From 66337f2ab919e961ee1b06f2b778cf58be02f305 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?andr=C3=A9s=20gonz=C3=A1lez?= <andres.gonzalez79@gmail.com>
Date: Mon, 4 May 2026 09:34:19 +0200
Subject: [PATCH 1/6] :books: Add WebGL Troubleshooting Guide

---
 .../troubleshooting-chrome.webp               | Bin 0 -> 17308 bytes
 .../troubleshooting-firefox.webp              | Bin 0 -> 14950 bytes
 .../first-steps/troubleshooting-webgl.njk     | 107 ++++++++++++++++++
 3 files changed, 107 insertions(+)
 create mode 100644 docs/img/troubleshooting/troubleshooting-chrome.webp
 create mode 100644 docs/img/troubleshooting/troubleshooting-firefox.webp
 create mode 100644 docs/user-guide/first-steps/troubleshooting-webgl.njk

diff --git a/docs/img/troubleshooting/troubleshooting-chrome.webp b/docs/img/troubleshooting/troubleshooting-chrome.webp
new file mode 100644
index 0000000000000000000000000000000000000000..a999f41b2db73ac69905771626e99b1acd3ac449
GIT binary patch
literal 17308
zcmXVWV{m3o*Yy?Kwr$(CJ+W;Y6Whil6Wg|JV`AHW^L+Q$zfRSuuHNpoc5h`Vaq(mk
z06;@bSW#V(Q#SnPn_;wH9H15z)NGsH{GoMC06<~_^2m`{%I&vhXCE8#ESB-nAg1aN
zqPG!NIcJ)|qz_Y?$|pPRl9PV?rb)%6U_mkaZ;?a&3(EL!RoJQ7@nOCosFDu$rNrN}
zHU>gtc~n4RA|TzUBh8{ai3@sSIv{#=+|6RI18^X*PfUOPg0m$pQC~C9P7ZxS1kw=k
zj0o=Ym1m6(oWCJG80^gtJU+0ZgtILe7QAe*rce;^4i8wLp;r*G4i8L>Px`!A7qnEI
zZH6=cV%)&Pw%TYm6!~CvR`|xNv)z}RZ_co-**dqKX4rcEuJOm=@{eo)$>kgCjey`w
zU16?7n;_ANHH|T$Q6_C57OSgj`a9Z8Txevyj1|T^y}Hi{&#68dK@n?tu|HTh>}Y~2
z+Kf7pN*6_})l4kGEg`WpbNu-lDXV?P>~&PVsYkb+ilzF?3^sZ3P)?!UeNxeEbct2*
zs%BCa#67BqnWb>6LDSA@*nCVZCrK(J!!X0}UrTfwjf(QqBeQ+;^t|qABvy6m)%fHK
z0wXCGHA@SZ%F(iU2KX;Ki0W~yos^7>IeO<DJ*F1!h8vmzG?snkX-|w)tno>Yl~R+m
zj6Rj&Z06R@i|g{q$;nIRB<Cjij5*zIT9%?NBex8tzot)aK!8|_jb<sT5YY(A!e=uZ
zmI~Xa@9#&>>H812YTwL6z4+wq_?6@jUjTq?uGyCKO4`tZ5ji|kr&Y&t`e4m5dqRV=
zr}ydF({JGZV=8;9%=py8j>Ik`5;I~?`C#5(I+_&9uJD%u{3goptFyyIW-Vo7bG>A1
zTOB$oLsrB@p5)4n#^=NNlFg>A|G%0xE7lLIxxc>&E-DAKA&w_$!0HXgqXC+rhG;=x
zDnyKApv0xDH_NQtk-3Igi$>a>@gOQ`tXI(m(^lhWg7k&WsF+)rULkP0+F`BYia?C6
zE1;N7(U^&lP(CN|kknAf4g@R$P>e=MAY%`u<}D>D;Fj^iGmr(!@q~bYM9E-jf+#yg
zoNxbdp*3GtSoWA4WKaMt36=3iv+V}EdZ81qx7VlZf<K21DOKX}OPN4nPS}ImKg}io
z_SjuC!2Bu!C%_7}L=XIy3@{Hph$%<Nmia_n$^eK4FU<^9rMw=>ESNFo3;WjqC<@It
zg+rskRQXi_mMWCHYndy2BLz@anWaJ;fM%^zM(RffXCgRO!apLy2hh5ToMjCnq8rF+
z*&`i833JqA8f;_OirHau4I=Y^SwnWcVm|LW-z+jbvHXVj2Q!Q*7%X}=asn((swBap
