From 5b3953275992a0b7c91a2b3990a4fedbf06828bd Mon Sep 17 00:00:00 2001 From: Preetha Appan Date: Mon, 3 Dec 2018 11:16:35 -0600 Subject: [PATCH 01/17] Add guards around subtracting summary count --- nomad/state/state_store.go | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/nomad/state/state_store.go b/nomad/state/state_store.go index 0996b0029..646d9e42a 100644 --- a/nomad/state/state_store.go +++ b/nomad/state/state_store.go @@ -3573,11 +3573,17 @@ func (s *StateStore) updateSummaryWithAlloc(index uint64, alloc *structs.Allocat // Decrementing the count of the bin of the last state switch existingAlloc.ClientStatus { case structs.AllocClientStatusRunning: - tgSummary.Running -= 1 + if tgSummary.Running > 0 { + tgSummary.Running -= 1 + } case structs.AllocClientStatusPending: - tgSummary.Starting -= 1 + if tgSummary.Starting > 0 { + tgSummary.Starting -= 1 + } case structs.AllocClientStatusLost: - tgSummary.Lost -= 1 + if tgSummary.Lost > 0 { + tgSummary.Lost -= 1 + } case structs.AllocClientStatusFailed, structs.AllocClientStatusComplete: default: s.logger.Error("invalid old client status for allocatio", From fc406801634ff368dbc0096243c9d9d449a0d724 Mon Sep 17 00:00:00 2001 From: Mahmood Ali Date: Mon, 3 Dec 2018 23:08:52 -0500 Subject: [PATCH 02/17] Fix docker tests Some tests have containers that die almost immediately, and may die and cleaned up before `driver.WaitUntilStarted` runs. The causes for container dying seems special for each test: * TestDockerDriver_Cleanup: `hello-world` image just emits a message and exits immediately * TestDockerDriver_ForcePull_RepoDigest: the busybox image in `TestDockerDriver_ForcePull_RepoDigest` test didn't support `-p 0` argument * TestDockerDriver_Entrypoint: with the entrypoint being `/bin/sh -c`, the command needs to be the entire string; otherwise, it ignores the comments --- drivers/docker/driver_test.go | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/docker/driver_test.go b/drivers/docker/driver_test.go index 697e078ae..5ecc3c725 100644 --- a/drivers/docker/driver_test.go +++ b/drivers/docker/driver_test.go @@ -1089,6 +1089,8 @@ func TestDockerDriver_ForcePull_RepoDigest(t *testing.T) { cfg.Image = "library/busybox@sha256:58ac43b2cc92c687a32c8be6278e50a063579655fe3090125dcb2af0ff9e1a64" localDigest := "sha256:8ac48589692a53a9b8c2d1ceaa6b402665aa7fe667ba51ccc03002300856d8c7" cfg.ForcePull = true + cfg.Command = "/bin/sleep" + cfg.Args = []string{"100"} require.NoError(t, task.EncodeConcreteDriverConfig(cfg)) client, d, handle, cleanup := dockerSetup(t, task) @@ -1908,15 +1910,19 @@ func TestDockerDriver_Cleanup(t *testing.T) { t.Skip("Docker not connected") } - imageName := "hello-world:latest" + // using a small image and an specific point release to avoid accidental conflicts with other tasks + imageName := "busybox:1.27.1" task := &drivers.TaskConfig{ ID: uuid.Generate(), Name: "cleanup_test", Resources: basicResources, } cfg := &TaskConfig{ - Image: imageName, + Image: imageName, + Command: "/bin/sleep", + Args: []string{"100"}, } + require.NoError(t, task.EncodeConcreteDriverConfig(cfg)) client, driver, handle, cleanup := dockerSetup(t, task) @@ -2133,6 +2139,9 @@ func TestDockerDriver_Entrypoint(t *testing.T) { entrypoint := []string{"/bin/sh", "-c"} task, cfg, _ := dockerTask(t) cfg.Entrypoint = entrypoint + cfg.Command = "/bin/sleep 100" + cfg.Args = []string{} + require.NoError(t, task.EncodeConcreteDriverConfig(cfg)) client, driver, handle, cleanup := dockerSetup(t, task) @@ -2275,7 +2284,7 @@ func TestDockerDriver_AdvertiseIPv6Address(t *testing.T) { handle, ok := driver.Impl().(*Driver).tasks.Get(task.ID) require.True(t, ok) - driver.WaitUntilStarted(task.ID, time.Second) + require.NoError(t, driver.WaitUntilStarted(task.ID, time.Second)) container, err := client.InspectContainer(handle.containerID) require.NoError(t, err) From 5f124c7ce3dbfb2aaa270dbbc2fa59ca60ebcfcc Mon Sep 17 00:00:00 2001 From: Mahmood Ali Date: Tue, 4 Dec 2018 08:57:54 -0500 Subject: [PATCH 03/17] Update LXC with drivers/testutils changes (#4951) --- drivers/lxc/driver_test.go | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/lxc/driver_test.go b/drivers/lxc/driver_test.go index e46076bf5..f031c103f 100644 --- a/drivers/lxc/driver_test.go +++ b/drivers/lxc/driver_test.go @@ -18,6 +18,7 @@ import ( "github.com/hashicorp/nomad/helper/uuid" "github.com/hashicorp/nomad/nomad/structs" "github.com/hashicorp/nomad/plugins/drivers" + dtestutil "github.com/hashicorp/nomad/plugins/drivers/testutils" "github.com/hashicorp/nomad/plugins/shared" "github.com/hashicorp/nomad/plugins/shared/hclspec" "github.com/hashicorp/nomad/testutil" @@ -33,7 +34,7 @@ func TestLXCDriver_Fingerprint(t *testing.T) { d := NewLXCDriver(testlog.HCLogger(t)).(*Driver) d.config.Enabled = true - harness := drivers.NewDriverHarness(t, d) + harness := dtestutil.NewDriverHarness(t, d) fingerCh, err := harness.Fingerprint(context.Background()) require.NoError(err) @@ -55,7 +56,7 @@ func TestLXCDriver_FingerprintNotEnabled(t *testing.T) { d := NewLXCDriver(testlog.HCLogger(t)).(*Driver) d.config.Enabled = false - harness := drivers.NewDriverHarness(t, d) + harness := dtestutil.NewDriverHarness(t, d) fingerCh, err := harness.Fingerprint(context.Background()) require.NoError(err) @@ -96,7 +97,7 @@ func TestLXCDriver_Start_Wait(t *testing.T) { d.config.Enabled = true d.config.AllowVolumes = true - harness := drivers.NewDriverHarness(t, d) + harness := dtestutil.NewDriverHarness(t, d) task := &drivers.TaskConfig{ ID: uuid.Generate(), Name: "test", @@ -190,7 +191,7 @@ func TestLXCDriver_Start_Stop(t *testing.T) { d.config.Enabled = true d.config.AllowVolumes = true - harness := drivers.NewDriverHarness(t, d) + harness := dtestutil.NewDriverHarness(t, d) task := &drivers.TaskConfig{ ID: uuid.Generate(), Name: "test", From f6efac6c1225d375a34fc3cbbdc1f559b5d4e1d0 Mon Sep 17 00:00:00 2001 From: Mahmood Ali Date: Tue, 4 Dec 2018 09:04:04 -0500 Subject: [PATCH 04/17] no t.Parallel() in excutor table driven tests (#4948) When `t.Parallel()` is used inside a `t.Run()` sub-set, the closure doesn't behave as expected, and some cases effectively get skipped. More details can be found in https://gist.github.com/posener/92a55c4cd441fc5e5e85f27bca008721 --- drivers/shared/executor/executor_test.go | 5 ----- 1 file changed, 5 deletions(-) diff --git a/drivers/shared/executor/executor_test.go b/drivers/shared/executor/executor_test.go index 1c274a382..05ab48938 100644 --- a/drivers/shared/executor/executor_test.go +++ b/drivers/shared/executor/executor_test.go @@ -79,7 +79,6 @@ func TestExecutor_Start_Invalid(pt *testing.T) { invalid := "/bin/foobar" for name, factory := range executorFactories { pt.Run(name, func(t *testing.T) { - t.Parallel() require := require.New(t) execCmd, allocDir := testExecutorCommand(t) execCmd.Cmd = invalid @@ -98,7 +97,6 @@ func TestExecutor_Start_Wait_Failure_Code(pt *testing.T) { pt.Parallel() for name, factory := range executorFactories { pt.Run(name, func(t *testing.T) { - t.Parallel() require := require.New(t) execCmd, allocDir := testExecutorCommand(t) execCmd.Cmd = "/bin/date" @@ -121,7 +119,6 @@ func TestExecutor_Start_Wait(pt *testing.T) { pt.Parallel() for name, factory := range executorFactories { pt.Run(name, func(t *testing.T) { - t.Parallel() require := require.New(t) execCmd, allocDir := testExecutorCommand(t) execCmd.Cmd = "/bin/echo" @@ -157,7 +154,6 @@ func TestExecutor_WaitExitSignal(pt *testing.T) { pt.Parallel() for name, factory := range executorFactories { pt.Run(name, func(t *testing.T) { - t.Parallel() require := require.New(t) execCmd, allocDir := testExecutorCommand(t) execCmd.Cmd = "/bin/sleep" @@ -191,7 +187,6 @@ func TestExecutor_Start_Kill(pt *testing.T) { pt.Parallel() for name, factory := range executorFactories { pt.Run(name, func(t *testing.T) { - t.Parallel() require := require.New(t) execCmd, allocDir := testExecutorCommand(t) execCmd.Cmd = "/bin/sleep" From 2f8b1eb5eb8845001920e2b5b758b383a4bf0f44 Mon Sep 17 00:00:00 2001 From: Mahmood Ali Date: Tue, 4 Dec 2018 09:27:37 -0500 Subject: [PATCH 05/17] server/nomad: Lock Vault expiration tracking `currentExpiration` field is accessed in multiple goroutines: Stats and renewal, so needs locking. I don't anticipate high contention, so simple mutex suffices. --- nomad/vault.go | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/nomad/vault.go b/nomad/vault.go index f866a8d20..ebf4bced2 100644 --- a/nomad/vault.go +++ b/nomad/vault.go @@ -145,7 +145,7 @@ type VaultStats struct { // TokenTTL is the time-to-live duration for the current token TokenTTL time.Duration - // TokenExpiry Time is the recoreded expiry time of the current token + // TokenExpiry is the recorded expiry time of the current token TokenExpiry time.Time } @@ -216,7 +216,8 @@ type vaultClient struct { childTTL string // currentExpiration is the time the current token lease expires - currentExpiration time.Time + currentExpiration time.Time + currentExpirationLock sync.Mutex tomb *tomb.Tomb logger log.Logger @@ -488,7 +489,9 @@ func (v *vaultClient) renewalLoop() { case <-authRenewTimer.C: // Renew the token and determine the new expiration recoverable, err := v.renew() + v.currentExpirationLock.Lock() currentExpiration := v.currentExpiration + v.currentExpirationLock.Unlock() // Successfully renewed if err == nil { @@ -602,7 +605,7 @@ func (v *vaultClient) renew() (bool, error) { return true, fmt.Errorf("renewal successful but no lease duration returned") } - v.currentExpiration = time.Now().Add(time.Duration(auth.LeaseDuration) * time.Second) + v.extendExpiration(auth.LeaseDuration) v.logger.Debug("successfully renewed server token") return true, nil @@ -650,7 +653,7 @@ func (v *vaultClient) parseSelfToken() error { } data.Root = root v.tokenData = &data - v.currentExpiration = time.Now().Add(time.Duration(data.TTL) * time.Second) + v.extendExpiration(data.TTL) // The criteria that must be met for the token to be valid are as follows: // 1) If token is non-root or is but has a creation ttl @@ -1274,7 +1277,10 @@ func (v *vaultClient) stats() *VaultStats { stats.TrackedForRevoke = len(v.revoking) v.revLock.Unlock() + v.currentExpirationLock.Lock() stats.TokenExpiry = v.currentExpiration + v.currentExpirationLock.Unlock() + if !stats.TokenExpiry.IsZero() { stats.TokenTTL = time.Until(stats.TokenExpiry) } @@ -1296,3 +1302,10 @@ func (v *vaultClient) EmitStats(period time.Duration, stopCh chan struct{}) { } } } + +// extendExpiration sets the current auth token expiration record to ttLSeconds seconds from now +func (v *vaultClient) extendExpiration(ttlSeconds int) { + v.currentExpirationLock.Lock() + v.currentExpiration = time.Now().Add(time.Duration(ttlSeconds) * time.Second) + v.currentExpirationLock.Unlock() +} From 8f7b78af0c581516c4917a677970b33abaf99cb7 Mon Sep 17 00:00:00 2001 From: Mahmood Ali Date: Tue, 4 Dec 2018 08:52:53 -0500 Subject: [PATCH 06/17] tests: don't assert in WaitForResult WaitForResult expects body to fail and retries few times before giving up. Assertions inside the testfn body causes it to terminate abruptly without retrying. --- drivers/rkt/driver_test.go | 35 ++++++++++++++++++++++------------- 1 file changed, 22 insertions(+), 13 deletions(-) diff --git a/drivers/rkt/driver_test.go b/drivers/rkt/driver_test.go index e5ca1445d..0c065ea9e 100644 --- a/drivers/rkt/driver_test.go +++ b/drivers/rkt/driver_test.go @@ -459,9 +459,7 @@ func TestRktDriver_Start_Wait_Volume(t *testing.T) { exp := []byte{'w', 'i', 'n'} file := "output.txt" tmpvol, err := ioutil.TempDir("", "nomadtest_rktdriver_volumes") - if err != nil { - t.Fatalf("error creating temporary dir: %v", err) - } + require.NoError(err) defer os.RemoveAll(tmpvol) hostpath := filepath.Join(tmpvol, file) @@ -602,13 +600,16 @@ func TestRktDriver_UserGroup(t *testing.T) { expected := []byte("\nnobody nogroup /bin/sleep 9000\n") testutil.WaitForResult(func() (bool, error) { res, err := d.ExecTask(task.ID, []string{"ps", "-o", "user,group,args"}, time.Second) - require.NoError(err) - require.Zero(res.ExitResult.ExitCode) - require.True(res.ExitResult.Successful()) + if err != nil { + return false, fmt.Errorf("failed to exec: %#v", err) + } + if !res.ExitResult.Successful() { + return false, fmt.Errorf("ps failed: %#v %#v", res.ExitResult, res) + } raw := res.Stdout return bytes.Contains(raw, expected), fmt.Errorf("expected %q but found:\n%s", expected, raw) }, func(err error) { - t.Fatalf("err: %v", err) + require.NoError(err) }) require.NoError(harness.DestroyTask(task.ID, true)) @@ -660,24 +661,32 @@ func TestRktDriver_Exec(t *testing.T) { expected := []byte("etcd version") testutil.WaitForResult(func() (bool, error) { res, err := d.ExecTask(task.ID, []string{"/etcd", "--version"}, time.Second) - require.NoError(err) - require.True(res.ExitResult.Successful()) + if err != nil { + return false, fmt.Errorf("failed to exec: %#v", err) + } + if !res.ExitResult.Successful() { + return false, fmt.Errorf("/etcd --version failed: %#v %#v", res.ExitResult, res) + } raw := res.Stdout return bytes.Contains(raw, expected), fmt.Errorf("expected %q but found:\n%s", expected, raw) }, func(err error) { - t.Fatalf("err: %v", err) + require.NoError(err) }) // Run command that should fail expected = []byte("flag provided but not defined") testutil.WaitForResult(func() (bool, error) { res, err := d.ExecTask(task.ID, []string{"/etcd", "--cgdfgdfg"}, time.Second) - require.False(res.ExitResult.Successful()) - require.Nil(err) + if err != nil { + return false, fmt.Errorf("failed to exec: %#v", err) + } + if res.ExitResult.Successful() { + return false, fmt.Errorf("/etcd --cgdfgdfg unexpected succeeded: %#v %#v", res.ExitResult, res) + } raw := res.Stdout return bytes.Contains(raw, expected), fmt.Errorf("expected %q but found:\n%s", expected, raw) }, func(err error) { - t.Fatalf("err: %v", err) + require.NoError(err) }) require.NoError(harness.DestroyTask(task.ID, true)) From 2c9b6cd7c4c92dd8bb05fec2547b97c871e00fc7 Mon Sep 17 00:00:00 2001 From: Mahmood Ali Date: Tue, 4 Dec 2018 11:23:26 -0500 Subject: [PATCH 07/17] drivers/rkt: use image isolation for rkt --- drivers/rkt/driver.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/rkt/driver.go b/drivers/rkt/driver.go index b14c2da87..3ba505414 100644 --- a/drivers/rkt/driver.go +++ b/drivers/rkt/driver.go @@ -125,7 +125,7 @@ var ( capabilities = &drivers.Capabilities{ SendSignals: true, Exec: true, - FSIsolation: cstructs.FSIsolationChroot, + FSIsolation: cstructs.FSIsolationImage, } reRktVersion = regexp.MustCompile(`rkt [vV]ersion[:]? (\d[.\d]+)`) From d1cc66ae493f6381740f22f801e6b766651041a6 Mon Sep 17 00:00:00 2001 From: Dan Brown Date: Tue, 4 Dec 2018 16:49:35 +0000 Subject: [PATCH 08/17] Add Reference Architecture and Deployment Guide (#4768) * Add Nomad RA * Add deployment guide and nav * Deployment Guide update * Minor typo fixes * Update diagrams * Fixes for review * Link fixes and typo fix * Edits following review - Update image text from "zone" to "datacenter" to match Nomad terminology - Clean up text based on Preetha's feedback * Text updates Based on feedback from Rob * Update diagrams * fixing spelling * Add suggestions from Preetha and Omar --- .../assets/images/nomad_fault_tolerance.png | Bin 0 -> 43308 bytes .../assets/images/nomad_network_arch.png | Bin 0 -> 43433 bytes .../assets/images/nomad_reference_diagram.png | Bin 0 -> 36526 bytes .../operations/deployment-guide.html.md | 241 ++++++++++++++++++ .../operations/reference-architecture.html.md | 131 ++++++++++ website/source/layouts/guides.erb | 12 +- 6 files changed, 382 insertions(+), 2 deletions(-) create mode 100644 website/source/assets/images/nomad_fault_tolerance.png create mode 100644 website/source/assets/images/nomad_network_arch.png create mode 100644 website/source/assets/images/nomad_reference_diagram.png create mode 100644 website/source/guides/operations/deployment-guide.html.md create mode 100644 website/source/guides/operations/reference-architecture.html.md diff --git a/website/source/assets/images/nomad_fault_tolerance.png b/website/source/assets/images/nomad_fault_tolerance.png new file mode 100644 index 0000000000000000000000000000000000000000..1d5006b619d3bf80415b809e51c44f03183894fb GIT binary patch literal 43308 zcmeFZcU05c_Ad(3L`0f&1f(Oq3sRL{11ca@Km-Dj4N)L;5JjZ-4gmzBGywym6h)e$ zL?CnoDWOOSO+x2=gYNx1_q=n@81KI~?zm&@k!|u_-?`SBYxenBM1hQTs4uWxAR;27 z*3;EABO)RJ6A_(rJ5LV$GTHT+j)*9fNKaGaj^FrdQ&0l-ZswvQyMdwPprI(;Esu@P zHXn2x!xtY(nO)h5-k5i>gYRp~`bX;?xzkkm7)*?Z4}^zX@`#SYxeLSLuDmbL^W5Zh zrR0}LYqV^<3{t1m+O#rLC+5dVke$@2wk$NL!nTecO=YKM;-`Ah3bRo?jV<*7Wm|#U z`#IY=(33H>+xo)ADQ5reV*zyf)BdX)e-s^A*P;DI^5XCR92awa zPc|jXhgqOp_(`Zq(I1KhA={oOy-XTLpg+@4f}g`nem|tgkjnj;8NO?>`O~81!x$8; zQrcGeaeaLC?Uze~ec!!0uaxFyJEhzDWcu_D(|kKx&OdS6uJmmxqwbr4E#{WyY+JYd zvR+$3;_C;EZ^(HD&aqFppRS@$$`3AvkIV&m)PMIGnhP}7F#5eqxm~!=J~rKgtI@eT zZDA6M&OPU$4pPevK3Hyoh7|)eDtsmGyUcaOHbGmC*F5ok$Mb?}W6f#P%p)P|(0uo* z*p+<$pRact4J4W#v#oBf(%!cWHjdlANA_nk7|qaexe=SeI55@^9WXT*PWRS4e4I02 zRcb9Tyua!?KEo-_jd;cLWWh6Qt$sRqT*#V}wJdC0gW?LNc{hwE@ILC7r{5QLs~^@4 z-dI`MIcQGE$^Kv*CHVIly^bP5iiaxxL==rHXnb`dmxGs2s}PsM3E9!9JtxOa zwRt2?`{3RB9M`EIBjFrA)UBHReRN_no-Y z`?x!vq!>%1{}B-*J_Ioj>j%s84}Sd|g1{Wa)h+@v#Ss;s|M6xzM;bG-GZ2eh@V844Vbhz9vl4NX*gRaT|jj&IfjM$*6L^Tk9qAzs5v>> z=pjL3?SF)D6W-ytROg)4vq|5q-m+9UX|KIEfJ@SH;Mt-m=;2@cQtV{$+;qCt0lOLi|8qS_`%bljoG_AO)R zpXa?7FpfoTe_N=3Ui%jce=CM?@jv#2{_k_q|K}n9-|I^GpND@hNBDmp!Ug^r_qQ0E z>HjnCZ{8KB{PXai6$$_I@SkOv8IWV*lzt)>zHptqb?|_4_%9XocB<}5Io+Ja+&0No zu;0g&syb&&?l1;v*-Py(I+X`GuWH2FkK&v0P0y=)0rTfOdPPQ~^=QF>Yrjj!gW-8| zVbzid@YykLK`M7^?zX_4=LNto2QLe%ga9)uBdh9s(|Jim-(Kn>K$8x0@z&hno*{zp zrQZVhqy!gHAO}sWiySMkP;)`c8spPRAj{`@X8ci#+jC%|V7icyv6Y+#<2 zu&(ofqvg6R$Z8|0OJ_rdsSaoA@sIV$8oZ20Rr|8n@Ov; zpfe&3vCz{>mlj+Q&OHd*xZUR-^sFi{?hB1tpsW37g;}IkUwV-9H)W565E8=Xc}bDt zO?$J^kk)}G-w%GRWV__SN@Aa^3>zsvr@M5(l~xrn8zq=kn&i?OxSXcVLs0 zrNb5UuIXeZlIs!svPAG^^ls2bP!99rW8uD!Ki`!3SLHq#zBicH>9x-Ib&;EGemeB9 zZzqIy(P8K5k-azPSN_vW$Mj~gCUe=ih&TCF3FSM7->K{yPEQU?IoNlgY0WnesqODI z`9Jy9VDmH|9?Py!hkLpR{a$x)0a6plc}l*$CUQKrLai|QtzIT>@vlo$sG#%8r!g{p z-z;`g6ZiE;a68=+EtBPz)rH%h*oyk8@w$+}XS*uQ&8VRsE`LI7`@xg?4J6laY`d8cCz;IV#7uMMcr3>Ei5|?Z227u`Ec{?R9#u{MypqF zh|>eEU+i}|U&Z!|&vNAHncX#5(B=FP$S+9ir(taMa4VJTcu8k%WGhp#AWOpjHH;g_ ztDKD=_SC#=^2#a}PM`nLo;@0R z#uK@3@LG}#k+QglDR-gNitaZbfei-Vrd`9eZVDmmrZktmX#*<$D@={GRJgYtC8=fTDd$= z_B^Q&S`*yDg*j}g{HZez$Jfq3qyisJZzu}&a#Dc0DIZigflJ{2g&fNm;QUR)tsX)9 zhr0({H03VkY7j#v&Vge@pwaH`uTja!YZ0wXaM}|dYQ>ZBxS>1cnZ{bX!J89an zY#5fYRsUd8ey;v*m6#cDAltN%x>#uW>Wj~}yh}+r2PI&v!10Y~wxJ&@r{YAWOe#hK ztTn{oOS==ETp~ae(L2U>M`k|}5U`kYm_kU(6{%2q=g3VNNTPg$7+kwDX+jn+p@Wz^ zP9aiYhIil%X}-cnuZNC%1o2;cPcW7scIkqbrX@8B?+twXcM1QYUTFX z!{1$!;Ue31x9P5bD!2J=3`7JWrEk$3Ngw#}gl4b4W9Rwn?@SokW-kgkqBlFKdl&um z?1*co&mS0mqwlPhz}Bpd9bDj)0u)&bw%$<}KF-}dkP4cqO%aq*c#v^AxUnovHw?&z z7ZGwJ*QS+YLtD_Jk%|ACE$@=dF*UV4DpgzRTK*#D5*7IAp8hhs^U&wIaI0Pm6j{Uv zU;(R-Pj=WVVqCm}NE5W@|A+~MNNyoAwaK&}`u#3mg#lsu!D3gt-_=x{-SRxB2%n2) zezHzQ2F3;ylQMv?)6N;E)*420?7pC)?cyEA#-bei@J@_AoPrElGymG=yxUcc*awkl z=Fs;b_%K!^W`L&lm?Br3&!Hja4#2w(I!ulIV=LSyKA{8YdM9zCL=kN!mv5fL8$Ja5m-)D6QcH4(a8Lzj?0xUf;6yHrT)>9jfu% z&FN^fDpq@tDpx1j@ySr;u45Kt+3E4a{t~CFuby2C5)FDrnmqD+lQA?dU`FR@O74ot z0ZK@{!u+5M6K3^V98xf8?)t5zz{X;mC@;C5F$*`)xztl=M3EzYXW404#4xhpHcZ}N zb?&2|GHk@-h~TQzWD%*+QEk%owm+>7K5!v=ckt)K$Trg9wk z7ryUKT(~c;9(zfkF%B<#4MYM+KgIqG*lY29j&*gPtOx4Ma%GH~DC3R1jt(weroIOh*=bV9Sge6|NYV2TxaKJI2|;7sUE8l6+hRA-m5KkMXhWZxDp3;?#uSyhADURc2^ z-|dOcctC~hhw15W<3Hn$7cjFL^P)1TcL}zBks0y?cvad;E&CdG_$4=4!^$Ecsx!EN zarKjGNdEMKwuyIa{^7Vpg^1!$3h*%#6=JPQ+f(-8r+|f~`z#qUl%PD{*3B&_Hbc1J zB=x-cFuO2u`jcts%^<(Z!qvc-{K}?(XYVfO#0HL@@r1t2J`@PnCT8$*^lAZ#3n=X$=ZEn@dB zG)I?u((s{U7ZZhkw!xw*_&~x*?J2<*!qM6-tHCktzZLQU3M)| zJJ?A{r6iM^&fwQJswk^i%C5G zCQJ~QQ@rUG2u%g0w%|UQ_gZXRI8jfpO7C`n#(U>ky{q2xRT)=r*{4qtPjznJ zAsrMB&;LfwvY$m`9~ID3U-j3ixcybPxzktf@4^mu0^;B$RWYp=s9ok5yZPiXB6RDAczr{rE#VZ7V-dVpx| zlfcl{IgLhX25hMDbfXI`pZCu0VG0$dnp41nglAp z>o=6Cz&rgGgrOa!e}?J{1LpU(ekN$2rW_avOhYOcYa;A?vly6~FbzQTU&zR+7N?w% zF$Ja}hv z22>~H@-6Rk{6BSA@w6JvKk*j=;zuWdU$w|Sz z?Kp;PcDs-ihdXm=^|{~5Z_M{B6hJE<)hVC61LSCDs2lC+CV%=E0>$?)%GEb5rYw{M zsXE<|R+=03&7GWtuI~5FSxgR}tOKd4zS^e3(hSaSViLBYFg|@{BB7tLY}(JTcK5hc zj=lL{PJVF+2uh>AmEi2BPqyriCqi6UZgt9?Zo-+?^BcA`7_J35gU|h%ukCH>v>iS2 zsJ{gf=_q#`a!-?^$!TmnwjBUGTMcx77au(4?Kn68p3OiB6p<=*bI9Zs;ODFS$hBKCLYT!UHf}V@Qy-h zQAaGUxtf;OJ=u<27-59a&GMW)ye+Tk^m&%K)LtARmKgEUPB&yR_SsAKkVW2JC>}Ck zk#-&-bvia3;B>Y0FJQ~#;VYj#ZQMv?nPgd-Y(=++3=s#>&eg}c3QW?L5Oe!`M{x24 zl7*8#b}H6*o3{jW!Bpq*Y5bAXWevp~c-?!3YfOS$zTa823=itK4^Tbc&vcwFe-6$E zl)mo1W9>cmJgJxOPoC&p07okqSox0LJE>&nrPQC@No}VB8;<>D*Ch4E@8|F#z^GnM zVW&-s=+X1wXqf_@M915XA?R4s3dyo6Q9IBfR?hbz;8Bby=XF>EkdcYS>^VIwlCdf1 zjR03_EoZjObqF~n)t~FPIEdC9oAz?L<8>I&QVyIQ6>l0lvY$0gFcUO32eHh1Rb}{6 zv`k)`wLGPg@R)}^M+)^Lz5-r%o#C2!$CmFTi?ebyIJdb*S0k2=I;1l;aqabPmNT#; z0R(G!7G)~@Axn5xvl$Aa7GoL-tc6hIet44~!3xy60gBIoallVk5t*Q~@;Bk9tH3Ye zK(UPQ>2Mwl(0X_t_-BXU-xPoU2GAu;LZI-!5Tl|1t4*wZd)V7-@49}pl-au$a*SPA zsOOlrIlRI3I2Qd0vKA}Bj@)cLeT0(Nj1DW}kQg0QnW{lHtwvFKvg zvW|@Ooj!