From 1252510698142c106b53e8c3bc08b4210c4c3828 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Thu, 10 Oct 2024 12:16:58 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .rubocop_todo/gitlab/bounded_contexts.yml     |   2 +-
 .rubocop_todo/layout/line_length.yml          |   1 -
 .../string_identifier_argument.yml            |   1 -
 .rubocop_todo/rspec/expect_in_hook.yml        |   1 -
 .../javascripts/access_level/constants.js     |  19 +
 .../components/merge_requests_list_app.vue    |  24 +
 .../javascripts/merge_requests/list/index.js  |   2 +
 .../queries/merge_request.fragment.graphql    |   2 +
 .../projects/your_work/components/app.vue     |  30 +-
 .../your_work/components/tab_view.vue         |  47 +-
 .../projects/your_work/constants.js           |   9 +
 .../graphql/queries/projects.query.graphql    |   8 +
 .../queries/user_projects.query.graphql       |  28 +-
 .../security_configuration/components/app.vue |   8 +-
 .../list/components/issuable_item.vue         |   1 +
 .../list/components/issuable_list_root.vue    |   3 +
 app/assets/stylesheets/pages/events.scss      |  11 -
 .../projects/compare_controller.rb            |  24 +-
 app/graphql/types/merge_request_type.rb       |   3 +
 app/helpers/merge_requests_helper.rb          |   3 +-
 .../concerns/update_namespace_statistics.rb   |   4 +-
 app/models/namespace_statistics.rb            |   6 +-
 app/models/packages/conan/package.rb          |   2 +
 .../packages/conan/package_reference.rb       |   2 +
 app/models/packages/conan/package_revision.rb |  22 +
 app/models/project.rb                         |   6 +-
 .../packages/maven/cached_response.rb         |   6 +
 .../cancel_redundant_pipelines_service.rb     |  72 +--
 .../merge_requests/refresh_service.rb         |   2 +-
 ...undant_pipelines_without_hierarchy_cte.yml |   9 -
 config/routes/repository.rb                   |   3 +-
 ...l_boards_epic_board_positions_group_id.yml |   2 +-
 db/docs/packages_conan_package_revisions.yml  |  12 +
 ...create_packages_conan_package_revisions.rb |  21 +
 ...key_in_packages_conan_package_revisions.rb |  18 +
 ...key_in_packages_conan_package_revisions.rb |  17 +
 ...key_in_packages_conan_package_revisions.rb |  18 +
 ...ate_memberships_to_bulk_import_entities.rb |   9 +
 ...ll_boards_epic_board_positions_group_id.rb |  21 +
 ...es_correct_work_item_type_id_constraint.rb |  22 +
 db/schema_migrations/20240918122124           |   1 +
 db/schema_migrations/20240918124015           |   1 +
 db/schema_migrations/20240918124041           |   1 +
 db/schema_migrations/20240918124434           |   1 +
 db/schema_migrations/20241003214408           |   1 +
 db/schema_migrations/20241009232130           |   1 +
 db/schema_migrations/20241010054851           |   1 +
 db/structure.sql                              |  43 +-
 .../install_infrastructure.md                 |   2 +-
 doc/api/graphql/reference/index.md            |   2 +
 doc/ci/debugging.md                           |   2 +-
 doc/development/documentation/workflow.md     |   6 +-
 ..._runner_fleet_config_and_best_practices.md | 568 ++++++++++++++++++
 .../img/nodepool_illustration_example.png     | Bin 0 -> 57975 bytes
 .../img/runner_fleet_steps_diagram.png        | Bin 0 -> 13099 bytes
 .../runner_fleet_design_guides/index.md       |  18 +
 doc/user/group/saml_sso/index.md              |   2 +-
 doc/user/group/saml_sso/troubleshooting.md    |  19 +-
 doc/user/project/settings/import_export.md    |  10 +-
 .../workspace/gitlab_agent_configuration.md   |   3 +-
 lib/gitlab/email/receiver.rb                  |  49 +-
 lib/gitlab/email/service_desk/custom_email.rb |  16 +-
 lib/gitlab/email/service_desk_receiver.rb     |   3 +-
 locale/gitlab.pot                             |  24 +-
 rubocop/cop/gitlab/doc_url.rb                 |   2 +-
 .../projects/compare_controller_spec.rb       |  50 +-
 spec/db/schema_spec.rb                        |   2 +-
 .../packages/conan/package_revision.rb        |  10 +
 .../merge_requests_list_app_spec.js           |  23 +
 .../frontend/merge_requests/list/mock_data.js |   2 +
 .../projects/your_work/components/app_spec.js |  66 +-
 .../your_work/components/mock_data.js         |   5 +
 .../your_work/components/tab_view_spec.js     |  43 +-
 .../components/app_spec.js                    |   4 +-
 spec/graphql/types/merge_request_type_spec.rb |  15 +-
 spec/helpers/merge_requests_helper_spec.rb    |   3 +-
 spec/lib/gitlab/auth/visitor_location_spec.rb |   4 +-
 spec/lib/gitlab/database/sharding_key_spec.rb |   1 -
 spec/lib/gitlab/email/receiver_spec.rb        | 144 +++--
 .../email/service_desk/custom_email_spec.rb   |  53 +-
 spec/models/dependency_proxy/blob_spec.rb     |   2 +-
 spec/models/dependency_proxy/manifest_spec.rb |   2 +-
 spec/models/namespace_statistics_spec.rb      |   5 +-
 .../packages/conan/package_reference_spec.rb  |   5 +
 .../packages/conan/package_revision_spec.rb   |  50 ++
 spec/models/packages/conan/package_spec.rb    |   5 +
 spec/models/project_spec.rb                   |  14 +-
 .../packages/maven/cached_response_spec.rb    |  18 +
 ...te_namespace_statistics_shared_examples.rb |  44 +-
 ...service_desk_email_receiver_worker_spec.rb |   2 +-
 90 files changed, 1572 insertions(+), 277 deletions(-)
 create mode 100644 app/models/packages/conan/package_revision.rb
 delete mode 100644 config/feature_flags/gitlab_com_derisk/cancel_redundant_pipelines_without_hierarchy_cte.yml
 create mode 100644 db/docs/packages_conan_package_revisions.yml
 create mode 100644 db/migrate/20240918122124_create_packages_conan_package_revisions.rb
 create mode 100644 db/migrate/20240918124015_add_package_id_as_foreign_key_in_packages_conan_package_revisions.rb
 create mode 100644 db/migrate/20240918124041_add_project_id_as_foreign_key_in_packages_conan_package_revisions.rb
 create mode 100644 db/migrate/20240918124434_add_package_reference_id_as_foreign_key_in_packages_conan_package_revisions.rb
 create mode 100644 db/migrate/20241003214408_add_migrate_memberships_to_bulk_import_entities.rb
 create mode 100644 db/post_migrate/20241009232130_finalize_backfill_boards_epic_board_positions_group_id.rb
 create mode 100644 db/post_migrate/20241010054851_remove_issues_correct_work_item_type_id_constraint.rb
 create mode 100644 db/schema_migrations/20240918122124
 create mode 100644 db/schema_migrations/20240918124015
 create mode 100644 db/schema_migrations/20240918124041
 create mode 100644 db/schema_migrations/20240918124434
 create mode 100644 db/schema_migrations/20241003214408
 create mode 100644 db/schema_migrations/20241009232130
 create mode 100644 db/schema_migrations/20241010054851
 create mode 100644 doc/topics/runner_fleet_design_guides/gitlab_runner_fleet_config_and_best_practices.md
 create mode 100644 doc/topics/runner_fleet_design_guides/img/nodepool_illustration_example.png
 create mode 100644 doc/topics/runner_fleet_design_guides/img/runner_fleet_steps_diagram.png
 create mode 100644 doc/topics/runner_fleet_design_guides/index.md
 create mode 100644 spec/factories/packages/conan/package_revision.rb
 create mode 100644 spec/models/packages/conan/package_revision_spec.rb

diff --git a/.rubocop_todo/gitlab/bounded_contexts.yml b/.rubocop_todo/gitlab/bounded_contexts.yml
index bd1243ce30d76..424517f16ac09 100644
--- a/.rubocop_todo/gitlab/bounded_contexts.yml
+++ b/.rubocop_todo/gitlab/bounded_contexts.yml
@@ -3768,7 +3768,7 @@ Gitlab/BoundedContexts:
     - 'ee/lib/quality/seeders/dependencies.rb'
     - 'ee/lib/quality/seeders/insights/issues.rb'
     - 'ee/lib/quality/seeders/vulnerabilities.rb'
-    - 'ee/lib/sidebars/admin/menus/ai_powered_features_menu.rb'
+    - 'ee/lib/sidebars/admin/menus/self_hosted_models_menu.rb'
     - 'ee/lib/sidebars/admin/menus/code_suggestions_menu.rb'
     - 'ee/lib/sidebars/admin/menus/credentials_menu.rb'
     - 'ee/lib/sidebars/admin/menus/geo_menu.rb'
diff --git a/.rubocop_todo/layout/line_length.yml b/.rubocop_todo/layout/line_length.yml
index 9d43402f37318..5d7c4acf14cc3 100644
--- a/.rubocop_todo/layout/line_length.yml
+++ b/.rubocop_todo/layout/line_length.yml
@@ -342,7 +342,6 @@ Layout/LineLength:
     - 'app/models/namespace.rb'
     - 'app/models/namespace/package_setting.rb'
     - 'app/models/namespace_setting.rb'
-    - 'app/models/namespace_statistics.rb'
     - 'app/models/namespaces/traversal/linear.rb'
     - 'app/models/notification_setting.rb'
     - 'app/models/oauth_access_token.rb'
diff --git a/.rubocop_todo/performance/string_identifier_argument.yml b/.rubocop_todo/performance/string_identifier_argument.yml
index afbf8d66626b2..35e36337e493b 100644
--- a/.rubocop_todo/performance/string_identifier_argument.yml
+++ b/.rubocop_todo/performance/string_identifier_argument.yml
@@ -217,7 +217,6 @@ Performance/StringIdentifierArgument:
     - 'spec/support/shared_examples/models/concerns/cascading_namespace_setting_shared_examples.rb'
     - 'spec/support/shared_examples/models/concerns/cascading_project_setting_shared_examples.rb'
     - 'spec/support/shared_examples/models/concerns/integrations/reset_secret_fields_shared_examples.rb'
-    - 'spec/support/shared_examples/models/concerns/update_namespace_statistics_shared_examples.rb'
     - 'spec/support/shared_examples/models/email_format_shared_examples.rb'
     - 'spec/support/shared_examples/models/project_ci_cd_settings_shared_examples.rb'
     - 'spec/support/shared_examples/policies/project_policy_shared_examples.rb'
diff --git a/.rubocop_todo/rspec/expect_in_hook.yml b/.rubocop_todo/rspec/expect_in_hook.yml
index 743b8d7df529c..7411a614bcf3c 100644
--- a/.rubocop_todo/rspec/expect_in_hook.yml
+++ b/.rubocop_todo/rspec/expect_in_hook.yml
@@ -392,7 +392,6 @@ RSpec/ExpectInHook:
     - 'spec/support/shared_examples/lib/wikis_api_examples.rb'
     - 'spec/support/shared_examples/metrics/sampler_shared_examples.rb'
     - 'spec/support/shared_examples/models/concerns/has_wiki_shared_examples.rb'
-    - 'spec/support/shared_examples/models/concerns/update_namespace_statistics_shared_examples.rb'
     - 'spec/support/shared_examples/models/mentionable_shared_examples.rb'
     - 'spec/support/shared_examples/quick_actions/issuable/close_quick_action_shared_examples.rb'
     - 'spec/support/shared_examples/requests/api/helm_packages_shared_examples.rb'
diff --git a/app/assets/javascripts/access_level/constants.js b/app/assets/javascripts/access_level/constants.js
index 9257d71eb57f2..07885e0df5374 100644
--- a/app/assets/javascripts/access_level/constants.js
+++ b/app/assets/javascripts/access_level/constants.js
@@ -10,6 +10,25 @@ export const ACCESS_LEVEL_MAINTAINER_INTEGER = 40;
 export const ACCESS_LEVEL_OWNER_INTEGER = 50;
 export const ACCESS_LEVEL_ADMIN_INTEGER = 60;
 
+// Matches `app/graphql/types/access_level_enum.rb`
+export const ACCESS_LEVEL_NO_ACCESS_STRING = 'NO_ACCESS';
+export const ACCESS_LEVEL_MINIMAL_ACCESS_STRING = 'MINIMAL_ACCESS';
+export const ACCESS_LEVEL_GUEST_STRING = 'GUEST';
+export const ACCESS_LEVEL_REPORTER_STRING = 'REPORTER';
+export const ACCESS_LEVEL_DEVELOPER_STRING = 'DEVELOPER';
+export const ACCESS_LEVEL_MAINTAINER_STRING = 'MAINTAINER';
+export const ACCESS_LEVEL_OWNER_STRING = 'OWNER';
+
+export const ACCESS_LEVELS_INTEGER_TO_STRING = {
+  [ACCESS_LEVEL_NO_ACCESS_INTEGER]: ACCESS_LEVEL_NO_ACCESS_STRING,
+  [ACCESS_LEVEL_MINIMAL_ACCESS_INTEGER]: ACCESS_LEVEL_MINIMAL_ACCESS_STRING,
+  [ACCESS_LEVEL_GUEST_INTEGER]: ACCESS_LEVEL_GUEST_STRING,
+  [ACCESS_LEVEL_REPORTER_INTEGER]: ACCESS_LEVEL_REPORTER_STRING,
+  [ACCESS_LEVEL_DEVELOPER_INTEGER]: ACCESS_LEVEL_DEVELOPER_STRING,
+  [ACCESS_LEVEL_MAINTAINER_INTEGER]: ACCESS_LEVEL_MAINTAINER_STRING,
+  [ACCESS_LEVEL_OWNER_INTEGER]: ACCESS_LEVEL_OWNER_STRING,
+};
+
 const ACCESS_LEVEL_NO_ACCESS = __('No access');
 const ACCESS_LEVEL_MINIMAL_ACCESS = __('Minimal Access');
 const ACCESS_LEVEL_GUEST = __('Guest');
diff --git a/app/assets/javascripts/merge_requests/list/components/merge_requests_list_app.vue b/app/assets/javascripts/merge_requests/list/components/merge_requests_list_app.vue
index a182dd8b75bb7..3a7238b799ee5 100644
--- a/app/assets/javascripts/merge_requests/list/components/merge_requests_list_app.vue
+++ b/app/assets/javascripts/merge_requests/list/components/merge_requests_list_app.vue
@@ -2,6 +2,7 @@
 import { GlFilteredSearchToken, GlButton, GlLink, GlIcon, GlTooltipDirective } from '@gitlab/ui';
 import { isEmpty } from 'lodash';
 import ApprovalCount from 'ee_else_ce/merge_requests/components/approval_count.vue';
+import { sprintf, __ } from '~/locale';
 import Api from '~/api';
 import * as Sentry from '~/sentry/sentry_browser_wrapper';
 import { STATUS_ALL, STATUS_CLOSED, STATUS_OPEN, STATUS_MERGED } from '~/issues/constants';
@@ -129,6 +130,7 @@ export default {
     canBulkUpdate: { default: false },
     environmentNamesPath: { default: '' },
     mergeTrainsPath: { default: undefined },
+    defaultBranch: { default: '' },
   },
   data() {
     return {
@@ -676,6 +678,11 @@ export default {
         issuableEventHub.$emit('issuables:updateBulkEdit');
       });
     },
+    targetBranchTooltip(mergeRequest) {
+      return sprintf(__('Target branch: %{target_branch}'), {
+        target_branch: mergeRequest.targetBranch,
+      });
+    },
   },
   STATUS_OPEN,
 };
@@ -758,6 +765,23 @@ export default {
       <issuable-milestone v-if="issuable.milestone" :milestone="issuable.milestone" />
     </template>
 
+    <template #target-branch="{ issuable = {} }">
+      <span
+        v-if="issuable.targetBranch !== defaultBranch"
+        class="project-ref-path gl-inline-block gl-max-w-26 gl-truncate gl-align-bottom"
+        data-testid="target-branch"
+      >
+        <gl-link
+          v-gl-tooltip
+          :href="issuable.targetBranchPath"
+          :title="targetBranchTooltip(issuable)"
+          class="ref-name !gl-text-gray-500"
+        >
+          <gl-icon name="branch" :size="12" class="gl-mr-2" />{{ issuable.targetBranch }}
+        </gl-link>
+      </span>
+    </template>
+
     <template #statistics="{ issuable = {} }">
       <merge-request-statistics :merge-request="issuable" />
     </template>
diff --git a/app/assets/javascripts/merge_requests/list/index.js b/app/assets/javascripts/merge_requests/list/index.js
index f32fce0cee403..951859eccca62 100644
--- a/app/assets/javascripts/merge_requests/list/index.js
+++ b/app/assets/javascripts/merge_requests/list/index.js
@@ -35,6 +35,7 @@ export async function mountMergeRequestListsApp() {
     canBulkUpdate,
     environmentNamesPath,
     mergeTrainsPath,
+    defaultBranch,
   } = el.dataset;
 
   return new Vue({
@@ -67,6 +68,7 @@ export async function mountMergeRequestListsApp() {
       canBulkUpdate: parseBoolean(canBulkUpdate),
       environmentNamesPath,
       mergeTrainsPath,
+      defaultBranch,
     },
     render: (createComponent) => createComponent(MergeRequestsListApp),
   });
diff --git a/app/assets/javascripts/merge_requests/list/queries/merge_request.fragment.graphql b/app/assets/javascripts/merge_requests/list/queries/merge_request.fragment.graphql
index df38b0d30b842..d6ac8bd0fdc60 100644
--- a/app/assets/javascripts/merge_requests/list/queries/merge_request.fragment.graphql
+++ b/app/assets/javascripts/merge_requests/list/queries/merge_request.fragment.graphql
@@ -48,6 +48,8 @@ fragment MergeRequestFragment on MergeRequest {
   commitCount
   sourceBranchExists
   targetBranchExists
+  targetBranch
+  targetBranchPath
   taskCompletionStatus {
     completedCount
     count
diff --git a/app/assets/javascripts/projects/your_work/components/app.vue b/app/assets/javascripts/projects/your_work/components/app.vue
index 343ce80882483..bf28dced2a36c 100644
--- a/app/assets/javascripts/projects/your_work/components/app.vue
+++ b/app/assets/javascripts/projects/your_work/components/app.vue
@@ -1,6 +1,6 @@
 <script>
 import { GlTabs, GlTab, GlBadge, GlFilteredSearchToken } from '@gitlab/ui';
-import { isEqual } from 'lodash';
+import { isEqual, pick } from 'lodash';
 import { __ } from '~/locale';
 import { TIMESTAMP_TYPE_UPDATED_AT } from '~/vue_shared/components/resource_lists/constants';
 import { QUERY_PARAM_END_CURSOR, QUERY_PARAM_START_CURSOR } from '~/graphql_shared/constants';
@@ -23,6 +23,8 @@ import {
   CONTRIBUTED_TAB,
   CUSTOM_DASHBOARD_ROUTE_NAMES,
   PROJECT_DASHBOARD_TABS,
+  FILTERED_SEARCH_TOKEN_LANGUAGE,
+  FILTERED_SEARCH_TOKEN_MIN_ACCESS_LEVEL,
 } from '../constants';
 import projectCountsQuery from '../graphql/queries/project_counts.query.graphql';
 import TabView from './tab_view.vue';
@@ -90,7 +92,7 @@ export default {
     filteredSearchTokens() {
       return [
         {
-          type: 'language',
+          type: FILTERED_SEARCH_TOKEN_LANGUAGE,
           icon: 'lock',
           title: __('Language'),
           token: GlFilteredSearchToken,
@@ -103,7 +105,7 @@ export default {
           })),
         },
         {
-          type: 'min_access_level',
+          type: FILTERED_SEARCH_TOKEN_MIN_ACCESS_LEVEL,
           icon: 'user',
           title: __('Role'),
           token: GlFilteredSearchToken,
@@ -141,6 +143,22 @@ export default {
     endCursor() {
       return this.$route.query[QUERY_PARAM_END_CURSOR];
     },
+    routeQueryWithoutPagination() {
+      const {
+        [QUERY_PARAM_START_CURSOR]: startCursor,
+        [QUERY_PARAM_END_CURSOR]: endCursor,
+        ...routeQuery
+      } = this.$route.query;
+
+      return routeQuery;
+    },
+    filters() {
+      return pick(this.routeQueryWithoutPagination, [
+        FILTERED_SEARCH_TOKEN_LANGUAGE,
+        FILTERED_SEARCH_TOKEN_MIN_ACCESS_LEVEL,
+        FILTERED_SEARCH_TERM_KEY,
+      ]);
+    },
   },
   methods: {
     numberToMetricPrefix,
@@ -178,12 +196,12 @@ export default {
     onSortDirectionChange(isAscending) {
       const sort = this.createSortQuery({ sortBy: this.activeSortOption.value, isAscending });
 
-      this.pushQuery({ ...this.$route.query, sort });
+      this.pushQuery({ ...this.routeQueryWithoutPagination, sort });
     },
     onSortByChange(sortBy) {
       const sort = this.createSortQuery({ sortBy, isAscending: this.isAscending });
 
-      this.pushQuery({ ...this.$route.query, sort });
+      this.pushQuery({ ...this.routeQueryWithoutPagination, sort });
     },
     onFilter(filters) {
       const { sort } = this.$route.query;
@@ -219,6 +237,8 @@ export default {
           :tab="tab"
           :start-cursor="startCursor"
           :end-cursor="endCursor"
+          :sort="sort"
+          :filters="filters"
           @page-change="onPageChange"
         />
         <template v-else>{{ tab.text }}</template>
diff --git a/app/assets/javascripts/projects/your_work/components/tab_view.vue b/app/assets/javascripts/projects/your_work/components/tab_view.vue
index 44fe7bcf7fdfd..19a76851aeb40 100644
--- a/app/assets/javascripts/projects/your_work/components/tab_view.vue
+++ b/app/assets/javascripts/projects/your_work/components/tab_view.vue
@@ -7,6 +7,12 @@ import { __ } from '~/locale';
 import { createAlert } from '~/alert';
 import { formatGraphQLProjects } from '~/vue_shared/components/projects_list/utils';
 import { TIMESTAMP_TYPE_UPDATED_AT } from '~/vue_shared/components/resource_lists/constants';
+import { FILTERED_SEARCH_TERM_KEY } from '~/projects/filtered_search_and_sort/constants';
+import { ACCESS_LEVELS_INTEGER_TO_STRING } from '~/access_level/constants';
+import {
+  FILTERED_SEARCH_TOKEN_LANGUAGE,
+  FILTERED_SEARCH_TOKEN_MIN_ACCESS_LEVEL,
+} from '../constants';
 
 export default {
   name: 'YourWorkProjectsTabView',
@@ -21,6 +27,7 @@ export default {
     GlKeysetPagination,
     ProjectsList,
   },
+  inject: ['programmingLanguages'],
   props: {
     tab: {
       required: true,
@@ -36,6 +43,14 @@ export default {
       required: false,
       default: null,
     },
+    sort: {
+      type: String,
+      required: true,
+    },
+    filters: {
+      type: Object,
+      required: true,
+    },
   },
   data() {
     return {
@@ -47,7 +62,21 @@ export default {
       return {
         query: this.tab.query,
         variables() {
-          return { ...this.pagination, ...this.tab.variables };
+          const { transformVariables } = this.tab;
+
+          const variables = {
+            ...this.pagination,
+            ...this.tab.variables,
+            sort: this.sort,
+            programmingLanguageName: this.programmingLanguageName,
+            minAccessLevel: this.minAccessLevel,
+            search: this.search,
+          };
+          const transformedVariables = transformVariables
+            ? transformVariables(variables)
+            : variables;
+
+          return transformedVariables;
         },
         update(response) {
           const { nodes, pageInfo } = get(response, this.tab.queryPath);
@@ -90,6 +119,22 @@ export default {
     isLoading() {
       return this.$apollo.queries.projects.loading;
     },
+    search() {
+      return this.filters[FILTERED_SEARCH_TERM_KEY];
+    },
+    minAccessLevel() {
+      const { [FILTERED_SEARCH_TOKEN_MIN_ACCESS_LEVEL]: minAccessLevelInteger } = this.filters;
+
+      return minAccessLevelInteger && ACCESS_LEVELS_INTEGER_TO_STRING[minAccessLevelInteger];
+    },
+    programmingLanguageName() {
+      const { [FILTERED_SEARCH_TOKEN_LANGUAGE]: programmingLanguageId } = this.filters;
+
+      return (
+        programmingLanguageId &&
+        this.programmingLanguages.find(({ id }) => id === parseInt(programmingLanguageId, 10))?.name
+      );
+    },
   },
   methods: {
     onDeleteComplete() {
diff --git a/app/assets/javascripts/projects/your_work/constants.js b/app/assets/javascripts/projects/your_work/constants.js
index 27426f611a85c..60c4a6cd0f994 100644
--- a/app/assets/javascripts/projects/your_work/constants.js
+++ b/app/assets/javascripts/projects/your_work/constants.js
@@ -2,12 +2,18 @@ import { __ } from '~/locale';
 import projectsQuery from './graphql/queries/projects.query.graphql';
 import userProjectsQuery from './graphql/queries/user_projects.query.graphql';
 
+const transformSortToUpperCase = (variables) => ({
+  ...variables,
+  sort: variables.sort.toUpperCase(),
+});
+
 export const CONTRIBUTED_TAB = {
   text: __('Contributed'),
   value: 'contributed',
   query: userProjectsQuery,
   variables: { contributed: true },
   queryPath: 'currentUser.contributedProjects',
+  transformVariables: transformSortToUpperCase,
 };
 
 export const STARRED_TAB = {
@@ -16,6 +22,7 @@ export const STARRED_TAB = {
   query: userProjectsQuery,
   variables: { starred: true },
   queryPath: 'currentUser.starredProjects',
+  transformVariables: transformSortToUpperCase,
 };
 
 export const PERSONAL_TAB = {
@@ -66,3 +73,5 @@ export const CUSTOM_DASHBOARD_ROUTE_NAMES = [
 
 export const FILTERED_SEARCH_NAMESPACE = 'dashboard';
 export const FILTERED_SEARCH_TERM_KEY = 'name';
+export const FILTERED_SEARCH_TOKEN_LANGUAGE = 'language';
+export const FILTERED_SEARCH_TOKEN_MIN_ACCESS_LEVEL = 'min_access_level';
diff --git a/app/assets/javascripts/projects/your_work/graphql/queries/projects.query.graphql b/app/assets/javascripts/projects/your_work/graphql/queries/projects.query.graphql
index 1658e4d3fb74f..815c834fa0408 100644
--- a/app/assets/javascripts/projects/your_work/graphql/queries/projects.query.graphql
+++ b/app/assets/javascripts/projects/your_work/graphql/queries/projects.query.graphql
@@ -9,6 +9,10 @@ query getYourWorkProjects(
   $last: Int
   $before: String
   $after: String
+  $sort: String
+  $search: String
+  $minAccessLevel: AccessLevelEnum
+  $programmingLanguageName: String
 ) {
   projects(
     archived: $archived
@@ -18,6 +22,10 @@ query getYourWorkProjects(
     last: $last
     before: $before
     after: $after
+    sort: $sort
+    search: $search
+    minAccessLevel: $minAccessLevel
+    programmingLanguageName: $programmingLanguageName
   ) {
     nodes {
       ...Project
diff --git a/app/assets/javascripts/projects/your_work/graphql/queries/user_projects.query.graphql b/app/assets/javascripts/projects/your_work/graphql/queries/user_projects.query.graphql
index 07bdfd921af30..0af14e1aaa192 100644
--- a/app/assets/javascripts/projects/your_work/graphql/queries/user_projects.query.graphql
+++ b/app/assets/javascripts/projects/your_work/graphql/queries/user_projects.query.graphql
@@ -8,11 +8,23 @@ query getYourWorkUserProjects(
   $last: Int
   $before: String
   $after: String
+  $sort: ProjectSort
+  $search: String
+  $minAccessLevel: AccessLevelEnum
+  $programmingLanguageName: String
 ) {
   currentUser {
     id
-    contributedProjects(first: $first, last: $last, before: $before, after: $after)
-      @include(if: $contributed) {
+    contributedProjects(
+      first: $first
+      last: $last
+      before: $before
+      after: $after
+      sort: $sort
+      search: $search
+      minAccessLevel: $minAccessLevel
+      programmingLanguageName: $programmingLanguageName
+    ) @include(if: $contributed) {
       nodes {
         ...Project
       }
@@ -20,8 +32,16 @@ query getYourWorkUserProjects(
         ...PageInfo
       }
     }
-    starredProjects(first: $first, last: $last, before: $before, after: $after)
-      @include(if: $starred) {
+    starredProjects(
+      first: $first
+      last: $last
+      before: $before
+      after: $after
+      sort: $sort
+      search: $search
+      minAccessLevel: $minAccessLevel
+      programmingLanguageName: $programmingLanguageName
+    ) @include(if: $starred) {
       nodes {
         ...Project
       }
diff --git a/app/assets/javascripts/security_configuration/components/app.vue b/app/assets/javascripts/security_configuration/components/app.vue
index 623596a35eb1c..9a71cf5cd06d9 100644
--- a/app/assets/javascripts/security_configuration/components/app.vue
+++ b/app/assets/javascripts/security_configuration/components/app.vue
@@ -5,6 +5,7 @@ import LocalStorageSync from '~/vue_shared/components/local_storage_sync.vue';
 import UserCalloutDismisser from '~/vue_shared/components/user_callout_dismisser.vue';
 import SectionLayout from '~/vue_shared/security_configuration/components/section_layout.vue';
 import SafeHtml from '~/vue_shared/directives/safe_html';
+import PageHeading from '~/vue_shared/components/page_heading.vue';
 import { SERVICE_PING_SECURITY_CONFIGURATION_THREAT_MANAGEMENT_VISIT } from '~/tracking/constants';
 import { REPORT_TYPE_CONTAINER_SCANNING_FOR_REGISTRY } from '~/vue_shared/security_reports/constants';
 import {
@@ -41,6 +42,7 @@ export default {
       import(
         'ee_component/security_configuration/components/container_scanning_for_registry_feature_card.vue'
       ),
+    PageHeading,
   },
   directives: { SafeHtml },
   inject: ['projectFullPath', 'vulnerabilityTrainingDocsPath'],
@@ -158,9 +160,9 @@ export default {
         <auto-dev-ops-alert v-if="shouldShowCallout" class="gl-mt-3" @dismiss="dismiss" />
       </template>
     </user-callout-dismisser>
-    <header>
-      <h1 class="gl-text-size-h1">{{ $options.i18n.securityConfiguration }}</h1>
-    </header>
+
+    <page-heading :heading="$options.i18n.securityConfiguration" />
+
     <user-callout-dismisser v-if="canUpgrade" feature-name="security_configuration_upgrade_banner">
       <template #default="{ dismiss, shouldShowCallout }">
         <upgrade-banner v-if="shouldShowCallout" @close="dismiss" />
diff --git a/app/assets/javascripts/vue_shared/issuable/list/components/issuable_item.vue b/app/assets/javascripts/vue_shared/issuable/list/components/issuable_item.vue
index a600c63d7e7e2..ac07c6f9884cf 100644
--- a/app/assets/javascripts/vue_shared/issuable/list/components/issuable_item.vue
+++ b/app/assets/javascripts/vue_shared/issuable/list/components/issuable_item.vue
@@ -444,6 +444,7 @@ export default {
             </gl-sprintf>
           </span>
           <slot name="timeframe"></slot>
+          <slot name="target-branch"></slot>
         </span>
         <p
           v-if="labels.length"
diff --git a/app/assets/javascripts/vue_shared/issuable/list/components/issuable_list_root.vue b/app/assets/javascripts/vue_shared/issuable/list/components/issuable_list_root.vue
index becd8bf6efff6..aa2e91fef4798 100644
--- a/app/assets/javascripts/vue_shared/issuable/list/components/issuable_list_root.vue
+++ b/app/assets/javascripts/vue_shared/issuable/list/components/issuable_list_root.vue
@@ -406,6 +406,9 @@ export default {
           <template #timeframe>
             <slot name="timeframe" :issuable="issuable"></slot>
           </template>
+          <template #target-branch>
+            <slot name="target-branch" :issuable="issuable"></slot>
+          </template>
           <template #status>
             <slot name="status" :issuable="issuable"></slot>
           </template>
diff --git a/app/assets/stylesheets/pages/events.scss b/app/assets/stylesheets/pages/events.scss
index 2ece0804d45a7..d0b5a63567fb5 100644
--- a/app/assets/stylesheets/pages/events.scss
+++ b/app/assets/stylesheets/pages/events.scss
@@ -75,10 +75,6 @@
         .badge.badge-pill {
           color: $gl-text-color;
         }
-
-        iframe.twitter-share-button {
-          vertical-align: bottom;
-        }
       }
 
       code {
@@ -104,13 +100,6 @@
         margin-bottom: 0;
       }
     }
-
-    .event-note-icon {
-      color: $gray-500;
-      float: left;
-      font-size: $gl-font-size;
-      margin-right: 5px;
-    }
   }
 
   &:last-child {
diff --git a/app/controllers/projects/compare_controller.rb b/app/controllers/projects/compare_controller.rb
index 599bfd75e146d..673dc1838d608 100644
--- a/app/controllers/projects/compare_controller.rb
+++ b/app/controllers/projects/compare_controller.rb
@@ -44,17 +44,14 @@ def diff_for_path
   end
 
   def create
-    from_to_vars = {
-      from: compare_params[:from].presence,
-      to: compare_params[:to].presence,
-      from_project_id: compare_params[:from_project_id].presence,
-      straight: compare_params[:straight].presence
-    }
+    from_to_vars = build_from_to_vars
 
     if from_to_vars[:from].blank? || from_to_vars[:to].blank?
       flash[:alert] = "You must select a Source and a Target revision"
 
       redirect_to project_compare_index_path(source_project, from_to_vars)
+    elsif compare_params[:straight] == "true"
+      redirect_to project_compare_with_two_dots_path(source_project, from_to_vars)
     else
       redirect_to project_compare_path(source_project, from_to_vars)
     end
@@ -77,6 +74,19 @@ def signatures
 
   private
 
+  def build_from_to_vars
+    from_to_vars = {
+      from: compare_params[:from].presence,
+      to: compare_params[:to].presence
+    }
+
+    if compare_params[:from_project_id] != compare_params[:to_project_id]
+      from_to_vars[:from_project_id] = compare_params[:from_project_id].presence
+    end
+
+    from_to_vars
+  end
+
   def validate_refs!
     invalid = [head_ref, start_ref].filter { |ref| !valid_ref?(ref) }
 
@@ -169,6 +179,6 @@ def merge_request
   # rubocop: enable CodeReuse/ActiveRecord
 
   def compare_params
-    @compare_params ||= params.permit(:from, :to, :from_project_id, :straight)
+    @compare_params ||= params.permit(:from, :to, :from_project_id, :straight, :to_project_id)
   end
 end
diff --git a/app/graphql/types/merge_request_type.rb b/app/graphql/types/merge_request_type.rb
index ccffb5b546d13..2fd8e6133c1d9 100644
--- a/app/graphql/types/merge_request_type.rb
+++ b/app/graphql/types/merge_request_type.rb
@@ -56,6 +56,9 @@ class MergeRequestType < BaseObject
       description: 'State of the merge request.'
     field :target_branch, GraphQL::Types::String, null: false,
       description: 'Target branch of the merge request.'
+    field :target_branch_path, GraphQL::Types::String, method: :target_branch_commits_path, null: true,
+      calls_gitaly: true,
+      description: 'Path to the target branch of the merge request.'
     field :target_project, Types::ProjectType, null: false,
       description: 'Target project of the merge request.'
     field :target_project_id, GraphQL::Types::Int, null: false,
diff --git a/app/helpers/merge_requests_helper.rb b/app/helpers/merge_requests_helper.rb
index 93b4f644a255a..c6c8da51b1a54 100644
--- a/app/helpers/merge_requests_helper.rb
+++ b/app/helpers/merge_requests_helper.rb
@@ -249,7 +249,8 @@ def project_merge_requests_list_data(project, current_user)
       rss_url: url_for(safe_params.merge(rss_url_options)),
       releases_endpoint: project_releases_path(project, format: :json),
       can_bulk_update: can?(current_user, :admin_merge_request, project).to_s,
-      environment_names_path: unfoldered_environment_names_project_path(project, :json)
+      environment_names_path: unfoldered_environment_names_project_path(project, :json),
+      default_branch: project.default_branch
     }
   end
 
diff --git a/app/models/concerns/update_namespace_statistics.rb b/app/models/concerns/update_namespace_statistics.rb
index 26d6fc102282a..694a0f51179ea 100644
--- a/app/models/concerns/update_namespace_statistics.rb
+++ b/app/models/concerns/update_namespace_statistics.rb
@@ -46,8 +46,10 @@ def update_namespace_statistics?
     end
 
     def schedule_namespace_statistics_refresh
+      return unless namespace
+
       run_after_commit do
-        Groups::UpdateStatisticsWorker.perform_async(namespace.id, [self.class.namespace_statistics_name])
+        Groups::UpdateStatisticsWorker.perform_async(namespace.id, [self.class.namespace_statistics_name.to_s])
       end
     end
   end
diff --git a/app/models/namespace_statistics.rb b/app/models/namespace_statistics.rb
index d718b3b9f8796..3a39c52943554 100644
--- a/app/models/namespace_statistics.rb
+++ b/app/models/namespace_statistics.rb
@@ -39,7 +39,11 @@ def update_storage_size
   def update_dependency_proxy_size
     return unless group_namespace?
 
-    self.dependency_proxy_size = namespace.dependency_proxy_manifests.sum(:size) + namespace.dependency_proxy_blobs.sum(:size)
+    self.dependency_proxy_size = [
+      namespace.dependency_proxy_manifests,
+      namespace.dependency_proxy_blobs,
+      ::VirtualRegistries::Packages::Maven::CachedResponse.for_group(namespace)
+    ].sum { |rel| rel.sum(:size) }
   end
 
   def self.columns_to_refresh
diff --git a/app/models/packages/conan/package.rb b/app/models/packages/conan/package.rb
index 3b9cd0fbe0568..2683a79e7a4c4 100644
--- a/app/models/packages/conan/package.rb
+++ b/app/models/packages/conan/package.rb
@@ -11,6 +11,8 @@ class Package < Packages::Package
 
       has_many :conan_package_references, inverse_of: :package, class_name: 'Packages::Conan::PackageReference'
 
+      has_many :conan_package_revisions, inverse_of: :package, class_name: 'Packages::Conan::PackageRevision'
+
       accepts_nested_attributes_for :conan_metadatum
 
       delegate :recipe, :recipe_path, to: :conan_metadatum, prefix: :conan
diff --git a/app/models/packages/conan/package_reference.rb b/app/models/packages/conan/package_reference.rb
index 5b5b960c92753..8cfea86bde200 100644
--- a/app/models/packages/conan/package_reference.rb
+++ b/app/models/packages/conan/package_reference.rb
@@ -16,6 +16,8 @@ class PackageReference < ApplicationRecord
         inverse_of: :conan_package_references
       belongs_to :project
 
+      has_many :package_revisions, inverse_of: :package_reference, class_name: 'Packages::Conan::PackageRevision'
+
       validates :package, :project, presence: true
       validates :reference, presence: true, bytesize: { maximum: -> { REFERENCE_LENGTH_MAX } },
         uniqueness: { scope: [:package_id, :recipe_revision_id] }
diff --git a/app/models/packages/conan/package_revision.rb b/app/models/packages/conan/package_revision.rb
new file mode 100644
index 0000000000000..8e718cede7c76
--- /dev/null
+++ b/app/models/packages/conan/package_revision.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Packages
+  module Conan
+    class PackageRevision < ApplicationRecord
+      include ShaAttribute
+
+      REVISION_LENGTH_MAX = 20
+
+      sha_attribute :revision
+
+      belongs_to :package, class_name: 'Packages::Conan::Package', inverse_of: :conan_package_revisions
+      belongs_to :package_reference, class_name: 'Packages::Conan::PackageReference',
+        inverse_of: :package_revisions
+      belongs_to :project
+
+      validates :package, :package_reference, :project, presence: true
+      validates :revision, presence: true, bytesize: { maximum: -> { REVISION_LENGTH_MAX } },
+        uniqueness: { scope: [:package_id, :package_reference_id] }
+    end
+  end
+end
diff --git a/app/models/project.rb b/app/models/project.rb
index a9428e67382ac..b510158bf1457 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -3043,7 +3043,7 @@ def service_desk_incoming_address
     config = Gitlab.config.incoming_email
     wildcard = Gitlab::Email::Common::WILDCARD_PLACEHOLDER
 
-    config.address&.gsub(wildcard, "#{full_path_slug}-#{default_service_desk_suffix}")
+    config.address&.gsub(wildcard, default_service_desk_subaddress_part)
   end
 
   def service_desk_alias_address
@@ -3060,6 +3060,10 @@ def service_desk_custom_address
     service_desk_setting.custom_email
   end
 
+  def default_service_desk_subaddress_part
+    "#{full_path_slug}-#{default_service_desk_suffix}"
+  end
+
   def default_service_desk_suffix
     "#{id}-issue-"
   end
diff --git a/app/models/virtual_registries/packages/maven/cached_response.rb b/app/models/virtual_registries/packages/maven/cached_response.rb
index d3d84834b133b..a4449300ce604 100644
--- a/app/models/virtual_registries/packages/maven/cached_response.rb
+++ b/app/models/virtual_registries/packages/maven/cached_response.rb
@@ -6,10 +6,15 @@ module Maven
       class CachedResponse < ApplicationRecord
         include FileStoreMounter
         include Gitlab::SQL::Pattern
+        include ::UpdateNamespaceStatistics
 
         belongs_to :group
         belongs_to :upstream, class_name: 'VirtualRegistries::Packages::Maven::Upstream', inverse_of: :cached_responses
 
+        alias_attribute :namespace, :group
+
+        update_namespace_statistics namespace_statistics_name: :dependency_proxy_size
+
         # Used in destroying stale cached responses in DestroyOrphanCachedResponsesWorker
         enum :status, default: 0, processing: 1, error: 3
 
@@ -43,6 +48,7 @@ class CachedResponse < ApplicationRecord
         end
         scope :orphan, -> { where(upstream: nil) }
         scope :pending_destruction, -> { orphan.default }
+        scope :for_group, ->(group) { where(group: group) }
 
         def self.next_pending_destruction
           pending_destruction.lock('FOR UPDATE SKIP LOCKED').take
diff --git a/app/services/ci/pipeline_creation/cancel_redundant_pipelines_service.rb b/app/services/ci/pipeline_creation/cancel_redundant_pipelines_service.rb
index 363f7c069a06c..443ebc666fe51 100644
--- a/app/services/ci/pipeline_creation/cancel_redundant_pipelines_service.rb
+++ b/app/services/ci/pipeline_creation/cancel_redundant_pipelines_service.rb
@@ -21,63 +21,13 @@ def execute
         return if pipeline.parent_pipeline? # skip if child pipeline
         return unless project.auto_cancel_pending_pipelines?
 
