAnnq1)~b3>!aY|3LZ_&gm<Ou3(UEChBVV@`~}T0KNs
z68JMZSO7-;qYh>o9LTc*{~QiU<hK{|yD?1rI%zw?-!(!u==lvJ95x8+gq;a|AQJMx
z#XpLKOv4&n?IsEDt4P8fUUL-qBzTjD$3i)5_EyD01!x{cj!oW!BfutU9>?*M-l%x!
zQNt9zbu>%{qxals$N@Ouy_yIa0IR&Ck|7JU#L6D!B`Hu1n|NOe6loNk+T;C83Oueg
zY$ozlven4t4445Yz0YSr7Z}=!Fol5LYaR<r03PSR$$~ksnZK6>_iCO-(jo7tY`Cg{
zgIsThGWZj(G((c^S(Jt)kaw6N)gb&W%5N;+V}@N?dKa-+es>;}Xa-P**SjVUG~v+8
zdndriEYj%Gn#}i`rkhwPBCMQTUPGW4QJ>W6V1MSPCV<O8RhGR=l#_hgM5sjz`zOMD
zsNq*9!ZLW0FPQ|znpbeu>)r#C;C*e9*pwb8T#;>dr^(^8x3^pC@%?wsi%-cr02u#W
zG30ChiYy;{KPiSx4V>i>WiZ}Ib>A1Zve~u@)t8iERJVJVmq8LpKS})2na~e^<C(Ld
zNcvggi)VoeE^*f^=!hpHeHw?;>a@AEdE(1b`pTijKyN~S`hUt-mcv-^@qOix8TAiT
zeii>5<hxthe;^NZ-mB&Cre^AEv~0K&jzUhBKy#~Uw3R?Vfnx+HG1*F@zD1)?_|19f
zrz!m5N|+wwqN&9MjuY6=k5@v^yi3F_4i{B!M(NEcLm8zFqp&lI8>92Z$hnNX#mH)(
z79Z128)IM7Oaevb3SaXeIH8YUc@T;W*Kl5gw;ji2aaQi|R#ZW>7Ee;`BKRXb#uFDq
z8{FWV7elV*2J$9&y*Q(W*LYSfw2T=du@1B^#~5@R#ST*a%3i94N!ku#E9X~gVXQ%g
z+A>JvKW?3^X-naz1n=<st*{Uz-e-jZO&BuV?LBV=EQ4ElQ3Fhm_>p7~nBraA0LhT{
zG^!=lDifmzoKNSduXD6^HZcP(zTfMWp)4GV`OQ}7fCqT{3UI?y-Y-|cDbPMg9=#9C
zX*{o90b}_8*fB{@@Ja1Z0M~hQJKU#@K_Pf5j<!Q3Ea5-5!(DNUP`OXH%<8Z@os1oz
z{l)Q;4wwL8ysHD|7)1DL$xa;~>VWB*0u)m09mSx+0QYdY8>T-@7ZsOwyh*M%O>sqx
zH?`aCnC+%1Oh*dE@eZd^Hz|v%vQ%5<&ZwJSSzb5WvY7Rd?BSMDMBB(AJB&oQ&S5P~
z*8W6e120~SMMKX|t%U|y$<umZ3t~rmAO)z8#PhsfEJn+D*gCil-}7JAL1HkWl|R%A
zXSL)?_9IVO4@<IoNt-zP!zF4j>dH~yDpy3`&HLBG=_vm?GK6}MvNto4Z`gpvFo7T6
z0QHzqF&m-NFc+mijDHT$_{%J|l-c1UN^qSk!tCh8N`N;bGb`oBCm<z8ghZ4t(LIcO
z(i32VpZNYKAOTGL#1pUyW{JI>-iC*_m#^9i#W0l*ZpA8UAr~YmwO0#ya}OAJ^){F=
z<{sMK_h|QA_8A#F5piGG!s%6W*(4(QJtd^A=bvl?cTu*OCYOuGLje}~##(5umB0!D
zZ3OHDYWU9Wm?AUz`R!1qS%eF^yrXtNr#fcA?Zske#eDBhm>os4SZ|x#oOTn2@w=U1
z@rTsNr|p9L5yb0?FwM0rteZ8jdj3>a%-8LLIPEm@S}y-)EnesbcR?iX__bZY!WJSw
z|7ts=MYr0q%P&QA6aG0&d>wVR&3%xiP7<aFE7Fn1N(hJpSHsWkfsBAsVU%;3jSRc7
z2kTZ8U-A@8gLJ<4DagzgD@20Fo6I&-wPj9OUA3iZL3yc#(s!y~u91KG6pVuf-Vu92
z1F(>f-Uqo6^{8?i+12B>t7RX|*BAL6L)J_uAndZxXa<2A0>3&AG5qSYke){^j};TW
zm;x)-j3HFW8Q$awnw!B(o`dX!QW{ep<VY-%#!&>m=j)z>8u*r9dJZgRaX{x_T#-lo
zJ5Zc?QO_%bW<~in@rpxOP>g)-A=n8Qydw`o8pMklK730Og?xaQJr56P=a9Y%-uFCA
z(KO?DulL>O;j74m$8j^haAxc1Y-To@wIG@UtdIM=Fs?^*pW&V(+D%Y@q1_8ZMT0s|
zk|MCnGFzRKb=q>kr?oaX@tNmuR<s)*Ov7nSo0T;=MB{Qro6T)@a|6Cl%ni$I4K1RR
zxx&q6d~@WsHaCc-=F_ccZerL}*~=)zr8S$;Ry!-BJv9<|h`%rhql)Ojy9~J2?r@sz
zZLMAG5t@lKn;YzH4V{eH+8VmpoBlAIAoH*CYlF}!-H>?ONl5My?QpmgiY6G^_596J
zc=lJ_k=h-jvct%~j83CC5o{A3Rmwp|{mB>6Ze<Qzop3=Pr4s$;jfs}V!%sm{u9y_>
zwBtx|;H_9?^8Z9LVx6Rjz!~qHQ*b#<w-3j2@k&>48j@ltCvzm9dZuOm+#Dxc#cNJO
zdgh&^{w`AVS5i5iM$rT=61tg2x%|LsOrp*F^l6w_@+QrT|BlZlqK1H$fdAG_CTt>>
zaWu*&FrCmj1Wpp)c0TD09PSbCSn-7Q|7V@(&kztVTH)`H2o*11@xT>NTM>itB$nPy
ztcZZPrihEk@HK_*$xPgOe|2HG6}5RtrppQw(V<(02m(`+Kj<dlFGZrK6c8$ku!!Pt
i07dLXP&@exXYn%l8}EB(VZWp;f<@BRHtu=_-ugeIO+n58

diff --git a/dev2/dev2-site b/dev2/dev2-site
index f69b92d..7d90f14 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -500,10 +500,13 @@ def cmd_provision(args):
     hp = st.get("health_path") or health_url(s, cfg)[1]
     compose = render_compose(s, st, inside)
     build_services = " ".join(["app"] + [c["name"] for c in s["companions"]])
-    # The box clones over ssh with a read-only GitHub deploy key (private repos have
-    # no https path for the deploy account); the alias keeps one key per repo.
+    # Public repos clone over https. Private ones clone over ssh with a read-only GitHub
+    # deploy key (the alias keeps one key per repo); some orgs (moshcoder) disable deploy
+    # keys, which only matters when the repo is private.
+    private = sh(["gh", "api", f"repos/{s['repo']}", "--jq", ".private"], check=False).strip() == "true"
     key_alias = f"github.com-{s['repo'].replace('/', '__')}"
-    deploy_env = f"SITE={s['site']}\nREPO=git@{key_alias}:{s['repo']}.git\nBRANCH={branch}\nAPP_PORT={s['port']}\nBUILD_SERVICES={build_services}\nHEALTH_PATH={hp}\n"
+    repo_url = f"git@{key_alias}:{s['repo']}.git" if private else f"https://github.com/{s['repo']}.git"
+    deploy_env = f"SITE={s['site']}\nREPO={repo_url}\nBRANCH={branch}\nAPP_PORT={s['port']}\nBUILD_SERVICES={build_services}\nHEALTH_PATH={hp}\n"
     ssh("root", f"install -d -m 2755 -o {DEPLOY_USER} -g {DEPLOY_USER} {root} {root}/volumes")
     for v in s["volumes"] + [v for c in s["companions"] for v in c.get("volumes", [])]:
         ssh("root", f"install -d -m 0777 {root}/volumes/{shlex.quote(v['name'])}")
@@ -525,8 +528,12 @@ def cmd_provision(args):
     slug = s["repo"].replace("/", "__")
     have = sh(["gh", "api", f"repos/{s['repo']}/keys", "--jq", ".[].key"], check=False)
     if pub.split()[1] not in have:
-        sh(["gh", "repo", "deploy-key", "add", key + ".pub", "--repo", s["repo"], "--title", "dev2 deploy (dev2-site)"])
-        note("read-only deploy key added to the GitHub repo")
+        try:
+            sh(["gh", "repo", "deploy-key", "add", key + ".pub", "--repo", s["repo"], "--title", "dev2 deploy (dev2-site)"])
+            note("read-only deploy key added to the GitHub repo")
+        except RuntimeError as e:
+            if private: die(f"{s['repo']} is private and GitHub refused a deploy key ({str(e)[-200:].strip()}); enable deploy keys for the org or make the repo public")
+            note("GitHub refused a deploy key (org setting); the repo is public, so the box clones over https")
     ssh_put(open(key).read(), f"/home/{DEPLOY_USER}/.ssh/deploy-keys/{slug}", "0600", own) if ssh("root", f"install -d -m 700 -o {DEPLOY_USER} -g {DEPLOY_USER} /home/{DEPLOY_USER}/.ssh/deploy-keys && echo ok").strip() == "ok" else None
     ssh("root", f"f=/home/{DEPLOY_USER}/.ssh/config; touch $f; chown {DEPLOY_USER}:{DEPLOY_USER} $f; chmod 600 $f; grep -q '^Host {key_alias}$' $f || printf 'Host {key_alias}\n  HostName github.com\n  User git\n  IdentityFile ~/.ssh/deploy-keys/{slug}\n  IdentitiesOnly yes\n  StrictHostKeyChecking accept-new\n\n' >> $f")
     ssh("root", f"k=/home/{DEPLOY_USER}/.ssh/known_hosts; grep -q '^github.com ' $k 2>/dev/null || ssh-keyscan github.com >> $k 2>/dev/null; chown {DEPLOY_USER}:{DEPLOY_USER} $k")

From f095e2017e417e8f4ab20b3745f671b444b10abe Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:52:26 +0000
Subject: [PATCH 010/104] dev2-site: quote BUILD_SERVICES; sslmode=no-verify
 for node-postgres apps

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 116043 -> 116218 bytes
 dev2/dev2-site                            |  11 +++++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index f488971ed7c16296896bcb455bd271462d28dd37..b955ceb372b5e142f4c49156b4ecdfe21d4d57ee 100644
GIT binary patch
delta 4544
zcma)9c~q2FvhUy58_=>e3J8KME{IO!f(kLpq9C9k1aJX@1o%)HR&Tc^v<;{+ImwG#
zyy_i66g8SLIC&<WlTR~~QP0a{d}HE}Gw(%*oY9zxah8}d>e1*+%)9j=F8OQvobUJ5
zt*TqMs&3u7U!VC8>)ltZ0cZUE{S5L~mig|_i<P$mqW9nzJaNxE#seOOqdtUhT;;2<
zZQS0I#8dXZh$Mbu?-agoPuQ41HK<pisRo1Ux7*?|hfB(1@|b7J_r_@^g9oae+j?qY
z=PP?A3=JNXdCcn2)dpsk(o;P#!zB^+h-mm~gA*H{Qp5R`o>BbT@gY2PUux_KX)KZ!
z=rVYWaz>QL=$4}<s9{|Ob)+kl*S{FWx9zJoMjwgcxA)~6V_l>8=U)!v<@-Yr$5-x;
zmiX%aFpT1d_wRs(ryZE=>sy#zT%4C*kja}4j1BAeQ>!bT&W6Tjwf3%WQ?p}rEvsAB
z>fL@|1N{CE2E!rwI6vcY2Y-!He&Jw}I6DpziO(t53<kH7WxQc9EK}whzcm;lvW=3L
zW6aeD^Nd@KTQjy<u9*$NrQV5$j=+36C?eP5{rvS91>bq`Mwdk~D16V+iB^NmD1+kt
zpQG!cC<<Tlb}B4h@wR4!&0FxUF#z{?@dr-a_Wu5ZAi#&8|6Oi~-Ea27+`P=n;;f=Y
zxpT6LXT`Y#;`r1L*TCdG`r&#Le0kEDPPq+d&tykaAgq&M6Tx1BZ3Kr2EPU!mIk54z
zkFury?>@SLN#5fhZ&k)M^)<KkHMPsII#56n7b->cDo~2)Rje$eSMVb5%D!C|In{Qq
zS=P#$bG?#|Kfezt-v2&th3zUWa#!vgo4`N&a|UMcsQxA5{g>g3L*9;ln~6%x?obm4
zORLM!?W0cQn=d5$PSOhu>STWQ!YKQLk<K-%Q@C<*j9hZu#W5qM_R3}G_Z*xG4C=Ht
zn>yWNk(H7x8uBrPcU~-rP8n2^>?gX-Z9`ns1}4dRo}oS|`rH^cPMztoN%<^S%%Dt;
zQawYYTb9B3a)C54`2eE%tjjh_x6<aXrt?qU8OC4wydXQ{v6-`JrW)04rs8c2aHS1e
z^#rJM)XXDUy~Y6!43Bv;myf)Z9GmURc%UCRxVoC-wn>k3yG-glzWP#Z!u)!wA)CuQ
zsH^4;>Po9aA8_;e$x9)|8R`Ol{!)f<&XEEh`9%^6dEpnWBc77y6B~V8VGp#6JVT}D
z#ob0e=|UJv`1fB#+h?c?T}6W$Qo3j$3!CG8gXCzj9_x~Bt4g-jzgAgGsWZ4niQl?0
z_GfC@L$B2Gwvfl-ecbNT5A6C$yA|DLPsov_yzt8jsH8m4P@mag@PuX>dhh!(XjpcK
zs<yCy+i<ls93~Ba|79#{1~+ubnCfohU@?+-kZuciEgXzpRe96paAR#RM4=nu{t=Ie
zmhq#Hi1_8pfAC-KTKr(<3f^*Mib;l5$FG0o@c+4Iq@?RT(GnZ@&#uftqg1Fs6F++;
z8O>hH-xe!K^Dh0zt4f@2+WlrVi+w}K>R%EPOiVvw|0KrOJm6}nJbx>$X5*gs=+!&G
zH18Y#@>O`yO|$pdw>7|W9(m(ETM<=EF+mBxbYr6A+HdA#5wE-{P{(iI{J~O6!Ykrr
zI6`>ftq9cf@wY~zjOX4e3YtN(VKO3?L{tjzz15D9eEjV=Oy~KxPem0<cE7Q@N@d5T
zTm7hJ6G$;#f-{b<`#6s0e`gP1a_Asdz13j&P6P!YO8n;rSiM`n3scgs`55A+AFV!G
za?JjlCyq@xx#;xl(^F5k_LY{MD_#0Y>C(Q+`o6~J{#4r9x5V8Sz2;kAQ(zlz8cgPP
z-1IY;1HFH|`zMpnvoP3_?_4k8Z~Pb)ooYH2ZYoPP^#u(tH~O6O8CULOIyZTY#Qu2y
za)0kvKmHzgM!X5^iy-G%0VTDN;7N)$ig=NtPQi5ZDoHnLuPJCZIqs3h2!eG4!K4;1
zC%CPyDi-6I6XW)Yanvk}al|CD`J%vz<j5@2$s_oMR7?nB`LqDlmt0`K6^mdOcdW>^
zxuwpt@^Ly9u`UrKwK^Yg6a2*wL-0$R?vd_Wq&Vu2M644R{W03MUe0)tW}P$8tZ2;<
zfYC;5(~9iKhk26}ZP8u}My+DrCh6T;KnOaF$Pk-{;|bWc)5DPfyrEqW$0(p(3mt*6
zu#hU-BxXmV7#qdTNF<p%CF_88HWIH`Y+Fb?i!xx>)KT~?Y~(o0An?~5V^9uk6EBZN
z9=3>2$KpxzFQw=$Ei@kMEeI969O#s<sfn0v)}-W=wk8qbK2c=AZHaND#$?2>d2+yV
zDNkhtFNwFNV-rq_v}9CB>)pvHL6x|kj1|}=%2SYTJ|ky*qV=TUoFzhc$e--_H#NIr
zoUZ1Uma6K8TJ}fn)igu{t>Ue8Of>&ls{B*CoQ}N~n8gd(*n`i-=o}=$B9`PJ7GDT=
z4qia)&Rn!u^y0oMR_9_2E{WZ_7#(m!8u(s5&b2Zh_iMW+5mxPbE-si8M@SJ1qf~Ve
zwS(X_0xyA!U^Pk46ZN&YS0IDS5Kk8(BWNA5o*{UL;Gp<bAvVm@%XJbls9+fFKcl^2
zlwwBNWK^+?lEElCMjrNCmen=5Y8ksl9P0h-wpjC&EUbHy5h$-F=U?=)i`Mds5Gb#C
ztzrqrLxCb*E=7XbBvoQHtrSg0d@RORpg#5-nQ}_!6NWre)Vjk_0}H%effUPgq*f@d
zRbY(GDy=wZv9Iq}YuZxWQ}CHct-@mXik(%MWVT6#RP9U^4#UqNX-1H#wbx)O%)ye*
z(KHoveUL5gHDD!5L`x$)*r#1>#0g-I>~kTaxDk;k7Z;nc1n-NK7EHoDQP+Z*mM}6o
zT=ce}5Y^)Q7EBpdDP8QhuBdWWxm=9(kn<zN?3I`fn`m8$Je$51Dg_cC`c@*toGgvZ
z(?S{YZI~(4Hk4%skX`)<P&(NLvKdg6Rh+dTvofPFw{m_~DWj9hCeeORCP*Skpyli&
zfKe#zGGhwO4-)C^Xho2CuN^gL6C*pYQI2{$WL(tBLqy^_c~o7(v=(=9NBp=J;g1Sd
zi-qfO%1Zf?2^3N5<yZE@bGu)zmtY(?!$Zi6y`p<PP6XUnmkjFqylZs0c>a0WAtJ@E
zo<}uRgM9;BwuRE_GWj^=nbEtB?B?@*f^(%+x1YngN*=W;XRU+H6GJv3GDuIk-ZAwC
zY8NS+WJ6MnV(%t|B3`_^NuIC*J*X2~<k5OXJi8g`$P~vmBNKTPdjzkzK3UXt$Q>!(
zg6Xj{DXu%x^9Af1%3Z1)_nQ`H6fIzBBpOJOZf&Euyak@5L}EW|zO;i(54WB+pn;%~
zpoyTFph|4tDr;bYII|UV&6RS(^IGVuSY-^VcraNHEn9SL$NT`|%Jx;)<Z6y#!Q$q2
zWDV@4U8L>6#9-2O`^7BCT3ne^P+T&LWs9{tFw8QS(l%avE3Z~@YzO>h#2@YeGcA?+
z;+w4)8Q9P)Z`fKn+#(-mj95#Z{-vE5YmCrc(Y;8JGL}oApPDLhdKX3wE~-1_T2V`m
z{jf_mnW3V*6KO~gU7Z-M$O<{tiD-*H-7dcB!~|4m!Cf!|OU3Zr81GjnE$^b`I|i1o
z-;EOAq=EQp(HsJOejZWt391NwQtx5n`a#4eWRobHwoX?cM?>920#Ul1aH8gm*@qAx
zHjil9=>&xhBRYiOj#zsLWw<RqJA^EUe)#g_&Pg48qxEB}x7Wf)xOz8@7x}Nto?zG7
zUxybVdP9Bq5ukTfP0T%vd6r^Ys6^~Mj2Y$@Ngvey_b{dfL_F;5dQ*S2i;q5rgetw?
zlL!4sOF+N5sfsOk>b>6`=y1sYpf$D3<)~RvTT`!J25ujRqh(cfLtTx2E%aL(>z1=B
z*|YzP%ERJtuv)d5<&!s!1W$`Mk0CUvM$&GZoZ9SkIhvaqTG?{q_&Xdm%}q6{7^`in
zX=R@dWbS?WVz<QYV^{@~XgrSC@`qQ6ev3SQZ7}_|(X;WB>xHfjMs0vmP8b~yy+GLu
zbaJRxm{t7!I7<CIq)G4xE$==2#biAo=>^O#CY?Y;5LG~e(r?VpDp`==V(p^r1mZAJ
zw9#v_=sAJrgn_RyGV>y}swqTGC&-{-9>H;1Rfv?6=<Cq`2Ft(Q@}Clc9^k;|D-CB5
z=wa#C<ikspK9$%uf}dQcKS_xmIbDa0ZZqabKv&klsS7sB??IMKW4+<%DSDV4Ju!O5
cJmSq$h{sm#(^JqCYbs_d*V7fT{R3$K51Zk&KL7v#

delta 4418
zcmai1dsLLywV&TNFJNFm9x4O!Frtn+q9P*oISTTWr%^!#ff*D<9%qJl#R1f6)@_QS
zp6F>MC}^Weq`mP@+Apz5qg~gSbz@t*Y-`G@G3HUzq)Fo=n#4x$*&h;O{<*W(_xsM-
zd!PL}`|R`0*FQGD^_1EAR!B&YPX59(ezoC}?vyqDFrMI355J_}?^8H7M)A&;K!t7R
z#v`v_EPwsT44W(H8Kch_E!X%AKI2^Z?i^>(`QQrWj$XGu)MpZ5y@=$!R{~}{p<{ur
z0G~;|jjpgEd7sfWLZgI!hZ3$)BKRMB6HFd-7Q06Az`n<L+zWv`wa=LtEe+VnXt&O%
zm&#&%`c^q>fGet7=Zf`?<QtzH!(ZyF){p6r<IzW#BA%~1I$58vA&EPG86ggDL7>f*
zKx=%4TBTH1qd-@qZ!@(SH|y+){H>!0VB}TDrt_X-<NR+Q+linrq0=3gkLMJxefHPL
z=VOnj#NE*8Y%7(|b-FU8T%pM-Wv_m(bHC|xqb@w(-*dbl#`6no*{S}5=Mofr;ctAQ
z+oXI09(*d<{EgJc?!&+6)D9>Qz~A`q`Oy1~epQbE|7*X}TXBz{{T~l*`%}+_LHe`g
zjhu+Ephb`8<Y!ctW|l0^S)5rquQi1K?2WB}KjHii15EtbTZdrf^Dkt@lgI23!ES;h
z1p5h|C(!esUC2fN|MWtZlu!NLEjax4-|tl>)?eJT^<uqG2Gxc<iY;F$pjVz!NUuVr
zm|o!}{%aS1YLZL0UT(xR{>kN&axC8NL#jXhuVz^ONk+bw31$;{-hdNneD}c0pb$yW
z%jeb(|Gx$-21Ae8<=|tlrUg#bN(ioGUVZhk5#P=<s?jx#AH14`>HO8JNn>W5l$z=H
zAMnUsbEULdTr+(px$mjoiDLT}#PT>qD&C3w+N-fV|J~`UW(}>7GHE@=wqS4Spaz}J
zHQSYbQW=~<=Z*N5{sW&yO3(2o3{m84t}nP-*JB#eCT-8-XWozJci#=ed>$4X$z!h-
zhAwzy%|hOKEhfq7TGYSzBn2*i($077XJ}fLlM1gIYm?_BkYBkLoS5l#4ob@k4IQ%R
zTGDEfK4*0sT-iM6y+nJ?M(I1Vc#T7{uG}HnN219SRa+5hkkRJz`uCiAXa7?E;(IA5
z;2*rVC8kgwHgpDfM}4cM$QL2wE$-3t-gic!gztSne#C57skdZELUNbM*e8cPPTsqg
z%Y7uBU%p?36}<cd$K;j6ez?loq8^F(Q9b3PCva7d(HGUf`lO!sZL{tFFcfQKLZi|v
zcItd1Gjt~(+8t6V4|-+WsQ*u?d974Bs(&@#`(YxgXsc2!LmH&hYkTxVTTfC$<F;t;
z<3nM(s-^wWJaJp3;;P{le~%eq`wr73nbE_{4@2DE72mF`<we(1v5r4^-4U|h7bor2
z`QjyR;AgHc#zx7V!DoFm8TGvSqcm*tANpv8g1P>iAMaD*!xnfv^_v=9?s?4J+)~Hf
zb_3JS)5mnEKH<-PS|$(MgHN+e_avdUj`!ZQ`D;HL0A~1|p9d<a^5@-L2e`QZ*6H9v
zs*xgsVnsCBWHX+2GoJU~&Os@^b6cR6@A={zEa#nfW@0@*dnZnA;k$QA!qR9-qzs5n
zqfshfbhjNb{OsMaNZ}vcJv(}-BoFATt6c0A>Ba!6*+deY$6xz$c2J`nI^^Ri^*{J>
zfim&!#MBq7UtIR`h*#5Jo_uEcn~UC@d9kqaV*J`0dW2TvwhqP`d|<Hp+wWa61T;fu
zN&D(%!GSW2iJxLP8*M0`V)(=S(dE+v{xWM~`7Fcb_#}w~Q6c4Xet7`rfi+@{f<7CW
zWrdWcB7!;OzKv+nVzeH!j7*L<sHJ+e8^S1gEQVk^L8!Q9Ml7<$eKXQx7tx{|f}cno
z_As`TR8eI}RmA~V4y$-B09lsJQpPJEk4F*Hk`bql4g@zKNc4x`Ig4gn^CDVQS}_&v
zVviN$EFE&i4{6n99j%I2|0bz=bg2l(QW&3-tWLEw0&d0FCC5KiUyDMA9`nV#Xr#lc
zZjOc>IHC60@EEXFJr{%VFp(&GO5BJ=DSjj}#~{ThB&k<z8-pL4ES<!jN3mMfh;jH0
zEaW(wPY|U3EeWfDE-`xo^3f@FO~4%Evy$}-_1pyPFd;%@PsJhmdVeYw8DEl|->8$4
z5gjmw6ttQW9P<;L2`o!aSPtc>oM4w&n}*$ZO?;MyHBx*2Y%D{C=$no8I4FYBvC#OY
zT=9FgFddgoHqD_R(ihUu=uPl=8=IP{s_WhCg1T@a;(;f`S|^f?e~}^|sZTp`!~{jm
z%*J6{5tp)&0=+QjAQ4xEJqNoGC;lr3O(v}{KNd;3NWwcJFIVos=TgI0^6_lL{;v{5
zVKU5WUoPG;P8}_&Y!s!*N2C1&eFQHOG!r~Q+&|OkAL8dlGO+o=QVeHUJCW89oFX_X
zRu^Muu2z(E7#I}`qrGReFO1U5D3grpl2IZUMaIav0aI;Vz1PjyEuv6!X1B$p5?NID
zBq3PdCY~!=$;GSxE<vcgi`C#VOoDPBVs<&~Mo5u3wYD4$di<~W^BQc#pM<jlQ5Ma^
zF@qYbDlpsBLME1qBNa%p804}^r2U@{OY^e|+*k0n_*6D`m_%kZrWpgIz#O%;8qXu>
z8(K`@R2?qNgfUbyGu2u*mINR}{CpFdQ7qyc;KO0{nFhQLWuexIqJ+KyF<2?~G+`x9
zi|b98hI?XkGv=Bir4AM)%9~MyN^!CoGa^?@69eY;Rh}xZm$6=Qf3&#Kj9CZ}6B+U?
zTK22R8;j^*a2jVyC0Xh@hNTvyi->lVXIMzDR`HZUww-iZOEOC{3o<I5MLCsunPrR)
zCYwfEJe?qgz)t3@#JI1BQ|&Tm4`>o1{?(2x2oZH1s6ngvT?abltb7|{<%g2iZpD@D
z@@zH>|2BM$JK`7H5&bC3BMdum)=XKGX%rWBz!f`uRF6nAcKzV74JJ>X5&1vF>(+<j
zl0ZG0caMt}Gj__R5G_{kL^Tz`nVs-jN~G2r`FLQ|8VyhQ%B;F~AtNAsiPYR0<nXk}
z6ISJMJ6M+Z^=`yQX{py*qShfP=+-G>L>Ur9@E$Bw9w?$<4@P2~aPPq`C4Vr?gI)4$
z{ihh;g@tg6bzR6n4yD7!yZ#X<{?LWGvFQ}y9T`Ib`-GA=N6rTfE1V?-Y%Z}LCQQ@x
zBk}ZJ_(o19`f%%|4P~KvzUgj^!Yah#eRA{jMC(2*F|L-ZZR)vwXwiq24~j`yEtU+C
zdjNS>qRKW^*WhhTklp^+0b~wtqE&o$0LfEGwlyfBAag}!c46tVc`SnnmV_cXsVpqW
zFPk@j>1;8jW0L6YkiF&I12Bt*gD}ZZTMmL5R>>8jXCLB1>l@|0SS_cW^6?~yWNPwh
z0^{{I%{$Gp@sh`u5NKzpLTo;S$HE`_q50`u?<QaS56K=ACW5-L0OLh&H^wQlQkuFE
zZ_<`q#er^2M!9;n8%AK2IR6YL1=UK;2g!WLpm|#lmIbB^ri6@U5@_plXp~J*LGZoW
zj}(2!F~LshU>US=ns^dTH5KD&r0E$+qik_QijT^oG3~QmVIyc9PH;ygpFlZoi>FQ?
zGh91}`LcecjJC_|;@SyBnY8XXPW=0XYzS7>@f`e!(i-US)vk5Xm&6y(BiB?!nu|r|
z3;2O?lN=vacfNpBt8KWGYfb#SUHj6@uy<(vow~*V7T7UhY^Y-EJX)`B4Rtsg8XYxm
z=5^Gpch_vxntyA6!_m}IU0+wDT>}H=O?B&7mF&@Hs3=Sh2Xng`SuT0AfuKx6YZ#F|
zZm*-M%H!GG$XskKku46#<fcZC*U{KezlFJo6yk8yG&a<<Fy?Nk*}^Uj=I*q7v0LK!
zD`){k>}e#f8oo=kYvj>;gK5`|mY(n3FLZA(Y6y&y#OTCmCCYYDbE9fu2Jw^AC=1#`
zk_6|~d#7>5VD6RU0%jFgUxzJ>YQU}x=(94H71+IOs|Y-Uv6v#J&}*tFJcCC2;71p!
zd6Jq|GL2FQoHWfRc!jJ!Ev}!z#SZPys-E}(1X_TDpPe*KBhbRq?#ba>l)jT#7s2=L
z)9<B3i=6I5Mz<R?6VMelc<w^=6Xb9v&9#1`rD!-iT4J<}Z4qmJiwW4R?)oiM#XJX#
Ml$)&(i_by*KV+?sIsgCw

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 7d90f14..08c17c6 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -430,9 +430,9 @@ def render_env(vars_, s, st, service_name=None):
         for k, v in list(out.items()):
             if isinstance(v, str) and re.search(r"postgres(ql)?://", v) and ("railway.internal" in v or ".rlwy.net" in v):
                 out[k] = st["database_url"]
-        for k in ("PGHOST", "PGPORT", "PGUSER", "PGPASSWORD", "PGDATABASE"):
+        for k in ("PGHOST", "PGPORT", "PGUSER", "PGPASSWORD", "PGDATABASE", "PGSSLMODE"):
             if k in out:
-                out[k] = {"PGHOST": DEV2_HOST, "PGPORT": "5432", "PGUSER": st["db_user"], "PGPASSWORD": st["db_password"], "PGDATABASE": st["db_name"]}[k]
+                out[k] = {"PGHOST": DEV2_HOST, "PGPORT": "5432", "PGUSER": st["db_user"], "PGPASSWORD": st["db_password"], "PGDATABASE": st["db_name"], "PGSSLMODE": s.get("db_sslmode", "no-verify")}[k]
     if s["redis"]:
         for k, v in list(out.items()):
             if isinstance(v, str) and "redis" in v.lower() and "railway.internal" in v:
@@ -506,7 +506,7 @@ def cmd_provision(args):
     private = sh(["gh", "api", f"repos/{s['repo']}", "--jq", ".private"], check=False).strip() == "true"
     key_alias = f"github.com-{s['repo'].replace('/', '__')}"
     repo_url = f"git@{key_alias}:{s['repo']}.git" if private else f"https://github.com/{s['repo']}.git"
-    deploy_env = f"SITE={s['site']}\nREPO={repo_url}\nBRANCH={branch}\nAPP_PORT={s['port']}\nBUILD_SERVICES={build_services}\nHEALTH_PATH={hp}\n"
+    deploy_env = f"SITE={s['site']}\nREPO={repo_url}\nBRANCH={branch}\nAPP_PORT={s['port']}\nBUILD_SERVICES=\"{build_services}\"\nHEALTH_PATH={hp}\n"
     ssh("root", f"install -d -m 2755 -o {DEPLOY_USER} -g {DEPLOY_USER} {root} {root}/volumes")
     for v in s["volumes"] + [v for c in s["companions"] for v in c.get("volumes", [])]:
         ssh("root", f"install -d -m 0777 {root}/volumes/{shlex.quote(v['name'])}")
@@ -579,7 +579,10 @@ def cmd_db(args):
         if args.force:
             pg_admin("drop schema public cascade; create schema public; grant all on schema public to postgres, public", db); note("dropped public schema")
     st.update({"db_name": db, "db_user": "postgres", "db_password": pw,
-               "database_url": f"postgres://postgres:{pw}@{DEV2_HOST}:5432/{db}?sslmode=require"})
+               # `no-verify`, not `require`: node-postgres (pg >= 8.x) treats sslmode=require as
+               # verify-full and rejects the cluster's self-signed certificate, while the health
+               # check stays green. postgres.js/Bun accept no-verify too. pg_hba still forces TLS.
+               "database_url": f"postgres://postgres:{pw}@{DEV2_HOST}:5432/{db}?sslmode={s.get('db_sslmode', 'no-verify')}"})
     save_state(s["site"], st)
     # Dump inside the Railway container (pg_dump matches the server there) and stream to dev2.
     user = rw_ssh_user(s["project_id"], s["environment_id"], pg["name"])

From 888ac34ca6826e547b7a4ba9ca7280f7a6570063 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:53:09 +0000
Subject: [PATCH 011/104] dev2-site verify: fail on connection failures in
 recent logs

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 116218 -> 117469 bytes
 dev2/dev2-site                            |   8 +++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index b955ceb372b5e142f4c49156b4ecdfe21d4d57ee..55811c30226ea5e0a5d8fd16ed1fbb585a69f26d 100644
GIT binary patch
delta 3368
zcmcIneQ;FO72n_6kB}_+00ImU<nfib;F9o7@GEJuND`7jHb7+xVYB-JOP1Z`zPCWu
zHH#<~TaAGLmmx-iQVn1`GAIx1IDE`7#c`a{Vn<D(t*tXwr&_3W6zg<)&RZ$yU-ggP
znfKds&pjXaoO|!Ncfa~+*44dPd2i<C=Gdq`R(*0q!u3ert9fWr@RbZG_yn8HMmzeQ
zc*wjq1bt3ymtA?7;(k=I*&e4)f5#@vN-@E_k_X{Hm)ST1VFf+r>5*`|kTx%jLor-E
zBr3Y(^&<H3l=O|qZ1kEP<MFf$-DdU_Tm-h7znuyV=#dLbums(5M+xr65%XLL5_Ux8
zpX{iUldGYc&rQcA%rVCDoVkT27)2S%X6v<u>?wpWh8RSvea_H`mkN*BGvhr4MTI^6
zSF_VOsT@(C$_Y(upHCB8Y_Pc1{wJ%GzHRkkw=v<SekzB&PENUdZGHA*$Z%mZCjNKa
z7Mc<oG3n-nbhk13=1^$rZ3>g+1}{A0i;q#_xWU$83zgj7^V}(4_TmkfK@!O?WJEz#
zIucu_t6r}jjs`V#X4yufqcLwV7KsUU)_uh@)s(tUXmQmW4Exj)U5m7-dU#z_3#ma(
z7~!^XFkomYzi-K+7JtnH4ZiA@DqmA`s;aS}!B^GX(p*#TYh2!(@-d^yw`jTFSDlIn
zbbU)qgw#Od9%H>0HP}cv7FF8<;fNMWg<_hnMq`GmZ4K*2%Gc1?yr^+`Lv@LoN~wlO
zXkrmZ@YVN>;QtbUk^X)Gs0PKTdZX%s<UBPPi$=8|hwkOj6GBrX;V1<kj;fRxH4@Mb
zS`>97^<!-+uhqhwK{w?;CbSmrCS&Q%nh3XbEVL8?@wgg@>RU9StE~w`4I8?prRwWr
zTW)h_Wt!aS>YYOKibPc15;oS;+Gk9Atz8jrW1G6B254T|);P^n3wcC>_UNE1<JB`<
z$elBA|ERlZ!-?^HWQ!R1aEK&i{!xsPS7)HaF5-%;JBmBxm{JUNpC+Mm^yyB;q*~xZ
z`h%R@C)@Y?50B_~_Al$-G%)H=M}PY@n{8IuL0GhbQ8>0Z{%Nzhw>rKc>~vhW@H4^+
z=eDZ%vT}Cn-NBzEujCEeGrfPrVSm4GVA#OSffYx}2d0zyyf_<CH!*fNI@wfy+OgAq
zWysL(Y4)9oONDh8t1iyHl)LQhAx&5EM|B(fR}c8!&Y$&46={@jP)K2JyJ9BF@UaU|
z$hGtF6wb>}=VLXMpd}0NIu6L3a#T3qqR`$k8_V&IYwT9eM=n7!m$$TT#NzQlYeW;j
zF)J!C0Z7WVl_+)oo<y#jdn$3z1-G2D7|-I*^73LTdqZVb4JP6P>8ZiL@OL@27E|#T
zSyxL%^>flvs8s3Ou=|E88%vR89;(G(ol~~4-+c@}V|bMz!LXUuPYg2ksr>m;94y$*
z^je0K3@^wZEkjquLrinc7QGBd7<k#lW(JN>@RSA5V9?bTju@H{UowZwlei(LHDSPQ
zqq&Xb`CU~qMgQw2Xjx7du}aLgRfyX0Yx%p?Xvcf9at)>9h77F10(8g&YcS27O>(nY
z{cqpg8K17fzZG1Sp9HXy(&TGJnKPFJs?B68jv$9~AsA{+ZwPbXEF`+YY}0UR2v*4n
zQKayk`Aihofq?9a<A*pSKa69eYYc0Sm8&*kAI8h;n=lW#@=k#zZYw__j;uhY1uC88
zB)ZhRASk}70#>W!!C_48;B4eI`TV|y>Xyo-H7#|%2gQ$hxQx?2lVLW4hm$mn2ki3Y
zPL#tTKkh^)hRbjoL3GNu(s+`3tG3Y;ljezSSPG=1V>`~dI3}UUH@8D8>Sh!7vc>0#
z^4K%<P-gVYC6D6FH`3;?$1oZ0m82S>PlwZ5j~?|#mZ|N47(xg2-KSvCJnFkJ8Xl>2
z;VgEU#ZO~6Cf&y_Z;;gnag9AzP=C;|va+c`RPs=>BI9FGxbJD&n!DwmZlp$)F~6R}
zT+YBr6NUDkjbDtD2N%F4AJ~OiSSpjdu*eyp!6(cMyXf97XvqkYw6!EPvUV@(@|c@+
zQDHP<swkAt@1>&QkRR>EoZ&2%%uySBD_a&f`kU_+HL`RcPC3>RU-s?79r=-1ASBjN
zcQ1XqDogqKF<+wCKGyPPIhsymqK?7ZL_xXb04CowZu#YsOuk<_fIdu@wY``EMaFue
z(levG7iDNM&-KCytd+ld2Gerd$=E^mn9g_{+lS`t*_o)=Pc4Jxv4N?2h9JXt_R1J}
z=mnH`YIx`Y&b}o+jk}hKTQeWWyn1<^#D_0onitEXh*3<BmeXFuNqUaG{~|`Zth4Sh
zzkU&)!DXHE)AI8psC6x8*%i`v6bqe#=ws$%NAZzext84%m^jJY^$YYl<dx$n#6&s%
z1eVD^oIsg;_5><=USE_gKRkiE<>FUp>sm5XS!OB;JVF`;p<-heZ3e5gDWMYC^9m03
z9J6QCXw$K<eCAc$C3_F!8}4+OdlJit^~V#a%J&)zZ(0b=c&St#KZ$xW&ttdT%2mhd
z4S63s9Vri+*pHd=-cxwIz$%EhSHR1s;7MDxl8^Zy?)PBO84ZYax>Yxm`I+|+y>-07
z^;)pqDx}FFUT-|n8VLuJx!<}otqMDswK2R-(6dNfAd^X#*DJJ8Of+&{V+?Buk_F7x
zHNzVZ%*{N9gvNX~nU3j(Hx`X_h%j@=1w9mk2_dv-utU6?S<*A|&}k&;92LEW;uTi4
zwhHyPE3*(Johjqrso-3h1(yTCi!AsAT1Q0ep!5pfx*}Wde+>`jKg=c=E)i3I<K!<f
zT&biR@gdYI^y61rluPX$bU8+_mKm)|P@xODRf#KfL-P-f8A@kn%<8o&X>-!+NGqf6
z8RpNkUCzt)&$VA3UFa{fUoLa{=SuSo-FS!PduLFJZ8G~TCeaGs#XqxU<5@`Tmmi+R
zmuc%VvVym^a2HS2`sZNf;#SDt$%+*`UqXU!7%`NAuaV5rx9V#-cdZ&`CFxdvtkhUJ
ddsvZc&eJ~IZSFXa_Z3$met>`6B_kKm^&f5Rn&1Ec

delta 2275
zcmZ8j3viUx72faP?1p5`<{^-R32cB6H?ScF25ccfFp-ca%@R>7#LZ>{Yr-ybcQ<r*
zC>X;-M<Gry9ErsMmWsmoD3u#2;UyUqTc4d$(@96L?Mz#&^)aQimgzZvbZGf!?ziWj
zdmi_kbMLu3(wqFR$CI6Jr=_J@_`ARS*h5~U)A^bc4F(eAGw>;5y55R?HYD`l$6&7w
zowU=5X?R2*b>f*M?9lbMB50sTzdjBQJ2vT|+b|vW9>Zc$JLvNqc<}^P<YG4ZbUYW`
zc695MX?PRZpg+h*0O+AR3s8e@+FF45IHb=MAZ9h923@kEiuP5)r4P)&d!Y6r<fTtO
z%$DVYC2nbPk*gZx=+z>eb;e+^4BI;bD%cu#r_tOJEVf5k(49)XC75T6NRTvAf*glt
z8)tY#9smtGF<DQY&70O=%)wvmc$7xwV+T%C+XAfO-MzH{gV;mcOR?DYHY>fae_4u)
z_K6#qR%r~0v`{$eibTWf*ZZ2=1L|EpSdPg+oJJ}z%k~kA{8eY(jea|9^lA;B#mBU~
zmNR0fEw#wQW%_9?{*6!RKppaNiQcTkG{={$^)-*k!|1u@(%JR+%r<Q^GgPm@PXvw%
zL<KrHcJ*7Ku25kk`ZGF(eo)}&0te}%M(kXi5c&~;K7m65k_#0Rkl>W;R*Carduy;g
z8c^yV!pY{`sjKw-JvijJ&Wv;`Z*9aF&0c&Z0?D={X65NmRwHD^uc)CJZMaA$n>iC#
z>G#dJ6F;PEKMGTmS<WNsSLlS3i`(YMbpyYnhgz``DRj0K#Wn}8FVt6C@d8pUOe=wM
z{o-28fh~*aO8rR?17om)eyp$&`}KqfJ_mk4ju`I6AhpD>&Ymrr-=T{!?8a>r>cCt$
z=wJtG9A<i2Brqp^-GQ=<c`RDRBT~=su;mZCuD_F`gB#H4$ajjBGLe;_)fT3PoedS<
zin{WqvgON~sw?hO+bF#Yxd3^(@Ld?RrVE>pL4WFkA3vh1EqH=w7q{@%qPlo1mIEEs
zxeaIR5{t4><#q&ey2VGSRPq2*ZtEz0i!l1>t?fAVjkMnRD5k>E$f~V8B7Cak5bttb
zOV*bkgBpWuYV1LDg2Aha%s{BabyrP&V|i2glBULnno?CjmwRv;kL%}lAqzPRWDnQa
zO`ZCiY+)hKhm%&8HPop^^!`&=#5Xvz7aPYHiD0dqghm0$naZ*fN|8tBdQpNpy4s7o
zZB4w;rI+mHdz`UqREQ<bYAmJmdr<8ZZo=*ghN5AY$|6@EDmZJceVCIaVu@5&UB$|#
z%6jjLQni$h^kE=rHS=lWZcIvT5BpkFfT!L1$!AbyooM<n&AXYamI;`r#z$X0i>cq5
zG`&UF2E?PgAA8}Z^Zne*EOezGE-a(8eJI8%y>K6Fz-lVrk3vU~jqTwP*=)9oNt*U!
zMat~aV8l_Sfa$VEsA>V9K(Q3=4uRPM*)-`e3fxO&X{n^y6u(`jrimL{pCG(y3bA;W
zoJq4PZbOX~dK^7}7{_wV18m;<<y;D0G|OV%^#UC~f-hk=@3|)R5~^<Tis}l1fQ8;I
z!6dqOKb&d)STxKHQ?2KfgBma6&sO6?$}V5t6zx2Uy-D<+0gR<TYRu#cpFW0JG~+lk
z8V4|wG6zshpB=+kOr<`Jd>R@+mM9da=SNF;Q|8xdv`nYDucIFYV&E>^PNzk9(Q&rv
z9%U8ME64GD%rIw}Go#=8R=LG<r0B4fT*on)V!vR8S)&TyICPxAuXzt2pTM>Zvnl>>
z7wi~>+h_JmN!2hGxiM@D`P7<-**g>I9#1Ij@ds4Y<6j%_x0%f}F~;LrA8T$8`pvdF
zoV+f$M)|l2zQHyUc8^B|TEePU^0-dm0ZKoK@kM^76Ao4lN1~o^s6DRM2q(?s@rOhH
zm{Ng|KdyemHn>oO<UNT5lIWe2n0}Ahk<DiO|J_$9IU;5WZ|c(0eU;pOvuaB2nt2)2
zR!*Ce<EoOW>J;uv-zbs-7nm7&TL0`6vW$$cES62EG~R2AGu4h|+IAM3jq&cxhWVBc
z=BIe4SU*e}>&>-(m}~P+p}uqcKs`q%&S4fd(Uo(U!bM0Q;-5RHWC#SJ3q$zlX7d5L
z@x1I1*XDnKn;x2*qBMh%heOG$pi%{-_m5s*vpLR_so8nVpl`%$hAJnQW2Cb4{D42H
T*Ph2E!|ucqeBq+{3)uNzRperd

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 08c17c6..e5cbfae 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -716,6 +716,12 @@ def cmd_verify(args):
         ok &= good
         note(f"{d}{hp} -> {code} {'ok' if good else 'FAIL'}{' (pinned to dev2)' if not args.public else ''}")
     if not ok: die("verify failed")
+    # A green health check can hide a dead database: scan the last minutes of logs.
+    bad = ssh(DEPLOY_USER, f"cd {WWW}/{s['site']} && docker compose -f docker-compose.app.yml --env-file deploy.env logs --since 10m --no-color 2>&1 | grep -ciE 'self signed certificate|SELF_SIGNED_CERT|CONNECT_TIMEOUT|ECONNREFUSED|password authentication failed|does not exist|ENOTFOUND' || true", check=False).strip()
+    if bad and bad != "0":
+        out = ssh(DEPLOY_USER, f"cd {WWW}/{s['site']} && docker compose -f docker-compose.app.yml --env-file deploy.env logs --since 10m --no-color 2>&1 | grep -iE 'self signed certificate|SELF_SIGNED_CERT|CONNECT_TIMEOUT|ECONNREFUSED|password authentication failed|does not exist|ENOTFOUND' | tail -n 8", check=False)
+        warn(f"{bad} connection-failure lines in the last 10 min of logs:\n{out}")
+        if not getattr(args, "ignore_logs", False): die("verify: the app answers but its logs show connection failures (re-run with --ignore-logs if these are expected)")
     mark(s["site"], "verify-public" if args.public else "verify")
 
 def cmd_dns(args):
@@ -979,7 +985,7 @@ def main():
     p = sub.add_parser("db"); p.add_argument("site"); p.add_argument("--force", action="store_true"); p.set_defaults(fn=cmd_db)
     p = sub.add_parser("deploy"); p.add_argument("site"); p.add_argument("ref", nargs="?"); p.set_defaults(fn=cmd_deploy)
     p = sub.add_parser("vhost"); p.add_argument("site"); p.add_argument("--no-cert-check", action="store_true"); p.set_defaults(fn=cmd_vhost)
-    p = sub.add_parser("verify"); p.add_argument("site"); p.add_argument("--public", action="store_true"); p.set_defaults(fn=cmd_verify)
+    p = sub.add_parser("verify"); p.add_argument("site"); p.add_argument("--public", action="store_true"); p.add_argument("--ignore-logs", action="store_true"); p.set_defaults(fn=cmd_verify)
     p = sub.add_parser("refresh-db"); p.add_argument("site"); p.set_defaults(fn=cmd_refresh_db)
     p = sub.add_parser("migrate"); p.add_argument("site"); p.add_argument("--yes", action="store_true"); p.add_argument("--redo", action="store_true"); p.set_defaults(fn=cmd_migrate)
     for name, fn in (("supabase-stack", cmd_supabase_stack), ("supabase-cutover", cmd_supabase_cutover)):

From 5175bd8d30fefda339c60bc695f8220caec29dda Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:55:27 +0000
Subject: [PATCH 012/104] dev2-site vhost: large_client_header_buffers at
 server level

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 117469 -> 117776 bytes
 dev2/dev2-site                            |   2 +-
 dev2/sites.d/agenticjobs.work.json        |   3 ++-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 55811c30226ea5e0a5d8fd16ed1fbb585a69f26d..0c86863afcdccdb68763e868224f4b87881b2cf8 100644
GIT binary patch
delta 1950
zcmZWoZBSHY6y9fd?_F8gCD8?0NmdsVkTpfKlF&eu4`Cq`(KHv>yW1kLOLvz|b}%z+
z`WVMCN#D{TwHdWSo#{v3#sN~(&~mi&ha;Je_VLR`9KX`i={<KP(01m1&e!vvbN1Zx
z{<7Jy@gsxj2b0OD;Xl*711qnsHGO5mnpEw8o?X^qiqf5mBhYWeD}wUoc%-A_gx#XE
zwCOuOcxJR!GD`_vTDq&zMEH>sReTtp`M+=yg@<2QZD<pvF>QKDn>?5znH`z{`%)`W
z+YE#elSZ>z<ixR$5L1R?8?k<bUK6r#vig&rY=b0F%554cnd`=f`Zy`I<8nBWRoD>=
z8(VHia{2gS+zFjJ$=;=lW`QOY6V>=X(@AN=coT=|PYu&2bs9RbYINM7OG@w3cC0T?
zX7}wFfea?5;iNIASq`jfb;+Ju_8<+(>=uV{5sSOA-s2Csnrc_M>H<=$D_9@#*!qzZ
zNzXAVqb6dX*7yaV^_TnvPb=R~;vWMS*o}0YS>x8<&}dR5{T+^t`s*qVXf#dw0)dM{
zp-AA7LZMXPArjnKCRCGHD!2rGw@|2|Sd+enoNmDzwY+5cgf%4c#knHSk}npDoJoQ^
zi^NJU9GXSq%OX#cFD|2?Pgq956=JbLwTcbYUI`iTB?fjj155Be%gV%gYjL)CSQl69
zFdvTBlRld8ghMFKR#GRU-++V4y=*kc;9I5P1uO?nDaUhhQ^XmirvT-A0*Yxq@(uWv
zRg|F$zq8$C_!|T4Qzs_kH+I~KG~8DHbiyuLck|K72MAgS!r<^TY1de06+Rag()Y0Q
zRp^{Xqm~b<G=ftE7YJ^1=oh{9jUkUL-z85HUlREq+p`#-0ZK(RHW*+~F0Fv9!;h@8
z4h`sMy>&>%J$A7UZljSe*mQn^S6R0iHl@Lh2U=WYE4`>j96RF0RG5_;UhIRY<2+fX
z?DpX~z@l8L$GTV?Vp0p5L@UL{vU4rif^p0r#!Q&mt}qs3B>N|fJj_yNzmC1Ju_K9?
zN4+MnTW{f6=$WG(&qH9Zw&M+qVt=$_0Hc(1>(HPTEzy!i@8CrY8XMjPe=<vWq>-N>
zzu99(YKQHvLAmlC<Pos4s!a$b3p^Sb>G6kcb4$ys3S0&GuByt?Tsc#@vI%FAGKX^C
z<%4(1*QuX8Zuje}^D3QkKKtoIbSF+DMj4H?ieMI*79B$_#<QcFk&Tzwoz0k!I%W12
zwCbLyi4r(V9Y+c4`xpz%<c)~7dVeTjlP%1)74vw{-mRFCK(vU_=A2jUDk@*NC|53F
zd$;0ieJ%GhE1#s;7^szGpR#@%oI0zTUrn7wl}ZWJk0P;~pTIttPOTL3d8k^(c61_(
z^=;?7r(;*Q!-i63+QGkSjWT-&1fZ4`>_jFSmB3E4#Y~TOPMH_{SEHOXCxJvTm6mlH
z!E^#E8`p(N86^}dq(Q3m$z-Z2hI&mQpOg7HJ)w+rntO&;P9l8_+tY=U(Z$bHTKD2F
z;2@Ltqa<!I#j6QC8g@FHFW8cuFvqxCLV+;f{Gf7wKZ0iQ;rj{qU``UfuSmSZ;SV_6
z9y#Q2`#kOj`2aiFgUMsQqoC+;$Q~&mS5V$&0vC(#MdB1M*CVkGM{^(;as>R1t@29p
zm>dpw!0&F6Wsl$8DxZ(GeuypXMFa+RsuxpBAAOp#%sFy9!DCMtRE{=S4ieN6_z2#n
zJ)^ajjY`Qkcul}A)_oLDV=cRS6cdom;*W7LL&-jd{a7}X_OZ%p0fU-{z(imsP}fC$
cRkO%cH(YIGs0X!tkmd9t3muBD4=uWX0eh40qyPW_

delta 1674
zcmZ8gZA_C_6z<cveJia+WCa92S_M?Z4w%FZ7ai!F_(9A3s>xI!eJe7Q!fg@laBhl5
z&3-Jyc{UlFn7L@g>3-;)$s%f^Ax^Vw%M!tu#eMvpnvM9CWxMCC2J|NPdC$jl&pGeC
z=Y05y<JQLx_xEnM)1p?#>u29?ecye?jU8TV+(x%GyePl(;u5Uu`sL2an2vD?#oO*^
z*Nu#Jn_<mX8e5D^nv;v%P!=og4#tFA5p_iz_Y5(6*!RIzn<bv1sOB<q+F{r^V3!J~
zWakrkyfLBk_Lj`fn%Sd@m1|<R;{=jNV2NiXC6!b+CXEQ-?bZz635`k?;DrLsm^{KY
zWrUnNLeA@UbYiQ=`P5|O)A~H*Vk+&-!!>N6U_M^8JAG=&WBE8~bso1`EZ?XdE0HzR
z)#czO?JdAhsX_bS7R!Wc`#p<gOtqc#Laf0)swu=kPGzZnQ5#)ZlzMTDjb#sGf04bi
zR4$*1K?lxBe<_+%a7lhX7i)p*^6@<UqvJ<;cOil*g)Co$`40R>y8>8+KWHF;$GAhk
z1d)&5>2VNw7?Qqf<mx#`Rc+!7Lo34;b!}phrN3z1Y8=<kviuc|4xzh*|3#cLX$;pH
zZZZrh7}Pg3Y>G#Oc)%9EbMcS{LpbKLXckL`+Ob<!+F`&ed)FZ1fG*Q(AvF9zyTfS2
z0No42i-$DUKo}{q)xb0jx2U@wA-HI$9>s9WsT*+;x>ZFJRyojsR{)PpZ$yU+eMDQZ
zS<hx)4msO!5EH4V4YT2<8*NyPG%DJP3Y5u~t>|^R(wJDm#g3)v9e5cU)pno^HagUS
zcacunyKxuk(zyqXR^5|K`OaRH<Ee6SpL%+P<e&R-WE8S#ZztmF_`jXVLV?UUfS)mC
z9-n)tZZ#n8a;|cv586T%%LAf<T`R5BoC6P?K7f2$a1h%wi`iVo_qU3nj8%`;x%vKh
z3eJO0_YdMFRMQN?8>o{lgl$?{O_HRT=I<}2M~AR9m8}Wg*U%J?`h<s8bYY<?@6#@n
zrZX+!^aU1%YAS;(R?ZcR>DMlNYpYdusv=C%H%03VQ7`*GLqN+h<C~!iInz=G^AW-{
z?J#nmhBGt8H%2(y+QaBZAw4>*n$1ey9{8}7%6rr+*2tC~*nwJVJAxUmMiuM}wPQQL
z?J-GSJ%W`fvywl;iIy;!DFZB3F@zb4xmimXW-(;bo4uG;u$Wzo_^wU*3|7q$!=;aB
zTNU*vdipY!`DqHQB9rAT8tlcjWaAge-jjF$oTH<sutZ<Q{?#;e3UeT2@oB_T^(Vt}
z{5)RE;$cdR@%x*i{%}OZ{o##~aHBXw|D8wS+RN<J{eBTKq9VwVq73U5B+}R%i^ToS
zb+K4mR2U+{W|!aJ9F4{O(WXt?L<3vget$UH6mAtF(iGk%ZY1mOqdk2{sNTQ@6fb*r
zE`?AWv5Vok`Q^D3AqK%v$579(oBNKRMWo2>7tmtImvrYcitrwJuV4yFXg+^t$;cIa
vjkkuwK9|`{pqp_RMl-k>%+@g{s*F{$<IO^bYcSIbYU;;Kd?dU2(W?CqpGu|S

diff --git a/dev2/dev2-site b/dev2/dev2-site
index e5cbfae..775c458 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -694,7 +694,7 @@ def cmd_vhost(args):
     conf = tmpl("nginx-vhost.conf").replace("__SITE__", s["site"]).replace("__APP_PORT__", str(s["port"])).replace("__SERVER_NAMES__", " ".join(domains)).replace("__MAX_BODY__", s.get("max_body", "64m"))
     for p in proxies:  # one more server block per proxied host, same certificate
         blk = tmpl("nginx-vhost.conf").split("server {", 2)[2]  # the 443 block only
-        blk = "server {" + blk.replace("__SITE__", s["site"]).replace("__APP_PORT__", str(p["port"])).replace("__SERVER_NAMES__", p["host"]).replace("__MAX_BODY__", p.get("max_body", "512m")).replace("proxy_read_timeout 300s;", "proxy_read_timeout 3600s;\n        proxy_send_timeout 3600s;\n        large_client_header_buffers 8 64k;")
+        blk = "server {" + blk.replace("__SITE__", s["site"]).replace("__APP_PORT__", str(p["port"])).replace("__SERVER_NAMES__", p["host"]).replace("__MAX_BODY__", p.get("max_body", "512m")).replace("proxy_read_timeout 300s;", "proxy_read_timeout 3600s;\n        proxy_send_timeout 3600s;").replace("client_max_body_size " + p.get("max_body", "512m") + ";", "client_max_body_size " + p.get("max_body", "512m") + ";\n    large_client_header_buffers 8 64k;")
         conf += "\n# " + p["host"] + " -> 127.0.0.1:" + str(p["port"]) + "\n" + blk
         conf += "\nserver {\n    listen 80;\n    listen [::]:80;\n    server_name " + p["host"] + ";\n    return 301 https://$host$request_uri;\n}\n"
     log(f"nginx vhost {s['site']} -> 127.0.0.1:{s['port']} ({', '.join(domains)})")
diff --git a/dev2/sites.d/agenticjobs.work.json b/dev2/sites.d/agenticjobs.work.json
index 18ab30c..be5e75e 100644
--- a/dev2/sites.d/agenticjobs.work.json
+++ b/dev2/sites.d/agenticjobs.work.json
@@ -1,5 +1,6 @@
 {
  "env_overrides": {
-  "OBSCURA_MCP_URL": ""
+  "OBSCURA_MCP_URL": "",
+  "PGSSLMODE": "require"
  }
 }

From 3362aab347cc9594b982cbe204eb6dfc1023838c Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:57:24 +0000
Subject: [PATCH 013/104] dev2-site supabase-cutover: tolerate projects without
 pg_cron; no-verify db url

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 117776 -> 118210 bytes
 dev2/dev2-site                            |   7 +++++--
 dev2/sites.d/threatcrush.com.json         |   8 +++++++-
 dev2/templates/supabase-stack.sh          |   2 +-
 4 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 0c86863afcdccdb68763e868224f4b87881b2cf8..0bcc4fb6bad1a06ef1170cf65b72f032a782ea4e 100644
GIT binary patch
delta 666
zcmYL^T}TvB6vywGJL~Gs&RSZDuG-bY*_AeP*EBaYL^2CBd(o1@wwcTNG0w!ytje|^
zL4nW*O9mr|;Db+YSdh8&66I6T*O~?iKGb^;_C?S`bXN&4hu=NibN>H(PIAh*Jni(n
z7DX3g=f=sU!CSf4Jx@Fkp5tyi?JpS4r0>tc3kTe>yXQffjNL60g@j-nPY6ow2pA2v
zIu9pWgELsEd2l3!vo;6;vQBMh2q~e2FpXxo6l}i$((-qz31JLO4v<o3f1QUiIBL66
zuwSfCaEh~-38s<KVArRhB5!;QUqGYaKbF3nf+cSJDG9V#BygStWKwBTmC6>8BPJ!I
z{Zu2C-e=ILtVT@JC&`Ac9Uj!LNPaS45-p~x#L6~Fnoh1p`?6(;P?c$Y|BdvBN==#i
zOv@P1qJ5EQ)W;08$S^%bBo_W$22IzfWVb9pY0yuorc{z(b5$)#5GyjEl7L1+ZN^)+
zwx5f;cD^#!*k17-yJ!L0%bRNyI#RPWQdS!mW11=VQzfQSB}~$>1!#qwzf52h+0PzA
zoZH8z!;hc~kE{G9Lf+vlV|<+diBSGE{x@Tb<J%U0Ft$1-@VekhhBD=KD}{9%?)+p<
zrljKyeLwVSDARi}b7^R$S6%HK&U9$ZNQZXJuHw^Kp2OYv7eZnW-f-_qHq92!Ix@Sf
zKDwn1PeC%|yw@~UwdSd?7av2|>qV~8l|1hs)6GVGSy0{Ch~G6j&SIyGCdsEg>9R#w
rcEf7=^K%e|0|!CjzIQ<pRBr|m@1BT%z{Tr)?#;GMjQA2`FZ1{ZKlj7X

delta 372
zcmX>!n|;CzcD~cRyj%=G!0Wm#>pfc|-&Q_Gt0hcA?9(4IGkR^GvV`#<D`UX)uvLsH
z0=3*Ft{|l#P{W<&KG|`BR8R$DF%u(0is5QThy)`;i6?{wRK%FVC<)}G7_DZ4%NnA~
z&Spq4u3<`H2dM<IO{Q;H&8W!fRKXm{P|m1ny8YH_#%)ZD5z{BGV-%TQxt`HP%*am7
zP@zVlBr!8bK{rpq)UD_&(Dv=8*E2dZvWo+aDf-7SeZMiI<aE7_j0sG;n72>Z$QZz^
z<<0zofkD~_M20X&GJj!U;E!VNV7|k_(-GVs*%{d#eTi3ThT9bm<>_f#8Lgy68MtIF
za!UUy<^h^{LP*QkhWV@ws~;PCGQ(tr8zS4!Z)H5h!+2r)q(h9n+{%iKDNLWd7{wX2
dJ{U2u@N`sNVwSwg!qMvXfti6tsz?-Q1^}MhUOE5(

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 775c458..c93fd2f 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -966,8 +966,11 @@ def cmd_supabase_cutover(args):
     cmd_verify(argparse.Namespace(site=s["site"], public=("dns" in load_state(s["site"])["steps"])))
     if st.get("cloud_db_url"):
         log("Unscheduling the CLOUD project's cron jobs")
-        out = ssh("root", f"docker run --rm -i --network host postgres:17 psql {shlex.quote(st['cloud_db_url'])} -At -X -c \"select cron.unschedule(jobname) from cron.job where active\" 2>&1 | tail -n 5", check=False)
-        note(out.strip() or "none")
+        out = ssh("root", f"docker run --rm -i --network host postgres:17 psql {shlex.quote(st['cloud_db_url'])} -At -X -c \"select case when to_regclass('cron.job') is null then 'no pg_cron' else (select coalesce(string_agg(jobname, ', '), 'none') from cron.job where active) end\" 2>&1 | tail -n 3", check=False).strip()
+        if out and out not in ("no pg_cron", "none"):
+            ssh("root", f"docker run --rm -i --network host postgres:17 psql {shlex.quote(st['cloud_db_url'])} -At -X -c \"select cron.unschedule(jobname) from cron.job where active\" >/dev/null 2>&1", check=False)
+            note(f"unscheduled: {out}")
+        else: note(out or "none")
     mark(s["site"], "supabase-cutover")
     log(f"{s['site']} now runs on its own Supabase. Cloud project {st['cloud_ref']} stays until `retire` (delete it in the dashboard or with the management API).")
 
diff --git a/dev2/sites.d/threatcrush.com.json b/dev2/sites.d/threatcrush.com.json
index 5fcf90d..12723b6 100644
--- a/dev2/sites.d/threatcrush.com.json
+++ b/dev2/sites.d/threatcrush.com.json
@@ -5,5 +5,11 @@
    "port": 8270,
    "max_body": "512m"
   }
- ]
+ ],
+ "env_overrides": {
+  "SUPABASE_DB_PASSWORD": "5df2829f245804448a8eb604a4417d54",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.threatcrush.com",
+  "SUPABASE_SERVICE_ROLE_KEY": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoic2VydmljZV9yb2xlIiwiaXNzIjoic3VwYWJhc2UiLCJpYXQiOjE3OTAzMjk0ODgsImV4cCI6MTk0ODAwOTQ4OH0.VRGW__PDSjJQkilfS6AEjFwbe3dnc-ffC57lAxQ2uwk",
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiIsImlzcyI6InN1cGFiYXNlIiwiaWF0IjoxNzkwMzI5NDg4LCJleHAiOjE5NDgwMDk0ODh9.3dJiBKet1EGSJCZoQaMFVD861UxKCboB7GcD-gI0EXw"
+ }
 }
diff --git a/dev2/templates/supabase-stack.sh b/dev2/templates/supabase-stack.sh
index 2ca5892..c81fb91 100755
--- a/dev2/templates/supabase-stack.sh
+++ b/dev2/templates/supabase-stack.sh
@@ -230,7 +230,7 @@ SELFHOST_ANON_KEY=$(get_env ANON_KEY)
 SELFHOST_SERVICE_ROLE_KEY=$(get_env SERVICE_ROLE_KEY)
 SELFHOST_JWT_SECRET=$(get_env JWT_SECRET)
 SELFHOST_POSTGRES_PASSWORD=${pw}
-SELFHOST_DATABASE_URL=postgres://postgres:${pw}@${DB_DOMAIN}:${DB_PORT}/postgres?sslmode=require
+SELFHOST_DATABASE_URL=postgres://postgres:${pw}@${DB_DOMAIN}:${DB_PORT}/postgres?sslmode=no-verify
 SELFHOST_DB_PORT=${DB_PORT}
 SELFHOST_API_PORT=${API_PORT}
 SELFHOST_POOLER_PORT=${POOLER_PORT}

From bada534a03704e1adb3aa0fa7b4276d19453c07a Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 09:58:55 +0000
Subject: [PATCH 014/104] dev2-site: reload PostgREST schema cache after load;
 world-readable checkouts

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/templates/deploy-app.sh    | 4 ++++
 dev2/templates/supabase-load.sh | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/dev2/templates/deploy-app.sh b/dev2/templates/deploy-app.sh
index 05ac592..bf65a05 100755
--- a/dev2/templates/deploy-app.sh
+++ b/dev2/templates/deploy-app.sh
@@ -79,6 +79,10 @@ SHA=$(git -C "$APP_DIR" rev-parse --verify --quiet "origin/$TARGET^{commit}" \
    || true)
 [ -n "$SHA" ] || die "cannot resolve '$TARGET' to a commit"
 git -C "$APP_DIR" checkout -q --detach "$SHA"
+# The deploy account's umask leaves files 0640; an image that runs as a non-root
+# user (node, bun) then dies with EACCES reading its own source. Railway's git
+# uploads were world-readable, so match that.
+chmod -R u+rwX,go+rX "$APP_DIR" 2>/dev/null || true
 log "At $SHA"
 
 log "Building $BUILD_SERVICES"
diff --git a/dev2/templates/supabase-load.sh b/dev2/templates/supabase-load.sh
index 1208d5f..826a200 100755
--- a/dev2/templates/supabase-load.sh
+++ b/dev2/templates/supabase-load.sh
@@ -74,4 +74,9 @@ log "Snapshot AFTER (vs the cloud's estimates in counts-estimate.tsv)"
 strict -At -F$'\t' -c "select n.nspname||'.'||c.relname, c.reltuples::bigint from pg_class c join pg_namespace n on n.oid=c.relnamespace where c.relkind='r' and n.nspname='public' order by 1" > "$DUMP/counts-after.tsv" || true
 strict -At -c "select 'tables='||(select count(*) from information_schema.tables where table_schema='public')||' users='||(select count(*) from auth.users)||' identities='||(select count(*) from auth.identities)||' size='||pg_size_pretty(pg_database_size(current_database()))"
 strict -c "analyze" >/dev/null 2>&1 || true
+# PostgREST built its schema cache before these tables existed; without this every
+# request answers PGRST205 "Could not find the table ... in the schema cache".
+log "Reloading PostgREST's schema cache"
+strict -c "notify pgrst, 'reload schema'" >/dev/null
+docker restart "${DBC%-db}-rest" >/dev/null 2>&1 || true
 log "Loaded."

From 433bc66f9ffe67bbecbff8c8da085957af0f812d Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:00:59 +0000
Subject: [PATCH 015/104] dev2-site: sslmode=require&uselibpqcompat=true, the
 form both Bun.SQL and node-postgres accept

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 118210 -> 118179 bytes
 dev2/dev2-site                            |  11 ++++++-----
 dev2/sites.d/tipoffwatch.com.json         |   6 ++++++
 dev2/templates/supabase-stack.sh          |   2 +-
 4 files changed, 13 insertions(+), 6 deletions(-)
 create mode 100644 dev2/sites.d/tipoffwatch.com.json

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 0bcc4fb6bad1a06ef1170cf65b72f032a782ea4e..164c4d518416933050ce06f4e94c2e267e04bb84 100644
GIT binary patch
delta 3606
zcmZ8k3viUx72faP{F`Jq3Ckk^HVG_m6I{a^DFzZGpd{HOL<x^#*kqRw2-)QBCV{XJ
zm6v5elpj6TASB=eD_U_WKfXpowK(E)+6r!^wli9XcI-evK#<aVZg4<$=Kub4&pr3t
z^SbB$d$c`%UweG=@#JK?MgA7eI=uYw!DRPttTOJ{eaLD=Gy^MAjjc_IN#fyfBFpfP
zmJCH2y}BHU#**E3<IX*sFwA&o&$tYKFTZ`4Eus&ULXo(LewTc29T8`V!0$9X9RaH|
zVxxDTLqDVARKombi%9e*L~Qb{`+NT^AJP4N6vufJr?2AlyNQ#kIB7R=`Zrrb*jnZv
zU?g@9qm<XBbrU=Dhq&bC>1<HDC1RBuWkjs4a#Rn0TD!%c8BQ}+Y|1nabyisi9T;p3
z+*=H{QL}fnb;$A&^tcUu$=ilRmwyN^io`9|$}QCzEY;SvwzYbTC2Od0eDB4CcoAr9
zsuh9g$$cAOzYL4zdHIBn7)zf!pBmK8S}d*x?Tp3Js0lR)Y0(|eA3>bOb<d=zcfVW1
z#c1$%?KbTijHH7(wrg^=utf6@t_NVe|JrouQ9Wu}VUNCj*qVZ?M%Q~GT!>D5-wDJU
zv;OoYtWo!|hvSf7>^uH6oW`_|W)EgN#M2Dh81^viV0e*1H=h0I9@vfVKbkG&Cw_bm
zInk_7$`a*Z&50n!8UH!)lBDTmCniUyeAyewHVR|;m=fI<^E)vu+Wqgxv`H~ck0tr5
zDnp^V2A}Y)47CoE<jSBwkb6BQBb!2jy4tFS#_Hh8246TgESdraeP1JWU;BQx?W(k;
zwbtn9c14%|HwH|I=ATK_5Qr9b*8t0m=(#tN$~9^4eGK<&)Zmi!Gp5@m=k}j3Mul<V
zJYl)<=nq%1(Aaum0_u#e3xlx8_{W90&MCa8pG=(?$JAtF#>I8WG`cPh#YE$qi(LcC
zBs*rU^7+N<(vTRcL^cafH{QN<r#&P|k9<O{(QB9TG#RYCEBz)lepWX3MA^L0%jSJn
z5s*n;hGOlU#WELOPH`DZ_~kCu&N}p7W!ia*uFuuZCq>s>`64c1H7t(FKX%Xi!va_}
z_-L_)P8V+@N;oH_3{%<M4CbZN04pZxEt0M`%dJ=!=j3pSbcTl*decASk%1!mUpyvf
z%;ZJI3{OcNSx!;Rs_th<r?LdhgOm0rV74P7Wmd^26w;{8k3r^uL>O^Mq65j;?@)Uy
zE7GYl1$SUQJ(_~y_6>5yW?prI*7@N!zmiNV3=@4&41K$tdCV;Di-4x@l=L&^+o@=?
zB9C$hVhWsQ%RpoSFPWV#3<DlC-%rO#*jQ9-r?VL-$D>q`iSha_$$HjYn~C^%$KyPm
z%dR@j?Za^bj@8V`V@NU^M`97MlRh4WB0Ns6+b~ssNlv|HF1!t{1f){a7>q>|y)Xt>
zZ3S|s^)ek8gE}*99G-&hdXx{1mzJf{-^XJp8VM6HT7Of@9yP~Kz|n+E-mKN;_Dpl<
zyG5ZKh<iDt3mLYMGZ)+N9_`M>Vrj`wxwsEiR5lIE&`xhmL!SPrTyfI8HVr3iE@gZY
z>r1W=hTWlXu%W?MRTmI{HqR7bFtCQ4vyr2pk|N#a%-Psuqr+aAwsXbUj&Eqa7vqsk
zrWZr-FZ$Apjc`+C2^wswY|qkPOE3c8(v=bncU+W8tX7$?2eIQvw>hU2-|Ba`BvbTP
z1;i9Fyue^GG%MiQub4VRi|0wV^61TZ$ak)1mXF~G!+uJtz=k=hdUKc&Vc;SWoI$~f
z5FAIr1uQrWg8dR~SIoAwwk{kH;xcpkb11J+tU^|wCM`~5t52!g9Bdw#k6t!eKW{yN
zY`{X_RU%tYkP^3<X-iOV#pkrK8Y}QOI$MoYhcYm;M`3S2?zFY?4rNs0#|YgamrXEN
z`!URluj!c@RLE%lP=hggFF8|SW-r5wu*XSSFcg}nYGpa-Y)^@qwgR&fFpCz4(1=C!
zX$TSQGmFA_2igqPm{KVkLb}ZVv}Vjl7f~~0;n4@pxXYH#N;Ambf>Kn|q85znw}b-`
zzswi%g~LL0u+4+1vjvmTi%zzn$e|)0VEg+}&MM^VQ>BtJvuPEI9hgdgT#to!_hG&2
zJoII16YETwTTou$omrV*dT(W6!2<CJs~E#+9m_DDA&a+j@`O%HHeia)#>;!ro())y
zel&0+s?kPkH)5+C**76WyWV_h+h%!i*HHB)T*f7OU^52(a%wFd+Ket62TjD$nnw`G
zxN(f1l{;oxdyaGx+tEosJ%V?BmhSou<{+JtwxCL;I=BT*`U0tErFnV_8WQ@<k*izn
zo=}rKHNH^5BMNDSfs9lYT-6a(gJic_Z>O#Y<mq_JKpt##)j)rYrqrF-sFn8IBJ}D`
zd02MP7dxfI-PHdH%tSGJ>@v2WPNcRcP&+h_owy|J^onkd)eJd~#Z~0b^@_WB>gSj!
zRR+y`5|OlVJaMD-a?V7W)mV8kT@zJw?n#;7xs*+qrB}<TEoKv;$?Ej=h)G%HOd(x<
z8igs$mA$97J{)w5G%9aLK~JKbw7VTSx3g@k-R&)?sJy47{JvaK$P9<OR1PXjyhRIg
zV;Cz`=gX$jjTl6awIiMe?Sf7EI${?@T$Nlw#e_l5x}dxVYvu4s`Gnl)xf{OQg^^a5
zGEZ6Nk&~jBL7kHTjq1R#KGzLVhK82~*w|lp$llS1-sr$|c<6Emh9iy!cfxH`tDRKP
ziP7+xjh)aT4^7KnWII+$#T~qT+x6`~+>1{V$M?j9H!WgN3QCzOVF)nXQs3!x`~XH}
zaXiE<PMs3Jorg+=hbg5elc^F)e;K3tdzt1;XK7*p(*qeU(Snz;5Etms%P8=u!&W4Z
zkCahqR>!oNi@EeBu4<B_Y2+)i2RO}&SFl}6RekctRj-=mn{?$>%&}GQM)RrgAbzEX
zC4Io$au8;U>qf&?y;^N^y*V#>7g;$Ev2V(P*=#mqdc9B7gj7>+?d9>*2R+pR5%yFs
z3skQVCLMeinQh$XWAQ6%YlKfW;bU^tYV&wRz#kN4Y)2!*5(%wNW`_b{PlGQMY6%Lz
zsA0Cl<7o(n!k%D#-D<IdImsSRb+Ep=Nr*sw^=c7gV>HnvU*ZQ2O-Mr42=$#4qv9?E
zkU-Hc3|VyJ?oijpFYgJVt``-jTkaFSCj|Ef!O;?YlvM4CjojF{jD&-7j$(m*9oxY0
z7jwr^r07GRm$X;)zAVjqI*xOO)BG1mG%H%nqNB&;cf)u(e@uQ7Or-uFAefcGYSI}t
zu|H#(n#hpP!y<;)S;ueb_aET1Hud$b^SqrwdD-(3%0u;Gs(e$IV}yCi%k505k0KR~
z8&2O67v(<Rf`acfk;1@tSkIwMvyPJFR358tq~dfVL@GKeZ0pPsAL47xHXSpx?ipnN
H7)SmOQ^B}d

delta 3570
zcmZ8k3sjX=7QWyA-~Z=v1@Bb>y*#{#k3qbOU`EJ8Oe7I6q=Z5R0{4n2a+z~^-taMr
znyF>}<}q;;bb4vEv}^roGb^>mT9cDhGh^b^)S6mroL2crMQr7ovwv*i$Xfq*_t|Hk
zefHUVpS=$UI)hGi28Deb78Ys}e;v7RFW-D5%&`}{w8?vq$_Lsd4J#tFElnX3+pa15
zjv-ZhZ(oYmy*FyyP`CAvM5|0Dcjz9qT^S{)c5}OuA%3^qXEwFNZPUWKJc_MdT^^yu
zci9&=n^=fDxLp;$ihJ0v!tIKCxWTdA#Tj96BJScu8l0%RI3t@)K5Ti|JxaUSm7s+k
zAEJ%y&Weu~8^@3_ou+nK>=WBA`^Bgp?x;?aJFYQOTd^Tl+tFPmkABUe^>@!lyq32=
zNglI&oc2x2aPC}#5W9N}t!Xzel@^++C77z^Rq86G#gv$!9opX)8S1X8@cHUidflE|
zA@yEovxn6#Z3`Sc(1FmOVKTiWKHmi`?Zs>SMj|2-TBXY-lV8e}e=?btN^|5ZCX+o+
z7QBb#xyB%04&=P_4uY)qxoU8=%s>4-Mg&H@5+dPdAnstNDw!nh-NRE<lW;jh;PT;h
zfTT6PnGH2?^i5rcB~bUa9FE&s!v{X}1-|{j3IuD{|9l?iz}eGJnh~Nc_;@#L+7BP+
zjV2S>Zi1}@`v|rZyh@;I3(q_Ri?-)Xo{<0c%uh%TeDT+ZL&RX>Ij=~8-RBModd?T!
zNDKVu3mcH6-8!Fx^gu?h+luT!_kXuZ5&n?uJ08kpKa$!@0<@YRYQ)mBKjf*m#n4}?
zHC(j^rvKOr+!wH27RPl5qOaBfHQKtLjt^Ntr(H-;ENN4&PZsRfYx7Z}oxa9VtCe5>
z1*O_!H>P2Q_S}s)lxc@=EU>1N{0I>}mP%BbHmq+o;<V@b#$dX3wD07|BEjyJt18{>
zn6RN2RV;}FXKGt-riC&=I>qN(5jcBurX+l5{dvTMww}_mbEV~<mX`Natms+U`gv(v
z&tiYi=qIj(n1`;yHIrFcjccKSvY-E94sL<Ta)1BT;<wTuOIX4)By`(JFDoQJ6cNlI
z`(lX~!}}ymSDFRAQcsbw+H57)uxNtc5e(xef)Imw{L3KRACpUq3J7)y9f?*ppHw|U
z5W|y$Q34y^7>qp26GEm%d_JGV%iW0E{>cd45`r~mgz?Q`c*SCDZx|B8v%)bMPx6)F
z7#q4yEZRT|&+*6IaOm#}ri|_S*EY<D@{E{yR!<oYkECdV-lOk{z#17jJZ2OgfK4wM
zg+$<>zSfQeV2%EVXpDzSqU;&o6N81=%E!hcRp}J01NvjJ2nw=nqv=dKtxc~Vi*vBF
z5+{csOfMRbM*)q$HUS0L#``B=hH_9$9nl~74eY^)<i*LDiblR68NaA=#EkzI-<*s(
z{rXhwf_lf%TB@)tlK&|cW6;3APDPS(T*#i(t<!KSIF>f^s}5(DBget=#emHvua*&P
z;+Hb874P#^nRr}Sav>ANsN~66SccvFg)GceJ`pR<>0f2xoN70W4<mhH_1;E@uhHAk
zP+3*yVV~(|b1@q5^GkCuMfs-?xuPfJVV?>Me}6vq;@`Z=g;WgTJ6(v!cl;d})+3&0
z6{0~k^7Jx4T8MG@miHE7tmTH#Aju+FYoYbrbm)mi_)eJ|Ex0U-+_{#hodhotyiL$V
z&`h%zh`PixO2naZ`0f(qSf3=;5(1szW&V8$I`WP5O(q7V6{8ek6hB5`VB|$c8O+ED
zj84VKuwHd(ZC#^>v3}x2kt1*MV~a%YL6{stW`AiU=V*QNVhmM9_H>qGA^?860uz-W
zAu&O}UV(ZUJ=|T573k$X)rhbd2F4C3yj+bmwT*Tt;*;GNr-X`Ssrq6!5@dYE+iS2$
zxbtr{NLIqd%xpbm8D2%GENDiMum7<Y)1Z(&F8%s)%n{dzXZY}2l<_xwXvcm%sS)o%
zdQjqpc0};)K17S?$2MazPVnYtB;z)JxfvO%os>rNi_IuP6;E$L%7_YbM9{KIUu9z>
zV_jr(9ADdl=?Ld~3kocT$K7PVjfb})M@bh-iuB@E%(oze?_Y<qaW>Lx+=gL9ttXw~
z3vw6cx@K486wR%ems`p<^7synRBfcm%(FZ2fU1zNm9OqV8;0|n9jL}?{@8kK5u=Oi
zMNui{i#B40NXJ<la0~rBb0bFm%53M_Mx0d1EllQRPr(y2cufz8T@vMiD?5Zzsf%BD
z3h(_Y-L(n%h~eLFLX`-n>uEG8i-n##{iCPR5Ik(ISnUsW`kKV8sPuW9ET89Vh>0-V
zXB0i72GUXdlXzD-9K2J*%u#e6zs*zM?0B%C@R8XSvu9O2vY;T7P2|@!aZL)je+Sa>
z9Di#EW@0wKu>-SFKnJ#KSr<ci`SYla&!+SA3zJ>!3b`srjC;+Cau&GQESf4NCE0w!
zPP9f&CB|TZrNFQVS<CE;mRKeKY^Mm~!#spzj#4G2HtEG2O|o^#fS8aq&Xdp2@5a1v
z;)?Q8Ti@t)un3;giQIws*!ZeWOqoQo{!oW2cTvSdg$s)_Sw1l=jv_IrD0CH+X7*w#
zGm6_pK4m@PxVKZ3PDe`C_^GUboA-d3E5#B%i6hQh=N0{JnHWAVKA!_d3(!yR!Fbtj
z*k_nFNldZ=0^>Hgx!Q$<VRtMsENxuoA!}!Ji3%~CztDwjOycLeFcvbu-35ngthVv7
z-AKX`y{H=s#MLO-kBOE#p?Du{zvj;NukObuA*lmSp-txz7zzrBauK)*k}0F65~LE?
z`N7vPA(0%y@+fA8coGc_6_bcE^u!S5;<to&)O?~T#EBA%B6=i2KTmrdW$5GD>&SH)
zSE@kVNg-pz*|>~GZ7jNrYm~x?TzNy>belf?4LmDF7}apFqZ=jhIPX1-{2?W@(INtm
ziGPzSLghMwNW~{OhxFPb(8KM671}7ycUR-|6G&WR)NL}R7ukvERq88QjnAmz{-I8%
zcyd;ISfjIgnWuV%QPlmxPG>_?Rb6ehKg{W@t*Q4ikF(Az)=;(Y4O&@S!zx87J}pLm
z)#+p&x0e->i46o50{m8D`#g=#hRSrGuf@yUY$@?ALbcb|==9dtwXx;I5nEJy>#Lg>
z^VC<jvGW5?J|TYC4IXzAO$g#UP9px%!Ioiki~nyA%;+kH<L+rA)E*cW3`Ra<bh(UV
zX6vbZQeLr8Zasz4&{ec2!RNZ~6vCA;FACblsB$Dqu8U?0A}-RuH>}y9Ssp*|p?EB$
z@V|d3-T~A2%@5&C9C#s+t__rMDMU>t$f02Y!7<XYi*Ne~J!^~yv`X_90^^heuT2^n
zFHqxbMo%2<nDlmH#!Kj)-g%E-jN?=DW7Nu67y-4efm<3OPY`4}jg9(b_-W8ZhIb6N
Wt<u%M;9ruOg;~<onf&`Rc;|o9TC{2a

diff --git a/dev2/dev2-site b/dev2/dev2-site
index c93fd2f..67fa3aa 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -432,7 +432,7 @@ def render_env(vars_, s, st, service_name=None):
                 out[k] = st["database_url"]
         for k in ("PGHOST", "PGPORT", "PGUSER", "PGPASSWORD", "PGDATABASE", "PGSSLMODE"):
             if k in out:
-                out[k] = {"PGHOST": DEV2_HOST, "PGPORT": "5432", "PGUSER": st["db_user"], "PGPASSWORD": st["db_password"], "PGDATABASE": st["db_name"], "PGSSLMODE": s.get("db_sslmode", "no-verify")}[k]
+                out[k] = {"PGHOST": DEV2_HOST, "PGPORT": "5432", "PGUSER": st["db_user"], "PGPASSWORD": st["db_password"], "PGDATABASE": st["db_name"], "PGSSLMODE": "require"}[k]
     if s["redis"]:
         for k, v in list(out.items()):
             if isinstance(v, str) and "redis" in v.lower() and "railway.internal" in v:
@@ -579,10 +579,11 @@ def cmd_db(args):
         if args.force:
             pg_admin("drop schema public cascade; create schema public; grant all on schema public to postgres, public", db); note("dropped public schema")
     st.update({"db_name": db, "db_user": "postgres", "db_password": pw,
-               # `no-verify`, not `require`: node-postgres (pg >= 8.x) treats sslmode=require as
-               # verify-full and rejects the cluster's self-signed certificate, while the health
-               # check stays green. postgres.js/Bun accept no-verify too. pg_hba still forces TLS.
-               "database_url": f"postgres://postgres:{pw}@{DEV2_HOST}:5432/{db}?sslmode={s.get('db_sslmode', 'no-verify')}"})
+               # One form both drivers accept: node-postgres (pg >= 8.x) reads sslmode=require as
+               # verify-full and rejects the cluster's self-signed cert unless uselibpqcompat=true;
+               # Bun.SQL rejects `no-verify` outright but ignores the extra parameter. pg_hba
+               # still forces TLS on the wire.
+               "database_url": f"postgres://postgres:{pw}@{DEV2_HOST}:5432/{db}?{s.get('db_sslparams', 'sslmode=require&uselibpqcompat=true')}"})
     save_state(s["site"], st)
     # Dump inside the Railway container (pg_dump matches the server there) and stream to dev2.
     user = rw_ssh_user(s["project_id"], s["environment_id"], pg["name"])
diff --git a/dev2/sites.d/tipoffwatch.com.json b/dev2/sites.d/tipoffwatch.com.json
new file mode 100644
index 0000000..a85cffb
--- /dev/null
+++ b/dev2/sites.d/tipoffwatch.com.json
@@ -0,0 +1,6 @@
+{
+ "env_overrides": {
+  "PLAYLIST_SECRET": "postgresql://postgres:JApsRyjafaEFHDqXQHWFAJTQoNxADLOo@postgres-q7ea.railway.internal:5432/railway"
+ },
+ "notes": "PLAYLIST_SECRET pins the playlist encryption key to the old Railway DATABASE_URL: tipoffwatch derives the key from PLAYLIST_SECRET || DATABASE_URL (packages/config/src/index.js), and the kit rewrote DATABASE_URL, which made every stored playlist URL unreadable. Contains the retired Railway Postgres credential; do not commit."
+}
diff --git a/dev2/templates/supabase-stack.sh b/dev2/templates/supabase-stack.sh
index c81fb91..e70e204 100755
--- a/dev2/templates/supabase-stack.sh
+++ b/dev2/templates/supabase-stack.sh
@@ -230,7 +230,7 @@ SELFHOST_ANON_KEY=$(get_env ANON_KEY)
 SELFHOST_SERVICE_ROLE_KEY=$(get_env SERVICE_ROLE_KEY)
 SELFHOST_JWT_SECRET=$(get_env JWT_SECRET)
 SELFHOST_POSTGRES_PASSWORD=${pw}
-SELFHOST_DATABASE_URL=postgres://postgres:${pw}@${DB_DOMAIN}:${DB_PORT}/postgres?sslmode=no-verify
+SELFHOST_DATABASE_URL=postgres://postgres:${pw}@${DB_DOMAIN}:${DB_PORT}/postgres?sslmode=require&uselibpqcompat=true
 SELFHOST_DB_PORT=${DB_PORT}
 SELFHOST_API_PORT=${API_PORT}
 SELFHOST_POOLER_PORT=${POOLER_PORT}

From 21e9b59ed21797adb59b23a32df702b6835cbe75 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:01:27 +0000
Subject: [PATCH 016/104] dev2-site: explicit 10.200.<n>.0/24 subnet per site
 (Docker pools exhausted)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 118179 -> 118380 bytes
 dev2/dev2-site                            |   6 ++++++
 2 files changed, 6 insertions(+)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 164c4d518416933050ce06f4e94c2e267e04bb84..7d66832e2b15ba95de5f529856fdaa8525e71a9c 100644
GIT binary patch
delta 3440
zcmZ8k4^)&@7Uws^_c6l&f`SGPH0HlX9UQ<lML?ziO<_Pp6eVex8G*zZdNZKTYFI%)
zt|#*|p9-~TwQ04jHf>+-)+yandCH3I)Y0hAY5%l)EIYZCO76C2-+kzzZO)nB+<V`>
z_uY5jd-uM1yg%;3KwQ$>iHY$s;<LHz#k*F-A5T(`B+oL$#Pr1U7<$y6xE>Ra;SYCX
zl9pVQVt7#1+(+!w<9upgjL(=Z%=%+|agQ2(CZD;<_@K#`*=y)kd*gazdQIBEksn~v
zuqaJ?=4iq->YbyO3}Kp1reT%lrB6geuwChs%4r$f6ybF8qsC`2I*J&dRhzOSHMP%l
zUF5Sy#MsIhdsfu&w9C|)AXFn|0e^UNkZla*$J=Z^{{~NcYnVuzt)<PgX_T_ryurYR
zmZs~R&E~L$+8c#szAeX@o$GXFUsbZ5b93jho5c)vqq~M>3+Hx)bqSs|5|jx6D<^Q0
zj+w1JMq)1kMDAEFjrj>)C)rt|RD!JnLS`Ym({`tbtGKwBO%U9067vUqe%9a(ZfXmL
z{7e;IPLi%W`pWZZuwRUiF~|4L=riwK_GeSp4%fL@rDy5AONYkQ4Xs@_R98P#?-@#L
z{2<mFeLs4@pjd?Y-=b|Vc8!B6dg=9g1!k@K?Sn|szJA*eRa<#xDJ<H+nI%H<_cPxq
zPN9Dx`pG*LW+9k$HmKwY!7S~uvrh@W?A#$`f#4m{3+EDn+1k~QTuQzWIHSeGzZ-{z
z+Qsw7uvk0vWib{-|N7+x15%>zeeE*f7txf9W&<`xCx6=n1ho6V`$IyFFl4I;Y7N@l
zOW8ua<@*Y((cbu;qfJ|X=|`;7>Mzd&(;mK@g?jDS<?3Xbjipj5DKNG`8-L{<WN8my
zxe4>N7p|PVp<0NCjg1~3J0Y?*j7Bz_6pOW8BMX$UAoHScjofWUBQG%EPzFg@C2dF*
z!6NdUNir+HV!(W5i=e}Lt`WOpF`mB`2P-Q0r*XK&T1r}Og8jnCp3Ex9b`^n@J58uX
z3hyytiDkRcxkr3MAp>9UL)M;mQ+10Oov}#dI}>rlBIlDcTX|6uveCsiC1F~8w=mj8
zhG+R5KG^g>3ZW4P^v_dJ0cE!s*{A1DfZw1zBIw8Ufi!d);o{bGEJTW4n+`j0T;Gv_
zsldJZ6O%CmDyg#Fe8`HGc!*ESM4s}f5IwEeXCf}nvWJEXDHSPtU>eTC5+R9;AW^TH
zfpx$m{Mnf(#~%K}Oe|8K6+<uS3vWh-2@`pZ6FKPM4><9oS|&y!SNTpSTJ=jg*bntu
zX0<#K*+l+I9&Q5TpXXt=^0Lr9ttZdJDN`m*7Ex`EBAd&`$_2x2r>w3e*vY>sz%IPb
zw-@3L5y{7esDYO|i_nY#exL}&%8;=5O#iG1XVnZDd?NWv3<SfrP&nAu=4ov8vk&z5
zN^v8wjek>yxyolkWkjF41ix0rHvg#tkKqg6=tdqU@O^Gf!9V#+ZggV`FRDbFDv#8+
z{Dn$P$3OURC8k+Mga@-xY}O8FLnAibUWG4|?8!pPCQ&-?BWgdv5rUTpHWPHv=%+;e
zix<?2MY;IFTDX$CNYqGhg5W6ssuo?#<awn_%C-~G5n;4{jJAPM78xB`MoD0_Dn@|~
zs~cKc!+ys8O_E8J$p7#YtHs$fijb`o_NVf2-l*?fgK?@jJ^kyk3JR?#TffwRfD!L=
zpBEeP2_Nzz%_1Yq9QAb3iv{X0$#pf)_F=k`Ak6ahH9kx=;&Z;O39FIBKWKteNfsl^
zb#pW7pfE+4@Rk<b9<K;7BUquo+=6*fCJB0#e(5fhi7UhlLbw|q{#*##@Ps})j8|c}
z&A=-&kjD3fFd5A}vjb~zig$EilS&I>nf!bQs^H`Kn~|I9p)ABTdqSRYn6W{M+s1cn
z#(X4meKX1}GTj?!4HJ0M7PyoG;bgU5vjr6v6!63MW9{?_<X2vWRHAywXHs?P%2Ibp
zgRAQHhUKMotdCFW!VPK)c~be}E-X~zNI99`(}k@f-jObNv4hul<5z+^-z_RiEnnS(
zMdFIy`T$aKoxPuHJvgaSCYZw4_QG!+yPZ!8|90c(O{JE{4)c$D@#=N$!9Fa5m4DTT
zbIMxbAf%su5N)RM%Y|7a-VtgSx4;wfJ6JhirooyfGj=ce`H_I4kIdnN>tW;l8j90t
z36T_kpu=`sdF85-hLT$wR#lf5vN`;FO<ao=JhB)0*w25z7sV*ym-nIsZdzl8R&?IX
z*FS=mDK1*bh;Z*_-%)mM6Z~-OYFD+JmC#V_sFMSH>OO3nm`9?ql1jV5CK<KDE0Yb(
z%irH8c5Wp%bCfAQF|=E+;b=D|H;$?aUAdxi{?S1!Pa>%(C@q0-(8eb5+<ugfZb}N@
z-jBI+NH-F1bC<4eSX#NVrjV7Bz+$TsOhcu+ysmH<IZT$bS$u9cvUspx6iZuf(Tp7C
z=CK1{v0h=q=Wt{tw+2P?xl6DE;v2F-7JdDV0n9LF$oOPv*<z5n3FO(|z|}!a9e*tn
z8ELrLPth(K6g6Q2KQM^J$mSmnVj2|w-$B?^X`RBS9l~rh>Q#rJK$ODT!<c0W2*<yn
z={v7YfAlckHRs8hX>qKAKss1KR29Jn0w?W%4nZD)l|TI~X4<9A652JX?jTL+BAY1b
zCyS^mepRTCuOyl_*=}IzL}&24-{MJ!ygTLM@(H=zTY2kb1+4msR2IBBTzL*oQHkb1
zhldPlvgVC7YFYSR=EKLZEMX1JP)Fd8;eW{!+v7ftiAuYWJg>JLhn|!%R)=K?{%Ot4
ze+~9dS)FAtODSp$D*+E{3dvd>8Ru{Wf)1~rg&p2zzjvc7-Vu|-(bnGB+Tx8QIvg!c
zfgtlcT7$xds`_x;rj{n=5heGu;3BHS!Ti1;tEM0sfk!|jnZzM~*l|mnClnG7Rv&97
zxkb1RhQf|upmi&2C5f0qyjH#KOuP=gTiM5>sXfKhPa*;{-+K~M){S)q*%1D}12EY*
zWY&JxDX0T5su7G5#^^T5)62T4NYX)K2|W1}>f$@atc+k-51m4ilJk_H-LhEN4es-?
zw1YTLe<4_hq#2zUyJ6V4q_oCu53~FD^KXilKaYP%KlAy>n+V!7$*Yy%0XlHGM9n8~
z5i8%;C&=YNzWX#j?4<WFqgO4H>m7Xs5-VSZa+R_Hj<v_#G%BAxKWmgf%aBY2H9VF;
zFphxQ)#wG4Ww^k2li+1(k{KIImduk(U?*4K!p!)+!cr_CCgj&|c?&xYY8Gz%wgmjm
HGx+3xtq*N?

delta 3286
zcmZ8j3viUx72a<*|G%4TNY)r4dBK7rS#$}3AYz7)KpsL~%gYd=O_tr25Fi`wF0U0q
z<dG1^g8h-BCRig{Q$-4H>o3}hLB}d3bR64)0j74Q+D@g8q87wQd(RCuYG(G!z2}^J
zp7)&lU+A$P=(eZ)VZ?|ei~MV>c(L_G$B`7hFYTYOSUM~n)()*h@350)6O1+6#yYI9
z1g%}#E_x>&xyGtK=XgD+@3I7KneuqIC1~Go3p#>{%WYluU{<HKQ|r__EuD6wr|(PH
z4HS(u^4~~IfMwUvX5g1jYcSKm%JlSI_UEKY{tITtBrddgvg2jXmO2*a$(_emyGTru
z0-gl1UGBv)h6+g#lbP)hhnWyyfK|d2W`!6|Gw2K(B}5!jq}knU%!p?vX;QMEiR0rx
ziH}6Q=hu%~wIoSAAHU7qo(g;X*qe81a2Po!AA`#<PlliwxdXQ&$+&x<Qc?~LeCEuT
z@*lF2mmKtdAx6hfobn_}-sh*o+7!vV!Du=2jNH54>(!>q{e<|7?~MQ^8gC4iYBMBZ
zVm#^WuTnA9c==z4QEaUIs07pE2S2)Cg)9E($E8*j#?O9|XhkUg!Nui3i&69W%g%-J
zpjgDPm=5p5NTcLZmSoNTq6YQGo-YWkM&5tEu`abzNfeoiyUJ+1G#ZUY?9u`k+ZE}Y
zEp|~%H_lz!EDPFrc^sx0n=kk0&X?pt+cJMp9F?&RVwsr8g0mz<#u@GV(v9{n$D~B$
z*2|=r-D0_H96FT~Kl){LBK)M=(3{0<Q76v}A43t_%VAnJ_1kcZwqCB=%&%>DFag(4
zmjgMdre_?Oo>RtBH4Kl)Lmro?;j@bwvgwKgcfdvS6H%#ck}@02{fRIWkW7nH(C1VZ
zl&x%Xq+$}b(ezZ@plz3;9cFVX=GtJG&!(XU+HOhPV}5-tLRM|BT<<sU&cGHMO6bE(
z%z(>uXTbwJXU@yU^}u~*TMll7&Z1&BJ(i1w_$hsyi>b~YNqS2DA{Ri1W+BV07>$4E
z&WBiXCP(iwZyk@*aBgHu2}81(H35ylURsxjYCJ@*=b=b@PO@GwZ60JfFp@?Wpa5&h
zSAcI&Zq`mgqE)||!n+EkYa^+n5aaYUtnVP*Ck@lvg-F(3k%Z&sU?Gk>a@kl+cYBN7
zrEXEhl5;tcOBuT8=uA9_H>k20cS%p4F2*7(qbtQ|K{o|vp+x(mJaNYCn}yT*80CC2
z>l@J)j=Ce!aC^Id*{YCumudO*eg!h9ssc&$Y6Y&~9y(fyeC@nsUNrw*iJ$ATNDtQH
zar~WbuESJ}pyoP^#fNl%9d^J?4j<Zeb<;kj%|49B2lSLr*6xzjU^54NaO#t?<XT+E
zDc#B|Vt9tZWLT$wx#xKG3F-ARuo4Q^qtvyHNq&Zx82acp_1Hd7T~lsjv5A52iQsYy
zE`{Js3cjg=6CpSj!R`#|cdu9#4GD3DDc5l_zoKnR(5G2#7E6XXxdDZ`?vl(aZsYNf
zGtF&Hm=4V$nR({1X0+Mx4owPT<=C^VAR=A%B!BOoD>rk8)V>_Vt$K{b=F{aM#yg!-
zOQHNlE?9Wzj4>-i_|}TQQbh~uWmX?=!DKB}3Y44gwx9v_m^Nv0{**#0XvN&51j!H#
zRp$0q6hh08>pJsyD^cM<1tmnW292~XicL6Reip?sV78hv)DV?Dx{N+phb8Ez;`Laq
zXS1>#I<g)<1jxDpQ_`EIr-Swuf5ab+3h@NTFotg5fLoACTQ;EDsp=5oc+%)E8&Ikh
zNhR~moQ<e)qKI0zW9ghU)~ovDT3+pBohb{-7nawSHI@42HdU23h)z~9nTuV(FqOf>
z<~Z#_Bl`}_&~-kZN)<b>5$W{W4g`|7Fq<cf$g>!w;cJaOcW6|(6Dy>^k)1Ncp`l8J
zowD2SF_SuwjvvtOrN&P5>zp@{K;w2Hlr!AvJO(_rp{`G6mwM^IE*$&6bW0cJA)De|
zIHNU41*^?H51`#qJWn2rC3z!jWk>lVA+KuHSVq~})$J?Vmb(M1!fS)>b`fq31)^@D
z(!Q0of5YIS;=KrEa;&jyLT&5ZbE@kWmo=5mZd$ycdZxIEe!EvTn2)P?8-7OjK8zB~
zp;sS9ne)3bEAos_r>7g;pL;316HaQ_hg-&$aEO<siCS@yvo>4q2NUW`7u1S5%u<=U
z4F-L*51TTkFll&Jb6G`(jm{UVYx5Y%E3kmxAyjAq$?7t59>H3h%ReM0WmQyF)Z2}!
z6sF3twW2K=c8d(U(v9+=TDqvb2l*3NHkRbBEw697y>8*6nWBmbPPb2Pn(At+8)goo
zK$KH=4<@6APWC{^t2=8yZq!yt$$e()e$2CFDdWnnS5id{gKCfvoq7V-r(HFp+=#Y>
z*cDr^94Tq!@5L;5skaw5Ac5ZOg<DsrU38%rH^Fa?dJ-C>&Cv%iQClq)KVjA!z{SL=
zLt(O|>hEm&cvZ&`V))Um&L;6ZCU`hRQNeXk;y3eFsTlS>muYo$T#BdF@|w%$v5HZ=
z&ZMuN$J1WbR@L(UOS-C-YRGkbk$m5ysv&t34IGjQbeZ2C!fxwGH7AGPbTuqrp(l@E
zo~xcMEMW+7Yh8VgGG0K27M0Y4X2A<EQ?iEVw;J8b>eX3o?T05{O?Bl^C3}uRt<5i%
zN7RgurFy+>VQ(NLqTWDDD6mqPw6q_&tvvPz?W<QT7k)XDe=m12-Rl*hU|7s&kJd0W
zONhCc90^6e?fyt)eOLs=awa>y-u7@L>J7K8+9*~sWrWuo2)6~+3K41xY!rh-Y3!%J
z^&<uc-FX~i8;4&F^<ez)g%IjtQ5pKtOTsUN;NBOU7{R?D_)dx)oH)KI!bxY2qakUt
zv?>_>WEQ=S6wUq%xvrJ%?t2SaF1`sK>!7W&d{M0@Dz;MWEsVod+Ry){(Q9uZ?8#vb
z*$g|mz6HFR#!$-JYKEh1^-)^#HvYVYzljBZ0}B<~(B~m<)hDBhNIiy|n5JUe%`5dq
zq;fDE>W{Lag68K>@arW~82E`A>NYh>i)`cMUJVhIo#Di&oTy}Nrc);{A<2*@rSFzV
V(ERTSJYdyEVa&x_Y0m)8{SVQML}vg1

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 67fa3aa..f91f803 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -470,6 +470,12 @@ def render_compose(s, st, app_port_inside):
     if s["redis"]:
         y.append("  redis:\n    image: redis:8-alpine\n    restart: unless-stopped\n    command: [\"redis-server\", \"--appendonly\", \"yes\", \"--maxmemory\", \"1gb\", \"--maxmemory-policy\", \"noeviction\"]\n    volumes:\n      - redisdata:/data\n    logging:\n      driver: json-file\n      options: { max-size: \"20m\", max-file: \"2\" }")
         y.append("volumes:\n  redisdata:")
+    # An explicit subnet per site: Docker's default address pools (15 x /16 + 16 x /20)
+    # ran out at 34 networks on dev2, and widening them means restarting dockerd
+    # under every container. 10.200.<port-3200>.0/24 is deterministic and allowlisted
+    # on the data ports.
+    n = s["port"] - FIRST_PORT
+    y.append(f"networks:\n  default:\n    ipam:\n      config:\n        - subnet: 10.200.{n}.0/24")
     return "\n".join(y) + "\n"
 
 # -------------------------------------------------------------- provision

From c0a8867c6f343844c4485c4a4c3c52957ce6eca2 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:08:58 +0000
Subject: [PATCH 017/104] dev2-site: sslmode per driver (no-verify for
 node-postgres repos, require otherwise)

Bun.SQL forwards unknown URL parameters to the server as GUCs, so
uselibpqcompat=true was FATAL there while the health check stayed green.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 118380 -> 119500 bytes
 dev2/dev2-site                            |  27 +++++++++++++++-------
 dev2/sites.d/brisk.news.json              |   9 ++++++++
 dev2/sites.d/cigarunderground.org.json    |   3 ++-
 dev2/templates/supabase-stack.sh          |   2 +-
 5 files changed, 31 insertions(+), 10 deletions(-)
 create mode 100644 dev2/sites.d/brisk.news.json

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 7d66832e2b15ba95de5f529856fdaa8525e71a9c..c4b2018258cdefab07654626d5869bdb91e06838 100644
GIT binary patch
delta 6133
zcmbVQ3wTsjlD>6s-%fWrFY+SqbOJF1=!8ckfFuwg39meW1PB2`r*G#?5>9u3gbqP@
z2o8=iXXL05B;o^wVa4dS_zeQ$_+Y?gWLGpYD~u!R>W2!9JXB_@ZfFzO@7r&`z2DdW
zJ*Q5cI#qS*RGq%x?({qPoL|tN0|Wgfd?w8J*LqLjwxB5Z@nEV^iLTS4H^AbNTD=y7
zZ=2Sj#o{|%YvlRLh}h-Y5bTZ9hHj7+XK5*j<F$JbCumJQTNM{T^Y7F|XyI11+Nf3F
zKn*`Hj~KROAJAHow76DVp)Exbb=v(nTCY_iHfYNb8#TL~f2Jl5)oQTka=NwJhGCM#
zOtR#3?dzK^fz&3q$!V-7&N%1^_=u<PdR2MLBXeko5P@DW%j_UmpFRZh_>rf_h|2*m
zm>)f7j$93{0Fc}fx1~rP@W}gQK6z7&xVaYmt=gby9Mb%E8a*ntJO+<C3Ex{w4alp7
z^1$6r2o)u3A(Eed+q7t<#LSw>W5l<rh55KWsur$OLI+SHbV}p^%3z%mHGmSmQgXr8
zxmpbWdiM~B<$>KZ6XS5*c+zEu<WX>y1dq~=y(ZA2c1T*HI64WIZ}Wy3H0%B(extik
z32~?L+%LlU(q|%+<oYyzVO7`=KcC;VWSZ<TRLk=vhYXTK=`ePvtE99ceBU$IA_BCk
zN|&p##m?-@UA>UaT5!MkOM6cHG28+vErM@&c1&b%;IBND)y<5}MkaPqoXdfDKDk`w
zz0a0fenQ&w_;V#Ge8O`-bk@kV@-<1SksIY7`d;5l(sFr?e1&=*`7*sqm8+68MJZHp
ztVk)Q*IZ@3f-F;%QU#}1%M}Vvrx%VbQ7UPyT3$vyyW;2@)94lBBwDpnqjzdS>B)Wm
zbueVa%uMO|<%KF4uJ<f^X@^mkWd6&`8AeG)6QF0z!E*pI5AMkWzn-$5^9ls?jPoi%
zaEnj;lMAl(9QacRfSDh8=MymWJo)Z}2Jq)`C!c~)?mbxmKk<K_j0Zm+e`*E<@aj_q
zNI!7uie)rP|CXHbx=EbRgoK_GAEcRa?CRNO$mH6``>-AINjFU3uY6L<%VHx;*U{So
zLyoUlpCl&$xAsQy;%sv|v$z!;(jSlH+f@t(r30PF#+xO#>KoS#Vs{86@Rry7BQaFe
zE=4o$_uGfM(9@xK6tVjdgi|1QGH5fIr8aY$d5Gi==;M&2p%PO-Do6S%X|+-=t%5ZF
z_W8?j_m?+o&g`aU+e#;^t8QCn#W1ioA<fp(>~hyIr_0Km*c@s7m6<tLwAL|aAFC7R
zwYh8Snrf`hMwc_albxU#!hn>D+B0x|i`B*&T~?c|uF28Zifgsl9S!yxXL`M>xyfqF
zv!*7u)Fdx)4WF25ZJ&sI&eb}fO{-(5m*%WQ4O<&gk2{CbYwFxqkG0lm*Q~ZC>*#!T
z3fFA!9P~eIY7h32Zfl<A$2Op2*dwIr1Zs^T7)x-AAOj)Iz+R@dgWv?gegu~R!HN$H
zBhn3$KrjmT!u24MI@d|(P5zG>w-`6KpE1RJXqxqMk~igG%In5gZ96@Cb9Z(gEnS!U
ziJ$3vSurP{3k^R#c;?BJe;e`sh|>!e{yF{h%yJC&#ZW5aE3%Amsaz%FVG47|o2Pvo
z9QtV6mbR^HP7fKkdCdh&-1V!96cYELDd~yQk1cWED^jdE`KD_SD)L%pu1z{-Gv`iF
zj*SOI2k>oY!+C7)UKq*W?#)#vq0SSz|EEihM*}74p(Jr|7t9d;9T42}_NVVEJi%ZZ
zbvw-tL4o?ymuCCgJESg?mcG;Ai(O2|Dg4FH;%BDbW~M}&p(kI^M(J-=i>3Fz+mYX4
zcBlO>yrX&W`4kw#?>(OqKi0PjYJ|b1Wp-G!dp$-x4ddLyMeK_ZC)a22xzS-ToF6_P
z_q+V??NwmnZCk>ZXj#6w$UVMG?FevZ`Bv2?XcK+s2=%8;)gSFXj|I6WxvjSen6$NQ
zPXO9%^hrZ4a>SA{NaQUSLSQm~;6em{^MYA+j~Dlsp+4@({K$orf+=^%$R!zCe3weu
zyCcY*>yz&Z(xz(D_D}cu2DKTeWgZ{#w=5;!J&kYsTUc~Ky9JBej2#ATW|z{hPv2<n
ztOnd!%rE`<WA*@^ejDcupblKCkncV|mPdUa6g_o+kx!qF5ch1KuI@r^|2!^4EB1uA
z=lF>AB|K?&7+?E&49w^DoG{VZjQRDo&y%7{usp(6lY6j_Rh#PxLodwZ-+dlEdOo$g
z<bGYYrW)?Fz0_Umn~Af^`h5P|RC5US7U=$5*yX38u6)Jc?S6}>%wr^e^7qsc<^58%
z#T^lMc=S%G6~9WQ{aMnbdLs5O-KX&Gbupr(3Cw<xo=6s@-H*E*E^C$i=`W%amvs#O
zKS>;k6748)FiGsQq$8?-=iQTi)_KfYl`o<!!*Pz{i%oql?kYVU(e8zPEsO!j2FVk}
zk6nx~Yd%{AL_t_!%m5}QKYTIzE(U)2;)$?ocloc9@Q&t*sjt9Ij1jvzgc?xmTK>;3
z6KzX<Jf1kD)p-&S>ph8x4FgZZ);Qd^N<RCm)It4H8}E|J|K+O@u$+JTRTeb$gnj)y
zz%>5Gf4vO3yy2TEkk_;Sn|ZRzE@4XLqc7E9HGT3@0o>}jaOnoXxSmhHH_NcH=ZniV
z0ByYR>Km3a3iSm93&qRZA%ai27K1}m|4|6#{IP!sSi^_?_=~(m7E|01t&eu_ifak5
zl(%0?g;D&OYr{h*6S8o$l4VkB0zY>xQN98E`n4)N-4)l9A&alQek^`Ij`k{5c8wiE
z1$&{2jU@i52(Dz_vOS!)+(-;+#cno{+WjQyIzRA1T+g8!RvGURy+0+Totazx;oP<V
zUcc(}>bBEsI?mLuJzdg?Y2KPE{}5;lo{G8Ns7{lw2K5a6`6I*hH6U5CZd_gjQfL+2
zxEv>0mcWfGMyUaEW!F$t`IsfJ!eTfUZ9qI7A5{@zIvX*pBEoPsCk3%LGq57Yn*;DJ
zfI}D+=#C-vSTX9)N(k;FvlECGFODfNPHn?>r}t+C)*3=?5l1Y+0|a5>VH3nbk$Axb
zS#brrAc7}QMp_6fBvEAq@#3Zl7U2DQt{Do{waBx@+hqo?0fIzX5bU++3+hY93sW$p
z!$y%63`5mT$ohnLSuo60;92iWp->3wHl%fXe+~nutZv8l0dI9AbSf}ST#SYZ5bCwY
zKpMawy|ZFr2*88hrZ~6<jKs>eiKpUWK0GEa#lu+3E+oB%Ki9V)4orp^Z+-%NX|!<S
z%q9avz2j5hELheMWg0<{HzpM-0Je*j!(a|@aeNrur~Uzlj(e3fh%v!nkuVxYn^z&p
zJ{pCHve9s<(9_z)oQ~$2rn+{gW_2_-RoB(DGP}DDFFpFD-05~Qk7jq<tL!ePwYAB<
z(q7kSuWEFrT0I`Co3%RG3=)}nTV$g+G6o))`2UydoiY{%gYouOFU>@s4Hge&LbB0C
zhVB>Z&?DmgObAd9BjJp<Hxo3t$Dv|y#%Y9&>IxNaA{M4zLtL%m<s9(}V!P1BK}tkD
zaakJ(UFvG$4Q^AtyT-vSV?24Y-DtJtSaYqckXD>Yk+PUzt2mSmkH9;kAP1JBtDnn(
zQqaWB9H@mZ;g}3l)W6`2uf2OG!&zgZzB@rAFR-cEZFRYuTUy9->_3Q>A<pMRq?nx#
z{^HGixCtHNPyu8ZKf^&q@nSmJWrTR~ND=IUi(+IkjD-ZTtQeBuEAe14Y=mTCDuEWG
zezdQMwIz@OUy5f-FgkCbh;Z+z60jK4<FL&JQ_!rZ){_J;5*#8}O|X(i|C3smg>fNT
zHce;?Ava_rksJhX5WFN_TL>Fw>F1LEU$C_VbP^Z^ETdp!v?Yv=CL>QUGKP^ly~gUg
zMhqqPGf}9*vR}mdMX*;jV5v#<jw**tqcIc*Z(8}TOVQr-l@I^`;<05gT=hqu3Em^i
zph<x<B3*-qq`#6J7iyjsFyKJz+Q#=ue?x=uMh~&g7uPjNu>_)&Jp8%7mFQ1VqPM^a
zw`8~=@@rus1dCm@FiIVS3=6zxYGE;eQKZ+y9DgH{7{L<nhI+^ZH459yyoVbg-vl#-
z!3`^*QLJ=>2cGj@al;XSJUz*aayO<Sm-u2OEP~@AXBCWsTcUXtOftrk%mi_86_kKe
z$g5#YconMJ>sM=c+1+l&c9RiFV#aD12ZKcCYM5iu_oIdk3Kt)(hFmopg;aUt+Mv(^
zIiemvZcGa&xfH`Jf?AtNX3)I6`FTatD|1U`R?f~VXAjfxDB5(&18gh--ESGWpZN*D
zjWEGzqUnP~{zhoSC_TCn903o|Fy&DEYtD0<!}wzhR8g=A>X6~!CbYD#w292knAf%n
z|A*ja>~|=<7lyD3oK}=3GdzV--{1Fv%)b>Co8g#|{K||Xc?&q>`jg%BxNMrzm-z5o
zip2JaJzL<2kGu9^n1$!0=V7SAaEbg4w5k;-XRY_K-$08gXAaJ8_qVxP@#tX&v*~BL
zJ#u>M@)r6t=xA(i)vPV7x!&n;TbaHsdJWM_N~p;BJvgJu7wv<bO)IU_<`kDrube)$
zvTWX*Y-SUG{5>ATd9>LRVUOr|9Hv0Nc=K_XZYl0}7XKkDobR}56V02zBFeYJxTL9M
zDfy;|T_wip*zYwg%$--nC_?)#2@~O2@y&MdL}n7HziQF8vnWOUH3xmJiKhgHNU8XX
zfPB@7Lp!{2Pe7{@;^<>TUfrrf(Y*s^2N4zXTV0d8*~+5C%^i@}x7VQ}Zzp7=5^uY|
zwJ2|4<&5I_rP-{I2o`Gzb}EaD=9Fjm!e}-_?AVFHTr5uR1co|H?t**N2IPFfTi*q<
zlo)++eccSCvSI@L9My;qcEga++so)`xNDuHiqeg#CtTROVKQWh?rs>02k@P4up0H*
zq2k+a7y%A%)H9$0u9>h0Gea{9KIkpn1DDNX`^==3ihf;l9<}BY)DYYi_3?uJ0aDY*
zL^hN5L1#~=t}dcq_e7%26>lN?;1X)nwqZQSP&=03yX^-sXIv8%2O!U;pFsM{fh_vQ
z>1S6@v?T+mdS11OQwPwOq25~u;88h3Pp$p;9zDMv7S9}nSs~@L&SC;59i!W&F!B|M
zR97PPuy^z;;0=oDPx*SbADG_dW001yo-EZBnngxHui9j1H7>m@v<KU4_?5-sWNw?I
z*6C<qhs5Gz5Z_6aqStSET@79ioa}w<wHs|V=G2<meA388P=(MQLS+1kYHP8(T&tRy
z#_EV{vFV>`Y|TxLZEQJF0&O<Da5!2Sb2d5J*f~;0X2<cxex!4*XZIBS4%jPxJO)mz
zluO=%q>BFPqZgh#D-F{Nl<u~>DiT#1M!A8Jw-}ujMls7ak~b-mSfKd$EhzV2M>-IE
z;l1xT1gU;|v0cRQJM4Q96GD-aCif}@d8I{Zt!%w$e-D!3UeQIbEOGQbXiiHY3GoD*
z$ds|v$|A_6?i_+cwCWDA=zTcdNgpqnAB_hP=mz%P@u{nSzL`WV-8Q|v_7~r6G@#!i
z?<&K0`9(LMDk-Bv$U+FH+TpnziKr*vZ0hUjM)y;{i*)bkZd)flI032tk0U24Ex8)J
f|2zRN%AqERzZ?!&=q?+l08EuHPZzJAg4h2WBl1t-

delta 5254
zcma)AdstLglD~Dk@8!|Fn}=WnjRcWEBZ|Q%5d=g9nwJIv4b${(<lS)k;)66X8g<qT
zP8`oBCkiC$L}Q}ssy(rFW_J9X-I(l`G0A2gPI?o~ZeAvzJH|(R#<-_0wrIZjWB9)Q
z-E*qy)TvWdr|NwCVNbw?;efDrLqmfF{<muW(e~=#UxbZ=Zx5%-y7*QlegiaQDQ!vu
z|5}uGWjz08D;;#cE^~aRlFDa!$|D<uhUrQg#~I2*jx&`m&!El)(7jDc1}8O3E%Z|{
zGrMs=;3k65utMokmhrW%%5pB>raZ~9U1{Rjq5Q<wso404o|BT394=)=$0R`@fui6b
z`$v}xAgmGBh#9?}33B91u$oSL`By;Mx(JBd_DV3Ur-oOKLn?jim8m8rTnQeQ-BLVX
z>DIfYIs7}ArWf3xM9|)y4k^Mdx5v<Rn-iw46iAQ~=$83cQX>7rZb^yKC=m}(j2b1H
z#_Tf7E*Pv<#?gvhsSr<lcP&gw;JU}-enWy=$5ol!x_&<E1|@b#P!iQx+Pf){Z6jb5
z`S{!>6OEh{&E`fx;EM+#TCXG>NT$noSLn=YD!ue|G(EXHMwil_Mt4OT>4n|F@hPay
zt#1))1-l4>T{j>PNUMa52{ind*8>BHqqnb(IOzCSKM3|gKH<(2GK}={t5ZetC7V(N
ziL`D{z2O!Q#a{k%9TVwq_FRf<5uM^CK}hHkzZHaDk!TZ_=*fER7z79j3-SW(I+pV~
zM0@V;D-+?mr)>X_EZzlr{_te^E>}bZPvVh}0f64}lz{9h_|>O6FnCgq>B8U+O*`d+
zYo6_=A^-yE8*hIEI?sl8*6SgN2Atjjk#zUzQn*FGIh_bH4Sa6_7-;o-rJTO~y(^I8
z+46pM5TBg;s}pi*<wyJZ`1VJ;U<MuWEoSq_K@647?t@Hv@NA(pOB940diCsbd2gs7
z{4|AK%7KNRo#+0ni&C=pb0+=`2_u2Z<Y7GvpT_<1yU#*m(ncBFv!LW?*#gQGdhWBh
z#Pq+%(Ig~gDm8wdMxXpVgcg6EkT}hs->bpJBcnVvU{LbhGLQOnbrK6#!9<;dF))dS
zo;1-Vn@58#w&&7aNyg+E{>5B;=7=;9qCV!|Sed2FrWeo0q|b31I5%H4`#F5}xI2WO
zM)t4f+s<W!2O*hSzcJ9YUr4%w_Hb6X35<r>{#9xo`}sjIiE2Lm_b<{)3m?)q5A`XD
zBNC?BK$tq$zsen^6e-0AO7`nUDIh##;e0yz%jtEcYT<qPaKBB;f_{S_C<}-5%AygS
zpUT(&J=wAj9wTB<CBGh}d_T}j=Z$F<53GF9H&%6?U$(uNRzGKiQth&sz6wh%I#B7i
zcOXJt=$BK={G;}A^nQ4iJ3?J_pJwF+!ARGCl>pW3q>G2`_*W_RYJTZqFi?&2izzj3
zBX?Eph|Vqh6N?{e{C)mn<d2ABW)G(8A9mUjwZ<>aH9esP?!|lv39ZwjuyiCq;U}Pd
z=WPM?Sh{#g_~d+gX2Y0DrEwtUp*TFOa@l>A0n0}ucg%q&sqO1bT~m8F9((3bHVE$6
zV!>Zm{c3rwvJJ%jLuxacx!Sk`Pu}<PxUq~;^Zkc&2Pt-cR)(ZC^CY-;5w)fF#sl%{
z68{24p=-a1*E#kByU1W%*g(PqycT-$0UrJCn|F;X)VljiTlt|9+Uv2Xv&kDFs*1a|
zZA9-s90=~jVqtlLAS~mVJYX6~8c0?f{j1$3F5T`<;@II%=Ggh*-5NCU04}GM7t$lg
z_Uro5e$;az6T0cS3)8{riTl6305j?D{&ooFQs>12nC&@qu|~}Gg(%HUE>~xdjo7+e
z{i%G|<y0K`_saLgK9{4jt+}Vy?(FKZsrf4DbI^dxD|qE|UM`jI@PgalMkB5#c>Z$P
z2k@BZ@YNs@Iy}F*wt}}^ntJ2cA&c=IEkSrfr0XtbbMm;G6|j`H++@&0f4F%E8tM19
zrU9W-ZYRMqT6H@eCezioAI-uVN}{<-NG^_MApC$+%zdBK;v{wl=|zGh&_CX8h9sKz
z{RGIP_1~W~*Klc{uGyxL<J?LgG?PqRU%<gNfv=&zXfV;84H9j<6E3Non(J}iDG?!<
zzIit#gLj`+s1UCRLJe547ga+ge#}+kC4&@REnXEQsYbjS;<<bGFZ#eWAQ-0Ky!-_F
zL=UFahR5|M<MkXrh#1$X3p^7zsWDK0W=a}IUwUX`Xp|jjbxO21M}k8D&Fp_<*p+}L
zkV<YUsY1XiNfMD}V#5KDC#~jV)q5rYp4MB??_@l}I)o?`!~W18pxTJpQe^HAG+XQ~
zW{WwSRIv3SFkLP|87n&x0x@7>e-42sAd+Q;LaAYZbDriumrG=YMo97whXU0@D9ee0
zeFn`0%@`B=EDEw=1B)`kBhp5`VvBdS5f<uTyLV$ORDiUV(_ZwRi35iyy}-x6^cE(-
zS{)R!lZh}BBE7d0Ap_vBH!T@b0oHjJnqeZyC`z`nz7(j1=h=UzK&~{xNpE;z0t5sY
zwjnzo&l%}8X22OR^dqGZA=LZbqtFQO0;|q~a@fXR&Vt#}0nR$+J(~pyfe_1XPJ=1(
zN>1v(&c2nQh^>4K_D7_f-EK3cGntR9TlZNR%$LVadto}nLF8xva3}1vq#s!1QHYoK
zp*6AW;~CsS!tTz1OzF2==pFCmnV`VLHa*W2Q#&HjuhL%?1jB0mb&gN#`P+sgPb)(K
zJ3b52VtP=@+>5wI|1`>muho06%z_`}L_A`@Y_>dZE;N&Jv;sQ^X+ZcH3!4X9;4L;h
z50>-u-<k)D!Okj+pcRJMu_7ptKHw|PdhZm$89707St#lY?RKhWm+I{4u{C!($e+A_
zTLj4fZWdM!ljXBq<c8=iDu<V4h+_X+124lDY+Wtnf|0#h3n}mwJ5viAA%!hp3_Y@T
zr!KQUE`~JtlHFVkkA&UeDuQ@Pb3Mbobb~z;3MOyq68KWe9?v->4t=*CM=v4lLpX-8
z3SlL3Kf%!@*4W5TR>+PwLSe)PBsC)(M|hnDFM|z>v^$f7gaHK1NrI_EFarpNgy6Ly
z=m~;HBWRpYZfWaO9faIQ3f2<xJ^Sl2p6ohqwh2xDM7s*f-Zz#*xXcsx*LHXmKww`e
z@Ti1`%l1Y)pj!tYvS(YN13qRKTOr1v8JIY#FuV<B1U-d2U?rl3(_&+T?OjR}aj5)V
zOhUMlS-8~&R$v6Pceo9H5aClc)CqME#;$ZijugT9W!_0$&;TH@XS<<1SmGptQ0@Jw
z8>WF2$Hz;&Q9Up}5K3A7YUl+Udv`Us;Z^T~HE;sNA}qVn?BHrJK`Wc}6fA|`Gx`+d
zz#aA<Pr)1+PfQY-?1m~(Se+ZDM%&O$0j)NdO;rimi6=6%5jW&P1pAX4$_-jPTJUs6
zmN@{0(j2a&&f7Zx6$Y5YPW%%zq#04Kc1@#k^i$LsR#Q@2Vl8eetXkMqR#Hzkv&T2X
zI5`qE$!ytXm?;OKa0DCL3~L~U#XJXgc!sTc4hEBBIL8-IS6E|RXf5?gB{embHP+XG
z@auH1yF|0igS@1yV@*GUTc#U4nS78+u&Y`##8J62%rLDL-4lM69U6p_GCGn-Y}FQU
zn8r%Z9&T8MZnXS_;L6?X#uhl?m;Se(!y;Zz1D}Uxo*f;}L!Y66>v7?ahm4ogWN+|R
zC<`nq<BIx&Ev`O(?QAZGMZ3@avBiB|J#F19%=S)apJMJI&US}gH4`l)T5Z=#J-Vkq
zi=D88nH_rx3gXd6{gICDmFA-I$|c23#q*k$)RgCwEEc&PHj34wAwRI4-^!QRhufh5
zikWc-6oZv5-2sCW3i*11?y-_9==vf)_vz8Iq!?NE{G%z@&I*RW9g~an3iLF-jtIt^
z#IgSxf<#_+E)Mb3sAUs}VZNkr&Q@>lF!bpnnl&i|?L_75+AB~NhE!hH+PYPznd_+B
z2_>UZk7PS`!sK+6?GH9vOX`{yRMsxeC*?>mn5+1tsnS|rpYMYyWIp?LCr@H4OW6fP
zZ|5Rx;V>ixcRG2`Z|Bot?}=ToNSB})q3xf|sl<w)-J=$kx(8CD?ro=;qqaKGq@{a!
z=`pgSdtfePvuk_c5gyI)d%-Mgt0P(AUdV)IZ`WRsAPDz%$=oZf=_n)^d2uDS6%NwP
z$$OEt7DgNEsn_7WpxjYUpb-@an!;)vRUxz><Y1;vLC8fgv9}LHdIoxdlw!CvaSKj0
z71=n_^d#Y^ip3p)^tehKV|01u$KyBw;RaiBgx8a6?9dS?v1qrmoLkOiwAgC*S}Vd;
z4^Xw5o5d!0xW6O4wH|n0jM2*O*n35*y}xDG--JaWOL3!m1c&hAOh{rKM<G_~<AfvL
zO-I2SmN3={v?lOi)vtRCGA3*NL9=B69sqn&w~efDY2Bhf++yi=TKLmXwb)x7_6~B4
z{p(whxE33TFQBV!1+nq!{tln@%N7f9C{9v?#t;M>hyDm8yBw;e$L4aaauS8KBH3WE
z^f+Cr#o67thIAq&)MBwayX}31IJ)g?$bXM|^Y{EizQf44IAo-0&o&<`I|U91Vuw#b
zO5<2l()!WE4TxxcOY_)|8WlDmf)#|Iw+LP(EtSbeymOdPB!pSshWg;OXaj=JyY+1d
zlcv1J$5w)sB15!(t;guW*ZAKwvQissnUf*<bfqPWtr;p=&))w7f4)p(m+_OwVorlI
zBN4Tl5H{iQrs60Mp%AC#2**+74)!mn;e)mK-y0$$-+-VUdhDsLJ>RvXYE5{oMQ=r6
z?bY|AX8j{KY2LtYt945fjw9@eqqjFs$Dh2Tbx5mCn%l-ara4RV;#xN8eMk@fXTFl#
dE4Uoq`uE{=F$8!gye!X!dE(`HEc!z@_WuM!OT_>H

diff --git a/dev2/dev2-site b/dev2/dev2-site
index f91f803..cc9fce6 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -432,7 +432,7 @@ def render_env(vars_, s, st, service_name=None):
                 out[k] = st["database_url"]
         for k in ("PGHOST", "PGPORT", "PGUSER", "PGPASSWORD", "PGDATABASE", "PGSSLMODE"):
             if k in out:
-                out[k] = {"PGHOST": DEV2_HOST, "PGPORT": "5432", "PGUSER": st["db_user"], "PGPASSWORD": st["db_password"], "PGDATABASE": st["db_name"], "PGSSLMODE": "require"}[k]
+                out[k] = {"PGHOST": DEV2_HOST, "PGPORT": "5432", "PGUSER": st["db_user"], "PGPASSWORD": st["db_password"], "PGDATABASE": st["db_name"], "PGSSLMODE": (s.get("db_sslparams") or sslparams_for(s, st)).split("=")[-1]}[k]
     if s["redis"]:
         for k, v in list(out.items()):
             if isinstance(v, str) and "redis" in v.lower() and "railway.internal" in v:
@@ -557,6 +557,16 @@ def cluster_pg_password():
 def pg_admin(sql, db="postgres"):
     return ssh("root", f"docker exec -i {PG_CONTAINER} psql -U supabase_admin -h localhost -d {shlex.quote(db)} -X -At -v ON_ERROR_STOP=1", input=sql)
 