%jSTVTdM^^^m10FR>sOmHh|H{0m0r2ufJ+>~gs{C;D-jMtijYAv25=_*! z0Gf)l1KpsR?mB6u@80L!RBBGE`ogevysv71BUzyxx-C_S+v2?i8njqo#<&j7U!CVA zg&B^OKo6VNs+uv|1>+~RlM(?2nF>8AA@hgR@6awKHo%)hanHD(1PR;%EPomi;(N%z z)&h31-tglhps5XV&DY~!EsTBS%JZ2@>&$-?`?}HPbJh_-LCzzat~U}PAXj}8|d;H64T*Xku#9FwG{v8&BAq> z+@PV$l02S5$debiJJ6Vm_mtxghaOM6v`mj=qZSvOHupDJo74$A;YK)|FZLp~yPA|O znV6mjYsM>0FK*MSV2;%*9;zzNT)o<#~|P&?zojmn%KDzL#Of}gH3q($^ora+TiM^vWu?#=TyaKHN$uJ80&wL$*GG*A1>l=3KCpCAbI2EvtQZQ*E22D?{Ut&oL~GbQ+f0R z_ia&PJ(ba{?=mGL{H~0Q;U&n2y^g*IFU$}gSq(YTD6&~OLZPvMEd=yM?Pg5dqS@7P zZ%%%aHpdh(?LIgB?ZCxUyXBnsB$iV8Ohu>22SS2o4Y!0*sorjNz`V;Mb2MOIt|wC| zIR&C7F&8-XuihfEe!TaWvhSrxHRt;;kIr+)9FAG9Pls6K|?695%;@7iP z-_lWMA|J*nUlfW#C_mSGUKpp8J!YGK{iBNyv9+^w3bklD>*G}L1wfl9hy0$h{gBno zeyHlP6n0xYQ{F`kbyY75{OR%uLzJNyYoX}tMblK6up+>ABYV~mP)raFiYd0&ou@ZD~}XXe*n z++t0!?%>Y2rH^->Z-tg@&o5V z0%e9bn-oYZ>m16Z!c{39>Ii8`sh>=##5VQ@&vm;{&k}_20#PC=8o(ZRQh|}KrH>mg zZhagid#sWlKo)@tjAV2)y~8lHMf0iLMmHjkU%wtI{OXTb=@O*cIfa>9w ze^EXTm3$NUVT%TJO`*!>#@hCbf~mLgnc0NPOTe{{eP3w0jN7DG_~(EOmn4!Ul3q#P z2+sTZK&sA$YicTB1^Qc~w$v-iVlrPSmfNn$XwMynSxr7|*E-<8C54NwBn#__I z{Ve%!F^DEpUI@?>OShLfn3gzw(SB=#_f6Q%o>BtifHRyZvH#Yn3=wmTy9cT9ursZw z8@Wexn?(RRPQFH6mie&Rw;>F9w%1q+gfmfe)E=^n;eZt;5wFvl%q)E^Oc?Fe8=Zks zhrIL+I+=9~?nh@krd|gq4_atbfsqYm$gZ{89%f6J{N+Juu%b?n7dBHS%qnk!OHwZt z)Nsyu*$9SpKa)UGq+Q#@6#vr01S6IWE8Q*;v7J;K|x588e`kFk+-P%}6jLJ}y<9 ztMGUcl_L%+!*V>G*ABhMnd!14q4dUJle1ez5K7ViXD0cpaHg_?{%wOQpB>D%!KYHG z(L@P;4sl+b84o{l$> zuxi-n@5s)-_gtGFQ0QJ71erRqRS)h(-OEVLc;DTtsH|F={$}?zE+9TgG+>2J#BsX# z4{ZuhQSiD?X5*iB4w+}Q#b4(NS%LLG8>zoyfj!Zku}1#LIN=8T!!`-HI)fD=GcLTA z?bDaEkCnZky}axiwGCe5;(EE8J#AgSXW4xvRN_cu8eD*uvI1%3Y(}p~_ud&AXTy@YXBl_~vLN!bj!v z36JK!(&4KVyi5lTX1MA@@jl9)bNH|+XC>eB{g2Mx1}-%(yWo;F^vLlS3-iF`2}p#% z%p%p)>GHi}<8M=A7B8rm?1O_1K6;6)sR>Ryw>7&K~+jvec~z`C)my}{mEU$x2g zqS2v_sL|5$1!}LDCN%1pHHx~l!WI9h0xKv3V-9ER|5sM(}g zFFrS7z;t6X@iWLZv}76lHd`<(|QG`?r==KCym^w3uQ4bT^o3>KBmg z)hC#Do9N?EQ(rnJLSOMlp4lzxd>c=>S}XM9letl6ain{gTu%%RchEMb;@YiZ)<5?h zH1(B)fX~WX5>Q6`#8{qr~SN@YMcv^ZSAJG z|KKL`L=7QqBS-w&j?eVY9!K6`*t8=OR|@wom4s37`W$a12g4W|XdJAW2vQ3{z)K_Z z3UnXUF=ALUi!847#Bf#x=JdaNKkcC&OK(Jw--0XvED`atFKY=qWe#$BC#u~PS{FNQ zrPwZ0GktNz)(;N&rDc(15^#)J|J5GX5u0$fX|*PwFDdxcW9>5u*MNLhkA*j$xBTL_ zRME#BF>~J%%Tbd>H$c_?3wAj+KpMrgeU}9iZFj9wuo{Jro5ByAmvZc@-!Uaj&jI=( zvT=S~C0CXv$NTGL*INz8x37(nf%ndHBY~{JXl3S-+SjSu+m)4karic5n(77c0ct*! zjg!cxU-4-4rS-UCIWgpTE1Dkj{<)b}U%d31&GGHHAIbTWvuU_1&^a(%Tab4D;`W3` z_u1+6D(OZnRd?*18wPJH*U%+}I;fL&Xw@VO&L{7I4zDmAL%;i0JXfy71~4f^1#IW( z4xBqU%WQziD!h-8p4tD^vIixNM#Hg=AjpqKWnqR`sPWZEQS%V-i61K^*%&NvdEA1zYuKl=Yf+Ujf-r z?09+h@uqu8(E&#@xVNy%ERW}-zO70+-(QxB{+u%_=id#j8k8)K@8SBq$6>?(2#x>^ z##=L7#$%aR&oXoMhu9|DNrHn13$7J+kg5kbi)QI&xOujYyy3Fb4QD5ja%_8)HyP;T zhk21`cyGy$l*PH7_A$y%>2cV85j9Vv`W_v$VE{P!q_^J~6sp^nqEDDtJvIPXHA)0&Ehk)~RtqC+unhh>bs z+g+`QtmP%*umKD^;Gvj=gGc_o?hKLCgpB7%Jyza0dqKoGiq8~=xstl3MxQh8$RjEM zM0Ra08zTBSj&fZ&qSSM?es}VCT?i`zV*3Uv=&Bn!kYDWu-EQSkp}TC0Ir7WC;mG|I zakS?g=e*2uqezH=H&Y-AyZ_q~*+THxMUoiW7SdJ8#J?B46Aa z+WrJ9{oTfXD*OI}%J1Ftsf#JaDYhbAggk%9FO02dg~*Ce`rY(oznS}K^|ENN>7&2U z97*0oBkwD7T9n@THqAb(a|Rqn=0#9ZPC^cu=heus(4G%l(Tyxt5KZy;HzW_dY{{>0 zC1*B@ESj38Wlrb+Qw0#X!%KGNTT=JW{dP3}IFx_!Bn*HrghT|_@b0xOY0K%4lIO?p>FpPX7x8Gq?e)-A-d1{#=+i%Uf zfq3#g8e5tF(epMAnVvsAuwI{5C4%R1j2h3{bbMs;-9H3p*W$m7ogz#$@Z(!rn zo-`s?<-b)D5YYK0pvF<6V?bt9BC59rQcsZg2B0~}>p|Q~K74O=n&nE{ycja)b=n{; zkbmFJ4w-K}x5rzr&fbEoska|DKr5@Y*N^6rR?F$`IrJ8x(5=nxFtqMjJ>fdS!4alL zYv%&B>WPYY9;9*Z-6*@8B`9FNb!B2COnSY&i7tSZ*j0$Wl)|{-6+UyReO69B=fO5= z?`acuv$S;0o*vGW|19V(Z9*v>C0O9j92xlC^5pZPThIEqHFb=4pKWj?y>gv?%;}ZC zs$yfYo}H%hv@Obgqpr~<=_6OuqsN>g=C4|JvKt~3zV)3I*ms#;Vto;% zNsX^ExpMu(P|C;4y!$6JDtvlg(-|g7$-+tnx_RDDLeDr#37)4+{HWRBK>qr?(#tud zgSuES?t|TzkF=mJ=Rh$pF9fOV%FTGAl&mgiw@HnADCVUA`&%Zkai6hZCq~-juTf71i>OU(1!W1^U?M*}j^xSBc)d%s)B?UF!OLyRgl*q+PRc z@Hv?#?bn1gb0GB@R_`9 zA6|-x>s$5{Bk~4F%+`_~Y3bCR8Br@n43V^d>`gwchRfbo()B|}V1oxvkN6y5uTN_h zucbBglCu=~W4opdySF=Cq5`aD&(4$yQ{!4{+YL_UOO0aQws6|1xcpXOY3pdeSvhk4 zn)Wi_-t6xw!?j&#i@^6%RJ8+WKqA|vR>rrjf9ChiH#&;uYC-rvC8LcGgZMpPCN^cJ zEu!0yoO1Rv)iE&}j|-EO``{n3k>WZF?!sDFM3z!}2G+5vnS0ir;FQ z4_H(gD^Uqpk(+GsX)^eW3NSE5#K=)Td5Sez`DS#O?}q;}^$`c;y~nn*xA~MzWjDTy zeI|>Pk`O_Kvq6B)vagbRgKvyC;68OMjFa=*o4{1GTE=GE8NyX}k0j&L^Z6^$*la>M zSqzBQ&cYy7bwbh-o1XqGV)8AKrKrBW>ws0>~o}x#a_Oc?8eyFG7O{X3_Av+(Gn#^5edt z@Npg^gkzEA7nZwi3yTM+SrX)-@%t{IZvVh*BEXmcQhL^Zg(CR7wo8oYXtq8Gs9Z5- z*DE=C#$0nu_6~CP3LgjBML1l8RLy(*dn%xPU{ou^Pqq6Vu5rd%qW{H49?^kz4ylD}wk{2}?uvjoqQ~SYn z1T!ldlx3GQB-5T7A(k6~dVqS%plhE=)3otzq3&|;bdb~4YheN~ zPi+kd9n18w{a#pXe+J%&huPq35#`X2b3L9w_p6TB$?mD5LGt88MOBZn$<*U2s%VyN z&Yp&0fU$|)O?ol=IicNCR?$WRcb+b{8=1(vPk9wWK4+xge`c!lGhF~t(5q%Uan@?1 z>S&C41yOb{209(F@th6!Q$;k`psEe|nn6;i2=HIk@4G&H>8mkffo5s;e|~SNJ+PBH zwgOb`A3Yjhl&Pa~GA;{UBK-zTT)leSys`lm6_l)l&5CVvG1nR*o-;o=iK}FVn*Q7a z3h@9oV1VIM-%{lEa14Z!Tx5yJv08-y|8kcyWgh&vrc(M|`jym%<5hLlLl&v4_?lxDnfSb> zhxa~iFhcuBoh$(v7BJ(RLVNo4`0)n^Z<-wY`tdWly8*mxjhZr;NHUFXmpwJKXSMCD zg?ybXW{R$OY(?mc|9kTp`EFA&~J35|Nn)U3<*fHoC?>IIs=0OZ#UXxzqTikbjzPDbbTLPB#rQ}<7E zzsEKOI2Yk!SyiBwOK9#Ast<&T1$5H{|EG%|MQGJK33MkD&;gkr0qF1_x`cP2%)dM6 z|K4(bO__w%1CE5y`~S0SOvcwOK002o>Se__YK!QJ}3c=*2wYI5^ddgT7u&wx}AKpfJEf0P9fyfdW8 zzrYdz{0AW2MlXL$_rEHR;cxi`l!O2^F?{t0GXe-6ptJu0v%U$snSiM|qf3Bd0D1_N1pf_2K>(r1 zY5bAyGla~;*X-hZUeNVU6OOWc3!qxpl)vA6wBKlwHy@G%C^`{#i?4}*|NCPb{;vKAcVF-Xa8m`b-gkKP>>J;J+h!0O|er;Z6c8 zjYf!+0c!$!iTOWE2wi=Ti&dVxq**%MsvV|M_R79y;1C zjXP!O5I(T^tZ%3MgU9V1i+O|w!Pm`0emGX+yoP62c;q4P zIW@`Q)kfEgO}C%Q!~d!ZX*$ll{tI(En^DBvu(8GFa8IR|%YNH=qG+ndNP~jst=jU3 z^$#oKyRj`Bj5M(IhDHA=2G!5iLuD5D$}cV(6ph#)PiY<*D{rzIL0`j|+1~=q0L|&Kznp4UUYfXF?8qV0 z+iyZE%O|ddJ$MLQUVKzHu6M|2G6vkZnRrE>c;3sSG}j0G6gPdm?pxm}{$Z(bcM-Uw zRnQbS2e8B?zytr?*E1d>_ilI8X95CD%BSCGJR5O6KOdU#&Il}_P*hPz=_Ee4F(HvP z+J8tT{vHlFBvqxg+xSF6^KR-3dWK=bvn41%R4HI1bJbw4$D-w6h-r8)ZyT2Du1GN> zV)GOoF*5(-Bzc_map!Fs1<&_CA526@xe#wigzWhMQ8_z})K3k)sMx^_i7(l0Q=a~{ zdiR$q^5nM~y_~W~iEi&aV(|1I%pTv?dv|X3xpa&4q#a8yyNxBsVk=#KhmTz!2KldcM??*KIVQKHH<4*nxnDFkB<*dtkRHRXs z`1Iq_L75m>w8Zyg2EtOB;##23s0WmAuqxt~E04!P7x_h!k%O{3>HC)!DhX=Y zwbNuj`HIeRv5C8S5rsCv{7gs`)v6&0++^c7NTk(beIV{TFQ+}=y*w-aadm)1J~WO` z3>8asGtZPnj$YcX^p)F)tuG|GHsgylr9bYc=fv(#8kxw`9KQZxk{H)%KPuuJVrP!3 zebdL6weHDp4%as$n=Wy|4kxCk0&=0PMPPWxlR&O1tmF`FvwRPqhy&^H%7)me)k zZYo{TyQ)1VG)A~`;9sH$&gs6%=W~v=V`uMae&8b>gK{z?C57B#F>BEaJ>jsJea`9& zPUONwNqSP9V+w4zGHx3#4o z@;EPvJ*5D8PT?&4B*R2vjiLP&8Sdu(G>d;d;tV3`3YAos&@UvGQ+_%E?8~(8Mb!_9 zJwrcge2%OXdd&FYvGbkJ*NORh=^gekZh1xp^8p-k!HLHNlGM~h;^HT4w-;TchNbo_7zX&aX%d`N%Ef+5| z*M(He*o&BX#%!0-6@ac6qONXQ7AuNbQJ4mDVQG8HE8Z()b&AK%uO==M6ezr_!xMPz zsahS_3+253i^-sDD9~+srSEO;vIK9glf)VRqI!u?2mq=9x5Klf+p z42;t0%Cf4rSVbgi23SSP+NDQ4WOLCj$)nzCSIw=Wj|Z;jyEt#gSiX*J!pz#0ud|3~ z^7MU0JKpUa&vP&DtMkU9rqIV>P*J7^$Th{L_3(Nod<=*Vxo`qgqeG3WRk*S=WoNlXMSY}n`=lpE;%$RVz zp08qQFuNcpXI=AG&SN1{PO$Qw&l_X4Xw{ERaYprIziZ_{GdJUt60U(QC}I|9VjDDaxm94O|G8UfptEq`I2RsTp7aq*VQ_E9;(%{P%t z%qmS;?*sSNouu}nfr=1-O@w0VG+1+Zmb<>{nNv58K9G-YiYe5A(Sk$*^5%jSmoFre zVw+;#`#u+}d<|p$3TjbF@I&)YYVo9N4JZPrv+%5`8cPE%_cgDUX&Y_ZV4^^ z1-0jLW~pELhhR-py+jU_?gtn?e2O;R zRUR;!=({2g)Y9)?t{PIO#$E6%%q6+qe?q7F*$XbBy}3z4L^J)#8b!Z+(bt9nUnCx_S&WeCPv^)?x(}t^vC*f?A7p2Z4`X_Qe$3)Bn7ks}9fOwaqlDczTwe}rTM3Z(l zpf5;Yv|U@s{0n!)(T6=wxJYc12y%WeqIQE9V)GFQretrdzPS=%BF=vj-vC}fZuU^)&AByci7td8y2#J;Ap$| z&_Yh!7V)V2GXQ)`Z+xT=i&=aM|Rk7OA`UI;;8gg+@c^GD*im0YluV@tf zMD=5aEr~8EDT9v-o}!cUkOa(Uz~_`x3tVHbTVzmH2)(8~vV~T^v!2)oV2=1TP2`Kb z_$Qq~a~$-wx_NsXJBSe`4i-j4>e^pb`N7rW=G}D--Nia`AwhHZdSBy@-YI&nY`6I1 zh9HMkYs~jl=cp}mm9cv`yWM5C#iM!=)f-4L$Z^90tIYo8%>wIY>t7;G&R%f{>~0^& zC{bxm4@@3Te#aS9q_QpZ7C`Ns*X6X0?mt{Ye8rP10m9zOyxfNR%fg?lN~e?w)Ona0 zulTl>Os?^jNA#XHhah?hrQnLoe}7!Kuya@mImSjjNxwU-v&LF%k*Y|+DRukO9e;;R zPwXcOcUbBP0sd=1ijjO>-f16L@`3IL^ZExzefqn0%>K(367`>kajYgDutzAbB#Fvy z6q?GZ;c8spJx3?5f%Li6D#JRnX6}qfv%8W48CPk#`Ss3xl zO5vYvJ25KwH|PakkF09YOiH?zBup=(uQ11!bc@G4Ld2lxfIqW{2x;b`@>dYDVnH*4 zbRn*kv$8oo7Om3XxaMNdzQ;<+EqB}dg-hzJN=m-Vm)h^V7x1dvme~o*V#(Ct$0aFL z?vKMPnBaHnnh1Yg0EJe+tp+M`qS#xx7IZN+`UM>L;}y+8I4SUR&u{lgA8ZDRC%$@| z6ClHNsf8+Jrg7udR&9q(ofk1O-uz@?KA;_U(Z0Kn$vZ5o(%<9wGHv!UYg;jmiLDqz zywJ2eWU2cVd$H! zZHlDZb{Pz<0jQCL`*bmdQp|B^&8<$Daxz`Bmz5!(Z&He$Av2=l1Y0$IdQhr>JgHuY zvNv=afjy|WJTi|bdf%JkG2<}f!b;B?TNcKaABm%^{2FW-H_Vz0G!M13%UW-JJ+Mobn5#k=Y$`C4mkHg1Gc&jy%(~x#u zuiD|Oq%>)zAnwdy?mk@Dj^RaUt+$>J1P+QpsPTn+Xg(EZqqBb8r==h@kO(w+^28nf z+@f7(v&4@Hy?#zksppHmx8N=f*9RjtLV8*Z^uW$F>5aYkpdOp&6fraZYTl$$rNZS} zsP+EEi(-{zyQl~;LEU0j$2^#<_&U@sQPYP%q_JMoAW5~?&0Adz=bjdj;*`(J!^Hf0 zEt=^souoT2BS^V`8d z8oYA&Br9j8oho$(7cO9gVlR2V7-+MyF3#PhU#Qqf!D-Q(uXub7WkRW-H~m%Z1R{y= zt6$00y^4whFJkB8FOX>eyp{5Fg)*5K{H}%NGYSPs>`QQkVw+uIq#U?R`E!koDUK~V z=PX|~IAB%5Iq5f&{2r!9{uSKIb#wAY00X>hi4_+HCY{0=+C|fB<@n)j@)xIL84$$Q zSRp@Z%m?KN(|28JT?~$Q#MF4>77w3U{D9P}HB?^!KMstXf*mXP;|j_}QTyh3!x}E8 z>j*0k=LA5M1rXH4U@0>u?%O0twY{&4C4Ba_A)s1HtV@I*mQS?uD^`ae(Jo}QbMu*0 zdefpUT>BgQkcfc+a&;IMuYh>n4+d^S`mjQ-tCtL$$2ZI+*{3HlI!81dDW)qt-^e5q z*8ZVL{uT)T`6I^$FMV8V9cC}Qy*U3%Et3v|vfG~2E3S_rkZ~7Rr(U|&^okrztc=`h z%LyU6gOzDjb6reS)9j0=$10buG!xygyo5^CvV}8Yv##nl{9-1Al7;Xz2BxG!HUw5$ zD=BL$*s!k`FO(lf+~I1oqpcIZ-BD)pI^4=QoW~2$&hF%cFsl})VHgz{9IPS6ElOW% z74X2JFb9)@kFF`m33LWUOX~y*r5g?wBqvwqa4hhhr$Jr0b%*uhIk3!?L2FVuxe$1V z%DGlYB~5Bfq2XqY&U%JVOU^`_3d*JJmy`;he#vHyI4JtkEX!Iq%slTyKY*JlCRTmZ z0$igQrzevOj++UHDFlF&j=?)tXwqBztgIh|!d}*d64e8H7zh*6LUp8eC#TUP#8L-3 zpP5-GetSP1V5T0sfAxj*Rqpb9i^njlPqeCpoVoNm=M|m6wR6bpi<#+mONZldxc0re zJOWmciVAER%t32Tf?Q?99(U=Wj*0@c)h+IjX?D^To!Y`Xa;!83@9bLza{*9)cea;= zFxh|>!%}^dWxx<_-Z#xcirLHDYL_e$5`?EzQ(?B2?)9jA713ItYy-qbJ`NIM7UV3h zA%+%f*I6LJu-Kw`z56#cOU;-O?X&!_9ntt2?A9v{^I;m+^BDNGULzK3Iq_K(u0A6GQjd{Tm9w-%Og zxl`p6*Y{AhP%>}>b&c8aS^ou-+;DyGE#sG>KKUlofpGAq8ZA#2&VE($K4w-th*?Aw@M%gyz2cw#Bwg50)Nzs%2q-iH@EX>Le z<+*k$*sFF}`+Z{XfRTAcgsPmk?--1mK2-~OJRR2fP+TLHtdG{-9X^bdc4}AyL8KD> zv^j@#sy#i#(ot7NY+s^Y1;f*(tt*oBLg)Z1%TEsOpGdaQ>-q8j5cb{yO?^wdunLGu zQBdhcDT2~PKsqQLsUjd%L0V|idl6JnN}dxPnqy7Lv3G>ag_m z?=cHA;Wt!~E`4QE_NB9!=k6D=A>7esw7X^7s7rp*!ko=c{WXewuUAa0hF}N88?LR| zpRO}fF@GlwFK6Evx33SF8b|!B+c0m@`;6r#`rE-?+}^dGp7d2Z;pthH!%Y82%OZ%yzZu50yPta< zZ38CLcTbQ{#iTPmoP!ZLvhov9N-?9pli2D>-A0!_&J%BbICHC|`-<20*&ey% zz~{XRr4vF3QbdQWRhh|cmA0*_8wfk$PuFWTcM*5{iuP4w8B$NzSjk$$1URyV|nAH z7hpZkN7(o9M}Ztq91m~lli%Z+4qPe;5rPmDBQ(e495aO*v>iC6elF5ckfLZ4Yg7|% zc-xZBx0J)o zoXTScrB#WQK9ts^oDj)4%=0kXqMEXi-D(Q%-FJsD8~FYjA{p#BCGo+YYYJH$uu~ry6b4ez!ezJO zd(N^;m+a3?vta@cCL{Rm1D&Aqmi-HxjQb^l^J8my;<4{g`Wi6Xcr`!)_3q^BQHO1I zyxc(Gb_=^>EMfT}J)-(b1lwNuym@jF5ZL*(sNZk90|Guv?3fQ!un(9YnbRJ=#NPAWBm48b5W+t`1bGy$vqTxIan zRexh$&Zd{>>pe?&bLqhW|Db%fy)q*91>h*7l-xbKS(6_vXJ%2i+hXdIBzDjOH_aTtm>AC_X+Kt;s-a?3&boNXi zUF&->y@`0ZT>a`h0NzJ-Qrl?M#$UAjZfU!0o)EB5(XH32d@{_ouC05x+4U;K(rDVl zu5u+qNCN3v2THS_W!Ad;d2HjgT}PY)pG_%Jx#qGy?lnF)?xe6fWyiLhs4~O8XULLw zjrIhLEoh7IB&e8TUYf9{ncc4{b#D4P(5!MYgxX6%-;E@?ufptI^ex)}RB!cDP^BZ1 z@vYJ`NVoEzgBl5&#OKB-%vg;vH6)X}%AXmtEN1*?35p@?arE6dD|zaeQtLNW&9dHY z(*urcW8{I2r)c7TS7O=J9yZ7dAv#+x-AVqQCVO? zP+ENR`k1$IMrCM&R0^d0TK7H0MXa*nLXCXQg)8O>FG&1EF!EpeRc$Xr&e}ECo}>pb z*FmG2`MGr|LT(aO-Fo_YVhr0Zf$ zE&Uh%$_xi3s`!|I_}^!P@+?HOb(z^vqXwxlr9PHbmg|@IYPj_^X;AJf$9VEx)}WLq z?7n)aT7o@Vq)vP&l4(^=CbTs&aS|u#tIdDroG(@hp!+|?-|-Q?2mw*+S-X?n(CSBr znRKYOcFRa3b{u_Xzc~F6W2m^oYQ*J9@r_86ZzslcywC&D3c4+nZ)R6shx~a)y%uPV zMCNZ_BTsOj(}2_2-S5KPxA5Y2O+`jj-&_?&3r;(^$B_kU(a^5&|@T2|J85p7yUd7>aLk`>JF&g z)MQux-ZglWR#b-U0zW+yQ(OI>A1ZGr4D&39?&a>f++N|68y)4-MeX0%MF08@5ke&6 z@L5_7`!x@3k3w$eI+x974h=ja@BUf<-8(-l=hsT1b93Q0L##}+brs6+A34`8S;jYe_(+6(#5t5sa@+@1vr|{@&-p*y> ziaW48IXKC>3w172h^cTmde%>apoDNePq>WL^HL!&7W6evSDqF7cz4a*g$FEUoxs@) z4-9F@=V^263M+WtW&7RQISP-#;LzOXDyXi%*|mRf; z;H05^{qX_i#dxbd_V{-%BG=VJt+Hu3y67EMjF(gA?f%wlTF;t&%nNi4)2mFQQIX{0 zrj93tIPM-l*y?zLme46NK|5L0R{3p2^QA9a;&s%=`n;vT)q*00YPd(>Y_*{{ksV_l zLoCLdkJ~arxS@G^T`Wy^(ri}y@IkwWja&DL1>Oj}FMtz^HSa|r(}*k<0q{WQ)q~w* z=i^lP_&4{#X+qG}nh@)7dWh|#U}5NLe`OOYBj6;a5+c++o}=}c5bmmLm9p?Ex8is~ z`;)r}&2C^fy1gkn!7g+Hv=TC5|&j98CM zhmBLLp+A9>?rN@4!|PlA(Otuwk`d^xieID9e9AS&R*x>WeZAht%ycNV z;NYD>--Rh{@<9qz@rCNBkB62cO=0tF4ntp({EM zD9eT)c;2!Eq#3E_UXu2o&sVPh{8&orjr-awpBvxHNJ|%AG=X}B;&oyrJis|mDGEIL zlB7nKpv-^WP6lza7- zUr_Vr%}F)0U4O8r(kttmDN{fy5O_fk$54PiHIR%HmmtR<6Baky`ZZc2@3yP?-;a15 zeV90}WPV@PRPWrICFK}=O(>@3)HbGRad5+8gkWCWxAp#}SVmQ`ZH;m)y`$!kiqYt| z3RaJ-;0lhV&UFLH;3Qow2+_}xfMK;~6z_Pso7%O?Wnabrl(=iZ>EX$XsQnR?j=2;H z6DCqYDfTc>=+*;rk9&ZIqLM69M9L`bDt^H?LHw8B>;-^jkLOWzb_-{kj^`S9Xb~O{)y6=FX2~l+RbUt}~Rr?Am+7A@}TL|;RMC7T;_tY+0Mh}vN8?gTh6k9kwWGjCL z^o8zAqMS;tUg`EGC>6~-57854!)lt(w;ojqkMin08}7W{%fYGVas#F{T-~$-m_T(+ zuN6QC94i0fFQ?B-itupp$aWXnypW^gE!sb8lQ2Ni8$^Z}s6Gbd-vIp%HaQNVMWX}b zUh~yEL30cqXk*5T^Oo3#ni}}&DXGId!d={Z2>)&5;P83_fqAGbpydgVj;Yu?^j2Ht z{-~m36M71;-&yIrtohu(D9+$Ln+|M59CsU%z;7ac4f|j6Dk!-+H%Z z?1MFdSN>l5lqP#B-`ScJevhg2QByg5%QbLAa2KWsDu3r#S&{FLm*ujeoR+sq$H<@eAAV2OXl4%ILqH>j0;Iv zza7XIc-t^{6$isr&dJ)Tg5>ull?WZ*ORLP6?dh+MrA7TF8R$(7d$o~*ftgBkWE)ny ztXB^k)%YYxO}X_mu8M>T_HAAkvdS04rBXsXog%8cs~)NWI3n=N>ek2}H3EEHVM7+4 z@c|+T1!;@ASU#;cvXj2<_&lajL)R%GhUODEf3xknHDSgckdScj)7%Xt7B)qwp=%FwZ*e!Sska9o0-F^2KVZrf1L*Xb~KtaG!T-JaXKb~Ku zO+=bjO6V1hT3=XS)R_5v%;vgNSR>fL!?$Zy;&(ovUP}r#j1jzO;Hy(|DK$|QEeiXk z;gYKsYejH0^yG@O$4cH3JGr2XOzT-ZwmOS&EUW!odxS#zA!YnNd`*<3mO5Sx`op|s|m*nzL{DtM7aFD7g;ZP zM8$y;D=J=+w9$LC_pLolS}!oeb4NRp@U*t{>tyjZEgfog!hhUPKAu7B@iTDuMK7y> zl%DN_PMWvBcm`R?6FC zBzpsX?~9zHx1n_F!%YEyTJ1yZ{h3IMK!7@Oz6w)Iz?EOsktu&#Y1@;a^d3D0aC#Dl z>&+pD$B%VnxnWPhX-Vq%%N0w{iOdrNf7J!*nT3@n@_~z07Kd&0pC0lwM8syfPk&os z++$3i{p7~{G+is~m1^s)uhCgpeMsQj-Chu6SX^yHlQzXkbl6g>`<`j~Ud#1(kA5ml z2dm{wGP03zU;A9LQADezMo3ZVMwNj=jEt?Llqff~>~{a|D7u-j@GE z4^W0#-cCi~CaDy^IeFkG>H*U_6Tx}`Y@CjZ>3BF36YAWzjl1sjICfn8;f% zceCviZt6nWiVEh$az>opkGu_4gK-`2Tm^x7D1gaDh0XP>?z8p%VaSxIHIJ`+8O*lY z$99GAT7E7-ILtEXsk>bJX6?}tZ?hmVsG;MAJ--1$^uP^L2~wBLp^ zFuxBoy)i{#f&rM{rvOQ<8gN)#FMf)cJec&EZj{x2@N1LRXQI4OMK_%q@@*C)#-(t^ z*t36|`4^OnSL0j#$EHD1wcnudkcCIr^iFw-0+ru-=o}u4sOJPlMFE8p8Hwh%udG}$ zG+j~8tIbE7R5;oW6&nostlz&DnqtS#?Wf$rUuwAq76&LZJQKzBE*mPlJIV$Vv7#%` zAmTYI0SB#wBf88P+PG8dYHrYU*D}Y@v4u2m@2p*54|jh7bnXzX!9H6%k*!2!`K;_B z>wVuAvmHY~s)7;DN%BbDVAkLOr#!=|fmplVA0B&hD)@(*tf-Bs4)afxb?0A3`~Pxm z2{oBxHi!ROWW5n#dDf+&ZIPjUJ!rms7qMa_2AyfNfzC)h6TL$P_GFN=p2s|=(->2eIaBq2l6fs1njiULMxN)m|Y4S?j# zxg_$2r2pLD45CAQqi7{U4Em)8mrs-3`UPJy-+AF*W)q5E#~bpIAHKVh06HncU@l~=7Fy0N(12S_`1)ybF~Ey zSb7-aG7rIqX7Cx&y5v->Lh9D7Kbq@cHa1e5_yX|TgXfQfU?ipiL~Hd9KT*NE8O~}Nb>6d z9Df-y@5Q5jce5wnrbhk97!HM9xVH7UaskjyC5WRNcDBEl^a3bH3(0?5xe+6;1~Qlk^o}NCTo1*~k!toVMveCBawZzhK7Ep8%WD$x@et z)vGJ>1#a+;DED5aHEQ)Gy;$&IWc%C~m9Rgub5>=*s;>&uLq7gbf5lvHuSdZ#4s4*$$?Yu@}) zx=|zT+UHIRET&#Z6eBj|aPl4ZQH`%0y@r=-A2*dnskxo0dgoFnXIId&xO$?fV9X9$iAd~`YE zzNGeoqjSw~_vr%4f5~$GdGBFcPo9>u>!@4*JB-4l!|EPYDd>Z6oH`(CF&nUJSp1Gw zZNB)dJ*g~qr4*bRfZ}W}eX;D6izr9{)h1KGEh2+nBcQ83M6L0`V#EtUAhLf3AuZ?W zFP&!CBzFNetTMjIu5vV+brxb1Y`v66JbM69m-%P0?nskuwKs7Cj!jE5%w!0^b413U z^lQ4yfBPA2l>}sX8p3G{dDH*lZ*d4?;@t6^05tHpNG49)SO^0Gs^<@k8#v)8KZ7uN z*Z(NzZBe4w)K~}a&72oR>Oi9LGS;2-%{obIB(WssEy6G?f8R2@q*Mn?2OqA2)1-x* zkwi^^o4B0ihE3RqkA4MtQNq0%+hVX(OP~A%#ruf493O_uLnB zx|m;`g31$Wa%{VA!}LDiPX@M%6>8=iB<(H)D|*u(;Ifyr8q%#mmGVX4Z@EAL)LEL4 z3H`P}+$27dB8=%q7}#}5KI7(&YR@5fZ{EmdqSrknkjvY(m8*H}So@3<+OMFpYPWtk z$layS@kWko+b{f#y$UO}ti`;oQS<6xSaYaBDaOPyxksnKrHpb^gmq#jh>4dZ7Fgrv z-^cgzMM%Vw`aVZrXt7r2{Qe%DYTf3T!t|p{BL%$!KP-H)3JOctSUH6s#9})ew|(6# zEJ|Lp3Ew&k{ka$%_*>nUCCb3>or86tLd=sFEvg&I#5BRqyFvL+);x3Y1djW zvF;gOv=x!?zP7p87c58T{HOJ*&WZpuo0E>p3ahd!!)YuhZy43HkmWh3-Z=cMvc?+} zpEPFI+D%knTPTkXDbZ%O+IgCE+-F5W(~Hy#Ai%cY>==y_+9^?=^7e~N*Ik3o$Un1r zD#KyHnSyL{6ge=Q7f(>MJ-PWa4;N{kI!%-(sN)p3Lw#tYKqcvy5EhrL2dJ%v+wK}8 zL}Dug<%;iC+}jVG|P>cI*lT^5q_n&vf7)}CU|%(-Pp@|tkhj- z;ViQpyLz6jQ&ezOMy{aQ8_(W*Hv)x0AXm0z6$8%Cc!Np|?>#kImR+7x$Tx_Uwf6M|q_U!e*$YSDvYU$gz!PguOXa<}RB!Ff#S{zSt4VvZ(*!G9U6YDhm zL%|Z?Ig21-9Q|FWP)P!&;x_UsDnD?%Qfzu#U(9_b5j!kWfn79`7VYr|7f)s~Dr5#@ zZ=9}WQUqClDjq(VFfS78*O!}yAq{6Lh&6BQ5d&xjMNlX8_u6-kqDwbON;n*(4i@vq z*&NFjSj2w_BGc7i40^K}X}rZ>5-nm)1oLE@%V&J#OOhW6!@RJ(+_1Bn^{Z8;@E0`e zXTIay*2tn0@z{Va-pyNG{3H_^HP)yYyz%?Nbs2XFLCnU=ye;~A_8>VJ&*iEsM0_8a zz|GO+LQ7Q2{B3HfJ>i&APQaeKKN`-|sfC_^2MWHU{YvWjMy&+5$k<8kp?5{ym`gdZ zudybp^`dap;f9k2M;^XjT<3Lu%<@*pWQ{#I#I*OW-R5n4mNnBLdwEdvpyZ|GT22+n zqyRLu&8UcKblkpKQ%43u#$Tn#v&rWo#4ng{>H(wmcXNKZK{AMf1-b#Fw>&B>I6yvs zn|NA#pq71I5S)@aEB?CVJQC2Sv*PiwQ9m=F&D>)_DH^7iHtOX<`cgUd1(y<+cx^^p z)|%P*RK=M5+dOKaM%@y~muNBwmob;i>=$BjQsZ};!#As&!95l8Mna7;yE#<=ldNsZ z1uNbzXR(0}RBqgE;Fzy*pFSh4zz1!8eDizbKGPYsRx9;=GnI{+V6$J_G1bQ_j{ZMn zT0@M3Uu@+~d$cyu5hG&%+}#F%nCArbpsY!qI^` z@+lFchkU#K=ovsUz+Nw|OCqK+kQ$JroW4d5@jV}PS&OkYxWK8-?Apch3NHLlqYGtN zF{#%$v5c0;;H>uZHF^j4dx>R;X+)smcDP@p4xyA)5#b96c8G$#XN7C#bo5|94E9f* zH(Ybu4&R)JuG)@n_{%9f4O$+Eoz+q>7F3RQ>FY5V-aWceMR+s9r1VTAn=( z3;BpU2bq#>2eXl$)iEeUL|>l2DOU}rpu;|cRtrGoWxbt4ajouHCCpum?+qdtaf)+i z&G)p>ccQ)OJ|FEeDIgmFo|-RT`%0@w>^EV{7L+g8FG{u z{hm~l;&DPq@1+@?7bYxjwc*^!RiWgiWt=l2k{HDSwBi_c>2B{oS_hOU#zA zcsG4QD16&AA0vNcR=Ki~mj-WM{W^ab5S(ATcbQK0=r@AhIe0rF;-37}*4O#MljDu~ z1N2GAs?0ZLJi)*NuwG9%?fr$O(@V%Y(B*=jLAbx|Yc84`)Aa}At7=V6IGxQ1qpbVI z%TsP6Zatuw)3&Bwc6`Dmvper3 zYo2Ua_awqiM@lfu9Vg9=hnFi#O4envoNAw}K)y_vKgP^d8fVBZ@+L9p>gp*fazEpGk9(|q_tLrd)E5?SkWk9cC6h#lhK6y< z+inPEUu`ni$(F3Pds{o{ak#r|zEir^B%dxFG!-b{x0SKby>GMX7`xQ#lbLw-h9VW; zd#!W{sD3-W)$jeqdl>f~Dfp>L!B<-{q+=Yv+Ud6tJE z^-!0IuTv3THr5E$?Gqp6CQIH2mc2uUF9Jlyeetz5j<@YK%2_UR{oIX7>7{ z34w^rT}Jlv@Qq8`f>%(Hm&YF_Q6CjbG~~xmx{x=GkUt>atQO0tQ^OtWw>SWRvfyqh zHJ00g4IHrNwnYUbPm-=&VTV5xnZTt|G|fExbKTP4=5y2k`r}8J{hh|(>ca#1 z-H@2eZ;X7&{OK=1S|glqYLXLXEt`F_R`_q;khA!~HKC9Eh%xcP7Ra$!`~l+=>hoKe zl4G!-K?$2~CsQBQag(;T^QGjNdi$-i_j+_|5}sSKQ-k5(!qgiRI`{ww)knhMSz^OvuDS!L3F?zes_A5{-B=;`1;< z&Bw9L8)rA)=e!+zHu0|;316%}O6L)$SxTmOwsi@vuzpT4X7B5n*(7S?2MRzyzdWP< zmp`-zAAc)*sNaO@ZeZ0^?+U4*) zU$TjF7H6A@{B-h-vxeO-=OeS)+HHJeE5qGT>1z64yHx? zoy_GdJk;_#5J3kunAmT+jZ1sP7x8K(C-+=+sL^+!-`5qXUXX)9yrl3YJ30qEgnxhU zUzf(Q0!&z?S#s8j#C&AH&SKwWQ018oTf(<0uJIMmbcy#b>GmqJ&7IM1EV;|4fo z`S+Ah1;Q!!??>*D0p0uetWGBqv-fXd{ife|pL4!~WOMTp82SHEaRHFRG1~@|AWFpxNGwR z+)oh5Bk9vldse`jq}1-HwQ9P!Gm~c@v5jRN$Vt{6vITDZ=;Z-U)A-`kK7T`>6Ul{) zS@t+Eb5@@0K%7i-17Qcwo(VdvhOhYz7h8x)5%y*m)=aBi%zaEJXxrxwK~i~I{u9uJ z6uB{FtNN7+O}yCi<=Z-b8uSf=kCb0SPilQQkjH(#ZK8FDoVBD?6ZmdBxyq|A?kEz) ztVyHV%Cp%{>}h*!Mk4ia&2MTeOM-p|H%d&7dLS(VR)_a50HG~St$%HqXBpV#5lb;U zR$mL)t<0W04g@8@K8;!#3GKIXehCQ$j3HH+#ho^wyx{eJ7KI@~`i5_q2k&D&6jy&z z2(7FkDNQ>C^QKpWh-&;c%!KKSE|tDYdBnulTZx9;fFscIu)gi@=E?28o~Bno3J(F3 z*co%s?{6zGe*NmtF4>Fj7rh)uN|x3{zw(1;BzfsZbss1S{1K3658nHed1fm};7J%z z$qJCYyXn*+o9a;9#%Jjv4^#qtRBE`NFTX^N;7L1j@#-grE0cC_Er1o|PtO^#48E57 z<`RUQ)l(NA)O)q)x1k~xkPz~LVrldCW(OxU!$U`3~ zDrzP*O^XlzEx0r2Y16eXb+C+)BVi`J&OLZZ?mRCYQ%3vVw>P~msn*wCAX+H{a>PM^ z;H%+CA2P(s+Nk`1IJ7e;d%xT6D35qU>u{5hmxW1pe#t(KO~|f9T5B@FDJdm?WCJl$ zkRkSFb0gT8WRI70vd5!g6Y)I{+(QDuz#bxl#@>tobUv`oPstEcf2vd(4;NsF{8t*B ziHAc@1r^DF;&$+d!s*QImcv7N=E zo38SJXiy#xJ^IJo{ogH|%OAS`!8RHTx|EBF|I1q1ns|@V%7;LYO`3y)s!gq{a!beE zW8zjalFZ{U?SKNJY_d!>XlnbjM9+AdeErwqSPg+OX9p0pu2%i*q1Hgix^$406SMDr z&^|$}vACkrmGi)Ier^{C(lJ;?pe;P)BBi@-5?4&!`0U5s&9S%5>oF^JNekbeuP)|6 z*(Ur1q#w2^Zz4fcPr3D`y`qr)4;ZR40cjQ7rO!wqaF=22uaYhvW7&Vr|Bku_WZB6s zKbS)#xCj7?bcJjAZyo$@IeSz~0imA2uC8~xwKZhC<_uJ5_xc91S=h5C4<8bP6MEAC?dEecrsAx0GLxaLP;MBhhPO$6a57sL#ot{KonorLt$X$qrbdFBcf z9qq6WieD7#y{<4hSFP?~BU#?wxTwzwx+pKl@ad4E;0m-=7?`y#O*`inQ){%nA zVsGm(GNWi`aC-(}hU49HRo;@;Duo!EI567$(O7r85rGQL8f4J*HL$^?@gqOpGcXQT zbk4PTDA_x7Ced;xHf^;_BwI1t`@AfYerS6;+{6}zlM-;#oRUUzjc@4_zjhz_(U%M< z1QYPoP-ZiA>2&ft9~mW6xEen5+S|{Q88uVnomaViM{>I4r+Fq^To8tBbPl@(cBHXY zUC`H>4M68V_&!kibdVmYl(t&-=whfBe|QsOaaY7-RJw@ zeHT-dGZm6CJKdno~6Q+6#c-?(>^yRiRN>ufU?sG;VS8t2h-OE%e3lTZiFUwj2&sPN}82KXLZ?GjRl3 zEK3XH(d}l`X2xto2qVR94M#AR6!d$!l!5yQ# zs%9=~^AK9fX74DvxN6IBQ?BU8lDCa6vfq}2G3D<%N9X_MGN%Ct@*h|C|L0x*zr9l6 z!2T4N`1ybF+W*hK=TD)dpZ~8ha7zEj{r-Ok2jDSpOlyd77Vz@_C+GOqfBDgGEcf1= z`t|=q2%zfyLN)NzVgEmd5C8Vb|68Q-Kkvi;ic$Vc;G1W+D4PFw5B|Rm@}Kz_(iK|z zEAmvMvQ$||JJ+b%*+qQDzwim|+@t}K=!}bcX3&0hpe_hp{)u}j%kkwAUSZ5e5rLbe z?6e>@xV4sqYRW#2y!`$@vFOdapBg``j7+$PUw#MnjH^D#$AlxiYV|}=;eWr1&3`*? zKoB1ECucEhXV+*y6o_jhe-if%pnl6^P{neAUoXD{H@%8Sh6E$|0u_jHviDvTw7Gro ztUXNFjm{*?vy;j(NC6D*KY{dThU(Yf2hS4Y!=C~tyL}-cS*G6db5y5M@S-^}!m3h9 zx^h&HCgj>c`*oksxGz(v?CUBW+C$dX!5-!27K~)E~r3LEzw{@8!xX$bsbI__x6xezV6xf%sSgbir)AWp@ZJ` z`sU1fcE1lszBV83O_G<$dTbw2K;64x&Sl$mOMcCP3s1~D7OpEgLpm3KveAd2UKM-S z5DpGcCVEorVZH^n3s3;!%QNo_X`X$!s*82yeI*e79w^Y8lEu+OT%VL2O6mOTyH}B* zXvQGUVY-^IagV$x&0cmPUDflCrLO51)$q>cDVsBDS`8L;2l097!ETq~C7`q;VArgmmZEk6)J=UZdv9(DRgF8u&QU086 zHd*nXO%vijOeJ2wHRZJ+b!GTtrqNwZ>4y*)-K~Xuo6_dyAjGwuE=_satH=ajn{m6p z0zL+sPZ+O(6oqrA`q0W51I?#!!qmGk%q0g{#aMW=pUpclIDebQjc^4>5qVnjR!L({ z)uT?sd};**N{p}mwgap!e#>HY4VF|_!F}jHeet7Fm3Gp=VStgewFeE**`(-b%KICr zUKr(-3y{i5UF^&-VIe@6glogIwWbA2U)02^tA)qkhK1u^GIj=5ua^DEUoTxxu*c@+FY!BhEhCxZ z&OUYh0f8&3^v;_B8J^<>TWmui&8TFTlOGN3`QEZ8$6IXi3p?!b2i>K`^@j(|>45Il zAc`J!(Eew+Y_IT#wOE-$Hhyq8dnFd{$UfR%i#;G;XUYs(c#_vBDD6&V`#O_2V|I)8}8HEiQbeGNS3yYOb+cS;tKVxTeuZ zzMaaWGN!T24o=au7E@|=LvGP=oV2*wl#z;24bPAv$-!yAJ5Y$Rbl?bT;F#*C>f3Zaw0p@);9wCuzK;7e2xW(oPhcQ;Ux+ci16 zwd|JSLJ2l){5_9Vnj_MRf_0aXlAOz?6c9h?Oig-|EV^TdIj`!EMvGydzH_+Py}ZJI z4O@yZlgiY}cnQMzUA^*}d$e7GbdSF6!PW%RqJt`;n(k}w*vlQm^cL6S?Y6aDN(GyF z7hZ)bMS*oamv?qJ>FYwxbEE)`?F%}Xnn=z@w>^0X{x&RiyK>$ybA)Eef$kE-`TKh~ z#yW%-W^=2ggWqCDJ@pqeJ*q;#=%`}eZh654n!QK#m<;W8qs+c2b{ZVk!{4UJ&nIkg4le5v1(9$raluE!yvFLnABz`&i|!ns`1Bjq<>SDW$mD-19&Jq* z)o=bQdPavx3BT|@e9(16SmbwkDf*J z$E7`(`MELih|;0I6QjNb^8QV_AfgzmBQE-iJw<`yP>5}DST~4w9*bkX4re)z;1v$p zR`J8~3GhMuw;=7qx~FFi_|D$_nz`i}wTp^*6K2A^dw?fe5K{nXtkmYNzeh~*nM(NB?d*=M9TT?4)dvPZK&C26loUR)YZ^Vune9K}-B~8R8d{ zHt=QYIWO!<$dEh~Ax^!7XFSGt%yV9+^ax2(AE7*{$uWf97Rv9tgQ1E7y0rRCzy1%f zF{Fs=bSRUexe0h~&d7VdJegy(DQy1>9#)`6+?6~Q3ZHC=UqfLA@|j*iekGpQ1qyc0 zV2Bk}aZxYRG;P*ZHOwTSOa*iixKU*G7@mv=QTJbwr%dM61&m)(YrMB|oi9R?0M@dh zVq3Aa*SfFdpeARe?