-        if Feature.enabled?(:cancel_redundant_pipelines_without_hierarchy_cte, @project)
-          auto_cancel_all_pipelines_with_cancelable_statuses
-
-          return
-        end
-
-        paginator.each do |ids|
-          pipelines = parent_and_child_pipelines(ids)
-
-          Gitlab::OptimisticLocking.retry_lock(pipelines, name: 'cancel_pending_pipelines') do |cancelables|
-            auto_cancel_pipelines(cancelables.ids)
-          end
-        end
+        auto_cancel_all_pipelines_with_cancelable_statuses
       end
 
       private
 
       attr_reader :pipeline, :project
 
-      def paginator
-        page = 1
-        Enumerator.new do |yielder|
-          loop do
-            # leverage the index_ci_pipelines_on_project_id_and_status_and_created_at index
-            records = project.all_pipelines
-              .created_after(pipelines_created_after)
-              .order(:status, :created_at)
-              .page(page) # use offset pagination because there is no other way to loop over the data
-              .per(PAGE_SIZE)
-              .pluck(:id)
-
-            raise StopIteration if records.empty?
-
-            yielder << records
-            page += 1
-          end
-        end
-      end
-
-      def parent_auto_cancelable_pipelines(ids)
-        scope = project.all_pipelines
-          .created_after(pipelines_created_after)
-          .for_ref(pipeline.ref)
-          .where_not_sha(project.commit(pipeline.ref).try(:id))
-          .where("created_at < ?", pipeline.created_at)
-          .for_status(CommitStatus::AVAILABLE_STATUSES) # Force usage of project_id_and_status_and_created_at_index
-          .ci_sources
-
-        scope.id_in(ids)
-      end
-
-      def parent_and_child_pipelines(ids)
-        Ci::Pipeline.object_hierarchy(parent_auto_cancelable_pipelines(ids), project_condition: :same)
-          .base_and_descendants
-          .cancelable
-      end
-
       def cancelable_status_pipeline_ids
         project.all_pipelines
           .for_ref(pipeline.ref)
@@ -165,26 +115,6 @@ def auto_cancel_all_pipelines_with_cancelable_statuses
       end
       # rubocop:enable Metrics/CyclomaticComplexity
 
-      def auto_cancel_pipelines(pipeline_ids)
-        ::Ci::Pipeline
-          .id_in(pipeline_ids)
-          .each do |cancelable_pipeline|
-            case cancelable_pipeline.auto_cancel_on_new_commit
-            when 'none'
-              # no-op
-            when 'conservative'
-              next unless conservative_cancellable_pipeline_ids(pipeline_ids).include?(cancelable_pipeline.id)
-
-              cancel_pipeline(cancelable_pipeline, safe_cancellation: false)
-            when 'interruptible'
-              cancel_pipeline(cancelable_pipeline, safe_cancellation: true)
-            else
-              raise ArgumentError,
-                "Unknown auto_cancel_on_new_commit value: #{cancelable_pipeline.auto_cancel_on_new_commit}"
-            end
-          end
-      end
-
       def conservative_cancellable_pipeline_ids(pipeline_ids)
         strong_memoize_with(:conservative_cancellable_pipeline_ids, pipeline_ids) do
           ::Ci::Pipeline.id_in(pipeline_ids).conservative_interruptible.ids
diff --git a/app/services/merge_requests/refresh_service.rb b/app/services/merge_requests/refresh_service.rb
index 5270f69a881be..0346ec35c87d9 100644
--- a/app/services/merge_requests/refresh_service.rb
+++ b/app/services/merge_requests/refresh_service.rb
@@ -194,7 +194,7 @@ def abort_auto_merges(merge_request)
       return unless abort_auto_merges?(merge_request)
 
       learn_more_url = Rails.application.routes.url_helpers.help_page_url(
-        'ci/pipelines/merge_trains',
+        'ci/pipelines/merge_trains.md',
         anchor: 'merge-request-dropped-from-the-merge-train'
       )
 
diff --git a/config/feature_flags/gitlab_com_derisk/cancel_redundant_pipelines_without_hierarchy_cte.yml b/config/feature_flags/gitlab_com_derisk/cancel_redundant_pipelines_without_hierarchy_cte.yml
deleted file mode 100644
index 67e40cbc90b52..0000000000000
--- a/config/feature_flags/gitlab_com_derisk/cancel_redundant_pipelines_without_hierarchy_cte.yml
+++ /dev/null
@@ -1,9 +0,0 @@
----
-name: cancel_redundant_pipelines_without_hierarchy_cte
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/438101
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/144273
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/463623
-milestone: '17.2'
-group: group::pipeline execution
-type: gitlab_com_derisk
-default_enabled: false
diff --git a/config/routes/repository.rb b/config/routes/repository.rb
index 2a94b1fe55ab2..6b03528990e71 100644
--- a/config/routes/repository.rb
+++ b/config/routes/repository.rb
@@ -6,7 +6,8 @@
 # Don't use format parameter as file extension (old 3.0.x behavior)
 # See http://guides.rubyonrails.org/routing.html#route-globbing-and-wildcard-segments
 scope format: false do
-  get '/compare/:from...:to', to: 'compare#show', as: 'compare', constraints: { from: /.+/, to: /.+/ }
+  get '/compare/:from...:to/', to: 'compare#show', as: 'compare', constraints: { from: /.+/, to: /.+/ }
+  get '/compare/:from..:to/', to: 'compare#show', as: 'compare_with_two_dots', constraints: { from: /.+/, to: /.+/ }, defaults: { straight: "true" }
 
   resources :compare, only: [:index, :create] do
     collection do
diff --git a/db/docs/batched_background_migrations/backfill_boards_epic_board_positions_group_id.yml b/db/docs/batched_background_migrations/backfill_boards_epic_board_positions_group_id.yml
index 9fbe2714875de..084259dffee28 100644
--- a/db/docs/batched_background_migrations/backfill_boards_epic_board_positions_group_id.yml
+++ b/db/docs/batched_background_migrations/backfill_boards_epic_board_positions_group_id.yml
@@ -5,4 +5,4 @@ feature_category: portfolio_management
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/153675
 milestone: '17.1'
 queued_migration_version: 20240521092459
-finalized_by: # version of the migration that finalized this BBM
+finalized_by: '20241009232130'
diff --git a/db/docs/packages_conan_package_revisions.yml b/db/docs/packages_conan_package_revisions.yml
new file mode 100644
index 0000000000000..9ebd91881bf4a
--- /dev/null
+++ b/db/docs/packages_conan_package_revisions.yml
@@ -0,0 +1,12 @@
+---
+table_name: packages_conan_package_revisions
+classes:
+- Packages::Conan::PackageRevision
+feature_categories:
+- package_registry
+description: Package Revision
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/167144
+milestone: '17.5'
+gitlab_schema: gitlab_main_cell
+sharding_key:
+  project_id: projects
diff --git a/db/migrate/20240918122124_create_packages_conan_package_revisions.rb b/db/migrate/20240918122124_create_packages_conan_package_revisions.rb
new file mode 100644
index 0000000000000..525f3fd3f04df
--- /dev/null
+++ b/db/migrate/20240918122124_create_packages_conan_package_revisions.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class CreatePackagesConanPackageRevisions < Gitlab::Database::Migration[2.2]
+  milestone '17.5'
+
+  UNIQ_IND_PACKAGE_REFERENCE_REVISION = 'uniq_idx_on_packages_conan_package_revisions_revision'
+
+  def change
+    create_table :packages_conan_package_revisions do |t| # rubocop:disable Migration/EnsureFactoryForTable -- https://gitlab.com/gitlab-org/gitlab/-/issues/468630
+      t.bigint :package_id, null: false
+      t.bigint :project_id, null: false
+      t.bigint :package_reference_id, null: false
+      t.timestamps_with_timezone null: false
+      t.binary :revision, null: false, limit: 20 # It is either an MD5 hash (16 bytes) or a SHA-1 hash (20 bytes)
+
+      t.index :project_id
+      t.index :package_reference_id
+      t.index [:package_id, :package_reference_id, :revision], unique: true, name: UNIQ_IND_PACKAGE_REFERENCE_REVISION
+    end
+  end
+end
diff --git a/db/migrate/20240918124015_add_package_id_as_foreign_key_in_packages_conan_package_revisions.rb b/db/migrate/20240918124015_add_package_id_as_foreign_key_in_packages_conan_package_revisions.rb
new file mode 100644
index 0000000000000..05ad5b089a1c2
--- /dev/null
+++ b/db/migrate/20240918124015_add_package_id_as_foreign_key_in_packages_conan_package_revisions.rb
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+class AddPackageIdAsForeignKeyInPackagesConanPackageRevisions < Gitlab::Database::Migration[2.2]
+  milestone '17.5'
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_foreign_key :packages_conan_package_revisions, :packages_packages, column: :package_id,
+      on_delete: :cascade
+  end
+
+  def down
+    with_lock_retries do
+      remove_foreign_key :packages_conan_package_revisions, column: :package_id
+    end
+  end
+end
diff --git a/db/migrate/20240918124041_add_project_id_as_foreign_key_in_packages_conan_package_revisions.rb b/db/migrate/20240918124041_add_project_id_as_foreign_key_in_packages_conan_package_revisions.rb
new file mode 100644
index 0000000000000..93c977e298474
--- /dev/null
+++ b/db/migrate/20240918124041_add_project_id_as_foreign_key_in_packages_conan_package_revisions.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AddProjectIdAsForeignKeyInPackagesConanPackageRevisions < Gitlab::Database::Migration[2.2]
+  milestone '17.5'
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_foreign_key :packages_conan_package_revisions, :projects, column: :project_id, on_delete: :cascade
+  end
+
+  def down
+    with_lock_retries do
+      remove_foreign_key :packages_conan_package_revisions, column: :project_id
+    end
+  end
+end
diff --git a/db/migrate/20240918124434_add_package_reference_id_as_foreign_key_in_packages_conan_package_revisions.rb b/db/migrate/20240918124434_add_package_reference_id_as_foreign_key_in_packages_conan_package_revisions.rb
new file mode 100644
index 0000000000000..e9bcbed79299a
--- /dev/null
+++ b/db/migrate/20240918124434_add_package_reference_id_as_foreign_key_in_packages_conan_package_revisions.rb
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+class AddPackageReferenceIdAsForeignKeyInPackagesConanPackageRevisions < Gitlab::Database::Migration[2.2]
+  milestone '17.5'
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_foreign_key :packages_conan_package_revisions, :packages_conan_package_references,
+      column: :package_reference_id, on_delete: :cascade
+  end
+
+  def down
+    with_lock_retries do
+      remove_foreign_key :packages_conan_package_revisions, column: :package_reference_id
+    end
+  end
+end
diff --git a/db/migrate/20241003214408_add_migrate_memberships_to_bulk_import_entities.rb b/db/migrate/20241003214408_add_migrate_memberships_to_bulk_import_entities.rb
new file mode 100644
index 0000000000000..1188b25a01d90
--- /dev/null
+++ b/db/migrate/20241003214408_add_migrate_memberships_to_bulk_import_entities.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AddMigrateMembershipsToBulkImportEntities < Gitlab::Database::Migration[2.2]
+  milestone '17.5'
+
+  def change
+    add_column :bulk_import_entities, :migrate_memberships, :boolean, default: true, null: false
+  end
+end
diff --git a/db/post_migrate/20241009232130_finalize_backfill_boards_epic_board_positions_group_id.rb b/db/post_migrate/20241009232130_finalize_backfill_boards_epic_board_positions_group_id.rb
new file mode 100644
index 0000000000000..3cc2d49a57187
--- /dev/null
+++ b/db/post_migrate/20241009232130_finalize_backfill_boards_epic_board_positions_group_id.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class FinalizeBackfillBoardsEpicBoardPositionsGroupId < Gitlab::Database::Migration[2.2]
+  milestone '17.5'
+
+  disable_ddl_transaction!
+
+  restrict_gitlab_migration gitlab_schema: :gitlab_main_cell
+
+  def up
+    ensure_batched_background_migration_is_finished(
+      job_class_name: 'BackfillBoardsEpicBoardPositionsGroupId',
+      table_name: :boards_epic_board_positions,
+      column_name: :id,
+      job_arguments: [:group_id, :boards_epic_boards, :group_id, :epic_board_id],
+      finalize: true
+    )
+  end
+
+  def down; end
+end
diff --git a/db/post_migrate/20241010054851_remove_issues_correct_work_item_type_id_constraint.rb b/db/post_migrate/20241010054851_remove_issues_correct_work_item_type_id_constraint.rb
new file mode 100644
index 0000000000000..70fa01327493d
--- /dev/null
+++ b/db/post_migrate/20241010054851_remove_issues_correct_work_item_type_id_constraint.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+class RemoveIssuesCorrectWorkItemTypeIdConstraint < Gitlab::Database::Migration[2.2]
+  milestone '17.5'
+
+  disable_ddl_transaction!
+
+  def up
+    with_lock_retries do
+      remove_foreign_key_if_exists :issues, column: :correct_work_item_type_id
+    end
+  end
+
+  def down
+    add_concurrent_foreign_key :issues,
+      :work_item_types,
+      column: :correct_work_item_type_id,
+      target_column: :correct_id,
+      validate: false,
+      on_delete: nil
+  end
+end
diff --git a/db/schema_migrations/20240918122124 b/db/schema_migrations/20240918122124
new file mode 100644
index 0000000000000..1c32a892502dc
--- /dev/null
+++ b/db/schema_migrations/20240918122124
@@ -0,0 +1 @@
+90eaec699835993470ed8b1df34a908532aa8def9ee599e296a020e71f05a8fb
\ No newline at end of file
diff --git a/db/schema_migrations/20240918124015 b/db/schema_migrations/20240918124015
new file mode 100644
index 0000000000000..f33a7a010b483
--- /dev/null
+++ b/db/schema_migrations/20240918124015
@@ -0,0 +1 @@
+7a7fbf9ac9b81ed5178bb80cdcdd2be01acbc1c8ae198e922e76bde1e2a2c2df
\ No newline at end of file
diff --git a/db/schema_migrations/20240918124041 b/db/schema_migrations/20240918124041
new file mode 100644
index 0000000000000..2d78c67d1876f
--- /dev/null
+++ b/db/schema_migrations/20240918124041
@@ -0,0 +1 @@
+0ea1c4c36e2ddb88033b928d5ddd39290313650312d7947efdcd63fa1bcfafec
\ No newline at end of file
diff --git a/db/schema_migrations/20240918124434 b/db/schema_migrations/20240918124434
new file mode 100644
index 0000000000000..46201de8c9184
--- /dev/null
+++ b/db/schema_migrations/20240918124434
@@ -0,0 +1 @@
+7515e7a251ce343eae09df9318ed6497ceaff4a290f90e404866cc4109d3c311
\ No newline at end of file
diff --git a/db/schema_migrations/20241003214408 b/db/schema_migrations/20241003214408
new file mode 100644
index 0000000000000..9985182927a93
--- /dev/null
+++ b/db/schema_migrations/20241003214408
@@ -0,0 +1 @@
+00864d1889155b6a72c188abd732e96fd531e0e652057901e38b41ab24810478
\ No newline at end of file
diff --git a/db/schema_migrations/20241009232130 b/db/schema_migrations/20241009232130
new file mode 100644
index 0000000000000..4b2107ed84cbd
--- /dev/null
+++ b/db/schema_migrations/20241009232130
@@ -0,0 +1 @@
+b5b91fa5252a6cffb0ae637fc57591e8c3212a993a11f72d38adc6ba44f96a0c
\ No newline at end of file
diff --git a/db/schema_migrations/20241010054851 b/db/schema_migrations/20241010054851
new file mode 100644
index 0000000000000..644e6e287c01c
--- /dev/null
+++ b/db/schema_migrations/20241010054851
@@ -0,0 +1 @@
+eada93a4417674d70f00bd15c88dcb26ca25a9d7711121c977cae162af004cb1
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index e4bac27b1100d..b4794a24d1657 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -7877,6 +7877,7 @@ CREATE TABLE bulk_import_entities (
     source_xid integer,
     migrate_projects boolean DEFAULT true NOT NULL,
     has_failures boolean DEFAULT false,
+    migrate_memberships boolean DEFAULT true NOT NULL,
     CONSTRAINT check_13f279f7da CHECK ((char_length(source_full_path) <= 255)),
     CONSTRAINT check_715d725ea2 CHECK ((char_length(destination_name) <= 255)),
     CONSTRAINT check_796a4d9cc6 CHECK ((char_length(jid) <= 255)),
@@ -15226,6 +15227,25 @@ CREATE SEQUENCE packages_conan_package_references_id_seq
 
 ALTER SEQUENCE packages_conan_package_references_id_seq OWNED BY packages_conan_package_references.id;
 
+CREATE TABLE packages_conan_package_revisions (
+    id bigint NOT NULL,
+    package_id bigint NOT NULL,
+    project_id bigint NOT NULL,
+    package_reference_id bigint NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL,
+    revision bytea NOT NULL
+);
+
+CREATE SEQUENCE packages_conan_package_revisions_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+ALTER SEQUENCE packages_conan_package_revisions_id_seq OWNED BY packages_conan_package_revisions.id;
+
 CREATE TABLE packages_conan_recipe_revisions (
     id bigint NOT NULL,
     package_id bigint NOT NULL,
@@ -22704,6 +22724,8 @@ ALTER TABLE ONLY packages_conan_metadata ALTER COLUMN id SET DEFAULT nextval('pa
 
 ALTER TABLE ONLY packages_conan_package_references ALTER COLUMN id SET DEFAULT nextval('packages_conan_package_references_id_seq'::regclass);
 
+ALTER TABLE ONLY packages_conan_package_revisions ALTER COLUMN id SET DEFAULT nextval('packages_conan_package_revisions_id_seq'::regclass);
+
 ALTER TABLE ONLY packages_conan_recipe_revisions ALTER COLUMN id SET DEFAULT nextval('packages_conan_recipe_revisions_id_seq'::regclass);
 
 ALTER TABLE ONLY packages_debian_group_architectures ALTER COLUMN id SET DEFAULT nextval('packages_debian_group_architectures_id_seq'::regclass);
@@ -25181,6 +25203,9 @@ ALTER TABLE ONLY packages_conan_metadata
 ALTER TABLE ONLY packages_conan_package_references
     ADD CONSTRAINT packages_conan_package_references_pkey PRIMARY KEY (id);
 
+ALTER TABLE ONLY packages_conan_package_revisions
+    ADD CONSTRAINT packages_conan_package_revisions_pkey PRIMARY KEY (id);
+
 ALTER TABLE ONLY packages_conan_recipe_revisions
     ADD CONSTRAINT packages_conan_recipe_revisions_pkey PRIMARY KEY (id);
 
@@ -30192,6 +30217,10 @@ CREATE INDEX index_packages_conan_package_references_on_project_id ON packages_c
 
 CREATE INDEX index_packages_conan_package_references_on_recipe_revision_id ON packages_conan_package_references USING btree (recipe_revision_id);
 
+CREATE INDEX index_packages_conan_package_revisions_on_package_reference_id ON packages_conan_package_revisions USING btree (package_reference_id);
+
+CREATE INDEX index_packages_conan_package_revisions_on_project_id ON packages_conan_package_revisions USING btree (project_id);
+
 CREATE INDEX index_packages_conan_recipe_revisions_on_project_id ON packages_conan_recipe_revisions USING btree (project_id);
 
 CREATE INDEX index_packages_debian_group_architectures_on_group_id ON packages_debian_group_architectures USING btree (group_id);
@@ -31914,6 +31943,8 @@ CREATE UNIQUE INDEX uniq_google_cloud_logging_configuration_namespace_id_and_nam
 
 CREATE UNIQUE INDEX uniq_idx_on_packages_conan_package_references_package_reference ON packages_conan_package_references USING btree (package_id, recipe_revision_id, reference);
 
+CREATE UNIQUE INDEX uniq_idx_on_packages_conan_package_revisions_revision ON packages_conan_package_revisions USING btree (package_id, package_reference_id, revision);
+
 CREATE UNIQUE INDEX uniq_idx_packages_packages_on_project_id_name_version_ml_model ON packages_packages USING btree (project_id, name, version) WHERE ((package_type = 14) AND (status <> 4));
 
 CREATE UNIQUE INDEX uniq_idx_project_compliance_framework_on_project_framework ON project_compliance_framework_settings USING btree (project_id, framework_id);
@@ -34142,9 +34173,6 @@ ALTER TABLE ONLY analytics_devops_adoption_segments
 ALTER TABLE ONLY project_statistics
     ADD CONSTRAINT fk_198ad46fdc FOREIGN KEY (root_namespace_id) REFERENCES namespaces(id) ON DELETE SET NULL;
 
-ALTER TABLE ONLY issues
-    ADD CONSTRAINT fk_1adaba52b0 FOREIGN KEY (correct_work_item_type_id) REFERENCES work_item_types(correct_id) NOT VALID;
-
 ALTER TABLE ONLY approval_policy_rule_project_links
     ADD CONSTRAINT fk_1c78796d52 FOREIGN KEY (approval_policy_rule_id) REFERENCES approval_policy_rules(id) ON DELETE CASCADE;
 
@@ -34523,6 +34551,9 @@ ALTER TABLE ONLY csv_issue_imports
 ALTER TABLE ONLY milestone_releases
     ADD CONSTRAINT fk_5e73b8cad2 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY packages_conan_package_revisions
+    ADD CONSTRAINT fk_5f7c6a9244 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY project_access_tokens
     ADD CONSTRAINT fk_5f7e8450e1 FOREIGN KEY (personal_access_token_id) REFERENCES personal_access_tokens(id) ON DELETE CASCADE;
 
@@ -35027,6 +35058,9 @@ ALTER TABLE ONLY issues
 ALTER TABLE ONLY duo_workflows_checkpoints
     ADD CONSTRAINT fk_b3d9cea509 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY packages_conan_package_revisions
+    ADD CONSTRAINT fk_b482b1a2f8 FOREIGN KEY (package_reference_id) REFERENCES packages_conan_package_references(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY protected_tag_create_access_levels
     ADD CONSTRAINT fk_b4eb82fe3c FOREIGN KEY (group_id) REFERENCES namespaces(id) ON DELETE CASCADE;
 
@@ -35537,6 +35571,9 @@ ALTER TABLE ONLY import_placeholder_memberships
 ALTER TABLE ONLY project_import_data
     ADD CONSTRAINT fk_ffb9ee3a10 FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY packages_conan_package_revisions
+    ADD CONSTRAINT fk_ffc5836122 FOREIGN KEY (package_id) REFERENCES packages_packages(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY issues
     ADD CONSTRAINT fk_ffed080f01 FOREIGN KEY (updated_by_id) REFERENCES users(id) ON DELETE SET NULL;
 
diff --git a/doc/administration/self_hosted_models/install_infrastructure.md b/doc/administration/self_hosted_models/install_infrastructure.md
index 8a8b4f9466a6b..6a790868ab25b 100644
--- a/doc/administration/self_hosted_models/install_infrastructure.md
+++ b/doc/administration/self_hosted_models/install_infrastructure.md
@@ -40,7 +40,7 @@ Install one of the following GitLab-approved LLM models:
 | Mistral      | [Mistral 7B Text](https://huggingface.co/mistralai/Mistral-7B-v0.3)                     | **{check-circle}** Yes                | **{dotted-circle}** No               |**{dotted-circle}** No        |
 | Mistral      | [Mixtral 8x22B Text](https://huggingface.co/mistralai/Mixtral-8x22B-v0.1)       | **{check-circle}** Yes                | **{dotted-circle}** No               | **{dotted-circle}** No        |
 | Mistral      | [Mixtral 8x7B Text](https://huggingface.co/mistralai/Mixtral-8x7B-v0.1)        | **{check-circle}** Yes                | **{dotted-circle}** No               | **{dotted-circle}** No        |
-| Claude 3     | [Claude 3.5 Sonnet](https://www.anthropic.com/news/claude-3-5-sonnet)        | **{check-circle}** Yes                | **{check-circle}** Yes               | **{check-circle}** Yes        |
+| Claude 3     | [Claude 3.5 Sonnet](https://www.anthropic.com/news/claude-3-5-sonnet)        | **{check-circle}** No                | **{check-circle}** Yes               | **{check-circle}** Yes        |
 
 The following models are under evaluation, and support is limited:
 
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 9cbe7dbe09526..347219459f7c2 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -10729,6 +10729,7 @@ Input type: `WorkItemCreateInput`
 | <a id="mutationworkitemcreateprojectpath"></a>`projectPath` **{warning-solid}** | [`ID`](#id) | **Deprecated:** Please use namespace_path instead. That will cover for both projects and groups. Deprecated in GitLab 15.10. |
 | <a id="mutationworkitemcreaterolledupdateswidget"></a>`rolledupDatesWidget` **{warning-solid}** | [`WorkItemWidgetRolledupDatesInput`](#workitemwidgetrolledupdatesinput) | **Deprecated:** **Status**: Experiment. Introduced in GitLab 16.9. |
 | <a id="mutationworkitemcreatetitle"></a>`title` | [`String!`](#string) | Title of the work item. |
+| <a id="mutationworkitemcreateweightwidget"></a>`weightWidget` | [`WorkItemWidgetWeightInput`](#workitemwidgetweightinput) | Input for weight widget. |
 | <a id="mutationworkitemcreateworkitemtypeid"></a>`workItemTypeId` | [`WorkItemsTypeID!`](#workitemstypeid) | Global ID of a work item type. |
 