+def sslparams_for(s, st):
+    """`sslmode=no-verify` for node-postgres repos, `sslmode=require` for everything else."""
+    d = st.get("checkout") or (checkout_dir(s) if s.get("repo") else None)
+    if d:
+        try:
+            out = sh(f"grep -rls --include=package.json -E '\"pg\"\\s*:' {shlex.quote(d)} --exclude-dir=node_modules --exclude-dir=.git | head -n 1", check=False)
+            if out.strip(): return "sslmode=no-verify"
+        except RuntimeError: pass
+    return "sslmode=require"
+
 def db_name_for(s):
     return s.get("db_name") or re.sub(r"[^a-z0-9]+", "_", s["site"].lower()).strip("_")
 
@@ -585,11 +595,12 @@ def cmd_db(args):
         if args.force:
             pg_admin("drop schema public cascade; create schema public; grant all on schema public to postgres, public", db); note("dropped public schema")
     st.update({"db_name": db, "db_user": "postgres", "db_password": pw,
-               # One form both drivers accept: node-postgres (pg >= 8.x) reads sslmode=require as
-               # verify-full and rejects the cluster's self-signed cert unless uselibpqcompat=true;
-               # Bun.SQL rejects `no-verify` outright but ignores the extra parameter. pg_hba
-               # still forces TLS on the wire.
-               "database_url": f"postgres://postgres:{pw}@{DEV2_HOST}:5432/{db}?{s.get('db_sslparams', 'sslmode=require&uselibpqcompat=true')}"})
+               # No single form suits every driver: node-postgres (pg >= 8.x) reads sslmode=require
+               # as verify-full and rejects the cluster's self-signed cert, so it needs no-verify;
+               # Bun.SQL rejects no-verify and forwards any unknown parameter (uselibpqcompat) to the
+               # server as a GUC, which is FATAL. So: no-verify when the repo depends on `pg`,
+               # plain require otherwise (Bun.SQL, postgres.js, libpq). Override with db_sslparams.
+               "database_url": f"postgres://postgres:{pw}@{DEV2_HOST}:5432/{db}?{s.get('db_sslparams') or sslparams_for(s, st)}"})
     save_state(s["site"], st)
     # Dump inside the Railway container (pg_dump matches the server there) and stream to dev2.
     user = rw_ssh_user(s["project_id"], s["environment_id"], pg["name"])
@@ -724,9 +735,9 @@ def cmd_verify(args):
         note(f"{d}{hp} -> {code} {'ok' if good else 'FAIL'}{' (pinned to dev2)' if not args.public else ''}")
     if not ok: die("verify failed")
     # A green health check can hide a dead database: scan the last minutes of logs.
-    bad = ssh(DEPLOY_USER, f"cd {WWW}/{s['site']} && docker compose -f docker-compose.app.yml --env-file deploy.env logs --since 10m --no-color 2>&1 | grep -ciE 'self signed certificate|SELF_SIGNED_CERT|CONNECT_TIMEOUT|ECONNREFUSED|password authentication failed|does not exist|ENOTFOUND' || true", check=False).strip()
+    bad = ssh(DEPLOY_USER, f"cd {WWW}/{s['site']} && docker compose -f docker-compose.app.yml --env-file deploy.env logs --since 10m --no-color 2>&1 | grep -ciE 'self signed certificate|SELF_SIGNED_CERT|CONNECT_TIMEOUT|ECONNREFUSED|password authentication failed|does not exist|ENOTFOUND|unrecognized configuration parameter|database unavailable' || true", check=False).strip()
     if bad and bad != "0":
-        out = ssh(DEPLOY_USER, f"cd {WWW}/{s['site']} && docker compose -f docker-compose.app.yml --env-file deploy.env logs --since 10m --no-color 2>&1 | grep -iE 'self signed certificate|SELF_SIGNED_CERT|CONNECT_TIMEOUT|ECONNREFUSED|password authentication failed|does not exist|ENOTFOUND' | tail -n 8", check=False)
+        out = ssh(DEPLOY_USER, f"cd {WWW}/{s['site']} && docker compose -f docker-compose.app.yml --env-file deploy.env logs --since 10m --no-color 2>&1 | grep -iE 'self signed certificate|SELF_SIGNED_CERT|CONNECT_TIMEOUT|ECONNREFUSED|password authentication failed|does not exist|ENOTFOUND|unrecognized configuration parameter|database unavailable' | tail -n 8", check=False)
         warn(f"{bad} connection-failure lines in the last 10 min of logs:\n{out}")
         if not getattr(args, "ignore_logs", False): die("verify: the app answers but its logs show connection failures (re-run with --ignore-logs if these are expected)")
     mark(s["site"], "verify-public" if args.public else "verify")
diff --git a/dev2/sites.d/brisk.news.json b/dev2/sites.d/brisk.news.json
new file mode 100644
index 0000000..4fe726e
--- /dev/null
+++ b/dev2/sites.d/brisk.news.json
@@ -0,0 +1,9 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.brisk.news",
+   "port": 8238,
+   "max_body": "512m"
+  }
+ ]
+}
diff --git a/dev2/sites.d/cigarunderground.org.json b/dev2/sites.d/cigarunderground.org.json
index 7b65c28..a5f50d8 100644
--- a/dev2/sites.d/cigarunderground.org.json
+++ b/dev2/sites.d/cigarunderground.org.json
@@ -1,3 +1,4 @@
 {
- "health_path": "/healthz"
+ "health_path": "/healthz",
+ "db_sslparams": "sslmode=require"
 }
diff --git a/dev2/templates/supabase-stack.sh b/dev2/templates/supabase-stack.sh
index e70e204..2ca5892 100755
--- a/dev2/templates/supabase-stack.sh
+++ b/dev2/templates/supabase-stack.sh
@@ -230,7 +230,7 @@ SELFHOST_ANON_KEY=$(get_env ANON_KEY)
 SELFHOST_SERVICE_ROLE_KEY=$(get_env SERVICE_ROLE_KEY)
 SELFHOST_JWT_SECRET=$(get_env JWT_SECRET)
 SELFHOST_POSTGRES_PASSWORD=${pw}
-SELFHOST_DATABASE_URL=postgres://postgres:${pw}@${DB_DOMAIN}:${DB_PORT}/postgres?sslmode=require&uselibpqcompat=true
+SELFHOST_DATABASE_URL=postgres://postgres:${pw}@${DB_DOMAIN}:${DB_PORT}/postgres?sslmode=require
 SELFHOST_DB_PORT=${DB_PORT}
 SELFHOST_API_PORT=${API_PORT}
 SELFHOST_POOLER_PORT=${POOLER_PORT}

From f3db2a311c1fddcb3852cba4314ab6604c9a2d51 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:13:05 +0000
Subject: [PATCH 018/104] dev2-site: public build-time variables reach the
 build; nixpacks on Node 22

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 119500 -> 121886 bytes
 dev2/dev2-site                            |  23 ++++++++++++++++++++--
 dev2/templates/deploy-app.sh              |   3 +++
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index c4b2018258cdefab07654626d5869bdb91e06838..70e19fa82c3410332e21e0eeded1602c816f0651 100644
GIT binary patch
delta 13493
zcma)j3v^UP((u%s%uF7WcP1nukI9Q<AWsO7fILDHAP^Er!Xp73Cb^R^Fv*0T36No8
zKv4*ygzeRfO4hKus62F|Q3uyg0awM{^#Ovb%;N5z-TnO5Us=W1iZ8yZ9)={G|3Bxy
z=cJ}@cXf4jb#+yB_05|{biX*Mi}+)Bc&G}W;;QF2&WSw`kswLhr*k#x#7%PIE@;Y=
z?Q#<S=F9E!c>FDpJNN?ir11_p6W^xES-VtC)8%Z0Gvo;fOXbeteQGBZS2it|7hpx5
zyjfm|sP!_F7vXP%T!pnO<i!YA%1aQglAUt(F5pF)wR(9iR&0>hA++(oNt1GKKMus5
zO4YPccFATWut{Ezt#;Xhuw8CO*de!A_$QjgiSh<~bICS@UDhq~#!a~@6$_SB)~@4z
zA}UaIOWl&GYdAx@bBggOFdsHJX$T{WMd%Cda$22cW|eJDc4hc?rBfuhHvFGiCqPoc
z@R8Xc0jT-DxhW7ld~EI$vD$d-%98o&`ds*$@2r18tELKx&uf@q6m8u^G>AFuR_1S_
z_OG#$CGdM1a<wLU58}@@G$G;06|eVxMjaxV#b)1X={C!bc8jgU$tDuoBm)1WzWG@4
zg|;}_J1reHM~Bm-VKfjELnaWK=pb-&=rxzX=ZG=}Qw%Oq6ZJ8v5sf#j?AH;eHLP&>
zla(m|dLFVm9ZLD6)lZp%3HJ(dsJ2@>d^(#`wzb(@?3$=@cD1uFhz%8Rsc{&4KHunw
z9~u7?VFg(_JDqGgpVgF<F&oMGG&Bt-n?Yr0@oB6bF4pY}>SWd}ESzs`s)voke{8xM
z1{M6J)`X-&V!=S8i1i9));60HdocU(XRW6tsNqAldEgknYTE?{Jt0paAcSwCZdrWq
zrh;@kRXPZKLY382O2HBeK}gazd}&jgS}O=l<O>|{PW*vdCANals}LQ_LsV`-;FJ&;
z{VK#t`TS0&p_C{t#cH?uwkahnhfu@$A395ViI5ODn?^V{)xxbcI&Chi(-h1EcY?9M
z5;F1W)3sS$7MF`LK{<lz1sfVxM`UaSh#}IptxkdE)Zn|39w97NOE^$Fe8=W_YN+F<
zT#0bU@Fkb5M%|mUZ9GW4X<IU6@vYldLp49QZRI#(&Zl;;HX#*UD@%v$WUYL5w+Zea
zZtMOtz%E|Cy)gJXj${I+=I-rjz=t2+eo=x)h8=e>2_EEs-%$wzJa=aqwDOHRGhlG|
zzMZI9Gx+g4bG4+E><517&gt-L9(~t`+6RcsEdJG9<#3G8*kzSU!j<Ayn5n$D6GDdn
zzUwbiq~siMg<wDN$m99pf5h>B?0#MHgz)0MaguE02WE~7PnR=})573$Tv9fNK<uhu
zInxs)XL*9!G@g(X*@0$IxeEP=DwV4^Q1XC0ArW8jH|NH0F8v-?`!NEhsV9^_eRmrF
zbWeP=NuC&J?FsXQvfon+OyP&4V|mU035jCITvKn74?7OZ=0?ci8zh5rt_wnXd-SeZ
zfo3^xm&!Fe@aEA6MypT-jG3Gt;9o9qBVtduC$vJfKcYoyQ?*Fz!m%boF7!k^qLPaQ
zEG9UhJs|Ci3_^^a2#?+q?g<~Sy1^8Q)DtF8Mrmy?gYhtl!#xI`{68THfx%HwWdWAt
zDRPNGnAaDglr}>of9CE~l0w+j0AD?kBl8~@86d)%UF88H8!PzX)Y!;rqr`%ELM)PN
zKELnPWd1^5*!U5lMat6y)TgR?qC8Ows+9p|D7AASNs>!>^xkxsqLkeOv3%{lQ+W4Y
zLs?Z|G<jx#2b{=~K&=Nn+5pY9s4zXzJuxoYy5f;%9S45(Fw(w_f3i0lX7lKK(-P-+
zq61xeVqMVz<c&3fkxRzUmFER?K`uKnKY)%SPvx~S6Zj{4#%U18wVYqMcYGuY-A`m>
zR&kOiR!l2YF0W9nTaKK?`Q;fHWQyd8<1g&XQCHyaKlY_ZR>}+7G=Vv8tmixXk|Lb?
zQERr4&$=%qdyyO_SILXzC8*j#q|&G&)uYNw2Q+QL%IRb<L<Y+txMOOtL#?crm+`~*
zrQ|G^>*RX50Xs<4Szh7M$SdVl@@l!U4VBtIkB#+8`eYd2Yw#GHi(O&<N<^m4O}BJj
z<5A0N$8fW5KrP=cn@91qepJ~qpz-MBQsLhvxw!-67TN%^Ot39{gawsK$(#&{Wrk5A
zuzC!*3#0%Nt_Rt4@dSpDTRjGk#-sM=JTV^WMBDLTCA}6E>eKs!r*4pKXg+lE#uJ+Y
zONLPeZYL01YO5+!Rg59UR(x;7cmq`Z(!Tq6+Wy4gJGQACRa+sG|Ly*`iT_tJTUCA(
zlfA~LZDy8^mJMi9@7P~rxQ7g}*1^!-cDOaNb<5;@G@57kPe&_yeSZ#o&U5<jZ&wH_
zrlxB3va<3e_2&A9vbqLy`O*rX;bvV;ZAGPdWo2D`Rc(z=-{Fw0<}Fs{#3;fiO`h!2
zG<VtTvRjj%@91)&LC;3Huwo?3CKD(j@CyP1p!DvA6y=~BqC&;4fgZ^t@${Jniz*;n
zC+th`z=NOwsP?4<sk-4w^;R%RKHaL?x+N7=bu}1*eT74y+x-`fWJc0Husg}Z-gH|Z
z<BL13rCl~VTP&@u4!f*Gr$KD*{fO+$z{Y>6zTKfZm$c%%sq}E%VDw<w$>pckzOeQU
z(|fZU4i#hVwJ(Da?astZIHb!2MmvqIA*w-TbqkGdO=xA!N~2qvoyD4{HeU$AXkl$m
zqik)lTQD9p+B%E{9ky+qmX=M<!U{*rCcTxl+U(Yu#_yy&BmaAU9z4n;4-~>L`P>6@
zO?M%4Cbc`d0OO+#UCo7C9c)vpojkJ;-z(Vcmh#J3>F|jIzk|?SG;yhuu}a>}bKz&h
zzvL?+_f4ve49wbmLnBU5ZK#Ya_&H#YapMCyF_T2N!AL4>7tN6K#s?-rAHVy7iM@|d
z?I3m3IyZE=Y<8b!>joRD*Ik5JL#+#_HLSC%*=}nwZ?bkf*>lu}W=F*u2y7!zO;|x4
z)@?3dh_$1u-O4O3D_c)Z;|Tngz>5U_ivYz`>=+avq`k>*C-7?;jv@x;LSTybM=&Cq
z`UBOT;Drxn%~K;QKDFH1>C@P49ag7Lvbfk~Z1+iRHfE(l(1tE%XGe)8X=^K+Pn}6-
z&Uh?w%R9-u|G|i`D^x>&UhVMF2M+_}@g)a4dq2=e?yu>qIX8atP?@*#>B^G@Z)9C4
zslBLQc3B_MukK%Uuz4`&iOJ_83x>+y)6e)SSQVRk$o@p}6KjvoJy~{cPR;q-YR@gN
zJ6CT$zkL0LRLg~!<~`+?W8##Y1360GfxLrkaMqCiLd@(v<(DF3e$JGw2evAA9Jph!
z<>I)BmlJxE57s{t@@T|E5f>72-%ltwpHT3G>q0_Fzvi+b@qE&X6Ny7pFPcg(B&|5N
zYV`#}<GHo#&KuVCOPA(XUPxPTCiCR-!K}f}gDp?Q55W`8p^TyBL*?%pXPnMFpSGZ1
z)8BkBreA+KDz3l&U?z`vKPu~dRMud_<Bf+KpXj=fJ@sN#(ll&6H?HDz!`a3&jc+)A
zcl)`DhI57$7o%1VpF7y34!QQlRF!cd{3n#>9m+R1qC{VtUYXwnsy}AMG-d?-aawsC
zzPu9})0m@vC%GaNUoK3DX)IA+m{CSA@2N%Ir3?+eT*}cj7V9qM1yi|1(>O<Wsg%k-
zh;JIFZUH4d4&sJiIHU#5Ra~kk`Ktqsy(XPcUsJid!Mtq6{OYQ5vrn_Ks-e>C(*@r3
zH7iE7>MK_-tG$UET31<C-e4|Uw#@8{u3uSM-B7ut>L#fc9OUK`ge9^#U*;j$tx{Aj
z(TV|-O0`GT3Nq{p?&D=M3gWh4%>%Fmt-7M}sMZysO9r0a8_)Oe2<;tZ^%7kadW)w|
z@&I{Bm-a>l2BZEGTF3mG)^RdgM-^E|Mq`+Qgjw`O-k9mKy2=Grt1Ii-L~LY}2;+vu
zqz&Oe#VXI#L5x0i)CTsO$>&J*aRaKp_1nql=7&}sgh9*W_QUpP=e{?g{LRpF^{dY{
zHl43ub8+4J_ZC@xp8n8^Yfe3Oxhts@ei2&=&*(}4y}>0K>{A5d$h_Wvs`x9?X9S+5
zf#PVO9jeP=(HCf-3(>mf3t`RYf|`dDez8ImHi3}o_{t{oZNGXHHuHpE|F@o8fZt|S
z0)J`sIBq-=rzK0nK2nOyAw}Cs2v_;KBl#NkFRbSWj-+V}C`a$`b4RACAxJ4Y3UN^d
zShHKTTiUJOt=k>EJA|k8W+>~kK&z3Zy}CZ-L;|E#$eO?c><yN+eJWW^%YzY+4r2}s
zciPl@L*$e_(jN65-Jak*sy!jCS~+xANKcTY!cZto*7vE%&GDy>=0$3#4#S^lqT$i-
zkB?Tx-gpbBgB*wTgx_>*0)+6L$I=DF!1~1ye&$%BTH8mp26d80%fCLBQxtNuXENE$
zdX*`)hFu_O3=p8mRGj764^)bkc=hpDLpyNl4`>xtUl@)R&x=mP0+kHo)P2EY!<{}I
zGYKq1cu-&@pnhdX4dXStRDHUUBgU9^q?U%flB7H&uV4?*apG2-#E?EMwuTO<M_N1*
zo9Q1DxjIvjD!D>9Y)R(EC$s%*ChA3}@G+f&*i?Tf<x>VB5rCq`I5-VAoyK23B@#s+
zbz}LYz%n3Hqb9a5JxJ9TD#s8Oi}v^9sk=jh#GG+XO2;b@7SydW8F;}{^L0ky_h<6x
zZ>qB}1QCy0Gt-!nwcQ;wGruPTGb6YRc>EU;%ViGV8;p~gwL`WtGvzWIPHVw!c1MfF
z?wnKLw6ZO>7OU8a6@SKl&P?RPzY+5-=U1*r4>A;dGWw+Y<n+_Ur!!BlyjW0;)z`ix
zqjYDi0o-B4g00=shM@+=eBDo-h0l1|Zze%9Z~x6Nv$Sj>lJ#lPBO?#2j;1+4U@`&P
zL?%6-G?WJ0_>!T-8NN^v+?Xl2VgJNdrXwJnuNzBZ+xus|Lp=UXK85ce%F@112<iNV
zp@Q^FVTKR%;rkc$E$Ux)QJ*=u{PER?SDzPCx{z<Vm~G+zGxX;|6tc>#!<0{fwPTAf
z-089~7YV5y^9cT=lf+U`bJ;dxVj92t^n@_+o+>JbGoGmd2<MxJ*Y*mbYy4KCnWje5
zW=jd68CID>N76AYjd~jih~!TzA-zU@MkXxgN}12~#`WuQzVqhI^JkPI#x5nxMl$b$
zN~dyCl=LHC`fRm6LbDmZP!YVEI(+2W7bHxYn7w&$58vlaf~WZ7-pbg$G-xStruOG}
zFe`T5o35FN^uFQQCm)llMP6gE@|$2t9-i_-ggVQWj`-s7=mMMPMCx%;1$=tK<g|^M
zbY4y~wgH}1(n+WB#IL_`;@2UL-lLZ@_|E@InMk3#c;rkuOU_38@&27MAjuQtoHmV|
zd%`44A@4skju*`ij*}<SkqWa0lLFWqP5kLh%&6q?=$B%9^F5Kcvo(Q6EEf!DI)X9D
zaFaOJsC%L?;ecM#Kb&0bi9*cD9<m%$uwHkgzQhxbHB&vI2&WB%_e8tMvH4k^F3)h0
zHx>`Jm(m+KF?{ef&7-~vXAXn}3_4l}kY^Ej{7vWQU&@DB{Q679v7-s!Ci>3iOZrlS
zJTWLN>&t27qsP*W9vNp7>zX3QC9+!4c@Bzjt|vCIFk;wre)eS(%;Q&IPVdbi76Pr}
zaAfF-A4SC=s7SO_H)K&Z5HyzJzRDogs2<Ux$9x>OeDt`ZFv0{z1z`jc3O{^r?9`ii
z6S*>=PXcWLqAeUlXnJ6Zu2Q88Q>XchT&0035~i3Dsx&<)`l`_;)-{W#ogN=ClB^mh
zFLo<i${>xjit{sZ^xNB$FlK?5j25$hfp3zp9@DmT%v;Tvw=s()kL_1G1{0Ril5^9U
z@W`=f%Wu}#jp<O&d(Rj^Y=HT4UO>ls5?%k#oh3J52r)rkF=}t&lzNgp2^-7!;aA3U
z?JE(c(Y?o0-o!)VLOgjj3R>(@xlwLv3*qNKGAv#bSU1d5jMn1+f9b6s(2d#Usj@{R
zP6|hqXH=eXoYGx}o`u#+ZXP3!7EdC1*3oK;i5Coo$M7YO>0=%9Hg>IAg)wOpa0Ahn
zZ3E!}DI?Y1(bL^HhR~)lZ)3^YZ%h{jibO_)-7a^?4j1JC#M2gZ)BNFkPqN%OS_mX`
zrKb!Mgdkcad9x=OAsgwBZ_W`eTBTMBO~$KKVz;OCq>dUn6K}4%JSii~+otuTp4c)n
zRZ5MxZf-z%t82jxCRH03VTm{Fje;d2hy3!Z`bpaYS~51y8Oc~;yD+_SH~;$8Dsc0;
zuVur0Zhb8$X|1a=K-x1tpjq-dS(S9)uLhbcMQ*nb1d-~2ng8{*oVnX;{1Imsio_kd
zj5)U0C|hJ?cVY!gKyT*O8FM=w%w=TZSmgtg|Muxk9EttJD_^gdVkG|X>$`hz$s^G*
zz!x;7sHlitBw8ZGeUwTk2&f4>Mu1W^c=`|yU0kG4SmD1t>83$;(Q7|}0|b7Cz#UxB
z$!uFNH?e?G)Zz<rvE(kRJItSsDZm&cpXCtqL0B`7?cmRy{W&i8;x|hCmwFk)yWSWA
z?OR0f-0;jlyeUC0*S+;{QW19YGbnfyOcVR29RA{41ykry!bG-3Bw{G#!Z?9r1Spsg
zXC)D{i12`2=i}ZkG0<HOqu5|{u7$6E+Y}|PcSL;FLX$1x551ieCnO{iAG#YcC*I0j
ze0zodVWRU90gN}MzOyQ<25DZ$cju{Kr7RXwl|$ip(*FHB9teGQ`{`*HrZ2u2v1EAB
z`AA)MioP)<^baw{#)#l|^RpY{RF~pHnljawQf4)!s(q;%EVrom)eqx%{|7Zt#Q*xi
z0<B2n6!J-zGBwL_q}jaw(&O0l{iS=1bO$;5X3Q7d*=DxL?Y0iK5>e+3ANIWfTCwzM
zzW%Zk-scxD7aD}z$oKdoSn|Cnql6FhL*qz11j>hNKWu>Ic(toy-&6ZyD$&6R?>9y6
zOQfNGqNa~Te*(WEe(*1F*Bd4`n>#G+R&%R^u|}k@boi^kOpJhuJnhO_?R3OsCcg8^
zRGg0Y%G4-vk!d1ApA(RHe`Fkw`u9e>8RnjUm%&Q@^1nA}*ct4{^FJ$#xt(~TsP*WL
zqrwb4Dip$MKJ?iU$QoYx`IC?rf;f2A7ZcGEzK+08H1x=3iKkb!#0$U3Oray+cM;i*
z+3neKL-wNVrP=jOZcTyQ)!vDk;rL>qR_sU{kNQv2@Sncu1QhDRuWV31{Pb792i<2#
z3ePWm=QpL87<};?6ju_C$gh0!O{`c+IxhtHJq3K{X9cj2XMX!z{bpi}GN;Tb-Kb8u
zwiH~v^_l|r^PjH$2wV9N-<3c=FaACi4;#zApIu4R*xv{U^`<yo2%1rrfRVlkP4MRe
zDShbE;99g;*=B0j5Qvlbh3}j3)@9lc8FL$`2ZiBm34u=tfdUhM9x-E79#L!+Ga~ua
zop{g@wrC<(e(0Q{rAm#f4bLGyjgz&QTbKjM`qa%9nf;C$q1mrbW~>(ZWqzP3nGZH;
z_?jOhHT$u4*|6is%^_huSo}`iA{$wj@`)CdJZfXhh_&SeW)W+*QQa&8B0nlJo)U7(
z2M6K|5tP+t)>dY9ZZONuj3eI9yzlFvIH;EluK%8R3YDf2Aamyq?Qj^kIP92vb&hC>
zTenhFVK&;B%Tf{99co-U-(+lMj&`H4(=3@t2(w*G{E#Vi>+ncs%r7^(gN^wut;T#~
z0Yi;exkHrQdYG(jA;e9}DLvk?%~Iae!@P9T6FhC*YL*D`Lz-}_GA$fthaJR<L-^-(
zO2Y1V(eAVcY4Iq9=2HodfgEif^~qAE#=x&;`o%>3g{;KkRcw86(=F1-LUcE-yGQKd
zqe@IHWN8MG)^YEwSoo(@vKhw+7y^+n6DqTqi2JB1$fu!w@ARJuZ!ldS55?g1-W?B<
z09uu&$3ePC6g}&Ge;j-bMRSPpk=zUUBzBd+*9ZcmeMuFSgju8fkO=cML&(+{Z&?!b
zs--iaypjSlpve1u3TD&b9dC9TWC9%WRvBReXbG1cSGv-%@w)P8Iv5NiLZ(qf_M073
zevdbtnv;nAh8HqGrwe<MdI|=Mlvoo~#J!3v`1EFx{ajXymq2C~?%ia9UI=@DaLGuq
zJnz>NVGY2LvOEv+io|9W8*?FzC8QlZYMI3#f1sur1in_D#9o@SNbXPGzvRJQonAOZ
zQriY>b(O#@_`Nbz0!g~Zu@3#Pa=rvo!h`|}H$GLlR)Ru5;GHxTW`b5mQkD{>Xev0o
zzG=uSY*CtKKnV(C{|rbe8rex=&u^zW2rl)bxD*?o93z{mT%LjAxlg%1114$SN8%rO
z3o)G;yqN6w$3I=aew}R<%-)629lQ*0Xqvk)uz7^0M-sv>GV<pb%Z$v1of+LCi~Aw=
z7{2->yOX`GjGK=M8VWGjd(`|l<<NXsXAmnXtep_*0%~8VM3lokxI?Kehm0tpk-}36
z%lMVDvm6Xzqn2AaTn_PxUK&Z;jCW35_(2SgfM0i5Tbyi;a;_Y5HJ@Pf58fZk;Z;qs
zFcKv=5}I!^6aJ5Z$ZEJF>inM*%``e)j!q*hB7U-zFRH*4b&H!RRVFQlqe((ZXnVTD
zI~*?2t<%zsA2EIA{r6%t1*14sl!$65)LcX4c<=mb+=}p~(zYD(^c0r)g0|SKTTxJt
zE{7cWnR0eHyc;f@;*I=utMXVKDoT;^_d0kegjyKo;+3cCpa_bU=jtI{lGMrv_0VY$
zft&`DNG_{eTOfYfJY`)2O!tQ&)yl&SkT!lqib5IQB$^^X2v;i?8z4&pwenp9WJbi|
zKsos5+<_?HDm%g<*}HHBysw#mp88Py;`bagadLiBJV2#k0>2}0fxyoQkS4Kjsia4W
zY>Tpf4XoCRefG8T@)}42w{mF>q(?nUIOI9lMFOuXp=-h1JJ!Ur=}66F^qZR%w3t_j
zyl^iR&oMHtj7%OQGr(vQGSYD2Kp3e7qXl6!L!TC}De;bu#S>$~35}!bV6$1awYbnU
z>{2QJS_>0|W%tKRBR-5am~hu*@|D7MkP>wedGSg3Raz@CWd^=}(zt{$@?`C{HgO%8
ziu7mVpYuau`_sI~*1;u>A&&5A8~K8r&1O0>;FoR6!4^oz_5W=PycpL<7)uC4XUEUF
zWE*2&D19=l)QUw-RsLIsiJB}VUG0st!nYEdi0}=tX+-<k6`HqjmLx=X)J@%&t#+%+
zdQ<z4Zh+}U6k7Ro{uY`2hq}73%A_A9da+i*0gY2DQ8vg;xJAJpq;3ubysRWXKGg5h
zU3f*wNV!&%96nX%#e&g$$Ob=2@V)Yg9qs;g<&+(!fJyn%4n>+th-UNVwxfT5aK+LA
z>8rAkq+2Q|M&}|9H>8g~ZKs1iCd6ypuI3J_3qK3P-GHA8;`wMPaem{gwAWCEqhoJo
zMEU|ayq7va2a`qIEN&2lQ~QzD`PK+ohs)%&ceSy}Gzo7^C)}+K8?hKA-d}Ek=K-ur
z<2INnX@LLuU83^THb{nE<&WDiMS04*s2hF@x+jn|W}(0_&fk8IGIKkarn1x2fb+y?
z1WRs1p{3K7PnXYg@%ulk#Xj4`x~%L&#PDhD);3E^H;Y#Ww?n3sASthHhgsU`G_e_q
z)&t9M)Kwlx%@rn9tk@+|C3UBxQ$(RY-3E(Od_y-#BhFF=JTMI=DHlCZ9WVCfP8^68
zAVvBB(bkT3c3KZi)2zapF7M_ZC=Ux0R^e^xzeYK=2g;ydfj&qmr(S-)T1cf|63Y>F
zmGzZ173hYm%u6a8*{_NGDEZOk#fd^3D$|v<eNZ|+gSr<YCc2;c>J<xT<8NJUZNqFd
z*+YGJwl7i)d!Yp$QM&iSzLX+F$L}f1>T0TL7Wy=mb#=9MHSA>~Eh6<erEecb7mq6D
zd*Qp}P+|)*#gV!OmE|j%h;UM)kq;|F`{0b0R-GA@t@pv23FIUFE^s8+IE}<GyDb8b
zaB6=^`Sw0I73lZU{pj3ll+W&m1dJVn_oK3RD7Wp0q@-Imkc#?>jQ<>^b3b&3xp3eE
z_~!%-#g1v-(0*7FT)u&X5}NPqLSJNYTJwcpcE?xX;m6j|W^A!Lx@2P~b8NJ>U@}4|
z#?2%JBN4mvlv6EWR8Ag*d5I)vcQoEh7|W|`S5%lQ=9^d4RnJC89sLmO&<R)6;aAxc
z4?#9Oue|#ZI`C#C_F<@iP0H$rVPD2tB*I9jH7tUPw<GWc(Q1rY0zts5%zFg3CW*ME
zhLFX^6Xu;1j7?U~KLRNjA$;}-Obc(PDiPjb$g4~~1T!^vVAWIJ&4-{%9pw={2#9&M
zD&IT`OCqQi)y3A~au|_b?I2WYg+3K24-Z0N4&matpr&$_c~NaWs#Ggggc+CNi@CO@
zx^cD-ikYl@K8W6TlahWIZok#qT_%m`!EQ>`AxI6iJMh@F3txZhJ#`os<0U4R{XA7s
zX#)Xae0C_AM<6ri1`C2k*9Nr5la<v+U>!_Wo<9O}p-TA%Psdu(qhB#T2IIAYM3GYV
z7)ItErTsDZG~*Tp5<F!G7<1B1yJCJGl43F5VR&)I_8=Fp;-9k@{D+a(ABVR?ruaoi
z9JUb<18t(xMglts+_GDzD`%gEi~<U1h3uFW*Pe+!iwIrN8JT#gAf}9a267T?R3;_C
zZC66&sRTkLW#u!_h$%AV>1UuKUqlSmI03{G`XTI+h%T0msui)rLM3Au*QrRUAI1~P
z``)T&Q8A-L)}xt(AvSlFGVmO3zz*g4=OAyUh#p3~y9gmf;2_SbBd0Er3>Z1EVuY<E
zKM&b@Mm*E!Ss0BzSc=)CP0vHTW<OS(^WO73bVf|L4@Kj{&$2gnp$C-3r_AV^M9dJ}
zid9=Jb~~$7l3#=5UJ+)E1Xm)ix+RbjG7vWRPeeGBR@7=HuV4b7*3#m_TqF}wnGjSf
zE(bQ?`Ht>4DMoWg=I3`f@-eC4%5T|VZP_G(Hg|A-ey8Gn4Gg^$zWH>4(B&W0MVp_G
zygQhkCc2Nnb_DJys&-mk`JEQ06F=yZ*_~7!hNK)$SH7de-p%fzn(+Mm7Dq=*7sI<m
z^jO~zQ<CsvEE>!H7$aL`3Vh0v*I|9{Mp7t>YkYc(EYs~Q9`Er>_*$yJgMf$tM}j{Q
z_l*to{PCe!(pv&TipLlkRYoht$c~6T%kCyM!Oane{ue8Kp`8}ywE8cH4=QucLZU&a
zlQ{8-Qw1#~DuewjB!xaqb0P4pxBo0eXnJ44a*eRGCaLCQy0$dI$8^c+|ELB0H|HQW
z4SofvURc>sW7^6N5kEpH?S#9DfVjsNM|P3Qt0feno*xned4v*4-~)QyL#5^FRD^?A
z^hMxjVRl<{0coKX|2tqlweM9*-h$ky3hGc!;4Z55DfYJ@!8CHV+)Yi(Xl5eYG@o86
zvSKd~`g6*YZ^7o?D^$KlK=>~4e-UB{?S$Duz#%#k%E%htPj#Gt$Pf=w>DL5~5fCeU
zl}g_epigR;NGFS|@kC-ttp9SU7mJia70FP4MopXzIMt1u4d{k}4H3BIlyHmQ2=yT4
z6H34)Qi<YGzugv5z$$tbPK(rN;V2a%)9P0%(gZqHh@7ffto7*s)VQtPA$QrWbJ$bZ
z1Lvl4c6%G&fo>^#8q~rUE>J@`d>*Qbb;FLxFM<F=oG-PBko)B{Bcy$?Ncs3Y{NsNC
DQMWCg

delta 11431
zcmb7qd3e-C((u%8t|XI$oIvggA;%CVkZ=dWm4q`SKmy1alk^Y<l1%8C5Ev&$1O!}^
zqs7Jp6%kezRB+yPM05e&b$5MN#dW=AJ$Bb)b#)b8Uquo5s(MH!;rre{zC2HA`lza|
zuBz^;u9*j(Hvj2}IrhI}Vxn~TH(}OOYke_$V+U*B8BY}$^(ju4vK5vMXKPt1e%jeO
zmWH22tVPVw7pAqc9PEu{L$~Udjbph8$Fn?y6Ih#nm);G<E>?*M3)l=CT*zi3tYxzh
z*0I?L7qNCW2j>^Fx!7C6s<!IHNaG6eH?45=isL{6>2%B1u=Q*uVma9=#9GVh5w2r5
zB5Yv|4XvyZTWzcfq4?aGlIifUHR}p=Iv%0v9PZ;GCOXh<(l%)}?k_TJ9tAdWazZA2
z;eU0)C=D+8^^;D3c2(y;RrU#hCJs!=0JHz8DUT+al2HhrCRl9&d@Js#J#Erx07O+?
zo>k3lLjFMmceOZpXo}{)#X&wu?5is<6;NL<&ebhL#%YUQ?EaDn2Ji-FOJ~ETdgf|v
zaJIR*jnIY>_=sqSV=EZd<Z5kiXmh&S+%_Ypg}7RB5TPjog_}p+d;(t~N<U1sIM5W)
z*z|}dZd|;_Op;dfBLDY`GXN|i`G#y5FUH;QxXnzsUyy|Q7Drpq>~u3{v(v*bsUdeq
zEB~6rxT+JeOZ`as{8HD#@cL&7%h1r??&f2WQP8xSyV^YNpxMRS*EHZR=MnKFnljSf
z+<Y9hp($u|w0ZcZprM^RHt=Y%Wmzpa{ckP%+A^w~B+4MVg#>B|)DbA6iDYUeA_zus
zN3+w7O!zwg<<;jjm?xffPK7rA73Wq+wh(d&0c9i`k>!ZH*A->2qro-;pVQ!6YSD72
zET!=^{*Tu+>rIM*4b7M&R=a)^bD1zSzKBR>iQ@Kj)L(VGJ9#{j(=NUGNux&de439I
zZ?=zaCJJQ*K8A35eZ_0Cx}6?}+ZMr<C`yVC2$_TmnwuS-29Jkx#W|M7XW=+nc>%Fm
zL*OKik_&da`FOE@eWIzFMyvg|ub--i1>(OwDbVHr*u(Vbfpa#dWs*a92ihiD+gzSC
z&bDT&$7OXlHLPCkYGJ6AEgNrux#Hc8iwBXALA{GND^;M)8rqnfJH+fwHn_v@-t<?1
zEu!Y85fMM51UBHBxb3Da*ylfb(_b{W*MHN^xXu0I%UdepeldFUG;oLwn}@)I{(Cl~
z+l>=}TMJC&vi!36_||c7SY&K@&vX~bp0jUjIUExeTOHbkDCvrY@v?p>MEk$m`ktl-
zce{9X`zPrh3(~4TUj(!I3@qDcXg2yHPYgM(iNar$S#pkRq4};TacF0j$bv+X_KPTu
zH;VNyWyZ3ho>A8r=zLLfPa_P~JVml)H>8Vm7b7xxUf+3^+rw>)uFK-Hh>MU6d2-iG
zNHwthE;Fql&+djKadBITcz@SG%fue$tU!Jpz=^~=;^U*cVmwoNCv3+-{$>WGYHXNT
za7V7O(5FAHsgYDR+!x)mVppsuzK3S*RB^sDkrqibFgq(ct`E(y5hq6CzR&+5QKa5E
zdIZjR%6n*ha2&Ntf5#1>PgdN+yLUH9nlDyu$HYo1bSoDK*DrE<H>5ZC28gWP`T9}#
zIeT~ZfYEGBv$2Qk+DdWgXlkrG+A}l6UZ-PY#i899+2fdnjb{^BsSlVT1t;&*v59@!
zlf(zRvj&tQ)?^mVrudBa=?-e*@4E-(Pi52CbXJbI8qu)|pOICv8Eht-)okg%aCcXn
zFU~zD><^5HXJ1D=$ERm=`w3EYP|xPE>OSJs^l8sOX!My`zKSFoThIn<p_c@yCD<Gj
z7C|Q-KAJMUE3VJx>wIyvksch-d1fP#`s-PNE%L?rj6S{3?2GYfCl()%5b=8w#j|@O
z3YV}O(38z<>4{}MR>J6|%h46<+|Y@Kaw$eL(CyK7?GU^7robj~Y;W4I|0h+aZlivw
zt`ls_tAnOS-q6;x22bgidq*d4qqA*talGE!yhi5OP-4e(IBwrKJeaP1`S6vH`|h;g
zO;`!lvu~I`t$c26eQn*eg?07i^D2VI#tvr-^BV1TSBD3WelBiKym!}dctAw$9|4C%
z>HaB2x6)Z&hBG$3H@*nt$eNDE5uGl+ZgmS?RtIVNX#`%)K8=s}KfM11h}uFcYVDj?
z2$w8?z5WAoF~IZUs{_diq|aa!b2Y7V@YPO?xJSgmd-4-<LviH}Vz(7n<NHL-J%zAC
z+;q>d?t5wUK_WD{*K~NCEkR@F8Yik@3t`Tq*#*>khQJvDD!Oc>*0Tg|B%lJ&F+wKm
z^Hl^6Q<rW&K8Sz^fh|6CEz^z6Um^g<#lm}sW@*h%?!bP~u%?5z@JC4=t#dV>PB_nl
z{QCjOOo?u4W%a!m@w<rQrvJx`{?G3{1Yi|++~1!3ZglJ({hlQU8XwAkwB*8oqLbxs
zM346;Kd?-%eP1Xx9<tA#fjoaVt|D*I0NqO&33X%iFO8^(!p<ub5*BItS1r@1b77zw
z`^y+(-4yd*N+WRS4b8YH+WdxDwFeAbl<S9wGr;&al;M!bIlR<=<j8!ZB^SFYJ>j-}
z#~*}t@zC*)E&riyDAiYpJtu}^_;~I_KKxC5e8O%H8e5!g4!0QeSeEfJ5+C(Xd~A#!
z^kV(Vq_|;tLvPn@*S4Fso3}?uoji9K28qW{CV)wtKWQsAGt*8T(_gze%y?iUSY)&Q
z_6U}-L)&56VcwzJ5wY6HqP9kM={22CFEUQeOfygm142B}^?c&ZlYn<i_NhU#dlp2B
z2Tx_-4XRLj&M8as8N}vO$>O6^c@QDK-kL0|PexyBO@DHT-ndhZ>QjA2(fwrp$cSFb
zbn=T@oh`GP|B*CwKLM5Qgd!X%=n{xGpZsmqVBGV5qtxw;Qfr;|CxL1u>UWy^-x?u|
zEW^$S6yE5g%hTio#4+`(3)i@$n0K0RHsYW@Jmb@NX@~>vcA6(kockzWMEyD~v|37(
zqOkO%Fz_+gq`H_B84IX8j09OaU6(O5JSqln;n-`|(6Buq)IMkkFS{$-pxYVA;%J7)
zhv;JB!}He``08S$iEcGpqKJKJda|>%q1jPt<&-9QOG;ZBFeUPchBMjXmcYI6zDRqz
z5YoiVryou?@)@LCl?@)GHA)D~#W9;j#GKB8PGLWtQpn#TEL<X#AMs7ta#O}&Re!h8
zpUND0iMaXnP}7SvuM>}+E)w6L{_6-mcD-gyWs4kb8-g)zPXqVVW6s)&DNrbx*0>H0
z$vbI<F#^uySyUg?puglyH9)l3{OpQFMTmj<nmQhhB&(9Yis(jS*A}S~INn548d0k}
z)j{*Wqp|Qt)E**n>_)2?|6E3_8L`hJo|_WBpG4DhRngJL_3*V$!Bqd5=T2*oBRb9v
zPp9ktN6qdDnjNfU%$VW{c;{Agl?Oj2o;z2WxRchKK=SBA$tmXe$>+0;(YVHkV&eIu
z+Sr&-CblO968!e(hv}nxa*r+x%an(H4M|p()eIQntYrKO-R|fnty$Nktu&(xMf;*z
zws`D!8TmOlss7jymcxc3e%duR(pWCbYc{g{69vb$y(d$}EtL@in2lm^S1cQ*F!#PU
zsGDi5uqQOqk?9)Xi{;UnG7V4%rI#VIA2hZ_u%hr1IHK>0V<T_`LW{DI6s%dXFA`x1
zj+?KIkMhOf$Y@^_!Z8P9y5c>gF8Zs)^oEV|3=8#CQZv3^FVm+-q7a;LFtSHfJW#+&
zi9LQ=#g!NBP$~+4U!2&(nD|aqw3Fn~nUHDlC7{ms{ywX`?^?#bYvFbhJ;gne_)Lnr
z?4ZUb`x1MyJ+-b?{O9*Jm?AR%kPX>l${&)u!&J$NN+Szh+x*mnhW;FORT^}C)`?dX
z({P>Xeb?!OVNn?6|2xKzaC*%udhQ2BREb10h^=%6AidOQ?wLiU&h(7y-Rw0->oYs6
z?@i>HAm;utEv+{X_YGpR>6-4rUt30L>)xl5#GbDry9f80m#i?SuZ~%N>(1>rSJkgK
zuV1g9rC5Ku>VB9t%HCr4OEClbqs{M~urBCFvG8C@Kfg*#!IM$Z_hfXXc>dR;#%eK^
z=CZn;!xqwMSE_ID+9{-!YL=n=G<5^;yhvR?MrmvjTil~ewgi1yonLkXTiP7iqg>2+
z$MhJAEt6BbAgSd4ORx0@&AoR(0lQJ<;UmKS<>_PAo;5=T?Pd-A6xHZU!8@X#J7Y4B
z33NY$H}#`o{d)b)=uo%JY6Y8#H(PTsCTt2%ci+?O?8j(rzg~Z~>uA3rjiG2^!?mzh
z*5--m(PcBfHtBY}X0UYTx?U3|nhL2Rb+yLYed!3-hdE%6dxnXIm(wPOR~f?G%;U=l
zTeI2Z%RJH1vkvHXW#IV_TXcgcxHwAu>*eT}&K~=dlEu|s10zB=E88ftUzv@MlXb7;
z!c?*MmHgD@eV(LgJw{_Im@ZYu&xB;U?bA`6EBhVd@S3ZH<<<Nt-s(_Zm4gAx8#SN1
zHaOi_BD3<%6v2L`QM0w6-Nijt9*w;q*h0m!KcQOqhhqJ!wc7U}UVL?X_ei2BCNPSC
zD!Lg)jT||WzeIhN$UQ(Uk~I_+k5FqlaZ<G%N)ti_olP{hg}S>5>>;ohfj6S4ojW&R
zJ~M;AjQya&!#f;a3%-Vu@i|n4Ifb1^qB*?=9Gc3z#itkU!W_8kwb7yCqro3|?If69
zAcimcTVMZ^h6!BhoA;(BAW=v%C6tnu<hJFBFW)RGqFkG+*N=J_(G!U8BXEoWr4B0n
zP%)qXENb2wolKP_P65Bq8)&XL@Rlu36`Rznriu2MAYOYbKS^mtJ!Q;P&2zaOSR0Cd
zdr|Z~$S0_8?`Wh#Ve8vVqKc8{7dYsC+W*SiPk{dQ*h2sI-~e-OLi7!jqh2ywm+B+_
zJS2B%r0$)_$Yq1|?<7oImZ%RV8nNA^6U84TiC6z#4GALiA2Uqq$yFrQ{v*dY8u<<r
z`~LAuoGShBHZ1F&|1i}!0Y~lrzkPTbOv;X$c<^I4yetww8Ii1XF@g4=(ncx(;pUfo
zVvqWPHcw!r|ISb9V8Oqs|0B&0Cyh`p-;>2XL!(y+d_q78^e}A?|8>?-J<`G&>)RSy
z9rdeSoKHdyrT$T$4vR$*SADm_MCDOlAkKX^21bbQz8e#lM*}JyQ||>$Kx&ex`F<@{
zrNx==r$M>6^8Gr)kJ@mn+_M}~#r8}2rfDQsk@&Am6QNREymSO|{CEHG7!3asdD#qH
zZQyg_ORDD|5(s;|sw963!gV<(gOctaV{@10wqiucos~N;w|1G=Sj0M7+tJidT%M`@
z4E{@(?*vrh_A5>p>;L-7AHn=Sa>OdKIDd5lY!H{P+9KUlUb;0g8TQ-YyF{gzxrlU3
z<DcS05L)B_Jq(9UvH{?k=tU&|VggIBaCNB&#}{MW7M99KG>~wUoTP^<rWJ(nPjT+j
z2<Vb717yNVd8Yx&W)SC~q0O<;qe`M7ZzfIiBwUP>Z*X#j@Ebj7L}N5L_<EW*68HgR
zoDmu!OS+9P#4?W1=aHi3$cK!OoOPYwuc9UO?agkkE)$#lixJujjWlZXG~)vyXms<Y
z`X*kBjDq^c2F6d*Bs7McXu5QnV7##dXUhU7Ot3yOt_j;e>YJFA=OCtcj%=R{<+42v
zY6=OB*Wf6hPk;g*&!n*o0^y>A#uvzc#X+ud6OMNWlH#G*&`sPz^=9>)P(^3Dqr6dV
zF6#zYOGm529d-w=d9fO@{-{|Ccm_!lWt}(OX2lAAt5w~qJdHT2OE!_#r~A)q#&?m`
zUT*b9SnW-#t#)e>uf|Dlr2K6%l%&rj#2Nwz5Ze|Py17-=JVPc7gsIu&BetkMRg=*D
zLL~3u6n9AXKq!m483%UazuPU>Plqh=@3)fz{~ibn4W>VkRL5my8swW|i7ZE=q=zj^
zQA%YQ(wYug*I!}VWKB8@wcLgz2Z-@oI`Qh;nSuM$;hZ+Q9hvqVcFMf3`2@8t(3Bx)
zq_gb~J<zTRx+e>Y;gP`eSx^YzkY8FM+qf559||O8!~ej@GLkf05>P?pBC-4yLC<R6
z&_IR4loN7bs_|~*@Oa?n9O%|-<(j;j2jd|jFg_n_0M7;*3m^yJ*1&Bx$O9AM^1brO
zVPGp%hcAP;g&ifLkDh5!{w{$%(o_hej1M63uLF|{!ECk&Vx;6vkn>BRBIy~FC>UK|
zKW+Z}`uR0j1FYxKfk#WA8!R^wZaIP2K*?xW4sf@;a|{e0N#`?k6sam4s*m-RKrNz*
zWaDZ6Tlp`fGCqc!UI?U(h1<>1Dz1?u*Wv7`GMETw<-f}y)qE7kFr3QR$&g`DE~%pN
zAUSq2+MqMAW-^q5X%@0-7%f{TgDWs-D#{8SQci=>@U#5WG{_hkK1-D9axclNs(8_T
z^rZZef*c<tQ>McZ&8^8>&O)YKJ{_Ws&*2iU2U@1X0}*rR;{NRCt5>h`4N7FHetIM3
zW4W`j1JjfHXbsX6e&b`GY@KH1^RUBb)9^9^yRaM7THO4%vTiPTEicoeZ_vz(@}0S`
zGFh3IN(P~CsVZrHhMZdkQ-R4{RWM|vy1G=ML4|Tvmg_Y?Z%0yF-@Sb+->-s!DF<m`
zQ)5HZx(@vQ4UzE6BuA5*m&urUP+)uwr#}mn&V%0?i`891$r4`aD&tXMgf16v?84Aj
znx$5^$JK7-BS^d)IieP9ao2^N@p4Tq97|Q6Lub|-gWp6cvi62XEbG1zD6GS8S1jS%
zw@c1l1S5<eAhJHty$FUH;d%MUG8i7c1(yjLHaH!fsJC~QK|bu2hUM_*!BloRrdNT7
zI|#|tw8qi2&MnWcfRT_PvsS=8W<uhhX!7g|C>ffm$9rHf?*G!Kx=Xj{E+jR*HmvcX
z1$!18$h&JfHh<usYBG5xv?r5k@T$je<{VyAk^1CA<h?6lTqrx4E8kiPS!rSUl@~ov
zi>YMdKbnkRg<m)QQ<LLXL5}eU+*eYdeii&=oc?>lvJp@*CLO0j_xKiS-9z9Qfzt#w
z5+HZu?^Ej=0v+-ogBwihNPa6XGf2h2I?w^xaocFRiNG@iekEr*puW3*d{E!q+R!=4
z&(uv#g=nr~5v6hbW&(6=a=I}%omWoBfK&A0<Sd-b#A#3X4Y0Gt<KX-!8d08jg@z;Q
z>zT93gSW_5oy=Vgc`6QsvZ-*uqqC?k5DE~oWi@2PNt7k1;Wx=-QN9Y~u7QxA(CTdF
zXbNsX1Ll(v-=ipD4g7O8ykmq!dA<b_!6x5mfow>S-?zY-q#Z;*mwesaf?pdmC+A<w
z7h7SmNf`~~kTw`*j6!A;0{Gp}B@OS6IqP9v_yq9RX-_JyQa0y}>-B%;XmNNPy(i$4
z^)PNEos*zBG{g9NL`vBr9>=hvm1WeGeMOV=I20sb=RiIptChEN$hE|vXqB|rFG7Lq
zZ4Os8_`7_&10%xE@}~|M1q0;B4KUIek7$bnjtv+&AX+}q3EA-`<mA<giZSe{=ZZ~U
z=!7h&k{3H6J<5axoWP2}z>Q#r5|svDCUYohf1=j)39s4RSnqD>Xy${F@Ww#RCfH`O
zgb)6xzz5y%6u@kG_h!7D4f3_kFcuTSh+DB>cqFjxR(J-?za*<vYO=ThlI0hhAr0KJ
zb1T@A-1PpvH6;h`H|OB@%(Q-<Jh2thVqd^c(A45+ZfM%XljR#*AqTTn`QuiYXv&~{
zWXg%#U_J)qUE3hDK;4T<$L}B$%;j9|ypdR#*EG1*7wr!b^KAL&Z75#6jJyr12C8$@
zj95GgInu8boUM2}uDcD!8q08`F>v%YD7RSDseOg$C(Cd5!n75nTd!%jl{H#Ry-~xh
z?JoMAh_zJl2?fn$l5qz~5WBFlwz9ecW9;nuxs^-#?X+MY1(I&m3qd{n%yREOm|%(^
z@_2b+A0$DJ{CFRhH3!N$0-9j6d|be;tbru4dC9be)w8Q-291>q7uGDSJ_cOH29<Xw
z$!GUt_OMIty9<6y{|c80LXLXlR^v|`6rKv@eUa~!AMS_qCNecQ$zR<K%kwDQg`!zF
zdpL?)z<RREB<L;956eOcXM5-_N+?cMG3(c)G?lHXT)|7-3_0-tI&rIX9e~u->yE-z
z!cevLGI{s_v|E;=C^zH38;mNEn{*FUMI=<A0NyCOy8{DDgWF-}^CW(imY%FUqqktd
zNu%E3@~0NC%FhqM)D%*yHy%s>*7B;FMHTfG)9V*4tSaMnS@AI35(*m&>CuuTKX@2&
z;jlCw#xOiX&NvJeP(!Lum9hIFQa*kdoI|FQo=CIR{9CeW1@?mmG76_N9D4s;WA%u1
zKLVX;DjOM1li>@3d<~D6bX7q*hWsH%U~Ehsjj5~!e-a`cN1)W`z@hsBj~syxeOyzB
z1aZ`s=SkZ!m>Wx@n1(pp@RuKau)OscRE9h$LB4zpMhquhd;nBeE~%eYQ(ITY=h1-0
zIv+drHPuy1%YsnMDZla#lbZ!*LuZd+-e@hEoL9_iWZkb|)!^$4rczCYY^3i9WX83)
z@NKjXyT8PLw-uDl1|EkzeX0^!Njn1Pcntw{BQ?v#k3&wvHQ|)-o;7&S4wk=o99BY-
z{Ooa<0wbjD2^gBMDAf5&w%Q%m+RCaK^|h4?7tb!Qq|;Rv;+r5nPhh&<Bp-SLzJLYt
zj*~DLHGA|V470d!;Zr1CcSyP)PQojZqe5yVnW_mW=@wFJ0fA-$*PYo6`QtM%q=<4>
zrAI!STtLwj5xU|N-fEU&Cg+@i{K507O&)^>F_qeB1ik{f^9(G-Dwh1{3{==vq_4sQ
zfmq5})P1G0g86+$Rm```MbBdTlOS(<7T+W<2Yk<=zs6mm)6_^n9rs!C!f#Lyt@5+q
z!0=KP^=nA_`2<wxR{>w0*FI$wqVLT%DbbWQXCc?Llw@8ey=T!iH(>j@!0EHl9-Frd
zxzW$I)_34{<LC_7#UB!=2p_Q;hdLWtT6l%5c?HtDRZ<jAg;W-FUD~5|9?F}DaTI2u
z+)+=(HX8&@4NV>_67nsidZnH@q*b7I9LMK8WmMh)c6*!4j`abLU8RaD#qvhj?d{zi
zjV;b5Z;ajUY;Hrg_7)csQSucu_aq;GBo-#S9rxnmwX|n9fkp)0I2v|4Jofemw;O)|
z!MKx#Ey&vC_Sju*Et_~Njo=DRuC}HQ&K+$S&)y{=HU2_8e)8`~`zmS3#WUu86<D{E
zhA2r1MmI24k6XcKJ^qr8z7OPG1XS{-EU5A}m9o7?+<J4gP->^FdR;C@=@h4Xm6O>x
zT`TIy@@-^kJRV6pPH9Lms=a}`9kjfgOS%36q$DekQtvwTOdzYGKRkE=QloC6<q3Qo
zc;N!X8pl40?P_%g+qCM>sDxyL&!T9J4XUjUj7<ybXI9o#+dB9b5~N1Pz6lva$531O
z;On%+aH1MO;1%lbpw>89^Cnh}cFMLlp<qEdjZY`Ag(fdhOTCyV84MMLsDR$5&~h80
zj3S{`d1xASs|cJXy!+%o--PwuUr_rJ0Tr3l?<kdZ$gO!Rfi?olOT*^5gT_=<R#j?M
zk@hf+9V4KON58+|s+g;4w$UVrGHAHK^#gR{;3S$+dAiEP!+H8%noy6&>oWH196{Ne
zyh&M=$5D%N$I$JoVtpBPRa8=b(d!ar<PO*TgiK2rzN&uK|6jk;oYd-K9W9Q@d_Pj)
q-gNGDfrD?uCT-9#sDW=*fF8=>KT#=A@Xgpv$oi&2PW&r;_<sPV`44XZ

diff --git a/dev2/dev2-site b/dev2/dev2-site
index cc9fce6..2e2ce7b 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -386,7 +386,19 @@ def cmd_scaffold(args):
             nix = shutil.which("nixpacks") or os.path.expanduser("~/.local/bin/nixpacks")
             env = dict(os.environ)
             if cfg.get("startCommand"): env["NIXPACKS_START_CMD"] = cfg["startCommand"]
+            env.setdefault("NIXPACKS_NODE_VERSION", s.get("node_version", "22"))  # nixpacks defaults to 18, too old for Next 16
             sh([nix, "build", wt, "--out", wt], env=env)
+            # Public build-time variables (NEXT_PUBLIC_*, VITE_*, ...) are baked into the bundle at
+            # `build`; Railway had them in the build environment. Declare them as ARGs so the
+            # compose build args (provision) reach the build, then keep them as ENV for runtime.
+            pub = public_keys(rw_variables(s["project_id"], s["environment_id"], s["service_id"]))
+            dfp = os.path.join(wt, ".nixpacks", "Dockerfile")
+            if pub and os.path.exists(dfp):
+                lines = open(dfp).read().split("\n")
+                at = next((i for i, l in enumerate(lines) if l.startswith("WORKDIR")), 0) + 1
+                lines[at:at] = [f"ARG {k}\nENV {k}=${k}" for k in pub]
+                open(dfp, "w").write("\n".join(lines))
+                note(f"build args declared in .nixpacks/Dockerfile: {', '.join(pub)}")
             gi = os.path.join(wt, ".gitignore")
             if os.path.exists(gi) and re.search(r"^\.?nixpacks", open(gi).read(), re.M):
                 with open(gi, "a") as f: f.write("\n!.nixpacks\n")
@@ -419,6 +431,11 @@ def env_quote(v):
     if not re.search(r'[\n\r"#]|^\s|\s$', s): return s
     return '"' + s.replace("\\", "\\\\").replace('"', '\\"') + '"'
 
+PUBLIC_PREFIXES = ("NEXT_PUBLIC_", "VITE_", "PUBLIC_", "NUXT_PUBLIC_", "EXPO_PUBLIC_", "REACT_APP_", "SVELTEKIT_PUBLIC_")
+
+def public_keys(vars_):
+    return sorted(k for k in vars_ if k.startswith(PUBLIC_PREFIXES) and isinstance(vars_[k], str))
+
 def render_env(vars_, s, st, service_name=None):
     """Railway's rendered variables, minus Railway, with the data services re-pointed."""
     out = {}
@@ -446,7 +463,7 @@ def render_env(vars_, s, st, service_name=None):
     lines += [f"{k}={env_quote(v)}" for k, v in out.items()]
     return "\n".join(lines) + "\n", out
 
-def render_compose(s, st, app_port_inside):
+def render_compose(s, st, app_port_inside, build_args=()):
     df = st.get("dockerfile") or "Dockerfile"
     img = s["site"].replace(".", "-")
     y = [f"# {s['site']} on dev2: rendered by cli-tools dev2/dev2-site provision. Re-run provision to change.",
@@ -454,6 +471,8 @@ def render_compose(s, st, app_port_inside):
     def service(name, envfile, command=None, ports=True, vols=()):
         y.append(f"  {name}:")
         y.append(f"    build:\n      context: ./app\n      dockerfile: {df}")
+        if build_args:  # deploy-app.sh exports app.env before `compose build`, so ${K} resolves
+            y.append("      args:"); y.extend(f"        {k}: \"${{{k}:-}}\"" for k in build_args)
         y.append(f"    image: {img}-{name}:latest\n    restart: unless-stopped\n    env_file: {envfile}")
         y.append(f"    environment:\n      PORT: \"{app_port_inside}\"\n      HOST: \"0.0.0.0\"\n      NODE_ENV: production")
         if command: y.append(f"    command: {json.dumps(shlex.split(command))}")
@@ -504,7 +523,7 @@ def cmd_provision(args):
         st["dockerfile"] = find_dockerfile(st.get("checkout") or checkout_dir(s), cfg) or ".nixpacks/Dockerfile"
     branch = st.get("branch") or s.get("branch") or default_branch(s["repo"])
     hp = st.get("health_path") or health_url(s, cfg)[1]
-    compose = render_compose(s, st, inside)
+    compose = render_compose(s, st, inside, build_args=public_keys(merged))
     build_services = " ".join(["app"] + [c["name"] for c in s["companions"]])
     # Public repos clone over https. Private ones clone over ssh with a read-only GitHub
     # deploy key (the alias keeps one key per repo); some orgs (moshcoder) disable deploy
diff --git a/dev2/templates/deploy-app.sh b/dev2/templates/deploy-app.sh
index bf65a05..84612ac 100755
--- a/dev2/templates/deploy-app.sh
+++ b/dev2/templates/deploy-app.sh
@@ -86,6 +86,9 @@ chmod -R u+rwX,go+rX "$APP_DIR" 2>/dev/null || true
 log "At $SHA"
 
 log "Building $BUILD_SERVICES"
+# Public build-time variables (NEXT_PUBLIC_*, VITE_*, ...) come from app.env through the
+# compose build args; export the file so ${K} interpolates. Never printed.
+set -a; . "$ROOT/app.env"; set +a
 # shellcheck disable=SC2086
 compose build $BUILD_SERVICES
 

From a6123d52d2fcf97396c2cd2fed4c27649354c18c Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:15:05 +0000
Subject: [PATCH 019/104] deploy-app.sh: export public build vars by parsing
 app.env, not sourcing it

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/templates/deploy-app.sh | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/dev2/templates/deploy-app.sh b/dev2/templates/deploy-app.sh
index 84612ac..ac603f0 100755
--- a/dev2/templates/deploy-app.sh
+++ b/dev2/templates/deploy-app.sh
@@ -87,8 +87,17 @@ log "At $SHA"
 
 log "Building $BUILD_SERVICES"
 # Public build-time variables (NEXT_PUBLIC_*, VITE_*, ...) come from app.env through the
-# compose build args; export the file so ${K} interpolates. Never printed.
-set -a; . "$ROOT/app.env"; set +a
+# compose build args; export just those so ${K} interpolates. app.env is a compose env
+# file, not shell (unquoted values may contain spaces), so parse it line by line.
+while IFS= read -r line || [ -n "$line" ]; do
+  case $line in ''|'#'*) continue ;; esac
+  key=${line%%=*}; val=${line#*=}
+  case $key in
+    NEXT_PUBLIC_*|VITE_*|PUBLIC_*|NUXT_PUBLIC_*|EXPO_PUBLIC_*|REACT_APP_*|SVELTEKIT_PUBLIC_*)
+      case $val in \"*\") val=${val#\"}; val=${val%\"} ;; esac
+      export "$key=$val" ;;
+  esac
+done < "$ROOT/app.env"
 # shellcheck disable=SC2086
 compose build $BUILD_SERVICES
 

From f5fd1f9705992cc0b7fb9548158a567209046aa7 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:28:21 +0000
Subject: [PATCH 020/104] deploy-app.sh: recreate the stack when the network
 subnet changes (stale embedded DNS)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/templates/deploy-app.sh | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/dev2/templates/deploy-app.sh b/dev2/templates/deploy-app.sh
index ac603f0..92dbb6d 100755
--- a/dev2/templates/deploy-app.sh
+++ b/dev2/templates/deploy-app.sh
@@ -101,6 +101,21 @@ done < "$ROOT/app.env"
 # shellcheck disable=SC2086
 compose build $BUILD_SERVICES
 
+# If the compose network's subnet changed (the kit moved sites to explicit
+# 10.200.x.0/24 subnets), `up -d` recreates the network in place and Docker's
+# embedded DNS then answers SERVFAIL for service aliases like `redis` while
+# container names still resolve. A clean down/up avoids that.
+WANT_SUBNET=$(grep -oE 'subnet: [0-9./]+' "$ROOT/docker-compose.app.yml" | awk '{print $2}' | head -n1)
+APP_CID=$(compose ps -q app 2>/dev/null | head -n1)
+if [ -n "$WANT_SUBNET" ] && [ -n "$APP_CID" ]; then
+  NET=$(docker inspect --format '{{range $k, $v := .NetworkSettings.Networks}}{{$k}}{{end}}' "$APP_CID" 2>/dev/null | head -n1)
+  HAVE_SUBNET=$(docker network inspect "$NET" --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}' 2>/dev/null || true)
+  if [ -n "$HAVE_SUBNET" ] && [ "$HAVE_SUBNET" != "$WANT_SUBNET" ]; then
+    log "Network subnet changes ($HAVE_SUBNET -> $WANT_SUBNET): recreating the stack"
+    compose down --remove-orphans
+  fi
+fi
+
 log "Starting"
 compose up -d --remove-orphans
 

From 945c1e72c2ae92a6446a059cee83377d8b8e31a8 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:30:15 +0000
Subject: [PATCH 021/104] dev2-site verify: require the vhost to exist

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 121886 -> 122262 bytes
 dev2/dev2-site                            |   3 +++
 2 files changed, 3 insertions(+)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 70e19fa82c3410332e21e0eeded1602c816f0651..4d0b71ba4e21c52f125c8ac956429c09755898af 100644
GIT binary patch
delta 1591
zcmaJ=ZERCj7`{($+k4w>-Pqc7g?-#P7;J0|0SEFSLKIB2z*O*KfXGfaDoZQ3cVm<`
zLqZ4|0&|-l3>i+CL{mc`ejE^m8BG`=fs2e#P>3J+k%$WZ5yS+~X>FK)yh-1@=e^JK
zyw7>x+dYSs*N-Z$Q#m<Ki9gf*AHC4#e#!Nr3&k@nc~%;BVFvB;p@8N-jk2N+L@bbq
z9G4A6;Kf6%#74C!O6g?=mCij3HG8*2?0qs(-cu8D&yC8_J)0g@A0v*n(<MnSGIG;I
zPIbmW;NwS5$QqGn_t_Fiqj<ZVxRt+i3EV@{iW8C)x6%H0P&A=M3T2brn2odZjQou1
zZmCahvBd3$CsPq<-@;KLko=4+7h1)I6vLYVkpki-9#TlWq=@*)=oU3*-wQHE$j4+M
z`YObY=#5DzrZ3Jyt}lPIM2g!bJ{2pZm`Y08rMM&Jh-8a~h4jEIDDd?h+FJY|Da|y7
zw0*Tzidj1yQ5QF0HA*rDGL1-Cr^;`n#T>eYlylSf?3Pl3YQ#b+_<1ayJR9EHyJH-8
zSN!f?jM9uSsWdctg;N~k`)nhY()GJzyffz1{V^w*klM{7|4ScVm7%AV<5@;Urbo=l
zEmy~~#GHD*x#lU6$V8$f<n;SU)`+FoB+&h<$Clc=xR<w6A+-rh8VPBGL?(?qRn;xh
z{rsiApMMehSP>?3aJ1YAL=3Gqpw$J8rn*o|Fw{{O3G!lXAoTp|)&QxCW^0v|TA*o7
zSlbYYEYL4-?j@P0(SlG|OEI+eHQ`8&p*4qfEjot7jG3C=7SdLcK>L(hA(uiJT2xu3
zH3#*GK@ZHq3O4Eibju!h+SpRzZi@)Bc%WuA-1Pl<D9YNFvMqv_{xA=lok?!|NB)a6
z(slDOW!Y85xvk#x)PK;%HXhnIc<<n{&+b1r-EY<}8frBQ8qKCP!%Fai5<aVh&nfH7
zw&<5i^lLTCbd~p)_b+&>s(*}Gvv3GQl_wp88_ma`F|(f?RvX#A`MA%4Z`s91u^hH*
zyx|=-(~s+RTxS!X#A4X~;x!-ZT#7gCm`cl*V-G-&EyvV~X?$goBJTO-&(h6JlId<b
zTfMr!p{rq6Wp5)-Z|O31ufT1%Xx>VUgN4?w#8{h~)2i8XJhgj<xwzgf!g{f-TO!M$
zy9nNOpBMQTJY2Hs0TR|v@{}$Optn|xM(+_p_|=6$U5H+?HwRmdfUbM_K^Om4PNId)
zNZ98HtCz(jHTF|8f(jP1h7dwBexrlyuogFIjgB%4$NP0OD~$qwP3k$5EM-X@cP#ju
zCfl$btt`-vgMiKoJ1_%iXNx!Bu!_x0-Heb0FVpo~umo4w&=y<<I@tcL_$3E>S$8il
zV}O1C8m7rguh54rr9b-(3^{Ow+4i9X$fXqneC!{y$N(k-huFZ|@Y|G61wliKP?*3m
zn{q-_I@6U~2N8F2>iVNd;yhdO2`*ZYq}9i<1LxS0<2dEA|2x}PPU9&I)9+4WBCb-`
z89br>$p=_v(XY_p86?X7J5zn9m~OuaCqzinsU~*fHv8PfA|)@iiV+M}o<vZ#dodq>
KOrc$0VaGp}b+WSn

delta 1292
zcmaJ;ZEO@(6n$rAXJ==>Xlb{V?e=S1z#=AX6eY!i0b(?^wS-iR+E&eLON-eiGh=JX
zY+ApX{%96(g%@oAOGIOq5Yhx50ZBB$6oMv;kQAD1BAWQ8ni_vd4H$fH*Tv<JFPWSB
zdG0xP4xQJJoYjL@0s$`(uj#ongPTj<37!rj(u^3JDaP|`xEbq0)D?F*pxP?YwVia$
z5faxNb}EQa)KvOO%un5pHchB*dnAy2)8w$)uf*N9FZsG%)oLo#69Y9;$dv`kYXU{L
z1G$(G>ZLyFrvVzID`*id?)NzEW1uS~u%k-21E3`*N>fVm{BStAf61uvI37x<5hgS=
zOx}j&0uh<AVG=hS!}8}CvW};qv*>A5C2MAV8>ZfH5yv%V><x<bE<2Q8pI<{C8uJJx
zs~kg64hzZ^VtrO>tEJG0NK^_gdR_;})MW{1`RwvM6s`KNYRi*lpB>J7wAzla@fMUD
zHHWpVBvndc9W5xXuHEw_A?CCHJ2w{1&*dQFKD#;(?sx_JI>#puRzRcnex1;IT9Q(8
z@dLD17xdTN?+1m{;E+LgK9^i!dmBxiu1P7m6v!x{YYU@>huh6IQ8YgnKisSrhJCjg
zUFtLDJYTZ~2i3sJT)k5^z0YoKMMe0Y^e3}Z(#V6FmC|ft`Zm1lofqqV5uc^8ExS>}
z{_YWf_S`o3c*S;XFz_Sa(S}!{EsCDIe6}6GyIo7dXDywG@=Kjq2kkErm+{*#;;0*q
zjCJ7%2z#O%kD-YTcB2*wo9f0L1lVK`Rs-y059)&@;$CaTXN?Ob%gL)ZBK&R-?rEWG
z0?zzUnh_~<S$cj})Q2xiuS@@;FbgiTmkuqcqrDdUz7HQgDs`AiX(UrqQZnU+1$W=T
zn|7~hmWd!Izg%UBex%UMn|C9jqm^GCLQKVPY@>xe(c5y=7MmOV1?P;*Z1!+s{96ls
zc!{sKQK#Y#>lncl26$!!r+^`z7{x}w;&Xd()`KxV{vKiqCfL#k=s<=)J%J4H7O$Gb
zVgN_E_mD_qhQGq_xQYXO|0np>z!@I@43$8TO&`Y#;C%5o8iA8M@&(#7oa2Kh@RNp%
zyloaUUeUJn6>i`<zjOgN70k0^Un7AuZ~6vTg6@A$sHCwA*VxNxJc6IuL>fCie+pR*
zikV@z(nwW5csg^R)cmP5bJEPS)K%=mGT-zA+V!IB#S13*$2T#cx=XPYf2?Po3=;nU
D0KP$`

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 2e2ce7b..4cb89ed 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -742,6 +742,9 @@ def cmd_vhost(args):
 def cmd_verify(args):
     s = site(args.site); st = load_state(s["site"])
     hp = st.get("health_path") or "/"
+    # Without the vhost nginx's default server answers the pinned SNI and a 200 means nothing.
+    if ssh("root", f"test -e /etc/nginx/sites-enabled/{shlex.quote(s['site'])} && echo yes", check=False).strip() != "yes":
+        die(f"no nginx vhost for {s['site']} yet: run `dev2-site vhost {s['site']}` first")
     ok = True
     for d in s["domains"]:
         resolve = [] if args.public else ["--resolve", f"{d}:443:{DEV2_IP}"]

From 492849d1ffb5d52a31b664436b3604042602f462 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:32:38 +0000
Subject: [PATCH 022/104] sites.d: media2markdown.com repo override

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/media2markdown.com.json | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 dev2/sites.d/media2markdown.com.json

diff --git a/dev2/sites.d/media2markdown.com.json b/dev2/sites.d/media2markdown.com.json
new file mode 100644
index 0000000..83ad9d6
--- /dev/null
+++ b/dev2/sites.d/media2markdown.com.json
@@ -0,0 +1 @@
+{"repo": "profullstack/media2markdown", "notes": "deployed to Railway with `railway up`, so the registry saw no repo; the GitHub repo is private"}

From 3bd9688bdb12c3f4934aa5a57cf86bdc73ee3fba Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:34:14 +0000
Subject: [PATCH 023/104] deploy-app.sh: recreate the stack when a sibling
 service name fails to resolve

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/templates/deploy-app.sh | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/dev2/templates/deploy-app.sh b/dev2/templates/deploy-app.sh
index 92dbb6d..53c0717 100755
--- a/dev2/templates/deploy-app.sh
+++ b/dev2/templates/deploy-app.sh
@@ -119,6 +119,24 @@ fi
 log "Starting"
 compose up -d --remove-orphans
 
+# Docker's embedded DNS can keep stale alias state after a network was recreated in
+# place: container names resolve, service names (`redis`) answer SERVFAIL, and the app
+# hangs at boot with a green health check. Prove every sibling service resolves from
+# inside the app; if not, recreate the stack once.
+APP_CID=$(compose ps -q app 2>/dev/null | head -n1)
+if [ -n "$APP_CID" ]; then
+  for svc in $(grep -E '^  [a-z][a-z0-9_-]*:$' "$ROOT/docker-compose.app.yml" | tr -d ' :' | grep -vx app); do
+    if docker exec "$APP_CID" sh -c 'command -v getent >/dev/null' 2>/dev/null; then
+      if ! docker exec "$APP_CID" sh -c "getent hosts $svc" >/dev/null 2>&1; then
+        log "Service '$svc' does not resolve inside the app container (stale embedded DNS): recreating the stack"
+        compose down --remove-orphans
+        compose up -d --remove-orphans
+        break
+      fi
+    fi
+  done
+fi
+
 if health; then
   log "Healthy on 127.0.0.1:$APP_PORT$HEALTH_PATH"
   {

From 9b5cbbf494b80d06fd8b584e5b514aca738944a9 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:38:27 +0000
Subject: [PATCH 024/104] dev2-site: db copy from plain postgres images; DNS
 self-check parses services only; opensocial.chat override

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 122262 -> 122360 bytes
 dev2/dev2-site                            |   5 +++--
 dev2/sites.d/opensocial.chat.json         |  26 ++++++++++++++++++++++
 dev2/templates/deploy-app.sh              |   2 +-
 4 files changed, 30 insertions(+), 3 deletions(-)
 create mode 100644 dev2/sites.d/opensocial.chat.json

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 4d0b71ba4e21c52f125c8ac956429c09755898af..d885d310e58af86229e27a778704371fea0ce52c 100644
GIT binary patch
delta 728
zcma)#OGuPq6o&uzd~<Vb1|@4@LtYnxDOqNrX-(eRn14<gIHe_&I$lN{!K}sv2}076
zL4T;EpsbAxFVq<lf^1RJrW+_^1xd6p$xKjjp#F~#chT8A=l$OEzF+^id1c&ee`T{-
z6@B81AA6FvjM(SbQhU`x)#-AbC@#s%j!(R}p)ykv)neDN!jgPf#rlOmusM_$tzWGh
z$6fg)nJJB4UrSZ<S)YHbB6LfjE3o!kP4{k8{YP<pY@@HKE|3*+{G-0F8}HDqodK3~
zloGz;I`0?Q1@yAl04L!ZkC>o}j0J-dQA<mTQb$d+EYV6o|6)N=&Qm-6lIk+)s+JB4
z9d@VSbSpfh>LRX8hTU{phTU{dh9z{Xit1(9O$}0&kypY?mn35R(z3V9y+9NSy(9dv
z;Ln?|8x}v5@V%>xWgKnCDj~p8k+^F#4UnSveA<C(#02K2qj-KRx{RhF`8uVgwIG%U
z97q%h@<a@d0*^Q<4mE@cZco6h0k63-2_FcPoRf?hE2el`2AXa7#yz=62q#7G*b(Gf
z5Y5Y_xMR|4$`PSGIEClf!=7@~!I~`e&pMzeD}guD4h~fy+kza<tVWL+Do=V*X~0R|
z(Sl)tdj8moVZg^dZP*92@{0=yTF}WIooFC*@sBG=CA9JOtC+Ll9$WjN0)y<<kS@^2
zH*Vs47@n~IKI(ySo*TqYV3ZvXQDnqZ_6*^R5ihxD6ti}`=d@=Ci$sXC-r}~^>;w+c
KVuAK)2Eji)n&)Z&

delta 612
zcmY+AK}b|_5QpFQf3CZ(?3Q3?AZY3#6CyIQ4wBn$NR;fVg_Rj0L@K(9Yob{e1(_id
znZAQY8e)fnw4$*@LI?~BDvgp%5~VI7m<hQk)O!R;bNS}S{APxk<zaj0u-*O2<#K9f
zWad68KNCCXo?nSC3*-bm1qFrvd|y^_>Y8XzTlG1rt3tJ>Yfgn8HLrH*v~;8ph|gK`
z{MXRYOY*;lj%g-nH3nhHM8D!IZPKc<9j?ps2t10jf}Mb#F}bd3Nz<~`KK0AO0rlfA
z7Buak%2z)vRiI3DfkPJDhm|xtDOaAiNtN$|p^w3acfkg;&}dFI-Bs+hY(cyhyeeQJ
zG0!Tw^R4`tDpKag=;KN}E;4X5qD5zh7mvs}H(|vMsf(e<7TK*dEfg|(OG#{>pNtiM
z9M^2zlTQik*AYogA`c!*-6qNuqcW4iTm*0A#b%}yFQq4)&rUwb`JL3b_$CWpQliyw
zB^&&B9c+}Nh1`xL!w45MZY&qGUZze^3|nOPNlF}KNp~r2cKniFO-Ter(pJlWPKE5L
zX8>wsp@CgcCuxlgIk+UVmkBCbB<~7a74>rQD&Jk)k%~?N&?h4XJ9PU^-8>ANF_S=|
z#C0(i#Z&pxM<qOy+<vyfpfuej*T#svzR#?UF?sNiIX4s1K1x&!D{^a`Zl^sP^V^F)
IBYT>mKP7v|9smFU

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 4cb89ed..ae2945c 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -628,7 +628,8 @@ def cmd_db(args):
     dump = f"/root/dumps/{db}-{dt.datetime.now(dt.timezone.utc).strftime('%Y%m%dT%H%M%SZ')}.dump"
     ssh("root", "install -d -m 700 /root/dumps")
     log(f"pg_dump {src_db} via ssh.railway.com -> {DEV2_HOST}:{dump}")
-    remote = f"PGPASSWORD=\"$PGPASSWORD\" pg_dump -Fc --no-owner --no-privileges -h localhost -U \"${{PGUSER:-postgres}}\" -d {shlex.quote(src_db)}"
+    # Railway's template sets PGPASSWORD/PGUSER; a plain postgres:* image sets POSTGRES_*.
+    remote = f"PGPASSWORD=\"${{PGPASSWORD:-$POSTGRES_PASSWORD}}\" pg_dump -Fc --no-owner --no-privileges -h localhost -U \"${{PGUSER:-${{POSTGRES_USER:-postgres}}}}\" -d {shlex.quote(src_db)}"
     cmd = " ".join(map(shlex.quote, rw_ssh_cmd(user, remote))) + f" | ssh -o BatchMode=yes root@{DEV2_HOST} 'cat > {dump}'"
     sh(cmd, capture=False, timeout=6 * 3600)
     size = ssh("root", f"stat -c%s {dump}").strip()
@@ -648,7 +649,7 @@ def cmd_db(args):
     tables = ssh("root", f"docker exec -i {PG_CONTAINER} psql -U postgres -h localhost -d {shlex.quote(db)} -X -At", input=count_sql).split()
     q = " union all ".join(f"select '{t}', count(*) from \"{t}\"" for t in tables) if tables else "select 'none', 0"
     tgt = ssh("root", f"docker exec -i {PG_CONTAINER} psql -U postgres -h localhost -d {shlex.quote(db)} -X -At -F' '", input=q)
-    src = sh(rw_ssh_cmd(user, f"PGPASSWORD=\"$PGPASSWORD\" psql -h localhost -U \"${{PGUSER:-postgres}}\" -d {shlex.quote(src_db)} -X -At -F' '"), input=q)
+    src = sh(rw_ssh_cmd(user, f"PGPASSWORD=\"${{PGPASSWORD:-$POSTGRES_PASSWORD}}\" psql -h localhost -U \"${{PGUSER:-${{POSTGRES_USER:-postgres}}}}\" -d {shlex.quote(src_db)} -X -At -F' '"), input=q)
     tgt_c = dict(l.split(" ", 1) for l in tgt.split("\n") if l.strip()); src_c = dict(l.split(" ", 1) for l in src.split("\n") if l.strip())
     bad = [(t, src_c.get(t), tgt_c.get(t)) for t in tables if src_c.get(t) != tgt_c.get(t)]
     note(f"{len(tables)} tables, {sum(int(v) for v in tgt_c.values())} rows on dev2")
diff --git a/dev2/sites.d/opensocial.chat.json b/dev2/sites.d/opensocial.chat.json
new file mode 100644
index 0000000..5980934
--- /dev/null
+++ b/dev2/sites.d/opensocial.chat.json
@@ -0,0 +1,26 @@
+{
+ "repo": "profullstack/opensocial",
+ "notes": "deployed with `railway up`; three services from one Dockerfile whose CMD switches on SERVICE_ROLE (web/api/worker); own postgres:17 + redis on Railway",
+ "companions": [
+  {
+   "name": "opensocial-api",
+   "id": "2c54f0d4-e1bd-4ac6-afc8-d6d1c9125a6e",
+   "volumes": [],
+   "db": "pg",
+   "redis": true
+  },
+  {
+   "name": "opensocial-worker",
+   "id": "30fdfa55-9ded-4356-944f-734a26e8bd78",
+   "volumes": [],
+   "db": "pg",
+   "redis": true
+  }
+ ],
+ "redis": true,
+ "env_overrides": {
+  "API_INTERNAL_ORIGIN": "http://opensocial-api:3101",
+  "API_HOST": "0.0.0.0"
+ },
+ "health_path": "/"
+}
\ No newline at end of file
diff --git a/dev2/templates/deploy-app.sh b/dev2/templates/deploy-app.sh
index 53c0717..e8eb1ef 100755
--- a/dev2/templates/deploy-app.sh
+++ b/dev2/templates/deploy-app.sh
@@ -125,7 +125,7 @@ compose up -d --remove-orphans
 # inside the app; if not, recreate the stack once.
 APP_CID=$(compose ps -q app 2>/dev/null | head -n1)
 if [ -n "$APP_CID" ]; then
-  for svc in $(grep -E '^  [a-z][a-z0-9_-]*:$' "$ROOT/docker-compose.app.yml" | tr -d ' :' | grep -vx app); do
+  for svc in $(awk '/^services:/{f=1;next} /^[a-z]/{f=0} f && /^  [a-z][a-z0-9_-]*:$/{gsub(/[ :]/,""); print}' "$ROOT/docker-compose.app.yml" | grep -vx app); do
     if docker exec "$APP_CID" sh -c 'command -v getent >/dev/null' 2>/dev/null; then
       if ! docker exec "$APP_CID" sh -c "getent hosts $svc" >/dev/null 2>&1; then
         log "Service '$svc' does not resolve inside the app container (stale embedded DNS): recreating the stack"

From 2b8438139763cad638229b8ab966fa29316c262d Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:39:23 +0000
Subject: [PATCH 025/104] dev2-site scaffold: pass NIXPACKS_NODE_VERSION
 through --env, rewrite nodejs_18, --regen

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 122360 -> 124189 bytes
 dev2/dev2-site                            |  18 ++++++++++++++----
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index d885d310e58af86229e27a778704371fea0ce52c..c0c507382e26202d9d81f2936c36a418ea7abcc0 100644
GIT binary patch
delta 8726
zcmZu%33yaR@}GJ$Z*ok?eV>zqToA|wfj|;M60Tg3gUCS0)sy?;&4eRP3<x4Br%!A^
zQ4kN5xE!O5sEDk(i+~U$3XZ6(*RJc|6^~VSU6+5=3zG!D<@@H>-PP6ARo&Iq^*a3W
ziqqb+PVVQ%jdNAuzon(eTjPRuxCeskj<{|=cLq#o_b_-WrI*3esBMkeaUo8Pg&eUd
zHqhvI2xy#2<tPpQ#3R4?O{}-kpQ#TC!`+6!v1H8%Imkf{M{aS198Bclk;5o|@<6Z#
ziPN}!2gLH`4seq_1s5@VgyzkhnahZPh!MJM5ynO8nVTV!jWb3*qGIlQ)rP45C7<UU
z2iGV=H1jmXFfYS+=52^&K8Cpe$*VsHuKk91=4VJ?{u@+=L>7QJfdwK?WNj>H0~nH6
zI}65g66;_gSWaf0EELOR7KU6YEF3YFMIfdzJz_eGM4ZB+5T~*(7LB|aECyTC*m%V0
zEEX}7b+b6^nIVWOqf_f@*(=INKBV?k->Um0I`)DkGz!8kp8G=|)Hpd<<S@+$d(Pw$
z_T)yPQ8Z++6r3fSr6T6AG{jjf9Wj?pL7dH|BIdCS#C%#A+UkDXylEqAU%;kg=Ny)a
zIG4>poX2J&&SzPO3s^Q{A<IE5VzUs7SuSD;n~hk?@(>rYe8fepz);5KV6B|3U~|#r
z3MR36SXQ$6NL|bpAXc%$4gD&^9n8dvuxkk`Mxue0ATDL4h|AbQ#A>z(aXBkPtYPJd
zwX6cMj#VPov&D!FtO}8_I}nX*31TBNAU3h3h|O#nVhgKAY`xtl(8<X`m$BuJwKTLb
zGpj*;+F32~cd$CdPF9cD#Tx3m8N=ENW<-=&Bch2lA(~k;Vh?LUTxndzTHE4PD#;l)
zaiuj}d&n8G<+JWbAV<E_;{}){Cwu-3xz>2ELN(-D&At%=6k8wi4-sII^+;eMK$Z2w
zpnQNktojh6086bK!;q!c`gBAW0JHi>&d@-MwQPK*7J95(CL9xBqjlCKKLPHyE=~>=
zV29O|suAE}>+1BM1bE8YmGL#eF?s3qRdCdLd3u@vFIb&s4gkDreIZK};FR^{oFjhl
zZ);oSB>-P*R@GiL{Mq`UA=(W>tv4G%4N+ETRSPiDDz-OjAj8_;9SM+b-MYd+CVXYy
zqJjC=RclfO)cv_ThXgQK`|k=<L!))?y7d4Z*2wj-0NwJu4RykRC-?dTWb)_cfUEV}
z4etmZDi*>*52=SkhIFUA|Go(M+C6jpG%U>FosJEXviZv$5H5dvPg>>w=mwQJ!4ZF0
zxML7fCpf4UjYaDa+UI0(+O9TTGP^i>S%iH3|9ts9FM%)DuLW0m+@|sJm2Z69S)@Z)
zpR+kd_S)(rH*QMjH_w8Lx8!WmvZx@GVR2#6GqIGtW&~u#u<;`kxtev3DJ;$`)}mo?
z_={%=7S~5qdxa(^i_1WwgB#UNd+;BjWMc%{$R;?J#-T#KYCBXrsZ@PB`IGyS-TK_v
zM2p)>l?gUS$(`Sa3oMD25VGWT&-%zW?n%Xkoa7MhkRfHr9$Rx<M(FZK55&ZG0-Nk$
zlwkAo<|!ju>sYd*r!_~ed(H<VdEFMju!$^X*ak<hV*=U=T&Fn5C2o1k4{nvI3a5IM
zV>@hi)u_yQj#<nFj+zBnnzEw6(r=YhsQmp>^o^5GZ<*o|#-=)Y`rIw!<j3!eMDuap
z0C&f1(sN_1aVK+y*0~gf`!gIYeIDld4h7h>4Jvb?qh;}M@Z_rw-6FE-4wG4CFVgxv
zE#vZ4+q@ctCRKw_Jq{^eY=*@P@2;5&W)bey?hrP6Xpp1N%i>}2w0H)GsK#n`+d89q
zkRgA!$}e(60f!>Dxq3FsAubpvhdofJo8?ff&-<1m;7aJc9V4ZB@)CEJJ7!vMT#)g)
zX%2f^i{$;WKC*tZua7sI?GQIb)#qdJ!R;rt^5mtPL)7_wPPhA-{PAZ0fKrDXR^XTv
z)m<d(wgmb5_W7C1NBZX|{qn4P17WVbXv=u#d6wbigGe6pExwMq`~1yb@@vJ)sqoUU
z1+37q;jCz&SQfX=PeGcw$|2bTj+qZ>hH0Y<J7Nd9u|L`2Qj)K#UW7XqaJw~XjU_;i
z*cPWQ#d7|(NRNeVQIqJ9+`0r;DcIfQHYVtl$@{m3MV2!it6-IEG5WEF{1%;{YE1nO
z`IBuC9!rqRz}(nUi%3yG{>!$2xMi%GEoU{zE6_MrYY|x;t7i?2HR*1fIHW(&5@=d5
z8d(^PHU4gFqeab{ZquWAubQ>6)-l?&jj6Zq6)jFIU%9{p)<F@0oSStLHjNwA0HfT2
z*r43NF}8PE0?7^s4{rHV9Hjhn%)q)WffmuCwm4b*EW*HwL(a0-b|3lG9nLz5nJk(n
zCl)$j=Ic_y2fXApI|?JlkR84Ns#U7h>LsdGkkBK4w&QZPU6hPX#?Cp?W0=<VPL_-v
zT`P@DZ*Df~yCvhwmaZO?eo|-4>h8LRHk01mrB~REQk~hTZ!ycqAKWBY$`LNTVp5W^
zb7il;oFn`7XC;6%9+mGE6KSm7rL&6}TTL}7(|Y})s2;V<l$eRXsHMxJsuPjyM)K>L
zjFVbTU7ZqLM3Mo)?sRKpuYaa~M2J2q+tH9xP;DudAe~?@fxJ^b30y9Js7!wDp?|=e
z*4;b*D9E+Dw!#JZ+g$}N&w?}+g(pmsvv;@m--$!)T2ph6xuxB%l{(Cl(I^Fw2K%T-
zT-Dst&@8PdLJ1KxP3>LvQU$eF6TD3D3IU!1l~jvhcdoB989VDbjCNgjPknn!Lrt4;
zjY)cu7>X1joyOH>yNj{2NB(WMlN`7w9)jfDJyYDZWM$1tyU^Jv?FQMjC)4Eu4lt2N
z%R8<H$%n6MgWMWASdFQnuCcMJok>4pznORzI9tEovmXrUVkum6584&=K-VVqHJ$hN
z^j!h_#t-S@2g(jtJzI6S`q}DNQ%_}_$T&6g#LP3onZnC6?ifm1a?Q<qTk(Cxk48Nn
zw>$3fiMuE6lMc?f9Go%aHtp4z!JO`)%oXzPM_K<3t;#=uSMI3Xm3=V%vS0G1IoI6W
zx2v~T?W*4wcQEzfs=>^KgNv#L7v3>AZONdAVX(I0JvVmEKbW`dXn9h2#%aIPGj99c
z4wfAWd8z5Le$EyDx!VQo-jymh^Nt-Ia@ThCRiE&E(eL_<AE-av@@&iCw1q#aRQbXj
z;b)bqKVK*mzN2O#HS>kC;Z~V|Jmo?q5z7Sw5vfpGHN&kM;f6|8E7ViL1WEXTSWGl7
zUoZ<pWs8TZmRzY?eyM8tm8ynIRSkozaj<#i<*HSe%T`}0>$_CeH&oW&kAr&!i||jC
zYI2`&%{OqD_pWle_=<1bCEvJ%>chHcbw>(c&p0#nO#EPO`Q`YEA>YcOs-;6UbysQ{
zFV!?&sp+~@(>2&FU9K?=E;pmJ9w;P@iqH})3Wahis-Z&oNu|02Duo+Ps(^X$qr1u{
z{L%J<*7UtAG_6hO4{v46@u|&Ho!8BF#o~g0J{9lky=%iY@22MYV&i?ScWt!#{XnJ1
z9_3w|thT4;65EG43hjEhh>h#fVr`Ps^>}BhCyTY2PS>X>^(_B7A1gc&2I4R1V8^Y|
z2Yv>4O%8dg#`SX~NCYRX8=k6lf?wn>1}4F`vhVXzVkmwdyl$QG{8|y-lV3d+2*K9(
zj%8}#bE~J#72qdp$V<}zzLG0Wl)!cCffMBbG4jtZCu?JHpfui^^vX2|j-`4WK^jff
zNbnXNps(cUld0lF?D^1YIC)JireO7^b;fBwcZiS|U5pS!L6$C-;fZ?d;uG5UY2bTu
z$6y4+$y)|9f<8ckU1OGdjJ>+17ISk?{iKGjjwET4{L$bCkYKf4Is)2@H0oVz$K~?^
zOqMg>-{Y4-stgeMX+<Kz`|?-sr$MM3b|p+p3Q3>Kv#!j86#2d@v0>6@#9~I36C$KC
zsvjZs8wfJwOILQnH*(X}YFz~m#19^o>6A0S9tz>sZ>}c0VD1wBX_r`q^f~f_pFV@_
z%+L0V%dkD)di}E#0Po9tzE}+($Ua}La1BASL{Mbi`eg;^JgEIEO|(${=C8S84Yn6s
z)Bg6h2h_;F{oF3R0X+9fNR)T}5(G>>{L3t;v)=fnT$tdAoCz995ipLVxD$v3qoLNH
zjB%Aaf1QPD9sYGLL|A|R)dr}{;on+di8biIZ{se@pWVy>d1o{vLgb4jkP2{`uLGD2
z5A&k{FY8v3(A5NM_&N@L`~d-ivGZyCsDobqqW~Os@y%-ZP1{FYf0bYVWissHr!)`_
zckz!kFgxN4(qukCGFeM@O1@O1g_D-?91$WQgx84BAbbY=O%Wo&z`qpXbYKs1*wyuQ
zOnM8)+o4`sNMnrrloqCmJF&jR_8%>*cY*bMttadcCX%#}=2}EBgQm$N+H5|<3#N*@
zvHqxSr5D_#Ns1tPD6!p5FpZjVIH1?bTqo(1^7OsV`lN<NeUg5X)XgLPAtSVfcvcYX
zLdFD7shB3HB$&<3{;(J__&I-=>-re-JdHn-iSKVlkN@VXudOry$}}*<p9q18kj5{D
zz(Jj&o1*1xes?HLf~WY=P>2y}?29&gDBKj_8n;Kld^l~3(c_|vN3rWQ+sa5V3gU6B
zpR-+$hJH1?!E57SI%L@P#6be?v+d1zhz5AV_O}Fx1ud~kN4f6=D2F4wc><(~uOaDO
z+rA0l<fOAwcQ&m<20xYx`S2&(&#CYr=pLbtH>e}c_E0)31vt)cOo1Y>@~o*aLwpDO
zuiN^j!c=E8{)KFq3Lo&Vvtb>a;~hCL8)ot&IgsMQk*|*2lW+5cJf1WQzJ*p>SS~CS
zw6}K1l!uDX<a_fV3S|Cz9!wBF#!)wHH}W9RC6<)v)ly=StCza4L!!?aB?plPuxS_C
zP0}ErgpR4B_#wSV-GAlQVyH%?y-J`0Ht@z0Xoi#gVhPL=zsFH7Hs4aXqSY#Prt$A8
z!AJ8G()r_+5XBQ0!@prKA72HNMHPO+N86TE;r74<e%CU{fI-{wWoRN~@qbmrW8lPh
zEr&G7=I58A54-SxEQb|-N+=UeX3WNVwUd-mn#0XC(59oTVc4U6`QK|`JUDaDS`;6Q
zGo{<6*TMl17Ha4{p@=8e!>{0Bi*11G;LL(q@IdGx7w&3AExh?`Bm9tcnWQBWoF~I`
zX@vr*d4Oss2;L^J6YL^bMZGtv=EE^~SECONHbUk^mtnttih9-)d`NH>!LE^vtV_B`
z?c+5113s|{%%zmyNXp@(NGXx~OXR~6`ItmLBGFb#bp9k-c8OL~B17%k#+G)oQIf)l
z5<se7<li>ILDv{0%*CJSYa1S-=fM}R+;(9F-Msxmz8X^k_X4%8q7|3ib%NWxaQ`!c
z+q`JojyA|q<2kt0iBS#4^Z#@~qL_$sme?kAL#G;k<a<oe7W-dPgOaiYw=w5fu{TW7
zg8F^=cZ<P?XPZIq_9zi3BuUS!__||A?lXg%n1rH@wykD}RttifTUTKin9N;QL$a8H
zT`O%ltHA&;f$v!ZMXs?(k_are8*3mP#A#SxYfHEj<~Tze?_LipU^D-8Jy_r^8@|<@
z0%#fzy>G3DP&^llHlkU7<d%)-FQ4-#HbOE)@XH%vrZ$U2XLG-MVIkbZ8}EfwUy8kU
zr{+3So!Kl&`xL+61NY(~P2r#23q?9*kMAX$(s|}4$Q7$m$lbQJo1j<+b^L-1hVkhn
zR|x@AsCE#!?e1j-<pm}AHMtAt*Ax~kk)Gql4?&<dgCxcAwufN4HlCQL^5-6cH87RO
z?1To`&o}La&7o7V$L>^>TUIi^WUgH-C@U*1E0JC&A5yNF88E=xABKO2c+pf4EiFaG
zOA-VLw|qD`ckumzpX6{_OKT{_@(sJd7&;os{)D3w)WcD290`Aei@V{JgZu1mSOBxR
z-yWz(FIl|@dUU-g=P~@5K%{Fv!WQrd6gp>jqM%;aBvVg!9ep$;Dbc6bKfkA=yQQ;9
z-_YLG!|+qAtJT<G)=SDZC|8Pd!({M%2f!FatI_L)-(UK?qSDIzn*7-{m1RX)QZWyI
z67B)~D5UH4#FMzIZ}3l^gjvwc^-n>*ZsfX=;$;ZNhr4(Xcm50F`H`m}H?p2Ar)4UU
z{HV$h>>66yG3$9t?wh>$X|VWJ5Z~y<MH?<n;~zf_VHh6&^E6BqOls~~g>QuOo`Do`
z1NOgSyXzU~QG4F4@DeCSwsU;#Ds(3*2IiJd`t+Q}mmPwF;myzB&m4luam3r}sxK+1
zs+m_>UXdlW6G5k6h>e=klA<M9c1V$0`EQ5Nmsjvf10dmjzJCB>#ru)-&$jaeus|KG
zOs>pZid3nSKsiktdGZm6_P#ZZq6U2%qbkND7}TcoH}G*9O1b(d#NeN4;*Ww}tBlUz
zB}ZWb+->VU3L;PraSTJnRup{6cK8^4?~*obCe73_GUp1abrWnP7)`m-$;Yzz(5n!a
zKqg9UxG$2zUP4Vp#Hj8$MC;};Cm}ANi|Vw2=;WDHpF!Zo>rZ0n2;wJCLP3&p0*mkj
zAdj+r%Gp(7_`)$%B~};n$*<vJX7JkA;GdWaEItLh!B2_JquG%Xpg-oC)3Cs8HO;q%
zz^LM<^B|nBJ`MijPNaNflTX7;jm{Y-!KUhmURS=Z7h-JxeGAsY!*4@?d?R`scRPpv
z`%xcWdsp9vAQyM$!8`}N4ypO|bC}=xKYSki8obScC_wqwC@>#$@R*jbIdn|R&m2Cc
z<!{!HX$6?0#<T*>BY%^_zZ5y~8-Iqm!+Lyq4g&d}^N_#;-p0FpL^m;*c?^W`+P5K+
ze|-j%vCxOlVRf`WjD-(GP=B%fTY)QgAvvSHkt3t!ufK8O`m+#CFXdw=h*nrOpM^*<
zW`vtxJ_{4&zPT>k`5f-4A`n#!;(6y#huGig5H~6!epJNGbKvihU``!le<F`L50xY0
zhAoB(zY{lcR7TP}s79D(tQxdq;-pcQ=Xc;Xo_`1P$H}+L@k%ylI_7361F5&Rmp5EM
znR{_HMom*>j<I6QqDNeWKR`Oaa1pxuB_(Ykf9`ckN>W~~?5-wrmt?F_KL0YtJZ6nP
zav4_|JM}G%${Sd{RM*+itgmaAjCE{{9xpq6SEn&SuxslY%q?A=c1^Rfz1yxaHFvEV
zlNBim(JFc_x|ITv^DF7oRixqT*j^$ixs!6x+VL<afL-jYlbTFQCe`bal+@Xk)L@j%
zNe#`$hBnF0Umb+7SW2$!P8}^x^aLmU9b3IxvJEpQiG)5#u#Vpx1pl;6Snt&(C3Sb1
z%t>9H?Q5jXL>ZTq)X>%0&?8C4&W1J8Z#20eeU60`$md;x9!TV`U4j6kl6l=lR*Ys|
zO44<EmNlH5DJTAS*%)P65?y=}9d?Pry+mPGx(D|}qF^W`@yvH&iRV6=oj}AlXOox6
z54;PH_dDyhx!>o$z4x+n)Y{yAxzCjBFF7)GC?@lz+*2hdO3q9ltZu=CZ3VOnFO}f^
zoz+J9TZhm|uRa~Zo%HHM1$Oldg=(cwX>|xi>Z|^tk2Vkb#T}gRLf>FQ!5NpK^5uhb
zYX<9^hgzk<I@4AE5Zju|@Nad%5O`JisD^x8Dl*kWp}rMU)I(FmicEh06^QIVgF2T;
zl$#_7C125lc>;Vz|Fu9`snn&(!#hs#8vRB+x1gdVVYPICY*)f%JMp#=d`c@_MzsY5
z%EMwM@zIf#KB3-;RP!LPQ*)CFCzPsq!d1)*ukp24Auu5iCz56p+)FHrsb)}U)GQ`A
zK>}Xkr?0}F`jtJV*BuG}az6Z`BhmYfq`YUOP)*tV;SXwRh7c%U+DcNcq}`7ZP4R%E
zR8u|(6;By;h~N2);u?wSS;$REu9QqbIqmSht7Ki()KpRm#fL`SNAVoRrS|bTc8H65
z5joKYmC1sY8)^XfP7?r{ACgtz`Ju}1LzT|9*$zx_%7#+-K40KJUxP2iKuEli&j0ce
G1pGhN=U#vS

delta 7539
zcmaJ_eO#1P_Mh|23oyew3~!<g$cumji1;oF0xG@$0z!;02;AXa&^u!$4Pu+N)|!gX
z=Cu-EwstF_QlDz9cJr+*%}jjDB(?3c?QeHKwPjn|X1m$%oCin9KXyK!`9Alad+s^s
z-gEA`=XrYG^ZNcxFaI-sent)c;)-8u9%JtIj{vDVX_YB}0h3w-Z2@+@I9LRs;>;f)
zRPuE8H9=^YJ+v2Srbgp=+RPq?8^{o7H#2RoG{|BLzjsJ?cPQfCA^qK<$U8%_?%Pmg
zYo0hLZ8$bhkv|Oxk^Q95$dUh(W1-|5IqH9L#2A_BuI3o#YqKyvyX9#O^Y78xVuvg-
z%V#BHNE{2ajb=f%cou9+U?H}|VGLb&x5k#l%(gKsY@^1O%)${<SOj7!YhjTa!8Vq)
zvM797*-AD7pJ}X(MdLG_jYO^tHVSbZi$Tm}7R2!^7BP#(Ax>cJY&7ytWbxRW#1arE
zvqZ!x{%jRX!l9{>#%^f7pEf9DjK@nXxn3Hgi;`pDWBfTy{z)6Cy)#dIauIywG@aL7
zLi&^7lf^RXrFy+>Iva=jvRNkL3^pEdCd)$1VG|H@*+j%yY!YJLa3^<RXiUDl)%k1+
zG8C|>h_l%=#5rs_;#`)ESjc7|&SNtX=d&Ed1uPeFA)AF*#PSe}Sw3P3E3hqMv$0jm
zR<k*{{xZhdTzr<ZLZmKc^AIc8{Eb~2TP1U_1vqpcTZqIeR)lC{#fVE-3F1<=2yq!J
zMO@Cx5UW`^;tIAHv4&M3*0M^(I(8o-V^xTDW<#uJOAs5_Qp85K46zC0E^a7l#qW#2
z8)MompV1o^H8UrxMpIhY3S@0%HHa%&En*w1t7&HpTdSBIaW$()<g5YF!5R^rtO;?A
z{eITmGDf4}-sssiN}{3H8?xmK{s&=({BXc4FjJl!_;1KjGJ@u7Ay09I#z?S0*&Q}Q
zf)eFOL<&HK^5@8WfJ$Y|2)hI}W$Q>}sa9T!X$PoNM#WCkL8D?zm}&s0@<i%k2{tKn
z)65b)sw~flmSDT`V5UxjCzK6Y-%0SSvUbwv0EgtdDQn@N^6`}M5-3W*^ge($mEULU
zC3s6YG4r4qZYhq%=K(^Lg32B(yrcZtHrf|PC|(Vqg;>R>St~)R;@4WQgNcfBRV=`G
zW#?)eE#YhD<2snDbgj#j(DuU*UXq|n`Q`eNTCgj>edu9;Rweo2M1Xd=WMhq#<tGk>
z!er(1jaMc4(&oSb$<gEV@i>HykdOT{RIc0{D&Kz3PagAVT=(BY{Mks)iRtuqrpn#j
zA@cf1vtmYhsNCCSV51^Yh|7n?Ojn=HRyu21iworakC?k+S)3=zJx|a$O&+~2Z#LSc
zWAQFsgWl!SmoSVc-NWM?=V`fsC92whCEa<Bp=Ymlki%nFr_mWWNRbP>twG5w#lz8Q
zavAw)Irotm5!(!*^2%F25<ehsdn`k`lSO~h`gC>rI;VMbvauUA&TLQ5<?GRruj#!*
zWLA&WEUg1+oqjH3zGj<$oz$SIla~1*#h<0S{4tGYs5p+W$IvZp3D6-&r@zbB<>&Gn
zp>a-7MS3B+Oe|CW>Q~VcOO+RGHOte!^NH}N#tqE9qg%tqvn*l&qx{tyVY0Gyf@y-s
zoX&u|3k?tOOy;%DJkR9jeDYPm#5;OPE%M0+^-=Pla=j(zEZO*7w7l;-Z~3`xenA0j
zl1K6cO=qAhP!7BpDzV9OPIQ!xP3iRVXbX|EAIp-fx0}NYJ(}25kA5_MzWl50kwHP7
z!On$u$ETs*<u6A`Y`T1YdxAdOh4&^AqSy>qkVkE2h%?ADqq#`#-Vh?scq}VmCd={o
zm*w`&k~ei1rX$U{$iwRbkM>^OAdO{uWDZ-3D}<I}WO@0TWjMDp^k)l_T%q#b9ZA}J
ze4gGB8&JSzH|RZbo6E%UV-V%<@EzuwIdZH#GIlOAu|hVF&By4~QM6(lEEv{aC|Aod
z0Y%7F%zRmiOOLT3$u)9#(jr#M%2+w_N;HoxcIjCKt7P}Fss_`~HIL{ryUdPxLkEk|
zWZONHm$<ZS>CX&V)}v+1S@ke;Rt#&`^ypn)Y>JvzC05%8td0VlF~SDFArmwjaq<{M
z=9-7C-tIEfN<2*H_r*9%{drWddY9RycWGT-u3(qc*U;-NcgvV#HW~cFStD!0tl-6(
z`&vZJWC#I&`PQ%J#|$HTTnL)Ang_I1nzfMJD%U-6QFiX!9A+*myssoTZ+=;IQE`4j
zbwxpGSz&RJ{GXkch-BaiXa^sM#T(Bg$RgMyzbxK?t@8c5O7+}^4DzX6U&0B+{p1Nr
z&y$I;ZueGrU-s@PFwTAfIF(|_sd7b6YtB9tFko;ru5mWC4(Qi5Hq|xqhe<~fNuEuk
zrd4ZdTbt^tTkPu`{8bvG_~hjT56EeIqC!?sGo0WJf;SQ5IeU^JOkTZbg6!Ti$>)6(
z<On1B>KkEl;NDQvKZrtqw?RqYyC3|<>Wkr;f8?&XU$t-6$|?KVxQ~1TwiP{E)ITEg
zV6MC1P{EP3Q}GwGiZA(=T=VtcuH9a_t9D<~^O^ktX$SKz`%eDWThTwWR=2DQ)%<Z%
zfz<|@Gx5Pyak?`T^Fpz6&KO*kq&*j%Z^X{U#Netd?ZwHt)VZuxX;<U)*twdduNvod
zb*wkFv-DLnysl26_5g(0!nJaGWSH{fa|Y0VjmE#Ic)##(fLC|)RvSOTJ|}oZY3g0!
z1z*eW9ZrM4$+r&2>CIS5yA_MFK@S(@{YN73)_mj0R2_V*{Ok8dfUgd}H5uSDdCJiu
zxT0)6S_UvuzIH6bFcRnSQA+UfYY-JfZ41G8(o|3IN80YsWbc!i`UD)gpv*jZO{-7A
z=68zaU9&$#$P+KeNVh?*yj%*w@`200NxVc8FB0q}=p)b){ElD=O2ja;$o#`ekyns1
zpmXvy_6}1+le2M6ZCYLXN-Iy2PkeY4;*{N24uat<P3u=muf8wA7&+$JQ|1gZQkAQU
zRCQgFKe#qNp7w!1O%t{fQ1Ee?-~a(Ffqx<=T%QXma@+O9xB>6l8i&2DW~H4w$*ve)
zN_+=t)pZ0J@}cWb!2ii}ZY(nu;q0Gq*m2Zb96AD{l(RQ7d>})<{nvK=A{@(>`QM(y
ze$?Oh>npIIqa6GD>j0PJj?W)}EAls=uQrB~0R(wU+ZW|v!ir48|3ixA$!GtOtFOZT
zLM7zO(*aN+U;nXHIu0WH02;gIb|fs9x82Tx`;`9MWm2jSawhAjq|<N%ffvDTvVQ3B
zhEZ25iU4vTLu><>0}<{k0B(RQVw)D4pv-+s3#Tza#7RBOgvW%|04WgVPBTCzz)?}-
z1?lj(==Op)d{>hOPT-K_{kPMQ{)jg$1gE&<4Fa}_Rv-A$u$CD9D(}0U4&7p}5k|oS
z;w>Z0iun^6Q%I0O3#O&=P-@ZM@d^=Rf*5?4oN0nODO(cHnjjX+#XBZA9?^~*1KQde
z#!uq>0jTBkXil}*>kE_h+pt~YzUB)L`#`5y5eECCh{Q`s*CGNcS@?9KO%o%+VWM8f
zw(PD5hxIyZ1kt03?H2^&sGEcnI=q}U++xkMba-2=b@djjC5<-=h=xhgb;Q#`unQTJ
z13BH+oRT;yD368;-0j|Im}A<7JU#e#I3zV><g+(I-RUEtR0kKtFJfUVj1@1(!t<s<
z;|2xP#z7kF72R<VZ`y~G`$)hQjVi!>BMv^6U_iW)0EKYGtxH4)sISDYx+{{vF6j><
z_X+p0Wa!euagk$%DUjjrutG9Gzx&xV7!9!7eJULi!9c9MSA3fRWpF^u9S7s}N04;d
zy<r@9d6{0M;Tg0i8Dhs|$cMMxS0=*_Fg-y7$7x`!+c_1M02~zk(_jI-C`L|)Y5I3@
z{EB<obeQOk8}aLWn26zaCLbPx(_&!(%z_DGdjX8|=|;X9idNAc26@77Hhcxl{o`yX
zkqmddRaS_GPY|7j5QpKmuMkr8AK|ROy88<u!Y7f8=rCBUGc36l-h>03>MHe$;=jZ0
zfYj>X9|-?4=rB>P;g@OnQz4hZGBo<@GAM`jVs<$+f?K>?4mtWSaF)jXZ8=;q7}Rx+
z73Y^gi0&rRMb{FD6UL?R0|=pC2I=}AkQ(KlvJB$&@V;1H3zOgj_s&{eB4mlHb+AVV
zSb)nxl_6p)gORwBK89hf6(2BIZC10N-r=lq+B*zs>XYY)ayzt`=sFt=a)0rj9TGqi
zH|?k;6vd^wBkSQAkQV6F_m&-}f`xY@{0M$-LlgW7bbZmiUgFDUv?Wj^w!k;p=Sf%!
z!TYp)eDT-t2<lR3a)sa|!6kwn1Z!#Z7Pb6DMJw*raq&tkOpWszjP$)U(n)Zc;BABf
z9k;V~ep*DW1ZOeby<9znlr%XV15TmLDZV(x2PZdjI)|LLoYPKnTHS!5zNyt|=R6!c
zgLnREaeXD8kx@vPfq%#K!NcT!sSUP*;aiQy-!8dJR>62MCHu~e4m+jsof{h_7NtO#
z``OhnMvEultP}GZj1u3kffRi_N-1$C-4AVA_)_d#2Q7);lYS?fo$Nd8G^=YINt<?B
zwNIR13L#=@2UrX{iO?=qbU=bB3FR#%%f7gCN?+=LpCswOl6bijlR>gDtcMJJDsrrJ
zPg@T*fOxU93l<nHNa6$z_ZMA|1^P^EuXQIp1hc)tE?OUj)$p*m@hG_9sC&s{a1^8(
z%Dtf?V+&@Y$Hc-dxU6I1fh`y!H^iPTkO2|m+!mN_m_(u{i=fA$1iD1+<B%Cj8F;{}
zvBpv3baK9rmNiX0|2Q7cRPo8<u)w7H^&whVnwYp1a`lxcWS!f!6&9LciFofxu;rzZ
zT=np$Q|mX#J>XwjP*zZsU!7Z0SUta>ia$#thOQyChNLQys~2~yXm|>y7~*Jpy7=8w
zunx0?<!Pvcr$tRKM2S6514mNOZZLbjMUkZ5H=$xj4`!`rMB{GwA=*fKVYFIK6eUX>
zqd>zK+{^r1@p=y&H_)zfi`cLS?9oG6?HGzk)(&PkKbrXm0ej)7hx?tqFb}4QpnXt_
zapT+vYxGW(^Mw1$eXz<qxDjV}7_E*qt7@o*u<|Cc>IH}nRQFxINg`+$GQ{o|z#d79
z?Fh2B-EYZTP`o(5I)7I6;?f1#e2$1Z0Gpsq>^lHc;SKTe0lcbfMRYHwTP*H-VM{Cp
z7N_MF@c?QrM;Opm=9U)m!Oa<*`=%)D16NoPu?$^D<UpRO6~!hPA@TL%`#$vcN|F8|
z%+{~RvBU0;7h#Py&^5@1%&PtM;-`Z!-=C<MUYpvS?G~OX?mGkpgKo<Z&m4mEB;xHb
zT8auPtLGM%m1pyMBA6^C*r_fqT2Pfe0OL3lw+>-kwuqF&=+{osa~Kkh8<F!Z{5ve-
z;1P&*e|Z?<wNa`Wss)8O#v2LLGqOR9eGNtj-%+R<<ZQH)Q8lk&ddd_>U&HdHQ2g{7
z#Dhh|yYYmovopjzH>85geZL#@fZAP0Fac~v!Kd84N8q16;|CW^ni}rvY@t>&!3KhR
zLV1$tKLJU}v{-H@C#&ppsjG?@vV98CnuX;gB!xFon>>ionnmpi1V*v^BqoGl@%l+9
z2v*P40t{v3QJuI~1ilSsgPLaNh}5@nA2Y<#x8YxK#a;SGcoNKNf*mS#)GYha&Uay+
zfs=fPD0vsA>bGJ0l6%{`FkNTzLHXF#d~?%BbZ&rn_YY@a1BjOz!CDZFboEy+u|Vgj
zVZ9)yWmqrR88@sK;*1~a)q9I07qHR{-FXomGIJ9ch0j@tz|!v6If&JVvGBeKQF0Cz
z3a@i`tKT6<u@QaIM2;0+{a6=`+<6u+$~%LjJab}24-Li)AGD~0GcKU)*de~E^H^G)
z?k5Fkheez^4^|jGd|v#}yo8~7n=U|DK%z5qXgw@R9Jm0B2iF5*hKs<j_JeDQ70N}_
zN1w}u_gRSa7@j)BP<V-|y<xM1tj?((EiA1sy;m!aeSn$fZ<o;0jA4xWVV2(Ay;$+v
z%kUD66XhSms;&W@qp^K0S1<aZ>s`Ishh60q4{B7YwZMmT8yFqVc5bhxH?U+FFx1pJ
zo7&q3>jL#MsK@Ze0exEyZ*ZtpLPvnr+SYEZ!#5^tU8B9O1<MAp;|fG~QROh;wX&&!
zV?o0|!(NBMYE{dER#Lr%;6a3rKq5QrPV1@~hhuF!XZ#mLHd(E!+8s`7dt2)|{s>Y0
ztk$~rwz@T(+uQ2a@qd#w62E~D9z>vC*a>Q-KOn3hfxU~a_5t4-#;VccH7o6HPF_s8
zeLaC%mJC%SYBBQj>SM5IQ4i5QRmvz7%;^H)be1?JPfkgUZ$c+>N+=x501<Q*Dg&P)
z+X()PWXEZpc;G7R%?gX&-PmtVdOqcq*8b$YV=b4;R`eIt^s|+h+B^E|9=xg1bU}fH
z7ug)CSi;_Vtb^V10Q{&8zc4+h%wKcS-=}PX_F{NwS%&svhQ4fqc<u(odYwQ;MR?Ji
z!%hX|qhx77JEx$$D0wa4O?Ii-p_R;RAt)u7N1%R8DJB+*cYdArXe_k?2tK0jW@;@G
z^FM)#Sp!7aNQC(WdIAH%V6je%{w1-LP^+9^7IhaAyiR<tia&n>?{ukd_?oEyAyB_-
zn2B9|Kc|liTy@gmiy?K@_h$8tQ7tOfvT+v;sGg#)U0i*cQ9U~3xO;r7x-edwgWOcH
z@e~58$_DQkwMwX@u6l{8z8-S3>S5LOPl?7)At~l1<V5o|j&<0$sRe+qb>X1<CPM>(
zA8X9+L!aW;Nw0}e4F7b3i2e-z5*-dHH#0Rl-_0Etw2@bJ-kWCM)M|85+>B!WA4kl~
A`~Uy|

diff --git a/dev2/dev2-site b/dev2/dev2-site
index ae2945c..b7bb49c 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -25,6 +25,7 @@ reproduces the box. State per site lives in ~/.local/state/dev2-fleet/<site>.jso
 """
 import argparse
 import datetime as dt
+import glob
 import json
 import os
 import re
@@ -380,14 +381,22 @@ def cmd_scaffold(args):
     sh(["git", "-C", d, "worktree", "add", "-q", "-B", wbranch, wt, f"origin/{branch}"])
     try:
         cfg = repo_config(wt)
+        if getattr(args, "regen", False) and os.path.isdir(os.path.join(wt, ".nixpacks")):
+            shutil.rmtree(os.path.join(wt, ".nixpacks")); note("removed the previous .nixpacks to regenerate it")
         df = find_dockerfile(wt, cfg)
         if not df:
             log("No Dockerfile: generating one with nixpacks (the same builder Railway used)")
             nix = shutil.which("nixpacks") or os.path.expanduser("~/.local/bin/nixpacks")
             env = dict(os.environ)
             if cfg.get("startCommand"): env["NIXPACKS_START_CMD"] = cfg["startCommand"]
-            env.setdefault("NIXPACKS_NODE_VERSION", s.get("node_version", "22"))  # nixpacks defaults to 18, too old for Next 16
-            sh([nix, "build", wt, "--out", wt], env=env)
+            # nixpacks reads NIXPACKS_* from the build environment it is given (--env), not
+            # from its own process environment; the default Node 18 is too old for Next 16.
+            node_v = s.get("node_version", "22")
+            sh([nix, "build", wt, "--out", wt, "--env", f"NIXPACKS_NODE_VERSION={node_v}"], env=env)
+            for nf in glob.glob(os.path.join(wt, ".nixpacks", "*.nix")):
+                txt = open(nf).read()
+                if "nodejs_18" in txt and not re.search(r'"node"\s*:\s*"[^"]*18', open(os.path.join(wt, "package.json")).read() if os.path.exists(os.path.join(wt, "package.json")) else ""):
+                    open(nf, "w").write(txt.replace("nodejs_18", f"nodejs_{node_v}")); note(f"{os.path.basename(nf)}: nodejs_18 -> nodejs_{node_v}")
             # Public build-time variables (NEXT_PUBLIC_*, VITE_*, ...) are baked into the bundle at
             # `build`; Railway had them in the build environment. Declare them as ARGs so the
             # compose build args (provision) reach the build, then keep them as ENV for runtime.
@@ -839,7 +848,7 @@ def cmd_migrate(args):
         if name == "dns" and not args.yes and not args.__dict__.get("no_confirm"):
             if not sys.stdin.isatty(): die("dns flip needs --yes when non-interactive")
             if input(f"Flip DNS for {', '.join(s['domains'])} to dev2 now? [y/N] ").strip().lower() != "y": die("stopped before DNS")
-        ns = argparse.Namespace(site=s["site"], ref=None, force=(name == "refresh-db"), public=(name == "verify-public"), no_cert_check=False, redo=False, yes=True)
+        ns = argparse.Namespace(site=s["site"], ref=None, force=(name == "refresh-db"), public=(name == "verify-public"), no_cert_check=False, redo=False, yes=True, regen=False, ignore_logs=False)
         fn(ns)
         st = load_state(s["site"])
     mark(s["site"], "migrated")
@@ -1023,7 +1032,8 @@ def main():
     sub.add_parser("registry").set_defaults(fn=cmd_registry)
     sub.add_parser("firewall").set_defaults(fn=cmd_firewall)
     p = sub.add_parser("list"); p.add_argument("--kind"); p.add_argument("--status"); p.set_defaults(fn=cmd_list)
-    for name, fn in (("show", cmd_show), ("scaffold", cmd_scaffold), ("provision", cmd_provision), ("volumes", cmd_volumes), ("cert", cmd_cert),
+    p = sub.add_parser("scaffold"); p.add_argument("site"); p.add_argument("--regen", action="store_true", help="regenerate .nixpacks even if the branch already has one"); p.set_defaults(fn=cmd_scaffold)
+    for name, fn in (("show", cmd_show), ("provision", cmd_provision), ("volumes", cmd_volumes), ("cert", cmd_cert),
                      ("dns", cmd_dns), ("railway-stop", cmd_railway_stop), ("merge", cmd_merge)):
         p = sub.add_parser(name); p.add_argument("site"); p.set_defaults(fn=fn)
     p = sub.add_parser("db"); p.add_argument("site"); p.add_argument("--force", action="store_true"); p.set_defaults(fn=cmd_db)