zsrS~f;0h>kg-hRe8;7g48b^sDI8oqA+BTCIL6K~}hKgMGhbmv7y23iL>v>YnZDmmk
zQvLSQpb+^@Y}SUjHPgh%=qqla%S~;7K19dkcPq`A{w6c$UJ1Y$xNt{E11U*nePDqD
zo9zfx9j7Fh?KkbE@|Q8-L>TC$#l{zb>J$z&DqKJ<O8n!MR`<YT;oR4}DBjdr68dda
zs%Ciq@v42l$EgALt+N^o4VgPKBrEX@t+%|;49b{JXp+0_o}n>sY7C?8b9etMDRcK|
zngKK@Ox=adaKq$D212#Tph){TYck5xdKE<I9XU@OKP}hnLpgsU;%~#&QWtY>%RxQo
zNomH5QFe(cB*Io7{iR_W>O@KJAzhGxG678o!pjRG1OKa>n4RA7fw;Xz5!=xOJv~^T
zkX&8*(a=Tn{csO8JzS9_8G8P)2|Te8HPp=hoYO^pJ0AhP%UuU&Goi_nBbbQq?=vq$
z{Qb&(+?0S6r%#dlRnp;?d!o5171J<oAZf66njzej?-<CJ8=#@eq^H=$9Z<gjtC%Y7
zcSdjs{L*<wgm=>QX>6o6^23G-CsID;e4?kyRkRXC1_^LD8T*dt<ZaI!;CymESu#kk
ztjah9aJ=pKbwu!uok?A~7YG>Ha4bP8(Dw#O>+%Fq;G=8`q~Al`_>1x_QMs^4EYOv-
zR57otmK%By8=>enO6{TO(u1wZyl%i*HicF7S3;x0w19B+T0dv^zb;9)tPPbj&R@cf
zZsz+e`>Tlg|Jt!FOhjXA%=!+G6Z$O$y34Zdm(iBZG)>KLahOf&MeO4kt==oCK2>5t
z@}{~#lMt5L{0lLe=8Eh(UqHg)Bu0Px@fmTVcgr1c$+}1X3(s4(J6*+ag<Hk;pI-Id
zCWh7XVgFNMd)N;pb=_?PDuCWC?=oP0%8#mU!(nRi%6f=v<3>U#cuvh@==(8zh+7{j
z1jV_oy5<<R-?{$Ry|kq8K2n{5^zcy>JZ&M%J*r)zN$0{N`Q?nhyIZJ$W_wp=6vvC{
zirrs02rvN}ofJwHDK4v%kzgcZ1x&DgOT@YeV)++$rfE8Jun6@XNUpQvrc;|(PqICU
z4vs#zczn#<`p@cd{!lI|mF=ZtrEj0DEh-Y<te=%u#^*D%hTJN!wQR7(RB|HYH2K6n
z#-BQOC87mku~{fYbTjE&vVR;zf4DfZxr+LKyF{J@#zsQ^`X%dkK8)VLG)5N~eCQ47
zWVvc;Ou|~?jRL*T(e2F=L;g#zSRlved?O*8&3orBO!VhC7qQmGTyU8Ehh8NeX2QSU
zR4Knj{W>q9J=@o~{LW9jg8(c`8KaO}{+U|Os~)sH8zvl`mG@up&5+lL+^gB#BnD`~
zqPEj)p9@k)Tz*ER#K4YFE|sgr<EF>O0xY@iAI#_@X=<9dc3G->TNj5hy^=n<^__?~
z0j#)DtX)@5%yGBK&<2!Zy}ald`XBVa+icZPk=pQB;O=gF@2RoZV137!Eogq#UwK=o
z;<{PaM{t9^S;<P3M{+1pGXKJtsFvbNK;dYZ(H^K@E-kY@ScYIlmR5!<y<j(h80Uhx
zlpWb{h1#&dkJf;4M>vxJF@hnea~<XC5Nb0!FKb6|QX1C{;}pE`ZRFRHcAK4VzN{Z7
zzlh9S$Ln)>$YZ)cdBEO!YxBFg%_Y)-YbqSS^~|qCws=)`l6mxyniLYrq3&`Fn;3h5
zc~{(uP)(xVGiNnI%eoPBoV3PSi3&bh{!W47E$+TTWi`5U<Z`gO+`C0TW!>ZBO{E@7
zn>Fg|F8cLy*2FpwpIeHs9<j-4*wA=KnC5o+?|NLasY>Ir=_ndvem#(PnVH_ECKW7V
zyLG-|>@G@y_d8{*y5J4{F2>m<E3ExxKEk>0EwzD+n^%MHl0Ms8o#v*+#^8YX7<VU5
zi3^kdn%ErYAm!s+Y??q2Mw@cx948zY>HOBSjJcbph&|qD5GJ7~G*k152D^lfY15=^
zli4lnN1TG4)&UKYoVuu%zuGA#Gceu*5#jPFR*41N#|p?uNJx}#g55!7;@%~1epDlW
zs_|Rg;ToVHZCSt<JohYIzsqpbGCbXu_Tg7GxlAIPde*Gp@RGPJF&4lhg&H!}kM9k?
z9wL7+(aYu{{lpEIV5MJ~(Z_4PTl7XAp>umiZ4=$MHx|>ahT7pEE0@;su2%%sfInuo
z38kD3DX!0DrLZTh_QD~lP293<1tWUd+Ix*E{Yn0xf2Xd{j|~8gq@&)~;y$H$wt2HF
zQH@GR4-N!RA_@*=&Pxfsu{J)rOfdy3kK)fu#YQvfhzbwX-O4-~Uc=zk&?E}K`=>5e
zq4jc7i104c%iXPS2vqdXcae=zr2*=Jx*d3vp$CfF8uXCL?E?I&j80ZKj`TSm0v|a?