 #### Fields
@@ -26096,6 +26097,7 @@ Defines which user roles, users, or groups can merge into a protected branch.
 | <a id="mergerequestsupportslockonmerge"></a>`supportsLockOnMerge` | [`Boolean!`](#boolean) | Indicates if the merge request supports locked labels. |
 | <a id="mergerequesttargetbranch"></a>`targetBranch` | [`String!`](#string) | Target branch of the merge request. |
 | <a id="mergerequesttargetbranchexists"></a>`targetBranchExists` | [`Boolean!`](#boolean) | Indicates if the target branch of the merge request exists. |
+| <a id="mergerequesttargetbranchpath"></a>`targetBranchPath` | [`String`](#string) | Path to the target branch of the merge request. |
 | <a id="mergerequesttargetproject"></a>`targetProject` | [`Project!`](#project) | Target project of the merge request. |
 | <a id="mergerequesttargetprojectid"></a>`targetProjectId` | [`Int!`](#int) | ID of the merge request target project. |
 | <a id="mergerequesttaskcompletionstatus"></a>`taskCompletionStatus` | [`TaskCompletionStatus!`](#taskcompletionstatus) | Completion status of tasks. |
diff --git a/doc/ci/debugging.md b/doc/ci/debugging.md
index 5eeddd2d131cb..97c620d6fbb4b 100644
--- a/doc/ci/debugging.md
+++ b/doc/ci/debugging.md
@@ -140,7 +140,7 @@ my-flaky-job:
 ```
 
 In this example, `DEBUG_VARS` is blank by default in standard pipelines. If you need to
-debug the job's behavior, run the pipeline manually and set `DEBUG_VARS` to `--vebose`
+debug the job's behavior, run the pipeline manually and set `DEBUG_VARS` to `--verbose`
 for additional output.
 
 ### Dependencies
diff --git a/doc/development/documentation/workflow.md b/doc/development/documentation/workflow.md
index 9e8c9d4c072a0..6c39d4bf39d07 100644
--- a/doc/development/documentation/workflow.md
+++ b/doc/development/documentation/workflow.md
@@ -65,11 +65,7 @@ It includes these labels, which are added to the merge request:
   For example, `~devops::create` and `~group::source code`.
 - A `~documentation` [specialization label](../labels/index.md#specialization-labels).
 
-A member of the Technical Writing team adds these labels:
-
-- A [documentation scoped label](../../user/project/labels.md#scoped-labels) with the
-  `docs::` prefix. For example, `~docs::improvement`.
-- The [`~Technical Writing` team label](../labels/index.md#team-labels).
+A member of the Technical Writing team adds the [`~Technical Writing` team label](../labels/index.md#team-labels).
 
 NOTE:
 With the exception of `/doc/development/documentation`,
diff --git a/doc/topics/runner_fleet_design_guides/gitlab_runner_fleet_config_and_best_practices.md b/doc/topics/runner_fleet_design_guides/gitlab_runner_fleet_config_and_best_practices.md
new file mode 100644
index 0000000000000..866c5fe4f80be
--- /dev/null
+++ b/doc/topics/runner_fleet_design_guides/gitlab_runner_fleet_config_and_best_practices.md
@@ -0,0 +1,568 @@
+---
+stage: CI
+group: Runner
+description: Runner Fleet.
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+---
+
+# Design and configure a GitLab Runner fleet on Google Kubernetes Engine
+
+DETAILS:
+**Tier:** Free, Premium, Ultimate
+**Offering:** Available on GitLab.com, Self-managed
+
+This page describes how to analyze your CI/CD build requirements to design, configure,
+and validate a GitLab Runner fleet hosted on Google Kubernetes Engine (GKE).
+
+The following diagram illustrates the path of your runner fleet implementation journey.
+The guide follows these steps:
+
+![Runner Fleet Steps Diagram](img/runner_fleet_steps_diagram.png)
+
+You can use this framework to plan a runner deployment for a single group or a GitLab instance that serves your entire organization.
+
+This framework includes the following steps:
+
+1. [Assess the expected CI/CD workloads](#assess-the-expected-cicd-workloads)
+1. [Plan the Runner fleet configuration](#plan-the-runner-fleet-configuration)
+1. [Deploy the runner on GKE](#deploy-the-runner-on-gke)
+1. [Optimize](#optimize)
+
+## Assess the expected CI/CD workloads
+
+In this phase, you gather the CI/CD build requirements of the development teams that you support. If applicable, create an inventory of the programming, scripting, and markup languages that are in use.
+
+You might be supporting multiple development teams, various programming languages,
+and build requirements. Start with one team, one project, and one set of CI/CD build
+requirements for the first set of in-depth analysis.
+
+To assess expected CI/CD workloads:
+
+- Estimate the CI/CD job demand that you expect to support (hourly, daily, weekly).
+- Estimate the CPU and RAM resource requirements for a representative sample CI/CD job for a specific project. These estimates help identify the different profiles you might support. The characteristics of those profiles are important to identify the right GKE Cluster needed to support your requirements. Refer to this example on how to determine the CPU and RAM requirements.
+- Determine if you have any security or policy requirements that require you to segment access to certain runners by groups or projects.
+
+### Estimate the CPU and RAM requirements for a CI/CD job
+
+The CPU and RAM resource requirements vary depending on factors like the type of programming language or the type of CI/CD job (build, integration tests, unit tests, security scans). The following section describes a method to gather CI/CD job CPU and resource requirements. You can adopt and build on this approach for your own needs.
+
+For example, to run a CI/CD job similar to the one defined in the FastAPI project fork: [ra-group / fastapi · GitLab](https://gitlab.com/ra-group2/fastapi).
+The job in this example uses a Python image, downloads the project's requirements, and runs the existing unit tests. 
+The `.gitlab-ci.yml` for the job is as follows:
+
+```yaml
+image: python:3.11.10-bookworm
+
+tests:
+  parallel: 25
+  script:
+  - pip install -r requirements.txt
+  - pytest
+```
+
+To identify the compute and RAM resources needed, use Docker to:
+
+- Create a specific image that uses the FastAPI fork and the CI/CD job script as entrypoint.
+- Run a container with the built image and monitor resource usage.
+
+Complete the following steps to identify the compute and RAM resources needed:
+
+1. Create a script file in your project that contains all the CI commands. The script file is named `entrypoint.sh`.
+
+   ```shell
+   #!/bin/bash
+   cd /fastapi || exit
+   pip install -r requirements.txt
+   pytest
+
+1. Create a Dockerfile to create an image where the `entrypoint.sh` file runs the CI script.
+
+   ```dockerfile
+   FROM python:3.11.10-bookworm
+   RUN mkdir /fastapi
+   COPY . /fastapi
+   RUN chmod +x /fastapi/entrypoint.sh
+   CMD [ "bash", "/fastapi/entrypoint.sh" ]
+   ```
+
+1. Build the image. To simplify the process, perform all operations such as build, store,
+   and run the image locally. This approach eliminates the need of an online registry to pull and push the image.
+
+   ```shell
+   ❯ docker build . -t my-project_dir/fastapi:testing
+   ...
+   Successfully tagged my-project_dir/fastapi:testing
+   ```
+
+1. Run a container with the built image and simultaneously monitor the resources usage during the container execution. Create a script named `metrics.sh` with the following command:
+
+   ```shell
+   #! /bin/bash
+
+   container_id=$(docker run -d --rm my-project_dir/fastapi:testing)
+
+   while true; do
+       echo "Collecting metrics..."
+       metrics=$(docker stats --no-trunc --no-stream --format "table {{.ID}}\t{{.CPUPerc}}\t{{.MemUsage}}" | grep "$container_id")
+       if [ -z "$metrics" ]; then
+           exit 0
+       fi
+       echo "Saving metrics..."
+       echo "$metrics" >> metrics.log
+       sleep 1
+   done
+   ```
+
+   This script runs a detached container with the image built. The container ID is then used to collect its `CPU` and `Memory` usage until the container exits upon successful completion. The metrics collected are saved in a file called `metrics.log`.
+
+   NOTE:
+   In the example, the CI/CD job is short-lived, so the sleep between each container poll is set to one second. Adjust this value to better suit your needs.
+
+1. Analyze the `metrics.log` file to identify the peak usage of the test container. 
+
+   In the example, the maximum CPU usage is `107.50%` and the maximum memory usage is `303.1Mi`.
+
+   ```log
+   223e93dd05c6   94.98%    83.79MiB / 15.58GiB
+   223e93dd05c6   28.27%    85.4MiB / 15.58GiB
+   223e93dd05c6   53.92%    121.8MiB / 15.58GiB
+   223e93dd05c6   70.73%    171.9MiB / 15.58GiB
+   223e93dd05c6   20.78%    177.2MiB / 15.58GiB
+   223e93dd05c6   26.19%    180.3MiB / 15.58GiB
+   223e93dd05c6   77.04%    224.1MiB / 15.58GiB
+   223e93dd05c6   97.16%    226.5MiB / 15.58GiB
+   223e93dd05c6   98.52%    259MiB / 15.58GiB
+   223e93dd05c6   98.78%    303.1MiB / 15.58GiB
+   223e93dd05c6   100.03%   159.8MiB / 15.58GiB
+   223e93dd05c6   103.97%   204MiB / 15.58GiB
+   223e93dd05c6   107.50%   207.8MiB / 15.58GiB
+   223e93dd05c6   105.96%   215.7MiB / 15.58GiB
+   223e93dd05c6   101.88%   226.2MiB / 15.58GiB
+   223e93dd05c6   100.44%   226.7MiB / 15.58GiB
+   223e93dd05c6   100.20%   226.9MiB / 15.58GiB
+   223e93dd05c6   100.60%   227.6MiB / 15.58GiB
+   223e93dd05c6   100.46%   228MiB / 15.58GiB
+   ```
+
+### Analyzing the metrics collected
+
+Based on the metrics collected, for this job profile, you can limit the Kubernetes executor job to 
+`1 CPU` and `~304 Mi of Memory`. Even if this conclusion is accurate, it might not be practical for all use cases.
+
+If you use a cluster with a node pool of three `e2-standard-4` nodes to run jobs, the `1 CPU` limit allows only **12 jobs** to run simultaneously (an `e2-standard-4`  node has **4 vCPU** and **16 GB** of memory). Additional jobs wait for the running jobs to complete and free up the resources before starting.
+
+The memory requested is critical because Kubernetes terminates any pod that uses more memory than the limit set or available on the cluster. However, the CPU limit is more flexible but impacts the job duration. A lower CPU limit set increases the time it takes for a job to complete. In the above example, setting the CPU limit to `250m` (or `0.25`) instead `1` increased the job duration by four times (from about two minutes to eight to ten minutes).
+
+As the metrics collection method uses a polling mechanism, you should round up the maximum usage identified. For example, instead of `303 Mi` for the memory usage, round it to `400 Mi`.
+
+Important considerations for the above example:
+
+- The metrics above were collected on the local machine, which doesn't have the same CPU configuration than a Google Kubernetes Engine Cluster. However, these metrics were validated by monitoring them on a Kubernetes cluster with an `e2-standard-4` node.
+- To get an accurate representation of those metrics, run the tests described in the [Assess phase](#assess-the-expected-cicd-workloads) on a Google Compute Engine VM.
+
+## Plan the runner fleet configuration
+
+In the planning phase, map out the right runner fleet configuration for your organization. Consider the runner scope (instance, group, project) and the Kubernetes cluster configuration based on:
+
+- Your assessment of the CI/CD job resource demand
+- Your inventory of CI/CD job types
+
+### Runner scope
+
+To plan runner scope, consider the following questions:
+
+- Do you want project owners and group owners to create and manage their own runners?
+
+  - By default, project and group owners can create runner configuration and register runners to a project or group in GitLab.
+  - This design makes it easy for developers to create a build environment. This approach reduces developer friction when getting started with GitLab CI. However, in large organizations, this approach may lead to many underutilized or unused runners across the environment.
+
+- Does your organization have security or other policies that require segmenting access to certain types of runners to specific groups or projects?
+
+The most straightforward way to deploy a runner in a self-managed GitLab environments is to create it for an instance. Runners scoped for an instance are available to all groups and projects by default.
+
+If you are able to meet all your organization's needs with instance runners, then this deployment pattern is the most efficient pattern. It ensures that you can operate a CI/CD build fleet at scale efficiently and cost effectively.
+
+If there are requirements to segment access to specific runners to certain groups or projects, incorporate those into your planning process.
+
+#### Example runner fleet configuration - Instance runners
+
+The configuration in the table demonstrates the flexibility available when configuring a runner fleet for your organization. This example uses multiple runners with different instance sizes and different job tags. These runners enables you to support different types of CI/CD jobs, each with specific CPU and RAM resource requirements. However, it may not be the most efficient pattern when using Kubernetes.
+
+| Runner Type | Runner Tag | Scope | Count of Runner type to offer | Runner Worker Specification | Runner Host Environment | Environment Configuration |
+| :---- | :---- | :---- | :---- | :---- | :---- | :---- |
+| Instance | ci-runner-small | Available to run CI/CD jobs for all groups and projects by default. | 5 | 2 vCPU, 8GB RAM | Kubernetes | → 3 nodes <br> → Runner worker compute node \= **e2-standard-2**  |
+| Instance | ci-runner-medium | Available to run CI/CD jobs for all groups and projects by default. | 2 | 4 vCPU, 16GB RAM | Kubernetes | → 3 nodes <br> → Runner worker compute node \= **e2-standard-4**   |
+| Instance | ci-runner-large | Available to run CI/CD jobs for all groups and projects by default. | 1 | 8 vCPU, 32GB RAM | Kubernetes | → 3 nodes <br> → Runner worker compute node \= **e2-standard-8**   |
+
+In the runner fleet configuration example, there are a total of three runner configurations and eight runners actively running CI/CD jobs.
+
+With the Kubernetes executor, you can use the Kubernetes scheduler and overwrite container resources.
+In theory, you can deploy a single GitLab Runner on a Kubernetes cluster with adequate resources. You
+can then overwrite container resources to select the appropriate compute type for each CI/CD job. 
+Implementing this pattern reduces the number of separate runner configurations you need to deploy and operate.
+
+### Best practices
+
+- Always dedicate a node pool to the runner managers.
+  - Log processing and cache or artifacts management can be CPU intensive.
+- Always set a default limit (CPU/Memory for Build/Helper/Service containers) in the `config.toml` file.
+- Always allow maximum overwrite for the resources in the `config.toml` file.
+- In the job definition (`.gitlab-ci.yml`), specify the right limit needed by the jobs.
+  - If not specified, the default values set in the `config.toml` file is used.
+  - If a container exceeds its memory limit, the system automatically terminates it using the Out of Memory (OOM) kill process.
+- Use the feature flags `FF_RETRIEVE_POD_WARNING_EVENTS` and `FF_PRINT_POD_EVENTS`. For more details, see the [feature flags documentation](https://docs.gitlab.com/runner/configuration/feature-flags.html).
+
+## Deploy the runner on GKE
+
+When you are ready to install GitLab Runner on a Google Kubernetes cluster, you have many options. If you have created your cluster on GKE, you can use either the GitLab Runner Helm Chart or Operator to install the runner on the cluster.
+
+If you are yet to set up the cluster on GKE, GitLab provides the GitLab Runner Infrastructure Toolkit (GRIT) which simultaneously:
+
+- Create a multi node pool GKE cluster: **Standard Edition** and **Standard Mode**.
+- Install GitLab Runner on the cluster using the GitLab Runner Kubernetes operator
+
+The following example uses GRIT to deploy the Google Kubernetes cluster and GitLab Runner Manager.
+
+To have the cluster and GitLab Runner well configured, consider the following information:
+
+- **How many job types do I need to cover?** This information comes from the access phase. The access phase aggregates metrics and identifies the number of resulting groups, considering organizational constraints. A **job type** is a collection of categorized jobs identified during the access phase. This categorization is based on the maximum resources needed by the job.
+- **How many GitLab Runner Managers do I need to run?** This information comes from the plan phase. If the organization manages projects separately, apply this framework to each project individually. This approach is relevant only when multiple job profiles are identified (for the entire organization or for a specific project), and they are all handled by an individual or a fleet of GitLab Runners. A basic configuration typically uses one GitLab Runner Manager per GKE cluster.
+- **What is the estimated max concurrent CI/CD jobs?** This information represents an estimate of the maximum number of concurrent CI/CD jobs that are run at any point in time. This information is needed when configuring the GitLab Runner Manager by providing how long it waits during the `Prepare` stage: job pod scheduling on a node with limited available resources.
+
+### Real life applications for the FastAPI fork
+
+For the FastAPI, consider the following information:
+
+- **How many job profiles do I need to cover?** We only have one job profile with the following characteristics: `1 CPU` and `303 Mi` of memory. As explained in [Analyzing the metrics collected](#analyzing-the-metrics-collected) sections, we change those raw values to the following:
+  - `400 Mi` for the memory limit instead of `303 Mi` to avoid any job failure due to the memory limits.
+  - `0.20` for the CPU instead of `1 CPU`. We don’t mind our job taking more time to complete. We prioritize accuracy and quality over speed when completing tasks.
+- **How many GitLab Runner Managers do I need to run?** Only one GitLab Runner Manager is enough for our tests.
+- **What is the expected Workload?** We want to be able to run up to 20 jobs simultaneously at any time.
+
+Based on these inputs, any GKE Cluster with the following minimum characteristics should be enough:
+
+- Minimum CPU: **(0.20 + helper_cpu_usage) * number_of_jobs_simultaneously**. In our example, we get **7 vCPU** with the limit for the helper container set to **0.15 CPU**.
+- Minimum Memory: **(400Mi + helper_memory_usage) * number_of_jobs_simultaneously**. In our example, we get at least **10 Gi** with the limit for the helper set to **100 Mi**.
+
+Other characteristics such as the minimum storage required should also be considered. However, we don't into consideration in the example.
+
+Possible configurations for our GKE cluster can be (both configuration allows to run more than **20 jobs** simultaneously):
+
+- GKE Cluster with a node pool of `3 e2-standard-4` nodes for a total of `12 vCPU` and `48 GiB` of memory
+- GKE Cluster with a node pool of only on `e2-standard-8` nodes for a total of `8 vCPU` and `32 GiB` of memory
+
+For the sake of our example, we use the first configuration. To prevent the GitLab Runner Manager log processing from impacting the overall log processing, use a dedicated node pool where GitLab Runner is installed.
+
+#### GKE GRIT configuration
+
+The resulting GKE configuration for GRIT looks similar to this:
+
+```terraform
+google_project     = "GCLOUD_PROJECT"
+google_region      = "GCLOUD_REGION"
+google_zone        = "GCLOUD_ZONE"
+name               = "my-grit-gke-cluster"
+node_pools = {
+  "runner-manager" = {
+    node_count = 1,
+    node_config = {
+      machine_type = "e2-standard-2",
+      image_type   = "cos_containerd",   #Linux OS container only. Change to windows_ltsc_containerd for Windows OS container
+      disk_size_gb = 50,
+      disk_type    = "pd-balanced",
+      labels = {
+        "app" = "gitlab-runner",
+      }
+    },
+  },
+  "worker-pool" = {
+    node_count = 3,
+    node_config = {
+      machine_type = "e2-standard-4",    #4vCPU, 16GB each
+      image_type   = "cos_containerd",   #Linux OS container only. Change to windows_ltsc_containerd for Windows OS container
+      disk_size_gb = 150,
+      disk_type    = "pd-balanced",
+      labels = {
+        "app" = "gitlab-runner-job"
+      }
+    },
+  },
+}
+```
+
+In the configuration above:
+
+- The `runner-manager` block refers to the node pool where GitLab Runner is installed. In our example, a `e2-standard-2` is more than enough.
+- The labels sections in the `runner-manager` block is useful when installing GitLab Runner on GitLab. A node selector is configured through the operator configuration to make sure that GitLab Runner is installed on a node of this node pool.
+- The `worker-pool` block refers to the node pool where the CI/CD job pod is created. The configuration provided creates a node pool of `3 e2-standard-4` nodes labeled `"app" = "gitlab-runner-job"` to host the job pod.
+- The `image_type` parameter can be used to set the image used by the nodes. It can be set to `windows_ltsc_containerd` if your workload relies mostly on Windows image.
+
+Here is an illustration of this configuration:
+
+![Illustration configuration Cluster](img/nodepool_illustration_example.png)
+
+#### GitLab Runner GRIT configuration
+
+The resulting GitLab Runner configuration for GRIT looks similar to this:
+
+```terraform
+gitlab_pat         = "glpat-REDACTED"
+gitlab_project_id  = GITLAB_PROJECT_ID
+runner_description = "my-grit-gitlab-runner"
+runner_image       = "registry.gitlab.com/gitlab-org/ci-cd/gitlab-runner-ubi-images/gitlab-runner-ocp:amd64-v17.3.1"
+helper_image       = "registry.gitlab.com/gitlab-org/ci-cd/gitlab-runner-ubi-images/gitlab-runner-helper-ocp:x86_64-v17.3.1"
+concurrent     = 20
+check_interval = 1
+runner_tags    = ["my-custom-tag"]
+config_template    = <<EOT
+[[runners]]
+  name = "my-grit-gitlab-runner"
+  shell = "bash"
+  environment = [
+    "FF_RETRIEVE_POD_WARNING_EVENTS=true",
+    "FF_PRINT_POD_EVENTS=true",
+  ]
+  [runners.kubernetes]
+    image = "alpine"
+    cpu_limit = "0.25"
+    memory_limit = "400Mi"
+    helper_cpu = "150m"
+    helper_memory = "150Mi"
+    cpu_limit_overwrite_max_allowed = "0.25"
+    memory_limit_overwrite_max_allowed = "400Mi"
+    helper_cpu_limit_overwrite_max_allowed = "150m"
+    helper_memory_limit_overwrite_max_allowed = "150Mi"
+  [runners.kubernetes.node_selector]
+    "app" = "gitlab-runner-job"
+EOT
+pod_spec = [
+  {
+    name      = "selector",
+    patchType = "merge",
+    patch     = <<EOT
+nodeSelector:
+  app: "gitlab-runner"
+EOT
+  }
+]
+```
+
+In the configuration above:
+