From 2086bee653bf42bc6883d0bc40056f8d402eb9a1 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:43:08 +0000
Subject: [PATCH 026/104] dev2-site scaffold: honour RAILWAY_DOCKERFILE_PATH
 and RAILPACK_*/NIXPACKS_* command variables

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 124189 -> 125470 bytes
 dev2/dev2-site                            |  18 ++++++++++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index c0c507382e26202d9d81f2936c36a418ea7abcc0..79018862cb0b932ebf80db1fc724734d33d1411c 100644
GIT binary patch
delta 7097
zcmaJ_3wTpiw$3`qN!z6FrY$Xf0&OjjmX=3(ltR-76#AkqMPAmlCzMBNVJD>!PpP9g
zQ=AHgb9IAQD5F=Aq88&A<T?VvsE9i000QA9bM<;19G&avz2nR$-nC8)t$g>p`M&&F
zd+qhwYp=cbIq7>pVE=`H&~qUn1`U4lt6yKcF6n6Kv)hFGqWDo0On2Shc10Kq(&#vx
zmO)DR={J#n2ehQ5(R2pL0m{K&MjMj`z{g?pmBL>p^ACOpQOfMcr|9GWDM>li6>SbA
zO0}VvlJikmN-5T?oUGBT5YSFwXOJVqX92yDO%uQQJ1~?w?(=g8P>w!!=t-9Y<Uq28
z^h7@`>*XM_+cQ<CaZDgd`p6n7RT`t5{nf^(v3?78V=dqhRzb2-@c0xMs~qf(TAbrk
z!r;dFg+SxLAblTMC+q!2It{X+S7%@C2=dQLX(M#Ze(u^S%B`>{NLLcKo0T60Q%Hti
zs?+G0q3qffrEJ}vpbeJwl*q*U{Ie`j)=T%P2@94oX<;&u1g|~`L4ljW9t|3wj`E{6
zXcRI8&`1+ILnN~tvQN_|G(%^oPatI2Xq=Cek?D71A9kbnxskGPUkY(g!c<vPxEyv@
z7<!`RP-TN)>XO6uX{2n-c^HL={<MA}OxSQ5C#iDc2sz!bTu+fsBO9e0StsSnx@NI6
zTn<Iwn9$A$Ib517M>Gr05FCZ~7;#UH{*=lXQt*)}{+&RFv-zL*Kmr!r)Cpsyss8Hp
zdn(rS!pZ=&6X}?9*GA+3C=EUF%7*WPVxy#Ka?~cOrZJ8pzr@;Nb>s3z*7MZp>3*+%
z<1EiH2X}F{am0*j_>;oG^j45&_!SuRyfo6kG}Aw$^e;3Ca+GqbH#%sVG|RVrRFB;I
z78sPLcO@wq|825j#J<=t^ZBaKh@AIAj{$SE&>y{Hte?WO`~RL{ztv8YQn+hs#8_#z
zKYyLkvWcDbuiq3G?H6T-M=S)n{`CrLD=24O1%AQK7)O;q4r$Idjbo92B**w=iZug2
zF{Qcwj7Wt}<aNf%ree*`uqL5d(<H2<N(hrIYDE>PSWMWb-zD^f=}-bIHb#z>V@HkF
zjEwJRiH?Q>Wzml4)VuEeVf?IYOQceg0+aIf@fgLmW2$kUKeWzKcN3z_@&tvl#(PU9
zZ2k!EqlU8+?6CM(zqW>3k7I}I-)R^<T#}=tGQXFpn$9>m4hth17ASKQ;&sx(PJ`dE
z+F1qJpjdmOVi)^uO64P#vPAiHZ(Kxt=V-^$yYm$o$^);&3sR*r)SD(&$=U&d7~xX2
z9PfABnc#>}f-BXtG<uO#<F5s&_DG#y22-V$d^XNIR{HJB;P*eE^YMlge|I@1rQjb1
zWqv}WL0XJQ9m}CJ@t$QRDhGCFXzS%f<?Qa%uqD#{&7$A%+6I2=B*cf>gGaQOrAn%j
zn7T|dO3S4c(n>6Mov$TH4~(E2lm;a^>_L>WO2Ja2EK-Y9tV(P~lO#ztX%)%}q$f4Y
zqO@9CBdwLzH5-5Kd30BjoMc}x+=(PoZn;N!y{wg5e-=nvpH|u+Z5$B}8$sLqMA;xM
zT!%Lu6C?-q461&qov=A%I0TJ`pFRn3g-Ih;ze!G_mH35lYplNHtCzN#38_O)l0{i7
z8|2ZlaAfm9pt4KBTjw!-NUXF)a$@TZkj5N&h+C&a6yLWO>(cn-jN}nB!yDhB*{ofv
z>3~dGX?pT}7t6tx#BvFyAb4YI3d_ou6fSKjt}0qsQd3%1UeZuqST~<Ng|nFfnS$3u
z64ix83meKRYwHTj%NvR+ioK@FvipfyJCcjik$0sni_6N3RoTe9vX(AC^Jk)Hwx;eL
z(Yw4%fgPi836MTcGy&3Y5>0^CqVGDXtST;Ps4uChEvu?zzr$It$ZXBF)>5_~l)|T;
zU#+TmgIn7qTf-(Bv#)7u^~njjxz3pX)6VQntuG4IJ-PJ4Y-dpGn#~)mP3!C_Ua_%#
zO^f6d&E~dt2mRPuHz_muTA>g4<NF|y5BwU!l|OL>{?)Z<&s=~HT<*QqTKHHA?5ltr
zrM|Bv;<s1_jQTAbPcT8FoaoCH*gWN{z9c1Le}a;`zW^V8Htx^J7uhB&vwH=$&MUOy
zS6b!OVlXTX6}@`j%De%{X}~zxH8MAq;3Wj*rTs~YXMa-A$G8l8GI2KENK(QML>o2u
z#O5GwcaSUlz(MG;fLI0BLgV&~`E^^j_FKIsB5}{6J@Vd$LsrkExkFinCv#4&I5p>d
zcx|_M*%-ca#`YPW=&TFI?AI*rc}M5DE00#5$$dBPRNlM!r}913HJ-Yqo@Mr-I>-5<
z_6t)sT^^U|8DBIsuDH9%6P_{@occEbVwY;Smv&ovg-^rcChkc)khwRr-?GnqB<f<A
zc`)sm;L1GN{$9<gEyrq4Mjl`CSCJGju;3`=lm0il&PR{`V|4wYrdOI@Z1zm6IG<IC
zLr+b8cj@K0>_PpZ&7Rolo|qZk^Dc))?(Ep!(Yy6RSo$IRD;+O(c=8rr$S(J+UGHg?
zht_t!*W{^LHB{MrHF{|;T#kz2dAsuV<UBcZPsf3+d$$fo3~C2+25XN+9IYRmf2i$3
za={th$t_i$MKzx4T2Jj_Pd%=5`B41|&*GJyk_Rr%ZTPEJ6SE9HiHg}1&>z{q<WQq0
zGN-%fYIH&`>}l$6KD4oa#ZXet-lpCq*MdX4?R&HrgA-h54jvP`9>P8PeV!%NHcRtf
zoJg2lD&WsYV=U?TGZbVo;LmweG5uUhinJx@E=?*j;ozz+(w3^d8l%qKOo_B*X>aBh
zlGrD+Ro-U_Wbd<7(KaFAv-CisvqanUfX^nY^sJaw5n3fXF2?o43wjWBSRZFxfiM0K
z*6;3t2E&(FD~#ZrYt2BcUSw}0?RxZRDF`}2Irpj={;7Qb>KHKt^*(Z?xE>bax^nQ?
zC`fZ1KQ>bb-?+Ye(*S}XxZtfkfNzx<Co179SNDlpfNbU3$w~Tb)MS%fk*BUfd=AmM
z1e3|{DuUlrRe!4lp3W8XaOMlwoYU8|`g|lq1Xt?2rcfBKOuLv25la2VS{SDszWAH;
z8>D!h-~ho90xiMw1k2H4Ca_$EeVi9}3prk$gSFe7#^yDS)$NU0O>OJVY=-jo$5&vA
z>zPY~pua?FURTYP4+NO0Bwu?v+Co99c2$$AuN%ro*CvmnOt5{Vu!EqVKp{9xKucg>
zDrwi}L%z~_JtN^ZaUB#<GOHnakk;EoU{Q`<e-ge|=G|CnY(Tvj{Mt_h@}tKf$@Srl
zNkL#y?tI=RHX^@HVgLC8j^n>LC^qAGiR<JSZvfm-oVPc_E#+^wHyYBB%?OscTEDCV
z<7gWHlN>EqKKx6exE9BfE9$GWVX$7g{zHp!4*2ZDnBDd}anPphyfYWtT%J3%!h{5r
z%+xW}Kpa_#Cx{>zzI<Y6F)_RnU@lnrPJnqZ-hBzc4RDL^)WRB&+}~^AEENYoBSHZj
z<XSz9hl%biJ>&wM<<<bmhUfUM05~4}2w8uWV4I*Eypx6eUj{-2JjO2s0*B{$OA!2^
z?<RrImHs=~aEKo;KoV@{ZyCUn{1=L*j9?P2nAXZnL{aisGfy@`GNki4MreZD{8=N6
z0ULkE2&YCpi~?S5qg7%bqPiCv*>Y0Zzz+n&bg>`lX7{yVcr*xh@CReyU_7x{HMv?u
zFpIoY60d@fj)iIBb4VX{*T=$Eoq0U*6G-e4f+8ByJGV2yVPz@iq7-Lfin(c3ia8~V
zJ;Wga@)8^*BNOaF!OU=0K@RAV6CKngKs{!AAOYqXUqqSL@N2gVYRM=c-Y~hd6QM>2
z*Z3o;FcAv)E2(hEs0OEoS-~5}Ko$)0U1MOJ@hB>vCIgo=ssZ<nF>qCYPx<jQD1$$^
zb?KOY@lBNYz+ImKHbFdv^cDBXOz6_WIX>46Gr;0@njsV5bN6#uFc#n?_j}op4tf%0
zZ}M*^K`s0npPvJh#k0uz#Qks%1Oyo0qUi$4iG}Z;4#n`1`_gpS4aVnb;v7vBxE(WL
zIlw9InFZzW7EjEFS>k1!|H{2GAEpIjBL1ZqreV3AD~4add0tTh7MRC-OCTrcHz;SN
zYUOP)P{cz@;cIAj|4<6mg8rx7sx8C7=kd-mEQbBOzYHdbU!c|<x2Ft71*KCEPJN2G
zAf+&cIdOuO(IzY-aO2P`wAk5Y9$E`dBXt>ek!HT(N-eC!p#Q5D>R=}?t%KF@9)G0{
z=88X{R;>HmI=H0QtLrS_L(3sb2l&?x?^+IHxM2nS11nox3E83%xjF6`D`A`nAM*zq
zArCIQpK8P<!a{zf3HIwEQ9_AW62*5&kO<}chy<x%;vY${F<R|=qTOM2*qr(-^_MN;
zbv9UMq^Aa7ktg%_ZIFgfpntWYmozkIc_D5U=x1Lgk?{l{(4xv|^`mI`GErv;E)aZ1
z@GL<G%^J`GOXBq{n1OTrwH7E$8>Gn{1ph&B5y7itHmQwyY5W$ceahq41HQEqLp@#8
z4H?xpqZ(yYIE*%)(f%+xV2pCfC`F9I_Uc!yX>r&XyN@`r6tkCKUysF~jf}<kwcqxg
z68Fokkfg`5{m_BE2qy8rx5IdGDoQlFGd4l17JlSUZGm;^L1c*@r80v@96@y@iK=}H
zz{H1EVESe{Aw~ZJF&^d*Iw8$CojlU_%b$+c%TD-FfDrz2CoF-PT)!12iTNn7%{^-?
zECZOvpX!2gLk>A5c-;ME7fb=M2<aW}v|m7JAZ+3-+hHR-&2MZ689eUgkHZNN7`00i
zpVWih;~=l-!BxG_H}~MSe$Dsyz$6&Y|Ih>Z`uSwKj7K~H)zHfupMYEwHBE28YOCGq
za4^=d?leF21Rkk;e)9<^H>#Vro7OdlPul^7;%YR~>y~#wg%Mi#`+H$o(Hyd?9@x1=
zxlr00T2oS6Qd!(kSY6hzuw*IwEtwd;I_SNHWs*A!P2}?Cr(uSEGN~8x=bwfxP{>pE
zVW&RAtpgCx_wNIStcYhII^aFhRj&vW-`$6u<~U#d4E!U3o?E;yR=xZy@y+5}bv5@2
zzscX|gHw9SD$C&y?+07La3>nVVDK$L?Mfk}`4NW$aKbPB&H-2e6+EIJ8nJ8~{m?Ex
zhIWp)zv_n#fstEK+i5V{+c#Jnt#+H4Ir)YcAt7ANyW0KL%fP~)c@b=Jv{+{ZKH8@g
zl~*k;ZYZ`iEUqb^&F<&%hv6~k;{AtVCJgbbhw*x~^MnCxkuqhYCv`mqPs^=jDMYp*
zcy&t(Ybu#9IX>M#^0Ff!$25@0@D)NE$cnVQ$_S$cwv+$;2=4Y)p8XP(iaT-ctlRk#
zv}?nk@X4XD8h;1>aS#@U5*J(InpQ_!3M=CGAB7U%wpsYIM<F|dWSxeT%914w^Q&s>
zX0r}r7*nco&`?!bzI3)1a#%b6{wUU^%*Vfq`?`boy$b1uCsFbue(foI@ED}Jzj_tM
zY2(!})CiX09NR*mo{?RA;_EOr@+XICK#tWm3d;IAHlJdC;&qq<%lMD4!#K#{<J@>a
zRc#Aj;D!nCgnN@4L_qKIF+Bf!(eO?8z%lqHXtHm?<Z1I=pE6Mo5$qzkr<CV&&)blZ
zNsDEhsG?Qzr8HDc49C8Jcn|TE(~vRBNi^*sR%;2-r37ySZ#WH0VH|(sG?YZD2df-w
z8HLnc9OU6=AX=|B)BE{^GnhyVUvUP$gIn&J-@{&rR-5PW^NHF)zj*3hSfGED9Bkv&
z@4`&6AL-lfo$tc5Fu2O!`54weFx=(U20x;slb(7Te1c_%kJg8Xp<V@Qhv=Y#175M!
z%9`!!#o!Dxn_Jt=O*ZB*H?6ictz)0@U6&xSi|z_<!1^`K3@;}39i17y*{t3Non*9+
zpa;PjPHel)VcuZ1+dJBr#1vv1&E^elc89sGwPg$A#0fE*o7!5N+8ML8Hf>>n$irlP
zP5UsGK<(ja>Jyunn=gZ{i@Lox*eXd47;yV~TdRXr(Ro)dpshp=UqI^J^YhEbcSost
zz2{P*%Z5=?V3b})2Z~W)v&X0#QIRpc8F<7MSYn_*co;#Hn_Yo=G2lGXmH0UHhZ~T(
zoXQCQ6Vc8qsjJM~%w8r{bx&K!(mH}aQ=m0OEg(2f@F2<M67@OFP9!Rf;7>H{CaRGy
zyb1M|Pl>UO81(-&6AAPLl@wP6!LLZfN|cSjLc<DzH%RUs{_i*8oh~(JI+_n9P~Ruj
zS0wdKh+gA-$@D#k(=eSteLz?5di6FRzU%36lc^7n_uTsT?17r<soJ?HO_wd3ML;*I
zuRo|Ael-o%2B_}I@OG#>p>ELtUwsQQ3@1?%SEjLdy7%4!SqLZxsDf`EbdUZN1o&UB
CLRO0a

delta 5978
zcmZWN2~<>9vR&Q%nx)wnWff4NgW9qRZm0-okX1ksjY7j~5k!#NjZ6PW$fz-zI4a)J
zYoaJ<%y^>TW%}zIW7IfC$6d0Su|;E|f9B*TlSwjWVlpSmzxCP|NXB!zUfsI2-?~*7
zcfaq^eZ|A?s;{rNhX0#ia-zu;e#~#*TJ50#b}SsmJ3m`{TPtY9NHK~I-Ov^seNc;x
z8qGm)f5{YfVkHctCpU~M|Bp@3*c07s8jUzi72(v;Dpk@;232K;hvczEXM4x)rS6I`
z^sR40=-$U6bm0tdYI`xB)<CeI7^kZ0@U*AUl=Z>%+KW-(MYCTT8a-UyBc75$93IYf
zNnYZJ$@m4@yDl_qq!|CRNpHJRH70qA36fqk@!wNoqU60()2(grkh~6!Qn|U~Y4rZ%
zC=6B?EsmyNZ4CD}+Q<E@!FUj8*NYK!+4o*XA90N2vs`0?jl*g255u&gnP#txp%-Qb
zqj>08Rq4;}X4=QmV;i!JgLV{U_p?1?TR==w1qf{X@4+_3<bzte@cjtA<kJ*G!4w=l
zMoe+LuZpNP@H}|BOf+><Fm3+PcWSD_ryJPc0vo;c8hef!l08qwBoNb-WP+If<U5XL
zZw>`t9#>khUW^tq4(i<89e$E8xva(;A^E8W$m@eV=TtR7DsKtx%v8BL{O$RwS#kVY
zjlDo!N&YHNuIAtqqBubfQ=I7Fw2lDDH&?ScuwL7ssn;&><&;2ik`%a8BTiOe7Q${r
zmv*DSo^x~rO8!!S6c7}t8SI>zR;`#x+ct#K&tLKiQ;q+kuBV7ok%9fNi&x;cXZ>hW
z*Er)e)u)aiH4Q#ekSb5=up|P+>_G<krkV{O`*=0rrb2pdcrcCH>K!>yW<la~RsA?k
zN3ax31O5`C6?5pcs0h87+u@;_q!ZR>l&P$$ahuUzqN*43R4NZ?wn~*?;8H%r?|Vl`
zN2tAA-4$ohBpMAfX%USVo|bgH`ci0Qc)k>(TIv{L4^+9EDrokGnUS-^0<}2A!b3$W
zC%38;y}<YFRkY-Hk^a1z-Liv1lZIeu-ePgCW&!uIW9Xm&$H7n<xy__2k%rQ|ZE^mk
z;_L=NjjE}dr!T_K<};`dmC^2P(Q)OXQLGT>h?Tsq^;plmJgNrabLpLJG5*z@Yo6#M
z&X)vi2lVc?p{8fV1>!=nhVyDsPOOy#(IVD~^`h9o8-Uw+ZaD6@k)2^um~GZTixE-Q
z`YYK*l1^;+g&&K%bz-B~G{~DJgYf2VLGloDmprA>5UscrTLYH8*n+UZcfbRUhK~4c
zcy`#J*juGAj6>z&>7VcR7n`Fy58^T@OcErW<ROJh+CyyzJ?Y2WhSKL=&>M+plk^Q9
zV$>l!wXk3ar0uLAW)M|9I?$}ptkhL&RzPAq{fNCs_rH9s+!a)uKeseHr=Yy1ydt}-
zq9&&(*X7gFDq3rnTZyf)wZ)}PO?3%%?TyW%Lol0L+wJ(Vwk&rH`B}8MBsZ_7GOw&W
zzoa;eo_VFoFNLR^q#{V?fSPum2j={2=QMz~onyL7b#Q}r^c2BZdbOvS7W5|3&fZ9v
zO}F>P>W}l_>G9sF5Kh18HHB)$MJ`=S<4O|G=`MrYH9B|iFoE<V=kmS7yl!wCHavIQ
zyEmL}eqadqsb4DA*y=5d7PU5u<PqPuBhM^P=bgR15RfjEK)+x3j^Qu0uGjS&gQ#i$
z$<YVW-wRD%KcnBrZ;NhA)sDIz(}C0jEBYpu_RX&9E1lanzPitUUSDnf2R@?n@N0h*
zmNamS7cyrA*Jf$18K-;m&y69u_<1)rsCJnC-PD{AzPM!wsvV)b6{hUCh6mLq>s;yC
z$aZI{Lc2dq;EVesgj%!5{ii$;PZnw?dfXqU;8{Z~!8)20KE(O&Lk18Y^Egg84Trx4
zI75FtQse!Q69|IS&W58y4LTQOIoF(+0ounvugYfl2mMYSE=2JQ{FXEJkIxD40qs2<
z1`*CTPEXXsL+3Z=yg~afaKiaafKTa!w~OJvbN$=p03&Jtg=E7>E=l5@K^OZWA^~v|
zf;6<c2*CxO1@bBNyp$@8;X8MnQ!n-F3@IG_37m1)Li`|xX1HQNpp~w2eyFdz_9omy
z!4DAZL2w9x4#8^(u>2E&m?*iE8Gf5nTzWfcw>pdsjrPUubz|#Wmzv2~`lma$A<?<3
z|0o!4qS(96vU}IGkVIoXekC*$omBKHDivF|=#7ulMq(z&P88ULpa%g(@Hzqvfjp$~
zpF9mIwB-|1)B~j2(W4krhWJs8w;n+zJ@&~q_&c5XV1coM%X#vj?W`v|b{d8`uRlok
zf=v43=dD5&r_Z3|@4x5kh%b5tY~T6Lx4t+DaEm&=TnV@7Kfi4Aj^t#5pwQX!RRtLR
zas6*JR7$UZoh{Vxb)_@-pO^iihTYXdvzA|~tRparwd)`pM7CK6)4(G4>7ZOYI)HO0
z>WQMn7d81I5D*Mp&LJ3(H!C)9!A!Q<05c&*{?Gt2z-_kK6B?mf{>~FFV}Y=@y<rMa
zrZd7Qh?B<}Ar;^pv-m&~Y-e3Q@P^L{)V>nIDlO~P!C1br&KHWn!QS@;20K`@AN*kG
zK#sq$9vzo_h3)Z&Vel+F;}6qg{ulkpN05whW5gr`F-#$OhQ$Ox3`DZ20Z<PQ*uDT5
z4)fT>05})c&KX>~I*UjyaB&yZkx~?~vOR$?Uf9O*YPmlU)_B1hRvQVu5lAAXXlgcs
zNoXYpY13I`6l4f5b9|Rv83oVk%`r%iLblZi#^ch&1sooB3yC%7#5z1<&Gn07&9P(2
zG6r#w8P$k9Z3uR7#>4<pga+myn9eHVppxhNU>wXe?&dtN@t@76RSJh*e-I)k4Tmy4
zyw6rAz!*qlM-t$GQE^Ujb2_Ut@!albT_zZ5MB(G8;6sg~K)z>!J6h;xZ;XO`I4A2z
z^8*l$agH-`<ruJPg%cdVD!(-rI(2ZKO-qFdkSRM-A(5ZD{AwDE0N5*EN{0k6AS*e>
z9*u)?ILe;RfHdI@C%r2_mjNCgMkj7h!JK5Wtyz!@7v&GLU@I7R;>LO0NR#bTVLreK
z);A3b!O5btVUlp2@86dfWJ880PsH!?A%hp()qMC3TxCVGU^+}@TV_Fu7vp>utXI|=
z2|3KS0R90@@(%@2sx>@0t@2{-_+-{m%!`4to?;j++~ZPT%6-KU=9Pd>I1I7oDY4nH
zq?K<Fe8!S_2oCY3OWSNCeavqzIE>h9$OpLdH%8~e0`BxzbD;v(vKiH|7*4Yz)i6!?
znoD`fkE-EAgF%TijlEL~!TNu3I_s>3;mq3t-$OSO>L5wb@aOjkc|skG6yOG1*Z`T(
zCvR`yAwm|ry%=`uJvavqtO{nE8X+2{utSZ!g1p#`MraFFx}RXPTkKYcVXX2cGgw6v
zEHUEHa~F9CyV3;l;K{yh;#MNKy7b?NF9Ac=d&n{h!8Hsj8>0`y<vzqtBDjpeg<uDQ
z6}bBoV!^Dkjc4FI`=2(*j^B@@H3;q?xWa);Ppo1qxryr&D0Z7g5U`ivuqDdv!k$R5
zz6sVS!NMVU@C46?-~}U?OM)pP=(fwSsIl2@B_tXtL(%7(>@MNOKavw>@}KQ9_brhR
z+hCZ1m+kdcyc<D0d+dNw!YIyBEt~!eT6FM;ZGRS)B>ad5aP}wq47!3!B+-g~+z(;z
zSRj~9?1WguE+n+G+D?c!nz=qJTK)XV)jHe>KWRbB4zGqPNMeRHkSwHdhUN04H82lg
zG~2!w3cV9Ji6D^V&(}ga2;({aoE*OnW_ZF9*1QSYU?aP?2_(26&)*DZLEE4-%n+8`
z1yQ_=i@JDNe_|`U__;o0ySpG6V%W_tm~6;G-BVcLRw#w%S>0Ah4Z*JI@>p!KS?qQ~
zdX%GP2e$G%mBK#S3WY}H^j^Tg(pd(DY+(UcvRalX6dA$7uIz?+Iq9fZxv}FAJHWYJ
zer0*(dBwRk*`@h41$ouvbyP7hJ<{={@&6J?CT^Hm!ycGmcnZZc*lT-W6=bm39^R^Z
zndK-%u-!dCI4Q6fLOtF>S@)C(VO#g|UUP^o?uGB80?{yxP#yuriCXdq^%wpJ_hEK&
zFPt-AVo3sfZXZ~q2Aa`Dt|L+BZcM%?dY-|na8~8M_$u%g!vgn19j_ewerOjQT+eR#
zi~X?7GpL12JG{-d_GOkji_K~#t!&w0hzd|LuM7ZX9%Qmzhrt?-;W`5OdpI_yuw+hd
zP44uXIc0@eq=-cvf#<=_dXB(EevR%N;WKtIi#p1?WE<vVV_Y3NkMS0hP((!zT>7f)
zvSQ*+k6ZR_mVXSSAr;6nFh%eP$#@+r34ll~S<4<D<L7N-Nq>MD!dkv}N_PAK+I0b|
z-F%!`@xPh<bQ}u&kjlGaV~f2tmW*d}Pe7jg;4<016Od#=UWa#Vab8u;(<S8<S)>^W
z#@JH6s3|Eftj=;l3Ta~Bo#2((#zx8fWY@5684|o-<eY!zKU*w2dYV5JzK~(0E<$lb
z@t}n7kro8XHCe~ToPrTSPYfy!*%w>UDa$F|e<rZAr(i0Su%AxBNJwBK-{f~xk<MhZ
z-h|PxT3-Gp2*9mNr+Ew5#1+3IA3P0Td!@MpMoUY7w%LZ*G6d@o{HmC<Sl^$)l!(ES
zCH!EB!d{F^Ma6*cQ<1ie#a;qaSS#Xqg1lTOB0dR0pqABKf@%n7Coe%>kaD#Oc`<V)
z<rMd`fXfhSQ2J>R8-1B4GLt=X8NT5|xa<nN453Q@9C)HAP4wROYcR{O5)G_krPpAh
zu#Mw)<;~Y1!yn#b7w^E*g#(RV>G6Y_I?5>n;V=AJ@Hcih5|nA6^oVA>IN%amETqAv
z%m#<Q+1%1<uD24qxqh*=ehG20u6~H_#Bt&BSlZY?_-rEo$5#%6*{qBNf=ag{_zee+
z03_S2cJnfe&9<VIh-5vIjb`(*R-4`2+S0s=Y($E$*<9b+Qr}L9wWWR)`2n5Ll85|5
z!VoBJJYIRUxtRGbSUa)dyL>F7Si>D|Uutc!lM=k|$_#oIv4I(+jGtf58~2z}^7^Z}
zg!6`AQy`dLf)|QlVUy>v9bu6XJ{(x!J*e{TLEjJvGPwtpg2yF}7xNd<%?A)SAIm6F
z>(b54t0+!fN%o<ra;D9wX$gW)(9tr)W+8Y3!5rjEMeHNo9fO!Z0v9gVBUZ%<9zx~x
zek80#0{)L25fB&<<e*>E5xjsbm59w#Xt*pwa1!}Wu?G*~VyBWb{OgivkxBWpQu$j+
z`I9IGX-YEPPjOsEB2eDw%D7hs`fj8t8O0YTQQnVA<_8k|t20niJxVu?bK|@v$p~<$
zy8DCD;TPaiX@JU^3>=4Y63P+vu*H7`llO7X$z#yiB>CmPf}}M}ffD#SSC0A=wDAAH
CNC^-C

diff --git a/dev2/dev2-site b/dev2/dev2-site
index b7bb49c..b3009fb 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -381,6 +381,14 @@ def cmd_scaffold(args):
     sh(["git", "-C", d, "worktree", "add", "-q", "-B", wbranch, wt, f"origin/{branch}"])
     try:
         cfg = repo_config(wt)
+        # Railway keeps build settings in service variables too: a custom Dockerfile path and
+        # the railpack/nixpacks command overrides. Honour them before guessing.
+        rvars = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
+        if rvars.get("RAILWAY_DOCKERFILE_PATH") and os.path.exists(os.path.join(wt, rvars["RAILWAY_DOCKERFILE_PATH"])):
+            cfg["dockerfilePath"] = rvars["RAILWAY_DOCKERFILE_PATH"]
+        for rk, nk in (("RAILPACK_INSTALL_CMD", "NIXPACKS_INSTALL_CMD"), ("RAILPACK_BUILD_CMD", "NIXPACKS_BUILD_CMD"), ("RAILPACK_START_CMD", "NIXPACKS_START_CMD"),
+                       ("NIXPACKS_INSTALL_CMD", "NIXPACKS_INSTALL_CMD"), ("NIXPACKS_BUILD_CMD", "NIXPACKS_BUILD_CMD"), ("NIXPACKS_START_CMD", "NIXPACKS_START_CMD"), ("NIXPACKS_NODE_VERSION", "NIXPACKS_NODE_VERSION")):
+            if isinstance(rvars.get(rk), str) and rvars[rk]: cfg[nk] = rvars[rk]
         if getattr(args, "regen", False) and os.path.isdir(os.path.join(wt, ".nixpacks")):
             shutil.rmtree(os.path.join(wt, ".nixpacks")); note("removed the previous .nixpacks to regenerate it")
         df = find_dockerfile(wt, cfg)
@@ -391,8 +399,14 @@ def cmd_scaffold(args):
             if cfg.get("startCommand"): env["NIXPACKS_START_CMD"] = cfg["startCommand"]
             # nixpacks reads NIXPACKS_* from the build environment it is given (--env), not
             # from its own process environment; the default Node 18 is too old for Next 16.
-            node_v = s.get("node_version", "22")
-            sh([nix, "build", wt, "--out", wt, "--env", f"NIXPACKS_NODE_VERSION={node_v}"], env=env)
+            node_v = s.get("node_version") or cfg.get("NIXPACKS_NODE_VERSION") or "22"
+            nix_env = [f"NIXPACKS_NODE_VERSION={node_v}"]
+            if cfg.get("startCommand") and not cfg.get("NIXPACKS_START_CMD"): cfg["NIXPACKS_START_CMD"] = cfg["startCommand"]
+            for k in ("NIXPACKS_INSTALL_CMD", "NIXPACKS_BUILD_CMD", "NIXPACKS_START_CMD"):
+                if cfg.get(k): nix_env.append(f"{k}={cfg[k]}"); note(f"nixpacks {k}: {cfg[k]}")
+            cmd = [nix, "build", wt, "--out", wt]
+            for e in nix_env: cmd += ["--env", e]
+            sh(cmd, env=env)
             for nf in glob.glob(os.path.join(wt, ".nixpacks", "*.nix")):
                 txt = open(nf).read()
                 if "nodejs_18" in txt and not re.search(r'"node"\s*:\s*"[^"]*18', open(os.path.join(wt, "package.json")).read() if os.path.exists(os.path.join(wt, "package.json")) else ""):

From 0ce1b24e91a8c70c78ab009b291b68546857d006 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:44:56 +0000
Subject: [PATCH 027/104] dev2-site scaffold: pin corepack 0.36 in nixpacks
 Dockerfiles

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 125470 -> 125841 bytes
 dev2/dev2-site                            |   8 +++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 79018862cb0b932ebf80db1fc724734d33d1411c..eb9773b6f6a912291ac99474912c71c405c372bf 100644
GIT binary patch
delta 4744
zcmZ8j33yXSl2+;INyfs+hcLb^gO3<T#^x|rh;P7P%LWs`V8+OL!UrImmW)9>;T%AQ
zd;uQ~G&3162C`vd7BJf3<$w^F83H5(NSGxUCs{%UzMW*49L!F#*-5tR8I1}0KK-w{
zj_#`J>gwKm&Cq$>Fyh^ikYEk}9jZ9d_)TKphy$Cn_aj(eG)(b-v8hCa_x+PzxTn*~
z23po$O7piQ(v$58u$10x&l=&2@D!pg{u)auq(wwODdox$y}}^R7b!=|5i2KaG$fVw
zbd1%?ku>SWk*2&}7*qg_Y$g{T%vu5EI7M52K<XRinK!7X(MScGG@i=9NFEi?Dbn;l
zU`mC(+Cfq(@^Zo#C7X*h?Iwq|PUFxn3*j7-R4kib(nvE^oQ1eY->H4kq~jVslRQd}
zlA~yMhZXYanyn-0<&TEZe{3Bo%$7>jaa3oiaZX?rU-SdN%@9owbf$;Q_2mA`zi4`+
za~v$7XGTZRxGr;8v{V|fo22o@$T2j(Yb2D>yto*hWb*|-m@0x!{pBP&&}GhD6qrgX
z4}=ODPgQ^`gRBosSk1%s#ronrO9N7=f{vr{Fprke6mh;R^lE7~jg799V*@t6cu!bB
zyRn+)Z=GdYAUze>H)-MFMHF_Fh@9uCq2)W$gh7|hS~(tl4we=dX_oQL@g+R$IV8~7
zooPaqoIs0rCYhE<OY6jd_l<U*j2PO!GX$#Xo}KYY%Os=p3#mq0E`y|t=Faequ|GuD
z(wjRIO%ARlNy8<lEb`6L(vNqJN?Re-N%c|#*VUq()F_M6N@<m}T5{DHA6hSITWnjR
zoamn8F$Q9l(6;Fj+h$pi*8I#5vPY2IlIJ0BS{|a;?h)l+$+q$_Ue{Ww)dkX2EI4T$
zVqM6P2O13>vn@J5(UbkJ_1DXZ7)L;d@2Mjo3#=e{<wRMO1vyxbleLF8^ajyeJ4ex{
zpVt{>$tUaT4ASVs8>yYuBtA3_>?~+nHS2^bO)I3g`9Ec4!c4E((L|ihcE`%Rtm@41
z)lzk4wUpsC4RJFk<YZ=fvjYrEbA!v}lq{YmOO`6KG`K7@{~0rV{H3>`*Z;*!pXy*d
zeRtm%x*xgo^mjeEV4;8SX$>;CoUJvUbsoBMf2PiYvNg98=(gKIQNtapr5d-xzG6kw
zDv1CuSr6|4?sNYB{rdrC`+Wyn1aY_X!|-Gpb|`A`eZ3|$yuEd6Yx~Bn8+SXdnMMyp
z#_XOz8<?xp^<iXchcFNm*PZ&S)GJ9-u1uSIzVgGEc^!t2B4Tzsx}H2Z@sMz+^1zeV
z$4tIDX7X!>Yh&{MkbGs9_gcXQfBK<fU0Yp}=6tk>m^f3*Kktt&Nadfa!wQ1==R<RG
z7XRGPh1Y3yHzEtod@wLJyv`sDJW+%SxAft4X5m&;J`O$`qw?-*alX3-u`bMTcX$xe
zX0a~8a5q||lOpRT3yud}k4}yr;s4>V9z>Dn;i6xE<R1VZ&>xT1!&QIXv04L&^rDgp
z|3|-9MvISeoojx}Yrhg9)&It+X*&4M|MxS&0K)O#KM!!<|I0sA0%XyFKW6E(xGu@|
zho2h&{dlA&(EIPq6sK_VZ~ol#1A;h%lM#N)dm~3c2F>YDgmAjBzY<dDtNri51WIm}
z!!&yK<_(zS|INU&I+#uqZ~Yny=^M9ZC88(fB_0IXj<64bBD{()g<3u<gBjHISpnDY
z`|Mlea;_i8|L)U4tnU;g_%Geg8pdTme%T~CIDZKxe|?3IWA62c^?ba{|MtCu+Tb)!
z5`^V`*VhZch*OXscrlS`dg+^daU~x&`Xj!*U;;P$SPOm7%-RLWgBInA0F~N|c&?DH
zBdT2t8pk4pBV?ne;}IeeMlqY78y2#5J<Ng(<+>h{wBS^}4}uFk!R+_JkPELc!3bl)
zs$?3W7T{IZIUL>?{v1xX31PFA^$3v31zSR(47RXqA;91;TQvgyso#nkciBDx#=#NR
zZGr@NfxTsdd7&5vF=JSm3sTP#Lm?5;SZ*k6ffejrD4dCUhD-W|TDwFpad-QnmSD3d
zYgl&}Oc8rHy;>OvgXe}pJ6j$LJu%246&Tt)gy}eaIr3~QHV$&cmpOe*Sr`W!b=C~z
z$D!J@2t_zd;|5-X$4)HPLW?)ZVs)&rSS^`EW{?Dv<62P1hp?L~riYR;T;M4L8(WYB
z3wbJglVFzdRj%^}|GV8<b?fP++h%3lXlT<xE<2hEhm5LMs(&_Co5s`E$2!v>*?62=
zT|mq08r4$yBn?so_>-c`;K>zFanT3L!pFg>70+_|Q|0YUcwK-(#XBC-0sg8SoB(40
zjwt6RLMrG{hn!;fCqX5gWV3T%f_Ra$?kG>^fWcrqjp8RU{6eK`23!Z@E68~lIk}1_
z7nTB?Wmoc`6i&1Fe3&lY;PU&*vV6!1;=%4HfgfNt>zD)C!wztX9Se*##d1-|T=*NT
zRsJ~_Dzy3sdr)cPKF(%78;pi-w$BC``oC~1ouFK`LGrNB4Y+s-rgI6xYfM}W+u&P9
z7sE2{$JdKt0d%mLRZtHX*wHG;6My6u@yh)wxUSc$uII9=%OOIi<xeoywj4&YU_1OT
z{FaHeFisrKxs#Qtwa~4HdF)0#?A1kZ77bez!L~O*Jj`c@8~9F-WbZe?W<FZb2+ex6
z<}B=DBcy<teborbVk)<qtwgT`lRmQyosPnc9YyMo2!BGjgK!X`6{SXQLlW7-HPD^X
zhun6Ay9ocup<hRwQWLp}<F`=%&n$+3ryTDJqSiI`6M~gRut*5*Bf;$;m_vf4O)wn<
zqa^5IzkWr-Dvy(pbmWY}l-^_?6JC8;oUxSu-CqpWr*gy%33^^dm)7&64%zHGFN_s)
zxW;NFZ3DOjtwvyMBQ&N4<5YNer4N6o`qfb4)dkQ4GrMYs2sW(^Ec!#pc!n)+gB0Ub
zZoD3s{qjL^A8CW1v@n7lc@`GIbf$j}vcwr&;RR*-bFc(pGTXHYN`uGaq6i(zmz!WB
zh((;<p`>hqnL*IXR&9qhu#bJR9b~wwENzF=pydaTcO^5+>V!Dn!pb_K0={B<J0S})
z*yT=mLSKTD&S7C)T++#EyPz1#*r6`Sff?-6E+{psn?%w5JeETtUu@tOyA+v1nGsgA
zi+f>7VIEGR9+!Ni{)21xkC<OvS!^q+$*(A>nOj^%PT&+nop&N`ZaU_w5Cs!hT{leC
zPek(q_HW&=9txOcA2{IOnf(~Vu)X_$a8_6k#ApY5t(kT0=ZE`krM?Hu@N?!__WFJ}
zqsIi1@$BgX;EWqO<R9<_(}lqUAA)XNW^fQr2ei)}ggIbiVK4JOpUpfkLyNeD&vRV4
z_cAmGg?qWRH`wZKX|~te-A*gnz?zRhT&S8zwTG%LwUGVh2sooLAa9t{wboKtTK-f~
zO;JJ3Q}at_kSZ2)l%K7q*}kJN4X(4BNBIrpVR6Tx2z(gvi%BkY{w(*;Mv{<h=FqQO
zlt14_&ZF0x2W>xMC4C@AE=QH2MvR+8iUd|33b9(!!M^L`JKDy^9fz4>2bWz|yvLzM
z2;DxY$CXw8*Rh{|2XjXt*Q@6bKK}S4MQrg2C?4FJLU!N;j7vjZZ?MHyyr^b&dF6r`
zWF0b$mI^+oDYunY&FF`0vX*^+f)|>PjaB&GwX;16qz3Qenm761ZDGewL6UM$fn*^@
zbwl+4&m-|7sO8?p9)A<Ygg;nNb;wiiM5pX;@@`nnPQS@7=cVkYHz66uv*eTftf|(8
zY|cr@fbGiKlOO_LT|ULn@~`>Ce^z==!8gMu3<iuV;b9zH(}$Fd(1q|wxt6di??75Q
z21{D8YE|_mI8>(?@_jDyWM(-JY2h1?#vM%8l9@=)VpZp%22$AT=lNaP$3ic_NWIzt
zt60Vbp0Pru`U13TN2;xE=pI-5-CuUS2XpkBaGuSq;ysuq_Hg=ZrTslPX!^xa7giha
zLmd|l#$wt07l(8pzeR@Hs?`I&4$lPii!M8<bE}QpYqDBhO;(4Kc&v_kr(-3#!#W2b
zz72bMzhQMl9kKJS`agIa^j53dwm0IWdl9yA@P;DW?etii?QVB#6OqUcWE-v4<|ent
z+T>cbp6o_Wh}G(7ayeQEak?Dq$uQ32$@&UYoQ$A$+7$Ik)6c9QgR>2ra{q9<B-L<-
zTUI+=9#W3csrST2q=xPZ^@{lUoiKQns0n@K?!Y^N;CUyQSAu7SV9k=v*sHL92=Cu4
z>=RfNd>DO0h*roauuwEy<Ft(wvdgz2DHJOtUE43rDqdhqUq_Da`W({0&K~=mU;7R=
z_j71UFUJXN2+yO-wMeZ%D8OME!t1!~JM8x7aIQ@aPDHs0;Y*aO&vAU(6MWPUMm_kH
z#9<nO`o>i6PW5&ix;yb1Mbx*^Be&=y$x?HYBjj;y9=nD-fq)m(;2BlBYy%F}CZr~B
kC~s=Y)Lb5B^>=s*&L|ysV6)aRAD|q*S*67NH)!Gi0q_|6Q2+n{

delta 4648
zcmZ8l3tW^(lAr&~d;`n~h&&YKG2jC+j*9QMFo5{rCHROKLtwsfP>{i%K@^ARCKxw+
zQPeheHi=Qx7+qa2I=lPH1~uO1Vo2iaOwL=(hIo-R-frT?-TUSC{N-|8A0lq}{pLT_
z)m7D1)!kJ+?79*1#wQ^WABBfo4f1bh@o&~tC!LBo)NC9XEpE-l^x)Ucd5WpZA13zC
zM{F?vXE)5eZQCg8age;h&=kXO?U@ucRGoF)^pF!9h+!RkUCS(fWaoGkh^!@u9zOe#
zLY%*-N6=tU=QJDqi+V?aI3BetIxq9Mv4^8(HA<psU?3*P&=Tn~dJHb(%5cevRGopy
z*9>a5jyZ(;EW3;^MVh5VQ)D16FfcHXSMPFQHedH*tSRm|__r?(G3BarY0Pi$%D3h9
zuF^C}x;lZM{P!^4usbDuo`23Ge+Kb)T88nC-8Pi)3#rlktKBhCgVg!Gnv)Do@qu`L
zU|}p4@XUn4Ms*>d!<({}^cqm}dxM6-zpR%VK)}*#;wc$w)8M8d{^h;1YJqh2%CDud
zLLR?oxTz>$;wgI)BZ~urdzG3J{87ALVFGV^aZ=<WwWK%kYUzo^{L-HJisboM@*yv$
znR@(-dHDgXd|tu;tGXn|uu>+xDUoM!4-)wuDYP_@$fNeAL@raG^eDX^uPNtQd(*I-
zuil$DyiB#JE7Ygdl>w;cc<HK4{?m`q<@*#*sHjLr3_rg&B<vX}UZM6=EBTeZiD@oX
zRo&_;DQ+ZH)e}(EDs{EGMy>YP9$W6(gCU!f0!h9Fe%qsDkZ#S7bk_z<YVAL`;@xLb
z>(q6RIm8~LefyMvRb5y;(qLdl)n5yB8l5Y(p3oEC=Yhe%uRn;-O7dqsT7P{YNuDiZ
zuZ-Nrir%^271V}6Qa}lq0@lEgfbqnJ<DvYQdk69@+sw9&YGc6c2~kr|Y~qer%99@(
z_wFSO4TcS-<%R~N2ZG06DKLp2S}{Z<?M8pz^g73z!Ki&*W@PYhTmQsw9h{A1Za>t(
z4;*svuG{JSyF(FHgFHiic^iE{4MrY52sneM->f$!zg}}R<LFbz=A6m8I=k@N%%ZD{
zO0JfcUt9Fd^`wgH11kCGV}pXPAImjwcF!<;5U&s>&o#=g%c;&0^6Ofd(<;BN$K=r0
zjidqY1oMq?*)ei((>%bPV!9cp&ve-bxW|~f#%Gb(7qfI;cLLe#PEp)XgmjMxC3=kF
zo*L3UL8oWLt%@?a9u^QjB|aipd(r~MECYEjxbdIA13u>KPF3NfVCSjI5SaO_wlT&B
z5Lc!kHp<G}wW^zyyKC38G^uep$lHFdV0h4Re!3a=gH^w?0>+^4y=}lZ!3Y0Z3XJ7N
z7spw~N?|rGxb@;^uw)QDo_jjxDpMqRH+Z_^Gm|n?lHoyqDK-M5__3SGh~gbLOEHWm
zes&S#dG}{Un8qjl;rEyrjQspLGp6(1|M@DM-0@{zGP%NDlQFR!1P2H>!7m7=aQ<Zh
zX7XEKI;H%u+kaKcrF>j4p?h(dWUTwft5izHV&47DTXMYpUaR7f<7L4Ke>rTljv(6v
zWx-qb7sED$#t-B{WGi^)-?Ef7a;yel_*+LL){0^?PQfdT3Nqo<vK5pXpGc4b>1L+u
z#gp=2f+&Iva&J6AoDSkbh*We6V<_@4N?Q<$6eCov#)=M^Rx!CB=Ac!q?}t$st+n<;
zC2&}nBk)_>b7by$f@blP(})$HM_{m={CflnuvO$mLg0w#ip2N$srW;GOtc@B!oFA;
z$5)2`*<!dl^Qn%fKR|owyHV$tc0B!e_M*s$!lH2$9gCr8DMgI(!hWFPKnb17Dlc=n
z**an<1S7=hD7*l-m^J_x61Pa{PE%!t$}Y+9I#J11kba#6Un>9NcB+^bjVR@S9DB5)
zXgnW=9pZWdS_c!06;n<Y5zHXlg~TfmI}$NjIV|a4XdQ`o*6bKX`~(tvjv$+cX;Psv
z#9zVej%<5lsNLaOWp~)euua0BiYXR9$pplyRK&^_c`+4BWzv&|BF}bA&iqP#d_JSd
zYC{sw?2ge64#j3OW{cF3IBL_~&>boepN_;Bye-V>7^a+(TEEjA>6mZA6|G^k%)8Pq
zc^_*X4!DiV1xf#2n=lS-COEaPCm<cTqYa#dp};S-8Iv&r7LsA@!ZQV>ct^Z51rux?
zlJ$lB`2GyBb_E7&(Nl59Vmn8YvngJurp&<&*p3kABjU`~?qp&Ga6x1{k&km?rxP=j
z|B&<FXjh$>94dniS%?S76Q+D*;Gi}sAJc()t*!vYM$5xQzh5L>%oBepLaOBrGJZnL
zkq!*By4I@Y>)mYis*UWf<o}=i_*V3!OY;;1Vf`CPd_HYj8G$A?EXQ`-7nU-tly0eI
zSd13YR)#8kAW~N#Q~6$M4AeX;aKn<UM>1P78pCV7e!I`_t*fi3tZ_5QM^58dvA+^=
z!deNdXsX2j;;7i*!dS&7Co{AYF6_5pp~zo@H_QVhi$^Vs7Gu^R5&0sy8YzeoS=HEz
zMdD&L>MZ(!Oct|hFdWgsRU<cYxYTlLFV!H@GA5q_8AM4vNz{7;pAd8t93p6-S*z4x
zNuq;c|M0hoyMy451fNRiG&8sAWt}uWNAkDDb|2(Zj2QY^r;5br@G&|^jCP&Tj_Da@
zble%Gh*6Y`JnXcrT3zFJGd7YqbQ@WxDE8y1GFCE{Xy5zcw8(>&xk(laj1$!Xj8Z1a
zDUbGQ0JSFL4@P0#f;A~&q)#m@y&o$eGxUP$@jtQ0>dRX&)$$gtzC~Q$g5k<ksp8YV
z--4kggo~7BEW>oMu^Ho(nR2FCJK2mfV6q5%0r}PpvQO|ct^5T{gpw`k9oj3~FgFzI
zMOO>f;Z?C{Cjz*tUEYcF0P87X6L&(^0`cx{6yu(V;uwcf!pSkyGLLM|7tLJG>=d7J
z<jUP0vImnfQ<UsMzD?hQ-Q@BdacmE=lq#vQQ@ghZ1vb=(SqD%yd=44WFH9y;K`GrC
zQIcDlTbNUxRXo3ZVeWGFYteoHgDg(6G+uNbz%<JQ63!Cwt=Nbx!CT?N3GrPkUP{Q4
zGo2yJvPuf)7v^;;xg{k<C57w*+V6)&Svf3k`ERwG2N452&TAK=595M`Qo}ODUk}5b
z(09YH$<@<MJ-0oatX&rVH*vmKdfE{zkX5Yth-?Sr#GNCkSGGz!C$x&UP!~FTqttG+
zI(+r=4psQv4n~)=F)pWmZQbfxkKI+{tyk@J%)7?z^4po7S-p<xWz{Jn--bJ$Vs4C*
zP2ZlKU$i8rJjYqSq$Gb9ds1wFTi&J3v|rP4O%$Gz?aL=xP9et@pq#xzCupQ7pNM#o
zAC8eC`82Xp)>4@NA|okeb|SqJI?a^0$FemY|0dc`BM@6oB7G;5c9La_f}p(8EuuPz
z$;M|*;@dNFh4vsuD=l)qL;E_2dQ<=Hx-5YnSA$?07Df=a(PCd+>-XBFrH?e^_Ux)t
z#GS#|G?Hz!+6!}+mCq|GT|A355W{9KmV@%5!u;j4I+4NZMa>y`A_HRI88F$m`nO?(
z^0JitRGZO;1*XCJ;`+K}lFK#{=$B!a*x!z!10F7;yWy{LlPjOJ%leoj#-EjazD%&Q
z7={cX&cbfdwVmSZSv-O5+TF8IAlJNiPG0JtOT%4S(s|quo6r*`t+e6MngOCV5$q!9
zdvi>rvoud+cOWgDLS*Y{%XIPOG}KM>`M!X7n*^8Q0~(2@y-PQ;T%zZSk2_F~VPf=$
zSel?;KfN#(%L5=~^zGBj;gjNx4`te%+LaH{VvN)4USFfvi{D+Nc(w=w#Xnub`2Nq6
z^=1M$ou!^0B<@^7oN_>N|D+i&<8b8WzCx|n=*NmOsg9yZzmSj)c9a-;HSh6K#+;5$
zrM7~3e0ptfjC43^y$<=V@jF~qZdbKl>>EQJj=K8Fn$@nxaED{Hr`F5djvBAjp)OF}
z8M1b@hgHae{NHleXmL37ir++w?IU<eLSuho``ms<U4_rr;AJY~#I{M(UZ3CLt*zO}
z1aagNE^n=?p2_#NYa<JlJekFNv_C_|&d*W5nM!$QzY0|?myXx3b=Ue?5k;xDlxK<R
zYbkm+`N#Ir({=Q8|ESGS`(RW+80DAIbz*d^*;dLw9X2NGzi95lGAsR%Vg%7zcNdl_
zQ?E<9kWslzHx}MC)8^wY{d0q@*J(DkXA|h8r5ig<dAW-V(>Jh_!q<&7JR@G~Mk*@B
zxo&vVd!8XukZq%IDu{9uIB8fw&_<Tu7fb($_c!Z-n`u6R;LkLlMil+VVD#&vCnJ6D
z*b&6jAGmr8)|+f!3#PXl(;s9%YQ{fGq@J%yrc5bKeUZ%|pg!1h+4YiMMMJ%g>51*j
ish&<f&&S2hJ2D0DYNoHS)fkcw6yg3eTFZaIi2nykh2ho!

diff --git a/dev2/dev2-site b/dev2/dev2-site
index b3009fb..4d84459 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -414,8 +414,14 @@ def cmd_scaffold(args):
             # Public build-time variables (NEXT_PUBLIC_*, VITE_*, ...) are baked into the bundle at
             # `build`; Railway had them in the build environment. Declare them as ARGs so the
             # compose build args (provision) reach the build, then keep them as ENV for runtime.
-            pub = public_keys(rw_variables(s["project_id"], s["environment_id"], s["service_id"]))
+            pub = public_keys(rvars)
             dfp = os.path.join(wt, ".nixpacks", "Dockerfile")
+            # nixpacks 1.41 installs corepack 0.24, which cannot launch pnpm >= 10 on Node 22/24
+            # (ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING). Pin a current one.
+            if os.path.exists(dfp):
+                txt = open(dfp).read()
+                new_txt = re.sub(r"corepack@0\.2\d\.\d+", "corepack@0.36.0", txt)
+                if new_txt != txt: open(dfp, "w").write(new_txt); note("corepack pinned to 0.36.0 in .nixpacks/Dockerfile")
             if pub and os.path.exists(dfp):
                 lines = open(dfp).read().split("\n")
                 at = next((i for i, l in enumerate(lines) if l.startswith("WORKDIR")), 0) + 1

From 6b2185036534d4dfe851cf909f7a893296107834 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:46:09 +0000
Subject: [PATCH 028/104] dev2-site cert: remove Railway's _acme-challenge
 CNAMEs before DNS-01

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 125841 -> 127073 bytes
 dev2/dev2-site                            |   9 +++++++++
 2 files changed, 9 insertions(+)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index eb9773b6f6a912291ac99474912c71c405c372bf..e841945f44b89f02e17979bf931b304a3c252b7c 100644
GIT binary patch
delta 9442
zcmahvYj~4Y(wSV_rZ*^|P+ACuLPMM00HH-_3oX~umQs+57}C6H2u+i4lD0Gy3tANM
z0`lT_Kt!%0EQnxsjjSU2Agdr~Sy42CcmXfF;v!zwug|)EGbhv{f4)8slR0zd%$ak}
zoS8ZE^7sYaXP@fg-;RrmQQ+VA)h{kh8FD0k<2dM&caC#HS5SZFK>!H8H2y09wY;M^
z4Wfgu7Vk^aCWAu3(qz}{O!!%TV)jw3ng}Ynwsx3N^tGbEu$p;Xb{6TP{-2S^`pZw&
zW@<-JTO+?!y8s0bnR78QiwM~St`Jv_oG>@JREX+NMA0pJGO1}Ia2**<8b(tw!6}5Q
zsEfv!RLmqh=02_?1u9uy@VB{X0C95KyunZ;7tcEc(eiimk`uddd|2gcYGgl<B#;gB
z|BP&>=X?70%ypcY)K;(8$HvN43sTZ2pwO_!=4nJqA>m*PYwT`6YYnTt%-+o6<%bu{
zhKAtf1>ftTTs~LdFC`E8n1LoqB5_g7?r{2W1Zxbc9Iq*%N`Avx0^XozX$KhMh<OwN
zv4JKUmLWggkTbZEh+YE!B;riM(h$Q1i@jJHyw>1QX@!6+d4cEealcZplFcFZ>2jer
z6*pk6*JmiAp)-*hP~ACl6dO+c@$x6$QSCHB>>?XOJinh|Kx_0l{dS)ziU~D@2A7GM
z6bkDccE8o{XG}<rC;D`x<0;K1F-r*?Mk<*`i%)R*G}t!MpV$>vO*~K?+_<bnHGoF>
z@Sh^m8IH0wN*3P|PYY`gUh_+;G@+PSL88&=Gddfs4!haocC{Ka(Hz~&Qz1isc=<e-
zDPLJWH<`G@Di3prjl$!zx+NcT$g^5aus*n=^<#iF@?9%(qZG(!0;ZN9TQLYW1rMz_
zuY{+9_utEuz~!G;mBZ8WovTa1A>X??9d-tHu13o$l#kzMhF|4t_l<#P<c#|-Y5xbM
z;F(2rOo9W!iVkNVwDlJ^k1{++YG^&o>2SIO8p+;VU}nF{zil3aGRAC~sxP2%BMFR_
z*KJ9|DfewzH}EJC2;fP+OgI6=j}d-Mu6{Bt{#8W78Z;}rdotTDuXu8I|IMP8=&^2(
zWVbZina}BQvsdLYThsMIrVw^ambPxdW&O1E{kWfS!_k<&#vis=zVOsPVTXKTTQ2OD
zf7n)R>Of&8RiIan!|7krRF~W0VGZ>zI?nAh*I5JsrMZ+91s6Vj0%F$C+)6KFljY1E
znIH#e?U)6b7l@kRvsvrwJub;o$E<GK680QXV<eBQ!OrTP=sTX3PwzDA*CUyAkT#oS
z<*qDPC+F-MG5sl`{)MQs2#g?*MWBtOXnjkX{7zR`%NqU6ZfD8Vvy*x>ElZp@*ZoAO
zA{kTVUAv0r{6_7W#GrQDm;1xfc6U>womu^M_6l{;4Pyt0KS0<$1fHQL*$VSx(`1ZT
zIT<)RP2f2>fA?MRr2NqC{62po(aM&3Hj#R0{XV1o>6LW(`fdX#gW5fAJ!peX&u;<v
zNlrNOy7n5$y%zl7NRviCobVh1S@PV_Q`!@RGWnO#)mS>L$mUE2`P{tZjYs=vX&LNG
z{(3J+)iEzIXyx%obCkaVe|HSJmKbJtOLk_lyPKIQxc+E|Cgl?v@-zXuO~SV_;RJ>U
z&Bw2*;>mZRu?d^FsNmo4hCcGB6U}Jv2Tr_+cI|s33)1B6Z|q5%ikx9BZXwRWYDm~N
z0tEzS%8O49g;sgZ$zh2<(PU8s#D=YqUp|=vqk<ottOd}>S#PHH?jM;mUx_@e#5hKt
z|K>2gXcq`#aNV1g0P*riZ{1xjG}J`4qK+mbMOY<)JZzd`BJ<d&Yb1>xB>?q12%Myj
z9;H^uYffcCVertYfhu$&XU}BAgL2oI6nI`XoGtJDFbydrxvGeF1le^q9VP_VpH;<=
z$-v$~Of~Z~JL$F=+5N<xjS~iR#!Rn=`Hd_dNntQWLfaXdJV`$F@oX3-r(Imzev1#F
zp>+0P^~k)uJa(Dd;<$DYMt3Hn!Lx)dB$XhtHsQ}TL={e41P8i~>~R7c3CIWnQ8`}b
zY(`6;%s$6<SnX%>&`XK2<49jMUh@*RS}wV?3Hr<LUm6t&{&xfuJ~<594@t<!!IPKI
zDB(_d<L6Hr%4k=GQbHf0=w-R|i;<&D)FW=KxX^SN*(L(wRuxjOuz5Nyv9)-$<b7X^
zG*Ad(6R5wIx|S1|DPRAhU+TBiBktayTkf7X;xc*YmEnDaBI4@lC{}xXc69faD|7T)
zX=E1xkdI%P2i9P}tMj6vOkVcgWUaW;dGfLEhJYl0_T2#_Kl-l+QYi`Xp&E*tu__$p
zby%!Yqtnft!QAV|Kr7BhE#LUw2cOIJH*))mm6Dl6?0+O-xT*s;vbCACpv>T<8}mS)
zM)-fIbCF!~qrohk(U%csB<`V!@n3fs)Jt_1x3$r3srNAE3f}i)PCR7sBTBeiJC>F-
zf+wk9H01MX^pnZkRq!YPk5j|*$}_+ZABGY9Yc=%OE~9z#xK0C~K}P5s4Lk=~1CeG@
zGojJ|>Q5z*M4-nglWCfM{B<1+O(Qqa6`wIbqcKCO&6t`oGh_CGfF?(3YV@))u8e{y
zkR6&H1tEaXxiSWvP#<!|z$wtFQ7C3+{LWaAASbjl76wC-*!-C&fB#K)a~g!Z;h)6A
zARZMDFX}r;nKc9+;HzH%19dHd2SZa5;0b_r{8A#!hKG56FBo4&lGt|ygc%9ra?#K}
zw7n8xP6A?DiV|TB?yAksmQg<?CoGe{&<kwvE$`bK(u*C$EdoacNfjATe_|7Mn0~t*
zE=H!X%IokkamTZGOK<Sz>4>WFJNy<*8-2`Xv9bG5Zdg@kmDoGf33Y4{&BPG+(kW8#
z!X)SgyFxRP;K6A92BdeXY?6^>@Jp${vvv{pEK;e4z&KK=nrKx7MEnyPD%otlJq<Eo
zZ|Gzij8?akvx?+;BHjGmR|I0*9%Hk|g<;UwbMyh-TtPB+DKW<ygku9S#+egM#(L&y
zGzuTb(nz9kdF3=W`JsT$Z)HaFBx4}TXtvcG&Bh$I5<3IYyfqyPw9UkLFF%qF2B_k1
zrbEeKIuZ2Rvq_i;5s`aMjF)I}4xTv##_JCt;jj45=Tq|1qcBh|x!NbRYY5b+wU=n<
zbG&Of4A+*>xC}l#6L#yxwulX?;_qj|pv2qec!8@;Fcg9zlL@|7rZQ6GW@Hg*hB*D{
zq{CHi&W2=ggvzsF5rBj5Hlq!{8aio){{<-K$8(`yGQE4c$Nxy9CX-%O{JUHzffGD8
z4-P2R8vfa2Ov|rz#BgIi)W^3e%M=@6QKmw%QY&fY*H;-pD?dKOAm@#XE|qkWB1J)d
zlm1rf+O%!D24rPQDat)Wif+?N3V&RrSD|Rrb#v+!QcNI5p-7Pv&lqI=yD?E)72A|6
zqx`+({Pn4|ena;VDOQSW(@F6TwUlr$k+zurmV-|T3aMAOxRud<vMce|7VYoXjd%02
z-fhuxsj1IE36XB18``2*Mz=+mDHc6|y2rG|5Q}{6SWK+chZf<3NBTvG@sdI6+dXb+
z8ZVs#Npix(SWS_X9N}n}`t@)$)6l9vETVs#t}R9~(Ea>>c0?hiNPVOM4&AK_28Dl6
z_oAfKZb`IfH@9FM8tEfz)p$~mWT_SY!M`)7Ndx`q-7U%(r9lL{7lXTKlzXA4AKam!
zlRj{h_4l3C|3OxIn`Wy*8p2Hh7{~{`2r+7G4vjQR3LtKDMw=cf!`eVn(pnK8ehZ$t
zElx_1Ob16CP)Fuj8QT`S)Fi*2p3;{kNLg*M&A{}2%AUnvTP#2R6c|)#Qnr|5aGO#x
zliY6gP=1b3DObR}Z9LoxMnjsEFWLp$RNV^|v!u(@*2SiFD<q9<Qyv_3Koyw_6s-!=
zXuftNjDRydI1&omuVc?Q|NZT^-vS91tF6&)wk@%`Tz0p^9!R{6kRuWvb^}MSqiCgJ
zrOU@Y!g~=(Wdh2Di^4i)w|SW4!@Q=|YY%HCRhG^yk35y>RUM9DR;R1Q+A6tytP}|a
zVI^zq(wfc0-lZ{{TkXEU0A_FWG}|R(O@!G<iW!9{BP$DC8wn<WpF_!`Ar*AaC>`qa
zd}!PqFbHNRM^fq&<bYl!AR><lL?Sp*TncMlSP5`?MZz4`xI9*Tm=@BidK`{;0f}@!
znJ*gygW5&NN+TxW*yC<-m7>&gk-Co2u0&xx^IIe*6Yr9+I^c2JSuxG4#?A3DGQY4A
zr#y&=j~s{b*1wze3VM8#Aod~3{8EXr(O0kHjSC@#Cyj-%njf`_cmrR*5LJ5%-l{zv
zeQsn~=X_`9(uPh~>v{LGPS*UMyQQ<SrE_`fxyIJcrGbAd6b&#@`F-RE&wY||iW18(
z4KP)St)(!He&)e+<-W3u2}$b%4+Wk|-|XDiXP^J@yw0=<ui4M1RQx@qwzInSy@WYy
z)fcnxIP8C=_B`KnHzc)x+{>`G^uvV2^-T{oZJ7J;${o7*5{B<9eZG8u`Qc$NrN5Uw
z{zCTDbJ<fnr!9Ctdtv8dSEqN`1#i<iZ&PP88R0}_87Z?2%9UtfR{Xh`*n7jY&Hf#=
z`||hA-Cx)_y8IQ@OJy%d9}c`$dgR{DtjTXhb=J)9Tv*qcWb2&T;C(-F*?C_Jidq44
zX(e|l=h4r6rG?gfmvS++<|?i9(+YJ;JY7H7ls7br-hHn}<8J;Kuh2w=D#yY>t^PH#
z9Xd43sx-w=*5_S1z*vi=w7S|-T~$+Sv9S2iqGD(V{XXJ7L%b!SuS#GcV4RsW5wc+>
z_f7;uN>9KOQcshmj3w|h-;QjWuW<aYp-x1j^dgTJNkSRd&44>Fi<>Y5%He0;F$2cI
zdH&iANP&I);~9{q7g1k4Jf?9~1?0n?(C7*%0%!?&XTlHo%cUy7mk{ucRgja{lcA7*
z5pVa1HOJm!%_8tq7SE>f>s64h-9gJc$cxeRl4Hm$v8>^&Z)LwAJq{g<Z($@C2sx_Z
zd{h-XN&L%EKrN&4MIfpgixzcF_%Pc_v(iRkWy?IlSZZW##5;}13kZ-`VSgh)ZiT&x
z7=Ls=6pdwXA!<^GHKi5PN@ufE*a|~wSY3*L>}?uwhQL__5og5SCwc$j+6A!4AiO~y
z5rhwzLb9jw<qI$)c$^<y0O^ZFk|FNANL(Wqp9aun7q5ELt$Rc_KCGdO?TZv2-ly3w
zAP8&gthR<GtV+_r4~SgMixxtrMul57EaX@SZ)oyG?l&6Mz_h!S7)6Rt$zUM<rq3%f
z`urZRk>!)J8T@W5m=bS$5)|<#tgwHOFh9z;0&#ASUkvkF>#(4s!x;m)e0v@A<uP>-
z!&lb9b$yRD{)sQQL9V73vXz7m+F+;#F7R_pAUl>Gu3>ev)84{9;?YhR4l>Vo!r$ZQ
z-M{~4waUR0m!e57;1x?@OEmSceke-rbypJ4Sqf>ekPm9W1TBS^Ho!82c<pL@ShBPS
zv^nAzljAoVU`(;_t>S1z=KK%Zk+lT&5)l4Yf4hZVp!r17p25evFvIT8Z7y6w7OF7o
z*+*QUop_O0vIvORKqVapl{wg9!rmqD1%V$4JVSu2mL;MDHk3dMe}}<5t+?7h^K2j9
zycK+k4+dwvK-?P${6ydi0`l&XhkZls<0R(?{-_UX+y9v7GkP;(@k$ha=Fsw#G(fy3
ztb|c4XF&qw_!;>Iansmd!pMji9T=l^hP7C@!<re(A&S^Lnm!z5!SG}Aql@ZL@Wp-@
zCenK*-nc!F7Gc_bPzB2S`LljVOWcCWg_RhZ9khVOz)OcfD!=ZBD9vb`LJIxrhghw_
zK)rNp!%@CE3sqQrEQ=3ZfrnkjOIE<keby1j4C2tau<TC3@CTmI26MH-{0ewO8;sD5
zLz&H?C)?l`CAuoP9U6LW2Gh`*=t_t!3nc!2FC@Fm?zjJbGjdnKm|VI)VO^w0VhJ>~
z2}yWqdp24emx$os@F!M*$<T8XY;+L&X@l?M@2!Fi%><NiU+C9WFhm7Od~gR0AtySy
z0}7yow{}3DW+HOPp+g-o7HeYst2HpV*H{z~Q0C<0^FtJUvUvXoFej<xg%3b#%otLN
zz?P8Z0nkB#C_&JBKBD7)3A?@cpu_$3xtbho8V=kR+Wa7_(cW6J4rM+DF9Iy*m)Ap)
zQVaZ(M7#*2Heh13pU>I=ZE!jC&Ib4^X!p}j`XeuR(SMk~wh=~*dYkB|IKI3Q3m9^(
zUZ=Ui-s&sH4=Z-7YrLN|*@gSXw8`$U+FDsMA1K2R$mSDexKmq6>#E`%GE`65NLzS}
zgnfV@99`e!ay450SOM<wt>OeeqHdMf;}z9{ux^RfCq8BDps_W4z$T1*6M4-hsOT%M
z+9ncQjx*5*A7>-_)ITGO#*LKip?__HNqW7w=<m>YHy^(PO3}5q?|^=jXjCLRPbTay
zC@CCYQ$D-AvJ8XyG|P<g`7A`@d%P=oW+pxYl~Ko79^L_k0}5&QBqU(;nq4tx%6R;(
zsj8|SkM22VCl*zvaCs+|E)Ma3?}SHEryzS+cUNgm<+REvVNH2WO;t@LJ4K>z7E&~O
zU>Ka@AMb*$0aRoT!w`{SS7Pl~L?Gc3Z)JX)XYYa6wPXxz4F6#dEF4B5HWEQaav@Td
zPf<xMl?t3HpX?I%KLf|R#})2{{1g%K{zBU&-sV#X6UBBs%Dpghw1>utV!wsD784Mj
zxYzBT7>KigHmaC^yBEBghf%$kL)K@(8#Q4C?N^N1*MuR->a&|g#1Hf>!+Mp|?J(M0
zo+ioYWuB#W8<uH>E&X1;#nda|FxdOk#s_*~{oFXIqH0c=rEH>QPEEylb`O8_Fs#yw
z$g`R(y9hqzl}9kDH}UmHpiF-+DYcn2&*YX-crhyCus}EH1t=Ztqb;OOuVljrZ9))M
z(`nsuL`Co!f8_;eNujSC%uakg?u2X)Q>2+ejC7Clh9KM#*Fhw)N%#$p9|}T|<_RQy
z7`hgOCRL&=Mi3C|T*+AoX2cT}Ey?NjdyFXW?GTh}g{hVCzAr)UaN@<PPi6UCmZ?><
z(b`rLL2s<ahNY^qV*dCr<YTCEy##r1FW>eO+;h8U6K|7EJn<+D(`?1jS3={C!gN)N
zP)O*q7^$qCfN)csZ+``b^u9T@P|d#tUG6k~{uL~}Oy&j0pcoc&{2n$`D@HudpE?Eu
zv_eD~KXweVFlG4W7<_w6_G_b)5V~X#wu%4iRSW{#an|ob1CPUv=#i0qAvNwLAf(+#
z*lGftz-_m*l21AX={fu8fM{dbayoM{#zIXYr)PE5L|e_}Q!qSv72$OFc->|YUP0gl
zKX(ciz%ZVD8p_Qg^jDy^$Rmzkcq5S}RNq1sNx(h)>C<=wW&GXK@DqF<I{7w~fk{-C
z>u9~=N{jSTWZ%<?Hj#kHOg+5dEMymn9H1vgi$s7D?Z_<^-*s-*wUH(wzOXk;PWk4u
zkdgQhtzjJjk$^_hcK+2_=&RX_)UJ^79q5W5{}}EUeG^~S<ixB+d|t*686x~g)g!3|
zYXG8h7Qm-@gVQYqqReK>*_wRpA}_oIjqN?@l*puROPz!_{tRb9v4=<<k#mXNYsKZ5
zAgpm)85U|O0}CXW&2EpGp1W9nu-h6$N=8$9o9bLnTOiJCb~@Z1W;eS$IEHey_OPze
z=@6d`DeEUaMgDa^O}3lBMg)OGBKz!qv)AhL;n!1%Z6UHAMSFaH@%5T*BMMGo^SEtI
z3_sUljEhGao;f``SOx)+PGpFhZ#cdb>!Eu-fxFuq$nGeO3CCI`$$~4w0xtf?gleLT
z%&wiVp3F`pb$`s_BFUdP>D#hB%DEVMQ$}aU$d@p>zibVe4PKmy_^Afl;TW%#`Rp{k
zPaGo4B?b{`sm^55g_Tw>6Q(F0p5o0xr;TRw`ejIod5)GyAU$;TGR)Pqe~x%1qwr@^
zR(?a3EE9YaLsFXs&dBTH+0u10DZ{EM<+YWj<?PR-oiJY)@iq|nC(Tnsm@xUj5>`)q
z!kWLP-fW^J5cq<cYZW*lTf$$x3Ip-e!lkQ_IjfvH$_U&~d{+q*Nd;w@kxvI&!m3fB
zNELo9vDm2TATWuVl?09w-+O%Sm(bkaMYxDy(bOf*vym_n|Gb2WdoK=DoaK6=iBD<b
z^V&{oK11LD0deM9nlF*SHKLga6QA6~cQs)QH@}6nV^1b^i?1ZR2orgJ&nrL_u})Bj
zFr6L?xy^`#t&k-Oi(sXMQH~mM=ptiqQ&U7SVN+yIg%Nuq9~`kUvH^NOh%a6iamu&;
gFPb|WJyMg)K7su$r1~1JD>VivxRJwu`3G$IKgQB@RR910

delta 8380
zcmZ8G3w+Z>(w(Gvv}sEVlt*c4C@pOYq2(b^pg?KMLrYsqK^|&IleCRZldwr!8Y%@X
zDyWG3<rd^X5LBS3hfx9^h=Ba?0s6_Es6kXt^v)L|!u^!bPrjK6QY61$CcCq<v$MPN
z+R3>ubWePwOL#XvJ~j$JJ1Y0ydntWS!rE~VP_~Y9!mmNY_}u_e!F`4Q22d+oCZ>Tt
z`1-^hJ+!?bDoUg(u30&7MOim%zgA5Ml~P?j$jD=@$S@o&JT8Zb4AJ-%M2bGjQ`I?I
z6ZNB&x2oqO<AJk3P0S_4U;^if%B*yo)4PaS^&un=^GG&za|m2SLX$?&Qi3U&sfvbZ
zj!7+Yl)5=j=tzKakr%u+Ck-G@Nt-(W3Y3X+Uj)5!VQ%llUvYj|?Q3cjmxxo8l05Gf
zBztF`r&rfnhlnWJ>h=1>Xr*F)N=6|v4Qp(kM#PMvHrT=%hube&!_i*hXcqCxBlBm$
zy}{4t|73s?<%8NjDS1dIl4+41#7-|9bxt475U!xQ?hO@`D{nd{fhVZBw*!*nh<F46
zK0p&q%TzWu3?1Miq=&$Fge;?08n$r5d=}2&4-Iu{Ei=ef=6g=X|3;%KF`LMzD+S(E
zJb*b~UvdFWoq^bZdi;oyBAdqJmCw8*+i3=$q8LRqH|{W?HTs->htH%JECx&PIT4dU
zVO^cWZ}t0yV9p7IpN@FEr7B|MB=9%Hl4`X0n98TYzL7qBDx!jDpdz?-(Ij<0n&rc9
zRAex$w>8==zIsoKSQ`AnZ&#<WV7!Awqtj<}Hd^Z(W{=y|YRo}(bT3YYOy!ZqbD>N*
zzj#h>q7JJ)qK*#=ug~hX`$VlWv(*HvgG*Y^0CXsKF3Hnh!zE21)XM55>7WE(T=Gv9
zYz#iIRH)!D%72%Y!X{<>@*=2JmM+hLEy1nJQM1M<hweASZ^{q%kB03^)&pm?>u4*P
zioT;5b_L5ioIO$3_pTqA{2+;;^$2I3(;d**9nHhd;y2~m`q9W^^oD7MVKi?zfsx9p
z4QaUKjt#5&?;`{Oyvf(7O#s^msC_`Gd@3#BAU4AqR4a#jirB0yd1_l<$)kjib9?L#
zOS41xoF2D0sEpp2VPKxj?0{n5xCXa%W#fnOmudHE@gMvV7UiSAeg{u0M>plcGs@4K
zCYl~VW+rtYX=t6(U*A-d*WwWkwJy5O&9v4D1Ob(~NE8GYY(5IH9kjN}D@3W1vn2=C
z24`-W2|1?;+s$XQ*4BDlc1w-0x^4AhH(_J#9$SM$)H>03Jg2;~)ofUeXwgB^D2nQt
z!LU*p`b_Ta8wvX=VP_J^B`}!465^uu)i?Q_uCP`#`h~+Gdeg`j8qu`WJ8`WC2vJTv
zrYg@oGj{gx)Gs4~Xt!grKOEz5H#Ith)$b4oXoxIK>>~OAweBIXow}qe!jHgYjA%J2
zxOj)aZe`fEJ7I&ea@(+;JBhWbrB+O)5!%1csC;ogL%Fyu86c?L?lyoX*!0o{fXhm^
zJ%_d56Z7wbr}s2z41=g`CXlPl3H?=jgqn+#UqWBS(Pc#rrxcVA=JsB@zo(YAA-<M}
zlOR<myhNZ;3il61<#g@OfSlmt`#Ur#XNhPN0kR+Vrh?6WP|$qnD|I}1D^xGmf=}g7
zqaj%td9)dMbRIp9itKxHFr+F^zqvhaDiVgZcxDc_T~raTO$3G$C{q?5%Y?<sierNk
zFVk8&0(?RN<?qK*U_|irv1)*5W$^LT?tLOl=BtoqF%gbZ<{cko;Qla123H*~2Z&cb
zdF!r97Elw}dkrl{f`}Oe^08}*jjUs1VQBUU1~gtv;1~^b2^COQyqyDMf-k<^UyWYl
z<cT5hpmOy@3cRQ!pDgXZil!70Uv<PCMk%h78BiE}{G>WzbS91lVk?EG*-7SQ6!#PP
zU|cYuGv;_b!fzDuhzf%#63b4|;@y?E&&+}>CGFFP+ix;@no5@)jvkSppD#Y6KHt{U
z)FLB^NbnrB7LZ5~*&93XXu`7B=4e3nC)N;ng1}k?0sT;~a5kfAPZ8&^ACC45CG%`z
z+*pz~8tr<LSf)%m`y}*HK0G@z676pbcKhsap#6xLgoDREKcRwg%G!TDm0V1x%0jU`
zEa+!S(U&7e=FkY6DO)gEpHK*}8I7S)R&u&6K3cRTWyhBzk|}10LK?58p~VEsl#5^X
zN&SvS*x1r<GB&>AVkPr@c25?BZB0kP+2cb`qFBz)HatZ$e<cv596CQ276$u#H8%!|
zl|>h(XxWDIl!F%rf=xMhp%c-M{rF%iWgR{gBkFo^3hTXf7OTC{=@#|Dyo(1x%Xgzz
zF8$<#b4u-{yk5LhQj>`OkDwOrs`JtiZ8mKvJ9zfeTri|k`+sThE@jf?WHWo8uOq~W
z+(rxI_m8+|u-91J)<%b=)+0ni@czp~6ChXaQNdl>(X=I#?4gF+AYV?WpKRH#hQ}aE
z#z(_Ts&_#ydljkw6AgW}URpO#>NIc;GDF{J-~||*hB#BSV3AU2ydQz?1iF;67cJ9U
z9@ar-8hMGU30d>98nf)xS<|v+WX+l%&<wRVHF`y{ROw+V3=Z9{hY-Lysfq<BI6|&i
zcpG$TWQwVn93KaEFo(9r!2syNhhK*LcV724Z-YF%1A5BO5+Ggb6JW350TQNzzzR7t
z1j#g14-bZ>c7t^QE9Kclm<6lkup}rfAx`240<1=?Tn#j}CmpYiTJ;2YSqckb4W6pa
zAr{d%Wg{Y6zMKR$_)hlf4jB_`iJBwD9mJJWp1wrJdYEym9$JtntoGLV1lxG7Z0Qc(
zd@W%${yM(}^F*JpS!`lC@(rtNtafpd2BAjWMJp{r;LD)UAPagx5^N3K(E}ceF+7g=
zt7@CwC^F^QRFH$W5_KhsG?TzM5~+f4<pen3v4kp7C7(`%EO<6_EDdgpZYO6IN$xnm
zyx}VXv2KsC+2g{v=j*!qfNl<>j8|2dRQ1QXfmq{=$tGj1@H86P$B9(p$S$vh)+Rp`
z(D|*xXf8Ge^hUF-)@U{k6>T^eh>@)sFkIV2g!jok8ITO+@^}VJ8bCLKUYk=z4iOQ%
zCc?9{xmuYs5DE>u5b+v*eLj^;dL8;JlfLR1dS)P0MQcALId;pd*^sTBNb@pfb`ESa
z@Uid#mCFxvAU*MxHTKA86J)~6A(ILIqe@+bY%pi#l!NmMzWv)thV#-q1bRblsB{S2
z4Nxn$nNf!ihK`xxSAYrfP#*N@O%I(v=KoByN=dGAc_9xb!4a9451pzVDhWOqtNhRr
zD~-dDQA0Y!X4<uOoj(qz@P{%DyPjYtZiYS(WsgykE+^;3c0{$QN}@U==%`LyfIjzW
z{f0;jXKL++HqFK;dz`<Ugw>ELy(1xB&U^!mO5#H?qi`glO^dKw8`xE((b!JBshzYb
z-rn8bV|UNa=m^jIbZt8M(-UZ#7e|7jdvcqu8HB-4Pa6KT$%W~Vti^?UU0<@iO=a&*
ztp5-Ym*~Sn^<|i{N!PVCKj|!g{<MjHOqse#-Kml%9)b+zzE|`z=P-2Z%R<}J+Elyy
zcd8>ZA*waXlrGQT2D$LA>^2Gtpg8pFC@=y15E?iJQb9k(sn_9kycn8N0O`;>K9c_&
zA$2)Ofc-?i+&31|o$Mqy_3N@H{Y@H5H!VITZ~&*``@|vq7Q0h~Rrs*jjd-6P0X}Z{
zbN$^%j~F5p@8F!T@$35@WZ^<ckxk=ZjQZ1PT`0E@c54lXNSq0zJH_%`F_iRt58L55
zi>0Wt(o$JbRc*0|_)tL!w1eS!qJ5WWCx(ue!U8}=OP>lu^4TBqo~DwV>=JI?0x!bp
z>KGcoBA4JS%_qq2a%eX;^#+dX>@<qymlZGyy?RO|l)@FcuoA|>KjdF4AqAe7p-M<I
zuovJ&WSacE5{ALHP|{2o3(y=YtAd~LS5B&iA*yRp(p?Qh^SeA2`&3HaBQnO_bj<7s
zD5{HT@<cUcz|-=_Y8b5f7Nv|1rO$?6^i|*de(l;d(Sk(Pg5D?reI>q3YML+^+ejOu
zv%%-9d4jRXD3;J^O(*nx0{gHVR=IrQV<Zaegu~_$cAu=h2gXjs?5Nf2Fhz$oMP<{A
zW`#Ay<wY|}!%!5CF2YY(B^m=-vzdslYRu+VhcA*<i4TeM&+_AY;O=DBE)GR}9aC@_
zF;(7fL4UADK4O6k3%eNhI2^Vv)8rdE$4R{D<`W^s3u^)%H@a%Nyl^zN#oM$IZH?8|
z(1cY8#^YvuVuFla2sxVHaX2kBdLg{28OFYUBnpCIx0P1o5KqA%kWgiHx>~HQV~sw)
z$7>Y%ByOf0QVXWUTT+4o>8ORB>8yR^aRc#gkDsS`tu^?9Q=wf3@}#E@ddYAt#L5|U
zaM94^es{`g^^m8DL$cAKwtC3az-hU)5r)K3;u?-_b~;+b$MTa#$cD8N+;EB?COfY`
zPiy5DZdAdUGSvecV(3L6dLSz$>CPVVcQ>R#mHg3z4mw#Td0|oVIpV4DVU5BO&<^Ea
z435$ZqbJ_TLL#UBEuF~21fC<nR%5tTBTv(M9JGxxei264o^r$@+`=FfVcPR|EduT2
zGekmpWF#AyfkzYxy)RMg7=aH7kQ)%&36KU019A}Q1e)dM7MQDL%f2FiYe7p3$li-#
zK-M0jew@I+37kfNbrpx*BhFC&b>j1tyn8WJxBofL3(6VswaV|l*|a^N37k(Xq!vY3
z@iGDOP=b7cAX5|15+EfKbYX(_8P?)U9UsZUL>SgsT0X3|pdYmP(L;4a$^2Fr#Nl0V
zj@y;A(7Ce1rMNF!S|KfQJqj0Axv?%o8?b;Z8i=9mjaJZW@^Og;p_8o;r%mojqh!Hh
zy|2bXFD#$Pl^5FavWsQnGWdJXl|*p|QRrM)XG5<nF3HcA!5l5C-!M6DIpk_aA<xFp
zz02Vj6}l!{2Q+k9hKQm)aehQc7D&8d7j}os;dk7yjB6b*I*;rptc#4;MJ!GABMQy7
z>!A6%IG&u5jul`^?y>|M9mNhh+vRfG3dqtFAcxk_$rUhA4GHq6hhZQ&&0Z^EIE<6i
zS3<s~5GhuLmac>`_$HR2RWKlFG%^UNh7QB@gCBjl@|#r{<z~p3M<6wJI0;2yO(^dX
z(7|wig7B-KW&A&q;nv584$s%;YN`_@IPu9){iCo#dvlE{^vhb<3(z88dJ@K}G$21q
zguXI*9md)%a=<!hgAYQR*THL`-9b0vi)8RT{=8fxA$R0Egh#<KbHr94InU~Knj0Lg
zzKK{#by!`6e$nI*7fG$OE=Qf!)+&0*3lavxVA*{=jMq-5ecdjr*F)vhC+G+d60_3?
z!ZEc?E?1+~k0qZj@5(pu2@R{g9xuNZ!n%5^k877(XzmR8-Fl34g)(CUl=Wg$Q;6{-
zT!|{Y&PMd99UEYj#)+7}gbr<hVuOJV{XLrBDC3`nB6RK*&qAMKniUDoMbvtQc9Kw4
zI;*t21Y`Mh%N?cj#9m_G<z2}$3$FU|1ABzr^(++h8%fhABPB+%S!J`Q7UFMJMMZTX
zy64}Y#Yfd-X?qTzE-%RA&%vXqlaV~EyR)dOe0urRu%@)Cs-mh~yhW_9Kcqg~0fXQT
z+4($N?MGFmFbw39LOGUxI0kXNx|#Th{A~vu){-)a;qvHCSTKmfZ6um@Wh|#qNGz3b
z_7YFy@5_>1aOjVDF`Y0hg=5~UbX=U9bAH0rwQ^bA2_tTE(>$*3S%_#M0rtd6w|Zhs
zjPda31SiM?o#53xh~m8*8nzp}`UwF#uUNCM2}6?A=P+~h5A-U*_o~xfXSBIIO?IPK
zc<y!BuuQ|cbfbKOnb+s9fTJ%Rd?3l;ZZ;N|Rm?82luWkFt|}`O^W@#H!ZIyKo@J!j
zW8ov&e=o*$zqIUy61Y!p-wTfpaMN+o0hfyb)bt_<N7K#RbRA>iWBF(ZTKaJow2<h!
zTnFhHnxJ%B(6H9Xar<CYd^_RzM6kjxm+phHnl*@eKXh;(G^rC;N2VYRZ)&led;so9
zAS|kl)9v>dMTy*a07|v2SH<${1CW<ZwD`m;FTK+;tzs6c)?z{!jFs52RFs#^D-6Rh
zj7#GWLOyP<@gUrDs~h8t_;LBgK^Ua@3(h_hGQ1AAt5aAYmSq8AMSuYNq_xs>7zTE~
zzBG&GuSfq{BDWvLcUGxX9f66kKu$ganOdH)M!JqbKP|H;mX95Q!LVBHKLX#U+~QJM
zmMl`8$K|1;=<%PzRlf>dI0~0yMnukq#Av-C(0$ZuBe0ghEhaf#_IM96hCWXUM+YNX
zNb7jceCjfvuHD^1xHf5f53+kNp*Gz<+SU|mPbF|fZha5tLzevQJt#GEoG(LZk%sS{
zT@U93l{aBI;?I-r_wfpf<<sxO6*w1K_dlp_CN3q_(0<u|Ih*9vn%}RJX@C<^w^W^i
zA!9k<cLijQ`W)-oB)N!ty@-VqZzQCYi^}>_kQLWKdssoh5hX8HLw^}M1-&#|5%W{%
z)G4@{P>7`{{<mvUlM~Yu{^JNMmK^8xwTNo5x?KE3raZdA>9z;-W-}#cO+Il(#{3H!
z+q?26PML1Wk=X5ifvX_fog@k;SA24d@peoQ*0`+#D>9U71-hBdZjYHBU}jsr!`8sL
z7cJ>+s&P4Ofq1joS?Bf$huP)9Ih2&Ohjoq4I{q`@zr+IN<V0&JEw-7!V+aC?g!Vc7
zX0O%f!~aF>;z>dqkhRC>=l`X|dcxomHjmrZB!t6_!7K)Gc;6J@L?!{w8?v~#6HX`+
zb<+PO+|_<B=^W)N;W(?^ZowU4r3U|UtROt6a7(GxmBMlM_UCjhlI8I&-;&l*awW)Z
z3c5Q%engP%iWQ_XXf%_tNQ?b&tk)`h4qD#FmniaxfJ5qFY?*XnmDMX)4f#dMj|;kO
zRGBBvLrUy!+9H9zp;ynt98LQ_v0W}G&Y4u@-%zo^1mDCG*Jf@DF7*SOnn@K_Pc5x3
zH!T(~k#wxOE~0H9@GY-HEmrr}sAVNO*5rTF=n%qnBk(WkJ{*M$3Y%R0E%e74;tStG
z&dd@TC?@a#(VeFjXAhK4MrwpwYE{rqxZL&-k<?I^%Y~DvJA=S}qB|}JeFx3$zfzk+
zm7a$9K3&w}K<D8(%$8bwm#e9z5a2rc7HVxLu!{iSxrP?)M&NtGanYS?>s&x*Ww>7S
zY{%hjBII%?r~91H?;;$l1lK?Kt;(v?r6IQ{5$g(RB5Q;gPc2GDBhH*t11EJkgt1PM
zIu%6piTrOw$4Ce0p}?hW3*Yk1|BsJv^w^tRjtSy$=pWz1MU^HFhF?mRZ~X`x{vT`|
BV~zj-

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 4d84459..14adaea 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -745,6 +745,15 @@ def cmd_cert(args):
     k, sk = porkbun_keys()
     cert_dir = f"/etc/nginx/ssl/{s['site']}"
     log(f"Certificate for {', '.join(domains)} (acme.sh, Porkbun DNS-01, issued before DNS moves)")
+    # Railway's managed certificates leave `_acme-challenge.<host>` CNAMEs to
+    # authorize.railwaydns.net at Porkbun; a CNAME there stops acme.sh adding its TXT.
+    for d in domains:
+        zone = ".".join(d.split(".")[-2:]); host = "_acme-challenge" if d == zone else f"_acme-challenge.{d[:-len(zone)-1].lstrip('*.')}"
+        recs = json.loads(sh(["porkbun", "ls", zone, "--json"], check=False) or "[]")
+        recs = recs.get("records", recs) if isinstance(recs, dict) else recs
+        for r in recs:
+            if r.get("type") == "CNAME" and r.get("name", "").startswith("_acme-challenge") and "railwaydns" in r.get("content", ""):
+                sh(["porkbun", "rm", zone, r["name"][: -len(zone) - 1], "--type", "CNAME", "--yes"], check=False); note(f"removed Railway acme CNAME {r['name']}")
     ssh("root", "test -x /root/.acme.sh/acme.sh || curl -fsSL https://get.acme.sh | env HOME=/root sh -s email=" + ACME_EMAIL + " >/dev/null")
     ds = " ".join(f"-d {shlex.quote(d)}" for d in domains)
     out = ssh("root", f"install -d -m 0750 {cert_dir} && env HOME=/root PORKBUN_API_KEY={shlex.quote(k)} PORKBUN_SECRET_API_KEY={shlex.quote(sk)} /root/.acme.sh/acme.sh --issue --server letsencrypt --dns dns_porkbun {ds} --force >/tmp/acme-{s['site']}.log 2>&1 || {{ tail -n 25 /tmp/acme-{s['site']}.log; exit 1; }}", check=False, timeout=1800)

From 7182d5b05c4054313c124e3d2f6e8d2bf1019eff Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:46:32 +0000
Subject: [PATCH 029/104] sites.d: meshhook.com on Node 24

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/meshhook.com.json | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 dev2/sites.d/meshhook.com.json

diff --git a/dev2/sites.d/meshhook.com.json b/dev2/sites.d/meshhook.com.json
new file mode 100644
index 0000000..f381a45
--- /dev/null
+++ b/dev2/sites.d/meshhook.com.json
@@ -0,0 +1 @@
+{"node_version": "24", "notes": "pnpm in the lockfile needs Node >= 22.13; nixpacks pinned nixpkgs has 22.11"}

From 3d0e644711cc8235f60fc26ad4a4c680407311de Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:50:13 +0000
Subject: [PATCH 030/104] dev2-site: image-only sites (stock image + Railway
 start command, no clone/build); openaccess + openmcp overrides

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc     | Bin 127073 -> 128736 bytes
 dev2/dev2-site                                |  48 +++++++++++++-----
 .../sites.d/obscura.openmcp.logicsrc.com.json |   6 +++
 dev2/sites.d/openaccess.logicsrc.com.json     |   6 +++
 dev2/templates/deploy-app.sh                  |  14 +++++
 5 files changed, 60 insertions(+), 14 deletions(-)
 create mode 100644 dev2/sites.d/obscura.openmcp.logicsrc.com.json
 create mode 100644 dev2/sites.d/openaccess.logicsrc.com.json

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index e841945f44b89f02e17979bf931b304a3c252b7c..9ddf0d4e42525c94bdc08228860e8d1875583a70 100644
GIT binary patch
delta 9173
zcma($3sh7`vbXMhm|^%0KLrE^1Y}f1V>Bu;ih{p@3gQ<PaqfV8oPnMJmCOWpjS&o4
zF?X{~UP6NTVl*%KOdPYT8;!}T`8kNLI%{HFO*UqCV}5(ynzzY$Rd*OZ*|+CypEGs4
ztE;QJs;jHId#-;H^vPd?!rluF4HmF`T6CoP^~^(I=Z;0sQwhQ@VVAf|wM(~4zbkl`
zfeXLlFhcIy5uy`8ki^}(R{rz^NR+SsXK=>uU`g95NUAvG@}wXIb*dztq_0%%HaIoJ
znM$i5AKDSaC$0f~!~yW*wgQWUKu_{rpw9>qcI%}vEn<tRMc1Nl32qTu3>86A$U}O!
zS`=JrDO3vU=hS=}=}~F~Nj+#hp!V}5eo`di@`QE!1;MTH)5~8T&m0#`_<(e`mN>dJ
zl7bC<asDx#V!w<Nhap`4;dq>J*g$E7OGC;eM^p+2M8DXBBM<be3W7`PfVQoz2D!)-
zBj=pdm$VuJGI4HkGzTV1@iveWn$YsnD3?}BBrM8K!g_Ll-PEZGum_<H6&x6yip=+p
zjtNZ(@I|c^3=g>q`caAvMiUojh<|#5K$6@+eyW%>R}jid?^F$rmojAI`_a*ZQ<XBB
zaO^U{oGBaMd~YmM;i54$0?WXfV!sZ5QTY3|8x8Sz5EoiQ<gbs#%8@6cG<ueREi_b$
zs?{K=`?b=z;7OrVJt*0>+D|n?+p5DJaj>T~h?)I;{EM+*5V5|uAtpihkkA^GCmcYr
zREE$i(vnrJ!Kj_yMfMC<q-lRj6K81EVsFS$3%Eo!!!Hd&<xwZgLE#n`rcj0tqg1mg
z{quVI8PJE}lB?0%k`-@LMj4IhPl^|!6cOuDa&B8xcnYqe!S8R(*w3MTE$Gp#{jC$&
zN(Et?U>>o!Ni>;!Fr&#}!cw)lywW<uq%1?zIQfm!DZy4-V_8L2En;QcTX&}X1J}ke
z8V&Nf@b~S4capVtjpSXvqG!R;qN8(<ZaGnZ!g40|!d*)dedk-+EkBQnfy4Vx{RU89
z>pP3a_<|K7Wp-QbHm0NH?m;T{0PzjQ8coAw+Ag1cXOi}Bgv@*Fck#_v3^A8OLia3a
zUC{nO*QBnM`(|{F_f9DFuC;heC2x%NVo1d&{(kR>`_IfdbGJ8U>4lJ@E8%gMBaB?P
zSJ#nvA!1Co@zs(0NA@a{?we%2V73l2o!ph)Ro@-mt@TdW=(SXPH`aJ#YA=LrzO2*l
z(aDX!`^@MIx7at=mD{T9wz4`qb2{X;r>BP8qP@vV5i}*q^WRR2VY5i7@rd?mt89)c
z$;#B?;r7!nL$;1RM8q2r_|zNi_F9F)%A9NwjafioF@cFlVGfa3oJ}hBiIzI{4h<t~
zuqnvbZ#KnZwDUHYHf$i9&BnrLoA|<*)rMlrXufubmCeRMw{f(?hu}x~H)j`3ylISS
zFXz_1){gnIt<RW#-k8%}{;GAqwP)Ue&EBy&+ZX+}Xw=lhw*tYh)8wdk)6&1v3gHoZ
ztgTjWbb4P{#`&=E-Km#CC-sI->PhLDcgWlqdT)y;-}A0z+1~^~zfANQLR;$hY;E28
zl&T~5NiEuU#IsHNQhMrpM^5+7T<2ZC!CPM0yMB{*U6r@0+FP^PYisPS+2XC<>fPGp
z&3WKrxa%u}5SI8=h@jIS?tb?(QIn6VB*^jyFNzO`ad5z*!#h7b0Q`@aAXa|brw<A2
zL5lkP+9ilHjtrne1h>wmWApj-OE6+)TmbDD;UvFPiVGy@k09|w>Ip+5NfpLYg~iy!
z0E?~QQ1X@A;0|`{CBY?1N%tZ{+i~Xzg|GaTH{O^$gxmmvGfsXgK3-nk8z=u`mtOD4
zb|wtaPX8xbr3--z0$g1BK-}&ZZz8esZEpgk$cEnZtbw?V{TMx*iGw_(k)&mSlRMZY
zQly_XRH1Mjfw9J4Tren2N~N)GgEM7FFGe5dX!%fYRQTvXj&z4eY1Qd6jEQPauLQJa
z293)T_Jmr*O2Hzo3qmfTu25+V;rEJddNpF*p_C8?W)_AErj;_+;;OsD-4V7`&M^V0
zl35xnjYGbQE)>(H@lsZ$Mw)OiJ7Ae=Gg0%Wr$B79G_fWVxfrEMficzNaCXtn(p>>^
zV&aZ)8Ci%l*%g6771Kz7y>xe{#-@{|48y40;nGyZ1f1p`S2&KE=AzUv9q~b=8rEmH
z!Vu=T3<&Q<l|*SKCg%IFHLJ5K+#Tu68qjLCl<S-jXd%IzVXZWm3UPiow{yS)FgJjd
zN5b$sVCOwi7L{UYbS$zot#N+d;Bf-82}Wpllq+hls!gjF+7fXERPHGM8es2O>K!(>
zd`12|IbvRt+7%^@k#F@SFBv*r&Cuy~s@&1eDFJ0%T4nHjT&M-E=zyCjQ}3Vhy16t_
z`PFj?&7smlQs)4k5vjOioD|uV;)+3c6a$VE;G?)mtb4=|d9jMT0ZKI7qE7X2*=_l1
zVaSL`WyJlRVzX2*bc#brLKKohRN`MyIPVEeR9YPHV`a<|9J6#7*XaRDXHKBz3R1?%
zbr-eGMMKd2%Nk&ax)cu$O6XHD&Y1&D`aM!w=2GFo&maj0OAcuLy_EKyvxZO(4+SHg
zxq-e&*GOsk(A`))S1vjdzxVTKzF`;Wo8yLg#)_c}{}ZoWIjnEhu-58ftzqsX4Ij5=
z7-cE>puG99;7GK^aKg2Lu1xG&H*D1U&bYv4R~%1K-X90%48{R>{J#z}QW;)6#!DN9
z2O4*RE3P_UE;^rZj}jhT35~!q^ujPcBc*a_W5B4A1-GgqUXmnhrJi4JfM`*wkaKrO
zPn2d$|GqtII)ixo6iCaIYAM38>_KlGTuj$M8l+V`pU}K{m|bkHcsef+-5eO81k3?L
zBa?mDn7U!D;VW0KgioeG2l1AiouPx4cV_YT+CiT^TWT1_q;XhlILj@aL2}WZ=xNec
zX`9sKq&tC9D%C?HzB^HR;9qHdB)+*qlw7VvgziBG*m`hKZiQGu$7~FlN<>L=Cl6c0
zW@)=CX>jc-wXWoYKO0nxLa1|KTT4H8E(%Pux&UkZwWlFMzT6%qzw-M~%?|PazIO*i
zCH<dU*A?tCP)?7d<3sbmaU?kS&;d-URA`r5@JvDpb&J2I1okb$Xu&zpPa_Cv0-NU^
z)of%Fh8=<W6RK3{To|BqjT*R5OPeGiUZ^%xETHR6Ri|3<-LX=2AUc7tT95?ys0T;2
zL)-iQ+7{R%Y*nomwt#u(;Ya>(H#862_1IKQ?@g;stik3mm75$+yQRi|70EF<tWHFf
zGbbHpH<#NaQ)Y2_RqdAYZDSlJ$y!%y-?rImbDFTLs>14Unl_a?OjS;^smf+@R5`7V
z2~svAH5eTQ*h_c-W*-x{7EG{<z$@~VtE2U1(NAKQ?_AA+Ir5Z`YNDG$f)^I%&d)Df
zvbbRNOdm}0!9=<1BO6SU!#{p8#iy@h_Qom)-U!TUR)|`#SBT+&l*6xod{qT=<;VWm
zrZ#I>p`3MNBxK6-ZcI*|Nz_jf^&SHI2>g-&8IjGF<r{@sCrvqDzJ6oeRI`aKqYmY=
zWFfpF&PTNzWaSGgud6G=%bHKS*~%)dl5$g!^KVW_)G=$Fy{v)N`t&u{ZDr-PRpky}
zP#vpkEO%Pv_M1z<B!6-<RfbPv4OPf04S$Yj_1ySdNRnrN`epO~dsVm+WW0<QgND|I
z_Oc7%>CZd5%X_r@tGY|S5`^i+BEn^234NA}rQ+ArT1%~BaUFfui5uxN-XeY{2$_<2
zIet{f#;%l?()XozhxVmTZ9bnm^XTaI;+7RHs>=z<_-=FWdELmHVR0R)&tyE2(G}kp
zKmL6Dtk*)0799@n3!9Bp;l@3Ut&Q!q7s5whO`g!rUTxgp*i+q?oqImJ<n6WI;$^4G
zyen4sC9gT3?DVd8w#;d9^@fbPY>eWudt*Cvea4jY#-gsGmzM8a-aT#7b7j~%7Ivck
zOzg>Rebb6sw3kD}_pE4L(O%dWntDDo=lSX$W6#{ajA=)Wy%{-p1v>rN?B=g^f-drM
zQd+Mrp+&dXd^0k-UFyj1TG5@`U9o>*caC@TJx60t#Cu~3yd|qIM6S6MxuG|5Lto@Z
zZ$)iyWNk~(<=B+2l&*RE%$HIp_ohznnR_(4FZDie$}Dg6>=yl%>9gBQI?NpjUAbN5
z-P(OsU8Ozh-l!?w1$ZmQt5vwvyVmM0t?*V<d*{`(=;W3^Ef~9jtiMTQ^eGo5GW%BX
z0s3qZUG#B@57H;H`S7Jbxgil3_Np$VrKqK`b#;fKJFSPEVBQsLF6v6X>nw*$Zl$Or
z%0Ms|!kuqN3W+P>@88`e@BFJJ<7{+DX-4q-BTc2_bQgouOD73`n517PsQxe`XKjw^
zYK{i$7D28{h?Y~oTnvSB{g-x4E&APN`O`07!uF%L_i5^}U3Yl$SFecRIDGw^^#E3R
z_IJ4&C*s|QAO7xaI6Taks^Ji9<Dv#;Lkpj)fg2iDfCL`17A^x6dPE&miD2{827_LN
zUwaxu;8B3%Tpb3#Havoqtc}2<yvPGF{Npf)$Id%pPzb-^^TUC|oBUch`~Z9TM-gzh
z=_C?6VsO{_-#_kMdv^U9IJWGB@y!)y*WY1}@kvG~il8a7Xxf{k6szZt8R12+^XZXr
zGO-m=KGnu@iG7GW+6Nn%m57=UI8tdR^661v)a=LhcF&S1*r5l``$oaOctWuv3IoLi
z=+MYk6K)m%MIubqyn^*pp0kPYs5)se;pwu}6olc^lr`7Xq%&n%Dok0X3G5;6Ooe;2
z4-(Bzekc`UU==@|3M-(HCyj>rhX2Bz5Af%3h=Di|?Rj=Ini7k0@8&BrAPyGu`V2_t
zbr}%PdomydGWl^r97BYBY=(ZSLzFallF+(UPCZUWDN+z7zQC19r<{%TPJB7^7fdO^
zJZ21Jg&KyCh43X~VBGZ3POTIsg&&Lv9Q)mBC#{B3@a5J>xoI#BNs%r!9>fgJ5j?j6
zmv`Jrh#VX3QXPy5Tr8AVu-L_{5IL}q$f`;Nrzc3J;@^*fF)*K}W<s|?F|=axRs3Qm
zOn^7I+6-xiU!$3>lBw<pim6s#4i4Ls*_!!{AQ<w+_Kmz^Z-qB;LSJmQAJcP}XX>G;
zM>G2-&-Eit)SqrR*>Gmnsb+uMTU~Rh+TL4j_trIDsNT|Bx)FEegODeBTFmgJ2%mel
zj7Rs>yn{kN^_<NDtEhPw>)&`LPlN(3oZ#E1!d7(sJ5#|7qF&`mn+7QWM?CYULk4Jx
zmc7H-4A>2C^B-owGQ%}Q-NB!uLd9opfOt<s4wUN*r-@Q|&MM^B=fV>zHbeBd^B@Nd
zuTt0hWTp9@Q~6K|@GeiD4+U_V*UpC=?O(A!Lgjg7K1|V}Q{7ks{{zeTwWTl#4tR`3
zFaw~#Q&0>`MQy(aKU;#cUB=%pfmC>j-!6f1njevg$&<Vs?&#os9=9IGCGQ})N<Lph
zD|UjK<f!Zl&E-RGSr7M3JBJ9f+Na4aSeUzvd9me#T%S4@3p-E5eFQEbn8*G|<1P{}
zQN^#Uhqb84)G{c64*p0PY#d2T%RWZn({3!c)HKvFtKuqLvjMU+dc2=b_uR7qE@_h$
zlgvlTrcj%mPA&Gjy7G;+Ru+mxP1)RD39;N)0l~bm626B+e8DEj){MZ;Wggcict#7G
z`6xR)txiIeY+M<|f3!g&*!XQbE}w}T>tH98a$W~@S|wtP<DvDC4#|9SJ)~(S;V8+o
zwjQ1X=s4nl1&}Zq1Et!fRt~Znw-#TBBN_!}azS-6z02?dd{@qPgb#Vi(ctcj9Qr!m
zmgUmm88nJ6<2ZJ-i=Wto8|eWjMyP1&;Cr1Am$njlhbXs?CtX5y8WR7cIQF=B_7oiX
z!D@)+d)A^ApaB-*t6fT4jAn#1vU;*S$%Svl{=Y5)TNtMk->H)A-;a_%$<@h6#c29Q
zO9?f2%f@}39S}orat$!okSHZeN%%`Vn9Q>qVfu)vcp(4h)3u2=H$t*8Wk`fc4a^}F
zB;{`n<<TmQpKF8>BhpF#fj250-HLH&2LAy&G2F#$fmzLC`lHBI@~CkH-bXT4Ob!%B
zO%K(6Pv91T?+F|vu$6jaasAj>0$Z?&r%{EEf}m*Bls3cUsHv)}v*Hn0c|y;kCv@eI
zJKkion>2LHGxL30fTzDfTseXNA@BtPpPE@EJG)KoH%Z<dzHTdQTdU-hD#B9CXB5pC
zg#$)An9&YouMi+lXXLDm9L=Z2{{);?=6}$pM^1J(^$~lYuB=R|vN+4i_+8uJSB4zy
z*n&Stgh~mJ{OfJ-a;i5fv)7Q>WAwxvis@;5E%9yj8TE-qZ(+SRpIw;k@HV(T9Ze7g
z+9<)8_Fc5+&;t++hBM(I3&q$o86gXUJYE;fQel{j*bd7<lZz5|d#Zm1HWe87m4~1v
zC5C3yK*kL5$M@wlPsJ?s7RqjO>rR-a?IHDA`ExrVU6Y4He&zXKCyZ7>9RIonR>C~K
zuoWh17GTdyo(EfD4Zywp%5EqKo=N-(yyD4z1nvgS609HcY-)pfI%wvv{u1i(ERpg!
zK7P*dJpDMl3E=V{Gt`g6D2%=B9G1d4ex1W+Z3!`3&PzHF^#p&R1M)E?|G5LE!UCT9
z1QZyQHGPuidOzRx1mHOcM;!LN`2-Xippl2Z0Bh3kCnic%E}+^mT8*&c{AKxz^U89U
zE-br0e>M9pZ+ihoY72?eef;GYV7hh|5ijDmUVv>Ft1T~r1zzW;Uxc<%h1lZ@TA5qC
zc;VvtK23gc@si@j>@4|D|B2~hH|CU&JO^IF<$<BNYy2PGa8gS)VKe!u{a_t6m`^@K
z>1LHbx8U2fz;5!qm*LF-wf+DsLiI}yz-7%|WN^+i=^)hU?)y0oYYNVCG+<yYcUZF+
zrGuu}yoSwnRkli#rPkgcnea|lZM8T}Ofl&W;y#{~E#%i;18W>9+hoL>l4)+ilI3}2
zd2`B^7Z=QA5?}W^2G|x_p&9TUPdb7}N;fY%0(r2LKYs+;QnryUr;y=dHlC^vAn>Wl
zIzvn{1OCR_Jm8A0Arj?Wq4*sw7h9s@wlZA%4xV!qri!~&{N!<Tw6>!#Uh^ap{Ka$p
zC^V=dp70an2)`11&M~+@jId2wyxKbLCbon>c?|OXYgfoWI|kWiqHPK`EzVzAwqVJ!
zl9_A=Aq=La*zjLr+5KdR0)Fptn21_!J`N22gMV@yGBjOC`*)Awx3EYRuZUM9S0I+{
zB%pYEC%2!3(UJXvl!-VuS!puQpM-U=go|&%EU4gf-hwok$t&LilU5mB$RB+R#=#Sw
zH{Jpbpv*T<!C39{$XHZ+Zl8j$^^^UYlBkCUgtky^7lBR!chO=_CNPCS36J^^#+XS<
z)=Y{i<W_1bECwgPf^fUI1<4~HraG-3#@HgN7xSk+gd?Mr4W@+Rr5GKsQ&~GDfJ)qU
z4h>f5dFCAK5o45aId~3NV&;#0?s-@gvWFP96R-;Ws}e}!p7Ri^rQ>Fp+S7L)o(pdt
z%m_*{_(}9vGRJjP&kXD^F;dcoGP&)jqZxb}TRE$AC`qI#JS)p)&$8fuh*_3RR!fbN
zRho2JS#=E?YpX0xp;=i~l{P!GX4Tqp45gb2U(n{NN`{wz<p|WI&B{_zLn{gECeVSP
zDT2`W{E}5y?r?0eGl@M-XalmgJDf`LVb2l<MOf@MO9R7y9WC2fG~&>B=XmK2Xo6h+
z`x}r_I+$RT+%i0wFeL{mR{TlQq13@B05CEjqaDJ?PuWh2-{d_kj~CyB)xodP@)MZq
zdHp7=&`kRr>zI%cn#IMp=$~ja+@ebcYgFoNqTj^iH)heNnx9{?*u0g!!RLN~XZ~7V
z^97zmZTuHsfZe<rY1k?PE#!7JRI?M9OHJh;+c$`_k7xWDt~Jx&t&IMtWQyAUD<Cy9
z2`G0%MPnte4rX0C&okw4{*(Os6Kg3(p>)Uc2+Suy*~z~{m#Fa4$DGtw0+3?8LBlCF
zQ;hi<KkyeA6Z{@hq85VVLC@8{K&Kd$3CZ8Af*^?aCNdvjmH17u$RD{4tF%T~sQM;@
J-?|N3{};mKD`Efu

delta 7806
zcmZ`e30RcZwf~uoS=d)uhFxKV0gZ}LTtGoVSzJ+YLEs+|7r;A%3(f?xDux!w-{zX<
zBVwDE=o1r+eVrtxQEE~(F|VU&gY%MSOw%?tZK_dIlcs&|oPQW${J#9(H-~%AJ?GqW
z&vwuM^XXsxZhYz&_(4E`Ucl$}l3#9)NjVYt+qZ+W6oRl<*sIv9-0QbjyH_VAely-*
z0fMO5@7E!S%4liwo+!!vs{hRWT2UioP{2V!^y^iMT2WW8+^-Xj`xN_>`~3E4_X+!S
z8#SW-DV;;55bP?^Ao_O*(upS{c>4{|<spAyH1hWc9aE7af&c>If(ch3tSc1+hno28
zYB7Xx-oLnCXs=>K(uNw)NweQc2$4yS0f`X=G2E`EjnV?^g=2Uqdio=dsXZeQI?GkG
zRV0aJ$sIcB@G}w54e3;<fIOD6hIDbVHqk_4(|8yKp%qQ$(0GU<V(c2!CAL@T-4-ns
zCk?iThj-|_C^4=Td6x^Oc*%6;1L<F9BK3`^&`&j7=rE9q(v-n)kVjF<4(&mqSK(#F
z{r#9}gzD{?vUUckrzIj*{S+=02**aW8p9w9N<an4DRy#=)($9C^Ds@cu7i}<k5%5T
zU^6}2p+c^^@sjbhUh4bx43B!z{xU~^4~L3P8&NRpvMvzNTj;q2@|*`95`<opJ&Kzt
z$b(XTXIM}YnqM!5%H|L8P;&AlIlyC!@KJ?#3#N#&Rz+f>8)izncfXx?AH8f%!NY$c
z+;10L=9)_t8(d454QSs8c|-Ze^fQysq@1a^l2wA}Z|_iOJrNcGt%gK=8n)HcTV^Jn
zoc`V^0DtMuZx+QcEsA3UNXGV%V1FDDX=0)zo|~+>OSmNI;JKJp!&+UJwnOU*TX<e^
z#^wqsxuPw-W{4Q}59liDDC%B!#XqHQ=_{)buf8O!G-R&1GQMVnsXO<8^?;>sa^H%+
z1+IzfUDX?1>+4-1o33aZr0nxwN*Nb&PX6q|5r|W>r%07r0!5@*8G%VSHR+|@AH*+Y
z@6pmd!pfS<N>e6pNZhaiwa&}SV_`UT2Qo{eXkpcLP1~BAtQIx{<L+;C8j|==>E;KE
z0{^ZGRBwl`1%kKZrMio$Qvb!ez;6UWw_I^cDFhln_0yiL{qT<p^&I35lS*ALD@p=5
z48o$5b1xkOX?Q3S6GyuXtOgKlQPTen#e$aKeiEW6hg8;VTeS4sp#-Fv>ZL*5<i`$P
zAKSIwBt;skH_>*5IBphF$&vzMyo9)%#J7J2(eYzZ7<abV5ut(|#Mo#l@JcFQk40uR
zas=VBaddffGto!^=+N6RU_Fl=>=>lBqz7|9@6P@4-Xi5NhzXlh_>CJ7zPTQ7yCjlQ
zAawcHDe8qf#X3Kf>2LQJlL_CW=+vnY>+q*K;FabGu#NZbA*P6_;&@qYL{R|{Cx~hF
zYB9av<TcCYG%5f2m>_ZDmUI*zC}zmyd|NI=wTTKb(@RI(jv#v=^B2wbAWS*+s9Z6t
zSKX);vwbj1N3b{vF+jQ^{bYME!bj{>Kc*nwZv;Qp9)Or>c0IzJ-T+64En`Igb%Hou
zeAJfdJq{Ag@R=ppm5B4enY}u%s#q&P%q8*o_kjt!LhF>W5z(JyM5!kwVrlMZ5y$F+
z3GE2AhxRBtH7cRgh{jbqLOtfi)rqwFKsnNFmc0LLTeerj&6A|<_Aq6rm@K{aQ9}7x
z&DCQy?^Qa&Y*V~kc8x4&4!UQqJ<J;n@+n5NUpJq0mW;!(ZT?~&o$Q#>!|e#SQAWy-
zJzNg5k?`=!S&P}_h;T%X*)KxgPvH$Dv|)a)%6IS1LX|LvBShwy*Q;m~=Z{r!42eM|
zDZoSg0EKOuS5dLh8?7?W0_0ifBXzo$(l*08vU~ES0q3Z1(U^r1AA3dOYH_d1JHrIc
zeISDJ7bo5|N0e>$gS9Ae(bzQFJeSf!;mM9R$2cFqFCOd5hhnnCXRXv{R^~JFi3rh`
zuiS?+V9CQFmNw3N2t2MY>(Ym5Gsn^{^AWtfH`*s@Vx#56pEow~9nn8rP{bA3olOu|
z`j!+&jD4Im`Nwf>o+@aM*#T^VPVf;ED^`fB>?1}OS7V~et`RH6s`>{V4m$5aB#3Lg
zCq}HdLQoR^urrJgn`T3=pZB;P$EJ%lRQ6c*XdI6X3Ga@cU}zI-eT-LUkH(_tlQ)eZ
zVyEe&p6J74@tOHXz(%>O*2{1c$rc-W1HAg8)V8sw-s~f2i_gqg?AFmkqma?NVVl?}
zHrce^1gKYyy%ijBV)Mh6kULe6DPlG%#O?Mtgltp-&aAdf>G&s6i;a%>F*~J*HnGKS
z9QAU&#vb3lWAtcLYR7nbr)_~(tIb9Hb}NLzVydgst3A3|XqH{xXd&}^eS~Mjw%+sL
zx_s-1yX{K5&aS5`pAuib^08lN`{90}zx5bivh;wk8!uOoFW8-)k$fBM6jB7+JP(Z^
zqzY_-BNng4EL(sVH>#ev)>ilc8|zh7^jjwiF@h%q3-CbeeU332^3`4r5Gn;xaKt_q
z+YOx;J)@nlQ`n`f6n27X&&jsyQz7O$HE#b)ppU?D0@(Hn>=kL&jTC9ijYlC@dg;a%
zDdn?9$dR7=?B$b{zyDYXv!t9qb*8&@&8%rhgSDZl(WGVtcx!khyh0LWsU+W&CSCv2
zl$d`fWEX+M1b#w*lw~ud$zPPh9O<bqGG;Ivp52tdmeYdV1=k_MBifB4x2B=d+8|oo
zel^X_)t1H`Zp}6etG9^KAHK*k`ZcqL9W^$KTerosySip;Lygs~WtQfq>K3+Dnsl=q
z5~TK<$^6H!gGM@fGssYbD#zi^dRoiNJ0YHjn;=}echlXbkLa%D8+$e$s2Yk)zZ{v{
zU-CxCvGO7PtoHfChJdb|j-2kyD~5!RV<#SY<h7imIRg`iGG<@SSn_V%`I@r{u4OBS
zVk<7kHoK~t@db3&CGEK3fS|65j*9N0p#bCMfYQE@S0WBa^zHh20#1HWhHnWKgENMv
zmbNb#))~4YV>%+c1BP_*mvz%$ns{XCfO05#>cG-V$<y2CN&osXukEf@2ny*=J)rK3
zJOW219M$#haV1O{sCc8w6;k9{vhqq`#Ycf_F9oh03S951-E=8%Q~Sc<P~(A`KFtda
zAH`>1iq9TU4y+i8pXoB@x`Jo57hjt;t2?~Ap?ggq^d<EzIBe>RJyLKfXtJwdm1}jS
zt7^lg)ithFwXWKYu6gx}_9E%xUyA%zDsBlvXvN7ne|5mg;jfZZ!7D*9mBP1oLIvY0
zxPLcG(%q>`IcM~*)al<3O{@&mUN(=f3>U72>#9<e*NnMU@k)2Rx++ELx?_O?>E4|t
zwTKR>k{a&5g7c7jht&-@Uw6`Z@3;asoV46u53o*p_uG8+R>W^UssHXm5Lo#Y9h`ve
z{24vuK?^^phu<sRFv<Cv0fs?Ck=bhGJ<mY2^W^|otbmQquY*9RfLEN~hro{j{*&(y
zgSQM%At8I3z%#r&9I_GL77nGbmwy-z9QwH>0{*Gkui%p-U<$m-4@5#dJj<Ptur!#|
zVc`_5bO6@C$3?-*P|r_C!JzR8M7fo<H6r_OjBGd5vUNnn5LlBjCR5@QN8Xb(b=$;h
zv6lS|m$uPzCl;6cd?`k!^ZRkIRtMd@G8qoX5CL0Cd9sWEwJdB2;mUb<3goC?#_@o&
zJOzHFf<pdD8pMHvf0qW+<8~0$V+0N$lPQ={6=W+3l=ISbsDJ|gQaUVDQ@MT1c`F?b
zE8yej2VpV)Bm<(=x!7kaq}weKJUA2lA)OmDVLacI2{F>zIl<W~htj4)Ve%vQ{BmW*
zqUC8?{cQ4=9$H46mJeovIY8$vz=+cGybm!Kdp`%gKTZw38qr@2=nv%CW{64&qCz-Y
z<-}mS3Y!IkEy}YYer^fjFP;NqVyIo&ALea(sWh9y%REQ@gba3^511hh^7ybBju>Ri
z$u=zK&t^duyw2asf>ixUG{FV@SwG@sosgKL59~_sNWZM#;3*F-W7be)Hckf~aps)J
zc_V#j%6y!i*?z8Nu;u*fvu!xR+;MKmhOZQG)mi=sMw9v-6nNQrcnVk)>a#e$?lj~;
zi3Z-}t7pM3C~#hy1tw5@qi}vd8<GHCbH>kw37{cb_6}c^2m9ey{AwO7R}UlVk4|$w
zJgzmIq2;-BwgUcUF}$F>sSuni7eOu<j?mIYTFP@CTnuXf&ho#PKna}T1*MRy`4g`H
zQ{jBN6sBp>`=?gIKcJX9D_}Cb<h)q{GeNTxNouC@uPUI)d0;hs44RQ>Ypp_Mi}_1c
zkPLnNToq&(?jvmgzHV68D5$O`IOEp96)n8SZ`VOaf}NBpMt89)0&mjvHw3Pcg6DXy
z2y-4ij|h{>t<Eng&R@>R1#ZZ9tMc(-9}w|H0v{q+z&<0st0e1t1wSFeT0C8#1y(>0
zud_hyxT{3^5dycSwx(`NOEa?&@$dL27BH)osOSV|&_?)36C>Lx4=Gy%8k=m1R$EhZ
zb4~453-kNsHb|g4k=O{?>JVhfbFOHFLmH^!cWv;ZY8;}ZkX2#)XbTu&4L{d{o{Ql(
zTi|I}&YN~Xvqnz&@%#@vU_3-~!%j#I%s{TC__Ma-5#%g4I;(bq0~AYC^j)KbkKYad
zh!4W|F_m2<zn7^U8oL_X6Zt#V4uPfErCZ4n{9r4Ds6z<PPqadG&=mZ<<u7-t2kpY<
zWS+DF!qi<jOqJWCp3`A`&-0+?Nqf+Do6Pw6DYH|r3>PDK&k=|S1JCD3Z=PWqM)6~N
zV1C%RE!b>ex;=P-6{9(RcbIR85o5$y{KfRg@p3!Nhzi9HZS-Zy+g};^Av+`l#gEDN
zgpo}HKun~b%kv$B|IH3jQNEuowDi7(oGIMsfG9}j(;P6jG<77cKc+CqAaIe~TSi`w
zrs)8UeoNr@1nv^}4+6VrH5l#BQVHzDDZlRkKK^xD?Iv)Kz~>0uDrOOz80M6~P7~i9
z{)@+8_gc9QQzOBsTrw&cjIxqZPBF>^Mx~fhm@x_*MoxEYHa2XvSs2SA4Am}KvRhkS
zEjHBIs;lJ>Z@i-oo;OTG5)psaFFo1Bi`(I-GwN{&22F?%l6p7PX?_C2!T(%_e^Gqo
zd4+#bN~E;(yGUo<laQ{&deZp}tORu~%Glxj<6dY~f|{><7PdeTAAA-f4Dw0os}#G*
zZ#)Z+YL1e|Pw<3J7_Xj#Y)?3gJ0V30VSHN`tiq!CUKdPK&%+hT`CS)O0X)iA_CSe#
zI-(eX7o5j>U@EAKaop?t{5e>lg<U-3AZ&-Dy!Rl6%ylRBgr@;)bk*Wl_=9*u4RHS#
zVF{e)>t2Lynlchr&Rv9hjwc<0LRiM@4?zyh<1Ze95`*lfpOCJF{N5qRS2rTZA!lwM
zlp3IscN~MN`Gq7zE`1AV^j}Er4qR5ays)gGI)6!V_2R-x<|Gl1kW;4+m`1=v=Ah1j
zJ<2Ea!wk&~VxP|~{jeJr^6ULjhaEuTuQ18i9S4Re*Kvpexp9bi{#C5k7o2IYqFctI
zKH$4vgFy`$g-z#k2fz|HTD3pL%}h#91;?+50{euY8GzGX>Zeb@B0y`LfMNBsDBzUy
z`0LQD4c&umt$MSy1uIpJ)naCLo_z}9B4q15Npdpj6m*o<OlpD>dHX4BlV<S2Q<y~S
z`L$D6qaNqgZ)2JNl>gh?atrl8Z$kk*M(68HvXZ)IQBoP3K*JUUZq=&%Wo7IF$$!Sf
zdxLA=0ehr{NJd)<atSL|O0z5DupT?#fgHtCO5T@+B~W`BGSxrD^<n3X)6k*}mOQk`
zAS>_S@BA7T2NJebli1K`Yf5CrJnAeIdYn<fYtKS<8qv1u6Uz!$RTq^nUoo3G2w_NE
zf|Kg<vXaW#ZkWt=^0&^yBs|iWXVF_f;p^Xp3HpOb`8ocqiG2I}kmP*rT}V~N$ZE(M
zY``_vMnDd1&i{H2QbI>IlohgVvXD~A=V2Wz;O*yOE^Odu&O<6p=YKd4i5i)^fEzAA
z21w577eEcT`|S5&qUI0^{z~cG_CDO!P4S$VwtDQrrcco5aRQvcLlIiWd#*s5iB8LQ
zk&9*WYMRO-MwMSexX1YoBoA$;F}cyCV2f#7!eg$&FR|gdbQK~ra=ly6|8f;=Rp2!K
z4!RT(a&;SRHRTd_pAQbhB25QL*v~_*!A#A|IQ~xQTzU<D9@I8kedWUYP^Fct^bL$1
z6R=lFgj}NKbl#08F@am%Si|bAa=~s5GMgKl%ykxKGuLgh)NPR~c&pZIZf>dF+ECXT
zU^X|@H#RYgd218$P-)-j_S@D_&+uhX?h#rwX0u$rpQO!xPT)BNt-*x0T5RU#8mo0@
z6BF4Bgf^h)CacZd)VOsw>m>|sQP<R1*TV4M7<Ic@AmY$|=lQjp&<eSH#h)Q*&FCc{
z*MHxFFE{j_+u@;$fyz6hgl1$wM)|-fF4@ymfhb1U9PauvRO*kDlL;g{r+f(&YQN8L
zT!!6V_bo^YrVubG+{%T8E6Pl}*f03tE$nYM@|(A?G26ubZ$p!52}vj?u#XbAjz;wa
z=F^n^6~o@7U5EHfx8Zsl{gZ~#|5})QHqVO<P16a;Z#?q#Ctq-**B|w_Om0?XLyVsH
zA(O}_r(2299mDbo(4FE*wqj)(4jXAMmlWAVqt=lPBU|h^H{F3W{cn&G4<J|_&Z;}m
ns|Zbmgs+Rh4}!lAoe8TIU)zD}zk$`7U?^68oys?T1H1koWJ!rw