z1wWbSQbBv#xPx%fnS0d(%~Ov{r$(Z1J70P)0YT5k9ve!#r_ADXQ(YOn+>rJ5aWvf`
zz~;@EJ+>jX2ElNQvcKel0t^0c_3>M?ryZKaam&ONx<dXJ=c;8YNwkEx!<;jn{dzTE
z7{uG~h0P@TC%?TKyVwbdOpJwP;5&J%q-rOD0Qj|q?FHdA+89AB(aNn?ay4jritM+0
zes1nLu1g~;p-4APE+T7f2**<eJ7XXXRI*-@RNrAp8G)v#p%~PWdlm7)<;9to#O~!D
zSYl#g#blq790cfyzSW^Uu-_#Dn;viW&&d-9u!q49%r7@ZNb7!JfkuEuQ+aQU`i|_O
za6Vy3q`+2O!euetrqW-j&Yx!Nr%9KUb!rocT9;cj!AzbMO>*URJL;XQ^k;CxI%w0z
zPPw&_V)P{R!V4lj2Lp#xBv0>BC9(p{@)=VPh3{$rce_7QT$vlq$)4xmpf7+rrSz64
zYjMYbRSBt;S>3v}PGcS*A--Zhd>T8XZ87^pBnw88Tnbm(eGn`VKG6~mdvpnUZpp!|
z4HHuF&4naqFs<AWZSPHmbrfUw326rJtQ~DnEIgP13%?EI*kL5YCDKk;y4^}-8o4NA
z^4je&Q~!FE8mh$mCv6=rI(xPay9M|FY8=MPf1d)PfG&#yH!iV2W|MH4c=M3(umsu&
z9&HK2Au#J_>-Ea)@R*nW%%iL!sElb8N#iFO-Wg3qL_9n^nAs!}Z-@RXyQ}ZGd4L#K
zNRNBUE@igmjcdvRDX#+Au@|SGuw_v5R=N;VZ;S?O0pluiv+qzbJ6;4O=pO#9igkqu
z;qtC8zc%i#Soa16L!~Qx7k(W(Td8b@g3g<7wNQ84`O2r-&*sykvMqWJrpKLID2IU#
zeTw|fcsa=2m9DvC5%zm}TqLBsBzdm*%_R38_!$RbZ!38X6Pyv}%u;KcuNSDbBybk5
z(}tH+%EnUMY+(!0dDdS$o>FTm6gsBjPIE#=cfJ^GQ&|PAYiM#+Cfjfd!t@xgtK(mK
z{e2*KWwD1iwphaWvle0c#NV@>cV=n5tJ&#CxQh!L?jlHaaZh>XboMD@J@`f+T4QGx
zDu=usV6;xlv%+GvnAx=*enr4R``eJpHtJNv$5opODKZq`#%>#Q)}^amX)!fDWFJ^J
zN!Sd`CeIZ5v0(Va8yj@)>fffv{r&0<fkv~9VH|Mx<kyPdx<>_B%5WBVqM&<Drhq!H
zH}CI~x^%FJxz>RdDl;vb@=afmvp`q$oy5Y5JMoY?bGEYciYAeq0Qc{XAGi6HX?v+A
zKkvgASDBg?E!mb|s0;uhxz8B*p6>_K^4eZfm1f&-&L~=cXt{2xuJ2UqsC?jK2vih+
z{(emFi_JTZ0(rCWb%U|3PdNI;(oKq{>W2X8i%;+DzUG?m3#^_9o%b<=Cs=-Bm!J4e
z9rufXh2)$Ds6?8^)Lz#Q326~!oEdcd65nq~ne<^-$OSZ8pH_OmG(*~3kYT7jCG0EX
z1-X5QM)5}3md-om_E_W(p`7L;NEdRR4NIZwI<hVItH@^HWSI??&c;#5(>(m}=9Pz^
z1^>Vre-9J32K>@}dCpq{<?&x!S)IHIUmMU}tk}S_6~x6W)aF6ErWGy%f)E5O?NYH$
z1oVFBE~EOA5hsyh)<JTu?e($j2asT@v(d`xgr|q5BNvV~QnX)wPf~7`TNUJ<D%(y6
z2vo{!YdUVCgFDTaf1Ka&E?pqLtjC`Q9g^V8@93txADDM@%F)`)eyu-b5o^*yL<+HR
zMiiy$iV{z)MY7uZU4}yr9s=r~#vZml{cu{!oFey6p&B8EWc|4_H;OtSJoD$}(+_>T
zpIap9%N7_=fUS$s^_APHdqBU{9J}#qKHlo}9bbJ3kx8~U^_rh*&-J<p5P>vRDkU5K
zd=R<Qz=n408BMqJsm~6CNg>=zmu$G!xkbtKMa~&Rgp^G~0xYI#$A2)(ERE-r>H#Ms
zh~GY~eefzGp}#Yw#@hqowYTfUX8Pa9wWWFARebb&SgSCcu7M~fcw2tc#_Ib0x{uxN
zelFM0O*u_3RUhxC(45#<Va+7#F=k~O!5X)|DcMAU0{-DGyP!^WGInba;|%Y_b=_)>
zHRP@sd9VH=%QeX<&rWTs5u@R#gl?U)1u9pLl5x#r+Z+BrNx1_AnaH>AG6_#`wL5DH