+- The `pod_spec` parameter allows us to set a node selector for the pod running GitLab Runner. In the configuration, the node selector is set to `"app" = "gitlab-runner"` to ensure that GitLab Runner is installed on the runner-manager node pool.
+- The `config_template` parameters provides a default limit for all jobs run by the GitLab Runner Manager. It also allows an overwrite of those limits as long as the value set is not greater than the default values.
+- The feature flags `FF_RETRIEVE_POD_WARNING_EVENTS` and `FF_PRINT_POD_EVENTS`are also set to ease debugging in the event of a job failure. See the [feature flag documentation](https://docs.gitlab.com/runner/configuration/feature-flags.html) for more details.
+
+### Real life applications for a hypothetical use case
+
+Take the following information in to consideration:
+
+- **How many job profiles do I need to cover?** Two profiles (specifications provided takes the helper limits in account):
+  - Medium jobs: `300m CPU` and `200 MiB`
+  - CPU-intensive jobs: `1 CPU` and `1 GiB`
+- **How many GitLab Runner Managers do I need to run?** One.
+- **What is the expected Workload?**
+  - Up to **50 medium** jobs simultaneously
+  - Up to **25 CPU-intensive** jobs simultaneously
+
+#### GKE configuration
+
+- Needs for medium jobs:
+  - CPU: 300m * 50 = 5 CPU (approximate)
+  - Memory: 200 MiB * 50 = 10 GiB
+- Needs for CPU-intensive jobs:
+  - CPU: 1 * 25 = 25
+  - Memory: 1 GiB * 25 = 25 GiB
+
+The GKE cluster should have:
+
+- A node pool for GitLab Runner Manager (let's consider that the log processing is not demanding): **1 e2-standard-2** node
+- A node pool for medium jobs: **3 e2-standard-4** nodes
+- A node pool for CPU-intensive jobs: **1 e2-highcpu-32** node (`32 vCPU` and `32 GiB` Memory)
+
+```terraform
+google_project     = "GCLOUD_PROJECT"
+google_region      = "GCLOUD_REGION"
+google_zone        = "GCLOUD_ZONE"
+name               = "my-grit-gke-cluster"
+node_pools = {
+  "runner-manager" = {
+    node_count = 1,
+    node_config = {
+      machine_type = "e2-standard-2",
+      image_type   = "cos_containerd",   #Linux OS container only. Change to windows_ltsc_containerd for Windows OS container
+      disk_size_gb = 50,
+      disk_type    = "pd-balanced",
+      labels = {
+        "app" = "gitlab-runner",
+      }
+    },
+  },
+  "medium-pool" = {
+    node_count = 3,
+    node_config = {
+      machine_type = "e2-standard-4",    #4vCPU, 16GB each
+      image_type   = "cos_containerd",   #Linux OS container only. Change to windows_ltsc_containerd for Windows OS container
+      disk_size_gb = 150,
+      disk_type    = "pd-balanced",
+      labels = {
+        "app" = "gitlab-runner-job"
+      }
+    },
+  },
+  "cpu-intensive-pool" = {
+    node_count = 1,
+    node_config = {
+      machine_type = "e2-highcpu-32", #32vCPU, 32GB each
+      image_type   = "cos_containerd",
+      disk_size_gb = 150,
+      disk_type    = "pd-balanced",
+      labels = {
+        "app" = "gitlab-runner-job"
+      }
+    },
+  },
+}
+```
+
+#### GitLab Runner configuration
+
+The current implementation of GRIT doesn’t allow the installation of more than one runner at the time. The `config_template` provided doesn't set configurations like `node_selection` and other limits, as done in the previous example. A simple configuration allows the maximum allowed overwrite value for CPU-intensive jobs and sets the correct values in the `.gitlab-ci.yml` file. The resulting GitLab Runner configuration looks similar to this:
+
+```terraform
+gitlab_pat         = "glpat-REDACTED"
+gitlab_project_id  = GITLAB_PROJECT_ID
+runner_description = "my-grit-gitlab-runner"
+runner_image       = "registry.gitlab.com/gitlab-org/ci-cd/gitlab-runner-ubi-images/gitlab-runner-ocp:amd64-v17.3.1"
+helper_image       = "registry.gitlab.com/gitlab-org/ci-cd/gitlab-runner-ubi-images/gitlab-runner-helper-ocp:x86_64-v17.3.1"
+concurrent     = 100
+check_interval = 1
+runner_tags    = ["my-custom-tag"]
+config_template    = <<EOT
+[[runners]]
+  name = "my-grit-gitlab-runner"
+  shell = "bash"
+  environment = [
+    "FF_RETRIEVE_POD_WARNING_EVENTS=true",
+    "FF_PRINT_POD_EVENTS=true",
+  ]
+  [runners.kubernetes]
+    image = "alpine"
+    cpu_limit_overwrite_max_allowed = "0.75"
+    memory_limit_overwrite_max_allowed = "900Mi"
+    helper_cpu_limit_overwrite_max_allowed = "250m"
+    helper_memory_limit_overwrite_max_allowed = "100Mi"
+EOT
+pod_spec = [
+  {
+    name      = "selector",
+    patchType = "merge",
+    patch     = <<EOT
+nodeSelector:
+  app: "gitlab-runner"
+EOT
+  }
+]
+```
+
+The `.gitlab-ci.yml` file looks similar to this:
+
+- For medium jobs:
+
+```yaml
+image: some-image:latest
+
+variables:
+  KUBERNETES_CPU_LIMIT: "200m"
+  KUBERNETES_MEMORY_LIMIT: "100Mi"
+  KUBERNETES_HELPER_CPU_LIMIT: "100m"
+  KUBERNETES_HELPER_MEMORY_LIMIT: "100Mi"
+
+tests:
+  script:
+  - command_1
+  - command_2
+...
+  - command_n
+  tags:
+    - my-custom-tag
+```
+
+- For CPU-intensive jobs:
+
+```yaml
+image: custom-cpu-intensive-image:latest
+
+variables:
+  KUBERNETES_CPU_LIMIT: "0.75"
+  KUBERNETES_MEMORY_LIMIT: "900Mi"
+  KUBERNETES_HELPER_CPU_LIMIT: "150m"
+  KUBERNETES_HELPER_MEMORY_LIMIT: "100Mi"
+
+tests:
+  script:
+  - cpu_intensive_command_1
+  - cpu_intensive_command_2
+...
+  - cpu_intensive_command_n
+  tags:
+    - my-custom-tag
+```
+
+NOTE:
+For an easier configuration, use one GitLab Runner per cluster for job profile. This approach is recommended until GitLab supports either multiple GitLab Runner installations on the same cluster or multiple `[[runners]]` section in the `config.toml` template.
+
+### Set up monitoring and observability
+
+As a final step in the deployment phase, you must establish a solution to monitor the runner host environment and GitLab Runner. The infrastructure level, runner, and CI/CD job metrics provide insights into the efficiency and reliability of your CI/CD build infrastructure. They also provides the insight needed to tune and optimize the Kubernetes cluster, GitLab Runner, and CI/CD job configuration.
+
+#### Monitoring best practices
+
+- Monitor job level metrics: job duration, job success and failure rates.
+  - To analyze the job-level metrics, understand which CI/CD jobs are run most frequently and consume the most compute and RAM resources in aggregate. This job profile is a good starting point for evaluating optimization opportunities.
+- Monitor the Kubernetes cluster resource utilization:
+  - CPU utilization
+  - Memory utilization
+  - Network utilization
+  - Disk utilization
+
+See the [Dedicated GitLab Runner monitoring page](https://docs.gitlab.com/runner/monitoring/index.html) for more details on how to proceed.
+
+## Optimize
+
+Optimizing a CI/CD build environment is an ongoing process. The type and volume of CI/CD jobs are constantly evolving, requiring your active engagement.
+
+You likely have specific organizational goals for CI/CD and CI/CD build infrastructure. Therefore, the first step is to define your optimization requirements and quantifiable objectives.
+
+The following is an example set of optimization requirements from across our customer base:
+
+- CI/CD job startup times
+- CI/CD job duration
+- CI/CD job reliability
+- CI/CD compute cost optimization
+
+The next step is to start analyzing the CI/CD metrics in conjunction with the infrastructure metrics for the Kubernetes cluster. A critical correlation to analyze is as follows:
+
+- CPU utilization by Kubernetes namespace
+- Memory utilization by Kubernetes namespace
+- CPU utilization by node
+- Memory utilization by node
+- CI/CD job failure rates
+
+Typically on Kubernetes, high CI/CD job failure rates (independent of failures due to flaky tests) are attributed to resource constraints on the Kubernetes cluster. Analyze these metrics to achieve the optimal balance of CI/CD job start times, job duration, job reliability, and infrastructure resource utilization in your Kubernetes cluster configuration.
+
+### Best practices
+
+- Establish a process to categorize CI/CD jobs across your organization by job type.
+- Establish a job type categorization framework to simplify both monitoring configuration and approach to optimization of the GitLab CI/CD build infrastructure on Kubernetes and the CI/CD job type.
+- Assigning each job type its own node on the cluster might result in the best balance of CI/CD job performance, job reliability and infrastructure utilization.
+
+Using Kubernetes as the infrastructure stack for the CI/CD build environment offers significant benefits. However, it require continuous monitoring and optimization of the Kubernetes infrastructure. After you establish an observability and optimization framework, you can support millions of CI/CD jobs per month. You can eliminate resource contention, achieve deterministic CI/CD job runs, and optimal resource usage. These improvements result in operational efficiency and cost optimization.
+
+## Next steps
+
+Take the next steps to provide a better user experience:
+
+- Support for multiple GitLab Runner installations on the same cluster. This enables a better management of scenarios where multiple job profiles should be handled (the GitLab Runner can be adequately configured to prevent any misused of the resources).
+- Support for GKE node autoscaling. This allows GKE to scale up and down according to the workload, thus saving money.
+- Enable jobs metrics monitoring. This enables admins to better optimize their cluster and GitLab Runner based on actual usage.
diff --git a/doc/topics/runner_fleet_design_guides/img/nodepool_illustration_example.png b/doc/topics/runner_fleet_design_guides/img/nodepool_illustration_example.png
new file mode 100644
index 0000000000000000000000000000000000000000..5c29b377c156da0364beacff15b431e50d062c9b
GIT binary patch
literal 57975
zcmeFZcT|&Uw>NA>kPb>OQUn$05IR^e=+I<9rB`VZdWQfiK|mlVAianv=tz$=fgquT
zj(`FI1QU8q=m8>pS7x4h&N=g*wa)v`x4!kQ_no!;W9~(g`@Z(I_rCV8+_85JbQsU_
zoIQ5z7~`GW+P@z=b`pK;*l{;n8gONY?cS$j#~vTMqkY{Z$a<ymbPB&tYU#Kbx1-aG
zo*o7{l%%|TM^DeFlap8{EaQ$-iepm7k9hf^AM!)QzDA-|kY@?}SJWeCowW|%Kafk=
zUB%N{!~6H|LA9N<p>whP5qA$)oPGX(_n)Ho&1j}yyAhO51j~&W19>c;FJ+`(b*3;U
zU`*?%SX5sKTsP@{A$0R_3&m5rLX0@7XSqQ;;9agVNn15=agh%E!JClsfk~GK_@sF1
z|K%LZnohXOYn7A>{!r+TGrX$_0q3PU)2Sb$`#<nw1Fo9;3k5J@<1Q1qT$Qv?koc@2
zCu|3IC!NK9qj@e!<Qp{Y?fl;O)M0Aa-fY^FCd#aIRCyVC{|fntJe_#@XzJ*2xA~}^
zh}JC~xe~EIl!vJbC*z|<i;dw2t2IKsT1R{RcSc8SBCO0gl3SX7jW<QPdFu<_R|;yM
z*-nh0IIxL<82z#>XdEcTT;!IR{=8g@Vwmqyo{q<jxs~Po@a@;QLuqbT7}86g8ljhN
zc!AJbZ)FcAZw(pdAp+TVii^_ipRc@2v%Z4J37*Rkg5ey~^!wbR=5s@(qzwh{pXpO0
zHoU0${=i0qj{Sz7rbg3&L7k{Zf79V|lhe&-40L<7MD&4Agtm0J%<hCQXP?T#>&T}^
zPFe1$mSy)m8rIvrO1|H>kfd8aM=$y5?rq=AUL`|Jxig}1vrp}g>Bo3pB`Hg{XWUM=
zF-z?s%O#u}A#LX$h}wbeHD;KYP%;4?s-^X7im^ckBQNBt%y$#xS;nZ3rJt{;ILolo
zPn~2|m!X>iPq|6TdrmriN=ihOLkus0SYZC^P8;QhEq!}mBo-uUs_x2Pe<UN(hDo&v
z-}@POxHm68^61r-DCvoaqhC=nbT)K0LI^I}kd?c$Qk|yUV$Ym%{D&tJFI!~6D({eN
zyqZr(3JyJ^q{w8AwfRXP-N#1D!nZ$qQE<+Aj-Kc}C%Zqsdqy0Lv&@e)9r`ODg7~6p
zro!tlVB(L+iAS_}E{{U<HoGbKroLuE+y_T*2Qe`YG^!V3AtW8o(gPx7cPfP>hd*fJ
zw0S7qMDgheT<O<HIwXeg)_bYjVGuA1c^wyVI3FQ4@_OY`G_xl8wF2KHxOXqc!<rA~
zGt$VLdp`VHKjK|IAZ^HH<J<^xi(rxhW#RA^r&UU{B0G92;wWrq>0_CgqwR}+rO6<X
zgEr~#0TZ&1O<CiPxevdD?poqJWq-L$+?b6qcPd&ioU3cUEaI0N8xwg`lLc$InM^wW
zMt+O3rZ$_j)uoI_u;0*R`7&1nVtGbOHE=I<wQ7VWVkOOg1HI8D(OI>x>bR%Ww5LxV
z|AX`n4Ks=6{x*+B$HztyPtadwS?k1vu%jD)2)bHmOz4sA>+3j)Hc%VFcB=Gi_pb})
zZ0H-bvgKQ&`CV2?6>?n&>4|`G_vVPD4@FGa2R32;%GN%e7dMrarr^FLhm>@OkY1H`
zlFYr#qvO-@<w8hBJ;)EgA=vDz2Yu65(PYBu$lV_K{)a8m%>6CSxxsTQg;^e5E%VvF
zeLtJ}H4hN&-E6v7Urz9*ldSBb&SR#c1wt+{*Y8e-MovAKDCIhA$LxYo_i|YI4XB3=
zj(Rrz@_EvyYD57+K6p{xHl3^ICrnTl=a@=4oj|KQKV+!I==caPQS#~cY7&M%`Us2U
z=OuhqRwcxURJs=BKoX<9<d4I4uWJsQyOoe4aJR$Mzh^YXgfD-(#E#B`Z``SF=W&~H
z9rT)TNYpsH+$j(|^AeV7=0t~2dFh}2xGf*`u!T|Ss^$FSlT01FVfRzB)j)}#StlLs
zMjY)@RBI-DbRi>_zO#70ha{%<-JtoLz-No`9MQX(2i0C+v#Z|h_bfG*x>FX96$rgL
z6ZtvGK)N;SJ2xmtq2xFgF)4p_?6-sA>pR^xhjKk9DnF-|H|~r{aMpNDcw<jzMK{Xx
zHq)Xw(cel&`3V9Ml=Z#6z^Sl6$Pr~Tx^{F#vU*h5Z^j&yGeLpAy}kYjfkQUpOtPWD
z+Ic;)c}{qbEOy4u5tHURHSSUG?vebAiJu47-9+hbn(=<`TQL-4Nw9s;Q;o%>A-k*s
za2NBe4ODF4>uph98;S1ob)y;}Xe&5IrHQ+>%&M3V#G)*Z&kYk5io>xUUo+|kpuDrY
zx@yP9&yUmnnb@Z9eIxFlOnX=y55<fOYi7KL-6EfO>RR(7pqr6<L<C7^^X1wAt!#^H
z!bxaw3BF?O^D@oNg!eaOWH)Z}v7_7Ny00dK&GAIZu4c$UZPsoahSDdgEf=FOHtc9F
zi(!>%okIfjF}E?h+vAuikNVY(fk<7cI?+~qxN<J250%D-8j9n#k&GBwOpmtU4Nfhd
zlM1!=tnQe!b_Oi%y)M5G?^4fVL1}wLtAyuuDBzJ@M@>HZSb{lHTPeRuyNOAAd2%`E
zXU33=!V@<}osfyn<Q$zzm)m9nF)d+Zem72OBybPTr^~H7cA8g})J&>+j*=!>#jWG?
zZ@yFvrWmU8+-uE8wf2d?yCrLS`h$NyIdg;WU)!LBx(yhdevWoXp>!w1c7KqL)Hi#Q
z8@Goo@DUdCp=)*X&m5K<k&9nZ`)N$ds>{WtZ<tWr%6`>^=pSzm3;IGy&1dK_oC7*J
z9kTu}zwa_@QM^buN%nEWX3jZYdY>U5>116;=EvS%|20np@&CPS%zrAB*vK*$C0$T6
zd^tv+aCnvJNdEb6>X5^hM4#53_MD6g62GjyHpv23(RPF1Kt~jtW))yY>-=`CG*UyH
zamlJa)&GWZsjhURAE||jEwPEuVWgzsm6^Izbj8KDp6<~>^0)p9eaO=GpEX2}!7g1!
zAcm8d|1|V#%*b<6TMRD6nmvNn4yjKblTGh{Uh{#2Cy90l36Si|j~3ve?EDCv@`7Q~
z)Ul1<1=!Jg&9i(6W#dHIu8GZt&Au#+Ut2>$VDA(v<$1SrUuQ6Pc<dL8nntQUb6|H9
z(LweM$qBhb(>L&{{aQzGWhcaN*Ljh?PmXGZMo_-^hFNZW+_9>@lWvz@M6k~(Jklc%
z(q5zN$;sH`yJ;H~LtIRP@!bnouv>)jwRB5ft=5b4Hom=z_;lzSMFV@*KH2(9n_3A<
zS(DUub4JVUvANk`ux)Tv`@2T*VON&2AtzB9Ema+5h%BGdQ!caiencsvj3p<3K5*)C
z+S?J@WtW?eE3zYx7HbQnl&;_U<(3oiZ6Mp(n>9I}Lcq!~v&TKK4t6A=KGWsvh+lsC
ziq(M~J!<%|?0pvDqQuAI%HK#$ptkvHW!-DJErS(<-{Dk?3X9WGaL^-bZhtezfnFkb
z=se84GeSRAfK<K0H-vlSA97WUl}N_@YG2Ong=Ue$*4sE+WaTSh3fYSUvYoN}a|qUJ
zf3awOr1E8;Q<Qi7wb^u5yDalwn^u*>;g|7YKhyh+mTzAW93E(96Qqd3qgd>17e6dZ
z1m0=yA}wn=5OQQKSkdeISKRbua?-&auS;ddQ}8;>QrP&1V=6IR<+=9qsbX+!Ja_Vh
zaeVCU)|}XR3(rPHy(&Tk)L1{e%{V6`pm$3yq`osvf9S>pn}>Y@^hJ(?a5q%@$;)=D
zz#od1BDsgXw-Nf{*e}@N>H!agbOA>I6Qi&MGY=oRVzW9{AF4?Cg(VM!@vhr`o{SaG
z<vLWthmP7sM@^fKMk*%NN*B(oYl(d1SQ{Y^{=`S*rp@Lo;yI#UzO1Z#%Niq?po?_>
zgyV7k;v_{Lp!-sx?;0N{Qsb<fG063=CR|8u!aR1{>f16oA1H=7hFtt<d_%6z5QJ)+
z%(8L|v~6V5KcCJfOVWX?|LO5!7YEW*{$;x&%Y<!p!hTAS7@Rfca8g|izS!Vcn3C`~
ziBlTxeroJggWc049|w-a*_>rFzASGC3@5%%wz_+5`qPj>xATO|J5>%eySM=?NYaVy
z#pijO1~L@Ot;v_w>kzEZ*Pp6qW~NI%E7baB(0Js*T2lNgJNp<`6{wi(Z(<(y1sX3v
z@of+effcz%T89umU4h3s3$w|(HBQssMX()ZkrIj!LiamSiU#JaXayQ&sLNW@(P5P9
z<lF8{$3y4eytC&`$zzu!zILq7Hizk#k{nZnbH}it1ka>7XotcXB?7xvUfg7&JHir1
z>8C*Fgi!i5_8Lx#h&ejOerZem5YA_j(Q15HeEgO}qC=KbuiuS0hh?&hmmEO^FQM(c
zu=gXd>*As!X31Ao;=>TDL-pl??@z>1->bp2hYQyRg}7`IneI~Dp-FT$PGW8A_IO>Z
z9-G$81Oe1;WR(1srDcprqPkqGJV@Y@CMCnGa23tj6l096$hgyi9(gR}p{nJyo9VCa
zVzJ?i76MwJS*jxwNSUTpO!`hDdk4oLKJigytLw+BjX3tEgQgRdn6QuykI}25Fh#7>
zNs2RFZz_A9!{2pn|IfPCz;%M%h0AdKeXL>uxuUwAkm1$x)q6q;-)$m>bUoG@oS=1k
z>JL)Y<?&)2d;W7bI<y4}j<?F<-GuX=J=Mom5A@zgl+CX1jC(R;_2{O#SkREROm*{V
zTJUt!Eq$?p0=HWC7TZeB+Q`_sm}ZQk;+5*(th;FJuMl9~goL)0+{X?Qx~go1oVsae
zS4VC`qiTPr;Q{;Q%<0QdHN&#r^w)7jyZVrEp%VXjjh`-dwki?&#%eWB7oN6A_uny_
z|HE!5RX;tG<Y@d}ITx&OZh3Lr4%Zhc7NlfFhQ!s~@=Y$YD#r`9n2|*FG<=k_|B7(j
z)!%D%*wK(T{PY1UG5!ie1HJD*;RKz!P1PZ~t^J6yA8wY_dYyC2ryz_f9O(6;)MCl&
znkoW{k4%)Sk*8ar%XIUjuxsk4vlQIjD|+vO^tuuA<Xur|8Flz506hcYJ|sN;xC1)E
zqPZ1=qWK1;AD4u)qEa~$;_BBvOSIaVBpF!{^h!xp)(>lcKBa$}$BA}IzkCuZAp3sn
z>$LMw$bm52{agBFxA;Pfmb0cqx*~0b^OYR&>SOy(<-H{^(Wi#GLZYmL@#ZL+Or!Bb
zTAT7`9O+*jb5M$pJJ^F!MxGWe`ekVS9|hhw&@e_`ubiNhS3~B4Q}wC}1|n%MB41q;
zsZO&FaZP{bk-$Ap>Y0?>FyOWf-<#c|EwjREOBGyI2)T{r$%JHH_|E|l;fT<?hirk3
zz+>7j=9QrK<B<lfmqX8b=~=lLN9dC?Ss;|szT&(pgZu1xPAAKwi|;sY4Hc3yl~)o;
zQ9&Zt%0E>&@Fj~wE9$fg-KKRkT=ULUF8*9;@2TRtt`zEqNi#EoyvjsEp?)R4>D+qZ
z3DO0`0-Z#rV43=kwNcBs{t;aJi&54M$AA~C!L17GATpn0{19~sJA*V8$b0{Fm-EC5
zWywXk*eN7gPXrA~l+$R}N0sfFiL_pWR|=iOCriK=*LCjtx*wz@a-vrlo)07rRV$(c
z1jAU-v<kdJrxEqBce0S(Q)FKqg=@vEw%|ZDJez7!`a)1QdVbIb-yP!Q25%E-2%PZN
zK|A&Q<Tkx|im*7&5|P<SC|`e0cQ<l*4B2}>wR%1NI`(XWIDy1{xzGfQ|3cf4AX9#v
zLG9hXa?geG{#UojX9u`L!aZ|*?u7J~tDYvjW45*DAiR9=8r3rrJQ@|$6o&?>bljPj
zH1GkI<=J*2z&*eyB1*b-+m@mta;mK6<LF6?d4|z8vhh>fk+?vADHQWcjqS+uD9?tb
z(=y-HbGL6gqj1njhj9`;S59?hVl%`rT}CKT9E`p!Cv^?OEbDaT?$cx$T%g#WJQ<@!
zc|xosV3}IDE<yW8Ct@x;BC^P>WG~oLMy~U%{gAh|Z<D7-?>eNfZ|1=+c)~efY;j$V
zZxYm%R+ul3g~E~1+j^~WBN79fu)Lb%=y$q&40U_nWdN55yPefPOUk)L@Y3M9B;C06
zyRuWtmp;2Ia^dSdq9Le$mHBKh!L1}?rdE6?0(7@is*LIF-Ityy>X|-p^kxa)@=6vY
zjCCk|9q&_Q{WA9eTHwq$amH>v5c%Z5DbQr_qPj;hSMg1;><`2g-t`N}76ngCtj_cx
z`Z|NR_z6cHzDfDg*&*R<RvOLg=aq)-xo+k6#7+m+Nrmb}vHXgjDo0&k^#f6O?c28`
zWRrMz%G?xY%zzMl6B`nfadCZjwt4BdrJYehwb-UGYsS%*FN5|XT9jhcAS7zz&8v_+
za`jMze7R$58wd7qlt)+TkVe*)xbUJnWH|byZuUaDC{sYjfJvz%e+P|x<cj%dtg>JQ
z7<I8uSvlp%4ldQ83dR6Qi?mg{3>L^&SW?8Z8O{jU2dxLRLfQxaI<sj1vQ<c#^y7I%
zYs#Bo`?gW<VStEZ!TgPw=F?4f&XHq_Nn6^Du~E|e?=>yK#{$3p)mLNp?WW!&*e#)^
zf>Bv7N$2fJL&g#QpmoKDfJTO3(P9i)qIL&aBdv5u@2BNRCe=%{*M|MWz(97V!Q)w#
z_k>zR7yzog9`~+8-zP}jG5p3`s59>8aiB^C4A)NnpN{VRU%>PKV!;0+z8(CGk=H5X
zJise6E5F{LzZmfFF@sG~?t7Za<GIlwjrIq7tZTAz6{ypRdh6agRxk=&wRUxSK<f*6
zp98Ya<YYgli4%OmQropL{Xri{JzLtto|}9&cfmDn?%tKNc6~HeLm;sq{WK%*QZF`g
z-LAi5-skjykQ5&rGfn>+tq|f;L57u35AJoqXHg9!Ms@llYjE*B=Sf$kJKeaI-z<}4
znZ4oHsVKgq0!jj*!u!o2?XCD9Pn_{n^x)#Q{e@LASCuTQSY5d}A*A#raP3XJQ$Uo=
zze<oI=_)0ZdeNHU?GI5&XOx6D^@-L`Uj)@6WuT{&We#>%4NwE`X>y|?q`}2+aZf&F
zy`6;xTm%$Bv@-fNwXDcx;?85T86Oqt4zhp$f+7*A%Ml{`A|Uxwc5i9xMea=&EN2QJ
z6pWzq^*7T0D&KE-f;bKvsTZYb20fBeQMgyNq7DKC@>4dj99=H|A1x-M0=t-Ahg1_~
z<1sUPWaREtgqC_!qUQc30G0bO|1)s*uj>F#8rd5Rz?38zS>@V;wR+S6u}N#4^Twy>
ze=HRZ&lSy$<60EbO}5D^0QI^R0B}qvtY8G3ZJ5`yVI5jMVjb!TfE>%}nIv5&0Mh&J
z4C+c>TsMz$Td5xRzyU0ibritxl>-GjoCFv^a&Vb$r5PxIi#dj_ROkc%AfB^pHbw+V
zix<xgvd6=_SdXfP%_Z(M4XIN|E%-eRFu>nQU#DWG<L)(9)uZ-tj@?rAuz)Ye&zx#r
znbz3o5W#i46hQ%aSwTJ0z2*mmik8xQ2UUBUxqn_P#N~#rWmtK)oyP%)G|O`6b^gP7
zKHnbMJIZ{1U#|ye^Lo?@(Qy)r^yKRYjT5O;*Izr_{<WFot9v&z4FJF_T3iMPcZvgm
zX=({TA8}9VrPAGN@y`HHVFkghvZ$_)0EEd_4J>M|Xv29lSkx8pH?+YPwoguD6e~jW
z!uMST=E0Ikj9woNKUlrl5I7kup14bhlb*v*&e<ogH|;NdOjh^f8T?@%C&?DU+&}%~
zj6g>K_ytlATsdA)OLKIKRRsDl%e~r+&11H6GhZE`BD1h>?~QQdo=sLU)7{A%LX)Ev
z4#{rqch>@#R)qxnUSEU%Fx1==jTO<Z=cZ=stz@f&zf$Y{lR|z>+S$0tn^*D{i}Exr
z-9U7735wHEoYoyqnXZNE(lp^zM4qjw>_r(BDz1~t_UXDD+^{#7B~7RFzNZ8;^)Olg
z=@gUN%H7-Z0Ayi4G}e>7l@x6-ltsF=WuWxKuQQBMP*dH{#8jPOh{~R{Mgl-uBQct5
z2j9NYEuBZ@qwWa&ter-7Pp?~sH6&^sDrbQo-%tkFxRVc~P<R)qp7if(Monp&%)_%&
z#HJ%nT9#6L{^k&tNbhGouDF2M#)qA@Nc_3IcLFAMA}ff~I>?UAqerHNp^hBBQi1h3
zs+kP=_=01k<>+m)!EYM_t^oF@!eIdm`OzF>P@Ayrdu+sZUQdQyH*YS>n3l_ir^=*7
z(*1|cZeowEFDUHdWySO0K1tPfv$PE9WUn#EdX*;mXQU{SW%XHL@5ofnoB1E5U|OTr
zj&Ik7nD7Sx4ikT6@(~mGYkP!w-st+^$KMhc0TXnd!UU2^G~9+v+3ZIFJYU1o0qn2-
z_5|LvMzFj%BOU(pl)}tMf55eIS9TkBC)Kt*Fx<}Btc0JQ7*CnAHqd%HXVG7%e$8%c
zFkdx9VnQ+(EoBDk04N-_QN)?X8bqO;POlY%kC-|nG!z?vG_q8%30Zu1N8kbn`dUUC
zo=WP`;{m&I4j+hL?KsAb{<~r`DEvB)?hz)yS0qsJq?Tttl|T-jQJd{|ZRZc1Fe>N&
z#fpv}^<h+X&RD;dg&)un>;>(IgHn+Q@CIFVRAh{mYQ%b;Z=Xu!0&g)U5UDbEDdlny
zUN@^{j4__pcV*hk6T!?aCtAPs$489Ia<ZW&_bIu<PrqU~>1}e4&vy2xJDvEcqna=o
zXG&(`S5@e20d$ddEi;{sEDNc0Z@=Dnt6}_A{a>~B$~4%$Os~#qWNwwp-g~tu%nK{O
zZubZ6`7`I+L3ZUDir39$x}6<)LvXxu7B5j;enaX+GeWwtB8I8(^O(N}C=sGIGz9Od
zuwBMi-<r<|@|Dg;N!z=<yv1>+kc-#k>DxBil0Dgr8E!%oaCrPneT&!xI?TBykaHRn
zYV#r+@TfY_a-(FjDq$GT3SR8EPq$>G*3*g7{`DDJn~g7@_`9BjzI%{iaFQPDk`zdR
zJwM;?(vvP5wQS4c5;S_Q7(`L+?T_2!jRv}T?u;o=K=~<s)R6^7Y@YD#w@UA8bwO)n
zS$Nc4BxjJep+oV^Cr0Lv>yeXaA~J;eqsM8#0GON|P(x|X4OGw<er(p0s7Y*Wq%YQ(
zmiE3R60W9~Q9Z>_u&ei>X4xmg@6l+zLBT9ooxT>Eh+o@Y8hs9Dk1+Jod|l7w+O%@t
zKob=}jjFNnA>R0OGMsY~$?yXIcc;9?eXxQuwAL}Q`Ms$E5j9YzEP#Pg0V4c2{MGde
zBmHS`&%NX4K~ITT(7p%;5k~||mhDLXP>Pwlrp=e_3WvAu;iG<~bWTHyF*^b6H_z;X
zED$`k0BSs6pQkANL;dAs<*Cs#6c<k~nES~l%Qz-03ipq<2@f%WfO)#y+A=p9<`n@p
z>9AD!JXXWD<|_PSN%dJs-0>5oI_j`67&gNy%F6z?I$SwmeM?+%m2kRzp1><X*JG_(
z^PE@vl{%QcO|8!#O!<#k?bTy`wPMnk&ct!13GR&A2p02|xL;SpVJ`WOIS!XTHYLkB
z=2Tvg{^Vait!{%U)@W9X0Cd7^({XK0;tr_MT$7xtx0qCBUQpCuhuu)`%Jy}UR|jhp
ztlV_7RG&Ac?;L?-U}n)?*k%k#kq@8wK2`r-y1@;7xOPs17yww_KTjoH<wj;9I?dq|
zkDDulignu(Un=oRp5`riEBu!5$!$Qy)%y!V+W1ya;)hF=cZ3*;WGG+2sGSg+6J6G@
z@mqC|T=!P6{ORzO`x(JE-S6hJ^xYQ1>ZMg5IJYJ}&z-*az)Detvn4KHv1Q^mSuRWs
z4UIrZ+ozsQ@@Y*k0q{|?sl~<kiaDN%-M#rdK?XU;XLePt%@ZQVHJ5F!Tt|G|?t!qO
zTPv1*G#gj9ayOW~^!Vg$ohVsGVsKf5tp&o=d*2p>^!)nT%QF%Yxt#q8>SGH{bW?zd
zQxdEzVs9yQces?!Pud=_iFP10G51Y>Ua$Aa;rhZOyqU;2{ZdDO8-r_Tqj1Ikl!khZ
zSOqd3ZR)L>?=Z>w;E7f-0bdSg|4WHVu`8(j7CXxFQK`b{YJ?CIVQ5Ja*4UOWtL05-
zWtmUXmFir+wq*QqzWJ0WV@TF5gg(mXnkt*a%VApR@sc4pAi286g=5}L!q^Cr;5<ZZ
zuzaY<h7ORXb=)jC$)TkUSv^s&)Fq|~xTLJ(nE(PzZ5vrgB(>e&q@*AAR@Lfsao`_$
z&*cP8-rb22S1qcrvXuAewnaH-d$-#fyDELn?+^W|N9Kv|usC$UcOTfv6FQi4uqhI&
zcP(<C1)+So<4GgP%k1a|HQL`O<z)$z7bSGE^4l4-=pF9xhWnkuZI|>q=5X7(TYYKA
z;wQw3zhJ1|RBXQflRW?GV{YG65_dbs`212#`Erx1hE~ukyJwg+w(fFO%td6WV14J)
z0~p+eB8YF$qzU-1AD2TWsr>byhwoQ*n6&3hfD51vH+e)}ze(T{YLnH{mVX5Ck5T60
zIK_!I$rcMjYV3?sbfPONCVvZGsJ?Ry!>x4%lBZ-Sf*-$fKiK%?V8L?BlWp<Ve75<~
zF2tl7(!EuAjn73JXX4z|&rr*q*?At##n6>`S#vJh`zPP>T^YPvKNsw`boaGu%)-I9
zR?PU~`Mr7QY~mH>S+TF#5{g7Em^Is<I82@%UmY(GEF9pmnapr{(+_rin#)&GlfQX+
zCmj~{!fq%D@Kc*TvWzOjqMMpBPvZndSOMB$_eBLXc(*m@U034|vI<;xyKo!sL{*LX
zx#*Vww;-}N$vY`uSX(uxRFiwX_3GMDG6)y(28VwXH!*lc;<rFQHgkvU0SUtBCrhUx
zTXB{vPW0|4Z#Z4@){9mScoH&D>VQeZIrGW?am!pVoNUMPkh~4~?L4u$IffTAh;==+
zlkz#_-K+a&_lWxB%FdT`j7#3FsjHGtd!4_HZ48bhzdIV|)ICt`T-W(x`*B|c&h5RW
z8(!Yz7c(w9yW(spYaCyF_K12S%(wCxxWze(SJ&zKtc6KioSI|y#>z&r`3+-pjzK;f
z)?;fVYduhkXv?hX5B*tovmLZmbiXgx+6D0LdO~<v&<v+CE>s232e&@kM3R`YNV8^R
zD3sY_zY`UdZpbXAe=LgD85wNQvn3)q)=D-TA4NzLwVHG$1vg+P4R>J0H)9kiVR0cX
zzMI>DMGL_-e@&3<r|&`432xy){$YD4f(&i5Z|+R&y%Jpb$~2pNW@dzJPUL#^;ofg^
zI<t5s(Tz_x$%7KQ<}rPh{QC?D0av47oF5C)eSd9+c1n(APz){pfXt(ZdgtTB^NKF8
z@GF}WIGK(RhLVw>EC1j`;$CG8w39O%OV)3do8OF@^s9fsLtm}?j?M<5g-t1vKC^rs
zg4b>H9P)vQ9VaqA8>V(gwyE5l#yDEDE~Kxdv=hmFiMxQfV=(q!hOyd|oax<mJ0nlu
z9g<JaC1Me(Ez-Pkd%81T$avNP@Am9l7q)8)h?u%ZqJ+kNh0za41z{Wbxi7T*J*&pa
z>5<#Bl+BBT-=s3B9Y)upUR_3!?RE*u)f`G_2qsN+NHxZlWWlfB_}oTa)r=+}Yt|&@
z{Frh=YFE(v$O_(U2jknJ>}cES$cs0Ik@l%9yFf-1Wd4Y|7gA$CGokwFKm>mLpq))-
zOwljbxYQ47stidpB9i$mHrkFpDcx={v=ML6!i>;Zl#lx<Ok?FF-F&Tq@Z~f<?yeZJ
z%GZ9u3vBu~6Js1si5Y`GTm*R}bW}@AjB}3MIW7<-vRrW6tmq0a=Vv*MHN&i!*O7EK
zrJk;`irh^>V)=Ad%P`yD6tE2r9MJ}>6mm(cdjQP|LTH7L<J)v+Pkuwl?F%%_>Pj{d
zfzNXT>wNwN6gZ{;23q^)851tZHk&s~o?C+N@ZP8b3$IW@8KcRS;reg1P5ezoO<)^0
zPKcAYI~_-#v2V={__hZF?V2^MLk_*2NyuRX)Hp}>%2w@h<98W8?1p8s_~mZy^+>J8
zC{4-8cADTB9+Q-05%}WXTTFb}cowOO|9r3V20FdA^##E>;drPLfz_tahjlK>6Q&UB
znQ&#C(gL#8hz2Rkl#+IDYbU$-jS{~5oFuZ_7Ll(<mRouhE(Yi3m(e=a)VQqI`+U<?
zICo$gis9@Tm9@$=ICbc$AZY_yklNgTZ9$;*;a;$4!C1G2k8WP=fVnbk%NNvhM2D$T
zs#wwA;y8*JvLIu;!`#nbJRf>=s^DR(vsoGrHg3f=fJ|SXe;mub6sBp&HUF|Ya(3L%
zzi?=(P}PB`M;0EH471&m$=z;&N!B}k1i}+rs9`L&D%b-sUtLcWC`B{}5`ZIB^hkSJ
zb#j69TGC;DY|D{%y{cL`2+v!#?r0@VJaw3mYGkG&tgxy<7)siKUyiJu=Ed{&pOuJ2
z#>wH`_~&{NWmWa8M;ziF5nuBkVn&#IzD|Ccb=$FsPm79eKH1;**Ff{fzXlo;Za`oR
z>++VVynRzWsf0*&w>?LHT^epS+J6*ZX?9U?$R#0aKoAHC2xr!cW))i2vIHCs+Y4}F
zqQB<uPZVu4>{i#kI%A}x9`eB<V%+w*zwjZSZG!yn`G~Ax9)=QHo5EG{>ORPc>VS&|
z<EqzJvO*#Du^rpS-R@oH@_2ek&gX#?Ac0YMuM9b9@8+YgFovS`l;^u6O^IARpxsoT
zdu(*FTZC9sQjy;PdiHW>QM7Wdz%0=sCZPG?AJH4gBDIN)8BicRXV!aUQd3Q{gCdZo
z<lmjgKHDsL+32Jxj^fH+8ay~Ueau3fk3J9D>IUhymA@OobT@IR?}B8iC##Y`FXUia
zC)fQ00|Btn;R$7D#yx|d>kMC3;_Zcfv+KH4WFy{NTnt#vUMQ+ejtiVvV|+GinrX^k
zhO=+N3fp8?Bgvnu1I~k+g%aFV)ltX84!;CmFfIDLdJ%JOS6KtZD9a^nAYg+iNj#i6
zYvVNR%~vDteusz1zx(Yr`Dx?$PIyWi>vpvB{4&vCVAF%jbyKmpKjP7}Hfmx_##dw>
zRWF{@5(satwoW<wM46V)LW|C1PGPGgFyVP#?&XlntZ?+1Pw`;=Ol~-Bz1N0coSEjW
zt{#kGq}_#SI2S*$8>83ggq^c<Y%}2_?A#;E`FPCR({}O(D|thFW;$m0zI<ix`*wxs
zJXE<a48P1<$b}W|xiU}HH?;^4%gX5O*{yzhrRcqYtJ!egO7oeW932>-G?EguoV7*1
z5OAt?iQw@~ROT8hp|7~bDZfhlAU=lunzPt*;ggQgqQ!{}OMLey$fW<zx()PbW?<nT
z>wI9v!lkR5dCL2Gr%)`bh~1v?m&fJccS8OG=`Ixj@sgnY{+(a#CihSo)oTL?hHYNq
zR93xZzE6s12>bKTKQvuiVz^hIRrdLy%tjeh8(iZ?J48pr*?Mh7zpf<OiMWGqyldB8