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 14adaea..3a0ca9f 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -497,12 +497,16 @@ def render_compose(s, st, app_port_inside, build_args=()):
     img = s["site"].replace(".", "-")
     y = [f"# {s['site']} on dev2: rendered by cli-tools dev2/dev2-site provision. Re-run provision to change.",
          "# nginx on the host terminates TLS and proxies to 127.0.0.1:${APP_PORT}.", "services:"]
+    image_only = bool(s.get("image")) and not s.get("repo")
     def service(name, envfile, command=None, ports=True, vols=()):
         y.append(f"  {name}:")
-        y.append(f"    build:\n      context: ./app\n      dockerfile: {df}")
-        if build_args:  # deploy-app.sh exports app.env before `compose build`, so ${K} resolves
-            y.append("      args:"); y.extend(f"        {k}: \"${{{k}:-}}\"" for k in build_args)
-        y.append(f"    image: {img}-{name}:latest\n    restart: unless-stopped\n    env_file: {envfile}")
+        if image_only:  # Railway ran a stock image with a start command; no repo, nothing to build
+            y.append(f"    image: {s['image']}\n    restart: unless-stopped\n    env_file: {envfile}")
+        else:
+            y.append(f"    build:\n      context: ./app\n      dockerfile: {df}")
+            if build_args:  # deploy-app.sh exports app.env before `compose build`, so ${K} resolves
+                y.append("      args:"); y.extend(f"        {k}: \"${{{k}:-}}\"" for k in build_args)
+            y.append(f"    image: {img}-{name}:latest\n    restart: unless-stopped\n    env_file: {envfile}")
         y.append(f"    environment:\n      PORT: \"{app_port_inside}\"\n      HOST: \"0.0.0.0\"\n      NODE_ENV: production")
         if command: y.append(f"    command: {json.dumps(shlex.split(command))}")
         if ports: y.append(f"    ports:\n      - \"127.0.0.1:${{APP_PORT}}:{app_port_inside}\"")
@@ -514,7 +518,11 @@ def render_compose(s, st, app_port_inside, build_args=()):
         y.append("    logging:\n      driver: json-file\n      options: { max-size: \"50m\", max-file: \"3\" }")
     service("app", "app.env", command=s.get("start_command"), vols=s["volumes"])
     for c in s["companions"]:
+        # companion_ports {"name": {"host": 3301, "inside": 3000}} publishes a companion on
+        # loopback so a `proxies` entry can give it its own hostname (an API the web app calls).
+        cp = (s.get("companion_ports") or {}).get(c["name"])
         service(c["name"], f"{c['name']}.env", command=(s.get("companion_commands") or {}).get(c["name"]), ports=False, vols=c.get("volumes", []))
+        if cp: y.insert(len(y) - (2 if s["redis"] else 1), f"    ports:\n      - \"127.0.0.1:{cp['host']}:{cp['inside']}\"")
     if s["redis"]:
         y.append("  redis:\n    image: redis:8-alpine\n    restart: unless-stopped\n    command: [\"redis-server\", \"--appendonly\", \"yes\", \"--maxmemory\", \"1gb\", \"--maxmemory-policy\", \"noeviction\"]\n    volumes:\n      - redisdata:/data\n    logging:\n      driver: json-file\n      options: { max-size: \"20m\", max-file: \"2\" }")
         y.append("volumes:\n  redisdata:")
@@ -547,20 +555,29 @@ def cmd_provision(args):
     vars_ = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
     inside = s.get("port_var") or "3000"
     app_env, merged = render_env(vars_, s, st)
-    cfg = repo_config(st.get("checkout") or checkout_dir(s))
-    if not st.get("dockerfile"):
-        st["dockerfile"] = find_dockerfile(st.get("checkout") or checkout_dir(s), cfg) or ".nixpacks/Dockerfile"
-    branch = st.get("branch") or s.get("branch") or default_branch(s["repo"])
-    hp = st.get("health_path") or health_url(s, cfg)[1]
+    image_only = bool(s.get("image")) and not s.get("repo")
+    if image_only:
+        if not s.get("start_command"): die(f"{s['site']} runs a stock image; set start_command (Railway's deployment manifest has it) in sites.d/{s['site']}.json")
+        cfg, branch, hp = {}, "", s.get("health_path") or "/"
+        st["dockerfile"] = None
+    else:
+        cfg = repo_config(st.get("checkout") or checkout_dir(s))
+        if not st.get("dockerfile"):
+            st["dockerfile"] = find_dockerfile(st.get("checkout") or checkout_dir(s), cfg) or ".nixpacks/Dockerfile"
+        branch = st.get("branch") or s.get("branch") or default_branch(s["repo"])
+        hp = st.get("health_path") or health_url(s, cfg)[1]
     compose = render_compose(s, st, inside, build_args=public_keys(merged))
     build_services = " ".join(["app"] + [c["name"] for c in s["companions"]])
     # Public repos clone over https. Private ones clone over ssh with a read-only GitHub
     # deploy key (the alias keeps one key per repo); some orgs (moshcoder) disable deploy
     # keys, which only matters when the repo is private.
-    private = sh(["gh", "api", f"repos/{s['repo']}", "--jq", ".private"], check=False).strip() == "true"
-    key_alias = f"github.com-{s['repo'].replace('/', '__')}"
-    repo_url = f"git@{key_alias}:{s['repo']}.git" if private else f"https://github.com/{s['repo']}.git"
-    deploy_env = f"SITE={s['site']}\nREPO={repo_url}\nBRANCH={branch}\nAPP_PORT={s['port']}\nBUILD_SERVICES=\"{build_services}\"\nHEALTH_PATH={hp}\n"
+    if image_only:
+        repo_url, key_alias = "", ""
+    else:
+        private = sh(["gh", "api", f"repos/{s['repo']}", "--jq", ".private"], check=False).strip() == "true"
+        key_alias = f"github.com-{s['repo'].replace('/', '__')}"
+        repo_url = f"git@{key_alias}:{s['repo']}.git" if private else f"https://github.com/{s['repo']}.git"
+    deploy_env = f"SITE={s['site']}\nREPO={repo_url}\nBRANCH={branch}\nAPP_PORT={s['port']}\nBUILD_SERVICES=\"{build_services}\"\nHEALTH_PATH={hp}\nIMAGE_ONLY={'1' if image_only else '0'}\n"
     ssh("root", f"install -d -m 2755 -o {DEPLOY_USER} -g {DEPLOY_USER} {root} {root}/volumes")
     for v in s["volumes"] + [v for c in s["companions"] for v in c.get("volumes", [])]:
         ssh("root", f"install -d -m 0777 {root}/volumes/{shlex.quote(v['name'])}")
@@ -574,6 +591,8 @@ def cmd_provision(args):
     ssh_put(compose, f"{root}/docker-compose.app.yml", "0640", own)
     ssh_put(tmpl("deploy-app.sh"), f"{root}/deploy-app.sh", "0755", own)
     note(f"{len(merged)} variables in app.env, {len(s['companions'])} companion env files, compose + deploy-app.sh installed")
+    if image_only:
+        mark(s["site"], "provision", root=root, branch="", health_path=hp, dockerfile=None); return
     # Deploy key + GitHub secrets
     key = deploy_key(s["repo"])
     pub = open(key + ".pub").read().strip()
@@ -712,7 +731,7 @@ def cmd_volumes(args):
 
 def cmd_deploy(args):
     s = site(args.site); st = load_state(s["site"])
-    ref = args.ref or st.get("scaffold_branch") or st.get("branch") or s.get("branch") or "main"
+    ref = args.ref or st.get("scaffold_branch") or st.get("branch") or s.get("branch") or ("image" if not s.get("repo") else "main")
     log(f"Deploy {s['site']} @ {ref} on dev2 (as {DEPLOY_USER})")
     out = ssh(DEPLOY_USER, f"{WWW}/{s['site']}/deploy-app.sh {shlex.quote(ref)} 2>&1", check=False, timeout=3600)
     print(out[-4000:])
@@ -873,6 +892,7 @@ def cmd_migrate(args):
              ("railway-stop", cmd_railway_stop), ("merge", cmd_merge), ("verify-public", cmd_verify)]
     for step in filter(None, steps):
         name, fn = step
+        if name in ("scaffold", "merge") and not s.get("repo"): note(f"{name}: skipped (image-only site, no repo)"); continue
         if name in st["steps"] and not args.redo: note(f"{name}: done {st['steps'][name]}"); continue
         if name == "dns" and not args.yes and not args.__dict__.get("no_confirm"):
             if not sys.stdin.isatty(): die("dns flip needs --yes when non-interactive")
diff --git a/dev2/sites.d/obscura.openmcp.logicsrc.com.json b/dev2/sites.d/obscura.openmcp.logicsrc.com.json
new file mode 100644
index 0000000..b71a557
--- /dev/null
+++ b/dev2/sites.d/obscura.openmcp.logicsrc.com.json
@@ -0,0 +1,6 @@
+{
+ "image": "node:24-bookworm-slim",
+ "start_command": "sh -c 'node -e \"fetch(process.argv[1]).then(r=>{if(!r.ok)throw new Error(r.status);return r.body.pipeTo(require(\\\"stream\\\").Writable.toWeb(process.stdout))})\" https://github.com/h4ckf0r0day/obscura/releases/download/v0.2.2/obscura-x86_64-linux-stealth.tar.gz | tar -xz -C /usr/local/bin obscura obscura-worker && until npx -y @logicsrc/openmcp@0.4.0 serve; do echo retrying in 20s; sleep 20; done'",
+ "health_path": "/healthz",
+ "notes": "stock node image: downloads the obscura binary then runs npx @logicsrc/openmcp (Railway startCommand); serves openmcp.logicsrc.com and obscura.openmcp.logicsrc.com"
+}
\ No newline at end of file
diff --git a/dev2/sites.d/openaccess.logicsrc.com.json b/dev2/sites.d/openaccess.logicsrc.com.json
new file mode 100644
index 0000000..311d580
--- /dev/null
+++ b/dev2/sites.d/openaccess.logicsrc.com.json
@@ -0,0 +1,6 @@
+{
+ "image": "node:24-alpine",
+ "start_command": "sh -c 'until npx -y @logicsrc/openaccess@0.3.0 serve; do echo retrying in 20s; sleep 20; done'",
+ "health_path": "/healthz",
+ "notes": "stock node image running npx @logicsrc/openaccess (Railway startCommand)"
+}
\ No newline at end of file
diff --git a/dev2/templates/deploy-app.sh b/dev2/templates/deploy-app.sh
index e8eb1ef..31cbc62 100755
--- a/dev2/templates/deploy-app.sh
+++ b/dev2/templates/deploy-app.sh
@@ -61,6 +61,20 @@ TARGET=${1:?usage: deploy-app.sh <git-sha|ref> | --rollback | --status}
 
 [ -f "$ROOT/app.env" ] || die "missing $ROOT/app.env (the app's secrets)"
 
+if [ "${IMAGE_ONLY:-0}" = 1 ]; then
+  # A stock image with Railway's start command: nothing to clone or build.
+  log "Pulling image and starting"
+  compose pull -q || true
+  compose up -d --remove-orphans
+  if health; then
+    log "Healthy on 127.0.0.1:$APP_PORT$HEALTH_PATH"
+    { echo "DEPLOYED_SHA=image"; echo "PREVIOUS_SHA="; echo "DEPLOYED_AT=$(date -u +%FT%TZ)"; } > "$STATE"
+    compose ps; exit 0
+  fi
+  compose logs --tail 60 || true
+  die "image-only deploy failed health check"
+fi
+
 CURRENT=""
 [ -d "$APP_DIR/.git" ] && CURRENT=$(git -C "$APP_DIR" rev-parse HEAD 2>/dev/null || echo "")
 

From 5aab1f642e896b1f2f41ae2a146c57a3841c86ef Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:50:57 +0000
Subject: [PATCH 031/104] sites.d: mynaposter.com with its API companion on
 api.mynaposter.com

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/mynaposter.com.json | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 dev2/sites.d/mynaposter.com.json

diff --git a/dev2/sites.d/mynaposter.com.json b/dev2/sites.d/mynaposter.com.json
new file mode 100644
index 0000000..d0ad819
--- /dev/null
+++ b/dev2/sites.d/mynaposter.com.json
@@ -0,0 +1,27 @@
+{
+ "db": "pg",
+ "db_host": "postgres.railway.internal",
+ "infra": [
+  {
+   "name": "Postgres",
+   "id": "815793bb-9f7b-4703-9bc2-1f170dccb836",
+   "role": "pg",
+   "image": "ghcr.io/railwayapp-templates/postgres-ssl:18",
+   "volumes": []
+  }
+ ],
+ "companion_ports": {
+  "mynaposter-api": {
+   "host": 3361,
+   "inside": "8787"
+  }
+ },
+ "proxies": [
+  {
+   "host": "api.mynaposter.com",
+   "port": 3361,
+   "max_body": "64m"
+  }
+ ],
+ "notes": "the CLI (packages/core/src/store/cloud.ts DEFAULT_SERVER) called the API at its railway.app URL; api.mynaposter.com replaces it"
+}
\ No newline at end of file

From 287d9684cde53149698739c4c49165143ce51b34 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:51:46 +0000
Subject: [PATCH 032/104] dev2-site scaffold: per-site start_command feeds
 nixpacks; mynaposter commands

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 128736 -> 128818 bytes
 dev2/dev2-site                            |   1 +
 dev2/sites.d/mynaposter.com.json          |   7 ++++++-
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 9ddf0d4e42525c94bdc08228860e8d1875583a70..2e3d14fe3e68d664272d48d463179891c7c4d796 100644
GIT binary patch
delta 2403
zcmZ8hYgAO%6`t?jc{w-?C<vpBhy)Q85k^5#qWBCkh!8MQYA49WkqBeBfUgW<x@?GH
zMBymM)MBKjP1XWm+_tA0HMG8})>n<IN~)q5k+j;VQ6n))&%wBs?fvncea_vFZ|}3u
zZoh46xnuG_X|-B({7cRH<C}gld;GVrk%k0O{29sgP9iMYqctf8bZTSXp8|k1z8l<s
zWD|sePN$l^P)6Fh<TWZW6LdN<sXDZ-+Cny0k479hRXqcvNU$#g@g&I?nUvtwD^9Q8
zZKw$F`cKu(@1@gK1bPFM(cVC}w9?9V0X{#yuFS8;x$qj`?cF?v)cRaVBzJx3NFo#0
zMPn>UB?~2G967Tt6XQrkO&pR*W{n-=$>JKPoTN-3jWu~lA@cfsyhz;ZKaeLXlZd<_
zvPZ)~rf%qmRFb=)He~X%R4PKsGM|N2rVzO{!f$Gm^z=lTM&fGi*6Ci`7M(Jq2VWvN
zwNc#L+qDi%CM9cw$<Eq=a+>mTk9?!{70e{@b#A;uKBy}|I{C3K60^vpu>O*gK_-$a
z%qGW(Q_gGxIrE497A1=pQZEWgQa6S}CJ`GQ$R@6hE?bT=r%C>a$7{{6lT#bhWPV2M
zn;bm;k9C8|+)a*Nb9p&A|B8XUG;VTp(@@MKw)#jzuJSXtfi%(=NN&9q^GRX7BkJdh
zpW;&9Q1YI|<XJ6vPR?&IxXm=a1i_@W-q=gw>IF(~Wg$6J?{K)4MM|OaCRdjPU1hP?
zpcE;^ibq-E_TzzukT`0aFSOqJKdln4tf>DJw6sB1%9QfwLN9$zUe;jnT9k~%LwTP`
z%5o2s<dq`g3bKVJVI?_FBLm;|hI<WO*=zBJd8KA=lbP(O4<W0o^nMk}D&A=(WpHyP
ziQVi9e{TQmTA^E}TQ1MlEkn#|t!Z<UWNWjQmgT8suKXp%#d#h@o3mvf(5wYEOae}8
zSzBkzxTtM!jFR*h`3oScx`vZS+x;yv?~^iqP<l<Xee@e3O>6mW4eSBy%h#4~aD8rz
zYK?Dootu)gt@P~hiRYpxX)k{Kk+Cva_gA~Y%`trX0KS|aKY0jW&JCVy;mi5hX`}dZ
z$<fC>Kz}K2N)X>%mixE|$(Mtt3WaOoecZ9~wfI!Axjv!itaE_y*Ez`G9%kx{G7CA@
z;7&4iCiKY3{T2nt`9D2f9T{u4YMz}&7)+f0No~chN5FYfvd3k)!*x^vf7jafgc@;J
zyU)@96G_=SQvU-#r+Mk<8)#7rJW7G;D)1~-hjAYlG_rTI5m(8G)=&)9rnMf><9i|>
z`5p!hN5=vWN%FB=Jk;usx!|uJ5>f0NVk9+zSdXU~6Sx!ANwSZp_{Vaw%~<FuE#wgl
z+K0!#MC54kdyIh5!qm;7P0D{uJ;J*}eJG9+$;T(h;%lw_WRV_WTKd@x8)8Yr)o=un
z16N-~Gzn~PmJWe@)?OTTRamqO*d}0yfL!h>2I?5{(zPk*(0td916Q><9ab1GiU0r9
z3U4fyjZaNUTc;Dli2to<+#!j#%5j@C-x|Xw)%9D;@Ew`gwE$7tfvzSCJX+y5=|G9b
z9_$6$Ny($-=pbJ`DzU_fbOe-X1>a@^1IfO}8Ca!Rx{upXML+L_BAlYB7W@)x*)a=p
zq~YOQJ4UY#6qaEE90Gy_BnXa90U-kHbcPl0A(oxBf&m@uJsX@740L}WCgM~2BoM<8
z$D;cn0n$m(*+CeIgY^Br_=Yc)LHH7_tRR^G#b4;=e#parXm>xPAcl?&K|XHNUx(lh
z&d};mq*>nK3`%__o$gzj>BB(wBotW|9A+7jSf%GAPDdkxKO^?_Q0&&@3Tuo-DvXzf
z)nhu#he6C7hbIzlQbPjL(8V$mkO|ymjZPFwxX=6&@r8j`qjNk~nA&)P)71{<o&W+^
z*mo(2m(k5)Q*qXev+Rd7P~a4+pNZQ*AX}4;Vlz7Ey&SxQ3#@DoexWx-@WEP|E71%e
z!dX}@?wh&$00mKKqlpTZ@RI#b!6G1;*%o4|8QCn`gBJ|ANLQ3132kgoDJFv+Ek^*A
z%W()x=&^E6sDtJ%MI~4JVkus?6o@dZIpLnlIM}>p7;MC4T2X-+d^u9VFX<GWwF+&J
zX-p-$P0NKvfc%tL+G-S=;H0dIUr#l=S%n39P?qMyZW*7j?)BIW>|{-~;BTyj-KfK#
z%s9vzw!kCd2<^R<-}2vR(pJntEUnp!Bm5e(Kg3P^o{isz9e%t@T}^lb=>+J^AlU17
zVhFC#=$+`sVLEsha?s9}@4`NblW?|R1uyT87JOp%6R%WF=df}Ft$ml@;Ob9d2Oh9r
z?MDd04)c^}sUvtU>f0RJ^sl96%~DT@)?7zj`;m-?%zO}|fZJ@`XUH%ZAB(&P(UKF0
zV7m@uzX38UI)N76M>PBb<{_G{yntz(aq9(SiI(pB4@{6?W3w+I(Z-8ebqgDCorZSt
zG>6bDU0BC!TJ#l;B8fTwg+{~3e~b88VrIN7V4r{@!7)KdUE=QuA=w1npweBu!J9Du
pE=&j(lU^0`QVkT)Gbo4A%6o7ihBe&7IN9_nkb!$1cKHEh{1;zC|C;~+

delta 2345
zcmZ8hX;f547Vhu$N@D{8f~bgy3Mf$l*&;6B7NdZ;CK7Ft(vAx#4T?*<OpZ=a8l^3z
zbQn~OW1IuTz&n`=Zpj>?3GQYz4!A<%h(=}H;&OB{Rd_tdnfK$X<=*dp_ui^kwfBuT
z?ioE!S}bOb_->~EZT?qbH6EX>Qy%-U$h~-%4UdCaeY$Rl9%s~;jUzyli~Q)fMMKe_
z{$4Z&1LzoMFb2|j&Jca1Lr0>h%jpvo?dWJzR#-HeRbEbaohIL12A7}1%h91~5UqDw
z5ko_YQxHpYi$f7dYqrf*NIb=+bhr3Q<+U@tx4BpM9FT-J8+JIW^M}1Qidf#{U0S{=
z+AWq0c38?Z<qB=v(2XV(2C>Bod}-L`4oIXio3k*4?%2FTJCqEgF(o08q(Hi~#1F%1
zafu5_G|1Hn$u!0l>^|a+6d6e~T>+L+4$m?T8QqR!=%=pUf?e$j6r9`*o#+i$ckO#*
zEX9^g_xIm0R|SY-qUf$I{V<N6+%gB_X(SCn3QMX)7lowKT>2@}=yMvaolpsu87g<v
z>A0=EF_GqO4Z<Yq+G_QjOr}(7UzbXzR!w6M9HOMU4KaFQ$hXq;3qEw#Hj_vvlJ=xU
z+XC?c{p&V{4{1_qh<-ZBu<7Yw){7RGTJRAqD-8^tLEOnqVkNU2Ai4k%SrnG})_iuk
z-ewXB<yOMS(?s0FVP**mAsxsZ3KrOPF0ql1$vi<(B%RE6=*a@IkYtk_n!w^_Nc*Dy
zvoCgNN$&qh+RL>hkL154yyUI<(sI4SOi~wwX*70)6v)G0A+?s#(<~0lseXG%#}$qs
zhu)!em>u05O4Z6rQ+vvE^?HNFpE$@Wht6gsJ*!qz>vn6<TkAIm1Wkcvnf60X0m9d)
zSGQLxDl0n(RH_rphXbcox^sdSm(*V>dMmn1&}itn+x=+#UJtV(?q$B%$UCl1*t-XK
zPkr>4O;G>*`5wcXV9gH!dYizY(TW((^i1v}hVyR8W-<K3cho>JH0r!<imuUbgs)g!
z>FaGXYOf@Yln%`XZ=0{SxpR_Sw1l+p-BM({TSmRDqw!V;lbrkNZQYHx0@~-nezrJm
zmdK|4qwxV2^~4tj=nW#t6Y9kSPk|rl=^Cr~p760tIIqUmb~d11P5XK*V4yqd`r{S-
zp{}PsTyQR^ZFSoXU9L&*of1++VEex%ypj;AR(yLzhnLiP>=ktCjN|dZ6I%Lx2A-%7
zzqg`ulO-=d)1Gh5T9lognM3RWB1pJmkEGUyBtxW7ut(8-4MRL4#I(sUFDGvvnPb<f
z4;pSFBwCsWwS$zl320KX7Tb?W<tK70hCV+Tk2W>x)IuG)s=Lmmc_M<gT@Qi}^}I0&
zeQ4H=DkWB-9h<YewHI++(soOzmXIMrg~L9G{;7EcTGVUJ4Zt;Z|IZc}{weL3)kD85
z&>CJ-X+&!@!s)EmP~4-1txIs1{--rYJXwQo7vKf0x;-1cRL?t=W@M{}9;X0{Rkz>j
zfa|pW=`ys?#AmtYFj<a-Je5D23<S~+FVe6|{pdx5C;rI#n6Xef1(tdkec4enrlXJt
zxMPaaue;!c>+FG&-&I042|f~{WTw#){3Uc|J1i(P$d0aXv0dI6$ftSW6QG4Rc_LbY
zj(K=v7!I;jZ}dffzT6v8P)>mLI0|2O)(>59gkAB$V=<if#Z7#}c_-n5zq31j$i#g%
z-XB8{#y0vR3wPOlf856zcC|Ccn%4@|Jf~5kdB)N+5Xe&kFv*O1UJ-)TIz;duVF-rt
zwDihTScMba`P^_gb-2nOy@Mneu1M2!w%dsweEI;qRB)3`i^5p6@`@;=12_4jXv|aa
zkk5$4Wj#)@ghVViHj2_m+go^DA}HX-Q-&f^i|2ez63&@$mQQ#e3^>JG$Kf8}#eYgc
zwh1k4<W&3t7x?k1_(W&yA>P)!jP|^Ocuoc$nMC;61ijJ73JDg87Cs~R7)aomb1~9{
zNqk=pdg*bAoy<cV8o4$f$v`$6y#zn9QA^;(!j@v4(5YUEHNx$k0(@X5Qf944xV=fe
zxLSa&23%ohS7D48{8yt;=<Z&PCMay>8oV$TNQReIHY|vjtwpvGQOvCn{jrh97h<*!
zrM%3EFSYobk1xTOKsA5mg7_P2cr3-&CLG~yWyn$R9h<pRocc+&VJD^{g5B7OW8y^j
z?ZUsH^5Wg7b{Ab5T!oiV8o<hZ5x_n>fIhg&mVbd4sAu^HFa_87i32#Oh%DCEV!7z=
z@3q)(5(m8h5Jmux`Q5|tN4I)WWU4(vWN%+7ph-6^X=19qL0;2hR&yA`_{^h-0Pgal
zZ;+<PGk*CywCJJmqbE=+E)L7RD1L%I?9@e!5_x(5go*MZ&$)y|1s;4)BVs*8%Nkoz
zf@U`VwkW1I8+ZrBqH{;@;5cIW`d?9@$FD5(0Rp{RrF4XRKs+V<%qBm;EODp4dH^Fj
n$+z4t-%7ieg!V@=oSlD&K!owOhe*&Gg?t(wF60A#gBJe<QhWOV

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 3a0ca9f..1eb6d7f 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -401,6 +401,7 @@ def cmd_scaffold(args):
             # from its own process environment; the default Node 18 is too old for Next 16.
             node_v = s.get("node_version") or cfg.get("NIXPACKS_NODE_VERSION") or "22"
             nix_env = [f"NIXPACKS_NODE_VERSION={node_v}"]
+            if s.get("start_command"): cfg["NIXPACKS_START_CMD"] = s["start_command"]
             if cfg.get("startCommand") and not cfg.get("NIXPACKS_START_CMD"): cfg["NIXPACKS_START_CMD"] = cfg["startCommand"]
             for k in ("NIXPACKS_INSTALL_CMD", "NIXPACKS_BUILD_CMD", "NIXPACKS_START_CMD"):
                 if cfg.get(k): nix_env.append(f"{k}={cfg[k]}"); note(f"nixpacks {k}: {cfg[k]}")
diff --git a/dev2/sites.d/mynaposter.com.json b/dev2/sites.d/mynaposter.com.json
index d0ad819..546e1e3 100644
--- a/dev2/sites.d/mynaposter.com.json
+++ b/dev2/sites.d/mynaposter.com.json
@@ -23,5 +23,10 @@
    "max_body": "64m"
   }
  ],
- "notes": "the CLI (packages/core/src/store/cloud.ts DEFAULT_SERVER) called the API at its railway.app URL; api.mynaposter.com replaces it"
+ "notes": "the CLI (packages/core/src/store/cloud.ts DEFAULT_SERVER) called the API at its railway.app URL; api.mynaposter.com replaces it",
+ "start_command": "bun apps/web/src/build.ts && bun apps/web/src/server.ts",
+ "companion_commands": {
+  "mynaposter-api": "bun apps/api/src/server.ts"
+ },
+ "node_version": "22"
 }
\ No newline at end of file

From 4b6f5431f64989ff576f998638d7d52f11731380 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:52:02 +0000
Subject: [PATCH 033/104] deploy-app.sh: REPO optional for image-only sites

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/templates/deploy-app.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dev2/templates/deploy-app.sh b/dev2/templates/deploy-app.sh
index 31cbc62..65ac926 100755
--- a/dev2/templates/deploy-app.sh
+++ b/dev2/templates/deploy-app.sh
@@ -19,8 +19,8 @@ APP_DIR="$ROOT/app"
 STATE="$ROOT/.deploy-state"
 # shellcheck disable=SC1091
 . "$ROOT/deploy.env"
-: "${REPO:?deploy.env needs REPO}"
 : "${APP_PORT:?deploy.env needs APP_PORT}"
+[ "${IMAGE_ONLY:-0}" = 1 ] || : "${REPO:?deploy.env needs REPO}"
 BUILD_SERVICES=${BUILD_SERVICES:-app}
 HEALTH_PATH=${HEALTH_PATH:-/}
 HEALTH_TIMEOUT=${HEALTH_TIMEOUT:-300}

From b1a15374741c70140868a39e6497c02ae31f5d23 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:54:03 +0000
Subject: [PATCH 034/104] dev2-site: a wildcard covers its one-label subdomains
 in the certificate order

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 128818 -> 129580 bytes
 dev2/dev2-site                            |   5 ++++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 2e3d14fe3e68d664272d48d463179891c7c4d796..cffe7deddb9f971e974abc8dead787e8076fe8a4 100644
GIT binary patch
delta 2603
zcmZ8jdr(x@8Na{F-UZnO5d?ydia=tKZsP+*WkeQvL`94*&`?BN7DZ)|vn;Cw#g2)h
zVuh~tXiN~3Hrf#tZIYX$R%*2~Vrl~7W85~=8vkf~v_(uZIL5Z$cZs#}&fMSq&Ub$2
zd!2K>-BbSzZ2KxO^plW~V1=Gf7JRTecI;0>-w(y|WM83ekoi3*$~Mhc_3(MwnhZT^
zqp8l6sqEGq>Pp3-7R4yaMy*csHOEK#24{qh(MkuE1`ku3)yCl_Wuuwq4EDAs{IQC%
zL)-p@AG|cOI)wf5)1Z~1)bd(TojFrEI-pXHl6QUt8WXo`Wc5cT^14x5NC=kTeIjZ9
zFC|)~a}rvEMISGorYefByFEH;FO7bIISLf1)G0;j6g;-8zLQ%bqm??;((Dt5>mgo%
zLUYZYNO|UW806dSi8h3cQiHhWhl;Wn5>Og5Ov(oJSb!Ia0iu`v6%ynns^S3;z9OKB
zFX`h)t@tB-eM1U{THWQ<&f?O_ijs1d+c&--qW%#@>3)T#`@dBBH!EZ*EnB^>D0VeV
z?RvHD!;+5GAFaL+aiOX+x+iV^<+Pfv{DSNGMcw&DUCT;(@>g_~t-M}V(Op*2<*Mo_
z6J4H~?y{Qh{F<J$n(wSUbeqZi7Q5L#2#JB>H5wS<iEJvfjGBzW%f#2LyhA{Qc9y3w
zxC#6LUawblP?Sazev`L+ZK*quW@7nS9xEc4^}WQzC89sz#JCpy(m5GR>aAgWhRTu6
zBllIc#_X><;^-bVzCEjZ)YP6K(|W9_o3m~XkL|If?4Q(B(rQ1PdnmVk=+%VD4fckT
zh7~)q_D$NH*=0$&5j}zmYt2!cJx!xqaoBpudSua+*a@fO$<fog4Gbu!)NFN!y~#s`
zuujiWskT~<`moQUgiLwZ7o=DTRkr3HNn!4{&a{}$CP&Q-GyTC5$QUzrW~Awy$wVj*
zZb6i8O2JEk2+`-JVU~(ZQl{gU_66nnSg*IE(?Y6QbJ3vnl4_`aZ7y6P76d3t0=@1+
zRUT@@DBV?vD?#{7&Md_YOBXSPpY}m?%Uz{NOSw#nM3Y~$=gzV(6g@QZ!|pfP=@D0%
ze2w8cLAJQX>#kDhLX)Z!MdW_D6Z&(1Wy(zgzj;N8V~uB>a5Cv{^2IXPG%E!&T`ws^
zuh|qvvb?tzak{qxW1$VBae@A>3kS`plGz@#m`0O|PHu#J<iSV?8B>GNh?l7~c!VFz
z6fd4foGkJpAvBqotLSxarnvg${6Zw?zwu(KdE5;S=pMskhBk)v9DEGXg^j^WL%KVk
zv(_d@Y{F;5|IM_25co~PSz0M*uN2Y2gm0y}9=lSx@`7tExX9udOPrnHGz5p^H<y*K
zt#*omLm$mmNa49Y`Ds1gv80jwD!uNofPuX^uo?RTwM<g|OrO#KR{%og;hk7B`Z-?Z
z;TWxAE}L1*AlW0I9Wpqv5e_YfXm98T8WA6W5wc@93NTAXH({JMhh~oIxlK5X;B+>|
za8iHVjAUpFNPb_R?8ApaIII8b09-0A$Ym{f8JFdW7F3uEc*znOcMy9~C_g%g$(SR1
z4<a9VGN%=G%}WGb-_?pE7E2zJFL9yf$@Dg)z%JLfVJb4@sWxoF%X0iN^wKBpIIX{_
zZ#YhVa7$i1fwN`~MWoB-c2tJnru3+X&0tHR41bs5C(-d8N56g&@zD0rf*$=pr_d6F
z0@?CgRL5kHs&<IeRTDcici!U6;>?WV#S3z$i<L6zG=7hM{oZMWV@MslI!|`<#EUF$
zl7r7+HXh1X&Y&*J#j2;J=KREh0N?bbBV<qq<+MwtcOYA9A$_mDvjd)hur~)dL^R5^
zRfe6zoKV)*nq$jd)s?Ygfh<3VEULtbb4U(nT5WJ_URFWzOY;^knl84=ug~FQyd~Su
z;|1*<n*LV*^Lfk;7-rZu%$Bp41_omvTjh)kh<{?r@KU|X$)2h&;4PHP@J=KkU8Zy*
z77cPqC&uATeS0S~ke}TbF;+WF#?1Pei|89PaUgQGzU_a0cCxgCp_O3*Z^cB0Nel(@
z))kCN+{#n+d>{=vU&H|uPvc$6x*c-jRg4MW&N7#sF5M!Q7t6I*@h7u!=~n7#*KkEO
z8`mn;SJfXOlWt&w_2*3VF*p@DtPnqt+ioCAJ5HK#{p}k#K6tco)t|ZBNgU=E1c?wI
z$g0~I5zWn@cCgLns<b(rqT1$I<#enOkL53KBk3pH-D=G?n{n$K+1*iw0|d2UtadxA
zZR<+hZf~V16^B@DvDwyDx~pxKuC*J)uUHdevpFhV4v!E{mt%v7CLN`ESti{<Ei&c1
zcaSvSXdvJ37~<Dl!jBoA=`7qV1fO=n`3gRGf=`Heof`n}p~#VOcd-J~^w;kqU&CGb
zmtMN4r)9)_j6tPLy^lC*tIO`wABfNOZ|-9_>iL&aJk!XYiO6uwJxOqT5wjV%oeZ2m
z<HCA*Xxtbhz^AbpVHxqhM~?hK#l^0Y3TJV#7{_}OsmP`W2oL_0meW{q*XwN$a7#4@
OAxG^SD))SYmj42|;m<e#

delta 1906
zcmZ8i3s96*6y9&)Ux9T&9p4zOY1#stps1iCts-flh`cN-AM5h)v8xwM*h=$(nod5#
z@nDXKSQC!s1GV35(zL=EMZwfELUXbjY<!IpBRX2=tfiCx%>DM<bH97ex#!+<c4u>&
z>Kko>Pg*QN2L2oqKA&N>Eebvmj43gt4~7LAn+&DVr+bu!l$fb926}M1!D$4KcQM~!
z3!vyhs4&_z%8o^t(dJK!V$m_6z@JT7tybC-i%ymkMuXuFkAj7)rL(b^7;O$&?@yL>
zma?f8fg5L4rJo6l+B5J>SnSz$ac9j#>ivhb-qsA3*aD4rl(lvA^QW*c(OG{GhtX{i
zq$fEr#)uQNb|kKte__-2#C(n)P02@hy(|&i&Ad8dJXUDed8NHxHy&<_<sr*G{g^q4
z1&Zp1XY|}RaV`M0G%Obh=2NUz4PZD;%W^S%a2+db{tcQVWsD<T)$^<Yjs|}Rf9iW7
zpA|UAkfg52zVjTfGSdBAyuksyng_jWqfjm}G?=DMb<UhON4bP_kzUA$T?^!JhUl;5
z<CX~)J$VjNp><(hhQ4JkwwU0igd&t9j4l;nKrfF3-<7xDZ8F?_&rsjdc_w^XMcUf5
zvOeo4vDm7t6jO}*h@dDhp2xG4<wb8Tnzy<1g<j;CqJEHYt_n!b)J}mS3B5CuRJg!=
zp4yD+qG-dZ(<0P`-WS@R3=RIuHQl3b%KV5BTIuga_+Y49f|6V-NwWG(K+dM*FiHYw
zFy-XWDs(BeRF2<8AV$`1((%RErVVAeNcSwkS8X&0%d7P0RdD;kOckp!6P>8-8a#`e
z6uAaYOCl49N5M5VBNrK_A6kP4Ms%ZtA0it`)UFg!+GwU!>7z>VDT3lzRsy^9mi35%
zmdbLq-fsgA2H>#XR1UWh-%<8fj7J?+ZN+R;hHS~C&`NB;M5?aDAdIG~mB>Oey|fJu
zt&j=(^<~>oWi}@Z`IKZNh2nN&Fox6I-H1a1?bwY47)#-MaEpIJ_wxQry4uTraGAcT
z#!-`mqT*@gK6pC(!I`u9sRXeUEbtqd_v6UF9KC)&dO=&q8|wAD2T&e>45Gs*?3TbP
zZ+n;fE$hgX)Xc=mi6bUwPDqJY)2a6ne2u^K-;baJ+82wfZ`tlR6)ED|6mS%;poP+p
z;+@VjMKxBgCR0Gpr&9fBT^@Rp=@|NBCB+>>lD3H#uIo#WVV+;RjgLso^yO;_1=b)r
zShQY~HQ!z6v8q&>R)bNTimDpKbP$?1$U1IR_T<s2=^62A3Eil{A$&yJkE4&Jf|px)
z6j(V*x!WH4UDo?`_c`+U$l+yGBH+8#%@lhQz5cW7b6J?@61THYVl#5cT#Md_r>I(3
zQ9^08h{8sFaV<2k(-o%>Zuyvv`Ek=KSoqlK&!=!YaKNK8iL0fLovsjRxxi+D{&GtL
z1O^IZP~(s2Yg-~q3#ANvbeBwhCY}VJCA#Glc>#SpEE8F7gbOcC<O$@ufLfEU@TTj7
zf5JJV@u86{jTmEEBZRf|dLxEtJ6I0UH#K5cNKapFKUK^T64S2?HmH3x;~IK&k?Qw`
z*zInQ-RV+=c4wZ;IaA%E&DRjoRhpUCWVidu{C#m$B~V6}uc7mc<t%&6cKaMpL80B_
zo>i<WMPsqsogTMyo>DHivsiUx9iO9)dS8bZ4%%`Z5ox{-@&A^fwo85v2|U$0q#G!C
z<x0+{<h?0*7^+0xrQDWEq|h6fhQa!R8_3eoMCb2tfqp@4o6#4uD5e?Darew_2BAT}
z*^E%Q<c~-_)v2C}$mdx4k4hAHSwPyzqnG9@)Iyp1D#aJzlh}M=?I2GJB7;sciIZ+9
VSfGE>f-6Q%!_eEow7M1L{{UV%5&-}J

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 1eb6d7f..8a0e911 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -757,7 +757,10 @@ def site_domains(s):
     proxied hosts (the Supabase gateway)."""
     extra = [p["host"] for p in s.get("proxies") or []]
     www = [f"www.{s['site']}"] if s["site"].count(".") == 1 else []
-    return list(dict.fromkeys(s["domains"] + www + extra))
+    names = list(dict.fromkeys(s["domains"] + www + extra))
+    # Let's Encrypt refuses a name that a wildcard in the same order already covers.
+    wild = [n[2:] for n in names if n.startswith("*.")]
+    return [n for n in names if n.startswith("*.") or not any(n.endswith("." + z) and n.count(".") == z.count(".") + 1 for z in wild)]
 
 def cmd_cert(args):
     s = site(args.site)

From fc6f772ae0af70b1ed3cc0f3d1d09415b8f956c3 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 10:54:52 +0000
Subject: [PATCH 035/104] dev2-site cert: reuse a certificate issued in the
 last day

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 129580 -> 129996 bytes
 dev2/dev2-site                            |  11 +++++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index cffe7deddb9f971e974abc8dead787e8076fe8a4..e55dca9289dede94a79577e456e2dcd928f7d858 100644
GIT binary patch
delta 2446
zcmZ`)3s98T72faP{g>zRN}@ra{0S&USeBPjFg}n+h!PPMqy)rucX1bC7w;|zD@ruB
zVoahfCf7`Y&rYj_4r)z*;xrm<$8<)F>%>e9rA?-fsm-7@fl)K5vG@E$t<H33{_mW7
z&bjAt&pmhh$AgA$1x1`UnL>5q_n)P|ZM>PbIpW<2{5wzjmCV0bj{Kf$TSL{te5C97
zfjLN2Bzsb<u<Zlw(COaR*^_(q_Q?LIKD{RBY56=Mdt-QKI1BeBY7znVsrT%mb2s~*
zx-U<#PwSM0j}*;0Z!#ksKO{aaC$%$7D5iJ9E>S?ir~MC~-fOZ)+RgnLeTE5V8%>?2
zo^_wcPhydFOQ)#~EX<d7FHWb4XU)arL@ija)F(|SpnE8l%>P$mmX>3-hB>`_T{o1F
z1beQwp23gJMd74pI;H-Z-yeYvx(;3Hti}FF9{mEIP!s2&M(TRJ!R59q7UuEzEE!f?
zvm?Xnv@puVKfB&xvngh`wb`LGv^F)_oK}}R!{%U$xw+ZpR?JzsxtU7#T#Mb&W^oGx
zrBiV_tah;_%RfWd`CJVyo7Lw~TwZUh!>+7%`J7^(&*@N_tX`jDw{}F%R$Okc&)U@F
za<5TbKDE67&q94~0hRy}JhTW4@`vRH=I}aMzevg(AwYTP#~u@+;b2>{y`EySzlr4U
zh|l|xp09FYin^x=|3ufgQD=(UWeiNo=x-g^aAd>a%n!2O%m3I?63BS&hE7+CLP?O=
zBEmAMLK@fUOiQI(0;{F3G#nFHBfV7oSy1>$aCpE}^ht2>-y@=TO$)?Zjs_q02l8q!
z*RB4v&UvZM8E`dzT(>q*+a$a-qgWd6(&<X1MdYtUI2R6y2<1{~xg;EyNR_lIma2$U
zNp*TbR_a#~snc7DSoN($+Vty*wCgwNg_kyc7p+?L^9_Q`H#mqi7}gMR8r%k9(qQn2
z)e@b<&_dD{!+cqgxB|lG<;6s*<yu+P8(AlJ>#u}G?9AJq_v-9DbB{iDDK7VfZ7}JC
zbHotTZ4AUr-S6CA6Nt*ZY{*g_&%qHQe<e;jPQADUZj(t8vz8`4?~6jnGh>mUu33qm
z5E#{O*PsTnNhpid8W(OD5v?w2K{@0&AzP{LTZer{wDWoG*o&w6U)qtA)IqME6wSST
zRd@R(UEp!srRl5pSL~|TGi~>ag8hai^V|-63k%QmV=9t(l^@CS46)6lcKNZ^n08Gh
z!oDNuCukSX1DhiBEQ4UZSf)zs&m_&@Pi)4;xVvO_UBIw`IqV)bM(fjLaEIUBjMrw<
z?P63kqiWf&iKDU@)xjwCu(83_<a02#Riw@)6U-vr82@k!4$1QbzeV-DjQ4}&V!^+m
zX6=Amk4V1%b*x1!58sJIjPdlHu$fAQ!2$7kM}-?Y(I2QMcjAtO1U~pPtiVDZ)q_mA
zOqd*3i+k`(gcb;%5e%v~cOw__GQs~&wY-VJVEj?Nx)*K<7x{_<IAyFR+aK|`gLo6Q
z{P;mUgEIcFgQ!9|pMMAia=S1%rT*j)4u^%6lko*QiX}X605h?GuNy!f3VGiEHlcz~
zKZ+ZI#2pj+ud3`AjqsQJ_s4O@NI9?q{>pFQiTP3-S*o7RBTo?oS9#b8oc`WM4V*v{
z<Tu2IVfFUA*c*&$&QHM?TPQ^SXotH^DJ(0mEUGVBP+z&UYz}ks<kR>7ch!HKMhv1i
zQm8)&zl&KWv0Xg)3>Hc{17Cgy8zy;3_5wAfl7I?i%k=!GPCUhpXOWH9dEQx+$oqui
zmb&#UTJ=%A6Gp;PJFsm$<Qx`7kkoG!&zH}muw{JpITVYtID8JdF=XZsRTdYos4p#F
zwtNoT#;>2lN$llEKEyQB&xKkq{vf=HNRzr6uih4N{S+;b7Ne0uZYR+Cd4SJ4kEDBk
zwUG3Rim=V+(TheNHiTpp@XR47*v>14kcnP(%MfIUpxqZR-E>$uGf~j4`$7M70Uw3r
zOw>f7y6*>lmAD-Qbo*E~wJC>S20=9+`4lOs+ep<#1E86^XsNk)kbDivcJTBoNQrrc
zcxs6lxk}=zxZ?_jjM~UK)tR5+vIL2Tk6@v(hxEI7?FjPa0l~+rZ;xOwa`J=OO`}Bq
zDj*e1<&C3=pG?E<k2IUz9y9$Bm~BpnZ7utb_l{y#*lXmmpWq$-#V97F92C4i%xrG)
zcztG%yQzcyf+Qxh+2(QES{ZY=Z5`}Mo^TDDQOx&ULt2G4{0~n%J3<F=lHie7fd-w?
zJ!Vt^qYK5T^X$iT@u(fFl*e7iY80rOuA@rEDF0+kjNtn`d>kog;kn~@T2!}U9D`W(
z$iwqU7FsZRPFN|yA_969Ca#Y*e(ki>uD_PlgM7492Ds-Y(s5CJ=O(_E<alI%{VebK
H25<crx%QhB

delta 2124
zcmZ8i4N%lo5WnC5fBz%zI7p^KO$>!pz*7><f=oq8g+#ejKr27)P!Q)X-kll8<wyBJ
zR1O8>vkbGeqJbPK@j2OtmQ7Y5$LLf#+2=IXR7#{trA@nkBFme3zumXH|J{9Wci**L
zh-y9;74wnPX}8etBlrFliK**jT4QkbR?TY2b@P!~_wxq3nwp7Gx-D#Mw|JA};u;K*
z<t{jp+{>qXV85AEH-;UA!^7}u1IZonBmTpWY;byGy(!J9O;!$Ou{;<Zj;^ctV(@4Y
z>rD$s-w)vkruC{UmT+_vdU;raL;IxO1n(#_=FqU_b#ahBD+)H+%x{c|=?$`f4H6v*
z-kZ$**ap3>;NxUD#tM5~UXA^RzQnv4VXb*wlinAr(vmVhKNKrl@^P(tZxR-0YEL$@
zU<i#&)DKfJ2XM;F9Aw)?Gl>FD0=Xpz368JH<PxpGGJR_~2B}C6zQfwj?9S?CkpXFq
zGa54^<BLud-}_0ix3kzADOq;BczL9#w98^C!xZhD#geT}*Df%brTx-NNSCk8(SGG!
zfkwM2nwyDRE7plD(C=natlz`r9=(Ez&;v|@dPpZPYlU9L+X_9*B&;v75?N~XF!5Sf
zSjlFowVZcLtSgzUw1%0)KggJ4<Qhcg8bt;r=qNVUP5m^=zPWOJ<%X)-HH~+5#;5N~
z+Uwaj@-u5xwJj2t+cv%<>w~OF;k}VXi#rRK99Ic5F{_`^MfY-z^1I=4IzhLcOe?UE
zgfe{~5>(V;)b)d*wwGZ6jA&9$RDY~Mmkn2|A1g2$#vqavs!0JnYeR+nq7pkWRIUjj
zBT2BU0aS&a?=3y+ERkzGovBNA7StAO8(zPV*xyBxJQ2d57%d}JxDmtTZ&gS(#?fb`
ziW;HZmi7}RBDi#-nc)FyJu#5<!o{$fwkeu8%~F?aeFz=b|HWoM6P&V&60cu$^Zso%
zxG0}}7>{RhF9<%g;M0m%nB!v!K8N7gr)<m0Rt8Ii*g&a^c!mkA>z2zmV3%<_@l`5z
zBi@WMrV+nIbv_24ju<()7UdWqn`?0cx@B7}JkIH4@HDN!Puz@jqeIk!CvZu_U|Cd;
zLd=wV>yd8ckx7&KwjM9RKACvI(4w|(#W)yl;#*aR#DS}DSXJ+YPs34p;d#7eD`eXu
zd2koDVxe^J#?8o+kL<>L<jXI2V~Vkw43rxF0va8Td^T?9tC%fM?!^R5k^Nh6E3#!?
z3)Wzc{ICUGL=L`6-+!gzUgL@SMtb()u#IyNlVxfv{Bb|fm8Ixn5_^ha_)a#p;_ZKI
z)P4Jr1f!llIIgxS?6?Yra>5}52WFEf)W5`cf8x|TXV06qXj=B7dG0$WiskaiAsj-F
z+ISdo=pW`#N62r!7{lxu+4v4}wcmAl?j2NJ=VRF{F3LOxKA>>x@}?EkbuYe)v3Ojb
zd>3~ZJ4n%`l8<1Oe)TiGMr3JT*e3b%`^bx7X~>pX<_r20g<EPzL2rkgaTMd?*eqmE
z%+D!YG-LK%b0>;Ta?4S?js`jN0}OZWBK1XDfkaA^t2$V1Be_1v3}nVABekezFzdNf
ze%gklKEGzjU}*`5b+)4cWwNOq$(Sr7?MOtm{G}b~ct#C71_KmyWCv26FOf4Fz0iTR
z{|2q<z_ETAy=UT3oBs{^D04LoI~m4unKBs0GZf13NsLI@#HzJC0H%2<Z%r4MlP_jj
zjcg<HxJQ`hlF-P_WqzJCPNB_aj@)wf$tj%B0NH#Rxwa=+Uneh~My9cc_&AmIIS$0e
zU!L7GPULHX6o~!Oeg=c%dDug-E|<^m@|1|6%Trq7DHoUI#51_X@fdsLzXP#dt~-P4
zMm$G+$l-F`=MMy3e&5PU@d8VnE|<se^Q;o0#OJ9L@$$_xSdVFP(pjVxn8W}7X%{c^
z1-#C1#jC)BF1U{cpFnU!39h`@$c@M45Yy$svsj8uHKYsk4g4rqou?6eLpGns2>9iR
z^B9H-b>Tb?VDS|X&lOpi!T325(;0FZ_*Lj_A9MUx^VV#CGpWn@n5pcMu{{`tW9qgZ
RbZf@77~4HsX8eh#{sz&4NW%aC

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 8a0e911..348c77e 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -779,8 +779,15 @@ def cmd_cert(args):
                 sh(["porkbun", "rm", zone, r["name"][: -len(zone) - 1], "--type", "CNAME", "--yes"], check=False); note(f"removed Railway acme CNAME {r['name']}")
     ssh("root", "test -x /root/.acme.sh/acme.sh || curl -fsSL https://get.acme.sh | env HOME=/root sh -s email=" + ACME_EMAIL + " >/dev/null")
     ds = " ".join(f"-d {shlex.quote(d)}" for d in domains)
-    out = ssh("root", f"install -d -m 0750 {cert_dir} && env HOME=/root PORKBUN_API_KEY={shlex.quote(k)} PORKBUN_SECRET_API_KEY={shlex.quote(sk)} /root/.acme.sh/acme.sh --issue --server letsencrypt --dns dns_porkbun {ds} --force >/tmp/acme-{s['site']}.log 2>&1 || {{ tail -n 25 /tmp/acme-{s['site']}.log; exit 1; }}", check=False, timeout=1800)
-    if out.strip() and "Cert success" not in out: die(out)
+    # A certificate acme.sh issued in the last day is reused (a retry after a dropped
+    # ssh session must not burn Let's Encrypt's duplicate-certificate quota).
+    fresh = ssh("root", f"find /root/.acme.sh/{shlex.quote(domains[0])}_ecc -name fullchain.cer -mmin -1440 2>/dev/null | head -n1", check=False).strip()
+    if fresh:
+        note("certificate issued within the last day; installing it")
+    else:
+        out = ssh("root", f"install -d -m 0750 {cert_dir} && env HOME=/root PORKBUN_API_KEY={shlex.quote(k)} PORKBUN_SECRET_API_KEY={shlex.quote(sk)} /root/.acme.sh/acme.sh --issue --server letsencrypt --dns dns_porkbun {ds} --force >/tmp/acme-{s['site']}.log 2>&1 || {{ tail -n 25 /tmp/acme-{s['site']}.log; exit 1; }}", check=False, timeout=1800)
+        if out.strip() and "Cert success" not in out: die(out)
+    ssh("root", f"install -d -m 0750 {cert_dir}")
     ssh("root", f"env HOME=/root /root/.acme.sh/acme.sh --install-cert -d {shlex.quote(domains[0])} --fullchain-file {cert_dir}/fullchain.pem --key-file {cert_dir}/privkey.pem --reloadcmd 'systemctl reload nginx' >/dev/null")
     note(ssh("root", f"openssl x509 -in {cert_dir}/fullchain.pem -noout -subject -enddate | tr '\\n' ' '").strip())
     mark(s["site"], "cert", cert_domains=domains)

From 0c29994e6aa74eb934d4ff9128390c72d96b2e3e Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 11:01:27 +0000
Subject: [PATCH 036/104] dev2: README for firewall, box-tune, image-only
 sites, companion ports

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/README.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/dev2/README.md b/dev2/README.md
index 158ea9e..1f11f36 100644
--- a/dev2/README.md
+++ b/dev2/README.md
@@ -38,6 +38,18 @@ dev2-site migrate <site> --yes   the whole move, resumable; each step below is a
 | `supabase-storage` | copies every Storage object through the two Storage APIs (node in a container on dev2; resumable) |
 | `supabase-cutover` | re-points the app (`env_overrides`: URLs, keys, db password), provision + deploy + verify, unschedules the cloud cron jobs |
 