$e3C>9P-w4RMEu~aFoHy;5yJx;dTD^=zuJFj3;S#aB{~=;qQ9yL(CNkk| z>~JY-p4k1NEbv!zxO<`Ntlcr3%h_`Jx8CI$Hc{?rRylchzug; zjkhRS^Byj|+L_J^j3dC#e?UqTRn0JS3U;I~s|9;3k&*XLn^AExgtrG2;)ziyc6O@J zoU2)W^9>n!u&&2x=}^bf;O#d6G>8W0_N@;{eh@Z%fXiLxB<`DtJ;hRQgYH_6hYOWe zFZ4)oC`ikvOWI<1R7ndvWr(nKU5FsRCg07a{-2w62I?yr2puwga5fa6&4`@^^b z(tQ4q=ndN6m=6Y~N6-N1ZrIqWelFnWC+R`l%JEElGvk*zSzuQ5AbZv_ua^J#^SWnJ_Q$ZZ~L2e*AR&( zy4ge2)c9k4=5*9|ZDtgX4V%1MSAIGSMQ1Y5+B0BsP~2q9qN-Iy$@V*DtRxq2pL`zy zpKLB=eZFpq&(EAJ&isJM5m!<&lCD1$HqZ$4o#ml}Pv&y6N+DzV@-T#EhKVbsnECZH zZ>yGFs<+@+b>|z*9QDe$SHKIA1}Q2?Xn}pWiT_)|anL`{@M-G3^vNwqyEmQ>gB?0< zUUJuAMpcO)5?vqXH{^)mydl?bkWO7`z7dV`5XCk(p0N@CRq@cBX?PO#i*JsLc=&WK zQ@)#`0H>+L8D|a-u#mi6bRC&9iK&#?XkPRMpE#Pu=&W;Gqw1<11}7V*QiXy-^B<353QF9a{MZba2H#13z>Qt-gEKgF?Ynn^|_1Sne}vP1)~4J?~NqT_bzO5gx>?3A-k~yPlYBzwiD^Qy|K+AC#9}I z=pU0I_27O*zl!DMmL~J?4cMH4P9f=M^OGN?c66v2SdZ&SR0BeOe;9BrCHjg8hmoF$t-uXP2_Zp+{p~d{7>SHAG4z>5Cj@@NM5~Q#}9O%&03x9 zn0K?_HpbA!5xx}X7_-ecJ~iJYBPfrrZZ2I;oRfWb5EA@KLKau+s&(9#! z8**Zw&DV^o<)#nn!PhQ2Er$jpraI9#CFUw_>@XcieV>=~i*a+&7(N~{WFI?J(02Gc zF^OMJdP+p!*C0u-KesnEo8}M7g2*Y&LrRtHK%;_M1 zTyWA#>!pPB&RzgENWXS(rTJ(stv0*R&D^JVh@)mdv2QM?xR&7QnJbX`6l zMvId3SpHl4D#vXK(ijh~P4S!-@_M!MA!@3+#~|x5fj7C8Z&UNwEH?eKe`n!T4-ZM= z);4jaMUCYSXR{m=y-Tt(zLH-;U{0A(lweWMtVwnLM<^qg~Yh*V~oHL$&^YU7^w@QT7&cv)*LLI%!jh5#kzIx*~?5?Ca=K zx=5BZl4VAg#xf={m@sbLimYLn%ow`1shN;vFxKyL#_RrZ@9XvZ_cwpcnKS1++vhyb z=lLw}&*zAeTU4J%LUKFmuWB;B=98bZ#4szx__MQHKtB82AANT%-5W{7E-wXHT_dXI;E^J}7~=Y5rCtl4;h_Yy1^xPn8Z{ z$aM%7ZX5ONsDTlZBR3+F#iyv4`3cwyt{nk*mpOk#Q_nB(*aiUZMHt+bx2BAQJ)!5i=7xiaS99GGd;s7PP| zw+%)hjyd0~wa>)N{RZlrxF(v_%o7KG$*PeTJPT3GGAT_ZRpzrxh1ujd?xn0(zCt2!j6Dx~YyneLMw=DPA3pFGCsf*T0Uym3A zcG7Fz5n|m&mVBjxiF_NgdR6#rez1kY3PO)iw2xNxdjhCsrqx%BJipHeL(KAc1AWsF;_|} z&Zjq%3tSux_YUlWS;`#dx*m+Ah>?|)>OryS>iyhnK7vxI*fKavV}Kv@>C8yRQKs-i$%(>5e7O zS{WR5eW2(-x8z1DGria~uk&o=WDgiBg&K&Gqa# zN=89W#*cBM3gE#VlcDL<<%}A;TpCU%$q;1N$s9-It+AT*(N@XuWUBeTp3*&>2Ol`$ zo*;+e_BHp7nmy6v`sv6nBd?%Ehl;N`wo{i<(wSwo$7>7OlzGbZQ+7^73e$9%9KP0l zww860F3eM6HW7#0AT_vM6h;m+14)A5E2P-SFPXWtDN}BhmYoX0d7)`fo}`^$(%9t) zhmG+&frm+XxYuK~i%QWOh#@))TdbZ!;Z|ErV5n=o?9l172~ErEE~;ZS%el*4Df`dL z?G=H!WZ7BU0$avNa;m3VbC^R)Wbw0dRK?Wl_u2`?>@W6~w$E~82NTSZ>~~_}*Bc(E zX3{(FBB*{#?4;T-U!!08hNQdhg_#3E?UJCMn!l?zV_N>aLMe(x@|A@XD(P1 zB`VudeTA!ERHlbVs1FbERDuVlm2~va3?*vxJUn>Py+5;eu%&;|Uy=2r({=)@xJ@7d z)x;saG7Wdbbo(wA`C*1-SZGH-n(2i3gFHrbBd1R(??ClPx~}6LglH0~*cGyep+S*h zDYS>9`~8>eRqqV@nM0$u%1F~#-Gw;&T~}_U{yg0~4JGXXatGiD@y{}zp}G2S@_sxz zV)ki^mQUkKK;mFexs-SLEMN-2rq+S6mZKNa(hKq(S7*<{Okk%om@8)Lap%Ze)e8SE zbu`?h#!l4P=7lrDe@<5BtuUJhgFa`zo({zL%2n(9kum-#_z}8pVnMuEMq!_T^n;&u3>4^xg-5%pe-ZE`FdbI;dLcRw{CW;xri3+4@7=D3F@~ zrnlz!ijhWasy<|qa;8%oc(&Vf?%%7tKW1kk-Scx_AVXzGnipZt3TPNl@HJ6!$os{Z zK8;AZ)T)w;EjG=VUdcVz9#^OCL1i-9-#)={csAoNH2#vN0fz6CXGX-T*n4rr%2MY> zADpr4bl^Uq80(eA#=mvA##8TO-dr%PW)Ig2TW^kEVK++ZS@BU6eB9N?!L^Y%2pe{2tl{$5H#Q|?p4)z@jnpXhwRKW z-w?5;CRref85pB?95PojeSklETA^O5p+|n4D!*aS4c9t|MA`|T>f6@G9Si51nkLlG zt}?<3_2mD^oQ*cduAIsBw*erd%2k_8RggCk>~4l}$hW^@l|RU2O{z7~cHkNBG}w$= zJS*bfME`hCR)5T_9E;m$MVG4X;TCGQj{2k$LLRjjqj<96DY9Ej=K|CT@7>3-NKMG4 z2*z83?sz|HRwDZZyTe7ot=_cWvk4`97h|3DJ#hzW;7JL>IgnWK*q&Xs-}?uuH*E(> z6X6No>n%y6^@x(&|Ey)F+}E`yH-_wL-4Am+IdyYQ_KhEy<%saLdsUP`G|sCy(bzPP zqx}FCt|M#)8Z5>x7@}aGdu`sR%O%qAS0rL+!Llnrmll`m%bx!@+bnyr)eXTdl>OWp zS!+g25zLWT#$yx#JQ5cfieKn&ZTp@-l=dhrZQ@?V?mc$_#=}jh!(UwXENMAG%3VCj zxS`Wkwz5(%FzK_qu?Fny`)I(j&^MDkXWOQ|=B`gISy^T--J&%(r$1$5g;9r8rxKcU zlwYf(5>5{s!X3W_ovM z$wR~eeFc{x%?SJ>h<*C!0J;Jx3xX*sffG;#GLAzM%6UOqXr9F~Li|C3Iq%FMx_O&k zAD^ma%p6wGq{GUXRm6}QGO_iMIYqm+mg&Pb7z zjH3QnfYQvls82DzTBB*Cfj64;E52*#x%4Uzj7wP!-Or>i)PnQzy11o)tMRvz=Vd7w z2)>F@%Lk>Bg*$wT7DeLLSh~VEmUDIlH|Wxp0Ou@|qH8nC1mm(z0vx7f;n|r<^8ICI z%LP<0^HXqpfa|%;B$IyWns6&;cVb2T!p(}S%7UIjFoal)TcT?GYMM`RU$Eo@tsU7+ zoz#q^&YC<KT_0dG~%Z{VEBT?~_}0NoTG8!`;T<^$9e^WhkA5Ug^Q_KaX2h2%Y}g*8=?&dx zzsoe8Sjlm4QspBoKrGw+vT(=|!g@J36K=2_r6*xa{y+ls4Ra*pHv;JIvbcu%2*QD>%q>68yzh`6dAyZ6K zHA08i+2C){wWro!{6cuY#UN98y=5P_eW+P7ItEDo*kk0yTY=B}6~c)PAt6yvsowWK z0?$+=J(s(LtHMi*-8}TOdg#c5d980}NB+oBh10W*E8TtNXpEs^t2M7UM#r>K0rMcV zR_t?@T-F*Tw|nm(6<{^Nt5#4-BtrxJdb1j)yScA--I2y;!2i{STbX?t!P;6qNcXc( zZ|Eo&6 zW&IxL7)XCRd7KKI&=Q9!K;bF#*}V)h$HdE(0zcBJ-M8QPKoV&ud5`by)%q`FaTjsa zD{a#%Nm_^}E9?hbge>DnFr6(BKLz<8!aS~qb%&aEZV_;f4(gH%=HvE4Wzd9dX+j|6 z%kDCrjy8t2g9e>DkUQG|DhBw$0o>#D1GPhQ*tm=6E3Bv`nOMd{eLKigsQBwULw4vQ zdmr#dijp5FF?E+4lT6-l6?qTT@g-E( zwQU-IWGwDwK5ae!T7*2{Ptfu4-##`%Gh3l1S%|7R#m%*T7bE{z=i1+SbEMBvTh|?K z2Veh80ZOi>i2?3iaG&%Gt0=xv3(;Fnak0I_*MZ6Hngs8y!Kdd*)z& z5#)m_Yrf!5olS~*xsCVXuk}1c#1jh<4f;TY8CtYO2iSLClw4t8#3cYcp zoq=0ceT(E^k9I*se(gzr1Uc?awAO!iw7l(!R?&`Y4`@!-A2hISPKf7xyz_poHhH0u z6C`{_vb+&~yCsn&qSKbva}GVU^b4unjYRv-0EmPWke@y5#u+l#VGma{&Yq*g{XVw_BR?*|HHaTSI>LGuT!6m#eE z+%LF>am8-E)pU(&6T9FV&V69co{aqN#oL0DW!?S(@8YYd@`j@qJPIrq*J1(4L3}DQ zX!NTOFsbB*aXEfpvW|w74>c}VcY{}#!43JJ+&zm!4c7cqWTSa#C7I~CJ5A-`>`Q@u z{O)kx?n3hM%C7@=qx+)wV$K2Y;#y0sg#8PywhH;Gq8BS^$h*7zABF zu^SLL8i1-nAEBrTArP1$1fo^`(;E;H0fs09ID_cvvm$o^eCS^T-i{K|wG#rUHX$es zLvRQ91qKh1;crk*c4o^b>n)&$f5!grdm%v8U4UrJcI`mqfq1Q0wB(f`xo zyGu}eB2eV%X2t&|I}ouIK!yR97(N5(7(A9{KAUKh=#XKf-mea9s6yc5rgD_91sw0< zMWNHZfMVd+t1fo(E0THE0Qvs;~q=%}a0wN_KAVNT-sq`*V zq5?vw(jfsN5C|<`0t6u>xlhp7-}}4Yd)Gbpth3G^hn2-jW}eLK*)y}}v-kc?qOKY0 zavb14z{bYLaam96Ivd*_FdN(Mn*IBLlE;T5(%9G@uwB-=cq0J2G|p9OPqe^q?lZb# zLcRS}RwkpIJxD9Z-u#Fk-^rIF;p*nMTaXv`e%are*SzeO6;t*4!Bu<9G6&s#wcHn@ z_9kEaENpsW@}_`sq}FF~)6%K^A{T75&KCOV*QrGvl`c1YW1ncQv3av zQK@P*M);nZg?B+T{Ct0YW@ryBxF={rJ{1t|f6HI#MewVZ=}Y^C9&@w)9fyxqv`tOk zU*5~={eki7hos#*a;TM8O8|NU{*Eg*|0)_utx_lN6n*+2^sDYucOfZ?eW&az$FDjz zzk6^a=uXjD_sCy$rSh&pQ-86_9^BXbRrdg8f#c<3dw^;ORlMYE?ym^&9a>Ja8s2RGi_QENs|~*R{SWp(&2ISc1_#rq-@AgKOBZWIWRlA2BI#?VG5^a~ryK6djnXEY;T4Ojl(qC`XkQb)f zJYMnP4&Sg(+;C7P`e9FiK~3W^|Bit6VNNzS^6eQmHWg(n+)*-pm&W<;3&pq5wRJ0> zq%-E4H5qsu=J9kQuZYAK%7oea z)4ti$d4Rcm5O50kuM(|w#QrX(;A5m{z?;O~b!kKg!UY{6d!H{c4FMm6NMhE;VL2OM z#WK5?_W_l>yAlmAjH#E})c7v)O+X=t7hf2d_di~?J{ecVkBrp>O||o}v2k;maG`c0;EMwVrx%cfm)3PO-wGAdHQaot9MN!xlc@b z8hJnz%j_BGyqeDaNI%BY=WQPf0Hqq1trYhjLkh76k}*+ImTYXLh1^_hY|`Ayhaw+M zQI^Z3g3f<`ItxLvr+z3C&#eC-aab7Sjw)2In*6w|*dhWoO_BJJg>xkHKW0 z7v@?{U9G+1w?@o9Ei7X-x{K|>%wyJ4eE6Y6YMXd;C3SJ~^K4^hQaptB{MPqw!~J9Z zQp+CmT1}ecjq6#<)ZS%skgD@FE36EW;l3H?)0d@lXTUz5ZhV4=eRbAZWvF4c4-#iP zsNQG`She4?A1lQ#bhf#-SPwtQySK*o+)6ulMBVU=hYn23bl~l?j(wt+#2-HQ`A`wW zn3yfwJzkEDl3h$lTW!8LG2QN~G2FPkPRju{q&_=qLmcKkao=vG@%hUS_&i{ry0CWZ z19`Dk2;oR%nz+QQ{fCk|`hhgSgudO`@7*ub6Obli=OOmR&+gOg*B6cgO{q2hZ!sAx zGxGf8FLT1S)QQaibPfF79%D@;>y6_O^|!^Ee)_A9O|9bpJkjzo4iz8ZeE!{2c@|b9 zP(LTWVb1Nayd`zrOwv~i0rS`Ep96lG>D!4*87*|{uEUd_>(a}qEhZHzed@&bd3m*W z`M5HkY&6*OWkMs?M^R_j*SgU(E>N{=c8NimARIiLepi+JK6c1 z)C69(+)%yU`TIz?&4V#!xb9o-+5aFrF|kE6thuSoLSQ9%b<@HMTM%Bn4AwVhV%%#Z z>S!4mCQ_i~2@w&wjMSE-iV^wfx_jhYS&F%ozL#o?$@r@G$2QHxL1Ru*WJI9N1hW^j z@HTdOTy?gV=6HXD@c0ELNPTF0IrA>%2Vp=&^4ER|X-I7Pj`ft7oPccF%B6QZ|>FyA!KKz~$~nK6i!h7xHqqh>Zt53MlnrEjG^sWX~T8 zElmw5HkEH$I{a3{(lot_bhWyXw*e#l;}f{?#!5t{$ao0y@P>iuldn06Tt*y`5m%pY z`qYFTqfU710fu;NqQ9Y9RA0w-Of)2tU25mdTue0Kl}%e6$ufzII6^e?tHFIJll;k* zo)-|{b>RS1gPT@|Hsct$9YVggLfc$!Y<)G%5fyPVsH46jkq61mbMn{~!Ku%{0SfHy zErQPz9Q!glN2+8_m~dMUYCqLBZOsFlf3|V;Yry8d zmL`#tN4SLYJ;!=4KZ)-b%a|LgoelU<8npct^Fx5k%&!NBYl~1F%xP}Q@NL!{^cz)b z&EecRJ%Qb8XEk(`VC3HtY>58QAo+zD6>(&<#=!8oY`|Mukaxw{dUMm~l}t7u54g|87RWhccXDP%g(m?Rzh+XnoEw zXmt13_}Ila4U9KiOsOum?iEe=6t@4YpV3gJ!s<38(|h<6fI(o8`_2YSSAXG{k%t5Y zWIBWUFXSe_*Ojj#j+^SjN?z}E!gBWd@%=J6OBc>xntY0hGCAkPuVYv>;-8G4PH-O` z9vxHT|6gOW9+Y`@NEeS>tXauuxl=PdHh~`t{YFx(5rk>u8WTNMR;p8Q5-MZ#j4^Oy zi1skJt|5?youyW}m((`&Z;7jw$*sm#e1L|eRNzwnBD1C6EH3@~6zng^fz7|)CVeBn zHaOcDyl(g9jd!#G8~pSsT_M;*`1f0Bw}nPMc%PRT41VAJfb(y{Y2YjWSlqMc(>WiX zy9j0D4{kHM5W9=QdjOKYx08JK%T7afvFuKoJMFu%8?xWJ%BoPh8P3I~DjJ{tV0+I$ zknmHRrz-c?J!CegA3`j7+Kf&UJo(PHHtk;>jQcw}76N|Fv6pa~AW;fZ0XdyJ2UOs0 zaA>g2#qadV_74CRX_~)qoVR)R>(3F}dsu>I#Wz`e65tZ)G=qsttIh^IP&yKy9iREh z@4L_ImS&*B%|!7h+iT5TtUmw1-RFn$ci*|n&GlfPAcdDD=;KSAj(>SWpP#j*zbu`5 zIsF&*+J)Flp}U9)*5i2BpqjGdFQ@N3hQHq@7(MabNa5%4ixGRiIqxG#Bu7X&-Y=yw z+oWa7E}z{M$$lX`POQ79)Spim&IhPwGb;C#?f}!CPw-U>I-|usZI8%<05-#l&&+;{ z?Ir1qf$w$~)kI+$(Uy+)gZbFq_@vEaL(3Kw!i-No+uPj(OUg9A#wfA4>UclJpv;pc z1YndOXwPoc?PE?W?d9{yS0+vIr|mx2#>CDLIHPnt?B|o7QO>kT zbZ~zdtuvKCticD6O{%j;+Euoc8Dok0a_-C}-d{b+HEb+qY9uNtl+=J`h^9K&&wxag z=<2MIc0CwHAok@hGTYQeZmvt*T#o{{fmieH0RUo=IX4O<5@`iGAv8qo2uSj;GNcM}+3xL<3=IpS%WmSghy%UCe6mcaOiNQc)vM*EISEj`}x* zc71uR-R=+HMZ0OL5RVLYI{@8di|4Fg5z}N?q{QcFFd$`Au72##%(^Qc-vb{T)|h z*cQcu@zl`+&8*(wQ2OZ+G#m#guF1Kzrh!q_e{#Z~e!14a_w&JgBFcYaEvZBU+Q5`Y z2lg$3Lzgm*!W1NG+A&1k(*$&W5R>;9rv% zF5@XsqaX`ptIdxu#|ot*0!FTP0)jmVFo%UQf36fB@o@fNm$Jz4xpWx4uA6D&T-Xn} zoHbn2JIYfDTK2hu-3L>PmR19K15>YpiuBautfENi$|eM%eeifo%%pPT%(J7PzlFhL zlL=KfD|2^G%sNiF%6`1PRa6qh!BT;#*4Z4BG-v^h@#A2orL!5{Yso-rGZh+hssm50 zs->q}_gM5#8oJkPZsrv<`sbQ3Tr(R}fB_mxC1}FcUIuK?@U_B6gxyR!b2+XCjW)_6 z1n%@wxe`|3p*nAKWn#~YfFmQibY{#cC2)3pP)FUcz`z+vTzmMMk%$Ck%M^O3s)y%@ zVbucwL;{N)(ibm*jn(F-`XpFZq<4F&U6oObUJ||jV?A!I3JKCx+Y`&uF0W*Dg6;f^ z$|<2H*^;mx+>pkF zJvLOkp>kNd=d!ViN3%gj#e~z}EdAXSJ%*-Eg-g+EG9UM~v1 zoP$Y_+|m|-g;3i2R-mA_ob{F9Iv5#|_ z(qp|%H&tZf`Eq2<<7L0%PrT0`yMdbVsnBM$^3p7`{8%$Tw2D;RSZR&mst}l!|9H`yczg^-vW}3IfD<_Swhfs_bQGx?#>s zeYMo7A~|qE3bF=MLVy#ryebKrI@5%K*OiIDqZw&PM++s^N;VW-adA&Kh1%O@1RHP; zy=`5ZF6esh)^;(fy#X;LglO!K6X)g1hpp)4XwHnp2k3DQJuFzW@NU=A(a;jjAr&EX zXQLw41PS^742ccddqA=td#PBJZ~ipV&o!$50Z~y=LJK9QyfYS*RtC!or^OI%g5YTq zV5~{NdlA%Kne6*m$Vs3rA1gl!x8Kxcr|$HCeTe2%77QyTa!eTGqF@*!3_LIVAYxWV z2-qGmTB4WG@dbWobzdcxz-cMQcB78Nj7GR^M6)I*l;Gr*ti99EQhvWqvVtDXye82S z@}vmnp~rbTN02*}Thh41z*eYt)(ty%_-J#uiOjD#i80o`#lOYhos5HAO7Yf^U#pkn z?YnbXS1oREsY&sWtnLgYEGFaa>cV+ulcC3tsEGb(pR;|)w^02EQHTWyNw^(W{+8f* z;1j`)VBVlq(|_5S_~0#u;YV@4(A+ey`>fJs<2~pqR>0X4?FKn@Lf0KGF?vDo?m5~McKJjJvga22F=3uF z!o1~iJ1cRMvQ0(Q=+rd^$1CNf81py=as&%N4^ z9~4GN5KL{3u@00#rux>xP;=XO4cHUm{;PnQUvs3!iR!oJh->OQegKvAXH<;!kO+>V z=0VyI>-{8bFC_-3R2+9W~b{QMI2g#S~RG;jY%UR-Lez_$GE2 z*r9hsdeJ$zy$XR5Ws+tTP4?#%34Ej&t#e_+57q|XE5^Rz5CeDXtm%eoKOUTiZNk1t zZ$cD!*1o;tL!e9~yU4GB@Iqw7-WW!2+!2H%weJMxbi_xW$@nVp$56UG%A%CjNkuPg zP?$GMOu~Cj1d(cm@&|2ZnaCvI)izzEnwv&pfyyU7q~FsC6@!^n=JKi!h;yP`klWp> zaLcJlH|?PJ+6K>WvF~?zGjBRuJPgw#Y#QDa0e8=Se#&@v^h8y>G1q7WaUj|>c-=^U z(RT1mt-GK{EIR-NFF>U|@1(3QU;zsxbb^v0Tm+l;Rr`Dkecy=PVInsMn9oTcVbB<3 z|EnWGkY`reg0o!`3ENBh6+YLo`WTj_Ni|d$^;q??FE*@=eDHGE+0dP;)>UhipBkW& zh7?$=35PhGeqv2s<>5I=5){2I%8%3pP{?2ZLL?6X)C5409Yp~s0>7cq zA3SyZ%l|Z>;cjlKcnJVPwm;Zv2NT`tINQ4We;UaBkY>sGUnpz`3yz%sb+!XT+Zo*s zQe)du`F_CQ{;L?!G4Oc@I{uLg`WrU=#+3h`*svmi313O;HgyghZV=R%FB@aN!_(K{ z*60;RV~5!#%|`E*CjG{(mVSNowC};xlbay~f8iCs;((u7f9T|g|I-#EMq&fHFU;g z<0=afWXN!P?>SrJLEp3-@@ccH^0rl7f~|kv$h5ER|AZ!4!_L!lX^e@FEi)^EOjOdw zmg~yTtofdhHOJw4-Kk?RhQC>IB9Tz*8>VWD-mJx&Zwep`CrXlJEew|nhJyhRX^wE$ z2nxC(zd@9DL?D)G7<2v2O?;#^^tx|Jss>XEeRn1ZF!E;vDJWtPiFgBS)JUvr_fJ`Y zAYKZP4ptLvGE(OJhol6{3kmeV76+TO8T3Z7f94vv)*3OWkv!vAyLkvhX7-FTK?HBdG>#C?smZ0Nh-gk5m5|Q|ZA&TEC9JMOw}&>0oi`{Uvq44^Rhwy4 zv6`?+J3&=R_QWt}+7`(&jSIo*Ye)$G!q6reGu0b( zZ2n4!A09beg*%Phz$iJx*vX!LEt=SGOGF%etS2VeV-rkis3vJI_mEs@eX=u+T7Xd} zG306!(=Xf1lrfxM6N1){QbHGxrc?>`1X5`SlFTf0(#$MEDQ8GQHXCH4ZOW?<-8T(# zIME&wlhZ4VqSDb$BhVuwig>v2)UDy-wz5j=#i$4b{bQvsCa%41YkU$OvvYKkQ*bFE!;5A%DcO%t+%;2+Kg8a(wf&t-&=MitgOUK3Z!Z;=r`P+d z8n2sAz*;_8hOI5kOWB45%#affT7(WMcl4B3q%WypL6#HB907j&H^(*wENX(QeXhCS z9L9Mq7;k*8BpX9Tk`-c$~2YWGjBZ(Ce_ z72G;_-!PQ8ZehsiS$SiBOSJ$)ub1s;_X6O@7Tf`XaG%Kb5=Eo7)UAEjH%hi`(fReV zwP`(xXvytz4O024Ipr)m%`GLkdP{xA&sU?|-9kshdjfDo_{s6`3<1bW{c1*%RtPy> zNrrTVkw@3JypEbCm^5Zycv2y2#J~D5>mm5h^xM>@2DDgQ^PSNF>GD!EvIiXYOHHTbP+4) zs|!t6C&yPy;A+)p-W=shGQ)IXhiB@Frexw~)UIgEdSG8^QO@G;EKAMD&&-wuqb+Q( z-`dyp@?2<*t3eZ`3E==RoPgD)%-Gvz5|eMYtq3i?^zBkz3o~+-=e4LI*x1;17-Y;S zCli64Yg4z=Rk+K28G^kbOz;mBXJ0H zp(QTLAYW*x_Q0siw}Ra!D1sJ06?@U1eE{6j87qa#Qw_{OSuphukV_S(gzyN;d)0Pe zFI?=u5_RVNmBV6YURtlaYTF~UD9W4GPlDBU33U{2T+Yvv`JSl8Lfp7n!%+D_1mNi~lmEmHCt~{uQ42PD?dx~dL!o1GF-GXvTCM0xe*lHEX3#$`{xiBq<3w;TNUSgn0 z>Htz&4&8JlCdrJX`Xb&v*VD_>2{2HDjzyR3jCE9{D+2VEXVg55YMp=+>0!}}x9MGY zU?aR8zS(_K=$NzR3X<+m`A9cR)F&}&u=(vM#8ehA$dp2(3Ax4OP)(XSUFQn4vK9q( zJBV%noE4&r#RU&-aSVqxzvHu%0&j&hR)?t$lyq!Zmn+n!H(KI|1;KBtYpLT1gEX^I z<`69>#K8T=vM65Md-kHfVNGo!UUSB8D3?^1muY_YBjtTk)n?a?Fd;PRaHS?KwlFMY zC}C(8fE^Edqaqaiibx)6QlmT@amj*6_g#FqQ8H{lnq;<#4mCnpqeYN-d*4@-)b|xh-8Voyg>59N@|fTyBd8lHKo4h{ zZw2_{2;8$Lswjy~V^phY+r3nHT}rwWZiHVaqy9>r=}O}8y2RZsIj zzy)7h&t5akiA&LN+Usr4e;%(0_L2s~^^V3bC19MLqdQZBZMMx`i_>$%pLn!I> z#rzWp&<}=cPFZ*NX^z0y^jy0H;zo3tmT&3SRMxWrfte0U-$iFNGx$Su9K}>TR=+8#|<}(a@qBHJ7b|T3o6%9ko{y{ zdTsU0VYkyIeOd2BnlS5UxUc(A4>oHB*$47SwA?Z!U(@YLkdSwPN? zMObgv^g0c9IzUz3XgJD6??$+nD7R{=F3tmUjG>*;GfFa}-<5^~kcjees3Ep=BgLe) z(S~LSb&Cmj+bf0CD++kqe-1mGdkR+=@K$Knd6fcI{P>!hMju}1x_YRKd~Mf`>Robf`>C`cwXyc>L{TW0A+@OK#B&FPCNuruXs% z@@-aV)Q*n}o{jet-O_#De?m_r?W>nO;Hckdhg^ z(it$8D8_Vs0mL4cTQsXIeHD{kY!}vERvWy}zLmzqg$buxt+szAxZ!v_!q|bMr^MB} z_Gt%^@%-iG{90JyhuAreqjs3O;N{AuB=4#fCkfpcg@T?d(DWekw*y&6bc^CW;*Jl` zpxS1XTS97*M8mGA35F%Zhs^o8jyhU=ye)D@_ zfZbp;W9Kai>X8v79xlZCG_wthID+Wcy_q?F{0&Z#;0@7yey>-K#SaV&ZZ2>XgVG2vyF^ka=E^9b|P7$8I zujJ{&o7o>vkgxF?=dPyG`c?AfuRXbbfGN<`P4aox58+>UIaJ$W5g{!B%2Ty|gHn)* z%YEp6utA7?ZR(ABP2;oHS5l|c9#HEqPTir&I^6V@s?;@I1p(<-`r;#x8!W&zww)R4 z*vM4*lH1=Ii5m1)xP|!(s`K!@he;RjVbrE9wIa4>TYUNt_{}Ty!Z3`;hYb z;0$Oo>6)%=6iW@h?bi4Y#r-qyN&33gA(=|T zEeTRQ`v7=W(VbN+)SP7I?C4!bSiN@6lsLYzA)&adXx#rsmM+vSF5vB(BJ4-%0kh3C z0fS=k;e|6sEcNmWk#2cO<2}6cw+=eDx-36kGV3?&IZ6ITWv6VL#u6BnX^2c{GS#O6 zn4GPA9fL}Gq95Lv_pU_dj-({XV}KP6wI(fIdFl>mAQJ$lnf={Kg$CW#w1Ijhgqa!c zI5sZNpy2P;0=#klK$4rGZ7#UO@$yM^Bj|wW3aOsQ0xw+=%C0!P7jTsS%09y7TuIY? zR?uq{Zra4t|1&rI)f+XA+qh4T`FO*DVcUC$JjM<4l|UIwqUGBPmA;VdKq%-1G-Ei2 zw;$$@R!7Trw0WCUR_#-3!Y_nS%Z;DB4MEQK)7yBAJy{)%m14giK zv-fCj)YKwZMDV^dhRnV+(#*tGhnu&s8kK-}Ba0lI^;SKC0YHqO&EyOG)n;ud^U_BqnxRGB5+3jUeJeZM>B67ji0Q{$orn|1@bj4J|^&P8Gp66=6 z8Ty%~q_}z4O^Bd|TsHc?&iJYJDt;8-G~SFK&Iwl?n7G+{6P;S02O1ozF7bVVm{@t2 zWJizsi4DyzYU3d7hLCB8V0%Gj3}%%f#@_$61|5EwLo*YI zT+wb%b0zYrWVz(a(8!r+2VSnb zn|D*2f#S2R;XA=?Rtn{x!>d*SQhOIjeTd({;_(|2r8Wtpl3NsT`cdhYSw>UT*I(iNK_eQCCnltp154_ zCaqW{7ln~lDo!N!*H`uvNUE&@Orcv!^nMziQ}p5yeo^)gG%QIw9UvC(Dl`PCJ@9T!rVJ- z4#B=bmboEkhmaMaztFBcB;53~39w(rzPE+i!SuBqIW27Qas%hNv0#S_E|q3DaWMn((<^xwp*HB5#K z!_rEe53&*gMw=gjXQCn_GHG)?hq?5{!K{c%VPx4yRO9$byjROpn>xKIp#%buVY>=- z1GBv9k#|!+>7^>}2&{ge|?Cusr`gYRpskbT|i3?C!4es2?%*IGgB_2yMtA#;EXUE<( zYtGyk)tR~PRhn!GdQ+X9Hd9%%8cKHc+TQjPRp#Lm8 zGQw0?G{3Lf!CnhjT_gccaCMeqg@*Fb)cK%cLLlZL;ktWGHo8xCn3U!4!oE#4H>8C6 z;XqxCp8C`sD6-eIhuL0Yj!AkRpeLIn(~0NTPA29QwTECPVtmM22Qq9v)TfcSk7B_SpsJwS-zx|oaEP_!`ra*D8*fG zfrrbL6_|X0Is-1Z>oG2=o;KcV$v?Gp>O53l?SV(gxT`6nWS=tVhr+hx0eQD&Rvhn2 zxOGg(fwp>$xZL~hEt*dySAdkHsm)0oifEdDx~6~hCpMa^cq!gxT$WZmTv9JVF0BWq zG)74<@gSza13^M2p+dYw5kTUIQ;d23c>v&@L%SCf>ktO9*9hwGcPBtyy`@*oQ1JxE zSn!bN4B&XR(TL15->+-k+k`Z{8InLc)S$pqceat~Qj-978#|t-% z>PD*HIZK)BpRGlN$cThhJa=(jyb(W^>0pXOZF{urBcEk#ruE&sX`HEan&jvuzWEaR zj_y2jnIZR3%?K*GlGtIPqhlo6nz#sIiw8vXeXOgt>on=!1R7l6kR#K5egR>TQfNo1 zQ;(4(`L6S@%pZ`hJS$L7QUIKzJP2ymF9E%@$K_{$>iMF1gC<+lh(a^T%j8-zke-Ax zYlvTS$=#Iq(;2(m-)bi9N(eBwA;*J4)0FAm+F;j%G#{J3a|S{xM$khu_f?xPy*@hU z{k41__4P)MysbBs5a}=^ih>fTbH2&OAOazz&W03E^tl}wF~iL@7zJNF1?o%SoSzdH z#ECe}?=cfn5d~kjs!Di`?eOVNtiTim8rW9nW?KQR)S~R(XlW&9ZeS=|s|3P+n`PUl z{W5^j@O!7;Qh@!Ez;NzgV7oXqo%wSnN$G4{58!yz`E|cK5|QMA*(7*WwK~HRO%x&a zKwwH-H{RsK;CYJjUWb{Gq5E^6E=_FQ@XqJvnpXV~Prn~zi|uil?#mOaae1NHwRwYv z1>D2!E1VK3IL2L2v))9m;I-`fgzWW`7zSk1`ce+)BGTc8t-@l;#$rv9#qzsZLm?p8 z{vg1Kf7|67ZAys4i+@?+!_j%^nwGEwl}o3upUt~3M~-LOl}7+DR96Hv?V4wpO;fcfF2p2vI{f1Af029n0{3@KM_gHH%V|9 zn2T8OSqnRuw6clo*;pu)j+Pby8&<~6f2X3S4|7STZ;9-`a;uA%3-T(>ie!89^h)9z z*;)$}e%oN#v{k(}$>9Ze)Tg5D&Xv;}+Oli9)HUt)^XXr7py`p7u5^=t1-0T$@D}fs z13qn+3&31EU1nSFu23=iPS8hm1^szfV28$_SRcH$2Y1C&Xppky|msuD^q>nm#I>u3af>w zMKQbnI(^AzEr5ap{v=K)jciAFEZKpml0SZ zU*9|@5!KySkN;91wF`#_NG}3YLg#@|9zSeAa(&vYd7v8eN$V}bz{XN{DxsgJ`sSSW zX}}dTH*1tgp+RotAK{pp{5Gc6-1I@jD-@U_*+U`to1K8N2f@`PQ6ulE=l0&Rhr1Jf zF=YNnHrdC8<%9*dHZAgbfJauhb~iT#v}mGb7NR4lx6MJP&5fX1-BjAsqzz<&vy`i- z9d&vWlw(jt!}$f;pex}-8i{6~CQ+^g7+uy8oE@bXUVRRJve!ppOS7$fcN_Bgf^?0h ze}C^=lxC-=T5~;V`-PA@K;rso-StJiBpbQzObkB7!YHDSTNRcyfKxRX8`;M5Ji#0Q z3D>~+npXK#LYrRfDaTPn=E4inVV8h=I`V4~7PIQEFMmME@%UyP$3<~4AI!z)lG>;R zPRO89R1gQfJb6?1C!nvWCw`Y21(4me0m+k+*uFf|?pfyZwRhCg?k93QrcD#8LG2WP z7a5qza5^}3r@mJZ^$o}@_PxhewI}lDX#m)XV^NS~uzb@pUE?A}isY1>GNZLLTXSty zUTcDyYo#W+4ke#ez&;8%?qTn9$@Xw%NaL&FEZ9OWb_Cd`0g&XgX_Y~htbi7ON za!MoEkuqH$Yjw4nhy*Tf0*2Tt%tB{Mb@0*-XUP&QnT{3uP!te(T+a^mRS6Xy`B0Tz z_KOfR-vq^}Z?I(2bjI5j+(Vx~1X*k+ zl!f2OtO4P1ME-5S0LA!yDGQBI*yP0=mAr;XAP&!8Toq4w{`v}05j6uY<<`hSe18D zsIuDT8HvGN=e-naDH?IZr^^rDfnPMuFLn^ja3J`9GZcUTy0`7U0>IwQS&TC+7|D() zBA8PE$1Y8RC4|(0O&y5UJHl4ndKpov-3qlNhx}N?S}e)T8rZIrS-MJfz!0O4~8)5)4oTQmMErrt)TyRr`jGnbCYrDkjkdw*^Ub z$SJz2C0&^7>P-rbZxn`70Mn)J>JIcSH89cJb6Z zfJhghhlqATqIcbpzCDs6BuIX9lUG-aypK!QOJR}V@dYxZDr2km73e~~A5c#jVPemL;_;Z^=lj#o*ug!*?AfQx!- zs6B?=8<6R<-;qDGM%L-}FyOcxtKi@6>%VjLI|A&C`tv)!|CAPD%l9WIztiVr=Q%*y z?;XPb0}M?-QqS<w8T?y8orG9VJJQFR{Gof3ZP5vHuUeguj5*1jzND%un-1(vAlH zqk(@Z?BAq;M(IE7i9aOOCTJ&XY&c_<+J93^S%=>AlV5y{KQlU6$r|%Ni{&>Zp(&ZA zUO>3t8vKW_3T&zfI1c=uIuEw^^W?8c03>_eKg<6-`OkX3l?32za2JwNd|zqs;1$jePdf|I5rdr~y|$;==s4 zG-1@C#APOnj?qqM5qqz~*6Yw3KX+KQh8_Xn4LpO5#er&`syVn|O>Vw33cIX>~@%m6VSeSAG z?l;%TvwNxzy+TR)lHDMu_Kg*1NqV$pU>34+#h4fK4L`XD{m5<~4~fa@q@EQ<4IybGn0Maqblp7XK z4v%G~*Z=%BTvQp&V~1%8ZG|9G{m#>}t2w$u;3w0&mC2_JmHTX{8^f@T-b`y}S~)YW zIp#Ge!OGc;7LvQ>j~#0S!eh80yb$=S;Aou0F`Qp1c5o+_L6P1Z(wLyyC1%2zrw)s3 zrq>&WI*u-awB&((R_X=Znd$raDIzRTTcA>{-<+;+qv(WzNJ^|N4Xa?!q9p+d?rhOM zNTD(3yj31@toW(Bye@Lp0?30JezlBka5f+kzIC7(qKVrq{`wA;CNDdIb~ghTy8)2b z0a94^T+OTPXlW-kJ`9e!krb<+fooK%O|e>zj?jCq4=f&1L^ z)C)yEOSWH64*|GL#ehag1TS2cp{%$B4(Ws71eD>gV7Ts&^^=1PR;NPF3ycmnD#6{K zp{q+?ARXXoub_suuknn-Tz9jP)$)j;>TsmP=t>RkC*l6qf+l^WIxN1Cc+)J5`ATWs z(kAFJU~US>44LKCn$R25M@6v9S1bCTOTPszek&#If2t5$Rsvw{=WjuNeqZfWx`cJ5 z`+D`l@qE^hzU1sr^Jj?_YjNLlccVo7=gl2YR)SLb$-Q8UiQ-4G0JO}{+EIBYS_Mm=QOve;a*drS8s#nJ%0(V|JXr78|7Pxm{et4YC$gPZS(kZxle4($da zO;mORbI_a5RW}~)kQe_;;Yp9k4!?^U$n{x3S|rSy}db!LcwE!AoWfD4*(OP z_o_$=D0sQY5VE)TjnbNAUtd|5qic)iQJ+yB!hRiLP@LZpJ&<-c69`wv>Sbh-l2JO< zGkzJg%h2b{(|R1|Jb*RPN^sV?6Izp0qG+ZG+WRiMBZT~eMQ*yHTN_H;Bz3F#zX;%7 z72a!!t&7AG?n!|uVUK-Cya|q@D+AM*t|g;{0-$*%dAK9?TV*bS?iY0q2$N;sUug4? z0(-p{+f1p~$EEJ(oaY_rB~(V-{JBoMBG%-RW9U_{{_!fHnb@!I5L#Hjvm5#7RJxCs z3~kBphJjZFskM4aC}ed1WMwuFCuW_bN*ZP%QClo09~UIyhNd}9tzRJ!2s$3fnY?0m zv*qfu#Du>ANpwoo4YI{6Et^eb7EXJ0Sp)oRtoW#oLrVXBjNjYrHqwvD#(*~C#v|d9 ze0EtCO>I0Er!J;<8^`;7K;X(ERh+^KqB?uyyS+hsoprH5$P2v)EwM@aB8N&LsftAc zKBOpY@kTx1IL3NW_mYBDG2@k)&bkGprRa#tRK*%YY@g3-Tt7aNy$q?x%tpDs2RMhr zRJO}r=OJmmc8Z-1vz_xBNt7|Ys3SfWhA5YTOs?nv?tK23M5NWAF3<|W5sLvnh4^g^ zB9AEY=TjF$$lRE;)_$VV08;yNZXJ*jEYWsdvU|X5v7s6!4~q1;-uKBdtx{9Gzm3>9 zGUb-(bAF*}bl>K49@+WZj=H@WZxTp1`v7E=7Ug4a;+d;ytZn6`hz0^!U*SX*-Go(T z&~zZ&T~}7rF`_%AXQd8iAx%Ct6z%iKRqz_^F~O0x0d; zN4Q2uO@$Klgc4BB3?sXwuhKEMY@s)h6OBqSR{Yi5nV|cAv-H*0h4d=zbX*o)T5_)M z)9^J6V+kz=-olmWAO>PZbg%dEtYkW761lnVRv=?9QSyZm$#@HnlqDnaq;vyDZhvoM zaW_2HGcsMzQS@*b$unQ1!J7CDa0j1fg9Xt{~i;-ZYM-gex?Mk8~!PVxju5N;tdz z0JTMP&*(K+wc+Nw-Mpmz=}Rj#b}0ZUeQxLBA}Tz6%9TfcFErvSnVHq`a^0w^ty`t# zDhPSy{tE{ObJB5DiK0`O`NQ)U26~@EO%vTYK}p3~Y3DE`YR96yTQNx12pTDm={Hpn z?dkg)6XKinigDEGsbSSy@07$8$>sBB^1Cd7-4Ye)lzEo~-uK^CkvKp^H{WJ{R&L$y3!~m5P2k2=y0I`n(>}SMk z9w6R~-&Vv0d@S^BA!5In1eQTYB7$)-3D zwI=}l{CXI0q;;*6fBI1W9^B_)c2O6)^ju|}?mI)BUrPe4N^jf6a70S~SeyL#&UP*%kvY*gOk+iLJXk1>Awtgg1<(6dH_@tz~JIW{sC3#fRll4eEk;n z-DVH>cJ-!oPDNv{OFM<$vt{ONH}4|O^;&G}L!LRX=D*6ymACLmmIbup6wa>BtMb4{ z^chg;C-|I)4`S3#;qs30o@o zv}<T@P8?9w*`SYTE~@)(?DY$wcegidOKN3w&usx-sX1^fAXq|k zZ~7xn?4dSexMZ?CY@@?S`e!KP{x8k3ciNrNJ(_e}`{Ws;vN=d#cFA7{(=(ZMC4aey z;iE}Y`haWNW~2=|;uoJuUB4#vmq<5o^I1(0cIx)n=6t)M6F}$#*kLG|Ty# z-kBn<#U{6)TN{b&kcN7c+!U*|qI7NDl|Mc{FM{3}=Bo2Mv z!*&~S|Ia`c6}{@*fFE6X{dRXX2TNa7g_nY4%trRO^4DsQoQRvb5v@MHx`Jv6srcZ` zN8|euq^!NuPwhRvpr8)iU;}lTwT>;tPo}+Gn+1L^#Eq!AScqTm znwHt{Sqvt9a+M{iZ(Q(ae*3t-(i1eU6m8T!Rcuj@@G5`Y;UClrY3u2zn`5F+qme?f zKDCcpKFwc<&s+qwC>x!*~Z(mJaEr<@-j0pRJ1MS_RVP{J<`j^Rp6a5t*8Z1*ze(VV*e)6kd z7a$N(T|u_^mN&ptSYTs8ln*KGpYQX|vX&mP01tB@N1J<5W!RKKjuWlwEO}$Sm5q*z;uIO88je z+Q<8#UxLrKIKcEM)R8IP3_Am{n)3-BQ94bzP0};C)1>y|uLhK?t`zu<>Q$okEmcy? zB6ioFy3qP9S#k{RSVL{oTJghHW&fp>HtjO7rM-xY4BE}YR6Nt4Y=T?!UiYJ4}V2A zq>~=f)~?aQ5d*JiAqAg>=2JIy!LGksTdTBzp#NXAMr?xg(z0r!Ap(_ zsGcU8wDn}lX=R2Tgm;zyv$C@j` zwL%6v+t@t4e70Q3ozdc19`H?963*e*6G27`(H>@Xx=+#&U z2Hsm^@vZL3GURToOAWR$`@)ldeG>H^5FT0xR>t0iI+;GX z7DA4`{FZ)AaYG1Ua`5^4F|DspDxR9LH)69ozI>o*T95}ou>m&pj0aM+hN|0&pm-UW zyb~dXlfi2q`#BqC8u5~9#@zqnB`tykutr6+1xoh7mQ$t#?f_2Na41L|jYQWw}+@yY+y8&g;CwN6L^jh|u`Y_Kt>kRh`nm=0W(&WdZdT5~s z+^mKsh|63VzfteoB!#@3{GeKn?0QP$Pj~Y@F)|#5GO0R`Mi&Xo%YiM#pyu#|pcf>% zwh;oMp}KbIX;qOMx+%HJ_wq)6$Ct)kn7r}zPh%pXA^3qxdN|2*sml%=pto;ePEhp8m+k{$5@!OabzKyRSaI4^E!7H_@daX zJmzZ)`Od~OLHw=LCw+A{o)l*nJ4h8+BR+BaEBozq<>}U|9}>E%hxqiKPE5Y?M`d6+ z_2eyU>mA`s0#PWh@oTG38Sycw^YwjRtJnNBW4UXMidIHJ6FZTe__!byIn}iofyBTC z+cO(UWR20k{saan)8_-)YPpPDG0@0<@vmJqrq!RpB|INW29MLkptyb>$r6QRbl`)90lRuq2Jnqs=L<3ht}Qg6o> zW8!f&bb66Z^ye?nAHyH+xMD{|EsMBq*!6LL)&5v*kWM`(j!cUDRv;fE0RWsj1{? zk)eKY-!;;+7}jI1CE6dep3Ao-kwafenu1<;ngh8{B z7@qmO+C)QQrlwS7Z#E1qWTh81J?wlC^rA3J<>7U$l2Q=06&RnoD0!-RT|U#-%FrYs zOTs@TX51H!_l?0Sw=z0LquFYb)y5sg3T6>X0$G9%VvCvV=(pb0f3Lx*oMF9G1xDem zTy^x)@~t5fZYtFCn&nJzOI5F9C@UEso~~-XP?bayG4?H)IWGu>a~~=`;+Z!5Bj`%v z#v>r=HS{nnH7?=%CEAk&L&JAn$BxdPO^`Yvu0G;LA8uhfR}q5^{w)b`(zugqEI25JCBhM*qkR<`MK)38i)rEfyljZWj8!rcB3 z^7g1NKHaD+L0$c0c_6Wa8p*L^YF0w-_X7}4cEP@%=Cyx@%Z@;eK;Ny4pX>{u$nZx{ zYW_$SUY*=<)V0LVr|X?3t;M8fC_qI-Xr6?dp1y>S@cLuU!{fpgKhG#-?i7I?H~2Vn=)&L~o7=M>014nf_C z1bCeiSXK9Iw{HTil;Tvt*+GI&dZARO5T_6KkIqFt+|6lRo_x0Hq_Q~`Edi*_5p$fg zR#5iB?4}pVOaPwxLIXnm&R$2kTHK>v1(q-6%oF09eaccNAlg1aKghe-Ix5qA^81b* z+b00LVO2g5)SwB|)UiW)xAMEpw4PVhKAkxpdjfk$=-zf4CII)@rywq?#)7R%7?dGs zN1RSL{e#)ioRMJTcdZ=y1slG_jDTed>N?jdhAUtT_ECbo0&9P4rxx1oS~DrF)eobU zN|+6swkZ-O3kbP4LL0Q2+6F|__SM*KFI9sd4@Lau!_DNV3M**p1YrVtJqhjHmd-AS zYtYQvJxT;-$^#w1ZUQ2xzU5+opiUX;c?A+GA8vkcro;i{S}8I{2VU{l=hq?C;p$_E zfEsL8{AQ0MCpi+Eb%Vf~fn_)?l_{k$NUA|an+c58-EbT}ba7rf#0|MJ+%Fci=(SX~ z<#jO8paFXv$r-q%HQwlQ??aaT7OFCRsgKMr^{uh2A)BJr74ov zw$KJZ)GJ10Og+jjUT1-&{*iqCH(03x)KBzvwKnMX3jLNlM-A8k1KaeVm8?1o!Cn^< zgCXWAnSwuH7wvE|roB|q{;dlz1_t|7{y#_N=0H4PMC|m*9k7dCSL=2HKV=5?tYL8? z(1hH>)v-|PTFYHfKg(WFMgxQ4K;I_jZ+V}Yo7w700eK+6wm!L;7uhQrgH>9 z>?Qz#14-O}9!c~68sV|ke$cjd2PM*Yn*abM?OW~*P*2uUC#VPIB6}2yYtknj7U@I~ z_(jo!M}Sd?r1<6m^tQ*3{Rbj#AnxX>I2Kr>G(hVg1b4u??sgp60UH+B$H{*r)Y-ea z2L{W#50JBS(MH%ky7moK7zTsd@s?h&Qi;uQ_U@A+r(-f)%3L#sBo5Sa7_>J9W@3G| zax8@A7-&9}(%0|reT$dK_;=Lq6;2LB0O_?)$x{q@M%Ao`FefoV9JE+mVDz1OGXt?Tlf);2;>r_u%7f$bE%nJ z=Q*L>LhB$a>L|Xw(=@I5VcZNyztypB)?1fr5n!|OPD)cXw$O#*MMHXzNHu?wt{|*~ zmpheW)zw6ob&v7KWVle)JnCqHOBIDllAK1>wiiK%tR*avC@E=~f@mi@TQe(>h4B_7 zuaRf=Yn#iU<Y= z(+T>=cmqI58hVyMrtVEXaOp(>0h)1Br=v;DwR zyvZOicJgsz>-$b5b~U)CpVkojtr*Ja1Vkw_Ab9TzArLPfQ~5%#Eu{r7kp@L?6Fzo~ z_8%dOn70(vFEL`s^qbLsH}t%%K7^m$R^FYUf&eBLVP$xrOFJ{h>o}Y|^_DC{&Me}X zHM+IYea$~2valW(+TcKo?)VbM&b2@BWM8PAHcV(ZJLtMm=5?bd!{;bo**M+>_ll