zZa8zSS}XU4o3YvAS8WCRGo1xEy(5)^NrWd%oGYreFnPC@f6yhErC(<4VbN7?qg#5J
zHl7$xqu+Se4|&xEH@*qt>38l3qZ^v*n|qYpw8qe)J=v89Ggc2<(+(1xIYaPndGc=(
z&Usez5Kjm=fSN9+m;Ka#EflX?-#p0)X|a#g4?o#3G&~H}!40*S{;~sAs8LCHE-~lI
zT9iRjH1cS*No0vUlbci4q;{*n{&&E-QNh#qav&b-o4j1dF;5i*5XQ%|^5tQiI^|tj
zhpk5Od6O1U5xlNrqELk)A&3$<tnS!8RQ_Ay#=3C@>+N+79+SQbp@om6i-IO5har!T
zZy0AVFsNY|pXlw$5gv(DR5QJm#&ACA>U+w?7f<`<YshI{IvZ7$OT2kDgNa(JE#e;u
z{Avy|EY+^&1-&JY4_Y3R)gN=BAA7g=$Fm3F<1RS4qYUFhG3h`)(N;F_Eqq+`V+QGT
zmN(EINNX4U)Y$wluus=Q9O<1wjbeiA)u@VJ>Z7)us+Sm1AH?7v9HxJ4F(OL*rLY%X
z!|D>E`!AcRL)E)euPDBec7s3pP@O7pLV+nxNq9qM@R6J2!4=S0t%jM7AK~6|joX}F
z58N8ii8g?h-ke9YE$Wj`1Tcl(sgHE~eaDj8sxnRt<N4W%H!%xNl<iZ@{8v8NWx0Et
z4llHb=R|uKeJ-im!EkB?WJ<Yhey#WtDpQ9^t9~kpdv5m?6VTux26v6K(4n8zEow*<
zSz_+*|Ffv_fBbh*<zfooS~p=W>>tf!V~?VklJf^cb>Cs<48l`VX|&F3;Pp=1FC|!s
zBcm%Ev=f51kUl@iyp9R4lkny%gS-bK+FW<y0~L|^nCBy%L7DFo%Egf-54OM7cZ67t
zUwz^eUj#Ysh*4a?ZO?~x(2ozxKkwO=Nm3AnwN|puME0HRvwN6s?auJh{fS|2$4&L`
z={_yeYsa0xWp1uovxK&~LgWmH5*pv{({N$rUiMXeXq6P$?YI=8elOeM2<}oWb7HM2
zjjtt>hak++o2WlRiqpZ!5)REslN-pp!vRy(d$h!+*_QaTjs0`Z{B$Xadu=q?{>sC5
zf950(-D(|IacqxfWedkD2xtDNXIXs>xPxMsr(;WiYy1=FH==p^JcQoDBV1u@Jx=X)
zh3=@(lGaY->)h>btM^5&XJqW}=tx51mRr>zB4Vb-clb(g6~PLKr6;y83-_Rnx^8oc
zJoDz;Al$N&hbHix-<Vyk#|HGDb~*&4^Vy+CtQUuA-srQZ(Ys6Zc`CGYPP<Fkzd!~H
zN<V|}FRSlu3EkaEQCZAv%!gCLFSW+0sk@-QzU)EeH@No8V)`Di!ZQUXnI$Be47gnK
z>=Wz6$AX4)*S|vEinOfdK~81`m<7SG4z*2_U9qh93GI1$_K%;yahx)vZR4ff<B!Jf
z$D1aLr=H!YuRwa!q{j#nKi=RWXLQg&AFjtKp$Pm1C`>rB`a#gD5{gb48(_LSI<L&_
zLb9{>lA#h6&&BF_{-$VRnj^Ol?Y{ydb+z!HiztLx5LmFa)#40aZVY46`<6xp`R^&<
zzW<xN_$FAmgQMa2>3km;C^B)casw-X67z3LC}!<(f|dKK>~eWG6xa6Cmdena*AGzq
zH=VML4On{kOTXd1WsJcfU|{YmTzB{XyAre9@H<nDWm<mDE6I2+GV*`<Z3d=H_gXP+
z@&A=QiCN3X<wER9e?IL0yR3{ONkapzc7`f<X0xWTsA11D>>!ul=h6uAt7Xb_U#A)Y
zXpsM;p^RwqwwePr?{EkX(`t5ORMwpzm`C+v%|dT=UkA+hy?>BIR~&$JKEU|;*L{*4
z6>(sR=)9PwhcSOb%<{=O$)tP%@HMouUVs+UfV`n9VaK^3FjEg_Kuvv1KFwizp(4Q_
z(Ga3GbUCD}@ZV={pz;txfW-@eX%|^0S=Tgc9Fj-MsGmu{`yg!;`}t2&>p$%k$8Y-N
za3E~N0dee$RzMjJsDO|Q@D5O=nC@PQ=qG?mdt;6G{JB+gIN=}hx>5knr<ytmJg+1x
zJA`rPjP+hheqMNk4}BwcTc0e|K*Ib<w=e?GHVepgQ6fm?H|6(K-JVfJ>o8z;V4f1S
za<BScc}5T}!@P?L1UM*;Y73F9`u6*nj}=(v7fu21uuwn1!}#+~6nNSKuJAo)eyLPN
zqQApGwq6&Is4th+dno6+mDW`%4x5T(J^JGVs6c66>}VMvyLSW_v~xHd2*sn6sg?&S
zOm<33yR7Z{C{-9Lgyck1m8Hr+ho8~1r&$KVta_8m12s{3p#S;zNti%FYb=%0;^tEF
zu#E8qs)lIN`TM3qd|9L%$5gXQKt)ND`Tf5cHGA&hoS8*hIBnqG%21L4(8;voz;GKm
z1<0$G3QjcDx8vm5xP3p#5b&EhfJa@dV5Mqze$ebL@S1{KTe|iBqwb2sk3VVG|3u`-
zHINjKDjcv*ML7ZH0f6do;&uOIMC-gHZ|CR+w*gZjMHOCZ3+OY(qq5ISf9%blN#BW|
zBH>$FR2(rt1k(CtsHb%6+v@+`uXQ1aQuQlr$Y=)cBuOCex095{_9BP?@3pB#>ZeIX
z8rk*%B?#bCzf!;T$N%29Hju(LI>lR#ikHK-zdyK{O)ph@fehRtRE8#;Uz-F>7o3Mw
zuo?xN7O2NzU#zKjzI2@$t(yPcXziBPubn*-fm6R{WwT$azk0%_`zN+TdOn@x=<pF(
z4%BGP*gr!O_Nc>uneXDeG$&vz^4J-5NOTl|#&-b1?G+1_-e&j&5pY&Gu&Hxqi~$us
z|6ek2pC*+`C$lasu^pHyQOm&nfrk&K|8+8FkcP8<2AHGg+L`K)n*i10=##~Fd-Qs%
z*8;%jCLg5Mo?SwaNetFVYRhxb%-;gGr;EYVMCE=T+V~d=@joYOq*XRx80R0af*^Fk
z^U`v1aIqOVsgiv<f?+8M0vf862mmZa4Ol|GamSYDvOJ|MdDp4V87Clgzg0VIpthRw
z1K4_km2adi1Ih}hy|)5^aCjwNzVG(NWl$n~|AWB)A8+R$1bNx`Pl2$Lx>OATt-pV4
zSTQeEAn?(p^5cKc=2OesKF#no-w9V8XSdQCXu$sIB2l}N4FcJ@@=PvTDU>oBjq*I)
zGGm)OOAOzG?#vaHJ<OvlMT)|F${RFP*P2)2rVOtl!uFyKZ<yx_9&X$dnhZSJcNEy!
z&eN1c=#zI=e;y4aPA7j->y35hPg@QC;t?AmqItBcg9|*`xJB@UA9>n1^*3#r?2tAc
zl4KkvLi?X>z!&OdajiD!JVev4J-0i-;oDflq#ywa9Wo(MP#k{<z@vV|0{wqqzWyOZ
zSccT<Onu>Tsm6JKe37WJGo?tkEa4fp^Qd|$^W*3NOS<ox3TnV`GN*Nw-mqcgHUzlP
zo-Ol5w9DQJlDP0Q)ygj8#-tOEs&T;BY4LgQwUC+W8@002dh$*O$T5k76(zxELDNkk
zBFvj_yjHhI&K`#Hmxltf7S-Z0?$}+{U`Y_%T+P$!_ozQ=hb{A0_W)<o*vfZio7;p7
zLH%g*7HOq6EnmJrrS-Bzzw0x-<ki5A$<wkLBkH~vXH|f@*hvIpEgib|Yd(3I=RQ(q
z>HW!MFIDYYWLxl36*fuv#wXrMMNi&k+P$rSLgOt8&EHVsKcpLf2YU!;A>S_yc1xZw
zm4y%BuNPlMf3wF24da{`3qBlXJ6*_4H49&~9Np3(3nz7)9Lex}5{$~(85Ob+XS?rg
z;{yeB;?(yMYsL7-BBJ`XCH2i?LX)=V(b(J&6Kf`D2I(FAYBn;yk!hlU<#2Mu(+Sn9
zX+f(qx>kFzgA=pxNJ$&IuCtbhRm7{oU)lk--OOS3!i)83Gcv2M2nTwzPs@;H+FMzk
zopA7ibpGUVVrC6!(C|MSba>?7^yGiL^FK0V6?UKNXGTXT)z9rnRPwH&3;lRV7I}?q
zn3$VzL1cNue8o6Q!UHXeP+~*JH1HDZ#On8}B`O2aK^k?)C&y;sP#4xra--(@JIi#L
zDlRQd`ia&4-RzLb*wc1Hx5?%i4Kjy|z&BV!K5lHgtL2yHl@P_rD^R#=-cVquB24a=
zonNur_qht64ob=2)7lxl=?+-kfZumgR-?5VENDab6Dn{Lf(<OH^d8*4Hv?uR)1J*Q
zmaQ+AX?2t~EibK%sg*K}Ea;QjAl)$3!z_;~@7xG!cv=1CA3ytD$S3<J(kxFFtFu-$
zM9)PG-zqwN1ZY|*;(`oNq*u1_ZqED&-cM}sitq_5_xZ#ck?Y8Zo_L-N&61p;x0#Il
z=+St!ei6OA@iHWx97ngO06$=~3?FI>Rv}HShRv%Sz}G!w?fX=u8xHydnSyHSAO(10
z#I8Y*M}On5hlf(_Ia-E|nh>%g?>5JFWMJ=jyXp<i#+=1-8cnl*^C15aA^lau?mdeg
zs)81C7fx+x$p|~0K)f9J#XMdk!|3<NhoUZ|>LQ7vs<8IJEbN^+e9X0|m&4TMkQ8wh
z&MlN3lKEjXh!W8rRV23eR7o>fCFVFHd9R}Hd*3aFpEciiEKXGny1Zp(>4_0XEdBPe
zl#9xB8fqN9WihbaR3mPno=#Ed`#8HC4o{2!81J0VzN@_ZJ<*z>;KgGXS5Y`?+x^_M
zA3@$t2<Z`fM2hoMmRo+CS6L%DqKyU=N31j~yhcw55#{^k6ylTGy;-dEZWU$+1+>~B
z8Z$_<e1k;=EgQtBvPRDM_mfB8H1HWAMy|vzJXY{`l8(tn-{ZzaV1f&58`L?r4}bbf
zM1)BB;XY-xQJyBI&PhqP`w|wtyfyQ3`%9K5$~8Rf+DeueniyOER8VACqPP++5Ix^q
zud&<UJ0CvOFB7&i^D%L5(K@8%R(`{@n`ia5Slw%l-O4*e{{AQPT}PbO{??ipeVudb
z3-J|G()h#4TVeQ&;Bix(j-ncQAfu?c`!|Hq+?OuvPzerc7lB*|TM1MlVsu1ipe!-2
zE#38Ot@WO+?3Qj)hgWt+`|}bTHVpy*Z|y7?LGca%nhS9}(61W)hl1;`qm*MhiC^yF
z?SL=%1IK8-u)AbIt?`s4iiB7gF?Tx)ftpK#YJ|r>W}WX~XQsz0tT3y2n51_-5^)C8
z{99kWf?r=mc9`vX0Mr@Zc1<3svfbg8aErr6dFsO1fu~=#yd9vhPr&?o&iE9*s$KPC
zl$!z@8V1w0B#^Yi_3CHIKMR;>-OMGk2ecx>^+Z6Cd%MS81jrpD>kS9T+lMT5G0Jg~
zq}e_1BR=`c?ydE0CGMA4Gmm$UsEcW4!c*FDtOl+3<?(-h?T#byxN)*1(~2+2TFAgM
zH{NC6EmV)}QPT~%t}XJoQ!QLiX?LAbLMK;^xY&d0%MMH(y{)l~DsgB>NV`?26dFGc
z^84hahx3XMgWI+A4l`$cmQ;W@Pb3a_Awsh~OS?BKD{;a7{5N!x^m(TaUTfS080_O~
z0@b7&cG|c}9aZ(1K;m@ZGlvc9HZd3b4Sd~yienDdyzr+S#@0DmAJQoW46rbuDe6M1
zt<{P)#DlYy6p%H{R?7FQ%hSbigL$VKoS4NA6MpixrpS)$+WnwPPF_j^aa%sh4ydaP
zFi|X#d0-MNe?#}^qwe5eP4h|%g1C0@%hx28Rh*(%E>*Ebz$<e+kKv%0mUYS&6z~l#
z)F?xKeJ^dfbP2m2qHl3vR*idc=1I&?=+#e^b>|7$3b*5?ClS)4?@6~tvIU_-PU+sy
zyn6hGgTC$cMSJS^C0w?cj=NOV7j-MmRMfHwMC(H(>;%U_j@Mkp^$DCTCT*SvYu7pi
zt;(R$=Yc$R*@Aq>xroB|rYNjq;yGb(DZb+aF|;)fg{OQc<vlfX6SH|CQ8h4M3EP&d
z>^qL8D!)U<iK=px{!gA5mf3~}etx6dEa>=#-;sRs{28@=wdv)Jt533g@No+dx3ZMu
zKNGN*%1bWJ)jSa_!0>HmO><Sif*baSyCVgK({ldMC--S$VRnD`3J|OB7|+&ex{jHw
zCqSky)Oi|t26;?EhFLcjSM`b(_89N~3o?FGj#_W$bq0=XhiYKFr@=3_blYkN0KaaZ
z2atwMc<%lP?5`es^znu|-Bi2GSp8(kvZJBaFTZLsA@1LqW;$@H>igfb6QG($pi^J8
zo25dD=Xh2jpLyf-EowU7b7LXDaU?eEE20%9RSGNmzTLl8{4<(sBRDR2tL==>aW-P+
z1aFMVVAbV9+N|>rtb{Dj9Pcaq?U1iL0a-oa5qF`Goac%`2t8ANmZf8pm(4rm^1vBd
zr-XYn4Nvd|$_AOUwd)+bbF*E(c8C!SE7}4%(cr~Y@SIlpu<2mn&fdc<b>yGti;6w$
z$Xq5_w)+^Kr~}V{u5|Z6Kk1X@*mTu%`-QN4e3W#3ma<-Ch0jA(#o4x_hCn|j(oqO+
zDSP34ix65H&60;$y`!29$17Ulw8re{x9+YPj~!8xn+{|0;jr@diq-o9fnUBpv0F5<
z7K5jm2XtZ@Wqyr?GdD=bpW4(~+&|#hel|bn?!YgUH`(X+Ja_8a---|#HR>3*^D~m!
z=})O7IGc;%!yJe7m3r?3vD(u-gr@^A_*TQfzwX?Sr4O)P#Sy*#K0gW!F*VMrPU@LX
zL#bxV9Tf?-lj~n4JF9@-bnFgP<(G?fgY{_3LS9bjLd6+ze6RBC1mW5J+*c1QWL3_v
zT!@i9C0a0`>CSF*$lC_vYWsB079qufj?qQ%6ntF&<b0vDZ8J*>N2_?Ff1ceVf;2~p
z=hDCBBD~h=CV?42TnLVv-g-b5Ug^#AAD(OKwpOFj%KF32t?<`o*y^<R-kvqN-3{Ih
zwcFb%?-vB4m|u#~?}bvv&{R(Cz-$|YH18dpEb)1S=N><>H_c{{Dea5$7@(NKRI9o3
zV_;+Q1+9mTY*ZHHzgtMLG&**%hgADAWI8^XV_DvxOqEu)fHz<)!D26_c1SgD4Z_es
zcV{AdwaR3tLnLv=TMED$Fz^zHo<3lXld&2u-2|rbIq%Y1!gDH)(LV_Up`y&GOu^S<
z8o}7sOr&b@s(}gLc7bXEhXIptCzJBe$FP}>mwUl8jQL$Lv*2|Dq{OqX`**U!DAN&z
z>ugy1KNT{T4$rv7^gjp_seWYv4@_F9SU;s{Yf#r2$ar0nJRJbYAk@ols4h!2As^cD
z6?LJH4i8?;D>ns%b$vxXuyC(h0a`=mp@z;QDw^V6H=Bx^&x;ViXzk4;d%15!md}sP
z`~q7^3b<G_N74b_aWk8$CZ!5I1^WDaFniq^z+)VS1Kl+HNAP?O4%nj8fXCFoGmK7%
zMvE#Vc7m(^OxpU)xHh0v-UUv6J`JtEFPb=Knb(b(f8-#P(~J;gPQ>QX*^JN78gb1x
z$CYqtr?@XUEDKmX`GB%6PLFXqRfAKMY+8Z#Oa%>zcF|~QGl-<lC6Zh76in;KToTHn
znP{{j>*>$k4p&Ou_qK2J+xA{67_AVr|KmK~t=<t;;L8^sm=CJ2YqM{kq7ErhM`RWC
zdvV5Wy8kqv2vi(?5Fn7)i&^>Hi;xyMfP_B&Q4bh31Tpu_3J226xlfj#FFtnzZl9k(
za(wt5l4LJ(rJlnr(*4&iAlC{refbRios`@uEER7D^vIJTM+w2!Pl%Tel;0eZRvO%k
zMP`P^GXTwI@Hfr&$md$R(1PBI+!8j$LHj%PT@?h&AbeDQr8y7}S5kd>F`~nWJ`j}a
zS6S!5`%aj>xnvuFJh)}c4Do|1=?Me$gHWHw?nH7))8Rf20Anv^3RtN__-(3=iEeKk
zgyp8HTS?V@f#`-xF*5a)4&L{z{J+0|99ftHdEL3R%Z)Ks(DXXzQ-rViHzR{C0xS4h
zawtBRrKt6K_5u9FZl?<E7Qo_!r}*MF;y3AMIK3ZXW5zxd<*KTYzMQ;?Uc6=-GF*Wb
z;Kg)ujuiSn-R^1q^A#$B{HI%mB)cN;QJhTSt!A$8URB~-qMZSL;vduETS%z}J>Z3w
z>M=?ft<dL0YFq9&{51aW@;|_d4{d%mk8n`+#JzYl5*E-GC|a0rz^5&X^`kvd4hP*Y
z%@RW4u2>Jjf8KF@!=;^<aEdK@;5x7V>ES81#GEMZ?X7twDv#5w`R-(~VL}Vb?dmno
z0Yfucf7}{wSatUv`9wiZtHW06cCFr&BfB((rET3g+@7U8MsxX^?UK}xPsSS$Zy@#k
z^35WExq5MmIy$rb020<OeIw+dCtv1VXf;9$X)OpZ3iYFOE+s1!zLBn;d9&xgYODp!
z$p;N*iZ3d8_ojquS&fqb8P8A;A*zR4lL^ktxZs)$k3OhJaj0{b{L@gMDCv<J+&MpM
z8Ppe5vjtOO10aWuj`L4_T=IY;l0G-*Kjy>9#lNQzeWsXOt=|C_m3IKD(A&w|>?X7}
zNQdU=pN=LQpyV(CKf61EZ4!8JWtM_~EL3!H=QQ+LU7=Q<YmXyl1R0vO6dyB_OMNGW
zI;C!2%)Km8d43c@B(G0zDg&K#`1^Q6p#H^FF|wn@bNqg9ZYsm1u}&&833FWUI}(E%
z0)4wWUw#~m*4EdXEwVXmt#&ix1evk8sa~ZiJ|rtzQySQ?im0ptcE=C%pJUtop1+>k
zLWG}%i}rz9w13&kdpCT{4R#=Ih-XPY+?0&58NR>Y(8eqB%5Lak%Y6Ky&_-rh-=#uu
z1Fl744_VbTv#Vak^I(H90;rEw?k?Y+lV*9#X(cR--7gsI4VNW)$~2B?o<SUQ+VY9i
z*FiW~+??RV$9X~D3;ks2i@5@A1VV_6`+DZpNKTe-*6)R2?xM=i`k2w7uyr1HkG4jI
z<zwp@PL_SL?Dwo`Ied3$o8N-+5ru=SPa03R#M7^I@JB!yg7SXN$AcHUd~McNp2dyq
z+I*wW&HIm7h135%%P%oIV3CYZnXY$inU(fKjS(57UqD2Ac3vj4wihyvIMOHYFUv7z
zd_Ye&NnaSgoo2|_c4&RO`U;$}P;y)Y1mmr%ve*u9$+}}ox@$L8ugCI{W(1&rw;#cg
z{n9``14T_MXL+K7xf<spz<VD2k<(t2K#I$GsB=tSKXc20>q+&-b#i5{68ag-n**wU
zM}B(f_}|F=JsP(gX2v{m=OJ6o{Q(1tEK0CBgze?=b7w2C&LQbi-G287<C(+C0`)8?
zUOAC3nh9JyN7+-fytph<uZ5jtp;i-XG4~w&Q~~p*44eK0G%x1*H(9x^zJX%=>?DDd
z7y*~=FIy##^G-0IK)T5_)=1A+oRm>xm<l3R0V)xBYVZ?9{a5?w!y)n9z0tI|r<whm
zFCarM+}_S-KON0^aK}j18?w6#psTvSZHBf_vJS4}+fkkxtO$|%OXHV3<2BeLLv4L!
z1p8b3V+ETM8zR<G`FyLN(FIR;qxv5h^{xBCB$m(Q@#h?{B5fw@u8W@vKOC}JdDKgM
z!Z=MKKJmPsmg68JnLG8_|M%Eto&N-wpN_M7`7d6)^R!);pMAhhk6UB_2!FP_dF2p{
z;u!+&gxY(io4TLlKedCf86ZiHKV&e;{BOZ~9NhjN_TDqBscl^wUKSKZno5(VpaN1t
zkzQh<SP(=+q)QD*?=2ANNEJi@X(|dT(o3ibRXPztI)u=BLQMiG-()Ra>#TM5+3(tC
ze?Q*qdiO86E+H9n%sIxm%X2@ou+HltZ|4mc5wTP;lX8Haor7`+?ch#41!9iP+RyjB
zAt@DZm*3_3$hBYI#M8osCM*pJwaI^WFhso6ewb$$kIH0C83K_V*jmJgrb1av&BEL0
zaP4F3Fn|}@JlwCeo<g$?`8@T=0vdV+BiRyx8X%e3sp|DPW6jPl`+v~J7i|Sxgna`F
zpc~8`_MeN@8wyV~CVRF3h{WH#R5%{!wE@1fA9%W$ni*GlzRoGce~VrO$Z$SdUNdi2
zU%rU3z%l)<Rqy;!TK|g6!Nj&UdmVt4Bd4eL10KL;H0@chdFl&FHS-u6NZu;PTQ+__
z?2%Vw%C6IC`<b{O=rAwM0qXb4OJXj!0$E`YnsmWTTWMXDrzc<%f<7dJ;lw(1d$^Da
z04t)gJXXEY8|Z#Rr)bj3_v%i~h$z%IytxYK+eGKeE}uI_Fl*G0%(}P_KfufBKl$EC
zz*N*Mgyc)wKS{g8$+j)f|NX*FvD1DeEdOnL!IvMTbLL5<)qSsms=4C_pZB%{0Uc>$
z>V7K66(|nG?zd++I|9^`r>+1C?wBhRqS*lGuGM6y>&0cWd--7hVcxX+#phm{m5!dM
z5wm#7e8<buM!{JM;}5h93iW8q4bT!|ML^F)?qvX~M5D4)uu`W;>FLl5jmai2s~|bo
z-N9p0jq5;6;LgUe*ih_3Z*~Y+H!fab=|hp?W&Bqs3?1}SBvdLOLugF1d(L-c{teJX
zgkZPtpbl92D`0*?tzR>2|JciW-U)m>_u;b^iQ9Et{5uXaUqeBBC(T<%CYl%&MW|bh
zLy@4qL_FYL>_@NY_~K2nMSFm56s(OFNJKr{nmH&Yal)mEe)tHd15<%BX6C#4<DlhH
z_~X@@n#f6?^GV#<%&%y#Hv&dNhPY&>tt<v$=gxws4)g1l-^2nqS!Ap<LhEo&U~BgL
z5#0~6KsTaixl%oH{9LW}ar-V|%=tc@df6aimff6j+MV(#x%AdZrxgv3b562jE=?=A
zCPqfQjd`TG5mq>qun1TcKh5L+qv@s9Ya8pVnJtYVhoRPoK1hm>C;;-$5%cBgsI{O3
zhY9&}OSITr7-X4&xbs^fiD{m=WyJD+91#Rv>WuDIxXM%a8>DLhAl=HPU!#%hG~b0j
zokqm0Nt(Rsy{mqcSRmRL+6u&SnpwsVVMpg-1njl`#GucxQ8hqTdg$<EWF>J6NV}0>
zFv@+v&xn0fuwzlG6-s&mSg*YdHN*Nh@*WinyZshY{4SJotCKdu@!9<^KwRzg0N#&E
zY3#Qc*b%FmNj%4>=^Z$i3Q6>NTQf=CvA7;tE&goVxn|!P7k>D9r}})|1I(Ep_Uv7K
z|6&7yYm{4nA7~pfz9RfiuV{#+>PH;$t<ld9U|&Y>qq1O{$A!1Q*|QX2esdCOJj>bA
zJo#n{_dQ;(p>D)A!$0;%!E@C#6V4!+&<}JW#T3W?eEokW|No~)?@;%IqH~60WzXZ`
zQp*DE#*4{R;$D0Sb$c)V6!igNTLWZ;+{F=Bkknl=;M`66IfFgDcXCl?cN!_v5#HAf
zkGKYKodvPZQ^|b-VMS;t$pS}321=;N7xt|nN846DZE9<hID3;N$>dy+H5!Tcm~tk0
zO;xVM3ap8U=26KJPs29eIY86ZAIcvbT*px7<6G?aT+S&R_}?!G>8~OP+_iJOa5G=6
zlLMEgv+86OEvP1?@{p`@v$r#Ej6mg(<T_k^EMU{s?se4-AMX@NFk^ga<X60sFM#cs
zHg;J`2*b%um<*;TxBA;`dHSZX#Y-_}ND$Dj->Yu&D0G+H7JJ2AffaiSJHgG2qGpTW
z$6WIqCaUIdGzKw5-|kV8F?uvn)l}zDJ8|Y_ddY^d3&OWis#Fd}Sebn%B0ABov64(4
zEWCJrP}+t=L6?Wx?q6`T(JXLgpiw%Yk}2bfcQ>#fGH>Wx@Gc(#?71S{t$ya8sQ2VQ
z-AxYNQ4GaOv!$ntN;(7up9M-3_u$xxj=5C(9g+gTvUrhOk7UNnt~Yvyi;6q551abD
zAvQ@+LQkPWv6pqVxf{(3<ZU`PUDi2TLw!Q@2t4k%%;7P2N~vahUVO;HxI;+!hMX`6
zdEbj7q;Yx*y3x@zyw!JyvvEEPQs6K%$7yw2OhJiDTcYLk8|c2{N1V%)N)mu|I}awL
zU0CES#)(FI*RPGvVkVoy77o|in>q|UeTLjO<^i)IB;##v+=m|`brRF~K`fk&^ICsc
z!$YbJ5Km_jx$AF|Xqx9jkFLKIVwX$XPF+u9EP?Iq#)`LWWxFz-Ul$R>oXX_QAfu7w
zv&SGa@kQR52m#~51RQyjtx&p7t1GHgEcK3}6+m0h2+syL)0yQoC(6PK<|pgCx(W{f
zzyPbl!S?OZs}jICWyBr<=V07w7k8hBa`7kADv~Oxu>&T`1pYCc6sD%%qG{7!;=Nb@
z#PbbFj~tFhL2F?0<FVj0F!)<!lOTW2txaPem6(DJB=QRy#>HE(-VlwCSgfx*W~M5H
zFWT+s3{!du{48c3vm@gN2kf~P>S{8U2E1mzCn|fKq68xWE#Cr$h!AesON2Yp-;>_s
zX)Z$BrTEeykImDs%b9xxz$kF63QNaapFXb`VbsGb5WK_bv&p;eu$7ABLgL2)h&3lI
zt+mqSwCkm-c91ZtSIRAICCbY?n-xMNV^r?BB|7Y@-wz*pK!tvkyYP|!=ka?%6<)u$
z+7iy>X)Zp1+{b-1bp56P!MSAI1jtU}uGNEDMzj1*MdN_JYk!BCCMNt2U_SfG@#jwS
zRLdh7f~|(%vvxLBiS;EC(V?JgOG7&T;l0|?tqVMTDFKKRIrRLYf$J1^qP!^~ap01$
zNJctm$cHQaXNzpo&39cg06ZFzfAOj4+AxV>+<P8y?k+A{!^k`NXN%-)qMV^?eRva2
zb(j!1t}_$_B`})X;WuYFE%z=!nagNb0ZHXj%#(YFPEeiCPAkf+efmVI%_|3_iAH#D
zZ>mlDIpg>Q4~26gJ<IXvgl?J6F3bc|sjw*gK2si0Ln9nN@rn#a?ul!1&%H7w@NLbd
zIKE`s86(Rc#zgz<b;>%=xiWd~I4S#dUI^Pn`b-zE)IMiKX?y`nZ*ONw+V-bfG<wJK
zBm|;7*=Ecwv9*$f{PLya#BI?PGo+vLD72~E9aa;bzlhlSZ0U}C&t@hUe|^{$>_x42
zKF<nI&T@xhyj!XIW-j-5oU*^x!j(=@ki-(HCbJ2Mf?XtjoRGU=-#p6)RI+ycb;BSH
z{M}oKiGCzc`C1q9WQv`g<vfGMi)jN0&zS+8kutqAi(pNki_OD!X?KEoV@Z8+D&j`4
zRlUvS6dakjs1as)2B(=&uA`z_7P}$+HWjDl@P%(Igz1`3qM5oHkR6C*X=I+AgY=~^
z-!8T#&mKixm~RE#H{;fV23t>9C{{>gjkjZ5CdOhWUhC+9su35EE=zQ5e(`aLFq~xB
zk>zrj=h|sxO`$TF_M1)PAi${5Fmp|uh9>{JRUY3X@#DT~kxdIFMA-J+(9DQLF|H0X
z)fXIzSdA)mZ@76h4BQI%+lH2u4IZPEI%IN2fN@{|T`4{z?qDGQKtt*F#pN)dG_7cQ
zfD@v@Tc&ZfOEUiz^jwE1IvujyEyQW_OLNBU_z8)R4pWPRN`+x_Spp<h2S1`{au&zb
zxtH=hh)HPsobB5Q+*s|<=Tqlk`>f}gw)0V-?Ay8IXHDQW54u{ksROMJ+Yw9h=su<{
zy0QusWac+YLl5PhIE5Hs&+T=vzsUTV_AN(FmKYZ}a8U0YgYMls&1XY7T+7t!o^nhz
z51N+^o>}%bRlZrD@G^hes=0e!G$$3e8tbmDbUEF-cTpo^-!a2mHij{4<Wz2ebqkoo
zK+4eDnaMuQWx%&Yim9Fu4;WOhgAdteFcku#ty1952tN(@+t8zo?;Fz(XU=HyL*8Xk
zeVyK|Z;xu9o)Rf-<|Cg(#E%8~2AVl6c<xFZ4PWfzlG^BM1MzpWwkn)7h2nB*Yfq3k
zffDT6+cF0Y!-3pV-2#p#c+%>A`p1sXoi>(Y>bF<@(l@^w#Ya#%Ov>YEIu8X>H)idt
zaMrIX-dhL1=!I=w7o3K0pR_Nmu#lURwQ?1-CpkQZn?%?fMI7exoLp;wrR~d2X%?_0
zoujAM4ElL9)Bg8c7SKC0lX%VxSF`v{D){vj>`_!<i~J%kAcU7clok|y3ieIFbUONM
zvE1jQYE1Pjr9E6EcDqgAXy7c3cDcGGaSO66yq^{0f1;o1ZQ(VJ(x#`5R-5FQ8JRkC
zJM*7eUFvF^5F2%RnQRAGUrL@>>EWJHr&swE-%89qUilk4cfZ(l>3EXRLr9m_H&7XM
ztm$r|dK~}SfGHduJ!6)gfa4BmLWO|e_Ni|(*X*2NH-UVr8Q+t|DsfERT|;y&2m-B=
zQ(L*y$NkA+2RL5<Eg2m@NpZ^o3H2L<tnNM^JTa?xOrN(#6sa<=<g)p$7pCB~l0n0n
zYOOjNidD$dKAGpz_-5}gSp7+Nyw(vC`}pio#}lDR*47+jDdAwCH|Ei`;sA`P=Ig$z
z*Ha&AM47=vfGy^KjY+JxE<#h!bW+c0_vXk$xcu+pMy;A((EybvDM%oj*DD#_WZ3pl
z^_PR~^P)CxVTDg))y3WBP(cySH6o$>D~|7+x?<VF#B)xL5@oo@QV1K@&F_4AstM?E
zI@X2-%!RHr1II_D$z{$)&pE-_DfS?x3y}{L7%OG^stlsXqHuM%GX7J&$M@qtnxxby
z?!8e+bem#!fftsRAjhK{DB1;N{X~VAT>w9<RR#8_5s%;$>l$qScFa<D&DTpa4ZiHc
zP<o1xwXum6fl_v}pNm4PF17+)-Q)%iSY$B8hJvgc%4`6egXBb3j^1r5-Ta+%UR9~%
zUOBDosru7K3|(OLLDmg1y%jt0Wf#6L<30)+S^kx@5{^9J0H8sR{)oC(<fUj!iy*r+
zhXG6eM^L)&Q@B)K5);DVnRQ>pbeU~^t3?$v(A$m!P?cyoUg{69N^Q)e4x~-p$>d12
zyyQ?T#BA?X^(Eox$^$uP>bUw5nCgYr*a3o{!!6Nf^Z}d0{iM{BE2u-wAI(NP7MuZB
zP+f+6A455ArYc9#q^p=$AAUt!F0|&L^+kdoz8=>fz=Cj{zb$g!Qsj=2yHlF+x{6B{
zp+&b;zM?l^YRJ!P(xfPX2!xh2$#X+FlOeIHrAbfrLwhL$nklQQ-8FO5k^k<z#Cf9w
zqg`Tbn^Dc&!9xgr`<jW817Ek<GR}B0&9Q6Ro=uduIsCjl)1j*=Qo?t#R8+-TV&8Z2
zT!~ph*{Pc4C>%;VY4B=giz{OI$ipW-R!M_78X>D%WBM4nifnOC-Quh4SqsH?${!*P
zcZ9gET;`ivky442&gpPdjs{w&ybn3lTa7Ik4c{Ij^geAkjRrb0KH`=#kCa#U@txx;
zof}n$52tr2oPW4?%UAM+?^CsK8t{ZP2+HwYojnmUdNuvyW~|EmG!TCNXwup7g$|f&
zMJxBN(#ol^QzdylU<oD00iEZ$z$_-wwARM27zXUDM}&IL5Qd!#Q*qXYrL!#SoOJFI
zK9fY>-_?e*SrZIifKP4mHy<z{HmKPdi_E6G{MET`>NAN;=81*-Svrj;DYg=C8fXnf
z80eezvprMQr7+P$HrW?pTKv10pwqqTUX$CHm3Q{nE{L%;C$!k95lT!`q^l9oq2i$d
z#LM-Sl;x13SzT4lkLr`>B-zrPGnKS}*j36zx1r8qA?z<{&(H1b3PTO>j{MbMjNQ9l
z){*<i!+bOWGv`c``uz%qis88jwVmB6v%m!PWmlOUhUb3=vOGR`P12ck$gF%7kl|WI
ziqa>+SG$15@WHD#-ARtT7mplO0)u3hRol$=>sA3na9=$#+J8mBZ#|>_Ifv->O=;wE
zzST1Chr4c-!b|T;TC1L`6&HP}jU(8TS8L$GSFGqS)No4$B)d;x+Yc`D5z`qh(u6)y
z6s*Nx*)3Z-TJ`y0tM)b$<`GXOrxez0Osp^8?weF$j!B|Z<mb<sav3<}u9CH~J}(pO
z*_6aMXysQLTQ3vR^NYXCOpxWba(50IN_Q)Wwa5HjI^^`8gmmh%i+0Sx(khN+^8h~{
z^_80dc{$G;bJpFlc@{=~eC_1XA)URaHH8fJ_QPdS-V&L+U9usosm)un%6!h0fSKKW
z{==*5<<(6v-aviPpP^FH#KdZ;Ny6)3-`OnA+d6TCmMn-xs{?7_d{kk#15F^^BzRsm
zLStC|2sayPVA`1))j)$n{f;Qr6<2J`&gBn1(x3g&SuD~i2tOK4e{QMq(Pvm1AY~tC
z{ZI!)B=jo7_Y(ruhiuHn`GYu)XlleOer%o$t{(a8hXuD3wEdl1v@b0mU9AfFewFAQ
z)G`?gS!l7zpd|_e@q=t`uhPOT($3$*xuHzs2Re^El<LCAQ3tVLt;UwgpnqprK-aMk
zd3C>|zOp8#9hPsG9<D_F?5Wl(iVO5FKBsEJ9<%MdFHSZbEFZkESblsE2dMo(Z?%7G
zR{pK8|17Bmo~w6g@_f*V93JKTEO1_hpp7Xzn00pQjFCf`*8clLz%2j!%lj-@G3=ol
z=|5$@chTG$$E`PYokZ??;Oo`3jX5Kw2{!rh1xNope?aQx;g3SYf3A7zg##YSwfjf6
zU;mB*e^pJtSswbmi20xMR)9&spw!_NKzM1-tf7XlIHT)c?D=E%0D=zLCu)1E&93d`
zm`>R*Ht`d#YC9A<%aVO@%#A9EQKSs}myQ-HX=Fi|uaT@?^KAWo-2W;u`#C)No13vI
zfdV%}Bs;=e!mBF77IV{NI05K)-A4qPZ05I4qT1zTDnvf0Su;cUN{s^2%ke>j$Hkao
z##5QcFu>o&qoL2}0X{p)W~Koc{v1n6f87Z!`~KeQ=m4zr?gBYetD%F#-1-@5+-36&
z820tfHfIqio2e~j<@2<<HRtD2L%B?^wr9{8Z$O{uD0BzTC#zpkyJ^7e?6pcDPC9Ao
zKnNbrEmTS04`Ng^FJ1j(NUKF@0q<Ln{48+0^-p(^7nrbL`S(7^9oCrUp>2)%<rIUa
zT3i^`-qM-Tm4fHJXhYWx*2dKUjJVVcwsmd4#xvCNR56U|3RQW#w_2n9;yCd37Q)A?
z%75K8hU$MB{>Of-Q%bu4lIXuPwTHIhrA!sxOj%I+2Wq=sI2!^GDNmIeiGihJrX=6e
zg*K&WkEMQIFJE@38QyKcCh_A@YO7S#gn#R89S47O$}_>>NUOW5sx7}941Rl<h2=ie
z{lhFecdtmiIeRJc_`#?H2bfQ@0Kq5=x$tTErDK^~*t&TY{MeQf9)aET?c?2E!;bW)
zXX=eNZDmeC{2238vak?s@BELS4Ep>ZkgGrCF(Ct&`EiZ-*w(>UIO!8jK!rB?a~q%2
z%gze+hufzwYlg&nC7JghH%1#e+)o1qlJ(&}vxc(f9mKUVsoX02<N`O|0DLYWDxryu
z8J-l8;_p~|EwvjvzLHnq4GP$rK3iyPN+c+*_bM|gbIx2?p9YhY`#EQqTHsY0rhece
z>05oLVX)gREE{hR2u`2wPiF1-%Kcfc3}@m&409WMud4wkd@@)IQcNbG4DS(k-Ix#}
zUM<T&yPm2W1V46p8H_!9xOt<ja7kp^Y>DWR2g)?`eUGxat=Y>D4#HVEzt5DT0_Uo?
z7iLFRhbLl{9ZNX9znq5SRZPY*xp&;O>$VLVoQ9PdD_`atR>2X3FfM2EA~^C!AgMf`
zhO=2B3tMnB^Z1fbayTuzkc!LN$SfH5ujY@4Wnz%CeUh%|*Z*`a4^1(`@$hHn5cZ5N
z6+F|AR2j~FjVQYtzV@i)O_+1xn#oMcyuW<haT8If{FgcEUM??-dibD-(OF@6|FjQs
zHr1uT+f!~5)b#^pPBeY+ByjgzNNL~LvzW4+`0Zv89{lxYJU?*gXbn#t-kle^7tvV7
zOWH6qMusqY2JG>k9P*#o-ALXra6;p3F~;R#*z`PSK?S5!C!J*M<`QS}QLMz2T@(`e
ze(Jby*uwLG<4d>ctQQy_a2XO97SQ@}sY_j@h*R1etKd9;d@8+KBmN25uWB}Wj>X~O
zFcEH6ducX?EAU<VsDI(k+81F+^@UAPf?h^EhhJ!<ktj6PB4FX_(Mr}DS#KjVsJLye
zIlH=OBlb0Gn(ws{wo|;D>a4D%#uY8~pK@QDpK&P5K9T)ka(BQY+fa%4Mc`W|i#_l0
zjkQXu1jp4`U!yo)Ka2?nhD_3jdCC^l4rYiuy{%2|{qAnl#hm6AhJBf=^31L;B!YMO
zVwQh`|IRpw&exPM;f1x4^`^u+5!z0Tap;0vP_<;=yKw?H3D>d??baj+#62J6%=A%H
zIi#B%K*`G@srC?2RUX?%ycf%Fk8NV9cSmHlQgoaKSm<Wm_weE`{Dzg&#>m=;OZ+pf
zF+9tx6D1=7oAXq$PkU8(gd0Q~`B0@Prb@r_zDrgseaI%Ls!<u&mFCnXlzY3bdiDEj
zAqwSXl<*93vX55i14uOKjp9RBTg=|BB|eIMmaE8Cua&{S!(KfoyV1K@=MY_C>HxI$
zjy_8Vc|NOFKZ%ic+KA2c648)A!GZ%ZBNcWR=1BuL!_C>t8IZn)4s*xs%rv20oMpPL
z4PPvbH1qt9pUG)ZSL_gfOjF=2D)Xtu6Fwod>Pu}!(rsLpMf)O$BwKv9zX*&~Nr9eQ
z9>(d(ikwPw12nXpMJT@v$jIe6r`(q9;9F~9eB)8G+dy+NN4)L478fi$QcFEE)h3qx
z`|Q<3oLVH`gm$V=1=r?^q!*YnO}#XvM4Iw<TYEYPemVVgUekLOzqC;8vAoz*LvWL|
zTRH(Bb?P1`+|;GRE`ld%2dj)22WwCV*4}m&Fk^0U433qRJSwFWCmU~$8&ytg$+dJ>
zLxYCyU8L~CzNF`kt%({|E03%$#wk*)y!%#{Lr{A3ucolhA1kl%1mz~&yK81Bc-^~b
zim(;}89Rz{c0*D~FB+?0q#bVjQ1$HEVr-t3--aw!`GU+!LuZ+d>7nd0XXPqW^>A3l
zHu1H?BTw6ntg)g-@@x(M`26sEvgF(B8YGdVhu_h~-{h|5Y7&nz3`IW{mDvm}16@>^
zixru&sk*DL(_C=xFEdWVpR7p}7x&~MGYf)C*5i{Do$a~9WC;|S&ka=Tf#CATM8DpW
ziK*Z_)0(LuB*-`gv}?L*>=sDQ26a>c1!%yYnpH>7Kay_<7vtiG`me%~n#b_-M;JK7
zaIZG-i{I|3<e{hp2vrcJvnTVd0;ur31D$i+xS~rUi?ZmqJ#Xui`}w2+&xtx>5^fmX
zt#ocR`f0o`e{`jRSij!s;=H8baJ!=3ILR2ppk<@z*vAdFml|dL;&dJ$ubdV)N!~O#
zX2#f<Xosl(urg!E)<Jv+fu^#K73<Ew=E61V_Z0+0ycKGm1=?6bvS+1YInoLP@mRMQ
zoU(7DftpO@7<rdRu#h)^*c9xXa&47Ek|Za)G9+OUf?F*boKUl#2?F-a+i9L$L`53J
zk1dk}7%egQZ_RN_aN06lia0Y*y)PH>ux7Skk1qQ??e!kW1*mUk^2g5n(K62nhBJIq
zub2l`kD0N47_lBS3E8NpL-(N+;AeAuW#Hafh!Ri{-2Ma3q-;g3cs=iW>oKzlIF>@5
zkydF?i3?%i7L>UNEe(-bmfP??4!s&+_vXZSgXD=O@eLZ}_dk}NL36j;n}WBIChz}p
zY|<U(TV2-;n%*b@>a4G`rfp>B*56p%3B|VPo6e7vjq?NdK1ZRHofUO*ldBYr$Dc&l
z^8{+GWcR(72EI7^zVW$2gX#DG`s~o4b|kwAkqu2z>gwkHjri5VzzeN;YoqskP{6k*
zBZ>O$kfkDU#4k4JN1{-+LSv(?iKZj;FZ5n}rZNdYgIJOcJ}i}*kxIGH9<2cu_=)&H
zqoOK&!u+i9%f{rEM)r(>QNaMhDlc823?_|x|1{}71ESe}A13K>v{U><QyUxUfqikR
zz`Fp6bqQxHX4%fL>L@<17x%u3)60zLgzE^q1lR+8CS{b#;h$BM7Cu;xjWeo<2IB{S
zj(sW!CI0C87A-on!@|*084A9y96X!lLD1Z;6w$u-*$&WM&th}`H%`ia?KdRyu9u!Y
zjlKFV5gP`|<K_>vL#57lC%Knt!+8@!vCCjW)#tVqwjMv<Ww_+=u3P;{oyYq!YP^#1
zHbPMIr7-uF!p-E*F4_p<N24kVb5;8!a1#Hxq?5j91pf7Fa?JEwmXe*D>9hK7J~H^x
zU4Pg~P(g1HyS%rEhY6*p`FC3k))Lp;GN+SOc8hD{Lh5{$9T5qlF%R$4nRj=56UYe6
z;gs<EJX1=0dWY6A^FWTWzvs$KfmxvUS0~2o5491Hm!3R(^L#hz9zhr_4hzgmw!F$u
z@hL>#X1}U1vyh->T?7Hi1p3L0GM;mYUi#?Ii(=WcRPP%uc=|o#BVACeIG!Jo460T;
zT;}9l{*Tar?p&!puUB%q>@azwG<l3;`paSB&7v%EBbmib9Ue2}SS*LcWx1@w{v5or
z4$u78-zbLEatFb7cTDhoj9K(O$y58#pi?aUWO}?Csrb5eXP(e0ty?At^UHdK{DD6q
z96C=HwUtZn{{#ns1$OPnUM3uMWjN=@0+6;g4V-b3U1@6?8*~O^{5-KIX9Qd^@~4cW
z$J5w$j!*!Ko=6U%?s<a+hsM0fO7PKwnj_ddQ&a+ZehTd=%u3^{c(Ctc#uRXhvZRAr
zLZ53?Wk+!Fq{o-|Z_brOY$23u+9@anwD@D@z}sa*U8lYwQV1!s`vCKrN$(Sr{68;n
zc6C$RA7Dz2S#b0xgw5%?&4`}W;#B-b#^tw;ziwhUzVVzeJ?LD`xExvl4qPqvZ;=I4
z31N-$rx1&T@#Mm)e2@xzI!H~v5l(cfsiH2U%&I1otE<tlZNF#E?B%q`3xC~iZqybS
z{`uTF!4JCJf=1tS4Xb@io8<Tt+Fds<OZxbQaooL>RwHLueUsxVIXNrfti^1CG(7SK
z84V-7eMY5{ng%U4oson#^4zBWc$2-8SD{0dfZ%+eK93u9Iv0C%`%qsL=#|1%^@G}H
z0z7m^C;WE;?MAg#d<MwC&3InTlsiM+-PC`#T02+Q$<}=e{k6v#4KwU%J%*;@d68aO
zwWMcBdtavQqesrLAYcRxXK|K1Lk{+y0K(5>Rnl(M3`Q~6@eit&n-93kO_7@9AK4-<
z8%1?e7UWaE#k#z!8xj{ah96*;7BGv}S2y~YEQy2n;8g?8grVTG6GpRVh+yj76*>@<
zn2rKh8m>@C)9@&Vor%0UlC>&Wfe)C*6aUUMPI3%4MDVT{!XFFq=Q|q0-S+Tn7|K?*
z>;+z(+a^j`RT`rMl7_9<oR6-djWTIk=D@J+r$gy3V>&dPnJv6uk%hEihoTmn9pdv4
znP09&+I2);1JN?;XUBhpnIa+Z9!av-%7<OG)!K!cr73q4cu&TRwC~=^_|*;h)+Cc2
zdmyW*WKkcqVL<GH?gR$-v8Vtqr)fQ*d~IoFbESG&Y$MfIT@OCqRN9_2J?et~v}}Fc
zyQ~h!h^`f#&zz{d6$eB?Qb*n6EBJVrBQg|MFA(WKHLr1*?bGqz5xn0}++HqVq67EN
z*mXpNz*<fIqfKPs=10Plk7#H_OwoozDceWR2jgdF<K!N{CS~|^EKEw(e@{+du3jtk
z#<0UQ&v@64S|{&fGq5Sx=`?)irJ=7oWIxYSI-}XkDg`E^GT#_fi{R^nNmP4w#e<|m
zyWh`;uUgzkIq8-jzYO_X>nmK`eMEJzu2Y4k_-WDdkh!+^Vod2Q@QyD2<>q3x;us~q
z{+=`?)3`dEbu$(XtJ3R{*o}G}bKFGrt25F^+V=WMxJbHi@a8x~rcENdF6M}?emXA9
zEk_{>Hs|BpbNWrU1po8Z(baR-t}9{Kb4S<An5vP4Ej76Qo|n_ELGF>&t+P<(>=-7g
zPaU?NK(nZ6&Vm#n%3Od_O_x-0pw(&2?O|=Fhv!-&hqI4xUvk`<HHEI7Xa20IH<zMg
z(M;~9n`;A_g^2Kd!Ovtx57=V-SH~9ltYD<I=Wa3ebK!?&50h@lHzs4FdTrx4xOriX
z#e83h6CT{*#o6`L^golS57AdlR{!3#)e8z_BYNFq&Sc8DrPS^;;(Ok2Mmw+?`vpZ_
z$~obWsacO}0gxL6TvvYX>=M)cUU$PAGOC1))a|6@gr<0p+)SVJ{Xd(SrHghbNRz#;
zuE-n%_E}|4l{ulAdXX2SI1_n2Y9f1-&J{4|hCeV_Uy_uebpqlCW6;Q#bu&xRvvUUv
zncGB-R@NSX>Z;q0B%l^#3hQv>c(VZGw)xb@RQV_FI+#5el^EfsdsbohMC9X+4PmoQ
z<zhL5{_u~BLz5v3zD+|3ldvm)0kq#mjtbeP9N}CQZ2G`bi6|cukE#9oLtcpDyIb)S
z57QqgE)SgLOQm$s@{~OuzLq2NJPRlrx9Id$bx*|2rfkx4uU~)2zxH;%?3qI(PVF=Q
zV~#gFSscA`YXs)Rtg_1Qmdh_Yebo`ZjD<lucQ%+2hNQ)vYw1AVO?FpBU90%&BLD+)
zE4W-qxU&^tY9(2ho}Z$msk|f0TMImn1IZ2doq?-dK6eS~OG(*8IaSwvaJu5rcf_<+
z)F~{B<2_=2z&-?j=1bf`D)^5*|2K9wiZ%bP`)342=McE&IQ-n3Yzd<A&6GtFOdW=9
z>(6r#f6`7Cwbu^1KgiLU#<!iI)0i*8_eCBzUj`b~Gfn`ny<5N7lYA0kYAb!8AX!~)
zMY*8%<JyPL9Wi+Fw55{J6<Gmb=p1qP%$B^j^UB{(BSdV&l(WByIIx5T#1ub0g>Y33
z10gWVy%103F_DL^O|u&cS_DbMuF{E%&{%E`3ha-=)HXLRB$mcgy7TIvkFUo;w+l`9
zvhwE<0b{Z-3id2-4hnJ2VVBp<=NV)s<cGq-_7rUJQ(=)ltbUkWnxFYxgSXBE<KLaW
zsh0Bc)shlqH?`#J^MX=i_Sk+p@#1PpPdz@Ufzt6HcF|<WgL0fnsl(L-`m9t)+VjlV
z*i(o?XM0AJ+MavtIjFBqa!c;5r(NN+W(XK!ei?-P&=!umZt!`c8;A!(;<9CwPQ`TR
z#TOh~5|81gp&b3=x_$!*-EPnROsfok!PEf6cXrbex>SCa8iAxT4h9y+75HwB-yzJU
z{JbpsD;$4ZR?e4=6+u)0-vT@LjIVA^`#!dP8@(DO*IH(H_$-|`uq}bG80mQ*ucVJf
z$tb1VyMt0`586MJI9)%fRM-)G(^;ihD~{PaMqO7w5l3DKJ9<6~Nl9l#e6EeTLI!@k
zAF9Y-)!+1~f5so<UmsX^e6JfgJqA1nfcV+!Rx`ktHZA%$0T9<A5v|f)V;hx}^&S@n
zU^ur71usE|>E?q*w4@iZrsrDenGuu}>?p`73{Bv9C_m!79=dNjQZ<#_yRKQqeAa-w
zNyc!~Q|A9VQ71p<rT@2?8U;iF@2_tTjX#}6(QfD$z?xU@4cc)_dqK}a0mKx?3AX#B
z=r%;_{cRCa9bpD7e1-==wQFvMe77<nAgy&QCs&=*i1%pahLsq>XT#n~s_eB;T{c<8
zJT+q3MZac(V4H<%GN3>LzwBC!`@2j)N^;dkZXXib%iyI{KPuf8fO(aQnN5cCNQF8|