+| `firewall` | re-applies the data-port allowlist (5432 + every Supabase stack's db port) for dev1, loopback and all Docker pools |
+| `box-tune` | sshd MaxStartups/MaxSessions for parallel deploys |
+
+Image-only Railway services (a stock image plus a start command, no repo) are
+supported through `sites.d`: `{"image": "node:24-alpine", "start_command": "..."}`;
+the compose file uses `image:`/`command:` and `deploy-app.sh` skips clone and build
+(`IMAGE_ONLY=1`). Companion services can be published on their own hostname with
+`"companion_ports": {"name": {"host": 3361, "inside": 3000}}` plus a `proxies` entry.
+
+Run at most about six migrations against the box at once: more than that, and
+dev2 (or its provider) starts dropping this box's connections outright.
+
 ## Layout on the box (every site the same)
 
 ```

From fdee8ed3c0e0a311f857ab68230a6c40c79f05bb Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 11:05:46 +0000
Subject: [PATCH 037/104] dev2-site: db-create for Turso/Supabase second
 passes; Turso variables re-pointed once a database exists

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 129996 -> 133472 bytes
 dev2/dev2-site                            |  39 ++++++++++++++++++++--
 dev2/templates/box-tune.sh                |   8 +++++
 3 files changed, 45 insertions(+), 2 deletions(-)
 create mode 100755 dev2/templates/box-tune.sh

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index e55dca9289dede94a79577e456e2dcd928f7d858..a00a5028b4ce645734f27f2b1eeb5d87e97e076f 100644
GIT binary patch
delta 19639
zcma)k34B!5_5a-2GT8$pfnWlY1;PMX2w`6X1dKoeArKZ}Nb)9OAjyO~lY|V>#2u>@
z>{B0B5EQjiZGYmRL2ZA<omQwpaC@Q^ms-@iZ>6>V&-c6}6H@K(&!?W;ckj8|xo5w3
zdi>jnw}0V?dm%P9%0&OJU-{_fWs`1>8zzzuWye`k8kCf)#o8RDQ5jBua}}R*5&g|m
zn$%Luxb&?`CVfp&vaU9*ovMr?I87N%aJnLuY-*XI9<`+W;)cl3?<^}tre9e^brniL
zxtRX0R7wbQm2wHeN@X#@)k?EkXseG=Hqgfw#Z9nY-ESK=X5#|_YcrYFHYhDh6?JY@
zs;Skd)DUb^6oOk7PnG(EEoH2-nZ8<;Ed;lD+LZb&V@xLLFq=Hv9xw(m2~(T7&FpFo
zO|}PON1soq@ijD5H7d^9DsR0<agI4}aZPvXg8mn!o6cpO|KW$yb87dHUx`_vZHeVV
ztsfM*@IzXWW>SP=RxI?NwcT`wNwEcbW-!s$UQ4^Ei@3}du=G|c_TGIgFs)x|GF@iZ
zUf3r_3~RTwo0SM9qTTwS;{lt2eOW|%gnB4FF<FV+GR0)_+uH3)6mP{WOpR%3Y3+y%
z#ZHycLFy2sUcF-r(~V_TQ@cgBb@Yr7gAwHBKz!dqVvWJ=wB|S^Ui);Em^r-N_JG+y
z=pBh#6WSv-4^v+loDw@o8LXIwW0zE?K6!1T`sUz>ltIc6qjs;Ox7U@T1AWAhM6)YV
zO-au0I0p(;xU4dR{>n^%EP&Aj&iw#@iO=DTB}y_IfR4>1T>xVN#sQ26$RXg0lOU9C
zlU0p%9+{8&2>=DCwFbNm9^K}z_jsD*#17OK0!#v!3_t`i$*BMd1Y8c?+U)m8ISn<u
z%IPR!fx5Ly*0tynRe^w~p(!9|Qk~yHz}fRp4gu<%UO?w+@{gvybedj^8MLc#_sEX>
zv%2%=AG029Ikx<G+p#U(#cR7Sb$3T^>|AhW$gtgmZkxIz;!I5P&eH2kcNgw&eyH%6
zwR_e2(=i)%h}WWHcFw$h=I)6vMUU8@egE>i#~-qtam4J5x;|>xgxwMQ({GPHIV9_4
z$EeRDOo^$VJ4}w)U4yjLn^X4>dTCI`nYiKIX*u_+FD6EI9P$5Q+hf~~TaFjMxcHBY
zyVtBgb@7H%bKKptH+FBV?p8dnD)lFo`j-^h-6XpMZQX%jcg^<h>h|vT%Re)jip=xO
z-{Mb+`E%pX7x+_VrnaTVpXKIN_*!nR#Gkq5)%epP*5FU-+GO*WCR6-6d_=A@V_Q?N
zpW0a#dLubs#Nd$6TXO>qO>&$%blAe^@Da^XHx0`W7ppf68)K^=v`Y2JurKUoAa<ep
zP)e?C9TnHB@20$;vX)A8<^fNW-xVQIFDn7c)U(5#*=RM+4jkrm@~P=j^}Z^_?GIE1
zJhGbVH-yGq^pse>jEcI$v(4)dxP4pX5`2nQxq$v26uRBpsCXI!%$D9xI%!uF&!jsV
zs<wC(uk_2+glR0H3MIEXBP~;`Ro!W0ZIUXgLN}$|FC6Qs=!%rp>g<uzhNGTDgm+=Z
zE_9n`TR>JxpL+AiVYW_ct_}TmWVR^bA&sq3C3ChOSy8-n*^;7);uX48da4wcS+_P;
zHF)G!Lh<+CvX#hOFR!KQ&7l$LBP~SS*;(5<+!$&jz=gx>QJ!s0q#Pk0x~0w&khwt0
zBcNNnM1@v-Zo_A6t@Jf`{k~eCY^VyzM$|<@5{bTav<rcl55R(&MkSX;x75_u=@ySV
zdDKXoMpeGh+EM?sil3>g#*U}~!Oua?<qZHg5~z?rCm4*Cq^n!2+MHEQ-sw)SlQfLn
zkA}nx8tSTAJkI7O*AR*Q={BXgp~<h?J&iR!#UqQUPJMmsMRk~1k7$<lz9vs2Q-O#t
zrBCXS7gtm)D@IYK5|X?cfOoP8rSNtp(kJo3?Wp}F0X;$zt-Kz;ZmsqyZSoSTQ>(`1
z*&e0B_Ry{4yyhgR68Q*_g`Ybe6!KAZNN&FE_f&af=;GWoVdtICQMcr6bATMg+OyP;
z@(NNON9QNdIfjm=#arWX^MM~$C+BC{j#0y|(1!e}Ld;RM30I4wYHGnnLo3mVrDrEf
zPZDsM<;7}g!5G^M^r3~e7wi<#eG8LE)TF}n^v8f_mwi*p-%*8bt0h(s=t7Z?sFj6T
zwo_EOC)8QE$~^Tn73C`cuL8VIfcVkZ=y65r7QZK;+q|Sr{b62`PXX^~HExPxJ4eL_
zLakHwi6P8pwt8QyM;<im=G=VwzUrDbO&n2crd5h})F-B0Wc!-XyFzbFdsK)8>Mv%@
z5-+LUGp5_fOqw1K#m@|ii5Q!vZLXG|phP-CdYfEAUPE7gLNoPf1FOHjxlTq>%~PS@
z&B_;Iocj0K<#yi8$7=DMStE84GA~uP5sTMs0t5SH4M{>nos3cU&q=clqVCUzo|^OL
z!J<yRxjaR@s6J3WZCE#Ej`1|Mc%`qgfz*dzH+vO%jry;0Pc#-HM^Z;QO08cpM*Lg7
zbwwNPCca|Mpcqs~6VR>8%E~K9L%J(2TF%JmM&j<P_sBjh`EQJs4t%pxtvi%z_ZHGu
ze)%zwZH+Be(yu$3d@|ssqAbAZu>`a^cZ+28Y(>#{9tx~hdXNNEeunX&MdT3zewcEn
zv(qqopR3NwEVD_dft8a<y*;pUcE`8WuE+NXp<D4aRCycyaw4WF1i&)nWGd-V<aUu}
z@%kG5E*qbPK?1DZ=)k!7_?!Un9d*3`lNS%t@P28n6NI{H)vhtvL8+Wdu>bmX;ro%*
zi{WZ<<pcHrmes6&Q#raL2?K7zH~fxZl+#bV>UZYMc9N)kfckkDd8$lA8RD$RRF;)5
zUa_obezCh`L66lz;|4TFmaQr-FE3e8yn>ZbSjp;+^5R7$D=Ny@NHUHl$;|bZddKQf
z9gu$sl_FCBAQAr|E2w)G030VF1-hl))2K&y{ff8F8<3CyuziF4C(yvx#QRP4)N~oJ
zqZXEwuc&Y{SG^4kvgsx{l)&_`R+nw43<7KiXa}$X*a_%X#ak1QXYsuSpk8fTGp7Tb
zqDPU*P~6}&zXVNnbCZWHu%Ys-Bny7|9y+}bbZe9JDTYF`H~5-aKw3PynFQtpxBFXa
zNM`&VU3hgXF;zgm#P!5ue)$f@;lp{?WEw__nI<&2=6Ob{YHIS!xoX+kqzP+*x{!$h
z4)n_+ltm4xd@^TkScs=ZCZp0KJ#})cdh6N}8}!79(7S8jie4C2qBvi<lv*UL*?{9^
z29!x?7(zgI&|u_H$TrzbJu*TOb*lLiUd$?L?(rcE<y;8-h!rJd&fN=`i)1Bc!LbdP
zg?JLwmNV7&yiVIT!Wt8b+}tUWn2l$m7Yp<_AmylcZpkge^b(i`+pR<i>nCA>Mv)Q~
z{e<1nj_jE*C<w*YFS6Kqf{E%{-!*pL#d`I9-=d3c)S1>)je*LIGOy1^75)7X7NX#=
zng+#PPgKdBS?{Z<s`t;%g)`RdpQQ$xR%SrZc*>w<=EOoH7{I{<&9f&3%`>OTkJXQw
zvO6#*s{lC%r9NF4v>USPaxlq_?J|>K_j&|*Gvw7vUW$zCTd_^9!!UhhfQoJPGnOBm
z@5Dbt0j>t34RCtswyjB)h0vR<JV;UTi0oJ0k6I=Y=t5Q=6ZE${4$#5B$=51(P|GEu
z&jTARX}k~g3MM$cey6vgs?L++Ypic`j*-!7<F-_hqu#J>T1PFR=;pdjx~-<3Ol;7c
zlXKpjv(*)Aa3#)HcdRI%?=CMZtI%Vlr@`0a@i*7jdbjn{Rd5K%ER*h#MzF-{Z8K^k
zsE&P$S@cB?2p=d`r(1loE{?f|CMPe^Pu}YCHkWNTHI{`s+FljnCbe?=*jV(G4yq-y
z8>8N|eWYzKeXI{XynU^?g8iDvero~$8*E>N($xSk;__*LX9>_MApP<d0=l`jkrj(>
z32Y1KmMxw(`MkRE@(kO(G{?r!b(c4q#eVgh&SLQ^b><bRqgl}okYY?p0?;=oZRGMR
zGHk!55$Z$tUXdb1k@|-#Gqd;<zr)nvx}Y_;t)ZUyori?SONV<zwO=*D_FHQ9tFEhF
zAG422GKau<$EHA_$v-_WkC}l`(T!$hg5IKzy*k}?nDAOc%dXZE7lXpV$Q3nJwY9!_
z#c43meVBSKfuPmtZFG`L?hVjs&nIupLk@}DMV)lJPm%>_4B8Y=OF<5;R4urDGHt+n
zd-iy&U3awl<d%T+c;wp{%A7MV7-96ulhbJgIRjvp`n%iHh;sVvKP!0(6#%r^XHW*9
z@^dHyP{ff`TC$pq;NlhT(y|4`ZZdl-O3F&*^VCX#x~I<5xKQ4&{^pklQts;QrN=aq
zC+=?XNIy9ObZp)`CPedGJjrwFy?1!*th?&eggv9^04ML+V1;3Z!!la^-#tq+zNfEV
zL%#`giTWNx-y@};t2ukK#KUU&-dW^S?b_=X2UY8xdE!B}@Xk4|pJVZs;GkTh<fi88
zJdmcATu#5dAFF(o01>E2&I|3i^Jx)v6J{_sNm;6T_m2^KLciF*T#Px3+IWA@S-Gnz
zEkTFzC~Bh=U(FVetfkzNd`OMHJ3W0m7F=MQCnUw-9tectQ_NDA-aRxS%%Cb-3e~{f
z&JM7c1Y67Bqr?U%7bSSg@@i_(?fy;80dKu-mkoTvFz6C|tlL^Qd1+OUbi<x3L#?&0
z-bd@@{s3V?tEW%hQC;QtK>GFQrsj_7dT))J1k5iZsIO$*Vr`^ARgd&EHdDNbNctHJ
zlLi28=2%lgkx0k{YXR9wpDw4NXqo$2@R(la)_@+-+CxE>Z<}PV)hxHDzc`SU_#TFu
z2Ji?0-P~9!52$}SFgguhs&3sxahwd%OuD(X*085I9ku)1ICbhhakdyU9cXCrJ=xLZ
z-~0b(^h_pQc-J5?F*ckM!wM3<sW)LjyKHf9ZT8VF6R7@V=;i;pNi4h)U91v}sK+l`
zId4hHeD|{Q;)Nxv$?5Amo?ag1^}j>71KrVshcd<M>WM>_j66%N@++Xw%1s*$WAiPQ
zCBSRy<cFu2-?D{#56>{iTHzupgE=?Yu5BGJhN}59qQn;U(BX+<y4n^RW0q-Z(G5e@
zUH==I@3$(6?e-Qr2Ff|w(Y4*$ZbQJ=Zc~z4Xu=z(qGp!q#+j5ww5nHRBo0%Ody#un
zgu>J=l%eVahdq{|?RK@um8#}F61#X<zrj*y5}Pu#U(Il?xu{=FD%Yg-s~N#dSgwpz
zuX`j@buWxmLyr`tr_*d1SnM50Y}%B}c1w`H8ikTZ3CXNLs+u+?Rm(grl0>TJyhEgE
zPj`qRnloKE%$u{-B6WziZ<B~t_dU8uxYW62iRwQeO|oQf9;a??AEN#6fQU3J+3JL@
zp<;|$(zRhs9!NbIU?RY2noEySssdFI1~(Y&HL8+-S6}SvxcCH6f&i~lWiYbdTkYRk
zPg*`0nHy-9eqXNF=Ms8C#me#(W$vPt6&JfJ$`%)w>M;w7DvIV6ttfV{EMG#t%$g%>
zh$TZuatw#crT+EE)Q$iqY6gJTb0y2OD8B^&elv7ODQ53uw0<HCe?^b=`|F#kWL1OT
zO}QBsT3Lo3pJ0GifNcP60HA9>SAPQ7oE-x4qQJC<vGSqx9Kc}!W@(m~2($Xf$I_!F
zQLi^>3jckfuO7Qv3`@MCbyxOF5h=T?_toBByMM#!5rtpbO-U*0<xiw8+xn~ayV@UG
zd^&sX(Z$^>Do!q_Ku)q|>&cC>yK-&!x=T-1u752)p*zv_QoQSa|3ecFwtQwYC5`^f
zZi<ZA8Fzi$uFLn!`*TlbPdn|H{#t}1)cVAI!uF?$!xy_k8Nc^fhW`zl{T0B4=37ow
z?>hRBokPf&Q00?vnz<Ytr{4AKc(wMK10$wVCsGEV^=|S47xr^C``IbxD6_ip*+MfJ
z+1s9dPQ<C}pBrri^rJB0$LdYb?aN|CYbQ17X;cgco?XJp7#2E|e6?%T<<F<tuRx#o
z)xh)VsXtIrk7BRS4X;loppBK~RqCPVFA_7=6VGRvE#}ad&o37<VyQJ4L2*tlsVI3I
zxakCF@w0G(JTTm2J-#pQ?g`GWQ9J&aK9aF!_n~s^Js;~^Kp;3mo$%a<M7apVP9-EH
zLH%CJp~Zzh|6_@u)WM7wR&+3jT1qR7*xM2IijV~Jkx8OX9vR@kK!PT66+j`);EL(T
zSaYz9xd0r%_^@nqO%n%#5_FM8Xk>z1MW6l{8eyYTjXmzPT|zD2hYF70XDNZtrJLRE
zV6@_Cs`s_!u;Ee&w?cZbt0=#J6Dr9wVaJIaDY88trC`#e3Dd~vmm0SYN7VH0jOnlo
z1AWxhsAD6{_U#rdZ5Gv$s%P&VF*hZkFY8XTmC?Ffp?%$j@iUnTvAAH=GU;pa!u4^=
z8-WYj1|ytf5H>rFAXK=*N{AGB{M#kbuV7jz8(E;%yuD*oKbH-IKym5TiTU~YoH#O;
za$HR~>+V3PX>95tV6tG~;zb?=fc@q3CNG`I&(|;DEF-eI23s>5{n;slGbDcra0kF1
z0zpS^lk~QbAFxn<Oy6`FBbz<JX!fquPtHcfEWsYF^gUPpOcn1mi?M3!I|U+L{q;MA
z_K_H8zWUxfhZ8CZ&sdVN*3kX$Iz;r_*ugu%dO!5Ud&kXUsk-BX68oE|UaG$O!Q764
z{eX)-y2cpdUrngGrLwZp@V1~L4Ngr%30B5%uAsx@A^>){*i(ZaCD~JB*9OeSCfNv?
zaP+dn0UYKQTng#Y3yPO5DO=-SxuUqd-{n&UaIXbm2Mw_@dqonA($5`(dN5K!?59+s
zM;X93)Np|d#X7mtOt#!m)WtLq-CH#^xk)4Fc5=?@Jc=PXw_pH1ZFZC*pb~r}niRdA
zn=Rf~cb!YlxCawku^4bM`BjulH#{!emPTJ|BWbK-=jPd<5eq``A5Mu9mFl9e3Wph+
zp1)+}ii+ZLcX8<|!{eK(s$XT=S_pf)`oveiBIKH{*Nw+*8F^0JCuZ3q_x!TbilUOz
z{*<D?!b0|xboGZ{54UZn0WJ?ke)E{HGvCIj$G-K8kJXvqja|+`7#|ZK1Z&qR*eRa~
z(rGjmD^MmCyPPmzek%bd{WJWmLhKpficr^g6(T<y-&Rn=hZ3ZhqI;g~DJmPDFq=}I
z=Qrw%^QpGW3H651rRPV*MYFgYeuQ?TLsZ)5Vypt~oI^|!)3lM1Vp4QIs#v7H)7+6_
zdlE#gl*ACU?{yq!YM(}mq2hBbZ?G64ZqY_ZiFsmy=8Y0A>nnt(Eo&3QwTGfacIH)B
zDU8>_9^(ZM??U5cjB=Zn5-skHhBo3j{(Qbx79)mfXQM^x#j9wP^Mh*WLMh;J_PRgL
zjPnT@PGSI$bQ049>ZHfti=>3H&PVojINwzqBg~@Xd}1#?IY)g(j%Lr>r%x)JSdgcS
zIdTlmdeADF?4z)c(Ew=xVMWJ!B7^Gm=w)RqDi)O^RW^_BiO$F5NuMu}$Co{M9H*a;
z8?|PX_FSwOA}TdKRxGl!qP<z$H(2Crm2sk4xU|RP=sad<pT&uD;$uyZ7hbVVTaX~6
z*rIhMh%;iTcFQ2qmJvs@8tLU8;_4#sW28N%l@1nT#q_SW!6H%Qvo3`(Ev0VEDG=@6
z^EplB9~<Na?aUA{&4_rf2#I7ZFHzK`-U(vt1K3aC$NQa36idZj+Q=laZp4)|Eu|Z7
zra$u2pWuWOT33?zE)}Tq9t{0ch%ag%CKLbNt3?hKt`6qzYII`t$zs7e>pQR%t2Nkn
z34t&aE_8r|92-=C`lIZHPu6&h1SczG7D9=RxXLmVaw|#$Jk<_lrF948Rcmq8Xxzhx
zC4UmSya2!|feCP-3YBNk`V@~+OE)Ey?3YFa`z#vTuue|CR$xDzsAm(=Nv*C7*@0AE
zKc%vXK6Oh|ou7jSw%n90Xf>RKi!qD6sgA>0J6#;Pm1@qLQ?O21IhuJIFsy!W&_l^A
zUybDKwFMW!h;`Z7)+1|>9(R*Y)a?Q7e})PBq;hn#1nL4Z9`oC%<feo+W~h;SXbZZf
zx=N9+p;1&DdhBZL!(n2o?RV6AQ&)D1Xo*b2Sys5rhMD{|HJrE9P~wSQl}ofU>%@HR
z`wS5)4rtMtV&)`1di0lTK!mjb(B!fPb=3ekTsCVoszE8OJySSsN2&3oc2}mjN`2^j
zq<Oko>s%!+nH9j<^S^e{`<~=7OCX}R_JN+lW!6AsZ=GUpw@?sh*{kkpAC;<DIS?Mv
zuieJ&_Pv(dc8a9Y5%}6`?j4;T)5Hg2`^IuGZscC=hh~u+AJuN@7x0?ZoBx%V(QZ+q
z+pS7WyOk!54J7n-rLQ>d9IyTPcGA)bYRTa&2TkQr2JNwGpDq<i+N-}2iQ02HV(`ep
z;c){O^$tNn_7L#a<}~$+ok@|2y*OBRMpAgiZON{o!Cx0OI`JT-txx4@H%E))4kunR
zc>{iD|KJj-LL}Bb&M_5;NJ(+iwaoM=7`?zI58a|SW&54WdbGLIU$e>6P=%y3HPn0Q
zO;mMTFP_sU@wL&2a&wyMoHf2i@(cnw+-qXhMpv%EKs&$y*8{+g$e#h+0B|F~&jD^C
z5Ny$+6U4}f8j`$iff-s<f^a&T>f8ZY*I;~gG}YC}wx)nj?nI|u0CR~>@@ABN0RWpJ
zRRUyos&fpB#U>+Y89R1ta4j}TLAJA%a(uj#rYgUmGJQlU%B(kX74G?n3I?5!uAAZ9
zNS9JA-VQkE8=aDZH_B5Iaj8eZ2ihRkDs{z&{Ypd4{fLI^r`lLWhV@$~b`l2wpOHL^
z0UBkZm_Tj6rM(Tfeb8fZYd{ygJ==YnP~HGquF#6!63&7%k%_yO-!P(c-suq&PK}tj
zd+?cv`0l~;jusrvI$G78aPg^#l2;?jPDYfSidf#ga`j6QtF`XoB5TT-sJLAzy9;(_
z?XK&NAALG1`;0Z_Gm|N9A)fDCY`(<&mC0mVY<|sZzpmtplHD2i4?jBZwe(3^(?w!>
ziABWEBLrcaZ+_1jw`1$B<m=mZXPmaC?FsBJ+FyHD$^F|;kDPJF8o485$A*(psjo(5
zos7!bUw(hmsi?fu*8DS8M|Y&>WoxavxBjB8oGh{5V%QjVQPQDfI4DFc%N|QGs?q0c
z@zqoI(I0jYf)T5@%6Z;Q*CpA6OgFhp=eeACq~hc_OLBnDVb^LR8(%L4BLY>@nKR!R
zbU1TrYMnXGT&ZbG#)v5$%*nffcmU^=(C^S$)$y_R={v)0CE{4w{IMYl+a)$hZ0Oi7
z!5yF*zyT-Efz10Df+FB#^5to5bZ6x!f4HSa!kEZu+Ax<G6?=@9^&yTPu7H-GB2v3*
zUE(@x607JBKq~h3IVg?R%()`lz8qW0(eiRdmYA+p<O<K~K3k5P&sxL9<t?y6XVuPI
z4ex{bmJNR=E$2U(_eD%{SR0flM#gqi`5*M3{~v^kMW%JF%@b$M9YO5A$D_{0uGrqP
znf??_R(iKU3246&|MwE4&u#BC+;-4Em_mweOLcQ2=cvP%ibOS=g=StxINx=e-WZg;
zqv*ASL7MGm+pa3@@dBYw3ws4Su>?23Mt~{+Y>}3@6=go?_ozg-(OaZXJ26qD+aY*n
zOV?Ku#ZhxMr%9NY-=PDXK8Z~mk2B7rgw%?9@}Z&H7n8-_!alT8vXgvU|1WCq@%wcV
z<ed*l7i&*X5n1M;7VX>=;ak9qLMO?&Ku}P3fY&+a@jV*8z>qz+cL)b$2LavE+S)2#
z#xb4H_DmHn`@2+*w{*QQReWt1Yqclmh-C4K_SzgVO?;;fo-4)==l$?5ULjoFT<@3f
z(tH%}Ypdsq5ks%R;0R{)sGf%)3cUd-)qXx#6vl$7gB$2YMZlS}P5Z-qiZ%W^S1h%{
zJ=WO6U0Nj8W%jWc5#%$BhiGkpqx(XUa0*w~$3^0h5XZajoG(&^p)0Tli6b#QPL@D+
zO5u;{_Ih#`y-j?^I=wEcqI*jg!!YwPIhkrK(O`W&s%ZYwVt4V<qLL;3;&}Gt!5)U2
zvm~yc6#pC5;1sEYP!95N18!WfVl%omNVm0|Qp20Q8ovyo)~xu+8>X0Q6Uogr#bUG_
zGLvHII#ewF=5W1<O)-BlA%_}-^gHwD_AjrIF8#LUQMQ*Z7`3NL#prRbW4|$OchRzC
z{LsVgHj+vSZa1YP=!VW+TC|ixC%1HIL(0TB^L&#ww@f@H#%kxw#1+xcVmic@a(UOa
z%fxa~$862y0g?6CMxUFvMJ_|l7Q_AHtOkskaVr(3KI@VSG;|W6gmPHn@xDM7<B7<>
zwb|ujye)!+c1oA8Tx2^Ecw){3u_dU~?prG+Q=s<dT2Y(^N(Uoza)@re`W8>nHodTL
z;`DRK3(5uBoONQPcuRAy6T`(JEx1mk&0@9BA=!Ft!@7`8H8_Y8Z{Eg6@^{F*<L=bO
zY#fXw|HfO}*7HDI{%_ambz-^@tGeRXi!ViP2Q!s{<4Wvj7nn?}Hv8CFI<$N@xoO2%
z88h8NlokOntFfwOEeltWuk;LR#q^^V=P!`DkyyRKPW0fA_s&lZ`L!Zl?fK|U&Er5h
zOoMTn6fU3BsXgl!!(xXKc^5%1t|JsfBS&l$FFMw;K6)ShI%yJmb4f7hSZ3%}r@Rj<
z16R-s3wjq-<dnAocNMDZxDB6w1%P6ZAD}cB4GXk<ugIIp8scwM3*BC{q@-wt#2av3
z6zSF?`X@g^kB<TVPQb_{$~Q4Ws&<E0Of|$jfC}7=(Dh0*=@@ryy|<~!qflCmxrNn0
zA&^-3%dnPZ0IcjeWm|^U)c|h+Bm&q0S^>5Jv;hPG_yrWaa@kRZ?|J|}#IU&-phGwS
z{vLRIx}7Ms6QF!|nEAoIx(({UZ@fVG8gqP0K(|*{)of{QGAz$GsAl08A?>BjBGZ;h
zr?;`|{ATftZ8Ez>vuJw<&Bj9>&XK@R3dWTi&t<2Rck63%%4r}1i_taOS4|=-VL)PK
zo;GHyI5?c8AAUlR#5}-#o2shm9y?q6XsbBB0Yp9@)1%{aFf=(aOnIi`DQxyp0Ny(i
zaE3<s1SMwgPAXmCH9U_kvL1K@Uc(S=j9(14O`vTCyXN@CNSkptc2-liiSaSWKkL>O
zucuYMtL@n)vc(?lnQfvrnk5@1NET_6+Qg;fuSA&>Vm(h9$)zIdvexnsw5+>=BAxPU
ze`yo9r1f=_Qy?kypDFzQQ3Gb?t!NlV4d49@-bHs}&B?LV`<L%pzI*g7>!|n-a??%+
zMTxji8?jwvcW_#qUZGMv7PRw&Cy(@i$`Ls^RZ4@m@f^rUKXG7ER%7L?Nzzba%7(Q^
zUn0q%@fSb|Ym`p<bVc{$G$@W3c^1dd$;<^>_jWN#Ox3>GF0yQw&_-_P8rd%9+YMjv
zuR!d(0+pB2B8`VuCs6tnz(RdwBETQ;34I~+@i`v=s*x->kHZx)+T&MJQf$5U{*_{d
zoh=LL`m0DWU!|?NN~DhCJ+s@01cXe&C{_Znk%~`7;`<mT8Di1)UnN#_To?^VBv*Uo
zzZ%rQeZS-^1>6S-S6RXpm9VQ47Dhr3N~9zt<Vk|tBxs@ADGWqDh{?}PycBI%gzj*Y
zDX$4=q@vST6k;Ym3+C-`KBN;3e4PK`-mgc~<p8V>@1}**V+MLch23ouT8c}g#x{8C
z_)SFxO?hWm{54{NJt++cP_~r!s_wbOo2ae4f!t6y1?QdGUt&dycIypd4W%_dy+KUt
zsKhj^>r`}x!qX%0@DAPxJDgz+Rs~$%5O4c!d@|RaMTyN>1xnWf!~skOm;%6IP9Bvg
z)6V*hZxpxM(B{(~ypd8rYiTEkx=!9G1`GB3nUO-O;_D$Dy}1ry3jbazoDEVez1a`N
zs@NW&5%7<2`!YiT+LrN;ev@VI9j&(){o;#U-%<(k$V%!SjIQ==%Lz0$dUE}ng2VHi
zM#dP=rM7qjdHovYYM^InZ$Bv#JNnf-3ucd=&~tSm2hig>T8tkHGHw*~7zFCn*Nq9~
zr8MC0=|4Z{)M+|njo4xDPAE8Sop{C?edB^%X{TaFcBjue(sJ6mkmBSUGk4T>C(k?;
zHS1-wb#~XupOedB+$lh~<a+JJouW3Z{N*Sb+PJQRC<GJwRKMb>_fQ7t0_DGDmni6f
zouEg4+^onv^uLU%$V7z|5DOzKAeKPphXJac6*~4LI|<P51;Pf-huY^r{5=53W%^-d
z$rB-8B=u%7B-TySJ_V|LO!e?ZMs%&cS)4L=+=0G(2#_AR6Xks<TX3Nj*hKEle$?Fs
zFcB+1fL5|e^hb|bF^@do663jr@r;mV^w+>fE>S)Rz^u;~@(1zx8-R@jXbWYgY4lNr
zfe)ejHh_l#;H-!D&~wmsl1KVQimagyr@G$1MbPgrlC=@HiS$7WY2!h2?gX-Sza-+y
ziQ2N;#K`PbAau_gUc7U@AjDaPc>!MUy6rX*Aqw~w%7*TIGIo@HL!dviMbH}fhYXvk
z<C|SCYT_DublASn(%g57F?4OT<4zGWjOi+^XrDMOc52D{#kkSz!0<6Xg?+|hj!y@!
z>~pPdKLuasv>p3JI|U70_PZ!(82T`fuce({u#Fz%&$Msv7GtAd1`eT+nb5``5EsS4
z52TpPQ&&~fCP!*34~WbmxSnC(n>;(KzpB<F=V~_`5M%8=kfcd_;((a4@%I?yOMn4u
zeh|H%MFX5VJ+ijBzMg-tVJLF;$(WbVqS?~qYm&IF&?7cg`T0dKGl*X+zeh~2!CA6#
z)nn-452ZbG=`9W2m9oCO43kI#lmtA2GIRPnD7_ExJONm)+McKGY}k;?leIJ~-kN(G
z<Ra}On#i`3YW~tS`d%?R+6Z>o@V<g!I<>$<WHs;8_B|w$F9rVu?c<$FwR3tfYCI)#
z@e>f|bRN@)*6Oh6muMb6j&8<^OBb*lEG}LnPh;|a?10l?N6FBQ+Mq*XnjJb%R%pu(
z(ZyAc<~bx3u}S;WA&R10+J}e4{J0k|$^k5GECK%Uh_?J;;mz4ZJ@tsnqVm#`(nY$h
zxV*fqyi}gTEI)EpHTAF<YmT&PLqg&o<4@oSL?)+8kO%o5!?WZ5Q$3@tnsQhiwS&{;
zDsAi|V%;Q!Dn=v{4wX&RPRSJZoRiW1Z!Di970zXB(jI?A+%@nj%NP|yv$h*xAj1}Q
zC)UZPlG%`xSIn9NOyz*oSs}W?eCkpBql|iw7yf@AM;T8hTd~{?K-~hs5l1JLT!RLx
zSKJg!Hn-R(y~iehiGF?NZwNFQ?*T?(fWz9HE^(2a^FLd)ja_1*?Lpe&Kf88!i7k$y
ztX6I%>I9>5{LSR-(|flZd7C!;s7Os>+2g>O#S;t@9B=p<%2BZ>g)QYEN{Kt?FDYBO
zfbL`Qux*y?(4ILe(v1vH?-g~NHt0z)aVR`;c?S(NKw+$VQn<`ct9I>^Vve{@d+tfG
zAg(X>YVcg|ZRi;7vb#l;w(%)3rQjBv7Wk-C7Nd9@0o@92{7DwXOd?(T@+r~Uf%miW
zT67E>K1iixR%iwNelj9t9$`Ocz_Cw8H&zyW;>;*Gc6l#G?xa$002Ce8AcwWDo)+Wm
zj}po-YuBh}M1zITh8&K=eGB6AxKlg$yjUEET8hT`VnS}#%*RBrA;p#2(qkeo7r2xG
zFD<TgUrhJqv*ewqh<4)g++9|>WX&wO5<;;GhdNdh4~r4noMR$Fd-0gC+YQodZyXcD
zE5fAVt)yWqy!i^0*eL`B^hn(B8!y**yPZ_oyVLMSIXm`<R`N$NI`#=#QkIo?!Aa*}
zWU+VuQH->tV@m4EJLgSbL6~ws0Gr4o+H1!}=HQ+^G7WIyLv)BeA=ZmE+LjZ<MptML
zoDf;r+=EqUk~7ESTv5DaA?LzM=+|4MAZHolR%+jz5aYyQE#uE($D#wYfb$7`0zr|k
zq#t9@tG)jZVua6sj`sPVMRGb5;y=72CIpM<Bifi3#n{+C(Drgc4Y+v*HMYMfo{yZ)
z)UZqA^g)At08EVoDBTTk1Ym%g_i62~i?oR^(`Mu$usV3axKrbfo%rOz!t~vWy1TXG
zuZ!%VccBcqBIR6<as$8#ElL+Fhp)n@1z@3mdKGnJwKiQ$$l*|L4OLKQrW%{VPAp@6
zzgmv>I<!}Hkxx%G9B+uP6A>=E%zVv5*Mc?l`$>658+1n0i!<8gXN1;IZ-+UO6)>#-
zK;Iw&Gd7~(djR$Y*mDglbe7Yw;vJy)!+Myx{;a8khT+gM9QAR0ISkZcWe{coc0Y$=
z;!Xk=B!Sp-U@mxvnsl?T#rR>InVxh08bcxMG4eo%2_c-!(}ui7nV{#Wb$Zu~w?whk
zTo|o3jLzt~=N*wC)S(%P+O8VXkUQQLnc9hWMWp>QbGvzS5<iRn^j#4rjN+{KM5OlJ
zyA(Mde2*@xH+&$5YHq6Qhpu+M6iH5JZ|}%>B|#bV;NS-=+T0JxIT)sOzDqaU$KMkb
zRwX4cT1$SP<c>#2PYgaxJAO{M;)nM}X5pm_7~6J{lJH=vmT-=gbLg*Py!x+G16N`!
zw&VjeUN^9@cbO;OO0+7@2h)v_Y=0x<xT8OXOb^9vnc;bx2|GUP|6J;jQRvbebB4)d
z8{Iq9WTvM2;LoCLeWdTDNQx)`*~ZcTP0CMGdWh>MrWo5hMY<?t>JL`N1;B6ouhy)L
z4@}iopZoD+P|y7PzszaN4UavYm#8kb{x|&mK78%gkBH9eFZnOng9-w(dzYz9e6X;W
zhvxE3@ss{<s{a&8!i*#4VK7oDn~T*aGlp9)v$fmQs$EIi+e<}c29g4qrU33y`Cpbv
zj=0PoSls&^SgIZSSWK}_E|q&V%iqP=3W^2!eT+sr1i$Cp+UzAKi+@~5PxUx~<DehK
zds?gN>w}KoWC7pE1?@SMS!h&(jvPvq;wO$qQf#f(`ggHO31`+gsm5wCoJHe6;3KF(
zA^!|5@D%hc=ipe2;t2!=N_0yq>EV%uFoN+pIgP#?+|1+{H#3PAZT2T3bu_YcdPHwp
z3E6cljdN@FVCbg-LR#l1B6-eZ7%4g@2bP?Fc_@*$2*&2*(3_8%W=St1C}hi}I#TKg
z<KzSYP99{-HQLLc2&DtDsYKF;6CZj^m7=(5opfDKKet_tM$XXfK#A2TXXrRNmx*3|
z**GJK_cUf;{W>6ZR{>=BvJ$FL!gZ45Q7ortB6MsL=2W@~=usTMVGVvhGvjqF`!RWh
z>59<JRZYgLPIi;8L3bRk;c-7gKP^m5kblBD0IFf5mus1yiOpU9&qS3NvHg@Iv$JUb
z@?UMZYr{hePmh{$WceR9JhtKZWk)ugp0&Q~_~)X@((&?$K`Zl3FXu<D8ftlYTH>m~
zmRAPbsEoWKel+iP(_t^bdTbS?6{V#vdRI?CnrRD0BFkkiJx6oX$)AhD60hX4@%CP@
zS;y1aMa9%DC{JViY@pbKZC!^RUt?2j-q`p(g}Up2$Oh{RwC1BO9^miz<ka%@KtYJC
z$Mr<S5Cyu?H8PC1XvyD*5$o8BUWJ}Z(Q^p^hf289H{zw$Xl0)n$)JAE#%=~mGbr2!
zuo$1nl*lK6_ocS;8!@b77Rqd2D^TJcRilJ>ob9XOjcWLO6o8$AV<^1<fcpuZ-#+8F
zd4ECGIe@PL%$Sa2szE3*7dNBCj=?rTX5a8*n1z{pccXbP06!S#x8lFW=V1Wm@&s&W
zIKa24n}pIO0A&Eo{w*kN2jDkC{BDxd*PNhc_Gby{U?Jd3ZocOlkj@?;J1iZ2QpkcJ
zt8tDs0PGWUkh2q?90IW@^-58X{IFz!>4{6n@&Dfl-5gKFPLe>gAp~^C%m$y*T<@7J
z|4L&~o5_DeSMhhEQrH|K@yo=nyZ#|&3cFK``Er5K-Z?L(*keVV_+o^X@=sA@vxqrg
mL}_dPDORNp7h^x0YO==c2)<-VdEM%`X5nWRlXW=H_5T2Tj#$qC

delta 17335
zcmaib34B!5^?&YcSqUIPNZ2MoNCwCPBtpU(LcjnCAqgO$4wJk|GGvk&?wb%Y1|k*Q
zQR!2k{V4+O2q-$*)CJ^MYwI6GX$w|fwU&R~uytQrsh0owo|j}oTKmrjPVT$Qx%ZxX
z_IvZ^pT@oR_t@m)0|q3-(9ic(KVSdtq@BsbMZ!~=$=1{+C3TxvldbrbH2R&RG%F+M
zcdpW+Rahsb2b6L2HC-9MEoRLOC4*q0GJ#-`5>zs&Wu|u2ni`2%uNLDrD2u3~Mv=<p
z^m~O;M%`8_iwUk$mJqx`QMG)#UmGNbX%{Rh`B(23SWisMnkFTrxM_@ESx5bv6%WA{
zrIuhosq+LCg-RO~FG1~sJ$1CVO<CWR6%!-lEHU1V`%NS<BBtHaZgI6n<~u?ICWHso
z1)7^ZEsC?=<MVqJXI9wiDsmcv{v{YOzVYWTT&VDAZx4A?6h^kCREY!-$4dXdnx_?S
z8Jee96kA8ky)lYCWa*xPzIItVL_=(crNi1`JK)%FGh3=-T(R04!}2;^Rymfc<YfR8
z2)Hb=5M?{ccEi@HdZjEt&Bgsxba3KF4ngb89#BpNbvl7-W8O|2aAWHo%00^-t2sGs
z;j8(tPB>Y){8ZK2lgqC>dHGc*-L)r&B-g!_lDcQ;q1dmjBB}867-27rq^0GFq)fta
z-j)+;4oa7{a>T;KshD6Iz)bDY5o5({?bwJc`y#4XuKj()myY>p%F{j@nPab@;wo+I
zsP|K`7{jiHyg}6!D^V{O1I*W)qn(*(l`{yaAXxWKj0Atcqqx<OC*+kYsQ!vb!{}d%
z<t0=!;=G%DYRDaEl5_DX+RlL^_6ft`Yf-!{AxVcE<GYqBT?sss5!dW#@+v;5$|clf
zE};gcDlP0BC(5<^ofGZ#RIxU4!ugnptE8eUUartKk1b3?y~`$f7dGs|uzNR!q(|0i
zC&v!Ahp2g7<dd<PqKr|RTcb*uN5F`$DJ`#DT3l0FZP=vOqqr=Ft;N&qm0oJSXv;Pt
zvtNd(T8UgWevFlfyE$`HXBALY16+*WNbqh75~qSU3~PfoBqyTNBm#!jM^tFSryrjK
z>SdtWrv~Z+ve^@owWx~^`I@~%-{zoULs3pf_iTVs1YB0bT36p-ST!}vX}^_fe35&y
z{%Nb&Ld9@gO(5VTF=-DcR|G=N;?_`OK>EU7MXsghbKpwZ32-fe8o8BVcz`5{YV))^
zJwacQ)8{0ik#}ilvqvt#4h_4~+8k63hqt9Jpm+_t^t3d14M(f=`+c=Wtn_YZrR5s2
zRc1kANk%L+2ZG)fS*^{@8Bwx{>g0`#P4#=d!9IJ+rCQ>K+tA~7^dO8O>GP_Ftu~;v
z8?l~H$lDwYX?jks{R!&O8abZhvkV1e%7YjnR35lb$S1V2DS7s1sq*^BmMNozgSR?U
z+dFkr9QIF4UZ|x{o0|GG21hVBi4JL_ug>e{qd%ber;W28rG}d$cTSrj#7yl({<dkq
zpo*|1+aDgNs*O3_<jNt1MBEqUs_Uqie2xGqiP_q=f-L*X^szJYRKe{cv3I%hkhWxc
zdiqo7=a9V%k<U<tVXr4q2pK|=2elp3$J>un<=v5=PhV*n^cofA>i};6{8k%TG<;Am
zW69@H`GU5fNU@)#;=_@HMZ3ii<~h4R(B_r<EQTc~PrjqMXBCR4wV%yeB@FG0StIP9
zQ1_=IgJ=I-h_%|Qb7qTUnqzK}{XA7a6Dge=7Sn*+u&S-K@&lAeVMt%lC1g8&sgQ6}
z$r(1)-`XGr)w~$_a$cSgE^XZWDhIFpJ?)zLvmM*0vwU7VGJn`O8+B8O)kv{)4^Qy5
z)Ju<B2K-(bPpvOS{xSdcOGd1rK1O_7KsKpCPo39@3(CNHZ(T^0ztPUFC>;JO+LOF3
z8+|g+(o9-LH7q_wwrf*YdK0lkIgF6WQQ8A5v&6UB@s;hg&(c+MJFx<3C1BVpmsQnB
z7xi@|8?j2QyD>ngkRVAjsa!Tu02%2Dtgm;h{1!8$0*ghdHR5P+6Dd1YzK72CmW>{%
z(vkx*<ffvWh&k;9>V$Te9H{+ywOt!_Me$_D2Ntc^M-nbS0#fK9d5AzanXWZW$vJK1
zn(>zNG1}u-Tt*7=>=kpwXPR^M(8fu?JsALV%N!~h3B;tNi+q6=)n(@cGq-{TOCG>|
zv+(Hx_?(7b)RR{XD)A<1Z7yxs>YYQd;0l>Xuy?sy@tPFDs}m{OHEZ@e8nFzYHhJxY
z&H+GhCBCx=gcF>qFXUC7*>jvEEbpSe2&iVr6qF(6M$)QfRZFTXi%Uw~WefU<*>W_-
zFI!n!RaLg2v|3)QhK;zY(nV#}HC3zSUxA7_?oI8tYco2b7bMh;Oa(X#&|iR1cNhQ+
zC?Oh#)$eUFVtuOOYw(36!~(L=EWbiGFgpoE&`(Vp(3G&Stg5=k%?$MxdVCBpjKGMf
z-j~g&Yyk)W1hqS^Oi4V0q8nhH_T-gwD{=Hj0$CBo4gOIjh-g@XUN*|6?z0i!tMY9O
zdI#NYBpiyV*&NM*Ru+bhUc*Ad@rpL*s$reSxR(-WR;7VaO#45g6y<@JxQ{0oROJjz
z=^!fwOtAqOZ1l9KY;olr-a7b8m4zsaI<miH-rBJW??#!7N~`oXm=-mgusXF<SIx6G
zQNwQ{saO9g(X|*evu}c9m8I0eR<7TvlIP-FKiu9-%_AeT*K3x=<>+2Upxcu$k+5Np
ztu7;@?p`1n<uahe(ey(}d<O!{8CqJi(;lQ=V<U5$uN6a?Rr4{5g%VmpW@x8ca*8p%
zL{F2o%26^+vME{XQ30eE={1vDSnuRWNnnxH!4pi<?vUFZyo*Y0gt}<r57dFy1eZ!K
zCPY2!s{_714wx*`ZdFH#>DuG!im?zH#viuMnwBr&6*AewmN^As%dA5Ao|YcU>;!HW
zUpXBEdX-n$ValN^PV(MZVwfYaOCy$i7qY&RWm6{iuFNj0fu?u6(1~p-_v-KWR-&UF
zFhBBIXsC4|bQ~)JQZkH@#djBKnHbnVnHEgY*R;gdHIviX7-*B7)UqIwxoMrXi1&d}
z;XzKH>hv{x8ob$o7Js`li}iZ=QrAppOCZ$fYiV$X0#3EgQ(qtOD|DRydrhHOt^M<w
z(WF7sIz}#!@*%9aVTZU&_7hEwbTw*YsgB)*LM$@Y<R2`;um)rU^MGNmBhOEj4cZMI
zF8l4&Ru*}-;}1e?*LG}~I0XY`4As&WF|h9zlNE2hr_~>F*OG@-*C_9#_EnLOwyd$#
zu<sJzM+bt>P4;Hja}z#crR56%hY8T~AnNia0*0l&g>{Bu4Q&b;)+TSed`Y`|>sb4J
zG{>6A;jJwep=*=3m6qI373WiOT72Ze)-|cQ3j%dbURh5O7o8XD(kP`^ys#3o0KIe3
z&Y#&f*1nhU)JOifEmep@?VIi6#`EERjun9!!?v9EW<RkwqlDW_-rFH<*7c+957WqI
z&3*luth=csGq9kz#!x7z7UkwLk5E?(qgf$q@+NKF4e55op25iVH|Qx#K-h46b@yRA
zO}@GpU1t#p+nl}@C;8>R(0NOC3AtR}5K;RE8e}-gS8njNgzbuV<J4?gsn&SkWwe3a
z_hl}|+Ko84AtCAYO6YcS3Fn7NDPl~noJttvG=Ku&8dg<YwsckTYWIR=B}+=H7M3k7
zbypVGTrPEO(5{<DKZlM0M1&Vm2B7j`ln-ma*flEo2o=fQ_BME17Rue)Uv@p1dJngv
zKB<MAarZ{ARLQo>Biio!rzA2?Ms`^H<NaO-tFATL!rd9-e$Bu8YD-p(wo?v))1e=I
zLJZQr-d#TS8`?;Z310`y!hf;)I;Yj`87~fKH}08Dj?=IAsA7*+v^Q5gsIA{S*R_p?
zxUAv9IYiIK*4kVUsGb~7Rqn=GUnf9hDwai&-|c-_By7hFmY|diwcQV92`%#KgUdzM
zTc{n_Bc441a1gZ#N-qb>N44UI(=SIX?wV?zDg?~rAxMiUs*o`w4lx7R)`)GUYy^Gu
zk)E5;H&1)~VP_{;PeKYLdk4(Y6Hy1xS$0r^;ZPe}Lq5OZkj;GZu;mi`ZP?oyeZ)G@
z7?RD*<*2na_ye_ONZ3y<*HK3!uGXV^p+$_uU~6Zs-&f}*c~s>EV1Y@YD3qdDBi`H6
zO2Hq(>=)5A3IJTrfvAK+l8_ZvCo)8zE~lxNSt?i{nSz!!3eMWPl?tl^yJWA_BAc{V
z9~qy*-a`TK9VB2_$P53UpFTPv4gRNLYotg{K8|%++UiX!`<6EE(OGsY8KqEU>!X>8
z<mc~udcsI1SyT&ww8YTw0P!L1uTPJ#$I^)7k;KStB5orZZSos!?=wSPy#(*!LtYWw
zlm4FXyU&ahzt^nKE*`_q(%;a9mKL+lbd5g+Jpg{E`JbI`dD9ko_}Q5jafx>B7hdZn
z9S(ix3nE1iT11@I{M>*gLpp37cIbo-yOOez?38jzpPHdub7`NNVO%r3PfhAZn*Y}2
zN}Be{bK}Ga?c8%^V@7reWmGC*y*H-AN;pS%Si|(yB9!5jeHx>O17fSyc_3Xo{robK
zsUM9aZ@KV=p<=9_7ZfQ;9kDoM{3v6!zzf5~IPHcPuFlHD)^Y$Q0U)L_k`zzK19o!b
zj80OOd|w;zVrSy7&_x2gr=5CnHJwk+;cU~{$kaTCXLOpLIR?NTcMX+H&Nop3ePD{z
zLLlfpn?CjhSp;K%s``T->1kHol)Yfi<?!&oc)7p~9*~pss7Ou+j@VS<@N(o4fCB)`
z0L(f65?a}j^n{5t>@=-MO^<|*Y!i{qM;{h(ujZzeWyICl^vZWcN@UJ2E39enV$CpO
zrhb6ZW`iTMv`1b!<ls2Q7P<1*?^w7To}@Y7NY~c=pC?A=(I8^ik9wxR$mcqzO+Gf=
z@`KR4$MP*?7VbUvYhl-Fk54cI%u$%|Jxx2ldl9Pu2MMsZMKL|jUBEaM0MhLmVEPHM
z<hYyqsXMP}*i9$D9k|}n+Fwhb{Vf%Z1a@oOaBE~7+E~1=p^`d)kUIJ2TJy)00{E`s
zG1`=4V=Ui_$Uk0NE@s+M6-yp{4oxdx2AWg?wBM;X51tdQp)s&GUhIxJ+O=)3r>AkR
zX}w+FqlwSaSBzY%z4ZF{A#;H+n<|j#Q+<k8+9Th-UM57cHt%G0C-a!KqQ(pt<Dy0%
zDV_jnRvP4$A$EHu2q-H6m`RfQ@JButPyoR0c>@+~sSC<iuo4hUUWP`d5)&wi8rC_r
zOMdIL&!d*lBh!ETh_wtZg<)~K!-<MF=nu4Kv;JL0eQV?u1j7lG<v}GGUiJ&fPaqZQ
zRi+jcOerL5R>7$P`J^`C^w=wFG5KPE`2bk7nagBb!fN^!EDdIf^c$QLjvBf9MV6Lq
z9j^!WK$g;aM@Akxoj-6EyG~eiIH6JoHu_-ko$@*$0?os*&MdHw(+s$TE2<%6ik9+z
zS>o$h6K9PwwZ`{v%(&Q7F%t#0X?b~h>@}N9d|4a%fxEK|BiW636w|SE{TZb_05C6{
zS0rzikA>q8@R}KCv}4N_b37y2j;5UeKLyYTgyV98(zlV!+(P*m`lg(xZ1si{*_{|t
zizHjNoR4kVsA`_vsyRMv6<J!xhf_tW_T-284$kh((9V7M%%F1WXRgXzZsg!caUv0}
znmmIE-;NwT_nJkNXgmH^<~WV&dD`25o7dTY9QtCLt}IiHte~!jb=9g>riTIjXEHGx
zW$1d-eSnsdvjNzpVDAK;0{il&@dh8Vi846_TtNw0^r=O0CIKUHL22dEWvksQs!OX(
z&B2L%B=b$<&n^gpM7I0PD}5Xes2MZQ!4^5no1aj_MNR^1-Es?=KvNaZq{UIfH5hc0
znlK#Xel$?#n1u?CgGpNU1!AEm0wlE!+R9Jo6hc)~5Y*N}^0?8k)nT}B%X_hse*y>s
z<V$$SVPz-7-qb?9DM@$Y)A@-$nl^*}s}IEMmHA?7Wa(!Y;wdm&`d$8TlOQEaS5()O
zR=G<nR+|1!o_5c7<LrJK)S?~z?osO8cz*5Vd9)1jDtJs%<sx^<vWlAGvWmV`q%6Nx
z-Qbs#w9n3`**6e^4Uy!3J|`T^);8_L_p11dR{X=n<s6#u5%M9i2Iq6&(?TAJrebBx
zWIRR{Y`jz(m7MfrYGW5oApt^>7k{V`d86_DJvw_)f^heQR_r^mABa4wxzUHTc^5|V
zmDQGr=R!tuB5MQF2hev85UU(W(a4GVrvpTRn4*tQ76pT{P{k7WIS^U2;+ZLW<x*kS
zf08V&%7$E4kjx6|*5h)`pgP0W=Ak@~m5NShPqtA%IYNvUH|UcFiuq!#-ZD_Q#0mYL
zfnve9c5DE4b6>aJ1d@yGraAg1ee@vlZ~}A~TfeY=Vvs1fd?}3&53Zxjmyp-l<I6b5
zh6jyx5_5Q^lQ=9y*(0^5lM?L}j_(~1?pi!pSVU(yrKdkdioHcM=yMbm<WHNLYlyjW
z49!X>$LBB-I~WC!0uWV<tW;8|&Pc3WR$a5G3JIn8e06d@DOUypp<KQe$z|{2d~(L>
zjFjdKr6%L@jPi`?HDP-Wnq|5E?j>T8$ksE52%Vh0mxj<GP1nB}BF>4w=<lWopJ>s`
zhSE{E^%sYVx5YgDXP1ihv38o-%&vBm))1lpMA#Sf>S1D{$nDxPOr(fB*1v0Ux-^X0
z6uO}2bdFQ`KOs4ypB*j=NvHO5iEFs1A0=-ANp1z$LEt}+d^1&)i`(?^X=3eY`1BN;
zZ>L}K!yn;<qxy?!;vXZ?Rqh1pAM5x_{WI|0Pxa)H!qv%44=rqlK`ffA<~{>Uu_k20
zi>qBzM?*D8h_^`xXiN(A1G3I*CIeZAvuxrPQ62?&7N7~h56}$I0?>&ptr17}9`$@9
z2L;ndF;Btg%K)q?m;e`RUDLmYd>e7~bUi@HZ)t{ghcPUGb#er`6#Mxr>QVtXtQ#vk
zt5F@*HS6fpum&4cjsw`<Q&8PzW`t&A7DupwV?2i{>)c8$r<Ey!^)?4+<^uGvsdOz!
z386rp<b1CcSEmOtDLil^z7E-AH>pa)5t`|#^?OxWiUw<_AtYn506Uf3l=H<Db@C?K
zgJG@pDDn+7ids{@h4s%yi5d2N)Vj56@@TO!emD-Z#$_>0t4<B)t#yi1X6VmniWTA>
zoz&N?0zPq!lFPC8DgY+?YSdi;z*dkcWa$ok^{rXLX+KDfztSJc64z;ex*@)+AXn_M
znjFLm2#&AmKyoq^$}pVJ5^!z|_$lC4qe>tgyOOJ%=Pi^_97DtC-lBZI%ZW={C;MKK
zJ%4t^DzGF7U^q79k<RQAXE@H8U03hScIL=!dd)O3y>kotYzMf9I=Ti$y$f?k%-6l!
zGMO@kdYZlhvsu&(F~cz%GuJ`fDHq<4Q`obCb(Z8UUrNTE)<#)fm5kuVItf;h1-dg|
zWZ0jkWxd|DIA83y4Q1m033NILz&@*0Pbd_bjzw5~hCaPej2D;bR~8EI72Ml&k)*fY
zbc}e_d{lgBd|uI|bK-XtCg<bp&L>Ct`#DT<Ku;|aW9-jU`JJxWMZ#fSB(cZtJmf?S
zXPIG9`v6Tgx^Sb+ifTp#J=>1yvB=#fZJU1cY%$t$&Z0j)TYOm<mDKBivI?LYpauY|
zq$#~9^YI`wH7shAY|u~75$TRsXnh}8y1t(yj#@G}5Mp|;;e{%eUjTdy@FhTzML%0C
zexBdkp@Kw#?~=Zz=5BLrh%oP=zb!sKUyQf>)1rSdUj!ELaxh48qz+n;b|K#6c;*{4
zd<>M`iE0>UsS+@(ZEbDxCD8a4{h<=!a-5*@SC+2dmxym1ES}*(B@~eP>V0)E&7?M+
z@`V29#bhNu*VC4W$!WYZ-p^4QYgqhroka7K53jFVB1R8`RIvv_x2Wdp0)_64iuJpe
zh<s75A6p_eh|C^?vu;5zYY;6s0zXFMFSa;T5gvhC0Mg*0oLT-royV`v$(cn#8a=m=
za|U#My;M9U#Lv4PsSqQDDe%~s#0i;3ArGr!y8)A7IQ)E*%|~v~ExCsh_bf{j(T{nH
zY0RW#u>><43B@JlrS8&l%J23u0&H%hJiRozk0|o#b57$|pjI5V;Kl_5wrSYH0djW0
zI(Udur^@}PwJ0hXEOLGtNfLHciV2Rt(AXa=UC&jDkKz)4gH4(2rXN@>MuDiS#e_*G
zfhNiAF0QQPOGvld3=0Rj-4spGrK!83xSX6Bx6IT>tPzte#E+M+5zmP%-Lh6}O?(n~
zPY@EhsOz@1VtF?qnGT?)F`y;DN8qk&^wu?*IvM#bGk)QSBTD8JG%NxL5ul7uR6X$q
zuz&M56C|R*A<$A!M#SHw#?d$V&`zg*^;IIp{sm1vqO0vHkr_9L<%<J6*5~E=6JBu{
zxl`|ZMXC5!pHweKkfXY&UW{3Ql#yYXmPbK*TR17>8r&ne@r-4&e2khX7!XqpF%3aM
ze%=&-Y3BxFO{~(P&1JRzc)b`k6y9`r0EI8U`u6T8XmWqo+x3DJ6Z}|DzJ9h|1iEf%
z6rG~84f8t8-ma8BYM$xHDzTU4O$P;>Lsq*L31R8L#Jd5Q9dAVG5ddbws0B<#9g@^0
zd6Rm`dl}W#p$)N`tj3Wtr_s|IHQ=XZ?L*^80+g)|(1r1%=yE{c@UckK&#V_oc8fJ8
zW>VM3>&4e`YgkjgfgYO(U5!M_KO9#{iT>JFN<`cXT;LeGO{Dw$VoFV*ZyBoB06;^?
zlK@Z=^0z3>Lc>~pMo8q&VqNh&s)hb8URqXMEq_m6hA1{{#q=XjW5k;Pe;{Dy3FK*D
zaOe+)#0*o`8&TmS;1Wh6X&ZOF-xmye6^eM7V^|kNS#uHA!pWw^7|4m5`6w*`coTrR
zm(QXJpZ%Od_=NHvtg5pH#dQFDUR5Zu37LpeRFSZw8r3F{2^l2d>ODECU`en;C#dGN
z+Pj$JECIt&OP6x3bh(a!e?~QH0I{D>E+rP~5qfq2o!$cauO7DOM=C{H*Vv8XA^T;V
zHN)i;MFdQAj&k4yg_EmHEnVbPLxG@EP62hycuoKQ8ZmxQztE^i&+8ETMzOYlOAsct
z5aO{x_=<8c&93k0prrQj&4R*n{pe<qQpV@NR6ULzJORKgjcD4ua`^xy=4()gEN@g}
zJcSLj#yF^t+CnbN2%6;Tu0>nOOE8n$Z|VN)#N?#yw0Og|(dTWGhW^lXB2#GkYuAbT
zL>6dB@;R$Mdz-lOl8u;+BiQaYHx2s!Z6Z~i)9=|X(#0nI!)@ZuQN6w7SP+%|lWOXX
zkGW^N{yYYZ*WcbQ%EZ0;gzH6SC+D;1wG`RVup`HOGPxGSip|dUD9yf>bD)JQxxap3
zE5c-o>Hsz`Y`U0WA7kNBy}-0e>_e+MYEP25S2Nx4T>Y)<MTQus|Lb}&-d;dk2y|uM
zAW9sj_x27t_FgQ=Do~pJ<SvxX0DJ=QFMtC8Pz5rL@W>nhC_J*=jE5_1`Y(4-WLl|z
zvO`p-vq1r4hf{D7kLy*sm~WfwT-%;oag|eEqkC=>BPTI`u=9toKwbd&lmP6a5|Cfv
z`z1{LgGGPrHc{Ql91R9G`5CE@9&uj*3gM25UcM3V0l>$Va402gsf1CH&~)-3N{|`}
zo|2#sy?XKa5vH-qW}?qP8x~>2xygLjh4k?4BE6b*3ZD-%Z!})Psjw3HcfY(6O%i|w
z@n^Jfx_F~^1K7(tp{M7Ikwcn&4SfGMm*)Km{Z|KB_0QLfF<rCn5J`@qL(vy%mLk*I
z?sWYm{i?f(56kt=yG0u%9R7Z{DC}efHy@MTj3H2PMy#J+>cRzK*E6cIYS4{$#QS~=
zpUjG9P-4r)_MA;V`|(jj#sSJC>PP7n7TakctCwSxI{g`)VzW}(#$8=!ba9F3s`wvq
zR+#xLu#c?Ni|!NkGkdj^90+>z>Ed9+gL-w8;`MvUFYT+PXx8v#{q_!Vsb0BR#OdGN
zCkA#7qha)FgL^A773f;2iqtK08nXy<8cQ6r7w@&7Vq$fKeVJy~(NE6gA#C#|fP>UY
zg~fp9;?!^0C5G59r)l?g?cOE6vvl48Bs&R^tY|3TiLw=`R(hzb$h%N?H^3+?mZQWZ
z4n&Nk>iOi<mAPw{Eh(*#o6v`OZVyU(0UiM0liY>U{QwUFz!cG2)A=#O>0>bvKZfdC
z03HX}ujlR+BkfD6>FKV@y@DRTChIpnAkqiVqFse8Ia5dxbKZWE{=x%dOeXGUXbXoh
z_!R;wb)!9-8P8(O0Pu@0@t}wmL%&D29{`x_|3c{@ebhr@xV@UXz1UUskl5}>jGCAN
z{n+Coi=4Qx9v2Z)wU_A!_KQ=ZQ{Q?(OqwteDELH>Q;`l@&VR}z6+bDQ;#K{t1EPcc
z+^!7=$<H0O51l(`!51z1oX(x!&}*L*6Z2m~AMA-=#f69F($i?ZCYnnR+q@qCY+O=E
z_$(AecpE%*?Q)oY^hq&pNH*1R;6q-BP4(1!<t+VMLg}~yR9UT0I3%X8dls1g3eayO
zKf~z5Xn2!=5ntcx_tV30dSt-T$o>QKDx{GzK!KqAjFxJ|HhNTkskH}Vuhb785|`EC
zIN7`!N#<ki9J;Til>IdH*#J;az%{T>V#z@5I{=&$BDGuJ{ko8~^1WEzGD3?Ne!gZo
zS6}&*xXiwZYL0a6d`iqoG@Wy{B(DR_M*ZCv#YDRJhWuu$t>hihef4BKHFp-toqGCV
zF}wsA&6uMSr58cgWXiafRxDtaUsAeS9>LUoI0Od-OD@aNFkkODEDA@IVEAIHAXl_{
z>54_O>37w#Wi_)YV{!7ZP{eY*;D{JQdU3@OQIhm5hC;^Z7QFXi%!@~aFMBy5GGbR1
zS5=f%EHdn+RaMKXD&#Rtx`PJw<D3VNiiwtwtooLh#CMZ%_il)Bd@qL3{u^H8e;fI+
zRe$5CIO>2bAVmIOv9<s{w&_Ag1HF%FX37t+%a@GykFb7rvDadfEA@<DioN}Fr6yLO
zX4TeD(??CibwI&f#yrVREAweTo!>8&!=?guz)0X%uzs%(j%zP_nT~Y;%UzBc+yLtU
zLIhlc`|DDHp3|@~?313;k>#g91yGwqLGz9(17i>9kH0KNIA);i)sMd{rX}8mBcuN+
z-Ey#z%=(pB7+1m?=O=_OoY2dD*&LySFI_+>dOQuR^9NcLXZN#mr({Xx0FZ^bTz~2{
z;Y|f^g$L8cma}B(vK0&HHo(22YUym*sOO#_i<_x0KOwFj247O%NYnLWkzbz>F3Sb0
z{>2F~S8Ud&ye<|b_9g;lpVa%$UKhTpn`tfyMxr|a6gvqRHn8K5@*pM<G5XbSh_+6S
z2m=@xHFJ<r$-K}6qWx$r!%V^!yWhD-&3x25VEca?F!Nz{JL`#T7V6A%a-S5F9J{H@
z->qGDoD|L0VOSG62)lY0#Pp_zd#A*bWYm(-(qG90oD_ODpAw}Gmg;i-7pFw73w<dI
zTT!~oeL3CB%$7HxBGHLU8uzk_rK@MlC19SV`k>Pyud|oLzB@j;aN+!b9tD(*WREMc
z4}F;PS+z0+qCO7DV8r7($$W#sd+xj4=x#Z~b3ZMp=M}8}(rGcm{t(qzyWTx5O04O;
zdAqrJ-uHTHls5se+1#s_oDt(L>E0%jA=F5oPPM-2jJQfH)89Np476Uq)DYtxJYuIl
z&md7?6y>_d5R=3%eTN}#?1W}JKd5)h6xd06AWIKWqFnK#yN;eV?>~_eGj**}(%%5J
zo6mNc0{`X-F$Gvc@3+Ph9pDP-os?A=(mlI;jJ7(!MopapcfF&#KKP^fO?(m4#bJsb
zj#S>*OP5<wx&>e_KtCIBh5q6DV$`$~G!dtCm?2~*cz_4`FouyuDZPd<>eD|EnZs^I
z8A3*?dIicW0e+>oejrw)!MT>1z|}{~qAp8+?*lO<o5Px=R6&E8sB9%UG^*@V%W+Jj
zKL10J=YY8iPt)&6p@(R<ekk5fL6GRO@C`(;f$mZ0HRmb4<0Ii0r}T3l3B8X#kDeAQ
zX1ECb9f%94s|8@Y!wv(xuTe$M;u}@S{R~1>KeHU1iRmO<96Uwi8jheiZekq~<rQ{F
zIaFfy=$qB3!<v{q;A0q;z((^A7A*80Ndw961n{C4?w`~o0^~xI6TRhQG0y%ZwWfAG
z^06qj5v{a2^Tu}#{!Anb$7V~1W&IFs=cPmRb)SoP@&tRnwE-{3>#ncpmB_sd;`M!>
ziE(!w7xCJ>Ok2-@Pao+Wpl@9zhQ<z51|1l@->Rp7DMstBd@e3cRxSyV(`^3KTXgjc
zQKO&!f-Z5*DS<&h^Q|b>4!#xNcP)KTV{P^{W#EAk`cq$$rI?`a{Y*?6IC4K7JbwD@
zp#P{*%IE`QFsfXeS(adrZnb~M^j`G({IA61fn)#w$cK!>nEk|#_=%FuK0b=;EyAVc
zF8Q~eF<JGNuc>v<j(=<Ia|S~)e`J!Z=p+-r5koIgTp_R#|I}NQiJ^Rb^S7kw`jh#B
z^}kJLpWKU<E~h|dJ?-zrB~dIrYkTUp6kBg!{mAoljNlOc(0}euM>seyRMfLVWy*o6
zJ#3Qt54zqzZX-_m@q_$PGW21KIau#dYs~s$ZQUQ!Y@6*JcJ0vF6n)+vkuaA27CL5J
zOlU#R0>;P4(VHD1SSkJqmFb^+C#Ku-E96i0tn*^x;sUD2CF^a(WkwwSNYh826#tnA
zz5L*O1KmVRZ=1*O=li3uBRd;^xfYJg&PJ-LRW-9Y<@zJ%MPp|)C3FV*uwVLz9sd6d
zO(tX)1ex<jtPQWF?i35r#hj%3>QCq^JTN=EC6J9vkZki30cj=7Yo@=$1G2My4J`rb
zB{NN9kZ<awcii3CkUyX^EtXS4J22S+fcpqgh(Xn=H<TUps46{0SL6ezP9)T1!1-@O
z<Rhq|Df*hU;Z#S&LO>@c0C1WhgYTY=<YKz(8~nYvva^YHD3QW2l01syrXA6ZG5y6;
zCF(iX)QM6w*TiY2i}OlmI*L_jzx)%@JQ8lKgtn7#nk0M&^F;+2&L&D&)3=epaU7;s
z`6SK9UhKReCU(Ud7EjQ8P|hB5J5`z;IV*FJK2@^Lrhe^-+MmI;0g7Rr2kV|6#QLuH
zf1uYZT~!xEqqXyt7+f<X=G2h*nj-6|ktsC=)>8#`DkB-z?D4g@-E{bCF~7a0qNbw4
zMK3-H$iETJ3J%j;mWp$PoY>)90{xO3xoo})6>PI{5wob2hHa9Ev2(UL?5j4B9g2~E
z19{nEu|0bpbwPAw8*~n>lTpWaIPc+;bEFbo_E3Y7+#Lyb|J5=-!j!jAN63hW9yEs<
zu^+t5b-NAQ<)u}nW;U#C1@M*v<pO}~@c98sY?YVblig;xJaRRN$&u2H=+cDG06+;o
z`E~1a==Y93z-AfVS%@;*QuaG5@X7NbKxg0DeD`-NKA!-17T_qr%K*m-82l!W7B2sQ
zs<Qx}0GtO9n3(^lk(sy|pX>w#1(|r$dto+a4!#}DcLMN3#=R&#46q-7IXxEJ84U0#
z>iFs7Jbab{un723+5q4J;Kw=pP&x?kGyuy%C*RPXz<0mAY(LRq34#2v9LOaoah8KU
zVUBJ#p^jr8mZYc<k^FQE7ML7|jHd#051J>^sbwgLG=zW=H>)|IwEDes<Qp`E_C~&H
z*9p62m9Sex;a728u2{<~VNVrVUtOj*#aX87kHuMv^-tq0D@P6&6F<+7u_fIY{+%`T
Rj4f{a!q2TSwlv26{{R!~^3nhR

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 348c77e..b91896e 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -75,8 +75,14 @@ def sh(cmd, check=True, input=None, capture=True, env=None, timeout=None):
     return p.stdout if capture else ""
 
 def ssh(user, cmd, input=None, check=True, timeout=None):
-    return sh(["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=20", f"{user}@{DEV2_HOST}", cmd],
-              input=input, check=check, timeout=timeout)
+    argv = ["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=20", f"{user}@{DEV2_HOST}", cmd]
+    for attempt in range(3):  # sshd drops attempts under parallel load (exit 255); retry those only
+        p = subprocess.run(argv, input=input, text=True, capture_output=True, timeout=timeout)
+        if p.returncode != 255 or attempt == 2: break
+        time.sleep(3 * (attempt + 1))
+    if check and p.returncode != 0:
+        raise RuntimeError(f"command failed ({p.returncode}): {' '.join(map(shlex.quote, argv))}\n{(p.stdout or '')[-1500:]}\n{(p.stderr or '')[-2000:]}")
+    return p.stdout
 
 def ssh_put(content, path, mode="0644", owner=None, user="root"):
     """Write a file on dev2 from stdin: temp file beside the target, then an atomic move."""
@@ -480,6 +486,13 @@ def render_env(vars_, s, st, service_name=None):
         for k in ("PGHOST", "PGPORT", "PGUSER", "PGPASSWORD", "PGDATABASE", "PGSSLMODE"):
             if k in out:
                 out[k] = {"PGHOST": DEV2_HOST, "PGPORT": "5432", "PGUSER": st["db_user"], "PGPASSWORD": st["db_password"], "PGDATABASE": st["db_name"], "PGSSLMODE": (s.get("db_sslparams") or sslparams_for(s, st)).split("=")[-1]}[k]
+    if s["db"] == "turso" and st.get("database_url"):
+        # After `db-create` + the app's Postgres port: every libsql:// URL becomes the new
+        # DATABASE_URL, the Turso token goes, DATABASE_URL is set if the app never had one.
+        for k, v in list(out.items()):
+            if isinstance(v, str) and (v.startswith("libsql://") or ".turso.io" in v): out[k] = st["database_url"]
+            if k in ("TURSO_AUTH_TOKEN",): del out[k]
+        out.setdefault("DATABASE_URL", st["database_url"])
     if s["redis"]:
         for k, v in list(out.items()):
             if isinstance(v, str) and "redis" in v.lower() and "railway.internal" in v:
@@ -715,6 +728,21 @@ def cmd_refresh_db(args):
     note("app restarted on the refreshed database")
     mark(s["site"], "refresh-db")
 
+def cmd_db_create(args):
+    """An empty database in the shared cluster and its DATABASE_URL in state (Turso ports:
+    the app's Postgres schema is applied by the app or by `libsql-pg convert-schema`)."""
+    s = site(args.site); st = load_state(s["site"])
+    db = db_name_for(s); pw = cluster_pg_password()
+    if pg_admin(f"select count(*) from pg_database where datname='{db}'").strip() == "0":
+        pg_admin(f'create database "{db}" owner postgres'); note(f"created database {db}")
+    else: note(f"database {db} exists")
+    pg_admin("create extension if not exists citext; create extension if not exists pg_trgm; create extension if not exists pgcrypto", db)
+    st.update({"db_name": db, "db_user": "postgres", "db_password": pw,
+               "database_url": f"postgres://postgres:{pw}@{DEV2_HOST}:5432/{db}?{s.get('db_sslparams') or sslparams_for(s, st)}"})
+    save_state(s["site"], st); mark(s["site"], "db-create")
+    print(st["database_url"].replace(pw, "***"))
+    note("the URL with the password is in the site's state file; `provision` renders it into app.env")
+
 def cmd_volumes(args):
     s = site(args.site); st = load_state(s["site"])
     root = f"{WWW}/{s['site']}"
@@ -926,6 +954,11 @@ def cmd_firewall(args):
     ssh_put(tmpl("firewall-data-ports.sh"), "/root/dev2-kit/firewall-data-ports.sh", "0700")
     print(ssh("root", f"env PORTS={shlex.quote(' '.join(map(str, sorted(ports))))} bash /root/dev2-kit/firewall-data-ports.sh 2>&1"))
 
+def cmd_box_tune(args):
+    ssh("root", "install -d -m 700 /root/dev2-kit")
+    ssh_put(tmpl("box-tune.sh"), "/root/dev2-kit/box-tune.sh", "0700")
+    print(ssh("root", "bash /root/dev2-kit/box-tune.sh 2>&1"))
+
 def cmd_retire(args):
     s = site(args.site); st = load_state(s["site"])
     if "verify-public" not in st["steps"] and not args.force: die("site not verified public on dev2; refuse to delete Railway services (or --force)")
@@ -1091,12 +1124,14 @@ def main():
     sub = ap.add_subparsers(dest="cmd", required=True)
     sub.add_parser("registry").set_defaults(fn=cmd_registry)
     sub.add_parser("firewall").set_defaults(fn=cmd_firewall)
+    sub.add_parser("box-tune").set_defaults(fn=cmd_box_tune)
     p = sub.add_parser("list"); p.add_argument("--kind"); p.add_argument("--status"); p.set_defaults(fn=cmd_list)
     p = sub.add_parser("scaffold"); p.add_argument("site"); p.add_argument("--regen", action="store_true", help="regenerate .nixpacks even if the branch already has one"); p.set_defaults(fn=cmd_scaffold)
     for name, fn in (("show", cmd_show), ("provision", cmd_provision), ("volumes", cmd_volumes), ("cert", cmd_cert),
                      ("dns", cmd_dns), ("railway-stop", cmd_railway_stop), ("merge", cmd_merge)):
         p = sub.add_parser(name); p.add_argument("site"); p.set_defaults(fn=fn)
     p = sub.add_parser("db"); p.add_argument("site"); p.add_argument("--force", action="store_true"); p.set_defaults(fn=cmd_db)
+    p = sub.add_parser("db-create"); p.add_argument("site"); p.set_defaults(fn=cmd_db_create)
     p = sub.add_parser("deploy"); p.add_argument("site"); p.add_argument("ref", nargs="?"); p.set_defaults(fn=cmd_deploy)
     p = sub.add_parser("vhost"); p.add_argument("site"); p.add_argument("--no-cert-check", action="store_true"); p.set_defaults(fn=cmd_vhost)
     p = sub.add_parser("verify"); p.add_argument("site"); p.add_argument("--public", action="store_true"); p.add_argument("--ignore-logs", action="store_true"); p.set_defaults(fn=cmd_verify)
diff --git a/dev2/templates/box-tune.sh b/dev2/templates/box-tune.sh
new file mode 100755
index 0000000..9d8aa24
--- /dev/null
+++ b/dev2/templates/box-tune.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# dev2 box settings the fleet kit depends on. Run as root on dev2 by `dev2-site box-tune`; idempotent.
+# - sshd: many parallel deploys open many ssh sessions; the default MaxStartups 10:30:100
+#   drops connection attempts (exit 255 mid-migration).
+set -euo pipefail
+f=/etc/ssh/sshd_config.d/00-dev2-fleet.conf
+printf '# managed by cli-tools dev2/templates/box-tune.sh\nMaxStartups 100:30:300\nMaxSessions 100\nLoginGraceTime 60\n' > "$f.tmp"
+if ! cmp -s "$f.tmp" "$f" 2>/dev/null; then mv "$f.tmp" "$f"; sshd -t && systemctl reload ssh 2>/dev/null || systemctl reload sshd; echo "sshd: $(tr '\n' ' ' < "$f" | sed 's/# managed[^M]*//')"; else rm -f "$f.tmp"; echo "sshd: already tuned"; fi

From 32b63196eedef439e2b569428969d25098b3e24c Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 11:21:40 +0000
Subject: [PATCH 038/104] dev2-site: DEV2_JUMP / DEV2_PROBE for when the
 provider blocks this box

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 133472 -> 134119 bytes
 dev2/dev2-site                            |  16 ++++++++++++----
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index a00a5028b4ce645734f27f2b1eeb5d87e97e076f..9407eec9c7e884af518abcaf3aabc4132d9e3be4 100644
GIT binary patch
delta 21832
zcma)k33yc1+5eoG$z)$3VMz!u><o~EeGeo+*b+iW!j=HTWbPyxGMNeIP7)Xr1{K%3
zpjUgbic8&<w$ikXbt`nSDyX4awO9MOd{s-o+G4G3Mf>@GfA5`S0^0BS-{;9Y=brt%
z=iSe_dH0s2kMyLB)9L9c7J61~|H+<?1vh7m6n{7|C1kbx9D5dOvu0##pNpI!=}N|9
zR@Aas>c$T)ab*rFnb2fWvc4;P<E330;v3&&4T>g91Z^fNL-mvIiJZk&i*J%Ic~1p*
zbrJAQ>>uGVVHVU)QL=sG?yx91$82>|wJb40`^uW5-@R8P53O@4!|SFgBkHCrBkN`;
zxpf8o<<Y!>_Jzu*x*{e2u%&LMGMeBlWemaDimHq~Eb8VcVZ}+mbCq^w9R1EyI+XGB
zJ71YVwH7E72`*G75nQB9Cb(FcLU4&PmEcmPQ*lw<Vr3e=EmNiwT&~O@SdyXaQwpf4
zl$M&f=dgC-#{3kesL>jGy?J<c_RRhnUXnj+Ab<AY`ub_RNKR4a4$jM)H&AzeqqQ-i
zZl$t-Mqi~YJghxsA4kY2NLm&{sP>NCRZE4{%4&i&${K>T%36Y(m30KSDC-GsRm$tO
zDHW93uIyJf&<g65h*C+v^~y%d-Jw(w+^K9LxJx;pR38@Fj)ba-%5KVNRXhZPN&~@=
z;w9LoC<ON^K7w*!ZyNh&U8gEtN)vS+R+_0syW%I<q3j{pskC_ZDFI6DS6T^1lpw(a
zN{C>W(nhdb*-P-CFRI9vsTPY&BHSK)EJjVjvfsMj>gx7f=df5(6ko^e0@WY(Eq1ns
zI(oJ^@)N6#<W*%`X1mvK-cV&&j1+#Us@}Mw%#~o+RJHknwIFmMeT66NZQc-4e8u~H
zs!XHaBSTh(f<d1*T<dT3h1$c#v*$&u1?vsr?2+kBB4HHODbxNd<N8TMC?#_MMiNj#
z&rX>~(69$XVV@jB$<^9TnNE?fl`fgCy_LD@|7z3ekwNLCHfyw1S>qh}l=51&6AN>+
zXx72y7|dmt!{|p22N*%Xu>1D;!!E1L<rgolLj?mnWAm^nexIC38EdtrL#CTuIyC32
zIr`?`h@m~&kpB`1ylAaGds~{!KrbRiCR;4pYuSOd7{Zlk*u1TZk>G9id0QlHgvCho
zdfLM6(kG|Wo1DR|+SEk)b()Wf1*_UDODVIw=bD^iVUC`F(bxZlaHU(qRAxS17UF*q
zj>#Siy&bc4i6$$gN_Rpyp}(GD?We3&mYo}@%%R`CM2s2PmC$8XY>KVRe%$_8taf)|
zSE6=vBxksi(6WHGC!x!sIGB*E!V(;<Z~TcE<4~-Wo2Wf9e6)5;Bzw4$gsO5+7}(}V
zNj7^)q6wxbse7_D5y?))F7Oi`u03^azE(D3SVCG?;+{OsJt8-q#HeD)!;&aZn{{1I
zbe~XZP$gZ-Gz*R;^{?Y{5v6AR-Nk=vEUv6dLzJAeQC=-=JP<Ek0Mh_~^mAVU0BPqy
zdlD&G08j{k-IPTDQQA<8oCz?CfGg8Ts;OD)UQt?8CV?#@L3)BsJ~<aP<^jw{u02c~
zU?ivkpRY|4UMzAUz#@Rf080Rt0x+c{8TNM7CuK2mc)rV!nqk?D&OEZI!$|am!@kzG
zuq>exHHkosVoZXSsb~ODi}JCwtV5Q!Q?rjwJUaa7-urX!N$ndk<6&>#@Y!cmXZH-t
zbqJB)lb=^8(y-VI_QG&$n@rZWj9QkB@he@nK@&~Y9vU@XRA?`b%FAXhO(ZGcZfg(A
zZB%!c_Rmo&Git7OIN#@}p**=z`)mH_;aoXI4ST{qcbg~NEZtP5XyZpuiq-dwelT|z
z<q@vJzBbjB$Teg=x~S2dW1Le^YOZ-Od!__J9>vWa%SNi<)0)Pth%vtY?opA`^NTT!
zViRy-BoU{pVRxuSR^e52$~E-+h%g-fpyCULd8hq{2xG1k9@$80^|bgDzf|Q8s%cKi
zhm==~I46i*+Fj1v{<V2Je6e|SP>trEmz)oaBo8HB$+A)F9=~V-@`((2nRYDGNbv0o
zOOI5kK(!OVPR7Jvt4FrT!<5&meLTKi<m+!86}ei&gdeWs37CkXVkRgfxwdRWRYhrS
zS&d<rK9AzEk^uFz`eZx09*i(M?QcL{N7;LOc1|2?quuPDQY@xvPfb}I^`b)s;Nn4y
z6yLr!Pf!7E8nz~1Sk6YJIRp%wpD=d-uU&XeZ<L`{zZz-`$yQHTO5`Pj3uupsveu(w
zoJl6qtII~>v9Zap`LyuVtQ;nlB-!Z>hgy6=c?Z?#(2h?1Cz0t9*ZZ~*%Ss3FNJy$i
zBK50!ntYLj=5V;pdBM8aDQ~0}k)+yC$l2-%?vG?thQiL$_Hc7Z`XfGt_xv1KR^9|~
zgg~vl8Ew*~#~<kQ?00(F{EMA_C&>+YzxG~1{tDp5NKo2a+f>8h3qncAb;xtH%Rs>2
zU?fW4-ga7|kyvdec-}@L6^Ghr6^gdJaCmeAHIdf<FdE8{isJ&}fe7yya_=I5PQ%jg
zQw@7VNZBtdk!PcU3_+VfYSj=v)>>)`m4I~2$0Q(I)82r5k_s-TKeY>Dpy##1-PU0x
z^e%r&zz`~r^N5g7YU^f=9?6(bBg}Vrq~FsJAZ>n%>S@}+Sqn^-vgxJ25jol`v(7je
zd8yjHv-c%|i-=)MwQ+MMZp4ln2~9H8-sVb>&(fRx8M4xdbUOTApPR|@31o>@75l)m
zHYc4*gF~XQ3_L?+x_0ZF0Eq}O_q2lrTblNpxzXLfq$08?0+CFrT^QT8LT{***elK%
z8r71&B0$=`f_{t?>1!pc!cEHfBA!Tz4NLj*6{>ibc4A(T=*>CbDN;))gYhMw*2))*
zTmKBbyBzVA$&-{}Bs7wgpdC@Ts!A4>xvm&HXV3_WuPqST-%5f;m2Xh_eLX)}u*I77
zCMBf-@D{-Dwfw~+vj*5pK8MU-YpWJlkKp}D^#(ku>TlfdRvP5TRQN;fdy6%iZ0V9z
zF_t+pArR{H$w#b)wQ#09M^y$EtF<gG5I@syU%GYNhsY<Y=(o302<NI>lC)Fh=al`d
zHl%oROziY*D((<sjrRPqV)44>SUxF_r;^bo{UoMnCZSf3KPVm4-Kn0k<q<IlvnCU<
zy+QsBDH7_^-{unXT6!Bis$C7VH_3Er_=5Jgk|JxqMY~yMYkfTl+LF?bM6xzvMYV%5
zbY45KqS$dOwU^In&#o9TA&VNR#G=5nNj)k4V59W7Whmg2!>II(_OBI^Fw?TKe(0zc
z%p<uoBwN%rkJo1;waL&PGEr6es`lRIMI&EBd73ZS;g_KxZ<1m4EAm=x_7-0%rY$E>
zm(rzucgs|(RcL3n>?4enZCxJ4L}Vrb!(O$qx)!FN#g$<sDh=-D5YYrt9U+y|W*_K{
z#5ATk&{mRhW08~4i&beblBjVDX(d&jN9BYdv7}0K4#_aMQ_e^2Aq2cayG>?l?`}`f
zMr<pc!To_BD<2`bD*sL?Rsr&9O2x2sh_NL<)3(%26lAz<TR@8Jy=}|H7n*bXu;vBm
zdLaOYmWwH6q!4S7{P%}~Dlv5&8<?-;23&V8UgrUPNlh=R$rA>Wc#Sl*dD^k<H&4ZU
zE9FvxgJ)}q&^OI>oOYn@F~>g4YQHw4esVMy{RQw28!eLJg#V&C3zj*F<NpWwtI_j9
zIST0~2^eWxH&&O|RF$qQbFW)9NLDnUFnQyavg+z}tIBF5Bz{~I8cEe<Yu44&R&SU8
zL;;iG``X$1Nzqeyhv=400B~enImWmbc`pEfDw(?sTfi4I68);;Z}NwkbHFaG680$b
z1My5-fQl}o3?pUry6T!*H<Q;NP~#r}V+f3jt6tfS%!2??fJ54m9XY8VAQ=K^(|)jH
zc@+r30JAG@P?IWwM8n$VlO?Fcios57pvphu{T!;>iB}X;j5}IG?IgeqYln~i{PL`}
zZ0CsR>s*V(fGQzZOx%BjRGcJEa~)4xn<`gfNCz1T=qWKI+nPN=mF*(A9z_WtH&vD)
zExcqUk%h4zv+#AuJY<p<Y%)z7*y>L0wVeeq?L{J-gjf^Vd2+w(q`I&5<nH>f)YWmV
zfSs0`sD!<`OE#KGQRbrxi@2nLzV=fKmsY%IJ_(fYo*mZcE>x-`5Hl8K4KfxIFcNFl
zktOC{C3&oRjCC0bFD5FYQEUd|eLzB^c}Ax{-0Ti@kd5OfZ&X5g7tx=(ok|Z`{+?n<
zPQ6Ln*jjDc&OJ}H+Ql&Dg%S+KG9Vc}&(dBC7M5b>+=ofK+wlr5O&rIZ+<^?t<RWQm
zZU+{*NLv}YnTC4#>fD~cgzmIDc&G*15qYJ9k>JrrscWVsQ#Z7vMhv{gO!M+o^lT*%
z6Vr0FcD*`UtkND;tEMof!K6G~#I|(KT+`{oHb<<>C~mNHkvy-B3r~q+0G1wdB~k;T
zGvYA$-jyVIsm!6w{Xm?NNaiZJOp;}R>HPEb5~Lg546Gg!xl`p@mzX7T2P!52miC+p
z53{X?gk`})G7gTcxwFTSVvGO@WL9B-!P+hf)TuUyI_33LvPqk=FXpNU?UT=Qdal@K
zw=L#np_53K)2}*7!8Z8{Lczd(=TufQk>Rc-PKu2*`-4r+aLB28J&lc_fI^#n>cAqg
zNBiPHt^?aEw`+M_`O!GxYm{juK;%f%3uUPoL~bJGv0YY5Z)D2x#$hI8XUZlf6Jkno
z091+f7<MAd@YkaiX&m4n%hZiA?xdPqdVbusSJ<)5+MzwewUUDs;uh_OgVSbVB$-B4
z$SS}{gYlH1_!>R!fv~%QoN8~gyqC%q?T-g%4Rq8qCz@%Evf-ILNQ#5|Os4Z8#ilk)
z5&3HXh+tYAgq1u>z_2z3nfnY|cwgACwfOc+NU5(cELHm2LT+y;*ywMPkI-zIFk|i1
zW!I53sJQ$cA@0{^94@OuNa8|HVbD+BlD9=IS{3rP_++C$;3Gm|r4io_mJOIN@!`Of
z7`<^m)J`29mhgQZ>#f7bVy^NnS2l<;?XxQ<tYKRF63YQ^MC^t8TLZ*`JP;f&B0=or
zVAQ6=0%{}!(X_*Vh<2L$suJq^o~w>l-be3p7J&;%aH!P9MMX@})DwE8sWNGp*lTW!
z&y)&{lxCkNK$44`9{B|I(XCx|^%_FZ%U5sAS&u!AB-g~K)oJp{qtr~UBoMJX{Xr+W
zmi{mW6<3lu?W3Tgyp<Xm4szU@{J}^9hbSpF(RAkmLcra3PFat&8%bDFSo(Yts*&7+
z6%o=YXi_AXQ3rB4Kq<N!QC+&OVr%Jk_o|I6%gd@)ud66?SC!VTB{whY*mYx`Lqz~W
z;`2xYQ2IrrU(}vBHag=pB`Mb9Yw`tG%j4RAAG<I20WL*;T96z=H_2_4EG2nbyZf$L
zsoW=b_M-OIT`n<QOSpT9gT-@;w)*Z#;xR37_bzLZY50;Ir=R@3$kP6P_lEI;`s_E0
z0_a}^E<!k&aNc_+il1uN+*3@p=yUg|;(OZSdyB;5+MautyKd&@ks*bI)aLevqW+y%
z<#8&JZxJA5mCDsUzq$7pBIOp0U~QAKTD$wcsp6iV=kMDjrhb6j%zh!$&yY_dH$@qs
zZuujv^nr0}ml6J5v(2pq_nVXm?lmp2Qr<2^ufP)IytgQL8N|Rk>MqnCeZUz70W+_$
z6KZmG+%39>DjE*8xjpO;7!KLW`#%Ovz%E8YXS1K^2O>|h{;fr>y(tiCFhd)ch=w+v
zS%XLQK@1wHZSB#9fZyvTk)X;{ObTj~Vk#7{F_L}3b_%UfEK5F*0a)6C;5n=!AyFk5
zi^Utqa9mDP*)a1kvoi**ofI(Wj0rjBsRYS}zE!qp&p((kZ91mqFsaH&B(dTq%gi*)
zI6}zQnw7kshi-XjavowmhP@f=*NfR&I~z@-<O8kbA=e-Ssee0V7U|{7dM<ltN-DWp
zkNj}*(m9xWTw-Dmi2lzZmnF#{Jq|Q<xc9arOrJyfZ)&MMn~B>!JqyL^tI*IcLBU35
z)#eoy>sGp}s>@cd+eWtaz%KR^H(Qz?Qj-{Y4|pi={AhxBSF`<i{a7|*|Ai{lrDeD2
z!h8WF1H7XJemt7SzV65Mj;V8yyBL5ylQ*fpk*0XU9&9fQr?)9fexjv69ZfxpdItgC
z()6d7iu2lQPj4q=6h2d68aEl5=b44keQ2>C0G@_xxa9e~j|{BQB=l;e1{OC6jR{oG
zNLSTBn@4(DRX4@Pn4V+}TKo;Y902G7xYUYA-c}%(l{OhUK$IzlVOq%-0iFP0H1b}h
zQuVKghT(})pi?ptEut##_k^AuotXD$%mS**<lHaO7aLm(v<H9nxP!g6tezdu{ocyy
z$aKy5$~bNJ3*R5Jlo}Cz{Jnqli|oA5v>7ih5JNQO#d(C#@4WbHF;r_fJ=t`oT^R1X
zrk%cf4YQ_$7>g!1$dFo$PQi7qbkhJyBziOD2Dt|m+M@#%(}TGZeVx<xpBYzdqg5Fx
zY&5xHG|3#4fpq27lv2|v<>cp(`Iv+RyE!seoAu&Yk<#<eGaE!nKAH?cb|Sefg<!ir
zbTx?pt(eX%Et1EDEox*A_{TA)>RRpa%j5F6){23u=h5eCfHm6BUY?j;jt-Y%#uR{7
z$<&uad;anAIwA73lD?WKQ<|-^)^v}P;%Xi7zz|72YUGn)Hnt^@DC+<g(g3csK?JfA
z6Icbn?g1FcuzK6%S<D0olVt#mDMnHn73_9S-n|=$Dxt^pg)(B)gSCce<VtE~xArVN
z`#v2Z=o?!_ZqM9T9}(+dJ{VTFJCbTfyb4%|HdCjy(oZmwLP0xZk`84JPa2=(pih}S
zZ{Dm$q>?H*ghJuA$-f=H10raUg23v`V0;5oENhQq*`@SK@&slE`_C--E>f4Ius8w-
zp)PA^@-wyje|tSijajchl(Cd;DNH?*QYAwjeyDJ#Jc919MUh13R8X7KbU=kGE?nd|
zE$4%EsRrir7QlS1`GadFU2J-oaTNQUnKNgy8E;OsPaF23I|?V#T=I`F9JAxcNPQ0g
znu3GYWGM44W}rGq)AWO`rB|ZJ<bh70$mLxCcLUr*Ad*x_vAPb@SgYlEdZ%+K+3t&^
zvSpCnfXHcqtim$wlvN^c)EpnRiz2P-quFAT_Jfb+Iwqj2HQKq4ew0;D^~_nB)9v}*
zACp8XY%lpCYMtvjd2X=~nLS_p>1H7|X*c|No#Q=}ZqnZVb4m2l=4gV|x~7`qr;(}}
zwyj&Ynl=Mur%C#(W}SFF1pomi%K>1Jv$w&zpS=aPKbb;VKbZbbDVjyoP@AbLmEMii
zRb^Eb8@IbR*OXNcI_cVmy4L})Q2~#UH8~T`AQJ)t$_)Ro>WrKB7pUMOwa>!3-nx|P
zvjks9Q>Vkcwl;`k!$Af`6P->lD;~wTyzi{X6Z<(%)wcX)*&;}I^2<7d#Kj$k-HYbJ
zEg!~A=zu>KKC(B{fs`4}NoWaDZ3<<+^q0c1d1##uN0fp(CYj4lY6Wzv-%Zx5=8D-p
z6@UFIS=4J4pU*8Zk+ia6b4_howY#ixi)qzB@(+rWWP1bcbfP8QZB2B(r>bOYDl$S{
zUap<|d^(AT;Qe%Zm2jbfdTqW?U%rWELG}T6o>sNSy>eq^ZRxto!COE_ST>c;FrdT-
z>lKQEHn}}YD+QdRG{BWw#uw!m9r&qV)CvdlPnP!5mny0B(tl6e#7+?#rKP|wYnLTR
zF+CuFNAqDt!5hU!+7py}@wuE_NJBEXrswH@*NRQk@ty=^V2(_|{jT0~=$&mx*6=*e
z2`q;G`lIft6z7G-$tJ<&)Wa>B=c|?M=ISMy7%pD!`Po-T9mOTogdaK)FAY0mFE}4x
z(UnGU^s&SUWp-zT;Z5<=m7%OuRvj;U%%+zlieX~4ey2k$Xjv038>o>9rH@Bh8=<XG
z*4<%O)*rL==L*X=)-7+rN>c}2DX19KBHQeddfT8cOB5s0E5lHE{Onnads3oYn{^;t
zzcx{1Ojvn*<6}0nusbWfAy&^4-q@eoQ>D>Gpv<bStZ?N(UbR;I?L7S-i6UEUMzKCR
zNleS#)IrAB^-19o{q>aUu57|hjlMfc<ceB7k|f4uZVqqhFQ>9C`u~1QjMbk?7HPR#
z8I#+NB`SkwmD81@-~5!w(c7#dNl!@@i^O()RkA3UUKd}rQr|r+3>xA`S)^P%%8vLb
z$vclFbPYSc>oJ@5$rX9%G&ym2*Kj#faqD{@5II(5x1N<Ea>shQNBsZw=xU%IN1#V@
z^zM;y8VE0sP07-gtaxLyND*n&#`YNPA|7rVOLymn5o6>B*OIzMYJ0E9p=i%zLQg*<
zMrL&94XV(n7p96_TYsV6kSb1RH-#Ys%^v8&Qdi!doq9={C=!0XElrFqaQByX<rDt*
zbd4d{(lwS~;Fu$h(d+Z=mas>EI!#O&67P_1IrVoqLwBZ&=_06Cq>BX^p-NMEm=?c&
zbGq2-K$Ka|*Z-0(=80l`VuqNPH5XZ|DZiv?NGshb%F(MTM1p>KhS*sERa!}EHl3>V
z`z9rnXV^PE6siV-oz8yeMDH6V#)v!g>6v1MSfd9sg-aOv(M+*w!qs39NXSQGwlO*x
zEW_kyX6s}6m@M&t17?T3R(~Ojh^wyGHbm?eQSk8v$KrW&=gclL#Bw=<`h3JLS>CwN
z|1^Mc0C7u$we)1lGg7NI*3_=4MihDlA9P<xE0Up5xQGw2i`c%ukTGfdq}EAF?WDDn
zHcYCiizF1HR6;}R?++EL#8Q1qw$M{yaa^!DyPOvs`dir|*8#GUGxQ7D;t%4y{!WhY
zi!OcLFd;=qe|ngBTWr#AA1?NfA4)x$$2&1h7$W?2JWSBHju4Z@vfhIuM2?ur_6<UN
zmDGr(CX{SHD&M5^*Si=aextuPlF(Na-%{5|(KuS(2Mpa0@Bo2tZuxqy*dQL%C+3Oz
zF;~&R6z#eVEButeH???8e>zY6D<4(qnDzgt_`3dA5Xqx@M!uL5ofS85%$Nb|B(@;F
z1O>2>!3Higfoc9ghq9hCF#%(Qf@2}+^~uXHJex<XlsfQw2H+IH0e~)meupw@o(maC
zbT-n68yV(Rp|~bogxaqVFw*+(Ho57{i%n}2A>c$aqyY2Abb_JgjHE_7tfa#?X+}g|
zK)r5Eor5piQ2C!xWI6#36L5_m6cS;T8=zW-t*uFwZ=w=dnc`8MX5^=WvJ6LC6Ng6}
zs`TRcJH(mhp*~-kGVChd@t|;S$jgyjx>G_IY!D?O54oIrNcQ6R%1w5K;h=y3t~fv)
zP>ZIp%*KcblycLV6Nd20dua`Zt-+(nw^1k>Of`Rv{@2lBx_Kb)fGtIn`8id+jsDbI
zdS{Ih58B3^ob$`Blfk~)y4UKJzB*r@ueC2I`&!jLHQZO)em14O_iy9G8#d=q`>9-e
z{ZM<~#F6zQlHSOlTAy!!Ghq@zV@Z1bxS@LKcf|1CuO^B6#7KB4wJxhkNI#&_F4(+^
zQ_j+#oFX=hhxDweVrd<_GMJ9sNt2el0AOj!Cge2&uu;p~V2y9XU{W_S%#*Z6>7)A?
zw7lo2*_--<Q-zFMC%v;>;$v$ek9R$~y#b&O;6{L(0FD6M3~&p9NQa&^j5KawhS*l5
zA@^1QNIMDa$!`Nd*h!thg=D3nz)Lrph_uG(pUx1?=DAxV>NA&o1A`3W4Cb&ndtk-p
zfejo0GSv78C~oz!`uGuzd&voqX)u$m=9O7Imlvqc`>0na^y7aL&fb(lF+}9&Q?Fh^
z_rQb0A*hW{AGGNt;uh*BJro7`_Urlju_EzXk=v`z6w`z~ObzwZvqVHcHcKp+kauhd
zTXV@_=qi4~WBXI2$wwW}*PdOS&nAi1w<*aXEJwuk`TFg%#iHowm?~tYf^dcD_OC<=
z3NDfo3^_YO0SaNNan%t?+`?IOg^CWErc-4)PT#P?<-~O^C%eFsV>av&@1UjgIb9?%
z?2*obmCi_#v%uTvEN~_j$~#bcr(QcpEQm5i97D!KG`4HVAQ8xf$Qv|3ji&q>MKw*2
zjU`fCKtVRi6X=Y^UMXIoAm{}4l8t01^PI)9p6qg}U|^bb4yck#(c$IGKrAo5@#a)2
zD8C;;FVkqB(4Q)MH_jDxBAR_`#gS$A3_qTH&w<BXPpo=k{>j`k^Ilo<!jitN+xoV<
z&u-oQYPqLxeM4Wv0gCr@i&887bcq%CSz#@={@r4!ux_%_A!UVitMwD}hsw5Dx1&m(
zbvH7%Sv^+LJ{8smWR_dK`0-kURyX~ItSVlE)-Zm;)^2oq(7Mt_ogTEVvr&8eP}zE0
zIesc^)yQ0LtFck12d%Zp?6z*k&t}^e{A6ymePR=tTlH(^i?YNd`>7$5)};5oHeZah
z4rBiQA3~$)lV%~6si!OwQyiPI8ME{Si^N37GHk~T-LpvSjx#Ba>Kje}owt=m5DO#T
z{`lU4Q%tSMV(DwF`CE*{4jJ~I0#gIGepvo;WJkVEmB4R$$zt)9$nPy#B5c+*2SFmS
z^S9X;hLsZQvQJTDr~5VJgQ;djjHt#WntsnOX7JsrUsp`JJWYS3SZpVc*0xOC?v5)&
z4b8j&3V;t_A^{q>9cd<XL}(4G+F~B_^)DnAUrVF-QcFX7&^&Z_kCu|Gf3ZyL894Op
zjV>3()`{i7Kkvzx=oprg{5Jq!A^KmWR_pJUir%>c<&~r|zCwWo>oxBM86v_9zSOKe
zy+TYBWAyVYL|c?6jW&{F+rS&CdXfkn(i1572X)(jVqAhDt{`C8Iy*b%TiCL*c(r%>
z14{f@bvH%Pke!D6I<ebhsys*4htuY%M5C5}9kQHv^uDuFoO7_!i)5{&Sf{_y?<G~>
zBm>AP4gKBqWbu8e=aq{Yd5i{L{M*!zVGXGABbpz@yY$`VV$2ALJ~sU+3T|HWROrr0
zwSHT<m@De_7t6(7k<o8F?p`%On1ngvE(;&g4pxxzGs=yO0`ZY87A{;G2zfmLby?w3
z3Tx7BS-EUx@82uL2_b&d`(UNW7bZ_&krI1rns;pNu>}a@&u|3zq8!taLD%>^bl_f!
z(c@&xTf&$hg95OUky5&HLz%m5108N&8rT2{n)X&j#vmcdq{8O~?*dy%SOOo~zmERw
zkx<YlL1(y4>?PTUT&tpz=?Qy4KB3=GB}T-q>h_~Rennk5d!MKxqlS3zNUa!>kow<P
zDpPE|etf$aEq3WIZWoiM{~n#Ex!t8zReY_<?KT6eS#CE4;^-QdyRvixc`t66p^vH~
zM{l*hrcOL5igatexGeQFx;3Z|xw-eoda)^nT}BR2Y@`S2ydH}(zqw$E!{IzAe!jSD
zY8b{nOQvlDm`WOiD4su%B1-^(HwwAYMF6r211<40mfQh(l+5Y_H~(ZhQS-9i&Yi+x
z*DHP_lC5{y2dscU+mDEy>H7B@L~FtWB#jgGX<jjLT6a=-I1R*)EDq=Pr<HtVm@+zE
zri{@x{WQlK9<8NDCKq-k^?UP=(FE}{B`Ar<2XcdH@t(Sp^h&RAjZG#)!lDe#vnXRb
zEcA7ST_8x{?67pFbfu_idX^$al3@`X5gx05KScKf&i^uP&h-!3EnW6#N`#!WZhLrw
zIT$IpggY!<Hge*}N0SMT=}M7SWkOIW6YtPJX%Hi3s8(eXy-udjQWE>;$W}`hI#g4`
znf+ZUQ}h!*7C9MVkS;&U)bM2eZADDh*Efj#Xm@H?s@%|(s!ZcAP1c4J`zv1Dq(7JD
zLtnxu0=T5~^kXJ!Xm9Xzr-fZ+idK<I<ueclx+n-XeW2W;6euGS`y(wE&AL#(`C*C@
z?ed9nMMeF)L7!Mzl$nFyT(e^48OP4qMyuDq?-TRMkN&_X%IIpTKBH0O@!b}pG&;<U
z*a}Ev;7}%#Tts&uih}KdfP5d6Xq_{Y&PzHYX_F4%x(3})QGDI<$KVU5cpP`Jokqb_
zG20Mx5LBHza~8myb3nOy!r=kS*jJPMhzy}~4u3GHKh-GGh9zUrbc!R>ePd@MiA{=7
z|FZY(MzL5pVCH+~>hCp*Q17>zMN~wuz?2+jZP$oFmL9VuPiR1_n(i#Nn7q1noV7~_
zrn3$p1)vmw<s(~x>+xC+z;Z9{$~cjS>i|(x&ZQ6HUKM4%KnGUHG90(+)lh(DiFl$M
zLS!I8#&kI#M3)>-q8^(W@uNawZ9JyVN@4b9jL0$6xRU-<xGIPAPxpu$#SQx9En;@`
z&78cWW%tZ|c+}&{6RS>6d_JQuyS;DwZa^i_*Ba~#g!<ZKUr6n12vg=YtA5`ey>-RW
zgrnhm+&|iLa>B2to|<}Q&YAXC4!m%nZwGA3S64LjjqvuhwEZ?`FKMLJ*0r$y)>${;
zXS1~qM&N2|JuJ(dhBO$FISsHOa}?bc5OeAJ{Ky68)AZtiSe){DQtSC_OGe%&Ir?P*
z@e)aEI=;KfQO5?u{{RJt32F3M1i?sBm1&na<)gqDq%K{#qf54>PWc_wtwVMT093F1
zGXQk2{1~Z~C|IK}42z<rtc3qUxv;rPE7q0P$iLE?AxaH<DLoRVw)`8wrv%KyD)}CI
z7_Z+K77I-!x(^xq2~fl>mDISqG2m}&^C@)RvI|A5WSMkWyw_kZwE%3c1yQ92U<bha
z0IUI+01x1`3!p!4VunrR<Cs;H?YcG;mjZYJ6o5-KG{<rT#$<9mj4Fo+(8+AvRbg$C
z0A;H(ZOSh&#=i*|jt06w*4}2?j$b01m8j^|_x_14d*)GB^bH{*4`ju-hz6TMhtF8`
zXRAbB@AwXJf5Q9{3|~rsVrPtb4iCZ+jAT@sHqc_H8V<ENWihJ8!jNAc5EHX5i7Bqu
zXLgB4MxVw+VDm>vzlOPO8=@$(fJWDE=n~`gk=^1UQt~IeMUJ^yjM_J_{wDz#9Se|}
z1MoKhCjd}%kw^X#24mIxQ!2XDBhSL(W0o9!cNL<~>u3&_0}D9&p>N)jdTS1f>;&@~
z#|L`g3Na%MXQPI_!|&^qAL;jBA*P6X^fOn8Mh<bBk>OQ(@nNxJ##NXT$8clU=-H2S
zusNY#YBL|bQj8OK>K`2zw~iiYD2p)}`m+oQ8gtEK`jcp|Tz~sYv5umHldq!a;CW1q
zK9nH)HsUBWzi9IV)rkcKeB5;|2N=q@RIX0ML>b8}J4^985H&T?{SV~D1t?=Wbr2n@
zRGub3pb41at@ZkwSBXi}mSO%7+s=U}=Blub!zY%qiYjTnQ?3@*(k+1A6W55J+P5(i
z{t4Zg@pufs8@tKjh*y#N3?P}>$~=Hy;T1AR&d2LI0H_nPzPTUH$kKm)14T<b`o}kj
znsIFXfrBDBxCe{NfpjmnbGfsAe^KR5r@UJC+$i#=@m$z>M7T_jLeD7#VA(1mnThu^
z7&upd=tfZ+Wu^g-m@I=sgnqHoh;`t~6vz7b)Knrqz-}j7zijcbTHtsYGbYm|qlvD(
z`vZuPvOZ)+sKM}<gOTJW``a6ilEn)H5R{<!gLKJ5rOV6vP0x5LCctuyH<)=R9^%8c
zG9i3D9O6OI<p3-P9;8JXRuUYbX&E3e5D1xQZndfFI1<uIS6&f*tD{*yNPlXUO+UX!
zjO|@|M5H-}jYAjE02Ehlh~0i!pzr)P(RaNb{kG^78TvoJO>wDu49{X$M-#|iBQZc1
z^>J62ol`GrC;%*Fd7+G|KOm1u`~#%elGujSbpRYWSd7#X0Jat&Tj)HOMePb~QTsHM
zfzbQi`hFi2a)dtK@^yO1s@hEp{Aus+bU_b)a;Z5ul(bV1-!2MBu6_4*F=N3uP2gL=
zBK`HB?53gLhR{BDxSf2d2I}`$dct?aLSm9--w~gPR3=Q&xb*0Y?-Y$onDR=IF`a6g
zmpedyk*on>t@r{ya(@SlYZ@^!L%*p@4A-l=>4ft0J4I%60yU#c-CSFd^U&R8lts#i
zM`c20c9;mPFb^<#FOkqrlmeBeaCTfGGUORx_Fe#%&<?8U#4~cRtwbL&5_YAJCh=nL
z-N(e|*67{n@*V=j-rq&~KBR591VNu^D)N5hkyAvQiK%nsFpY_VP9|26&$!NAyRp2i
z(!Ai!yzqV0{sF+_0A7IO0N(>R0RYOP5BF*;L?N;X9sd~F-vRguKrex>eYxi#s;2Kj
zrJowS)mwEh?V!lhul=qVH)K7nJYp@JMOy1FY}*3;sqc!hQ|f@}*tZ>seq0na*nx2Y
z-qR_b-)<6Fu72b`v2QkCBjAg7yh|zQ^8|sxWR*zM;cw>JsE-fy#rKOjL{W6RVv{2^
zuCq(^7atW<=~VL5M@5gR0PFPQkBQfWreAhkOrOlw3h(T5Sou&4_35Q^{Y)?YfpCgX
z^iPkAF0s0|?R(^akN64dUPnv6XkD?o|I!<NAg0az9qLdO^ZTF3up+`BUjtiCpYYHn
z@nT#*k}w1*<l$@bc=yW*`pF-N3E4|2kM%H_c6Qa%=#wk;e^8f>b|9`ppZvI3u=^Bx
z{wKgC>-ZsBzkq`G2^h(Z<SEft$hb+4Og74x<RM4stck1!oV*!{%^rwZDVdD+>(4wc
z=6kW@tUrx3^1|pV-$J^+N%!7Z%3Oy2ItaKj2i+R^5V_|7P7{ENX^eeG#Tp1F3o=06
z;#($vt1Q>IoDfrDVHDa}Zy?mJ$lIvGN4+<n5X(}tm=IWr8tC<~{?5~4+DO>pk*or>
zos2KK(>enmEISv=yYz9-h><HXfEgQUMe0o&)X1Qd;Ihh9%sS;|+oge-45An8S29M3
zNxQCR#G+BV(0m)!By+!}V)L3}`mNr$v9_2ZzJ1S-M;+AXJuAkNfZzPASebSfeS%l%
zjx2x0iOcLyKP&tNLF&jz+*(>)xvp}Jkx*7$y|KDdzJWo%;ZXLzlceN_=-odP7iOHr
z?uZE-<U|ltpbZ=K|EXcN{_;t2$^rI}JM`O5iTZi)VoWC`9*uHPIR!%5sLn&V9SvGA
zdyXUq^hrM#_r~McrUEv5MNJl$UQ~xzF%?!lQZ)b?0FxXOD94*mA@35+aY+oEH6GNN
zk-{JU1$=(E2A82FXwAItcmUIFz-tJAosq+oqQjNAYoVeD_ZTFrKdh6!;31QTz9v^&
z!)@jrwCSkzg#PF+#3)Az((U@`Ux>Vkd6YJWLWA|w82+^Z{qK?=(%Nlyh@=G52$=dy
zu{voblj-fCl#~IgEMVs_GJF+XDZsZ%Ox(`cSGP{d{CorxWR|bjPn;3HT##I32;FFN
zuB_O&c@<q=aBr@zD3(|1MK6&>k)dyTN$eT{vs~Uo!(AeRo_mSzU`*A|za&b;xAa*r
zi&d!uM^AFl&4Alq7XI1a!8U@vDrGs6cM>q{AkzOxncTli-}Q><j3VM7uSdhUN(JXi
zrjY|c=701enRpUV<q~>WjJzcPapQ;08-$!L@{pE1jat0RPf!ZSEb65$(vXWbunke8
zr>P%j?@fK;IP4p;)^mI5-`G4XMqm+SFg-c20^Xnd^_<s4c?NQc_vs%!gq*TXZ+%Ua
zIaoN<>rcEUid?8m$Ay(;Tit8v+DWmz9~r4m+(B_~tgP5xEVn~A)ahBj6*Hp)d*VOx
z$FIJ+kls&Y1qgV%QU@WFS!g0w$|#H5e88KLOxKX<-+ADgHzSFe;A;m*9OZtBCKN|c
z%sjamKNwt|qIxrW-}x=k5#gu&_agV9@oxz0I7Ux`i5|wx)l^Z!9A;%MpVe3XPD~gY
zLj)r#+)RdAo4)UNVyD=tzy3S1TwJXWH|U^@ZGgM<5`(yoyQtSa28Fnv)Ne4vHBpGr
z3t0n5A>UTgH-K~tK2B)=5ifB9Vhp8Hq?$sAba9(BY#c{lGvpXYEDWBq%_U3?SaLB;
z<y=Hbu^Gu<(emd*7(@lGjgIO4@GVjbWR4Kt8j=<>&KxGAgCOJs12}sGsfPic1-L{J
zwd)^!AV$ym9rm4LncP|f1#!cx(1tsU??NZ{s4w_XOd0VI(%@-Q7!qkX;qt8B{-M~M
zSBGBbqpudEOks~yk^YAd#jFB$D|b=`HD-jf=4RK_Gboq+$Sd^~ABmalAw=frM{+3s
zd;Le^?HsuBE-N3j(_K|BedjFS)w}*E0^(i$+#iKLNUg+o@)RcVKENeLO)4afL;-6*
zHe#H3tp{Lz!_p$I7rZD?0DJ&(HNjl;fh9_roj^g{dBn-7>9~S$E<HsWgFI%h!Qm^G
zK1@2Wdkkx+gKZ!3EIZ`mK=}!PcC>|zQW3%?@4)HQ5B^CcIa$eEOj+LcFn{)Zh8nKu
zeeh4>vP^NWKJ|i_Hnx}=<L1j9gbjl}%ih~gUWLM6{L+oR2lc%d#K_S&rHnWV3h=KJ
zB1r`Wh@!NsW(Z-I{@?}C?2X4EKEskPi8-*T^;hbJ`g{$ue;$=y1z<Y(Hl@firSoD*
z_mq;UMkKSKAQ&pZSyO>|)|993{X&e6BBVi|xW&BZPw5Ra<DkQ%==lYJpQ48>WUIb#
z!NASwpCLQ7pa24nKmL`!Ku&r=!C;1-OL>G5n9*_`z-5^D6y8-sPydq6;X5gZom%!l
zjWmy<xM}Ki_k%vE-+@AoXIzgIQv}B|aFBON?7|Frynq5G6&!613UnYiz{Y{Z*0Gv_
zETt=Fw_*DsDcA!vQrL#Z98`%ggn4&<A}Y-xK>sSu>S;4?O_v~ZAYNhGHtc66QUS<_
z9*$GUK1>T>52Vp1(ySEzOCIt@a&ODOML5CyPB@{qvbK``ofSbc{E}!!m2B<0td-}e
z8Exyi6pVNkr_GOUgoM<=p~;#uYIcbJ?+(>qu3_bV01ZCJGQ3DJLq3Pp4XDS$_#XmT
zAfX!jpL3s}_IkYDggS6IjEtCn5&I`XCQsw577)6Jz8VWRBR+(WpWJT4zP7Bo%rp?L
zMn9X-V-<jg*H4jRv4Ri_ZpzU35a{OhuOy^+p=*&MUpQuQoB$HpAiWJe?8j?2z(%~n
zspbErBR@wT3lf$JPISQgSBex%57yIeyfy+v*>*jQ<aGdd06YnB3g8UDD*$g0pr|%|
zUqmaF|BbAV0X_$yv&fi5I}9nN?EOfw-0MP$<uy|^6ZD<PyO;6LpNQbgQ1ipgCy-*w
z=MU?~U`byfZxK?J05t&25)q{EseyU<pKqQ09Iwv-FiSAkFkkS|KA%4@6ET}a$6%*j
z0Ekg@ERe%#an5Askci=PpusdM*pj>rd2DCG_8#D@7*8>`f$~8g{2_sxDR<DP8A(fr
zwuY4UfNz=nGxb2Lw5b2Bzm#D8c-#3TOM2!_>#tpZQ{}alN0&ToeKl?Rq2xCyukPBq
zn|58h>uANp<6liLIFv%4$(-HU_<YXu`_Hc3-WLd-O${ANdNXtAP5Z9hcf0Lq+1=&0
mmp?r6)seGb&75;6t@lZXHQnkMNf)F4HdlWs$$AstVflYu86Cd>

delta 21402
zcma)k30Pd!+5eoGVP;qYBtSwIk|Fyf4rC!_F$)C94kUzxgoF$OcYq1YOwJu38Ht0|
zxYZi<+Fq+h<G#fDRY}DzwwhLJzZk{6y;W;$t;T9i?B}OV)&Ae#dx0U*{-1B2hxeX)
z_Vb>1Kj-qk?t14&SL*Q*Ba$riyL!vxyEiVlAvIf!eso62nxc#d<lbsgQV-c`CTn5a
zY%TUg;;5P_N_x#yWn|4XWmL^{C8K5riei~Z1iG+TYGx`~H6CU3<(8UR${2#Pm283+
zC~eBv%SDY>X;;S4GfxRA<LQ~Ngp~>OoTKDWt+~oXg7cI~1m`Pmf(1%0!3D}>f)^@#
zlqpnqp)!@;7AeyRE>@-!T#~9tWd;>pWVHmGyZ35m#$;s79GsHkX|xW@pY`qe+QEZ~
zNy-JotLn4=DJU;*c-}?%L(S(jS{oB;mML>-2FsOs1Xn2Y2^J~^1dEgf1Xn5-5-e60
z5-icuh1a#{h?Nng%}>a+Da$X{u1@e&)l@30sK#bRRaVn7s+5SbhMrrLwUoP6Sx2y1
zSx<1A(xGgilI=<vz11k?1a~ME1a~SM3Dzo`2<}oUFSlq8$42bU$hyH9*R&~}ivMz<
z)j39&_@&ZFRaK>lU_@yq*r5aob}G9Gb}20c_XhSUtt~Sx7U?1k?mfaYw^)Q_pLL(r
z)76{qoa5}hF||n~WKz*`?d!B_r-7E_2!N3URM3T6W)L*&?V(6Oj-liV?Z499B1^xa
zUu0@MISHCCZQb0&>Y~c>wdJdqxU1y<r;{$fY?ouHlR`}ynd``+RD)I9las04G4hfX
zXy~!aRC>rXfOG<eJ+L<z@mS?3erX6P0TsL89+;R-2?k^iWfW;UN6j|7bZBQrXX=fw
zic!72quv(wvsQ0N`$6V5ry<;iNHVmunXPNkxyNbP8rl>ip`kg@&>|;e2xo&o9O;k&
zIgQ@rbYzLJ>ZGUJ{Fw-`s?Bm4WtQ|llC?~TEbXJwV^@7h7}G6^P^^lL{_NcrV#0(7
zRWpCLS`OK|MU!)XLc}(hr#J@pxWrOhX0hydXesk2W_KraTNS6`?6yDbI+9>k-tX*o
zY9lkUvJzVs()J{DJCr2eVXLsT=V*)E6DKPU%1n+@{U|jW>{(c@t*~3VZE|1C>>vdl
z$lVd3nSaU%?mE)}siCB4g_mY(D@v2~8S_Mr7Rt_=mEP^#ojq7P{@g268eAEvj8ZJ)
zu-f!)?Vaqb*ie3knSaPNIG4*r>|1-<Z1H548#a~j>ZbmqBUbt&4b5e=-^=y|)ac0K
zP<wlzAyO4=3xql%%jV57MByo5v5II0J13_AOa+)8BY5iH0HBpqAY_S@oB=>gVUZqy
zSpc&EE&%Wn@T5wh+enc9_NIWGgZ#Mw^N?$g(D+7z+8PLi<$Pop04xBw5P<M%k&7@s
zlds2R*gMpKl#7wW(_DfS)0N#Xn>r1rKN1PFg(Gq)6{s!(1B7N$xLkqy07M)Xbvmu3
z$MXA>k=Ga8Jn4a{{d0<+vp?1O+@|OEJ=fA-TGPMN*PmS1(>rEd0ug0z&iFi$f|Z`N
z=SAAWa<*1IVR;6oQSPw~oA3(lfeDkv8twRmaT(0-PTB`wxFaH~sBX3P#RN6Z^1B@s
zlqn0e(>Xb#xptBo@kau_us_l)cTicaHf7?pc!LD3e&T&&Yp8%Q7YT$_kCUs(YV=c~
z<xX<XK&goV?9(83C$)zBijRAj^_0I$Yo4@nKyK(~ZV{QiznRo1Hf^LL!$pEZjrc+>
zasysPmn@;@gTinG+m%3jgf~0bL-_L~@yLd&&EFDGf>M>+sHQn3KT<yJ;@l~sM!O?-
z?BD|Zoq>UQNUGuQeIfS&;i{#iCsEdGmrPl_5cx!kyi7ZmX(R;pMx<Ycs6e$7z`hQM
z(>A|skv){xsQrD)4noyOw}`P?!_>#t@&ru8P%)F2kyuq)wsAvIRq1BKE(3nWV<my?
zZwtshROK9TXs2Cnl~+*q?%rL~CfR6DFPXVaOx1odb4kpH4(kBU9mGfq><#<d6%eXn
zYYIeU9xCM%Fl<4>To+#V;&nu$47CN-P-958`6IF&d5Pc&+9RT`Rj3$e8OUXijbv<N
zlVJ;J9iH?|rWcp&@<l=|fp)1=jga<3&*wy}H_Uq1CZ=nVJa_CG%8t6KLLqmXzkOdc
zwLBDY7j;CMLoyf*D7>+!z@_rL0M`<zlHWs{5z-%Q?egz)`@_K{?x33lgglIb%ySBw
zXgl2<VNZqxPK*Slqb;l&jzBx~i!6m4FdQASwKZ68IAvf@2d&R=R+<T(wBe-UP?(lb
zrxoUpo;`t@$jbp32dj~aBLb3wsP2czy+yk;KV#84N*Xrm+7N_ul4ynqu#Quq20<z2
z&!iVy)1FrOI2Byn`+R=TngvlIe}XQADsQ3ZgF-&8t(%vV&G=0r{C4_f&|lvgQ00?U
zeytXpw~(|{-@Nx6jI$NmUGw+4z#+tp%e2V_Q!B7rMnaPe5n>YL&*)A599bzu7M;O{
zfR9P;D6&MG3iR_7%^4=skdPTH?4F~t>$UF}w9<&y1;-sM!ra;`3u1LoQBl<DZH=Z;
z?Yx0a$!iF;5$nXM{vg$oPZJ=;zlI)0k_@zw1>z%ZeGa`R4Gc^9@;Fu0wZ|@OCtAu~
z=oZOCSdvd@8y4lR`zbnf#8)PNfvyu8Ndgf16-KD)puFLzPo)u*K)5xuuZ@I=Dqo@U
z+j{#JZMCMqN=f-Tz#9O6&~h%yP9I_&c?_Aq)=Dp`9K*Yk+|cS*)nMa3pHeSRQQ;Bo
zk&Cq9V$zp3N^4vC&Lrl%gw{}3Kt5<Sta)?fdsKaB;acl5uXsYcWm$FZyT}&=1_VnI
z;a~Mhl4`2_jI#T*QOl<fh?m~V<()#5Xun&rOuVc)3#X0aX{Cl`ki-$qD%9o=woB6I
zmY?;mDvXNxSOKZzj(Yibq)2$nVAvz%0eTxgs$FgEXp)K4@R;_GqI^3HJMF2XqqU_g
z-xssBsl}BJ#??n!ckwdE^;9a4X}>BSGbM$Zs8HgBag&acg6)mc?~|d{fE-Ds&uITF
zmb9U*B|AoqZ=#w;VpmAEs9}FYz;K0SXg3)Js(ev<ckANpew3#K+B<_X)Xv*wSc8f@
zpv|uiBxBNY5_Ku3X?Iu8w0>>TPE_wDe5~5GB8G{`WCDhLV?|{Z+XS9e!>QE!nnOe#
zM1O=*PMdw8HxkB}=1^PtHHOGVFIJ`Aa8ctH(mksD2$d7si6vE<b4W(OopK(=96_K#
zXg^TXw090CXxZC~F5v#andJ|X^pvO3DFnTIg1`W_dKg>sj8?s4s<3DeZC^<0>fP<j
z#phaXO;+=KbX@>|q2+~?GLneNNXiF8?JBW%92=Og<OW=K4qoR1d_hgmsmT)tl6Z|Y
zwYl2uH8;$}e9Pq`g2QKPh|ssqb)43{<A@`IS#@aMozr7k=&u>?Fvg-uZZ#MQsBZ6a
zH}U@a$X|(`7s*VdAp?z+>Wa$sn>Q8}m-^P043iqWP?%V;wY0KwZAs~7mhEwUXSga$
zSFhb%Rk>aM16?s0zOB8yb6N}%(zNE_oG@?3Rp0<0qu?0;P$l!0VQUSv8_uAr1e<~p
z<{L0eoBS85fg6Zp!mU)apE8W3Rck9ZSNWK{-a(B|0mcv*A6Kw)A2Oo=7Xx%_H`Hb(
zpG2|+pjG>E?TU>c1Ou$D_&`mn1QHEvIKUQ^sTl0U2CDoE8oh_=cH$Mq6zGn&PzQ-J
z!`d03zo0y!t=Kgt_A=KZA)rb~6%+S=Mk-DczvVjqa9EXv7}7!J0D5wUWVqSiuCnzb
zSMkz8ZmKLoS~QR?M0UhJ%p%Y!M<bJzUz2ITK;62v*LHaav=<3;5@Ahb&B=Wda^^(u
zIN#gJtK#|rJ1xtogk8V$HkwIMLI#;4#WmDd2ep{2EpNGy1WHHCPHPOtn%qiYz$BCv
z$S5FSI5)2)d&^fMd8}%Tg>5`<ETU0t#y2h3)UIHp*%#_0(?3WqtK3T+%%necJ5}$o
z{7;f4G5MgjvAuGb{O|omyIo{4LoCI3EC^<!d$0CdD6a_9=Z;JQ-hx*sZDKoSXNinq
zLc$cO=AK}s^R$xi4WyD^ylQOkC*j+y4jyX0c7uAr!I-GkCPY@xN}z6NUG*5a(oFLj
zLzFS3gHX6q`(7kREYpreHqKylgHw69sBP)|0@KC9UPrCV7euW~7t4>d$sIFd7=T5H
zT!9oX6JjOmFqz-ulDt%AQx*Zhp5Y|Rlzb)00>KOu@bnVo4s<iLdWhvNm1~`6rO0il
zm;kt>_e4jQZ56~UOCJ(+sYtVp`~Xsn5g>tVD-1AP;kiJfYICSdUPUGAw3+)>5=ph}
z%dt6lH8t9G-J>V+nnrsra#Qf6IoRIhj)dH5gTJvc)T+>y9_wB#8nrLG$2zcya*H;8
z|Abha#$f{)36L(*bTU~0?nbVY^4J(#MsH-l@%CU~vLs~_69dIG$f8$e2)TBmz{oda
z7%3d~AluW2F>a=s6}^w|-y=-@eQC>RtthrZT&G<Zo0W}`q>HMM`o~Cv*wFf8nF)s|
zqgFc=n>*C9x1cA@8UuF8KZ>sjoMkeUAF0a$U}VT&13<jeY9NT@O#}>UV>@$}VT<gI
z7`B$cJ_!l*&6Om}Kse-U2(>o`o8-MTn>tKUJ9gPMv@K=d`I8WbHSdAa-S<=W+04B5
zAo)8DEoy#AsG%hw8-uL@+J9CE@wqbJW5UE<LsMdWo@=qBHIj}e<7u!b`4A1#s=ayO
z&@k54v@7aGk@mk=Oj*rz^##@lK8V`$_O-PVyYcAor-<B`hpBMTsv7~5r;+SI(*%En
zid3!c%0lAhJFmRC{0@4TUIJ%b&5=l0U6P;A)Jr{~SDHT)h>6nX@VV1ZY7Y2YNmP+L
zBac!ao!XUGttPC!cvVH_I_z{baq|Gpx=o(A4|6Xh5VgC5?QZfIgAod`6_X_$ppcEc
zo*Eera@CrG?a>4!&^ga56SU?-3kd;-56xJIwHq!hDIx;_`3`!rdRInCiJ(coTtXel
zivX6Pt1*>DYd2IEZTFQ_6t6F>T(x#Xsc&OZ)f#zN8+rRR6OW-H03q==NCQy%S)`xU
zetLUO>TfAY0i8fopna8mK>N$>caOc3OOc<_PClQH1hq=0k^HT8_>Q^B+$VSTtoG&|
z9x+XG9KOiGqPR(0eR!I<Uu!$O%R0+)<MwRry~DMWzoJD9T0hO`RkWUiX0p_jJEw}r
zw5#u2MkeQP?^MNu+C_Kei-)zAyH<$rX-DoFoAv<a^acS!N0D6F`^sIv7D?BkH)~kR
za_#UvGsSJazq@CXh@C`k+MqD;)l;yFF#kAmlZKJvkCEXTWOKs-FRC+e*6H<<1K$uJ
z0$GBI&oeg`62PQGFtllKf$t3$0#x7<!`arN(95XsFs9Z}xj;K|pF0NnW&UHQ)8zC#
z<iVqnmt!^#wYeh_Y^Axh@%E2F30THR=xPqqA|Ur9>)VaUwKuhfXnEWoATBOi>D6%6
z`_%wsp^+T!(AM3b)a0aA61tIMBou%#5(DiW6e^(rmHZ7l$N>PQbC^Uzph|EQOE=j=
zuO7FlQJ8C(^%=3&E{Xwk4WRla?dSJTm^F=R8xE6z3@3>dA6Z?d(X|-;{siS#@@VeX
z!~@gE!HPHR&0w`&OwiiZXj&X6wW0?+!>pgdjg=`@qK4kf9+;6#e$+#~)0Z+L<2V4q
ziPmA^nNox5TLyh8T6w2$PX{9R>6HJHmU46pad!RDMPk)uXlR$9TO)1bmX#aU7W+0<
zmaba6jST0ZEgK~1zo7qj2@DYRko)n@Po{`JX!gg~O*)Ax|AQ*DGE1H5pL`Cy0{mWU
zdpw86{_f*D95eHgdm+GlfLE!$k)rq`e(WU+qTi#lkG0e%W638_B?|C{cJq@<#Yfs}
zPi`k<<p0uZ8Z92J{+Ekl5wz$4fE(c%El(o-HUQRWl65({8Cu*hQc9pI#t2ny4g00P
zP4y9XFbT;DwD>zZ=mOXaaK4F-ylNnr)ifC|K$IzRLr6Ufa1?;i$b03a>fem@!p)>u
zrDQ5vKvn+O8~#;}bKD1*1$39mrx2j5Jmh@s{%3#eV3#bVxAwPhSveh@t>yOTYX1Lz
zWa1)fMD%fbaP)KRw=<ge_(GAS1&%Ke3EHj4e=Ab8hUcf7p7Jyd_mOtf^LI>TK6DT-
z(d331NEf10Fq&rsx!BbwavYbU&3jt(MDC)0Q_@JHz(P~N7iw?aC(}{J9Q7SasUxVd
zn}0p#&m@?o+AAlf3R~|NC(6VuwkhEtN1fzy<bk!GM=!YqXi>|6@=KAiLJPf^B@So@
zUd$cGxyy%&*rzSVOiQ$<UYwe-8ub@ZF~Y(sndUOJ_wyIm3PHxsOPga%Jht*G)17t2
zwX$Ka4~0l-QKNv2uw5*H7r7OnfCliS4BPV+m_Q)_Tk>p$SsTLg1ZD!<$RZRnQWzg8
zR8Z%hURMX46w=T1T~Y@K0?t&3MqWp)z7oBQUw)Uu`+8kSjO|_U>VrafwLiU<HD94l
zs$_s*G>O7%UNV?S<*`C01x?Z`pv+saVD4hlFXiU3#}nF&*C+3U6d5Mau^KZZ&NdKB
z$eS={C<77+unO3}W#M&>o+ItUu`(ZQwF;W7N4xj+Yl-pay>Wl)QZ{{Hs6>-C%1~zz
z8rLnaMR(YesM9?Y{;b<{5QQf$A7qY}_1Cq@uVZF!0L;^Zf4yqjxt4+%=djP8GiMIR
za?FW7uZ@1+7lV^$F8Rk8jyVeFLh?ZX$ajt^lXc6x#-~FdJ<~-wfQ4Jl_G|?}E6ZB|
zZUwlFK-85-k+e?IGppoB^iF3*vLg^pChMrVBcmQMPOsd6W!fpLP+p@sKj;v%wEZ8<
z6S>-tKPYfaLRZDwhaVhGucmtDtjy{5K61(>lHb81-bJnVdY}Gqi4d;dFaLIf5M|nR
zAFp-1h0-$Zt&a<1=Ql?atkyHrlpys~)v#4pSDQ*6;?E@Y9HhnqJP809Bv%8#sAd;|
zb+u#zft4sIl104fq<}<Z%!S%aRS5kW$t9&5H&kr*ZP{E}IqcM_3U#jlU?Tv|9P3{u
zoM9>-GR6$gu=cA)iwc1MrGj&mHOt#-D+PW{AzVt6qXV{Z7!uWRkQvZK#|O-MH=zUG
zcUHyDK@JOP)t@Y13?WU<R9CxUZRj-Y4QMWW@*d2@jumrw$KFim2&R%xXlbX~BnMyk
zBrliasw3bdQqaXDa|y{ikN(uV5-ChwbhVh!yZCfQlBm|o&K4A!Xe!>YWph<&rLVMn
zt7(lud=HCcWHhvP(8-eYg`4QGO;yQ;R%9o2da?HO+1VrzV)xN0lH*_X)NAlxJJy%c
zDoDw5=P4Uk`-&^dtBTf^58nhjO0ubRxByK&TscsjvdQOH+9)7=F%58umiFcPa}M4j
zUseeRb5M%*!dEKk<&|I0+QeQA+mTENtRfZy(@YWb&H1nv;H_fg>L}%&dp;%$Xh;T^
z_CEP_mDn@`?{**~gcRh+pu=_yy|c~7YMRIS5f(##gZ@)8MPgwivR=Q0did`5>qRj;
ztNNzzi_zk#pFAaQcI3OM3IFIIyQn*bV9ue0DCO)=jT8+OS-Mk|l}ho$B}Z&}g-c|K
zQvHZiEVQkP6zd~hB4h08XtKqkthv>$tUY8qf?3c{SO$tc>sqja<Oq0<f6Dq{l|VUW
z?gqWgCB}>>i<Asz?Ovsyd{<;>>$Ob%W|v5vvhv~bBM6?;Z-07Zy_vFDBG`8R?Jmc4
znuLn(^vDMNS1vI@+o-$rghY`cHlsuz@sLQ=7bJ?@@f$lWQe5kbfD`$rZ0gP+1XLcf
z>3i&AjM%JSP4&{MBH&v7QRx;v?K&|@|L-J`GGZ$utoo2sp?T?N5{2KsjTlkSP7v+|
z@pWyFuU4tqpA`Xh@K0H+oZI=1c<0WYhZ4H89<J5jN)ofht{X4Tv?@M*QnDC3sc!$6
z|63m(KlL%@;o2dTWykk40v6$4ccM~1Fm5s(o%?AEX}|E}wgc(?V<V74{8Jh(w{&Og
zMJXc7rW_Ia#1}+%>i%)VDg^XpDPrtUp}r?Y9M5QsAQEWyK=*jM$L-#sz4YgCdfm^(
zC_ACHS&xknlf1QqmAWTTX0UrA!QI`H2(}y=x;aAkJ0{pI5ubj1gqSfh-f!!9{p$It
zguXU?N2*wu+Fowz0@DW952uQ1M<J1`oTq=4Di(;v`usGpAbk$9Sm&|XX~o5#vHA^Z
zqSkwW=2lJ`6S8p7Q^1*<Vej%&R2Zb`b`QD=`rK?WQQV|2Nf#?ciM~Hwc<irJLw)^~
zVw@g(QKafGr;D*uz617v+<S1qY(<a5C6hd3cJ%|@J5t>1fH@%#=)WH+7K^QYqeh83
z5i6u7XB|rx6wIHOZ-^CgCiVHCU9uFJhW@7m<N(Ai2-d!nDbGmWSh2ZkbtR&|EBS=^
zY)ZZig(CTUOq|cA_u15G+o!cnQ>vz|nN~J!b4@fM52X^CS3i>>N*rv_+@Rl?E#~Mg
znWBCv-^0jpce}|nb9+PXb1t~JF+gF|<(|>tkGPk+SDmUOMkAZ!B3g@_u792>{vtlo
z-^>z0u~%O;T1e5N|8%r?Q<UjH7$f#gPNjj(Q<wq786xs+XnRiIm@Q_BC4CoXi%c<x
z4IPM>a%#rH6WVqV_peg=+d4U}zde@lJqyH8q@C_@>08H&3v=Y{K<OO-hY5Up%U8yU
zGI6J#J6`OVco_{$L5Lf$#!m=*TZ<F=PsfWdCZMXk2VH-A#VPvf31XbMS5M9nGh%b%
zc8=-rvtnXH;tLQA+ZqMv66(OTf}luQ*_n8NB&3iQ;v{C|9}?TtOcE&^a+_9C7gBox
z23^CLd3<BI=m?_`*CWhZJaKin0JV<;u%2WDK%&I$8hH}0#|RiML>TE*Oqv0VXHc*Y
zljSH$71r|)<gwk>Ln%*e@~{X7YuaY2W!S<^D!bdP?kTF&Wrk?@h}{ux;sZ*DDjRS@
z-9jCi5hEITF<$H{-M*k$Y^Z_5uymz^?zbSs!QQQr*nndtA6XNI{^UgAT2hHdwn$S%
zreX91O8Mv{2>mz6+h_rXt=_N5-=k2}o2vbC%2p@qC!Z0S+UZY{wbQ#2#tryF4j5E4
zv0qS?>rm}lr@s7Z;qI%QBo5fd_ZQc_>fha8*V5mj_DA;itNZ%*Mf-~`ektkVKHC)W
zhHX-^{pqpx9m)3ooa`Oxt~at~?#Qygv3wdqqhQ32aee=sE`BDmVO&%Z<FT{y5RG%z
z)}XkhS3f>eY!P?sxgN2!h6^zfxgF@Q0e}vX4alnp0R6BzOMUSH1<an|1a7372VIRa
zKo=)yVNX%Bm-If8sBzPzuXvXD*y`c&u0pq018fDj2H?8@*8+SG;5vP~S9IqeMEZJw
zLd@a@q;3R&B$OI~v!v&|4Ro1^HaADN=ZR+XFsvT+nJ2!59ft7%^AnqC%nUtfmI?r?
zpKP<C74!8c(~*0G#y#&u#$YR%%(DiW&U5)S)%hdp<q7@Ck7#qp=ZlfJUrC2n)|+j*
zxLD-rg)>A_U(Xz26Jk`~<#S1#>A#pK7V1BrC-zJ|loq8a>`#o4oo)UiIfE(E?&BUF
zf5fVb?}>5RoS&wX;ds5cHp{N>m@9I1W4;&@n=qgkS+V3|W7&mYffO`eG^su0?hLh3
zP*IJmkEnAiXSvT>-81D3s!T`OWh*^yT$pmRdn-Al!rtySS|J~gMV%49bbE{4B>BA!
zjc%{omM3+6Z-H1C<DI@4HSeZjJ?X<l8WR|A!4Q?1@+gyPnvNJtn7F`US;G>H1r8)V
zoq3+OOYAnjhb|~!v4%V+nj9UvspKMbHt<Cp76jjVMJXA?JcyR(Xx1NM7eVjr>}ZQm
zXZ9UgAZCb|_u=3JJDx~<YU)#?pW658rmb&m+WFF^o&B}D`h9_yY8zkK)YQMR`Lx9n
z6f3RtD7LP~W2JQs9&4<dtp8)NR9dU8pW{($J!3woY?sxCDs|RIWbU#ySxGEbTAPu%
z$r{8XXpPk2*+G|}=@GF;@rYWBZPaOrZLN(uEwNSDs68H3w$Zi;k4oD%WNx%=w^64h
zwi;v>+jiiw!?qKTv|8I4n@FqGf4oqXCJFn~Bd4u)xae}n^^a%vWh@d&)+}b@_d!YQ
zd2%2nS)aE=%y4YNMtgPN5;4`W1Y0m&zj}$Ni*qFo%o|NFop+ff4a*#+hWJ)98-nCb
z>GKU<d=VoZrSkK6F^L5%$8TgmRr)9WC8+<Tn%Ke|{hEu!Tc!_a!KLlKOP7idMPn4C
zG;n&Bhf!H8RU`EYitKdrg?um7jC~DK*O13IU>{yj^`m1c`qNV1(T?bmnzyty)ZlMb
zm*)`)Cg?9M7u(6hoxMW*(8rxuV1$DJK7cv^KLD0a6WW6`y5+E|VO3kq!#gkm#n{{f
zS|w%pm=dDLs!u5tyG2&tb%kQ9b>?bp7jGOJz_67haAMx}Ig1qHi{*OySTS0kTr3V1
z3{@;A+0VB@zN8uhCbA)-jEeK^<9`&3sbY+tT_VCUo;KP@4p{@EWCf5U0b<O6_NVA^
z;OG}7vWyWhY+YSl@-=KQB8_B-2V0f+acP~~j4Gz!j?KV*FIE1Ts;7~$uEL1;qQ`RD
z(dR4`ryQb2KeL{k<JWc91~T@(&{u8{7mVZe^QvE`c80Z;I-u!M%uBy&gP1tx0OkUJ
zfr8oQT}*}Ug_P@0ZV&|{AYh`q=zdSc?cJ+?QX#VS(Pd-~dQ7ikf0@`ZWr&aocf?f|
zK71XnH^~9`SDA1NPv3-c@u(2b_q|XdCJ2*Luo&J&)21sx2W<Ai;xinre1(lE#-Iy!
zemWs%c^D^LM*UZ4HU<C;W+W9AmzDZT%jg_(Son&q<v5?kQiqAtuhI4|00yw+A{){?
zWq%p{*`uNMfCORTK5v66dy#8ZRI)c=44B*rJ_e!2f9CG-<pXpm!JuQYb1x9+`(TrJ
z(Pr|eDRW-hBEGPD-U3FLh#C81Ozf-fd^)VnZ>Iy-z4>(TK_|xgr!`{w>_1>uDL!A(
z#*KVe$>%epvFSb^Mepctm9M<0j9eq1^ytMq$ek?KLp#WBnx)U$DK1TZ2BX2RlbiY;
z-zheUW@a76D)z=0(M|{Tz=rwF1q(2a0k#8M`2g`vV?kGiydDB{v=UcXyeweTyz}(6
zMGx%~<Fhg-hb&R(B3#^)PQuK>zB_gahh6(}bfPug9ycL$G9gCkXX}OGtfhMe`xCnL
zo-oOnPaDMMv^vUg#={}{Iz>#iE6#^qx_=u5Qcm|Ix?SBa#iEQFXHh0}TIh=h3Q$o_
zPA3^3-HB?-KyP&c;iRbC>1!tFmwYCY7Lv1GPak90V~J7P;r;eu)=9#x^pOU+_LE{R
zg6{4_X;pIDg)*7)d1`d|RhdE=Q|U_*XFQN{?eEZ`nmp`#j%o4Ih?8)_zsSVFlrlZy
z9!%3v^i_%?;66}#hF;hxX3t3KPLgHaNy<$ARAkM6>O`N}D5hucPmW9(?5;bBI+@j-
zjE`OPv;>irV^L-+&cU$DIkUWg;wAZ1MIX~7CgytwLoM`?l10fI{^rRau*x_b&Zb$l
zt~7}Y$tS+GNt7-F!$lLlUSgk6YiA&uu%w`1{*qHTR^h-t#c=7^HEQ#c8gO&ne7c#C
z-`>&MD&N*~n#DNlqe5TPEG8tgg~onyt-iZi<YYmbMMqGim+tPm8%d~94EdLRw>66;
z!U0R%U!dRFEJA(jcZ-;a#aPgowLO``j5g*0ruQKcXL_2DA%-K|QQsPDkPdp0r2s6L
zRw1<-fW;9jeb)EbEk02<StDhTHG-7Q9v{NmvKH*fGKa3QGiKyEG@L+yj@CnTCGcmc
za+KaxAS*6x22YXMDlnHLvx%El)1SJ78o?--s{gH3w1{i<>NYX2;?0b#>pO4mIIKLd
z{)x;dB2QI4x4eJ!-u|5pfK8$P@SgsV>{mPbWoLh&i!w>R7g<-qpvznhdoHsKmK#A*
zMVS?PX1geGBwDf;o=(!s+r^Tk*IaF<M_N+Hof)Oy*e*_xj;159gN_<jxbI;hJ+x~2
z7Jy*Xwb8UD-10sw8A6F}n9;@3BDeej>TX4L6PMxjuK>_x@_nQVQBb0<?G*V-S*d+M
zxv*x6Hmoh$Eb(QLA&Lxp5&h)f(BdP2j|rFuK=Lj0FhM`sDHfT^DT0g+0v=%`lUnpO
zwg$uDfI?>&EG1ca6`&HUtP0F!BLEvbd=AG}&o)$f8z2*aNu~>_y#V_Fq5yn_6l^48
ze!RB=Fj@JKsslJr^KoG0D-<xj^&r(vfKE5#vKP!|BtVI&=GCarFvjNu3`ad(tm+7x
z*4O_cn^lho8ty+3n3K&;G7_c`W!3d%>=nOBxR8A=T>p8{I_$18oUmwWrD<0zajTI~
z*ew?WLjz&J5toRm>F34tR_aBUhzE06Gr`J^k_w7&+b}+mkTYml{q{@5WZe@J_mkE0
zQcPr;8^-8;1vq#dfKf6ZDb`beM~eBdhf?P_y}!lESvw&<a=xLRjuj7BNAy)uC@kmF
z9HL;Xk7+SImN#8}N{`4$FmE`V)b}3{7o_0K(Xe+016}gZ`cDp!D|MUx)&bF&%(4nX
zN*3wmSBRY#T!u8qPzSD$lRHOS!x~pT-|l?yN|8%(*)OgTH{}d9lnXH#`XhlbV4<JU
zx#suv<7lv0|M*I=R@|pAyo$nYeBMc)2T(L2>d51#3;@-1(})j|P63njX&sY!J*LOf
zFb63{a$MpK1tCpze~Kz`DcD1=p5$S)2w9gRPl5*cY^X#(b(NSlYZ2z3Ol5I_Hem3x
zalj{mavfFrZr`G-#nm`XFMCyt?fc_3;;?-iPxG(n(~OQ&KXNCn$Go+A0;x{`Y}A3w
z1o#zRA$;T<ycPpM6Oa+h{cuK#{>niLR@CZW9~7HoY$dVY%EZl3T$H1mqFpQ8JND(5
z*Sh6*sCjf0$b&?LyFNgn$bh?~eDkU*x>LzBWKRwuDw&1x>;zy?Dj}JO_vbL33}m|6
z=w2jkjuKt$4ytZCbyos<|Mg;N?A+LfEX0%tq)|OqjSEN|apMC_3CEs&L$*EHx?-ik
zu`6a^CS}Gf-3|}7B5KK7&Ad~FX<=@L%SV?^8zM2XBhzRcd|RRf+v$FVN>_aMnK9eR
zm_Pvl(*(0yJlxiU0w$|(#4&17bO`_p?z?DFbPLP83@e-IZ76~<-6Rjwu;viP0H$OW
z&GL5oQ_~5s|Jzq~qeyXN<p8Tt9TeTIAGm)%UvIyen4((0{$|ld-i+&qV)3x6yc(K7
zXdBK}y48-`w(J$grLZ59<)t#R-oY#L#Yv>tXsAN!3IH-2hktF#ksb&nI_hN^y&Rjg
z2Ul6X?c2i?2p{_9DbVF7+oy(B_h{dTKNR%iuMjl{M}eyK1GfsV*rxa1DlS;~Z4<bX
z7NyeP;2|sbTOZo%i*%54vy=LLQXhSrSVT&?;x=(cBs0l^CuFU@{&vxL(U6Rn)2Oz2
z(*gt-O&^l*N}x3m37jM2X~gIS`r%8+*|y$6@w!RWf^I}}MMdVLr~Q;g3M(#bm`7OH
zFk>)g&y(mZ$62iR&<OOISX|vf#K>oXR0OR#;vN4?EPKGGW;00!B7|7!qe&d=`|%y(
zpVru|XnY&Gw94C&z5{6+E+f$QjEX#rygLErW9oOKG=&2hM#|=u<c6*FRaLAnEjKSq
zGb22N+D8B$24E`UE9(#9^+y181ZWKvmc{hqN5_vM`v(Az0kA%X;V_&597NFc;iPP!
z2Cww_@21ToEZ=gE$Q`+gRvxwH%_S{&3t?Bz*Pp*fOq#J3m>&2B0uhIE{Pe9D7vK;2
zsCz|+Nnd02JMR^H=kZ}aE<l^R<Us021cp<TlcvL8mhGlK-qP3KC*~6|(H)0Pj^wzG
zU#9=@VKI}A6zx9}y{5w4sz3Q7@v1ne-}s1_J)bQc-q~YVc`Anb<ovmk*=dQ6rvV#U
zLmi5?>3D`XrQ82Ybc^D?OaF`f+o_MC-4%p}bJqAR?N00JqheOUYp74v&F^QTS^0!n
z+{jW_&?hi-=Xx2g2T2%}6qX1y`5X4hN%~8ViYXa5Iph!unTdAQ-x!dEy7MtH%Mk)X
z!}`L<#KO8K(epn5&RgHZX#ETd-X>rqHj;}&-|FIGHZs}3V^%ncVq2K34;+aZ&SpPk
zuarz)s{X=b;=%?{0_$NTh1@6l95#<`NYXvDh3INOfF$5a8+P^WUF5z8Kt46=qsD>n
zkXT*e5I{CkxA+z)*d|x&O}%2q#0=DhKxO>PgH+*9^ru!3=&|VHW0BMMyIwISIi0zh
z)$;2Yq(?vfOED{UAEl$|UbTa4I=V%A0X_hBFJW4ZIxcW4_3kCnqzl|(y2KZdRDc<n
zaf&9SUZz<YsdVI9T3*6Dx4v|{d=*n2MrhbjHnU6#N$sK|2L{xC_$%QZzYSegQ7iH@
zHgDLndKo<{D=Mm%QDFDvugJx2)>l0xCXs?@d`c9j97q3mV-b9jTtD%Y2zr~T55qa|
z|1^w*(#pz;%5wP%#{QNw)uYGAo=DWMds>{m-~@J2OksByfyb}VGdmLhsbRAIr(@!2
z2iQw))$jYY*s<Vy7zo-;#^Xj7DyQHj8}g%3{xv4fjuS@%oAnESBkqhxs!i=}_KL1q
z+_IFaL&tuAYJduWg8)pLOvoHPX5v0i>6{nkE<iJALL-SkvTF?l;f@T^q<OKs3)9_&
zsx1KQ0QFGHGxB`-j!O)ZH7C|dpU;pTr4swKMZ)G?vT5kxsQ&Y3#CXS2r1$7=J|o6W
zXUZJ~r8-D__(uWs??fJ^wf~F$RFN=XLFjZ+>Fg_fR;+LpGZ}v$w30MLwO;m1qoYgc
zCIP+|VqS359Ws36>Xyv@9GzeZQLP_)K?KHv=%OR(f||Q{L&cU7y0hThQn_K7jOm3h
zid;LKgP}VXMPuL<$XjXHbETO6#*4xu+`8x&h2lzmWxps%9y)rGe9nK_yqmC@pt5pV
zisTOn7<Q2Af22?DHdhb5B)VdkW9Tc;Fs_)v=aMO<3n=}M{wtFZq468G(1pljX~YD<
zbOfr9_oC+>N)7sD7d?UO5WrCaI8IT|cg#kfvyEW{haRVXvilCdEFLBUsgHbwr^Oh|
zpNy@eLzCy7xm}<3x>%ozT;hBBzX>6?+^t{ox+rz9V5ruA_qxdUpe~&amX}uh*3dnZ
zWfE3qG}(<yC%%gE4cnK=E#R-MdhQ!yPHbowg4ciW?|+{iF-T-yM6bycisO>ko`dx<
zwyKa~dl8IeB+~t1`tKOHip}`xq0B+l#4*Dm>z~ks;+Pq*Z_Y&x2A4mldQ<yOzd@8k
zx_#%L#Mt}i|3O%D89fOmdKfd8Qbl<ffK7rY^r}CKDWe7u!H9}9laaSuzxt1&R&3Yb
z|D#wTF4bqeNoQf);ud|=o5Xh9MYS&9q_Fc*{q{G-Rk6Ei8E4ankV4*)q$}riBmMt?
zmpJV(hLY*~F$xmWjcZcHaU6Za5@Z~)H28^)x`>;C1DMJ@hlmDdB!5NA&$Cl?SipQF
z+V}Zeq!Ngz2y^wWC5$zP$>bmjc?SS5`EI1{0(b)8Je3sEzj$Bd%zuqAAs+>gaqEMi
zA#T`%Hr!c!ANFvM`kD{Kj4^j24TdJ2(Ta2%zzO||55$&nThZ%0^fgT0BX5@e*#}~-
zmz~({ltGOd<*ej;Fpb(_x$K|D^v$Ql9P*MbKP5iPM9jcr<<oS!YT7^_63aLB?|mp*
z#hd!s4~0HVpTsGf6$9*=^Q|5yMr=pHR{(6~ut^_RG%O(E3gJA36xR>TJtr+O>IOn`
z*bNUHikj{&2<H5wpfSknA#hHtj0Fyp%)3-%SVNuW_t;kYn&BZJ8i8>$Ty~Ty#A9SL
z2O<}yZ+b3KHFQMy)8c2T?UKH}kHn>E;*h@hOEIg841T`8q7y<4`t*5E2YDn4e^5&o
zOV|~r`$VSq7j==p=4F2k=ZsN@*NcBx5OsOIh~adoX6&Ly@B5POhr|OQp8yZM$MIkX
zTV#L3o(hTMD0vK(I8?$Uf$Jw^&(c}2q)SLPsu4}|dfP)@90qyK!=Oy$(%@z&JUYVb
z4K}q?)PrPQlN#d~3w?oRhB7$NiWzgf;~tFoYk*$#k<JGJfrxkLmh?}NolISm6!fwb
zd=fb{#Bi?9qdX#H80B&<0DF=%m<05kuZ2Gb|Ad`p_Hd09zoPhPMRXa2zHi@#LXMbR
zg%nc{M@(=~cV2YF466JZ1x!{>8hThLr3$aGASCvfwGiYjT`aqSHkhReyO~B38|0XS
z%DZb`lxH=NPc`XZoLT*0^MW*6EeFsXWMCRV9G-Mi-f(J@|BYz@&`Fg=-9(C)Vv>m?
z-$?B1{<nxEm>>2gRFzki)BlkoNY<g1rdiI{A3fIcQ`C%h`&1GJyNuK37d1jcF5%Mo
z>QZVJm9JuT9Moam&sM-^m>shxGw(5UawY1q!2VPK3v-Z}2JkUzuR`i-)PeV6qz*VM
z1OK|mG&J!E3pm10UwK8E5rM)djXs}YUsGCHYDQnagMP};;|73(c*QLS(?H#ZS3(Aj
z57&9vWv?4hr-PPeUd&sMSNO*AY1I1%3RtYLj9|IMJG2a?EK918+5u1x0I!N=iK)SL
zygm-_BtVSs9v(;X6$11>>*(_!T8sP>vQ7bf24KYu*svXm6w_`8QY;1cBE>SB>6S_M
zX5<|L;153VU8ebQ<WZ!Uw9~Cv|2Qn^b7U?+Y8^lY026&DQWpd86*0a~#<%5g#Z5BN
z$0LcjbHSGo&W|Zh!G0n#&f!Fk$eFAcLv)GBU)Cel0KkR<o013d%7!L05G**hRZOm7
zegbWS0{E){AJgWr?<`zP+d@i5YhbzjE48IXTGa1S;xyei6KCvWgzj=#PxcihT1QwN
TW9T~br}OlxWa~k`wfFx3>Zh7V

diff --git a/dev2/dev2-site b/dev2/dev2-site
index b91896e..b13a80c 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -48,6 +48,13 @@ STATE_DIR = os.path.expanduser(os.environ.get("DEV2_STATE_DIR", "~/.local/state/
 DEV2_HOST = os.environ.get("DEV2_HOST", "dev2.profullstack.com")
 DEV2_IP = os.environ.get("DEV2_IP", "23.95.228.174")
 DEPLOY_USER = "anthony"
+# When dev2's provider blocks this box (it happened after too many parallel sessions),
+# DEV2_JUMP=<ssh host> routes every ssh through a jump host and DEV2_PROBE=<ssh host>
+# runs the public curl checks from there.
+DEV2_JUMP = os.environ.get("DEV2_JUMP", "")
+DEV2_PROBE = os.environ.get("DEV2_PROBE", "")
+SSH_BASE = ["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=25"] + (["-J", DEV2_JUMP] if DEV2_JUMP else [])
+SSH_BASE_STR = " ".join(map(shlex.quote, SSH_BASE))
 WWW = f"/home/{DEPLOY_USER}/www"
 SRC_ROOT = os.path.expanduser("~/src/profullstack")
 CLUSTER_ENV = "/home/anthony/www/crawlproof.com/supabase/.env"  # the shared Supabase cluster
@@ -75,7 +82,7 @@ def sh(cmd, check=True, input=None, capture=True, env=None, timeout=None):
     return p.stdout if capture else ""
 
 def ssh(user, cmd, input=None, check=True, timeout=None):
-    argv = ["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=20", f"{user}@{DEV2_HOST}", cmd]
+    argv = SSH_BASE + [f"{user}@{DEV2_HOST}", cmd]
     for attempt in range(3):  # sshd drops attempts under parallel load (exit 255); retry those only
         p = subprocess.run(argv, input=input, text=True, capture_output=True, timeout=timeout)
         if p.returncode != 255 or attempt == 2: break
@@ -692,7 +699,7 @@ def cmd_db(args):
     log(f"pg_dump {src_db} via ssh.railway.com -> {DEV2_HOST}:{dump}")
     # Railway's template sets PGPASSWORD/PGUSER; a plain postgres:* image sets POSTGRES_*.
     remote = f"PGPASSWORD=\"${{PGPASSWORD:-$POSTGRES_PASSWORD}}\" pg_dump -Fc --no-owner --no-privileges -h localhost -U \"${{PGUSER:-${{POSTGRES_USER:-postgres}}}}\" -d {shlex.quote(src_db)}"
-    cmd = " ".join(map(shlex.quote, rw_ssh_cmd(user, remote))) + f" | ssh -o BatchMode=yes root@{DEV2_HOST} 'cat > {dump}'"
+    cmd = " ".join(map(shlex.quote, rw_ssh_cmd(user, remote))) + f" | {SSH_BASE_STR} root@{DEV2_HOST} 'cat > {dump}'"
     sh(cmd, capture=False, timeout=6 * 3600)
     size = ssh("root", f"stat -c%s {dump}").strip()
     note(f"dump {int(size)/1e6:.1f} MB")
@@ -752,7 +759,7 @@ def cmd_volumes(args):
         user = rw_ssh_user(s["project_id"], s["environment_id"], svc)
         log(f"Volume {v['name']} ({v['sizeMB']} MB) from {svc}:{v['mountPath']} -> {root}/volumes/{v['name']}")
         cmd = " ".join(map(shlex.quote, rw_ssh_cmd(user, f"tar -C {shlex.quote(v['mountPath'])} -cf - ."))) + \
-              f" | ssh -o BatchMode=yes root@{DEV2_HOST} 'tar -C {root}/volumes/{shlex.quote(v['name'])} -xf - && chmod -R a+rwX {root}/volumes/{shlex.quote(v['name'])} && du -sh {root}/volumes/{shlex.quote(v['name'])}'"
+              f" | {SSH_BASE_STR} root@{DEV2_HOST} 'tar -C {root}/volumes/{shlex.quote(v['name'])} -xf - && chmod -R a+rwX {root}/volumes/{shlex.quote(v['name'])} && du -sh {root}/volumes/{shlex.quote(v['name'])}'"
         note(sh(cmd, timeout=6 * 3600).strip())
     mark(s["site"], "volumes")
 
@@ -846,7 +853,8 @@ def cmd_verify(args):
     for d in s["domains"]:
         resolve = [] if args.public else ["--resolve", f"{d}:443:{DEV2_IP}"]
         for attempt in range(12 if args.public else 1):  # resolvers cache the old record for up to TTL 600
-            code = sh(["curl", "-sk", "-o", "/dev/null", "-m", "30", "-w", "%{http_code}", *resolve, f"https://{d}{hp}"], check=False).strip()
+            curl = ["curl", "-sk", "-o", "/dev/null", "-m", "30", "-w", "%{http_code}", *resolve, f"https://{d}{hp}"]
+            code = (sh(["ssh", "-o", "BatchMode=yes", DEV2_PROBE, " ".join(map(shlex.quote, curl))], check=False) if DEV2_PROBE else sh(curl, check=False)).strip()
             good = code[:1] in ("2", "3") or code in ("401", "403")
             if good or not args.public: break
             time.sleep(15)

From 00aed0cc1a1052d6d428747fda60475e15b130e5 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 11:26:05 +0000
Subject: [PATCH 039/104] dev2-site volumes: per-file, resumable, chunked copy
 (Railway's ssh drops long streams)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 134119 -> 138132 bytes
 dev2/dev2-site                            |  47 ++++++++++++++++++++--
 2 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
index 9407eec9c7e884af518abcaf3aabc4132d9e3be4..a2914a846746beb1bff8f2a51038d798dc60fc4a 100644
GIT binary patch
delta 8043
zcmbt3Ygkm*wP($Xf#EU80P@m<fH2A!4L(rRhz$5bh+<TXVqs=@$iR?2gUC2!Olu<;
zlVH$n(!@9>CStS+2_{4C*ITt}Yhr2+LL!;i+qBKSiLJdQiER`6xOc6CBbeL!^+(V5
z&6>T}UTf{W*K?nJKI7U0er@EXh=?!&pVgb*+E$VOdgM!=!>ztkpYKt?^}dC_8&W}Q
zU-Za{F!1#K`>oXgkM!yOs#iht!DPsX-EUUF<9g`u-_S#<D(W+mvupQ^e7ADOtm<3-
z<XA8QJnS!ugS9H%F@+$o9s<XC{_7CSpHG5BekBn~;1z#r5*!4@4;B3KtB^1{^1Ec1
z46kxs3aruZCblG$&OFq5gxgc#6nJ^+BsiP$5~2dis!A)n2H1is)=Wfu5jdytUtIu0
z*T^4qT_Y9h#3d{dg#<K~2J2R975gcY93--*Lipki5dB*wgC!LD_}MHdhwD7a2+I<Q
zh;2d1tb%}!R#8W|TJABzT)5=#Gs1V3=}!>uNdlV)bQ0K4;3)!K1P<_W6L==ml<a8&
z1tg49tD8VJfoJ$l6MR=EZ~69aADIEg(9bW=fGKd<{{{8pBal^zzpwrtA_#j_dklMG
z_r&dq=d+3+m+$g}zKdT?=C96#!Eoi4*@CbcWw(Xw<&V#T4Da4}kMdc;8rGq*Y7$V$
zv%(?eUV|$NoAP7Tjg45tJt0UNftbiqT5D8?0WtbRp(juy^nhTE-Yv9g6@o|WiXO!Y
zf-5H2>WH^aaK#3D+qw!(G0TJUf-+EI%pv6oTqZqM!^zlSJ4mrNPL@xLkRNLtN$px_
zO3vyq1c^q)SmRGlJVENgCpgj;+7Z{a%aojG7M=`yQfE=t2o}Yb<lCwVYtwl``9L_t
zdc%So9$o!B^bXjU<O$oa*f&Wfw1u}Jp(|xnvLLj_Rf9EQx7HJG7Eato2D#fJT%kca
z*W_TUBQ7|OD@`1e)DgEWb(DtB{}jTzX1=X2u_n3E-K@#as;ntv5<KDKC3qsnQB69e
z4UU1}8n39yql&5+uc$+cpoT%H5v-zBv?$vm+jM(l+YRlp?eXoZYLzv0x3(?Hl@?sS
zCtTk0l-=5sX+dtYuw@H6m);ZEHSn>)>(P&`!K3Sl^XO?IZgf~wvCf)azZrEJHEutV
zL3(S3JO=w_qM@TacksBEJDRjk?TAIqW&R_6#AkWDx^W6I9tsHxAKhb{t}SxkR+Zq1
zWYhkIN&eqCT+tJQs`|G3lcV1I54?WbIIoYlPCuC)blkRRPxQ9Tu7TeqPGA{#S@X8r
z&lqn_tLc!^6Mb?<ko#K>aL=d%WRGVV?*RW=XifNMp*7*3hgJ-QmM4a#xr{*-T4#>S
zL*q>z6SOLte3mE1Dp>DLq%5Wh;_q^qJ5o$Yo-^h-cg5oDL+UZ+PUXIND*oUsNacYX
zh)c96K)~S8wS~1{(im$S=kPCcV2++`!Mx=TS?{nnH`qkChTk_EVsqVbVivPGn;R;t
z?6z#N$;QO$I=jtixt%uUZK@GcqWo$%0xr}EZP0aQPaOZ`WeA(FWg13}!U`V6cFIFq
zkAh>}jrD@{PVCBwUD>8`ks$f;D1#gEfJe0uar?5-<DpD2DoX+o%9bI@s0@TTo9uNi
zdtIZ=$;zp=9VEP(9iw(XwgV~}WIv*^REB*gO(EjLSLZ>9H^g4&bk#N1xRa@#ZkPA&
zoUzdEuvFTei)Y*({Tp&Si;!`bFg(G~UNAf{>2TyTksnUX>QoKK#COkrYT<Bd#<9dB
zi9P1t)WOu*`&V|FyVK97ow1%X_FDSW->4f=3kk*%jbMmxU&%0G3+y5a^|~{}sZ&v-
zjaG4nXmYhS*~Dtm)Wqr<UDaY{hI6wkqiJ(v=5;MrNOp|a9z?bxHiG-R%LG&?a`5+6
z7J`GY3hNmcJi-=CI&ILQ@Bk&Sr-1_q`*bRyRrsN@1=z$#5z7{$Fr$*)r1la5G0^q?
zn{m2vD(PBtDaNb8Nt|&=@b%}y*SiEM#(2cs{ZMB?HykWFV*bXd!lCa)O#pYO>?2O`
z9+CNQxp<bES?$(~tCxz7MsaOroxP>9HBWTw2;*{y4UX+LMn1ssclWj;5g~h4wL*v%
z4yw4&p|Jub;=LNHqU(|KhI>7Cs-somM)Edr-L9HgckZ|mCip$%hoOR1MQmNiGqWOH
zbP|%Eju5N5t2BO6T!(h_I1zL|jJA+NO1>xr5>m9T@E|>+LtV5u`N3Woao2X-i9bZ?
z4u#0;QH~uaJW3B(!%s$xB{)D+sD!cNWR1ZU7|2*CA+|$<Fm8NQw+d;3YXYBiFHFs<
zR-_AT4TjBFm5h`*qC6OHG&geVT}ga@8^nY}TZKenTMFf3{kPK0WPbV~Nao?MK$sVV
za=|LJsUB8!!antAs|8ww9m;Z{1&r|}a_F&pQ2KQ;I3q2{&diMHNA6T|Xjdf@O&0WI
z(PV0Ln3&Dd%$#*-eA7D7#14_EpC`u%6*Fbh0?{2Jnsy+AH}kq4B^nis9GPV!xTUew
zHaFIbNL}f2*&3Q$)T~A~vRN01tO^BPr}O`<kkR-RSqJvq+6CfmzNp*8;%w1X*I;uR
zC$L-+zJkDf0t*P_5%9iG@J(7FWeS#008dZ?!vm-gh+KyP9L=u69Zhx2W@RFcP~5R_
z+&o)JtyKil5g0=QYIz9(HRVhvE1{7^1l}g_EU^qwtC+xb1Wqpotel_3UHHgneMSM`
zP8=7FV+pF--t4RmqqxjPVHlL3ghzBncNDef4;v=(75i6o+XfBkKG%R@dVAruB+(cB
zd~RpRh(aCR0K<tXhqIo^I+}B|`Pj}QJ5R0bcb##1-<$J(-aC2HhK*9Wbzp;Sa8<Rm
zvSvgOYGH)}|B7Ix;wwRzvx;DPF~OwOis9tRN5i`x?pc3oMQ>hz-Fxcyb?@k;bsGnl
zmrKhwNt-IA#HufpkYs_*f=>-`olajyui*p3+_yC&p+a){%}60a-<jE++Fj&*#@L<Y
zTi&y#r=Z6x>F@g>e96~0F?VJh-F9{AeFIbPlj4_rDF812nqgx1Twkg$#<!xUrXP;i
z_iX7mo-eov=ZY@QzBuR1>Z|4r1Lh5b=5ncEla%n_kYV#sMb*`c+JTB%sjmKNh5br}
z{VyX*l6A{TA@s^pWr0_tIHyT4&s3kAoUbuYSD&A*#?D=-7JXwhCz0nL1WZZb5s1G`
zU}O1I5lp3M8{!a0jTz7`v{yD%St}R2Q~r@fy=dFf@i?+7c>`Lt$JsmUmF;rfFaqmA
zQ`g}@LY+iqAwbUh3ijRF(Y%{2vLlFdXZ@erViipkKds|R43!u54w4^Nu*F!BMq|#M
zNW42LS&dUPS;b5w5*zBRbr{x7Yz@s7WvOj&puDwW<#g7vQDoO>%Ea55AB(EpE?VoV
zt8FY>w9TlQAu=<u=|qd8p~-G@*%pZI@Y~c4l`c!IF_u*bf>vPFNQZBxmu5rC(tK*m
zAvqSJl(gBe32dYQT2J85)csEa>!>RSqa1=0dE6W@tslb01(a5&Yt$-q90;gf4yz-e
zb~#*?cJ?2LkpoRWB?MHsRVPBH>t1%AhQ?wwh9;nZbx!OWsEE&4g3stX`S^m#ev4dR
z;LkZ9v*cfSeg`CX%^xxF6La9WcX&cvXIy8iFWNWvNP<r%MP;|Eu4#4cHJz2+n*DX1
z5BfAdr_a_i3*%tt@d_z>VZZr|;fzKq+AM`{8PZmKsa1!@e-SQ3#T}@6F41T1DLAF}
z>t5IO=l9pYT{1Xxm2^+BRP2<dxds!OF>IG8%nGdU@r4wyQQjg&yYi#R*aMdCslI}f
z>eqC~b-m`ntoc&r0%<{|G^I+~<`{}=8jO6XT{)bZek|cg!qKFmsDdL&`)P@WUZp?e
z^^kt(3+uNI&RqHw_>$UH15pLn^f7~UDnKx(H@2&<X~PdFI}5tB?e6Y`qd7k3G4~Po
ziyrS_+U(x4fwbKI7-`BPY0>KUEYjNbm+CG)C~d5is%oU#`hlu?$?lLUo1~_lQiNwn
z+eZ2+lH!afGhUm1e0r~Sa9W;ZTqqe94QUq-CnR;R@j-iJySm-gx#rIbU1&bsoG8R5
zb<ZBmm~+)Ix7|D(9{pr-M{&1dDBL^Ar|MDmn2(1Jh_igE;iwoXKI=+U*2#ii^@)}J
z>4VveKhno`+75(2XZ5Y`$?wVOsX7(Y`#@h}Z+QRmGwUv<o!xlRa;8LD`+$_TerVDL
zsisb<w@cr#4wP4ngb1<ozR(Kc(fc#H)d#YVs(jmfDtpR$6{m7~oBI~@X7_t*&$uoY
zoZTVaUv{QZTDL*U*f=DXe;O5iU|RP&U)jmn*OHDW^{(mN`Fh2m(JW;ZN`;M5nqzQ6
zleD7^t+`yWima(GR<x^zbx}_)=vc6C;d3$F>wV6Xb6(3kp4aOdoW4++hN|5tWt2;m
zwht1jW&L$Jj@pjZdymxjrVmb?CuQVHhWSI<1s|awIWe0Cr(QQ`Tp(rTNqJRLnnkK_
z8j62tFpA-1V%o9LBcVriLy-kXbo)1SuIX0wxL(_Fd`CZ=*onSy&(ggQ`E>2dfyjc7
zbdhNLn(j)U=9#+g2YVDJb9$U7a(kvpv%Mu3ol@BY(z*vOwp^@}3>$~^<>)HyEu9Z_
z$L(+JtoJ3IEbEOqv9V`muU(2L_)u#e!P9+A;>}GUs6*SM+vj#9bguY7HR+o#w}KFr
z`we<^-crRkUriD8X87i-xk8i~oM{-OKaMQTQk{*<C^cy>Bqo>UXfMoDmFjb}KcA6Y
zI$wKPr$T6fuFkg%{+L{-RcP5q6z;!P@VyIQhfcmFlM_xYkH~`=@CUvy57Hw>kSLQ9
z^fx#M1$T;nZyppWA;&+k7*>P&FGw)cpSA>UDxr{1G{dX#NB%Q2%up+lZIS<$86FOS
zKlxjW;RS#V{^Sxk0U_)Id2;{dQb+|2QL?}AKi&^};TGSu1|C!=AZnTalQnQ%3xD&!
zy9qu4)h&gX<$rB6RDnXN<S`Yn3jW5oRzRLQ3#o1X!xivuC|LNmT9^eF{m<3H50skQ
z*MAG`U^H52(hqSXfe?JvbJ+1TE}vAgY5p|At7;q$D?87hutT<bKBAlbr|mE&RH0V#
zKQ+TN@i`K)2}xN!fj?1~UKiMBlr2M)e93lLG*62dqbi`zFJ6&f#zL_dfc$_eA0MV8
z>Tm)P2u9y<*sn;~B7SN+Y?1fY0%dTD*R()YLM)NSBM4}!DlPTRO{|%S<COf@Ex1TC
zjy&m)*#TEIDN~5_0bG(hqS4_Joi0aH6TQx|<v75fe;B54qZe-JJ`L)Dz0LFUASPZ<
z6`GB{uWThYwiY>#`#0`_!x}ipzkU>+S8P<`%Tg@=;T}kV^Ze2twA?2C`#tb|sOQdh
zXwo#3SR23I4jE9+qdFj6U5{e^&7a!=8#MP-(r^Z;>G#x%qQ#~Ym_y)Q!tJKfHPp2d
z_#Srgfc#s+TKVNC;X=kAh^&vmT%yQ85K!R()xoAw|2-m|&HFo{wN$<gZY5GGQH(s9
zky|nH7DmQpmk381l=sVMwE+ztVO=)H4v>~75ojcWX?)jycrl_G+ds#jQ;%RY9#%gE
z-686o*#E@;+h^bh06X~ip9K@N^1f%GLfwWVH~ewW!AlA#;y-#G>QnDW6nlhr7fxq^
z+eZO;TU5+(vgL;%SN9uQ9$lHEotC@^27dT3gsXQU^B4Z!!;q$gb$sXr*Z|+<*)PIO
z&2Ah~sQgtg!pop*p*aX>RsNWlAO|#$VJBSWFMb&cwQ!I>^(s81n5gorUxPda?4yhR
zS&GRj?s^?c6<Q^~@H*Hvog`&HpZ5mb4{!1IH=qy>@XK%DUHWdW?t@~TY><9h;~u`b
z5AvgWks}h10?txw>=HQq9&^S!eK1uAkMfZp!={WqBr`ykYNyth$Q+1VTUb_DV&0m6
z|B9`v3d`9|?l_Hpwu3)@8s?)We|8!kh7MkI1}yLqf8`A9OYT7CK*)ytwIwS`mIc&>
zYuA>pEn!zl?(MG@{Xc=Jkn4ZqEEoXB;}-B={shj-3Slk$<#S+5rmGLOikL-|i?;-F
zJCP8Rc;<OH9i+Z-9#*E*67|?gO@7OwJ9Bmg2l%E7@Mgq&C}tYz0r34w_7skvEJFNC
zehOyoJ<lSYJIv&4#sIB!+DwcRi#yKT+|Y!#G@`}sXts(?%(2a8afz&x_gw~8LMw`N
zN81{=iv`7{516-_mu`JvZSf-J<4fMhFg!Z?t>)wRG5$(9NU#JR=Sw9p!(q}`V%H~n
z70*rt6Tc!se(IYjjSb)iOIS5E{Rjdo(&t@Dl*Qf89RuKrJw|k64ojwHk3D?_4Rwl7
zx&m_*R}_5x6)04Hh$GAVzAMnI)DOv21Y~DA%`-lPRgr{sYec;Nafs|O{_uzBS*`s1
zhcJ5rk-5XflEMvJmzS2UTf|QDu&b~Pcd_;=F!+F9xC&F%A0t(nf8;8xR3^$($kJb+
zdCn4${ePIR`xw%K66MKUwKkft<73zY75uZ0;XZhQXI_JJXyL`zK!mfr;Tp_@A^-E&
zKn;oylsx}Mh~dxOfXG<PjjXc9#(s%2Y$4;~HG*v1WdEOk0hdE_Mz=`wpSiP=^VB*=
zV3@#S@~Qg><P+%RUw;Of#?v%(klacpKSEtu#Mq9WBHTH?{By{h@Dpm2*)TsoPVFc7
zBcH=t$#OW#X|xjE5eH>!$+^<!FS`zB6tQwj9Q#Nn=f(Lv>jtdUyi1ZU@f|l{f%?C&
zUFY}TfLgtGEOpCS`&(&x9&O_f2=JBdze&Q+X&Z8qmzP7|%Zw0EH_}^{obugK@^y*D
z##|;#t<6#|*8sQHWNK=zve#MM5hhbzO{0U^Om;_&(<@hpKuAMf4Xec5Ooh{}G2wL!
z=KTva<8KHI5?W7ar_E(*s&qPA9L&l-BD4-gJDe_)qtV{VenA+V!s2Me`x<6zw6rqH
zR;Vtj+-wf5Urx`N^4CP3@^`4#P=;r1yyNeX`kk?|B3G2VONjifl3gYtvU0ywZ>WSY
z$_|WF%qUbCIkSAFD|;5(#l!vw%ENAu2m<^44gUjAt8>$ktVF&UH7ZKjFpi+gKPD=A
zAIG+Q!wIq<85IHLvch#G#$A|9^VEt==;0Q%VhX&%A5|+H%jJWSmU0%|DY4}Q<`a;w
zhu$Qia+W(t*4;^6FM(3(;^|ai7l=3puM9Pc&%LrjJVfvafm{OeXHmHd%XL;($XF?+
zgCmnqezFS3l=LlS%IX@`Jt>K*ANwAG-2~()e@vN)&0gxu8A?{}m|iJZM|FLJUkXuV
fhN&=eaR-9)Q~zH>6gf)Gy)gMpJMh^$Mc@Adi5XD=

delta 4254
zcmai13sjRw7S5eN34!ob!4eUpBAQB2t0GF(2BlV@pr9gF#1JAxAi+uS5qVU%3hi2@
zMI39j;#RGeuC=~?>~5{t>eklPC|Y|`Pb+onqiB8Zsjs#>caY+G_MH9C$v1cIy>su(
zojZ3Xt7Xk4rV0EiAiz(-zwz1o=FT7SQQ(%#;NHFGay0?l?q}OhD`COzkQ<GDocYQ9
z7XhkvYaa$H!C4;xCRn<67Q7w|)$-L~=&cMYKsztL5^Hixu|wv#<%m!)0F=wmhe3u?
z`z}!^=w^g1?EHBMW$*L=9Xq9iG}tQl?g8~cwiCAG0ED+o+9IGAyw9{fVRG<N9M*$d
zr*5RGSaDC-0~M@yBs4#@iL<;?o;jbM15QC6b)r%YyB`Vh+C!YK=RfD0KJ4aN(91c!
zz~T!ZvgQGh4K~)p026emM05CPItxLIo(hmRhm{*34vxsX4X{*-T7kUR5oRE)L|BDT
zi|_`*n=IQ1<-O{VUX3sgjo}RF8iW`G#_kwlsa7oO(TbMDLMrTG$77)n9F=ckPaDdI
zO8j?wtHfF_Lo!=G7_R$6PPjrblbfmVsbFjf^qW?paRqTT@#XuKEA!P{L-DpEU(0F#
zM|42B59b7OPS7JxaJj@eA)Wdg{2Tf5@dHJEm%8VcbgLViq^;W=-80aIW5idk$?wVr
zKLe3r9i}=4abw*!NNltZg!c_~={g2*c9<*Tv0nFfzru*F!~0`Kp87xX@W<qF|6{yv
zLx`KZtMGOCc6fF5>Y&Pf^Lu;{QTOSDh`Pc1gVms@g%uI(?g)q{hMp`r9)>^V_L=4=
zE-SI>?-Tt1I*^CN?Wcb+(ZE*4LueJn(9=L}&+X$fQ@wGV-mTFaEpzlneJp(&h3h%E
zef9l2#Nm45LKH_w>n(*Pj(oi_LvJ2P7fjc?waCmb(;J<I`u5D)fEM24<_#fq7H{Yr
z0mxm=DVCTBp|SDE8;LLqApzk8!bhm5Ldt~T&nIv2V{avbF)kGuqd7S7!0Z3`DDIS3
zYbnXkoiEnyq{q3HoBZdbgtcyh$hwg?y0MyZu)XS>Mq5)*YhJ5<!&duJ18Er2Fnv=(
zgK?X?sc%zglldSV9M~M_8Jqrv%QI!VCo|iVo#(OSd#pt#EybR^5|6+Aw8rsGV92V%
zR|{7=*AL&A@K(YHemjRXjre@{KN6Y~zL@8kJo9K}%eYyd#9U8qfoEi4%K%$T_qi>B
zMc)K>ty-O0JEkG*1K)<lI}J_ao8k_J9~*um;b?*<Yq}>p_hi=WmK3umInR@~_y*4a
zFcIFALn1bbB!%2jC{oE}@(VUu<Ys%rWz$JEs>~p>kvW~1$!(P7Av1+ou(1$3xlyH1
zIEWLwcH+XuMJmu}B^f7iqm^W$#K&X9Wyw+sHmOnuGLxlDi5smXQ;=CfreZTynubkK
zmUL4Bjy2N1H2y0xYNfT)PX|Pw4Tw1z5YrM6`?Y4!4XvW9?oN!qLgiZ%QWN)Tc<sb9
z%E)`SLKH#q_qg4JMB>D{wLfrzM%f(FZ$f~EIjj&SAD;k)B<M;o&)DsRj^QdaM#07;
z!$PenaiZAGVa>@93uoAkWQfv!&9@#4kMo`ax4)M>CIz0Cz+YaL1}}oDm5Y7lv*~b0
zf=G5O6L!G2Z1EI`RbAndFnPxmsPutzvT-K-1z@o3$$>`jv1xp`>r?X5T<8sI)TFI!
z`)qg(&a+`=cuD&^XX(-FafuzP2A#ae3`aF^L9Uz&=Rrlk;&M5!81jHzA?!#Aq`(E%
z#SRIo06uDroMDGAeZkCnE`%ZQxtzWb)=BC|Rs8y5Fc{3}^J`3YA8K_visxHt8ipf;
z52t;RuPksl^65clDu)<tBxk4bpOcA0&`W0J5bR6Z2;064p4P8JYcp_s5yCm_UPZXX
z&m6r**zIL7dc@D1V^Dfkrqqe1OnRO7ykPPwP5h&H!sso8+Z>*!H*jDp8tcOfmP3wM
z=5ok{olI8^dEpOG^;ZsFb)MN$R8~sMQ28NY_0<rgGVr+;%15f<teSj9*v6I6U1{Vz
zHhCrVVdqxDefTFky9x%WMsV&@Sz8Mm)v%s5u7P*RXsPbR-cUB1K~LDgDjDCSv8;i?
zGJZuyuZ2>zxKsHJv=;io7<OnaM5!imGj(#?TF6q5osDzrhYM&y>fZ>yTuyZehq3z#
zO5?CQ5#dj~YasL|<W6KuHp1b4XHe}!gdV8j$HA+l)_eyI!u~N-4QE9Suqa*J*b7h<
zYZb+erI<hzbAjU4(IeQ!pio>d#o2n*b8N*fD;1TLMq>0bQ5M98Zi07JGdR6f{&o|5
z;-i|)>HYGC?XV6Yhs8I7Q9X;Z+)=D~8+2n;jgX|u<BY@d(MH%pU?6ksfTG^RIg2jA
zrTITry~UcM&|MIFumj@#kKx?#;X?QG{kaBRyZd4NrB;`XTB(&A`I7&fS0A0fnh)VO
z0wY=VF35rc_WdpxthRB5ZzVZ&H*5v%OmvITD#=Ioz)(<^^3IQv{QF)=(m)+cIso&?
zO-XJ#00{(MYkz^QI{*>nuEhE`Lpu4Hu!YS~tS&=S^Vv_$FbQ_CghP-7i`bGw{1s$l
zO@|;=D|TrQ&b^ogeFi3VJs)vNlBa#fh42b{_c+WLSBzG?xM3woeZ$qgff-4eNonJA
zO_L_(rX*!kFWMM`I%5$`2zX=Dmr#(yo;v{}VHR_rfJ(5ldndpGCs~dMR`A|W9?-#~
zhh)(yh=vf^bP~G3fAPAqH%~#c2nC(VvRl9!aRE)IpeHq-mqBW$b;wXMZwq|dp}p}m
zBuC9b?amuk+`9NE^ZGeUi*2rAo89VU>NBucwToMm<b!9RR5R!;KFaN9be5Hx^UO}G
zkz%QEhm9{QDYe-P^p;{rS-!rMI_6p}E<G({x!-{+TqIYB)jnT8E;W7X_}uY{xl=Pz
zN7H5O>UaDUHsFqpf&uKW-@|k8XZG{=FrFV&9t~aH`CuiB(Seawo(EI!br|oHd_ie6
z1<Casyvi(7MjAbf%M?Ky1qRlm70Sa_pi1X61GkcvO6=F=5W&mNm#q*-8YM=4;Mx9n
zF4N1YKR}rj{BgS;R~G5AnVtL*QUa0dR_kqcmqSlW+0z$!?#yDP7hzZzRO7Fxw4|)u
z7t%AQjHa8}zKbw{FX6X~K;ds}-X(}uHFK>PdHp3wmUO~}uwISMwjzi$Kd`0^`gRx;
zzFdV?^f$Z>a`;)TYlE>+&05+Z3TCpqZJ>v(Ec_}AhL7dstDpkzZPGP(T6LJ4jFYRb
z!7bmR?aM$PTmJC29jR>y2N0gf)H1gD7wB);j3V*c7wXHgD@=6GdI9pbu{&J7%X>)U
zzVOmVk#;iUUDy{P4wa~oW}aVMDE35@!DaIAci|uj71gfuPl_mck?iyXNLKGeOCPbQ
zhcHTejMIrqUOd8->_II5!}IDxNDQ`g7HCnMpD4y7Ff*=mFaSM`#=gMJ7o}Xx4F9?q
zz^k&GX@OG|c6X4`Xm=PbR_ZcZ3ayqRs$;PMq-QkNdaqB3t$><&rM-=*uQnP*6@MQs
zA4S;D<^_<jL7#Hktu-1;9Zr|gVJ}`pKSNG{(P(klEoGEi?UqG!80Ybb@B+0jfGkpD
zWu|#-cp&LLyYmJR#ovIUKdL<ym&8$Ai3rvcSHlcc#&b(CWE9hzVgk~7tU;I@)XMe+
zl59T@nn0K<hX;{0s(1|-rin6TAZb^4uz7H<;H#Q07c_mgJ(QRi2I7?_Buz;(yiC39
zQa92cUS~m}qz|lO&x8`k3*v>M!Lh=?3rLBVy?E4%_q-@W^|(cga3&Q9>DZlta2QA2
zBkW2jxm+az(*Bncwc-)P-%Jq;aV3g?bl#fynxo=5_Qd`9L@-6T+G8(5gHVWILl7sk
zRO-*kdhCn3B7)l)R}oSXYY$t{o%Hv+$~E~46wV9sw(ex8q|!pKTam0)M|S@QhrWRI

diff --git a/dev2/dev2-site b/dev2/dev2-site
index b13a80c..34da3fa 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -757,10 +757,49 @@ def cmd_volumes(args):
     if not targets: note("no volumes"); mark(s["site"], "volumes"); return
     for svc, v in targets:
         user = rw_ssh_user(s["project_id"], s["environment_id"], svc)
-        log(f"Volume {v['name']} ({v['sizeMB']} MB) from {svc}:{v['mountPath']} -> {root}/volumes/{v['name']}")
-        cmd = " ".join(map(shlex.quote, rw_ssh_cmd(user, f"tar -C {shlex.quote(v['mountPath'])} -cf - ."))) + \
-              f" | {SSH_BASE_STR} root@{DEV2_HOST} 'tar -C {root}/volumes/{shlex.quote(v['name'])} -xf - && chmod -R a+rwX {root}/volumes/{shlex.quote(v['name'])} && du -sh {root}/volumes/{shlex.quote(v['name'])}'"
-        note(sh(cmd, timeout=6 * 3600).strip())
+        dest = f"{root}/volumes/{v['name']}"
+        log(f"Volume {v['name']} from {svc}:{v['mountPath']} -> {dest} (resumable, per file)")
+        # ssh.railway.com drops a stream after ~15-20 min, so one big tar is not an option for
+        # multi-GB volumes. Compare size-lists and move only the files that are missing or
+        # differ, in chunks that each finish well inside that window.
+        def listing(txt):
+            out = {}
+            for line in txt.splitlines():
+                if "\t" in line:
+                    size, path = line.split("\t", 1); out[path] = int(size)
+            return out
+        src = listing(sh(rw_ssh_cmd(user, f"cd {shlex.quote(v['mountPath'])} && find . -type f -printf '%s\\t%p\\n'"), timeout=1800))
+        dst = listing(ssh("root", f"cd {shlex.quote(dest)} && find . -type f -printf '%s\\t%p\\n'", check=False))
+        todo = [p for p, size in src.items() if dst.get(p) != size]
+        total = sum(src[p] for p in todo)
+        note(f"{len(src)} files / {sum(src.values())/1e6:.0f} MB on Railway; {len(todo)} files / {total/1e6:.0f} MB to move")
+        ssh("root", f"install -d -m 0777 {shlex.quote(dest)}")
+        chunk, size, n = [], 0, 0
+        def flush(chunk):
+            nonlocal n
+            n += 1
+            files = "\n".join(chunk) + "\n"
+            for attempt in range(4):
+                try:
+                    cmd = " ".join(map(shlex.quote, rw_ssh_cmd(user, f"cd {shlex.quote(v['mountPath'])} && tar -cf - --no-recursion -T -"))) + \
+                          f" | {SSH_BASE_STR} root@{DEV2_HOST} 'tar -C {shlex.quote(dest)} -xf -'"
+                    sh(cmd, input=files, timeout=3600); return
+                except (RuntimeError, subprocess.TimeoutExpired) as e:
+                    warn(f"chunk {n} attempt {attempt + 1} failed: {str(e)[-200:].strip()}"); time.sleep(10)
+            die(f"volume {v['name']}: chunk {n} failed 4 times")
+        for path in sorted(todo, key=lambda p: src[p]):
+            chunk.append(path); size += src[path]
+            if size >= 400 * 1024 * 1024 or len(chunk) >= 2000:
+                flush(chunk); note(f"chunk {n}: {len(chunk)} files, {size/1e6:.0f} MB"); chunk, size = [], 0
+        if chunk: flush(chunk); note(f"chunk {n}: {len(chunk)} files, {size/1e6:.0f} MB")
+        # Empty directories carry no files; recreate them, then make everything readable.
+        dirs = sh(rw_ssh_cmd(user, f"cd {shlex.quote(v['mountPath'])} && find . -type d -empty -printf '%p\\n'"), check=False, timeout=600)
+        if dirs.strip(): ssh("root", f"cd {shlex.quote(dest)} && xargs -d '\\n' mkdir -p", input=dirs)
+        ssh("root", f"chmod -R a+rwX {shlex.quote(dest)}")
+        dst2 = listing(ssh("root", f"cd {shlex.quote(dest)} && find . -type f -printf '%s\\t%p\\n'", check=False))
+        bad = [p for p, size in src.items() if dst2.get(p) != size]
+        if bad: die(f"volume {v['name']}: {len(bad)} files still differ, e.g. {bad[:3]}")
+        note(f"volume {v['name']} complete: {len(src)} files match")
     mark(s["site"], "volumes")
 
 # ----------------------------------------------------------- box steps

From 96b223ef432478d09ec10c8c659ac920db99f489 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 12:57:50 +0000
Subject: [PATCH 040/104] dev2: keep credentials out of sites.d, which is
 committed and public

The fleet kit wrote the values it re-points straight into
`sites.d/<site>.json`, so this pull request carried threatcrush.com's
Supabase service_role key, its anon key and its database password, plus
tipoffwatch.com's retired Railway Postgres URL -- in a public repository.
ThreatCrush was right to fail the branch.

`env_overrides` now takes `secret:<KEY>`, resolved at render time from
~/.config/cli-tools/credentials.json (0600, outside every checkout) under
`<site>.<KEY>`, falling back to a bare `<KEY>` for a value shared across
sites. A reference with nothing behind it stops provision and names the
key, rather than deploying a site whose environment contains the literal
string `secret:...`.

`supabase-cutover` was the thing writing them, so it now writes the
reference and puts the value in credentials.json. It marks what is secret
by provenance -- the state keys it substituted -- with a key-name pattern
as the backstop, because a wrong guess there costs one extra entry in
credentials.json and the opposite costs a published key.

Also:
  - the four values above moved into credentials.json on dev1; provision
    renders exactly what it rendered before (verified by resolving each
    reference back to the value this commit removes)
  - `porkbun_keys` and the Supabase SMTP lookup hand-rolled this same
    read twice; both now call `cred()`
  - `db_name_for` validates the identifier at the one place it is
    derived: `db_name` in sites.d reaches `create database` and a DSN
    unquoted
  - drop the committed `__pycache__/*.pyc` and ignore it

The keys this branch published still need rotating; removing them here
does not unpublish them.
---
 .gitignore                                |   5 ++
 dev2/README.md                            |  22 +++++
 dev2/__pycache__/dev2-sitecpython-312.pyc | Bin 138132 -> 0 bytes
 dev2/dev2-site                            | 102 +++++++++++++++++-----
 dev2/sites.d/threatcrush.com.json         |   6 +-
 dev2/sites.d/tipoffwatch.com.json         |   4 +-
 6 files changed, 114 insertions(+), 25 deletions(-)
 delete mode 100644 dev2/__pycache__/dev2-sitecpython-312.pyc

diff --git a/.gitignore b/.gitignore
index d821a81..b44bd9f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,3 +23,8 @@ credentials.json
 # land in the checkout that owns the links, which for a contributor is this
 # repo, so without this a 37MB stripe binary shows up as untracked.
 vendor/
+
+# Python bytecode. dev2/dev2-site has no .py suffix but is imported by its
+# tests, which is enough for CPython to write one next to it.
+__pycache__/
+*.pyc
diff --git a/dev2/README.md b/dev2/README.md
index 1f11f36..6c429fc 100644
--- a/dev2/README.md
+++ b/dev2/README.md
@@ -84,6 +84,28 @@ small file per site, so parallel migrations never edit a shared file:
   "pg_service": "Postgres-iVtY", "max_body": "256m", "branch": "master" }
 ```
 
+### Secrets in `env_overrides`
+
+`sites.d/` is committed and this repository is public, so a value that is a
+credential is written as `secret:<KEY>` and the value itself lives in
+`~/.config/cli-tools/credentials.json` (0600, outside every checkout) under
+`<site>.<KEY>`:
+
+```json
+{ "env_overrides": {
+    "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.example.com",
+    "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY" } }
+```
+
+`provision` resolves the reference when it renders `app.env`, and fails loudly
+naming the missing key rather than deploying a site with a literal
+`secret:...` in its environment. A bare `<KEY>` at the top level of
+credentials.json is the fallback, for a value shared across sites.
+
+`supabase-cutover` writes these references itself: anything it re-points that
+came from a key, a password or a DSN goes to credentials.json, and only the
+reference is written back into `sites.d/`.
+
 ## Database kinds
 