Y(uNRhzKHdsv)d$?2|OD*D$2A;JhwecLOo}>U?veS&`T&_|ot1 z{8{jQ@lEube)m{zcD3G7+CeF0$0)&IUAH@qlt~dLdqL;Xi)l-wq-C~@+X|RD9pB$i z3&;1pi@C#cZ}UkM3dE5{AA_nft$v3NTTy!~dYcUoeR9!gp>L#pyLp#!0=)2gN5 zO{3}HWWDnfI%{f0R?uA6?WlY7T~lp)eQl7nH(KBV!!~Q(s+q(u9UXcto<~Qi%;$&2a`593zLycL>$V@J>Ev4u5qOEV)`{nz`+Q5>@1C(mELvz& zN=FzQvkkXfQg}Sc)s$uf?k@!gDPI1*>SFxs1z#ry!UI{=-%QlPE(ZU~mr0!dx;{GLJXhlv*kd)d5RBy(aL9KKDSy0exdw~-QTXdr~))%r$|G1yse#x;h} zAM~S!r^Xj)-`b|8I@D-I74d=oiJ8clC71GER~iQ*)kLwFlCrH`PzT9v?Rp)Mqzd;K zpYe~9>lBY3Z%)X6dqY922xPvl-l{!SIMC4sCg*WM<`27u7r{zY52D(&XRXGzn2+`e zD6Z|E#a+zy-p46ZAOSkELb0g^XIlU7Fv6RuhoCYE zJkZ9{y8{?ssKgDNh&;n=ii`AIHHDWD4% zF+mbWNH`!z4`NXql^Hbx zYWk%An(&USYcv2B5bGHwbnAP+t4zUK269Uz>30Z2HVDJBiCs5-1Eo~!K|QvJ@|l;s z{+7^)%r?8A^O<+p^a{G=#1~P*WUJPyLVx(yK&<|6fauUWby7kNM|;t~fn6dQ#%DC* z1XLmivrD>|w{3Hn z`+N{~&`trMC#Z{q;>|rIDAy~7LON*A4?t*s@{@QQOX?ykX+z@Ixj&(EKn}KVfm#AS zMlm@F73V?h*~eLpRRtx&ueyNDad* z9A`@nz-g%R4+diciUq;*aPl9lF6KeYb1q!}H420#cnFgE_FiKU$o?Q5FHk4&+60Ki zhn6G%XJp=AQ(fH7BAI2D%#^8`RMsO@^~W!s+=4WkDWB3zN!mv93=_@&pfRM`pfD2X z2WUYx3sQ%x9DNQoJ-=pRV|G~uNO{wwsQ)7Jq5p%(I1m#;<(AtbfcE9U{eH}y6Bvl? z`eE4XTxJu2^Y@ts=!ft?fI_LneoicsZhK*=Wnsx^Y4cv9A(F;G){_=ihPCKT^CFuw ztr-kXZ&ycwV#@la=E4>*JL$)EU z-zcaEByMmX%lN`+1WE%Xl~&XBlS?8f426g#k(@U_?#={9{i%5;C&I&tgz`d}dgm4X#h80{CCpbc%ccWz=QzHRm! zZG3EUwHf05&c!OSh7%bDZ-;)xuRlpy?K-hU$JlEAg}7E1jHfErSudrvXl>xP5+#?C zXfONKmY+tU3h~Q$1Fcmpe2ov@C1QFAz3H}u#D+e%{obS%LG^op*dl6eC8c0*f*M}f z>s=7lAulD>0$$t7JlwEnF*xZhU9yF+CV7V8uDm(*&A%jq^evZ-u~@Mz+Vze^v!W&N zNF;G_9}#JuE$=EQ2_Gmd(Ar8yx~wN`&Fh&N5~H5I7&^nt9`6IaCB%PC_pBjTN9fGv zrEfI^`|ICyJZ2g19y~SO|771S@c!z0+WU7QPIc&}C3I2L!!W9TTG)Lvk%)nFpQv4q zd|PWJnKrBKE#-$@ALSrAI?V zf#{1L5A6)skWJ#+yBbj-20yGGpfRiJde(4kxj4gA7kd_?V|b(^RPV*77jgP=8zl5i z%KA_QJtq6Qo|mqYuHU2Dj%QB|t3VPN1ml9j$+p(l`uD40Xg<|k^xMWJ**uYR?BCKp zoV%lcE9y4)CfEK~*Hwfm4{mFfs1FEnf_GCl&>adDPcJ-w@_}7oT<#=R$L0X&7-SZ< zQjx^PyJmF+{^b)JP><3-pjWuh_pC%E4vRD1n>_I% zy7}b06FxC#&l*f!jtzJQwp4ERLcLJx*V~=J%gY5}Q=cBZyZbI_tEGv)BdxG#>GueI znZI@`?~^+>mH4|L&OA3hM)Bt5-@$)3P0p|>j#e75CFbTDNT*!?z&cjzd=ImA`<%r3 zp?JvvlQTWXV;|kVXDVr09gj0NmN2+s)vx64GOMiWxjf5}dWv+O$IJ zep2_Eo=IywruF-uvTz4WLPRiO{W8MbYJa3eY5N_5{h?i>Fmd?N3s+?)Gi>X_yK}h9 z5_GsZD4|8R`&wp)u#t!qE>aB294~6CbC}ot!VpH3ZLNNHS-@LejLsu=W1A^9)%Kiy zvJvDJEDxvg%V#6IDeIR$aN!Q%Qu;1O(er`TU)rZgC}tRGn^_sB+QF zdIgTas09L5{&k|in3{#viQ-sN^v*+$p+tGd9#mscRMjEE^6*S;_#<&j`bWY;@9(+@ zm&UB&_Mpbg&ARqnCGwr|;{1g7G2$Y**P}u%v%hrCvUVO9ENHAJ^Bf& zymq3%AM*TtMrltt(xPrf)N7`2B&oz57A8O7=+{@+?+^)RGiooo8?+Hd)j^zPpCQ(p z`<)oH(5H2YPX)7gK9=oR6@2Mqq!*F&i^YqF9zX zTv_^{z>s1niIPsNl7zz^|K^Gihc{ZVv>)V*B%Hc`G=?>@*)EWxgOj?H>>$`2*I>{^#5awCej!&&3(a4rcS5IwDqt58QG`;=;7l&K5B6<81jl+-|BVEvcvfx7p%_*Si?(bT z5E+Pt%zNzIN^V66(Zm^kWFm|IRQ-vBg@)Zz%&@}WOkZ4@f78A z&u>2lgteFN8l|!VM0K|zq89n8^^_G+enEW%f?Ce*zt6zHBivwgSR9Fm^OZ{G(VxfA zNxEZd(F>Qq|BE6)6}w1VD+?C5Nq4?a75UejwP)`y*FQS{#lm*tm}`-d#y5&yFy#3lnaKGK&i*WO;t$ z8>}d4^kjdHw`DZfEi>G&mxaqmmRylhuL*lfTD7`TM;4qWqMumv=C?CAc5S&BE>~PG zL>MvFYpyw+eRby4ju=)h3=1HkQn8Ur=FBI|p*4a}X>)lGOfC8ioy95VeNhm9k0$!Y zYun85vTC8Yl5_{kzCOMRDWw#QetD&oF=4%{qRWxDl_b2#hGF?3Kd*;vDB7%Q)dYhHI__IA7~$Eomhi* z`@?GvkBuwa7Vj%`&W@VISwCKGb$SA%9};+=0-t*v_J34kYp8G#-Ss)pbl3Z#)H@6M z-Aeqg5Qa90wj9B=t9z9Bh@5!wa$LfNoS=7n#q6^wX|Mhc&q`Lduo&SDph4`paQa)TmwHFZ~AW%e~S$Fuv-ybZTld!SqA6OfG6@4FJd;g0!U z5io^rFffoo9tzcnVTF_jvIg7o`<0>9a=oR!^&v0I*L@1Sng|TRUeEiw^u5wrp?9{H zLTV{a8!PqYLFR}KAQrLvKMPJf7WK)TN7*bEv#&c+TYD@7%B#otj=A*t2bk)&1!VO* z;EIoT#ZQm;+C0?A`hnMH*iTDi*n1E2-IJPZF#S51@@Fh+=d`1#i*k{8S6nzIr&X0K z!|@99K(nvv=-<4Y@_CbEM{)Zq_B)WGzt|sAeuUAM>Ab7n@?F?NJPFQ5K9KANeou$w_>h+iR=TGS_ zsfpfKsPtW)Y(STRZ_w$2Eb#sA^zwaCW9CM$HeBl6Fx+ro6AjKs7))nKb=sCs^a;Y) z+uyRc{Qv+yr?N;2o@%h-UHvHk3`0P%YX_vYw{B6&U-bpet$89hH0RNc-DBD!^fcc(x}HbRM8Oj6c_tX%efYO=|`nhru9qt zUGdIk`*KXHH0G8fJf_o8mRfxaa&%07voKk+tNX$$$^$-5vy}W(`wOPVwC)i^&!HYG z%3o!`UG>|L`-E<8TX{&B*kvF^;dcPmu&h}}YL7sLkcaH~C}GU43eyYEgZL#lq^*KO z*ZTY?cKrhx=1%;A6Y$IG4yLD{4mhl_BTO$;UA2BZ59AYg4`|%%pi=LNqUMUCxv+Rv zrY+;@r~#c6hlha3Ygl!Z0GM3)8=uE2aO4-qOX)I;@=nkE4+bb*$%Cscm|>> z;65|%@_uYVWGdFFZE;}6N~q>pzjVj{;{xlCpp7Xx{5TLM{+q!B`$6F0%>PBueHa~C z@1RCtTonI_oS1rGL+Ek>I{UK0xY{9rV?CFA%AJ;P~$V zm}Q#+LhzEH_gPTny&ZE!mNfx`&ouiGJ`e>|x_@X5bFgpwD?af67eYDxQ#hD90udMx z>xahx@BmpVD~exn-X1yzr6~b7RGV%atxs#V8=JPRn~jZM(5xb^X9+yUR<|h`Og9V4 z2KkFoR#JuYRtIf$5dy^7(O)XczRoR6DSk3Xi35Rvm5ZOjky9%FVNXtlP%H4+%kmlM?4Z9xZ&+sY($Ii zBChj)u91WXj8R8MUmnw7e0G!$ZhP3ic>gA4UxoTIHd;r;P=jO~KO585ryM?+>`48v zCTJV{)xXU((cP#-v}wX2ra~Sv5MW*7mJHnC5d6*(|HT3wnU@%yqQreWPqCAUw7ziv zP)EBh!4jN`GmP=Prg`$Son{1bv6ClWV7Ku_1nEhk;9n?%wv~K`L(T^fvpZb|;1v#Q zZ)VY2NX8p%?8t88-Iao4dK4}vy>tujH-gHF)$;I$D*#5m+-Jk3^JWKe{LyrbYdk$a zoV#!Ho;u_EXV-Z5t$t7BKpaz5rJqzQ4Bmb_c?<^Au|_=e5f%0^mWDfcHLtmQ9`wb3 z*N`!~L#g$Q2)7EH=V?)QzOQrjlYD2?WwmFz9S@3Iri3#D^G`)=HsAx#bP+`NB-P67 zNecUbHP?sk{vyDs=iWv$g?>2}^|2C9bJ|0t~C%uvlOJgo*a`t{CCi6^FeJK0|xQ| zIUO+E)Zuft!n}kRjT6 z?`1vmvAH9Yd?3^@?>-S>=xX+?Rh!_SuXBok8E+3-agbCd*1Ntpklc*yf zql7YPlZpde$Zbfyrm4xhMO>KByheBkE&jxvsFt>|tuVQL z93D5q%?T0&SY!^Mk(`b7l)UiZzM*M_9R#_!Z={Hg6$RU7?{0fOd6Qf<-^0ko4JELW zazfNuqfJ63Pbz9;FQxWIs*aEnS55S6?8rW2pJ&V2S8@-5r5(63IivHAIL~2|!=JzF9DdmxC9Iw+@! z)~ zWkzok1z`;_FI&=diz?9oMO`2^R4xD;Ilsa%x+Cwa5|>XN+l1S}Oo{RYs|PFE{^QiY z39vAYOv8b1c{3v|Fvsgfu=upiCkVuU(15^yELt=AuY2u~5V0VNK=IE(7;t_}j{TU} z6_N+JHcV>*PSdi1l%bBbj_Bvpv}o|4D^_W3Qq8~@5IlTm!)*n9M{1gpMkEvU;*!nD z9+8sGX>tQM8x)A>%wB5%%*M3d3R_!1mq;T*>`5_&6W(9T8v@6T>1zdAb<{cRQ`69P z3)h=ip@tXKvJA}=r4=^7$l~gYf%6c=Nv{Od5EG>$s1fw|y_pwoI_^5KBGDk*wc>o!mcQ!DcM3E1JZ| z3B?pl52|ocm%Y4qaj-4CJ!xLPRn@vJU}AkSik zuCVo%+Q(k)y4`kBtAZcv_Xbn;DG26Xh*}kJ7}VkBHr9qbpKzn5ZH=fboFG5bhqetJ zRWMT~^QGx=QPyi3P3y8jb^=0NSfsrKychqyvpr|OF^VUB2hOeQ4{F4KeKEDP({Nv4iM^HXc><&WgvBAL#NJ#k;2%^rSx~DE0 zbcaQa>?u0)OM$MYYFiqA0uukjgt0B3# z3l=#k4uAQ#jEsOw<#5oOLTvZds8-4J@tSuWRZ(w6d7n2fr_txwZuf%Fg+|IaIBCgvFR9nNQ)!%b{pM@>V%7wI0e3;r|hzE+%?_ zm5F~$Cr)Hrb$*(I?c@!WGyOvleyMalSl0f>#%|j^kmU&uEj$G^63pOmI|Hz|27CL10Y=l=pf+%`WVl(zc-Q%2I^?3@0Ls zfhB|76i&p%0iq4GL_`uG{Gc!_yGDW;Ji5fQ%2hA5!~?6iejhwO+`Oek{>4JrdmNO~ zH-qJn?GfA||G^>YirCIe!S|A_9l;2I=Hy7Q_FwZdDQ27>4CFFF`Qt3EQOPE}>NNv12J5x9! zBl4I|ANJZS0a|WLjE1}u?1$ez_zTXyeUK-DW#b{M3KUZaIQhp>kR-uEG6*?|V7)yE zvXihmcV_MhgR#&4i2HsFrs9@5j`q-mTK z{BhxaL6C~nkKemmg04T}5R6z^4dv9Ef3VzEfY`KQl8k+D{v@B?{MTi(&Cx_om-&5l z3!b!3rkax-c!@3)mxuzGV$L&9Pa3gaY$Gnbygd00t0nKOIrah~4lG~CtP_PTQrUzv zM{9kFH!2vZ_%Z8xsCUPQ;1%AnGDe#1id{)62NQm7&U38HyMf-Ma`XkiIS>Dm_EA(; z1gz0~qCbLo%^n+}o;joch@($sVQow3&i4rLT5ZiZ{m$seWW%+Lb=SH#Sm?fx7k(-? zCqF3DeCHpeaUPS>kZ{&?Td4-x9{DjxaJrR&(%87WEk5k!5#~hu&p)P)LBS=2&(8GV z7?m!Xvu{pG3Nz;gi)h(?=9}FWaQ;u*jEy8r%B6A?XfdLYlO1mCa0 z|FQB?J6d&f79LZf#jZ2|z^BWamcMLYXasS_@6ASD!unFHx!Tlp>xaC&hJ^;gVKihx zE~@$Eg?*>o&f|?RgQQ2hWdW=#Kl(`?Yk8MzQ%zmS8JDe7+d>FZXkvb=(Pp=!$VD}A z;DkXu-W@dW^;XPi9hBp>O}8fL^@d(#N@8Xj$5PD4$ynPht*bEv;lIaiS8_U{OcW{`Nl=XCauXZ^uRj82VJ z<<#W)E#rT~)0+D9YxYkv*|(oZWq#f7i6ue{OPSPY!) zezKy&BzaS=AXwkp=GFTYg8k-P?wPG;KlJeeALl|MTzI@+GQU-rrg5=>;cI*2&xqcV z*#3}+)eO8Kt%9jBAr;^o%$^e)=rA9wJ1YEj_z<4_chk&m<-wUA+l$~W&|?E|>emA| z!I$Q%tEXG6!oMoHAXWvc@L{b>3G`sKx@AXnaroE!8KE!3YQH$584aqwGl*x9K4ha` z#eSSj&uD&s;0`IR*+<8H#Awrx)NV;u2^vwy)00NWl9EOThTKKWlyohYv9|QW8(N-- znWdIl77gW@Qj=2@7-xwYrcv@6C2fm z@sjY|xOXl$+rn+D=5t4b1!dz*F2fr)Dr`4nuQvATThSIu=%hRM&RFp}={70N30x?rMzVAZ@@tt)-9}UVf`d}4L>GL# zHr$H#NU_gDsFQ0!&yD`>nCr2ujTfU8L(MNJzOuz@rA`Y2G`M#g7v6-)=#1x$?X7R~ z5*ZOC!dLh0e0v~kK+}f zTlv6fsTAr;9j;r+T1sdj2g=Y(;;RIX9)}YGj1Nskn|QQq5vw=Nfv5pC%z*_uA>VF! zKB0#1wMf#vWl@gkD1ZKl`Hgr-nMA^&LA&b#L1)%g$%3d$jdT{I*Vl-$xobtZeW)wn zTq*nVTLI6Tz~?y^h#UYb+pCq=KX~e`$sH)jf9g@ZHD-3uRk6*U%UHZ^M9LxQo%pVg z>+G)vgQD*JNo@AqXbMz{NZ2pddpU_W&CLvfSXrD^&Qg$-;Rs}Wo+;U&zk8RYRqQz% zg1!VGU2hIkp-h<|_gAoS&?42VMLC{C`5$zk>PYbmC>#V!Y=@t{J+!4NExs0G=6REw zV<~J&uf03sMelWe6!_S*d%J|v3SFpo<3rlgI&G((^ag7_yCAUp)nVpqzDDaE?lgwB zgMe8C2M0VIkO~94xt}I4sKRIl4>1n;CuI?^GhREuTt$_uR2IrNIN5H|r z=AKu`hA(EdFg_^XJbd`XaP;yUJUV?en4 z46C)lwRI8if(vtlR&EYMl|gbH%ah%+&0gr`oM4Bu@BS{3-UO^) zrQpQ0Je1wXg4g=(}SsK>u1X-*917;iWozm4Bsw7Yw zXkr4BW#43ifSKG2%fxP(Z8b=U@H$gBUr>5cdD?R$D!pCqSs9&z~2bgxPN z;^6Dg=3LXQN77norKudU$bk|K72vtmS4kFMq?sF8fb{&O%ad~-K4>g4UW*8&ew?hz zkllPUR;M>n@P9&Ee|-qnQf(m(X&G2N-~wCItzcW{DpS|Ck>l?r?hyx{ZOEFAFQ|_+-t;yb zuKGF8$K0A$IQ9`xbGx-$}dQ|um1~-xv^r=@NtuWLjaWiUt|U=CeNh! zg~JDP9TUctjlrXl32}oJMcs2!2z$E!}Lvm)2I}Drhts;XDf{S4jAg2Fnp5ZfWwd%{ z*AnU0vVFLPa|zW2s(%3c;O}$8%)>TXBg#QwB$(f-=Q&16hH{APk2^+3uU@Q`$0%c7+OC_`5OG?0bQESA{s)4OR)xfmA z(12K+m6hh8l87E8^y2VrqfV5xCBDXJ9wz)33Q?){?DLGz0~;O`hnp1Z=ZsFgFI(r1 zFsq2O!43YHTb}(T(&&}3+|5b`O<7Uz7$ z4J!2TD{J2~*c1+LE2aJ1VmVuT8Yf3dWP-Jg&{aIV?lGt!jT>j* zrAmNKM5%P=T#Q;;rT96j6J2%F%9=*F?_)`p^{i=;a#_A@rxUz3v8Yi9KX=KRC`v*J zmjC8#7CchL@cU^qVDF>(zfOR1xVf+QeO}|fu*(&8o|=1w$+6&w?b@-ya4XG-L2XVS z3ir3*z2N-5xwdiZO3IEchT9>Ltv8*VJO5G;c!{4Wk!ly|eZc$4YV>)K`9(7Nizr`a z!SJ$a9%>(vks@Xl93bn-;I}Ny_ZE&~^;-q?*-3c~@_RnkN&L#B< zJm75LDbu4T=`@G*x(8{jv#DwB9wrEGryG|vrgD>q9#G%(9vzaF<&d6w;&OwkM&%*8 zoNkMlu;kqzY~f`HZWtu#yX>f|?ofJaBBWNCdxhe4CHb_I*@umNLjO?9wA(Mrv)ogP zwYjS3!tS!iL>B2?Jqm4` zD$n$xh`@X+P~H~oUFNjE#QsJG!Cpt6@gO5mbHsHU+?wd!;)6U1t>kg_7e)8{6PG-=o7bUq07cfbG$#-2S1`0x6A`XC;rktM1HhG3EWE z=NU#dc~}Hjk^90lRchfleg37x;z7aCuG3D}ZWAWEm2joq=s&iN3haGnjL+BFsvh^= zLiV?Te3`E-9>k!e`=#K#k66A)Putau9MTky@HUnY*hKx=vv2rv96CR#SIv9ncZ|+E z&br#7)*&zJj5nbb;Xcl$=3}FT>a{r3%_n8mQt}_AqMUJjCB%p2Pu~rpu7k1^@WSB} zsECG%ai#F50?#SSO#jJ;ou4ZPZpVo^$$NFM^Knk5`jm#-%2P`dr^=W8$A+(!Hdm_n z@t>9qG}|=~gezCY?;VCkxcUA`HZkY(Qa5}XXlA=M)w`DMyklvLy+!<^6VG6vvg;&W zY|nG^lYR!t;mIN#{V#)RpLK*b6+Rx#eX{M3bVR`BtekL0#Vv}e#SX4JA7i`TEGft6 z^izgXYVgJa+_p9X&w8&>O6yeo*0C$;R_I;tLNgHf8710znd2P7#q!2LLh4=^5EP${ za8Z^P;w^3{TqUn$POln^OO-6n3dWYX_3l|a3s-!(+IfSz)_DH3lVJGZy9KSZU zX08loA65uQaTiIpXOTo}%7uoX<4lKk@Jq9n7p9K|UI`wb`?FfsqouiL)wK&3cXH%@ zl`w))zg&I3(?=}AX5!6?!HlAmIC^&3r^WgTc_kS)c8of31eA)Jn^ue4^h)4SehsE{ z4P;;M--{)FF@5qv2T5D`*)AY@eS%`s;>M~$2}o3Hly`Mf+*c3ra*lr&ys3QWu(NvQI{o0?HoW1p5r5;mpoYiC z2wINTu|hOXrP*AzTz!UB7JgO(@@m2E$1k@kU5Y)}>mBUiEQ4Rd9km5qceU03;f?!# zUt?FZcld?E#5d++TdJ}uh0NVv54uBoK)t~=Xy?^DIXk4`d%I@!F^>a%6f({FgEwU# zeo)gHv;0?hvQUYHjb8V|sM$E&<$_1pLu%Ec$V_=ytmm7Ia0OwE-k2sjRb;`WjYL$e z8ttPPgpA2fBoAwqp>aHCyua%|G9V2$M_KHkSj{U90NU0JVD(E>w*s`9l;J9vu8|HUVE^V6*f<)Toms4~Zj{~@X?y}f}IKJp` zGvWVN-IYZ(m1R*W+E}Ylp+z8!5?TS#05O0VVwglh1IQpUgJ3a5K;}Usl$3@50Ti^D z1jImuC@cvAGHRI+W|W9Pg`rK55D+lTF+}=B3c6R@tAF~d^Lf^J_nrIJ%{^!DyU%+y zq+yxz?Bqci3ao!7g@YH$0nAl*Y-s-?mEDE`-bfQU{rl)bN5=h)drQfVcvB`axkTy!c6Jxy%M7ocui!(EPdVKWz#S%>js64iP zmnGku?81{0r-NTk%&1W7{(w1mWN>;@agk-eg3)cNHHd(-eOaLHutxAH`b&+C_a_Q9 z3XMR;+-k$i#jd*4TG}iE&;VXzB-UyUHYQ{DRh=lTiWh*v^x1{GhiYM+;H3kbRea}i1PrA15@HP?9c=k4Z3 z++V?F>+>%oov=F@36a@3 z&>vLo|J<^OK7DCt`C3lED88ge9?GKZr#XKG^M&mlJ28*hm+ckTTSr8dC zzdJMA@YjPnk*>;jvr$K+g+h^#Y+Xo2r`qft7G)(9yC>zGqUjfOx&}Kzaj#@8iOB-*R`bnSX#)X}n3;`Ew543?Vt`4H9;*mBD(L zw|4*dUNKADPU2v8p^kQ6>j!K6Oi5Etz@^@yv3hN+qQ~faK%RlO!=^7;M=AuwAWYJz z2!$+pVjuOPY@oM75!ujP74&*QaN&T?O4ljD2^EZ%M6m%tD*u=_ee*YqxSTU1+WT;7 zrTygL;>N611Lcsr356AyyqY5_EQ*_>U!J36oz-gaGD5=vsVBIWzKS{-9bYBNEpJ?( z0ACEu-ow9@CT z5<_V~0MwZ@ra?aBu106c`uQvXHw5lb_}RSa{?ZMnu99hX&$}CQHL(FJaRq4Jn=2r6 zQ(d4J2kxi7I3^4AJ5Bv`Cz@vd$BG~Pc0~ewR7=IaUqMEAUdW_=XnLvY&s68WY z4^qO9k<qK!cleAQ#XcREw>HhYVvBK^*w$1^yX<5FmekTN&{Xu%)~ho|+= z+>yqO5p$0Odb?wrA`Q)!(NYe>eK>M#yCl1PFaQt&S){(cSAmaG$WsonfAIXgP+*0t z*UQh%1{yM%?|||Edtcr4h^UowhdJ$B6EnTwhW8+oCJH%+6n?eQxs6cZM|hKNJG#v?s-CKI&{d zl&epNi1U5$1MvIA;E)v;JSQ}I99&QTSf0)O$b!r%Vq&QN2GF*=G3J_*_0kwXMyIO7 z<@z5g0jQ*A%#zYNyOhI~dK?1OPse4d^zA(u7T;#*iJVC4nl9GfqwTA1viqpd%LC#a z;3sWpyk1V84X~$Il@#zYf4T*}S~jrmd)3L~-7!$V-9hRsBO>P5)w8#(vgN{B!Du>` zrC-YUX)<-GG&ogWBG3d}XG<1b>Zb-KfNBRg0T;R!osGkmY>LG zxpb*vC6udl<_?UXrVH6839GQ$BP%h$cF@zFy!tm$vadZ3?auX#h!5?@SgsOEG>j=` zT52pl<7ld0qdLlg%Up1#s6Gf*+cRKwXka7r$I&G`!2-xU=W zhg!43TYO%4tyTv7OCqSxX8CNoH+(PK5{Dv+-9S81tF)~nh`E39tIHCL+kKs(de|0e zLt%)uEq?TG)$EMYT%fHZh`*5SJ(hEzQ=V0z*Q@6XkhTX@)S_u_5YB| z_gD2ypqN7!o+Io_V%t|QTtD3(=;WK<|1s=Gbd(|++v)EL9L-1x5Hfyz$Vr&*qv30A z4@NWPLM)=Ed+~q}FRCKJoQI+YFAST)?U4JSy+MCvDkK2!{RPxWKut;Ye$;T=Y}t)p zZ%tu*pb33;fX9PK6u9HX=eFaMP9(46jaW)BJ{;1*PY;b})V+LKd-z61D8V%IuY8gptsl z#wNkzC%CKTM>gy8QwN6S@LpzElB^=>Ot}qiyV(*W&i~;4NoG0b5zvoT@bQzWEOWtNC~U literal 0 HcmV?d00001 diff --git a/website/source/assets/images/nomad_reference_diagram.png b/website/source/assets/images/nomad_reference_diagram.png new file mode 100644 index 0000000000000000000000000000000000000000..3297d7aa0eb1e3d29dab6c535d33162a72ff08d7 GIT binary patch literal 36526 zcmb@tXIN8P*EWhBsUlU1C~Tz!1f)qvsnS~rLMXzfcSG-@6saObdasEDks7K#@8^Bad9Uv}e@^~DR@Pi|%rV9s;~w`M>w|`x0x1za5di@K=}SdfEdqjT z5CVd$M1(hiE4_IY_5=h01TSTu>v)W>)f1PenR{+d?0WnM$%Vq}lqM`Ssu5sU%<^St* zt$XvdXS41!;{xYD?NHV~y-u&D+sU|t-L$z$ zi8Hb}Bb3F^{>esdN%htb;&9*nF$LHoyhhNsF+{wA*fe*eVnhG4z1Fr!hVZd6OIq*E zdiN@`{c+opH)8TvV`Y@9n0>aIT(R?~AN}N&qeW%|u66kG+QYCt#r)FN^Utb*XNRl% z9}ncc%z7;=dGt$N=*+0UVJnDdFp0P8p8R^J@%bAW+^^MUa;drvai1s@LR9$RI$asu zdltG@b#Zgo1fubS~o2H_PIqs9wa4pq1L$g9C;6C15^rEPZ9ESlRGlJwQ; zwLtRJtsKqO;bM?NC$9)yxDT_ub2VFpf`21~7584G`R7_``+d@GaD0DrqTor-X;iYI zR2O)t{=UcTTha?s0m!94FqtB)Mhx8zOW!PZbm)l4fBvyW@YvS9i<(t4_s90}M;S7X z1F79UnbrNHp9+#%em(oTDIhei(qU?R-J2v2l^wG&x^(=HxMX|~K2Es~qhpaaPA1hP zNnbDPmSbBa9k=NqXIgDgQRl!e%OhT9Lz^JfoM2I?c7d8b2-Yg`kEe)ELiuVu_oS%)4luUse&&b1dNF=Qyj?gkoS?#inMtA zG(*$e#;q4ut!^>7XdLRuW-YE4xxxWXHfUn$rh(99?pq;tg2l?AfNj ze`EJh-e)8IY435gW)UY&mh&$RpHk)~5;f;@B$4}QrWp!uLM2&RaJXGskxUq(Db2zZ zlO4v4`?Q0e%UxZ}M+jp$iA**6Sftp3xdjaq^WdC;#Y)5^If_Hy%X&m@H3qK2SgTE% z0>32&g%gHfigXROx9;d)EAUKHI&j7JyP|f(61Uuw>^LvuE-+Php}r#ReBdv|&I*~b zZ=1EYNGmGz?6}WnRx*sb9m{I}uZ{R2xkx^xI2!HmE;{iR(Sk`2R3ENIqF9EaZQg+= z(0k<`z2bi<(h}b%gtfY}32wb(KAruT1d3qFdCT?W%by**d<&y+QXL)EDz$!pzvMG%F%aX%bWMd&1R%@Ljt^e$L-<;p&?eE8cPwj*Vwt zTzX9h3pl#G)e=-To!pQ_%aTEv&D*ZmIfV*FM8^MY&wLD=NJXwjk4HX4x^c|v4tO6f zpGBX9pj)@mB_%h5P1sirMRIPxqK*jM+pT{fC>z-Yjx!I@g%DqlTK@%oeLv|U-jC-` z2vST*Mp)!=k!bQOS&ybv?WM;!_IE(PB+FLA4)=HZxR4oT}Sc%2n(^K#a!e)V} zEJ1e@A*ztG?lS}TR&F%Np=mU05ZfI1g!2qD&9Sxm6XeE!LdQfAXKjwB^43la6&Jf1 z=dpj>QWj>uT6DItdF~*hKT=pf&$QY1$HA%#D4TuhC;%8`JKb%(b!dLZe@nU3o6VpWH z$;S_uPnHiZ_1Zr(6TDh^#TF*z6@OD%7O$(Pbq{CL+<#Qi6HEkD1sT`$ctI>&*WQyFRtA@t!#3L zNC>-B(%+-f6vPU}b~51XsX3ZIvcGPIpQQ8kRgu0j5VLNC7au0Jro5!Z@m}0q7GliM+rm9W$O2Jg#K$7XZ(<#T6D-u?Ri%JtUakr8T!bVL2R?X5}EA$3cdk{O8{J;9?S({3|dxG=U+ z-_D@66iZREF4o~`V4L3qO833c`&aIpolptbVQcHEyM&>g0nTFGr|X8k@L8+rIU5pz zusPUimExFAJ?JQzJ50-ey~l&0>h(SBsDbVH4SX6|9sk1mq}U$o<waxu2UO!j3ZP9QrUucvOM+ zUDjzRHGJ84UcWEm9F2-$Cjs-rs2@jv zT1bqlCP!8*bxI+9+uej9d8IYWpBH}`$CqZOiavHdZ&YQsxbN2VL}qAaHC}#o&2-M1&I^y5ozrG3Y8j8J@t~ud9R^>mvn?5lFbxuQWifi?PHX+r zSetv=P|UU6vl%~ghIX8U)Onq;wnoS_m{v&t$pR$#DAPE?VTtk$>0pAO#W7;nKZN42#R(&tnxrdHzx*gMAEWbzn$BP*Eo;+RgHX(8meBbGsuu^W|URd3q zPy?(0JkteEOqb`zfcHkA5*NLY5fW`ym>it(@fUc_{R3LoSL+r?%<23{IQT$9du>$9 z7!`d$m12^HNXWmkKcL5Fvp=q$&M8!X>V^8aeLSWdc7x4V9f&pf92(Ok0I3yw6NCz_ zNN0~RGDo6`g1ZLvaZ7bIn{*r@>whEDk7IeLl^f3oHgI3u*4T&7+lgE2qWvwGBB^t1 zFXnemryHYYjvPPgP)|1Gc+59p{}tRi2o*-;3(n`TFRi48l_cL74)3k6&-(R2YlAM; z0t0u@S-Lh;*xgEWZBz}ja-=yD_n0%ovcmcI&YLU03&=!kxoHH_&u z%=tG)a`Qr{z7f#eaS-}(w=FcT-siPG{Nx7Ln~9$bU!{4Sx~G#7g9O2-Yys~(w#IVd z9q$+G>ncLGq>~T@=h)93t^QTTQ+fxErS@m}b3>aFP^8=tSsQ0ZrS@aL0p*gj4g>os zT_7np{ySeW0IwqhT#<#Rw5!URV>~28j~{<$Gc0oE+mquzt;<&g!pev|)12x8)nq zG>gAa#(6)Pub2wi1UWApyvwp?fb9*ZR^DJUG_G@N-+l9B^jq4+esA5$i+>}f{%a(! z_-jSDqJo!cc@c%CMSToPX=I2<3r3w|1=g4oHw*#6fl_g^^gy@gw(Za+8RgNATx=M3 z=g44M_zj<%(7h4f%Dk<;5QPZ}J3|l-*$4^n-0gcDZZ-sYit?^yG5kbP& z8y1s0{v{omH*jC{m`-F3X4I|$Z7UygR?U5@Z@$H7ZB;pNRS`LaOqaKaJ;(=lOxU2*rWDlf;$XCubx5aAkmqWR-{;o$}3l9nUx)m}=dVet2Zrii_EMw@@a zcQVMJF)V<0hO^{u^_w|L^JGK+Nb2~L!r693bQJf5pX*%OO{-P--r`Tnp>r>DziFi- zgn@tuTU;bol&Vti3^z7)9##1Bf3zVW`3_xJsUT{|Bu3f?n)mPDlzYc#7v5W2|0Qgc zFf62Q`zNk7mE5S`-iW%r_xMCPtl)e>SrFDLYQS}zI?Z}Rx+4aW*3N}m+c=Ivkfyj% z&wJEbzr93sfE(H0p&ue2QAvY1`Up92B>3!Y`1MvL!*;1#liM)|hnp%z?kZ5aOtu+k z-B(4H0hm6;HZnCsG9L7-?63JQdOz z7P(fou;bks6vJ)x@G_e9L#=&o7HG}3BRQ3kBT4Dt)y|lLbE9y*L_Bf**w4+$ z{H=H6OZPvyorK=_EQB%~to*rZ=p+tEyUY{&5(jD1j>`#F(Wl`(`$yP^Nzc zYtjxUnKHrkKChtsk9D`_mWACxu%4fU8D)~XHM+Xz_gFboW7~wHa!jt3An4oMP>4!r z<|8ajax3z=FvO?CRh=7tk}~z}jr~#WD&*IZlxUfrOHXudancZ>))}4akGO6LH)!cu z_uocCQB19Ew2(FUvGDa(=+yoqD7@hDS+<*)%vrkSJIma(nW~8k((dUh+y!;op?|x^ zsd4|r0gwc&mC+Y*vNu1SCxcYLWW=lAin+!$oE^IEnmEky8x>^K`;81t^>kis?3RD_ zOsL1OBJ!j#u)MMfinRe^|E2>HK)nf;n~=RGDe)YY5d_GzKQs;VVP?LoQM6G20+Vzx z_go*h;Jhk{LziHT9_8qC%l91f_jbg9D9mU9U`@h#L>Qx33jl*L!k<|GmD)uS_Tf7) zH#}XEc2!>Q8FPDC05|s0UW9aNrFrZ4n?{dbXXgzFGD+)1yb|C~>U`uy8QO?wGQ3Y_ zBhidvNIfz8=Tn>h6UoBipPy8h`G;?92ngY%oDHpQyaTgos0JQPMVlSfyBMBGqcAi# zI1Z<{&O2HREvzk5wz1d*9MY&}tLIJDZ29cXe21ojMhI8^T*J3&xmWDXa_{9L3?mFL zvmBx!1*ElZGBpqmsyY~fzRnGxNU&J8e*M@>)P3D=<|%|O<&Z?1kjjFN3nqwVZZxXf z?whQcxrpjE2+uRVutxdmG;-cKKYJwRKXcJ9F6h)Ag_h+$Mi;y0sGS-aiO(yT-*Y9Q z8X_2LTcU3JK=d}zDq=+0Y@?7#cyoS+LrA=~T)-~Q%2;A?%rI}kP*(4Dwa-t(=^s!#%jz^L9ZCMlYih`DS*vQuCu^wNxwEadvFU4Wk+kY3 zS*w2vh;d3>f_ZK-2z@ciqw3mOGSCI(L;rBoPjdL22qIy~P|$xU^)i})3l=2uYP-38 zWjHi&WHVi}>pY}n|Dw)+ClA2*B_LIDISxhKe6548uc5Wj(bPwau?ZcSjXa0@BWk!7 zRQkEG@feWH<1A~>m}0bmNXF*|1R6yH)9G*JWvFbl(Gl}eR&T@zZ=Ra;t?o$j4dKW6`F+i=?;)NIv`GEL)Xn z)i^;^`$bo0H#793oZ?rV*GJ8-zBKeXOTU*_`a@bXiDna|&-KBe}6nb(jEUZAod9j2RaJyCQ#T5llQ!QUF*Mnzq}2Kd1(;AuBn?=@rABF%cIrS zUGkNIbRz62Jm_V!p0k4z0-IyTm_eVHSQ~E~E3eOZGhk#n^qxg@FT1&9Vt&vM>XPX# zMG-bm^X5tOR^ki4W``1nA!}9Gqf70^TxlQb$(!nqFV0v$Q0JySkJLn&oTQ{E4+!E6 z&Biy=XBuqp51;y{Xw(6b{w&=Xh}D;#0hGfX!{|0Iqg+u;-auzRqW2q9mK5NhM6clz zDIz$d8{a_0!ho2L=b%c%F-p1oypFGcTHR-Ngzx6hNS^C&CZU9JZGxI_7BC zdEW>gj5@a_EZW)}DDXugSMTEscKl#`Nw?mg?s*WjNUt?9JjBD<_47{N$}6cAfUmf> zbCRpiN=#V-)M2JTfa)ZQ=F-D6mVcNKxP6$M_(dtA!?h&Q5!}9?c5^l9b4N!Y|M}_U z^V$rH<+oI&vwn!-dc35-;>Kw%7xyO2fJ=Na|BY&i&p9=#o@0-Hh2ER7DWD2#%vI@U z_!v`kt(Tpa*y8PclaVEWjsCS=oq0brGF5(MW)A1TBh*lx%~;xz_4CHiQThcI;T}nU zc3#AtqArLl;b9*^W>>c*7Xkiv;e@BN|Abl~rcDCFJ3mi??V#n^Cxp7C2$d6jG4sf{ zzQALHb%qO1dz~@-8n^DE<4*A$z0q1XU&3AUSX{?$L*LNI>?F9mH7tc0WWl&Y{V&KA zfH2v8b)(P!{G_hT1Lg-QHCwIh@Grr$Hp9JoP_7e9FHk{OBcYVGZCO}q_4DmlwOzWB z@Svpeqa$q~WT7?q9K&MZi^6JCf?Ab1ez|sd^hFOBp;ZN5i?(?;WRpcp- zAUNIni8?gDrag}Ow8fLY-~3$p_P=D20HpFc_mCvOfpz?#t;(h% z9c#$>Lim%N8VA<}ieeF3#3{q!nRdv6H^5&+7y|s*)7iu-E&v6ad!H07>O=&DRZ+97l0j%lS9KJdYzos2kKed79 z;_;O;fcWkHm{^ewFaQY+fZ0gj`AmGQxRFuc6r#~GDhFVMYvG=qPxZcTeF2!s!g0X+ z4<1teiAz7X0_JYwnN1sj#eL2E;xQPzvjP+2huTD+Um^jak<$| z7>OUXTQV$7+^p{wozr5L{s%pYW4Jp_zAYdQ=+=OriVuIAN%{a5#S3}Q2v4GI4~q5j z%~p}>dt-otPE#9i=?|eKV!CQRKQd>8tcaQUN7OF~qIZFSxKtW66SFfyeZ{Law|qzc zQM?DBc$q8K`aC}8CwNY{;xiAb^OowLRkE;#m_yWt2}kwQiK^#@+kLD5p_`&B259gM zol@jm`>KgLN+h>X*Q*toOAX$m?=nbmdyOxO@ceScS36%D^^373)Bdq4n$`TqC7Hke zgpaJ&I&*8`#OMmY;m*7Ue|472(i$z>GWj9{` zvq(Je4ur2@5ezr}+^94h_@W=+*~yaD1kdX{dlVWAglt*-{JE2LvuO! zG8_D(BdPzTqqi_XHGcvy@C5we%e4bi1LH{i0i6KT&?@z*;~2R?AIW0($I13jI3O2=cJ;nIc!PGwM-)n{%F6muP*mVm zUHbvBQ+7jW==gtG`#)YX3K%Z5kcTC^67aQ4H(^-`4=v>WFU4Noi+5U5yg`mxSZw~| zwf~pL+Q^pKbOz5wne&JDO27=Zv)W5Q=a?8!*u^#uXU{Z#zH%CSb7PX+xBiqtM|aYq@jPY)GC9KeD=u7a7_Wc?Kupw|ID_FGdAhIm#Z>NEscw z+&c)v*huTu{ob3~9dl=wZ~nq0vNHO-mgeo#w|&XQ48EDUWP$g);(BwB(KGvRtw(6c zk*S-_f4Od5berS+jOgEFysXG;OcP1m$#X>RzePhU$gY|O{Tl9|;0|0?vz)4NZT<8} zncl$|Xn`nowcWE~YPX-PF73rKI&5W7*Z-8Ht<^KlHO19L`3u$5)PxNoAi{&` z@gPJql}lbsu#;L86URsM`K7Aj_{XckpYM-QSs~q`NhgFpUuYg_jNQyOJey->I)ZZP zea(CZ9RG)>X=&Qty6<6PfAWhh1G}u9w0&souAvoa7aUatAZK^kyyLnJ z?k~Bu5|g`3mN_rPC?qtsk6C6IPC7M{n%Ay<>+G->o^sJfk(#w&bL1mAXUfuMLjo29 zu92}{D|{A3fee3AQ#iR9r>({z#VqCLb5s_C5&PP7Vr$g{u zOAoGd^0hpJMA4W;Eq%F7I?L88VUjQ!Wwa%d2C^bz)v_Yecbfaame9U^-T`utN3`j! z*KRgcz@nJMDiit4M8LrbWz< z1PWx6lv>Js*Ku$#2~$@%-MH_$e&b@={@t`_o{o27(vr(_u@{bWW9r>QK%2v=LCB#pm@CH!C#rbYOX?6$<$3;rGNU@zKa> zd3392D>P=DR-%*d7O{uwxCwm(uj3WUI2otdTguXouGgbjJgHK{6;s74W)$uK?!^2`L~VDGk48 zj(k}ufp_Di)WWs4Ue!2?CW#02TCZi$WD@i+xAP^{t&A^wqSqs7*4E`$A{trU^>oS|@M6xrgzsA6Zed=Ai5lroNQFR@12 z^`PKQfhk`OUi^X$=g$d7x*8J-vB&!D_A7jT6#A+pOv%7U4K+V{&?iIAO}iI4%l_@(r=udq}~{Owost~3%icylp&9WNKS6Jvl*Lo5`0s@k~Mwd2#y?}N`36MBtNmSNbG zwq%{}*}tu%89QOgJXa%}=U{%{{2O+!V#DEnS(-%+8Xp9HR**3Lilp+QQkEj9NoXMN zi|S)<-~p>^tG-Z%sm|3pt44{;g|c>Vh5(C(0c{b$pW^0$tG8tdiL~@a-PcA-<0a}* zuYM?&(tyER0}L?g60^Ta%H%~B#WliK%k-?uWO{@0Ys3cU0ol@(r8MlkaMz$}1L3>XqY=L6A$Dd}Bc zhmYvlf)Wg;7wjGwLDaPqP{?_hbxV}o@9@d;k}lbSruomMF*WZLKFbI{K%ivAc@juI zYH6u3yMt@-<_D}8iK1~gH7~qH{}piZ7n7qCO_!IAV;8i9HgXbYj?FDvk>BJBiYfNl zO@$S(+5#%VC;^UX(?^(!cI%4^x1G?d7nLj#O^6?Al zW#C^ljP|s!_?26cmSroiioK#djiSBhj=(C6820LhC3|+JSt3~s9|=Pe83NzZWtlFp zU!