zH71zHe%hslrhyo$1-e_@4bidc?H-vIInk*4>bWg_GtobV!ps|^<V#HaevAT6WpN9=
z+6hbh<2^h@BsykLQFJg}3+zb&@2YTfZtS}*9*Vuhd;k6iu-`<=xx0|!D8gdzs!1^k
zKLE)!PB@4b4UxHn)cpb5k{!66o6Fp|VLl0ze&x9^kC|?SX==K7X;)^daf%S*VIH5&
znwKuFxWpmL*+wMnO&75I!6(7A?fIL$@u}Z%!yBPQX7^*)KFoA`eyIJ6%sG2F`?_Bo
zMy*Ps_!%r~;#;~RB*jnZek$=|D-k5Dc%QQ_{RB5arLnJa#C0f}?H~3r&Ifym{%$V7
z5V>a8JrqJ{x+U=4l2vxk4lU?waL@c0Bg>DUhGbtJFO+e-`TCCpOaAcuf^UIk0lySK
zB_8wWxlhDjFz^e$oAu)nYsFE57^d=P;uwss5bU6XqGOK~lEx8q@Q~BClun<Mf^2ul
z*`(V;bCHaGNKAR(8$0t!!5a}2Jn*KbRQPUCF}|8h-04vDx*h5f({#s1Ngl3(Q>EYA
zU4iFjz=H@fEog0BA|h)eG5VCU<g9Iwe{F9_ZiE!%lQ~JQ8!zOfxag+HU(FUAj3oOT
zOLj&n+=PeNzhOf?$%{lk90nIHPbhj1Yh`AXk7(pjcY*=ZURKlV7|z_~weQ3tBsT2o
z6~qNp7=RQ%Eu?J)L7l<?gH3}p>l@ZvEQLq{+f5UiWpglY<<ET{y?KI{IgLUnHyaLV
zQ5-V&IhvDqN>cOhZ)%@eQ`jI}X<xKog2uhp$kT2K+b_+BYXrG_4(5Od3Ed1sW`AR2
ziW63G)<i_5>aCQ5p)~c`XuD0eZ~b8z%Gm!<{apkH@1+MJaR*Yu-~GVjyh&((`S)e@
z2D`A>Rdx8ht$gj{6_uu}h+Lv~G~hR^-5bBIgBL5a1|Rn7ub#o<K)$;64**`wL%}`}
zpMOBCAg3T`kuzdE^o3u*6%Q!8obY<3BBaWM&xdXE!BuYaQ0Caq+zjYEXiRtjrRG*#
z<<r;sw_<+=xW3wEvcCl8-Ad~eRJl~k-u<|V^cBj&k0Q2(uXc?_+xuL0Ss~?<Sg{Jc
z3xs(mr(6*gUt=nzd0@KNA(wNRmT1G`KZ-<)x{(mCg6pu!ApuRZzqCtWEU+7;>=sSo
z%+5ecG)N!Dv8B&ZR*uQJJN{V@o{6Rx5R@Ph$c`;he#Tk49~lAQ1>*ki;>HmK{q@0!
z1~}n4FcPvR3UAG{889sS^TT^ieRZJMJ8M2mb!#vnEQ7>F1yL)nBx0WmGiiGo{l~Q^
zg4sZ)B8HF*Ww)hXgXz&PECt_4hr_+!CN~6zXt)D4e8sFG9R&RSJyv+Mx04bGPy`Io
zaNIrCZ*OjeOgM;xn9$a@Bs^N@q~bVG)7)+TmShw+LA0L&;GLT#@y<t2?m!aGEKGv$
zweAmz3y<R<XOTvc1lS-{V2J+#$^<9ZzUO?ycr|XGzmab5m_IXQYmm9bKQ5qCB<vKr
zI$JlRP^16MXW#EIZiPe2W-fh(|J$Y>ssl%&*>Jdk*7&keE<(l2vGs(=UnoIDe}C(S
zn91@GqqwnyS3Z&)hN{*|i>b;=jU&iwaXS7tq4K`Kl;Qt0#{Rz;!df;|l%l5G{4|4T
z{kbzQwj02~XUL%JcLLtquEI5S{Q_de)eH9vyuU2)g7Zn@N&Kwfi?Kv|fs_LSx<$GX
zV0NL(JQb;71xo&+U1>sNXDdJvOQNt6Ge?I0h-u*91T~rhyO3wU97DxfX1WnpW#{m2
zlXl%vuK>v5=j%jd_CS5xc}`H)UuN?c8SuXX&g*!I)BQ){BGsBX#6x5LVN)znv^f*+
zpkC%fV@5r-5(`1hjDv*K4gcG@yvo!*#vOH}>-;kn;eaMtAL8p|<?Fy7UhtBAc0ptS
zwZrLk$ke*B@5lTutn*>9BT$xe|1aQUU&=1gMSI!8fmDEEQa1hDuj3`rEw;M_9KQIH
z9C=(EJ^~%Oc94Owk$`I336Mk&a!^|tdU%_zrw7j``N}93TS%nV&v5}o*F8Mf<m=19
zm8D+DdJ1muf5#7;_$@L0SeP21ld$M95_E6%i9^D!VC{MOCSG?!LMzt1(LaXUzzlT`
z57AjTH|9(&3r9EpQ|ficpXx23e9md3&0sMcW)w6=YJ-^eL%A32_;F)v)$}nS>Gak?