 - `pg`: Railway Postgres -> shared cluster (above). Done by the kit.
diff --git a/dev2/__pycache__/dev2-sitecpython-312.pyc b/dev2/__pycache__/dev2-sitecpython-312.pyc
deleted file mode 100644
index a2914a846746beb1bff8f2a51038d798dc60fc4a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 138132
zcmd442~b>DnkJenNiOW0(3&g~q{Je$gH|?4Xh9O71tbIsH-SV+Cb~BPkxFb;O-(e|
z>Jch?%4jS<r>Z<*)K<4~cgHI<Q$0pi?k@RtMf6Q2DsYxwbiJOMH{<A-36<S%s;%yb
zdf$I;-kS+ZOXcpKh`AEyo;>&L=Rg1X&;S4DKYy8&WK!Wd-u8d?U#wQE{xkiMA4A0R
z<*yP{s<%{}s!heIIgLx*re<$Vo0h$GZ94YWx9QnCp)G;E4Q&SYPHanLZ)2O0y-jT<
z_BOYf+1t`)Veh22B=$~jOJ?tswp8{`YfE(`^cTw2ioW}cqJG);H8E}S_vqV^^?_RY
zCBNIUzb18gG?nagWOLdNG}5oO72hbGPDz*hjne6rbSu9m-A=i7(Kll5ivE&){kvsf
z^vxx32Dt>KN7jCW^og8NPT#if8>BOFW+k1Kv$W-XgS1IpvXVCc8>CB#NmtOT;!?k_
zcI5LqF3pkOt8uG)RX%h~TOpU;A7|_}D#v<<vHw`K?_{5&P_B*AgGF41Bkye$m-&vi
ztr#_o2gh;7jZ>hr&BkT7ZRB#=HgPN3O1Rv%(r=K<N~IoU+^V*6ZuNImZJW6@a4WdA
zaJO&*x9&UYwym6(v*Nvt8{+ct-p&nk`FQW(3J_~2R|t0(w;paKw*hVyR|I!AR}6O#
zH^SKvcQ3aQzxHvP;O^&2;2z+vaHaTCjUF@fe@E`6=$k8(>&KP%XudYq=HDq+g%WGa
z3-a2k#M<_PSlg9YJ9;!d`nFnbC)!iT?Sfm+Rl+^URlz;P?S^}p+XJ_O+Y9%|*Njda
zI06pYC&NqIQEop{AL9<dJ<e6bZRBd;p5SWXp5*G_p5p4^HgN~xHgkvIws42xp5_|h
zp5czbJ<A<!JI5V^uaz6+j-&V6I3L%D_j&FFLN9P9;kI+9;9lgea!vTs!8PMoC)Wbk
z&Ygza#hroM&7FnIap&MVxK_A5TpQe8?mXN+?gCsV*ABOzy9oCZ*8$hXb;2Fs>~P&&
z7hDh54R?^^;9lk&aQUz4rFb);M;?ndf%9{{sIQmnLmoq%6Yekvz-k-eF4?beF8D^d
z0k}TS4fiVNf$Qf6;f`^a;lAQ{mE$iJt5kd<pzW0pBA}>NjcP_UwlVu_Sn5oiV|Yuc
z;Pg7GtOK55ht+OvvO8TP_R-QlkKlE1R{Cc3xV;`LMYY=9ob{5!F=%yq5iscTj5^)D
z_--9=@V$;QlgWxl$<)d_dYyuoAEnSG5AWz2a=N7Kg|dDDIrQ+J0l9Q*vA54*_3}gB
zKHIV^UC7XSzO?j`6IB`P^}9W8hhG>Pw0GGBhu=HI3!e66NrXPnh;<LOWZ&{H-S(ay
z59%R(jaE@=TPd}qY;?e7E#71;b33mL+Pg0a);dr3B?sT*bUAERr`t+Z<sE~b602Q6
z2cB$NR>&al8FmUzG;vueuau9BjFd+L@tI1ivO3(uCDv}wz@SHPlten&Ds=PCL9g=j
zl4G>QDmc1%hgVou8rQYFm`JNQyO;HmTxFrp&SQYPT|*dX-nt284vsDzg_D4RUf!|1
zh+&UwXuu&nUk=M50zg(N7IJla9d56HVgW?4O)ih*v%CQetmMqk^NyZ&sRa_mY_bYo
zJMSf!V-Q)4PNxx&M$BsO?)D71z00Ad+kqs@x}W8G%;7B(to810ess`l9d=^;Jp84u
zA-A=zvAJ|}MTxb`(c|GA^pj1I=Q@KXO1!Myy-xQP3=%(#-tBS$W~`<AtQA{!mTktr
zimE+>9^ShgAQ9KuGb(2XFdrQ1ayh%(t=&Vsi?x$YNN*qS8S3q`N@WxeI^AvzWn_|;
zSUo&z397ujA2@fMVWW=daXAOA4irCX<vas+fVJJLbVVfNWdp@WFoodt49YcTeabr+
zE|CF28kqqG1e>g!QvgV~9o=4K;#f!Q-tN9-xif^aBwLoZRl+n<SID#XWRtbHwt>P3
zC<rUbFwtWla(S&?yxraX93~lX_VRXMx97mZ?s8c@J*)_O7qDUpO&Jf*IrtJxbYW<~
z-sN&Et1f1u6HpS#tF&|!^MgH{!{tCB1fp_>5KK6`5uw=Qc8yx?Jv9F!wXvB@O#nWI
z3<2L2WfGJ-1uM`9H`MI~9;rfZ2=ID5E-Sr}HOmO0K*ruajNAwhY)4Ums7p+Qwb|H8
zF@U=x-;o-vat;G{mZ0BFl&OGPI|c?_=pzBx#sl2OJ4*Q>w+YyeRfbAH;a#39W!7dd
z_2nR1!XVUzOli(z#+L#1?XGf6Td$*>=4@$?%i-`w5FbPSWv0(*d1?$Bl@fg>%12ro
ze3_CTW5M%IE)p6}uB$(@rK7o}x~0COuA#}7`?Y0-jV$Wn6U{BYEUH2o8qhQ3a-mY)
zm&$-`!v+?k;iNBV%hs~W?PXiG>?*6+xh-t4yS;rL_h=-GBd3p_46DK>7W-t=iJE$w
zKCBglzGs?J&$FZ&g5={K&aoE&z+2EJUs|mM?k&y%hiAyUcguF4ru0ZyZGDzd-sc%`
zl>2nF4*1evDHr(e^4N;`%A^>PDzN3Eo41d+5XsX+)h?G;zVb4x8$PrAvy|)d6>i_m
zb#2+XeOIYt`>xHU+w46%O1mmIZ!6upV@KDHuC6WiofTcqYpA3z4Lyf8lsmZ&2e)PW
z_KHg1ib$acVk<;Nc1O07jGoZL)#C5V8aQvMyvjFD?N`06dPn1pY#ddpejQ7(#Njme
zv>#A<JRnR|HeI7H!L)bp-hI}VyPB|$*4VJV2TN4nU2RxD$YT*fZ;uM$1i=f)<?pJ)
z+5w?gpmMFxl4)oq5F>yIYh9jReic5|<4?$eb4_*KG1)uSJ#~8W#Jz$KH{RViTle$i
z>M!w0^}o7ddWH{L_%xKoXOgo5j#PDiCA?vs+XGav7T$yOB~sy`$)Ty{srt$Gdl?_D
zyt{IC+s{)D@T(Ewe|3e8XRDhU8yXK)SzlP`5j*eZt*Fl-sx-9;y*xBI8psIf#jFkY
znm=s2+cxX{c}ksBYXu?@Q-L2Be*AOc#~Xnpz#3@V<&R(eK?FKwNHf$oHJxaZTW8bp
zSxCcYlS5q});X>?y*3S>%YJlYRtr>jt5q5;E$4Lbg$Ou|KOrB^HPsWHas1F^?d10H
z^7pjwo9>uq3Loos{wU+)757)n75>>;sRv?fM>vAbpa5zY+XH@8bneJoC!VpHI4!61
zt9tcgDlhdPd*ZfO<=1d}zt*qw>+dCe5Gi#m!LR0D_b2ox%4wr-&Tt9a65j7M%VAt%
z{FvD08>6#5Ze2BgmAjZT^(V=BMc>{O+3!u2ef{aOFZ%YY<d(~0hjPuR5lx?E&lR<x
zQL8u$2S&+C;2su_26Ne?!~<i5;=Pk7=lyN9U&~wK=iZE*n^m?{UkxqKb|TORXjv_0
z`w<Xa*ydpMwUt?$9N2__%mRV}y0;eNgUvcZq)E4Z5T6`nVIB4=eQb3ICk{FX9X+6=
zuqbr5U@g%*-Gf8ku+Hna;teN9l5`*^3e^J1hYen7CE*DepQXw*p-ixj7eCY5s;qo6
zzJ=8$-iY_-h0lKb+s4l~|NU=&YqNw+*o(Na?zy{xAW^xnNf_z^k_SN|gtb`S!&u*`
z2?X$A3z|#i)$_cE59|6pPB$>FeK4#S`dp4HVg2PH;4FrYQAaj!Y=*G5dw>h;yZap7
zmw4<zRbfM<A^ax%;!9ZN1_fffGNdR^DGj=%8i7agCv3xnxTgA*A#JkYO<~@!YB42i
z(mT~QojEOt$y>*@PZHB_Bu^wy3W4?0+}uv_WV6`L%_lmpRexr%Os2iH`sV6D+M~4m
zC&??tHKo(`4_$X%(-&vAe$p?VYMDRNI)AY3z94pXFLd?=JNxFHuK59eVc<$|;EL!Q
z3prm2b-wykrP^Pufm^MqrB}V?pyoI9I<EP(^!kEc&GhY*^g69+qhF^r=jm0axj?U4
zO*_5XH68S_Yq}^GyT(bm&<nZPH6HplAiXYYhUwR3%?Q0ZHCO1>fsH#}t9=@*S1DJ?
zZ@jAcENAU_#f@DPyF}fFKn)xT$0(QqU8&%h{~_TR1W6CA(VRMpXD}PIes!;gSb}5v
zD0bmA@*JsCwI9c~1h338SH;64emyXcmILOwr~4pMlQDze(9c-#a_Q2W(-Y1S^!@}c
zfw3zvi`{Fy3fAZ+P+s<M8pJkGEq%ycuA5qQ{e(`1IXwDm{E`wGcI)@j3d|nP7{5;F
z6|idiGvs*Dx0luk_IMTC(obvNvd6Emu;tnzPYX(;g?`x+!AQVcoQh#Cibo6lvPX%R
zBE^fvTxfBeoC#w!hSdi?rxm6JD;!Nmo+JePMsjE(e*Rl>2$y^g=uk1N!k3b-j2!BH
zo;Z38mGGO%R{_VC5>9MxKHO1L-CWPp5Qp{HW%WAvZ4_fWIXfs+N7w_{0wn(+kAYV4
z#H8md$*CfT`1AZ8a&q9<62rP7Y>@c96vC>zk9-Ve=<Iwi@SojFy96(P03QTe#UeOF
zT9<iRyO`5L-`6oL^2D4mRXCMBb@{#AfLY8bneG;|w*<{wuGKxsSTU9My<OvmCzk9R
zjT4Pi+X6!~+aBt~Gwt)1i{t7=v*pH~i9J(WADPz%il$F}zvLtRlSIo6(}ZcVV#*N6
zyJZe$6h2N||J0z$T>a}rRbtW$aL=sp@s;~mey06d{a+pZ^r+a{9y)w6w7)~#*C}>(
ziJW7Ba|JoqBaRmbdC@y6dVON|Rk6!2`d`6puh!HM;;7a%5aOU05J$D<1Yv^X((9Dw
z4E;K#IZLktnsfAeRozOj)ol!MFvMg$uc4L!ZCpF?Ji?&mnGq#_1Wznc(ob-*?1>Uq
zV<0y8)j%i&NbHFlUmG(eG=4oMhV~u3Tg~Z!Rur`5*MW4QZwY=4+(<ls0{jLRo=EOH
z7QgDAF=h*4vYCBNXKD9~MVht`3ZsZ^aIq*mY5xrPk-m001Z*hTHWqB9UI%z=*wSK!
zCkBXTz}d~1K4m_Wb;Aa0HyDX-X>EO`EAtKvvN_?)07pQ$WZk@TCyRvb_dcsHnZ8Sj
z20WZq%3xsFTH0gv>DjltY6jnpHf_vAAmGIUYKXAS!n#4bw=b+i7MMgR9W&z?qJ-6#
zX?;b&^NXkfJGl-}3;a1myof)c9}ZU1#H1VM3G-xKC@~jnWaYl`{@YpauDZ1<a5|K`
zNnBAfT|I4|Zl2KvE!*d6uGK%$8OC*DYC)hnur=VGX_+}Vn>SlMyLFbE+dfzHaHZIC
zT5LWeo;fdGXcy046q7r|UiZ&+9toTj5J1^9s0^G=!UJ%ED?RbRqhA35IhIQ0RVZd@
z#d=30(}lorn#N~(#znB{!WxgjHzOTGGGU{_8^AtM$9M=-tqA>YVjPJM>R`SD!5sbs
zLc7;gx0~KQd+Y4G7j9j+XPec{49}jPxfohgCuT>sFmW4q8%bm53W(Q8ys?-iHr_V4
zUs+6%MdXRjDt@h(s5th-TR@{rWi*Xka<j^>a$<?UtzjL7%?tqq(6QGsDA)|F-TZk3
zv0e)&V8<hP1<-lm$cJ?<kDUwaJcAB*Bq4tQQI~9jOcbYs^(5bej}D4J$Q^s3#PrE+
zp~Mx}s-NT)yq|L?=l!*J*3PKs^R`^ycB68l^39g1yf@B<%xgql^IWEQvMIQ$8D0r|
zV(|<OJ_DaK=+D?5jt4$o9b&VGB<iv3g(%4q9T`qXM8udT+QYPEl7VZxYD^p53iT5i
zwe0a@%fKbvGej|vU)!&2ZlaMnWs`v|3i~IQp^jmi^ruEs$Uf9Zku@)g8*jU$iPy$x
zNu#O)RRuT>BOtL_RcidZzW<80RW+ivnHoQzL+^s?!qc)DPGpeK;km@qoDHi-c-q}#
z8YMvP0#+^~37prE#Aadu6iytlUvh9xUf?evrUY384SY9cpyP%HuxVg?N5Wh{Xki2R
zh%S4#19S<4N{xUW4zOle-6PN_(y}gXwM~M3*b#xUVSMSspWuN*JMM(vJNm7oZyE#o
z8Qo*u_9v#y$(E35<<yy=so+}e6JyeN_vF^=Yo{u1bMHEDIj1$#)id_TYj@4&eOz?E
zXs+-_r8m}6CWpUuc)WRX{k(3)?fiE)-r5*wzPE9vCA6{X@ygx5(W*=<#@9X*2tEIB
zW6e74kJssIiVfYdU`kb{?_d58II&<F1vh|`lHzwo1TiUy)>-z%LkRNZkGJ#Y)b|ux
z9-ylw-iBXI<X3#a^((Ofd<xy{N9<Uz0^crdfIQ0M<^;e<BGG)pAmmeaWNb4s%n;Ua
z-f$wMP~en<BGkG)BT_^kBzR%%kheQ*bP65_TL$djaKg|aMdfL<W%$q$)(Y#fG3M>O
zfDg-{L^ojPFY({OhXMN71PAb8%)p9g%)M4~kN@!M-K!tIdiT{I@gHBkfA!;6@4p%<
zKe15W8Z2)WyIo>=Yp8r+YRgpbt=$1{a8=17prYYh4dae^UFMtpfy@B^ID6ystDAzJ
zrcq$*xW|kf!N#&D9@6(JBm6w)1IS42SN9WyEqgwQ{O;B)M=j0IP54ojG~w^68*K?Z
zo1Y5$k1U!k^~X;h15dp<tm7Sa&IUfL+YWKe5Q<rX`*oPBF8(zHU#3sAXQ2L0y54o8
zccS-(Yr=KAGQfqBH_aPMX4IH(8}4uTkHrhd68wK;ERkl@AEj0&Y9A!(tJ4gGD3phK
zf+79)Fk@nSH7?RuXoe`I5N}@^ulG2GFDTC&`8|fkGwvMHI2FEB-0$Ge$+H7Xzp@<o
z)lqJj{GC7ORd$))Ou6;_%HC2A0Z)^r>aqv$K<w>h52xo6<oxBf^siYK2|s1Hk>e12
zdDqGD`q#?7=vz)9?Y%EyWcU_up8UN(U-m`c98{%xHJs_5qWH9A5mT^XG(~g^@V~`a
zT9n?=_%(vryI!s-mn45tgU<@`D!I{@4LM3gELsj^*yHSFgsDWbCwo1Y9PaungAf!7
z)n2yI4y)UI37a-=uG+l$^AaqkSQ90wYB*t}&to5OwqTb)TlKIRl5KG4S||_SdbdZB
zCbC??@dI13Gm_W}xrfu;Y0F@1FV7+UvZ)?6IiSqo=4h)O)?(YkZ=pzAsU$6gEc{ja
z>8GDbv~f}pGtX0)ks)}m9Xp^S6mc6lY|mc^pG^w}U{5c&l~)F_pnEO}G?A6XJdq#i
zV3p?IMld0GfmTeQ4pZ_C+l1}Sy4&gR=G@9z$lVmgzNDlslv^LlJQy+^x>mbrO1e=r
zQ8c+>DnDdevtY^#n)1Z_Ei=_2(+({53a{`<a@w2uZ*97{X(4@6Fn!Z>?T1J29-Y<B
zo(q*645c4hNIw-!KNU)E4kfpYYZncs>n%50Ct6=WKeaWOwDyr<ZG^WtWen^Bw_vvA
zabnGr<n$ZP3FmE{v^iK<QyyGXE^a;?TGJ3(aU_&{6dA>-U7$2%+I+3{GjsBrS}}9?
zeCnP>bMmz#(lSE*B0na07{Xf#_hkqV3$R*Z2T9bu42tnKPx7P%@uBQ9qRToMdVdQF
zSQlM-;*k__(VT_|h$woK%OSBJhuu4ua9bOtjK}mw)l14y$P2kkK$PgYMC|V)XaY-M
zLJV&q9tE5r_r#cC`C`bKUNsD>cy~+=anO(7z?lfsD)|_>6u)s;C0Mvrdh>fBPSJ2_
zK8zPbfZM$aYK@07xpZ(c(rA~llvVi>w3)$W0&Qm9%a+>?TK#bh^2zZV(Y_T-fT56R
z5MUU%T&jIHDEwxXP8E|v(U1JL`ng@ezmbT7g4hvK7Nh8B#9NjMRs5E*L}HhMy_pz~
z6$*|`628P)sAPyiOGp%>c}M3|_o|)hF+(f%NMnhwBwqi8^d3=<L<kq#szy*G5IaCs
zC2SnF^G?#n5PZdbUhkk#RbJi&iGG*I&T}#*W^!_<dJOhmc9jord1k0_K=X;WK1;O^
z4nn!cPC6CkwBvndWa<gTC;$#is)qWRhj;o|gl87W@kx`Zv}JVA;WM2E<}9u5MF0^<
zq+As?^nqM*@WSU;&}G2ejAxkuj*W*G!Uj;pg1y(_(^EyQ&on^U|AwF<vBl%DLY6e@
zOK$Xdt#Y9bj_tTUC(4GuLCz$c7XBusNs<x0eb8BDby|Tj`1j~T=8_M+*fm*)1|#c0
zSWkN}h|V2Mw8J+b0qAVr<#Kk>UJPA|4Va-x@-XBaHsCYu|JfP>(wj+vjE7rVPS%r`
zFF+prI5}(`I7+_gVnFO(Y!Ba|(EkGtl>#xD0}O^P4>!s;QkWJcht*hxAU_JL9ZcFP
z5HiGq5qTo=*51o5{y*TuxA7<Vv07ruFsIz8nyA9wui=kR%%umj>q6%G1@p0>`B=!@
zC~<dlzPAtD-Q>(0?g{roa$zvJP+WgPJkz$gZo_+5e&7qZ#5G&R`m<s$|7)$<0p_Kc
zT==C*oid~z*FM#0jZNw&X*qALy}5QFttgmQG_9R!7SoF6(<*0AeZu|J`M@cjJoOXT
zoOU6t@@ay~k~t|%?0=G;{no~t8>gBBD{i%i(l?FQE~ey8H3w6yV&S$~ZLo0noZ(>+
zIB1`4dUW9Qlhn+&OgBwa6#>I^-W@Zx9`mWC_k16|a`%<l(TBz2zGji@dtB}mF9}c5
z*9O*13p3khYNto1FNy1_Lg~9j%kIUL^vN9)S05#=e44Au%>TQUDszsQgSDqj)Rp}v
zLzP}7rd9sKla#C*{t5p=%KBi+`Y%*!v~4kC)zs*8{Y>5uH+-~VX2op!Z1u+n?;re+
zhv!=6x@Q~3-N(g^jpEu9;+m6U`l;Wq{fDPoO7=|Hj8S;7DX(s~=Es)ox^n%G^Aq9!
zq+DOO%lOGQ1NnEaIcU=V`HJF$di`JM_3(Go0w+JT7}4)9DW}*4k90@CSkZ8r+sZCe
z+NsJ*9;hv7id<w!ptx|bs+kF2^GXUGQLi9-ZC4d6Q4Bd}KUB{exT?az5(rbByvI$N
zX%yfni6~~#55YDDzU%?ijK2>jtQHsqV^$Lc5`{D9<Urw&0}k?13daHpM=6tkfCO*g
zPbh;!Ae$_vcowr(ObOE&!IaW3wQ5WGVtEyS&$0(&VyRIt?yp8K>uc1{Qwhn)gLT>`
z@GR{#jzn%)cca@*@Xm=_u7(g_(;FpZwNVl~p4tF}V%jJdE#5Xt=5~$g{5l~y$|2)S
z#H$B$7ITvx5XQQ=l!IB0fq}F%O6bju1mOgUYW5jROF4d&l+B=5<)ojHk@F>$md1=5
zeTj^kFZJRDVI!gC3&N)23(cEszCsxrf+J3fsG!HK3@3torifNB8>|e?f)!d#<)<`N
zHyk@#-P%E-t)um=VGU2hZ7dkwePQ)+rtT5e_d@$}(5C1A6O!;BQ#wne5*=)(JWE09
z0fBHgLtzpEGXpG$H%~-2|1*4h3x7g49HM<K<Ibt9K;rbK8Sjre9$o@ReKC2>ln^*N
zvl_sVydNmZd_aAz_E(9f8^#Hvn7%$B+^hMp?k@QG72xNaE!Vrn%w4mqXOqSBL-Wap
zNxrjlV&`PV>s6vI>v^^+?MoRbxmZ<*T?zmK>E^|6>4~@3jz?mGWf~cBM*L}Tz(&Iv
zxWwoV4nPH&DrCzk7;>|3ZwvGWX;es}2Z;-0CKzi03WftvC+L9s0CWeLWJb|QXPU%N
zOm*;Ol8BGku|DV>^3HDWVJP7qb&S@M#sSnY_R?l)&|B(ujQBEWq>qBz<fcf%LCA#m
z`c_61-Y!vi2dVH19T8yhWj8aO-D*-{Y`~Jw58GXPw{G?&AM^AcgBqo4FVh?1X$C@T
z!{tjsLt=>y@T<<_n<R*!na}?@9I()j;YHdNavPU$Q%n))K->AhLPT0H1qYmKs$W{t
zCbx;XyJuU(`g8NG=NDQ#gRPwlt(StWm!5*#rEVa>UYq&|N%>mUN9k3kKBif;q>AYq
zr|ZNmHFI@8D;Ljqh<1nAdj+4bs_QiXE6YK|RqGFGB=FFoIQdZ+Fr5flifJVD4C-HV
zJId$)E|8Ekry~lqPIW`yt?30N+73hy$)KLoQ}|8Ib)ycUWBO)BrIK$%WlL!Ez5TnP
z^O8b$6^13xb~Q$^xVQ(5XKz)ZyM(FFR9*eu5&f9$s)Orw2v^;Zv0ZiIOac^DhXgB>
z>%oBJs=Z@)Fr)`idA1htKY}l;c8AR|6##8SnUD$}NWecs46xS}{J_sq5<RPASk19)
z1mYV?1dfCrk^ulQIr0nm{sa682jKuiB$_d9N&T9|^sK4cK=+J3XxV|q!?^2O^)J_1
z18aio%4ZCZ*6j+JD}(EHP34VOkN3RZAg<dLG*^nc%C8=oD;dM|wq=vfSA^pQOt-)I
zvdgv~Wb=7o&-RUxIdGv2JOBspw!6Zb!Cqfp{Kyx|c-P42g)+Cp`z-lFnXG$y0R(qA
zQU2x20(mK1cA*IWg)(+N1G#&`dggtWx;*P=34^_*VDZLRZrlMh6AO#-4g#zzRX-uK
zWsm$FyIhF)E?~bmrold#5HowQ($O%mN8V`(>gzdCc~HFFFbEVy0LiPbmw5>lu?OWq
zyMmRY1I+8<F&x1<k048wv;r(Vg+VCiLi=7h4wKS!=v3G3I!M8hKNL`)!UrWj>`B$v
zp`I7RmRDGrJsNoj$Z303J;a^@i(cPUU)RtKSYAX)e3+bHkn?}TA;@(*Y(|hX4llIO
zAR-r{Od<X+DBe#gUQ%662Psl_9BpW<YYuDe9ETMWXBiwE1lM}dJwiuVPsekFu=-M1
zJ&ZN<N?1n$kY?jJ$MX_vbGOSb2srrA!FBQf9fkZc{)E@y0PHO(uh(CzUrfz<%Y4)P
zy`%}<xO%+e38?A3+s*SSd4XL|%t<6poIE#mdESiQf4yS;#NqLpN!?;f+KthP(W$iG
z_fvA?P2*JIn<;m)eyvyKZh*Q*+S)HIs<a*Bx<zx!<o4J01~T6po_73TOw8N%Xyvx2
zT73JZIc;*wcy#@Y3><0}Bh{|Kk657O)ZZb_@e9FG226RFF+iHe=U{#-a{h7<&QZ`(
zZz0om(2!$lE=Fb;mHED?z+u%DHJ=38V~lP_H07}Bd+N8;;4o~~;dIy^Y9SAVwlz)%
zIfZAb5tN`{1Z=-0KB3;_8FBDX)7F%2=08Uzmn>(-J=hzA0m$$3tpUM<<(0B4+rth6
z2>Z&E&qO~7v}gQps=vRc5|g`v&Gv`(@sZmFQ}(wvyjyas<n1ysrT9@wgIK!%ldW@?
zf3ia?Z3v|_Al_FDp?!PX4mCF6TI`|230SPLj|H9n|5Cm*Ua|}^S_}Rw1QT)=h;_qA
z@?dh8*nDoGxg*%zG2d(tC3l6)U81f_S{Gx7o$v)Co7xacV}g}V9a-tXwr4_`*!YM}
zPgKkRjFIJ6V;x+fBWwg*BB)2fLXOF2QzV}_AQV-_<FuqM7r`M4Mw3coCF*40LWvt$
ziKQq}ixRawG<Br)7#aexB_l`Hf|uoo7Q`h475*E_EMjGDM439|sgpKuBwr^wKw164
z*&$p7I$(*<W@vntQZ_WG5LRH;gw<t?T7Ra)fr&Cn|5dZG48WS`0J<4*LRCi3&VNCv
zl}?GVASl%uq%%zd|8tZK<r*A$^9*3IwhuyuH35hZ`7Ni`lX2Pr0!82?b{>jPz@R=r
za^ZbA*HoXa%nKzSx>YoJYC4V7^2KfSk8KBEyF68N?U0y!=reQr)HbMQhRmmKj!fnS
z^4>4HQ#4)hgOZuNQ2tizv5(z9_AvYLo|CUtPmWxx6V0bSGe9+GD(&W>@r$43T0=?a
zZskl?Ppdz)+_lV{d0f0_?$l2&Jh&h>oq1e;_BH!d&b5PL(z!)T`XkF4oM^ZlH0O!B
zysy46t5OcDzxo^VsjvPf=^T^E{p;+SwYu9nICpbv3Um*&Y2;?<$lZ`#Q>=TiHx2HO
zQ*>~bpdba*`_bfB3>R--K>G(^y*PlQ;JOGn$CG?U!5WxQ+xX0M{-V9qx4E>keN$Ln
zdRNC5AgoP8UHlg`hR|TaiAbB8pP(V3`4*YxI>9y6OQ=ruDSg=hhbDN^jU5v^CQET9
zfqTFIPX7;FA@kM+5K89C*@BRHpQzjS{7ly&Et~1IT+&RJ*$@3x-m)h;zol3l&FmMa
zQ0M?9g(l_*1C_q)f!e=Xrc!wIsQx9fK_kS(h8`W%`w3&{zz+cRfE<jY(3b;U06>T4
zrV+)F%y-b^J6PP?*Ub~5Rvy9sn0}?o;jD6*YV*sUDu3BVndB>#18owa0kRcGjCMG$
z^x$Njpd4B9CCTwh2OM6zFIh?NbocOf;Pb&j@L=9VYH9TKPz=B^KJZ>}PzqwIfnGip
zBe9hCVq%Fqc#q4$XW{G5kX&%Wxu$~P<+aMm{2S#H<x@o=Q~o1Uai9w_B}>X{4U=1L
z?4Q^_wIgKCe`KcMx+ezX?_K%U6*09HTk&~AhuG(e1WhJR70esf21XVQW-%rIks&|e
znav1p*dx}TUNomZ4@e}<Wq`z|s#L$H`@O>0xfBH)NJbTePkZqw6UM0wq_nw`P$-u`
zh!hfLny2iE$E=A*f<_5eWr@g-3UcD9A;n0k6=GLTE5F@pC#h0>^V(#}^_O$vfA`uv
zmsZZht>p|(6@&>|EOiFzss0?foakG|O;~(&-I_iuL+yx4jIDU`_NW>cmfb9DcoQk#
z?`p2E!Xl?fDt#Z$#r#0+L#@X2=nYK4I@P4U9a~1yf0sl{V~PGm&P*w#5k%R>Zs-)C
zY>2?dj1cWG5fo>kILfai`t^q9dIrieA(rVyA{FFmzG3MG@sC`SB3lykn8k15k|Sh;
z#cu`?l7h{+cFZzn1`;v@0*NAGkKZKs<XDnF3GL<lNn8rmVJsOfOF<h_W82W)hcBuA
z)JWaamV7&hZ)yItNc+?M>0CN}_a`%reD(D-e@efic_5WfF5+cSyxyq3MPBr)>{H5Q
zJ*51SdM};Jq#V2jO6+tli$WquH$`qGmknk{1hIn@Zo`%fDq6j&u?(~{hf>I+HK}g@
zE!vam&y?Epnr=eJt%!|rBP&7>W*}acKP%EFa+@WxEkzE;C}d$wvk@~J{k++q9qDIE
z$;5e5U7c}tK)99B-odEn#4ufQ{5jkzs+Yoa$@!gfT>VXQB+=&Bim0Fwy(RU0GJ1vi
z6n1g07lf_!_;cmHW}D@eW2-of$k^(!HU8We&(roxD9_?0Z6o&hEnZ@*vqxU;(2JSg
z3OTfYi|mWOxpjVv9D8i7e=VQkUoE8h*Y=YZ!?K67%5@!E{gPbsmgb6job#^%DSZB=
zIj^}sfU_$Z{qf*?wSSG=mv}QM_mXUlJs8n^8e_SR^6wYIOu;vbU8uxffq6=WEqmnJ
zMd8N3(!a`EDMyQrws&`&u;^Ik#><^sFPH!PNb?ndmpC=z)^i)=@$KI$ml=J_c%M)E
zy7Y3HIGCW~if$*%ztyTq&2<fpm9%Ea7?#!yu9&LA*%S<`lQ8VqI(&Ume2gYw#p0La
zTM>U<O#XyNbl&}P{ZSIb3v!*17HS3&Jd*d#(gHf8Y4edb4=a|Y9b@uZOo<rbB_)m(
z`14V}!kCS3p}&wTp!TCSM%j;aEG*I^S^h%Qk~Y5U#|pjGa(l*gJ!+U#N~E&ok&)X5
zgEMt#{RSwyZ1NYpq2@|}VWhQC&6Ud72H|D?WVq$>41s^M443d1$Tfk#5dK1{Dg3$c
zvzEo+PTIx;clOuH^^3ka#q<*TEz6%HwFaBl9OSj-pPCnXY<XT=k=NEp9k;>1E#lt}
z|MrMK6@In`qwF2<?}&u&^sh&2iXvl!z_B8Kk<@2+OW3(cN{QdB6ueok+^*Ytv<dVK
z+Ej#mE0J%dlrMZ$<nvpRyS%~?HqMHf)p;@FM(bRiw_ff&U?w(hatt}=$V$AS|BxIr
z`sQ}av86RpuERG;)2G2^hgLp`KFEsnK$bLH5zb%%Z;77S!+HSN7(I~X-@xs?t^N1v
zv0{I5e?zohvd^!Hhkg77Q4LYK{t$-BbSQP=vL`mhm<?sci4&zh(fTyxXM1t1v5o$X
zLZ+8AGuT7F{d)9;$-faNl0X$IA?oWUzrO#t95ed%Z;Yw`Mt?DvxCbA(ePBcrjcfLs
z{k8}r+UzeLRs)ig{5C(MZvDl6GsV814QyEqmURLB0`>%(k+26bGhZw8o{&o$F9a6Y
zA0G=~wyp4<l4Hsk0IEf6CJLo-h5x`iu@oFinbcqZ7)nr0a=QK&*%y8HpN;xuUrY*6
zuFIePw&fww)wjR>`EOkHy&Aa}y%**0-cH%a)!x>4yX9YAhwQ^i^cN^i$vMhzuI{#W
zY*WlWP1zYm%{M}Ut|Vrk*CUq{efu~0OE~MjdYNVel$G?;_IcUE9hA#`(Sep2yr3`!
zF;0h~n$D0HD{K(#K7dW6$2%bV`rWcG`o@Z^x_4M!-=j4d#hhiVM4iG^G)8=EkE4WU
zDZZRo9~9t-VZ<INwrv<QdTsLWB`_DE!qAqrek0ltBd)>TD3__P8DB91{(KyEbgvkr
z3T)5SFk07mzQWl0Mbbv=T%>$Oi=I>K`}4@*o`y!>sV3;Ak$E7=##2N*N=C$(Eh1PJ
zV_eP>*=!ftHc%{v$+|2{j0D*Su~~|UY)7KHHX|^fCBROaqge5gKFx?t7Rd_B#I2+;
zK}OGHRh)R=A%T@^8t=3Gts!F9U`d>qtQ#QQ^$hXdj;qAvvNEpMSfu5`)ks&=v5pX6
zP>;-DjluF3F^iXll1vy+q_>uo2MIE3l4RX1Zj~Y>p*l+|H$bM#PU1Wwnfv0QmelO@
zIgZyzWigkh2@*CcT?_jWl17ujhv<u*9dd-6jckiS?ymZLHP|(uAHd%F^BY)FKL4>9
z&d<pC+ZAwjL7K?VQ%XxrRfMp{$uZ7q*o6EeW~U^Dbwk8zTR3G|1H(x%IW%x#qteQ-
zQE6B>X-Uf<ikv{<d;vg-x50rVku@3eV+k;YaH^b-Jh(ijIK+@k#wDB}4Ocih5<4<p
zVRgALsmdw?uux_7Rmoh(;{8>M?E3%-zYi3jmw3))rR|#_+?F))qq1-t6F&GVm?Vpd
z%%x=eUzU#KqXc%0UCF0V^>rstG_^2}t1TJgi7uvtLb@Rkk}<#3C)7J&$r3Y@Se+~_
zYd^o9a?x;II8xQs!KAG`@ma%qH%VXt7k~g#LgPtf&VyQ5YA%Sl%S^gh1<$`#EAqv3
zEb2H0!l{V<n81M|dPj)&6iywH6J|!`gi^hTa%;Q`&OQHk@Uf#pOid!fo4v*~9Qgka
z-+b$!-~wTwWEe7zJkWru3VDe6_mV(x&5^s=f$EuxnKK_%&Z*}%JTQi~Hr%$~&Hjp=
z{r^{~tJH5AR;i^Ugoem;U~o&CejQNIOO63d`i+xn4Cz5gBzX|X{{u=4r$oj)BJ&aW
zoz!`|$f3^VtKbWpU~vU!C!jPeKnE-ezceCJ0v2~0{oGE@KO*Upm~2Q04A>~5(<mBQ
zej&EESu)IsE*kWJ*9}8gq>h4dg<=%Ol}zh#9bkkbiSj6;NuubO(PZ*Sc@!Z5Hmj8}
zmB*OIHZrQ%mW`^J^jE`1wUOV0LSn}>toHm9Ml=t(2%Au|$cSbidvIn>J$ZR5`{wAQ
zoZW#_f#Ex?GkG%yKe7ea?+)ecesD$-?Eb6O>(oA1l@)>j8O2*k$Y+KAo;3XxV})3*
z5GY_RDP_1FhgRI)-B#g}b8wKX;y_D*tl=^AShm!T9J7+=h8;}KVdJl$n*1mn(&{F?
zFrY$6A;K1tW|O%<>U-#W!_XL?i+1rYN>C05C;VCNWaSYe^1r3<gVcY!m<ckbHyXB_
zJ<)Wu`DAr%eMduGjFwmzVuy_<&Oo!Qp{~Ap*}0u?VpIL0hUS*0R{l4X?VIHM4JFZ$
z`5}U1SVLpB4#NrPEC@p(zQ<z1G38Uq?1q&R{daPR9mYiXOsvARI`~g1jN~Q!SMb4d
zn!_D7I0eqx>+~|wC&}Ihc<?<{Ot^-X2D<ZJ{#z8=bg-cb3Ly-o{fc7zPjc3hbCn!F
zIb-C!Le8t?TqB2sg*?d%(4)}e<Npi&_K-73fr*4FSPK)OCpZYa<_H@bF~*F*u$4l9
z%lBfj8WF-qWlW(+?&2gJEfYlkTnAx7fejXvnH>B9%KkoOuLE8X`2R+~KWD#bt&{XQ
z6WEG{tcM-=bMis<T^R005GtW|hIP<S^h)w%9o8O!=^IF+{$DA_==A?fmKMVz@O9|m
zZ~}u(oCxsngMD_lz%Unogg!xd4Gn$1p8V===#=3k)+p1O8Rl0~Ae7~MrGuEI$d$Cm
zI>~v#(<y(Gl*}x#*q0wcp0xT4>!EP}738EkgP3@JUU%V%(E=ovd>~;F2dVamNmeMD
znerF&OQEG~g0^xcy>~C}uAz6G`dZDe$~J%4d$;#P_g(joTIb6Sy{RL8o7;uAN8c`=
zPu=*i=~}~+BHQ~TcShcS<<2XA+BaXc|9WBMwAYF^8s|*~bG;Awxps)-))!Cb+_|u@
zephh)uKD#<p|oSc^;H4&to>uheaGCvKO30Ln>_f2O<Z4f?TDCmY*Cl|D1A>*x98fC
zMN2ZwRwSp6L-R3te0bsr%(v{>JL?YaIsUNs(VjD*l(WG-XJ#%>swX#)GSJPGKw4nO
zo!sdi!MrWO)GgwkGq8A(a&~cT{=5CR`ft1DQx4p6-Q*_iQ)$!onLVMh{ohqjxgMn)
zc$CukN!`QDpBx$2eU_3jd2TT|eX?Sr7e~O-GR6}Y(=#R;Zk9}q%%>NP*DPkQ0H*5~
zQAGCEnM3p0dnPrDnc0)WH;+t0{XTQDBbc#%I^$7B$#mahYW6~EUN9931A(J=%4YII
zsoNJ)_XJb-%ym7?egMl=XM+dNk*%0+XRxzhyyOXX4q~JZXqcI*8p$x#0ZpR@>u{T7
zZmLsbCxy^1&1JG0)2ZRfYD}kOS!x)sFDd2~`nGRWgC#o6r}?!(m9rNLP#MKfO{&y%
zXh@+&M{bq|43E=`(V|owHn?dTuU;%F7HzwOMSEt?J}RmYWn2mt)d%t(raj#8X|CAZ
z6>R7hd;3ET{gc&`J#RFKMfKx#V#cM<GIFL?ET(2op1Ns39ve4JH{30Gv~kaD{(`MK
zXsezp7n@Jd+s=eC&IWB~0@X;}_r_7tb|#o{R=muMf<Jh93~k`mb=0sLO&wXqxeP5>
zw1Hj-JR+Ilx}dp8J#ksxLCrj`?v$c*Xv9k{@%#m`-4Qz9gXk0ii6ap*J2m5VPjc4>
z?9;kCy*O=AJ;Qx;D3rTrGV50>*9RP-l_e8L$Ll87FBTMumLgdE>tD=T`PPM-7ru9K
zQvD<cqxW9(e2#5;*OScbw;FCXh-=S_?H5Ct9h2(MGBR(Sol*bL@R4Cw{U@eCuM(vR
z$3a4wXC~F*jLd)6He>%`??=6}_CM*ryYi`7m0kGMqDo4;adhHn;LvQ<!&48vpPm&j
zc8Hxl!Hd1~m#>QcF|^}V^&x7<nEEiamzVmYMRS_E<P7=(-&z0_=)4w<g95wpLgzJW
z`so|J5O@iog5=ErmBoU>z_~lS9~Eqy$zRB?4CYtP7KQR_9(qymLT5jNL6<miId}>7
ziiSg-Ba7<_X0kq6`LI4z-8A3cDcXBN?Y&Q`>gG=WwDm#j!{Jc<nfY_)=c_K@%YwZ>
zXa^8q7KNdZeR#qCO3?lahO0|mtqGidzx7V*^zi)p9jMVE%~1fQHusq3f2y=e$2Cv$
zR2jBk7pqoVLn%9MZJV?QDgtNjRL<x_1=}%2x6w4-@fp6R?z~kuc{xxW=(*D{lNBo5
z@!hnkx^cajy7Siws<ru{w3=HjQ|k9FVu+m|9ecdK`n!2kE#nDdTFqzpnttdOH<fm;
zY&LDS^8V__8xMZBVu~9#K))VGg2t<#WY9cqxKk3!C?Bu;%vu!6JbA}3RWV&LeddEo
zB-(L5ch3GW;ej($dE&dL0*3K=G4te;m1{yo)WQj^Jo4~VaAo88(WjcEtYpmoDcw^o
z`PLRqr%ms;n=Ad=c3>`VuI@pR^y?^qsgrqsnVLIQF?Hrv<x@Qp{c-~i!V;uPzxLM7
zothhd&?@~pc~)#~6VG=ATf12Rjw+?C3|yYh{k}i6s`ZXPkT+ZLan=1Q@!;9VyU+c*
z>VQAEs`aS>**;BFrR7gwp2__Kf2g4Su75gj_VUNR`#$l=`N#V&e7}0yA1r8pYNVJZ
zRazF1rS4|$Q?vBjx)Ghxc6YD*dv}d`u43-&gDN@Tq`Fltw!wywBiPm>2Rgw=6um<j
z_z{2t0CPxPqme#BV{;7x8i3*eqU%o3SNegtb((t3w0e5OT_d`F+x;9&lF?5AXF!&{
zL3^Jlc*P-qP#6oXBV$^W2x*bS(<G{EGWr9Z*?Mcw(-i6VuFBcfAH51VISjOl;}<JW
zQ3Cpb<h8&$Pu5ri*>9hpu70$p^iMNq?6V0UIsarGM%?(o^$2MC%(;d7j$l0|X?Lie
z6CFLl`d+dBlIXe;>>qv9|Ef6lD&}6lG-v6Bd=CTC(Xf7~@8j2TsgnI_X5*_~eUfUh
z<s?-1RfX#r#IpgH23i?laqzOpUkwiWLn{d>P>p}hs{hM%8^6d!<HqZsu2v<b-#9jL
zY%2HNHMiCTywgpg+|Bcrip7lV$&s6T7BUKg83lp5>HJVe>3H2@#)`KpZ&pqLCl@}-
z*fp*DF!65UOm?Vv7vMf42PhBfw%IGE`h(fU(}gp6cWu*!liXDQqwL~E*{<5W#X3_6
zTa5{KN`H~HjV*msy6;v7(x%scf9-7DT-yCZGg&j2|9Ax&m%aU$E7y(JPZqv@^yyAj
z`id`isnT<4!exhO_W<W{#xWe5n^I40xMiHYifPEEcwjf$Th1(;WnW;6S-a*7J<>is
zq*0}${oOH*YW3Q8ci-Cm?*3c*?``>T_ubte?!UV~v}*Uls`}un`iG<9s(Q?adDjr|
z&?`73f&S*y2Q^PJSKQ7H=-)TrG5;Vblv@_cEC=ahuE2R57`*74(#{)K2h{Ivd%yBd
zC2VNHP}bvueRJxc8Xg!P>OM(YFs=q|b$#pj(Cby>C6oQ{tq7RJ#7*<Mk|#RL^>YhJ
z>w-z^0xdIz^GQ1&>vnzh#d(b?{kZz8FR=WcQ-Ae~lmlOVu|k#ULP&xt6CuFhv{?Q9
zuQJv>vUI)2fjmjL>zqD63p*RL2k+ZvSIr$4o0?(iQrvWUe#04%3_m~D{tu$1>mR>Z
zsY>1XRTzKBE4^0zRXF_+d9zNj@>aJYq@ew)FLX3FzWO4O;QluoRHikearHCd0m#Ll
zBxheN*ZpL@0q!T3?2FqHKG~Ucu`=<`^*Xpe-IjWBf8s;Ef!qp9hc5Bcm6i^p>C;Ua
z9m%@CDo*NDCH&P69b8eB)TvJplXc{-$mldBh$T95cVu*?Bm_-5a*Iu!nTf%zW^(uI
z;D%DNJ990e4LWkSXLqi(%v*Hi?pWJdU;zr>+*xdSvVUV|srIjvjU9Upf1R_cW0&Et
zcj@8(WvRY%$5Klpv<V@-t1rI~2bx)Mr6-=2V?6!FsK%4biH4mBqnyhU{Vp)xB6%xX
zRB{M(RFs1N&*v!T%=E;4MYPw2ioRqXJ!1SpIlGKgR1$Zk)0VhwkIA0`#m^U_%w=0l
zw$*2vYtlX;QO<)OMG9ig$@X2KN{LftH}*~JyInkQE_kn5v^CAIZ>E#D%&6Dx;x{ga
z%!Q(^kY(pHNEPLlFf52Q$@)AIIsfze9Ouf^#H0c*UK6zo2dy}zW8;paGCoQ)oH><y
znco#X)EHyEiM0BYqVZ*4blhI7ITy`eE=PVt$^wOGo7TR8I+_hE7i%A%%>1(p5jZRD
zbD6n9d4Rw}#wM`}b`Ei(Zh-DCU}g_xOZ+7!+5p0OKeo^K=x{}D8X)$S)lJd>D|n7x
ztKAy85QI{fS#g*SmznUAWkgm2uF1f)BhvL3#k8j`vEsbD%L`kB;8;VFKnm9#5o^TK
z4JM39CI<;6#O>}-_UR?Ky`>|<fRif8bwLavaYE_J1u(;K`v$wZp#%ryuXNCv@e;6k
z0Qa^sY1d4WxQGF=7`uOl<_4HA>Zs$1t-_y2pE5qhGLQ$8=127X0GuU97m|s`6s;&v
zN6pJ=U|JFLn(FUNDx>*^VZw03GGTf1th9v;n5VakYb!#DTVU=EnxiA%8u`6fzV*ta
zecrI*i6wP1?e#<B>d8}Yox6EXvO{)HH+|{@Lul>h`K$_@)Vy~1d9_gmF%bhXR%P@9
z{HBLAjKRla;198GT2y^h4)rtstqf++^^e4khsNYwA(({{)ELa&a2lFeeu@9P4!@bX
zu!!hg7gvp25rj#~a*?z+e-KkQ<$N%SvzV0%WisNlGVDNbiLpXKTnk`ql$dP?Xeb#Y
zoKo-=`1$#7@%WO4-0UbP!-`g4`fh7y6de)=sS^xX!enePB`#Vk{UlTf4(9}AH%tKp
z5=%6SB|sywZ6&@7<M4n{VoHB~BX|`C^SCg%bHX1qta`6;X6wwzM|<XU!L9Y7!h_<P
zgTG8loy?iIu#jX8CRu-;l+Ucmj<>>^?6ybdbrQw${S!0k3k6ldf~wiAp@RK$nqWcg
zoHtZ(biM_2D;H{UJUZ?GMU-6dE7;>KozhKS5!Y3SiCZ4)wmuIs8K@n@t8Z$)7Gz`)
zpm@ukC<xrZ0Wzl9B!NQQ+Z*`R@eInyKm+B;=bnflVN<+x&^p-(y&&xv!0bDufvbg<
ziCl{!0?6o^3Y@RwRI-ek&(`3edDNs0ur%0N%b!Tu8~hrSWRpsYn$9G1HE-+a%ra+W
zZ`iD2Z<sY<Z&+t$Z&;0IZ)o1&o%T+QUKrJwX(wu;`C`(r<1SL}_{B7ar84k~O)#k>
z{9;-YyoO7M&RK?3Zgg$Icc#fIPv*!p%#iA{BwiLx+xYR8_7rP_0Xb(=3goEAN~Dpr
zT_M$0bYr0p3w@Yqt71x1r1w~VSHvFuS7h-TMMe#uEjKciNwTtpBp`4h@coj56N~NS
z1zv8D)M+>c2UF$j6a#D?M0_v`9`WIX1D_m&bCjhW)il0?^N{T1gEY78C@>6Tcyxmg
zGf{#!_bdrZBaS3SZea2mJZ^R!SXhfYlze75xW<MF7kmj=`(RF$H=;>cR7k6WKO_0s
z0wW+Gc7b7H0pALlxgC{(NunNN5(|fr252TJN7~_plJWyPgGrmf*)(TN@)P?4wng*G
zsji^eI-QF%2a`1uyQjuJGbi27m}+`E2X?En#q44nn}b~tiK-(}1Z%EOyJzb*$*ecA
zlzp0gxR7Q~B@=MLvpuYXU{`=|TUbZzXvDAB;?sku9Q1_MqpX!oZpGJ9mWo)Cx`8Mc
z(3}j>GD*eXQeV*e88*Pk7z}swtnt!K8?2A?d<SKt;9in;jtDH)vJ+YS1&T;cHU0!G
zFkBQ77j2y0dB?v{R23|$nlIWDGG75#GLSdd^3&EIx6U_#57iZF>V_GWV3QN<s)d2!
z;J|RGY502MRK;V<8nI{(9m2Zug(g9t@#|#Oiq#==`%Uj;-g`Tzx4|mPw)uhs4-P)8
z_(_9!>h!{?3&B$tLUk8#cFRl2+UeSlGn2LB$7r+y=~JtK+qvm2fmUqG46~YP|7^wV
znYo(TqjQ%ZX2a6$L$lc2BA#v+FWN<*`L15k)Hknl{vs)DT>XR$h=aYFJGFH(W$JQ-
zL%k)CjJ(t{g<u=9{N}3XdVhT6ezVweRy@}x?l}*3CgZnZ)o=yv1EF^JqxK<@9}<VJ
zh!;l1QQ!PkVtXi@V#fVA0IT8PHu%9<z>d<dW>&*nB;(=dBo^vbHQP>~$4v&<3%3I!
zBNq;AL!@ih^w6(fiEVg6bBTUk(zxg~pmEd7qZy)f1GvxtB@Aflv<UQR*zE;=O|2H+
zd{UrGQ%~Pg4r;-KHXhQ_qL=<Fo$-3}WajIw<3}flMbp~Hx^-WDk*l(dVy~L2vRqWN
zTXF&=^(x(iq$F|+it6>cADeY>m*5v=%OL_LWARHAOT=5UVwS47*UBhZi43a(B<YdE
zVoe>sq!fh$!s0~&v1N~(BQxLnTq&TCw2e$Tfr%qQ>SQ6kMDE@rA5kw1FX3D)O}E$s
zb4<uaS0wV+@rCw>LM5V;FvtiI&Blq1Fw|W5uI-lXjgIM4^QQ87-R3`C|0CVUru(K(
zsvdHG<^0qcsy&AZHovR;@fPlRqJ-MUh?0L~M2U>gNzXvY@uEQKK{#6ufuXguz|)ch
zzdlx}52sG!kS#EG8OcRC;jfc(MGgsmEvcDBk5kEEoZ%ha^3b?ctwGM8<&!Aq9gob2
zw?V{tJF;Of)k9HHe2F!@I2%pmLoHG0XIudUrE?G+wIGl5FUe0~F37b9!{Nm(NsGpm
zeX!!8SmTrX1S+4^e%ShuXnBwiCL*<X^YWghzH=A8q|ErOj?;Uv1W42ZdvMi{8vTo_
zdr*ebznFc>tcrJG&`WBPBj+A{`xQ9jlI|(DF{2y;RrYYuk%65+HLfQ~<I;N-xB*#}
zfDL{|qqJVqeDtN#uAb?jm9p#mikWtgFWa`8_PEkreqi%NE;(eI9iI-iH3obM(p7P|
zg8<U`umxgk<t{s4Vy(;LCPlwzI?_ZS`=NAtH>~NUv(fnGfX$jxSXH`gOOhBtv=72v
z9!<3!O(#yYge}tbjlxh*kMl|l`{)hIMNcXLymW;J>8A3eoC*CUCv1g)K~argFr~z(
z9wH1Ni|2bKMKXOiR0;*2Fb}Cuz~BxcWa3TWk!90lz6WODI;f1>h)EQJ&<BSOZ(7FB
zOjKU0`^=p3W`@l7CEK4BGiN`lnkf<YwTM}#=hMzWvdFBdZG9u<TMgH0$1|U#t{C@C
zrA=*{+8`$7z1J6LgES*^CSisX3wD2!IO~JJa@)eu3&Eoh2zG~#a^ew(xVPs?Qp%09
z6K5m5*$vYf)B5RC)86SG(Yig9wBtvbj}7+?3%ia4cO7|nMr=7JHn%?9AKG;uW_6O<
z)z|9(b5c51^9Z|a@5Elos_DC{Z>@%0F&o_W$L5OJyg%MW>s-b!3pPxbJu29By>Gk?
znlYJE2|@F^A9a1)d%t&K-^t*<lgM3cYZqHDGNB(Qb~waSJ)wQQIH-z!Ve#ZP*hJM$
zwM-op6AR{bg|b<6&0B_>hPP56>DGl(*Gm@CbqV9T@g5u+_Xb)(-DHY}9rL=KFoJRI
z=<~>1SvKo1T(QfhWG_m(<&Vsc^(tHccqm%lSz;0-H1gjiD8Tt%=QEJq(8nu(rYkM&
zzwApXi>R@5M6T@AFp%Och>x@01X8g}7w-FGN-vSv{2hGfC=T!sEnw!Paqr~msh&Vf
z;NaAW=`-T?gE*QWG9O+rHwMj(A@fO5ck%^ICUvj3aDM{!8aT$;jv0VWD6*EGxNJq@
z*(`g&qfsaW*q%|o#!XM%z3f?HFQzt%)1u+=j`+$QKBi+<W45vtLcy+aFICdAdsTF}
z0xD|N36^Gn->pzZkFy#?&3*yn>Gz=C*SF)?<iCY_znTWx*M)m3y>-}5b$dN9=hnkJ
z=&EE%5g9kE%BDrg_GUShY{9yOK{ko2$Sw~fU0700mhW4Zelt#Et#kofnN8!f#O4$I
zMHxbKD`i=J;pC<H!FC&QE+hH*H2M2|S^4{6O748s-gdn5i_c%oZ{K9gX9O0E*`G%{
zqs&H$$LOH2adQ5GoS%~ODI6ffpOb$IPFU09<`0lZ>&4w}T5wbOzr@ey5uuqT1^A|9
zunt#Tg1{!A{?~{LTVN*3wc1}KmyK(lSdwoXnmELScxh8LA<H_T8<@NqnHah8%ET*E
z_W2ZRpcrP0VF8X=V}IQ}uKh*E;qlrhsp-rbPE$ZTH6#{RiYu#TYeT6A#;e0AsZ*!u
z?vuc&x7#KQCcD2|3~M==4eF;xRZ2Nzq?Q!fc5#FXMWs|K1xfrTHe*1g;l2Ec3PSk$
zsExvSG<Q52>?J9bl|EW(lsCGZE{FA#2ons~`e`Ec(@U-@{THi~f(w?=Pl~;!m$Wku
zet1cWxIF_ye>$0cCf9>3N?<1e^!y%14>QM9r%XIwnlx$3V}deBrLBC#(G?T;%&1(G
z&Qre6GL_#kv9LjT6XO&!le*~VE;!)DDiekg3rl#h;glYjk%D%vj1c%gLLsyy2$UhH
z1cQlK?_$cjd4u)6ruWa@Is5*_I~V`7=7)zqI`qS1A03-Zo2wNMp9|KthPJiMuRkwx
zy<*>$AU7(ukNzSFJbHP-CizzWyG6H($N~}cB=Vs2^VnQEWB-FIv|t}r|0>Gmf3xeY
z-kZH|xo*0khH?pdV%Z1g4b|e2POPcVFE0vPpM)1=R^-K#MF5u&V5)41;;pW+7XLvA
z8{W|Z{U$atMZ#w(l2JM3GJBsTCZJT>8~!8pKk=_XVdB1faIx3`@dyS1N%UOox|>Aj
z4|-t!Niui&$CQr7U?<{X3<}r3Uw@~5x^%v9muOxs>fCb{sA3F%+PZN3V(|Dyu>&`q
z^@fi3iN~Cxb3okZMii-=VsQ%X^VqJD$k&&56PTA!U;P@)qwJU>OjBYq;|f)YHTyQ!
zXWE<i!OURfN!T1C*y4YHmNDY{S)y!Wn)Mm_h585p%g9{`!}kp?g;!G~Czw&@XOYnu
zb<;knn~bI#Srb{~V<F?3N5+~!23?UP+Nwf%yYX{YxK^{6M9MS?H=UE`1L*;sXkH)S
zMYB!R*`5a~+6%GX+K{=FOapk~)AC22^AM9#D)vOhlaT$yx9+5HQPGdd*!L*d2>6uk
z-IaW`Q96bAw9(zX98=y8gJVm*A9FuaRP;*Bc-l`g+v3{T-Bgqn9hZ_xiYYM}JO5O<
zjqxs-?I&i*vgai!;_VGJ*!!hEhg0+ZxjDHjVscoqteW^4Pm;%_#q`h0=hMivp}a2M
zOP75(WUkP8@vfi*We5nSht0J()Gn7H#{lBWbmwre6ef*+JOdwGHmB^P0R^xH`rPQ}
za4RtWxwukP$E}q3AH9lc6157q3gk&O0{>E}9k>GpN~l^gf`NLhrj0t@Yv?VH6}y-;
zUQ5=>E#VKxj6u4bZ}i>2KI)f!FG&#(f^;wtvzFB?f(MoI6Xh@9E36|ro3nyy0Zq^N
zU5PlRSR|K=t3%_o#jngSFYS%kBab=g`wf1Bp9!YmFOmH?uxq5Uh^CJ*+@a#~xO}<q
z_^U5z=fBL{f)N3^wo0Gui<$uG$3f!d&r9kRxBs6n1vsuk&Y3He%SI^rUV0#SOpxm~
zX7ZaRb;5s*!F`J93ZyBO)AVnXebG0}RYYbMa4Rk?eM$Xksa^JPMRE>fW^bkZF(#il
z*h5J{*Ivhg8?IQ6!NbyM<iNazvk_c;%^IN`7>}&T@$=mz=Nnm(OU9C5%pr+zK(Bf%
z`D^knlT)EKF!;b`b3&vx@ym(UKlf`|Xp{34qAiT%$(3W4Rb$moiJ#W52uLw+vi!;Y
zyX9VwzWpg!={937G1EyzXUOF(fvpM_50@Y-@f2JJ;cG2+)MjoAFyL0d4qV?<e==$Y
z${t3QQn_vZG+fz?z5Q6~bu;FwSuWk5>bKn6E<-2E+be(RrvY5{#6U_s9QQRdhT9?I
z0=Zo<AEIV9pVMOumZZyH`_Z4vA9+0*%iwnUGnhGnd~dBBtG`b6Mc>@6m(=!O2qSZq
za_`CY=XXY1^^!Wo@3H4{d{K`;5ui%00ZbtLVYF<R#@a1^iDx(iri5_lclpEZ<n~Cj
zOinAeD;64G(yoT(xdIm`;|plt%SwoW^GTSO09+oG)A<#?_*mvk%8K8I1>8Ov>R^22
z#nfFKNbqOLt>(|i^r#a0q7fO(h=I&wa*LvGZa;UxpP|$)+n?>vU`Eb1#Fq4uvCEe0
z7dt9kbu`qU$$$FKYWE++)<(|vMeXiC5pARF;}o+NV>wad99->pRNiJejz34vJ!;yA
ztCOLRtM?(|*b09plzmbnDo2FLQn-T*BOYSzVRGL|fZ`6BtJ44<=lECnSFBRSw&KNo
z%GJa(D;BMtT+1ar-oPD+n<`U|P3x8HN6HsNVtiOWD)+@$?n~0ggJi{w8s8NIm+>&>
zv6#M6QoU%zy*2U}#xt8DLpUD`*SXwrxiv5~veLgY9%kYiqdi83JfO%Gp?6_Q<iwci
zoA<&?QpD|dm^WNTWkYHEtlVPmWVDXnRyma9dU7g8d9Q*&IARC0hdU*wiHmug<b9Bw
zL)=)+;Oa-}7596Kf0g`wY)#Bw?Sfp3==-12E8J=Bj6Aa3*?Z^YvH;ur<(&Vi`FcC#
z9HN|t4|GykbnbpV-1yhX{rkMh8Lk!d&?(@JwJ)h%oH_K86!D>Ft=uzmoj?IrM=3AH
zxqwkfuFb!;SCJZnl538o&mytTa~EQSXLh-lqHmc#5-c&hk#@OcwaRUMuH=i@Gk0*E
zoLz=Gtjk?7{_c15y~>^tqpQ%2kvefm@8B$456Of;lgE$S%k^<it{?eIij0?_AK>B!
zI5+3%Rqpude?g1J*7?^7M`B8+90!->co~MX_$4h7-qCViZYZWb!!iDmcl3S}cY<jl
zXt*mxL(wY3jgs4|T-*8Ldd2j#&%bUNp6`~&MlO}R>R$&Ah1PHKul8&1`9DaMVm#Ng
zP_E?0xK}{M8@T*?ugXxQRw?R|DbE}7fyu1jmv87>dVe=4t5@VNF}*19&Az52<tDvr
zjo}1I&dMaKK4Wu4*T5<<h5rC;;E4?P>7b5p#XX@;FBAuAagm7whM4&`)sST+;D$V0
zHtN$eeQSw_Y$(Hp4lt)68LII@>L-MgYmZf*uB-1ja-ycAuAvF$6%yz&2<H_jR6^QM
zN8WuY9tadzJ`#u8m%1#Vl-be<ClddevgLn8wbPW=Ks}RHqnzJ|jQIWJR8#eG<O`kZ
zPShT)Z#vj;tiI!9b<1H%#$iA;GARZuG92w_Xl!n&K6b35_IO=5v$5eE1vbZqB6hkG
zyXJJmu{stvU5TrNEs2R-n_8B|RKmb&{|l-uIq*LuKRNLKU*snTxn(J3G@d{&!catW
z!-+=zFY%RbYJhc$gZw@G@RdvI8?bhP8<x<+!%hz_vr(ilWbA@PXT~h7POtB1qsJPR
z>Qq@HhAv2jgpQO*_BNcjEw=lTU@fLx$;yVcYsl%sO*hIlv}9_*7EW|WV*0Xh!xFpe
zp}foKE|-J(e=oNwY@wTSI-q1L;3$gJ5Y3h?zU;US-5X9?a=rvych+mHyQqu8>b*Xr
zT#7ZUXVvrROG}|nLN6RWfdauM0vG*8>W#3G%I_CCDt1BMOa6Qad#gy`OY+{02)0n0
zVHjPy!<Xb}lKCY=B&9FA3Yt2ROi0-#@`Fjfe3{)Ih;fm_fz21nwp`#YlwII9`BI{x
zWm|WYZT3~j0oFmM+YM7C7@*DU6U{kg++w6>%-YBj)ka!Gi6Qmn5jct|AL!>WB1KI{
zIpWHg6h%cWUbu)RVg_bS)C^46K=w*7T^k|oP@|jC?|(=A;9_0wS|aR-G4CTQEk#wE
zmFqt4Bc+g!JS6KrD^CY)m3K0s<yt*^>f;OdFFdq8-rI7!0-;}hNl5hDxdrOmh5|LS
zJ|!7o(p5JdvikI<`o=R>pJs2Nuau28-6bYiIR|hL^tZpR_o{I9W{LHgiBzYYy>5(=
z&vNlX*?t*z!fLzEV#-rG-o*bQYV5Pg-!Z4iAQlS189XIc?C{J`-z0W)&>^Ibj<Bht
zqo%34vGy?h$sHYs>#L8o9PT*XbgZMpXP{d24RuL~k|b&ZZumrco7R^W`Bp9q+XObj
z`Cm|VG^N#&7P%QW<9T3O$^~0xzKR&VG3bd6IK5Sh{+QM7BF&3YOlpQ2B*ae_?om7+
z@^O1gC6#yJ_yL~<sJ9BeIq33?T7BOkuq4b($=OLXlc`Cvj}?hSklP1^Hhdo(68d&a
zu{n<er_6AzY1b%ljo@(glv(NOH@Qu82V9Y0Lgs{6x;$5`WO$BU1y|nZ8E}-_-ME9*
zJz9<nI?8=NDUV1lA$cwnpcyjK=j`s2P!Tdg4osa+GE>KD!?Z|%0;FuAbw-zhu(Hr@
zC>{Zsc`-%HtcPUtKB%dw+vP0vdY}c*8i7KGx0I4@yV99uCR44aRJy9w!IjqF_+2eq
z@vH~wHd^cUvI^@Sf~`T<=mBa1?-_J<lkVO=SaU)5U;u~0>P?a&lxC3Un=q=+5=xoz
zA|Kw68*=oURAYQ5h!0ELLjzs7H!wiMpICN&b9)&=F@EftGD^~A7aY$FrKMh{*X8h~
zJvU-34vx_I5{}~#o?!KDvU+-Y6a)@?Ns%Eg?u^s->pN{_)@qKEdXIqs`Upa01|afy
z`U+W3+pY3+DOKzy#Vj&IBbeCe!`M!@MmxQeIy_FVcOuEtci;P7%wVzA>3pQ`Yk`Z~
zm3x3C5`_A^T=JH7<GanLJ=tW1dASIwgIn7E3wku1A_vI2WdDIeO);7Ve@X#~GC<LJ
z5i-R^9S)_XZU+z~$#rd8B-)9z7bO`wDWypkpsMjboJf~w&>2hI2z-g7A2DhWZ&6%Q
zg9sZUHp{{$oSUFnAd;}q4-l<HQhBBp#6KWk7dczVp*4UXM;@>m);HvJ0zCKuMklSM
zFQh9G*0VXozd-@)WMm74>Uv$CF6oZ=Wm-&wh!{>J*dh(juz7H(3wI`W&{0q_C#K?=
z`lt?9J$b`M2Y{3j7W_lXzmOafd-Jc6k90+OQWjwPeEfIt(`J>9fBc9(F~two@0t-@
zL_89qO_^j}k6RdF)=tA;3Txc><9fncz!+Q6=>{JnCBg=TbfDuTn@+^+mJB^<aF+Ca
zYNi&o2ff)dh^P+SLXSG@UAR&b8N;fVrq{`AE5Yy=$?JbeDKsNJlCBp)iC{&R)|Wi8
zE-Oq|$uPyIVoU!m%HaP26#>P>M9a8z;d}~CizdPl&g<|jCMDlEJ#l(+*XtdRk}BUz
zhLURb-O-S>^4dXC@wAZ<otq7lyQjL8Bd4%4GJSZa4(2YjV&a~8-Cn4Dj_aZHcxuWJ
z$P8SW$rcT}=5>`%jA;wT+@LWxuw61MGHsrz5c9Ur_w+6F3<P@y7J7tWk1+2YUhrNG
zdawS5EN(;$Z$u0W)&Bpyy$M)UX__ubY!E>N`zDJTAPA^{;DX|kvbuxpAPNEp5M+@P
z0ZJICRh8WdSw7dG(z=FInVn&mb2F^;PGVQyr^ueXQ#h5~P2R5QI$?wbNqO&d*OPO*
zYnErSD{H1J?K}6G_xsN|aSmo^R#w+cC};i8fByaa|M$J$`;jq6wMevaO4~u!9}}80
zM6NTSIjjA!<j18Sl>T`C2m6;aOM8Wu?!dkt+>+R3dbJ~D1428*+$$0h(GF4a+6o;)
zR_RXYaIZ?&N){os!waf(?X>IFo~9s?9lGlkglj$WjUzJ+ubx=R%YV;s-{2hy<n5n}
z5vpKN(;~E<^)+`cH~0IR`$0V<43GJnFA7cLLIr>Quu?dYo@xTV&R<&8f_AEZsZFSA
z5h7Xx`nJ!sM>U2z&C}>qch<MZW^}&+P0D(Az1w-G%iAq%KjbSc2Y<<#N3Zx}8)po#
zydtA_A*nE6E|Ne-wGV4QD*3C@N2PzY|IvQf`Up(`?%I4!c7NqWVCUpYcD}Hs(wAK|
zQz^t+eU{A6wVIT6-E0j!)@eV5Te}=GweVDYui!z#lbC|}oCWO<^A{(U8Xiq8G%m*f
zdFy8e3XgPI5?njoDW05wIqyNkd#(3d-#dH%tg0fkOUM2D+5!dbPc88`PtKlH!I^mP
zK7U$iz_RDVY~huQfwJ+ZQ5o(APl7)xXGXgk69=bzLhRXqrSob0y4%~pWaaS3Z+RTw
z{-B3QzLpD742OjBHh*C|z=ZM1xA@zRIRwcfH`nn5Ky+OV#B5%yT#EKpwR&~JwnM(W
zaxl&$r`&FyYjz*>CvAD0)Z*=>*o56D{e`tSg=?#snw8X|`Ec)LA!Uz{ym#jCN=)p{
ziP;HPS0E+_<=*A1Z1&iMt*`iU52@eewY_)g{w1OGc%bNnFf<~JI(<XaOT9uvzpr-S
z7fJ0zHj;e1bgtB0{M|D5rMIu%xjG*=uLE?vaUt$u%lr}VSYYG9kMxUELVbg9suBEC
zLJO*`!`E_#%(SXIpB(A}>?`@S=5G^{(YN9~t==9XzIdkc7fBf|jl0(~;2rmz@ogx+
z)9Y#lGIPe});+OgJWWo!JvcXbPy0^9-H3NAcP-wA`SgVWzqMvL`LIii+wPJ#&fgxH
z8+l{QrCUkZ;Mw#zAqT}gcz;mXbBa2KwuU-Q6%inbJ9gF}o;6ShYy`g(E;hnm3qfed
z&KRRrqs#%;L!FHSqZ2w*qt-^xRRQuCXlMzvwlBAK`dT}eTYG)2u#xK*&QJPVFZmlT
zFE>p48m0pc*YK<Zs|Xlo6-^TtiaXxj_{PcQ#9Ut@9HPHxzHgpCzF4}n8_vqh8~u4r
zfyCxOYe%4~d%3IM*VVt=HRkIY6E5=pE}PJ4M{E-s=B4(8wt>=hT-!*yvzjLGJB77r
zz*hwZvLl+`M2978aQFG+v#FgW-p-xNWzCWI?3=gv;}6VKq94Sv7RMm3y@8l4D$^Zr
z4Bj4{8}%n|cIlp`WxT!l&SoKVk5G1esnMTS?}}JSNOSjo=it4aUY)n``v;ddmHIZ7
zE=0h{@1tztup>}$<&&6rwCYQ9mu_F3yXxr;q-=S*F2mjUJ=5FKccT64@|M>X`qmYC
z?f!K;U52MgslK%42dVSB0{MIWY0W}wn?I>tICIvQbk?Q)q@votvF6dHg?dl6XWY~4
zO`g|)Q!Hz~e!lXtb<g4^-^Lo3!PVoAcUeGb<7#wodLw!{Hrp4Q?P+2pSQGx7U4hu$
zxGAJmkx3(nv}`}=q#+L$53wyz;}UMC%%$AUn9IP&VVgg$Xr@Aq1nz;K%zHiW4Bj1_
zkNGHZvF9i2{%ZZB^*`AdXlPn)Xz`&5Y;Hv!+*$74TW4XM5cgin{S=|NJdj^;`|L^_
zIP9J#BvJRdeQ@sJy)1HN_s+Jv+r0dIi9c(1Affcb1mVE>z}~^93G3b67)BCuW{t2h
z=y@6yC&X{^M`bTZZSzHK^PUztvHVe$%TdRDQOB1~2&d2aqq>))27OV3!jJ=vU>YAD
zw9)7aEg;VDb#0zC->SHMc<%7+6LTlf@!IFj{>1%@_9w;@i2hcVs!{CqUik39Qk;L^
zaew@YrQSePgU~{>SE9dUp}RNG&MikZ{35Xm^ll1L`purV2ks2KJ$z@_TY?(hu=7dG
zuJ`$cU5nXE+NElt5mB5K$~vEv(h!hTt@$)2&b7;(?a_LUct?cz{r;E(%Q2O{n94v*
zHMkyxxT+_X>Q61vs8l;f)phvPtY6eGS%Tjup{WZQJ*OEUd&l#-LD~)JF4C9pyl$M%
z26Q~_c->Suc84_%+QnW8N3V@?hND=(jkFV;u!UK0tXrsGxU?|1a6m904H%EXaK)8~
zSGRcD#5u%5-r`|=<IuPJE(jx+gxJgesHx?sYrd#!a!G%JK|e0R)#ToZ^zK2^oP5~6
zXk5w_8bLOO=SBs7jrHge8fp${8Q0!5(ed;#%nFdoam)%<lGb~YMJg`O6`=%nt`bq5
zaP~Zc3~Cr(mz9xPO>3{wW0m;U{~EQgZKq;r)K1aGE?qaBS$n83`gA=8c4B~qO;WD`
zj9l@Y;h(f&eTE^rK|5rp&oGPtVNo%kVwPodmAJBJP6v$ZXwFp+PRMq5q=#R?P$hJp
z6GkrzSDa6b)9|Uz3N+4r%xj#_UuY1_hn5UKH`adf>s?{i!<v7J3`^cLclOyoS;C?l
zHNL2ZfBww|kbs1K=9%pZrip)1T9G+W7PgdXpzX$*bnO0SU&UtZd|4Hd*!c^pw`2Fo
z`uKr#{U=40i8%R>y7&RB?ms3~QGmbO7(Y;;`@7<DI{D>(cJ1%eDZanA8V0sR{C$p*
zjtdL}r4fH$!j8+5&&TT4$c79^iw=LEd$1uG?R71u8I81KHY)y9{5C2uXed}d{5uBy
z(AjXzP|2E5z<9C;l11Ag@9SW)DXF=bXkJHKfNvve87H<Qw&Tp`89r;%Sts05JI~m%
zS2bCynlldV8T!itZ}<*8z$?ZUv?hYc^jCD1787cFds>%Fc8yPfIEGKeTUTf%PO5ug
zm7`;324}TzHhSW|*MhmY=t@{f%JXIh%-iPc!N_TjcE#OJg*o<4PqIHQZ#izeFK+vM
z!hD}UZokjGf5GN6R|xtF2FZm3WJ_&z8>n!bD^47(gdgM<5(2G8$mf>YX4PFwb=#@B
zVA#lp>hj8_uJTi-x>n;FTdGeqRUbbZjA~7#>XCR>soQYy8md*P&Y7@&*fzXsoDEa-
z?Xso_1^gl>!;^?eMI61I#^KOlYQ@|@juz6xRK=zCELsKuv+O}LX1S&jt{^C7EP<3U
zjL4?>KSp3ws0OvN8Y30dsfOyBqirBU4z6ou$>TpDwCLNH3czYrQ;Tm<Elxv-9{-l=
zouGme4|QD6oo2Vj)BVoy-Qo9Nd9u0kr;+dhjPHf7u>+>`PmXlo%DmJ3h0TITzLmCD
z^Ct;=HGdYdR|7%v|3azwEjA1me~zvB_<u(HZ1X?UixTNYWP}#yrx#(P_9#p>DE}gH
zz-se9p|di3Grdxuz;DyN=YFzAP_6=KKT%Rl+-rc-L5zgYJ%Ce{{SAqG4IH_}iAN;|
zQQXQia2bL;&<~YX2vize8}7&1jh$rMB|D*H8n*ut!sSpg1ht<0Lj?~Bw~D`8ZXipM
zbED|B;Om^~g8fvDDn+3q2}QsKgn4kVq1?cVIvf}?STeJ{=0+(n=FF95Fqen)VO%82
zv;p0~K*(d!#f?2)emg9VwUQelt>jin%SAIhV(9V=A_akWgf*i*h>HcLAZQU33TpyP
zxl|LJ=u$EAP1G-YlUyfFsyc~hb>jTWI=S$B)JfUzS||Ma(0EA|HeAmoQt1Q7`CQqf
zT_&;8-b1x<Ane9|<Sw)`&Sd#nxh)VTT_msJ$A6FfHUG}}OXpIMLnv6D|H=IlIWvjv
zj5l!W<aUL;rQ(hOPfK-&D{1UXy6Q>>yRu$&WdkdbdN?hV>%5ifJY>JK%I!r&*1~Dz
zOL`pII7T12r>Xk61w9}WrI|%74Hh!+7|v~Svd=X1>Fa?e$hK$5xgR3&;&Z>D%;zrP
zRP{vGm+uZ`fBBl6m!TlOT?xbGJP2Z@p`SMZHw+i6FCSrmGBex^m)xSF4+e7%lmi#5
za`qD(y%4hwxU&@ICN+H8z;Lz^T<#F*5}*4ixJE9QCNxexSrjp+J-TT;3;LrxN1dcM
z0iPaRyg-Et%}LNd35f0nN1?Bk!a&0T{SebvkTV|H2?9L{wa?%v+z}MQIRF&ct>x`q
z_%7|hSi!thh>j>$kcd@_?8m2zq?%80iN|a?%wa0zhc8VPj`rE}!&k#k9X?Xm*hG7x
z@uz)rV|Bx7B+knl8=(fQqT{Oart*sN#_Cnmsl$zpCr&~ay{g}}b4LmDVFDd6ziI}B
z-^Fg54JrY++Q12u8(VN-vkemoA-M8=l+3HN`2|bK@L-Q^d>AfOkSO~EZyST->3q#<
zY*TYXV_jEyGZbb`b;qk~S1ob^NP#9&7R93g2W@y(-0$8|x)+a{8mg;~Hd2;?CoErj
zc3-<1#qI~Q7R^q93=p#_I%bh$VFeK(J6Iq$Hwro6Gwmh`EfGyQDFGL!T&YlbDVif_
z4JQXl)4j%r5^2j6mlI5}o1ZLBE`CY%L~|lhi$MAzWiq6i_|k_S%5k}9yP%9<B6+@%
zp7=GzLd%gC`(U6Mv1oc}6nz+cNWpEi`46;NpbeXKvB|X=!I|R~tMn7)-SAvPZJ9~m
z_aewI@pjw4!N?<7EI*A+c1_&AGI!;T>7U2u%<5+}GemoMb3e%NB0(eSX~UVz1Y)bq
zcXICLcq0Q@JLcO~;^Jp?Gv%*`LmU*h8AQ}Z(@f$wF1fP5dCgt&_U=2oJ%xevVv<KC
zyq$U{^?T_*Pt2LEnkk<de+o%z=9`UAWWk599c<W7HXjyFc7avTcajs%+k{J(AD_Rx
zlA7+W^`&lg>0IUC3IEIxmbCeE@Zz>>KusSL>#BVH^3&{sh2*7@rNNI62<Jgpe%W_^
z3hU8hT8W~$h1SByMAD=I?Rk>E4S)j)7iou(BcMCN%5(q{G*rldwu!{qhjb@tRa>j8
zqg}nOkwo2xbWJ1%@7H$Fx|epicShGm_xiQx=&W1UE8gR1m)1wu`gH^B<h(AJ3uFKS
zSE;;mA4jCRd*1H9)9>jFY}g5*8KgZgC^E>3Jmc>;?>gs?2XYTB9tTsE4}vCgIWX=!
z#|y1s5kKQ=J&VE-67wI&<U^KKe1DP^9NuWM+>D-$c3t)G-a=pQ-hi=eCBit9@=eD}
zYKdMsFdz4$l!qxlO!aLp6JDu@ti<<9%SvhiWoRy(YNFN`ljUvoRC+acYl7!3!E+(8
z)E85_n6;3wQ2#+P3-A~Zv{QgTt@$hp^$Pp-_=MX@b4jji{<z%7aRuIz<=CCR*quL*
zh5Jlul8ex!ER_FwxDdO01yUY3nwZOXr9a&7ZuIPbyuN6$LC82F908TqG-}DIVPyNX
zV`of4>x5tvwR-}Z5?nliR)Jcg9Xsm~&zSne2|)>auAeSCHH=E@qA2*FGgP@#<Dm9)
zMZ@T_qMdXSHLbl~y`neG>waW<XnNlqh}!?qd|wY~OEGxEbgtrC?e6h6&bVqHM{k-p
zKaOIqF{)vSOqvQ;v)`QV=6vQXPo-ea74*4Zd=6{o12$T${f8ZC$McQ7>ZOSpmudR&
zc@4I&g}tVIP4}AdHPdU6ubClB_zE+B$+SoNIu@fMb!e!mh+0<gdL$Pvhs6gOcFY7v
z9MHXPR;@2X+e-&c0_7<K+#SWk-BIY!L2#la>~#~DJEO%gW1KO~M9zfGnEN9*%d4ho
zJ#i&+;C*~S9Kk6)Qp`MuK8Sl)Dm!|w=;0g_toyWxctIRNW69uT4ddqXKTHzWFh5R*
zGZshbs(csamGqYO1@8$O6nvfcV47+Oi5rSl{5(Hc_pY?mB#I*}uP)D;LrqJS>G*80
z>`_L{^DY=K(=e$_cVH^YWx&jgnP(zD8_3*IoPcsx_*leug?@n1qM(CMXW@<1PM`a6
znQ}`&ZG;Yyr3w)y`YBcxn3S67h!;GW?TkSBa@59L+~%PW6kAGexy_P{E3cOS-|5>-
zFMrPZo-aif9nCZ?psB;!$%F!scn%*CoLdxH8{qzG0tlSoYy+5%UN{*7h|O_ilXVnG
z&C3)!VP(j>l@%f}%sAoK%4Tgk(a69Xc=+-l&hcn*NonDB{3|ZYzCv;-nnFz%I%L;=
zwldKn9r5z?swECa)I|dRKKCL&-;KB(HfsslkicJzV$`aOan{7AzaX@3)~vQ8$IM)1
zBRAUqf~Ue~jcd`nvk`p$3&IBNlF(!<AqOktt6{SdUzV(~@FBV`r<;vL4oxhdk;GE=
zR&ZtU!e`90;4$MY>QZrP`LY+JIZ7ECLoo*`9WNAHokE%`cZIcOg>_%j3*H;eQW>)*
zm3n^H3ql8_7#Jpqu@1Ir7!*UdiZ~2u@lv<f;y6J(R@e58Obh^KaaiQzUJy^vp6i7r
z9UK-3f1RIF>(E-QtC}*0ndY_(ONK5;j`|#1Bk2+^BFM_D6Qjd@Hd_HagOYnWc8`_?
zgzJHe$r1|7Fo|XCmemR_A3G2-W!AzXVArIJ3b+W*uvc0chOumote3vbJE$*_<T42E
zBpWFWhfgqC3Iw&R7a1e~Cv2pqbj**R-eIJq(9dBgvu0&qap=nmrn4l^ep(UCNt1iE
zyj%owmPj*t2`Hz?Qzg!J<w6kK8He6(+l1IeY-cfCx^S4t%^!h&s&e7d;`n0kQgWc=
z6fS@9IejX>nUJIrA>$=w!!!ulzfLi4pnRd&WzVs4Vbdsu%sNW4q=KepATH2IhJW%^
z2BZdtw2X#J$;YW9isD3;M}R{_t!$xF=0Hx4yug|ja#Sqi<7w=+&;yc-)G|jroms5~
zsCMaEkw`V3Ph&qOb778GC;(7&SU%ah#zy7Wh>KY%{jB|fq#w&i06Ha~l?=<+$2nRk
zg5j|N4DAE*(;PntC})|K(1QikD5Z$TE>ax8bzUJteP9|LXs%hiwvS{nhJ6+k7j|S>
zrvZ#($gprUTck}zCJHg2i24G7;4F?AR!u~-Nd>oRU`59N5#^FrjjJ(e^~@1p*Wjpa
z5S9Uvtb243WS1u<-_=Og-B1F<Q+y&l$Cjb5;mC%z9!8mjuwVR%;`T$h=h*latu&IF
zBrz)g7Rnx@>85ek2$dk`YH=64G6Kd8pO}+YEKxU)%pQRgnPN}t-7?QMp%CtfdW8;7
zNa}lH>Hk~tzL0W!sbXoTkaQ|wssAJ<btN|LwsFqrULS~sucr6b-CyTp4c=ee7s&5Z
zBHiK10ew)SH(V&h5^6~3xgaDB2P`8}YJ`Lx^L4_GDxvC%5a$dSLE;?mD!+YX?udK(
zLDPGu@1OqA@MH4_=EcMQJtzDHCxvab!uq;E;;B!}v98S9d2@Nf`r}J=0=Ns$bPDNR
zf%tP^NR(gS8L(vkA}JLJmEyPe+}R^+-Xm(@7tBD@)GuCn#6Seu%}>%>Tunr=*!p^z
z^sJE77O=F-sf-(Y0$0NsRP}LG?hypRMc?BEoQZBs!PSSt7Aw6HS66{`mmH-^J{YOB
zfV2{it;Q?&q()<_fr^L4P!WuVdI(=bo5R>RSciXcZ{&|tTJ}?G3KyFh>yzEo*=X!0
zF%jzs^2pAv>?!CT2J~L+A}<@@rF52AJF-|@1=JJ!cyyhtf&vr=dI_~&I-lyZiI>sK
zMt~FL+128Kp69MYhzBqwyE!@rQ;lBgo>^yEBIQ9u>beDD21u4yRzzEN{a@7YOP=rd
zCFu8#B-M*qKG`do`$<O)goOn4W#uRd#H1p<*gYbTJ|c0Qd`82cZK4NHmRXCp7nW?_
zUii#VxV@-krzr2z)i#NKW{nEx)T+J*@M~6!eY~BKsk70DKTS2f2W=tWA`TEXY8;i+
zV5(?CV}i&rs_nhVymqqDg|DWYY*=9<3TctfS<juLG35|`q6{l~?O4Ls;vp;o!)&XF
z^}k~LfZLDc*<_c6F*X%=GC<K3X`ZQ>&0mg8_eG|=D*=6p%z;}75Knfy!e<9(I)rs2
zf@yTc)F?E=Wt+y-qq$!GDLF~I-8a|gKK#b0KQ8BS+&*vjdwuu&=4;*^5w`5Re(ayL
zafWft=V7${$LuhJ1xSOvP*nEa?eo_8H}6O1ZGW`?iT)HYqchGMT{9%>0aUJUwogdR
z@keid9KFq(wH#IKiz*f!>-wYi&uBj}#z?L&yFKA|2HhQAy^vn8p!u=k1A}m|!M~^R
z@t$@8aIn%&UnzLHz?web>pJf*9TdhVh3Tu1R$SFolC*+$=$uueFSI&sJxMFBY8nV3
zW@^-~q5#HkUY@=Drp{gdy>N_wDSzs?n>j!3Tenv@05}MXx%0em77SpJr~$Dz>AP@A
z7`iN6b_n~fJc)6_=VA1E_&kIJ3&JC57{V*#TMZDenA!}%ktsi5+yc*YrpTGiv!+|e
ze8vsH(&`Na6BS|z#3!_4Z0r`IdII`hSq@VF?fvd-pLv6z-|%HJEovT2>Tv=U|6=Mf
zE~vNzjTYL8_zQ)c2)QDrMH2fFL6&TE3xd&?#}s0vt4!i;Clxxcp`fZ%eh(BdFONIK
z`c;XW<TMY$<#a-Y87Idpdd(1Nx=3Ckal*zpwQ8a!Cy}egI-2TWRMy9p?AlelmmCUN
z$x#vUU0U-F5897R^k9Mmn+8~EkoO_^CTtH*VNQc7qV;_Da6egXz&{ZTq;O#GD`fm^
zt6Espz-pBY5(*eT{XA0G#1CTYh=idDU4%ITvs;9X3n1oFI$(_<;!gMvQQ?kc(I}^&
zn+?Y{$;ROjLiL0GlSgza$UY55{2AKx&}Ni2ZW@KkafB}#t&N$-WCkN&V=x8t0+v_;
z)ANm}n(g?reGAV)XbyQD$;Nf=CcilgB)<}mFs{96@*J4Y_M1zUs~{_MX9vt1*W%^s
z=IT6E{>1!w!=nC)v6@h0CjeX1dj<i0<`;GfmFOLvLVK4`eop8C>T_5yj|7aPFJJ<u
zk3Z`be+*TJ8glY=DCR_GMem|e=!e!Gls3{51`0>Xm)Bc5P~`?;1&l&Y_VT4yh`aF&
zjBc?F$CDA#lF|5<NsgZ>giUl^A|;1$Zb(^CP$mTu0Ge*HA7=>>PZX51WnURfK4haI
zdMe1yq@3H<DWC-|2B~MML{2~+9z2eN%u5Qd?r#XemdDt$r7`xRe2{7fKaj$QetU31
zEJ<dQLAOR?8uo)~nV<+#98579J{_S3Dum2YklsU1sVH}SK?>H%p)6t3MyHWK{DN>n
zf(keY2-XMkDYt<%)p5F7Ffd3G#L&49(g(<L>1p$H<g^KkXf3y4KgwYA-`i89!oanV
zx!owIA90vbC)BjqPeo}Uw{1`thKwUfD`zXR2O$J62>Uy{&lx1-m-1zm^Yel@gK|-X
z&!ip_GL`C3MD@5{$tkyvvMrYcNY6s&Q(fMWq1c0TL}+KhG>ZTO5SC>s@jD^(QPKAW
zg>nxz$@2AS3zr>=bdSp!fG~vHOzDHFKT0B$!8kG<<&5HT={l78CPpF?Me^8SE~3#I
zL2$;}eav+1Xq!T*$K`WdxUGnn<(mX#+%~RYz`zwgD3WE;L-}(0mHoTYA-A1CIn!}m
zu^dMz@BpXfO61t+9U%FN<1HZkie;l*@a^2rw+y33ZkHSv?(W2B8N=<y6}f+uGTNLy
zP7*%u#dUdXEOSQV%08zV+x^I~mOB8+`$3$&@>a}ryh2gO9pcLEBynOt+^<-3md!?8
zaa)P;R+?9^@wSRe8Sf0%!p#H;aDmoN^$@bXRVg|JhzIdim`-pe%;|1~gHRk6$-TPi
zglSe|xVwe!u1RY(OHYkL+AvfiC0(_1CWtLSu5*-fkmwvbg>9hbQ0Lg7K0^s7+IPv3
z0VqRXox^AeN1Tart7N&Ca?M<FL@9G5l*igJJBmBXdXYS4C#gnaP-dbJNbOaQowdwl
z5G^UGNM@-BhD3^vy`^89q8ru7mGVS9d*V3KeL|gXRR{|Uaq`6>?4@!kC`3N&nL0dk
zYE7(r<&gG$@{t0OL2Bz&*QNHN)D7359@o)UlN9<oxutWU%fWbW=E5E{y-R{p{796m
zkkugM+R<vAy<7~3HoA^$R*wNgmGT{BFZbb>^=}Y2706GZ-?XUP&2#;xb<MrDHD~Q>
z&epU(ZtZiY*M#i&idG-|mZHSh#&hOtJb8A_J3HS>UDM}T8GqHNHl6n3F_r6ru6G-E
zZtbW#o$gE>s+P-E*~_&eem$J&lNx?Ah+u;tF^t&jxNZ>MNHxs$%I$#TxV{0^{7@mv
z<oe~dhi}#ISDzQ&ijYg?W$lF<W+2TXrPrz3q@0SEwMK4aO>K-i(`YPH_k4`%=m~4`
zF}CKJi)+r-wzhHh&EeVBMsaiYx1!{nJs0c5ns_GHoUM)Zl2ST|L#eCF+!W_f=JW%4
z^>=l8J$L2nmQKHxb2`^!JFUcuv#Uzl`nCO}gu?fTjj9`_H>%Q;&t2oLJ2xn8W+2?T
z@xeEg{L}YH)o#9NKPI=#p%e0vvJXX^=M2t+QMTWb+a~)SDf9gxS*Lom1HlkMj~Pwy
z3+7$F!<_NKtM5u{D;4ojl;o$8eQAk=$WD@1_REG8b~@u)9ACI*HZIMFxB>f7Iixc~
zZoeRM3QG%nSwBGD2i0S|s!WIESTtenAc&jJxC$%F8$T6~E@^@kMt@W*YS4>OY>voN
zLA5vU!UZM@c0^d2w_^Ah!lhMBzJiS8Gcj#(l#{~zoPyNjdd|UvG7sH2BfEiMmvl^U
zmE0$BAHZ_ls)ixv!|r4i`Da*0emBKw<a(?Z;Hkjs$Sbo-l5z+;;3N{tB)~R_T&Ek#
z_w#+$-U%LJN4wQg3#B4V_K7CLI(7*x8}R+nP4eJ<kcimV`c7t&59TI1=uVlD)PNA9
z4~RnI`FM^9iGe~_^*gq2->&HFneg7xF7j=3LzV)+3ZmLmd?!;e$^M(Ic?xh<lv|8Y
zx}hi=?1$nGav2C@?D<O4xFY^E6^n^B?^As+*u(!pN5rYZlc_%w>;t&Uq_>bOi0TE=
zwd5>LQMT-Pw)qY{@F%o+n>HS7K!tHp6b#kypW%E}Z|5ia9A;63L+lR){3)suJ+2($
z{}nxwAoKVufr_3Ph_2;;BOF#Zr|J$kjFBQ~%K=AZq>Owx;E0P98J>WQZ8=(5-FP6&
z5uFt&QM#N0t<(W<#~eLbez>};uJ%OxfmKcMs%ATrbCX}oF}oufiU~V8=`P@`1tZpy
z(p|f(1!Gn)Y!wVx9Y$GA$TTX?64nOZURqjeeP)uw6d}0OwpR7qccWrAQK=lJ+?qk3
zL2@vrYr)N(+Z`!IqP`h47>xO(ke-FF2S=17GNW@alSE68l1c;Th#F~hq$n6=s$uE9
z+pLaK(w1Iip1xT>Aw?iueM>K~ZYA9&3FO4s@GQ%IAGc}>f>dDq(}6^b?IGAu;E4j}
zJdUKbWl*|(J1egUtH@E}NGK|VXm20TDiffBkuI)h7mK<lKpw+G$;mOkihY2>P|tGY
zzVP<Q7-vOE%JEoV5O4qjOKZV+jn%OsWC*L%Y3;+ytd2<Q!Gm&aNg=~J3`HcY1Q$@p
z*+LvSB&i@tD;d8T|DUN^e?=`fg@!4qM6G$jF)QBz-k5GqbR#F0HxsRPW3s~trD&iz
zEJ{~N)aoc8*K<<8VVIxb&3@wXvUbbwKpL!hzuH4Cw)es>9XLRU-bQ(ajd^UM=;7!M
ze;5uf^s#Y`iF8GKEJw#nqo*e^!qK3JS5RE+SxO<}8i8whg&v4`u)_ce#haCNV@HNq
zs!}tfqO@+_ESCNlh(g9L@FdoD#D6Im`cMA>sliCqC~B_c#+2P3Y%y6@@kDMPbS5<d
zYi{QeLQ*-BvvU!OsvadfYVWt^ir1?mtyVg!CE7G)$idZSXb|ZN4v%seOb6{#HRwK8
zP^Y0y%l(kDROBdE0s)*=2SuY5T1H%KwDZs#(hH9FO;wTyJ@$3!?d`j0FTl4dGBTIi
zV0OR5ctOtYu=oPzGQI0O9<`~nqomP_99^)M97Iwki$*6fY$11&Bpu`?qpIw%cdQ8;
zEIb_|ahO$)@%3zslBDn3cw0As{nafcU5$-Lx{g=3ug0>o<F$3IwOvO5-e}|*%-zH;
zGdO;@s3qY4jy@UnRKb$upEZ0?8!3HXM$_%Hvd6as6%6!Q1r`q8h(ZiMJbkC~^Tg>z
zKVGn^Yi(^6iF_zAqOvlZj;yqKL>ofB^T%m(A5Zg)1c+F7m}feX35S%5qNO0y9F)^z
z77D`j3M4aLHCI)iI#Ji&MH%JGC;%;=`8L|TP8-JNL%tCihYnL6sJMHGkcX#5x@aTY
zK}U_Wd4?Nn2zP9BmF4|E)6r2RZIu-JgyLTfXB<zQs5*7iefGU(tT++U@Gh!aqeU!-
z1Wd858ma%1vB|0lZMUm?c(B{H8X*lgL8S+Q2Y!WU;Un_W=&H7N67Htyy_zoGOF1x7
zK}F#RbUfYY?jKNC18cG(>_j)&4TdgUg%bCrKT*3IMgF#f-yD7l(NlHV{uEP-=O}sJ
z91>Y_{2O+-<DW*y%`^iEF0t<j=8dAu#VxLS*W_Hg>$ux~@2CeF+<Cosa=sN%r^yf6
z$<wo7JQ~m+BlNp$vcSJRd1uly8rZn&eVefFYM}I*bXSPa^+n{)Ykw5}Fns=MV0+Ed
z_|GOjo)DV3KwTeMu3v`3%j`Q5t|`HKguGRLoU&wsGPFT+j?}Qx-2^!|^}r?EI{3NV
ze`ljNQ`olOx8=aX_+rKf*Zh_`K*l9{p)!BehR0EPp3R^YO165E030vzCl`LB?)u>w
zFiCusYWkCiIAH68q%8Mr$awhuL2n1rv6qo~G-{hDQO%$OfTp++exoU++OxDft7SYS
z+j=R%d7O47jTkFLlaDBHNj%Ovu&~M1Fw-)lTS?ytSoZ$M#&w?(84q!Ic+%j6>v7sE
z?^_n?e;DJBK7>%9ahRN)bPWe$Ha*=~=;hy=ygxZV<S#0JT-5Z@8KI%^CtaX&@ozl+
zc%vQEBQq5<PM;-X1&kTVbIER_KQ8leT)n6Mo#wmE-aX&%!pVoxi}2F@Xv)8*ekObc
zPC#2`TU;mMf&FpRzI#L9jj8k#jK;Tl9|$U<Gu-tcf~a}_%HnQ+>9Iic@#}|IlGfdB
zn`?7VxCa)>7l!}5&YySUgSz=~YE<v0F4Xz*PWU#Q@F$(TUi*(QX^CIiknJ<3&lu<O
zKaEdxaqenQi?`g{fB&d=p8#5t<i#{0=>%wm0`aGp<Inlx&-vqfg#KY){P0Y~N^+(r
z(^GRde>rQ14<<8}3yJ=$gF@yjLgJwr(<gfmfzlzL`6KW4hTk3Zbj<603A=<NKsZ4S
z&-u>u2_5}H|Bz5~VaB+UK+R|Oom98kQ|jI0-7<f4p?{%mv4dD~8ryyKr-f7SGd?Pe
zO$(z$2XRfqC>&0SEG~5-i%X;S998^zaLr)X4fkaTd0F)MeGVotICE;R(k}j*_WCj6
zwh9;G^B$yoqvo4F+`6!Sv3p6sI0=_w_N9KI=?pOu={pJOFg1Gyt##WEVgea0_hUS;
z*7&QWM@b;<X=wU+dGkW~e^W1%H@oY-F^@A^0#PmGOC9hGAvxch?M?PheVFv)^bgVj
zdzyUI?%!JnejOpP{)w>xY!T6|nopzF&75?{y}8d_AVlU}uY9UE&m4B^U6bxMA!)NW
zd|nsO?+oHCo<_mG$bI5Yk+)bVIN;lQa8a|E{V2j8bp(wfp2(EqJQYan=KCgpe93GC
z*igEk0)C+<*RJ45(ReoBHMy^NvxVfM`Q(L!C&mM?af)958zZ4Tj*+igk6Bo^&D%fU
z8_<^p6C<n#0&Um)<bo}rrzGB}a&7cmGCdsH%t2vO*+R`?Wk7%Asor>_(iQ&g<1+_@
zbw%&%=F8`YAJ+M|R|!ScLbX#cO$YQ>(Ulce46`?To?qmJmeWs+MEUV)BxuQKfb&Og
zL}5gN(a6;@>-0xvEJtSgA~XGwo0cQ<eUbV8$gNaZtP*n{m_5_;RUf7=L@l=dv}5U{
z&^{a(xhxEmy_5sq<<aZgL=W<<V!I$m^0?S9l7aQ1%^)NXBN$wChz{YWv^8YoRHGXq
zv#C+t6rGLe9JF)jPU~^8Lw`;Wa7u^1Uymk7JKP)459vRrvkP=~T0cy?VZDtWu<NhU
znN5GlfZZWOCxJ@344@OC9itPW9qwH)j1sFzmtl;~It>?TchTUW2d)@uh?m7-ILugD
z!q3ny?kusi7&^oMR`giBY|ikRK^^3Q%08E=>?NnP^`6PQ?VjV_2_b_jbV`UmD%7_G
z%&pg}$c^FDH>SRI#Z~-`tL`RWMCNB&gXy9M#8NK3tKU8Bt)Abpko<7};<}~crIwGu
zxYi|fJA{}k0gIDS&>RX_%F&j(G(8%jhd5V8G!;~)l_G;%g_d<(>an=kB$7l?$3@6<
z+5x(F9wbpX8vq~$JG=H2mG=crJ(;3)X&T5(txMBJW@ofx7f(}=PF)WXx!}#ZR}Z6k
zCVczo&Dz;oza_&He(#EBMA%Wi$St-A8&05ix3mZJr}5Bv-LUSrtP#2LSP#st{^-Ku
zSq$HSrY@oJ9D;POfgDNss1;jLpLUcI$!W)EH>RDWgj~{Hq1~j;Njs;moN6wvf-25X
zX;8fkm-Ct^%gtf|G-<mjnr?inaIsg6yGM?jwa_?5pk=U=6INFg94ViD|ELgiaIr67
zIe|}YO3ppIxAOZ_?_9lm)t_4`B<~USom`p_%9@3?-T=sSTE_%_8j&9YtruR!Yfcb=
zD*2>#)`XFwm!KL|t~`7Rc6!%=rL5)QUcr1|vGM1|qZq6Z>{GpQW}iq<wVaacO92U&
zKV_ScTp$z>frZe~?Q8GBy95&#(Dz|9n2DR&J)7z}?&0QlQ!huTK3_|}Fm78OzvLUg
zghWiCfRPAZQ$<#ayx3ch$RG0-x_1P2Y#`_|v}wQib(bbA|D@)N&)0>mZ`J(vHzi@Q
z8NUwGqLF?QlML9`xF`9}l>35^4}LMS81%Q|d($Iy_6n`sa_f+<b;#d3EVPW^#iN=5
zDungtskl=IQKsNf8eO)GJ+_Sf^JfN%^O=oi+8-xcIyOiCbe*+htMN%>PDgRrFN#fP
z!*stW+jnN4?&&@Qj(ZU<_#>4NDcC+INv0aILe8rdFcbulI@mE_Hb}ov+!?aM0T3pA
zEt@hs(%JeixAPR%Cx;uV8-vEf2Xd{B7^@SKJv*d42doACB?SNiiBtQ^6U~iH)eT+1
zor}}{{WRAlXpJ~aP3Rq-u)!#&>*7Grikf#KW#6Q^Y8Ju~rAYM5q>#Gv{f_yQiyMWM
zdcV10+1%zcxB1Pd1^sCe&?e=Eas(%NQaPN)!OP3x<<=w$%mHPl2hV=k1A`11LD|4}
zEG;MCa+G;!wf0@^>$MgPLJVrX2m^0xK{KGB7rTi~w5ywg;gPlAJh1D%-NUp9C7GBb
z&05fAEhxvyq_wWLtGc0~uA!^3sqWN)Vz$nMu!xnU<<#M>%DUR7@}srtRT8Mub$AmK
z@~UkbR*fi7_DcR6NZ}vh&sKrLkV@0N@j-?+TG-tg=;D^UhJ0NFO7wS)3Y}wUnHNQZ
zt97ieHfmd_omyI{%^F&@UoP!ntNSf0Z2&A#$It&1HWt7zHb8Y8+E6j*U4}O+&_0E-
z32GkrGKF=}9;m;97Fe8KfldttVTMWy6i^>((E!C;_=BM0Y8u03C<VRT1K=gtXbPJ$
zO_`t|2to{@AkdMhe##US%||*K&%rDm5|h3IL27A;)*&P!x>i7+ZFY1a;xfSDHfu02
z-#0!1m*Ha2KCJwvK;;a9dEc-NNIxb%CQx0iqezs%@K^;F6bz1{=ipUp&UR}-wKX^E
z;s9fIN3SeHxW3CQTmgu5ku1>0B7qYSSw44*$hXmliH6x)FlsFprOS@EFXhM)BVUrz
z4VT}yP}Jh$znqTBXv3E9Y@ts}bF|_Q>8g!3Kc~$CHa0yrw3KCI0lx>0lx=3HwSE)#
zfC~g8UifVIjKgnCdu%*5pZTMlhdB%3?-#u3^p?MQZL#Tk`6m&^&$K#I76=oCl%qe*
z`PtTww}J=nuM35v?P#*6L9&QlGB_5+^%xp+La$b&?wp#Px^YF=w0q{t-<dOh`x_kw
z^~c6cH%tRE@Zm9KJ+s9j8UJo)c|q8t0#o^3-J?AkY<txWJlOpIHG;kvJ^QZo44Qu_
z^no-?vtKCuEU+<(|6@sWC5NZI+&JZ-Xov>9=Y9&M5e6zlEx(mY*N8;$6Li#x;Id!p
zzr?XfZj2A1B%XPQkTy!PSUHU5f|xBB;litk;XC-VQB?yd4q}5{v%6fWFt&bdZhcc+
z_m6;VG;^WmgZv*CeNf~tJMQ0jVtHeOZzGmgE&h$Ig1+_3NaR?=$39?x0~FkAnd+hY
zUxK=XMp1OwqPu|B$fqbnhpcO);av{J1__m^C9X5NBp|GGDwkatI7FNgrz8C~Y=MC#
z5nXmo>oKh8fq7JhD01K^qm@iJjwCb;-egu|9x-%=sBHz8iMEr=5Nx4B1s%O0lol?7
zqC>WdpcS`h!~J@uLN_&&*{|W^UNw@zqTIq1XH`TDb-hNV4-J+O7k{A&rMg4OZKzPl
zYXX-T%4V2LdX*VT%I}nW3Z6)w&HNr*$f%7-VWZBh&w=HnzR7;dXBv)h6XdHPA|k`m
zR8?uG!MrkEEO~XD3hGl%1CXF8!FXV!jd<28rk_I;#dE*llfZd$8yMnYgDQ@VEDoy@
z2gU&C<HaAShwuiqYqilq)!i)i>?ZZI=nXW9dhTc2s(NF#LId`)^dha)C!&?wV{gk*
zrzZ5<(2tZd+N`{7P0oT&TG4K`p<H~Cn^m~`&1V+oTkKXjODOTJEG64s&?^e$c7pbf
z4~+^zNw{8&PV_^m8o9zZgKZVza>P4WB1t_`35~nCs=Gy0%?P!f?WL9@kGXI{od1%r
z#q>-tEF9&A?Aax%JS3rnLWkO+3PnA8=d>AkNNSV2?Z5_#zoBjNk+L5uQjX;#)f3z0
zYsx+pj!=I4P!LzAgy%}-yGYHRw+z!36<%(y;>;5ztMp3=kGZC<4>&ETt8h6s<no|`
zj~Jrw%yU0y5W`MA2kvxV2{pDT7&`kNIf78JsStD~XAt`%w<0-J+#&lRITqv>vv$>4
z1?2#vM1%tur=u13gwANLlB;@9Ew=`g1$vzL<MzVwBjr5UVqex*r(;y3!eM*09E;+Z
zmpkGxLojgkdwO6agQSLdW2mslFVIXt#Wlj6kaN1GzD}yHs#9L8AZCV+$Z1jbL&ue4
z`N$cxF`ztil@IFVQkjmmpOiz{>*S-MQ}U6r2kJ7`UMrsuHONQGUXBxA?6_X-dB`-*
zqV>UfaNJO{5=uVe;^q8(M|&fQVWs2bE7S4Lcp#@RW)MD?tA{m&=7v!<?lm|QQ0t9v
z>0U7YHPL<bSb8HDXexCnHrrd|lpv;-uW0qb9)hr~ti`px6|trq6P<}KYeRgh(uQ6h
zQZ56GOBP_T+V>-wUom<ref+fYG}i&AwJ*-`nXi%Kvsi*BJ?NC{H`EL#_#K8TT7DhZ
z6>3!A&SA!ptju!cv|@SL4aD&uCapb4Yl@QA>2=D8pdM|w-ml2NYMkSG(5Iy@8;e^y
z1|qjzZbKZ0ysZmWGF+dW&oAd3SXCv4e#DUawPQ%961|xr&5)0x$7DFuLw)rW%p4r1
zhM37J_i1K=d37$F4E_sa>Zh6caedhIdbltR&bw6e)F3qm`qhBS$?18NMcU9=xpbAi
z+|IsSmWW{u&d<3XBS;$Yno*fd6Z%qd4Vr<_L(UD@ULd!N+_3r^cq0R2MYsG;dA<Ts
z9#%)<&lya&D$OHbKh2cJn;AE)lH~$~C{k*z(^h8&$}W=GBv_|29*imsNI@r#Itfdu
zosJ70Wd!k+cnVaIV-j`|tKTqw1<8MAvC6nXfL|Py`v6PqIR_}!MWW-8-EEzc<tAio
zZq2jx^;tn2U3IdWiB@FsS`njB%;$;vfZvUcBNP70g3n62dOR`#lwwaGaWYszUIB?5
zROCZ_y>=^qfS%eUA^`{CL8n`R_N_%7u0}$(CdJ6_q!-fio4IP_sY9-j4j6D@2mU^%
zL0-i;ZADuk+nq3)C(dfw3Nqe~$i$y~NA9sw2+fW4K}P8;*>Bx_EdvPD0#-=)0hu}a
z5Mo-@UxGU>$qMtjC}#P;aNUtg=m4%K1gXjQkOdpfB_-DA=-NA*T=k+09xwMev*dkl
zp?IO?gS|f-TT1lrK6zvO&ZaLIL*lnK<ZJ#k0;xDmZ`kyu(q{&&gm;pQJda;Rde;;e
zE&f??ZN@>6{RQQ#6qdyLVwSVd&mzUlq#gwU;Z7KT2phF9l>dq>zeQQ5K|$nkX&Lpw
zr%GQx+*-g`^hxVEoJ#yHF>xA4LOz3#jgq&>k#0B!MPqg3iS0&d7%yr(4pSA#3`inu
zb!?+RR3NtV%!QvM3nw%ox&XJ9I+NM_vWkAT9ggLw$@Zc(+w->MivjU&qAp-j0~ZTx
zVw{r5=0NVMCYL{rOg@Vf-KWtVF<{oS*ertI0+=NWDCIz$66%>L_`tIWNVx}rpmOYa
zQ7RBM2^hsR*ib&e%(7&N__kcfzMykH0?~@W_dzboxV#txtmI^j`E-LXIac6&-|$#B
z=QzjF1u<F)F=y@V20DxD0|JYAhg*A>pkC+%c;_&|pVmGJ(l0sR+oaeWN%RKL9LceZ
zPe7tBjYQ89<s-1L1`qj4G@xhUWyB6!w5oZ9--ZIeuNUQR`P4+W(1tMBDy;G*8a_7T
z+NwFISgESuZ&F;AB7)EsaT6nO6U%6Wo<--h=ZxfVO*uz$PUbY8b{GojuBf0{|7GN;
zDgp;71Sqi8vCcX<*iEpuLSA%fNU&k@=P3fn=S~GFa1Ve%NjWPk$PT7aW{#cCvdZxm
z)Ij$^UKPdW#107r1%%%K$(z?`KANp8YJz+r+AG0$#S3zwP9u6KNq7QEKhr@z{Vd!{
zWpW5SPr1E7lpnO#{OVj2#yl<m3c~O-Zo&2)M)KBz-W>Ex1IzN?<8s*bR}0G>y29dq
z#B{P^@E<VLI1aPh`1;r;Z17k}zGLx`v5lau5S$O-Le@X!ZxPDON~FK6J)SzOV1ym%
zC<P)@fe%D<YP2fq)>40VoRri<guI8#LzML(se4ql1Bw%><uYDrj%CHARJ3xW1;bXk
zB@pi0v9S~GRrgu3VSjMKP+dzda=|{5ccyV`K4^d=E)HKDfO5zocMC>s#7KDu`<a(Y
zu_uE%%9JJdAxESVioc46NxCdmGMa<^<+&P#F01gR^$%6VpdFaq0(f<VQe?jsbWtS-
zHy5K??P!Ojb|~4-k5LWgw)F9X{Zpg`;m0nC;~bpv+Quf}dC)pZV+IdDf%%T>(inuX
zfrgmiKnM?rHk-BAIt1$jN<Q7RK~>Uc9i=f~v~X;YJJ4GwJtp1}$E(r8QQO5e!xgJ+
z7M4sL4&?H=0RECIU=SV`JJ9|mO`qIozg#X6l8#RTZo=>ZW)5sTTJ!BAMFRWwkyU2!
z+lQ&%@5X#46-BNiK9{~A>Q6%!BL)&#(4>##s>c3xK9N5|OR!}kU6LEyhL3kIcDvg=
z-JV7vZy#V^I~IBZ>E$2q{(?V9jV4x34Sgn&p6y^7lNFscxz=3Am@=;XZleq<<==k{
zSyR%%Nm-A&q#^oykrNPkvX8|`BE*q2OL^|ck-rJ#oPN>_B_A^sE%DOb*Rc_d&5LSL
z{!A@KuvK}&!aTIl!?G&uD<&+D5mrS!7kl`Ak*6O1gj+vo{rBx~-vZ}Y?gV%D?Tz<~
zB(K6rMH+WXk><<3l>dJ&3jQ4=ohO=1{yt>_e_t!pP&9~5@UyV67R^bmZ|tftbO9%o
z+A3lfuGAhQ6dvtRhLxbKhAMEm<*cs-aExwHVK2Az;h8V^AK=XnlQj82e?e^oe|j9T
zj#z?&U`LFh=AoXU%X4$7y5msYiiel`8veU@n*SV|uanCFl}ZvG5<6N>^~2HmxO=_c
z%y;@9j!Lu8q!bOh6GlenewfT693~LuiK8Pjg#nToPB=QPd6#&yo5FZNR#+3TTNn+l
ztVH{(s@g^?d3Lo0XJA;A$@4FKM*-_#)(7}x&^K+M`y$PH0okzS|G^85|F_8f*DkW3
zuPw6uXFl#+(tOys8296rk2}BM|2y2y*R7hs$S+Pc8B0Hv9#d+L4B~T-S$ux6f_)b~
zxiYmjLzn*-v<{J#i-gELsXs+zJRwyWz(VZP1XN!&F#ovxHz*|aE>W*NNk>1W%_G`e
zp^cL^)3mutn`_v>Q?H%xw+{l0Zl-G__!f2Pd+F$B6vRSi0~O_s)xe1~@a1%!HMI^p
zYNQPz-$hz|Qthr9`|;sIGvN6py8AJ0u2IUFL)<nBjIJXA`(MRTewNBjt&MICBM{ul
zg1wMd?hJ0Ss=atgBmp{sORM1*2bjy+a2wx?l_mR-i(Z5AVzTXA)f4~Xst#6n{9n_#
z4l@k~b7x?HRTKMWbzz)e4Hqklr!_Mk7_jpR^nL@5x_Va)^oCykzeNsKbv@l2|CDZO
zdPK$c>$uE-L%<ch{C9}0hv8D1Ert2N#Dm|Zhra`v)Nfw~kyl~d737yUW4?Pq|8QWQ
zKnJf>FoahnLwHqbSCUiQ5#Jf|NA8{*a>4bxr~mHJ`9y#AuGfoQL)R;X$lafqqi^Yi
z<kAJr!sZW5^H&zPEsYEHr$2TsjS6ST9c5BE#T8efm6h!oe)ERM<|CfscXr*~<xTZ(
z+VObP-g$mG>yR(&&|-o=t9r59mvsaPOjDGf7V+2!r<(kx=Ia$J5vJ=7f>qhRy~ox4
z`u;Z)?&&<0-#5A)LjH-Rrk}Nc-0owmV1LV~|KzA}LPP~g9B4-<Z<QjF@3@GX++e5F
zrA=s8qGDZfvn>Dxo5;=Y2J&D_zI-cOJB5_W#q!0$M<*5!GJG{$j-K%~0`u4@7`p=c
zb5BhfeiI%5TYq%2u<poG{E~jDTu83<N7XGyHT$BP{ZXygYgQtnTnXQterk*r60$uF
zo+=@4j}S-1`yW;bm2isNDm1kT<?T=QpC*rZQ}7z7cOMp_vIEAPm6(K^j@KP;o)>cQ
zE$H)a=wIG2?AtKx-vEDq6OT7cz!5BY&=ZpDh1iCGrIF~<%3d#fYDpB5E(ucvH$^_L
z$<WLW%Jnr3900;i@6m4@b!U0g7AwHwmbH7nXTE76?!&zcTNhi1N0X|vVY$A=R}ZJX
zeg69X$MshOLzjfhQ^J*L|Ik(86xFg7PKcwzV+gt$Zb0ja4l~5ejJuL&r`%Zq{rXSM
z$*ysC#@scpM%Ys3!^Ep$G5mwmelu0`mk`?8#hs6g{-~oUv#5ldr)N*QEpT}III7N@
z{9fAqwE2_%{0f{c4pIQ}hMDND2X^Diohxr&yL0UU|K64RSKhmJ|C)c}E6W>?_%<E^
zpazBo!UkaC&k5#k(JlnO1BwFr?NrTquHCLYA+6;7z4KdP7h+%N7mU>bea&b3u-FS!
zRKtKhW270@UZRgQ?U3io0LSAiIV}1`yr4Zq@YU#Y9a0q;bu(`^@79i6%$3HyV_y4w
zi$8n6KjDBs^5Ei*kDQC6LeuF0m`hLh34LJI<Ao8MV6zM56TZj^f@z0ex4Ei4d!FdG
zF%+RY%~R#sEu?Jmo3}2Ti+$!|zj+7c!#K0+7TiI;k?P(tx87|NVmEnq2&UYCKJRHn
z<jl@*O}TbHj!1bkL0I1(NF6|C1!GP?zxioo)J(syu21DydeYZFDO|eZ?{^A)(?T+t
z4IIWa1i3e#)Dp5h7OqJz+`S-_G!Y!Q<Lq)rm#?EMu=$)nuG_cyoCj_g$j7HU^SfJw
z&F6e^-Tug)>y^KVik;Dr&kzfttIxCMzXLG$9rJ@i+@Zy+fU)```_d4BVcR-{6K9?r
zJ_{EW(Q)Wa=;!_Jm<JZmRbkiJKxglA=b*0>-baW1og>28Q6z8-F0HZa6s=Xxiiq`I
z?F3y+nWXJiZ6%@6%~d+kJ&I`USFhZvlAUS<5_4AKlCD==pZvzLTMp4e!`l!@p=Kc%
ziv#+S&$MB2joRx+pJISWcE9pqzqe4>gQ`2X+|loYNyfmSzhg)^eL=Xu3#m4|(W$AX
zLW^eZfTK@PgTWRJCAwC7z2=jaGc!@k#xx)Pr(rSTPiqJm8-yM^oElP{$oXvzw4GgU
z>-7N|%=P=*287o0!ubgyc~ZD~jq+2@s>E{Rw43npnWyQM9e_onm3C;EqYB#L)&QJ&
z<K-P9I{LJXj%MZ^8>d;in2kq`?l3E;BPb{UdwsEoy_??4zn?!}^`OWfd)RL|e7!nQ
z-;CVQ^i>$+m&Y#q#x4s}(}A(8cmZ9-t^vEHq)&F1`6D|X)_BJk`hGn4!QhhSzaL)e
z``O^fgF;*TUl02ao`&z2iJL&Nx#Pa=bT_}<ey80t{=GAg&0FSc=)2OPGK_GW?rrkr
zRL}SQX!zmq`=kDxYJ4Mv%$h|ob~Xj{&A&)UhTR67g3NTksrP8yHcvjxa&~wJ7c}!!
zA^X~?95$S$iFIm+*0n={Sy$bw^oD=`_=gF;{b!b%e|F~MGe7P0??2<;d&cLaV!i+$
zw>a{RUlzuB!9GErXf6y3&TGJ%(Y^m0$kGa6tfw_$=F%^IeOeP1-=q2B*BN2vGeBI2
zvoH)1{m2~E5wCxgs>fEyUe}RgT+Ybr$k4ACa<E<97uAs&zh+hnMTQ6{`v)BSesD4c
z7!!(bUQx<C2&(4fg#nc4q#0m8d!&2>w5mluhQh}n$AIJTw+vjw1EZ|o#Pe8mh(AtE
z;u0rcm7nDz<+UdWF3kBB$DhG70;I@OY|b7O-ol7<47}S=fMAZ=XAMsMgUf^qFru{%
zgA1HQFUnFOk|t7@&XcV!tpR$*E?X}_a@*5K!N{z1;$r?bx<zCRj75QkgJ~t%GD8uA
z*N#GBO=6GpW5XQT@mg6BoJbPcLN@(wf+UZiiTn>S6MLrXh47DYT^u7LXGx4E+u9fO
zOIMyZ@yGH7mX(a%Te96IUI001ziLC&{5yDwBbQPrr5N&Fq>i%3_x0o2d0dbS?it)Y
zv1<ifPc1kxSqf>s$e*Rjb0=-sbbXMnou>^g1(>-iG6d6s5MElNY2GQtOB3e5#$zk^
zvkl_W>tV2FF-6TZ-E5z2|8@*UHGSlbJ<I0xKJ$9;cDLN!J6{zr?`5V^5jV^(+nYPw
zIWR(q^X$Hx3QMZ36GGA?x@$R>#pthwYAt%JU@8gdRo(W)6Mg1OFqmaX%<tD_<Yp;%
z1n^$cN{IbbSUnZv<-5||X}!{Az>i6+V`Qp;0;J!|fZCj1!rTSBoXnM}JdX|))SSXi
zCSq43Ge%=nca7}brZvwhF-JOsot@#@g56Y1CvAZaH3O??aq5wWD0{4Y2WQbNZm?hu
zCCFEmz2X2<!nKhwfc@02Gm&y57q<r2mZF3ck)~^KZKP&oKe=vzdO`it52X^+hy&-r
zI5vmYi}%!9<R(#mMy`=HB^u=0#2}QMpW^sI`KYyT<f0vp;beVNNQD=Zuo4f9nr4P6
z(1`8Un%6`w@*sES?Gm9m^-^?QxD-4kYlkJZ4n+C5F-+Psh-am6MAU$@bE4b5f{Oz*
z9sy`?FA$$PmoE-J{J%np@Hc5g+A`inn>pHihc<7}<`y=NNlDM7h|1Rr)O)emzHASw
zqh1sYf@wQHF!DQu>*c2|LbpK6Q~qDmhLlbGZ8~z(hICE*9c-Yf>nRXZC(`}swrttr
zI86ls4}yw&McHE^5o5@8f<&W4NqGW6I>vhF<Ae6&=P)Xg!#m=<5fvOLW*Sv%^J7$U
z6DAo6Arw(bLvB&Z8PuPNL`dAgQxj)|06?S%2TRddfT0BzkTV;NAoSUg0O`!W9Wos$
zvwwpizocM=7%MP(!ZVv{^jvG<E-y_38;V7f_lOuFzGAUtF?+FFh&|$uIJz8B=ZmQG
zN5C&z+vA9~-(|50lTlZyyTqOC9uQ(S2O@Ky>Ma<6F@MGO2;`BN2N{m9T`8_)?)v@L
zi8>8iCu*=x{8S&US|z?|7bOhdD}jysp6X3ASu>qJvSZEmMPkM5P4Y*ID>i%(`kv_f
zzx)ZHL6T(LpZ`~gLSECqmiSuIYss&r{J}m3dc@6s7!02yLB{Z;qp=Eb6ukr`!mvve
zzoIWB@-YfHikZRm=qmFKjL-&z*9{QV&x-H>tA~OXaR?y~VF2ZbF&kuW$cR}-G2Z~R
z0tB3Tct1r-;9ol2mah6N1qoU)_|aFN{er`)>ccPv7hzRlF5TIk67gEZ>w4uAgC~rX
zQ|uWTGN>XYy~67$>;n-ws~1y-!Cv=zqG~Q^R_@>fL$0}^aE19}#&OJSBDS$=T4=!f
zK|l;QYDNV#uK;pqQ@D5q0zZ^2Wl6P@W0!}0#Gjx*(YVA1Nph*mAzn{rZwr2Qxa6;V
zN22_!7(15&XKPZ4$akhqv&k>>LyUG1dDASlgAA$EBd5(yQ>fP93_8(snkA@Nx-$~3
zYXg8{7LX;I6&m1~WEe-J!Z^b6Wx&^Tl+rpB+TYnAGz<AjQ({66GF3$@9m*3RIj3+B
zhqlFK0LZ&uiBk=q<<dZzs)X9`mQj8d?NVLt8^5A%RpqY0kTqcgVVD2|5H=k>ZGJsz
zCUGWdCS?Yu=3M5hMgWmF$$4;ESlMK~Y6M|1Mqv7(Zvip~O5f;Ew8c)fcP#U4vXdEf
zI7riJ2DxeWg)<n(V^p~g(ui|8?4ITZsN<b6&fs<ASecw{o=rlD=Z1P7*YofOrPT64
z(kM+X#T<hqJNibKKFk?Sc#S{&JN{t(Z;Pt`rEpsxY?J#6gE>Q&`TS3AVSLV-*6~$6
zU)4Ie0>GT(9u&%Ndaj)n{eJE2|C4bd{`VXw;=lGdkwD{wGlAcvn1gWJRpYa|9R}TB
zq8%0kP9DaUq>+hA5Y)Y<9jjy6p|s{T;|j>JmG<k>-6#cM^eete%s;nwS|5aG;yV{S
z21WeZ<NRGJ%1K7kCpw*}M6Y3JG)E-X_mU4C6|m_nMgm7f%h>P)U>S~Z5t+dNMm%!{
z=EC!iWNRK)+7lxL7z6wYm<pPAuGK5jw2ziapVLh7cGw{4=tJ5L%k3Lu4~$}_weS<C
zWq#z1Fg%jJBkDduHu3U!#b{CS#aAs;gNsfqyY&0<AQ5IeH87^s)vjtxB9WtRHPVLF
zhJ6?gm29FP>hB^brm^o(`7GdgRZlnh4^bYXON{5{u@S>S(?O2n$RK%uRFDcTQ@Z>A
z(A2gD(ZSj>J`u*N>(bwjz7zfPb$KrRN<xZz=Xdt6Wahk+b~nviHJ|Cv+&Op5Rprk9
zXwxG1ll=MKh3r2Ygg7`gAAWNZQ)Z5_DIdQ?b(BMr6;cpd0pGDtUBukqS|BsJ<=D>H
zb1t44&Ha@TGeIUaVPG@SJa~<yjY@b2{yxvcMg?@GIhJM?vpo7Fsj!=hs$6u3q*Jh)
zOxqU%w7MZ=2?gEpg(C?zn!HHJ)r9=JRqk<DrCamen!8nBFl*y)#l&l%A!n?O)*>tK
zp(4-~Ztr)*0u-hadF>+?g}4GJ7iq_NY9T!S*1}Z@n8q4sKW=?j567S39CY(xVXudC
z+E8ZjiYYs%Ws^&dVhOBR?4k+3MoriRtJF}jD9zMPpdt1fB2njaKV>MGjo=I~H<F(<
zijz%wIKdDFf5dVJ3GStjC1+eC#5CEdB-jtnMSjJbf<qR<nk9QFo$_IH!aopac@U+1
zW{9;H16y#)!6hKI%m)Z!NMepTlhp&^6tVfn%PF!a%15E5w*6Wd^Vg&6D^n)P)hA>j
z8mc3_BUU9L3EC2Jag6adgrr0sik=(VgB~G<ta6H!y<&wVaRBSD>cIhQ;IR0)s#kFU
zr_{2she3IMMJp*0TtuCj4Xut$>d`>R0RoAxEMoHbJ`nFR=wCsTwSXtYGyf;ppfBXI
zpp{lI2Nzt%1G&G7MP)*4NgbIXDxZb-o}U=KU`1d;en6r_hy4KU^}%T*--CF5MdIye
z5#sP=6+aBdGC(NVb1_n2>rN{{8*KUU%&8fFl-{tHHVV#xAP)S$qx8{0DZ(2{=?IIc
zu+``$JU=#JufBW{oCzFnr8_k2hyaXZbab3H+1TWpRt+o#z+@n;Holhb5Eem%9ej_*
zXdj&tf`PH~*=QQcqzvSGQ3T9W2X~}}9DDk~UUEK?#+^Ng>$l)5utY)sT{Ba@lDO{n
z(Yd4UK7V4i$L>qqI#c~L-Rg<^lRd5okQ>E~XjanJznym{@7|7k6YpHPd*%IO3-(3Z
zPj~%n-^cqH@|^QQPkg*zI5q$Q!g<Y6k|WfBnd9@YuwBP#o6Xc==_j=-85{3e+*iFV
z?;oAtw=noq!_Ukgo1q2wA88j3pB7Gc3u!(7sMDnPYFw3{CMLUVo}Br_CyBd12>;9!
zmXQrDGn8^rIJ#@@5O>-UZ@stDdrgRa<%#9cZ-0Z&M$WyV<;}17HoqdI9Qt*b28k!{
z_Pe3yOYj`^4lHQyU+|t?$p5HvN%NB$=(=|;o?NbK^;Na{tJ;Oi(?V)TAn{C~vuC;U
zyboT`1}`jk4nOW3{%3fILtM{n)b)N)p{oqn{v<rLYP;bl8_UD1wi-U#YQV{wuMFCS
zIN;KF^IZ)FT+9aO@y0OzkFgWKC0hOv9TR9o#9oOtxoX@$+&$96bsu!B4_Te^?PRJ^
zY6+-OuWi2g2b1iB3DX9mY8=Fk)Iothh^y32e}HoUl35emX65hV8bGtpe^tS&A<9CP
zk1Ksx`HvACIKYFH;B6FB8a;ZMJcSbWITvB9BNss5L0{#13J}wKo_JXc8m!%0`Acn9
z{wcjNP5P)|G6A4FH`w3b$8WRt6%G_y`6_zM45{bH#o<1C9~`|}q|hStDM=;5W7>;b
zl$xLlL&PnSj9BcBtcxl=)=W2kNgD<wVnm(LpGpX%ChBAi@yNR5y5|LajF0nI6rAWL
zRwG1cuMM;|kg^gQZdJzt6Lp9}&?E|s*JIomus~zrmFE8wuJF`B+1zSXk8-kMYqOW|
zAJHwPi&JA@{oJ+=!KsU%qmAkZ$A}Un$gFA|{Qru0{t<t+y%=o&%gb;<p{O%gwruqt
z{lPYWbm{$Vo_e?=%%8KkyC26`z1w`zr9vYBE8UM9dwv7`YK7L<*t66v438`ikNbwl
z1^$XKeGR(N5vWLof%8Dw_J446as1B@VkDqz3kQY99;i_9B=pIU23|i5Z>rGBX9N;A
zKhUEaPu_1|Fa`1|7Hgiyr-DXBH&g#KCe2;!K6B?4Z@Ex-(6{XsV1;6;XY?!a$*yGA
zR8WHyvu#FCe1Ze6Zg=?HpsT|Z?y-6Lyv2z2%Kc98Z7x(TCN72xHD?6N*?_V0*G7XW
z<sU6!G0C@j-UQCVTlv1>N9KoSB>Tb#wf^nLg`yL}37fFR?oXXS4h}&zg>0u((^wW$
zqn*)x5}kCb7es)S4-D^_@0;hV{CRtY+%lo8Tgd7WhQ<QP7yZ%WAi>Pcekb*A>b>+p
zOy%A5IZ9#TyzWO44<i;dKa5=9{M#$Oqw%EA=zTGjPh%7OG!ewcADcg800ZDHovZQ<
z<BY?ddT)ov_KxGO<NHqkrk(SRzD;`;5`?S+!hw@N?G+kY{(5k!Lul(3dIp5^7kqGJ
zJ3J<IUlcB05u(U*t<1LgAm_cU_qWb-{w@22{QW}Wfq?PgN@_ZYGBq>NGX~J#)&G;$
zY%16MW?fiPx_hTTXV-G#?wP6;OWe&9vnSk%0m}xD-mCLg-8cEH#U4FiN<vEB<Cwe$
zmGg#ok1b^Tw;lW>Hp$g@%km}>ACgwS=lz8F<{zfbTNaKiHZ5&>)V9>SSSvI%3!7R3
z8(IOU5TIZ`$NAbjKZ^)UDh2VTC2lUqZMe1Vp58O*?e;d#Yv127Kk>t|`E3j57wt=x
zk1h+R8VOL-D&({UtnHu1#NFEBZt^rfNO~{*e)@d<{FR5D{(RuAK&dz?Y#Q^&UlcA+
zqb8343x=AEJ)uQ2BE-~e*$rUI+$|p4gI(|KyT5PV?%%p!*n)y>6LQ*x?!G6f{jBs{
zWB2+93<Ljun@fe9JwhS@xxlD)%ZAU3{N^Tqei=~a!oD71Q?GF0VjyMQAH(Ba)=lr2
z?wanI1JRXt&2z1;dbi$dfA8}B%L|%!ub>?iRlGj#G0*6H(UlBf=NbSNrRWJ%`(TIH
z_AWR-g`KraHleXuXlh=%v@|FrwgqC_i6`<BpjOFqQ?3i1^aqXe3GcRfkIfGYQI$V8
zR(%FkXhPa=fKxD-B&NBePxKoYNnFgHFVLRRCBOJQD=fAO_=VkJF;yA{*Zv=(>+<xE
zl5^?`jDL}qQMbeR7o~b^|EI!?y1mA~G3&8i^R=T%6+T5_pKCGx{Gp`pSUqDPd;SMy
zV=Yr<;<NVr59?$Mp7cYgeJ>0ZTrne59zumCvr&g4%8SsUf|G2UmNURCI~?v2>4VIE
zP~9qII+CJR!B@}%L@m`*B<@O>HOm#VDmII<3>gY8AmsOwQdcesyd~<ba4wpQc@X=q
zRGwHwD9T#BxIB=<gU}-0sfXhpvx+<*C=XIg(&W@|iB28l>Qw*u(Gn;>S(3&4Z}ctu
zbK1nx2HxiISsdve9CbugG4}&jht7J)3XnJ;4GapN2e<~`OkYF>r-%W=x!O&E!@x{&
zYWPnm$S<)OJogz$@FS1(br0LmPaz(M^a!RF95Wsw9y1<(FvJjK{|I#Xg#99D0K0pz
zWL^yy-vLV`i+BXT1i(AMjXJ|m^dncRIs!nj*#?_lF#H6YPq1l-GRI&VLYhE`n2Il{
z3I9(@H;G%GR})6kr(AqJ4-8sZE=}#eK){!M$X6nx33!N4tGQb1>bc!N*DtIu^d}dI
zSLRE8wEN-ig*^X`O7X(t_+L#tnpkT42?3h$2uu=|hsJzEW5UHrfINL2Js2ggf@o4?
zj?D$VcFkPAi##an+!LOY?{A%7ztAlh4+ZoDU%PSP&0cpiX4ecT46g055Bq+6;e!iH
zoBRiBg#&e9)=X~}&h`ky7Xy*w6sKus(@ft?|IF5aK6xb~!M(#5vEiOh$Zif;TNIeq
z5$}$l>x)EnA4(wjqlFe5W*+0<HApe+!CONpvgd!H2qP7Gzv-}-ul^O8gdz)(JIU*M
zC>S7?gMvW=u`pDDT+m}3JBO-HmPAa8M1a7Etnp#066eFGoUWg|@EU8MWy8k+l>YsL
z14X^Vg9UcD+qM-!b<ErlfLEQllj&9GlnR9)6`%hlHnh@kl2!vP64ESPD4~oB*rHX0
zI!=|#S2^i?93+zHv(Nujg$RyA*c$C|0*a}@+6KapmkN49#pZ-=l~zV_;fj(=16brI
z`uMAOy-fdBf<U4vKnERtPPg={24*uSE{}uLb0$N>lv!FCQ^$3rVi>s4Gcn41jwpgl
z*yrt_zIF;>u#EaeTrw8Lv2nKza|Ty8reEbxV?ZhWW>X+0%d2_MaNpn^csJTpz8Vwj
zj{8m?CN1$PfI!8@-*n76ZeE?e>hAMY+!^%8<O#++)`Vf-D86_#=2Tt7@rvf!uJThy
znLmYSIZ2||gw<p@Kx1`fLv@oJ&QZrW0$A$Fj{<{2{4Nc}nip(D1SLVMg01lIa6Y&Y
zSrIl;Ile&~YEnE$n?Bmm2!>*xpkp@b5iD_4YrDV}Kf$p}T83EUY*5<xe@0i_P9@rn
zXHcT#{5WDZLIlAI>E(W71z=)E%S{v9f@izN-^c}L;`Q?1XbpyZOv|yvHwo$6{FZ|I
zHepAlP<_^4)Ono;f1)L7F6)*}NFNTQi~wOg(=)T{`U!EAP&ZPV7~u6`pTCc*uNi(P
zrb9H|0d$+28kJ{KVm)9D6N*+76s=kk=!;7KkYf7aRDd%ugqI24kEQUCuW1J~;L{Dm
z^nf}n`>DE0aLORx!zUbaP3jg-orAVa3M+RJc@MY&IPh*7q*Nm~0~FAQ>A4>lRJx+O
zCV^ef#6_l&&((C~EF4d<cwUoZ+5*Y2Vb%}|$EJ!YNtv?D7%(21p>_t4;9cq6aw@?@
zls{|0yP%lp)lM54vDMHK{DnzJvSJ5!!N6g0T&gC1(f^macL9$oyYB>5FG;16RC)^}
z0i_qB&<laYL!fT-Mm!|+0t6DGRJZg(&s!yd3enI`e`C>&2NCydix{Vc(^*8!tkpZ6
zSRMC%t+qQmB5~qdRAJ#V`6iQbX5;-byB>FE<L=2O`}?2!lqhIA_UyM?pmSg6p4UD1
z-2e0UhYhBiAp<Z2DL3qXV1ebnK-N8@BM{mFkrxi(+$d2LKq|d(;eu_n7g=Ch<+@nF
zthLB>#}P%$GfadolDQQNt0Kk_Yn3o>;VkBHU2sg<i}0?pY;OJtCXe|2|3`F3lw|(j
zw1=jL@&817bx0c5(82U*cj51o{{e|cw{TF@EreSAID9_n0n3AhFwI+a0NMyS#gtsn
z^6ivM5e33D4JA!RmF(jQ)D5LWjS!yxGwS9+waIWCL7kVar6JTBTj&XNOT(=$po(6j
zmR|bPC{NUDfRuQtju`$*Jt&P!(@TyI2j3rDNn9C!km`S_`Qb~GT9-%v3B*q5TkRe8
z^};`5+~3O!6Xc@cJ2B~hX;LcXGdF!*eycLP(yWv5T&eAR3ngcez=w<<9cJs0j?O_U
z5r&)}P%jTs@>@uP222(H?}-%i(V_9e0Bn6}-JppAd5h?96|L<rZ$R%VsE6R1Xjy}X
zDl_Y@>5gfBz;D~}(6)QAO0ezrNAL03cF&c}G|x=F(SZ|JYlY}NkF&BV7R24+JH?CH
z2&b`>`7mq$Oq)zz2{4z9+Ps{=Eb-q=dTSG0JI3cX-kM%;`nHrT*7~;W^T(I_qxWB}
z{g3H3M3}!-HtU$LynFP{QOHMgcEh;dG1K#U?OfT_8o{#XC#e~q0tmTYe{*6sb6$5h
z`cCvhTfnySgKRWieI(++--8FN)4yIhJApCAJ$P!SdYHId!eaJ*_DgW%NcD8VP5Ogd
z(bX2?N2Mv%amMdkA}HOsy*k<W1EUe?npYtXxiMN{pZoz{ihn6fC{JgtU9P;kkfIB;
zl@aPwX`QB37HFFaV@On4D0HaxFw1f+#4y4PO4o(g=5ja}9`fGskZYo%80R8L*CLmA
zIRX)hBiPqK&qa=8b7r7OYHWMesJj+0gI=)Fh|CzmMwioIYoU)C<ET)~pUT{E(Oe8L
zD`OG6lh{9rMh4r9MT}Fi<IF0nH*NNi*pdC@{Con;l8EhD_XDG-M3^2y?C{IxX){RA
ze}&N_9LZ33D2ybRM5BUl(S~Q_Oy*ML`a{|HYQ93c>*ZYPGfLT@mcmr*O>4$x<8;Jy
z6qih2*)Mu3TpE|erT0Z>#}Ul1qA5ePW2q#Xh4S-9^y(QSX4Lh35XPDE@Nt{C&7Lgz
zh!%ft3;P5}&j-)O7HaOnpoz^;`3;b3(MD-U*;y*~-QZTa7Ih14VYZgshJYXkP~$W|
z=zYcSd9gt+M^8ud(VBke%B|3ajSR2p<JM^t%Fg?O)@TJ4+rA*LLSdm?JByXRU48di
zBzQ)z;cCG*V>l~U2ooTq*e4d>+%E2GQ+X_TD_1-n!^9r>^7Uy2sTfaM`}A1Pv?ge4
zuI~7PUOYYiC2XX2vUJy)XuQh&T2n(Q%UPysy`T5Q)aRo{9hOH8vFY{q_sGwkiEj2b
zdacDSkF$8BZ(!tNF+kLd85!h_tA-)^K<@zHY+!l;OLYc{<=ti5=5P+X5RtL~M(!eu
z0)L&t9VI}Ga=RzUz<r$;kDXB<KmR9+UTE#6y9=HDK(cX-^trro>rNDjq!%N&{x7^B
zLH&@M|KIRwmyqA}XS#wB&>92k1PT?h3kjO48!M01GTkmiJPSri_(9x=n{UC>4eI&f
z&%+Cu70KtO!a@Y>^QQAIvY+4-)B$Rjjg@2*af{9Zp8#+@7bQHLBB|TO(w0K-L3a&&
zm|l15Q85T2aF@Vd$~gfbL+(9?nvT_0FiaibY1s<ha6N#Ax&nGHHJ%?+m9P1pDx@W;
zfEBEV3?eMCc40ikUnn_<%J9?LBoTx#9i7q<=!aeJH9&tyv|u^PU{3tl2L&M_;6Dut
zkxrs2CuTzk8t^1hNc66Vun_U(@8&Hu&sN_yy=}Q=nXmjttdN=)NZ9sno@nOsm8=|{
zH;GyGh$utySQRrH7VrLUmlJ4BB4!RaSIm=vks{QMAgwG+MM-Jtj<tah<=6lv-ZE;V
zJY%J~NT^+s9|53uJaG7!+7CYg7W|Z)#0EUxr=q)-?XUqQ4$97TPfupnC2qa~fK~FT
zwfuX9xBgj^1_2W2C4un+0rjC@(0jUFBg~HiCoyAf`0JJ!Y@0U;CmC)7CW~iyj7`2m
zZ%)zBXrBa9G;O;CqY4S9sLZCxWu;sQ77BPHTgiUgW&RP~CniMoM$^j;a4DzL<pyHf
zx{j`UH1dR};0|oy3TdEOl#m2!p8T9d$2M<Tv2vzp%mq*>il8c8J5Wr>TR4`k@C-W*
z^UId!o<h8pVW(#Z9vuXzW@8HyVrD|VD+ayv#*dD<MzBKJE|%@s2e2xHkS$wZ*~lnl
zy?DzedKh{l9PT(c`M3zoi5HdDK>48%hrEXbz_gWF9DAzB021ZTq#7cY#$I|e7~BSF
zkb~hv(E1LHF$qf0L@jlT+GkZ<#Uv;?WENG`78DSSs;oX%+g*FCvf-%u-l_U$QG6V$
zQ9?7mlf*Fm=d=t)iY*=BS(u8T(F^<{#<U`!vCHY^ze|<qu_l_BL!c;gCSwHRaMYj3
z=|swJG`|sjt*3YRFOaMgJwJ(sM)r--tMv$H_(tQawO1>z@{i+TD<b*wSqrWrz*&S4
zl{Q!U_P$&D=1=<53x%{Ip$H=5o`BH_XP4Myc!ygPZd|;E(1~wH+=`etd?Om@2(7{f
zyWhHf#<-$eY5P;NZ&!`b0oQM+GN%F~&@fN>M=l7%1Vi8(o)QMV(A%F!<Sg(kv;osn
zt*<Bj?0FqSeHawYP)@-NWufK?p($MR-p-mESV)3v{wZM-MTAN_`Y^4HkS46{&>$D=
zUi5s>7AUBi@vz33=Su_DZ7UG;{xm)r5<w}p;)ypd&qw&Jc?*@_sl8XbxOFMZUr@1H
zaL88x)Pd8F3eE`UhJ>;4)v*cR*n}`iSP50oAERaC@Du+fh0B7AV_d>)1A<evK}mh$
z-aetM_5;IG&G*cU-sQ@7UlH=_Rw9L#4&h9XkVtC8M{(l;H${TFq&q=fJ*huMn+`+=
zL;p{T!Ld$=!Lg=vJ>*B}fgtObrm%z*7|z5d6FfsCg89Xb1>Bc?aij{ZM7%NF9N);?
zeVX)-&CxeDT-)HI1)F$Hb2$UJfG{o`Pw@T(VJs}|SuT0M++SQL6xE}MLpp}Dv9X34
zb5!3<CB?LmM|#XDDjO-f9dlZLwe}|w(Gd6vF*T1OYkw9SKf6`PC|-<Q@Cy4n16@6<
zUH!f;SlbNxyUq)pLnv)n^r^3dz81yRp=^{#8(eEa<SUe0r)PmuY7zAZCr{|R2#w*a
z;T&zc3=Y~j3=_1OG+dy~MZ+r;6m8OQg^nf+2g#BCpwUH}USl6^`i&zLr>@sHN=Gi^
z7;VPHSaj(uOj(1ek)oBIGIdh8GHaI!N`6c1jeXblUEe?V(qf`7z4SfjQucfO1T%r?
ziMjLr^QVQl9RXvBbmp*ZIdxX(KIc2>@E_?B4m$-WCd(_r1kIO&`qR{<Ga|adX*nJr
z>sh>moc2vU2J)9roH+sY`@)8WC}C&6kUZcw53ZWWeC9E~nGYD<sy?M|A@#?`lBXr5
zirN;y7hj4;e}?!;C)1iDhY4wCNPk*LEDeeiR2p&du%ra%O^#IkkO+2xgD1(RD18Oi
zIi#<U7D6cresLp<T>`w}%O>Lfp(G}e(7K;HQKN)~6ae%tbH4&-5Ux_qP}f3ur0RJ%
zMJF?;c;Bi8a}*hcm7?&ap>mm3_b23!(sEkQz0bl$55}vt$$Qg^4eE36j(Nrtf!bHT
zPu{{!Oq6nfqJ$!tK1S@P>3yPnPTg{GkQYe&DHl(@x*Wm9O-KBOM#}hQMoOL;a(hCy
zA!gbbQiK|-`V&9*e#C%z?)Bs^E}wDsDJ*@_+^LjXu9x;nf`s@m(!0RQ+DNHpmaQ8*
zmM4wUX%^vuxhugnkV{`vN(SW+uR%T$3Hb!6uGx<RcC+%nXrt0>=C(Y4j^h2Ytubjx
zmCHo^nVM3wAaTf6`OY<OYmO#gu4aF$W<PHYmrT=<{p1|nHhBz*rw!pq0vvF=y^$wx
z1yRyZ)_vYok;8M_LNdUyYe`FQ93w~zCrP2ebhi9o5<M8*4Yl3zZg2u^-Q9c|or>%3
z27c@bgcl^nv=yg`5Tl&ODo=G+HPv)<cLyVf9T&TMM!Bh=VRz}UH&WsUE-^Jj&{$To
zbJ)9qv=dV>PH=GDWS~r>?XDd=-21)zLtWWTm!f21Ps{=4LUS+6;Z25?5Ml1S<rZ`k
z0GchR+Yh*CcKZ;)n08CKDE1lxA@)p=<)+)V*S5R#{C=+?D%<9bC3N1BoqLLQ;9p5O
zGyV2fM9Ezd%YqvT@Hh7Ekct)$&y<&UmCNVE{0s~gV69?4-Ua0J5%ji1VXbp$<Z~#z
z8yIuMH6Pd?bveo#%^r)5Jr>*NdU);xiSj0!5=b_PXCgzBLXzzl0+*Q7qCw-1-KC}8
zO}!P`2agQyLdPUnDRTQM_TC1g*lRlj^H^I>udQo8DWw3>S^-u{gdCAB74<mI7v^k}
zTvKv)?BZ-WBX+uh1I9>2&bDnM`6YHc9gYwb^q8&CK_%w&hQ4z@Okfor6@0Ia8Y}X3
znx2Se15^$e)u9n^JXGSEnan!m8lm2B#opbNQ5>s6kHkC5jAIF13(bH9O>AUk;~2);
z5Q7wq85w0lfo=vzEW(Vuj%m*P<wetXm2)E5Fn@}Y*O1sFHGB?xCx1+r4pKsF57;w$
zN`{`H^9;aUp3x%nVkYK=HHzPchPa4(`O(wd%i~z<4c9f-Y=b{`^TXJj`7H1;X<O&V
zZx;t*TW=N5HZL?k$n)=Rd62i<yg0s;^6#cr@_f5n9u~H|K0a4`wcZ!o`uOPa)uU%0
z9zFY7H4%6Ah0KMzd-jF&#YQ0x(Vc4quK!n0ELI^d%WuhEwdDIO`3r|dq&&Z+YSnVs
zXF0s`Qs4}ceuAUV*WK?wGvK!ju3C7Xg$K>&(MewTjP5<8KTdQnZE&p_R6pq6L;4Qd
zM4u+gIJ$>2AjNg37^>Ng_^G(!)?cJcw86D0pkiTDYdA~+f!+Eew23}yAT+ilgyW7)
z5E66!v0GPTVeDJ5aC#};9}BQtU+hbuZ(}#i?RtCvt^M;}G2*R1y<#=J)|XzpJQ6t3
zA)H3Y@*dx5r~d@!Pj{`R5Bt(7c<d<bez76AQ>q!1Jeor|r>HsO7&S4YolYUe^%EkM
z+lvs#xYDaXPnT$eYeRa5>?Ogk^#Xp4ia2PXA`THrj}+M&3{Kj(3{HwJoxxGy>5L(w
z=aJ&Vu(5_n_j=PI3MO4|I%>it+Ti3d(@ENNn7S#ZbiL^uT^lx@qmxckuXxl;NByQN
zw5bZO4o4|f;q~FjNgJFz6y8Fcw(!&8D5Wa=3|;FtouQLw!y6*lQ9}f^?l2u#4@Y2l
zBco@-#pv$7xGW*J%okS%ZjhN!e=pV-SGSVni#rC3S6^JKFR~TJq+q1tTA?}>PM!6g
z==Q~Rqj)DcLzEcLQu7J@>qe3Biz3FaKrs;Ayr^5;`mTB5(o)t^+lL+RcPwA<S2PI+
zjtj?|g~*nGvGoa}tJlmn&C3>DE+L_Gu{U6>kl2@Exdc?Y|0E6gDMJTsPJ{JA3r>lw
z*GWSUo$N6*)6lmVTWQl~JWY?I#dwB}nvI>b=`^;`fX277_|I*K|18Huu770A`0SUd
zVS8G2pZQ~3nf~$psD_>49~q(>3S&RA8fia?(g%emq-*4*^o7MD5cbLMeo5X&V-h79
zZ^~Q^1#}H*Q>N&9B+Z%uRvxMr(g=?>#lB;Zc&>FnP%X^qP_9ShQnUbDp(tEgbHSNe
zT)Yh`MaV_TC8DG?Mx$EaGcJaKRWL9Hru8JZb_5O{j9b?{9P;|Uu#sra%JdF#s>d4S
z$%Z~XVi_v5<FoGP;=yex@vERE{C&njfXe2e>Elwl4cta9tq=Ai-_n6nh31H%9vN=x
zpzTbNTf|pryx%f#=O*<Uw>gx?QH3+`M9QUvd<Ky+#V9|8J`v(f;(11*)tV7Ek-*QS
zE6;m2q!ESlbV3?5e3N99Y=n;4%-JTHhSVJ$dbCJ8JCdsE*amHK%hfHHDYp|k#=CI%
zHC~DGV$Or3%a(J=qsV1lF=Hldo{r+7d%|<b!RUs3&M;!m#r3Utt_m-#BmHF@)d2fN
zMK{gmsr9RK-IF8N&2952x<}Mao|1A@QTtl(xaW=^U>5je07BT#=J=s6SyTSnnh^6(
z(Eu{-VF8P1r)VG{3&@w-59_N!aKyBN;J2pdMVg)$ir2wwN&O2wu6zVnEYBC>NVpx^
zBYTNtE=>k&V)zusj%14Li0e5-Tr?4CE@%I!4LU4QBNjA}Ix7(tgIYqE6n5Tp<nq7~
z65$=rDWs!BDSIOj*cnbqo;F5udCdp_;c|}-O}f0M^3u{><v%AdK&FfXIR-r!v_>!o
zq?2B=B9iC-n#eW%t{q-|;RSDW?xlW@XRO;f%DFD{e@ML}aRX0s6UG7|D!6WEP`8Vs
zgO~0op=8(3X^!!;l-Y?_ENHBQh};`*+cq`;Y(9>KS^)uXXR1AK40I-lz##c;GEZ>_
zS&q}V{F*R)P?k{iX*VKRyKE&pNO6InA<oeu45btgLJV~696&g0#1ZJVxd-~Fi6okr
z^iI>QwMXl^TN~;dYiqizYg^i;5gfg-wz{pmt>IX0Q+wNVEuCnotwThSnrQ{@$}vIQ
zg@?4Q1V$+OuugNMfJh%1^@yQurfVCU+UlCx8*8Q~Mo0zPHv+y5)iX=a30}N)%)uk5
z1hB2A6>zhO5rwVEBekW6ho$Xl47Q{6|K*|k|M$qr?2>ISxG9Xf1RYsOPiq3Wl?-h`
zhAm_2#*!U2Qd`1Gk!DwURM3JM1BlCRI`oqNJ|=Uyf(IvCJNAIjC)_zUCEfij)QDUg
zn;WPNaYxohCK5|7WcPq^#e8zZeiF@cT^s|(rHixkzlFyg3>RyawOzgR`Z2bSy{qMP
zxStZmHxdx)6Fox%PM##Md;=v!)reXz#^ddy!^4yup=2{9D&(Y%4rk~EXUt!WhWT^T
zrSH-udiO=u7PR|p9TL5w3$P^f^oa`^`$k7O(R*?U$8K6xWX_OnMfQ+6R)}5X_u=LV
z{J9B{Zk={(4fNV$v*kw0wUpTyAbmeH=gwzet@;`8m3IrtyWgAm?xlAxEtf2x_-LPh
z&oN<l<I0ebct&vc2O<VmBSw7@qyC6-VZ!?`!VBLqAvRNl8J<rU3hJTV+WNq}e2LUM
z(We8EXC9kl0COG_J2UmQPH4t9WV~(p9m~zEg?xl0Ph6_~IB$8Qu;&QS&SxT?q-M;Q
z-rfJL{kK{cD}S82d#3(zQrcYYd?^@E4nB@KE3rc2gwS!0Qf^2X9w9%#F<uyT18*27
zXKMa(;>w#<b0(;sy5AdI&i?n?KHB!fT|b=o(WM8MgwAvRBMyI6kC4iAPD$fXG}P&t
zHmyN_j2N+YC??p+GsL7NG2Rm?_?aY54>v);d+6ulXZHe~J<<L!v3j9x@vKl-JyY`&
zYa%p)`+sNuJrkgYZydgMc$WWK<1Z{>8}<N$+-#ZQu0;Wf9h{JE#!a~9v)o)M{3~_$
za_;0T)(M$#G(WR?vghH+9^Zi`p?^@=e_n_g`f=p&FA~FI)BbBxSaj@l_w367Yxd8`
zD`l?roy2+5eDnPHLdu<~c?!F+(@9)L21n_TX`Gl13r~!o<sxx+NYM?8*L1b|CwR{8
zS?B9sc*(w*KcDzc>wN7(yr`*L$j9xw2dNO-c}m@;i%bzT1w|0G-!L;FBpq3)UMUk|
zngR6u#F{eend@4p4On-+SB)F?4bl*nohO)6(Iao(bNAA>F3mPQGFC1{B6(U(L*H0T
z+OSVX@WTE2rj$UYVd|EyIwBW2T_~0Y!fl0tLCw-n_50xTYs?%?(}qw6Yttqb#V(ZD
z<g{YY1tRtkM9}mKv)>@GZ|i<4kVhyMB~&j|Mg@>1c;o5E8Sk6qeGub@L4|b@uT%PM
zX%}pfzH5Vo&SnCelPc$dX+IgaMR1X!>P3iMEMfFR9*sdI$ZF*Zh)sH~?DsF}53672
zNmI&zDbV^~s4(W5J8bLo!}Krf>2q>lLLsC9&spuM<(o#CU`AN_Jh>zophn9hUIui(
z>Bvy#YAWf?#Q=EL#98~4*&){f!$|f|E)8R-5a5GFa((Jn+XlG|d5f^<C2~#}y^^s8
z`^jZ9qt`O|th$BLYrWAcTpnOFjBy~P<+SMhp$Eeo4~2^+gtDs2gRyUdXza@jW$A0V
z?#C&HvV5F}zP{|oAbOLu=A|4^y_nH$6>0~w6f*R=0(U#jpof{!ZRnf|5+Ik#%w-GK
zJe3X8CK$PH1Ur^O8W*tZ5nTHH40*)x4%grv&X*bszf&lZ=#I^*NinyDv-K&iD8vjy
z6maZC+79&*0E)jU1|Zd4Pk%;V)gEL?2F5$qv`FkjJYy$KC^L%61k0NZ@k3UK9yOsy
zYsY`>`>bIe!6qAxSTV?@Mh)i<#xRGCmO=C8{r7)YUzVSOy5(~3Z<S~N{XF?iC3ZAB
ztOTam7a(@%fI^%x{Qvf%p(6~&f!i8IcM%glK>TZ%<8Ay+q~1u`){~)%h^C<7r2VP1
z@wc(m@~2TTf1VPu+T;oIikWTl5wurL7wVA&b=$pL%YpYh#5o;2Cq^f&v~5T1rjZHQ
zgievpWyA&lM@}^8jKuBa^;dbcp|X`X<0z=B3>qu(<1JKlG$k=eM0S|}k5m;oZg^qo
z>G2Ffy|!Zq%uFSl&_a<kED9RhPPM@tb?s@<0PG?aF@*#cViq#T>m3@Pz?*iP#z2e_
zzRWDF6$8Y#QF4ZE9HFF@l1@tgnv!%%82NmO_NFPhOvx*hT%qJW8a5a0jZsobiIWnJ
zl6A&q49i4ERWe$e=xY8d5_`0UxMr#p6B&xR8D-5U(@>=%35NGLoaZOTM29~@l@Ya~
z-$fB_`b=r*YLTptAgv1-)Yc&P4g9(P7c_VsO|4jrJ&umOTKiMdH9Xh&YoT_v;D8T^
z9c{}y{RMTa1;=~^$5tGV3XcE606V6iA$rY`SC71@e=Fi<#9Prfqi=UCnEY`?OG%H6
zFFj7$_|}n|N8UPiEpo;<(?hTg{j;9g-nptd&)ZYCrWO*uad~bO*hBS;`-Eu1zIYO!
zND=7X%D9<vdtf1Xu@vT9x(~8G%zr=s!{Yagf0*^7{0I3zDt=JxFF(Cn?(~%-HiySw
zJ|XOz6eceTJEr~dmuJGC#K4|uE;|sj8FYU0-II4t-fvml$msD%VMnvSuqBY&x*D^Y
ztk4hu<95<q?>931)~(OAIYZN6bC#Aq=lLD`&0P!eLjL~y&c&Q>4?s7Q2~ZRJ0npnh
z@XEC-b8e8m@3avXl2F_(Y(EjmJt>@X3LRZPP2M=Gdz_f`R@u$6xs<P0%vbsoa~Cqd
zlY1|BG5p(w!v50_x1WBJlrjffH_<R|X?!{5edxV})E41%_m7j#0gEps4Q6{W)>-ph
z*?i7|al!fCo~8QbcENfi5Pfug6~flti{pz<A*bA*SiUs=;l%qB%O}2fSvcPAf4N<$
zYNZC?9e;X6D5(UJb&9X}5Td&XV;2RlXfDSPq&6HTmZL>~l7em|!{AMBN&IZ(?5^3~
z+b8E5g!rvLj?VjKa#%vrFJi)yvp&sIaV~1#;R&tk?v*=N-s6d5`|g!@ulV!oSM!>E
zdCdYs@#Ho8^IShR_Wr}Bu-GlWn9ZNFnf@oXEl0PTez@IqwA8#tp+F*hO!Kf$1kCd<
zLxn4%LCH;tGu(zVD9#$`yWqtizJXuGH&Ek^&7y6D({-XU;j+OHn2DOyittreQk2F_
zjj*-QUAQBfw(=^E8up+D7+P^Lbe@Z4-*<~y;{*?fiD+DB_YEj9B0*y*$_vmw(sj^b
z@q`Ep7a*xb>?dm5b{!~0Yf9gU(xp~Cqx3ZS>jX;T8or^4Xej%kR~f9;n^anZLFXyT
z6hPw*fR{;9IS7@v2<1>EQ}`H#2rgOf!z4l+t0HEoCBA4pfPXEHmpmR?+6*H6c)16m
z+J$>IsIFovnBMgtuZPkDNT9Z-xe)RzC3ES|E}Li@bxb=zI}=17=#;(dYp`!_6yZ`U
z@eKjW*EKYp&!+E5H4<;E6j&I+8$AeW%|g(talXBqnX4@~;Fe@yOjbp(8;HJwh=m%o
zRaRsjinK=tBU;<5t7}_ZgOOG34M%Gl8ta4Rn%d(>n>uJWx}mY5tpQ*8({vPZvJyww
ziEKSuTYH?Hs&1)lJycs0jBTu~t!X8ro0g^%l}EkB!xIP%0IBJ=oB^)96~@^keVO)4
zBDTgbgsLsf(_<ShB7^<1H&J%|P_x*6PTC?qi@t=+as<{5u#ZRQ$H;twKZFZkTv4?H
zqT?a8q9`Xj0rLyn&sR{sw={H9$^K=)>8eo%R4(Gu0C)MacOM&Cb+}R7HU}L0;Y|Xm
z|IjGhXyBa#l8KO0Sm;gZ@!7qJPZbSyz*#iq^Jtmyp-$SPM8bxVDXTORe@qFZEwGMA
zNQSUx*2ZGgVx9bqh!<wW@jfyscma}QZ5+`KQhnW2AK!xUyoW#cf5F^XM?^f{m^QcX
zRt7$B)Ayk6t`Mv*Eyph(_-ISOdYq&#mYI>c=DDd`opX&a$f#ZnzjtJzLfCskh&~yJ
zJoO}g%e-#B;Er`M9%ur-lA2}bO3p_EKaM}njJjtxT)Twt%$9nx&5ncntKJk}_#`P+
z*wBElR7)$+34JXcD=!C<&IGy~0>=X3d0+8eq)%0)o>@RwiJK|lrr_j7*e+vJ3wv~I
z4(Zv~?6AIt^z(=Gt#q;;Cd}Bhi6+dXyZ?Jw2<T4ge*rX!X5BC1^yXtag!mIk`%j=x
zCm&1+hdKg~7<Qh+jXk<9x}!^XR{x9Cu()R3r)lbkukn#F`&XY@!#3pnGRzQP_&9az
z{p<zDx3_+$;9kMEi+rhjmkzIFt{i%h?>o@`WJ9`;0pkKhc!N1XCxXweTnTLG4meyw
zKTq-LCZ>FDF9QDw)0YMJD*{iw?t^6qYVU#F{gbrKx83t4-<X`|=G}ACfwY2u{?#uc
zQ0ssDG&(FU<6-2{cXB|hP>j>>omj3}Ze8kJY83L0tY#g3n055O36V!XcM})>QEoxC
z-uV5bjG8_AALz|Br4c`{RBov$j`+CPgoBUwm}_%Qe-f5fYcu_c&4hg?rit>iU=MRA
z?2{j3)_pbV%Y2)E9c4d#O`#Z6<YX!=?wW6=ktwn@>#)Y;Rx$3y_xT_3ebz)>-~h}^
zp?|nYf@<I_D%bqH?-_%CP`(Yy2!%lcBaIli@|ZpbCV}ryY+6_+Mh*ZF5wAzVMAOP#
zm1EQ|uNvfs_`;F<s-k};3V;vsuSIeRPXj(cWuGk9&GIE8Us8yCP>=KRni0g87<5F+
zHR8$@=?|m?k?vFKSB{MgeR*Lr&==07-A`Akf_1sX@yo#YZF;fs3o!zl<&k3}kiV`5
zsU6%F$U@e(Bvl@PK}ZnS|2Ugk>h*sDtwSp<`+?SBigGSh?G+HUG9?x9-{3KNQ?bmu
zosQmKib{68g)~eo8jd&en2U$oW}ofn2T&OQ+sGU=P7b&(FxK0f$#NASW^bR1L7CI>
zguA-m<viaqIy3|ZaGuIPccw_pX)99m+O~;j*W^Fb^)fuE$cWMjgjv#578l#t%@gh}
zT%ox3+p-F>>~{6YmStzkU#7t2YtYbO__5lS`q~<AERZr`T{>lB)pBdza(cse;qQ~J
zNHo|Q_)t?c^lQLSms}g8;M%wjwHuMmA$FIbJAo364!c7jTrg;JR(A;3#vjo4iJqkd
z+nwC$%Re*k0I1{cH_u~N40`=rvGF>{CoBz(-JnP6TZq63Z*H$`2c;5myta|iIgz!e
zjzb4rTl1UiA%BXRM}wrG9$}FV6VckA)uoTubt%c|+uj58&*r(UZ=S*KXZ&g8KzAZY
z3E$pQ8#Gr}HdfajJ&N9#NrPR}4IOsST3OxJ(A3!7Qrq0#(1HgUFAlK`r;K^Q<U~Oe
zYl$}!YW496hr8cvg^#0)uwDy$co0YZk`04NoX_FnJmk+~VfRK97CJa+Pk)|-e%WJ1
z3Z)nOqP8-J_87s!G?JBcs06SVNf&UETD9bBIJ8?d0unb}r#DQD&`g%3fOqwD2hFV6
z^vVDr1_so4#e(6YPM+_eF{DqBDkG6#k(gmByOTeUOn*!nucGu{ts`(kY95VmWL&NK
zi6!Q`TSzPjSPRMiZX4;wW~>3@h9@xzvpfHF2TV8NN(TJ=`S1n(!XaTdoW>mZM02{s
zWPX>#>^$R-lBr~T3z_F3{RC;7VaD`0EAMXpo%{u-KWpb=&r;UnDPLB_62GhyGOK)%
zn`aC&9dqGuZkpZp`pdU#gv^pa#?E(ZpClyv*~CZcPw0eJGCs-ArVUbmymKb}Czkj(
zcL^J}FYH{%S?F0zS&S4?_XQFOEb~cp?5q*Gy?O+9N)yWJ1Z(}u#G~l;C)W7cQbhHg
zoaYzzE}mTKUG5hWn*7$|tJV`f>j}U0l+ejNv~q#oLE*eR(ChI{URqz)idnFd(Be__
zIl`8Tx)wFN^J}pnk782+XR5$ol2PH)8aC24;pv2ZGH3j9y#4d&2Tp^i)=SZ&42*{r
z!~aEc1{MCPmn6`Lu&J7;_3F8BmFL4zgsLsVQKX6si6gTbv=2v7s@5w+tritzUaB?P
zlY*YJAMTD(W%W3URb|#VvT952i-D0NLBg;fM~IVnN$JP5Ay}zN8^S<ZpgDs+Cl1`T
z4Q@&bq=A^5QWc5>(R4E9^Gw5)pygn%7eb#P1^z>6*)X=sl5?wDcj~$_lH_})B_}Yr
zfZ;WyA0!PY(Y9zt_k088(JHd;=e~jS^wC-O3)vGz*W&hgw#hdPZkPAe?VzH$QqRd!
z2~d^A@>u|wC~Z|WR%9?aNMFNsKg_a?G|S|BKux8oy$z)ulIt8KzHZ%5zQ(09eTlYJ
z8FCGvb@$1)4VKG$>Q<p=!Z6Mj8fVh&(H2l8079Yk{+4e`GN#KBfKLQuj;3^aFWFBn
zNxpVj4@t)Eb-EUjcCyKH5v@}+A@cng6LLk8%@MPnIg;5ll1x&^G&pcjjMTuxL66Dh
zQVsx{i4Ka9B+Em|Tj?xvn>D$~5Oi&BGv${10(w{B1vD;8kqSVX84gQ%5)JsjV?yvO
z-r!>t!8`EYi2-l^3+-7kV0;cGWt99Wog>8!-%N)bCBKD3Ks>N=*oiot@a90ebDrrn
zY}*Eg9eu9C(Gloh$Wf+%1Pdf}u=5U7>5V97&MUScV(P%U55R)_u-6W4fQ>XGOkYE$
zb1+1NYYaKbjE=xNA2w(X#MXsHVN4xmqp-dTkcen?m?WF`;g$<8+s;fCH+I?huTt|8
znDhm*4i!$Mu1$_{%V1Ui9d&g#bubqR`N4Ce{B}D2AqwD2>15>aKpza_T%30wg_M+F
zXNwfn4@o`(Q!7`mhqX>)DG47W1aqL660C3MAUiooC0A3zL}oSEleI#OG>M}&u?W0V
zv_}~24BnMF+B1I@W|YK&>M~Ud6NNB(0Tjl-5XMX-Z<y?5ggQe#3PyH!a|2EfT*+wl
z4uW0+Q4$Ova3k==6oYRR!(uS46eEL}v_=gBOvDc(mmup|7s}E>m%c&?>(l>;J_YsA
z^bqbnKZL|h(nyuu5fwrVi(VRCo{X&i9DnXOB+n&xVmI6_5MuI{N|xH*-?Pm9@yiQ2
z?}gvnOfrd+Jppc9H~}EIS3ta1!gmBT%>)9DKaNeg9VNtM&-dQ%7jpM3<$b(Q*atDj
zslaJYXmUL+-m#c;@4`~fA6%Iky4~oD$zQHnDGR{l>hS5uu^EBQMM6yRV%`V)gp%47
zYoNm^)N_zp#PsT})&j~iJ{2ZA?W=Lw@U=)x6}3q~3l|c%`7GNO<G-8yZt~*fdz(Hs
zt{9gmg=6DFEgv}O7A7tu69}}voBMs1&9Lg3`qtEYIZHW9DN7fY`IWqnE<ujtt3M^w
zbqIS-2X>wjx?FTe+3OYaNq0AVYr|sBcMIPwT-{mi+gZJQG_bSzNn*-d`)=-AP0aQs
zW(N{;-*F51CjxmVpIDP-FVDB#?YPsiFuu6)-n2jWfRF>w@@65q#cyq0wRZTd9e(SX
zRjb2ib@;7Lp>Ob^buchAiUA}X0u1LcT#cT@B(KIm^|1w}Qj>Q&7J-w$lHsdt2Ohi7
zf5CT-Fb5g{6o3uceqnP?^wSv<eT}Z@Yseivw$?DC|4C%j%+Bl3hNaHw=C<B4`(v_R
z*TXz3KIhXUmHav!Fm54Awq)kSwS6=BLUQBExX=vo*2;OIqepP|tvZK%&LLq0hHF#4
z5w9>z(z#YqUe*qX1I*%9J+nEx0*C`pv~+|ljru0q9Mm(fqbk^~fzCZB3g0LTa!NOh
z;6CK^>Mzk|8lF)o(~F+qhF*OwQOR_KYZId5QJ=n_at`Q6smwn8n0R{)<&<t1(bdxJ
zoUV@UbL#48V?Ja62WDz8e1;0Ba@x`jOwY7pjc(AVtZa>Lh)7w(1;*js!b=nO38~TF
zLYe)#%Q_EEh`&$(KcQ@pRO(Xx#_$_8FhSs&*Z-crg8)k*nSx@PxxNsSv+k!Nt`n@N
zDjNxDzZEav`~|&9l=G=uwQXv!Xt`hVmgI4vthrRV9NO3i3RIEIsO3YNBvI$|?UqXf
zb$A8z1)X9)Q0N*tjht((mPJDohr@vY&yaqgLlnAKrA}24JCgCqx;o^|7Vm;Xph{tf
zbC%}=ivd6&)X3SDvJ@&bR4?R~%Ds}epq64($OQQ;Xp~sH)qAYPRY+m1#R%49UtS2L
zBH*eI4UJx)h;Zx+T2{JirwGOhTZ<{1g1QPG-+4X{07pG6W_A&uNgtTgXm2pm-9wm1
z9yg<Nyy<oL?p{Et@&}uh%QA@IT%XGrPJ}`P7uh{Kc1Vaz%+KLGV4YGxq_8pym3F#;
zTIS6a(T(JM#i6qWjXO}LH;Ryv$hEt*g2}MFJ8V4=W2~#|8D%i9fku0Z27CD}>TxIa
zn1$CvR2UJE)rnK0p$D@7VPEk#>D<pKVN#C2p*?yfML*itX^*6?8Z@DObhrzN-6($J
ztBCxVptEiyGDx-zcS>3rx%d1ftU-T;KliVY6Y-*A;%Dlv);`&~?QY+lzPrPBhTm%l
zY<=l^%Z=05PTw{MVzQR29>&zczQYntaW!W99$7X&iBEoO<IRn?OW)Dojkps*K&1CO
zmUMnwxj%isKmNc>)njY?jmc}1vxASUne%0L_ubjI(6ShH@9a{Iudwn_b`=yNvGqE9
zlueOBRPH;y3+=x*Jl`!umIaKvMUTX|odM%6cr9M95#sIs=<Py5tI&QXVC)3g{Ppaa
z-npoE%I@yJvwy)&@ism%d{F&y%8Ka+oBVs5{Kd!p+08;$3l{5E9aH6`GN>LP<I~Dr
zr+->f5RTEnsDypOBhhLav{4%I22&pPQ+4#}I>f;xQ1iAc8U%HHMrjIwyyl$)lx-se
zqvJ240<WcK^kSiBVuaB50JFu9j(SArcFgx;%{6|Ca_5AashV7DdSa%8np1BO)rY?@
z?OegV-Bde&8O8q{{@ld1g4$!)H|m3#-Q<tnB4k!9O$Lm0(qj=)4)~)gV7Bx05Ywj#
zg~8AQ6>5hVY&cG@|H;FHk0jm2elmNfTm#txApl$Af$^A%l8ka*b-PBHqg6kI4Tkt!
zuF0)o-cUC)+`yLMcXN@Fxd#iLEwPBqScCTIqlHgw8Hr0YiXrmaWQG{D{KAY>3Yo1{
zil`r37;eNN4+~Db#<W89)>E)v@k!f*Pnz-xlt&5%r^=^_nN|=P!hSHV$ONjc@@Y|3
zJE}n|gjWeqnKGDOF<l>qp#ip<sDMcl6H7d($V?t54io&I$Hq+Y2%}r{FOe7f{a`(N
zC*Zt-7?+~3_-S@+8=SHvWIVe!R%AU18G;4hV@z5lRal29BC>15sd?iRy9TM;^_C3<
z&sWeh$+fJUzsw9Kf)Qd-9DkhZdKJ~c2#-|kJYxtMlbS<^j5B3R`5)7vs$93xAuZdY
ze@ys#{_H=|D*pSFypK!_5?f@(L`IA`yojtSe-&-`ulRHS9dbUG4~s~d>zPlzb>0_Y
z2P3lmf8PFq6U$<?uAP{Lmrv*^Ueeyz_rBRGY_tcGw?E#nan61#8X=yB?lt+W2ZY#)
zW!-YYM^;~K6H}X?@wIgNVmq(aGpj%52(wuPwVoTnT@I+}2Nuo<(G*ANNlcs&|1um{
zbSpUzB9^xV;5*R@g|y>QYY*(c0APj>fE>W+&?DofUwvv|>gCdRa^7(-l>FZ00=M9v
zpI*%>^<|Yptz7y!Q`CGvCZlS<{`>pQ)w!l07*nflrXSc$*!ONg@C3I6{tgI50zE{i
zjq|`=#8@dmWg#Lxnsy=bNUw@YDTboJW$9TcPYU@OWT?v063Q((lyfWquVH!hO-Pid
z^{-~DF1ew+2vn%+P_&`k3MPF<5E3etK(lY_;Ugg}kXV+U-$J4}*8Q*;h2K|bU)cPc
zG_6#m&FW3+LgIv93H?(Sqt>UalcxaX#%z-#8@(CiU+M<Ts$*<Gd7@B94i`_B6!UMR
z3Vt35gk9gF{okW~Logivkp1u-dxy@!5gpdLc<wA}Fy2+7xPsBGRV?~OTho!+Mt+9!
zFe%FaM0?+%WRVglCHE=$x0Jj~35UcUE?WG4h06UyI{Q16{1GMJMe@{38xDdOec)fi
z4SEc{`yO)Pg^h~6KJAanSdGf`MP>S<vR9+*z9_ptDj!(!QE@klt`)6D*?dtpA^YWJ
z<I<#%S+_DNOcBDL7ubg|7g_D>^>y|Nedqn1L#v%`U#C0JNm1>NgQtF60h5g7+NGC;
z&Jmw|6gIY&%um8}mT}$H>YtgdH#T3}ylUR!GjEwUEVKybEdle6#mW!34+q{KSkZlN
zXw|#}{~wxnh?bMz-<(`kVfcQ9sX9Dj4M$7#4Z0Qf$tffhjzg5as$3xXLIB1VGnzh$
z<Sfp%fNf)21k(}s@G*=4aFq5q636D-2q|HYYGhzb1CciH>eHB&11n(Myb&dPb{6d_
zDf&4*7XC2aT(7>U1hGwim%axiMGc0JA<B-64~7FIbj0NeM#$kHbo^;rzV%}G03Qli
z1BQEn9xf$7&kA!7;WC0=N1A80BCg3{sL-xfl1p6X&Al+M&AhXB(X-@u_u|S)q5YI_
zrqkEnDYSJ_aHJznfu9n*A}V7QNh&Uhkd|JNCap&J1U#^D2yAdof#`pla8hW~F*HTH
zUWJkw5WOmgCwboLCDW;)Rxy?P$M_o?`A8a4GbQYM7e#yTBGFQg5t!)ip@}~J4Gdf~
z4IHthSHs@q-<rHRIX8@Wf0>JQ@7ljx{BE&-XSF}IW;OM&FZJ-sE`Ms15Z5GjTUmf{
zuNi-Adaan&c3Ylk*fLyjxw~?gm{5c6T=$cgMH#1%VG=@(ppD%!tx?~}ixtERNvg4I
zsO20;gc>zj7icO{l7(F46^in=4cC*6Vb?2-SVkG*Ayi<`GXX-Y!*3Xz2G;6Q$$1T7
z>0sUyE*kx+EXgx^k)i2D+`7TRA(<s<`n+q}0E|W`Vw}J|xg73ILazu%M4=ef5>$Z)
zurT6b*rR)XE}-8<xDSM+I896?wOOTPp$1h1HR=ZiOGXr)J2Q&LezaE2GHnWl7$QG?
z)E&BY3M#zR2Ytvs#45Z;q(+EieGL-FP`HG0t*Vg}Os}L_jyV$PZk{&sO&TGRO&(Ph
zmys{>C}#(=<m>7-lmp*0W}kx8BKKkh97f1_s^lccKKCIN^#iJ0h0EX)rz0@>NvbLm
zEV3e)3Z)+96h$hG$rM#7m%_?P#i9@6ujxo|JJS1$@>G?n#*qA}d(+i6zy(khuVvuL
zz!^<`4p7%^qUoeO14OjoHq#kITUg(oEozzc_Br(fK;!DNAun(jL(UGx{EN#ZRVZ`G
z3+J+^e7vVj@%VN9^(?&e(TGH{iHjTBFdTn51`d!pYy@(rV?wHbBe|_`?ULpVMtmE?
zIkA5;;&Loza~X<X_d^7X$m!VWkfK9wyZrQ@aXnwY&K2BN)+;=TJ#r=Tn+F7XsZDt2
z5$TR0G6KEzGH@8BeXJacvJ-puLT_L7(C7qsL4K4WcY_DC<uh5K!|lERxPKgpA8r=X
zslY~oe`MqYNEId4&Nk`b2gq{A%|wtuK_J&MXgA3c+y?0OB8_=E@rd3mMpM2FqH^0A
zN1?at(#{>1?VSpB*$MKJxvqhbw6?Y%udJ$Ut?jO<g7H&bFiAN9<FCU6^Fe2$m9seV
znw3(6W+!!#f=zm>oTC%4<|8(EY`}RQyst}@lxoLdT{qS4ZS!UTRM746*pyP4Wgx-+
z6>(w|2T{5jFJ|B%W0l5I({S|Ucx7wr$)=XI)@k^-iuQM}U`Gi+fGGvR3x-YnP3ttg
zk@U#vvk3bT9sBrfq;NfKZ?pOt3I*Xy)Sx_RB)dKcE~X4DWP#CZk=ZwT8vh10d9%iV
z1_?kG_qLbI$A|3V^E+GKm2WTKcINCsY!5a<y0sGx6`AY*mG%;dM)?GLYbd+F#|dvb
zC>1tPA#4FR5aDtHx&D@gf`Sh0jQ&B<a&v%4?f$^v@T1NV&}<$N1g}<KM~W*6-S3EK
z_T2%E8crU;=6cVK{%ie0>VYN4YV5%WMW4CptNWGY3f-KsLibJleJi~}*BCSb%LNMR
zI%-`8H1f){(mXRJ8TZ~GnMol5{ZPOINJcO&E>EHSxJi;i6U6~lJz}O|s(JeP(TTo(
z_WrDWKj2$1Hs-dG`~`0d3qMHa03Kw80$nb#z&0_0cMLC?^1|8R(8&+ry&Le@f4+g*
zY?kJ+yV#phEThpB%S8lD$1B^a4+SIT6W+aS_z|PQ<ACharBsH#QR|=GW^ZaSvr6dG
z)WT@|HGB!4p*W)tV@H|MkjRidY3NvO%7Uj;mTjFhJ2zo=>e=ix1Y_hTce8*b5yx8^
zj#ajFH1dB$)9pH@>zA8uTWGpvqLpmA32}#S)y<C2JMOyfxE7lHTMsOo{aYK}jK5X)
z8UGWif!;j66noxe;*2Tag8OCOHHi?o6%6c$yl4@*z}4q)PDx@b<fF)#-X!@w!U8Do
z7V!sABs18B3#`%Y0P<@!>hQ*vlX6GN7c@Fx>Jf~VtSGv9@Ks>7W>Fh|ld6nXRvsWo
z1!Kh{x`(O`O6!t*H%{3z_>ZVB|3JyQSND&oNe}44Un2>cDayn!^EY~vPBNF+9NPOE
zx@;JOo5??7NP-dl4ziNqdB)4XNzICw7#W`!^|*po0NuK~VYkxVH#FMg7z##+kvZML
z7$zSA%Ipy9J@M&GWEYIasiA?MBJthaPZhpO$s`iHRb(CAbmBi#@^ec53<;U1^t$=K
zrDHKDFm>mv)EXn8V~3doZqP_iE~uXv3mT|q66lJeJ|z`pexxsBgUK(Vgjkv`P1v~_
z_Os{>0GB*)Ys*5W0N2{>6>#y)c>jt&y6I}|V_Pn%WZsGW6r5PC{!Z*%$$Q(Enm;x?
z+FA3%o*$ima9%hqdSq6U6J`_qTUO#{DsR+ZtDmj>+F`73bZX}CeC*X4;!JDxkByOY
zWrP)ay8>mx&)`<Y&C=PDS;s=9P%`weU??zt39cl#b`U-@SY>$>fTIQx=)VCgBMPDo
z3O^xg_Bp+aayICD^{+S2Rba_PxyWVe(_gK59A&wYdo6d?0vXA}s9p2=yWw}j=P&tf
zy8z^3iG5;;o$<V}Z%+66OSg9kna%(Q1JY4HHzqj8Q3J1Iwhc`(!0JgVw@Hky&<LDW
zWa-eu#|DGmP0h?W2h)=TTC3j}1ahZ{5hTQA`^`BI%?%5t@0jnIg`J1|+ZwJ`!3Y(F
z;j^%k`=f#f1wSmpM+QeIs|#ifI579<5!2KXb2IaUzK?rX`T{SVxV`o5f?EZvX+^%Y
zqJ{DAT)1~(as1ofKw7!b*|pl~^mW1k+2!x-oo&H=e`%%2$y=+IcP;0l)I&Ok#+iGH
zEHW}X3;=drjmh%GWX<pN$805Zo!HrpbGznpg)Jq5b?0LJ(%?##P;o2}*%&z9h5}CL
zj#D3-b<MB~Nt_*+N5p3#XTOkiz#mg_wGOzpK3aGDafesxgx0nP4SvfBJOEg*n6JGI
zAldwq#fBy4QoB%fQrLMakl*3AT=3<0%sYgxv#VV_K1e#81OBc-VPw+ZHHnag9Hvq8
z?9|OpUv#FB-$9`ZFZ`u()8lB{yolbz-@SO};-Y>jVg8~&?|`tiVySt_v(&rXC`7eh
zt$qw=@P=0#=BgKaR<Z?$Yt=E}b0B2MnBPIqmN1L3YBY$kBWQz@Er^wYp>Mzwz{9cj
zP=^un^ocQcW_&i~+SFWD01dFjT|N5QC;2p?Kl?;a)9tfgZVrnEyGJa>A0!`14F4#s
z2<i7t(ML8$em^0O((DvU%Z*4M7&ac+Vtla4g0ybUC&z{Y@Lq;}@+O30S`p2!quYWG
zhsifM1LKKPRKiNu?tl}Z7zivEguEK_SJn9j<Q7&(`l;N%dX8vy=9Da%O|nRf7BN30
z0uazC29=NwpuR{5ftkh&`%&1J>INREF{EZoaZm#P5F?lS1!g1(O1>m{Pu+$x^FTBN
zsgLWoj8jwO2Wly*0~8=_NLj;v(-EEwd0!?{5iC1mFjNVO?hP>#BT$NB2!b(7U>u*0
zOO&=rw3T^U29*=4#5lS2n3Cb(s3NchxC57r(lh0D5vr=(HjHVud|ovo;Wo(S5caBE
zE6PdNJk1RDG&iYyJ)Y-g&GjwJOdE#X%JT<Mi}K{NG*3QT^W<}|FX=S7T<kNGS(Kdj
ze5rtH7>vBzo}ZVqhcdASVHavd6;4+iNx)XEn<sc{(jYI;j&A-mp{f=@7C~_a>8-}^
za+F36Q5>oT+zv<@q6SOE{MuBOJ*ZNM^{v2j)V84HnNMXWdup0kf{<FMvW`-;!1Co<
zfVhwPkP-(2K^{#<b7gD>M{~QS?H*~nSK98QEmwY91ODRy^C<r0*`peFp{I%R)xq8J
zp1SprNeugO`|lsn%=72335w)Kz8kBZQj**XJk<)g9e^IA-{lz9?O`y~IzuGiy5F=S
zBjh)~=xV0kBR};K9iZA`r(;9T*q2mjHOQQ-nh4<5X=}(kUY5%RL=_}7Oy*>T@jBp&
z5M2k@&Ug>mip?G5DsLP5nDS*hmV4;{dZz*oOvi9l^4LJN7pLhTWnA}zY$=YbzF#B1
zA6Tv81|dsd{{ud*^u~n%`Kpw2%TI`_m0N&$qJD+y<m-5X^=w@_q?Pw7kwB~$o>D4a
z-z6y(8zlP#W?vsf#r(g*MDUswd4qRjE1+HrDfR>`6%=DOX2|{r$nT9qusNUvfMG=l
z^05J1Ia4)x!wX1wRql-{ki}NzjNBK)Q_Nuf;1Os!EEo%yLAVJr?c<T!4*pZ(3tqzD
z@GnzBA}Y~yk}!frJD_;E!a`<JN7g{=Ez+LK!EA!~Q`EO`TkFyG`U-4Ynwr`w7_fua
zYHMw4uW4xNu4zJyy2c7`f~~cot+u<p<!FVhboEA&NPvYpsen;DNg-ewSK*C;iCoiB
zggX%rBO$1$YOKWtv#q|et@dPPM+JWk9Y)B@)?;mml>&KFg*Vz(d#bIru@#Pll674$
z3gO!k;SYYLZm*F{@4WdT?d_iG9kXTPe?lX4m!2UJZfgiJa7ZHW--#WC_XoT9#k{{e
zMv`HfNk#=(mWec$Or{0D5=k1c7197BlLnYRH&#?syu><8I2J99gkE8)ZE0z0Y2;Vw
zao$5apB4z@l0BZ>Gr%OkSTckpYA^A6Bybf)1BuhVEyZ)0izVMZ@a}=-@W8J6m3_jg
zjt4IZUA+jW=R<_G(MiF3>EY<5H!G3#GZs+eD_I4)-;XHJd5ypuwt1t9<!X!JpeccR
z;2{*@5v&<SMJ7lXSIQ`2k)@!d(wHD@R!CWjLT>W9>uJa%eLzu=@`ELSvJ6Y(TCB<d
zc^}3usLN);SPEaNqp@TNT))nMmeYXJd=UpUrrVddcRq8edb#9}53Mx+sPjRmaJuW!
zv9mLd8-3UMW}R~-H%5`=GiKHO6?2*HdVHDgcT>xB!Fa-cKGf9O)?L{M=UBYV!Hvo(
z3JBCtUEAG)7lmC)R4yGp*@k#Q)h)Gc!8GOMag;;e#ENh>n5<l@scaLa(0Dl!OXUq(
zOGqyb=|xXBEmT1Zb`&v7EDkg>mS7By2QPSV&Iz-jAYC5oQ$@p894qoHNFhW7I1%7Y
z4WML0eRhKg8<s{7Vl%bkJjRhdAD-0XpU2AcN?fSCwpN<ewu!MKTO(feaxE-5foR*j
zY3Cs3KgXiGus!$~or6S@<J>my5qkm2E8+Yut+$0^5CPeW)ngVnRC5d$A|9fDZ5HQ*
zhhUfOnHn1{ECXTcD2nE`PCCa?;-cgXC9RZvosu^xVe+Xn)c23*kiJVA+uVLyjLPX8
z5ez(09iqMNL%Q%P9g@gMgp0dGrS#C@C?#W*yoSUczup)OI-xM0+4Ua5UeJU`NP&>u
z!=5ow;*?MKE+Ju2bVh>u^OKkt9G<VIKd5(e{6Wevfy5n;L=h~>JEDLo;pxSQ{~@06
zc6wWMSO=bOToyT#^y-D#?GGa|ZaYP1lldbH(};4yy<fkyPspkbY_5BfuyHQ)>)UVl
z&yRoO{7f!n3o$8j<PyP>1rY<q7R{cQLzDC@CM|{wyX%%GR@y(BULFzJP77xcSI6Z$
z(<_|r6Z#M~lss6bAcP0E?-q?JcpWqJm5eGV!X&aBg)t1Wtc@vYKFP!br}Ttb+;FYo
zP44#2xA)xIvzlJ$LtN9MHh+4%Kjnl!`XoeYmN*ImDJ19mEnBbFe0+Gt6KL-U)SO=M
zklFE4M4<Q}ylNJV2%Y+Dd7QS8hnCWX93+ck#}RKxHK-NhbNtb{LSDnl?tro7adiA_
z=4{<f`)vAL-F)f%)`jr<?gbZu^)xR|zT2^QWa-L^XQfwYBh`d3FzV|Y6MDymaq_IW
zEC)|LME$=kMopcD<q)nN7Qt%TL_yeT2*Qx14M9h7tyK&<dQLw~M<aSSZ9K5CMV1l$
zWjY$xze1Z=^voxw-f)zBVvZTw$!(_IaDtBN3`}Nq(!gR{It;yZvd=I^SsaFOIyz_I
zX~V;`;8PT4sHU(!uNWFAkPK~b?Xa<tBL2K$XriObhU2t3ZtOJThAv|d-Oy$1ryFR4
zYXin1Iyqn*r<1h7N#5wDlf3Z)oumy;UPR0w6wMoJO^`eC#v_FJ++aFFCkKp2Y13sq
zMkhOsEHJ302?)|pqGDioZk%hKs}(Yj3Mt2cULA<)#08^yCg+Czn%$Q;J?DP=m0Pa_
zwiNplVc<0#FkU8M<>Xw_ZRcG3e5NwX2bYqT!k0#c)JDIh3GaY8#uw8K?=s-p1@iX#
zW4it3ZXk$D!myl$+9ghCZ5K`q_*w_it}CJjs!HEQkLC&xgC5(mgzUXO+rE_+;rNj6
z*f4S_Zv)F!O^@23vy#kHXF8|<*&6Yf48j;OpYzC=_arusK7%)gt_|JZBjar^CJQ-x
z{IPoxVJkO}5E1X5y>oW4K9GChdeV)J*EYUcIv4TvihwzDISWm<Wig@c)M8e^R_0G?
z^4ZGfN|xe3OnyIkY4UrUR&xCN8h^W4u$B3ent)O+48k{T!Z$dHc1vNU+H}k{uobR>
z=w$LS{ne_gQ?DMwSk3g!x&!9)x$$>$?%MCz7pfL@OPP<dplJKB@BO}I?t|e~bGib>
zEhOaxjJa%?*)9Wq3uR64MO>lUPUsvoqanD3JQ`xd&wd#ZmV8|IAI#~3IbF0k{bAn5
z#(l;=*BL3z+TQq*;V)h?HASqohl|59i={K{69U>?D+FX-1au8QhfX8N3u&+}vrN#y
zDn0~YftZ=Qa!s!l=dEF|pK}kVF-BK~fMBakDh@#?;asTjkeWLb=3ML{rJ-1Ax$PlE
zcnX3xL^2RcszyI+aS~PJ0<=1c*|sWof@xHRAqc#xVI~#foJP>1F!LORQ<a|1x-#Na
z0o!1X+B<m<&Ic@Ls@yZQ3CM{^6Q6${mo%6sm!WRCWC(C{p-{9{v;bL<^=x4hYES)U
z1h?V-M!8S0^(AV7{kXJ{HK(IyV<@rKx25}@u8+&mV#Q<Jh`44yd9DH{+Hilf+zRr4
zw{K|-#xgChLWkCg1ll)1EqS997Q2w44SQ2+CWa9orcX3|P;Ew-=5dxtB&NV*VRZ_m
zsP)fu6_a^q6zTTHtsyRnwcfJM(Pn)H(c31T*wyNzP3<*g8$w(&KaZ*7HQ4}|Q{hbl
zvs-<%y{5Jsq&qkOBH=}svNa4AO}1V5W1vS0g9VF6k-;MKScx&RfHBfBhEwlNE-Z9i
z1RxXVDum{I$i+O~DjN9%G!XA#0H0<ybJoyzL`R3<H35dL;We=ozM^9R_*~*QzFQ;;
zu82{}$-V*W<Q3g%T9hfvXZ+VtcQ8R}TQ_SPV=cVfpU>8__Q1`K!tU^IqmXBC^$I`Q
zgMm?o3vbX1aP@J-)dO?QkQN4B-b@M;#@m}DJ{DnVrJ=TCs6|bGIRA%uLW~h@<a=rN
zyGVjY;_{!z+P~0fAE(hih>l2{{l%v^`(4b_0tUq=g_ctfDg@{U`}%#I{lXA0OkQ|6
zbV1AF=N9W0B8qhbhd%x1fBrmX&7_4+pEyMh6W+c-jLdSEI-`26kXBjbh%TW)&&I1x
zr>pc7)^k7W7$3$jB~w1e{k(=f*a@t|Az)040jt1z{K)vHCM*AAG_alq?DsIo!HX1?
zEpozvqbn|dQQKS-l(92yH#)9$ykWgsxdv|Oi7|Snc~<{g)9vjdU*b<Io&`z0;dbhL
z{5R6(qUR6a=f895-lgwcxp(CQ{=-Y}U;6M0^ykG*tHq~$#ixXh0e|tJP;_318X^J@
z9Exo|VgAUSErP9NG3mX5#WV1W$zDztBI^UjLy~LUO9A7{Peh-^Y=3l)u(f_AC15<x
z2uERq{eJFu^6%vXlxeeX_aXoG2El%KB^MzeS0;qE{=mS<>VU^L0C2{Os}q-f6PNLN
z(Tj-p(FG+rh*+0?P<-bGiC#G`M$B~S50a<5^sd$z7+Fq7AY$ouY$nCcpss-m8xTRH
z4jVjllsZA_6+=Cd)s{oXHPq}y4K;hwA9YcfdPSHb(*a8*<Dq~QDTh0mZCYpz8H`@R
zV4BAhTuT)VVtTCq$zReha{GgGT{dwAp+h&qkQuen4^pUPm5PEykG{@Et*Z2TE*$5u
z^ol<yLxIsmN)6<DHbOHA0oYF!ldCZ^IHEl;ap{NeqE+03nuH=?sHI!6FXKPQ$&>_Y
zO~5`=9AZBS3gkHXeszn0f64IfNkNX(Z(7!U>l5XC5d5dD`$p5d$$qj(oztK!;`^K-
zipgP67f_Z4_ObmChge<!Ea<Yq&<2)bHgAC#b52=vm@Jc-V=AYZ<Oa^iZjU$e=%|Ab
z)@-b3NTq=s1N50UP_Q>z{qS==nr|}+dY=1jmNJM^Z$<`~=>uKUe(ZP!zR5LJ)fL`U
zZQ;_l8wQ&d%zg>7?#9}a-6YPd;Hi@kUXx6&yQ%Rg#MvG6QKArPU-T)H8nW(FHZc3Q
zYgT2-1!y{T0cHzk4xWf8jXFhpuTw%3ENCV}t!{$r5k*R&*HdO|^axFV{(4Gv^FKwl
zR$5PO;(Geb1@xye`)2^^FS>C%zBY9`dp>5tvCt~)=oB`0JxV+K3n2F&_?d)WH*m9J
zws<}TV0HWM#mrw>91<caaPqU(LLk#;&3D`>oZqr&!g9Fr-QmS<p#}km5kYy-*Lhwz
zGb9X63KyoZ)Leoo5mrJ8e)j^rWpJ`iwEO4)`-^q41L1|S1kwgMTSPOXVG+=yS%fqh
z*PmglT_>fzh7poFSVj%vYL`9Zn(3X%4;WK4%h@Ai&eN_q^i(i{VW0f!H@%o;{Yw|K
zH9%@PYnC!277_^>4VD}Lo0FEcNUiov)w5}qGPAsV5=5=KlrgAxxx^TCVGFfHp+05_
zAeV%tiWWTP%`7raIFs;&Ww3=%E#sS!U}lsBj-t%6;5jKMIaTW21}vFLct-1fsBI(I
zA_8-zCx{>17gNPO0xy&6z=BN$v7fR?YJ%Zlk=!ILk|uGHWb5O%P$>TqCCq*7G4{Nh
zsz=ABXvLG|)1y6P@(wgDGHI8WAGQpV{kpgm<`Cv9gy-8v5M7fDy&V*S(Bl|@L%!@e
zZO0NhHR6P{oyon6h6mkGvoGs1@MmciOGcD?k$YLA@XJ!n;9+-dQ}W2l45&CNc<Lb_
z;c<}^6pF$S=A<P%_Z02GzmjsX^W=i(O;&QQDTNIYTd224aXiVI8HUU(4yVfl4}kN`
z@ZaV&+6pJ7kHtWFF;TH}Vm+6(uAAk>G%_?I<vc>AVhqc7?ksc+fr}((bPTDI!6ubS
znlMB@<>4kgWrIFc3Id8DAF>sW*h+T{EHB`>-o=#oTxA=jvA4&($ZD>V$!uM>Xlm4~
z>`!@wvz0v`_3~_aCr3b0d@l;`lh)A7QiJ&afalajOZ=5DT;flKUg9^GJWAV1>wAX|
z3%n4Ohjo4bJ*$wncPVOl=kmZu70bm!^Mnuy;D-w#*7(1Q&cynD=1#GYxl`EL7HB`c
z+J4U04jDcS9WVGC7ya#1LYtQ@?#vqVw7!#8^)7J%KP>|@jnHy_8u(1O)*&wEW58L$
z(p_gbV!*;*XJ{swGHsBh#n48Zc7uyfwitSe_N_DY(aBmvKW!`nwB(Z<SJ<#;$*?$q
zcrFRc4Igb<w&Ln>-4s>jg@hZ0d-aE@9NOUIl>P{9ju^UVlX{lYe#o-vJHpG~k=G6@
z9}ppFE5xYJ`GQ=BnC>@94*z%ff?)k)!A!7at3I}jG*(tnBP>~9UlJ+^;J4WdD#3=r
z@{d7=!W&5a%1no=aHq1UPV|_9kDm5xrJs%fENH80t1=iu;K-RZ_e8;Z%YtJGYXeU8
zO3dd_P*R#ZBav6SPi_-=D~1$VDgs2Fm<IN>qn3wqyHza|`4|9U0(6x=GURN)?qy%a
zXWpw=8cO#vk)v`ivo*xM1};%K$LtN+xnzu7&NJGiK#=l@ns1&WPUTY1*GTPSf#Fzr
z8&KXx)&oXOuo~kv7L>$Z;X2YZEvgCp(ZZQ^5`lY~afHy4WLAWuIM6H^(qsu6+$`^@
z+rdnAU*7Xzwu?Xc8;u&%HP&5`Ur=VQe80M#R&3Z{-KB_U2l0&7|5S0RdXG#$FzYV!
z0K5)E&V!5r#rN>{b<-yNnYj!a32m925)cQLSW%j`6s&IvC>Jw%Fal~7%Rc>Ji4`@d
zh+@Talxm^rxlH;e&u>sXC2~H^JWwbijBJ)>l(V^<kWXZnT!u<Z$zuYMzET=$E0c4o
z9)*LXH(&RY>%5;Umm_ac1}WRw@5RdCG7%&X1Q7i+rBsM#F#3Dsz2~(AcC6AUW85Xn
zSh+NA8@<t!VfXD%*Yk|`Pq9wrzotF`PVv4(FBOYAu7E4_R4Q$(lK0dt)|Bnk0=YeS
zYDHKDi|_A{XU1Tynp@tJS7{0|$?r!9$P(Zv?fEt9-MO}2^rK#`kK09_t6H9A#HwDM
zwn!GwrE)KDZ-acVJmOrLJi@rD%v|{@`n?-tA@e$Ww5!lmW{8l8S0oF;z25f#dpCy2
z2IPW<klJHoHdsy3E(L*?Edv>KUTz~P0~wg`1DwkZ(?5Q6a)1olU=7IP^Aw1vM^gn+
zM6oe*mWdHJ;PbhOA#%%etyO8jvDL`~wRUi{2LZovdCGQyIgXBEpT95wFS+wB*BE^7
z;FJW8f(jsfC3_JgKY>f4NNM<G%u$gQ`Iz=7z5!4C$a-r-y2Bf-rTo2S#YdL^35K2j
zLy(Y6D#Cm*c~;&XDvH&i@;tvy=cppPKA5PuFKP^)qSSr<`;?ia>agwl8twmUO33QV
z+oZ-w=MXb}5?+SjQzV9o`V8l){ct>#poobz0!8oacOW(rIX{v&qf$NY6s?(d<HcWR
zvcxP08@-u|SEHL8E7`+`^(O`1klbs%5k-UU(Gf_xf;1Lg7!@>|32>Nu7lUASXwEXA
z;(7GQyS-h0;PMk=oR_S{(mrwq{^s5F6h|}w&Ir&YDpMqT?v<D9v5mRMhiu;WZH1K{
zTj42Nq0^Ryi3$c2vjpS75Sl%s@Ivl$B1pY^TOQ4@BFwNnJ7FY`kWm%Jbi|eiVIC~Q
z=yIOTHH3S&$pwu%;Qi@zZF945TiuSnzHKOA#4!vb*gX7)sTS@YaiK`Y)XG&*?L6Kg
zh6`=S+rnk7=c{&!F(K@FFVLpt`uV@YP<l^>>Jv3yeTC#^Jg?p?+e^j3e=KG_C9cjJ
zqZYv7ky2$EmQJ!6^A>_pykG-g%7CN?z_5>A7*R}ui)__v9N4{$#IYkF*Tjei9OF3=
zq6^k+680EoE9MhTUJj6wJ);PRY6GenbKs@3Yu$3~MfTi~9OXx7EAxn4?=NYgdCAjN
z9qlpyNE;oVp`?`(`nd9{?U|DfIZ9lVsHSL4&GR>Oj-gtssM5cnH)tQdro_K$%-tAx
z647j;8JjjNshiF+4wgJ5gZj})<|PTp=}G=isi;4rWP);$Mu^#2irlT3hT?IhC&d3}
z+&Vx!ZVHmCVV{PF!6qcMCg`Uz=f8l<9nwA5o6>B7F-u(XTb7%aw_>gtXLK_qPpmL$
zyWJYFX3p<@91}YO_rbW?^lPI+%;vcv!IHng`z$3ChBW17%G^Fg#jxDz7IMlK&k7rA
zRw9LFgdgkjHJ=rZcMEmrgdWZx?^=x?_Qeki<8Hxo1zaaD+V_l$c3f2=So5fkfgv}`
z23*Xlrx{i~;BynY^&;%%<!hJcP6w>p7I*=W)5SFlS&uC-H+Em!EhJ<GEZGY>KtAm_
z2pG<X+bUP|D;2&&9m_kFEV%*8)`gNqy|Am!x1;`He*H?1(CqLv_N*iT0aS?F`ViNp
z0u}%shf`%fOW9J^hg;v@3WT@v=D>*#;q)2*iB6&0@$iI0=!a{j*VlhZZ~_(^*@2?H
zAF8vK70XB64-d8lPMj9bb_-qSgmVs|$0;~CFxD=>4Peu$n;<pQN!=uBikXeSzGtp#
zwrY0#>$Qmg5x*JnKOmp}HLaA=UY=`t`^2pi^G%B_{!M#@w3nBvkigRDiqDw(;-*Fs
z*LThEZ|s?|3yGzQf!>8>&%dAgXe!VQ(7V(A<}?2KPNA+#h&&rGc0V!3zqxHSA;*`H
zgYb5B_w0d$(txoHK8x2cu39sFm|NouDR-t8xqx+lz<A)P3ro2lm#;X4<0l>r_^Y9?
zJm;%+2<47|)fq5yk0Z=qoqTn2W+V`?i9q_I_XZ;OJ&8p~TOp$<aJ+r>_!-}EQQ$u8
z>m2bP9~GL$Fy!O9Au^ClAEtD|=q0V7^%7aoSu0JLmq;<$tktF&1N?AjcL|$IeTk)r
zX*U}#q#gUAOY|=86uQp)P7nDThlOK=moO@-F*h>(V>65d{~q4HCk-&boUI_IPy~E^
z6b+lRgxOucT`{*c5Syu$qXb}%ro|Sof(+{XM=uLitth%p$8f?ClL2L#IQ>7Qhec)h
z$Zjhdi^@vE_QrjNzu0GLGDJ9Wto$OehczVZlTs{bS}{y$Of3(V8S&?lcfvxUTin;n
z#P((2p$#fpMdc=-pm9c^@JXx)vtOVkb=?mru~^IL7Ydw56`KH!Ps#_jPZvrIqe3%<
zEGbT`B`oX(N>Y>pAxlz3GA~e4l-z0t)s-x_LES>>p!Q22N@Sx(zC+LTAzPFpm-hlK
zQbak=Y>@)|#Oe#xX27*_@%Izt8Su<@Z3xvaSd68~=Mj@9Nflq<DA}WkMR1hjv1xLq
zs-h5F+u+I3T-&HR687qQBcL<irwHO;2NP<(sG9Q^90|p#SFRVVu~9qX*Y_KrH8&MN
zrx&a%)TpO(arZUqnP<!eMTnzqS?Cdf@I{(?FW9OOBjDLCkH!nsr$i!r!TLgt!WPbU
zUn9_Y#waM_qZepZ)|VWGP_4>-p=VR{CB`b}H_)owr&<-N?OUJ973w+f_!4c;`;u)B
zRo~7pQQx*NSzoA8us<~lp>l11Dp#nsmxgLPm+w*BfU$lRsBXJhvGo6+Td@j%17lkB
zLZd}0L-u=tcU5t+{WVsQ9WT@>l2pHFt4e+YW3|)sl3XLV>wf7Mep?U9xnE$^%6<dw
zd$IT9#lBIBP<Kt+!=5X)H395W5w6O8Uu(|5VBZhP*8uyz8A`Y#^0DWbyf>}TobtFx
zvFpQM37?`E^Vn(t-*-3icW^7v@_=hJ+84Ay4(j9w#wbF2&<eL{U^XGj72t~?d*VsZ
z-Uh+hH}Gi<Mk)yIQ#iEicovE(QjSsKjg+Go@GZFR4KFM_KQO|v=%OsJtr+2qWN;Kb
z6!I<CNHB`j->z;#!Se25rx2A4wrWKq0~g0&PvN!!CTqkt(90w-Vo*}VGZDkml0h4U
zSP))@lf()gF!sBK#^7$(KYBqEh>gWyTNiYVIh6mOVn6;5l4$%n$x2wrHYOmP!yycD
zO(O(B#R9ldaMY2}LUM#GWbss4L^tZ5h>!1$DJ&f58$ovphemPFpQ40dgdBn^26fPo
zuqbGMLKXfeO8j&>Zap9z{}VcGLCG*AV{za3zoav$L2H6Qm{NE+gdWD1QS)D={^ao_
z01C!d@_iG8s(75C)CD6DqHNUJ-5pGCaa^cTANnDTSe^XXgR$`CgqL%V2%qH+M$xf&
zKsaKaZqC)~m>5DNm<y<cg(YF}CW6tF5o5)w<U8pi3$}Kh_S9f&8>y`|lu(R$7FbP;
z$MzT0ekQNlMi-dS>d)xh1RauZBa<F6%VK5@$Nw8lBxW_iVD*Dhtd-ORH=CF|sfNVR
zYrC*#j|l1=W4wi$bC9lFql9L#Xy^Ps4&Bi0he@(5CdT6bj#@y;O>mO#W)m}JHpj1;
zZ9cPY{`?0Q0;kTco|^WZnhuyRL*5h>y&9G7i%OqQUQ80A(*04p2^lHktBtQV&X)U)
zn^%qbK4bp<X~77ywFCd6E0LBPvDac}C;fzIJ+HePdnb0`V!*a{Df7dk_ls820_7Aw
ze)R<BJHZ9|#{{G&#ve;}dHs=DxU2GR<DJIE-GQ9)rOFQ*-*1Fdde;EB@^RgueyI_%
zgNpMc$Qjm;kVVBXVsk-;KpR}TB3e{PN5lG~hQ}!xxBG?UyoLPtE(`Ymr?Kmei7LC|
z@4WfLV`i8?I5@K|jtI&CT2^uV!@p51C_y`-xG1hdfr^aaxXxMz#Fl5)RwtVVH|=I2
zH4)M#Vn1|glcr<8EPiO$51aI|@7b9`KbW+inlzcc(=^@qrRUr?vu@kiG$Frt?tSOp
zckaD!cqjLsKOIkt^`3rqbbt+E<i$7}d?&N<_4{Yg7jwy}ALt}E$)oz4{p{F4&IDzH
zU}SWA?r_aUl99QP=BT&}3tJ!7FV-(_)GG_aI-IJ1)^s9kp%z)(Hgt$dxUMPXYTMl4
zgV=m*saFq#mIr?w`$cS}kDVD_j_Lcp#YQfrF+c6db$#-?3~^+pFcZ_7QiU^dQux9h
z(YH6JPJZ0~xc}4dr26&N3k9x8O{qYx{}QK+_4cLe^`>(o6d2k*Ue;ri4DtL_p=m->
zwqR4w!@y!-*{W~dk3MvP#{t&a$A)65fZlkOU5lr$&8%LV!C7s`_*hI(6a}r&$EzN{
ziJc#%$4A-NczSGVb<D816n>&T=n~4trm)X(_$IC5kUUJQIE0osxQcYad)Ezj(0pkK
zZPE+Rys0VMQ0~EpvBlVOuU<{gd9lYay}LgZ)58M=wkb{7ifp?dh8M%j)p}K9YWK(C
z$Kj_zc5WmU)|)S}=;d@Yu^KJ-{GudXa<9yy34HuzI76b5QwoZfw*aLJ-WxOWyyZ)M
zazf5*tk!FqSXna*ck8D{SnDOtJDSe~`2W2(CaEk6&+|Wm8BGbQZA+ey0*?YIt6qC>
z#q&wv3FbH)Vq=MwfZjHV5gAadY4pFv8KVn|^$jERT)s3717FVAEBm{^M&i^TW+R-y
z{w55QSh`?;orWWCzBGY;Ir*t&zFJMGLjl`9iad&>_USthue5y<c@kkgLwa-^T}f6V
zdiyJ66fTip$~aW$^WLl8Bp>U$NN>^z8;zz%Css$vvvShd#TLsoI)SoA|L1aj+gM7m
zczw8dv@6}3Y<&;I&}E8CW_?NDJ?{@T|MO3F-)H99`@=u2S{VFE^@Fkbu@}r-YdC5?
z3wYk#B|Y0!-0L$vYxMS(n*LB~L7Eb4UO^kmfdN!ENMWkAoQ|B1L~2cl7~h}@zY9hR
zrdl}?&)`35<XfkI+TSN;5I$CT`GD@oYo?<e*i4Q8ojxbxnB*q1#it3rpijXtQQ`pR
zcSJ1_pD+Ua2i*-(9c@p=Kc`|BQ9mOV3SGJ8%txLiE$Jd2y!FuSIb<Zo2`w4P!5@c%
zSwt`5SJ>RyajL^O;kiSMC#lD7f*(>bN7RpqI!}Nf9w|<Cgz+d1j<!MLHUd%*<G4GN
z4`c8vx+_8(d_WycQ*nmi1QjWLLj1SHyn&<^$4251sDkQf2P)o1AP$Sp5;Z_DLLh=6
z+$Kucx&N4`-w-?@_>|!H1Zjk|B24-5HjXp?XR7)e!50J=9Ziah5D8^O2^E5LN#l^~
zCQ+mw8tQ}49PU%yBEchqpA-C&AVnZF3@?o@K=6X<8i|S!^biQu<0etJ2o4b3CJ<R*
zg@z$ikH1o#&_7-fWugfZ%F0W1<UiCFp_ou!HlY9sB_#eX6>k#=bK>`iS|$(<TtbT>
z*C<1QA&XB#sUZ!6-VHjS#T>H2F|eE_g7y~Il$I-3$^0N3H=`DUW0c<c3pUM~0N``8
z56rn;61dl;vUSNW{)*Qn{By2Lj&-SIUGl6;wspxRZf!ue=Xl7FxRtmwb8F^a{KLfi
ziL@`c>I*I@ns2vO)S#L(4ktwwojsmBj%nbhHOCIMn10mzllx~|k}c><Kd#w#sLH?b
zu`PQw$3A2<8mAqBRYzbh{@}*^4RWn#^<j4CEp5wr&2d33evV9C$u9B9Z)P<IHOC=r
zX>-ihCF>}Q%G_%UCp23~Ey_53sy(YnC9aqJOR^ym)?v20+5Tkz-0`JKt>kN}ZOz`k
zdST?L_vsX#kFoLCs{Ja8=_;L_Ois?5<~kl6n?JVX*Zd8dYme&4D9*dncdyKan6*MR
z<wuydZ(g-;W`PFHz6aYn!>T>wDo1A5UW5{lYRi;*KMcMfG!B8-_5)gJqw30(1XUYX
zBsdIf(xEk}JtqTnLe5$Q!Ca{V-kjGAZv%Ho&;eYQ;WTio8Ctkah8<i1_&RW#4O}_D
z3*O+BGWNq23vA?06Z%f%Y$j;Rx+SYyJ$2{Yt#i!Xq*<C%r<wV1#^Nf}g*40F<?9R;
z%a?UqHB03}7c;-{mAV?uQoFRDnfH99u1d3PTNp*YtljF7)e`Qu;lup^!ziZ}D!Cir
zAW<If?g41zmvIc+ab@tm2quHGJCi#xPj8=Q3#vujtUw9(S|P;UPN?7&02gs|4si2w
zfRorE4wU;XSat$j#j*@_T)}Qn0FTKgoQteY+HeC@7dMjxIco*f<l3PIw(zr1gzZW@
z0M5$%6i)J6cpLBo#jOf#=3cDF4%+~aVEGYQLCL)(a0z&z0UM8F<6XSej-%M5z)_id
z%b|g{II&@cpQb$IC*F_?w(&|2)>eDa`;J%Ja1FTMgfn0(hCntTxl3mg$%Jv>$0}Pi
zSF7sCnaywvS6HTw@lEIkZuWyG8<IBoX(X>>(plbQ!w32m*v`E+sNw!?=;X?~VH4D4
a4@l_!c;hqEYkxE=-#dba+~!Tf5cyvs#?6ud