}VmBXGDJjbbr;EC{(Swx+Q15Ob5CmRJ2DsUM++DN@GE!7I~DHazpzHQJ(=MGrf# zJ(2G}oVwGpZHUkc3`Rrqj;~C(*_9Bh%{gNB(=JeX?Pn7M!n7bE_YAR0i`BL{Q18^h zF8#+_(q$uDt9+S=$rH3Uy1K@V)`4YRciY;((mZ_$2gXu(*DVf(2OfD`nsTb6V_FbQ)ldzsk2V3 z?o9(<(wz*03Bfh_Qh8H-6Yz$=1Cr1MeRRijYk(OR^dYQ2XAs)2Wfpr&>bgW%@Ap(^ z(kRxCrc&}Lgo8UStozL$oh6J0p52l3V1ZnEu6B)Ch32gy z>wvavq>C7ngy)0!TQ0k55I(>DoO&Thlhac@RzdEMYBA|u)Z7^eIR&+2@%?sa9xO+T zyO|&l_r34^?qpq*CJ+5`kQKG)^Q@>uHu@S`oEn4mU6?-WnaFpOikd<>Q1=j=o54!} zLP;Z~YpMV2mb2{m%TG~MizCv}Xz%K!qhAuq2n3C!*3lGBb6+0AS-p^>JV!+lZ%f4^6BcUGMh=5g1*d=gqgM1XirW z0!Xv|G6~;=46)j;a>3*Rw80dJ4lY4rKhqsAQMR!1#Kd+DaNkukS{xZ10~I9lBaFyC zri&Di-UwNB_VvnZCVayb$Q8(leuJLJ_h#>~vAXMMs&qc5JS<0`i0l<3b>dM$S$q!(9OY|xao z<9c%WHk2E`s_At}VaPR2zOU4nl?DiQFx`GGR=$_BRB5fsqj^;jMw#>KN|Hc*q-yqn zuxSb>jN0pm`feUPheHqo<(Fh_c)7XGKzv_=5=blvwWpBl9Q`sXUx6sI?R1OeLjl$_ zO7_XsB2+fpvzFoxpO{a2k4y+vxGQY1^?4HAsE>k5f=VUtp7T4RVBORbwVKG(fROJG zluCt(6ybr)bP`@J)`_ESp3fY287URFB?HNguz8~Zya#W^#xe+RL{D4vs1pnq^2!~b zJxljyBb*bw$-SQCzy=ev*if(CJJppyP_*RUr1lncI=h#{k^3okp8yl3C!#YJcnGM5{&xe)o!()CwP`9`*1Ua=d5^N0Xz4tsUNYc}|g5Bx62t9Y@%Lh%K&y4BC z7s3g#^<&F{nH-Y}q9gErMSVZ1NwI_ewb9d)*VkF8tsV?l+r*=OI4#t79+fEtP@c{% zvel&VkkI$V#2UZLraf8`lLw*qfJ3xVHjGpLb3K=uITd4x9--Eum)e4wIM@sHZR+e%P5qnvBIcNaz%#t7&C}ot7G7rPUf}%RVY~PmW(M{m(ubg+9bDeAhG0$4wzFD!MBFT|%W~!Jk@~?0+ozlfQPq1x(8XoR%6&n| z({iByCU1<3su=F23oEwL(O`+RN88H!$SS=aA8WSKIu=e&MwH92GuszXvZu`qaaFEx zYyhvB2te%ZkRE+zgeh^2=ZOgMfM3`03z3vJ9ey9jSC|yWpu&D1^8W3~qvOc=5r6m7 zattRtP=0)RBN0JpvSWMdu{=;Q&pLY>nD~4^#{#3)isgGcokH|?WJCr4uHTs<(eTWr zF6l&sOApP>C*M3m5@lKcmU{J2__iP4Hji-Ni70)c6~26{un)2%liU+ zMSFof`WnxAS81nDKM9|ew(&*9Ju({50J>@-trce4dzj$?A7qs@iO{v{TN$rJ1(B zJ|-eOraj$G%#d)c%^lnKzn)vND2EI-%43MmewsxI)xT$QZ7ti%lKtedc76@) z0x{Ftev#};)TPQQ;KHX6YfCLwv|Z{nRXH8mE8%~Z5#J*W#QZhp8|*tqpT)sESCauf z^UyPf6G4&?a96uGXd+SY6^1#gr)l{1ExvK~n*i8(6%`d~EcvSB_XxFh$@Ocst`m2N5}Wj{b0AQ|4?lQL9roCV&k z$x=!ge_B5NsnSApKnXA~E?-%+rA( zLgkXHnl{ydE5{v>zE@+Yqv(f0Atwyy)y#`?6gdNds}sQ>Ac5{^m?m7{nUY`tHi5zk z?h;fQ=)#16+vesdTFW6VaL+|7kvuW-j3dgMk)D~UA^oK;F>`Q~Y2|PtLOyt9B-$5J z)rh5RH`ZTK2HOI!F1c=W1-Fy5IvXO45#mu47jB{sQ*FX2Hp={I))lC*IS8M-_$J|p z(VHHTuYMo)v80<1XWO_%3Oot>v;iyvPW+|^YG8VFD|8iTS}|gAdwF5Jh})e8&XKyo zA%Ic}{t|}7z(0pUh%yRd1sGJd6h`kvm5&?8qlg}wEpRj*xLoJba!!uSH2Jbqf$B1F zD8^fGJ>x<#`l6qnz*QcGtP&FvgnqDU< z?$|3LYG`-5S7F2E>v>T>!+!DD`?z-9-gdAE_G5^)a>$vy#}n@L*U@P&@PD{&9op9Z zxf0v;gLg0+6S!&ejk?sj&rxBAEfn%llF1=)lluNUCMYs$*y3XfG2 z5uBm#f|auvu>ekze~)5$_Mt<6d9vtGT)*npLRQJ=WuH*8?Co`xn+yx!O9Qea$ z0R55I-nOJG*$%18J?Nu2HL9~1`{NfEN^8P$9H zE*i^^-q^YEYkA6igF0s}m%YsRoCIj80~6ba&W3o>I@`qyIo0b)vWygzQ!tWN-CuM| zfmJwnVocGyA>o?yZB!SF#^jsZoBKxU5|EtMpR`q3Ku35Q5%D=u~A)+>%9T#`Fk7Ntv<=_ft+*g?sCgjX;EsX0_F z59JwdlM$w83ZHH{=er;_?AT0844WSydsHEZC&&n3=4BN&3mpVj9@nK$Qa%1QBp95D z0j1bKz(DgvaTBC2ZE^GaFGbGND5tf3Oix<{C9H>1|L`1W=$QOqD&m-6$&oZ*T%4eT z6b!-uXOq_qxp{|@W{y8Mf(^!H4faLPH^b*k8Zx!iFW*80qO>``qo*+920cNACBd$- z)KNolFi@X1xQvTJih5LhPOmWUKew3dby$s0w?YmAN4NMfw&UkJmAEjoM#-AP!&c+_ zgZsb8Bk6Z-{dRZyTVD%jR2i&7?-95f5#*xiYxbu%(+wE?mp?1KZ}4%NgoM4@xL;-v zPN-~|h5xlDBZ5Qnv^a*MHsW|?X-;A!193^8jMvxupQ2h_nMHFv)|iYLo!2o3X-15& z)+Ik47Ou1)jE&O-vzlb%;pFEY4!?ccf~aTqo`-41Tn%17UYQsCk<&Nl-EIoAM488K zW(;lZBn~+cM#*#drl=H86Jg-p^ly6=sq*X64#vuCS@M8+$J`pvj#~Iy$-&|^9=w_r*bj%YKYq66!p356)%H1cu8`?On zufO$opGV>6DV7@(awEEc8~S$LGsk`f6gcz-)|#yI1@{#=uzC6ngKaM1E-ZdXO}v;F z>B>CXGk#|o%RjBBWe^bU%Al9=xbgm~YHRYV(om=IXO>^MWBhtvG=FiE9JH0_L#T|0 z{m_~DX+8{WuAR1H^;5&IR+i;@W}NyYFvEn^E+_E6n;H?7vp6gTvZcQc?SN zX7NQSx#t$F;}y1$?Nzg#4Y0~74Douz4Lv)bR*Y-Ks5yWZ7DXZbW1odh2`jhxqj^k= z#Y|bIu|V@#@~MYDmq1ioZU)cvmKW-#Rl_+}BbR>WXk%b7?h7BYGM?fB`X3VI<_}jtz2!o?cqzV;h|{)|P(?I2>S82VQgJ zFV%Z?e24go0_%RL9*2~qy-&Iyo9V;yFtxRZ#nnec{WdS|L=^=^>s z`|>Yn5P{tH_j-8~w@nF6e$?%?Li>5`fs&p<>+SKjx5}7xTtg1vP>a;l$r2^N>yrJ$ zc2jx|Cw=oH@%4kA8kDRv_=`*N4ph9P@+aSij5U?%^EOl6ipaAt@RaAGmOX}~RR^um zAV1k*GS>N+tk|e91@Qq|nB3(FTjlzwWNs-jQ>M*J*V@(X5J9|n$spN4d3rSfZ8k6N z@?s?<_`dB;jwAE0sHtO!-ZCh?eQJzyHaPvk!g`|{Y#7a*#u1@|WgR`^gShmVAX(}k z`!ea%SpPZ`gyiy(#aDhz&yEr(R68!kd7V{>n)RQW?iP>G#9B&jyc7F5Dd76Xxu0o- zmbfN?q~j+z_exahpxiour>sQZ2kZkCg)xuw~7XYZPQ}4c$4|sHNqUb`*!aYd*vPuc+v@ROiIK}-ihVcFHp^B&ZTYl-2~CNK0==s#{nwEGlT zWidgcspdV-tzCw5SzjM1QjSwv`zC?}xFy_cct#{PKCIeeEz+-Z1j&f-%ynt2iZ~29 zoNPh7^6>DCj+UMI1^PzE1vV+iD~})0ic4kY!=>xJ{LU)LfzWe9flwY^g_gV9r~G%- z+8wQ~iw5{PkxuhB@~f`Sd(7qO7{3sEc55UOW_CWBar9c|UhSl7BCeRe;>4la5Whi+ zQE+ADv3sK*85nW&@T-hndN#;AfBCUICh?|JX?64RB!sh&C!f*z+EC5r=2&{p2K}-f z>?}sDkie*~^j(~7G7Avc#1br})sqCcRp~#VmkxL#eRo;N^A-`eS1>M$$%QaBVTC+L z=Q?-YyD+|6)|LxMCV~mA5GZ%>rKr0}% zr>q5W{;?8gQ{$otCg*-^*oWS#{DHW{AhJY7?u~HN9G!g004hu8PTuz$tkc$ECcymd zd^Hgqj#Qsl?`tPk0={iZIQ!jOj!;Ki|*O~0-c>D4}# zaNnf@-!QUcUK#v;E?(Vx-ygiaQ~j$IBrFN7+uf@T7s;ruskA???d7I1^s+2n^CqX_ z@x@J>?iV@^G1bm03y+Lb`lD<~8TWrnwC|j6OG)H-{03FUVP{2C9rqPVzD!oFlzAFg zH~2KxUfmlgBELsKIzX_*v)NE>%p|zoh2{lEgtZe=Wc0J9t}3&_f;JXbd%sG-9`4N1 zSlwyT^4lPEdIPxPphkk}W;E&rB~8?k^ZFQePkXce>&7cAtg_ML_qwa-)@}^#Nckel zzqV2h*7x2;$_0evyXZ=>!TyTwj<%GV#?}mH#2_LKglJ>)rJxb?!uf|h?H7j8{#7n4 zyh^r!)eny{*0*OC-KDmt=UQxeIP$yFjqIi>i)V5~yJBUvUl>1A7v&+^Ib?wo>n5=h z>E#x^{d+9)Hr`HX}U;k@I5-ZBHkGwoBNME+%Y{ zUY00Uj?7uqlF0cv`woqSOzz1d>&q?!#gJY;s55jryu}ph`$EYaOm|bem9nK-pgK{))acmU7WsWujb4q*(7{Fnp?~)N5tZ;iOFj z*IUhO)%p``NU&QH0#r6u1m(RS6ozj|pWQ>vjVY*mAUP~#Ok!7V^t#74yx(sLY&^{|V@OlBa z-gEUpdj_F+{kzGO^m1F@dpxS$qR`Cn!fQN6uPUag*J)MAWRm*nzU zMJ?)w;`(T1{Y0a)%ZiS5Z-;jVk}3Mh^~5qA7)!z{zlm}O?C9yrO3f(8`r#kFTZeqY zE4~tjv@7O^T<0dFs^{B9KDf#+by)F+;RV%;=b0^5losJ8m=BHj4T*K`q!c5DN8W=3 z70S++85UQC@25bB?q9h(5=vn6wHus6uv7(rWk~=m4@q~SzE$)<`2w%IAp10%alNo! zD~jW{8<`ACM8_|Bovd9pyuLlr`0#*3eoz~>yTaYbH3Q==55l!o0F=MrV3PllK}DWw z`J#RMh41#Z?GyN5tZpJ`;(Ib;socCJ1$*|ZQLItORQ8rrVo_fjDbAQfD*Q_lFC^7+ zUKs>%QUbRlUx1zoPYfI?0wDr_e8|ZVs2$eX)fzu>+lN=H-z;^1Ay=X~l$_;meP@wK zwx!5*F4ZIJzjJR60IYC;UnfDKJy7|Mw`f=+$0wlu42*3B@R55pe$Of#azP{z`a-As zlF`$PgN#ACACa*uIySk%<4{3#(uZiN*=EU~5hr8z^=Qg&@JR}2j#SheQ5kdZ+UxgL ziC+f~-=kiLJWkr?25mlVR=hB8L`g~0r$EIXkB}#%GZ;zC!q0Mn69bA^+W#`MbaN} ze4pZPz5w20%*FLVD+*BXF!gM{yWsPQ^$4js{&E)I;by2D8-H?K!HtIfvZRW}cYCnU z2`4Qg0P?v6^C*}J-LzjLcd`XmgT)8c2w9xtTsu~61EpqPya9*9Zp zVIY^lBNsdl>}dNaBJ2F2?sWo-T!AKBoztnmc9N@*W$7VdHqfOCyhGg$?g|N8(Ffy7 zmm+>?`@Ud6O9##V)uoq{$(dF~-9&na?()9VF6tXjoLIAN=w$a`u65i0DekSqqI$c3 zVN@C^Nl6i?jB$e1azdk8M;I16lv*qkA9!${LcBk&pGFM z|9QE%CicGfx_hn9TI*hG;BZO)FfU0HD3qw=xIQ&lCe#HmDP|#n9_q}egZiJBlt+!5 ze>g7vCZlfwMJY~lDy{8m-u^~V9r*2$?_B9o7rc}qm8QpMjK$nV&6c<7D@V-00l%&s zqGdp$B5WxIgAZ`HSV1?WWSmtJUs&Cd`$q&3+vZB*tDWreyZ~ngi)?c`CI+hceHz#a za>lY)Q?iG>${o~!F_w82vQ0*v2&%@)h#y&tRna8pq}Z>g$1SUsq?coAr)sQ)_{3hsgCO>^CE^3wtsnq(bt^ohQc2FBzQlLb|KqJguE~VOz(6g z^XN0vbar}qD&_5EqCSw+g@P!L@mRH?I>VDQ$k^Co6Uec%0j(S&+2vmAG~foay(yfj zUj-Kl=vQGUkXWkH8I7|{HA4-&Q$1+L+^Pel6J;zND?aRkr_L-ZvBP*7naJ=fY}-yL z&;l>Ke)s~%*iJs`;zZpiL4AVCTAMmg(1vHrx0~$`*G;C5gYKXe^D};E{g5c}km|}b zeT8b&Pg+rJFzrc6S~k;n-wOgDT6-vI4+d8}ea04-nP7*$+lE@fmB4{kRPq?aekb~`>xE%(@+B8enrgVs%!@7`IBI~o}oEyh^iVbH$$ z6DvM!lJ6Qf( zFaZV0ri|fJyl`b&^NcXCdCSPRQeBD-mggtRNbHN_))+JZhn~m=;_-NL9Gk(w}`GH##A4cne@aMF9Si|Z}tkGj&xr9id1kj zVj4!S?Dk<~WI#!g);#!iA-?!Kyab`yZZTBu?PnUD^ii6HxJQq1-xYwlBR)}mPFV=eq75+tS$#$+~9wf=)x%j4=_n0+i*nXtitLN*;PN#+^C?6Lo=1HUS*;?4X$3@Y`(RIY*rKC|}s=CPt@rSmc9(e7?tZdtGd z1y+d)$v17s!`3zr41%zBBH{U~Azi(r&sH#F)*CZ(;@GDSg7s))e`Dr8O1h4IxDtMpYQcg?Tr?p(a13my38mef!Q`!)y?b^VK3SpTCHT z8O1D!u`vTAbG@VGWvWy%G1~5t9^sfh8`;@z=xnYeE?rc~q8xVo3OFiS>2e?QJ3-)% zKt~trX}uO)8f2wBDJq-J=E|Msu^2OR;dZ95qwfr)-yc38LHMJxo527R>g(`P+mn12 z^>XZD@(<2m;52|jOJ9V`@8+?d1WxYWLY_}tj-?U(RxAo^f!FY8f8cx@Vg<-;1p2c7 z86jqw!DFil_dio7mD^BU5j36{2IrHJ<$l(sW*9wOnAvvnX7*S(5THO`e{f_2$P zkrzkKJYRXXQgULT3|tBHj8yrvu2s~y4A_+F_w+BREs5r|83nB>fu ze~0>^J|?j^A-in#SK23USB!r@Jj6DOl87KJ&+G9rTZ{IKTA~d(MXK`6spV4mqP0{W z`P1G&QZEh_Ejw7TYL3s59Vev7ho6LceNCzs{ zcD?%vl?vb?a0!t8)D9UHrrvz@o&`A1U`R#j%S|N<2(c_%n0Y5wmb|c;`Lpt~h5a|t zXSuu%QWhbUK%yk`+R*M^?Kj!CEwnkKqw|2ibQOYLl;dJlc4HslcOMHKrM{mcV2vuR;|80F)p!BaX~#4;$@XPI)2{dT;c7!P6kUF@urU7LQRJb7RliwJB5K=5O276% z4Q?!w>1@bev$WIimJ4R<@6=B^(XTR;^L>niO!> zghr3Y`x7OGCVRQSap@h6%$hFbO^R}`c1V{E3B7(Om8-m?_>j)s*nOW{E^Qmk=;`Ar zwkjTQoFtX+sFs20AY9Tu|FbMoJH&QN;u{?APXgJ`eLi3EOF_r6=(-wUZ%}rd>;$N( zX`w6)tKjj0eSQ(Y z!zqw|=tj>Z@(WXe1)VDP^{4=bq=KF58&auFDkZgtn=5(|x`ib7ADcZL%X1?bcA0(j=0HsiSH`r`hzMJNyIL>U*YD`P>P`j^;|Q<{aDGKFcd zKGZT8CVrPs#ti!)fkt>Dy<-|x!K-)}euZdJN|cGV2yKUGs6@u^Cem0sqO&Zj<8oGY z_gHK1MqmqSZz~#VFZC-Gx;^aKxEddW1_K*4tvuDu19@)wpn%0R6~vH#oPI(x=Jma_ zAcp0OhLgUVM}XzFS@x)G(ad)BkY8c}Io|w{<{qljcCWiy(adV&)=N~4EGHOK&+weq z7LE|nT)gfBT$S*;($ce(9cdelOQB&EoJ9pg8vxJ*Zm?`X%qlqbwtIEb<1-&o3uRjL zCo-=iYU9f`pv`ZDLKr6_dfUq)=mfw8%#XIvdN6GD&w02p@?C8Q8(8iT-XQ-^{6MV@ zomVF_d7NNvG8sdgJY1b!;}0~s!f@SRkA>QIYaf|rmaur18Ib)sxy$4>sTGNKPQmtY zA*K7Hf4c8Xcx4qnThU8>90pYEA5TX5$R^i5>n$W`?pMT;^mL{ZP<04Bs#aA2gt%!} zKt&!&l@{GN%#e|qr#rIw_eo)*JoGE-!fXXi>wHJ+}+CS$sEnTK%+MIn5r1#bR|MYaYw zOQDSwHF{*jl`r;aXwtNYGMbd*AaM!+Q_LPy3lFJtj~S+l`_H3i&=#?x!$LGx7AYSLKKunIjpAcLvDt4mdQzmzsBdyp&oFB^eY9K@e6!CMcSwA*a-u zSNV-XoGC2*bVR7tP0*fHLe>pa8I(>)<&PI~l1RfGnjBUMSV%u>CEbiA0H_SJHkh}JQ?DA`I)G+44rcaO z732XYv5_7)7QrPO_1rmpJ$e37Q~IU%VetHvv?aTtBp~*$9u9q>(O?0yVFkRs*GPjt zGF8MNiDW`X=@Jln>fn3${oCCuhs! z>|ye>KV#tr;$F5YhVAl2%t50*$i3@@MVW^V-fZt=v}px(r}emIrE#IylcHUKX0CX4dp!VitqM z=)0=)4NS?ad2HIha$N&;VOJ;q=wt4?|GoZ<6KsPb)V3usCy__V^8U#8bOP>CCO9;9 zpUW2RnX4s&*f)p$yt-qzi`>jDFE6h+N%>Mr^UYP8&Nugg%{Urw; zfk#zaWQS@mPzOG^#s?N#|3sE5Hvr4(A_4h3s+XHUdO+X%#57IB$MrG6p&$dxS**WY zER7L5JF0RS^HU~8aeDdirR`d;jH7)>s6^y(@veC^5DHT7q}zJ4)`s6xkHdPof4rQ% zVfU=o`u23*@%)ZW=|!PwviB5dsAJe#XcA=*ADx+Bh8&7gz#DM=+bN3^!atpP(rBZ` zy=5xd0~Lx5iHOX}sX(sDcIIfMRTg`c`FaRz=tPG`fo$F6fh%xqYy#zv%$m%0m}{>4T^`yD z`-lV}BpVSZAvE){1x9fAQQ5jA8hW9hhMEU7c< z`LqF5nf>JGc6i$Z(@;mx^|y;^8c4#yGzkC$V?4HxDd3wyni^wXRE$X;*Z#UFspF{! zhFcQ4TH)0vd~q%>7iDcyrST7#t#giI(!=ysO{SJ(_w2qjp1YqGKK*UmV@U&;<#nz# zvuqMcQ=OH{uc}Q9;5VpU>f|rf_hVGZJ}kwNA45Qt5QJNBHdWD0sQv#>cKz3#(Jik;ihw#V~F2jW?n*~JT{ zc3W+h#No1l`B$;oxmBbrd+NOcW9)eOAQvRq^=Gu^hf+-P5Z3!_837Ez#rsq#JYt_zSvZg~Rne!@d*^Uuk^}vG^)G$)wMH`Rz{Kbw6J&GPoF0!BG3@ zW|rC_VjlmCn}EUekd|Dn+z4c!L7BMjk=icqlss*lxyD+Y5TSO!EO2Xp6x1f}3Im=I?eI<`g;Iq2r}}*|kDO>hZ>JzX;rqwdSMsv9Kz{zR+H2YhW4jD{WC6!8t-Y7xEkgI_=V6*~Tfa zcThK3vSTz7_dGXGAu;NZG)(3&HYj7;*CPP(Qg>uCe=Z^Oi}Cdut-It6eEf9G)&HW- z0-uf4o$WA%?kSsPcmBl=5FuN5BXBsUr07E7HjfGvd-3Gb74T7C4G_d7y8>sLpd9(| z_%rj}ddDs?MjHKy@w?NqJ0pjMnpu;Guv&--^7z~JhcNkpC-WQpcNfkRKxQHZKSE~V zQ3jFMDJ{f=j|u#_JmjPey0#3fbWDK2=6$)sz3WSthR*HWaq$ff8EFG3$EflmVVtf+ zvPx9M9WCt*=oE+u9-}E_7Pie089&9BEpssk00@+e|O$(lZUI%fCxZYVwbC8T3U#vcegfA~1A=6F{Dp*9E6)|2)G zn^5p-c}W+FcjmYK8OD8^#F_*?Ad70;yAiVg`40K{=Xu3rY2oW@L~@Wj;EtUXE6|9R zlP;XRbRD1QyN#DFL_p3G4yL=9|BzyP8AVV+N%L*mB;-%bb2AY0?Djk&;h!%+jI+xl z!c!nf9oa4>)u(?#p@DgN)TQwE267SrYx%#v{4IqHf-e1A>QB@)a*Ut;o9KV7;a{aD z$OwUI0PHLf{_l4Do9KV3;a~0e-`DWpnw{T_4CqF7j+hZykuhC@SOu`qjO!>`;5TErV4+_@-wlBnnUz{o@vH=jAluo3aEdmz+qL+bq8z2fT z5I_{ib}k%gBovz957U5xOvT*iAY*ww0??AAH{o{tg8zLrcuoJ+R$uC>_y1SKPF zRcAn$vw2n18IV0HA4t6Dh)f(0k4DS}AVkj-?~T2~pwV+ehM7im;0afVVDtdPbAPKl z+wZ6T?E*kpvFS-_*%*y+0W&4P6DtzAG|Rb-BqL*3dGvtMY{lhYP`B#@Qra7iKVBiK zrJtrTCqFBCK#q*>JrbSA6Tkj-v^i0xb%OyUDp{E@a3d++D$a0XSspJZ+KBLfn@!!h zgVfH8)pCr1z(;-Qi4@t5i0^1yAKRGnC{L(1=cK-OTqz_lkT7O@n_p050drOq2RBEh zLfVC!<%FTNo5&DoVb>8F<(a%tnjP^}Y1(RJ)W4QYJc(i>A;i6K(9)W&>i&7h<&~fOWINle@8l zv|Dbf$v|o017@(9?%l)Ho@v=~$(d9sx~DsUKVC-4T7H-Qs~`{)zEd0OPIVGO=(05a zfVxZws21>q6+SL_ZX-MQBQk(fNM^5H8@$mba7)DkCRo>f_q!|MZ8%_MHYf<0K9Ck55_NA0!1OWHe)t_JL~*AiL5E&#w(^ z0;-3kvgLNeIs`=0v%~7b_lUQ}MnP=A({?aPwNx*iB2nhTL+L7>p7A|fQVkOTPMpyB z=OEyU;dbv*InL-p+TMmE=PFskl3li#Q%mBp))F^<5W;&%OoxD&>kiuma730oH7b#n zmaT98xY2XTeea&SHu+E;W9WUdsQdyBR4L+7U_qdTX^h~HUBAs~jP>~rKPyzf4yvGB zAwBtk9n4N&@Mp6llR^B?Z0Y}!X*`S)(7Bq?E=iqC^EALw7F^b2TQ#JcuYbCAHh zV`)tcJ6Lil5Hr;l_6Pc*A&>e5sd_dmEILm0@IfE!H*`?TP`jILiQ>-2Qdk_rkGi++ zCEYPu559P~g_(3WlI?E7;-Zox)-(?)(>MvKDJuYIC1p7lCKz)Q`N0o1p>c)GI@QqV^wJ(>lXRJFK~HJPcZ^XAz%Jk62gMF> zC13z6k=dH~hf6$dl^&&wkM)%M6_@c?$ZqWP2pW{52N6IslE{GC5MQt5s%4r;&uN() zdB2Y_maQ*ug%lMikXK!Mo2S$gh0HL}Cbg%IwrLfa4e>C4uz$TTyGa0uZXgi?=6cYW zq1zLqC{mxSTYJ`HXE{%_ELG+KAyB_=vT0tvMT`)^x~wz#-OJJ# z&>$Izav=|Z`*h4e;xvJDgGCAQT+*Wr85rUxRNP)5`5_(lpp%D4HxI8AX`33oTi1v< zk%CMia2)M(Tscy|bQ<%4N(}|&KzfegsawQs_yJHL@WW;^VNs^AX-G$n9vn*JYolTk z_HyMhWG{*6NP%4J8Ld%a#~{ha2&q-LoC)Tut(QO`=F#^O zMrsQa+2*h4n{o)~hWHvic+^5A_u11dOIVoHmWbK*hf*7=0YTs>fynWe)MuV1_cazF zXYzL|Z``{_`o=S^3Iy=An1Sh{Z-wZbj+y&nifrX6JoqRp`VCXB;PlD;P9`={MM4}P zr142m33SP!lPl+UINa4AGwy7fEGWEoj`mmPu`dpg9Mivng0ft>7ajq`3I=}?*ZcffS>@i|Hk=4=B>Z?K^AqzPDk{~zdwv(qKLmY>OP0Ai2K|OJ1vih&d?V7_d=Rf*+|-FL-grK^ zxR0`i^90;WLZFHw(Tsv}asMsk-VapZBJ%T}%gE0kIe^RmF49Zlik4+H);_CGUe+w! z=uE0A9`IUkn``pexv`xC8wDGYvaLjRq;&u7xYc#}xZ#ObFPQ`^*Xrx_d2o#c3wT;w zEW(5sg*cnzizs)p$s?3ZzGZ3`w+w%>Beaj8tw%f{9rn!IAA!wOeEUmne+fR%m^wrf z+?bqHnok7%Er=KB&2zn)w7DKK{+#~m7`TtOIq+Egch#%<>thb~H8NBb>J7J>fYf=f zi)j<1b`DH{yih;eqW&i*!Imc|Od=+FH4jj-%-XNhSg}youy5f5gSGx1-yErC6jwAOwWTqM{S!2lk=ZvFzezUhdy@k%*1N9F zQF6zlybl$UQSZB=)hRT(Z{`HtW;tkMqU3J9G3&!aA#S@p$N#{c-$se-MJd)wk??sV z&pQ)r6zzX%%Ud=7Gh!RRlpcr&tiyqyr9qLfW_AvX=tYYSNY)pZZ$#*5@fM<`tk9~aZR4AGS^;^0mY6;aUa?n3os(<}` z#td0zr(x^BdgCW=E#oBzo82W$N59#@J5X&3fwl%+*%E(6^o0X&n$<_>B$b!vdOoU+ zc+x5h_*JRbH#G`rukWqVrBR%o?fr_L?jCU}^-Q@nKJn_1z)Pfjs9SQ;y`CV25XUcA zRNrU0sl47AV&vWya$O^jO-W zcf0}=gxV#kd@o4^wO~a%BQskq90rzB8MzS^OOZ6V4Y95Zc&?LJ?&3)fS?Dr4EQRjQ zxI7H>Q$zXG>Lj4b`nTQG#LcF+4{9Gk%|GjXW5oGbJ}#@|p@%N7BlSsdV8MH##f3fa zPP>%+?$54c_zp97jcDDE$He9itbdT5-Eoo%|EC*b6F+n9B zZuiglO<6J%M+}#QF=79GxxW@63Hu0Ii^%^7l7KO-VSfbj^ZvOY2}6PZy@)LO5rho~ z%Kod=|CvI$;=p8+bIU?Ld+MD;fzO}&&5wp*PFdxJuMZ3_cibEO!z^53oSn@ zX1(e!ql|I7>%E6Aj(^&pQZyl2WDmkk-1g(KDg$7`Q_9Y#LN^d!M_?1sD+3%Q9&&O0 z$urfiyv%dKZ?xb?cx7a}y&wOpi=&D9;$P*K3GF3Tc+6Li`wM>?_~rx-4S}+qPt$Kf zCAIz0RfE)%R_JBul>yybyhdx9N(_kl6rQFSFb9@)5H>l_FZ z78~k`We7}u(1T}jf0?D{5A2EP6 zIXSeZxI)L**iupfDYIDZP$&@h&9Z_$6m_P~O@wr5p7b~D&hL$Ei<-L~FOAd&Dlxx) zBR3HG<7Yu=%_q%D(c1E^yJ2tLC`njujjQF+iZCWKe2g_YkFTPQCYq&uG397@sIX+M z-^)q!g2-!&XUu^q^2~oG)4y`IMg(r)@!Fc%gjKk!b3d~0!5TJ{2|RT>LHnsKS_FP{ zzaZfKk(8tEL7n~Y#>l${Ql+?>GB&to%nYJT{{?;akD446@nFk=qX!4IUp=pBkZaQp z0wd;hv1WM=ZayaBAUkZl4Dl%@tR>r{=0u-C#U)hL$JFL~ z7kb1qbsyJtVTa3E2NXu$?^1MNbwRkM-?T*3SEudHg?gwy$YKLF$p$MrFS_JCd;EwC zNW}HLb*iK~P|LN5im;z#J(3V1od((FKDO#vxkvl2_A^ZhR?FtZgIYv5e!5@$swoOI zhPjL4yfkcZDCmB~y4-g-t(*GT09-j7#pSRc<=K}Mh+iiRUEI#rD!=$q8sqE zQ<|uK)(c^~InK#r4HIVMv#YrJvUj|Kmld94)w3st)4_2(kWl_xl#HE9j^PPdT?Ss$ zW_IQ52d%v9S($&p(`(Odn%<=9AA);5(^NnqJt|R+J5#*IG6^2td2)CiW4Rv>N*Y=y zkCg?U?$zN>0A(yzzgFl=l6|8b(r=_zz{3pJ%njqB+^FA5+~W5CeSw#C@O36$j1o6O zF863nF$r4@8y?g@kOVX1R-390pNCpO9}WeTIQ@-ednCd4oWZ%PxykUO}Y`+hX z$uh{cpZK>0LU_&jW?xdYYDVj5&x5zo>|V04 zy`_lX+&uK`4!fRalv{;s{mW82DaW&eUvt)-svy<$%&usYNg#jc3>kSF7CP|d($9JA zz%Jt|M1KNkzG7gxr7V-{nv3{v1F9k0OQ^elp59Z{R;k&bsGPFbcl6SV2*u}3B z<3V=;{`JNMHL8ixnqTB#Q4?-RX_5rOEuIn85mMuDDi0uK7K72zsQ2x1>NCoHUP!h~ z7G{PYW&GN@Oy=NwU{x^T*r&5&T>x;{Y=|wTN8S*lrsJfu-6?=@YQJUUmj0$rSVerg zjZMa!Q%wxByQwT~_X znBrr#C-h-;0ZrlqzVG(jGd?+lIT_Xu8kpfV6-50+IUKhR>;sHfX{QFe4NT|PguGPG zq5urDs14J;mH4g)d-GObfQhvt;Sq+FB8*4z72T$=4DjssuL=2jw(Y}BtGdZP>op8` z5G(=Ia)S7kMc=ZTGoqYKmZkSiGv|jhxte3S!^N8Q+zs#QbJ4Q>tmE$ipf&7os<7*^ zmI>C+DNK}~>RwV3Q3k3S?Qma9RMwp*LS~g4Obi^>!D};3*~XY!HuX{5Cjb(GQVt{) z4-WJt6))e|M969F1n4U-sq7e}m$V)!U7Ev>9&JoBlsL)8rrdTieLn$Q02Ihs2eu)z zapQY1HR*gOgHy-hz3*j+5r=qK*-;JAKvD{)F#kZx(A!xDZD2n?`RG{lk`6q=>uM={ zx!#v#1srgI)3$Qe-e+hg1D!tZe=_tAV&o9Q`ei7Hs0rEO=U>|dU z?GBnnul5oCS10p?SM`;IMz|+4PLMK<`9_3%l4bDvyFlli)7#Cc<36$nd;n)RfmMk1 zTo8UiXgh6*Qh00B+o(UQYmPU4WS1}1cLMUEpjf^k(e$>v6lqNzL??p zNVW&yynhhgA1nu4`Ewchf&_F(SO=9n{b22kFWyoYNbVxD{Ofg9#!j=W(Gvd&ygKmr z&hL2uc1A#7pMDFJAb)Mt^6Tng5pq6z^u3G!gK&VW(pT4+${*w7NCXLeb^69k{r91> z6K+R8@XIRRSDKMkhC5v??&wV+t2HgCo9@L**;=UurB^ zT^7qu3o)@(o5TA=V&b+00Dsj$8`d4V*uz~L=-as)2tX1b(W4-KZWus)>wbp&V;3J^ z8fZ#?e^R|j{r-f9>ic@0sj2*w=G)ib9=tx{t@ke#GQNy8f%vv4n#|Mr+-9;m`r9E& zpt{2D1{87vH6-;Sv z)+4DYU<V$sT>ua zK58pB@p&&B2C0K$@DB~l)mcWmeg^<@%8MsShGJfcgv|)E^{TwheLuh0n?WrvSZ}kg zSXmCyrWRY0ZffILf=Kx8S=Cha`Cu#cMMrJAo|8uKKyM|g+zoV(=!1~asfY`oY z&l@@(h|nN(Eke=8=q=uED2Lb*CrKzyPkDKbYDvHh5@p>6!jbnWnw@m{A{MjOcWQoo ziK7=h9YOreC435IgCdUl*a}NDU7v@~FEoB}ul&gZo{LUkRhW+aZ1oh78`Z8wcs*}* zw1nBf@jQkD6*V4+TMER1UNV}wS28GwsfDklDLnhW>tw$45|IB9+(ag7&`&BZWjQV2 zH~fnEdL&l%#)^glMC%0ICZ}p7u8gyu&8H#v zHwv7^Tt9c;^xJi-FfgoWxKF_J(+GAz#Wf(cnfA6b)S3b#*$zP7ZrVwB^6O@Q^K^2V z0ZkY{P5sWbNW*OLvpOzZlXrhP-Z2&_rPP;Qi<&zD?M_<-hEyi&3%GzSj+DU}MShQY z7PIDDN*=iu8DX6^IZ4O?v`d}gnv~P7O?G`rp5l`=FM+y(E|Wov)@6(LkB1Xk3}6oD zT0^M-1tb=$v)`|gO|2`GEu!oo(Zh}c%tF1A9biS+$?b2CZ-*izLfDKS%;|e4^EsAD zJw+RyP%YIkQq4B=H@5it%^dy)6>UzR`G`Y&ES;{l*Ol-TYhTV0h(K)aTQC7m|0s zQn0El;qmM3eVH0dGk)NkR}RdEi5g;ViC9IR{?j;lK8rD$vds3$CZ1~Bbz+E>bCAVJ z(>kFmnoM7kA_m58rtlDx?UaFFUeA%Mlz+S)thT^*!Rv7P*KA40$i7IqZ%R2@&Nfkf zY=(~A)#dr3I2)U2%Su0&{?eAF zF;Fj2^h@)y7MtI+{XR9FnQu~ejwe;CR^5}R?53!i!4+cVE&tJiNyx*KW zZxZfVW<9?%Xt26Yl~e(AoLb0*#)dZ|JJij!C??#pBag)JbA45yO72od3!k4VJbyEh z+kC%@hRws6)kK>Dvu03(VQUvRn89i}@av{2bIU}ZLBK^*(RB9%?%SJwax-d%HSCB) z5C=bW!Y50+XU%T+pv3y_t~Aih(d1FlW^%wLOw*}!Iq#)~{W*@fpO)>%uA?q=LsmEC zm_7eX{-3n7oAdTJSErc=1KwpwA(9>sf_lT_e>3UD?EAHJIV2`YO3yHTl8u;fA>>oC zd{=}Q{~;!Yez$S&&C%o<0x)i}^^)i`LL4d1LKo_*hGRVp5bry?HIw)l_OqAL|?Q$(F5=}OX=O*F>a7Q_?6?egf z*$D()nif9!Vo@oefu}>BesIm?Qv5+K6{s7}I;5iexEuY`r3D~xjfdg1@s&ar39ULQY5hbGMrJm5TmP@LR}a6{Jfk%s-9Qb~{(JI8%dtMw50~V|1&A4Z%EJrpbOW96jQ1Bo_F7 z@plZed7|rz1EJ4_$~J4alYgC?+a-%ojtJHrCZ~WX_Y|-aI2!J>{242k4j&8!1XE|k zA(`YF^raUL&!~@I>w5>4YQCzGCLDdv%=l-E)47|qMrHR^vN9)zji#!rHRu!QMPX&` zXi>1dbNj^JdJR$omeN_aCb^*EoW6PvUbyCWeUDf6T0jr;0d+MQV~$Q8p8rteN*9kw zyv9#R%`=84zhZNbhHYMfhXzfzr#l(NU}J_iiTcvu;53V}Nmc)8+xT(4^lZHYAAC&t zn`Pv_ZWz!lod#FS{DOOAb%Cc`4ub|5xmhNRlF6SYW-nIXu z+f%-84yCJ4u_8u!9X6CGO=n=@G-y_h+Pw+sBuMcH^;}c@EM31^+H=$)8!y^VNx2@q z-rutHqQ|O6q@QR#0xR1Q!&!c-BG|$;sUI-B0{koq)E9;BXHmgnp1&H782CJWwTJ;& zC35+@t(p^^`J^`DM!L#hizHkBS#^`ukXhKf^kH2aChfft6&&X1wH?7Gh9xe!EFwy* zn%2*3Gm~u^C}s2o`)a)Dh4!6VYX*3QkJ&`4@U%s03U=ptZ|aZ>(C&)BtS+$5F?zvn zJG!QDyRl_G@#xt=c7me`;^KKPMQU{#J7rk)nRA*&tnEkn$0Q~l=;4X>v&W2Xz1E>E zR&N~tY5V}@kfM@a;ypf#SF;6atd_BtBrXlQ;`GfN3olxAyP0wlnfuw3E)~my$M${h zE)IDsg=(b#LVG7BaI_}SD;XUyi~`V50iB>3!mId?phYfhbX-?#_^~Ada#VtTF0O5e8O|LY7QXfHRTlQ0J?ow` zpGa}sg;mvc~S4 z=V)ijrpsBq-stQ8*@h($Te+4jwdQoo$a?WF`{PNphxTmviNY?rTU_g5&1Vhw<~%h0 z$p%>d+1;h{a(`6n%ONhO6c$8&;<&TW*m{TADb zGL%eqUH)m*dIa8OZ6(5yQ$~<5N2^4+dN^*l`)JnuK+BU!ZO_+}sU&-PH&H?87sSMC z?c<-Pe$s>eirLt4>q|Mz1mlEChA-LssRuAYr+$g_LJyQM(yoqqD-SIE$%NHs@So8C z9pQCst!r;XS4(O-6W>^?<_Wt4Ov^p$AK!-e-cqY8%xD?oK#> zCF6n9?QA6db|Mv`5aCX56E|?ba=h?#q|7oDP^p8Q8~H-cOe|cB{3xHjlwrrIrJVK0 zC?j3lfk&c`Va9==5w0HI1KI5)u3yj7{pu#imRryrH?zI$7^zCnI z*V?^eO!!!I&bQ6{9U3<;)YT19IhEk8cB< zG?rHwSGIS&Oke}*RSaiV6Cn_Ij$A63zwQ}0GAH{Tus>`8&pX^PLBymO~o*oT(IeKCu_~FbX*syx{7HytI zzbKkV7*l2=PGZOyIea`XtX?kv&Oyc3Ksb$TjxbrH^*tq4vcV-;O%Jm>#03qEJ8d& zSy=9CshY~h3x92WdT^bh_lBB;v7!J>Q^k{f8hw@(q1LPvfij``WJ!)4DT_=kV! zIJQS`0*nAH$+Y9jFSQA3dgE>y=!y!r(+h#6sp4sWVhGrmt$F5r9P`*2U=}()$+X^~ zc$+t(LptQ3+EGXLDz=ma2<- zAF8}kP~F~R0~VrPLdh3iLIx5jA^7BZ)T5%xA9=T-2Kd35%9m967nl)n1l>B?aYOXZm`G)%mE@50IN&9LB>X z?V?)IqRFJTM|C%<1 zL2%942s_`F`RlLdbz1{pK1hM;`P?a`VAxxz+hP@f-|i7R+9YEMKHdY^?)0beJsh!d z#)^YGZGojX@6o5e?