zMg8)Nh2%}utM@x%<!3$Mn5X*3eKo&-$+R0!x^9#`J9zNUIv&1H(gY7$rv>kRyT(x+
z@|}t41?~M%UL$-F3;neez4-R{f~Bqwgwkk7+f>8R9U)EPc4M+*LM=U??c^IWU7nJ&
zvtqU!lhfxDU3*M$&3v_oZs|Y>#5htWlW~X6(hk!pc){8=4%PKR)=`b=Iq)c8TYH>Q
z9)Qqx`awk;zZT)3FhrN<ZIV~<os+EwbY{@*9ktqc8UB8vO4YHef!D)8!Z$XDaR+8M
zICi&|#AFZE(jyup(jiH_oCU(_lb*!zV*ZBzcC6$XF#LtA(Ve}_(Q8ujI3tD>h+E~2
z+K4y-)>6ebyXUYSL%&$&dD*iaT8eU)9rKC@_=|(de1I%|p_BI(#UH$zPjJ8nR7Wxa
zZ>hb0l-^YlTN3TRR#(_O2MDNX%cE4LRGWb9snIb&u5|G)8|{l#ay5RFsShSTwXe}o
z+~?$D`<%Ha#V^Pn4)GTnP2TMFhPjRV@4PHw>YeUM;d88+rnH`?w#$N9_68hBqAFFK
z2WsmX?_~T~VR$(1x$hsCxHB_%%}hx59&>=wVEb`o%r6?b3Z>Lbql>lMGrNs4GE5mu
zU9>{kUmUK6y2K7Nv1+^zwLF<sw_6m`QPL=3t;^OI)^2$?mGnV5D+2Niwxva;y+C(a
zP2<Udb3G8?rFD&QkO1&l#V3jEdT8KC#{&(*Tt+Tdc(==ywABQm^L+e}=GD9-Q2p0?
zjTmUXSh-XD{iIBwBL87=)VjLk)Wp%1!e}HxsaK{HCSkpiv4mIcZ5(WxpRQVnHyaT_
zVV7#N90N?D?cJwU13oIp(_3l;p@sjVO%0+OJ-7ecO@tc3?WR?z-_1<YD*P*jS;r0A
z{AZ`JR!Qc7{uGrGa~xgTlQnD8RrSe*lno|nGgs+~RjLADDnruJt07$Hk$OA`xn?6D
zxb-65>NI{fAI<6jXrhKoW4nE@XO^MTjil#URNV%fhHm)nVN*h;GTDNod``-TQ{BrS
zzbFix_jL{pcfv@9**}y~vM9+a^XKwmKd(H^d0~+Qearlnc%KJZs=O?0u~f78dxg4J
z5wAFZ&2FtZ`yvLe^A`ZX@^nz|_SL4#L$(?m>iPBC`7P?APjG568)ps-XX69I)Czi#
zGsg$>H9+`%BSO)9tohL=sajma;93x5;<O)L{>ov=`8u3Q@y;8*y*dT2#Fmn`^T752
zu8A=9(eHTF{1RWcGmJW4=wBG1Mp9qJ`jf1S*BjyPgKLs6h_NUn$ff&^a7(z*S5v}0
zgcB_PC;Wio>_UH1!!NI2H6{yHYo=Kr-|&6jT7%fzN&46xh&13gVqXM%Z^)&-?J~=7
zW>@zkIR4oQpz~Cl^8EhSyGhW?V20D)G%am=Vb<Rf4{!*%OVHv~_baeeudWZG;%>Dj
zm>Rqa&{4b|@u=rT0dY-qEa)ijMe8kP+#_G$<)WGanVv0;ZzbP0CQGKMbh~mD2J8YY
z5ai$AHy++0OF#IzVl3-zg^i9&=;_b<KAfcGRA!N-dwAn%{!76umgv;CpB-Zy9_`8r
zyP`e19oB1lWKZxb|1ANC?sO=YmzvDQE8&wO;?^QntF*aCkwqqNwr058O2Dmp<KC<d
zNeDc>vNO-1;&As8rp9mj)P~3!ApHx@6#5dX{2Hq75WH3=`tH=ZIO%ZsHN*9m2R7v2
z%IIhk=AHvwScw;U=G?!o;?UV*YF09js^a+Evh$SeflXMrFOe*9kUim*I-z7zuk%5^
zRoU=7y2v877DZ<^Qh$2sL-&R>V^k~~qA8AhdY4h|Er1+02a=IVgBPKjHvyeGlTju1
z*^lSk8nCWr=mPV~{~|J|G1uJsGm!m2Q--sCKdY>`a$z2j%hVgR=+I5^O1ClxO={ip
zBdz0n8HKMrH;cn<^TQpUHZOoinI%?J-BF0W_d`X$u%gcL!a5EYYq0O_051T)^)1pf
z$FdN%a$#8Vn1s@!$w%$7m^AHMfC+bg<FeL|yZzFfJv;&Qca)lJ)<-PX>W{Ot-zOWF
z-^fwgQ!99~8j~`z5|5@V>6e5tUwgswV!j8dQ*q{uN54cOs^UhHKhQ@uYROW;!{eP#
zZ%K`DvXk<AuANB}PxQ;lfZDlXvx?gmx6fB7PwhQ27j@ojyN#`BXo`Pfhl*U*70`Ca
zQVHIPc+ws?Ns|2FcKMATLQ(XQ*D*hFE}+oHKpULP|H72=1TFN1{_GKcK}RgOH@i%C
z_%FkicH6TKjdH*EabW154l23xFKfQ+v8ZqXQ`bGbVw)p?%<<d2ls?Bm3O9$jO_{;y
zTH8NRX#W0eH`ziFyW_|jcZlgl-4r6jLmI!X_S~v`Fgc>$OC#sUcB*#h?w6l*=WomZ
z^wZd**>%oPO5NVp9`dkn_%U?S&ku23>3bhd6;VI5_&wWxQh#A0-~N&PyKH;7Sdf`=
zM$JgMk&tptt67b5^(gS8N%cju8l9r=zpH$&GZYwPSVs}le=+_32bHfSXgoVB!214`
z#KLa)i{~>&o6a)liGxrh`J0IEk8)dVGN0|VG`H3!sEvuREhXMCnf+VrSFWg!TZW(e
zCPD`NKr7L?8#(-J#%$AZ_B`=HNXB0tl-qosFaFH4%-Mb4{FvVVN~oslwY-O7JkAqG
zejT1P)#iF4?6*<Vd;P)Qel-Zhp7!f${po-Lc7U*d@UTT4QXDsz`j#+b|LgDuNNMyp
zDbl}=T6*XY(d0K#{ro+B`9D9>;R$R%d@)m<!yPg|wmxBo6_1GS8yf$a)c;H>u#o=q
zr2ap+{PVd6YPYJ>B)u~g%{L6zrZ`_#Mt~_wMeEOG=W~q4ZbGuAwUCp1-kTxur)PD0
zn&}`cZyeu>7}hjosF1IDe@pu4w3C=New{bqL0g&^Q7=sLVt4J3Nr}(Lnq{K?aUxu4
z>%)v_<?=*h)g7$k3-@^wdGLoku0-hgU38;#9@a}hJ9X}2S7n<hdPDUY?`*-msTTxQ
z)s-Q>s3{vjDPN<&!Gbfue_BnBwwKx*wf2!gY?_;J(2YHXWUltqS``@Wv`vTA>S-(K
z-tQ?BF7VPv2kK`~!J<QV!M?pRBF3d!J)!}VnAeEagqhJ>q#8^<epUf9GFz%bXb=dx
zlO(J^hS5s(E8qmLLg5P&dr=!=#zlfSP?ml&2D7U;{WiJ<$tG57TA-XIyS&??Hrr)f
z_7J+ZsSn-^PDgINoK>^ddgb}__41{N^HiCBc#%)jp{YFAzMee)I-$1slC^U9GBUc_
z-h0VfzpWTmvlpg+5Z!nPOYMf}$iN663D3}}PuY4zKJ88DPY7O`PVW@+P6nA7+-F7V
z%;*$?Td~iex%kiYOQSsh_F-4C8uZMe2I7xBglU^rr}4t!26!t&j?%NHnRt!sQP#>f
zdz>apUL;c61k5T;yoTR@5J_=e^}K2zzEO58$PpWOlr{80YfnZ9v_s=vLj2Gq*W2Ob
zs-5q$v&Qpl%E7xGLHNf=U=E&$i#~>BpbLyjRf<A52b?`>;I;-u)6Rnvb#xXCI&a9u
zMw@e2<z4o4QB@2X3M|7LCK)x|-uj;_l?CZ=X~?Rtj%f0X@qMKjuy=L(b*m)>_)%<M
zV16@_c28@(nynm(x_Y$J^OGZHp;#a~7B4!fo5ky0m*F?D^_uG|TG(T0q<egGDlZW>
zi8&Mkz2fm4Ik{HursQL_P8}(zkuJ1^zec#dR$3hl-({`rEd$=J$uiPo-(#nErGF32
zj758K?<7(+HVP{p^(N^a?kyQzHAvqaG)=(vq+TSBxqS64nm6UXz?jw)PM_>f(k8lr
zDsA4RUvFOiZJ@D-6o2R4^dldqA6XW!?tc7B70&<Q&2bGaGK}s#DvQEPjI`LUoePO*
zTTk5MJ>f7fW^&OtM4d~358v@3Z?=-keCR@!7Pz%Zi(QyMIr9!S@O09wVk7Mfe^Y38
zK5UxXyQ_VAhHL6LCrFk3<2x?(Wy7+^7Y?rV%$s%qHpt;3-)L6PgC4waOgDZk-!sE)
zqz5ukQABNsxS>otz2Mz2e=!RMbXj~xLseI=&)!lb(H5&MNJjPGpNd~i0%|%iop%^I
zu2yo%Qp$F*_@RV*>Jwq0?5J97*`m~pPqWbUY|8Te(G6mIQ!68aT5Pm~v*erES^K89
z0e9)k>5-)!SSas|ED?)NxQ=KIsP^{G%Y;5~>OcET2sX4Xu+N${v6V(07)3`Ue!^`n
z+!HT*4Abe^8OvTEQNTgLk9e;vR6uvFA1Qit9lOWKKgzX-ZA9B*K&@<OAKe5Pk-OKL
z$a$LfzSFLF-<#VgQ#Yr@oQUI%$yEN1%IQV6F}r!Qv-5tuU$r~LF`V(gR`C3Gx2~G}
zRkNjUYNPuH${x#6uj-}><pre;6?6kW<GN~Cg|(riE)BB_SD`PFzF2wkYtu}MT>_Wo
zb%^J7Dd>o`&yn~uq7{Q<zS<bBjEAaQ3&$Y)#!sZWvwQ#gHn&4g<eUk?4|aBeEU$o5
z9DJHnsRQhLs24)*loV#M39LqcM9dlf)<~wDGp*xyf7xL6H1XROQvlC?>uf>NLO{@X
z`NgDb2t4;x_;f8D`b~CxGX9)}yv;57*0HYM3gc4a<Ul_uS=LurL`|e(T<RLipP4##
z_~AOC?<xmRPQE2)M*EX1%V3vhW2dKv=*+0dgPI(3T=9oy_J>7CGjwTt_QowPO=~0*
zO;1{e2&8*|m$vA<Y!yc?ueF-Csq&h368uGXwaTEs#B=#AHDNe9`IeCnS0f-ou52<-
zL$i$WV+#`h-h3<I7lg2zsO=30u2v=QJV$BG(dL2ZncL0<yv#Y%J!Y><x$tAwD8$hl
zDi(k`QHGl><Rw-Gj)wzHh}HLecu`rq?t6|ky)I}@?2#QE!e>nuwO_`lUUfGfl_kd2
z;X&L1p-%!qQ*opq{y6##CBVBXksGuh{a`Q=R>;dd?`sg}%aCNLexf{oj+9r(VgyQL
zw&Kz#G|3q+gpr+5AN`K-NL|~gVt%)&WJr+gSkb_6Y<Jb*OxA~VH&j&e!1K<vgvI8Y
zXH9FcgBm=yE6I!Vv+2CdI}~e=49M`df0co{3X)L)bxHv0T<iRt<XmPqsHIwT4DIt<
z^~}HMj_wm3VDG;&6F`Hh*?J(q)2H$L%GthN)ixr{#|4r2RJofu(tO7mRDdXs__q&e
zERAemx@RWP#;|T@aYeyv@t)5Flf<2Q87xrg^VY`<u(lq<EAT}{@oZWmGIJ;??hK)K
zgA-Nis+agJHPvPf1{e0~CT;GUB(DN$m|Ew{DWk)OS|eF<iY%XdW0ng+qR<Fu4T75^
zpSbVE!FVM%?viIGqxBNNq~_;K$eNpwBUpSe5R2EQ>{)JcQFrG}{nya?PKRer2$Gf|
z_?Bbnd(qz|tjACt^~n@ct&x7)9oC#x_to;{uUB)TrS8b@27)T_%doq5D}bi{na-{7
zq!tOn^0!cDrQfPIel?t0D(rKY{w%Eg4-TR0qg+LY(QG4Zz-&OIXq-W9xMhy$V<X1k
zxHu)0+-{5g)TFOc#|A1!eH~T$t#^B#2_5r`RM;y^5Y*S{WJ9aP!<d)838qX4&)}A1
z9pIlv!$AXvn+T^!X9LGqc;d&=da20tK8x>75XGs5UFMe6acDhgXuZpJtCqJ;^|cyG
zDoO-pjD(k;g&J@jM;{FSrD1y2G7MX>SnbP%h~Uu!Ir;Rwv?SH97f)-^J17H2f!?g|
z{KBQqGprBaicq_3PlNs1>BAR%q00flYmgh6(L9PywX`7hz;=A2KIptY2s+Is0zeFk
zW2E!C5Von6!bNROk2d8$Q{d^qRON~~=ue_QUH6bxSjOFyO5LCa!&1qUVIV0!Qn}(z
zSLtl;L1$h8XqAmTq)|2|-Z#W+Np9%jUHww7cYmjjrzI$3t;jJx*k|bCL8e-+(if2x
zG|e=+4jf_M>4Z%@#_7Ku+eT^Z3c+K3S#)E{n^A*vTbzIH9<$)~Iak4+U6~K8@P06U
zcbnVA_L13dGfOvRz924db1ti5b;l!rw1VE@z?*v83)o)NN4^xC<NXtRLU36}KfxmF
z^ObsOGHR#;eGDtUtTIlYO2Z+Sil1sNZli3>yp|n<$U8SS9Ium?)mR7VTVvwf(>?lZ
zW~Wh+RHJe`qpcOuNk-DLGao?+zQ-$hRxm=ZrG47K3>HV_?U7)~vQ++V(B$4eqmjEM
zxzr`k+VE{>_Sp<NobWO~$cHsUuZ1i>(jn;R;h!fM7zAprH7$!uJv-SVUV66Z`>6a?
z4IA(N@2AKC9G<(X#q)Dl$L>R7%>+RTmW|*vZrMZD{(lxLj;!{(78SoPu#vy<w{?Y4
zp3jXPdp?wB5KoR{*Dn(xoXl@L#5ta-%AL(Ag3Qh>n7-2F*lrBbkvuHgryw6^WSvao
zmSWTCF<uP0lb~n7(a?~oEMGjFiL;*hrk!eaIpyPvKz~lw!QTBVT@EL(;tm`PR*nyV
zK<}FvwNJ}ik0`qL#=5Pr{c<h6*!v?sAD;yid-ZWVskO|C6%u76C|unkYE9@h&v_yx
zUB`v#?0@X=keDLL^a{#4GM}ZWbv@CUbII(%t+@c@-4$$3Pt84Od-)`U`K*<%X{!Bm
zW@BVsAEqf@tlF!Jl^H*yb7Zgp#v{8Xe_usWH)S0h9D@xWW*q8caHtS~rk?C_FB)>O
zj12fhcK8M9sBM@?8f8KUXZhB9I2XwCNVAJ?3ASHf;NKv7*dS9_WLqkCYMq%s&A7YY
zDu7p04?sJpD*RYiT?)jZX07tUx+ry&@M@7Tl*|t$J47pwzzfj=q!ssfj+*g1y3>8n
zW{m!;4)m*wA6)%v_Uzx5Y#jZ+9?<aFRf8}kQaH5LAwCQz8|s6l0|Cnr3Q1&8;x_C#
z_gJ8-Qt(4xQ-3p0z>*^MNy?-Cp?PO*!a*Z$;){<5%(WtF`Y(6hJ5Q`WhoEs{RR#0&
zub5sgd4K9!tg^ZM4vPAi<o=TOGWa;1rkd8t2Qifr2P5k12clV#DG%iv*&bTIVt#BU
zFtzfs+vs488?ZbsP}EdiGu8tU{>{~>>+G&^A2$QTR^>>yP_$x5Hc=`gZ2&mmv<U!h
z_2yxcOxC?DRdArHl=%+wp5)msrc_EQvFtn%{sv(^A|YI{x3dnL%XQmiKcsRk$!#Tz
z`rSo07<yP(*wlSGbd%%^s)ab-&5husrBu03_R=E#yn#VgzG<F70F6Mj_l6JH-Q37O
z@()1xhrbWPjjF``q6DweYM|WH`-$2Id({kP5%ImV_o9togunvz;9$|4h=OML6G9Z{
z_~Xbn^TY1r_L#>_t^_RKV(OIJo0!U-+;i>l7rV*xeRgK)py?h*#=}Cgep^Jjnd;j^
zx2ud(6w>=Cmx0SZi9R@JI95ucw*%>7nfrI4CkYqqmb2Z={R@BlkTWa)N3;B&K~$S}
z{OyBtqaDDk5M?<NN%n~R^z-P)MSZ_3vir#rI?tQ$3f%r&g7HsSN?JnPd9yTUVS#q|
z9NOW=Mj^4nEfJd6p!F9U?m|L!$KO9@)fEz<j=v7?6|D4JJMy<t|Cf9DTakUT>e8h@
z2S)x!?HD*&I2Lbgl>a(BdrEisdFrcQNBw`}q#8XaGTbmIo$q*X_4C_hRB20(T_2><
zvNhHl5Fu2Cba$3Uv2K<ZwcG?WRXRl{ii8B&c%anjMno3f8UtL;-00*+Pu<jGdBj|g
z|5zZIF|kg+-0?lI&Lslq9GIISR%ve*h`yZ<I!uc#QA&zK>XF}_P_NuSuIP87-+gx;
z#t!Ty>v?AT+MD{-J!@r^PPZ)7tH?B0vo(2e;XH8%i$QM|A|9w%dU%>W5VqM9CCRRC
z<XKs7F8EiPRykD#&ZAwu@8&=@THN2Q_`(ZlHwcurY@WE`s0ha(u{!y&(dv7^{yK!H
z0|?lRR7t$|meMFoY^vNaH|&d5)sbvp#z5Rtr~qIQ=T$LyR!vetR|-j#`aPo%H2n^f
zO=saPeTl(8pLxFqh(7#l0)5Fr^DD$j8dmO!2aY2h@;hf|3(@YZJyk1i@~wecE9myj
za@Q%qwt^1VF)ZjOwPwO=)&`6>6g-#3=9%ibP{w6)f_e7<87l>0y__zl?0=IxQVW*J
zd0Yp*R?;aJ#-NfBNae{wmwP+Q7k1)j>sw?e?k7dqZu-ufc*drW*4)+~M#=ky@Y5wi
zM~5iZNGmD_8BvX|TQ6AtYL~@Fb(LyCS5^V?l3ShI`0jFioweuiB%XO9J7DjvXl<qI
zBtBubW_s*}@Y*xw7tH?E>9=lfI9u+%B$tpgTWEoykdtQJvDJA{FH=-Cf<k?fW=m#J
ztZl=uDy*>7bSHq0lDZF}RxZf0ZD`3uUZrQ#0~$@L;5*J+iO&DkQuvi=L^}@N{Y#bE
zKXX4yo&?-7DswPcu=2ww`ZaR6DfzG8TkK+B_e<ge4ObfM5L8d|9~q*)Aj>f`W%zHM
z=!idV_K--B3R6-~Ap3%#!*~zkOM#HyPLUfMo|Z&bK!SYR2-#{(Mnxi--axg0*2NCg
z5XJ-&$LQgPcHJdKQm&@5ejLzHjwy+k1p(FQt##U4({I~s^ae<GwVt*LXOgbaO@yN+
zRdQo65L-u=)k|k)19DOF9dMB6@m*SUThXwn*;*2nb->a1Z}W8-mfM}GK^C$h>KzWl
zGMTku6Le-ynmCh-u|4|N5@DR3aF<?B+0!c70ChJ%4C@@oSL?bK{UG0XFOK^Hc0_S7
zl02!C-IAGL7T2n+2o?lif>!mO>Q;0Z!d=T`L#!m%O%>--3QAeZ3jeTsf3lJf|BaP|
z<3h|R(f;H<?ARQ{)ZH76Y!Nl88!+)4w~)n05uG*w9k%hE)VM@zoX7Pgh32pLCx?vT
z3PBj4-Mdy;Pgt%I+^Io2&HGl%3&*Uy;@^`|`(9PaBo3od0}wr9cJr-_oe46)Y(ZCY
zQH9ugNd@R=wsyxde>|t2AOso0Am)bzNFh(aZe->455!u^p`-0>#>>h(g0$$;dE<*a
z9x0wi!WY^HV`q&N7HK~N(&9^nT3nquSzTVmiDXAJ+B5DS`NZOW!sd*n#>5moV?WS4
zSvMH?oz-3l%$GW%k51g|ge#q!-zR(&KTNdk`Zdwpz#2)RSbq{d7_->Yj{(|oUuZSX
z<&wIPHNB5Oms52N3Y^V)p6OUdP4LoSMnBriR>@z6uKa)Pop)GM+4}FtQ4vK%h5=Nn
zpn|lBC>^4dV4*1@AWcL-q}LD<f}#jWQ&ftSP!v$ARA~vl1&D|cdWTQ~2{i!%xjQ;@
z?zuB_oO9+k&wcKFp2HvFAA7UcT6^ua-u1qp@B6j{u4qr3jEq+qMln0IjzI#YG8l`G
zF?vez{!oe2SpQlrWs%$B`NX40-s|~O=LsJ}8k;5a%B&##X@$Hp?%DHzn%N-+gDeNj
zbsf=J$LDgR2ak;RLJ$+rzs4IcDtYlbN@V_)i`r#<<h8)g4tP-96yrt#uUDG758Rh?
zSmbmbwC5NaRopdDmHT3_AXk`4#dp<J{mDT$ktCl~rHL?^!L~S=p-R}wV1W&Gu=SPr
z&~$tJ5RlmQR3%WtW3i46EI|gU#_h%18N6XIX7YP%UjG6QeDy@#JdI96PPKOLO_>iA
zR|6arZu00ixx!fKE_s-06#m-rX(dcpswU7a?&nttG1qik->f`6Y<uETy=FL&qq=45
zko=8w(XCFP{&(K3;#(2ycZP?zP_rYCw0c<NK=rinCk%hc+!BC29^X)M8Yuick)9}G
z0267;6mZKuKZb4pAs4lhn*hMk!<PG46|YCcg;X!G&M(GT*Uzbd&|-OMYHcI;j6F$y
z7ga2%?m5E9qun;I<%R3D`1}J9m|{^xP=vxoThCF0IdUz2ME|HKu{j`zLNCzbhl=RL
ziRHzu>+s7RlZVvL0dq#hZ!>Vb?nQ^HR>xMn<IZc@F;o73I^X{uD0L6xi_yc-L*bKw
zr9<IZqly(!WiOxH{jhmMd|ba5-rPLTqH3^HOJJcxab5yC^~$KcJIg5a0i(jgAds$~
z+ssr+jG=65I4;`tE5GyAxpL*g=-Gy@$bP2U(%eEE;Lr;jbq#yAEFArzmJ-MPlrd!N
zR^Z~Jo#QC>bm4Ypvm5}PJ-JerYgw8iSXoJ)g6wW`tL3IU95*_Qer}fyj82D%Z<e-G
zBMxB~HolTbCW>to161;T5UQAd(f!fIt<ZQ0UO)gq-ww7pHinhyRQ6xkZYv~K+MYNH
z2K3uDA3&{B{z=!&EC7m|IMy^NuS*^GuNTiNCfnRF!UM@s47%d_+dS>lr3GAPtj_Kp
zU!D@5-?pzUmH4iYiFQPZiL^aay11wlS#fpRd;uZ=zM0Nb>O9oX=iO_yNG!y8vv5m!
z^2j>6x?r|Twz~6>oMuW8<v$*`+pk4!_!T{4!yXp{F0P26#4|V36*k}DkQW8H;>TkN
zr(F71^{W<^M7UbhtlJc-6tlR|%$yJzsKc<?+@jwFFustqtDs-%>)^a^2^KW?xU`U>
z)eX-3s7F~mYnWiCsbH&VM&}3TykOUa`~<67eHe5S7s^T>y!$f<QTFb^gA0yZb}}X*
z(9hXdC%q*1Tl$9!J|nvTVUDR-p55a7{{28zsZ8F&3q0%Difv2HU8kB`ag~coqxotu
z<~tn?Ioc8AsiQad9IXx0+I`p$`9XZg<^E-=yTLC1<%5dosn=<ToTH@AVr4dY1ypIV
zwQ#Z$fvh4U@3X*NJ^?w@H2CI|m!=k?ET!5Z*E)AhMymYd8EpMy7uYw+_cv7H%Wq+J
z!L#=x8S2W#=iDP+MxgSR@T2g80XtMjuAjM`{pw8T;^(U%ulb%F51<&6v#Z~c+0%dw
zRQ%AzxL>7HUtKPS0nAUN%nwkzosQPrd2{e$+XqYLcV`NGx+I0dW)qej--043AD%jR
zPMHGVBa5lxXQZ?w#Lo*U$!wVp*YXR!mwZT-0{EP~vXU~n*_iJTm*OlX!X}mox-qn}
ztMlB}cLsPPs(uI_$8bNE?DC1*xvIh}3mHh==*0(+r(`s@=ed*BVudXFgq}|9g${|Y
zTii~BwV1KzXCEYTTMG&7(m^I9r#g~ATs#wf20KQ*2SPkv8k*Kpx`al&XKr8)?UBni
zRu1Pe)J`Gwz(;D~KJ5z2Qa~`Kw{R~vOb$#9=3U_}&c*tJ%<zuzMpmX=bEIjk!cXl@
zK%IB{?@sg+M|Dtn$SoJ=i5Ge0p@ep*R!_*2n_d?Y)em+p0_nzG9eT2#&$evdI#ZDH
zM~iXvN#FM}X@R^lXBz{~OL*3arsM1sPxF1@z$u$*oGa;U@K@ezHBcPSE3-GsTCp|z
zb1O0{%2K`7C@n*AciIs3ft_1WgsR1IRqUNs(I2@``6t=aNYrEODOf4y0dWHMg8+<@
zwnX$3+c<v$aUOUU9H^t|hfy5|gZVbrGm>7=YS(<nFE4A0p>0|C&7}kp8%aJ3TEjJ@
zP+rbPz>~<hhn%fIfF#PM<Zo7>p5W-`RP6_x_2T%(xvQ-E3#0~EOfkM?0x&|KPsH}z
z^eF^Z{i|gEUwD}`Uv!>>&E?<*IayrX>mvA%8$|D8JvKSrkvPxqJ9C_}P&&diQq?K{
z5|F-g1|@6%%4U5<W(qU_-+bL+8|1n0*+}FbR-c=nN%;NBX-zxt%FTc@0#{mqIu=a$
zyaN?!fWG)MMI|4Tpk@3anN!$S6?Gbg+*FX`8!tKgqa?yks{C36OxIu;dSQ%3d7v%)
zSV!qlp`X<&tI=axna6!vM(EFWF~VR6S_3o5dvA(FIu8^JAF#AVQ0+D!Hq^(eEv}eU
zw!6qQ1k2C=IOBeiWhBs{r{x2tM~9mJ&jZlw9sZjH6Z(*@2iJzyBGEG)35r7tU1g#3
zLvTwdP*|uUoJa2UryQX_Tm>=Q!A5=^kBs5uM|uG(uoEr#?o~<nX5)gu{8-}y)flZP
zgsBrfdRZV#My?Ur8GbR!KWo-BNo$|qut6&YCe%{;=SNu<F=5QtTpaDtY^b%aa$m81
z7o_CSt^C^$RZ#K54BYRjx_<gU0568i`>&qG$6K4ZNyu%U($Q%{=h5ft<^v^8LqOpY
z8}XDp%#I>eHGIy1ks5<H;OwtB-T#bmx&>LYx=Y!df|dyf9fHD(8~`l*T#M6iWuG5?
zn^FV4HyO&%K#m`NY5yy|%80Z6We>*8+4pr#;4Q7vyWO|sJgLlh??{!w$NM=ZVM8c7
zjZj0eos9WgANYgJ4l*CJI2W$>vD3OK1Tb2h6HGD4s;yZ)|6>RvNLTV7EkS?T?b8_6
zNT{(Jakop587dy|(1U)-A9HSa%DKoWsel$po4xk8zCIhs1esW2S$@<b&)vM-+hh9>
z5tJqE4-}5Bf!;ai^taB<AKRNF08P|zyQ$BM`GGvle1A@Syb8Po4%C%=M5@W;`&*xO
zr#&+)620}JVypx{Sbe<CZ0iub%p+abOHXy<?kGG>_78XEzvQm6BIza$KCgp(1T<6Q
z{C-oy45-~ma58LRr6G?#=Uf3TWN64Gu6xbdXH@9K%l56SD+w~zBQYkMxPLxI{H19V
z2-q1ND)}4i(3<SN#Rt3D+@1Ot#~Kq5uPcxnLyLeWfaymZl?O$mp#}@!vSkzVw7`)F
z9);E%i>g})!1qr4x-Yyt^3vvi{D~T>(rGNvCUb|u`W6E-ytB%n1)oycgkIceu6cQ@
z%36=zVmz1*75o8uf{`2NY&dL2T3D0F?>}x_dcRwYvWB<Zhd$@6&6o-|4z`~Cp8}Ia
zQACkfRz;OAGwS>rqSPO=lj{{<@--U`L)`)-c<6B221sK!<Ex0BEKIqVsf8<{Ep}pk
zp$qTTo0X>IH-6N4sN8E&1iW#16jUb)m~sZvqS${vg8UVb^+Q^1^K|)^Y`IAx$fHgx
z%#)GUrQDk|+nC^9UNQH?#<`9o?;{&#+geaC{(u0TD4_WXmjKP-QFeUnU?8#@bV#Y+
zT!ns&0#r+4+BtJjhe5PIy=d}(n3#WIG9R39sa#pCa9$gtl&^pirk;EWsrOz`Vg~a1
zhzq~fW*w%{loo+dI|p<7{pFfcf7kdVWSu#5K5_9&OP3jGd$V<QYD_r7!vhpgkaZb$
z#LXXj$N13xjxn=(IUNc@d$Or4XPWxd{Uir#JqN9Su5Q+(yY+F%w8)czc>_|V1SOXq
z<)bGpym7l3ViM0h<T3{ZaN=AQ)aN-6s#mqzDR+H62kP>&{FGkBCqBh{!2@YSNzOP$
zH{|5Aw859}2<4_RASk1bA6em`u;kzMorXQBVV=v%!z}g;K`|BHo#D=n*?rEm$CsVS
z*Xqo17F*>vb4;=H!Qm~>=cm5}-zYH+;AqtG1mtu%!4nbSvS(~tYbyG~jC2)eSt}^W
zt*d<*Iti1uZI!)4o+~*88H+}iew;<^X9|9|BWY2b&A08Ok6p^+H{Xp>!!1q^T$$}u
z87_5Sc<nEKYPNsD2Avao9q;_J<L`W8q>umbiJdtX15_vd;zu0|T8y(pK_gYyALn}y
z`IfqO^Eo#xK+8F^ZsM!ZLr#d%8nqq3c`^-D+H!)8;E?Nu$=Y>PxIVCVW!%w^{?*j^
zH-LDCdO-d+tHHmM(*zJruxtJ1qxg3++5pcR|IJ4(QFrE`uqD|v=Qp&w*wbFaE5F2g
z89m|s%}n`sR3$)mmS9F^8NG&NiGLX7`G$$&BK9_Brrl-kS8~D}vJ{PUKNo-f1vuCa
zl>Bd&{TC%N)a)N=$p9rwJ;Ox!=V1mQ3JU7nUtrjQUb!)j41dSg@P|G9Gh)9V|1(hK
zN$c=Fo=_*RUo3tlS)f_Jf4N@|)!$q3OzP8a?M8hGnwv{!a1owOjX;xr_p-D9Oqw7R
z>T|<k^u?yW`OsIX!(uNm<iCIUU%i6g+s^N@N8V>eTo-ts75`Ov%f|yuvp<*&e=<ZN
z664o$9_r1hdwG2oNt9b#GurbXzqaR^%J0vUFZ*TYI)4pALLGs@IVc>#5N&ZjD$xE#
zd-JD<g@RzMVkXshY~9^Dj89`GA{=;Ge>f$-d&tq?TFUIH7FkOvFaH|A9Qq&)wC8s#
z!Ji5#nuYkgk5S*K-Y}B;8s-1*<oRbs%>U1mXUcWh5dSg4yqtkcHvsriECX|W7*3ep
zC*Zand1U5w>AkUArB3sJlch$5y3-U$<M&&SDM)QAn~hH9{YYrQ4_<3RjjrDt8D1zi
z^}v(J!h>t`vOh1g$*<<8x^Etm|Dsdrnm({Pe6s~r;Te~JIyWCx3-7_~lq95um!kpp
z!b{z+0${L*lG&TOw;X_jXm4TqH;Vs}mg+{WPSW`Suel!cxw;qtu&#OrCiQSWbg5V+
za=x6X0atDD&3HQu4;Iho0|MC3an2J;0#}9uDi$TBGK^g83Fo2120rxT>QAl=zm6FZ
zO;Cb&*tjo7HC%nPS)vu?BECd=TPhJ#va&P0Z`FeZpUvW^TngT<R6<ZYb8Y5(ay7GV
zI?v2ZO!+Qt1o59&CX-&4tpvE=t}`W7baHgKE+~0>Dv>G+2S~|}hNiGaT+2WJASIJ`
zSx<2*LCsHYxb$*|0i<ZKL&dioh#l=&dj+Vec;-xZa1jcy1S(4eK)cq`EqG;et2(^q
ztMa}yokxrXXa-iEq=1i5xq2{5y84GCKEiWoTnodgZ)qL+6yPGuAaQ>9`^+!~bR5LW
zvp6kLRZQLig6uJsZ`qX1<mKQk?e2@&eIDOB`7Iv$ZB4QNB_YlC7Tgk*Tr;<z%Dk(I
z4~_w`#l6pe#@A?Oe%=MCX9T*}i0}uM+|pXAq_J3vu(FC#&Mm%|Ui1M{#i7J?cKDvA
z(dTIzK>F|jXXlp2_B&l4a$j6g<-6TF+gn!1OY(32q4cfp35$<pUj<eB)-P&h%sL%Y
zn#!M?heHpmHLq;0&T=z(pINFkiHdwshiQk7m^(wVk<)uyw0?epAwAq?L2D+=xsRsK
zJNK@ed%9{xs+5t<`FyAsN~gL&n)+H8@%|?yg`nH%VL%8~qzQ^4Ur8Bc_;WqF2$now
z%2a@0oIZVc`BR#6hGJ(Q5KNt7Iw;5WQI-T->aJdYNGa_xcS)>AHHCw9oD1{`$<|t2
zj{PMAUB&miN@n`QpUUCtO#MfFyZy8(F(Xz%Sm?le9iCDKf?p3pMj(xtfw+@B4JA=&
zm&5BZq=j9l?=J5Ern!qcf+g5u7(VmK%DwIZ-t21sAzO2d@$yCjfI?hFvqZQULot&$
zi^>}j09BjOj2XP}$;KQ`I93+-Kre{TKb1ybu|THr(?&Tqh82JZAxH@;sa(e;*78P-
zMJWLeT&-n*Y=dQP@E<~pWIshTac1<zFErhEw~>JfKvL1NMH3}a?FrbWw{rMUl&Ary
zLT&l*ZQhZ!L9DwrA!!28sR%cPInGk<A9>ply-8DmkmLys7n+=aS`l)?uO@<2H`~@`
zy0ki^&n7^Df;y9a!GaM2n==NpZKN`zrfRN_?D^Q-idLOn5lu<3l1hQj>ZQysk=7-1
z99<{4v8LH=KxJO5vr6(#47<lL?j8`I4tujfF)!S7RtU<RkOu(X`7nyx%9DxN6>cEY
z(dT||hTuc4Kv&SCa-&YK0UT@|5m)@cHT=NXi6aZ?61L)04}g-q)UiR|3qr8l^LnJ&
zR)0#H90Y)dm+&!c@fA}5=`VIYbPc=KqO-?|<T97-L$g;%QY2kbSjTYMS)4VBs5&ea
zh<W!wZ(9M;t^jeWBCpYnszuL?2n56fMM9Q7sq$HRdy+5z!is*+CMsDN3p^own%5Fh
z_me`>xs~zi=+2|{xg@I8P*0y0kYHq0BZ2|Qcim@ygBH$S5>Bx=^25}14EI^SSLD4A
zynIvUT|lMK<qQ)D=tivw=fw|ii{@*+foO^Q*^NMlXWP2U>^2vI4H`qKleQ0}g5r-<
zMqX>5fu;M6Tc*<*fv8=Sdk4!3fY#Rq2?&!Wp0G59_BcPYhIkfB?o9Vr(HGbzV`m4#
z#LjXiObnoWb%(LcigLUkk=t#%!v*$Njh7e(dJGy@mom#l6qEPv;U;vv_OM?JB=PBC
z1WDFKcodKPxUm8hh`Teb0}zfmEmS~$9Up?Rm$4l`p^$WDLMZM@Tl;?Sg6aW`wAn=4
zVsH`xx`#e|i-40K!-ns*&2mkm@BdFnmBEJZlo=$wn4kjcjUNX@nQb7YGjBFKrrI>+
zTHyfAaXL+XQhKj+ZrWfmblW4&t?Rl9U+Ml4aid(WYbt>H;H?KXlOvG`49o`fOJuT8
zDor72ZPIMD@3VaDV#_%TVpS|z?ld_Rbw!aJ%U%PA>BcBazEAZT3;m>i=B$u!eW&mw
zubfnVO9fel+I)Oj70iiPda`fQ$EViQj7_K|)Rs;w!(6UeJ1HDrK@<|yU)y4T)O*%F
zcSYHPde+dlvx?H<u^J}j5#bFeD3-z4t&gW@3b`yDO9_~g$l7r3^jVL@O#;0NQ}*u1
z%IWmog&e6Q^9`TvY<93ae-JlXg+da?OUbo<WUp7)vCIb~3Tz8qOEy~jQ0IQhOY}W!
zbbud7d(-Rt{EgO=+0|Tlj>Q+93Yyr5F_@wG6K=z|=?mV2rx0mmGn9bl{m->>R@VeB
z7?UN=tIYy&2(bja$8C{nLZSeY10kf6D8eM*2H&wPt5z}9`t+NDAeJju8Cp+{Dy*Yk
zb(%T)lo(<#g72?r53JS79k}x>UT%^Aknvuz3^LwS)@46YB@5+ujf*y32;q(%_qBN_
z{#XhlzzE2<ehz)U@f@1ufwzHIlDo+?@_P{!C(l2oONlwyQ14Go=7C3tPLWm&E>y+d
zRZK703lU)F>gDx^h~7(+fKR%82=z`<k+`R6QDogJD$1hV-dmEa-_#ro5?0dASvM%C
z0cCPH1^EN>CUagQ=!B(QeJQi>aMKrE|3lI(m*jD=_u;qevyji<%AVZIM7@?f-;)he
z)FYr)kjL_ZG#kmJWl23IVRZ7|bHev~HE<p;9(wF3UHQfYKUN``qNnyNtOua%i~D;#
z=3r~JiJaMM_pE<TDr}5+RqU0--Lb=T@Jtog$fjX(C<HN&2o;Ugb+P+776DP)R)C})
zwXuzUoLk8I6$5rxe@Z#7zpVf|1;7Uj58o|kPlve@U~Y*5f!%$l9i~$oGzqZ5T>|8=
za@6b(G|-qO60{l&68w@jb%x`|_{{ty?}l!7Kv)N2?k@zk&Tn+&#Vt=nUuTWTuPUSO
zow`c)rCC(sT;gQ_ZNy~kg0p<OddP#d^<eE~cJs~%`*S#`?KU$@R^^;;-{#}WnluPE
zB;I5p)&qGW*SbvxeT^2N7HkF*>!@%?C#>N3G5|V<bx9H@epWL6T_Lk@(xb^(Ny}zC
zuiG>t%Iof?tT<a?Aa<O!q3a$y4als0u6`HE=5eUEbSqc!6ud@6`xWH2TSWW;i5rhq
zx{N21mb&v(rDO?aH^En0?$;yBy;h%SmYvurN!hU}*+o+S<QkSd)|*!!20m)Dx*mLe
z+2roihWJ#Q4dp#Yn~*7a*9}@soO<=9*5tyD1WwB@9vu-4)<6sFNfNN4h-b$fTaeHM
z?7eYQ4SBiSy;p+c@0fWMy*kQG!?=gL)ivN2d&$#qcNL*qX#<L|kIr$B4!fx;WD3aN
z4-z8vW1}>FXlI{*5Fr=6o!e`NIFEd;N*}1Bv&g~ZxvQ+MN&PCQ{EzneN1fpGlK~^{
zfrR-ZtZ6IQ84h82PedMiTbCqm^6;beU62ms7JCaZ@(O|5t;sTCd$mr~GpR~G*<%6a
zKe+)0Z^yYS#GF9X<XvfJp0(Ke;sSl_dY7Ho$@H6Up=RV@vJ*nrqVN(MY^U)7>Hw0Q
zTobsi<u~uLhiVwcE{GHtT~F=y`Z3F5CGk$3+C^lRkfjm8KR;}H=|Ie6>#TEt>=ZdE
ze0>R;$|V3+;mn-h&8ilKn{x?hE=%-|V!r|jgz2c5Szn_IMX=x9=`(OX)?7I0g?IVv
zY3pzBU_M?lh2{YA1PJXKf7H%a`u3NWpJ9v!?f~)-pn<nhPNaAlsrUXxH6usJ1~rj<
z(D%GDhDvj$82M-crzzj%ts8}{K7*M`h5S^D4^~-X{(Lfu5%;7Rq93va@m>YpZ!A3k
zJ$nu4^S2BR|H(U;x}X*1WO2lPtZ#T`__d?@xK_;(E1NfRhrr8qMaJoMpT|^|+6r03
z7aMCtMMHPU3Bp||??lRHx=s_cUldHN|GfUm&9+tM$7ky(Wt&^$H`>0PqONXrU^Z`=
zu*b-5KKB~!yP=UIFl4jGV2hI$d@BF-`79M-ssc$1J5f!^)<-mt9xwPwn#FiS8ST*;
zF_0m90C!|X`^1O{&gX1H*^R`vU!nMhATztLqUE7Nd=V}!C-`cvOzzbMBQ`Y_cs(es
zQM=AgQO022%a7mrz=s_6k-h86TW!pRI6JUOtJK;-rM3#MKw>ynhb?KZ%M2?I!v^+a
z35!^!w-hbU6y0@(e7L0$dEB*4W~4vQb#pH_=kO!rX~nxgCptxpmuN2M&+w&{P@`WB
zmYGayo>hJ8h_Q3|i58vz^jtvPx{OE4*G7KB<p1mGsQZ7+O=c=t`@R+cSS}H7ioS}P
zoabvO&7Yo<dwNr}<LQZ!#d|wb{Wfpy{m=l>SRuR--JO0l=fsHquRF|t;z+|DC<(Db
zjWC=TTO&Kkt~=QZF*{C?ZODCBGKL8s8rV%^@^NBtw}MwKk4XN!FWc8IzhnV`Te)WN
zy-&}h7%q!R9{`?ugMJrd&fa_TN>m<CS7~*R1OierxkTvYiIaToJq)w!oA+v~zpNP$
zvJk>h0rxk;L6$qE3r|zE%T|{I{EJ16i@ep3<4B-3{`W*{9*Vi48ldwTz!2xLJ2{9(
z&PcGiJWke_Pthx?9B^Mu<(91^sqqgC=Ql~?CGjA<n`c&zDA7cx4^Tw&OnxwAhY`)O
z(x!sf1WeD^4}9aJxv1JetGt&9i~d`FeLGM6{2oe%Fj5K}N6qJMA^qMs5et?4b^?;k
zVhdM$YS+qK+sjjxOC(odFF;Ac1Zq+r8|<r&m(jLwet~<a2#}H@_02EI@xJH!1mJ!)
z$*H<0aw9K1VulOMA}SUtP@a?VfRCu(Yev5pO3AmXJBd2<!9U!m%O=l%B2ld`I5+bn
zVA8axS!Co6O%8tE$Io@~Vv^J^@VRD~(4ovn@w<0uJ3$9sl@^L#5KW#^MNodWE$Y<^
z0EsSitTE|)LouoM+MfQWO-Tn@?Obe0bu;MquEdW9EHL7`HidO#8@6sq6!Pdx!~Fmw
z?MQcb+QiLJTFeXF3aKU5gpP5r^RS?MS>FX!{ONU~aA@+>d3?SU&&SgjRY!tGaL11L
zO)4FajOR|U23w&gG%3T}4BC3fNqfXy<^kPgZpOd9x)!!W0MPm_VhVPCOeE<BJ*k{d
ziOw;t;L5obLMlsv>;zQcnWhSHMfAmw?CkA~#0x<4HrmTra!rgWLpr%ztQ+S<vwr$@
zhJUl6`n*{Uztwp8o=??gmvHFIc2Pn9DzeJ>47)qAf$L6)^&aU&B*bDJ0Es4@HYQov
z?IdrN984DlN->Z}Nw36>xR)DIO6IL8&L9N0OYh_<3wf;M(5n8Y9$+dlsC2iMOC^*X
zZgdt3b}@qOsIo@HY_l*I`FInv@v<GL%p`)L*l)^6l2gg7W3i;oYw`QV<@6W5;^AVX
z*zB;0skkfyI@J2^<%tp5bpJBQ;lyDKkQ)!ke4&u!-!$aj7A)LkFx~Nj^ahY8x^o20
zN7GdI@kyw`7P4ISdI=)7i{ZnsR#*t^R^t>!y6+g4egN;B(46%W$U_nBvP*j2Z$6Op
zNB|)eAaHSh0RZD{+06hY<sBR=*K+hAJ(;&DJQnDzKYMGZ33J%zEeAY{WosiQY<a#w
z4A3ndBQ9%4CaDBa3(^YP<^GLR!K>OL+j_1vS#6v2Lm))O`l4hLo6Gh?KrG>z#w)Y%
z?3#&%mQo?Ja)-2&;w|97wU1v_|8ei9&L%8u53{hlXQl!vkkscP#j&-Lw?iLLDz!9u
zDt3sp@8Lf8U>^<nAP?Cm@fQyVGiy{<AD6zZA=T*Pze~DPLzCHOR|q?M;15FM=Z`-~
zg-HJt90PEN+O(^y?IQGD%9ac765R|9n^etZRN@erNo-Qmdvinh8qvbR%Md?k6b2QO
zG|j6mxo}%gO*8effWp%D@(aBTYuh~cp)|sRB&*F)=cK^47Vv()CL{g|^o+0w8rGAf
z@rYt_tbK`-R3^LK76K}4ZnJ3gPXAo6@ScbzEYH9Q8S$VE7hDMGtr13sPi8k(8hcMc
z)q5q!z9$;bUAa)OU1Dri4IlIj*?valS0uEbW*5HLLBdQGV7u(1r6=p<@}e>&XHi$M
z=&XFnNu20@39!fb)=VBUJ_3Z99@_GPwZpS-j7}fS1JiS~t{=s7MBu7sax{Ssv=btE
zlq>0<3PEosXnpM=qz!J%s0a*wS>S0&`lkY?$G%IOlJTqrN4woO4oavc9_bAZ4*qgv
zS^VW*fiDJ{{?;ksM{ai~TO907ci+wtxFREYB1?MdWF|o#6tYbm-)Jy(p|3iy(a0II
zYs<^^p(AdFzL9-xQ>yOc@UgcsRo+AUTrL+Xwe=#lwZK<NGNCKwFLe9M>nZ#4c21vM
zC2d#h<N*b7^wx>Rmk=c6>XIj-?sH)>b{(@^ZaurE9;&hU97U4cZ^xy&{({3YikaB#
zC_?ID!rlOHG*lRDl$=B>%e9YOEWk#YZZ?OIG+i)4d<31!b#PwO0?r*!NC=-Q^;*!8
z%b?u9`tmYjgq$wZRY(}D7mPzLL-XF?+uBfGlQTUh(QTE>h>Zp#voe>w1ga{H7CIaI
z<{aL#gdQ%irQz#`hw@*wq2+nBu?F<&=^{2zc1)`NX!}PV@h&BC)Ygz%g@L{wICqEY
zi!jLw2??ElLOWnnvv2K2=ZNt=VJ74AncTZePM@i0I6I*?<fW%5_0vdU<eQ0Dpde9G
z;?`w{^GmEexXJpMaQj97>89E9Jd#TZC$XZih-Z`%$t9Z=)b2d6iX@A`E9%Y$sJ%W$
zC-x3lVabL=DC+s3NJ&GZ1nDgz{wK>QJ?G?Sf^IbWDYUZQ_7{?+PF~Xq^xy@b@wYJs
z1=zw2$4!WzE!af*gHs47<P=JP$jdR}f+1r)&8{K@kc-^y^-v0p<tfsA9Q%}chx?;j
zU6``$)W*CY{57?8|G(AAN!EAw^V8-Q_j0G>H(=#7ZDCyS^k~cjxzZ+Eol33Lia}uf
zOvK77E8|#$jLWfyKD=}>7~ks6vlMfDT}FEieQWLl)2V&szi-P`IN)Su+fN3%wUDFn
z=iLzPtR&E8YY2!S0?rFJ-zcM0t|rc|$(}^RJl-FZaOk*dS7vo#8!kY%P(+RdfeYxc
z35dFLq<IJ|@?^;e5HLO$EDG;GT&X8cm4({iltGm`!1r1Oly)<JnE1MESG9w)=hR5q
z<om2H_~7dJQ8NpVw6L=`RbAUYlY5PH5wIQ<-vlfXTtTEF2zdU%!i<o-1i?_;B2kQq
zD@FI9qlSjY{ev5vtpRLv?@}=zK0yxV-`58*IT{G&pSaY12CF9Ec&8!TC223#GVO)k
z@yq>5+w&t`kees25trK}Sa~|1eQ5;7KAvNMc2F?Cvs<=<dIw`OFs%_CzaO>LsQymb
z<?v(4%cm~MiV`T7ufIb<?T6`4GeC%UGvXp>$IALAH#7L<^Ii0u&*d9<ijAb!$7p!>
zp*LWw)}@2dQF%0NuM#6*3A3E7zt0q9g6@jdAdSY^y~VjKh$me_lpU{`ABgcj-XVT6
zTCTMJNqr0}CfW%;p#@Ib^qELew|{Y_wamVO5QdYM`$<=2q3E2ru8Bo^wMSP`3})OO
z=B0j01ij&aUWT>tnA^bPf$yS#>Yr%dP%ZQ&<Y9Pl@TKtM7&Q~}MHRzUIj;WTT{l_h
z8Xn|`xV@7pwAr&Q0ao4)levDB=f|l;*A;D{iy&OV^5*&$`c@GS#|Q~cjrUBz^xp&i
zf5~j_V4LbP|K&XoRk8OjCx}{iNk>VyUY5U9DZg)HP@*t_>fXkr%S(6z`*wAkgz#1L
z2Oc?V(Fv2mgx={m4e!q#mUx2!X`W~f%jlGq?i*N3ry{2imlIN6OgH_={B+6&gk?lT
zr_aNGOUpO=A%)6s<4nFypc29Lz<0VL-w~-FOKrU&Z>PkQeCIa%Tzxe}L*q^3Gs_eS
zYI2g;CJ&2K{SR48Yj>)9IBcOlOi|{6D{w@NRQ$;g_0c9x)bm0Tc6V)qNTF5p&$U8j
zA0D;pH`itIY5zQU16kQV<&F+`VjZ2`SOV-MYww+~pY3+imC)|=9r)md(IW#EP-T-U
zN=U{I0h)xIinL!(ba&){VmtCH75e7iRpos;zA+&WcHqOt!6pz5U$-Mg;??W8kyuOy
zw+}id&Vs0Qy@JM9>58+~d(++{N^jd{lf~d;P43zfSEO;2WlX*$k~U}qFJO_IXqG$U
z`?-JwG^3qs=hV*P6s4~?j#3u)0&3miI`L$Ff5{XR+lUR{z}}>djBwgk0ytvDc{*F_
z@;YtWLcyC5%X9cc&gmjYo>{l5n6+93Q|g?F;rI8OyS$R74g<4Aj#++Np9=Cy5_Pd9
z&-w9i6Hr27U|y2p_ve&OV`o9}*L(U)*(A5_Gyc$jAO7EA|Biw4-wF4B{Zo@)`IJH{
zZQk$R(ODO0KGxh96k2{ZqRvi0jQCn%J|8voj>!Mc-#e0jsZi;ade8uB$R?8~Z=|44
zqGRbhTds!2-NKn~3k{1Zoa<j(WkNy)CaWKZvA$yodr>N(PakS#a_r_|XMcW79T`|K
z`pEbFjEh7O`)&z#_C5(;Gm=e}YexVsN%LQ>J<-9zj$A6almZKRyBa%O>c89<u4-t=
zhW@gejTYKnlg?-Mx^r7tNa(tCbDlmILSK(_J3LVK&V!ReLh+iB^Htg09VX<y!ptMa
zccD-@wwpj74<jI}!Vc~Tz)J5MQn^J_VRXkeCj#%%=g38H_U7Ep!Om{7mzps1Sn>Ug
z9$=dQC<<TVI<FYhDd5rrWQETCUN<^XfW_a&rmCp8pm5`$Ht=^jM?F$G<}y>k?Ck7u
z0tipfevix}vBAO3V$}o<kuTRY{Q(2_ESNeoQ$*00J_8Jw;R9TVZf4rk9pD*vk>t)!
zdtAz$+rU*>KcF}g^|d&+Lx9_9qiJbfN$L&Nz*RSQsfsA3M2KwyO?<vlqotLh67=*T
za8>q?2whJ#KEqWJ;C3L_WP~pK(0|;K;`!=_yXnJyJV4i)uPFGCNBzBTzA?~Mn6gxQ
yrK$-u(n42tW72<7^zF;*S5E(5`=|K$CMfHXx|R7$g2WHN&t*+rja;?c0sjjdpx%@K