zJdGeaR{X?6aE9PNe{_H$IUt~<Lt9je0^Z;a=dT<5jf8&c=NSZC*s<SF2?|*H9F^n^
zaLJ7o&d#f_>md`jryE9#FAK`)62p%FDjihw?jEW5-jcS4b!|y^x;#pXl=pgKn;orw
zwMQLkqg}(&Qwae{3+sI)l0<sapi^qtj|}S3O+c!E9Z}4pqp%rz8pQ*dKP6hl4X6UN
zI^5FV;7`YL7zLH-Cd?9(gBToDyTLyp!UPl=ZjiOJbiU_KMz#zGm;C%CftP8c?lS}U
zz;DpTRj__Yv}#u!x%%Hog0*37hw8r~6VS+3uWC_km>+IRzY=^2<?%x|M-NbZSmB58
z$9}=i69B;K8RZOsxA(LQ6ov4M^Xx1XVMNl?1)hw=hoduMb+O9Pa(hb+5TTFa=oZdj
z4<tVv&EOBH9snkWw1i$Bcs|r7*)hHN+CcT7U@8lCf!`Dq3R;9RLy9cFqS&Bb?Vav6
z7%@kUe#g~<H`GI4%{bkW=bKu50dLkhGd|gJy;k+oR`$1rE<mlA;vf8itSSL(#DV^k
z$^yA!?q{+Y>1TSY2l~=JIZO+C#(W_=b7hBk40PeTH6!YE)uL?f%oid=mu>kLlRX;t
z-arrp;Q&golx6Uai!jYqLAdL?8Eo+d<Wm?VbhWX@T&yO!h<U#E1`}8MRrog3r!ktt
z``sk08$q>lRor{H8t}DV%+r1)l@H~C0IOhnuI3$MiHcN};o}3oMu>_iAV|kYjlXvR
zewcYV?RXB$*p!F_ni=rai<n?NFQ4jnqTO~gD-8bqXI@%7pg+-RH`iarYzMj@`tnF`
zyFIn#&Cz-ej_yT2BVerr=>a5JqC;Uu)P!|GQ2zxwb1Avv#b=sQ4(`*r;P>Kwk1|I4
z-n)M!xd7^kPGI{ohNDGm<8Y&2bxcP}ouCn2djXg?9`##G<xeZ|{j(^`oNWO>?*sNI
znWavTwr<v?(iAY6s%HvX5P~b%-pgr0NnCyOJ+i3fOY>{C=o{64P0<O2wb5W2-4t=%
z?>B71)Ni*5t71d^Tb})Xjep`;9UE{rzs)?D21KB+kTJ;fXng0OPXy@s&QVp~?ZoYw
zM9ec@+XTF)l)l4&;pjT8mg+3H3k5#6Vt(`?G|_#5=6wX&N0^(NGd|cn4?#APVB3=k
zI8^{v@(6wY(5e5Degi}Md^gV9H37iUK`IDc29^AC(}&cWVy&h35fj~((jgW!lxj0+
zoeB*@-nLyA(&LBHJ$Ek~Y(!y^IK)5#g85+^<n;TG8p*YZs^P(TRbVv^LvVH?%8B^)
z-DLHdmKIuN%=A7(<zt=}Afg{%_37_>!VrDw^IOB}m~38?pmZIvqQoc#mMs~WYG}wZ
z%_byj;>$rAt$TN@<iSA`Gb9O1vLHXkfXq9_(+5Z5c<WxE!J;Yur$Bk9vmf?P0AhwW
zcGba1PtsR_Nu!K#7(r8xL<82HiU2`$Q2H~m8N=4S9uy^5jk5GM5z-9ZsN5=jKz&3Q
zwvS#1uOL6yQ<p9s0U>#U+OC{>F26>QFbb#A1MRmB$((A;J72&wYj?iMO$k{NUTIZ!
zVlpUScfPXC>TEZt?aYW?MgoNXO%*pwjX!yCK)a6`Pa%PaWN!uKR3JzdJ!A-01j$-%
zesR}bKs_ScsKm4~hQ?jp_DST1UTyr8fvKIEmG3DAP<ZYQrM11D<FI59Y_8GmeT@0o
zKrV+2qQj$jSKTQ&Jrtx|MWH8g$u%CVBWz~%cf}1CSLHpI3$5&<$(N^;@F<t@V<$n^
zF&PwZZn(`S>jNxQtD!BNp*j1rNP2<`Z6%#ymAMTR;nM+wsXU$89DLv$cFG+aL?-;c
zUw|;PU+)NRSNWT93D$cUD3j07-d`de<%y1LR#Herwh`6iUhMo2^DDk1Ub0R+-%%Xg
zx)fbtDee}J{)NP*1ZB$<Zq~HM552$y2fQ<=KL}FwzjNB7GO+9hQx9qh*%D~VPJ<T4
z(U%%LtD18!p$E8yx$q>L=NT)BQyK^U$!*Qp=YjjGME;ZJQTX1DOji1?lgtUjQ0xqE
zN$92sA3950jW5Zn;ZLE#WA4y2P7+jlB(Df$Fk#j`0+e~(w5F_E^03rtZnV2}-e;^^
z(UFBz923AxSK9la3>|d+J=L;P+>!Tumw2@LjF8kqpFQALmWP1siX4~M=|pZ$je8uK
zJqrM^>!-p_i@FCbH?Fd8-xe1(5OSjY5>ii;V3#g1EoXW4oC85CE>-X!8OqX5wg=2}
zNqSWfHkTn&!TlNCk|U@1W8(UtM4+&nH1Y|n6xY?3RY}|(A6Fn{m&H1?Pa{D+6UHHb
zNQj=Mx%p6{GJJHvNWjHc?yfpQj<YOHiVRUyFwe-Iiz3)n%fLGJMT<d&-`*Uhb;;<U
zD!0OL-dg4si#C^FQ{gC>1Gc5}JD?a=5AAm9Qs7&!B|$CuVbd4eMc*#v!I#?kW*;`4
z)_ny#hqp$IRpOe-SrB!2*jnGGt?&@6DrY!sT(dhi0UnDR05ltUrI$)uD|akn8hfSJ