}@y5f?S?bgE$q(G_>T|zo(*cn}|O?27S_Jwd#vpPOFWx?gig& z-Sgy^g+*8bPAATQ-Tb}miro~Ie%X-Hm}xcZC>$?bYC;;gmAp5g_j+g~uv3s1LtY3d z-yP)rSReR_?QG;?QcqH2=f8Ytb`{Ls@q>+r+eS33AnoXie|YHCZu)bz1j4L}X0<4+ z^Yh1~*FRl%&MLOeaaonh+9yTq9pe?sFB(jym9#ir?4B(q@49b$Dlf_8e4X7a8 zwffKu%4Vb$(g(L3$$zz&DE$Sf{Fp=>)O!3EN9}#h14=1Ngc~Q#+^n~4Tbj)kO}Evb zPM14I{|vx? cd{ei*rTrmQME4aO{b!aGWK^YLlBPlb4*=QP4gdfE literal 0 HcmV?d00001 diff --git a/website/source/guides/operations/deployment-guide.html.md b/website/source/guides/operations/deployment-guide.html.md new file mode 100644 index 000000000..6000e3b85 --- /dev/null +++ b/website/source/guides/operations/deployment-guide.html.md @@ -0,0 +1,241 @@ +--- +layout: "guides" +page_title: "Nomad Deployment Guide" +sidebar_current: "guides-operations-deployment-guide" +description: |- + This deployment guide covers the steps required to install and + configure a single HashiCorp Nomad cluster as defined in the + Nomad Reference Architecture +product_version: 0.8 +--- + +# Nomad Deployment Guide + +This deployment guide covers the steps required to install and configure a single HashiCorp Nomad cluster as defined in the [Nomad Reference Architecture](/guides/operations/reference-architecture.html). + +These instructions are for installing and configuring Nomad on Linux hosts running the systemd system and service manager. + +## Reference Material + +This deployment guide is designed to work in combination with the [Nomad Reference Architecture](/guides/operations/reference-architecture.html) and [Consul Deployment Guide](https://www.consul.io/docs/guides/deployment-guide.html). Although it is not a strict requirement to follow the Nomad Reference Architecture, please ensure you are familiar with the overall architecture design. For example, installing Nomad server agents on multiple physical or virtual (with correct anti-affinity) hosts for high-availability. + +## Overview + +To provide a highly-available single cluster architecture, we recommend Nomad server agents be deployed to more than one host, as shown in the [Nomad Reference Architecture](/guides/operations/reference-architecture.html). + +![Reference diagram](/assets/images/nomad_reference_diagram.png) + +These setup steps should be completed on all Nomad hosts: + +- [Download Nomad](#download-nomad) +- [Install Nomad](#install-nomad) +- [Configure systemd](#configure-systemd) +- [Configure Nomad](#configure-nomad) +- [Start Nomad](#start-nomad) + +## Download Nomad + +Precompiled Nomad binaries are available for download at [https://releases.hashicorp.com/nomad/](https://releases.hashicorp.com/nomad/) and Nomad Enterprise binaries are available for download by following the instructions made available to HashiCorp Enterprise customers. + +You should perform checksum verification of the zip packages using the SHA256SUMS and SHA256SUMS.sig files available for the specific release version. HashiCorp provides [a guide on checksum verification](https://www.hashicorp.com/security.html) for precompiled binaries. + +```text +NOMAD_VERSION="0.8.4" +curl --silent --remote-name https://releases.hashicorp.com/nomad/${NOMAD_VERSION}/nomad_${NOMAD_VERSION}_linux_amd64.zip +curl --silent --remote-name https://releases.hashicorp.com/nomad/${NOMAD_VERSION}/nomad_${NOMAD_VERSION}_SHA256SUMS +curl --silent --remote-name https://releases.hashicorp.com/nomad/${NOMAD_VERSION}/nomad_${NOMAD_VERSION}_SHA256SUMS.sig +``` + +## Install Nomad + +Unzip the downloaded package and move the `nomad` binary to `/usr/local/bin/`. Check `nomad` is available on the system path. + +```text +unzip nomad_${NOMAD_VERSION}_linux_amd64.zip +sudo chown root:root nomad +sudo mv nomad /usr/local/bin/ +nomad --version +``` + +The `nomad` command features opt-in autocompletion for flags, subcommands, and arguments (where supported). Enable autocompletion. + +```text +nomad -autocomplete-install +complete -C /usr/local/bin/nomad nomad +``` + +Create a unique, non-privileged system user to run Nomad and create its data directory. + +```text +sudo useradd --system --home /etc/nomad.d --shell /bin/false nomad +sudo mkdir --parents /opt/nomad +sudo chown --recursive nomad:nomad /opt/nomad +``` + +## Configure systemd + +Systemd uses [documented sane defaults](https://www.freedesktop.org/software/systemd/man/systemd.directives.html) so only non-default values must be set in the configuration file. + +Create a Nomad service file at /etc/systemd/system/nomad.service. + +```text +sudo touch /etc/systemd/system/nomad.service +``` + +Add this configuration to the Nomad service file: + +```text +[Unit] +Description="HashiCorp Nomad - An application and service scheduler" +Documentation=https://www.nomad.io/docs/ +Requires=network-online.target +After=network-online.target +ConditionFileNotEmpty=/etc/nomad.d/nomad.hcl + +[Service] +User=nomad +Group=nomad +ExecStart=/usr/local/bin/nomad agent -config=/etc/nomad.d/ +ExecReload=/bin/kill --signal HUP $MAINPID +KillMode=process +Restart=on-failure +RestartSec=2 +StartLimitBurst=3 +StartLimitIntervalSec=10 +LimitNOFILE=65536 + +[Install] +WantedBy=multi-user.target +``` + +The following parameters are set for the `[Unit]` stanza: + +- [`Description`](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Description=) - Free-form string describing the nomad service +- [`Documentation`](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Documentation=) - Link to the nomad documentation +- [`Requires`](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Requires=) - Configure a requirement dependency on the network service +- [`After`](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#Before=) - Configure an ordering dependency on the network service being started before the nomad service +- [`ConditionFileNotEmpty`](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#ConditionArchitecture=) - Check for a non-zero sized configuration file before nomad is started + +The following parameters are set for the `[Service]` stanza: + +- [`User`, `Group`](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#User=) - Run nomad as the nomad user +- [`ExecStart`](https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart=) - Start nomad with the `agent` argument and path to the configuration file +- [`ExecReload`](https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecReload=) - Send nomad a SIGHUP signal to trigger a configuration reload in nomad +- [`KillMode`](https://www.freedesktop.org/software/systemd/man/systemd.kill.html#KillMode=) - Treat nomad as a single process +- [`Restart`](https://www.freedesktop.org/software/systemd/man/systemd.service.html#Restart=) - Restart nomad unless it returned a clean exit code +- [`RestartSec`](https://www.freedesktop.org/software/systemd/man/systemd.service.html#RestartSec=) - Restart nomad after 2 seconds of it being considered 'failed' +- [`StartLimitBurst`, `StartLimitIntervalSec`](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#StartLimitIntervalSec=interval) - Configure unit start rate limiting +- [`LimitNOFILE`](https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Process%20Properties) - Set an increased Limit for File Descriptors + +The following parameters are set for the `[Install]` stanza: + +- [`WantedBy`](https://www.freedesktop.org/software/systemd/man/systemd.unit.html#WantedBy=) - Creates a weak dependency on nomad being started by the multi-user run level + +## Configure Nomad + +Nomad uses [documented sane defaults](/docs/configuration/index.html) so only non-default values must be set in the configuration file. Configuration can be read from multiple files and is loaded in lexical order. See the [full description](/docs/configuration/index.html) for more information about configuration loading and merge semantics. + +Some configuration settings are common to both server and client Nomad agents, while some configuration settings must only exist on one or the other. Follow the [common configuration](#common-configuration) guidance on all hosts and then the specific guidance depending on whether you are configuring a Nomad [server](#server-configuration) or [client](#client-configuration). + +- [Common Nomad configuration](#common-configuration) +- [Configure a Nomad server](#server-configuration) +- [Configure a Nomad client](#client-configuration) + +### Common configuration + +Create a configuration file at `/etc/nomad.d/nomad.hcl`: + +```text +sudo mkdir --parents /etc/nomad.d +sudo touch /etc/nomad.d/nomad.hcl +sudo chown --recursive nomad:nomad /etc/nomad.d +sudo chmod 640 /etc/nomad.d/nomad.hcl +``` + +Add this configuration to the `nomad.hcl` configuration file: + +~> **Note:** Replace the `datacenter` parameter value with the identifier you will use for the datacenter this Nomad cluster is deployed in. + +```hcl +datacenter = "dc1" +data_dir = "/opt/nomad" +``` + +- [`datacenter`](/docs/configuration/index.html#datacenter) - The datacenter in which the agent is running. +- [`data_dir`](/docs/configuration/index.html#data_dir) - The data directory for the agent to store state. + +### Server configuration + +Create a configuration file at `/etc/nomad.d/server.hcl`: + +```text +sudo mkdir --parents /etc/nomad.d +sudo touch /etc/nomad.d/server.hcl +sudo chown --recursive nomad:nomad /etc/nomad.d +sudo chmod 640 /etc/nomad.d/server.hcl +``` + +Add this configuration to the `server.hcl` configuration file: + +~> **NOTE** Replace the `bootstrap_expect` value with the number of Nomad servers you will use; three or five [is recommended](/docs/internals/consensus.html#deployment-table). + +```hcl +server { + enabled = true + bootstrap_expect = 3 +} +``` + +- [`server`](/docs/configuration/server.html#enabled) - Specifies if this agent should run in server mode. All other server options depend on this value being set. +- [`bootstrap-expect`](/docs/configuration/server.html#bootstrap_expect) - This flag provides the number of expected servers in the datacenter. Either this value should not be provided or the value must agree with other servers in the cluster. + +### Client configuration + +Create a configuration file at `/etc/nomad.d/client.hcl`: + +```text +sudo mkdir --parents /etc/nomad.d +sudo touch /etc/nomad.d/client.hcl +sudo chown --recursive nomad:nomad /etc/nomad.d +sudo chmod 640 /etc/nomad.d/client.hcl +``` + +Add this configuration to the `client.hcl` configuration file: + +```hcl +client { + enabled = true +} +``` + +- [`client`](/docs/configuration/client.html#enabled) - Specifies if this agent should run in client mode. All other client options depend on this value being set. + +~> **NOTE** The [`options`](/docs/configuration/client.html#options-parameters) parameter can be used to enable or disable specific configurations on Nomad clients, unique to your use case requirements. + +### ACL configuration + +The [Access Control](/guides/security/acl.html) guide provides instructions on configuring and enabling ACLs. + +### TLS configuration + +Securing Nomad's cluster communication with mutual TLS (mTLS) is recommended for production deployments and can even ease operations by preventing mistakes and misconfigurations. Nomad clients and servers should not be publicly accessible without mTLS enabled. + +The [Securing Nomad with TLS](/guides/security/securing-nomad.html) guide provides instructions on configuring and enabling TLS. + +## Start Nomad + +Enable and start Nomad using the systemctl command responsible for controlling systemd managed services. Check the status of the nomad service using systemctl. + +```text +sudo systemctl enable nomad +sudo systemctl start nomad +sudo systemctl status nomad +``` + +## Next Steps + +- Read [Outage Recovery](/guides/operations/outage.html) to learn + the steps required to recover from a Nomad cluster outage. +- Read [Autopilot](/guides/operations/autopilot.html) to learn about + features in Nomad 0.8 to allow for automatic operator-friendly + management of Nomad servers. diff --git a/website/source/guides/operations/reference-architecture.html.md b/website/source/guides/operations/reference-architecture.html.md new file mode 100644 index 000000000..c099a3d63 --- /dev/null +++ b/website/source/guides/operations/reference-architecture.html.md @@ -0,0 +1,131 @@ +--- +layout: "guides" +page_title: "Nomad Reference Architecture" +sidebar_current: "guides-operations-reference-architecture" +description: |- + This document provides recommended practices and a reference + architecture for HashiCorp Nomad production deployments. +product_version: 0.8 +--- + +# Nomad Reference Architecture + +This document provides recommended practices and a reference architecture for HashiCorp Nomad production deployments. This reference architecture conveys a general architecture that should be adapted to accommodate the specific needs of each implementation. + +The following topics are addressed: + +- [Reference Architecture](#ra) +- [Deployment Topology within a Single Region](#one-region) +- [Deployment Topology across Multiple Regions](#multi-region) +- [Network Connectivity Details](#net) +- [Deployment System Requirements](#system-reqs) +- [High Availability](#high-availability) +- [Failure Scenarios](#failure-scenarios) + +This document describes deploying a Nomad cluster in combination with, or with access to, a [Consul cluster](/guides/operations/consul-integration/index.html). We recommend the use of Consul with Nomad to provide automatic clustering, service discovery, health checking and dynamic configuration. + +## Reference Architecture + +A Nomad cluster typically comprises three or five servers (but no more than seven) and a number of client agents. Nomad differs slightly from Consul in that it divides infrastructure into regions which are served by one Nomad server cluster, but can manage multiple datacenters or availability zones. For example, a _US Region_ can include datacenters _us-east-1_ and _us-west-2_. + +In a Nomad multi-region architecture, communication happens via [WAN gossip](/docs/internals/gossip.html). Additionally, Nomad can integrate easily with Consul to provide features such as automatic clustering, service discovery, and dynamic configurations. Thus we recommend you use Consul in your Nomad deployment to simplify the deployment. + +In cloud environments, a single cluster may be deployed across multiple availability zones. For example, in AWS each Nomad server can be deployed to an associated EC2 instance, and those EC2 instances distributed across multiple AZs. Similarly, Nomad server clusters can be deployed to multiple cloud regions to allow for region level HA scenarios. + +For more information on Nomad server cluster design, see the [cluster requirements documentation](/guides/operations/requirements.html). + +The design shared in this document is the recommended architecture for production environments, as it provides flexibility and resilience. Nomad utilizes an existing Consul server cluster; however, the deployment design of the Consul server cluster is outside the scope of this document. + +Nomad to Consul connectivity is over HTTP and should be secured with TLS as well as a Consul token to provide encryption of all traffic. This is done using Nomad's [Automatic Clustering with Consul](/guides/operations/cluster/automatic.html). + +### Deployment Topology within a Single Region + +A single Nomad cluster is recommended for applications deployed in the same region. + +Each cluster is expected to have either three or five servers. This strikes a balance between availability in the case of failure and performance, as [Raft](https://raft.github.io/) consensus gets progressively slower as more servers are added. + +The time taken by a new server to join an existing large cluster may increase as the size of the cluster increases. + +#### Reference Diagram + +![Reference diagram](/assets/images/nomad_reference_diagram.png) + +### Deployment Topology across Multiple Regions + +By deploying Nomad server clusters in multiple regions, the user is able to interact with the Nomad servers by targeting any region from any Nomad server even if that server resides in a separate region. Data, however, is not replicated between regions as they are fully independent clusters. + +Nomad server clusters in different datacenters can be federated using WAN links. The server clusters can be joined to communicate over the WAN on port `4648`. This same port is used for single datacenter deployments over LAN as well. + +Additional documentation is available to learn more about [Nomad server federation](/guides/operations/federation.html). + +## Network Connectivity Details + +![Nomad network diagram](/assets/images/nomad_network_arch.png) + +Nomad servers are expected to be able to communicate in high bandwidth, low latency network environments and have below 10 millisecond latencies between cluster members. Nomad servers can be spread across cloud regions or datacenters if they satisfy these latency requirements. + +Nomad client clusters require the ability to receive traffic as noted above in the Network Connectivity Details; however, clients can be separated into any type of infrastructure (multi-cloud, on-prem, virtual, bare metal, etc.) as long as they are reachable and can receive job requests from the Nomad servers. + +Additional documentation is available to learn more about [Nomad networking](/guides/operations/requirements.html#network-topology). + +## Deployment System Requirements + +Nomad server agents are responsible for maintaining the cluster state, responding to RPC queries (read operations), and for processing all write operations. Given that Nomad server agents do most of the heavy lifting, server sizing is critical for the overall performance efficiency and health of the Nomad cluster. + +### Nomad Servers + +| Size | CPU | Memory | Disk | Typical Cloud Instance Types | +|-------|----------|-----------------|-----------|--------------------------------------------| +| Small | 2 core | 8-16 GB RAM | 50 GB | **AWS:** m5.large, m5.xlarge | +| | | | | **Azure:** Standard_D2_v3, Standard_D4_v3 | +| | | | | **GCE:** n1-standard-8, n1-standard-16 | +| Large | 4-8 core | 32-64 GB RAM | 100 GB | **AWS:** m5.2xlarge, m5.2xlarge | +| | | | | **Azure:** Standard_D4_v3, Standard_D8_v3 | +| | | | | **GCE:** n1-standard-16, n1-standard-32 | + +#### Hardware Sizing Considerations + +- The small size would be appropriate for most initial production + deployments, or for development/testing environments. + +- The large size is for production environments where there is a + consistently high workload. + +~> **NOTE** For large workloads, ensure that the disks support a high number of IOPS to keep up with the rapid Raft log update rate. + +Nomad clients can be setup with specialized workloads as well. For example, if workloads require GPU processing, a Nomad datacenter can be created to serve those GPU specific jobs and joined to a Nomad server cluster. For more information on specialized workloads, see the documentation on [job constraints](/docs/job-specification/constraint.html) to target specific client nodes. + +## High Availability + +A Nomad server cluster is the highly-available unit of deployment within a single datacenter. A recommended approach is to deploy a three or five node Nomad server cluster. With this configuration, during a Nomad server outage, failover is handled immediately without human intervention. + +When setting up high availability across regions, multiple Nomad server clusters are deployed and connected via WAN gossip. Nomad clusters in regions are fully independent from each other and do not share jobs, clients, or state. Data residing in a single region-specific cluster is not replicated to other clusters in other regions. + +## Failure Scenarios + +Typical distribution in a cloud environment is to spread Nomad server nodes into separate Availability Zones (AZs) within a high bandwidth, low latency network, such as an AWS Region. The diagram below shows Nomad servers deployed in multiple AZs promoting a single voting member per AZ and providing both AZ-level and node-level failure protection. + +![Nomad fault tolerance](/assets/images/nomad_fault_tolerance.png) + +Additional documentation is available to learn more about [cluster sizing and failure tolerances](/docs/internals/consensus.html#deployment-table) as well as [outage recovery](/guides/operations/outage.html). + +### Availability Zone Failure + +In the event of a single AZ failure, only a single Nomad server will be affected which would not impact job scheduling as long as there is still a Raft quorum (i.e. 2 available servers in a 3 server cluster, 3 available servers in a 5 server cluster, etc.). There are two scenarios that could occur should an AZ fail in a multiple AZ setup: leader loss or follower loss. + +#### Leader Server Loss + +If the AZ containing the Nomad leader server fails, the remaining quorum members would elect a new leader. The new leader then begins to accept new log entries and replicates these entries to the remaining followers. + +#### Follower Server Loss + +If the AZ containing a Nomad follower server fails, there is no immediate impact to the Nomad leader server or cluster operations. However, there still must be a Raft quorum in order to properly manage a future failure of the Nomad leader server. + +### Region Failure + +In the event of a region-level failure (which would contain an entire Nomad server cluster), clients will still be able to submit jobs to another region that is properly federated. However, there will likely be data loss as Nomad server clusters do not replicate their data to other region clusters. See [Multi-region Federation](/guides/operations/federation.html) for more setup information. + +## Next Steps + +- Read [Deployment Guide](/guides/operations/deployment-guide.html) to learn + the steps required to install and configure a single HashiCorp Nomad cluster. diff --git a/website/source/layouts/guides.erb b/website/source/layouts/guides.erb index d5f70a6d9..34533bcef 100644 --- a/website/source/layouts/guides.erb +++ b/website/source/layouts/guides.erb @@ -59,14 +59,22 @@ Operations