literal 0
HcmV?d00001

diff --git a/doc/topics/runner_fleet_design_guides/img/runner_fleet_steps_diagram.png b/doc/topics/runner_fleet_design_guides/img/runner_fleet_steps_diagram.png
new file mode 100644
index 0000000000000000000000000000000000000000..9d5a28d5f0da20dd17e7bdb0799f0d6c90cf2590
GIT binary patch
literal 13099
zcmb`O^<R@;{Pz{<mJW$YNr!Z&FgiBr1_5aSM<cBuQW7G~s41;<h;+-OBqhcu8B&wJ
zFFxPz{dnAe!2Qb}+u8L#XXjiy?{m)U`MTa1>T8k_GZEjpbB7G9rEYxZ&OJ-ueKH|F
z@JbreU3BM;*dbV51rliUCyyX|aq3qrZy9zOB>pqRyDZKjm_&g_Z3~}DTh}@P#+4-c
zhPONBj%Y1Ek?tF6EiKW=-WY#E&i9v`F@`K2dl_F6JwM;D{&AfQPg~fp7!N8y%eR$G
zj*c%LEltB}yv$ues)V2z%KtwvX^N*?Zu}oxo7z03<1JeKo>_AUEOiWt$uA)nMY}QD
zjr-(1M`f#du5Q+9{mK5bX&6nyZF|+kt}m4`3jtpO_UUH?p|e6Yv*mQ9m<aQxcAemz
z%%gx@@7<qL?rwkSQ!!wzhV_f<?-gt+3Zm`lQNblG==cEecF0a^fcrt)rqwS?EGgP<
zN^?r*EI%ft<*^NRhHS@bOs)}av6*}2oaficypi~C$*1P3e!N99+jC#YU|BRk<19P|
zLS^}}J_<oNP?0z>y`y@3@8p8B^oIBB9;Ezv%#}G*K&JzvCEmL?xh#8#p*Du@(M9<B
zD^|>PO-(JyLG%7qA|t4FhNGTm22Vs(B+e#J#r}E8`TkjzpZgh>sFJU7)1!o{(NAyb
zu}4pswzZ>;>50QLRcmt*xBZBW@ap9Y)(lRYNqhf4(ZK>YilDJL>)m<7={F`*U-u+4
z7JeZ*FExgeri<`qd3LVC7t$kSXA7fkr(2v+D?D(Be3gNXK9`#sw6wCaAOaGpC<ppy
zlCDj@VyuKQQ8I8`PlUXABY4f;w)yA&@$br*vFD?)t}5c@S4#uFQlvu_m!UE5X&38^
z|Awh341LU{yl@+a2JF!9pvhcA6(0B7s)j47BJlUkezp3=C0r1^zs@ieMo#Hk`bEUI
zIh1X(#<fF%D~JcEtA3gqMTQg+|E9m+OB9(`@Posxc^391AWS3NOEp2?2g}#|cu%o9
z{AK@|oNd_Wof&JEoTl>2#TXhEQb$wK&?e*sQC(iSeCdFQM*^9!G1utKemBE&OAJkx
zZ$bI9%D7o!QT4y6q6I?2N>ZSf$i!E~<Ll5A#meI#)dM=CF3|vN@u|^I(~On)l!uXW
zX5EG*{iH2ps+dPhhk?7tV<;F1{>ZK(&9hkwVHPF_ic74h)Lt3Lr5$BV2SSP+n_gDW
zJeHaZlL2)mRtP2Lv2c2eh)+!AVk+!%(<tH2lcXjv-36b<td-=H_FByg9rIQxt3I?6
zwL_zBFnF7RJ0AWhJ168zm7FkV@AD7GLUgT+rbk(+z~#l0Mn^9jf@RlTID221i}#7Q
zH=d@BGaX*sPa}S5iRI=y*l!s2qjwKK5eOzjVYxW@gXvO<o~~U=gA_+TcP+&E&CJzZ
zI~>YUr%5*c5l$e&@{!x>y&e-IfwftRgxZF?s2-N7!N@;PsJ!>Je75Q}yR^R0DwVd9
zl@j*~ItY0<=Vh<!E`R3}Jge5K;_^BMju+S9fa3b(Qjzj@fNxvjc+hWJA`MUBlYcAP
z9L2~tXDhQa9~$o|?LI8V&gt&4q`+t9|B$sDiqzfcIjtBML}7X0w(|3*zqIL2$tuG+
zbarGu>vD}mr#y*d#hx>qBBbi!*Ofy3@gs-qa3eDbG`kLVS?hJjj<#QUCGLS`d$jIh
zq4n;fcHc^kqp!K=Sg$|RTkTYo%3x?@5MAbKzN2&3rDy7~OeQYMh7>+&x0;xLwdx=`
zD{j0J5#{FZEie+7avkLik5-_kUaNX@3?p4lb5_%0vTO0*>v7Ep(VtO1xi4w7dFfQI
zY}ZZr$>pa#qv03=E4pc$Nev<)jw79sIvMw0X~Fr#taHcFh|>IN%&2hlN5|c9=+nQA
z8iOXu0gL-pJR=DyPwbyB4*_MmgC^;+^NTD_GWU`3nRF5NEnzhc35}XhRbrBag4(i=
z>G#ZP*0!h_O(BI{_6!LEk5xDE_TO2=T@1uz7yH8yl_3K|VjNEFQ{`E9u_}z-@At=*
z2PiNvQq^nWrNn7yDxCP8PcV<A1!yK4$j`wcQHij}NN{;9C(BB}m3<^RMaG_a8LZ%!
z;ZUcp5z}$b>hU-0JxX&hDoXF0-qKamTT#BU0!5=;E9*=)HwTeUOT7MgqHa~LL<M@M
z&f2flCxYZd*2*$79FB_CHkn)?5W`CZRcGDbxuQ)@OPH<b$+)1CIhB|a`${FnwC84v
zISGP7IwB3X!p_y`{2@rIB52o~JJw0xEKY8U4_mepw8LWQ*O=<8ttH}78yxb?nJfM%
zc_=Dsn;KDft*a_;bVPT!OJ`mN2NT9gy6sa?<3wACTm@We!351a;VqRl8$&J0_kKba
zw&qPU1>J1+Bw;-KW@r3#{8N|il9{iwoOQIQSX$c}`^J-=Y~9^hst*On-p(m|VGXqt
z;fAjvwE`~4+$s7GsiLYU2G))HdF&(E;%p}!4P`vNgwquEEneiYJbw2=l3s*ARXbTH
z61+y%=YsLNkw5in+hD9Yi@>~0N9pAdeBN|p+_xsGQz6rB5E$z)%an3s6*(UJ-WmUQ
zt`MKIJntiWI%h3q-1Oqb=d#kQ6ySf&O<U~JqlrnvJ*w;<6eUC3neW5T?E>#K;%mJo
zLa2yIV4vNVWXHiO`-1wm!G00rVf$J%8=`cZ*denbCQc05#(MoC7_U~-z|#E6Buv3e
zcG|9G>wX%_06`MB_GpDo`!yb75}C{Ie3riBz&vhF*QBcj^iuzKC>73LPE&lWr!>`C
z%=27GUI<xGi$H|2gUA!ehl@1vkJ@@S4VnR7ykYFqy~qwDB2nd14&8kvlVD{;d})iO
zg_RTc;}1C(>}VeesW~&7zVGE?k`+_pZ~U71aQYqj)e7`PK4_a_?31~+2`cF_H?8u1
zD`ZqZo6iYpK8}LKlb5)&p&GJ)vSQt($8dVM41*HF{hp5B4ZmZQwzbl#H7YIIhVSPA
ztDZ>Kurgxr=CAthF%&KgXUcB%YwQE*2Mv8C^%mYH;#K-1;bMuxOyN#c3iKAW>cub3
zx8#({dG|X+4y%{#C#_qfs7iF(RdTeQ1<|uW_T%dSq43{y-qx{evaC=|*S+Yl6eiW}
z&L=k}DS>s}CadHgG=StEhN?a=WE_@UWG<D0<N5<z3>W*M4P28-59ghIPb8bMO|8eL
z!xM$=#~B?SOIL#Nc946=dk#hT+oBnXWp-vCj$cD4Hh74xO@6u49lqSA;1&79ktgxq
zmyI(Uj4BcKSUN)-zj>b=tU5^6oyghqv(x|{T5*$V+SgusIHj`~{b}AT$M1EYCv5^8
zTTl^DEfn?;5ANa!#bgn28=viz{N-5s3b%z@nYBKC*lo#YJJv`Ft2j=0Pe48*SV3CD
z-SKex8|$B{68US+O__{O9%EOGhk@JlybQyiKf;3`MjKZN85QkQrdp1wX1aQt+^Hzs
zL_+finU;{T&EbOS5|{kU3x}u`$bF~gS?vj}ND=ouOa78)y>Cm1IZUuZS)HkCN23f8
zMAb785BtFK<0Kk3)Y3hq4#Mz!Ye=rF`cW7Mst?(*N~CDgHwmoxjj5ffI6od|^#*~u
z#SvP_MYqP)&%9S0efa!%eeLjs3P(5$-aKb9yG++)@TgsPsly~#bC{^?F*`*nt4SZ#
zVUQ4kt@2LDbuVd2!XwQ6Z8lz^vdNCR!z%uL4ybq~{9uLJ;<B_f9v)~%3r79=gj7SM
z<V;U)?z1a!qI!^d?{Fh3akM3x$5XCTA5>!WzQ1{gn)JBM9_LyKZw_~V;Zjr<Yx`+x
zQ-J?|+iVfVR6KO23Yi~Cg8GqbA7t=VE7pJI<=0{Z>pxQ4*AaQcSL?A9mNc?M$7YGu
zPgypKHEsGeuV5AoPEZ^8vm88JK8_1iG2%0kYLoWjThIVk#^yWV?E__Fd*7oq<Kd~L
zM0f#Q+OCh=1h$;kX;k{-C(^+9fxt`3OemXQwwH`bXX<YrXy{n|$@WLE61YD*=fW;Z
z20|2b#?{^iwG!x&(+GZ&@uZ<8$3(PpW%^vc`!Ry%Fiyt+T&I#>)E*+W&jqDYU{~N`
zbeL_G{L(xXGK9+I4dXid+0a^kVX-KT5D+877;W<pv3>U7=_uANy{SzHR(SVcwYY4R
zhpur|0ae0bT#WXN`yE7OhFoddgg4zu?-JvIl?Yr@fpp`3n)ZG<?ebeA{V=_7H$Osm
zZLtbzxbp4apX_)@OK*$inO*Yfj1j*70BO-MPmi3<xz3@+*<pFM0c6{0XWwjFaERih
ztD0M(c=!=o?<G~{JrkII;)Q00;Xd`(@#)eoPG=xLP>mL9KeB|~uwQYVb)$UwOT9eS
zcon#R9eq&@l1b#JeEI}97(7zo?o&h2*JxoX(h?SOoOG@l4+um#Dv$}xPv{6n4p=j<
z4V^Rnl8&>Tk}Kt020Ds{`G8$0HxPys6nmV+_f=8(S~!fG*PeO2h=|*eD^pwDD@!qb
zuM*oShh#%coqs(3;FRncNKM^dH2lfD-QCJVV5x<pTME%D24wH;$6z98<b3H}$o7e1
zh``~1WNrghdy%#fYWEcBp2o7S8Q@tM`cL&-HN&!TGt4AdFQL1aE+XY{%W<0#>h+;j
zN<Uc7`1kDw)!SF1TsuL5?yP4Six_6+>frtb+<_BcgNpi*nI$Ei8nCDc8J2LH9!eDO
z?$g<bRu?#WHJoUg7HBrM1Cv3Ad4PUhDd)`<s0vm7V}X8(^iEUaGyPI(3XzDR<t|-;
zcUMGRzYz#Ti0yo_yzDDQb25AMv<Y-mBOdO!?k*Yx>mvs~2Y3l~6!LM7bwGpl5AlLx
z4*QdWG@z;okb+9EK9kl2gOztHP=zY8HBM^<ELm|FA-hQcWfA2a#S0i?Vm*pNq;Z2M
zz@6;LS_f|sZ`-$BDS+#uw|=xMtjFp@!HuiSkHUDiO;+^n5y#Pp_u(ACr;_V(g^b^L
zP?oV;%S-1{45!k29zh~SBigjekTxA4{5R+N4he}kP}BKbYtyIWC`9fv9|zyYTIv#+
zm_M#?ET@vkQjkipI#j1|Gt}~2pDCs^q$>?iAF6Ln(fChC8v}0r&1M=!59#ZrRch$-
z@PnnY8q&UB-A0C_QEV9+=ZCT$y+*umt_;+kE4eC#+=UI{lp`v}uS#z?tsyN+^w>y5
zj&6^8`f~bltv{M+`z{pRA<)5d_NwhI(Y4`p`s0_MyRwf9NGVS#B~wYU!P`n;dg#81
zgCfw%k^8m+m_o;oEjdIPYWP^@VF`mzEBJ`;56-p{BYWm%t`JEMqJk7-4+JIiJkR?y
zAYX_;Bm+$=K!R=ryYC^Q>Lpy5x0QxiHz<(Ih@AQWH0f<<+5R&3f1y|`G9r!Dio2=h
z*mc2$e~5uSsk~DfKfY5ckrWfic#ktAMX9&F2*K;+f((RoE7I}1A`s`g=LSf%s~%Zl
zpoQX{ilDaJIG0dM?34PvO1=?BkmD<-<koz>#1J*8$vdtqo_p%Fd!PPBl_3zf2N5xR
zEm^ZxDeX)psI~8wh9q!|$rcDfAcM8~?+j&<FImfV(<55XKfS#xcE`fvQsXlY*?@?|
zK-ca<1VzjW>IiZV9zd4rtBmZPSt6=CEa&4V9m*6{W=eJrG##uj=c@t(Ei~G3t>fBO
z><piTMc6YEzzgQ$8lI_w&}EiFm$5a9PYW|i!s$ZtpU31rc7BlJZ<thNx`wh1{nPo!
zx8p=)ig=`YA5-_|?=`IY+`Yh0$~=NTVxgO$f4PLwnQ6HsjN=tNvQ(zT`4_sB#Nfe4
zGt<W9K--(*nkDo{3zt2KB)V(z>wQ>FxWuWI#<6|D9rh2=?V#?gQSrky^p!%B+@!5%
zDOr@6t=rkx%dnTyzh;F$(#XM7Xu_^4_^*F^w@fNt59)-o$a$-LUHTn;>6d)vwHNpy
z<}~u{J){AvRI5}5UT%43>qSd<EU~Oz)?>#BlY3d(gu)rXu&88U<?1g-*u@*^n7_ay
z)=X=5r;9?Yw}hLHhp&xwgwQL#s4Oxe$;M8aeWzjI)(uQ8UEKDhwk~!TYG(Rw8T0Y_
z$?hKIgO!&*?_I`wU)b&iBtfXf8|Clga5{P{wQ+W5>H6>3H=UCRx7T(dU$~#EVLPQO
z90@StHa-d#PN^DKHEczFHjkC&z0r@O^ivOf=YA=z<(503g(~Q5J$P>hL0Nt8vcS*W
zv39pNCp)gKMBsP(@!%lub-hjv4dm6;OT{JI;31SrmzG2+Db|9KfRhChWbiH{f+(hc
zMog!QQtq7-IsN@(k+^}mxrE^$oBlg)^4aYy!WW@5l8s&+TUmAJaajZ%=Nm0jl;3|p
z|MFIv04kEJ)p~QxNfLH+tQkGmFX6W6nSLRU{UOM9vEcpE$8expCM0z4>k;xd*-OmN
zx#II-FF#nCuk!gDPyavsB+|lRyKhemjjhiD8nD<A{jf(bS*MoI&3}9p4UArjS{UBa
zkiR;3+EwBiTyVtNex`Qw?_SrR2<JbZ(MOUiKEgL^>HEnYY%yK23GqihiophkA5cL}
z5l05sDS7%QvlanAe_LHrYqe&C{XA1Tfh}w@M4V)Ft<|&)_g`PPg)RZ};O2E+*4Nvt
z^55NtH3{5^x#}kg5-Oa0`rPb=S%>$}KwT`Z$v?7DO;PmTEX(C?B)4pSRYZGSXDD1z
zlQXT_O6_TOoG>WWu$=nud1q=xq}@)Ss<sKv_hCXgmX0J$_3OOX#fd_jD<M}mCo=Dr
zkE*183BSGwc)BvG<S^)SQ}j`3$B(>P)V0<+pscDIynu)Hs#{%F$$OJ8Ro*{CTdwfH
z>gb>~V0P|dGhG}J|E4;}uU-khb0)&P+}+QTb8M|xt~&G~G99LCZPb5vh#aNz>6p_K
z^aL0I>WHKaDN@;W)Dh*2c2uT$pRM<pU`X=Pza*Ed-HEHZh#Ni3nG35MZp(wiVb}22
zt&#1d0Td_b<=yM;6<AMK^hy`(&qB8hgIL7&5Cv|*y;<>gie*e>CN>(a8L>NYJrw`t
z9}mlm^x?a<J4Y=-GG_$g3#G#NUF#9|mZiY;Lhd~gy9F<{#=2KpFTePzR5OPu>fFkP
zJnOHHsek$;r{Lvgy<9qf6!E4ni%1BcGF<aJ_e8W$q_TJa>BlfAm&YuA2Q$fZ{EHa0
z{JiY+id~iGrAngEKBi@f=-QXSiiOip8uON8{=A(nF6_7T_&}b-rFHwwxw{uFWb;6N
z{cr`ZfTZUE#nKVZ&FiqZi%*|x-*xpm=nzcAqKh1a+YcUgD-m0%Pd2=f3*fJ*ZM?Z+
zUP%fo5CF~^c@Iek?;H#WefbiBQ5`r_GIMR&@@?z0waN@L7jNpP+hJOh4i#XwWGH{<
z@GEdBFDf`LaT38_P5-to`K8UVc=byPCdYw2tl&-dRSoI5N?6}q&>3t5gdTGxO}Tzt
z9*hSu?_vOEnRreA%ox2qy?n&q*-o~gv5xMOyLlny4_+ol%-PVN=?Hat{3r}|+9>Zp
z3rf1a`OVaHDfS6}_I_@n-+={Z;%X2$Nia9ju{m=Ut9B}_#K6?PecpyY`y@AdmvwnJ
z|GxL>*=SbYc~2Z!`SbU(Uf7vkYFzm0Xw^8#J0%}pHIEV|@O`Z>b7lp}4v#weasS;w
zn^%~>p@GlRFQ<;Y=tZhoT7UV=gPDAH%ALD_#)w<3A!YmTXint2_k#%2lm+{0u|p~U
z9pTo&LiQT9Fq`LZoTDB8y;<L~qfj#OX8=`u|6?|)s@;3uz4G0K%r^Swo^)Ishb;7<
zY1Y==eVXvnbWhIZ;g~|b0cFayBjYk}9nQFlQuB6~inFp|{J`n_wY$ol<c{k+MRYhC
zVH)-7z1m}+RppwH>>ouuIOx2v<3Al}yLvGy@UdjvfRCtp4>7G|E6!SJxjaKVD~6d>
z&Th6LD)DFDZ2NKusX``mbwgOeP>R;WNp=!`$*JIN5|uti-|_U0ffq=%u##7#G&h~G
zr%-yt#QS{Hu7b$K>06Z){OH2?HaA@U9Ef#B3np(Va5Gz?*&<+uQY9U)o2=zUD|9At
z@6$gRy-`he2qaaAt+3Vn6QZ%_ou$q;ILCffZc|hCNYA*dfR;NFk$aP4c-rD>lO(uU
z_5EmoB~b6+Ut}gllx$4V;pEW|>g1z17C%jlC}(st{*#cg$)03fs@bg5Mz?O!UvuBB
zofh@dkMg_1PN}<t>|HoEZPw=FWke^BUM^n#D5N%eM>Aw{EBA2}sTddApcSD>)mfJq
zVQ~RtG;3NuTyPQkUGuvZ4{*n~+P?*Daei|Yw>yvyX6cq7l;M_L>T!I*U~lY5l3eHd
zBv4cOv%9N6tY22@y<&Y17qS(1FTX~^_{jq`^qRtKC+!20F843jj!>^rlSCWu#~IJr
zj`8ss831sQNb5t+^l}fjlYuC~GW7pm%g()gO+xXG?aM;#+=V)=WTptInj-ylr(7N#
zghqyyL6w8JgJack6sjU7y}8o`$VbFUd{(5W+LVV|H~SAxbIx6MOe&wxABRYGXaln_
zrk^f&y10iWrLd}Q_(?Y&2@An$OMP7i{NQ06h+$P!yz%Ao;lW&s^gFr9!$8JkEXL+%
z1|<n(eX26;n|*WiqY*{nu}^ie_#{l?&5vUT7^>eLp%D3$ar;F@)QaR7kD;UQat5mj
z9rbkq^FJ1%2EaWtQWmg*-_?Hq7>Hc_3F)5L6c*9xX(tv=?EiY<p(<~<J))9l(o!s_
z0Jd}uWPj%^jp3<77Zc0POisoRxOxaSOeJ){eAHH3saSB7x{|84e!TR*UY}dNu$o7A
z_?D9<)gS!LWwPA*p~?DY*L~q&<(PFKPk{6!10C__H*?et8^hY80v$_NHUV`eHKTnG
z(3bB<N!b`2N2q8h&QW<WdTpOZh+$`)pr+^F)5W|rM@!!(QUwCn2liV(KWOfB2b!HV
zi9#sR8m2ZRv0X`B)RMi1+qLIp!B?ULBu!};*1u2o6ehp*>>hM7c)bSaV^{ta%mvA8
z7j+sb<7?AmJXYPo_6$OCmg*B3NrF>q$H-M7i5<GQrDF26lgW3~;)r5cwwisuw!f>!
zP_LXN8Jrl__<e)4$L%k}k=#Mx*NmBDGQsaDWm_lYNrE4yRDkt5xjQ6AjoR69_nY+u
zd79o?D;)hjM(hE8#Hmq9)Q0}}&9G(Ja!X%UstU4L3)U#&Ld3>9PgDS}CAaZC=je8{
zQfizJ)Y_BZNRSrZ!!20ppV{KSL57g;>#j4*5Wen|V$w1E7pR|9<+CMJmZP3rqVKTJ
z$mC&E)z-h+y^=_7G^*R)FfE-R;z9y@b1=a|PZ#u8<r^ZI@$FJlCw>NM?p`%<|M*%E
zVN(Dqim6#6aWyjAkt#oaw$PU@KRW-N&*FYAjprlK7Hr<ZRis}r)ZlGmmS3HS6LAI}
z49AB&F51pa^NY%dcxjhUb^rVr&^D(smJDn3ULyHZYOLCljfV6;Ky@QeHSv@9b@vC%
zf@z>9%$B(g(~mYGHLsw>GM1}(pMCyGGg$||oqX`3UY<tpyN_P4Jo#C^E5oY7kIKk_
z`np&nwypN}HPIq8tUAx)lYIp>gfEOPY*^*{Df?V0!i>ZLuJ-4D^FB%x=xM~?x?&TV
zw3xtwpw-tLR!Tp*g(l=Yw+4T=`$Q(5d3tD+C&eUHJtoJ<VIsnrEYU1d+<}6Mn#a;H
zvaio<>wA<Sta)s%Z0f47NMjy;e)3w`n2k$oT;!bsqBh<d-xI<hoJhjjpUp9(!<2s)
zWabMaQNyq6y==BrB6{aoVdu}#cS*dCs+(L^Y0IMy?T172*gx<2_ekacg)Oet{+9nt
z$Tcx!Rt4l^cr3Jgny|DO$dxFlt(@5x?qL1E_QNE>o~x3#caed^^-Q4sLx;iTgpsOA
zIXF=VMmi!~QeVT7Kj&L4ak{cq#DN(w$P)()M;}q{b%Zo&qg$d=YM=kb>C^g$u3c^H
z9%feQnHK@ek8a%yvn0yzkGTEej?OA)4`@cSEMBw}rnAe(?Gij?e2-qM7JAWj;G3Bw
z=-*h_!%_e`Z#8V*=UPhY!K&%Yl}|JLq?sppNU9aV`(4q}ESx%nH+PReHt|l}dTe^Y
z{XNry6Elx@wEeq?nyC;N2{mT&lh6u9kC=~5U=wL_bdZ^Y+jBy-vSQfR=cbp66)A`E
zi-IKRmv~7c0iX=nx}kY+oOu7hZx?=-n78-R$e;EBB**wmT`WoT`Fw|3nQGDOgMm-W
zbM<82#s7^=?F1c@>;jqMqd>2JycDOb1I6Ixh8T3QpLXp-_Bc{dH%W3)U2OkE09t=b
zAx_T7y{6HvHi0K@YCYS-!(N@>iF+ZdCVkj<^tYhNzFc;JjHLA~Y4tUxm+Ev{4W0|O
zUv9^2$h|=DEvG8a`7_&J9F1m7Yw}hg5!rSHD|QaqWAZchxE)Y`k0X$RNYV~`Es_L1
z$YN3roArmcg^EPVsn6`^B5{hs9Vewo`vz7rYJkMacASKR^#0$&S*cH?F<XyPV6t~_
zK1r;ciZo9y{Ph*d0Yl^i$#1ptayX3iWj<#H0$fQ)-@)mWd_2MOJ}N|}#JyGM-*o$}
za;KG$Z2vc)SCb2q+0juXT>Yc*1GNS?+%)m&SCfRjOOLIjOKu)~AIdkw7njeBucZzx
zU}vu^8oppLzjii^V78>(A=x2|8(piG2qvH0Z8ijsZvs76skh?`Xr)R|Pi1(4v5HZb
zp1?V(^C2aAdVEezocGFA3p5kIALjdGA?a+Wxlvv7+3yFW=9=D@%L@^Lb6A9n*DO^S
zlU;os9>_@jFm9JgR<5>~G3_bo5gD^v(GPaDb+QS^?4rwdyc7=AS5Bmdak#c(_ho-f
z{#MS9yRSY-FG@vB#xx}=6NWoW;V)U}8!Jy~$yTUetR|n6UZfA&{F`s)!Clo)N0<5C
z{Q$PHB}jO3Uyb?i&7BqwuRC_4yjF65Wk*ZiURQmNIaLArd<95n63%yBcm?iPDL(N)
zhC$41sL^(g5cwzfNMP|kr1U(;hbOw<ZOyn~v)E4ZZXgdzQ}jstu%;<Ln*T|-x<;?R
zG0;bfUJnS=^S?_vdZLQz4+<nd>hNI=e`5Nmx7QisU`6B0`jopjsQCajsWxdk{vnl;
zo!4P^pa1WnaOV$EktXt#idqX}|9TNwQJ+YXc=X!$NUn8Xqc_z%F(gJ`=#^+>If@q~
z-h<0l75E%qiL>hXJsGK=&}n`-v_TYN0cu2x9}|6V=l>j&Xdky#t6ZY94~yL;VA5vb
zjU1OJy{oRN<uCDL%O!<B6BM}^_R%p~A-?gK|4pIIgc~l=P9C4d%}ioAZAkT<b3;Hx
zq1zxM>U84Xu+J_}*2ob_BmDce@7cz)RZ1pH*Je8ncYoZqefpiO#TsJF8+>|Mty)1G
zS$@N0ktm{x^>GGPO--qy$1DRIto~-9_lVg_?r~Wqu+AEvDXB^}`mnxGBkdkQcMro|
z4cFw<Z}c-&FO>W5Zu1BVUOz+_wmE@ZxODNK^l-{ffxv_opLKyP3GBFEJA&}3M{vC5
z*TVpYvPc`HMcMu!Gb$;!X7-qc(d_2eN3|9GeLPESma^j8?MDX9<rCo+MYS%JeB|SD
z{xu}g7?E-k>&Bf$+y1*?g6X*&O5q3u!Z@i)lJOq=uUQ-{R^Wn<&%<MA-Hi~|p0?RS
zqb@wc!2T=hR&`PR?~5s%N|HbK7zv#2RH%kY6ctt`Ak<*9fN+HD2AEa-W#!H=Ai_G4
zrt~{L-?y*d`&1#oWN9|T#FEBP<vT7~;y6LC0uZ8fQRRBPpy=b$3J1qepkQeK9Y%J9
zA)C%4S408;DQ@*NMEgWykTUcsAMc{|tt#;!9e1|XC|#QSZbbvljZ7(|bKKCdYTUQs
z0i-gDLxOF+`+faS)sFvD0!?7v|J5e8xT13d4mPuxP01#JIG_Aqg^qy#r@0Jy#Dun4
zg2E#8BQkqSDgokGAk1OQ!=afDYM=*uD%b2Cyv4QXZESUz+{@gYh$3rtK!)o@=Kge6
zF`>;^RS>x1+5W3u<#z&94LzwlE`Z1LVY;{i0ih9akZ@e_{EEI*308wb5dRYiD4%a=
z#i4qDvJ7-l2(eh+8(PT6V+pfKxs^7>vA(y`=2&oTpRMt^K|R5lT9gt5FZN~Rt+pBR
zrR)7Pu9{ed9nMYB|AZH$D+20grCgH^2IyidptQe2z_0mkmC;L3Hya{&N3~7)+<@s7
zpvP)I@<CXfhgyx<J_$BJ_RZva^8~6ubsINXg*te)yYDmVJse{c{4Z1`=rCxM1L1HO
z&eg#~7S$C0NtoPkn7|VIGQ-9&<L9Vme`ss_aXwr#EcI<Ak&Pj3np?A`76u&7o}9vJ
zL`z-%5w01(`G=9;2l4!QYG?Yfz407P4kw^BJ2LN^00GnY<wS|&4&hwgJP1|Q5M@9z
z?!6V}OGAD-7n#te%}A)9>({Gf-24<(su+GfvauQ6`iv|KXdJ17^h*<79Ea~5mX#>5
zhw+f9(;geF;Tb^HtC!Y<g%o&x*)cCW6XhGyrY_9{y*kc?C!6msS_G>=wQ}T)|6f^M
zLn$>s9p7<xzcwbSoR1w<C3waCOEerZi$5GM3>SuQi3jbOMTl<84B-Q;Nc$iL@k-Vo
z=CUm{#I`|=<VP^6$|;}gF_HE^`SktNY1ITp&%=nmg%zd35IlH`BYc)quDRJnqqL>w
z79S`p-akr2M9Gh*juPs?=BY^whpUoh@TDR=dSv*!nGqWfn2^qcYF{YIilc+Ouh8XP
z*M;xmW5nW%`O;ZVu4XrDTGS#a?0*pqDxMk}&sQ~fVM7==+x#NO8DKuCis@^w+8^H1
z5!L^&iji&E`8_urs7=6^7CEf~u%cNUw)QxluK@_d)m@U2+b4rMDDeD;V>F_?Aweg1
z4<i7ma^D2|7MG)fYItVJ6yC+D^f|{b<@hyU)w6fA9RZ~SoFO}~BspsNVt^3&>1VK}
zuSH&}25V-R3|`#QBcBT!+VCdvXublV3BCWJPdwYyP*uQAP};<)B+&DzPri7#BEmOd
z;>D{=K!ibr?rhdB<<^p7mvPl9UTk|V(+RPb?XzV4riBWH{k^pU-3EH}nEzaR-U|JJ
zhqN@--TA4%tbdTgmk#L^?f`fhK-(bPqpv@xW;|IGF3SGb*;RYEDFFZ*Zkf#EjE&^V
zHdsG^+c?IqFpnKCx!^VMW}k=|q&xm$7y#oaP5jt&MdJA4mr;gq*Bk&Lf+*hz^<(ce
zr=jZj{f5DRaIs*5TE0Y^{T9ULr#VE+s|8`JkJI?#Q_ukZ>(8!Qiq2qcfXhJs0t%AG
zEmjn{{63Y}1os9?fIt3i$$L#Kc%s61>px!uP!O8p&G`>ZYuf<Sp#&y3Yxl`89RK(r
z!6?*YNe;Bn0`(cYWxzVZVBd<BrM2N0E^0Z#5t2i)4Hl#c;-J+a82sWptAeMq^B@lq
zw~+>POh)T}$!c~4#J&&ZI|4}TrrMZ_HQ;V4efjb)5rC;dzZ<zrfAS1sN|QM?o9&%G
zZ1`*4X!(jJ?I&e;Tl=zA;_N7`Kfe}3su|03H~x!$Z(GA1s6}hgaBKJ22Jx~DDp6gQ
z5<l8FK`Ny^R`^sdBdpa>5e4=uPh#7y<^uR~Kfv%EZH!~nt&iSiET^tHxLb$tuRPOX
ztBe}*!K5vxzKFWK7o;`nh%i)DOm4S1*Cf8P$!lgs-1!@TsViE4R|B!eTLVZb<Iwls
z6r6!zT1~e3`S-MNZ+JU91^D0t-#ckc^VXwuFKv-`d~r4#`2DETo~?P!AnC{5rhE~4
zb%1xK)CK-eeo{7!7PS&Wly7`S0%J)|%};${va<EB54Wq*VT*g4k(VL++jGWcVd~M6
z!)cyVS8o=8*VAY2ztuX(95!w6TvE^u)))rz&mZSHj*?d|_ET(9pT7$2UHksLFMW8W
zg;Edf%C`NvNcV#M*~5&i&RTIa<u)}hn}Q$5k_(l5*^6{3?Q`|v_$oQmzK+tvw5pb_
zhFbt=0GDMKu1hK4{AYkFrby}1DbR}C21ww<+OvV!l*+ayaD-Nn8=FKJG_fZ?p&0Bq
zaGnTG);g<zIq7O0WDnbz^e6AkD+jA12oBS6Zz}gBNP^mq<KN$LUM3@oGyX6flz;RE
zK@hJ%t9sM3*^Fd1w%G}J()sbXL`I&pK+~J84_zqv0!ji%V=J&kY2ySF>-B_)cSHE7
zWxVIB@;-rWwInJqo&(OGj#A_Cbl^Pj%P+IJo*7*x)bizGslZwj17Y6aweplw0vVvi
zFkA#`9`8R)X!}*ZFKxL&iM-u$bQ_-*#Z-QgFqy95D5ZzXPMKaGQ?-{H)1s9m`3Fr?
zntB1}iTT8fN1+<oKh}h+NW*x$o%mS7=Bop|xBwdrE|In>so}P3qo=eBm_qABIeLE0
zaA^<TqU3}L_KR-U06Z{tbA?Ex&fr8T1-uv6aa96)g4<BpKm65wnYI2B9H0_a92)Tm
zL|1`N!ap-~$TN*c=ANh)U_wvF{b6p60`TqRP;3bEaa%ERK%z?zeK$}*6dprO$gV{z
z_Q|L}!svx=kBnKST&1EG1oGX1rx$lxdg<Xv9)#`Zfza1x`G8>LV!;AHEuC7@H}Qhr
zCXn&a@k63FIwC`@fGA3{My3mw-m!B0ilMUoKSCoP#VHh+6WU;0z4#I$VfMSrT=nhX
zBRe4B@R2JTye50D{6e-liw=x)_BJ7P=x=rr{=<!x!5-(JbYijUP2rv-b7meB*o`OP
zu}w$m=1@bMs?z}{mF3bckH2+NJsp!7M0RWw0fjo_EV(5boA`%J8&ZH{?3`m`X|T&#
zCY?Ci-XNQjKRVLFu4BHa&3)vMYb?pR8Euxks027%#dR=?w*S}MMa#_A=MZZ_Io8jI
zsP`ZOepgb$2UF^`*A|qOp&ySPeq^A<6{H*J!Rl<4)&f?IK`}1e3jA3^S{@UpMZ=@a
z%C;Mq=i@Kyb%}1Xiy(KzRfePccqQ=p1M{GtG!tS)H5?ev_u?RyR=+~xI11{h80{I-
z&k6k?1}7W9nR3o&!_C!8DWUoQnBdHQs7MSB^gG7qB-(_v2b^!#3lM!^OTn;XjC{p8
zK#dhnVXrSOGP&Fw<~3#AE4~E^fy^pii-dn5u}{GRG1R*Uw)Sy-Mss;MghUD`scy!2
z2J)PcN+tDC(cWh&v+_+5$JtQI9gwgMCJ*`wTo5%qwUd4!Gs|gipm=MbtY0Mjzy_?_
zkiH*0M84C<fTM%$))Qs^EM_#(&a7zl+Nhrfg@434$)4f-WKda|6~4ARWY%u<Lw93x
zu-v)jK9V4V#>?Ax%LIb?m;<X9;8CTc5jaCo6|$MNkI*74x9Lt>(<4Oyu5A|f+Qdcm
ztwd=ph7EfNa*Jx$>YKk1JIygmPf;3q@zCj=U8q->#@A=dF7|Q2R#55IU7Se)y4PJD
z6jI@|H9;ggs~bGywY#jINd~&YOClLP(|P@sJMF0Kd0;pcD06#tNf?wiz3A7%&0)JK
zACC0iX-e!W7v~3k;}by7-ntp;<q6$rZf&e%!O(WSqygIiXaP1bSAas5Nh8dlTFPk;
zYE`ZMuNuYO$4QYQ4D!}~J;Fy4^cO4L5hG68Fw^oCq4nqFciLT3MthjIB`i5@r6A?Y
zw;!t0cUr~};U&8Y3kO2$DJp4ruKs2@A^8byP1Fu`+Ar!<M6n^98h6g94=ZA%tJ0o<
z*q+!3bSZ(z?)HR33YW?OC-I%kr;YnpQ9Ax<^4&JvJ8b_5X_MJT{t2`!OOj!&PMg!^
zzp*%t9O%~}nxtkS{>Z|HC%5KX{4<(EL`<__Lkf0zU=_pp_|_|4wi!AA*d(hM950<T
z#}@R$l~fOLVBrEw%+(G@1w^8jOut$$2sm4`UZP-}oD{la3iC60^iH2Mb#GM4No8F&
zupDq#_OANir$Pcpxz)UbuvF|YMpKJh{??bx1sSkZ$fy*6wb}GrF}8j6lQ;__<fSsx
z>JeWIfs9@YgWe@pzy!xw+;;LT2QjKzMz!wN%=2*}CD0sD+_L}4(OqC_7Nj458C5!=
z1tpg+<U2`tHyR8cc4_4EcTs>^{<G|PjCB~|Z6!YKKHU)uKnrHzE<bO4Ns(FbF{PM#
zRB3X_5kjiuMe7{|{3FLZORD^o&RU3gW#{0~zJsNwe=}=eW`w^*eU+I=g%EAnt0=~`
z3$S8?h=X<$2OU!<h9~s2R=>R{%v>e^N?P-D#Yb#6EcUwe_*Iphi%-pcW3Jo%g3ka6
ze{v<s%tTc_T(>_W=X_Lhv0P+oawgYv1I+>dJa>LP1_`x&rGWUn*QBuB=#LIMIpWsY
zW%|DCk0fPRQp<ma2lI+<*PBTcmyjDY2sxZ8THK6(pPxT;v-JU1UG2S-pqI`pDo*@n
z)7HnA^r?T(gH(&zxc{vF!B4GsnH-pwOA+LYl{-BKRdzO-pQ{Bbo;jX*K%2OyutqK4
z02aL_!i^Lte0(>tExXkPmxVOvqIEjkh?#AQo}$^Z1B)_4<ilzRw;9(G0kPGp<LA2Y
zQ%6~vRBwIaLxYVXJ~mXlCQ^K^q`c~_{e#BU2hX?1KLproG=7A{{+!0FkcFEX6RrFT
zT&@lpa2TY*nB5n1;r{YZ=VML-%Z|2LQ&ewtx#Cwdg-;1HyO|+IhE3vVNN%!>X>&C9
zN_xsOf;_V3dvU=IfOlA>1G#wA)9Pezt3B576%9jM+AlRM$Wj=RHL?7mi!lH1$%*Jt
z;R-*#o86X75F6=k?l5(9sOY~ib?-crAm<cYguF>7+yA%6MpOyGkv9bNbPp?&>~1)L
QhhXl2HT2c1Rqdkw4{MjHQUCw|

literal 0
HcmV?d00001

diff --git a/doc/topics/runner_fleet_design_guides/index.md b/doc/topics/runner_fleet_design_guides/index.md
new file mode 100644
index 0000000000000..5821c4096b674
--- /dev/null
+++ b/doc/topics/runner_fleet_design_guides/index.md
@@ -0,0 +1,18 @@
+---
+stage: CI
+group: Runner
+description: Runner Fleet.
+info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+---
+
+# Getting started
+
+DETAILS:
+**Tier:** Free, Premium, Ultimate
+**Offering:** Available on GitLab.com, Self-managed
+
+This section provides a set of best practices to successfully set up GitLab Runner.
+
+## GitLab Runner fleet configuration and best practices with the Kubernetes executor
+
+Always wonder what are the steps to follow to successfully configure GitLab Runner with the Kubernetes executor? This [getting started documentation](gitlab_runner_fleet_config_and_best_practices.md) provides the information you need to achieve this goal.
diff --git a/doc/user/group/saml_sso/index.md b/doc/user/group/saml_sso/index.md
index 31ebc681a304b..4839ca2479a3f 100644
--- a/doc/user/group/saml_sso/index.md
+++ b/doc/user/group/saml_sso/index.md
@@ -182,7 +182,7 @@ To set up OneLogin as your identity provider:
 ### Configure assertions
 
 NOTE:
-The attributes are case-sensitive.
+The attributes are case-insensitive.
 
 At minimum, you must configure the following assertions:
 
diff --git a/doc/user/group/saml_sso/troubleshooting.md b/doc/user/group/saml_sso/troubleshooting.md
index 0008e59c4cf73..8ea178350cb19 100644
--- a/doc/user/group/saml_sso/troubleshooting.md
+++ b/doc/user/group/saml_sso/troubleshooting.md
@@ -277,9 +277,24 @@ you must set `attribute_statements` in the SAML configuration to
 
 ## User sign in banner error messages
 
-### Message: "SAML authentication failed: Extern UID has already been taken"
+### Message: "SAML authentication failed: SAML NameID is missing from your SAML response."
 
-This error suggests you are signed in as a GitLab user but have already linked your SAML identity to a different GitLab user. Sign out and then try to sign in again using SAML, which should log you into GitLab with the linked user account.
+You might get an error that states `SAML authentication failed: SAML NameID is missing from your SAML response. Please contact your administrator.`
+
+This issue occurs when you try sign into GitLab using Group SSO, but your SAML response did not include a `NameID`.
+
+To resolve this issue:
+
+- Contact your administrator to ensure your IdP account has an assigned `NameID`.
+- Use a [SAML debugging tool](#saml-debugging-tools) to verify that your SAML response has a valid `NameID`.
+
+### Message: "SAML authentication failed: Extern uid has already been taken."
+
+You might get an error that states `SAML authentication failed: Extern uid has already been taken. Please contact your administrator to generate a unique external_uid (NameID).`
+
+This issue occurs when you try to link your existing GitLab account to a SAML identity using Group SSO, but there is an existing GitLab account with your current `NameID`.
+
+To resolve this issue, tell your administrator to re-generate a unique `Extern UID` (`NameID`) for your IdP account. Make sure this new `Extern UID` adheres to the [GitLab `NameID` constraints](index.md#manage-user-saml-identity).
 
 If you do not wish to use that GitLab user with the SAML login, you can [unlink the GitLab account from the SAML app](index.md#unlink-accounts).
 
diff --git a/doc/user/project/settings/import_export.md b/doc/user/project/settings/import_export.md
index 2efe76ab028a8..4dade4c12340f 100644
--- a/doc/user/project/settings/import_export.md
+++ b/doc/user/project/settings/import_export.md
@@ -187,11 +187,13 @@ For a quick overview, items that are exported include:
 - Protected branches and tags
 - Push rules
 - Emoji reactions
-- Project and inherited group members, as long as the user has the Maintainer role for the
-  exported project's group or is an administrator
+- Direct project members
+  (if you have at least the Maintainer role for the exported project's group)
+- Inherited project members as direct project members
+  (if you have the Owner role for the exported project's group or administrator access to the instance)
 - Some merge request approval rules:
-  - [Approvals for protected branches](../merge_requests/approvals/rules.md#approvals-for-protected-branches).
-  - [Users that are eligible approvers](../merge_requests/approvals/rules.md#eligible-approvers).
+  - [Approvals for protected branches](../merge_requests/approvals/rules.md#approvals-for-protected-branches)
+  - [Eligible approvers](../merge_requests/approvals/rules.md#eligible-approvers)
 
 #### Project items that are not exported
 
diff --git a/doc/user/workspace/gitlab_agent_configuration.md b/doc/user/workspace/gitlab_agent_configuration.md
index d4df736173845..5e83416b3a76b 100644
--- a/doc/user/workspace/gitlab_agent_configuration.md
+++ b/doc/user/workspace/gitlab_agent_configuration.md
@@ -315,7 +315,8 @@ You cannot create new workspaces for a user when:
 - The number of workspaces for the user has reached the defined `workspaces_per_user_quota`.
 - `workspaces_per_user_quota` is set to `0`.
 
-However, if the quota is reduced below the number of currently running workspaces for a user, the user's workspaces will _not_ be automatically terminated.
+If `workspaces_per_user_quota` is set to a value below the number of existing workspaces for a user,
+the user's workspaces are not terminated automatically.
 
 The default value is `-1` (unlimited).
 Possible values are greater than or equal to `-1`.
diff --git a/lib/gitlab/email/receiver.rb b/lib/gitlab/email/receiver.rb
index 61bdb7c09a563..ccaf45ed6ff16 100644
--- a/lib/gitlab/email/receiver.rb
+++ b/lib/gitlab/email/receiver.rb
@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require_dependency 'gitlab/email/handler'
-
 # Inspired in great part by Discourse's Email::Receiver
 module Gitlab
   module Email
@@ -62,37 +60,37 @@ def mail_metadata
       end
 
       def mail
-        strong_memoize(:mail) { build_mail }
+        # See https://github.com/mikel/mail/blob/641060598f8f4be14d79bad8d703e9f2967e1cdb/spec/mail/message_spec.rb#L569
+        # for mail structure
+        Mail::Message.new(@raw)
+      rescue Encoding::UndefinedConversionError,
+        Encoding::InvalidByteSequenceError => e
+        raise EmailUnparsableError, e
       end
+      strong_memoize_attr :mail
 
       private
 
       def handler
-        strong_memoize(:handler) { find_handler }
-      end
-
-      def find_handler
         Handler.for(mail, mail_key)
       end
-
-      def build_mail
-        # See https://github.com/mikel/mail/blob/641060598f8f4be14d79bad8d703e9f2967e1cdb/spec/mail/message_spec.rb#L569
-        # for mail structure
-        Mail::Message.new(@raw)
-      rescue Encoding::UndefinedConversionError,
-             Encoding::InvalidByteSequenceError => e
-        raise EmailUnparsableError, e
-      end
+      strong_memoize_attr :handler
 
       def mail_key
-        strong_memoize(:mail_key) do
-          find_most_concrete_key_from(to) || key_from_additional_headers
-        end
+        find_most_concrete_key_from(to) || key_from_additional_headers
       end
+      strong_memoize_attr :mail_key
 
       def find_most_concrete_key_from(items)
         find_first_key_from(items) do |email|
-          Gitlab::Email::ServiceDesk::CustomEmail.key_from_reply_address(email) || email_class.key_from_address(email)
+          # First handle reply key from custom email to fix forwarding behavior in MS O365.
+          # https://gitlab.com/gitlab-org/gitlab/-/issues/426269
+          Gitlab::Email::ServiceDesk::CustomEmail.key_from_reply_address(email) ||
+            email_class.key_from_address(email) ||
+            # Also perform direct check for custom emails. Some email providers
+            # don't set the forwarding target email in headers.
+            # https://gitlab.com/gitlab-org/gitlab/-/issues/496396
+            Gitlab::Email::ServiceDesk::CustomEmail.key_from_settings(email)
         end
       end
 
@@ -170,15 +168,14 @@ def x_original_to
       end
 
       def recipients_from_received_headers
-        strong_memoize :emails_from_received_headers do
-          received.filter_map { |header| header.value[RECEIVED_HEADER_REGEX, 1] }
-        end
+        received.filter_map { |header| header.value[RECEIVED_HEADER_REGEX, 1] }
       end
+      strong_memoize_attr :recipients_from_received_headers
 
       def ignore_auto_reply!
-        if auto_submitted? || auto_replied?
-          raise AutoGeneratedEmailError
-        end
+        return unless auto_submitted? || auto_replied?
+
+        raise AutoGeneratedEmailError
       end
 
       def auto_submitted?
diff --git a/lib/gitlab/email/service_desk/custom_email.rb b/lib/gitlab/email/service_desk/custom_email.rb
index 2d2ca20aa115e..c7e99750d8b4e 100644
--- a/lib/gitlab/email/service_desk/custom_email.rb
+++ b/lib/gitlab/email/service_desk/custom_email.rb
@@ -30,11 +30,25 @@ def key_from_reply_address(email)
             settings = find_service_desk_setting_from_reply_address(email, key)
             # We intentionally don't check whether custom email is enabled
             # so we don't lose emails that are addressed to a disabled custom email address
-            return unless settings
+            return unless settings.present?
 
             key
           end
 
+          # Checks whether the given email is a custom email and returns
+          # the project's mail key.
+          def key_from_settings(email)
+            return unless email.present?
+
+            # Normalize custom email to also include verification emails.
+            potential_custom_email = email.sub(ServiceDeskSetting::CUSTOM_EMAIL_VERIFICATION_SUBADDRESS, '')
+
+            settings = ServiceDeskSetting.find_by_custom_email(potential_custom_email)
+            return unless settings.present?
+
+            settings.project.default_service_desk_subaddress_part
+          end
+
           private
 
           def find_service_desk_setting_from_reply_address(email, key)
diff --git a/lib/gitlab/email/service_desk_receiver.rb b/lib/gitlab/email/service_desk_receiver.rb
index e286cf1f68c34..4edd7fac6f129 100644
--- a/lib/gitlab/email/service_desk_receiver.rb
+++ b/lib/gitlab/email/service_desk_receiver.rb
@@ -5,11 +5,12 @@ module Email
     class ServiceDeskReceiver < Receiver
       private
 
-      def find_handler
+      def handler
         return unless mail_key
 
         Gitlab::Email::Handler::ServiceDeskHandler.new(mail, nil, service_desk_key: mail_key)
       end
+      strong_memoize_attr :handler
 
       def email_class
         ::Gitlab::Email::ServiceDeskEmail
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 141798d91680e..97a6cdef1530d 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -3821,12 +3821,6 @@ msgstr ""
 msgid "AdminArea|total billable + total non-billable"
 msgstr ""
 
-msgid "AdminCustomModels|Custom Models"
-msgstr ""
-
-msgid "AdminCustomModels|Manage GitLab Duo by configuring and assigning self-hosted models to AI-powered features"
-msgstr ""
-
 msgid "AdminDashboard|Error loading the statistics. Please try again"
 msgstr ""
 
@@ -3959,6 +3953,9 @@ msgstr ""
 msgid "AdminSelfHostedModels|Manage AI models that can be used for GitLab AI features."
 msgstr ""
 
+msgid "AdminSelfHostedModels|Manage GitLab Duo by configuring and assigning self-hosted models to AI-powered features"
+msgstr ""
+
 msgid "AdminSelfHostedModels|Model"
 msgstr ""
 
@@ -4952,9 +4949,6 @@ msgstr ""
 msgid "Administrators are not permitted to connect applications with these scopes: %{code_open}api%{code_close}, %{code_open}read_api%{code_close}, %{code_open}read_repository%{code_close}, %{code_open}write_repository%{code_close}, %{code_open}write_registry%{code_close}, %{code_open}read_registry%{code_close}, and %{code_open}sudo%{code_close}. To permit this, change the %{code_open}disable_admin_oauth_scopes%{code_close} setting using the API."
 msgstr ""
 
-msgid "Admin|AI-powered features"
-msgstr ""
-
 msgid "Admin|Abuse reports"
 msgstr ""
 
@@ -4982,9 +4976,6 @@ msgstr ""
 msgid "Admin|Deploy keys"
 msgstr ""
 
-msgid "Admin|Features"
-msgstr ""
-
 msgid "Admin|Geo"
 msgstr ""
 
@@ -50662,6 +50653,15 @@ msgstr ""
 msgid "SecurityReports|These vulnerabilities were detected in external sources. They are not necessarily tied to your GitLab project. For example, running containers, URLs, and so on."
 msgstr ""
 
+msgid "SecurityReports|This project has reached the maximum number of vulnerabilities it can contain and some of the vulnerabilities couldn't be ingested."
+msgstr ""
+
+msgid "SecurityReports|This project has reached the maximum number of vulnerabilities it can contain. New vulnerabilities will not be created."
+msgstr ""
+
+msgid "SecurityReports|This project is reaching the maximum number of vulnerabilities it can contain."
+msgstr ""
+
 msgid "SecurityReports|This selection is required."
 msgstr ""
 
diff --git a/rubocop/cop/gitlab/doc_url.rb b/rubocop/cop/gitlab/doc_url.rb
index 79e25142f262a..ef085d073a669 100644
--- a/rubocop/cop/gitlab/doc_url.rb
+++ b/rubocop/cop/gitlab/doc_url.rb
@@ -12,7 +12,7 @@ module Gitlab
       #   _('See [the docs](https://docs.gitlab.com/ee/user/permissions#roles).')
       #
       #   # good
-      #   docs_link = link_to _('the docs'), help_page_url('user/permissions', anchor: 'roles')
+      #   docs_link = link_to _('the docs'), help_page_url('user/permissions.md', anchor: 'roles')
       #   "See #{docs_link}."
       #   _('See %{docs_link}.').html_safe % { docs_link: docs_link.html_safe }
       class DocUrl < RuboCop::Cop::Base
diff --git a/spec/controllers/projects/compare_controller_spec.rb b/spec/controllers/projects/compare_controller_spec.rb
index 662d2920e124c..933258f5b66de 100644
--- a/spec/controllers/projects/compare_controller_spec.rb
+++ b/spec/controllers/projects/compare_controller_spec.rb
@@ -503,10 +503,16 @@
         project_id: project,
         from_project_id: from_project_id,
         from: from_ref,
-        to: to_ref
+        to: to_ref,
+        straight: straight,
+        to_project_id: to_project_id
       }
     end
 
+    let(:straight) { false }
+    let(:to_project_id) { nil }
+    let(:from_project_id) { nil }
+
     context 'when sending valid params' do
       let(:from_ref) { 'awesome%2Ffeature' }
       let(:to_ref) { 'feature' }
@@ -530,6 +536,48 @@
           expect(response).to redirect_to(project_compare_path(project, from: from_ref, to: to_ref, from_project_id: from_project_id))
         end
       end
+
+      context 'when straight is true' do
+        let(:straight) { true }
+
+        it 'redirects to project_compare_with_two_dots_path' do
+          create_request
+
+          expect(response).to redirect_to(project_compare_with_two_dots_path(project, from: from_ref, to: to_ref, from_project_id: from_project_id))
+        end
+
+        context 'when the source and target are the same project' do
+          let(:from_project_id) { 'the_same_project_id' }
+          let(:to_project_id) { 'the_same_project_id' }
+
+          it 'does not include from_project_id in the params' do
+            create_request
+
+            expect(response).to redirect_to(project_compare_with_two_dots_path(project, from: from_ref, to: to_ref))
+          end
+        end
+
+        context 'when the source and target are not the same project' do
+          let(:from_project_id) { 'from_project_id' }
+          let(:to_project_id) { 'to_project_id' }
+
+          it 'includes from_project_id in the params' do
+            create_request
+
+            expect(response).to redirect_to(project_compare_with_two_dots_path(project, from: from_ref, to: to_ref, from_project_id: from_project_id))
+          end
+        end
+      end
+
+      context 'when straight is false' do
+        let(:straight) { false }
+
+        it 'redirects to project_compare_path' do
+          create_request
+
+          expect(response).to redirect_to(project_compare_path(project, from: from_ref, to: to_ref, from_project_id: from_project_id))
+        end
+      end
     end
 
     context 'when sending invalid params' do
diff --git a/spec/db/schema_spec.rb b/spec/db/schema_spec.rb
index 7d1d634521eb7..b07b865a6f603 100644
--- a/spec/db/schema_spec.rb
+++ b/spec/db/schema_spec.rb
@@ -130,7 +130,7 @@
     gitlab_subscription_histories: %w[gitlab_subscription_id hosted_plan_id namespace_id],
     identities: %w[user_id],
     import_failures: %w[project_id],
-    issues: %w[last_edited_by_id state_id],
+    issues: %w[last_edited_by_id state_id correct_work_item_type_id],
     issue_emails: %w[email_message_id],
     jira_tracker_data: %w[jira_issue_transition_id],
     keys: %w[user_id],
diff --git a/spec/factories/packages/conan/package_revision.rb b/spec/factories/packages/conan/package_revision.rb
new file mode 100644
index 0000000000000..7c8a6bcdcda31
--- /dev/null
+++ b/spec/factories/packages/conan/package_revision.rb
@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :conan_package_revision, class: 'Packages::Conan::PackageRevision' do
+    package { association(:conan_package) }
+    association :project
+    package_reference { association(:conan_package_reference) }
+    sequence(:revision) { |n| Digest::SHA1.digest(n.to_s) } # rubocop:disable Fips/SHA1 -- The conan registry is not FIPS compliant
+  end
+end
diff --git a/spec/frontend/merge_requests/list/components/merge_requests_list_app_spec.js b/spec/frontend/merge_requests/list/components/merge_requests_list_app_spec.js
index 97416f3b47dc9..1ce17e781372d 100644
--- a/spec/frontend/merge_requests/list/components/merge_requests_list_app_spec.js
+++ b/spec/frontend/merge_requests/list/components/merge_requests_list_app_spec.js
@@ -89,6 +89,7 @@ function createComponent({
       rssUrl: '',
       canBulkUpdate: true,
       environmentNamesPath: '',
+      defaultBranch: 'main',
       ...provide,
     },
     apolloProvider,
@@ -574,4 +575,26 @@ describe('Merge requests list app', () => {
       }
     });
   });
+
+  describe('target branch link', () => {
+    it.each`
+      defaultBranch | targetBranch    | exists   | existsText
+      ${'main'}     | ${'main'}       | ${false} | ${'does not render'}
+      ${'main'}     | ${'new-branch'} | ${true}  | ${'renders'}
+    `(
+      '$existsText target branch link when default branch: $defaultBranch and targetBranch: $targetBranch',
+      async ({ defaultBranch, targetBranch, exists }) => {
+        const response = JSON.parse(JSON.stringify(getQueryResponse));
+        Object.assign(response.data.project.mergeRequests.nodes[0], {
+          targetBranch,
+        });
+
+        createComponent({ provide: { defaultBranch }, mountFn: mountExtended, response });
+
+        await waitForPromises();
+
+        expect(wrapper.findByTestId('target-branch').exists()).toBe(exists);
+      },
+    );
+  });
 });
diff --git a/spec/frontend/merge_requests/list/mock_data.js b/spec/frontend/merge_requests/list/mock_data.js
index c816a84449dc5..ac6184c4758b6 100644
--- a/spec/frontend/merge_requests/list/mock_data.js
+++ b/spec/frontend/merge_requests/list/mock_data.js
@@ -62,6 +62,8 @@ export const getQueryResponse = {
             conflicts: false,
             sourceBranchExists: true,
             targetBranchExists: true,
+            targetBranch: 'main',
+            targetBranchPath: '/target-branch',
             approved: false,
             approvedBy: {
               nodes: [
diff --git a/spec/frontend/projects/your_work/components/app_spec.js b/spec/frontend/projects/your_work/components/app_spec.js
index 4ee84aac0745f..f0b65a6f2f229 100644
--- a/spec/frontend/projects/your_work/components/app_spec.js
+++ b/spec/frontend/projects/your_work/components/app_spec.js
@@ -18,6 +18,8 @@ import {
   PERSONAL_TAB,
   MEMBER_TAB,
   INACTIVE_TAB,
+  FILTERED_SEARCH_TOKEN_LANGUAGE,
+  FILTERED_SEARCH_TOKEN_MIN_ACCESS_LEVEL,
 } from '~/projects/your_work/constants';
 import { RECENT_SEARCHES_STORAGE_KEY_PROJECTS } from '~/filtered_search/recent_searches_storage_keys';
 import {
@@ -33,8 +35,11 @@ import { OPERATORS_IS } from '~/vue_shared/components/filtered_search_bar/consta
 import FilteredSearchAndSort from '~/groups_projects/components/filtered_search_and_sort.vue';
 import projectCountsQuery from '~/projects/your_work/graphql/queries/project_counts.query.graphql';
 import { createAlert } from '~/alert';
+import { ACCESS_LEVEL_OWNER_INTEGER } from '~/access_level/constants';
+import { QUERY_PARAM_END_CURSOR, QUERY_PARAM_START_CURSOR } from '~/graphql_shared/constants';
 import createMockApollo from 'helpers/mock_apollo_helper';
 import waitForPromises from 'helpers/wait_for_promises';
+import { programmingLanguages } from './mock_data';
 
 jest.mock('~/alert');
 