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 34da3fa..e261376 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -300,6 +300,59 @@ def registry():
 
 SITES_D = os.path.join(HERE, "sites.d")
 
+# ── Secrets ─────────────────────────────────────────────────────────────────
+# sites.d/ is committed, and cli-tools is a public repository, so a value that
+# is a credential never goes in it. It goes here -- 0600, outside every
+# checkout, the same file `cli-tools config` already writes -- and sites.d
+# carries "secret:<KEY>" in its place.
+CREDENTIALS = os.path.expanduser("~/.config/cli-tools/credentials.json")
+
+def credentials():
+    try:
+        with open(CREDENTIALS) as f: return json.load(f)
+    except FileNotFoundError: return {}
+
+def cred(*names):
+    """First of `names` present in credentials.json, then the environment. The
+    file holds both shapes it has accumulated: a bare string and {"value": ...}."""
+    c = credentials()
+    for n in names:
+        v = c.get(n)
+        if isinstance(v, dict): v = v.get("value")
+        if v: return v
+    return os.environ.get(names[-1])
+
+def put_cred(name, value):
+    c = credentials(); c[name] = value
+    os.makedirs(os.path.dirname(CREDENTIALS), exist_ok=True)
+    fd = os.open(CREDENTIALS, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as f: json.dump(c, f, indent=1, sort_keys=True); f.write("\n")
+    os.chmod(CREDENTIALS, 0o600)
+
+SECRET_REF = re.compile(r"^secret:([A-Za-z0-9_]+)$")
+
+# What must never be written into sites.d. The cutover also marks the values it
+# knows to be secret by provenance; this is the backstop for everything else,
+# because the cost of a wrong guess is one extra entry in credentials.json and
+# the cost of the opposite is a published key.
+SECRET_KEY = re.compile(r"SECRET|PASSWORD|PASSWD|TOKEN|APIKEY|CREDENTIAL|DATABASE_URL|_DSN|_KEY$", re.I)
+
+def resolved_env_overrides(s):
+    """env_overrides with every "secret:<KEY>" replaced by its value."""
+    out = {}
+    for k, v in (s.get("env_overrides") or {}).items():
+        m = SECRET_REF.match(v) if isinstance(v, str) else None
+        if not m: out[k] = v; continue
+        name = m.group(1)
+        val = cred(f"{s['site']}.{name}", name)
+        if not val:
+            die(f"{s['site']}: env_overrides[{k}] is {v!r}, but neither "
+                f'"{s["site"]}.{name}" nor "{name}" is in {CREDENTIALS}.\n'
+                f"  Add it there (0600, outside every checkout). sites.d/ is committed to a\n"
+                f"  public repository, so the value itself must not go back into it.")
+        out[k] = val
+    return out
+
 def with_overrides(s):
     """sites.d/<site>.json is merged over the registry entry: one small file per site,
     so parallel migrations never edit a shared file. Keys are the entry's keys
@@ -508,7 +561,7 @@ def render_env(vars_, s, st, service_name=None):
             if k in ("REDISPORT",): out[k] = "6379"
             if k in ("REDISPASSWORD", "REDIS_PASSWORD"): out[k] = ""
             if k in ("REDISUSER",): out[k] = "default"
-    for k, v in (s.get("env_overrides") or {}).items(): out[k] = v
+    for k, v in resolved_env_overrides(s).items(): out[k] = v
     lines = [f"# {s['site']}{' ' + service_name if service_name else ''}: rendered by dev2-site provision from Railway on {dt.datetime.now(dt.timezone.utc).isoformat(timespec='seconds')}"]
     lines += [f"{k}={env_quote(v)}" for k, v in out.items()]
     return "\n".join(lines) + "\n", out
@@ -656,7 +709,15 @@ def sslparams_for(s, st):
     return "sslmode=require"
 
 def db_name_for(s):
-    return s.get("db_name") or re.sub(r"[^a-z0-9]+", "_", s["site"].lower()).strip("_")
+    """The database name is interpolated into `create database` and into a DSN, and
+    `db_name` in sites.d can set it to anything. Constrain it at the one place it is
+    derived rather than quoting it at each use: a name this tool would ever generate
+    is already a plain identifier, so anything else is a mistake worth stopping on."""
+    db = s.get("db_name") or re.sub(r"[^a-z0-9]+", "_", s["site"].lower()).strip("_")
+    if not re.fullmatch(r"[a-z_][a-z0-9_]{0,62}", db):
+        die(f"{s['site']}: db_name {db!r} is not a plain Postgres identifier "
+            f"([a-z_][a-z0-9_]*, at most 63 characters)")
+    return db
 
 def cmd_db(args):
     s = site(args.site); st = load_state(s["site"])
@@ -814,16 +875,8 @@ def cmd_deploy(args):
     mark(s["site"], "deploy", deployed_ref=ref)
 
 def porkbun_keys():
-    f = os.path.expanduser("~/.config/cli-tools/credentials.json")
-    c = json.load(open(f))
-    def get(*names):
-        for n in names:
-            v = c.get(n)
-            if isinstance(v, dict): v = v.get("value")
-            if v: return v
-        return os.environ.get(names[-1])
-    k, sk = get("porkbun", "PORKBUN_API_KEY"), get("porkbun_secret", "PORKBUN_SECRET_API_KEY")
-    if not (k and sk): die("no Porkbun keys in ~/.config/cli-tools/credentials.json (cli-tools config pull)")
+    k, sk = cred("porkbun", "PORKBUN_API_KEY"), cred("porkbun_secret", "PORKBUN_SECRET_API_KEY")
+    if not (k and sk): die(f"no Porkbun keys in {CREDENTIALS} (cli-tools config pull)")
     return k, sk
 
 def site_domains(s):
@@ -1069,8 +1122,7 @@ def cmd_supabase_stack(args):
     slug, ports = sb_slug(s), sb_ports(s)
     host = f"supabase.{s['site']}"
     log(f"Self-hosted Supabase for {s['site']}: {slug}-supabase, api :{ports['api']}, db :{ports['db']}, pooler :{ports['pooler']}, {ports['subnet']}")
-    creds = json.load(open(os.path.expanduser("~/.config/cli-tools/credentials.json")))
-    smtp = creds.get("RESEND_API_KEY"); smtp = smtp.get("value") if isinstance(smtp, dict) else smtp
+    smtp = cred("RESEND_API_KEY")
     vars_ = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
     smtp = vars_.get("RESEND_API_KEY") or smtp or ""
     ssh("root", "install -d -m 700 /root/dev2-kit")
@@ -1134,23 +1186,33 @@ def cmd_supabase_cutover(args):
         if not st.get(k): die(f"state has no {k}")
     vars_ = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
     ov = {}
+    # Which of the new values are credentials, known by where they came from
+    # rather than by the spelling of the key.
+    secret = set()
     for k, v in vars_.items():
         if not isinstance(v, str): continue
         nv = v
         if f"{st['cloud_ref']}.supabase.co" in nv:
             nv = re.sub(rf"https?://{st['cloud_ref']}\.supabase\.co", f"https://{st['sb_host']}", nv).replace(f"{st['cloud_ref']}.supabase.co", st["sb_host"])
-            if nv.startswith("postgres"): nv = st["sb_database_url"]
-        if st.get("cloud_anon_key") and v == st["cloud_anon_key"]: nv = st["sb_anon_key"]
-        if st.get("cloud_service_key") and v == st["cloud_service_key"]: nv = st["sb_service_key"]
-        if k == "SUPABASE_DB_PASSWORD": nv = st["sb_pg_password"]
-        if k in ("SUPABASE_JWT_SECRET", "JWT_SECRET") and st.get("sb_jwt_secret") and len(v) > 20: nv = st["sb_jwt_secret"]
+            if nv.startswith("postgres"): nv = st["sb_database_url"]; secret.add(k)
+        if st.get("cloud_anon_key") and v == st["cloud_anon_key"]: nv = st["sb_anon_key"]; secret.add(k)
+        if st.get("cloud_service_key") and v == st["cloud_service_key"]: nv = st["sb_service_key"]; secret.add(k)
+        if k == "SUPABASE_DB_PASSWORD": nv = st["sb_pg_password"]; secret.add(k)
+        if k in ("SUPABASE_JWT_SECRET", "JWT_SECRET") and st.get("sb_jwt_secret") and len(v) > 20: nv = st["sb_jwt_secret"]; secret.add(k)
         if k in ("SUPABASE_DB_REF", "SUPABASE_PROJECT_REF") and v == st["cloud_ref"]: warn(f"{k}={v}: the app derives URLs from the ref; it needs a code change to use SUPABASE_URL")
         if nv != v: ov[k] = nv
     sd_path = os.path.join(SITES_D, f"{s['site']}.json")
     sd = json.load(open(sd_path)) if os.path.exists(sd_path) else {}
-    sd["env_overrides"] = {**sd.get("env_overrides", {}), **ov}
+    env_ov, vaulted = dict(sd.get("env_overrides") or {}), []
+    for k, v in ov.items():
+        if k in secret or SECRET_KEY.search(k):
+            put_cred(f"{s['site']}.{k}", v); env_ov[k] = f"secret:{k}"; vaulted.append(k)
+        else:
+            env_ov[k] = v
+    sd["env_overrides"] = env_ov
     with open(sd_path, "w") as f: json.dump(sd, f, indent=1); f.write("\n")
     log(f"{len(ov)} variables re-pointed in sites.d/{s['site']}.json: {', '.join(sorted(ov))}")
+    if vaulted: note(f"{len(vaulted)} kept out of the repository, in {CREDENTIALS} as {s['site']}.<KEY>: {', '.join(sorted(vaulted))}")
     cmd_provision(argparse.Namespace(site=s["site"]))
     cmd_deploy(argparse.Namespace(site=s["site"], ref=None))
     cmd_verify(argparse.Namespace(site=s["site"], public=("dns" in load_state(s["site"])["steps"])))
diff --git a/dev2/sites.d/threatcrush.com.json b/dev2/sites.d/threatcrush.com.json
index 12723b6..150c502 100644
--- a/dev2/sites.d/threatcrush.com.json
+++ b/dev2/sites.d/threatcrush.com.json
@@ -7,9 +7,9 @@
   }
  ],
  "env_overrides": {
-  "SUPABASE_DB_PASSWORD": "5df2829f245804448a8eb604a4417d54",
+  "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD",
   "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.threatcrush.com",
-  "SUPABASE_SERVICE_ROLE_KEY": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoic2VydmljZV9yb2xlIiwiaXNzIjoic3VwYWJhc2UiLCJpYXQiOjE3OTAzMjk0ODgsImV4cCI6MTk0ODAwOTQ4OH0.VRGW__PDSjJQkilfS6AEjFwbe3dnc-ffC57lAxQ2uwk",
-  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiIsImlzcyI6InN1cGFiYXNlIiwiaWF0IjoxNzkwMzI5NDg4LCJleHAiOjE5NDgwMDk0ODh9.3dJiBKet1EGSJCZoQaMFVD861UxKCboB7GcD-gI0EXw"
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY"
  }
 }
diff --git a/dev2/sites.d/tipoffwatch.com.json b/dev2/sites.d/tipoffwatch.com.json
index a85cffb..1b556a3 100644
--- a/dev2/sites.d/tipoffwatch.com.json
+++ b/dev2/sites.d/tipoffwatch.com.json
@@ -1,6 +1,6 @@
 {
  "env_overrides": {
-  "PLAYLIST_SECRET": "postgresql://postgres:JApsRyjafaEFHDqXQHWFAJTQoNxADLOo@postgres-q7ea.railway.internal:5432/railway"
+  "PLAYLIST_SECRET": "secret:PLAYLIST_SECRET"
  },
- "notes": "PLAYLIST_SECRET pins the playlist encryption key to the old Railway DATABASE_URL: tipoffwatch derives the key from PLAYLIST_SECRET || DATABASE_URL (packages/config/src/index.js), and the kit rewrote DATABASE_URL, which made every stored playlist URL unreadable. Contains the retired Railway Postgres credential; do not commit."
+ "notes": "PLAYLIST_SECRET pins the playlist encryption key to the old Railway DATABASE_URL: tipoffwatch derives the key from PLAYLIST_SECRET || DATABASE_URL (packages/config/src/index.js), and the kit rewrote DATABASE_URL, which made every stored playlist URL unreadable. The value is the retired Railway Postgres credential, so it lives in credentials.json as tipoffwatch.com.PLAYLIST_SECRET, never here."
 }

From 7e0ecc77bb9857d2b4a0ee8ca4a1a38f68384bdf Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 12:58:50 +0000
Subject: [PATCH 041/104] dev2-site provision: inside port from the Dockerfile
 HEALTHCHECK/EXPOSE when Railway set none

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index e261376..658155e 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -428,6 +428,18 @@ def find_dockerfile(d, cfg):
     if os.path.exists(os.path.join(d, ".nixpacks", "Dockerfile")): return ".nixpacks/Dockerfile"
     return None
 
+def dockerfile_port(checkout, dockerfile):
+    """The port the image expects when Railway set none: HEALTHCHECK's localhost:<port>
+    first (that is what Docker will probe), else the first EXPOSE."""
+    if not checkout or not dockerfile: return None
+    p = os.path.join(checkout, dockerfile)
+    if not os.path.exists(p): return None
+    txt = open(p).read()
+    m = re.search(r"HEALTHCHECK[^\n]*?(?:localhost|127\.0\.0\.1|0\.0\.0\.0):(\d{2,5})", txt, re.S)
+    if m: return m.group(1)
+    m = re.search(r"^EXPOSE\s+(\d{2,5})", txt, re.M)
+    return m.group(1) if m else None
+
 def workflow_name(s):
     return "deploy-dev2.yml" if not s.get("shared_repo") else f"deploy-dev2-{s['site'].replace('.', '-')}.yml"
 
@@ -627,9 +639,9 @@ def cmd_provision(args):
     if s["db"] in ("supabase", "turso") and not st.get("database_url") and not s.get("env_overrides"):
         warn(f"db kind {s['db']}: app.env keeps pointing at the current {s['db']} until its own migration; set env_overrides in sites.overrides.json when ready")
     vars_ = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
-    inside = s.get("port_var") or "3000"
-    app_env, merged = render_env(vars_, s, st)
     image_only = bool(s.get("image")) and not s.get("repo")
+    inside = s.get("port_var") or ("3000" if image_only else dockerfile_port(st.get("checkout") or checkout_dir(s), st.get("dockerfile")) or "3000")
+    app_env, merged = render_env(vars_, s, st)
     if image_only:
         if not s.get("start_command"): die(f"{s['site']} runs a stock image; set start_command (Railway's deployment manifest has it) in sites.d/{s['site']}.json")
         cfg, branch, hp = {}, "", s.get("health_path") or "/"

From 69d8bb34169a499b1d8f9f4e98dad7e6ef841058 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:01:50 +0000
Subject: [PATCH 042/104] dev2-site deploy: default to the default branch once
 the scaffold PR is merged

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 658155e..96f8c1c 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -879,7 +879,10 @@ def cmd_volumes(args):
 
 def cmd_deploy(args):
     s = site(args.site); st = load_state(s["site"])
-    ref = args.ref or st.get("scaffold_branch") or st.get("branch") or s.get("branch") or ("image" if not s.get("repo") else "main")
+    # Before the merge the scaffold branch carries the workflow; after it the branch is
+    # gone and the default branch is what CI deploys.
+    merged = "merge" in st["steps"]
+    ref = args.ref or (None if merged else st.get("scaffold_branch")) or st.get("branch") or s.get("branch") or ("image" if not s.get("repo") else "main")
     log(f"Deploy {s['site']} @ {ref} on dev2 (as {DEPLOY_USER})")
     out = ssh(DEPLOY_USER, f"{WWW}/{s['site']}/deploy-app.sh {shlex.quote(ref)} 2>&1", check=False, timeout=3600)
     print(out[-4000:])

From dae6486b194492b09a3193e60725b232f55f5e97 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:02:13 +0000
Subject: [PATCH 043/104] dev2-site verify: probe wildcards through a sample
 label

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 96f8c1c..87fc6cf 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -958,6 +958,8 @@ def cmd_verify(args):
         die(f"no nginx vhost for {s['site']} yet: run `dev2-site vhost {s['site']}` first")
     ok = True
     for d in s["domains"]:
+        # A wildcard is probed through a sample label (the cert and vhost cover it).
+        if d.startswith("*."): d = "dev2-probe." + d[2:]
         resolve = [] if args.public else ["--resolve", f"{d}:443:{DEV2_IP}"]
         for attempt in range(12 if args.public else 1):  # resolvers cache the old record for up to TTL 600
             curl = ["curl", "-sk", "-o", "/dev/null", "-m", "30", "-w", "%{http_code}", *resolve, f"https://{d}{hp}"]

From e0bc53d79fd93bb701e15d0be49f19e83cd60837 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:03:15 +0000
Subject: [PATCH 044/104] dev2-site: HTTP-01 certificates and manual DNS for
 zones not at Porkbun

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 87fc6cf..1f84e0b 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -904,9 +904,37 @@ def site_domains(s):
     wild = [n[2:] for n in names if n.startswith("*.")]
     return [n for n in names if n.startswith("*.") or not any(n.endswith("." + z) and n.count(".") == z.count(".") + 1 for z in wild)]
 
+def zone_at_porkbun(domain):
+    zone = ".".join(domain.split(".")[-2:])
+    ns = sh(["dig", "+short", "NS", zone], check=False).lower()
+    return "porkbun" in ns
+
+def cmd_cert_http(s, domains):
+    """HTTP-01 for zones whose DNS we do not control (Cloudflare etc.): DNS must already
+    point at dev2. An http-only server block serves the challenge from /var/www/acme."""
+    cert_dir = f"/etc/nginx/ssl/{s['site']}"
+    for d in domains:
+        if d.startswith("*."): die(f"{d}: a wildcard needs DNS-01; move the zone to Porkbun or drop the wildcard")
+        ip = sh(["dig", "+short", d], check=False).split()
+        if DEV2_IP not in ip: die(f"{d} resolves to {ip or 'nothing'}, not {DEV2_IP}: point the zone's A record at dev2 first (DNS-only, not proxied, for issuance)")
+    log(f"Certificate for {', '.join(domains)} (acme.sh, HTTP-01 through nginx, zone not at Porkbun)")
+    conf = "server {\n    listen 80;\n    listen [::]:80;\n    server_name " + " ".join(domains) + ";\n    location ^~ /.well-known/acme-challenge/ { root /var/www/acme; default_type \"text/plain\"; }\n    location / { return 301 https://$host$request_uri; }\n}\n"
+    ssh_put(conf, f"/etc/nginx/sites-available/{s['site']}", "0644")
+    ssh("root", f"install -d -m 0755 /var/www/acme && ln -sf /etc/nginx/sites-available/{s['site']} /etc/nginx/sites-enabled/{s['site']} && nginx -t 2>&1 | tail -n1 && systemctl reload nginx")
+    ds = " ".join(f"-d {shlex.quote(d)}" for d in domains)
+    ssh("root", "test -x /root/.acme.sh/acme.sh || curl -fsSL https://get.acme.sh | env HOME=/root sh -s email=" + ACME_EMAIL + " >/dev/null")
+    out = ssh("root", f"install -d -m 0750 {cert_dir} && env HOME=/root /root/.acme.sh/acme.sh --issue --server letsencrypt --webroot /var/www/acme {ds} --force >/tmp/acme-{s['site']}.log 2>&1 || {{ tail -n 25 /tmp/acme-{s['site']}.log; exit 1; }}", check=False, timeout=1800)
+    if out.strip() and "Cert success" not in out: die(out)
+    ssh("root", f"env HOME=/root /root/.acme.sh/acme.sh --install-cert -d {shlex.quote(domains[0])} --fullchain-file {cert_dir}/fullchain.pem --key-file {cert_dir}/privkey.pem --reloadcmd 'systemctl reload nginx' >/dev/null")
+    note(ssh("root", f"openssl x509 -in {cert_dir}/fullchain.pem -noout -subject -enddate | tr '\\n' ' '").strip())
+    mark(s["site"], "cert", cert_domains=domains, cert_mode="http-01")
+
 def cmd_cert(args):
     s = site(args.site)
     domains = site_domains(s)
+    if not zone_at_porkbun(s["site"]):
+        note(f"{s['site']}'s zone is not at Porkbun (NS: {sh(['dig', '+short', 'NS', '.'.join(s['site'].split('.')[-2:])], check=False).strip().replace(chr(10), ' ')})")
+        return cmd_cert_http(s, domains)
     k, sk = porkbun_keys()
     cert_dir = f"/etc/nginx/ssl/{s['site']}"
     log(f"Certificate for {', '.join(domains)} (acme.sh, Porkbun DNS-01, issued before DNS moves)")
@@ -981,6 +1009,10 @@ def cmd_verify(args):
 def cmd_dns(args):
     s = site(args.site)
     domains = site_domains(s)
+    if not zone_at_porkbun(s["site"]):
+        warn(f"{s['site']}'s DNS is not at Porkbun; point every A record ({', '.join(domains)}) at {DEV2_IP} by hand, then re-run"); 
+        if not all(DEV2_IP in sh(["dig", "+short", d], check=False).split() for d in domains if not d.startswith("*.")): die("DNS not pointing at dev2 yet")
+        mark(s["site"], "dns", dns_flipped="manual"); return
     zones = {}
     for d in domains:
         zone = ".".join(d.split(".")[-2:]); zones.setdefault(zone, []).append(d)

From 49fec2d9f573a004052740ff5b68ff885363b47b Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:12:41 +0000
Subject: [PATCH 045/104] dev2-site: nixpacks images get the start command as
 one bash -c string

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 1f84e0b..d99e61d 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -594,7 +594,11 @@ def render_compose(s, st, app_port_inside, build_args=()):
                 y.append("      args:"); y.extend(f"        {k}: \"${{{k}:-}}\"" for k in build_args)
             y.append(f"    image: {img}-{name}:latest\n    restart: unless-stopped\n    env_file: {envfile}")
         y.append(f"    environment:\n      PORT: \"{app_port_inside}\"\n      HOST: \"0.0.0.0\"\n      NODE_ENV: production")
-        if command: y.append(f"    command: {json.dumps(shlex.split(command))}")
+        if command:
+            # A nixpacks image's entrypoint is `/bin/bash -l -c`, and bash -c takes ONE script
+            # argument: an argv list would run only the first word (Bun's help text, exit 0,
+            # restart loop). Hand it the whole string. Other images exec the argv directly.
+            y.append(f"    command: {json.dumps([command] if (df or '').startswith('.nixpacks/') else shlex.split(command))}")
         if ports: y.append(f"    ports:\n      - \"127.0.0.1:${{APP_PORT}}:{app_port_inside}\"")
         if vols:
             y.append("    volumes:")

From f1a6b116033566c4653a4112d3dcae8bb5e8a376 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:15:56 +0000
Subject: [PATCH 046/104] sites.d: app.moshcode.sh runs the pwa server, not the
 CLI

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/app.moshcode.sh.json | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 dev2/sites.d/app.moshcode.sh.json

diff --git a/dev2/sites.d/app.moshcode.sh.json b/dev2/sites.d/app.moshcode.sh.json
new file mode 100644
index 0000000..b631a9f
--- /dev/null
+++ b/dev2/sites.d/app.moshcode.sh.json
@@ -0,0 +1 @@
+{"start_command": "node apps/pwa/src/server.mjs", "health_path": "/healthz", "notes": "Railway ran this service from apps/pwa (its railway.json: npm start -> node src/server.mjs, /healthz); the repo root start is the moshcode CLI"}

From 2c657e6e13751c3ea9d3f5b24ee06fd7f76ccf84 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:17:10 +0000
Subject: [PATCH 047/104] dev2-site: env_remove for settings a ported app
 refuses; README for the Turso second pass