    + > + Reference Architecture + + + > + Deployment Guide + + > Installing Nomad - > + > Running the Agent - + > Consul Integration From 6a5238eb48d2c10b59341e0ed0e121aee2300273 Mon Sep 17 00:00:00 2001 From: Mahmood Ali Date: Tue, 4 Dec 2018 11:50:59 -0500 Subject: [PATCH 09/17] tests: stop integration tests tasks explicitly Also update the new recommended `nomad job` subcommands --- command/integration_test.go | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/command/integration_test.go b/command/integration_test.go index 44c1d71c4..f509b26cb 100644 --- a/command/integration_test.go +++ b/command/integration_test.go @@ -23,7 +23,7 @@ func TestIntegration_Command_NomadInit(t *testing.T) { defer os.RemoveAll(tmpDir) { - cmd := exec.Command("nomad", "init") + cmd := exec.Command("nomad", "job", "init") cmd.Dir = tmpDir if err := cmd.Run(); err != nil { t.Fatalf("error running init: %v", err) @@ -31,7 +31,7 @@ func TestIntegration_Command_NomadInit(t *testing.T) { } { - cmd := exec.Command("nomad", "validate", "example.nomad") + cmd := exec.Command("nomad", "job", "validate", "example.nomad") cmd.Dir = tmpDir cmd.Env = []string{`NOMAD_ADDR=http://127.0.0.1:0`} if err := cmd.Run(); err != nil { @@ -52,13 +52,13 @@ func TestIntegration_Command_RoundTripJob(t *testing.T) { defer srv.Shutdown() { - cmd := exec.Command("nomad", "init") + cmd := exec.Command("nomad", "job", "init") cmd.Dir = tmpDir assert.Nil(cmd.Run()) } { - cmd := exec.Command("nomad", "run", "example.nomad") + cmd := exec.Command("nomad", "job", "run", "example.nomad") cmd.Dir = tmpDir cmd.Env = []string{fmt.Sprintf("NOMAD_ADDR=%s", url)} err := cmd.Run() @@ -68,7 +68,7 @@ func TestIntegration_Command_RoundTripJob(t *testing.T) { } { - cmd := exec.Command("nomad", "inspect", "example") + cmd := exec.Command("nomad", "job", "inspect", "example") cmd.Dir = tmpDir cmd.Env = []string{fmt.Sprintf("NOMAD_ADDR=%s", url)} out, err := cmd.Output() @@ -83,4 +83,13 @@ func TestIntegration_Command_RoundTripJob(t *testing.T) { assert.Nil(err) assert.NotZero(resp.EvalID) } + + { + cmd := exec.Command("nomad", "job", "stop", "example") + cmd.Dir = tmpDir + cmd.Env = []string{fmt.Sprintf("NOMAD_ADDR=%s", url)} + _, err := cmd.Output() + assert.Nil(err) + } + } From 92b57036a8fe26d0f8812b230837a3b090aeecbe Mon Sep 17 00:00:00 2001 From: Mahmood Ali Date: Tue, 4 Dec 2018 14:00:45 -0500 Subject: [PATCH 10/17] driver/rkt: use rkt environment The rkt command itself needs an environment with PATH set to find iptables. --- drivers/rkt/driver.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/rkt/driver.go b/drivers/rkt/driver.go index 3ba505414..a93b0aaae 100644 --- a/drivers/rkt/driver.go +++ b/drivers/rkt/driver.go @@ -652,7 +652,7 @@ func (d *Driver) StartTask(cfg *drivers.TaskConfig) (*drivers.TaskHandle, *cstru MemoryMB: int(drivers.BytesToMB(cfg.Resources.LinuxResources.MemoryLimitBytes)), DiskMB: cfg.Resources.NomadResources.DiskMB, }, - Env: cfg.EnvList(), + Env: rktEnv.List(), TaskDir: cfg.TaskDir().Dir, StdoutPath: cfg.StdoutPath, StderrPath: cfg.StderrPath, From 8b624340ad94592d9de7c8d354ed83dec3fb8e01 Mon Sep 17 00:00:00 2001 From: Alex Dadgar Date: Wed, 5 Dec 2018 14:27:07 -0800 Subject: [PATCH 11/17] Fix various bugs with task events Fixes the following: * Emitting events when the task fails to start * Don't double emit events on task shutdown (nomad stop) * Don't emit a OOM kill metric unless actually OOM'd --- client/allocrunner/taskrunner/lifecycle.go | 3 -- client/allocrunner/taskrunner/task_runner.go | 31 +++++++++----------- 2 files changed, 14 insertions(+), 20 deletions(-) diff --git a/client/allocrunner/taskrunner/lifecycle.go b/client/allocrunner/taskrunner/lifecycle.go index 224a3af62..6ef91546d 100644 --- a/client/allocrunner/taskrunner/lifecycle.go +++ b/client/allocrunner/taskrunner/lifecycle.go @@ -112,9 +112,6 @@ func (tr *TaskRunner) Kill(ctx context.Context, event *structs.TaskEvent) error case <-ctx.Done(): } - // Store that the task has been destroyed and any associated error. - tr.UpdateState(structs.TaskStateDead, structs.NewTaskEvent(structs.TaskKilled).SetKillError(killErr)) - if killErr != nil { return killErr } else if err := ctx.Err(); err != nil { diff --git a/client/allocrunner/taskrunner/task_runner.go b/client/allocrunner/taskrunner/task_runner.go index 7f2246ac1..53c0f8523 100644 --- a/client/allocrunner/taskrunner/task_runner.go +++ b/client/allocrunner/taskrunner/task_runner.go @@ -377,6 +377,7 @@ MAIN: // Run the task if err := tr.runDriver(); err != nil { tr.logger.Error("running driver failed", "error", err) + tr.EmitEvent(structs.NewTaskEvent(structs.TaskDriverFailure).SetDriverError(err)) tr.restartTracker.SetStartError(err) goto RESTART } @@ -399,9 +400,7 @@ MAIN: select { case result = <-resultCh: // WaitCh returned a result - if result != nil { - tr.handleTaskExitResult(result) - } + tr.handleTaskExitResult(result) case <-tr.ctx.Done(): // TaskRunner was told to exit immediately return @@ -437,16 +436,8 @@ MAIN: } } - // If task terminated, update server. All other exit conditions (eg - // killed or out of restarts) will perform their own server updates. - if result != nil { - event := structs.NewTaskEvent(structs.TaskTerminated). - SetExitCode(result.ExitCode). - SetSignal(result.Signal). - SetOOMKilled(result.OOMKilled). - SetExitMessage(result.Err) - tr.UpdateState(structs.TaskStateDead, event) - } + // Mark the task as dead + tr.UpdateState(structs.TaskStateDead, nil) // Run the stop hooks if err := tr.stop(); err != nil { @@ -457,6 +448,10 @@ MAIN: } func (tr *TaskRunner) handleTaskExitResult(result *drivers.ExitResult) { + if result == nil { + return + } + event := structs.NewTaskEvent(structs.TaskTerminated). SetExitCode(result.ExitCode). SetSignal(result.Signal). @@ -465,7 +460,7 @@ func (tr *TaskRunner) handleTaskExitResult(result *drivers.ExitResult) { tr.EmitEvent(event) - if !tr.clientConfig.DisableTaggedMetrics { + if result.OOMKilled && !tr.clientConfig.DisableTaggedMetrics { metrics.IncrCounterWithLabels([]string{"client", "allocs", "oom_killed"}, 1, tr.baseLabels) } } @@ -794,10 +789,12 @@ func (tr *TaskRunner) UpdateState(state string, event *structs.TaskEvent) { tr.stateLock.Lock() defer tr.stateLock.Unlock() - tr.logger.Trace("setting task state", "state", state, "event", event.Type) + if event != nil { + tr.logger.Trace("setting task state", "state", state, "event", event.Type) - // Append the event - tr.appendEvent(event) + // Append the event + tr.appendEvent(event) + } // Update the state if err := tr.updateStateImpl(state); err != nil { From 104be1cad6bd58db564db8c5e85c40e29b543e33 Mon Sep 17 00:00:00 2001 From: Michael Lange Date: Wed, 5 Dec 2018 22:07:44 -0800 Subject: [PATCH 12/17] Grow the default 0 to 1 bounds to the domain of the data when necessary --- ui/app/components/stats-time-series.js | 10 ++- .../unit/components/stats-time-series-test.js | 86 ++++++++++++++----- 2 files changed, 75 insertions(+), 21 deletions(-) diff --git a/ui/app/components/stats-time-series.js b/ui/app/components/stats-time-series.js index a93a8190a..fc5854875 100644 --- a/ui/app/components/stats-time-series.js +++ b/ui/app/components/stats-time-series.js @@ -51,9 +51,17 @@ export default LineChart.extend({ }), yScale: computed('data.[]', 'yProp', 'xAxisOffset', function() { + const yProp = this.get('yProp'); + const yValues = (this.get('data') || []).mapBy(yProp); + + let [low, high] = [0, 1]; + if (yValues.compact().length) { + [low, high] = d3Array.extent(yValues); + } + return d3Scale .scaleLinear() .rangeRound([this.get('xAxisOffset'), 10]) - .domain([0, 1]); + .domain([Math.min(0, low), Math.max(1, high)]); }), }); diff --git a/ui/tests/unit/components/stats-time-series-test.js b/ui/tests/unit/components/stats-time-series-test.js index 401a8a5b1..d9c661c7c 100644 --- a/ui/tests/unit/components/stats-time-series-test.js +++ b/ui/tests/unit/components/stats-time-series-test.js @@ -11,26 +11,36 @@ const ts = (offset, resolution = 'm') => .toDate(); const wideData = [ - { timestamp: ts(20), value: 0.5 }, - { timestamp: ts(18), value: 0.5 }, - { timestamp: ts(16), value: 0.4 }, - { timestamp: ts(14), value: 0.3 }, - { timestamp: ts(12), value: 0.9 }, - { timestamp: ts(10), value: 0.3 }, - { timestamp: ts(8), value: 0.3 }, - { timestamp: ts(6), value: 0.4 }, - { timestamp: ts(4), value: 0.5 }, - { timestamp: ts(2), value: 0.6 }, - { timestamp: ts(0), value: 0.6 }, + { timestamp: ts(20), percent: 0.5 }, + { timestamp: ts(18), percent: 0.5 }, + { timestamp: ts(16), percent: 0.4 }, + { timestamp: ts(14), percent: 0.3 }, + { timestamp: ts(12), percent: 0.9 }, + { timestamp: ts(10), percent: 0.3 }, + { timestamp: ts(8), percent: 0.3 }, + { timestamp: ts(6), percent: 0.4 }, + { timestamp: ts(4), percent: 0.5 }, + { timestamp: ts(2), percent: 0.6 }, + { timestamp: ts(0), percent: 0.6 }, ]; const narrowData = [ - { timestamp: ts(20, 's'), value: 0.5 }, - { timestamp: ts(18, 's'), value: 0.5 }, - { timestamp: ts(16, 's'), value: 0.4 }, - { timestamp: ts(14, 's'), value: 0.3 }, - { timestamp: ts(12, 's'), value: 0.9 }, - { timestamp: ts(10, 's'), value: 0.3 }, + { timestamp: ts(20, 's'), percent: 0.5 }, + { timestamp: ts(18, 's'), percent: 0.5 }, + { timestamp: ts(16, 's'), percent: 0.4 }, + { timestamp: ts(14, 's'), percent: 0.3 }, + { timestamp: ts(12, 's'), percent: 0.9 }, + { timestamp: ts(10, 's'), percent: 0.3 }, +]; + +const unboundedData = [ + { timestamp: ts(20, 's'), percent: -0.5 }, + { timestamp: ts(18, 's'), percent: 1.5 }, +]; + +const nullData = [ + { timestamp: ts(20, 's'), percent: null }, + { timestamp: ts(18, 's'), percent: null }, ]; test('xFormat is time-formatted for hours, minutes, and seconds', function(assert) { @@ -52,7 +62,7 @@ test('yFormat is percent-formatted', function(assert) { chart.set('data', wideData); wideData.forEach(datum => { - assert.equal(chart.yFormat()(datum.value), d3Format.format('.1~%')(datum.value)); + assert.equal(chart.yFormat()(datum.percent), d3Format.format('.1~%')(datum.percent)); }); }); @@ -82,13 +92,13 @@ test('x scale domain is greater than five minutes when the domain of the data is ); }); -test('y scale domain is always 0 to 1 (0 to 100%)', function(assert) { +test('y scale domain is typically 0 to 1 (0 to 100%)', function(assert) { const chart = this.subject(); chart.set('data', wideData); assert.deepEqual( - [Math.min(...wideData.mapBy('value')), Math.max(...wideData.mapBy('value'))], + [Math.min(...wideData.mapBy('percent')), Math.max(...wideData.mapBy('percent'))], [0.3, 0.9], 'The bounds of the value prop of the dataset is narrower than 0 - 1' ); @@ -99,3 +109,39 @@ test('y scale domain is always 0 to 1 (0 to 100%)', function(assert) { 'The bounds of the yScale are still 0 and 1' ); }); + +test('the extent of the y domain overrides the default 0 to 1 domain when there are values beyond these bounds', function(assert) { + const chart = this.subject(); + + chart.set('data', unboundedData); + + assert.deepEqual( + chart.get('yScale').domain(), + [-0.5, 1.5], + 'The bounds of the yScale match the bounds of the unbounded data' + ); + + chart.set('data', [unboundedData[0]]); + + assert.deepEqual( + chart.get('yScale').domain(), + [-0.5, 1], + 'The upper bound is still the default 1, but the lower bound is overridden due to the unbounded low value' + ); + + chart.set('data', [unboundedData[1]]); + + assert.deepEqual( + chart.get('yScale').domain(), + [0, 1.5], + 'The lower bound is still the default 0, but the upper bound is overridden due to the unbounded high value' + ); +}); + +test('when there are only empty frames in the data array, the default y domain is used', function(assert) { + const chart = this.subject(); + + chart.set('data', nullData); + + assert.deepEqual(chart.get('yScale').domain(), [0, 1], 'The bounds are 0 and 1'); +}); From 62ac40ab099bee69f3208dc9f74088aae5196604 Mon Sep 17 00:00:00 2001 From: Danielle Tomlinson Date: Tue, 4 Dec 2018 18:16:39 +0100 Subject: [PATCH 13/17] allocrunner: Basic test alloc runner --- client/allocrunner/alloc_runner_test.go | 63 ------------------- client/allocrunner/testing.go | 81 +++++++++++++++++++++++++ 2 files changed, 81 insertions(+), 63 deletions(-) create mode 100644 client/allocrunner/testing.go diff --git a/client/allocrunner/alloc_runner_test.go b/client/allocrunner/alloc_runner_test.go index 0f1c6897c..3c1464560 100644 --- a/client/allocrunner/alloc_runner_test.go +++ b/client/allocrunner/alloc_runner_test.go @@ -2,79 +2,16 @@ package allocrunner import ( "fmt" - "sync" "testing" "time" - "github.com/hashicorp/nomad/client/allocwatcher" - "github.com/hashicorp/nomad/client/config" - consulapi "github.com/hashicorp/nomad/client/consul" - "github.com/hashicorp/nomad/client/devicemanager" "github.com/hashicorp/nomad/client/state" - "github.com/hashicorp/nomad/client/vaultclient" "github.com/hashicorp/nomad/nomad/mock" "github.com/hashicorp/nomad/nomad/structs" - "github.com/hashicorp/nomad/plugins/shared/catalog" - "github.com/hashicorp/nomad/plugins/shared/singleton" "github.com/hashicorp/nomad/testutil" "github.com/stretchr/testify/require" ) -// MockStateUpdater implements the AllocStateHandler interface and records -// alloc updates. -type MockStateUpdater struct { - Updates []*structs.Allocation - mu sync.Mutex -} - -// AllocStateUpdated implements the AllocStateHandler interface and records an -// alloc update. -func (m *MockStateUpdater) AllocStateUpdated(alloc *structs.Allocation) { - m.mu.Lock() - m.Updates = append(m.Updates, alloc) - m.mu.Unlock() -} - -// Last returns a copy of the last alloc (or nil) update. Safe for concurrent -// access with updates. -func (m *MockStateUpdater) Last() *structs.Allocation { - m.mu.Lock() - defer m.mu.Unlock() - n := len(m.Updates) - if n == 0 { - return nil - } - return m.Updates[n-1].Copy() -} - -// Reset resets the recorded alloc updates. -func (m *MockStateUpdater) Reset() { - m.mu.Lock() - m.Updates = nil - m.mu.Unlock() -} - -// testAllocRunnerConfig returns a new allocrunner.Config with mocks and noop -// versions of dependencies along with a cleanup func. -func testAllocRunnerConfig(t *testing.T, alloc *structs.Allocation) (*Config, func()) { - pluginLoader := catalog.TestPluginLoader(t) - clientConf, cleanup := config.TestClientConfig(t) - conf := &Config{ - // Copy the alloc in case the caller edits and reuses it - Alloc: alloc.Copy(), - Logger: clientConf.Logger, - ClientConfig: clientConf, - StateDB: state.NoopDB{}, - Consul: consulapi.NewMockConsulServiceClient(t, clientConf.Logger), - Vault: vaultclient.NewMockVaultClient(), - StateUpdater: &MockStateUpdater{}, - PrevAllocWatcher: allocwatcher.NoopPrevAlloc{}, - PluginSingletonLoader: singleton.NewSingletonLoader(clientConf.Logger, pluginLoader), - DeviceManager: devicemanager.NoopMockManager(), - } - return conf, cleanup -} - // TestAllocRunner_AllocState_Initialized asserts that getting TaskStates via // AllocState() are initialized even before the AllocRunner has run. func TestAllocRunner_AllocState_Initialized(t *testing.T) { diff --git a/client/allocrunner/testing.go b/client/allocrunner/testing.go new file mode 100644 index 000000000..3e18379dc --- /dev/null +++ b/client/allocrunner/testing.go @@ -0,0 +1,81 @@ +package allocrunner + +import ( + "sync" + "testing" + + "github.com/hashicorp/nomad/client/allocwatcher" + clientconfig "github.com/hashicorp/nomad/client/config" + "github.com/hashicorp/nomad/client/consul" + "github.com/hashicorp/nomad/client/devicemanager" + "github.com/hashicorp/nomad/client/state" + "github.com/hashicorp/nomad/client/vaultclient" + "github.com/hashicorp/nomad/nomad/structs" + "github.com/hashicorp/nomad/plugins/shared/catalog" + "github.com/hashicorp/nomad/plugins/shared/singleton" + "github.com/stretchr/testify/require" +) + +// MockStateUpdater implements the AllocStateHandler interface and records +// alloc updates. +type MockStateUpdater struct { + Updates []*structs.Allocation + mu sync.Mutex +} + +// AllocStateUpdated implements the AllocStateHandler interface and records an +// alloc update. +func (m *MockStateUpdater) AllocStateUpdated(alloc *structs.Allocation) { + m.mu.Lock() + m.Updates = append(m.Updates, alloc) + m.mu.Unlock() +} + +// Last returns a copy of the last alloc (or nil) update. Safe for concurrent +// access with updates. +func (m *MockStateUpdater) Last() *structs.Allocation { + m.mu.Lock() + defer m.mu.Unlock() + n := len(m.Updates) + if n == 0 { + return nil + } + return m.Updates[n-1].Copy() +} + +// Reset resets the recorded alloc updates. +func (m *MockStateUpdater) Reset() { + m.mu.Lock() + m.Updates = nil + m.mu.Unlock() +} + +func testAllocRunnerConfig(t *testing.T, alloc *structs.Allocation) (*Config, func()) { + pluginLoader := catalog.TestPluginLoader(t) + clientConf, cleanup := clientconfig.TestClientConfig(t) + conf := &Config{ + // Copy the alloc in case the caller edits and reuses it + Alloc: alloc.Copy(), + Logger: clientConf.Logger, + ClientConfig: clientConf, + StateDB: state.NoopDB{}, + Consul: consul.NewMockConsulServiceClient(t, clientConf.Logger), + Vault: vaultclient.NewMockVaultClient(), + StateUpdater: &MockStateUpdater{}, + PrevAllocWatcher: allocwatcher.NoopPrevAlloc{}, + PluginSingletonLoader: singleton.NewSingletonLoader(clientConf.Logger, pluginLoader), + DeviceManager: devicemanager.NoopMockManager(), + } + return conf, cleanup +} + +func TestAllocRunnerFromAlloc(t *testing.T, alloc *structs.Allocation) (*allocRunner, func()) { + t.Helper() + cfg, cleanup := testAllocRunnerConfig(t, alloc) + ar, err := NewAllocRunner(cfg) + if err != nil { + require.NoError(t, err, "Failed to setup AllocRunner") + } + + return ar, cleanup +} From 419ae3299cac4375112bca2c7f937dfb454c2f20 Mon Sep 17 00:00:00 2001 From: Danielle Tomlinson Date: Tue, 4 Dec 2018 18:16:50 +0100 Subject: [PATCH 14/17] client: Re-enable GC tests --- client/gc_test.go | 149 +++++++++++++++++++++++++++------------------- 1 file changed, 89 insertions(+), 60 deletions(-) diff --git a/client/gc_test.go b/client/gc_test.go index 8b9b33bbe..c20fb7adb 100644 --- a/client/gc_test.go +++ b/client/gc_test.go @@ -1,7 +1,5 @@ package client -/* -TODO(clientv2) import ( "fmt" "testing" @@ -28,7 +26,7 @@ func gcConfig() *GCConfig { // exitAllocRunner is a helper that updates the allocs on the given alloc // runners to be terminal -func exitAllocRunner(runners ...*allocrunner.AllocRunner) { +func exitAllocRunner(runners ...AllocRunner) { for _, ar := range runners { terminalAlloc := ar.Alloc() terminalAlloc.DesiredStatus = structs.AllocDesiredStatusStop @@ -40,15 +38,19 @@ func TestIndexedGCAllocPQ(t *testing.T) { t.Parallel() pq := NewIndexedGCAllocPQ() - _, ar1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) - _, ar2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) - _, ar3 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) - _, ar4 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) + ar1, cleanup1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup1() + ar2, cleanup2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup2() + ar3, cleanup3 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup3() + ar4, cleanup4 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup4() - pq.Push(ar1) - pq.Push(ar2) - pq.Push(ar3) - pq.Push(ar4) + pq.Push(ar1.Alloc().ID, ar1) + pq.Push(ar2.Alloc().ID, ar2) + pq.Push(ar3.Alloc().ID, ar3) + pq.Push(ar4.Alloc().ID, ar4) allocID := pq.Pop().allocRunner.Alloc().ID if allocID != ar1.Alloc().ID { @@ -119,11 +121,13 @@ func (m *MockStatsCollector) Stats() *stats.HostStats { func TestAllocGarbageCollector_MarkForCollection(t *testing.T) { t.Parallel() - logger := testlog.Logger(t) + logger := testlog.HCLogger(t) gc := NewAllocGarbageCollector(logger, &MockStatsCollector{}, &MockAllocCounter{}, gcConfig()) - _, ar1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) - gc.MarkForCollection(ar1) + ar1, cleanup1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup1() + + gc.MarkForCollection(ar1.Alloc().ID, ar1) gcAlloc := gc.allocRunners.Pop() if gcAlloc == nil || gcAlloc.allocRunner != ar1 { @@ -133,16 +137,19 @@ func TestAllocGarbageCollector_MarkForCollection(t *testing.T) { func TestAllocGarbageCollector_Collect(t *testing.T) { t.Parallel() - logger := testlog.Logger(t) + logger := testlog.HCLogger(t) gc := NewAllocGarbageCollector(logger, &MockStatsCollector{}, &MockAllocCounter{}, gcConfig()) - _, ar1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) - _, ar2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) + ar1, cleanup1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup1() + ar2, cleanup2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup2() + go ar1.Run() go ar2.Run() - gc.MarkForCollection(ar1) - gc.MarkForCollection(ar2) + gc.MarkForCollection(ar1.Alloc().ID, ar1) + gc.MarkForCollection(ar2.Alloc().ID, ar2) // Exit the alloc runners exitAllocRunner(ar1, ar2) @@ -156,13 +163,16 @@ func TestAllocGarbageCollector_Collect(t *testing.T) { func TestAllocGarbageCollector_CollectAll(t *testing.T) { t.Parallel() - logger := testlog.Logger(t) + logger := testlog.HCLogger(t) gc := NewAllocGarbageCollector(logger, &MockStatsCollector{}, &MockAllocCounter{}, gcConfig()) - _, ar1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) - _, ar2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) - gc.MarkForCollection(ar1) - gc.MarkForCollection(ar2) + ar1, cleanup1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup1() + ar2, cleanup2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup2() + + gc.MarkForCollection(ar1.Alloc().ID, ar1) + gc.MarkForCollection(ar2.Alloc().ID, ar2) gc.CollectAll() gcAlloc := gc.allocRunners.Pop() @@ -173,19 +183,22 @@ func TestAllocGarbageCollector_CollectAll(t *testing.T) { func TestAllocGarbageCollector_MakeRoomForAllocations_EnoughSpace(t *testing.T) { t.Parallel() - logger := testlog.Logger(t) + logger := testlog.HCLogger(t) statsCollector := &MockStatsCollector{} conf := gcConfig() conf.ReservedDiskMB = 20 gc := NewAllocGarbageCollector(logger, statsCollector, &MockAllocCounter{}, conf) - _, ar1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) - _, ar2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) + ar1, cleanup1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup1() + ar2, cleanup2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup2() + go ar1.Run() go ar2.Run() - gc.MarkForCollection(ar1) - gc.MarkForCollection(ar2) + gc.MarkForCollection(ar1.Alloc().ID, ar1) + gc.MarkForCollection(ar2.Alloc().ID, ar2) // Exit