@@ -47,15 +52,7 @@ const defaultRoute = {
 
 const defaultProvide = {
   initialSort: 'created_desc',
-  programmingLanguages: [
-    { id: 5, name: 'CSS', color: '#563d7c', created_at: '2023-09-19T14:41:37.601Z' },
-    { id: 8, name: 'CoffeeScript', color: '#244776', created_at: '2023-09-19T14:42:01.494Z' },
-    { id: 1, name: 'HTML', color: '#e34c26', created_at: '2023-09-19T14:41:37.597Z' },
-    { id: 7, name: 'JavaScript', color: '#f1e05a', created_at: '2023-09-19T14:42:01.494Z' },
-    { id: 10, name: 'Makefile', color: '#427819', created_at: '2023-09-19T14:42:11.922Z' },
-    { id: 6, name: 'Ruby', color: '#701516', created_at: '2023-09-19T14:42:01.493Z' },
-    { id: 11, name: 'Shell', color: '#89e051', created_at: '2023-09-19T14:42:11.923Z' },
-  ],
+  programmingLanguages,
 };
 
 const searchTerm = 'foo bar';
@@ -161,7 +158,7 @@ describe('YourWorkProjectsApp', () => {
       expect(findFilteredSearchAndSort().props()).toMatchObject({
         filteredSearchTokens: [
           {
-            type: 'language',
+            type: FILTERED_SEARCH_TOKEN_LANGUAGE,
             icon: 'lock',
             title: 'Language',
             token: GlFilteredSearchToken,
@@ -170,15 +167,10 @@ describe('YourWorkProjectsApp', () => {
             options: [
               { value: '5', title: 'CSS' },
               { value: '8', title: 'CoffeeScript' },
-              { value: '1', title: 'HTML' },
-              { value: '7', title: 'JavaScript' },
-              { value: '10', title: 'Makefile' },
-              { value: '6', title: 'Ruby' },
-              { value: '11', title: 'Shell' },
             ],
           },
           {
-            type: 'min_access_level',
+            type: FILTERED_SEARCH_TOKEN_MIN_ACCESS_LEVEL,
             icon: 'user',
             title: 'Role',
             token: GlFilteredSearchToken,
@@ -219,7 +211,10 @@ describe('YourWorkProjectsApp', () => {
         createComponent({
           route: {
             ...defaultRoute,
-            query: { [FILTERED_SEARCH_TERM_KEY]: searchTerm },
+            query: {
+              [FILTERED_SEARCH_TERM_KEY]: searchTerm,
+              [QUERY_PARAM_END_CURSOR]: mockEndCursor,
+            },
           },
         });
 
@@ -239,7 +234,10 @@ describe('YourWorkProjectsApp', () => {
         createComponent({
           route: {
             ...defaultRoute,
-            query: { [FILTERED_SEARCH_TERM_KEY]: searchTerm },
+            query: {
+              [FILTERED_SEARCH_TERM_KEY]: searchTerm,
+              [QUERY_PARAM_END_CURSOR]: mockEndCursor,
+            },
           },
         });
 
@@ -266,19 +264,41 @@ describe('YourWorkProjectsApp', () => {
     ${MEMBER_TAB.value}              | ${MEMBER_TAB}
     ${INACTIVE_TAB.value}            | ${INACTIVE_TAB}
   `('onMount when route name is $name', ({ name, expectedTab }) => {
+    const query = {
+      sort: 'name_desc',
+      [FILTERED_SEARCH_TERM_KEY]: 'foo',
+      [FILTERED_SEARCH_TOKEN_LANGUAGE]: '8',
+      [FILTERED_SEARCH_TOKEN_MIN_ACCESS_LEVEL]: ACCESS_LEVEL_OWNER_INTEGER,
+      [QUERY_PARAM_END_CURSOR]: mockEndCursor,
+      [QUERY_PARAM_START_CURSOR]: mockStartCursor,
+    };
+
     beforeEach(() => {
-      createComponent({ route: { name } });
+      createComponent({
+        route: { name, query },
+      });
     });
 
     it('initializes to the correct tab', () => {
       expect(findActiveTab().text()).toContain(expectedTab.text);
     });
 
-    if (expectedTab.query) {
-      it('renders `TabView` component and passes `tab` prop', () => {
-        expect(findTabView().props('tab')).toMatchObject(expectedTab);
+    it('renders `TabView` component and passes `tab` prop', () => {
+      expect(findTabView().props('tab')).toMatchObject(expectedTab);
+    });
+
+    it('passes sorting, filtering, and pagination props', () => {
+      expect(findTabView().props()).toMatchObject({
+        sort: query.sort,
+        filters: {
+          [FILTERED_SEARCH_TERM_KEY]: query[FILTERED_SEARCH_TERM_KEY],
+          [FILTERED_SEARCH_TOKEN_LANGUAGE]: query[FILTERED_SEARCH_TOKEN_LANGUAGE],
+          [FILTERED_SEARCH_TOKEN_MIN_ACCESS_LEVEL]: query[FILTERED_SEARCH_TOKEN_MIN_ACCESS_LEVEL],
+        },
+        endCursor: mockEndCursor,
+        startCursor: mockStartCursor,
       });
-    }
+    });
   });
 
   describe('onTabUpdate', () => {
diff --git a/spec/frontend/projects/your_work/components/mock_data.js b/spec/frontend/projects/your_work/components/mock_data.js
index 8bd88b1b5d0d8..57fd7327cddd7 100644
--- a/spec/frontend/projects/your_work/components/mock_data.js
+++ b/spec/frontend/projects/your_work/components/mock_data.js
@@ -5,3 +5,8 @@ export const pageInfoMultiplePages = {
   startCursor: 'eyJpZCI6IjEwNzIifQ',
   __typename: 'PageInfo',
 };
+
+export const programmingLanguages = [
+  { id: 5, name: 'CSS', color: '#563d7c', created_at: '2023-09-19T14:41:37.601Z' },
+  { id: 8, name: 'CoffeeScript', color: '#244776', created_at: '2023-09-19T14:42:01.494Z' },
+];
diff --git a/spec/frontend/projects/your_work/components/tab_view_spec.js b/spec/frontend/projects/your_work/components/tab_view_spec.js
index f7bdba866d324..723707dd30ad8 100644
--- a/spec/frontend/projects/your_work/components/tab_view_spec.js
+++ b/spec/frontend/projects/your_work/components/tab_view_spec.js
@@ -18,10 +18,14 @@ import {
   MEMBER_TAB,
   STARRED_TAB,
   INACTIVE_TAB,
+  FILTERED_SEARCH_TOKEN_LANGUAGE,
+  FILTERED_SEARCH_TOKEN_MIN_ACCESS_LEVEL,
 } from '~/projects/your_work/constants';
+import { FILTERED_SEARCH_TERM_KEY } from '~/projects/filtered_search_and_sort/constants';
+import { ACCESS_LEVEL_OWNER_INTEGER, ACCESS_LEVEL_OWNER_STRING } from '~/access_level/constants';
 import createMockApollo from 'helpers/mock_apollo_helper';
 import waitForPromises from 'helpers/wait_for_promises';
-import { pageInfoMultiplePages } from './mock_data';
+import { pageInfoMultiplePages, programmingLanguages } from './mock_data';
 
 jest.mock('~/alert');
 
@@ -31,12 +35,22 @@ describe('TabView', () => {
   let wrapper;
   let mockApollo;
 
-  const createComponent = ({ handler, propsData }) => {
+  const defaultPropsData = {
+    sort: 'name_desc',
+    filters: {
+      [FILTERED_SEARCH_TERM_KEY]: 'foo',
+      [FILTERED_SEARCH_TOKEN_LANGUAGE]: '8',
+      [FILTERED_SEARCH_TOKEN_MIN_ACCESS_LEVEL]: ACCESS_LEVEL_OWNER_INTEGER,
+    },
+  };
+
+  const createComponent = ({ handler, propsData = {} } = {}) => {
     mockApollo = createMockApollo([handler]);
 
     wrapper = mountExtended(TabView, {
       apolloProvider: mockApollo,
-      propsData,
+      propsData: { ...defaultPropsData, ...propsData },
+      provide: { programmingLanguages },
     });
   };
 
@@ -48,12 +62,12 @@ describe('TabView', () => {
   });
 
   describe.each`
-    tab                | handler                                                                                     | expectedVariables                                             | expectedProjects
-    ${CONTRIBUTED_TAB} | ${[CONTRIBUTED_TAB.query, jest.fn().mockResolvedValue(contributedProjectsGraphQlResponse)]} | ${{ contributed: true, starred: false }}                      | ${contributedProjectsGraphQlResponse.data.currentUser.contributedProjects.nodes}
-    ${PERSONAL_TAB}    | ${[PERSONAL_TAB.query, jest.fn().mockResolvedValue(personalProjectsGraphQlResponse)]}       | ${{ personal: true, membership: false, archived: 'EXCLUDE' }} | ${personalProjectsGraphQlResponse.data.projects.nodes}
-    ${MEMBER_TAB}      | ${[MEMBER_TAB.query, jest.fn().mockResolvedValue(membershipProjectsGraphQlResponse)]}       | ${{ personal: false, membership: true, archived: 'EXCLUDE' }} | ${membershipProjectsGraphQlResponse.data.projects.nodes}
-    ${STARRED_TAB}     | ${[STARRED_TAB.query, jest.fn().mockResolvedValue(starredProjectsGraphQlResponse)]}         | ${{ contributed: false, starred: true }}                      | ${starredProjectsGraphQlResponse.data.currentUser.starredProjects.nodes}
-    ${INACTIVE_TAB}    | ${[INACTIVE_TAB.query, jest.fn().mockResolvedValue(inactiveProjectsGraphQlResponse)]}       | ${{ personal: false, membership: true, archived: 'ONLY' }}    | ${inactiveProjectsGraphQlResponse.data.projects.nodes}
+    tab                | handler                                                                                     | expectedVariables                                                                          | expectedProjects
+    ${CONTRIBUTED_TAB} | ${[CONTRIBUTED_TAB.query, jest.fn().mockResolvedValue(contributedProjectsGraphQlResponse)]} | ${{ contributed: true, starred: false, sort: defaultPropsData.sort.toUpperCase() }}        | ${contributedProjectsGraphQlResponse.data.currentUser.contributedProjects.nodes}
+    ${PERSONAL_TAB}    | ${[PERSONAL_TAB.query, jest.fn().mockResolvedValue(personalProjectsGraphQlResponse)]}       | ${{ personal: true, membership: false, archived: 'EXCLUDE', sort: defaultPropsData.sort }} | ${personalProjectsGraphQlResponse.data.projects.nodes}
+    ${MEMBER_TAB}      | ${[MEMBER_TAB.query, jest.fn().mockResolvedValue(membershipProjectsGraphQlResponse)]}       | ${{ personal: false, membership: true, archived: 'EXCLUDE', sort: defaultPropsData.sort }} | ${membershipProjectsGraphQlResponse.data.projects.nodes}
+    ${STARRED_TAB}     | ${[STARRED_TAB.query, jest.fn().mockResolvedValue(starredProjectsGraphQlResponse)]}         | ${{ contributed: false, starred: true, sort: defaultPropsData.sort.toUpperCase() }}        | ${starredProjectsGraphQlResponse.data.currentUser.starredProjects.nodes}
+    ${INACTIVE_TAB}    | ${[INACTIVE_TAB.query, jest.fn().mockResolvedValue(inactiveProjectsGraphQlResponse)]}       | ${{ personal: false, membership: true, archived: 'ONLY', sort: defaultPropsData.sort }}    | ${inactiveProjectsGraphQlResponse.data.projects.nodes}
   `(
     'onMount when route name is $tab.value',
     ({ tab, handler, expectedVariables, expectedProjects }) => {
@@ -81,6 +95,9 @@ describe('TabView', () => {
             first: DEFAULT_PER_PAGE,
             before: null,
             after: null,
+            search: defaultPropsData.filters[FILTERED_SEARCH_TERM_KEY],
+            programmingLanguageName: 'CoffeeScript',
+            minAccessLevel: ACCESS_LEVEL_OWNER_STRING,
             ...expectedVariables,
           });
         });
@@ -202,6 +219,10 @@ describe('TabView', () => {
             personal: true,
             membership: false,
             archived: 'EXCLUDE',
+            sort: defaultPropsData.sort,
+            search: defaultPropsData.filters[FILTERED_SEARCH_TERM_KEY],
+            programmingLanguageName: 'CoffeeScript',
+            minAccessLevel: ACCESS_LEVEL_OWNER_STRING,
           });
         });
       });
@@ -236,6 +257,10 @@ describe('TabView', () => {
             personal: true,
             membership: false,
             archived: 'EXCLUDE',
+            sort: defaultPropsData.sort,
+            search: defaultPropsData.filters[FILTERED_SEARCH_TERM_KEY],
+            programmingLanguageName: 'CoffeeScript',
+            minAccessLevel: ACCESS_LEVEL_OWNER_STRING,
           });
         });
       });
diff --git a/spec/frontend/security_configuration/components/app_spec.js b/spec/frontend/security_configuration/components/app_spec.js
index 1b651e93afb20..1df91e09c7bd9 100644
--- a/spec/frontend/security_configuration/components/app_spec.js
+++ b/spec/frontend/security_configuration/components/app_spec.js
@@ -5,6 +5,7 @@ import { useLocalStorageSpy } from 'helpers/local_storage_helper';
 import { makeMockUserCalloutDismisser } from 'helpers/mock_user_callout_dismisser';
 import stubChildren from 'helpers/stub_children';
 import { mountExtended } from 'helpers/vue_test_utils_helper';
+import PageHeading from '~/vue_shared/components/page_heading.vue';
 import SecurityConfigurationApp from '~/security_configuration/components/app.vue';
 import AutoDevopsAlert from '~/security_configuration/components/auto_dev_ops_alert.vue';
 import AutoDevopsEnabledAlert from '~/security_configuration/components/auto_dev_ops_enabled_alert.vue';
@@ -46,11 +47,12 @@ describe('~/security_configuration/components/app', () => {
           dismiss: userCalloutDismissSpy,
           shouldShowCallout,
         }),
+        PageHeading,
       },
     });
   };
 
-  const findMainHeading = () => wrapper.find('h1');
+  const findMainHeading = () => wrapper.findByTestId('page-heading');
   const findTab = () => wrapper.findComponent(GlTab);
   const findTabs = () => wrapper.findAllComponents(GlTab);
   const findGlTabs = () => wrapper.findComponent(GlTabs);
diff --git a/spec/graphql/types/merge_request_type_spec.rb b/spec/graphql/types/merge_request_type_spec.rb
index 773565955f7d4..5723d1a4b7aaa 100644
--- a/spec/graphql/types/merge_request_type_spec.rb
+++ b/spec/graphql/types/merge_request_type_spec.rb
@@ -20,7 +20,7 @@
       notes discussions user_permissions id iid title title_html description
       description_html state created_at updated_at source_project target_project
       project project_id source_project_id target_project_id source_branch
-      target_branch draft merge_when_pipeline_succeeds diff_head_sha
+      target_branch target_branch_path draft merge_when_pipeline_succeeds diff_head_sha
       merge_commit_sha user_notes_count user_discussions_count should_remove_source_branch
       diff_refs diff_stats diff_stats_summary
       force_remove_source_branch
@@ -50,6 +50,19 @@
     it { is_expected.to have_attributes(max_page_size: 500) }
   end
 
+  describe '#target_branch_path' do
+    include Rails.application.routes.url_helpers
+
+    let_it_be(:project) { create(:project, :repository, :public) }
+    let_it_be(:merge_request) { create(:merge_request, source_project: project) }
+
+    it 'serializes correctly' do
+      path = resolve_field(:target_branch_path, merge_request)
+
+      expect(path).to eq(project_commits_path(project, merge_request.target_branch))
+    end
+  end
+
   describe '#diff_stats_summary' do
     subject { GitlabSchema.execute(query, context: { current_user: current_user }).as_json }
 
diff --git a/spec/helpers/merge_requests_helper_spec.rb b/spec/helpers/merge_requests_helper_spec.rb
index cc6cdf488ff63..65e502aa0ea3d 100644
--- a/spec/helpers/merge_requests_helper_spec.rb
+++ b/spec/helpers/merge_requests_helper_spec.rb
@@ -348,7 +348,8 @@
         rss_url: '/rss-url',
         releases_endpoint: project_releases_path(project, format: :json),
         can_bulk_update: 'true',
-        environment_names_path: unfoldered_environment_names_project_path(project, format: :json)
+        environment_names_path: unfoldered_environment_names_project_path(project, format: :json),
+        default_branch: project.default_branch
       }
 
       expect(subject).to include(expected_data)
diff --git a/spec/lib/gitlab/auth/visitor_location_spec.rb b/spec/lib/gitlab/auth/visitor_location_spec.rb
index f24e1888f49e5..65e6b25760065 100644
--- a/spec/lib/gitlab/auth/visitor_location_spec.rb
+++ b/spec/lib/gitlab/auth/visitor_location_spec.rb
@@ -25,8 +25,8 @@
   end
 
   context 'when locale is not default' do
-    before do
-      I18n.locale = :de
+    around do |example|
+      Gitlab::I18n.with_locale(:de, &example)
     end
 
     it 'returns localized country name' do
diff --git a/spec/lib/gitlab/database/sharding_key_spec.rb b/spec/lib/gitlab/database/sharding_key_spec.rb
index 67cc8c445d135..e10bde77535df 100644
--- a/spec/lib/gitlab/database/sharding_key_spec.rb
+++ b/spec/lib/gitlab/database/sharding_key_spec.rb
@@ -195,7 +195,6 @@
       "sbom_source_packages" => 'https://gitlab.com/gitlab-org/gitlab/-/issues/476214',
       "sbom_sources" => 'https://gitlab.com/gitlab-org/gitlab/-/issues/476215',
       "snippets" => 'https://gitlab.com/gitlab-org/gitlab/-/issues/476216',
-      "upcoming_reconciliations" => 'https://gitlab.com/gitlab-org/gitlab/-/issues/476217',
       "vulnerability_export_parts" => 'https://gitlab.com/gitlab-org/gitlab/-/issues/476218',
       "vulnerability_exports" => 'https://gitlab.com/gitlab-org/gitlab/-/issues/476219',
       "personal_access_tokens" => 'https://gitlab.com/gitlab-org/gitlab/-/issues/477750',
diff --git a/spec/lib/gitlab/email/receiver_spec.rb b/spec/lib/gitlab/email/receiver_spec.rb
index 7dc2504443485..b8da127afb4ed 100644
--- a/spec/lib/gitlab/email/receiver_spec.rb
+++ b/spec/lib/gitlab/email/receiver_spec.rb
@@ -6,12 +6,13 @@
   include_context 'email shared context'
 
   let_it_be_with_reload(:project) { create(:project) }
-  let(:metric_transaction) { instance_double(Gitlab::Metrics::WebTransaction) }
+
+  let(:metric_transaction) { instance_double(Gitlab::Metrics::WebTransaction, increment: true, observe: true) }
+  let(:mail_key) { 'gitlabhq/gitlabhq+auth_token' }
 
   shared_examples 'successful receive' do
     let(:handler) { double(:handler, project: project, execute: true, metrics_event: nil, metrics_params: nil) }
     let(:client_id) { 'email/jake@example.com' }
-    let(:mail_key) { 'gitlabhq/gitlabhq+auth_token' }
 
     it 'correctly finds the mail key' do
       expect(Gitlab::Email::Handler).to receive(:for).with(an_instance_of(Mail::Message), mail_key).and_return(handler)
@@ -41,7 +42,9 @@
 
   shared_examples 'failed receive with event' do
     it 'adds metric event' do
-      expect(::Gitlab::Metrics::BackgroundTransaction).to receive(:current).and_return(metric_transaction)
+      # Use allow here because we receive it multiple times which is out of scope of this class
+      allow(::Gitlab::Metrics::BackgroundTransaction).to receive(:current).and_return(metric_transaction)
+
       expect(metric_transaction).to receive(:add_event).with('email_receiver_error', { error: expected_error.name })
 
       expect { receiver.execute }.to raise_error(expected_error)
@@ -148,69 +151,132 @@
       it_behaves_like 'successful receive'
     end
 
-    context 'when Service Desk custom email reply address in To header and no References header exists' do
+    context 'for Service Desk custom email' do
       let_it_be_with_refind(:setting) { create(:service_desk_setting, project: project, add_external_participants_from_cc: true) }
 
       let!(:credential) { create(:service_desk_custom_email_credential, project: project) }
       let!(:verification) { create(:service_desk_custom_email_verification, :finished, project: project) }
-      let(:incoming_email) { "incoming+gitlabhq/gitlabhq+auth_token@appmail.example.com" }
-      let(:reply_key) { "5de1a83a6fc3c9fe34d756c7f484159e" }
-      let(:custom_email_reply) { "support+#{reply_key}@example.com" }
-
-      context 'when custom email is enabled' do
-        let(:email_raw) do
-          <<~EMAIL
-          Delivered-To: #{incoming_email}
-          From: jake@example.com
-          To: #{custom_email_reply}
-          Subject: Reply titile
-
-          Reply body
-          EMAIL
-        end
 
-        let(:meta_key) { :to_address }
-        let(:meta_value) { [custom_email_reply] }
+      let(:incoming_email) { project.service_desk_incoming_address }
+      let(:mail_key) { "5de1a83a6fc3c9fe34d756c7f484159e" }
+      let(:email) { "support+#{mail_key}@example.com" }
+      let(:meta_key) { :to_address }
+      let(:meta_value) { [email] }
 
-        before do
-          project.reset
-          setting.update!(custom_email: 'support@example.com', custom_email_enabled: true)
-        end
+      shared_examples 'successful receive from Delivered-To header' do
+        context 'when in Delivered-To header' do
+          let(:email_raw) do
+            <<~EMAIL
+            Delivered-To: #{incoming_email}
+            From: jake@example.com
+            To: #{email}
+            Subject: Title
 
-        it_behaves_like 'successful receive' do
-          let(:mail_key) { reply_key }
+            Reply body
+            EMAIL
+          end
+
+          it_behaves_like 'successful receive'
         end
+      end
 
-        # Email forwarding using a transport rule in Microsoft 365 adds the forwarding
-        # target to the `To` header. We have to select te custom email reply address
-        # before the incoming address (forwarding target)
-        # See https://gitlab.com/gitlab-org/gitlab/-/issues/426269#note_1629170865 for email structure
-        context 'when also Service Desk incoming address in To header' do
+      shared_examples 'successful receive from To header' do
+        context 'when in To header' do
           let(:email_raw) do
             <<~EMAIL
             From: jake@example.com
-            To: #{custom_email_reply}, #{incoming_email}
-            Subject: Reply titile
+            To: #{email}
+            Subject: Title
 
             Reply body
             EMAIL
           end
 
-          let(:meta_value) { [custom_email_reply, incoming_email] }
+          it_behaves_like 'successful receive'
+
+          context 'when also incoming address is in To header' do
+            let(:email_raw) do
+              <<~EMAIL
+              From: jake@example.com
+              To: #{email}, #{incoming_email}
+              Subject: Title
+
+              Body
+              EMAIL
+            end
+
+            let(:meta_value) { [email, incoming_email] }
 
-          it_behaves_like 'successful receive' do
-            let(:mail_key) { reply_key }
+            it_behaves_like 'successful receive'
           end
         end
       end
+
+      before do
+        # Technically the state of ServiceDeskSetting and custom email records differ based on
+        # the verification state and whether it's enabled or not.
+        # But we always want to match a custom email with a project key and decide
+        # to discard that email later in the handler.
+        # So we ignore the custom email state here for simplicity.
+        setting.update!(custom_email: 'support@example.com', custom_email_enabled: true)
+        project.reset
+      end
+
+      context 'for email to custom email address with reply key' do
+        it_behaves_like 'successful receive from Delivered-To header'
+        it_behaves_like 'successful receive from To header'
+      end
+
+      context 'for verification email' do
+        let(:mail_key) { project.default_service_desk_subaddress_part }
+        let(:email) { "support+verify@example.com" }
+
+        it_behaves_like 'successful receive from Delivered-To header'
+        it_behaves_like 'successful receive from To header'
+      end
+
+      context 'for email to custom email address' do
+        let(:mail_key) { project.default_service_desk_subaddress_part }
+        let(:email) { "support@example.com" }
+
+        it_behaves_like 'successful receive from Delivered-To header'
+        it_behaves_like 'successful receive from To header'
+      end
     end
   end
 
   context 'when we cannot find a capable handler' do
-    let(:email_raw) { fixture_file('emails/valid_reply.eml').gsub(mail_key, '!!!') }
     let(:expected_error) { Gitlab::Email::UnknownIncomingEmail }
 
-    it_behaves_like 'failed receive with event'
+    context 'when mail key is not correct' do
+      let(:email_raw) do
+        <<~EMAIL
+        From: from@example.com
+        To: incoming+!!!@example.com
+        In-Reply-To: <issue_1@localhost>
+        References: <incoming-!!!@localhost> <issue_1@localhost>
+        Subject: Title
+
+        Body
+        EMAIL
+      end
+
+      it_behaves_like 'failed receive with event'
+    end
+
+    context 'when email is not known' do
+      let(:email_raw) do
+        <<~EMAIL
+        From: from@example.com
+        To: to@example.com
+        Subject: Title
+
+        Body
+        EMAIL
+      end
+
+      it_behaves_like 'failed receive with event'
+    end
   end
 
   context 'when the email is blank' do
diff --git a/spec/lib/gitlab/email/service_desk/custom_email_spec.rb b/spec/lib/gitlab/email/service_desk/custom_email_spec.rb
index bdf3156725184..74411ef9cfbc1 100644
--- a/spec/lib/gitlab/email/service_desk/custom_email_spec.rb
+++ b/spec/lib/gitlab/email/service_desk/custom_email_spec.rb
@@ -3,10 +3,17 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::Email::ServiceDesk::CustomEmail, feature_category: :service_desk do
+  let_it_be(:project) { create(:project) }
+
   let(:reply_key) { 'b7721fc7e8419911a8bea145236a0519' }
   let(:custom_email) { 'support@example.com' }
+  let(:custom_email_with_verification_subaddress) { 'support+verify@example.com' }
   let(:email_with_reply_key) { 'support+b7721fc7e8419911a8bea145236a0519@example.com' }
-  let_it_be(:project) { create(:project) }
+  let(:project_mail_key) { project.default_service_desk_subaddress_part }
+
+  before do
+    stub_incoming_email_setting(enabled: true, address: "incoming+%{key}@example.com")
+  end
 
   describe '.reply_address' do
     subject(:reply_address) { described_class.reply_address(nil, nil) }
@@ -67,4 +74,48 @@
       it { is_expected.to be nil }
     end
   end
+
+  describe '.key_from_settings' do
+    subject(:mail_key) { described_class.key_from_settings(email) }
+
+    let(:email) { nil }
+
+    it { is_expected.to be nil }
+
+    context 'with service desk incoming email' do
+      let(:email) { project.service_desk_incoming_address }
+
+      it { is_expected.to be nil }
+    end
+
+    context 'with another unknown email' do
+      let(:email) { 'unknown@example.com' }
+
+      it { is_expected.to be nil }
+    end
+
+    context 'with custom email' do
+      let_it_be_with_refind(:setting) do
+        create(:service_desk_setting, project: project)
+      end
+
+      let_it_be(:credential) { create(:service_desk_custom_email_credential, project: project) }
+      let_it_be(:verification) { create(:service_desk_custom_email_verification, :finished, project: project) }
+
+      let(:email) { custom_email }
+
+      before do
+        project.reset
+        setting.update!(custom_email: 'support@example.com') # Doesn't need to be enabled
+      end
+
+      it { is_expected.to eq(project_mail_key) }
+
+      context 'with a custom email verification email' do
+        let(:email) { custom_email_with_verification_subaddress }
+
+        it { is_expected.to eq(project_mail_key) }
+      end
+    end
+  end
 end
diff --git a/spec/models/dependency_proxy/blob_spec.rb b/spec/models/dependency_proxy/blob_spec.rb
index cc62aecd1abbe..94e9e51411948 100644
--- a/spec/models/dependency_proxy/blob_spec.rb
+++ b/spec/models/dependency_proxy/blob_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::Blob, type: :model do
+RSpec.describe DependencyProxy::Blob, type: :model, feature_category: :dependency_proxy do
   it_behaves_like 'ttl_expirable'
   it_behaves_like 'destructible', factory: :dependency_proxy_blob
 
diff --git a/spec/models/dependency_proxy/manifest_spec.rb b/spec/models/dependency_proxy/manifest_spec.rb
index 174fa400d72ac..df909ed275f61 100644
--- a/spec/models/dependency_proxy/manifest_spec.rb
+++ b/spec/models/dependency_proxy/manifest_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::Manifest, type: :model do
+RSpec.describe DependencyProxy::Manifest, type: :model, feature_category: :dependency_proxy do
   it_behaves_like 'ttl_expirable'
   it_behaves_like 'destructible', factory: :dependency_proxy_manifest
 
diff --git a/spec/models/namespace_statistics_spec.rb b/spec/models/namespace_statistics_spec.rb
index ee3b4765dba2b..f42fc741499d2 100644
--- a/spec/models/namespace_statistics_spec.rb
+++ b/spec/models/namespace_statistics_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe NamespaceStatistics do
+RSpec.describe NamespaceStatistics, type: :model, feature_category: :consumables_cost_management do
   let_it_be(:user) { create(:user) }
   let_it_be(:group) { create(:group) }
 
@@ -97,13 +97,14 @@
     let_it_be(:statistics, reload: true) { create(:namespace_statistics, namespace: group) }
     let_it_be(:dependency_proxy_manifest) { create(:dependency_proxy_manifest, group: group, size: 50) }
     let_it_be(:dependency_proxy_blob) { create(:dependency_proxy_blob, group: group, size: 50) }
+    let_it_be(:vreg_maven_cached_response) { create(:virtual_registries_packages_maven_cached_response, group: group, size: 50) }
 
     subject(:update_dependency_proxy_size) { statistics.update_dependency_proxy_size }
 
     it 'updates the dependency proxy size' do
       update_dependency_proxy_size
 
-      expect(statistics.dependency_proxy_size).to eq 100
+      expect(statistics.dependency_proxy_size).to eq 150
     end
 
     context 'when namespace does not belong to a group' do
diff --git a/spec/models/packages/conan/package_reference_spec.rb b/spec/models/packages/conan/package_reference_spec.rb
index 0f31415478be3..57552de14ae9d 100644
--- a/spec/models/packages/conan/package_reference_spec.rb
+++ b/spec/models/packages/conan/package_reference_spec.rb
@@ -14,6 +14,11 @@
     end
 
     it { is_expected.to belong_to(:project) }
+
+    it do
+      is_expected.to have_many(:package_revisions).inverse_of(:package_reference)
+        .class_name('Packages::Conan::PackageRevision')
+    end
   end
 
   describe 'validations' do
diff --git a/spec/models/packages/conan/package_revision_spec.rb b/spec/models/packages/conan/package_revision_spec.rb
new file mode 100644
index 0000000000000..6652034d83e7a
--- /dev/null
+++ b/spec/models/packages/conan/package_revision_spec.rb
@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Packages::Conan::PackageRevision, type: :model, feature_category: :package_registry do
+  describe 'associations' do
+    it do
+      is_expected.to belong_to(:package).class_name('Packages::Conan::Package').inverse_of(:conan_package_revisions)
+    end
+
+    it do
+      is_expected.to belong_to(:package_reference).class_name('Packages::Conan::PackageReference')
+        .inverse_of(:package_revisions)
+    end
+
+    it { is_expected.to belong_to(:project) }
+  end
+
+  describe 'validations' do
+    subject(:package_revision) { build(:conan_package_revision) }
+
+    it { is_expected.to validate_presence_of(:package) }
+    it { is_expected.to validate_presence_of(:package_reference) }
+    it { is_expected.to validate_presence_of(:project) }
+    it { is_expected.to validate_presence_of(:revision) }
+
+    it do
+      # ignore case, same revision string with different case are converted to same hexa binary
+      is_expected.to validate_uniqueness_of(:revision).scoped_to([:package_id, :package_reference_id]).case_insensitive
+    end
+
+    context 'when validating the byte size of revision' do
+      let(:invalid_revision) { 'a' * (Packages::Conan::PackageRevision::REVISION_LENGTH_MAX + 1) }
+
+      it 'is not valid if revision exceeds maximum byte size', :aggregate_failures do
+        package_revision.revision = invalid_revision
+
+        expect(package_revision).not_to be_valid
+        expect(package_revision.errors[:revision]).to include(
+          "is too long (#{Packages::Conan::PackageRevision::REVISION_LENGTH_MAX + 1} B). " \
+            "The maximum size is #{Packages::Conan::PackageRevision::REVISION_LENGTH_MAX} B.")
+      end
+
+      it 'is valid if revision is within byte size limit' do
+        # package revision is set correctly in the factory
+        expect(package_revision).to be_valid
+      end
+    end
+  end
+end
diff --git a/spec/models/packages/conan/package_spec.rb b/spec/models/packages/conan/package_spec.rb
index 74f7c0ce2c8cc..8c624b264c127 100644
--- a/spec/models/packages/conan/package_spec.rb
+++ b/spec/models/packages/conan/package_spec.rb
@@ -15,6 +15,11 @@
       is_expected.to have_many(:conan_package_references).inverse_of(:package)
         .class_name('Packages::Conan::PackageReference')
     end
+
+    it do
+      is_expected.to have_many(:conan_package_revisions).inverse_of(:package)
+        .class_name('Packages::Conan::PackageRevision')
+    end
   end
 
   describe 'validations' do
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index 13ae91b740bc2..096b91757bfb2 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -2636,7 +2636,7 @@ def has_external_wiki
   describe '#service_desk_enabled?' do
     let_it_be(:namespace) { create(:namespace) }
 
-    subject(:project) { build(:project, :private, namespace: namespace, service_desk_enabled: true) }
+    subject(:project) { build(:project, :private, :service_desk_enabled, namespace: namespace) }
 
     before do
       allow(Gitlab::Email::IncomingEmail).to receive(:enabled?).and_return(true)
@@ -2649,8 +2649,18 @@ def has_external_wiki
     end
   end
 
+  describe '#default_service_desk_subaddress_part', feature_category: :service_desk do
+    let_it_be(:project) { create(:project, :service_desk_enabled) }
+
+    subject { project.default_service_desk_subaddress_part }
+
+    it 'contains the full path slug, project id and default suffix' do
+      is_expected.to eq("#{project.full_path_slug}-#{project.id}-issue-")
+    end
+  end
+
   describe '#service_desk_address', feature_category: :service_desk do
-    let_it_be(:project, reload: true) { create(:project, service_desk_enabled: true) }
+    let_it_be(:project, reload: true) { create(:project, :service_desk_enabled) }
 
     subject { project.service_desk_address }
 
diff --git a/spec/models/virtual_registries/packages/maven/cached_response_spec.rb b/spec/models/virtual_registries/packages/maven/cached_response_spec.rb
index 55017f38cffe5..3b09185db8f56 100644
--- a/spec/models/virtual_registries/packages/maven/cached_response_spec.rb
+++ b/spec/models/virtual_registries/packages/maven/cached_response_spec.rb
@@ -6,6 +6,12 @@
   subject(:cached_response) { build(:virtual_registries_packages_maven_cached_response) }
 
   it { is_expected.to include_module(FileStoreMounter) }
+  it { is_expected.to include_module(::UpdateNamespaceStatistics) }
+
+  it_behaves_like 'updates namespace statistics' do
+    let(:statistic_source) { cached_response }
+    let(:non_statistic_attribute) { :relative_path }
+  end
 
   describe 'validations' do
     %i[group file relative_path content_type downloads_count size].each do |attr|
@@ -96,6 +102,18 @@
 
       it { is_expected.to contain_exactly(pending_destruction_cached_response) }
     end
+
+    describe '.for_group' do
+      let_it_be(:cached_response1) { create(:virtual_registries_packages_maven_cached_response) }
+      let_it_be(:cached_response2) { create(:virtual_registries_packages_maven_cached_response) }
+      let_it_be(:cached_response3) { create(:virtual_registries_packages_maven_cached_response) }
+
+      let(:groups) { [cached_response1.group, cached_response2.group] }
+
+      subject { described_class.for_group(groups) }
+
+      it { is_expected.to match_array([cached_response1, cached_response2]) }
+    end
   end
 
   describe '.next_pending_destruction' do
diff --git a/spec/support/shared_examples/models/concerns/update_namespace_statistics_shared_examples.rb b/spec/support/shared_examples/models/concerns/update_namespace_statistics_shared_examples.rb
index 191b954bfb1df..63e8715313a90 100644
--- a/spec/support/shared_examples/models/concerns/update_namespace_statistics_shared_examples.rb
+++ b/spec/support/shared_examples/models/concerns/update_namespace_statistics_shared_examples.rb
@@ -3,25 +3,43 @@
 RSpec.shared_examples 'updates namespace statistics' do
   let(:namespace_statistics_name) { described_class.namespace_statistics_name }
   let(:statistic_attribute) { described_class.statistic_attribute }
+  let(:non_statistic_attribute) { :file_name }
+
+  shared_examples 'skipping statistics update if namespace is nil' do
+    context 'when the namespace is nil' do
+      before do
+        allow(statistic_source).to receive(:namespace).and_return(nil)
+      end
+
+      it 'does not schedule a statistic refresh' do
+        expect(::Groups::UpdateStatisticsWorker).not_to receive(:perform_async)
+
+        subject
+      end
+    end
+  end
 
   context 'when creating' do
+    subject { statistic_source.save! }
+
     before do
-      statistic_source.send("#{statistic_attribute}=", 10)
+      statistic_source.send(:"#{statistic_attribute}=", 10)
+      allow(::Groups::UpdateStatisticsWorker).to receive(:perform_async)
     end
 
     it 'schedules a statistic refresh' do
-      expect(Groups::UpdateStatisticsWorker)
-        .to receive(:perform_async)
+      subject
 
-      statistic_source.save!
+      expect(::Groups::UpdateStatisticsWorker)
+        .to have_received(:perform_async).with(statistic_source.namespace.id, [namespace_statistics_name.to_s])
     end
+
+    it_behaves_like 'skipping statistics update if namespace is nil'
   end
 
   context 'when updating' do
     before do
       statistic_source.save!
-
-      expect(statistic_source).to be_persisted
     end
 
     context 'when the statistic attribute has not changed' do
@@ -29,28 +47,36 @@
         expect(Groups::UpdateStatisticsWorker)
           .not_to receive(:perform_async)
 
-        statistic_source.update!(file_name: 'new-file-name.txt')
+        statistic_source.update!(non_statistic_attribute => 'new-file-name.txt')
       end
     end
 
     context 'when the statistic attribute has changed' do
+      subject { statistic_source.update!(statistic_attribute => 20) }
+
       it 'schedules a statistic refresh' do
         expect(Groups::UpdateStatisticsWorker)
           .to receive(:perform_async)
 
-        statistic_source.update!(statistic_attribute => 20)
+        subject
       end
+
+      it_behaves_like 'skipping statistics update if namespace is nil'
     end
   end
 
   context 'when deleting' do
+    subject { statistic_source.destroy! }
+
     it 'schedules a statistic refresh' do
       statistic_source.save!
 
       expect(Groups::UpdateStatisticsWorker)
         .to receive(:perform_async)
 
-      statistic_source.destroy!
+      subject
     end
+
+    it_behaves_like 'skipping statistics update if namespace is nil'
   end
 end
diff --git a/spec/workers/service_desk_email_receiver_worker_spec.rb b/spec/workers/service_desk_email_receiver_worker_spec.rb
index bed66875f3462..04428bf19c3e9 100644
--- a/spec/workers/service_desk_email_receiver_worker_spec.rb
+++ b/spec/workers/service_desk_email_receiver_worker_spec.rb
@@ -22,7 +22,7 @@
       context 'when service desk receiver raises an exception' do
         before do
           allow_next_instance_of(Gitlab::Email::ServiceDeskReceiver) do |receiver|
-            allow(receiver).to receive(:find_handler).and_return(nil)
+            allow(receiver).to receive(:handler).and_return(nil)
           end
           expect(Sidekiq.logger).to receive(:error).with(hash_including('exception.class' => Gitlab::Email::UnknownIncomingEmail.to_s)).and_call_original
         end