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/README.md | 11 ++++++++---
 dev2/dev2-site |  1 +
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/dev2/README.md b/dev2/README.md
index 6c429fc..cd44731 100644
--- a/dev2/README.md
+++ b/dev2/README.md
@@ -81,7 +81,8 @@ small file per site, so parallel migrations never edit a shared file:
 { "health_path": "/healthz", "port_var": "8080", "start_command": "bun run start",
   "companion_commands": { "genrewatch-worker": "bun run worker" },
   "env_overrides": { "SITE_URL": "https://example.com" },
-  "pg_service": "Postgres-iVtY", "max_body": "256m", "branch": "master" }
+  "pg_service": "Postgres-iVtY", "max_body": "256m", "branch": "master",
+  "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"] }
 ```
 
 ### Secrets in `env_overrides`
@@ -116,8 +117,12 @@ reference is written back into `sites.d/`.
   `pull-cloud.sh`, `load-selfhost.sh`, `sync-storage.mjs`). Then
   `env_overrides` + `provision` + `deploy` re-point the app.
 - `turso`: the app keeps talking to Turso after the move; the database moves
-  in a second pass with a Postgres port of the app's db layer (the pattern is
-  rssamplifier.com `packages/db/src/pg.js`: serve the libSQL surface over pg).
+  in a second pass once the app's Postgres port (on `@profullstack/libsql-pg`)
+  is merged: `dev2-site db-create <site>` (empty database in the shared cluster,
+  DATABASE_URL into state), apply the app's Postgres schema, `npx libsql-pg copy
+  --from <libsql url> --token ... --to <DATABASE_URL> --verify`, then
+  `provision` (libsql:// values become the new DATABASE_URL; list the retired
+  Turso settings in `env_remove`) and `deploy <default branch>`.
 
 ## State
 
diff --git a/dev2/dev2-site b/dev2/dev2-site
index d99e61d..2ef8db4 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -574,6 +574,7 @@ def render_env(vars_, s, st, service_name=None):
             if k in ("REDISPASSWORD", "REDIS_PASSWORD"): out[k] = ""
             if k in ("REDISUSER",): out[k] = "default"
     for k, v in resolved_env_overrides(s).items(): out[k] = v
+    for k in s.get("env_remove") or []: out.pop(k, None)  # settings a ported app refuses outright
     lines = [f"# {s['site']}{' ' + service_name if service_name else ''}: rendered by dev2-site provision from Railway on {dt.datetime.now(dt.timezone.utc).isoformat(timespec='seconds')}"]
     lines += [f"{k}={env_quote(v)}" for k, v in out.items()]
     return "\n".join(lines) + "\n", out

From 20bdde8ccb9c7a3f2c54d2b8e03e169497e75889 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:19:24 +0000
Subject: [PATCH 048/104] dev2-site db: copy the database the app's URL names,
 not the instance default

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 2ef8db4..98c1aa6 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -772,6 +772,14 @@ def cmd_db(args):
     user = rw_ssh_user(s["project_id"], s["environment_id"], pg["name"])
     pgvars = rw_variables(s["project_id"], s["environment_id"], pg["id"])
     src_db = pgvars.get("PGDATABASE") or pgvars.get("POSTGRES_DB") or "railway"
+    # Several apps can share one Railway Postgres instance, each in its own database
+    # (mynaposter-api used /myna on the instance whose default is /railway): the app's own
+    # URL is the authority on which database to copy.
+    appvars = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
+    for v in appvars.values():
+        m = re.match(r"postgres(?:ql)?://[^@]+@[a-z0-9.-]+\.railway\.internal(?::\d+)?/([A-Za-z0-9_]+)", str(v))
+        if m and m.group(1) != src_db: note(f"app uses database {m.group(1)} on that instance (instance default is {src_db})"); src_db = m.group(1); break
+    if s.get("pg_database"): src_db = s["pg_database"]
     dump = f"/root/dumps/{db}-{dt.datetime.now(dt.timezone.utc).strftime('%Y%m%dT%H%M%SZ')}.dump"
     ssh("root", "install -d -m 700 /root/dumps")
     log(f"pg_dump {src_db} via ssh.railway.com -> {DEV2_HOST}:{dump}")

From e75d4462e601e66300a967a50bf77b47d99c7185 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:20:39 +0000
Subject: [PATCH 049/104] dev2-site db: companions' variables may name the
 database

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site                   | 4 +++-
 dev2/sites.d/nightcell7.com.json | 4 ++++
 dev2/sites.d/ringhuman.com.json  | 1 +
 3 files changed, 8 insertions(+), 1 deletion(-)
 create mode 100644 dev2/sites.d/nightcell7.com.json
 create mode 100644 dev2/sites.d/ringhuman.com.json

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 98c1aa6..f2c81e3 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -775,7 +775,9 @@ def cmd_db(args):
     # Several apps can share one Railway Postgres instance, each in its own database
     # (mynaposter-api used /myna on the instance whose default is /railway): the app's own
     # URL is the authority on which database to copy.
-    appvars = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
+    appvars = {}
+    for sid in [s["service_id"]] + [c["id"] for c in s.get("companions", [])]:  # a companion may be the one that talks to Postgres
+        appvars.update(rw_variables(s["project_id"], s["environment_id"], sid))
     for v in appvars.values():
         m = re.match(r"postgres(?:ql)?://[^@]+@[a-z0-9.-]+\.railway\.internal(?::\d+)?/([A-Za-z0-9_]+)", str(v))
         if m and m.group(1) != src_db: note(f"app uses database {m.group(1)} on that instance (instance default is {src_db})"); src_db = m.group(1); break
diff --git a/dev2/sites.d/nightcell7.com.json b/dev2/sites.d/nightcell7.com.json
new file mode 100644
index 0000000..d385ef2
--- /dev/null
+++ b/dev2/sites.d/nightcell7.com.json
@@ -0,0 +1,4 @@
+{
+ "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"],
+ "db_sslparams": "sslmode=no-verify"
+}
diff --git a/dev2/sites.d/ringhuman.com.json b/dev2/sites.d/ringhuman.com.json
new file mode 100644
index 0000000..6d2a6e3
--- /dev/null
+++ b/dev2/sites.d/ringhuman.com.json
@@ -0,0 +1 @@
+{ "branch": "master", "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"] }

From 148ffdf8b5789860cef292a35cb412d8f1a62020 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:25:32 +0000
Subject: [PATCH 050/104] dev2-site: a published companion listens on its own
 inside port

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index f2c81e3..04a6c77 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -585,7 +585,8 @@ def render_compose(s, st, app_port_inside, build_args=()):
     y = [f"# {s['site']} on dev2: rendered by cli-tools dev2/dev2-site provision. Re-run provision to change.",
          "# nginx on the host terminates TLS and proxies to 127.0.0.1:${APP_PORT}.", "services:"]
     image_only = bool(s.get("image")) and not s.get("repo")
-    def service(name, envfile, command=None, ports=True, vols=()):
+    def service(name, envfile, command=None, ports=True, vols=(), port_inside=None):
+        port_inside = port_inside or app_port_inside
         y.append(f"  {name}:")
         if image_only:  # Railway ran a stock image with a start command; no repo, nothing to build
             y.append(f"    image: {s['image']}\n    restart: unless-stopped\n    env_file: {envfile}")
@@ -594,7 +595,7 @@ def render_compose(s, st, app_port_inside, build_args=()):
             if build_args:  # deploy-app.sh exports app.env before `compose build`, so ${K} resolves
                 y.append("      args:"); y.extend(f"        {k}: \"${{{k}:-}}\"" for k in build_args)
             y.append(f"    image: {img}-{name}:latest\n    restart: unless-stopped\n    env_file: {envfile}")
-        y.append(f"    environment:\n      PORT: \"{app_port_inside}\"\n      HOST: \"0.0.0.0\"\n      NODE_ENV: production")
+        y.append(f"    environment:\n      PORT: \"{port_inside}\"\n      HOST: \"0.0.0.0\"\n      NODE_ENV: production")
         if command:
             # A nixpacks image's entrypoint is `/bin/bash -l -c`, and bash -c takes ONE script
             # argument: an argv list would run only the first word (Bun's help text, exit 0,
@@ -612,7 +613,7 @@ def render_compose(s, st, app_port_inside, build_args=()):
         # companion_ports {"name": {"host": 3301, "inside": 3000}} publishes a companion on
         # loopback so a `proxies` entry can give it its own hostname (an API the web app calls).
         cp = (s.get("companion_ports") or {}).get(c["name"])
-        service(c["name"], f"{c['name']}.env", command=(s.get("companion_commands") or {}).get(c["name"]), ports=False, vols=c.get("volumes", []))
+        service(c["name"], f"{c['name']}.env", command=(s.get("companion_commands") or {}).get(c["name"]), ports=False, vols=c.get("volumes", []), port_inside=(cp or {}).get("inside"))
         if cp: y.insert(len(y) - (2 if s["redis"] else 1), f"    ports:\n      - \"127.0.0.1:{cp['host']}:{cp['inside']}\"")
     if s["redis"]:
         y.append("  redis:\n    image: redis:8-alpine\n    restart: unless-stopped\n    command: [\"redis-server\", \"--appendonly\", \"yes\", \"--maxmemory\", \"1gb\", \"--maxmemory-policy\", \"noeviction\"]\n    volumes:\n      - redisdata:/data\n    logging:\n      driver: json-file\n      options: { max-size: \"20m\", max-file: \"2\" }")

From 0a6469961f354168a4038a0fdc0928d854289e84 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:28:03 +0000
Subject: [PATCH 051/104] dev2: tronbrowser.dev on Postgres, retire the Turso
 settings

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/tronbrowser.dev.json | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 dev2/sites.d/tronbrowser.dev.json

diff --git a/dev2/sites.d/tronbrowser.dev.json b/dev2/sites.d/tronbrowser.dev.json
new file mode 100644
index 0000000..50d2709
--- /dev/null
+++ b/dev2/sites.d/tronbrowser.dev.json
@@ -0,0 +1 @@
+{ "env_remove": ["TRONBROWSER_DB_URL", "TRONBROWSER_DB_AUTH_TOKEN", "TRONBROWSER_DB_PATH"] }

From 585c13a496560e93e6526874caa6b9cc417a20ba Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:28:14 +0000
Subject: [PATCH 052/104] sites.d: app.moshcode.sh uses its own Dockerfile

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/app.moshcode.sh.json | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dev2/sites.d/app.moshcode.sh.json b/dev2/sites.d/app.moshcode.sh.json
index b631a9f..85ec5f4 100644
--- a/dev2/sites.d/app.moshcode.sh.json
+++ b/dev2/sites.d/app.moshcode.sh.json
@@ -1 +1,4 @@
-{"start_command": "node apps/pwa/src/server.mjs", "health_path": "/healthz", "notes": "Railway ran this service from apps/pwa (its railway.json: npm start -> node src/server.mjs, /healthz); the repo root start is the moshcode CLI"}
+{
+ "health_path": "/healthz",
+ "notes": "web app is apps/pwa (own deps); plain Dockerfile on the deploy branch, health /healthz"
+}
\ No newline at end of file

From 0b635b5bb50c93a1086b54a089d77dc941039414 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:31:13 +0000
Subject: [PATCH 053/104] dev2-site cert: drop stale _acme-challenge TXT
 records before issuing

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site                   |  4 ++++
 dev2/sites.d/goingbroke.now.json |  5 +++++
 dev2/sites.d/meshhook.com.json   | 10 +++++++++-
 3 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 dev2/sites.d/goingbroke.now.json

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 04a6c77..36a41a8 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -963,6 +963,10 @@ def cmd_cert(args):
         for r in recs:
             if r.get("type") == "CNAME" and r.get("name", "").startswith("_acme-challenge") and "railwaydns" in r.get("content", ""):
                 sh(["porkbun", "rm", zone, r["name"][: -len(zone) - 1], "--type", "CNAME", "--yes"], check=False); note(f"removed Railway acme CNAME {r['name']}")
+            # An interrupted acme.sh run leaves its TXT challenge behind, and the Porkbun hook
+            # then fails the next issuance with DUPLICATE_RECORD.
+            if r.get("type") == "TXT" and r.get("name", "") in (host + "." + zone if host != "_acme-challenge" else "_acme-challenge." + zone,):
+                sh(["porkbun", "rm", zone, r["id"], "--yes"], check=False); note(f"removed stale acme TXT {r['name']}")
     ssh("root", "test -x /root/.acme.sh/acme.sh || curl -fsSL https://get.acme.sh | env HOME=/root sh -s email=" + ACME_EMAIL + " >/dev/null")
     ds = " ".join(f"-d {shlex.quote(d)}" for d in domains)
     # A certificate acme.sh issued in the last day is reused (a retry after a dropped
diff --git a/dev2/sites.d/goingbroke.now.json b/dev2/sites.d/goingbroke.now.json
new file mode 100644
index 0000000..c6bdbd9
--- /dev/null
+++ b/dev2/sites.d/goingbroke.now.json
@@ -0,0 +1,5 @@
+{
+ "branch": "master",
+ "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN", "DATA_DIR"],
+ "db_sslparams": "sslmode=require"
+}
diff --git a/dev2/sites.d/meshhook.com.json b/dev2/sites.d/meshhook.com.json
index f381a45..56abca3 100644
--- a/dev2/sites.d/meshhook.com.json
+++ b/dev2/sites.d/meshhook.com.json
@@ -1 +1,9 @@
-{"node_version": "24", "notes": "pnpm in the lockfile needs Node >= 22.13; nixpacks pinned nixpkgs has 22.11"}
+{
+ "node_version": "24",
+ "notes": "pnpm in the lockfile needs Node >= 22.13; nixpacks pinned nixpkgs has 22.11",
+ "branch": "master",
+ "env_remove": [
+  "TURSO_DATABASE_URL",
+  "TURSO_AUTH_TOKEN"
+ ]
+}

From 61c8113a498beaf9c38e4ed48141d5e62a8092ff Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:37:36 +0000
Subject: [PATCH 054/104] dev2: feedback.profullstack.com off Turso onto the
 shared Postgres cluster

Retire TURSO_DATABASE_URL and TURSO_AUTH_TOKEN, deploy master, and pin
sslmode=require for the @profullstack/libsql-pg pool (no-verify would connect
in the clear and pg_hba rejects that).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/feedback.profullstack.com.json | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 dev2/sites.d/feedback.profullstack.com.json

diff --git a/dev2/sites.d/feedback.profullstack.com.json b/dev2/sites.d/feedback.profullstack.com.json
new file mode 100644
index 0000000..b7a699a
--- /dev/null
+++ b/dev2/sites.d/feedback.profullstack.com.json
@@ -0,0 +1,5 @@
+{
+ "branch": "master",
+ "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"],
+ "db_sslparams": "sslmode=require"
+}

From b7ae547149de1da91843c8fd82e2ec5867f4d697 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:38:36 +0000
Subject: [PATCH 055/104] dev2: reeleel.com registry on Postgres, retire the
 Turso replica settings

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/reeleel.com.json | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 dev2/sites.d/reeleel.com.json

diff --git a/dev2/sites.d/reeleel.com.json b/dev2/sites.d/reeleel.com.json
new file mode 100644
index 0000000..8b124a6
--- /dev/null
+++ b/dev2/sites.d/reeleel.com.json
@@ -0,0 +1 @@
+{ "branch": "master", "env_remove": ["REELEEL_DB_URL", "REELEEL_DB_AUTH_TOKEN", "REELEEL_DB_REPLICA_PATH", "REELEEL_DB_SYNC_INTERVAL"] }

From 5e02e643000b11d26ffbfdc573e232334cd0bc3e Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:42:23 +0000
Subject: [PATCH 056/104] dev2: opensourcelegends.com off Turso onto the shared
 Postgres cluster

Retire TURSO_DATABASE_URL and TURSO_AUTH_TOKEN, deploy master, and pin
sslmode=require for the @profullstack/libsql-pg pool.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/opensourcelegends.com.json | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 dev2/sites.d/opensourcelegends.com.json

diff --git a/dev2/sites.d/opensourcelegends.com.json b/dev2/sites.d/opensourcelegends.com.json
new file mode 100644
index 0000000..b7a699a
--- /dev/null
+++ b/dev2/sites.d/opensourcelegends.com.json
@@ -0,0 +1,5 @@
+{
+ "branch": "master",
+ "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"],
+ "db_sslparams": "sslmode=require"
+}

From 3133d8e5fa35129e11ccdf96cc37ccd090ca2457 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:52:24 +0000
Subject: [PATCH 057/104] dev2-site: detect the Postgres driver on origin's
 default branch; libsql-pg apps take sslmode=require

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 36a41a8..af42338 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -717,13 +717,19 @@ def pg_admin(sql, db="postgres"):
     return ssh("root", f"docker exec -i {PG_CONTAINER} psql -U supabase_admin -h localhost -d {shlex.quote(db)} -X -At -v ON_ERROR_STOP=1", input=sql)
 
 def sslparams_for(s, st):
-    """`sslmode=no-verify` for node-postgres repos, `sslmode=require` for everything else."""
+    """`sslmode=no-verify` for repos that use node-postgres directly (pg reads `require` as
+    verify-full and rejects the cluster's self-signed cert); `sslmode=require` for Bun.SQL,
+    postgres.js and @profullstack/libsql-pg (whose own parser turns `no-verify` into a plain
+    connection that pg_hba rejects). Read from the repo's DEFAULT BRANCH on origin, not the
+    working tree: local checkouts lag behind merged ports."""
     d = st.get("checkout") or (checkout_dir(s) if s.get("repo") else None)
-    if d:
-        try:
-            out = sh(f"grep -rls --include=package.json -E '\"pg\"\\s*:' {shlex.quote(d)} --exclude-dir=node_modules --exclude-dir=.git | head -n 1", check=False)
-            if out.strip(): return "sslmode=no-verify"
-        except RuntimeError: pass
+    if d and s.get("repo"):
+        branch = st.get("branch") or s.get("branch") or default_branch(s["repo"])
+        sh(["git", "-C", d, "fetch", "-q", "origin", branch], check=False)
+        pkgs = sh(["git", "-C", d, "grep", "-l", "-E", r'"pg"\s*:', f"origin/{branch}", "--", "package.json", "*/package.json", "*/*/package.json"], check=False)
+        uses_pg = bool(pkgs.strip())
+        uses_shim = bool(sh(["git", "-C", d, "grep", "-l", "@profullstack/libsql-pg", f"origin/{branch}", "--", "package.json", "*/package.json", "*/*/package.json"], check=False).strip())
+        if uses_pg and not uses_shim: return "sslmode=no-verify"
     return "sslmode=require"
 
 def db_name_for(s):

From 42fa4b3d25af2522bc5af6acabf68407e8cab1a7 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:55:33 +0000
Subject: [PATCH 058/104] dev2-site: fall back to the live app.env on dev2 when
 Railway has no variables; box-tune raises inotify limits

Retiring a Railway service deletes its variables, and the Supabase second pass
re-renders app.env from them; a cutover after retire would have deployed an
empty environment. Envoy in a new stack segfaults once 128 inotify instances
are taken (about 130 containers).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site             | 39 +++++++++++++++++++++++++++++++++-----
 dev2/templates/box-tune.sh |  7 +++++++
 2 files changed, 41 insertions(+), 5 deletions(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index af42338..08f77de 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -148,6 +148,35 @@ def rw_variables(pid, eid, sid):
     return gql("query($p:String!,$e:String!,$s:String!){variables(projectId:$p,environmentId:$e,serviceId:$s)}",
                {"p": pid, "e": eid, "s": sid})["variables"] or {}
 
+def parse_env_file(text):
+    """A compose env file as `render_env` writes it (double-quoted values may hold newlines)."""
+    out, key, buf = {}, None, None
+    for line in text.split("\n"):
+        if key is not None:
+            buf += "\n" + line
+            if line.endswith('"') and not line.endswith('\\"'):
+                out[key] = buf[1:-1].replace('\\"', '"').replace("\\\\", "\\"); key, buf = None, None
+            continue
+        if not line or line.startswith("#") or "=" not in line: continue
+        k, v = line.split("=", 1)
+        if v.startswith('"') and not (v.endswith('"') and len(v) > 1 and not v.endswith('\\"')): key, buf = k, v; continue
+        if v.startswith('"') and v.endswith('"') and len(v) > 1: v = v[1:-1].replace('\\"', '"').replace("\\\\", "\\")
+        out[k] = v
+    return out
+
+def site_variables(s, sid=None, envfile="app.env"):
+    """The service's environment: Railway while the service exists, else the live app.env on
+    dev2 (a retired service has no variables left anywhere else). Values from dev2 are already
+    the rendered ones, which is what a re-render should start from."""
+    vars_ = {}
+    try: vars_ = rw_variables(s["project_id"], s["environment_id"], sid or s["service_id"])
+    except RuntimeError as e: warn(f"railway variables: {str(e)[:120]}")
+    if vars_: return vars_
+    txt = ssh("root", f"cat {WWW}/{shlex.quote(s['site'])}/{shlex.quote(envfile)} 2>/dev/null", check=False)
+    if not txt.strip(): die(f"{s['site']}: no variables on Railway and no {envfile} on dev2 to fall back to")
+    note(f"{s['site']}: Railway has no variables (service retired); using the live {envfile} from dev2")
+    return parse_env_file(txt)
+
 def rw_ssh_user(pid, eid, service_name):
     out = sh(["railway", "ssh", "config", "--dry-run", "-i", RAILWAY_SSH_KEY, "--project", pid,
               "--environment", eid, "--service", service_name])
@@ -644,7 +673,7 @@ def cmd_provision(args):
     if s["db"] == "pg" and not st.get("database_url"): die("run `dev2-site db` first (the app env needs the new DATABASE_URL)")
     if s["db"] in ("supabase", "turso") and not st.get("database_url") and not s.get("env_overrides"):
         warn(f"db kind {s['db']}: app.env keeps pointing at the current {s['db']} until its own migration; set env_overrides in sites.overrides.json when ready")
-    vars_ = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
+    vars_ = site_variables(s)
     image_only = bool(s.get("image")) and not s.get("repo")
     inside = s.get("port_var") or ("3000" if image_only else dockerfile_port(st.get("checkout") or checkout_dir(s), st.get("dockerfile")) or "3000")
     app_env, merged = render_env(vars_, s, st)
@@ -676,7 +705,7 @@ def cmd_provision(args):
     own = f"{DEPLOY_USER}:{DEPLOY_USER}"
     ssh_put(app_env, f"{root}/app.env", "0600", own)
     for c in s["companions"]:
-        cv = rw_variables(s["project_id"], s["environment_id"], c["id"])
+        cv = site_variables(s, c["id"], f"{c['name']}.env")
         cenv, _ = render_env(cv, s, st, c["name"])
         ssh_put(cenv, f"{root}/{c['name']}.env", "0600", own)
     ssh_put(deploy_env, f"{root}/deploy.env", "0640", own)
@@ -1165,7 +1194,7 @@ def sb_slug(s): return re.sub(r"[^a-z0-9]+", "-", s["site"].lower()).strip("-")
 
 def sb_cloud(s, st):
     """Cloud project ref + db password + pooler host, from the app's Railway variables and the management API."""
-    vars_ = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
+    vars_ = site_variables(s)
     refs = {m.group(1) for v in vars_.values() if isinstance(v, str) for m in re.finditer(r"https?://([a-z]{20})\.supabase\.co", v)}
     refs |= {v for k, v in vars_.items() if k in ("SUPABASE_DB_REF", "SUPABASE_PROJECT_REF", "SUPABASE_REF") and isinstance(v, str) and re.fullmatch(r"[a-z]{20}", v)}
     ref = s.get("cloud_ref") or st.get("cloud_ref")
@@ -1198,7 +1227,7 @@ def cmd_supabase_stack(args):
     host = f"supabase.{s['site']}"
     log(f"Self-hosted Supabase for {s['site']}: {slug}-supabase, api :{ports['api']}, db :{ports['db']}, pooler :{ports['pooler']}, {ports['subnet']}")
     smtp = cred("RESEND_API_KEY")
-    vars_ = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
+    vars_ = site_variables(s)
     smtp = vars_.get("RESEND_API_KEY") or smtp or ""
     ssh("root", "install -d -m 700 /root/dev2-kit")
     ssh_put(tmpl("supabase-stack.sh"), "/root/dev2-kit/supabase-stack.sh", "0700")
@@ -1259,7 +1288,7 @@ def cmd_supabase_cutover(args):
     s = site(args.site); st = load_state(s["site"])
     for k in ("cloud_ref", "sb_host", "sb_anon_key", "sb_service_key", "sb_database_url", "sb_pg_password"):
         if not st.get(k): die(f"state has no {k}")
-    vars_ = rw_variables(s["project_id"], s["environment_id"], s["service_id"])
+    vars_ = site_variables(s)
     ov = {}
     # Which of the new values are credentials, known by where they came from
     # rather than by the spelling of the key.
diff --git a/dev2/templates/box-tune.sh b/dev2/templates/box-tune.sh
index 9d8aa24..6bceea4 100755
--- a/dev2/templates/box-tune.sh
+++ b/dev2/templates/box-tune.sh
@@ -6,3 +6,10 @@ set -euo pipefail
 f=/etc/ssh/sshd_config.d/00-dev2-fleet.conf
 printf '# managed by cli-tools dev2/templates/box-tune.sh\nMaxStartups 100:30:300\nMaxSessions 100\nLoginGraceTime 60\n' > "$f.tmp"
 if ! cmp -s "$f.tmp" "$f" 2>/dev/null; then mv "$f.tmp" "$f"; sshd -t && systemctl reload ssh 2>/dev/null || systemctl reload sshd; echo "sshd: $(tr '\n' ' ' < "$f" | sed 's/# managed[^M]*//')"; else rm -f "$f.tmp"; echo "sshd: already tuned"; fi
+
+# - inotify: every container's Envoy/Node watchers take an inotify instance; the kernel
+#   default of 128 per uid runs out around 130 containers and Envoy then segfaults with
+#   "assert failure: inotify_fd_ >= 0". Persisted, because a reboot drops a plain sysctl -w.
+s=/etc/sysctl.d/90-dev2-fleet.conf
+printf 'fs.inotify.max_user_instances = 8192\nfs.inotify.max_user_watches = 1048576\nfs.file-max = 2097152\n' > "$s.tmp"
+if ! cmp -s "$s.tmp" "$s" 2>/dev/null; then mv "$s.tmp" "$s"; sysctl -q -p "$s"; echo "sysctl: $(tr '\n' ' ' < "$s")"; else rm -f "$s.tmp"; echo "sysctl: already tuned ($(sysctl -n fs.inotify.max_user_instances) instances)"; fi

From f000a2b14b3d8bd49879e1ba9eef05470ff55aac Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 13:57:15 +0000
Subject: [PATCH 059/104] dev2-site supabase-load --reset: replace an earlier
 load with a fresh dump

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site                  |  4 ++--
 dev2/templates/supabase-load.sh | 13 +++++++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 08f77de..4e38778 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -1266,7 +1266,7 @@ def cmd_supabase_load(args):
         if not st.get(k): die(f"state has no {k}: run supabase-stack and supabase-pull first")
     log(f"Loading {st['sb_dump']} into {st['sb_slug']}-supabase-db")
     ssh_put(tmpl("supabase-load.sh"), "/root/dev2-kit/supabase-load.sh", "0700")
-    res = ssh("root", f"env DUMP={st['sb_dump']} DBC={st['sb_slug']}-supabase-db CLOUD_REF={st['cloud_ref']} NEW_HOST={st['sb_host']} POST_ONLY={'1' if args.post_only else '0'} bash /root/dev2-kit/supabase-load.sh 2>&1", timeout=6 * 3600)
+    res = ssh("root", f"env DUMP={st['sb_dump']} DBC={st['sb_slug']}-supabase-db CLOUD_REF={st['cloud_ref']} NEW_HOST={st['sb_host']} POST_ONLY={'1' if args.post_only else '0'} RESET={'1' if getattr(args, 'reset', False) else '0'} bash /root/dev2-kit/supabase-load.sh 2>&1", timeout=6 * 3600)
     print(res[-6000:])
     mark(s["site"], "supabase-load")
 
@@ -1353,7 +1353,7 @@ def main():
     for name, fn in (("supabase-stack", cmd_supabase_stack), ("supabase-cutover", cmd_supabase_cutover)):
         p = sub.add_parser(name); p.add_argument("site"); p.set_defaults(fn=fn)
     p = sub.add_parser("supabase-pull"); p.add_argument("site"); p.add_argument("--reset-password", action="store_true"); p.set_defaults(fn=cmd_supabase_pull)
-    p = sub.add_parser("supabase-load"); p.add_argument("site"); p.add_argument("--post-only", action="store_true"); p.set_defaults(fn=cmd_supabase_load)
+    p = sub.add_parser("supabase-load"); p.add_argument("site"); p.add_argument("--post-only", action="store_true"); p.add_argument("--reset", action="store_true", help="drop the earlier load first (fresh dump before cutover)"); p.set_defaults(fn=cmd_supabase_load)
     p = sub.add_parser("supabase-storage"); p.add_argument("site"); p.add_argument("--concurrency", type=int, default=8); p.set_defaults(fn=cmd_supabase_storage)
     p = sub.add_parser("retire"); p.add_argument("site"); p.add_argument("--yes", action="store_true"); p.add_argument("--force", action="store_true"); p.set_defaults(fn=cmd_retire)
     args = ap.parse_args()
diff --git a/dev2/templates/supabase-load.sh b/dev2/templates/supabase-load.sh
index 826a200..62469ba 100755
--- a/dev2/templates/supabase-load.sh
+++ b/dev2/templates/supabase-load.sh
@@ -6,6 +6,10 @@
 set -euo pipefail
 : "${DUMP:?}" "${DBC:?}" "${CLOUD_REF:?}" "${NEW_HOST:?}"
 POST_ONLY=${POST_ONLY:-0}
+# RESET=1 drops the app schemas (public and any other non-system schema the dump carries) plus
+# the auth/storage ROWS before loading, so a fresh dump can replace an earlier load without
+# duplicate-key errors. The stack's own auth/storage structure is untouched.
+RESET=${RESET:-0}
 log() { printf '\n===> %s\n' "$*" >&2; }
 die() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
 [ -d "$DUMP" ] || die "no dump at $DUMP"
@@ -17,6 +21,15 @@ docker exec "$DBC" pg_isready -U postgres -h localhost >/dev/null || die "$DBC n
 log "Snapshot BEFORE"
 strict -At -c "select 'tables='||(select count(*) from information_schema.tables where table_schema='public')||' users='||(select count(*) from auth.users)"
 
+if [ "$POST_ONLY" = 0 ] && [ "$RESET" = 1 ]; then
+  log "RESET: dropping app schemas and auth/storage rows from the earlier load"
+  while read -r sch; do [ -n "$sch" ] || continue
+    psql_admin -v ON_ERROR_STOP=1 -c "drop schema if exists \"$sch\" cascade; create schema \"$sch\"; grant usage on schema \"$sch\" to anon, authenticated, service_role; grant all on schema \"$sch\" to postgres" >/dev/null && echo "    dropped+recreated schema $sch"
+  done < "$DUMP/schemas.txt"
+  psql_admin -v ON_ERROR_STOP=1 -c "truncate auth.users cascade" -c "truncate storage.buckets cascade" >/dev/null && echo "    auth.users / storage.buckets truncated"
+  psql_admin -c "select cron.unschedule(jobname) from cron.job" >/dev/null 2>&1 || true
+fi
+
 if [ "$POST_ONLY" = 0 ]; then
   log "Extensions the cloud had"
   while read -r e; do [ -n "$e" ] || continue; case $e in plpgsql|pg_graphql|pgsodium|supabase_vault|pg_stat_statements|pgjwt) continue;; esac

From 9d32dc776aff579e54ae4059d5c2e4daaf9a3570 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 14:07:44 +0000
Subject: [PATCH 060/104] dev2-site: sites.d skip flag; community gardens stays
 on Railway

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site                                      |  2 ++
 dev2/sites.d/communitygardensasappleseeds.info.json |  4 ++++
 dev2/sites.d/sh1pt.com.json                         | 13 +++++++++++++
 dev2/sites.d/smshub.dev.json                        |  9 +++++++++
 dev2/sites.d/ugig.net.json                          |  9 +++++++++
 5 files changed, 37 insertions(+)
 create mode 100644 dev2/sites.d/communitygardensasappleseeds.info.json
 create mode 100644 dev2/sites.d/sh1pt.com.json
 create mode 100644 dev2/sites.d/smshub.dev.json
 create mode 100644 dev2/sites.d/ugig.net.json

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 4e38778..f11b668 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -1129,6 +1129,7 @@ def cmd_merge(args):
 
 def cmd_migrate(args):
     s = site(args.site); st = load_state(s["site"])
+    if s.get("skip"): die(f"{s['site']} is marked skip in sites.d: {s.get('notes', '')}")
     steps = [("scaffold", cmd_scaffold), ("db", cmd_db) if s["db"] == "pg" else None, ("provision", cmd_provision), ("volumes", cmd_volumes),
              ("deploy", cmd_deploy), ("cert", cmd_cert), ("vhost", cmd_vhost), ("verify", cmd_verify),
              ("refresh-db", cmd_refresh_db) if s["db"] == "pg" else None, ("dns", cmd_dns),
@@ -1165,6 +1166,7 @@ def cmd_box_tune(args):
 
 def cmd_retire(args):
     s = site(args.site); st = load_state(s["site"])
+    if s.get("skip"): die(f"{s['site']} is marked skip in sites.d: {s.get('notes', '')}")
     if "verify-public" not in st["steps"] and not args.force: die("site not verified public on dev2; refuse to delete Railway services (or --force)")
     if not args.yes: die("--yes required")
     targets = [{"name": s["service"], "id": s["service_id"]}] + s["companions"] + s["infra"]
diff --git a/dev2/sites.d/communitygardensasappleseeds.info.json b/dev2/sites.d/communitygardensasappleseeds.info.json
new file mode 100644
index 0000000..618b5fc
--- /dev/null
+++ b/dev2/sites.d/communitygardensasappleseeds.info.json
@@ -0,0 +1,4 @@
+{
+ "skip": true,
+ "notes": "Anthony 2026-09-25: stays on Railway (DNS at Cloudflare). Never retire, never migrate."
+}
diff --git a/dev2/sites.d/sh1pt.com.json b/dev2/sites.d/sh1pt.com.json
new file mode 100644
index 0000000..293362a
--- /dev/null
+++ b/dev2/sites.d/sh1pt.com.json
@@ -0,0 +1,13 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.sh1pt.com",
+   "port": 8244,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY"
+ }
+}
diff --git a/dev2/sites.d/smshub.dev.json b/dev2/sites.d/smshub.dev.json
new file mode 100644
index 0000000..d223e5b
--- /dev/null
+++ b/dev2/sites.d/smshub.dev.json
@@ -0,0 +1,9 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.smshub.dev",
+   "port": 8256,
+   "max_body": "512m"
+  }
+ ]
+}
diff --git a/dev2/sites.d/ugig.net.json b/dev2/sites.d/ugig.net.json
new file mode 100644
index 0000000..d4b237c
--- /dev/null
+++ b/dev2/sites.d/ugig.net.json
@@ -0,0 +1,9 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.ugig.net",
+   "port": 8249,
+   "max_body": "512m"
+  }
+ ]
+}

From e08613348aab8a8b475ac9257ba510f7e91e2690 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 14:08:51 +0000
Subject: [PATCH 061/104] dev2-site cert: reuse a fresh certificate only when
 it covers every name

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site               | 6 +++++-
 dev2/sites.d/smshub.dev.json | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index f11b668..7c0ee4e 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -1007,8 +1007,12 @@ def cmd_cert(args):
     # A certificate acme.sh issued in the last day is reused (a retry after a dropped
     # ssh session must not burn Let's Encrypt's duplicate-certificate quota).
     fresh = ssh("root", f"find /root/.acme.sh/{shlex.quote(domains[0])}_ecc -name fullchain.cer -mmin -1440 2>/dev/null | head -n1", check=False).strip()
+    if fresh:  # only if it covers every name we need now (a stack adds supabase.<site> later in the day)
+        sans = ssh("root", f"openssl x509 -in {shlex.quote(fresh)} -noout -ext subjectAltName 2>/dev/null | tr ',' '\\n' | sed -n 's/.*DNS://p'", check=False).split()
+        missing = [d for d in domains if d not in sans]
+        if missing: note(f"fresh certificate lacks {', '.join(missing)}; issuing a new one"); fresh = ""
     if fresh:
-        note("certificate issued within the last day; installing it")
+        note("certificate issued within the last day covers every name; installing it")
     else:
         out = ssh("root", f"install -d -m 0750 {cert_dir} && env HOME=/root PORKBUN_API_KEY={shlex.quote(k)} PORKBUN_SECRET_API_KEY={shlex.quote(sk)} /root/.acme.sh/acme.sh --issue --server letsencrypt --dns dns_porkbun {ds} --force >/tmp/acme-{s['site']}.log 2>&1 || {{ tail -n 25 /tmp/acme-{s['site']}.log; exit 1; }}", check=False, timeout=1800)
         if out.strip() and "Cert success" not in out: die(out)
diff --git a/dev2/sites.d/smshub.dev.json b/dev2/sites.d/smshub.dev.json
index d223e5b..18eaabb 100644
--- a/dev2/sites.d/smshub.dev.json
+++ b/dev2/sites.d/smshub.dev.json
@@ -5,5 +5,9 @@
    "port": 8256,
    "max_body": "512m"
   }
- ]
+ ],
+ "env_overrides": {
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY"
+ }
 }

From a55a52dd3f4c9cd6215fee2023c7b26fa2eaabea Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 14:15:03 +0000
Subject: [PATCH 062/104] dev2: ugig.net onto its own self-hosted Supabase
 stack

Gateway supabase.ugig.net -> :8249; the app's URL, anon/service keys and db
password re-pointed (keys as secret: references, values in credentials.json).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/ugig.net.json | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/dev2/sites.d/ugig.net.json b/dev2/sites.d/ugig.net.json
index d4b237c..964c788 100644
--- a/dev2/sites.d/ugig.net.json
+++ b/dev2/sites.d/ugig.net.json
@@ -5,5 +5,11 @@
    "port": 8249,
    "max_body": "512m"
   }
- ]
+ ],
+ "env_overrides": {
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.ugig.net",
+  "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD",
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY"
+ }
 }

From 5506d7e1e8a85d008a13d83daa3f58eb9b9c93f2 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 14:17:31 +0000
Subject: [PATCH 063/104] dev2: sh1pt.com off Supabase cloud onto its own
 self-hosted stack

supabase.sh1pt.com gateway proxy, NEXT_PUBLIC_SUPABASE_URL re-pointed, keys as
secret references (the app carries sb_publishable/sb_secret keys the cutover
cannot match by value).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/sh1pt.com.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dev2/sites.d/sh1pt.com.json b/dev2/sites.d/sh1pt.com.json
index 293362a..6534fa5 100644
--- a/dev2/sites.d/sh1pt.com.json
+++ b/dev2/sites.d/sh1pt.com.json
@@ -8,6 +8,7 @@
  ],
  "env_overrides": {
   "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
-  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY"
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.sh1pt.com"
  }
 }

From ba3d64ed5bb9243f0276a1b5c0905320b1e7c429 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 14:19:28 +0000
Subject: [PATCH 064/104] dev2: smshub.dev off Supabase cloud onto its own
 self-hosted stack

supabase.smshub.dev gateway proxy, NEXT_PUBLIC_SUPABASE_URL re-pointed, keys as
secret references.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/smshub.dev.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dev2/sites.d/smshub.dev.json b/dev2/sites.d/smshub.dev.json
index 18eaabb..1494586 100644
--- a/dev2/sites.d/smshub.dev.json
+++ b/dev2/sites.d/smshub.dev.json
@@ -8,6 +8,7 @@
  ],
  "env_overrides": {
   "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
-  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY"
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.smshub.dev"
  }
 }

From 25ae321c444bd0cd3428526b30840c93d6c1379e Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 14:23:34 +0000
Subject: [PATCH 065/104] dev2: b1dz.com onto its own self-hosted Supabase
 stack

Gateway supabase.b1dz.com -> :8240; URL, publishable/secret keys and db
password re-pointed (keys as secret: references, values in credentials.json).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/b1dz.com.json | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 dev2/sites.d/b1dz.com.json

diff --git a/dev2/sites.d/b1dz.com.json b/dev2/sites.d/b1dz.com.json
new file mode 100644
index 0000000..94860cb
--- /dev/null
+++ b/dev2/sites.d/b1dz.com.json
@@ -0,0 +1,15 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.b1dz.com",
+   "port": 8240,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY": "secret:NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY",
+  "SUPABASE_SECRET_KEY": "secret:SUPABASE_SECRET_KEY",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.b1dz.com",
+  "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD"
+ }
+}

From 0c2a64442807a3ffc9118196bba14207f48064ce Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 14:25:25 +0000
Subject: [PATCH 066/104] sites.d: keep api.smshub.dev as an alias of the
 smshub Supabase gateway

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/smshub.dev.json | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/dev2/sites.d/smshub.dev.json b/dev2/sites.d/smshub.dev.json
index 1494586..c35cad3 100644
--- a/dev2/sites.d/smshub.dev.json
+++ b/dev2/sites.d/smshub.dev.json
@@ -4,11 +4,17 @@
    "host": "supabase.smshub.dev",
    "port": 8256,
    "max_body": "512m"
+  },
+  {
+   "host": "api.smshub.dev",
+   "port": 8256,
+   "max_body": "512m"
   }
  ],
  "env_overrides": {
   "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
   "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
   "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.smshub.dev"
- }
+ },
+ "notes": "api.smshub.dev was the Railway-hosted Supabase gateway name; kept as an alias of supabase.smshub.dev so old clients keep working."
 }

From bb8d1c277a266a990ce3a0eaf5e073183c55f73b Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 14:25:38 +0000
Subject: [PATCH 067/104] dev2: marksyncr.com off Supabase cloud onto its own
 self-hosted stack

supabase.marksyncr.com gateway proxy; NEXT_PUBLIC_SUPABASE_URL re-pointed,
SUPABASE_JWT_SECRET and the keys as secret references.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/marksyncr.com.json | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 dev2/sites.d/marksyncr.com.json

diff --git a/dev2/sites.d/marksyncr.com.json b/dev2/sites.d/marksyncr.com.json
new file mode 100644
index 0000000..d402f86
--- /dev/null
+++ b/dev2/sites.d/marksyncr.com.json
@@ -0,0 +1,15 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.marksyncr.com",
+   "port": 8260,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.marksyncr.com",
+  "SUPABASE_JWT_SECRET": "secret:SUPABASE_JWT_SECRET"
+ }
+}

From 38e43a9c54f0a73c559fb398e4e413b239200e97 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 14:29:55 +0000
Subject: [PATCH 068/104] dev2: qaaas.dev onto its own self-hosted Supabase
 stack

Gateway supabase.qaaas.dev -> :8266; both URLs, anon/service keys and db
password re-pointed (keys as secret: references, values in credentials.json).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/qaaas.dev.json | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 dev2/sites.d/qaaas.dev.json

diff --git a/dev2/sites.d/qaaas.dev.json b/dev2/sites.d/qaaas.dev.json
new file mode 100644
index 0000000..42f7521
--- /dev/null
+++ b/dev2/sites.d/qaaas.dev.json
@@ -0,0 +1,17 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.qaaas.dev",
+   "port": 8266,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "SUPABASE_ANON_KEY": "secret:SUPABASE_ANON_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD",
+  "SUPABASE_URL": "https://supabase.qaaas.dev",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.qaaas.dev"
+ }
+}

From 52c77ca290c4e901242be15933ed39f5882cf123 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 14:38:36 +0000
Subject: [PATCH 069/104] dev2: qrypt.chat onto its own self-hosted Supabase
 stack

Gateway supabase.qrypt.chat -> :8239; both URL pairs, anon/service keys,
JWT discovery URL and db password re-pointed (secrets as secret: references).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/qrypt.chat.json | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 dev2/sites.d/qrypt.chat.json

diff --git a/dev2/sites.d/qrypt.chat.json b/dev2/sites.d/qrypt.chat.json
new file mode 100644
index 0000000..44eea61
--- /dev/null
+++ b/dev2/sites.d/qrypt.chat.json
@@ -0,0 +1,18 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.qrypt.chat",
+   "port": 8239,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "PUBLIC_SUPABASE_URL": "https://supabase.qrypt.chat",
+  "PUBLIC_SUPABASE_ANON_KEY": "secret:PUBLIC_SUPABASE_ANON_KEY",
+  "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD",
+  "SUPABASE_JWT_DISCOVERY_URL": "https://supabase.qrypt.chat/auth/v1/.well-known/jwks.json",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.qrypt.chat"
+ }
+}

From d94e6a23522c89625cbc8b111b52e1925b84f63f Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 14:43:05 +0000
Subject: [PATCH 070/104] dev2: icemap.app off Supabase cloud onto its own
 self-hosted stack

supabase.icemap.app gateway proxy; SUPABASE_URL re-pointed, the service key as
a secret reference; extensions: postgis so the stack step installs it (the
load's own extension loop never reaches it).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/icemap.app.json | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 dev2/sites.d/icemap.app.json

diff --git a/dev2/sites.d/icemap.app.json b/dev2/sites.d/icemap.app.json
new file mode 100644
index 0000000..ca93013
--- /dev/null
+++ b/dev2/sites.d/icemap.app.json
@@ -0,0 +1,16 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.icemap.app",
+   "port": 8262,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "SUPABASE_URL": "https://supabase.icemap.app"
+ },
+ "extensions": [
+  "postgis"
+ ]
+}

From 2acf153984cc4c852d9feb5e8f6799fafe185e4b Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 14:52:21 +0000
Subject: [PATCH 071/104] dev2: d0rz.com off Supabase cloud onto its own
 self-hosted stack

supabase.d0rz.com gateway proxy; NEXT_PUBLIC_SUPABASE_URL and SUPABASE_URL
re-pointed, keys as secret references.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/d0rz.com.json | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 dev2/sites.d/d0rz.com.json

diff --git a/dev2/sites.d/d0rz.com.json b/dev2/sites.d/d0rz.com.json
new file mode 100644
index 0000000..c9acc2f
--- /dev/null
+++ b/dev2/sites.d/d0rz.com.json
@@ -0,0 +1,15 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.d0rz.com",
+   "port": 8228,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.d0rz.com",
+  "SUPABASE_URL": "https://supabase.d0rz.com"
+ }
+}

From 4fddf03dd636f41ef40eeca21b91a353e54a9359 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 14:57:33 +0000
Subject: [PATCH 072/104] dev2: saasrow.com self-hosted Supabase gateway (stack
 up, app NOT cut over)

The app's backend is 36 Edge Functions called at SUPABASE_URL; none are ported,
so the cutover was rolled back and the app stays on the cloud project. Only the
supabase.saasrow.com proxy entry is kept.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/saasrow.com.json | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 dev2/sites.d/saasrow.com.json

diff --git a/dev2/sites.d/saasrow.com.json b/dev2/sites.d/saasrow.com.json
new file mode 100644
index 0000000..17cecb9
--- /dev/null
+++ b/dev2/sites.d/saasrow.com.json
@@ -0,0 +1,9 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.saasrow.com",
+   "port": 8276,
+   "max_body": "512m"
+  }
+ ]
+}

From 262c37433c8f8791a14f07affc1a8d63457f5917 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:02:21 +0000
Subject: [PATCH 073/104] dev2: postammo.com off Supabase cloud onto its own
 self-hosted stack

supabase.postammo.com gateway proxy; SUPABASE_URL and SUPABASE_JWT_JWKS_URL
re-pointed, the db password and service key as secret references.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/postammo.com.json | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 dev2/sites.d/postammo.com.json

diff --git a/dev2/sites.d/postammo.com.json b/dev2/sites.d/postammo.com.json
new file mode 100644
index 0000000..86531e7
--- /dev/null
+++ b/dev2/sites.d/postammo.com.json
@@ -0,0 +1,15 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.postammo.com",
+   "port": 8246,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD",
+  "SUPABASE_URL": "https://supabase.postammo.com",
+  "SUPABASE_JWT_JWKS_URL": "https://supabase.postammo.com/auth/v1/.well-known/jwks.json"
+ }
+}

From cc5c698fd910de7ee9e5c8b46da600c8b386c165 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:06:37 +0000
Subject: [PATCH 074/104] dev2: logicsrc.com onto its own self-hosted Supabase
 stack

Gateway supabase.logicsrc.com -> :8272; SUPABASE_URL, publishable/secret
keys and db password re-pointed (keys as secret: references).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/logicsrc.com.json | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 dev2/sites.d/logicsrc.com.json

diff --git a/dev2/sites.d/logicsrc.com.json b/dev2/sites.d/logicsrc.com.json
new file mode 100644
index 0000000..358131a
--- /dev/null
+++ b/dev2/sites.d/logicsrc.com.json
@@ -0,0 +1,16 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.logicsrc.com",
+   "port": 8272,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "SUPABASE_ANON_KEY": "secret:SUPABASE_ANON_KEY",
+  "SUPABASE_PUBLISHABLE_KEY": "secret:SUPABASE_PUBLISHABLE_KEY",
+  "SUPABASE_SECRET_KEY": "secret:SUPABASE_SECRET_KEY",
+  "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD",
+  "SUPABASE_URL": "https://supabase.logicsrc.com"
+ }
+}

From 28b576d5ff4503ed303bc43a8b7f79bef43569f1 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:10:34 +0000
Subject: [PATCH 075/104] dev2: weedforcrypto.com off Supabase cloud onto its
 own self-hosted stack

supabase.weedforcrypto.com gateway proxy; NEXT_PUBLIC_SUPABASE_URL re-pointed,
the db password and all four key variables as secret references.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/weedforcrypto.com.json | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 dev2/sites.d/weedforcrypto.com.json

diff --git a/dev2/sites.d/weedforcrypto.com.json b/dev2/sites.d/weedforcrypto.com.json
new file mode 100644
index 0000000..7af8eb2
--- /dev/null
+++ b/dev2/sites.d/weedforcrypto.com.json
@@ -0,0 +1,17 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.weedforcrypto.com",
+   "port": 8243,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY": "secret:NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY",
+  "SUPABASE_SECRET_KEY": "secret:SUPABASE_SECRET_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.weedforcrypto.com"
+ }
+}

From 3c15d0bdaff8cfa432773ce9a6805e0e528d8e48 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:12:28 +0000
Subject: [PATCH 076/104] dev2: infernetprotocol.com onto its own self-hosted
 Supabase stack

Gateway supabase.infernetprotocol.com -> :8227; both URLs, DATABASE_URL and
the publishable/secret keys re-pointed (secrets as secret: references).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/infernetprotocol.com.json | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 dev2/sites.d/infernetprotocol.com.json

diff --git a/dev2/sites.d/infernetprotocol.com.json b/dev2/sites.d/infernetprotocol.com.json
new file mode 100644
index 0000000..a6ca493
--- /dev/null
+++ b/dev2/sites.d/infernetprotocol.com.json
@@ -0,0 +1,16 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.infernetprotocol.com",
+   "port": 8227,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "DATABASE_URL": "secret:DATABASE_URL",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.infernetprotocol.com",
+  "SUPABASE_URL": "https://supabase.infernetprotocol.com"
+ }
+}

From 4186565e4f5633bcc56e106cb6adca4df796a28c Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:21:56 +0000
Subject: [PATCH 077/104] dev2: phonenumbers.bot self-hosted Supabase stack
 staged (cutover after PR #10)

supabase.phonenumbers.bot gateway proxy; SUPABASE_SECRET_KEY as a secret
reference and SUPABASE_URL staged for the app change in
profullstack/phonenumbers.bot#10 (the app still derives its URL from
SUPABASE_DB_REF on master).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/phonenumbers.bot.json | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 dev2/sites.d/phonenumbers.bot.json

diff --git a/dev2/sites.d/phonenumbers.bot.json b/dev2/sites.d/phonenumbers.bot.json
new file mode 100644
index 0000000..fbc15cd
--- /dev/null
+++ b/dev2/sites.d/phonenumbers.bot.json
@@ -0,0 +1,13 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.phonenumbers.bot",
+   "port": 8268,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "SUPABASE_SECRET_KEY": "secret:SUPABASE_SECRET_KEY",
+  "SUPABASE_URL": "https://supabase.phonenumbers.bot"
+ }
+}

From cbd788a494a8c35ff13d074a4f20ffc2b7a4e973 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:23:18 +0000
Subject: [PATCH 078/104] dev2: pairux.com onto its own self-hosted Supabase
 stack

Gateway supabase.pairux.com -> :8274; URL, publishable/secret keys, db
password and the LiveKit recording S3 endpoint/credentials re-pointed at the
stack's own S3 protocol (secrets as secret: references).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/pairux.com.json | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 dev2/sites.d/pairux.com.json

diff --git a/dev2/sites.d/pairux.com.json b/dev2/sites.d/pairux.com.json
new file mode 100644
index 0000000..d52b5f3
--- /dev/null
+++ b/dev2/sites.d/pairux.com.json
@@ -0,0 +1,19 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.pairux.com",
+   "port": 8274,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "SUPABASE_S3_ACCESS_KEY": "secret:SUPABASE_S3_ACCESS_KEY",
+  "SUPABASE_S3_SECRET_KEY": "secret:SUPABASE_S3_SECRET_KEY",
+  "SUPABASE_S3_ENDPOINT": "https://supabase.pairux.com/storage/v1/s3",
+  "SUPABASE_S3_REGION": "stub",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.pairux.com",
+  "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD"
+ }
+}

From d02f59c95b6595eca60a82bd20eefa41806e4c1e Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:24:30 +0000
Subject: [PATCH 079/104] dev2: installer.pairux.com onto pairux.com's
 self-hosted Supabase stack

Shares the cloud project with pairux.com, so it shares the dev2 stack too:
URL, publishable/secret keys and db password re-pointed at supabase.pairux.com
(secrets as secret: references).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/installer.pairux.com.json | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 dev2/sites.d/installer.pairux.com.json

diff --git a/dev2/sites.d/installer.pairux.com.json b/dev2/sites.d/installer.pairux.com.json
new file mode 100644
index 0000000..f1d2f2f
--- /dev/null
+++ b/dev2/sites.d/installer.pairux.com.json
@@ -0,0 +1,8 @@
+{
+ "env_overrides": {
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.pairux.com",
+  "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD"
+ }
+}

From a5d9536d5a8e7032392b4fd1884e96e39c504bbc Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:25:16 +0000
Subject: [PATCH 080/104] dev2: bl0ggers.com off Supabase cloud onto its own
 self-hosted stack

supabase.bl0ggers.com gateway proxy (the wildcard already routes it);
NEXT_PUBLIC_SUPABASE_URL and SUPABASE_URL re-pointed, the db password and the
three key variables as secret references.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/bl0ggers.com.json | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 dev2/sites.d/bl0ggers.com.json

diff --git a/dev2/sites.d/bl0ggers.com.json b/dev2/sites.d/bl0ggers.com.json
new file mode 100644
index 0000000..2d1e080
--- /dev/null
+++ b/dev2/sites.d/bl0ggers.com.json
@@ -0,0 +1,17 @@
+{
+ "proxies": [
+  {
+   "host": "supabase.bl0ggers.com",
+   "port": 8257,
+   "max_body": "512m"
+  }
+ ],
+ "env_overrides": {
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "SUPABASE_ANON_KEY": "secret:SUPABASE_ANON_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.bl0ggers.com",
+  "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD",
+  "SUPABASE_URL": "https://supabase.bl0ggers.com"
+ }
+}

From 3f408e8c7613c65ee8ccc0a8399d2fd25062fec4 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:28:47 +0000
Subject: [PATCH 081/104] dev2: brisk.news onto its own self-hosted Supabase
 stack

Gateway supabase.brisk.news -> :8238; URL and publishable/secret keys
re-pointed (keys as secret: references). Loaded from a fresh dump with
supabase-load --reset right before the cutover.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/brisk.news.json | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dev2/sites.d/brisk.news.json b/dev2/sites.d/brisk.news.json
index 4fe726e..11b2a67 100644
--- a/dev2/sites.d/brisk.news.json
+++ b/dev2/sites.d/brisk.news.json
@@ -5,5 +5,10 @@
    "port": 8238,
    "max_body": "512m"
   }
- ]
+ ],
+ "env_overrides": {
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.brisk.news"
+ }
 }

From 03cb3d6f115b1b431defd833e4e9850c0bf7d4a1 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:30:24 +0000
Subject: [PATCH 082/104] supabase-load/pull: count psql-prefixed errors, stop
 docker exec eating loop input, grant functions by signature

- load: 'psql -f /dev/stdin' prefixes messages with psql:/dev/stdin:N:, so the
  error counts were always 0; count and list them properly.
- load: the schemas/extensions/buckets loops read from fd 3 -- the docker exec -i
  in the body swallowed the rest of stdin, so only the first entry ran (PostGIS
  was never created for icemap).
- pull: function grants were emitted without 'function' and without the
  signature, so all of them failed; emit them from pg_proc with regprocedure,
  and revoke PUBLIC where the cloud had done so.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/phonenumbers.bot.json |  4 +++-
 dev2/templates/supabase-load.sh    | 21 ++++++++++++---------
 dev2/templates/supabase-pull.sh    |  5 ++++-
 3 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/dev2/sites.d/phonenumbers.bot.json b/dev2/sites.d/phonenumbers.bot.json
index fbc15cd..5768e42 100644
--- a/dev2/sites.d/phonenumbers.bot.json
+++ b/dev2/sites.d/phonenumbers.bot.json
@@ -8,6 +8,8 @@
  ],
  "env_overrides": {
   "SUPABASE_SECRET_KEY": "secret:SUPABASE_SECRET_KEY",
-  "SUPABASE_URL": "https://supabase.phonenumbers.bot"
+  "SUPABASE_URL": "https://supabase.phonenumbers.bot",
+  "SUPABAsE_URL": "https://supabase.phonenumbers.bot",
+  "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD"
  }
 }
diff --git a/dev2/templates/supabase-load.sh b/dev2/templates/supabase-load.sh
index 62469ba..d16680b 100755
--- a/dev2/templates/supabase-load.sh
+++ b/dev2/templates/supabase-load.sh
@@ -16,6 +16,9 @@ die() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
 psql_db() { docker exec -i "$DBC" psql -U postgres -h localhost -d postgres -X "$@"; }
 psql_admin() { docker exec -i "$DBC" psql -U supabase_admin -h localhost -d postgres -X "$@"; }
 strict() { psql_db -v ON_ERROR_STOP=1 "$@"; }
+# psql -f /dev/stdin prefixes every message with "psql:/dev/stdin:N: ", so match ERROR after that too.
+nerr() { grep -cE '^(psql:[^ ]*:[0-9]+: )?ERROR' "$1" 2>/dev/null || true; }
+lerr() { grep -E '^(psql:[^ ]*:[0-9]+: )?ERROR' "$1" 2>/dev/null | sed -E 's/^psql:[^ ]*:[0-9]+: //' | sort | uniq -c | sort -rn | head -15 | sed 's/^/    /' || true; }
 docker exec "$DBC" pg_isready -U postgres -h localhost >/dev/null || die "$DBC not ready"
 
 log "Snapshot BEFORE"
@@ -23,29 +26,29 @@ strict -At -c "select 'tables='||(select count(*) from information_schema.tables
 
 if [ "$POST_ONLY" = 0 ] && [ "$RESET" = 1 ]; then
   log "RESET: dropping app schemas and auth/storage rows from the earlier load"
-  while read -r sch; do [ -n "$sch" ] || continue
+  while read -r sch <&3; do [ -n "$sch" ] || continue
     psql_admin -v ON_ERROR_STOP=1 -c "drop schema if exists \"$sch\" cascade; create schema \"$sch\"; grant usage on schema \"$sch\" to anon, authenticated, service_role; grant all on schema \"$sch\" to postgres" >/dev/null && echo "    dropped+recreated schema $sch"
-  done < "$DUMP/schemas.txt"
+  done 3< "$DUMP/schemas.txt"
   psql_admin -v ON_ERROR_STOP=1 -c "truncate auth.users cascade" -c "truncate storage.buckets cascade" >/dev/null && echo "    auth.users / storage.buckets truncated"
   psql_admin -c "select cron.unschedule(jobname) from cron.job" >/dev/null 2>&1 || true
 fi
 
 if [ "$POST_ONLY" = 0 ]; then
   log "Extensions the cloud had"
-  while read -r e; do [ -n "$e" ] || continue; case $e in plpgsql|pg_graphql|pgsodium|supabase_vault|pg_stat_statements|pgjwt) continue;; esac
-    psql_admin -v ON_ERROR_STOP=1 -c "create extension if not exists \"$e\" cascade" >/dev/null 2>&1 && echo "    $e" || echo "    $e: NOT AVAILABLE (dump may fail on objects using it)"; done < "$DUMP/extensions.txt"
+  while read -r e <&3; do [ -n "$e" ] || continue; case $e in plpgsql|pg_graphql|pgsodium|supabase_vault|pg_stat_statements|pgjwt) continue;; esac
+    psql_admin -v ON_ERROR_STOP=1 -c "create extension if not exists \"$e\" cascade" >/dev/null 2>&1 && echo "    $e" || echo "    $e: NOT AVAILABLE (dump may fail on objects using it)"; done 3< "$DUMP/extensions.txt"
   log "Schema"
   grep -qE 'CREATE SCHEMA "?(auth|storage)"?' "$DUMP/schema.sql" && die "schema.sql contains auth/storage DDL"
   psql_admin -f /dev/stdin < "$DUMP/schema.sql" > "$DUMP/schema.load.log" 2>&1 || true
-  echo "    schema errors: $(grep -c '^ERROR' "$DUMP/schema.load.log" || true)"; grep '^ERROR' "$DUMP/schema.load.log" | sort | uniq -c | sort -rn | head -15 | sed 's/^/    /' || true
+  echo "    schema errors: $(nerr "$DUMP/schema.load.log")"; lerr "$DUMP/schema.load.log"
   log "Data (auth before app schemas)"
   a=$(grep -m1 -n 'COPY "auth"' "$DUMP/data.sql" | cut -d: -f1 || echo 0); p=$(grep -m1 -n 'COPY "public"' "$DUMP/data.sql" | cut -d: -f1 || echo 0); a=${a:-0}; p=${p:-0}
   if [ "$a" -gt 0 ] && [ "$p" -gt 0 ] && [ "$a" -gt "$p" ]; then die "data.sql has public before auth"; fi
   psql_admin -f /dev/stdin < "$DUMP/data.sql" > "$DUMP/data.load.log" 2>&1 || true
-  echo "    data errors: $(grep -c '^ERROR' "$DUMP/data.load.log" || true)"; grep '^ERROR' "$DUMP/data.load.log" | sort | uniq -c | sort -rn | head -15 | sed 's/^/    /' || true
+  echo "    data errors: $(nerr "$DUMP/data.load.log")"; lerr "$DUMP/data.load.log"
   log "Grants for anon/authenticated/service_role"
   psql_admin -f /dev/stdin < "$DUMP/grants.sql" > "$DUMP/grants.load.log" 2>&1 || true
-  echo "    grant errors: $(grep -c '^ERROR' "$DUMP/grants.load.log" || true)"
+  echo "    grant errors: $(nerr "$DUMP/grants.load.log")"; lerr "$DUMP/grants.load.log"
   log "Ownership: app schemas to postgres (they were created by supabase_admin)"
   psql_admin -At -v ON_ERROR_STOP=1 <<'SQL'
 do $$ declare r record; begin
@@ -60,8 +63,8 @@ SQL
 fi
 
 log "Buckets"
-while IFS=$'\t' read -r id name pub limit mimes; do [ -n "$id" ] || continue; case "$pub" in t|true) ps=true;; *) ps=false;; esac
-  strict -c "insert into storage.buckets (id, name, public) values ('$id','$name',$ps) on conflict (id) do update set public=excluded.public" >/dev/null; done < "$DUMP/buckets.tsv"
+while IFS=$'\t' read -r id name pub limit mimes <&3; do [ -n "$id" ] || continue; case "$pub" in t|true) ps=true;; *) ps=false;; esac
+  strict -c "insert into storage.buckets (id, name, public) values ('$id','$name',$ps) on conflict (id) do update set public=excluded.public" >/dev/null; done 3< "$DUMP/buckets.tsv"
 
 log "Rewriting absolute https://$CLOUD_REF.supabase.co URLs to https://$NEW_HOST in every text/json column"
 strict -At <<SQL
diff --git a/dev2/templates/supabase-pull.sh b/dev2/templates/supabase-pull.sh
index 0fb0886..d37e3d3 100755
--- a/dev2/templates/supabase-pull.sh
+++ b/dev2/templates/supabase-pull.sh
@@ -33,7 +33,10 @@ pg pg_dump --dbname="$CLOUD_DB_URL" --data-only --no-owner --no-privileges --quo
 
 log "Grants and RLS policies (the schema dump drops privileges; PostgREST needs them back)"
 psqlc -c "select 'grant '||privilege_type||' on '||quote_ident(table_schema)||'.'||quote_ident(table_name)||' to '||quote_ident(grantee)||';' from information_schema.role_table_grants where grantee in ('anon','authenticated','service_role') and table_schema not in ($SYS) order by 1" > "$OUT/grants.sql"
-psqlc -c "select 'grant '||privilege_type||' on '||quote_ident(routine_schema)||'.'||quote_ident(routine_name)||' to '||quote_ident(grantee)||';' from information_schema.role_routine_grants where grantee in ('anon','authenticated','service_role') and routine_schema not in ($SYS) order by 1" >> "$OUT/grants.sql" || true
+# Functions: "grant execute on function schema.name(argtypes)" -- routine_name alone is a relation to psql, so every
+# grant failed before. A function with no PUBLIC execute on the cloud was locked down on purpose: revoke PUBLIC there too.
+psqlc -c "select 'revoke execute on function '||p.oid::regprocedure::text||' from public;' from pg_proc p join pg_namespace n on n.oid=p.pronamespace where n.nspname not in ($SYS) and n.nspname not like 'pg_%' and p.prokind in ('f','p') and p.proacl is not null and not exists (select 1 from aclexplode(p.proacl) a where a.grantee=0 and a.privilege_type='EXECUTE') order by 1" >> "$OUT/grants.sql" || true
+psqlc -c "select 'grant execute on function '||p.oid::regprocedure::text||' to '||quote_ident(r.rolname)||';' from pg_proc p join pg_namespace n on n.oid=p.pronamespace join aclexplode(p.proacl) a on true join pg_roles r on r.oid=a.grantee where n.nspname not in ($SYS) and n.nspname not like 'pg_%' and p.prokind in ('f','p') and a.privilege_type='EXECUTE' and r.rolname in ('anon','authenticated','service_role') order by 1" >> "$OUT/grants.sql" || true
 psqlc -c "select 'grant usage, select on all sequences in schema '||quote_ident(nspname)||' to anon, authenticated, service_role;' from pg_namespace where nspname not in ($SYS) and nspname not like 'pg_%'" >> "$OUT/grants.sql"
 
 log "pg_cron jobs"

From 0cea1ee429f03620fdf004da60e3147a6dd5723b Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:42:50 +0000
Subject: [PATCH 083/104] dev2: coinpayportal.com self-hosted Supabase gateway
 (stack up, app NOT cut over)

supabase.coinpayportal.com -> :8273. The load lost public.payments (3405 rows)
to a NOT VALID check constraint the dump re-creates as enforced, so the
cutover is on hold until supabase-load handles NOT VALID constraints.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/coinpayportal.com.json | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/dev2/sites.d/coinpayportal.com.json b/dev2/sites.d/coinpayportal.com.json
index 8114183..82af887 100644
--- a/dev2/sites.d/coinpayportal.com.json
+++ b/dev2/sites.d/coinpayportal.com.json
@@ -1 +1,10 @@
-{ "health_path": "/api/health" }
+{
+ "health_path": "/api/health",
+ "proxies": [
+  {
+   "host": "supabase.coinpayportal.com",
+   "port": 8273,
+   "max_body": "512m"
+  }
+ ]
+}

From 0148c32cf646dff858609c0353938f0c8ceceb5a Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:50:11 +0000
Subject: [PATCH 084/104] dev2-site supabase: new-style keys, Edge Functions
 step, NOT VALID constraints, vault, S3 host, bucket limits

- cutover maps sb_publishable_/sb_secret_ keys onto the stack's anon/service
  JWTs (they were never re-pointed before), rewrites <ref>.storage.supabase.co
  and swaps in the stack's S3 protocol credentials, and refuses to run while
  the cloud project still has Edge Functions the stack lacks.
- new supabase-functions: ports supabase/functions/* from the checkout onto the
  stack's edge runtime, copies the cloud function secrets into
  volumes/functions/secrets.env (env_file on the functions service), probes one.
- pull dumps NOT VALID check/fk constraints; load drops them before COPY and
  re-adds them NOT VALID after (coinpayportal's payments table failed on one).
- pull dumps vault secrets, load recreates them; buckets keep file_size_limit
  and allowed_mime_types; storage FILE_SIZE_LIMIT raised to 5 GiB.
- cron commands get the cloud URL and API keys rewritten before scheduling;
  the cloud cron probe no longer parses cron.job when pg_cron is absent.
- transient auth.one_time_tokens / auth.scim_* excluded from the data dump.
- stack no longer chowns an existing site root to root (CI deploys broke).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site                   | 69 +++++++++++++++++++++++++++++---
 dev2/templates/supabase-load.sh  | 21 +++++++++-
 dev2/templates/supabase-pull.sh  | 11 ++++-
 dev2/templates/supabase-stack.sh |  6 ++-
 4 files changed, 97 insertions(+), 10 deletions(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 7c0ee4e..1eae436 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -1217,10 +1217,14 @@ def sb_cloud(s, st):
     pooler = sb_api(f"projects/{ref}/config/database/pooler")
     prim = next((p for p in pooler if p.get("database_type") == "PRIMARY"), pooler[0])
     host = prim["db_host"]
-    keys = {k["id"]: k["api_key"] for k in sb_api(f"projects/{ref}/api-keys?reveal=true") if k.get("type") == "legacy"}
+    allk = sb_api(f"projects/{ref}/api-keys?reveal=true")
+    keys = {k["id"]: k["api_key"] for k in allk if k.get("type") == "legacy"}
     import urllib.parse as up
     url = f"postgres://postgres.{ref}:{up.quote(pw, safe='')}@{host}:5432/postgres"
-    st.update({"cloud_ref": ref, "cloud_db_password": pw, "cloud_db_url": url, "cloud_anon_key": keys.get("anon"), "cloud_service_key": keys.get("service_role")})
+    st.update({"cloud_ref": ref, "cloud_db_password": pw, "cloud_db_url": url, "cloud_anon_key": keys.get("anon"), "cloud_service_key": keys.get("service_role"),
+               # new-style keys (sb_publishable_/sb_secret_): the cutover maps them onto the stack's anon/service JWTs
+               "cloud_publishable_keys": [k["api_key"] for k in allk if k.get("type") == "publishable" and k.get("api_key")],
+               "cloud_secret_keys": [k["api_key"] for k in allk if k.get("type") == "secret" and k.get("api_key")]})
     save_state(s["site"], st)
     return vars_
 
@@ -1272,7 +1276,8 @@ def cmd_supabase_load(args):
         if not st.get(k): die(f"state has no {k}: run supabase-stack and supabase-pull first")
     log(f"Loading {st['sb_dump']} into {st['sb_slug']}-supabase-db")
     ssh_put(tmpl("supabase-load.sh"), "/root/dev2-kit/supabase-load.sh", "0700")
-    res = ssh("root", f"env DUMP={st['sb_dump']} DBC={st['sb_slug']}-supabase-db CLOUD_REF={st['cloud_ref']} NEW_HOST={st['sb_host']} POST_ONLY={'1' if args.post_only else '0'} RESET={'1' if getattr(args, 'reset', False) else '0'} bash /root/dev2-kit/supabase-load.sh 2>&1", timeout=6 * 3600)
+    keyenv = " ".join(f"{k}={shlex.quote(st.get(v) or '')}" for k, v in (("CLOUD_ANON_KEY", "cloud_anon_key"), ("CLOUD_SERVICE_KEY", "cloud_service_key"), ("SELF_ANON_KEY", "sb_anon_key"), ("SELF_SERVICE_KEY", "sb_service_key")))
+    res = ssh("root", f"env {keyenv} DUMP={st['sb_dump']} DBC={st['sb_slug']}-supabase-db CLOUD_REF={st['cloud_ref']} NEW_HOST={st['sb_host']} POST_ONLY={'1' if args.post_only else '0'} RESET={'1' if getattr(args, 'reset', False) else '0'} bash /root/dev2-kit/supabase-load.sh 2>&1", timeout=6 * 3600)
     print(res[-6000:])
     mark(s["site"], "supabase-load")
 
@@ -1295,22 +1300,37 @@ def cmd_supabase_cutover(args):
     for k in ("cloud_ref", "sb_host", "sb_anon_key", "sb_service_key", "sb_database_url", "sb_pg_password"):
         if not st.get(k): die(f"state has no {k}")
     vars_ = site_variables(s)
+    # An app whose backend is Edge Functions 500s the moment it points at a stack without them (saasrow).
+    if "supabase-functions" not in st["steps"]:
+        try: fns = [f.get("slug") or f.get("name") for f in sb_api(f"projects/{st['cloud_ref']}/functions")]
+        except Exception: fns = []
+        if fns: die(f"cloud project has {len(fns)} Edge Functions ({', '.join(fns[:8])}{'...' if len(fns) > 8 else ''}); run `dev2-site supabase-functions {s['site']}` first")
     ov = {}
     # Which of the new values are credentials, known by where they came from
     # rather than by the spelling of the key.
-    secret = set()
+    secret = set(); s3 = False
     for k, v in vars_.items():
         if not isinstance(v, str): continue
         nv = v
+        if f"{st['cloud_ref']}.storage.supabase.co" in nv:  # S3-protocol endpoint (LiveKit egress etc.)
+            nv = nv.replace(f"{st['cloud_ref']}.storage.supabase.co", st["sb_host"]); s3 = True
         if f"{st['cloud_ref']}.supabase.co" in nv:
             nv = re.sub(rf"https?://{st['cloud_ref']}\.supabase\.co", f"https://{st['sb_host']}", nv).replace(f"{st['cloud_ref']}.supabase.co", st["sb_host"])
             if nv.startswith("postgres"): nv = st["sb_database_url"]; secret.add(k)
         if st.get("cloud_anon_key") and v == st["cloud_anon_key"]: nv = st["sb_anon_key"]; secret.add(k)
         if st.get("cloud_service_key") and v == st["cloud_service_key"]: nv = st["sb_service_key"]; secret.add(k)
+        if v in (st.get("cloud_publishable_keys") or []): nv = st["sb_anon_key"]; secret.add(k)
+        if v in (st.get("cloud_secret_keys") or []): nv = st["sb_service_key"]; secret.add(k)
         if k == "SUPABASE_DB_PASSWORD": nv = st["sb_pg_password"]; secret.add(k)
         if k in ("SUPABASE_JWT_SECRET", "JWT_SECRET") and st.get("sb_jwt_secret") and len(v) > 20: nv = st["sb_jwt_secret"]; secret.add(k)
         if k in ("SUPABASE_DB_REF", "SUPABASE_PROJECT_REF") and v == st["cloud_ref"]: warn(f"{k}={v}: the app derives URLs from the ref; it needs a code change to use SUPABASE_URL")
         if nv != v: ov[k] = nv
+    if s3:  # the S3 protocol has its own per-stack credentials
+        s3env = dict(l.split("=", 1) for l in ssh("root", f"grep -E '^S3_PROTOCOL_ACCESS_KEY_(ID|SECRET)=' {WWW}/{s['site']}/supabase/.env", check=False).splitlines() if "=" in l)
+        for k in vars_:
+            if re.search(r"S3.*(ACCESS_)?KEY_ID$", k) and s3env.get("S3_PROTOCOL_ACCESS_KEY_ID"): ov[k] = s3env["S3_PROTOCOL_ACCESS_KEY_ID"]; secret.add(k)
+            elif re.search(r"S3.*SECRET", k) and s3env.get("S3_PROTOCOL_ACCESS_KEY_SECRET"): ov[k] = s3env["S3_PROTOCOL_ACCESS_KEY_SECRET"]; secret.add(k)
+        note(f"S3 endpoint re-pointed; stack S3 credentials: {', '.join(k for k in ov if 'S3' in k) or 'NONE FOUND (set them by hand)'}")
     sd_path = os.path.join(SITES_D, f"{s['site']}.json")
     sd = json.load(open(sd_path)) if os.path.exists(sd_path) else {}
     env_ov, vaulted = dict(sd.get("env_overrides") or {}), []
@@ -1328,7 +1348,8 @@ def cmd_supabase_cutover(args):
     cmd_verify(argparse.Namespace(site=s["site"], public=("dns" in load_state(s["site"])["steps"])))
     if st.get("cloud_db_url"):
         log("Unscheduling the CLOUD project's cron jobs")
-        out = ssh("root", f"docker run --rm -i --network host postgres:17 psql {shlex.quote(st['cloud_db_url'])} -At -X -c \"select case when to_regclass('cron.job') is null then 'no pg_cron' else (select coalesce(string_agg(jobname, ', '), 'none') from cron.job where active) end\" 2>&1 | tail -n 3", check=False).strip()
+        has = ssh("root", f"docker run --rm -i --network host postgres:17 psql {shlex.quote(st['cloud_db_url'])} -At -X -c \"select to_regclass('cron.job') is not null\" 2>&1 | tail -n 1", check=False).strip()
+        out = "no pg_cron" if has != "t" else ssh("root", f"docker run --rm -i --network host postgres:17 psql {shlex.quote(st['cloud_db_url'])} -At -X -c \"select coalesce(string_agg(jobname, ', '), 'none') from cron.job where active\" 2>&1 | tail -n 1", check=False).strip()
         if out and out not in ("no pg_cron", "none"):
             ssh("root", f"docker run --rm -i --network host postgres:17 psql {shlex.quote(st['cloud_db_url'])} -At -X -c \"select cron.unschedule(jobname) from cron.job where active\" >/dev/null 2>&1", check=False)
             note(f"unscheduled: {out}")
@@ -1336,6 +1357,42 @@ def cmd_supabase_cutover(args):
     mark(s["site"], "supabase-cutover")
     log(f"{s['site']} now runs on its own Supabase. Cloud project {st['cloud_ref']} stays until `retire` (delete it in the dashboard or with the management API).")
 
+def cmd_supabase_functions(args):
+    """Port the repo's supabase/functions/* onto the stack's edge runtime and copy the cloud
+    project's function secrets. The self-hosted `functions` service serves /functions/v1/<name>
+    from volumes/functions/<name>/index.ts (its `main` router); workers inherit the container env."""
+    import base64, io, tarfile
+    s = site(args.site); st = load_state(s["site"])
+    for k in ("sb_slug", "sb_ports"):
+        if not st.get(k): die(f"state has no {k}; run supabase-stack first")
+    src = os.path.join(st.get("checkout") or "", "supabase", "functions")
+    if not os.path.isdir(src): die(f"no {src}; the app keeps its Edge Functions elsewhere (set `checkout` or port by hand)")
+    names = sorted(d for d in os.listdir(src) if os.path.isdir(os.path.join(src, d)) and not d.startswith(".") and d not in ("node_modules", "main"))
+    buf = io.BytesIO()
+    with tarfile.open(fileobj=buf, mode="w:gz") as tar:
+        for d in names + [d for d in os.listdir(src) if os.path.isfile(os.path.join(src, d))]:
+            tar.add(os.path.join(src, d), arcname=d, filter=lambda ti: None if "/node_modules/" in ti.name or ti.name.endswith((".env", ".env.local")) else ti)
+    fdir = f"{WWW}/{s['site']}/supabase/volumes/functions"
+    log(f"Edge Functions -> {fdir}: {', '.join(n for n in names if not n.startswith('_'))}")
+    ssh("root", f"mkdir -p {fdir} && base64 -d | tar -xzf - -C {fdir} && chmod -R a+rX {fdir}", input=base64.b64encode(buf.getvalue()).decode())
+    # Function secrets: everything the cloud had except the SUPABASE_* the stack injects itself.
+    secrets = {}
+    if st.get("cloud_ref"):
+        try: secrets = {x["name"]: x["value"] for x in sb_api(f"projects/{st['cloud_ref']}/secrets") if not x["name"].startswith("SUPABASE_")}
+        except Exception as e: warn(f"could not read cloud function secrets: {e}")
+    ssh_put("".join(f"{k}={v}\n" for k, v in sorted(secrets.items())), f"{fdir}/secrets.env", "0600")
+    note(f"{len(secrets)} function secrets written to secrets.env: {', '.join(sorted(secrets)) or '-'}")
+    # Older overlays predate the env_file line; add it, then restart the runtime.
+    ov = f"{WWW}/{s['site']}/supabase/docker-compose.{st['sb_slug']}.yml"
+    ssh("root", f"grep -q 'functions/secrets.env' {ov} || sed -i '/^  functions:$/a\\    env_file:\\n      - .env\\n      - ./volumes/functions/secrets.env' {ov}; cd {WWW}/{s['site']}/supabase && docker compose up -d --force-recreate functions >/dev/null 2>&1; sleep 4; docker logs --tail 5 {st['sb_slug']}-supabase-functions 2>&1 | tail -n 3")
+    probe = next((n for n in names if not n.startswith("_")), None)
+    if probe:
+        code = ssh("root", f"curl -s -o /dev/null -w '%{{http_code}}' -m 20 -H 'Authorization: Bearer {st.get('sb_anon_key', '')}' -H 'apikey: {st.get('sb_anon_key', '')}' -X OPTIONS http://127.0.0.1:{st['sb_ports']['api']}/functions/v1/{probe}", check=False).strip()
+        body = ssh("root", f"curl -s -m 20 -H 'Authorization: Bearer {st.get('sb_anon_key', '')}' -H 'apikey: {st.get('sb_anon_key', '')}' http://127.0.0.1:{st['sb_ports']['api']}/functions/v1/{probe} | head -c 200", check=False)
+        if "InvalidWorkerCreation" in body or "entrypoint" in body: die(f"/functions/v1/{probe} still fails: {body}")
+        note(f"/functions/v1/{probe}: OPTIONS {code}, GET -> {body[:120]!r}")
+    mark(s["site"], "supabase-functions", functions=names)
+
 # ----------------------------------------------------------------- main
 
 def main():
@@ -1356,7 +1413,7 @@ def main():
     p = sub.add_parser("verify"); p.add_argument("site"); p.add_argument("--public", action="store_true"); p.add_argument("--ignore-logs", action="store_true"); p.set_defaults(fn=cmd_verify)
     p = sub.add_parser("refresh-db"); p.add_argument("site"); p.set_defaults(fn=cmd_refresh_db)
     p = sub.add_parser("migrate"); p.add_argument("site"); p.add_argument("--yes", action="store_true"); p.add_argument("--redo", action="store_true"); p.set_defaults(fn=cmd_migrate)
-    for name, fn in (("supabase-stack", cmd_supabase_stack), ("supabase-cutover", cmd_supabase_cutover)):
+    for name, fn in (("supabase-stack", cmd_supabase_stack), ("supabase-cutover", cmd_supabase_cutover), ("supabase-functions", cmd_supabase_functions)):
         p = sub.add_parser(name); p.add_argument("site"); p.set_defaults(fn=fn)
     p = sub.add_parser("supabase-pull"); p.add_argument("site"); p.add_argument("--reset-password", action="store_true"); p.set_defaults(fn=cmd_supabase_pull)
     p = sub.add_parser("supabase-load"); p.add_argument("site"); p.add_argument("--post-only", action="store_true"); p.add_argument("--reset", action="store_true", help="drop the earlier load first (fresh dump before cutover)"); p.set_defaults(fn=cmd_supabase_load)
diff --git a/dev2/templates/supabase-load.sh b/dev2/templates/supabase-load.sh
index d16680b..b1d12e9 100755
--- a/dev2/templates/supabase-load.sh
+++ b/dev2/templates/supabase-load.sh
@@ -41,6 +41,10 @@ if [ "$POST_ONLY" = 0 ]; then
   grep -qE 'CREATE SCHEMA "?(auth|storage)"?' "$DUMP/schema.sql" && die "schema.sql contains auth/storage DDL"
   psql_admin -f /dev/stdin < "$DUMP/schema.sql" > "$DUMP/schema.load.log" 2>&1 || true
   echo "    schema errors: $(nerr "$DUMP/schema.load.log")"; lerr "$DUMP/schema.load.log"
+  if [ -s "$DUMP/notvalid-drop.sql" ]; then
+    log "Dropping the cloud's NOT VALID constraints before data (COPY enforces them; re-added NOT VALID after)"
+    psql_admin -f /dev/stdin < "$DUMP/notvalid-drop.sql" > "$DUMP/notvalid-drop.log" 2>&1 || true; echo "    dropped $(grep -c '^ALTER' "$DUMP/notvalid-drop.log" || true), errors $(nerr "$DUMP/notvalid-drop.log")"
+  fi
   log "Data (auth before app schemas)"
   a=$(grep -m1 -n 'COPY "auth"' "$DUMP/data.sql" | cut -d: -f1 || echo 0); p=$(grep -m1 -n 'COPY "public"' "$DUMP/data.sql" | cut -d: -f1 || echo 0); a=${a:-0}; p=${p:-0}
   if [ "$a" -gt 0 ] && [ "$p" -gt 0 ] && [ "$a" -gt "$p" ]; then die "data.sql has public before auth"; fi
@@ -49,6 +53,15 @@ if [ "$POST_ONLY" = 0 ]; then
   log "Grants for anon/authenticated/service_role"
   psql_admin -f /dev/stdin < "$DUMP/grants.sql" > "$DUMP/grants.load.log" 2>&1 || true
   echo "    grant errors: $(nerr "$DUMP/grants.load.log")"; lerr "$DUMP/grants.load.log"
+  if [ -s "$DUMP/notvalid-add.sql" ]; then
+    psql_admin -f /dev/stdin < "$DUMP/notvalid-add.sql" > "$DUMP/notvalid-add.log" 2>&1 || true; echo "    NOT VALID constraints re-added: $(grep -c '^ALTER' "$DUMP/notvalid-add.log" || true), errors $(nerr "$DUMP/notvalid-add.log")"; lerr "$DUMP/notvalid-add.log"
+  fi
+  if [ -s "$DUMP/vault.tsv" ]; then
+    log "Vault secrets"
+    psql_admin -c "create extension if not exists supabase_vault cascade" >/dev/null 2>&1 || true
+    while IFS=$'\t' read -r vn vs vd <&3; do [ -n "$vn" ] || continue
+      psql_admin -v n="$vn" -v s="$vs" -v d="$vd" -At -c "select vault.create_secret(:'s', :'n', :'d') where not exists (select 1 from vault.secrets where name = :'n')" >/dev/null && echo "    $vn" || echo "    $vn: FAILED"; done 3< "$DUMP/vault.tsv"
+  fi
   log "Ownership: app schemas to postgres (they were created by supabase_admin)"
   psql_admin -At -v ON_ERROR_STOP=1 <<'SQL'
 do $$ declare r record; begin
@@ -64,7 +77,7 @@ fi
 
 log "Buckets"
 while IFS=$'\t' read -r id name pub limit mimes <&3; do [ -n "$id" ] || continue; case "$pub" in t|true) ps=true;; *) ps=false;; esac
-  strict -c "insert into storage.buckets (id, name, public) values ('$id','$name',$ps) on conflict (id) do update set public=excluded.public" >/dev/null; done 3< "$DUMP/buckets.tsv"
+  strict -c "insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types) values ('$id','$name',$ps, nullif('$limit','')::bigint, case when '$mimes' = '' then null else string_to_array('$mimes', ',') end) on conflict (id) do update set public=excluded.public, file_size_limit=excluded.file_size_limit, allowed_mime_types=excluded.allowed_mime_types" >/dev/null; done 3< "$DUMP/buckets.tsv"
 
 log "Rewriting absolute https://$CLOUD_REF.supabase.co URLs to https://$NEW_HOST in every text/json column"
 strict -At <<SQL
@@ -83,7 +96,11 @@ do \$\$ declare r record; n bigint; total bigint := 0; begin
 SQL
 
 log "Realtime publication"; psql_db -f /dev/stdin < "$DUMP/realtime.sql" 2>&1 | sed 's/^/    /' || true
-log "pg_cron jobs"; psql_db -f /dev/stdin < "$DUMP/cron-jobs.sql" > "$DUMP/cron.load.log" 2>&1 || true
+log "pg_cron jobs (cloud URL and API keys inside the commands rewritten to this stack)"
+sedargs=(-e "s#https://$CLOUD_REF.supabase.co#https://$NEW_HOST#g" -e "s#$CLOUD_REF.supabase.co#$NEW_HOST#g")
+[ -n "${CLOUD_ANON_KEY:-}" ] && [ -n "${SELF_ANON_KEY:-}" ] && sedargs+=(-e "s#$CLOUD_ANON_KEY#$SELF_ANON_KEY#g")
+[ -n "${CLOUD_SERVICE_KEY:-}" ] && [ -n "${SELF_SERVICE_KEY:-}" ] && sedargs+=(-e "s#$CLOUD_SERVICE_KEY#$SELF_SERVICE_KEY#g")
+sed "${sedargs[@]}" "$DUMP/cron-jobs.sql" | psql_db -f /dev/stdin > "$DUMP/cron.load.log" 2>&1 || true
 strict -At -c "select count(*)||' cron jobs active' from cron.job where active" 2>/dev/null || true
 
 log "Snapshot AFTER (vs the cloud's estimates in counts-estimate.tsv)"
diff --git a/dev2/templates/supabase-pull.sh b/dev2/templates/supabase-pull.sh
index d37e3d3..8bce031 100755
--- a/dev2/templates/supabase-pull.sh
+++ b/dev2/templates/supabase-pull.sh
@@ -28,7 +28,7 @@ log "Data (auth + app schemas + storage buckets)"
 pg pg_dump --dbname="$CLOUD_DB_URL" --data-only --no-owner --no-privileges --quote-all-identifiers --disable-triggers \
   --schema=auth "${SCHEMA_ARGS[@]}" --schema=storage \
   --exclude-table-data='storage.objects' --exclude-table-data='storage.migrations' --exclude-table-data='storage.s3_multipart_uploads*' --exclude-table-data='storage.prefixes' \
-  --exclude-table-data='auth.schema_migrations' --exclude-table-data='auth.audit_log_entries' --exclude-table-data='auth.refresh_tokens' --exclude-table-data='auth.sessions' --exclude-table-data='auth.flow_state' \
+  --exclude-table-data='auth.schema_migrations' --exclude-table-data='auth.audit_log_entries' --exclude-table-data='auth.refresh_tokens' --exclude-table-data='auth.sessions' --exclude-table-data='auth.flow_state' --exclude-table-data='auth.one_time_tokens' --exclude-table-data='auth.scim_*' \
   ${EXCLUDE_TABLE_DATA:-} > "$OUT/data.sql"
 
 log "Grants and RLS policies (the schema dump drops privileges; PostgREST needs them back)"
@@ -39,6 +39,14 @@ psqlc -c "select 'revoke execute on function '||p.oid::regprocedure::text||' fro
 psqlc -c "select 'grant execute on function '||p.oid::regprocedure::text||' to '||quote_ident(r.rolname)||';' from pg_proc p join pg_namespace n on n.oid=p.pronamespace join aclexplode(p.proacl) a on true join pg_roles r on r.oid=a.grantee where n.nspname not in ($SYS) and n.nspname not like 'pg_%' and p.prokind in ('f','p') and a.privilege_type='EXECUTE' and r.rolname in ('anon','authenticated','service_role') order by 1" >> "$OUT/grants.sql" || true
 psqlc -c "select 'grant usage, select on all sequences in schema '||quote_ident(nspname)||' to anon, authenticated, service_role;' from pg_namespace where nspname not in ($SYS) and nspname not like 'pg_%'" >> "$OUT/grants.sql"
 
+log "NOT VALID constraints (COPY would enforce them; the load drops them before data and re-adds them NOT VALID after)"
+psqlc -c "select format('alter table %s drop constraint %I;', conrelid::regclass, conname) from pg_constraint where not convalidated and contype in ('c','f') and connamespace::regnamespace::text not in ($SYS) order by 1" > "$OUT/notvalid-drop.sql" || : > "$OUT/notvalid-drop.sql"
+psqlc -c "select format('alter table %s add constraint %I %s not valid;', conrelid::regclass, conname, pg_get_constraintdef(oid)) from pg_constraint where not convalidated and contype in ('c','f') and connamespace::regnamespace::text not in ($SYS) order by 1" > "$OUT/notvalid-add.sql" || : > "$OUT/notvalid-add.sql"
+
+log "Vault secrets (pg_cron http jobs read them)"
+psqlc -F$'\t' -c "select name, decrypted_secret, coalesce(description,'') from vault.decrypted_secrets order by 1" > "$OUT/vault.tsv" 2>/dev/null || : > "$OUT/vault.tsv"
+chmod 600 "$OUT/vault.tsv"
+
 log "pg_cron jobs"
 psqlc -c "select 'select cron.schedule(' || quote_literal(jobname) || ', ' || quote_literal(schedule) || ', ' || quote_literal(command) || ');' from cron.job where active order by jobid" > "$OUT/cron-jobs.sql" 2>/dev/null || : > "$OUT/cron-jobs.sql"
 
@@ -56,5 +64,6 @@ psqlc -F$'\t' -c "select n.nspname||'.'||c.relname, c.reltuples::bigint from pg_
   echo "dumped_at=$(date -u +%FT%TZ)"; echo "schema_bytes=$(stat -c%s "$OUT/schema.sql")"; echo "data_bytes=$(stat -c%s "$OUT/data.sql")"
   echo "storage_objects=$(wc -l < "$OUT/storage-inventory.tsv")"; echo "storage_bytes=$(awk -F'\t' '{s+=$4} END{print s+0}' "$OUT/storage-inventory.tsv")"
   echo "cron_jobs=$(grep -c '^select cron.schedule' "$OUT/cron-jobs.sql" || true)"; echo "auth_users=$(grep -c '' <(psqlc -c 'select id from auth.users'))"
+  echo "notvalid_constraints=$(grep -c '^alter' "$OUT/notvalid-drop.sql" || true)"; echo "vault_secrets=$(grep -c '' "$OUT/vault.tsv" || true)"
 } > "$OUT/MANIFEST"
 log "Done: $OUT"; cat "$OUT/MANIFEST"
diff --git a/dev2/templates/supabase-stack.sh b/dev2/templates/supabase-stack.sh
index 2ca5892..a1ae684 100755
--- a/dev2/templates/supabase-stack.sh
+++ b/dev2/templates/supabase-stack.sh
@@ -39,7 +39,7 @@ DBC="$SLUG-supabase-db"
 sql_admin() { docker exec -i "$DBC" psql -U supabase_admin -h localhost -d postgres -v ON_ERROR_STOP=1 -X -q -At "$@"; }
 
 # ------------------------------------------------------------ 1. the files
-install -d -m 2750 -o root -g root "$ROOT" 2>/dev/null || true
+[ -d "$ROOT" ] || install -d -m 2750 -o root -g root "$ROOT"  # never re-chown an existing site root (CI deploys as the deploy user)
 if [ -f "$DIR/.env" ] && [ -f "$DIR/docker-compose.yml" ]; then
   log "Supabase project already at $DIR; keeping its secrets"
 else
@@ -138,6 +138,8 @@ log "Overlay docker-compose.$SLUG.yml (own project name, container names, ports,
       realtime) echo "    networks:"; echo "      default:"; echo "        aliases: [realtime-dev.supabase-realtime, realtime]" ;;
       api-gw)   echo "    networks:"; echo "      default:"; echo "        aliases: [envoy, kong]"; echo "    ports: !override"; echo "      - \"127.0.0.1:${API_PORT}:8000/tcp\"" ;;
       supavisor) echo "    ports: !override"; echo "      - \"127.0.0.1:${POOLER_PORT}:6543\"" ;;
+      storage)  echo "    environment:"; echo "      FILE_SIZE_LIMIT: 5368709120" ;;   # the base file pins 50 MiB; buckets declare up to GiBs
+      functions) echo "    env_file:"; echo "      - .env"; echo "      - ./volumes/functions/secrets.env" ;;   # cloud function secrets (supabase-functions)
       db) echo "    shm_size: 512m"; echo "    ports: !override"; echo "      - \"${DB_PORT}:5432\""; echo "    volumes:"
           echo "      - ./volumes/$SLUG/$SLUG.conf:/etc/postgresql-custom/conf.d/zz-$SLUG.conf:ro,z"
           echo "      - ./volumes/$SLUG/pg_hba.conf:/etc/$SLUG/pg_hba.conf:ro,z"
@@ -152,6 +154,8 @@ log "Overlay docker-compose.$SLUG.yml (own project name, container names, ports,
   echo "          gateway: $GATEWAY"
 } > "$DIR/docker-compose.$SLUG.yml"
 
+[ -f "$DIR/volumes/functions/secrets.env" ] || { install -d "$DIR/volumes/functions"; (umask 077; : > "$DIR/volumes/functions/secrets.env"); }
+
 # ---------------------------------------------------------------- 3. start
 log "Starting $SLUG-supabase"
 compose up -d --wait 2>/dev/null || compose up -d

From 76c4e92d568aeeb7a1d1a524c11ff3bac1f1b057 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:51:33 +0000
Subject: [PATCH 085/104] supabase-functions: re-point cloud URL/keys inside
 the copied function secrets

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 1eae436..96785e7 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -1380,6 +1380,13 @@ def cmd_supabase_functions(args):
     if st.get("cloud_ref"):
         try: secrets = {x["name"]: x["value"] for x in sb_api(f"projects/{st['cloud_ref']}/secrets") if not x["name"].startswith("SUPABASE_")}
         except Exception as e: warn(f"could not read cloud function secrets: {e}")
+    # Secrets that name the cloud project (URL, keys) must point at this stack instead.
+    for k, v in list(secrets.items()):
+        nv = v
+        if st.get("cloud_ref"): nv = re.sub(rf"https?://{st['cloud_ref']}\.supabase\.co", f"https://{st['sb_host']}", nv).replace(f"{st['cloud_ref']}.supabase.co", st["sb_host"])
+        if st.get("cloud_anon_key") and v == st["cloud_anon_key"] or v in (st.get("cloud_publishable_keys") or []): nv = st["sb_anon_key"]
+        if st.get("cloud_service_key") and v == st["cloud_service_key"] or v in (st.get("cloud_secret_keys") or []): nv = st["sb_service_key"]
+        if nv != v: secrets[k] = nv; note(f"{k}: re-pointed at the stack")
     ssh_put("".join(f"{k}={v}\n" for k, v in sorted(secrets.items())), f"{fdir}/secrets.env", "0600")
     note(f"{len(secrets)} function secrets written to secrets.env: {', '.join(sorted(secrets)) or '-'}")
     # Older overlays predate the env_file line; add it, then restart the runtime.

From 6588e86e1a00b1732915cc5220bd1b0f627a462e Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:53:01 +0000
Subject: [PATCH 086/104] supabase-functions: the API only lists secret names;
 take values from the site variables

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 96785e7..bdcdcbd 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -1375,11 +1375,18 @@ def cmd_supabase_functions(args):
     fdir = f"{WWW}/{s['site']}/supabase/volumes/functions"
     log(f"Edge Functions -> {fdir}: {', '.join(n for n in names if not n.startswith('_'))}")
     ssh("root", f"mkdir -p {fdir} && base64 -d | tar -xzf - -C {fdir} && chmod -R a+rX {fdir}", input=base64.b64encode(buf.getvalue()).decode())
-    # Function secrets: everything the cloud had except the SUPABASE_* the stack injects itself.
-    secrets = {}
+    # Function secrets: the management API lists their NAMES (the "value" it returns is a digest),
+    # so take each value from the app's own variables, which carry the same keys.
+    secrets, missing = {}, []
     if st.get("cloud_ref"):
-        try: secrets = {x["name"]: x["value"] for x in sb_api(f"projects/{st['cloud_ref']}/secrets") if not x["name"].startswith("SUPABASE_")}
-        except Exception as e: warn(f"could not read cloud function secrets: {e}")
+        try: names = [x["name"] for x in sb_api(f"projects/{st['cloud_ref']}/secrets") if not x["name"].startswith("SUPABASE_")]
+        except Exception as e: names = []; warn(f"could not list cloud function secrets: {e}")
+        vars_ = site_variables(s)
+        for n in names:
+            v = vars_.get(n)
+            if isinstance(v, str) and v: secrets[n] = v
+            else: missing.append(n)
+        if missing: warn(f"function secrets with no value in the site's variables (add them to {fdir}/secrets.env by hand): {', '.join(missing)}")
     # Secrets that name the cloud project (URL, keys) must point at this stack instead.
     for k, v in list(secrets.items()):
         nv = v

From a101dc3d8431554d3a25f7164109a9915ff2c49f Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:53:52 +0000
Subject: [PATCH 087/104] supabase-functions: fix name collision in the probe;
 sites.d function_secrets overlay

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index bdcdcbd..92788cd 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -1379,11 +1379,13 @@ def cmd_supabase_functions(args):
     # so take each value from the app's own variables, which carry the same keys.
     secrets, missing = {}, []
     if st.get("cloud_ref"):
-        try: names = [x["name"] for x in sb_api(f"projects/{st['cloud_ref']}/secrets") if not x["name"].startswith("SUPABASE_")]
-        except Exception as e: names = []; warn(f"could not list cloud function secrets: {e}")
+        try: snames = [x["name"] for x in sb_api(f"projects/{st['cloud_ref']}/secrets") if not x["name"].startswith("SUPABASE_")]
+        except Exception as e: snames = []; warn(f"could not list cloud function secrets: {e}")
         vars_ = site_variables(s)
-        for n in names:
-            v = vars_.get(n)
+        # sites.d "function_secrets": {"NAME": "secret:NAME"} (values in credentials.json as <site>.fn.NAME) wins over app variables.
+        fs = {k: (cred(f"{s['site']}.fn.{v[7:]}", v[7:]) if isinstance(v, str) and v.startswith("secret:") else v) for k, v in (s.get("function_secrets") or {}).items()}
+        for n in snames:
+            v = fs.get(n) or vars_.get(n)
             if isinstance(v, str) and v: secrets[n] = v
             else: missing.append(n)
         if missing: warn(f"function secrets with no value in the site's variables (add them to {fdir}/secrets.env by hand): {', '.join(missing)}")

From 48e57bedcdc673713dc2f6e0b12d6e6c32e6820e Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 15:54:57 +0000
Subject: [PATCH 088/104] dev2-site: sites.d crons -> /etc/cron.d
 (coinpayportal's minute payment monitor was a Vercel cron)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site                      | 15 +++++++++++++++
 dev2/sites.d/coinpayportal.com.json | 11 ++++++++++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 92788cd..e3e5f97 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -666,6 +666,20 @@ def deploy_key(repo):
         sh(["ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-C", f"github-actions-deploy@{repo}", "-f", path])
     return path
 
+def render_crons(s):
+    """sites.d "crons": [{"schedule": "* * * * *", "path": "/api/cron/x", "auth_env": "CRON_SECRET", "timeout": 55}]
+    -> /etc/cron.d/dev2-site-<slug>. Replaces the Vercel/Railway cron the app used to rely on: root curls the
+    site's own URL with the bearer taken from app.env at run time (nothing secret lands in the cron file)."""
+    path = f"/etc/cron.d/dev2-site-{sb_slug(s)}"
+    crons = s.get("crons") or []
+    if not crons: ssh("root", f"rm -f {path}", check=False); return
+    lines = [f"# {s['site']}: managed by cli-tools dev2-site (sites.d crons); do not edit", "SHELL=/bin/sh", "PATH=/usr/local/bin:/usr/bin:/bin", ""]
+    for c in crons:
+        hdr = f' -H "Authorization: Bearer $(grep -m1 ^{c["auth_env"]}= {WWW}/{s["site"]}/app.env | cut -d= -f2-)"' if c.get("auth_env") else ""
+        lines.append(f'{c["schedule"]} root curl -fsS -m {int(c.get("timeout", 55))} -o /dev/null{hdr} https://{s["site"]}{c["path"]} >/dev/null 2>&1')
+    ssh_put("\n".join(lines) + "\n", path, "0644")
+    note(f"{len(crons)} cron job(s) in {path}: " + ", ".join(f"{c['schedule']} {c['path']}" for c in crons))
+
 def cmd_provision(args):
     s = site(args.site); st = load_state(s["site"])
     root = f"{WWW}/{s['site']}"
@@ -735,6 +749,7 @@ def cmd_provision(args):
     for name, val in (("DEV2_SSH_KEY", open(key).read()), ("DEV2_KNOWN_HOSTS", known), ("DEV2_HOST", DEV2_HOST), ("DEV2_USER", DEPLOY_USER)):
         sh(["gh", "secret", "set", name, "--repo", s["repo"]], input=val)
     note(f"deploy key {os.path.basename(key)} authorized on dev2; DEV2_* secrets set on {s['repo']}")
+    render_crons(s)
     mark(s["site"], "provision", root=root, branch=branch, health_path=hp, dockerfile=st["dockerfile"], checkout=st.get("checkout") or checkout_dir(s))
 
 # ------------------------------------------------------------------- db
diff --git a/dev2/sites.d/coinpayportal.com.json b/dev2/sites.d/coinpayportal.com.json
index 82af887..58fa245 100644
--- a/dev2/sites.d/coinpayportal.com.json
+++ b/dev2/sites.d/coinpayportal.com.json
@@ -6,5 +6,14 @@
    "port": 8273,
    "max_body": "512m"
   }
- ]
+ ],
+ "crons": [
+  {
+   "schedule": "* * * * *",
+   "path": "/api/cron/monitor-payments",
+   "auth_env": "CRON_SECRET",
+   "timeout": 55
+  }
+ ],
+ "notes": "Payment/escrow/lightning monitor ran as a Vercel cron every minute (vercel.json); on dev2 it is the cron.d entry rendered from `crons`."
 }

From 79e99aca9c5cbfab6c2b8fe9ff227c5d0fd79912 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 16:00:12 +0000
Subject: [PATCH 089/104] sites.d: coinpayportal cut over to its dev2 Supabase;
 saasrow function secrets as vault refs

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/coinpayportal.com.json | 13 ++++++++++++-
 dev2/sites.d/saasrow.com.json       | 15 ++++++++++++++-
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/dev2/sites.d/coinpayportal.com.json b/dev2/sites.d/coinpayportal.com.json
index 58fa245..8e45e68 100644
--- a/dev2/sites.d/coinpayportal.com.json
+++ b/dev2/sites.d/coinpayportal.com.json
@@ -15,5 +15,16 @@
    "timeout": 55
   }
  ],
- "notes": "Payment/escrow/lightning monitor ran as a Vercel cron every minute (vercel.json); on dev2 it is the cron.d entry rendered from `crons`."
+ "notes": "Payment/escrow/lightning monitor ran as a Vercel cron every minute (vercel.json); on dev2 it is the cron.d entry rendered from `crons`.",
+ "env_overrides": {
+  "JWT_SECRET": "secret:JWT_SECRET",
+  "NEXT_PUBLIC_SUPABASE_ANON_KEY": "secret:NEXT_PUBLIC_SUPABASE_ANON_KEY",
+  "NEXT_PUBLIC_SUPABASE_URL": "https://supabase.coinpayportal.com",
+  "SUPABASE_DB_PASSWORD": "secret:SUPABASE_DB_PASSWORD",
+  "SUPABASE_JWT_SECRET": "secret:SUPABASE_JWT_SECRET",
+  "SUPABASE_PUBLISHABLE_KEY": "secret:SUPABASE_PUBLISHABLE_KEY",
+  "SUPABASE_SECRETMAT_KEY": "secret:SUPABASE_SECRETMAT_KEY",
+  "SUPABASE_SECRET_KEY": "secret:SUPABASE_SECRET_KEY",
+  "SUPABASE_SERVICE_ROLE_KEY": "secret:SUPABASE_SERVICE_ROLE_KEY"
+ }
 }
diff --git a/dev2/sites.d/saasrow.com.json b/dev2/sites.d/saasrow.com.json
index 17cecb9..8a1640e 100644
--- a/dev2/sites.d/saasrow.com.json
+++ b/dev2/sites.d/saasrow.com.json
@@ -5,5 +5,18 @@
    "port": 8276,
    "max_body": "512m"
   }
- ]
+ ],
+ "function_secrets": {
+  "VITE_SUPABASE_URL": "https://supabase.saasrow.com",
+  "VITE_SUPABASE_ANON_KEY": "secret:VITE_SUPABASE_ANON_KEY",
+  "OPENAI_API_KEY": "secret:OPENAI_API_KEY",
+  "STRIPE_SECRET_KEY": "secret:STRIPE_SECRET_KEY",
+  "STRIPE_WEBHOOK_SECRET": "secret:STRIPE_WEBHOOK_SECRET",
+  "SITE_URL": "secret:SITE_URL",
+  "ADMIN_EMAIL": "secret:ADMIN_EMAIL",
+  "GETSCREENSHOT_API_KEY": "secret:GETSCREENSHOT_API_KEY",
+  "RESEND_API_KEY": "secret:RESEND_API_KEY",
+  "RESEND_DOMAIN": "secret:RESEND_DOMAIN",
+  "GEMINI_API_KEY": "secret:GEMINI_API_KEY"
+ }
 }

From 3293f47aeb3c6528808643dad5e1d8b74ded2581 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Fri, 25 Sep 2026 16:27:04 +0000
Subject: [PATCH 090/104] sites.d: tsbb.dev off Turso (TSBB_DATABASE_AUTH_TOKEN
 retired)

---
 dev2/sites.d/tsbb.dev.json | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 dev2/sites.d/tsbb.dev.json

diff --git a/dev2/sites.d/tsbb.dev.json b/dev2/sites.d/tsbb.dev.json
new file mode 100644
index 0000000..79a7315
--- /dev/null
+++ b/dev2/sites.d/tsbb.dev.json
@@ -0,0 +1 @@
+{ "env_remove": ["TSBB_DATABASE_AUTH_TOKEN"], "notes": "Turso -> shared Postgres 2026-09-25 (profullstack/tsbb#28); TSBB_DATABASE_URL is rewritten to the cluster URL by provision" }

From 32e74abbf4ce7a9273047ef033b7970ecb1f444c Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Fri, 25 Sep 2026 16:32:50 +0000
Subject: [PATCH 091/104] sites.d: app.logicsrc.com runs apps/pwa
 (start_command, /healthz) and leaves Turso

---
 dev2/sites.d/app.logicsrc.com.json | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 dev2/sites.d/app.logicsrc.com.json

diff --git a/dev2/sites.d/app.logicsrc.com.json b/dev2/sites.d/app.logicsrc.com.json
new file mode 100644
index 0000000..e756827
--- /dev/null
+++ b/dev2/sites.d/app.logicsrc.com.json
@@ -0,0 +1,6 @@
+{
+ "start_command": "npm --workspace @logicsrc/pwa run start",
+ "health_path": "/healthz",
+ "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"],
+ "notes": "The service is apps/pwa (Railway rootDirectory); the root .nixpacks CMD starts the Next marketing site instead, so the compose command overrides it. Turso -> shared Postgres 2026-09-25 (profullstack/logicsrc#218)."
+}

From 43a42e3a0ebde4cc0b2070b169565f6e0d7573e0 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Fri, 25 Sep 2026 16:36:12 +0000
Subject: [PATCH 092/104] sites.d: p0dcasters.com off Turso

---
 dev2/sites.d/p0dcasters.com.json | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 dev2/sites.d/p0dcasters.com.json

diff --git a/dev2/sites.d/p0dcasters.com.json b/dev2/sites.d/p0dcasters.com.json
new file mode 100644
index 0000000..f4998b5
--- /dev/null
+++ b/dev2/sites.d/p0dcasters.com.json
@@ -0,0 +1 @@
+{ "branch": "master", "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"], "notes": "Turso -> shared Postgres 2026-09-25 (profullstack/p0dcasters#29); next build runs at container start against DATABASE_URL" }

From 5f8b9646cfca711c6ef1665320d6fe8f3c34c74b Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Fri, 25 Sep 2026 16:41:34 +0000
Subject: [PATCH 093/104] sites.d: app.moshcode.sh off Turso
 (DATABASE_AUTH_TOKEN retired)

---
 dev2/sites.d/app.moshcode.sh.json | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dev2/sites.d/app.moshcode.sh.json b/dev2/sites.d/app.moshcode.sh.json
index 85ec5f4..4b95cda 100644
--- a/dev2/sites.d/app.moshcode.sh.json
+++ b/dev2/sites.d/app.moshcode.sh.json
@@ -1,4 +1,5 @@
 {
  "health_path": "/healthz",
- "notes": "web app is apps/pwa (own deps); plain Dockerfile on the deploy branch, health /healthz"
-}
\ No newline at end of file
+ "env_remove": ["DATABASE_AUTH_TOKEN"],
+ "notes": "web app is apps/pwa (own deps); plain Dockerfile on main, health /healthz. Turso -> shared Postgres 2026-09-25 (moshcoder/moshcode#551): DATABASE_URL is rewritten to the cluster URL by provision, the Turso token retired"
+}

From ed71870465a80b66cce82abc0bfda0869983ef3b Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@profullstack.com>
Date: Fri, 25 Sep 2026 16:43:58 +0000
Subject: [PATCH 094/104] sites.d: outreachgraph.com off Turso
 (TURSO_AUTH_TOKEN retired)

---
 dev2/sites.d/outreachgraph.com.json | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 dev2/sites.d/outreachgraph.com.json

diff --git a/dev2/sites.d/outreachgraph.com.json b/dev2/sites.d/outreachgraph.com.json
new file mode 100644
index 0000000..e0e983d
--- /dev/null
+++ b/dev2/sites.d/outreachgraph.com.json
@@ -0,0 +1 @@
+{ "env_remove": ["TURSO_AUTH_TOKEN"], "notes": "Turso -> shared Postgres 2026-09-25 (profullstack/outreachgraph#99); TURSO_DATABASE_URL is rewritten to the cluster URL by provision (the app reads DATABASE_URL first, that name as a fallback)" }

From cbec88730e5c718f8d86523ac1038ce73a09df8f Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 16:44:26 +0000
Subject: [PATCH 095/104] sites.d: advis0r.com off Turso (DATABASE_URL was the
 libsql:// URL; drop DATABASE_AUTH_TOKEN)

---
 dev2/sites.d/advis0r.com.json | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 dev2/sites.d/advis0r.com.json

diff --git a/dev2/sites.d/advis0r.com.json b/dev2/sites.d/advis0r.com.json
new file mode 100644
index 0000000..ef777cd
--- /dev/null
+++ b/dev2/sites.d/advis0r.com.json
@@ -0,0 +1 @@
+{ "branch": "main", "env_remove": ["DATABASE_AUTH_TOKEN"] }

From a02dc464dabc3cf60c7c831f2a43ba490361b5a3 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 16:52:51 +0000
Subject: [PATCH 096/104] dev2-site: a sites.d health_path overrides the one
 recorded in the state file

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index e3e5f97..731ea61 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -700,7 +700,7 @@ def cmd_provision(args):
         if not st.get("dockerfile"):
             st["dockerfile"] = find_dockerfile(st.get("checkout") or checkout_dir(s), cfg) or ".nixpacks/Dockerfile"
         branch = st.get("branch") or s.get("branch") or default_branch(s["repo"])
-        hp = st.get("health_path") or health_url(s, cfg)[1]
+        hp = s.get("health_path") or st.get("health_path") or health_url(s, cfg)[1]  # sites.d wins over the state file (app.logicsrc.com)
     compose = render_compose(s, st, inside, build_args=public_keys(merged))
     build_services = " ".join(["app"] + [c["name"] for c in s["companions"]])
     # Public repos clone over https. Private ones clone over ssh with a read-only GitHub
@@ -1054,7 +1054,7 @@ def cmd_vhost(args):
 
 def cmd_verify(args):
     s = site(args.site); st = load_state(s["site"])
-    hp = st.get("health_path") or "/"
+    hp = s.get("health_path") or st.get("health_path") or "/"
     # Without the vhost nginx's default server answers the pinned SNI and a 200 means nothing.
     if ssh("root", f"test -e /etc/nginx/sites-enabled/{shlex.quote(s['site'])} && echo yes", check=False).strip() != "yes":
         die(f"no nginx vhost for {s['site']} yet: run `dev2-site vhost {s['site']}` first")

From 6798bd317f300c9c04a970aface61b9f4afd9782 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 17:00:11 +0000
Subject: [PATCH 097/104] sites.d: c0upons.com and bufferoverride.com off Turso
 (retired settings dropped; c0upons also loses the dead SQLITECLOUD_URL)

---
 dev2/sites.d/bufferoverride.com.json | 1 +
 dev2/sites.d/c0upons.com.json        | 1 +
 2 files changed, 2 insertions(+)
 create mode 100644 dev2/sites.d/bufferoverride.com.json
 create mode 100644 dev2/sites.d/c0upons.com.json

diff --git a/dev2/sites.d/bufferoverride.com.json b/dev2/sites.d/bufferoverride.com.json
new file mode 100644
index 0000000..26eeea2
--- /dev/null
+++ b/dev2/sites.d/bufferoverride.com.json
@@ -0,0 +1 @@
+{ "branch": "main", "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"] }
diff --git a/dev2/sites.d/c0upons.com.json b/dev2/sites.d/c0upons.com.json
new file mode 100644
index 0000000..5e00908
--- /dev/null
+++ b/dev2/sites.d/c0upons.com.json
@@ -0,0 +1 @@
+{ "branch": "master", "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN", "SQLITECLOUD_URL"] }

From d4020d4f221ed8b616c2d830a73c04e877d82bfa Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 17:04:07 +0000
Subject: [PATCH 098/104] sites.d: hqtui.com and moshcoding.com off Turso

---
 dev2/sites.d/hqtui.com.json      | 1 +
 dev2/sites.d/moshcoding.com.json | 1 +
 2 files changed, 2 insertions(+)
 create mode 100644 dev2/sites.d/hqtui.com.json
 create mode 100644 dev2/sites.d/moshcoding.com.json

diff --git a/dev2/sites.d/hqtui.com.json b/dev2/sites.d/hqtui.com.json
new file mode 100644
index 0000000..26eeea2
--- /dev/null
+++ b/dev2/sites.d/hqtui.com.json
@@ -0,0 +1 @@
+{ "branch": "main", "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"] }
diff --git a/dev2/sites.d/moshcoding.com.json b/dev2/sites.d/moshcoding.com.json
new file mode 100644
index 0000000..6d2a6e3
--- /dev/null
+++ b/dev2/sites.d/moshcoding.com.json
@@ -0,0 +1 @@
+{ "branch": "master", "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"] }

From a357409cebaf5c9818b93efdb2a6eff900fff9c1 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 17:08:31 +0000
Subject: [PATCH 099/104] sites.d: aiornot.vote off Turso

---
 dev2/sites.d/aiornot.vote.json | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 dev2/sites.d/aiornot.vote.json

diff --git a/dev2/sites.d/aiornot.vote.json b/dev2/sites.d/aiornot.vote.json
new file mode 100644
index 0000000..6d2a6e3
--- /dev/null
+++ b/dev2/sites.d/aiornot.vote.json
@@ -0,0 +1 @@
+{ "branch": "master", "env_remove": ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"] }

From 1f390c9cf9974c68ed17682018cb406b6cbbe38b Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 18:04:30 +0000
Subject: [PATCH 100/104] dev2-site backup-install: version dev2-pg-backup.sh;
 dump every per-site Supabase stack and mirror storage files

The backup job only knew the shared cluster. With the cloud projects deleted the
20 <slug>-supabase-db containers were the sole copy of their data. Now: each stack's
postgres database is dumped (4-hourly, or daily when large) and verified like the
cluster's, and volumes/storage is rsync-mirrored daily. The script and its cron file
live here as templates and are installed by .

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/dev2-site                     |  15 +++
 dev2/templates/dev2-pg-backup.cron |  15 +++
 dev2/templates/dev2-pg-backup.sh   | 178 +++++++++++++++++++++++++++++
 3 files changed, 208 insertions(+)
 create mode 100644 dev2/templates/dev2-pg-backup.cron
 create mode 100644 dev2/templates/dev2-pg-backup.sh

diff --git a/dev2/dev2-site b/dev2/dev2-site
index 731ea61..c1a3379 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -1178,6 +1178,20 @@ def cmd_firewall(args):
     ssh_put(tmpl("firewall-data-ports.sh"), "/root/dev2-kit/firewall-data-ports.sh", "0700")
     print(ssh("root", f"env PORTS={shlex.quote(' '.join(map(str, sorted(ports))))} bash /root/dev2-kit/firewall-data-ports.sh 2>&1"))
 
+def cmd_backup_install(args):
+    """Install /usr/local/bin/dev2-pg-backup.sh + /etc/cron.d/dev2-pg-backup from the templates
+    (shared cluster every 4h, per-site Supabase stacks, storage files daily). --run does a
+    frequent pass right away and shows the log."""
+    log("Installing dev2-pg-backup.sh + cron")
+    ssh_put(tmpl("dev2-pg-backup.sh"), "/usr/local/bin/dev2-pg-backup.sh", "0755")
+    ssh_put(tmpl("dev2-pg-backup.cron"), "/etc/cron.d/dev2-pg-backup", "0644")
+    ssh("root", "bash -n /usr/local/bin/dev2-pg-backup.sh && grep -c supabase-db /usr/local/bin/dev2-pg-backup.sh >/dev/null")
+    note("installed; runs frequent at 0 */4 and full at 05:20 UTC")
+    if getattr(args, "run", False):
+        log("Running a frequent pass now (all databases; a few minutes)")
+        ssh("root", "/usr/local/bin/dev2-pg-backup.sh frequent", check=False, timeout=3600)
+        print(ssh("root", "tail -n 40 /var/log/dev2-pg-backup.log"))
+
 def cmd_box_tune(args):
     ssh("root", "install -d -m 700 /root/dev2-kit")
     ssh_put(tmpl("box-tune.sh"), "/root/dev2-kit/box-tune.sh", "0700")
@@ -1431,6 +1445,7 @@ def main():
     sub = ap.add_subparsers(dest="cmd", required=True)
     sub.add_parser("registry").set_defaults(fn=cmd_registry)
     sub.add_parser("firewall").set_defaults(fn=cmd_firewall)
+    p = sub.add_parser("backup-install"); p.add_argument("--run", action="store_true"); p.set_defaults(fn=cmd_backup_install)
     sub.add_parser("box-tune").set_defaults(fn=cmd_box_tune)
     p = sub.add_parser("list"); p.add_argument("--kind"); p.add_argument("--status"); p.set_defaults(fn=cmd_list)
     p = sub.add_parser("scaffold"); p.add_argument("site"); p.add_argument("--regen", action="store_true", help="regenerate .nixpacks even if the branch already has one"); p.set_defaults(fn=cmd_scaffold)
diff --git a/dev2/templates/dev2-pg-backup.cron b/dev2/templates/dev2-pg-backup.cron
new file mode 100644
index 0000000..a2d778d
--- /dev/null
+++ b/dev2/templates/dev2-pg-backup.cron
@@ -0,0 +1,15 @@
+# Backups for the self-hosted cluster, the per-site Supabase stacks and their storage
+# files. Managed by cli-tools `dev2-site backup-install`; do not edit on the box.
+#
+# frequent (every 4h): everything that cannot be re-derived. Full dumps of the
+#   small databases; the bulk catalogue tables are excluded from nichedb and
+#   rssamplifier because they are re-importable from public sources. Measured
+#   at ~700 MB and ~50 seconds per run, so four-hourly is cheap.
+#
+# full (daily): the complete copies including those bulk tables, kept 2 deep.
+#   Six full dumps a day of a 165 GB database would outgrow the disk in days,
+#   which is why the frequent job excludes them.
+#
+# 05:20 is after the 04:17 docker build cache prune, so they do not overlap.
+0 */4 * * * root /usr/local/bin/dev2-pg-backup.sh frequent
+20 5 * * *  root /usr/local/bin/dev2-pg-backup.sh full
diff --git a/dev2/templates/dev2-pg-backup.sh b/dev2/templates/dev2-pg-backup.sh
new file mode 100644
index 0000000..2bdffe4
--- /dev/null
+++ b/dev2/templates/dev2-pg-backup.sh
@@ -0,0 +1,178 @@
+#!/usr/bin/env bash
+#
+# Backups for the self-hosted cluster on dev2, the per-site Supabase stacks and
+# their storage files. Source of truth: cli-tools dev2/templates/dev2-pg-backup.sh,
+# installed by `dev2-site backup-install`; do not edit on the box.
+#
+#   dev2-pg-backup.sh frequent   every 4 hours (cron)
+#   dev2-pg-backup.sh full       once a day (cron)
+#
+# WHY TWO MODES. "Back up every database every four hours" is the right
+# instinct but not literally affordable: nichedb is ~165 GB and rssamplifier
+# will be ~40-50 GB, and six full dumps a day of those would outgrow the disk
+# in days. The split keeps the 4-hour recovery point for everything that
+# cannot be re-derived, and takes the bulk catalogues once a day.
+#
+# The excluded tables are all re-importable from public sources. Critically,
+# `sources` in nichedb is NOT excluded: it holds the adapter config and the
+# import cursors, which is what makes re-running an importer cheap rather than
+# a restart from zero. Scoping agreed with the session that owns those
+# databases; do not widen the exclusions without asking it.
+#
+# RETENTION is 7 days for both classes. That is cheap for the frequent dumps
+# (~700 MB a run) and expensive for the daily fulls, because seven copies of
+# the bulk databases is hundreds of GB. The script therefore warns when the
+# backup directory passes BACKUP_WARN_GB, rather than letting backups cause
+# the disk outage they exist to protect against.
+#
+# Every dump is checked with `pg_restore --list` before it counts as good. A
+# pg_dump can exit 0 and still be truncated if the disk fills, and a backup
+# that cannot be read is worse than none because it buys false confidence.
+set -uo pipefail
+
+MODE=${1:-frequent}
+OUT=${OUT:-/var/backups/postgres}
+LOG=${LOG:-/var/log/dev2-pg-backup.log}
+# Both classes roll on age, not count: "7 days of history" should mean the
+# same thing whichever dump you reach for.
+KEEP_FREQUENT_DAYS=${KEEP_FREQUENT_DAYS:-7}
+KEEP_FULL_DAYS=${KEEP_FULL_DAYS:-7}
+# Backups that quietly eat the disk would cause the outage they exist to
+# prevent. Flag it well before the disk alarm would.
+BACKUP_WARN_GB=${BACKUP_WARN_GB:-450}
+# A database with no policy that is bigger than this gets flagged rather than
+# silently dumped in full every four hours.
+UNPOLICIED_WARN_GB=${UNPOLICIED_WARN_GB:-5}
+
+mkdir -p "$OUT"
+stamp=$(date -u +%Y%m%d-%H%M%S)
+say() { echo "$(date -u '+%F %T') [$MODE] $*" >> "$LOG"; }
+alert() { logger -t dev2-pg-backup -p daemon.err "$*"; say "ALERT $*"; }
+
+psql_q() { docker exec -i supabase-db psql -U postgres -h localhost -d postgres -X -At -c "$1" 2>/dev/null; }
+
+# Tables excluded from the FREQUENT dump of each database. Everything here is
+# re-derivable from public dumps or re-crawlable; everything not here is not.
+exclusions_for() {
+  case "$1" in
+    nichedb)      echo "public.items" ;;
+    rssamplifier) echo "public.feed_items public.item_extracts public.feed_keywords" ;;
+    *)            echo "" ;;
+  esac
+}
+
+# Databases big enough that a full copy belongs in the daily job, not the
+# 4-hourly one.
+is_bulk() { [ -n "$(exclusions_for "$1")" ]; }
+
+dbs=$(psql_q "select datname from pg_database where not datistemplate and datallowconn order by datname")
+[ -n "$dbs" ] || { alert "cannot list databases — postgres unreachable"; exit 1; }
+
+rc=0
+for db in $dbs; do
+  size_gb=$(psql_q "select (pg_database_size('$db')/1024/1024/1024)::int")
+  excl=$(exclusions_for "$db")
+
+  if [ "$MODE" = full ]; then
+    # The daily job only exists to capture the bulk tables the frequent job
+    # skips. Databases with no exclusions are already complete every 4 hours.
+    is_bulk "$db" || continue
+    f="$OUT/${db}-full-${stamp}.dump"
+    args=()
+  else
+    f="$OUT/${db}-${stamp}.dump"
+    args=()
+    for t in $excl; do args+=(--exclude-table="$t"); done
+    # An unknown database that is large would quietly cost a full dump six
+    # times a day. Back it up, but say so.
+    if [ -z "$excl" ] && [ "${size_gb:-0}" -ge "$UNPOLICIED_WARN_GB" ]; then
+      alert "$db is ${size_gb}GB with no exclusion policy — it is being dumped in full every 4h; add a policy to exclusions_for()"
+    fi
+  fi
+
+  if docker exec -i supabase-db pg_dump -U postgres -h localhost -Fc "${args[@]}" -d "$db" > "$f" 2>>"$LOG"; then
+    sz=$(du -h "$f" | cut -f1)
+    if docker exec -i supabase-db pg_restore --list < "$f" >/dev/null 2>&1; then
+      say "ok   $db $sz${excl:+ (excluding:$excl)}"
+    else
+      alert "$db dump is unreadable by pg_restore"
+      rc=1
+    fi
+  else
+    alert "pg_dump failed for $db"
+    rm -f "$f"
+    rc=1
+  fi
+done
+
+# Per-site self-hosted Supabase stacks (<slug>-supabase-db). Their cloud projects are
+# deleted, so these dumps are the only copy of auth, storage metadata and app data.
+# Whole `postgres` database as supabase_admin (the superuser in the docker image);
+# small stacks every 4h, anything over UNPOLICIED_WARN_GB daily only.
+stack_names=""
+for c in $(docker ps --format '{{.Names}}' | grep -E -- '-supabase-db$' | sort); do
+  slug=${c%-supabase-db}; name="${slug}-supabase"; stack_names="$stack_names $name"
+  size_gb=$(docker exec -i "$c" psql -U supabase_admin -h localhost -d postgres -X -At -c "select (pg_database_size('postgres')/1024/1024/1024)::int" 2>/dev/null)
+  if [ "$MODE" = full ]; then
+    [ "${size_gb:-0}" -ge "$UNPOLICIED_WARN_GB" ] || continue
+    f="$OUT/${name}-full-${stamp}.dump"
+  else
+    if [ "${size_gb:-0}" -ge "$UNPOLICIED_WARN_GB" ]; then say "skip $name (${size_gb}GB, daily full only)"; continue; fi
+    f="$OUT/${name}-${stamp}.dump"
+  fi
+  if docker exec -i "$c" pg_dump -U supabase_admin -h localhost -Fc -d postgres > "$f" 2>>"$LOG"; then
+    if docker exec -i "$c" pg_restore --list < "$f" >/dev/null 2>&1; then
+      say "ok   $name $(du -h "$f" | cut -f1)"
+    else
+      alert "$name dump is unreadable by pg_restore"; rc=1
+    fi
+  else
+    alert "pg_dump failed for $name"; rm -f "$f"; rc=1
+  fi
+done
+
+# Storage object files (Supabase Storage keeps them on disk under each stack's
+# volumes/storage, the shared cluster's included). Mirrored once a day, never
+# deleting on the mirror side, so a deleted object survives until the mirror is
+# rebuilt by hand.
+if [ "$MODE" = full ]; then
+  for d in /home/anthony/www/*/supabase/volumes/storage; do
+    [ -d "$d" ] || continue
+    site=$(basename "$(dirname "$(dirname "$(dirname "$d")")")")
+    mkdir -p "$OUT/storage/$site"
+    if rsync -a "$d/" "$OUT/storage/$site/" 2>>"$LOG"; then
+      say "ok   storage $site $(du -sh "$OUT/storage/$site" | cut -f1)"
+    else
+      alert "rsync failed for $site storage"; rc=1
+    fi
+  done
+fi
+
+# Retention: both classes roll on age, 7 days each by default.
+find "$OUT" -name '*-[0-9]*.dump' ! -name '*-full-*' -mtime +"$KEEP_FREQUENT_DAYS" -delete 2>/dev/null
+
+# Fulls also roll on age, but never delete the newest one for a database. If
+# the daily job were broken for a fortnight, pure age-based expiry would
+# cheerfully leave that database with no complete backup at all — exactly when
+# you most need one.
+for db in $dbs $stack_names; do
+  newest=$(ls -1t "$OUT/${db}-full-"*.dump 2>/dev/null | head -1)
+  while IFS= read -r old; do
+    [ -n "$old" ] || continue
+    [ "$old" = "$newest" ] && continue
+    rm -f "$old"
+  done < <(find "$OUT" -name "${db}-full-*.dump" -mtime +"$KEEP_FULL_DAYS" 2>/dev/null)
+done
+
+total=$(du -sh "$OUT" 2>/dev/null | cut -f1)
+total_gb=$(du -s --block-size=1G "$OUT" 2>/dev/null | cut -f1)
+avail=$(df -h --output=avail / | tail -1 | tr -d ' ')
+say "retained $(ls -1 "$OUT"/*.dump 2>/dev/null | wc -l) dumps, $total total, $avail free on /"
+if [ "${total_gb:-0}" -ge "$BACKUP_WARN_GB" ]; then
+  alert "backups are using ${total_gb}GB (warn at ${BACKUP_WARN_GB}GB). Seven days of full dumps of the bulk databases is the likely cause — shorten KEEP_FULL_DAYS or move them off-box."
+fi
+
+# Backups are useless if they are all on the machine that fails. Say so every
+# run so it is never quietly forgotten.
+say "NOTE same-box only — does not survive losing dev2; off-box copy still missing"
+exit $rc

From 6064da580e174bcbd24b9cab7600fb5c7df6ec5c Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 18:45:00 +0000
Subject: [PATCH 101/104] sites.d: communitygardensasappleseeds.info off skip,
 moving to dev2

Anthony reversed the stay-on-Railway decision ("move it all off railway").
Zone is at Cloudflare with no token in the vault, so the cert is HTTP-01
after the apex and www A records are pointed at dev2 by hand.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 dev2/sites.d/communitygardensasappleseeds.info.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev2/sites.d/communitygardensasappleseeds.info.json b/dev2/sites.d/communitygardensasappleseeds.info.json
index 618b5fc..31f8b58 100644
--- a/dev2/sites.d/communitygardensasappleseeds.info.json
+++ b/dev2/sites.d/communitygardensasappleseeds.info.json
@@ -1,4 +1,4 @@
 {
- "skip": true,
- "notes": "Anthony 2026-09-25: stays on Railway (DNS at Cloudflare). Never retire, never migrate."
+ "health_path": "/",
+ "notes": "2026-09-25: was `skip` (stay on Railway, DNS at Cloudflare); Anthony reversed that the same day (\"move it all off railway\"). Zone is at Cloudflare (kobe/maxine), no Cloudflare token in the vault: the `dns` step cannot flip it and Porkbun DNS-01 cannot issue, so the cert is HTTP-01 (`cert` falls back to cmd_cert_http) AFTER the apex and www A records point at dev2 unproxied. Stateless Next site: no database; the Railway volume at /data/db is copied but nothing in the repo reads it."
 }

From d93ae5efc526fce2f2cdc8faa8eac937efb19f98 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 18:51:31 +0000
Subject: [PATCH 102/104] dev2-site: a failing nginx -t no longer reloads;
 HTTP-01 challenge files world-readable (umask 022)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 dev2/dev2-site | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dev2/dev2-site b/dev2/dev2-site
index c1a3379..9107d53 100755
--- a/dev2/dev2-site
+++ b/dev2/dev2-site
@@ -986,10 +986,10 @@ def cmd_cert_http(s, domains):
     log(f"Certificate for {', '.join(domains)} (acme.sh, HTTP-01 through nginx, zone not at Porkbun)")
     conf = "server {\n    listen 80;\n    listen [::]:80;\n    server_name " + " ".join(domains) + ";\n    location ^~ /.well-known/acme-challenge/ { root /var/www/acme; default_type \"text/plain\"; }\n    location / { return 301 https://$host$request_uri; }\n}\n"
     ssh_put(conf, f"/etc/nginx/sites-available/{s['site']}", "0644")
-    ssh("root", f"install -d -m 0755 /var/www/acme && ln -sf /etc/nginx/sites-available/{s['site']} /etc/nginx/sites-enabled/{s['site']} && nginx -t 2>&1 | tail -n1 && systemctl reload nginx")
+    ssh("root", f"install -d -m 0755 /var/www/acme && ln -sf /etc/nginx/sites-available/{s['site']} /etc/nginx/sites-enabled/{s['site']} && {{ nginx -t 2>/tmp/nginx-t.log || {{ tail -n3 /tmp/nginx-t.log; exit 1; }}; }} && systemctl reload nginx")
     ds = " ".join(f"-d {shlex.quote(d)}" for d in domains)
     ssh("root", "test -x /root/.acme.sh/acme.sh || curl -fsSL https://get.acme.sh | env HOME=/root sh -s email=" + ACME_EMAIL + " >/dev/null")
-    out = ssh("root", f"install -d -m 0750 {cert_dir} && env HOME=/root /root/.acme.sh/acme.sh --issue --server letsencrypt --webroot /var/www/acme {ds} --force >/tmp/acme-{s['site']}.log 2>&1 || {{ tail -n 25 /tmp/acme-{s['site']}.log; exit 1; }}", check=False, timeout=1800)
+    out = ssh("root", f"install -d -m 0750 {cert_dir} && umask 022 && env HOME=/root /root/.acme.sh/acme.sh --issue --server letsencrypt --webroot /var/www/acme {ds} --force >/tmp/acme-{s['site']}.log 2>&1 || {{ tail -n 25 /tmp/acme-{s['site']}.log; exit 1; }}", check=False, timeout=1800)
     if out.strip() and "Cert success" not in out: die(out)
     ssh("root", f"env HOME=/root /root/.acme.sh/acme.sh --install-cert -d {shlex.quote(domains[0])} --fullchain-file {cert_dir}/fullchain.pem --key-file {cert_dir}/privkey.pem --reloadcmd 'systemctl reload nginx' >/dev/null")
     note(ssh("root", f"openssl x509 -in {cert_dir}/fullchain.pem -noout -subject -enddate | tr '\\n' ' '").strip())
@@ -1049,7 +1049,7 @@ def cmd_vhost(args):
         conf += "\nserver {\n    listen 80;\n    listen [::]:80;\n    server_name " + p["host"] + ";\n    return 301 https://$host$request_uri;\n}\n"
     log(f"nginx vhost {s['site']} -> 127.0.0.1:{s['port']} ({', '.join(domains)})")
     ssh_put(conf, f"/tmp/dev2-site-{s['site']}.conf", "0644")
-    ssh("root", f"f=/etc/nginx/sites-available/{s['site']}; if [ -e $f ]; then n=1; while [ -e $f.bak-$(printf %03d $n) ]; do n=$((n+1)); done; cp -a $f $f.bak-$(printf %03d $n); fi; install -m 0644 /tmp/dev2-site-{s['site']}.conf $f && ln -sf $f /etc/nginx/sites-enabled/{s['site']} && nginx -t 2>&1 | tail -n1 && systemctl reload nginx")
+    ssh("root", f"f=/etc/nginx/sites-available/{s['site']}; if [ -e $f ]; then n=1; while [ -e $f.bak-$(printf %03d $n) ]; do n=$((n+1)); done; cp -a $f $f.bak-$(printf %03d $n); fi; install -m 0644 /tmp/dev2-site-{s['site']}.conf $f && ln -sf $f /etc/nginx/sites-enabled/{s['site']} && {{ nginx -t 2>/tmp/nginx-t.log || {{ tail -n3 /tmp/nginx-t.log; exit 1; }}; }} && systemctl reload nginx")
     mark(s["site"], "vhost")
 
 def cmd_verify(args):

From 4393b0396d8229fe8a251b48c19b92ab59bd6b38 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 18:59:31 +0000
Subject: [PATCH 103/104] sites.d: bittorrented.com (not a Railway site;
 Supabase stack only, app stays on the DO droplet)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/sites.d/bittorrented.com.json | 33 ++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 dev2/sites.d/bittorrented.com.json

diff --git a/dev2/sites.d/bittorrented.com.json b/dev2/sites.d/bittorrented.com.json
new file mode 100644
index 0000000..8f2cf12
--- /dev/null
+++ b/dev2/sites.d/bittorrented.com.json
@@ -0,0 +1,33 @@
+{
+ "site": "bittorrented.com",
+ "service": "bittorrented.com",
+ "repo": "profullstack/media-streamer",
+ "image": null,
+ "domains": [
+  "bittorrented.com",
+  "www.bittorrented.com"
+ ],
+ "db": "supabase",
+ "db_kinds": [
+  "supabase"
+ ],
+ "redis": false,
+ "volumes": [],
+ "companions": [],
+ "infra": [],
+ "project": null,
+ "project_id": null,
+ "environment_id": null,
+ "service_id": null,
+ "port": 3290,
+ "cloud_ref": "ussbjnpovrynxyztjeeb",
+ "app_host": "do (DigitalOcean droplet 137.184.114.110, user ubuntu, systemd bittorrented.service); NOT on dev2",
+ "notes": "Not a Railway site: only the Supabase stack lives on dev2 (supabase.bittorrented.com). DNS at DigitalOcean, so the cert is HTTP-01. The app, its workers and bitmagnet run on the droplet and were re-pointed by hand; never provision/deploy/dns/cutover this site with the kit.",
+ "proxies": [
+  {
+   "host": "supabase.bittorrented.com",
+   "port": 8290,
+   "max_body": "512m"
+  }
+ ]
+}

From 9995d4b0d9c34b867a0802338f18384192a4b625 Mon Sep 17 00:00:00 2001
From: Anthony Ettinger <anthony@chovy.com>
Date: Fri, 25 Sep 2026 22:22:38 +0000
Subject: [PATCH 104/104] supabase-load: extensions into the extensions schema
 (cloud DDL says extensions.gin_trgm_ops); skip generated columns in the URL
 rewrite

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 dev2/templates/supabase-load.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dev2/templates/supabase-load.sh b/dev2/templates/supabase-load.sh
index b1d12e9..e386d04 100755
--- a/dev2/templates/supabase-load.sh
+++ b/dev2/templates/supabase-load.sh
@@ -36,7 +36,7 @@ fi
 if [ "$POST_ONLY" = 0 ]; then
   log "Extensions the cloud had"
   while read -r e <&3; do [ -n "$e" ] || continue; case $e in plpgsql|pg_graphql|pgsodium|supabase_vault|pg_stat_statements|pgjwt) continue;; esac
-    psql_admin -v ON_ERROR_STOP=1 -c "create extension if not exists \"$e\" cascade" >/dev/null 2>&1 && echo "    $e" || echo "    $e: NOT AVAILABLE (dump may fail on objects using it)"; done 3< "$DUMP/extensions.txt"
+    psql_admin -v ON_ERROR_STOP=1 -c "create extension if not exists \"$e\" with schema extensions cascade" >/dev/null 2>&1 && echo "    $e" || { psql_admin -v ON_ERROR_STOP=1 -c "create extension if not exists \"$e\" cascade" >/dev/null 2>&1 && echo "    $e (own schema)" || echo "    $e: NOT AVAILABLE (dump may fail on objects using it)"; }; done 3< "$DUMP/extensions.txt"
   log "Schema"
   grep -qE 'CREATE SCHEMA "?(auth|storage)"?' "$DUMP/schema.sql" && die "schema.sql contains auth/storage DDL"
   psql_admin -f /dev/stdin < "$DUMP/schema.sql" > "$DUMP/schema.load.log" 2>&1 || true
@@ -84,7 +84,7 @@ strict -At <<SQL
 do \$\$ declare r record; n bigint; total bigint := 0; begin
   for r in select table_schema s, table_name t, column_name c, data_type d from information_schema.columns
            where table_schema not in ('pg_catalog','information_schema','auth','storage','realtime','_realtime','supabase_functions','supabase_migrations','graphql','graphql_public','extensions','vault','pgsodium','cron','net','_analytics','_supavisor')
-             and data_type in ('text','character varying','jsonb','json')
+             and data_type in ('text','character varying','jsonb','json') and is_generated = 'NEVER'
              and (table_schema, table_name) in (select schemaname, tablename from pg_tables) loop
     if r.d in ('jsonb','json') then
       execute format('update %I.%I set %I = replace(%I::text, %L, %L)::%s where %I::text like %L', r.s, r.t, r.c, r.c, 'https://$CLOUD_REF.supabase.co', 'https://$NEW_HOST', r.d, r.c, '%$CLOUD_REF.supabase.co%');