za{F4si_5HTmUm&_fo~`ZOY^Xu<K(=g&#Kdt{E2=2FC!q<(3!Oj$EQ(6yBq&O$^53d
zx~cBya`H&+6VZ)1Khvik30%$4dqxPI@nmxveYFkoHZ9SpsY{_g^4<u7ZY*YcaYG=p
zO#?B?v_8qx+)uPK)@4Qo&!Zaq-Btmal0-x@y?@ESD<h>AVo(Wqe$Ab>QZB0yC)r<c
z2mya3%S&O<=yh<z3WRUM{WAS=#J)=-SNGqUcwuZrE_Te#s^OBM3L-LI9K^aIK4}+X
z9o2wY<ybvJaIUp#A4l<hYlw1VFvK)jO51%lpOy;A6gu<=?am{k5?*Q#ZJTU~Ke>%9
zEaa50kI+!j&b-Tqx_K!S|EvXV<hc~_n`@CDS9xZLvmJ{_jv830I`&>D+&cy{2z+-j
z^t%j_KzSu|?r){$Sf7!?$hbTcW@j}rOm&;lt4{>~f(wlGBdapq%ZdbUmZdEoHCG*B
z7(YFa=~g(p)27x_JG6^&4s9&u@|azZ$?>KE8=0DY8U7RY3e@*+7OpZrh~6S6zMNxQ
zpI*{s7qtx588hUk8a1VYwD;r_B^}yw0VtS>T|n1~>kIMlk_9;(v62KXPR1_2p$mFA
zr$y$jf-leFIGa`?U&?TEBJ!zbJOy4on9ce!n_a1}?KS6UfqUfot_z+@lTRTVeEW>e
zLX5(4ri(_xx{~<{*lVQlnu*m*PF_~xW$5OF;~}Af(>4TAt07<2a((o!n`HBhGFRM&
zjRW%7zfW4Q#dFLmij?!S>XzHxMJ@`g$JTx`GgdMEU?vTpoC19GRUWm+(&Q^w`Ce`p
z8LS4Ks?m*6(ulW?_+W49^_ckyrt4`-gecE--%FXrPn%y-^uaXtRAJf5sxM^I_OBN{
zQ?OIwXPx_rT0hY%PrPBldivDQ#63CQtlX#0vUE*gcGcB0w6qS3V|tK^rWOh|JIAql
zDb6-D^#ngr&q-91tRq&MoVo0OW?tY%;p<wbyeb7B%$O9obdVIYZ(hFSs>arT+2kXW
z(RCsh2y_6>{9EL&pAbEQ#<nsZ0k@_&A!#8ns;D5hcaLOF)prqA+f-bwX+~Z=hU~-Q
zL=l9&e?w<N2Ii4u^Uj68n5e@=CzAN8p^GFTK0@gLuOy<QN>j6q5qP%m)UjmXmBx*X
zz{xM%{7`VyPNzBPHTzrmW4@8KGD8Zr=X75`H*^14y};S*W2OqlVI5H)UHvzKU;<zW
z3#kd+m1OA&?hHtHY9_z=7M1Pk5!Qh>li|M`QF*0Ms2;MBni_TtN)nqN8W4Zl@^l7E
z_x6_$wAV9BooZkSYpmDYLqS{y#o$sr`%*nGWA@_wZPF%>U~)Xag}$ku`L|&%OUuCn
z8#Q_OLzTDHmq_gvk#yK(4546_9%NCn&awwY5KZRt3RQbj*T}F57<X(|a8>XMlSV!k
z7_h`#aTxA9LNH2axo8Jf)f8<+Hl5#E9;+Q6TQr<9QVE@?vS~euAv}=<A??}k`B*^*
zj*8ivF+c%}*2X7om15VIL$0mq7Fw=5ugXy}P+)C!=Kflv=V3`NUM*C8BbCCI=!&B$
zv5&<!7s*WTbNdW@2iz)|e?bs?IlLR_uXurJ;637=zpdIBHD(wPp0@MAstPeE<7X=*
z$?ybt5s?a|A9&C>qD^Mn&W_-SCQSn1<uel$*n_k$yOK}4ycA4KGdLbYI8HWwk~p|k
zpnw($Qjs9XN&#S~H&op!X&XKS4OB=_>q!06D5#8;^xrRkH!yF`$8R9x)8ziGp8o4<
zI1>y5-E)-YR96oV&#D0aau<&!&$s9}f2-zas3}Qy=gd}$dHq{q{#xzZ`Aik|*l#w^
z0hj|xF{8u5>mozUyw{wIqo!QOb0j+2Rd9!}seGqTFQ2T;xvPUGg&62<|0sOo<J4as
zf4$)tT}SCn)?ytE%Ku)A^p(}yifo&jmDEbLqWzeUdnO0LA2h0yE!Gj5uU(!I>KRXl
zH(I0UQ_%El6WUAm+|{7>LM~7L@QBRTjf2NhJ;Qh+THYA~CmuDzB!2p&lPGry7U(<n
zt+yf@IaPX9<Wda4eIp5VBs;RG{6nbFqWm6z-5Czw=Q7=?^=1eRI9szKk2D558S~|=
zlu#~XGKTd2+RlT&W#{*g(F(XpCD=dR&Fy(+F+K%=IS>vHKPLDXlIS@?39str{E}fQ
zaP@)TcNax2DM#`97k(nky3lM!8sbk4^pl?4H)HBybhPiibCFl_l3kUh{=<_B$H<VQ
zG1IJwxaWfHz_Nl*F#07s@5HMec>~8aoxM@dI_BFbN)Ov7#w9rorb~g)V;pON9=Ia8
zV3NrWdxCSB%2E{YI-A~DQZFx~C@>`)#KHw!GySR}ZFcM$RHWt_%Zj?R<rI1vAj3jo
z>D~m_O_r&l!-(<Hr)jx0WqRi9Qmh=EMP9zk=XIK`rTg(*7fd3!ZX86SgZJZ-nN}CL