the alloc runners exitAllocRunner(ar1, ar2) @@ -212,19 +225,22 @@ func TestAllocGarbageCollector_MakeRoomForAllocations_EnoughSpace(t *testing.T) func TestAllocGarbageCollector_MakeRoomForAllocations_GC_Partial(t *testing.T) { t.Parallel() - logger := testlog.Logger(t) + logger := testlog.HCLogger(t) statsCollector := &MockStatsCollector{} conf := gcConfig() conf.ReservedDiskMB = 20 gc := NewAllocGarbageCollector(logger, statsCollector, &MockAllocCounter{}, conf) - _, ar1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) - _, ar2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) + ar1, cleanup1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup1() + ar2, cleanup2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup2() + go ar1.Run() go ar2.Run() - gc.MarkForCollection(ar1) - gc.MarkForCollection(ar2) + gc.MarkForCollection(ar1.Alloc().ID, ar1) + gc.MarkForCollection(ar2.Alloc().ID, ar2) // Exit the alloc runners exitAllocRunner(ar1, ar2) @@ -252,19 +268,22 @@ func TestAllocGarbageCollector_MakeRoomForAllocations_GC_Partial(t *testing.T) { func TestAllocGarbageCollector_MakeRoomForAllocations_GC_All(t *testing.T) { t.Parallel() - logger := testlog.Logger(t) + logger := testlog.HCLogger(t) statsCollector := &MockStatsCollector{} conf := gcConfig() conf.ReservedDiskMB = 20 gc := NewAllocGarbageCollector(logger, statsCollector, &MockAllocCounter{}, conf) - _, ar1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) - _, ar2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) + ar1, cleanup1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup1() + ar2, cleanup2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup2() + go ar1.Run() go ar2.Run() - gc.MarkForCollection(ar1) - gc.MarkForCollection(ar2) + gc.MarkForCollection(ar1.Alloc().ID, ar1) + gc.MarkForCollection(ar2.Alloc().ID, ar2) // Exit the alloc runners exitAllocRunner(ar1, ar2) @@ -288,19 +307,22 @@ func TestAllocGarbageCollector_MakeRoomForAllocations_GC_All(t *testing.T) { func TestAllocGarbageCollector_MakeRoomForAllocations_GC_Fallback(t *testing.T) { t.Parallel() - logger := testlog.Logger(t) + logger := testlog.HCLogger(t) statsCollector := &MockStatsCollector{} conf := gcConfig() conf.ReservedDiskMB = 20 gc := NewAllocGarbageCollector(logger, statsCollector, &MockAllocCounter{}, conf) - _, ar1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) - _, ar2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) + ar1, cleanup1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + cleanup1() + ar2, cleanup2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + cleanup2() + go ar1.Run() go ar2.Run() - gc.MarkForCollection(ar1) - gc.MarkForCollection(ar2) + gc.MarkForCollection(ar1.Alloc().ID, ar1) + gc.MarkForCollection(ar2.Alloc().ID, ar2) // Exit the alloc runners exitAllocRunner(ar1, ar2) @@ -324,13 +346,15 @@ func TestAllocGarbageCollector_MakeRoomForAllocations_GC_Fallback(t *testing.T) // TestAllocGarbageCollector_MaxAllocs asserts that when making room for new // allocs, terminal allocs are GC'd until old_allocs + new_allocs <= limit func TestAllocGarbageCollector_MaxAllocs(t *testing.T) { + t.Skip("Test fails, unsure if behaviour change or broken test") + t.Parallel() server, serverAddr := testServer(t, nil) defer server.Shutdown() testutil.WaitForLeader(t, server.RPC) const maxAllocs = 6 - client := TestClient(t, func(c *config.Config) { + client, cleanup := TestClient(t, func(c *config.Config) { c.GCMaxAllocs = maxAllocs c.GCDiskUsageThreshold = 100 c.GCInodeUsageThreshold = 100 @@ -341,14 +365,14 @@ func TestAllocGarbageCollector_MaxAllocs(t *testing.T) { c.Servers = []string{serverAddr} c.ConsulConfig.ClientAutoJoin = new(bool) // squelch logs }) - defer client.Shutdown() + defer cleanup() waitTilNodeReady(client, t) callN := 0 assertAllocs := func(expectedAll, expectedDestroyed int) { // Wait for allocs to be started callN++ - client.logger.Printf("[TEST] %d -- Waiting for %d total allocs, %d GC'd", callN, expectedAll, expectedDestroyed) + client.logger.Info(fmt.Sprintf("[TEST] %d -- Waiting for %d total allocs, %d GC'd", callN, expectedAll, expectedDestroyed)) testutil.WaitForResult(func() (bool, error) { all, destroyed := 0, 0 for _, ar := range client.getAllocRunners() { @@ -362,10 +386,10 @@ func TestAllocGarbageCollector_MaxAllocs(t *testing.T) { expectedAll, all, expectedDestroyed, destroyed, ) }, func(err error) { - client.logger.Printf("[TEST] %d -- FAILED to find %d total allocs, %d GC'd!", callN, expectedAll, expectedDestroyed) + client.logger.Info(fmt.Sprintf("[TEST] %d -- FAILED to find %d total allocs, %d GC'd!", callN, expectedAll, expectedDestroyed)) t.Fatalf("%d alloc state: %v", callN, err) }) - client.logger.Printf("[TEST] %d -- Found %d total allocs, %d GC'd!", callN, expectedAll, expectedDestroyed) + client.logger.Info(fmt.Sprintf("[TEST] %d -- Found %d total allocs, %d GC'd!", callN, expectedAll, expectedDestroyed)) } // Create a job @@ -453,19 +477,22 @@ func TestAllocGarbageCollector_MaxAllocs(t *testing.T) { func TestAllocGarbageCollector_UsageBelowThreshold(t *testing.T) { t.Parallel() - logger := testlog.Logger(t) + logger := testlog.HCLogger(t) statsCollector := &MockStatsCollector{} conf := gcConfig() conf.ReservedDiskMB = 20 gc := NewAllocGarbageCollector(logger, statsCollector, &MockAllocCounter{}, conf) - _, ar1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) - _, ar2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) + ar1, cleanup1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup1() + ar2, cleanup2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup2() + go ar1.Run() go ar2.Run() - gc.MarkForCollection(ar1) - gc.MarkForCollection(ar2) + gc.MarkForCollection(ar1.Alloc().ID, ar1) + gc.MarkForCollection(ar2.Alloc().ID, ar2) // Exit the alloc runners exitAllocRunner(ar1, ar2) @@ -489,19 +516,22 @@ func TestAllocGarbageCollector_UsageBelowThreshold(t *testing.T) { func TestAllocGarbageCollector_UsedPercentThreshold(t *testing.T) { t.Parallel() - logger := testlog.Logger(t) + logger := testlog.HCLogger(t) statsCollector := &MockStatsCollector{} conf := gcConfig() conf.ReservedDiskMB = 20 gc := NewAllocGarbageCollector(logger, statsCollector, &MockAllocCounter{}, conf) - _, ar1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) - _, ar2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc(), false) + ar1, cleanup1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup1() + ar2, cleanup2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup2() + go ar1.Run() go ar2.Run() - gc.MarkForCollection(ar1) - gc.MarkForCollection(ar2) + gc.MarkForCollection(ar1.Alloc().ID, ar1) + gc.MarkForCollection(ar2.Alloc().ID, ar2) // Exit the alloc runners exitAllocRunner(ar1, ar2) @@ -524,4 +554,3 @@ func TestAllocGarbageCollector_UsedPercentThreshold(t *testing.T) { t.Fatalf("gcAlloc: %v", gcAlloc) } } -*/ From f3c057d7e01e4257cfbcae8e71730693e53a89a9 Mon Sep 17 00:00:00 2001 From: Danielle Tomlinson Date: Wed, 5 Dec 2018 16:24:06 +0100 Subject: [PATCH 15/17] client/gc: Replace GC integration test with unit The previous integration test was broken during the client refactor, and it seems to be some sort of race with state updating. I'm going to try and construct a replacement test as part of work on performance, but for now, the underlying behaviour is still being tested. --- client/gc_test.go | 155 +++++++++++----------------------------------- 1 file changed, 35 insertions(+), 120 deletions(-) diff --git a/client/gc_test.go b/client/gc_test.go index c20fb7adb..4ddecbe13 100644 --- a/client/gc_test.go +++ b/client/gc_test.go @@ -1,17 +1,15 @@ package client import ( - "fmt" "testing" "time" "github.com/hashicorp/nomad/client/allocrunner" - "github.com/hashicorp/nomad/client/config" "github.com/hashicorp/nomad/client/stats" "github.com/hashicorp/nomad/helper/testlog" "github.com/hashicorp/nomad/nomad/mock" "github.com/hashicorp/nomad/nomad/structs" - "github.com/hashicorp/nomad/testutil" + "github.com/stretchr/testify/require" ) func gcConfig() *GCConfig { @@ -343,136 +341,53 @@ func TestAllocGarbageCollector_MakeRoomForAllocations_GC_Fallback(t *testing.T) } } -// TestAllocGarbageCollector_MaxAllocs asserts that when making room for new +// TestAllocGarbageCollector_MakeRoomFor_MaxAllocs asserts that when making room for new // allocs, terminal allocs are GC'd until old_allocs + new_allocs <= limit -func TestAllocGarbageCollector_MaxAllocs(t *testing.T) { - t.Skip("Test fails, unsure if behaviour change or broken test") - +func TestAllocGarbageCollector_MakeRoomFor_MaxAllocs(t *testing.T) { t.Parallel() - server, serverAddr := testServer(t, nil) - defer server.Shutdown() - testutil.WaitForLeader(t, server.RPC) + logger := testlog.HCLogger(t) + statsCollector := &MockStatsCollector{} + conf := gcConfig() + conf.MaxAllocs = 3 + gc := NewAllocGarbageCollector(logger, statsCollector, &MockAllocCounter{}, conf) - const maxAllocs = 6 - client, cleanup := TestClient(t, func(c *config.Config) { - c.GCMaxAllocs = maxAllocs - c.GCDiskUsageThreshold = 100 - c.GCInodeUsageThreshold = 100 - c.GCParallelDestroys = 1 - c.GCInterval = time.Hour + ar1, cleanup1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup1() + ar2, cleanup2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup2() + ar3, cleanup3 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) + defer cleanup3() - c.RPCHandler = server - c.Servers = []string{serverAddr} - c.ConsulConfig.ClientAutoJoin = new(bool) // squelch logs - }) - defer cleanup() - waitTilNodeReady(client, t) + go ar1.Run() + go ar2.Run() + go ar3.Run() - callN := 0 - assertAllocs := func(expectedAll, expectedDestroyed int) { - // Wait for allocs to be started - callN++ - client.logger.Info(fmt.Sprintf("[TEST] %d -- Waiting for %d total allocs, %d GC'd", callN, expectedAll, expectedDestroyed)) - testutil.WaitForResult(func() (bool, error) { - all, destroyed := 0, 0 - for _, ar := range client.getAllocRunners() { - all++ - if ar.IsDestroyed() { - destroyed++ - } - } - return all == expectedAll && destroyed == expectedDestroyed, fmt.Errorf( - "expected %d allocs (found %d); expected %d destroy (found %d)", - expectedAll, all, expectedDestroyed, destroyed, - ) - }, func(err error) { - client.logger.Info(fmt.Sprintf("[TEST] %d -- FAILED to find %d total allocs, %d GC'd!", callN, expectedAll, expectedDestroyed)) - t.Fatalf("%d alloc state: %v", callN, err) - }) - client.logger.Info(fmt.Sprintf("[TEST] %d -- Found %d total allocs, %d GC'd!", callN, expectedAll, expectedDestroyed)) - } + exitAllocRunner(ar1) - // Create a job - state := server.State() - job := mock.Job() - job.TaskGroups[0].Tasks[0].Driver = "mock_driver" - job.TaskGroups[0].Tasks[0].Config = map[string]interface{}{ - "run_for": "30s", - } - nodeID := client.Node().ID - if err := state.UpsertJob(98, job); err != nil { - t.Fatalf("error upserting job: %v", err) - } - if err := state.UpsertJobSummary(99, mock.JobSummary(job.ID)); err != nil { - t.Fatalf("error upserting job summary: %v", err) - } + gc.MarkForCollection(ar1.Alloc().ID, ar1) + gc.MarkForCollection(ar2.Alloc().ID, ar2) + gc.MarkForCollection(ar3.Alloc().ID, ar3) - newAlloc := func() *structs.Allocation { - alloc := mock.Alloc() - alloc.JobID = job.ID - alloc.Job = job - alloc.NodeID = nodeID - return alloc - } - - // Create the allocations - allocs := make([]*structs.Allocation, 7) - for i := 0; i < len(allocs); i++ { - allocs[i] = newAlloc() - } - - // Upsert a copy of the allocs as modifying the originals later would - // cause a race { - allocsCopy := make([]*structs.Allocation, len(allocs)) - for i, a := range allocs { - allocsCopy[i] = a.Copy() - } - if err := state.UpsertAllocs(100, allocsCopy); err != nil { - t.Fatalf("error upserting initial allocs: %v", err) - } + alloc := mock.Alloc() + err := gc.MakeRoomFor([]*structs.Allocation{alloc}) + require.NoError(t, err) } - // 7 total, 0 GC'd - assertAllocs(7, 0) + // We GC a single alloc runner. + require.Equal(t, true, ar1.IsDestroyed()) + require.Equal(t, false, ar2.IsDestroyed()) - // Set the first few as terminal so they're marked for gc - const terminalN = 4 - for i := 0; i < terminalN; i++ { - // Copy the alloc so the pointers aren't shared - alloc := allocs[i].Copy() - alloc.DesiredStatus = structs.AllocDesiredStatusStop - allocs[i] = alloc - } - if err := state.UpsertAllocs(101, allocs[:terminalN]); err != nil { - t.Fatalf("error upserting stopped allocs: %v", err) + { + alloc := mock.Alloc() + err := gc.MakeRoomFor([]*structs.Allocation{alloc}) + require.NoError(t, err) } - // 7 total, 1 GC'd to get down to limit of 6 - assertAllocs(7, 1) - - // Add one more alloc - if err := state.UpsertAllocs(102, []*structs.Allocation{newAlloc()}); err != nil { - t.Fatalf("error upserting new alloc: %v", err) - } - - // 8 total, 1 GC'd to get down to limit of 6 - // If this fails it may be due to the gc's Run and MarkRoomFor methods - // gc'ing concurrently. May have to disable gc's run loop if this test - // is flaky. - assertAllocs(8, 2) - - // Add new allocs to cause the gc of old terminal ones - newAllocs := make([]*structs.Allocation, 4) - for i := 0; i < len(newAllocs); i++ { - newAllocs[i] = newAlloc() - } - if err := state.UpsertAllocs(200, newAllocs); err != nil { - t.Fatalf("error upserting %d new allocs: %v", len(newAllocs), err) - } - - // 12 total, 4 GC'd total because all other allocs are alive - assertAllocs(12, 4) + // We GC a second alloc runner. + require.Equal(t, true, ar1.IsDestroyed()) + require.Equal(t, true, ar2.IsDestroyed()) + require.Equal(t, false, ar3.IsDestroyed()) } func TestAllocGarbageCollector_UsageBelowThreshold(t *testing.T) { From 5fd8d3fe681c791693e36ae98b12d67770d2a116 Mon Sep 17 00:00:00 2001 From: Mahmood Ali Date: Tue, 4 Dec 2018 07:31:30 -0500 Subject: [PATCH 16/17] tests: ensure image is loaded as test setup --- drivers/docker/driver_test.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/docker/driver_test.go b/drivers/docker/driver_test.go index 5ecc3c725..793fd8115 100644 --- a/drivers/docker/driver_test.go +++ b/drivers/docker/driver_test.go @@ -433,6 +433,11 @@ func TestDockerDriver_Start_StoppedContainer(t *testing.T) { defer cleanup() copyImage(t, task.TaskDir(), "busybox.tar") + client := newTestDockerClient(t) + imageID, err := d.Impl().(*Driver).loadImage(task, &taskCfg, client) + require.NoError(t, err) + require.NotEmpty(t, imageID) + // Create a container of the same name but don't start it. This mimics // the case of dockerd getting restarted and stopping containers while // Nomad is watching them. @@ -444,12 +449,11 @@ func TestDockerDriver_Start_StoppedContainer(t *testing.T) { }, } - client := newTestDockerClient(t) if _, err := client.CreateContainer(opts); err != nil { t.Fatalf("error creating initial container: %v", err) } - _, _, err := d.StartTask(task) + _, _, err = d.StartTask(task) require.NoError(t, err) defer d.DestroyTask(task.ID, true) From f6e2687f5b936088996a22d75940659b476ae528 Mon Sep 17 00:00:00 2001 From: Danielle Tomlinson Date: Thu, 6 Dec 2018 15:04:37 +0100 Subject: [PATCH 17/17] gc: Fix maxallocs integration test --- client/gc_test.go | 168 ++++++++++++++++++++++++++++++++++++---------- 1 file changed, 131 insertions(+), 37 deletions(-) diff --git a/client/gc_test.go b/client/gc_test.go index 4ddecbe13..b40030368 100644 --- a/client/gc_test.go +++ b/client/gc_test.go @@ -1,14 +1,18 @@ package client import ( + "fmt" "testing" "time" "github.com/hashicorp/nomad/client/allocrunner" + "github.com/hashicorp/nomad/client/config" "github.com/hashicorp/nomad/client/stats" "github.com/hashicorp/nomad/helper/testlog" + "github.com/hashicorp/nomad/nomad" "github.com/hashicorp/nomad/nomad/mock" "github.com/hashicorp/nomad/nomad/structs" + "github.com/hashicorp/nomad/testutil" "github.com/stretchr/testify/require" ) @@ -344,50 +348,140 @@ func TestAllocGarbageCollector_MakeRoomForAllocations_GC_Fallback(t *testing.T) // TestAllocGarbageCollector_MakeRoomFor_MaxAllocs asserts that when making room for new // allocs, terminal allocs are GC'd until old_allocs + new_allocs <= limit func TestAllocGarbageCollector_MakeRoomFor_MaxAllocs(t *testing.T) { - t.Parallel() - logger := testlog.HCLogger(t) - statsCollector := &MockStatsCollector{} - conf := gcConfig() - conf.MaxAllocs = 3 - gc := NewAllocGarbageCollector(logger, statsCollector, &MockAllocCounter{}, conf) + const maxAllocs = 6 + require := require.New(t) - ar1, cleanup1 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) - defer cleanup1() - ar2, cleanup2 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) - defer cleanup2() - ar3, cleanup3 := allocrunner.TestAllocRunnerFromAlloc(t, mock.Alloc()) - defer cleanup3() + server, serverAddr := testServer(t, nil) + defer server.Shutdown() + testutil.WaitForLeader(t, server.RPC) - go ar1.Run() - go ar2.Run() - go ar3.Run() + client, cleanup := TestClient(t, func(c *config.Config) { + c.GCMaxAllocs = maxAllocs + c.GCDiskUsageThreshold = 100 + c.GCInodeUsageThreshold = 100 + c.GCParallelDestroys = 1 + c.GCInterval = time.Hour + c.RPCHandler = server + c.Servers = []string{serverAddr} + c.ConsulConfig.ClientAutoJoin = new(bool) + }) + defer cleanup() + waitTilNodeReady(client, t) - exitAllocRunner(ar1) - - gc.MarkForCollection(ar1.Alloc().ID, ar1) - gc.MarkForCollection(ar2.Alloc().ID, ar2) - gc.MarkForCollection(ar3.Alloc().ID, ar3) - - { - alloc := mock.Alloc() - err := gc.MakeRoomFor([]*structs.Allocation{alloc}) - require.NoError(t, err) + job := mock.Job() + job.TaskGroups[0].Count = 1 + job.TaskGroups[0].Tasks[0].Driver = "mock_driver" + job.TaskGroups[0].Tasks[0].Config = map[string]interface{}{ + "run_for": "30s", } - // We GC a single alloc runner. - require.Equal(t, true, ar1.IsDestroyed()) - require.Equal(t, false, ar2.IsDestroyed()) - - { - alloc := mock.Alloc() - err := gc.MakeRoomFor([]*structs.Allocation{alloc}) - require.NoError(t, err) + index := uint64(98) + nextIndex := func() uint64 { + index++ + return index } - // We GC a second alloc runner. - require.Equal(t, true, ar1.IsDestroyed()) - require.Equal(t, true, ar2.IsDestroyed()) - require.Equal(t, false, ar3.IsDestroyed()) + upsertJobFn := func(server *nomad.Server, j *structs.Job) { + state := server.State() + require.NoError(state.UpsertJob(nextIndex(), j)) + require.NoError(state.UpsertJobSummary(nextIndex(), mock.JobSummary(j.ID))) + } + + // Insert the Job + upsertJobFn(server, job) + + upsertAllocFn := func(server *nomad.Server, a *structs.Allocation) { + state := server.State() + require.NoError(state.UpsertAllocs(nextIndex(), []*structs.Allocation{a})) + } + + upsertNewAllocFn := func(server *nomad.Server, j *structs.Job) *structs.Allocation { + alloc := mock.Alloc() + alloc.Job = j + alloc.JobID = j.ID + alloc.NodeID = client.NodeID() + + upsertAllocFn(server, alloc) + + return alloc.Copy() + } + + var allocations []*structs.Allocation + + // Fill the node with allocations + for i := 0; i < maxAllocs; i++ { + allocations = append(allocations, upsertNewAllocFn(server, job)) + } + + // Wait until the allocations are ready + testutil.WaitForResult(func() (bool, error) { + ar := len(client.getAllocRunners()) + + return ar == maxAllocs, fmt.Errorf("Expected %d allocs, got %d", maxAllocs, ar) + }, func(err error) { + t.Fatalf("Allocs did not start: %v", err) + }) + + // Mark the first three as terminal + for i := 0; i < 3; i++ { + allocations[i].DesiredStatus = structs.AllocDesiredStatusStop + upsertAllocFn(server, allocations[i].Copy()) + } + + // Wait until the allocations are stopped + testutil.WaitForResult(func() (bool, error) { + ar := client.getAllocRunners() + stopped := 0 + for _, r := range ar { + if r.Alloc().TerminalStatus() { + stopped++ + } + } + + return stopped == 3, fmt.Errorf("Expected %d terminal allocs, got %d", 3, stopped) + }, func(err error) { + t.Fatalf("Allocs did not terminate: %v", err) + }) + + // Upsert a new allocation + // This does not get appended to `allocations` as we do not use them again. + upsertNewAllocFn(server, job) + + // A single allocation should be GC'd + testutil.WaitForResult(func() (bool, error) { + ar := client.getAllocRunners() + destroyed := 0 + for _, r := range ar { + if r.IsDestroyed() { + destroyed++ + } + } + + return destroyed == 1, fmt.Errorf("Expected %d gc'd ars, got %d", 1, destroyed) + }, func(err error) { + t.Fatalf("Allocs did not get GC'd: %v", err) + }) + + // Upsert a new allocation + // This does not get appended to `allocations` as we do not use them again. + upsertNewAllocFn(server, job) + + // 2 allocations should be GC'd + testutil.WaitForResult(func() (bool, error) { + ar := client.getAllocRunners() + destroyed := 0 + for _, r := range ar { + if r.IsDestroyed() { + destroyed++ + } + } + + return destroyed == 2, fmt.Errorf("Expected %d gc'd ars, got %d", 2, destroyed) + }, func(err error) { + t.Fatalf("Allocs did not get GC'd: %v", err) + }) + + require.Len(client.getAllocRunners(), 8) } func TestAllocGarbageCollector_UsageBelowThreshold(t *testing.T) {