zc4e=f)nR+={NJY{e||0nXibemB&5r_CK2EQK6Vy#Engnj`pR7|9G)oJ{y&rCa|9-V
z;Y!OV+a$H(Y(zy+>kZ5k)<3X7U7*cG6vD+gFL##fr**3TS|SLKL$C1S07TSDZ-@Aa
z*D?wVIBTkVu=&&N^JMHpxHq6!0pyBKL=Msj-r!H&m)DjTW!gW#i*5k~e$q{K$R1*B
z@)Q7?vkjBwYM&6aJV)l&wnauNY47|@4MtyQ7>>Z;Exw~F2;k<-5XWB|wd3$G{S5J8
znT5+uv2RpW8J7}yx$%i9mG%5LJ{npLNCI+sqDZhM_2+={%8%l4iw+P9^H9{_B=Pik
z3=jWF3dC~S(s%>j>A2ft0pHx+6gZ*}ko=QkEG~n2lRy3u39NpTMEnnPn+iA6Tu_ix
zo^N{I1-b`v*#_eB+ujOiY=&aNckRK>QE1;=S$_5la0^VIrPH;MAqgt07K@3#M(0t*
z=V_*bTM?4g+xa6{SAPf=P!c8<qQGo0vX)gPVpJw96LRw`OH3C8%4qnvU10`1ABVVY
z+d2k}c3~$NTI3!UPrAiPszY)w)*8pDohy)|aLUPd1d+I^3K#x_vUNWsd7!YsPh@n>
zT6^}*Jm@|f`AdmZ7yn{k(V8QKNo?s$r)i9O&=isIc`d;MYE!IvFY@-?S5UJ=tDF#+
z=c*;Dkt8S_TBj<fN=A*O(15?&yf@5d3PM~SCGO0rDKfm20^#a1p+^Q*tTApk3!buO
zJIvJXe`stwRk*+E$%Zi{X1-Kswf|b#3y(;GoLP&zb&Jh~k_qc>1jK5-W940QWL7+q
zMp?**{5}y}tGSIkjdp6^YnUd2a(Q?X7>}kt3vBs)7+&5lf7GeShg7qj&+%o4Jh(Ay
zRn{Uv*lTq+He5&eUHYp&t7gWxZ>xZzLtm712$(Z<-K98@q9S@N4gq)^(ohw^96tSp
z>E9B2?atS)q5n|TLc;ROypvTtvx(~3683C;%EHd+*01TBFC28sh=9yJeoW2v!#8wy
zEdu@+PE44zzcUb7c23FVN-tI_%kjXr6R-+esDG}}HS5`od^G%$`oW@q6>{+<Ka+ED
zvd06d+p_r9W`^WUf#l3E%6y8v{#g8lb@YJbU-Nbx3x9TouI_1mq45`BKM~|rn1p<P
zu_Bu^sHym_eMeL{!9-QOSuoViRVyH!QZf41kIJE>%j=SZQyDSUJN6fUWky)a=oPb~
z^HFNE*0B3X5}Y@Di9t^XMTGqik4IOPY{)b)k|R-MPCW9U(SYuW@F$=b1T7M}leYfd
z>aSbh93h0B=(S2yk=4j>|E_i$s6N*yOL^yFB29&TivS)lJIOm2c0a#zSS)s^f-v#!
z75E}d;i&@<LXp4Jqp+xr_T{(UTE9GhD75|z0UmQ7<AT|@?)GouV+GsT+Hfdl7XYy6
z6cIaqkH<%pE?Uw~wM49OfQA)qth@-H-~-X_&?A6bd}_`lg;A^W3K=~W1!?ClkKaoa
zR;Rl*!_i+J7*I-HV}pwabDk5i$%kB{By%r`n1DLLls((&#J%wKd_UbCh0OxqZ77z8
z)L#k!HQTAH%`I3{2&Oa=;c+QA5p<#06E7nvA6l2ijBlbqU8wdVCgycZS0w5)hBg7~
zqhJ*>P32<86yt{T@g+tswa~r2?Q3Mjl|)>!tH*97op$(ZLkoeJ$?|=H&I{s7)Lcpx
z=6c1ZhT(-1UscupCir_%t1ToDPv%0a!nKw2LYO2|#%n%0gD4QX?A}QUiziV~K{8I)
zf_?ejVuIor#-jRXM_b!uT2A~-`}v)|$DF)m`$t-T6G|fe_s|%a37~D(^dGVAw7m;X
z-gjmY$W<YOxS5eA<8Aw5!z>5_lEXEsj4*W9$_As!$HG^~_Y%Qbj_&88um=A8hYA$j
zr(>HSx?Q#U^>z2T9+5^%KF_~)RQo{(c7FVQ>>dQhn-9!sb#&QUWte1R`f_fT(SR}L
zf4fAfoH-rdis2!v>UIKq_$h$rQ$tmzwp(o4I&2(0Jji_E=zI_>CER?n2y(Mtruom%
zHt#s;-q#opeiv8-{ePBv6<dL8tTj62Vz9~+ggu3EVt_c5P=L^H0*7>&o0FOEBU5ai
zou8L0cK&8ZIzs;5UWDu_+H`~B;p6oEy8W?Zc{#cgouZ~N^Wi<hXR0|8llr>tc!q|~
z)DSu9l^>?1EgkNI?JR}=;zAez%>-F0=2)w}WmD&{m+x=tG8!!&lBWRAoAvz&fuAoL
zY_~5xO>8g%B@<u})&WlQo6i4;uPZXhPM@;u@4I(@VN~~i7K8OUr0hO+ZJSbPXoCvP
zuAFU#=wk5hIY@EKwm`lpFWD83i+CIF#my`mpJrBi_DkF@f4(bT2FM>s>dLCK9MxtY
zWFrfjBP%w@{gk9gOYTWI!v(Kf4txRy<PwOB&=WOPy^HmhY@V$0umXtbM(n42IInQx
zaV89Ltv5s@g&*MG`1}<<ebNeS@~YYU73w0H++&-#a4I_aA=)Vz0phWyxmVj6({O!!
zj>oq>V}s`i)$<U{%%DupOR*rC@%Yd25zjfV+Lza1CQtL2P2fH^PAi60hxS*m5@b+u
zis^|19u~1VlBDK)nJOC}a`Rf8k5vj9sN!FDCo>v!3|1pBZr8dOeSKz^(L5!Xt-Ie3
zGwFV&!XI9Z+&=S!k?QMV9z&7$t>Mc<a5(5D6nDR;bSW=9e#N0Do^<xuxfKXT%Vh|`
zzdf=td)(MGw^00)_vC|tnf&EOJKF|)PWgNpMb#SiNuf^sHwH@|LP{WcgoM-YqH&3|
z{-?$p^Vv#ex~==9l-OIQGSG8o{H_PSSZA8e>sYBa#(e5#e)*<dUydY7p0c<&t?|uY
z(=P1`8@|OC*Jp|BBp_p+rIO1lq}<yc+41^75O4%lRA}uxi{^4e_Us*H1lRVz_uyfQ
z9pP3t^~foSxEgAGe0v|jH{J1IR0{Dce4+ey$vq@~C&0#_4k1)qA=@#yhPshBV`2lt
z+J?XEr$~8F&AEI!J)NuZ_)nyP*5X9M7bWj;7$HQpX@jUyeDr3hix{MVPzW2Gb|{K&
zHh}lE?T3%n_q_fkAS{v_v8Utm*NGfA1dBE7oft->h(5ICh1&W$kC61T&ewD|&?6=1
zP1Qn(xRoS1Ub`kU9rLUJ!n>s9JaFx*ClZuFWDN&~7gSGOivtJkQx;=>Dfw|K=LsT1
z($CN&p8?ZDlsfM`A#rzg&y}69<oSHx2EpFIYriX%d|NYhgREru&7^Q3rh?IP$vHaE
zQbs6o$a*Q~|GXnH0AvN13_Jog>eh(%StN-!WigvpyP$raflq+RyNfjNeTq?*?^A^O
zC89ROqH#_ohs31QkpNK#WM6>$=YDgohq!@~fqJ~DE}*`Ef{UAFL{#&A3eEier06x7
z>orKW=P_63Kx6f01ed~t4JUNVzH_{CWpt3wmIwmwq~~`usZE31h4@ZbJtBAo+7qfX
z_ZU8|?0%+infS(LHfuQCzzT${eXlQvhd_&@n+jsyW}YAUcO=UnSbn|!rE|E~V^@og
zJkONI5i1|5S%r?|xtL7@ZMeb!-B@tVH#;OGf)kI<;%R$GhSS@qnGK^|VD=WVehtL=
zqaW5;sG+pZhn4RcM+CpHLFr}xd@9F_Bf|4I6yTW<4l?O=^VlRlVA1W6jJ4!$LZ0Ki
z2`Xo6{OF>ec8U`qD1*t02i7Sx;pIi!KmbPrnLj=T4!K@)?3A@|=E8aHS#+uZGL_<X
zk|hG1pr96K*03E4Y4qR)?S;2(L15t;`iE8~>^m-8mWRyoAy6A+3qZJW{^(wiO`AKo
zLetRsBqLw}&h(L2Tb~R=UcotY-dPe<m9oMQMPSS{Ud&!axpJsM$i5G!&b`-l1W!%H
zheGs%IGg=z+1i9+%h0YmzJ@P_AmGRDAKA~D2)>>Lw4Kq|<y_$!O3WuxXe-mg_QFeK
z>Xi!&C2diz>!$2bP=HlZ+B#%gXY0DqH9`HnW4Ry0%ghrb99s<!NBSOgIu12f<O1fT
zN7i5FJUJy0c%5hBz&w~Fug$dJBEb28Yae{MtxAhT!_&^a_@QdsxCV_8=Upw{Cgp(g
zhhhx*O}udk8o*;%x2?VeO;ZAo#O|PR(jW6*yhQ3Y!IykhtV(6m$Glsj1J7Lt$w>bh
ze=}NeLqpP8KTlzq31EvO66cTi1~^xK<CPAOOfh1YMo|!7NAGU`)y&rKID!~Hk&V7*
zlPD45kBS?8;O$KQ;h_pJi`XZ_19e|%A9w%I-;Gz>haQXci-NXhzsE{x#olrWzgS(>
zS?_kmK2Hn?fOVyg+&M({1f87-mpEmVAxpPt88L5${7nZnCxk?2$V<#~^GyWe){T^S
zxTb=vC)J=|Yelddr>4e2juQP&I1RyR_4Qr5C9}4@7JkAr>UUHex;2Y+@5l!@^v=-x
z;(jNl)D5h^0hHBGgx-SlA=f@66c`&?F<zlFR{Ma&8`L=fWo21&gAqB#8Ut!u>jvvc
z%4O}1cUlxrypjt7c1T$nkTuQtL<fcbZd+#-un)lWNclvrkJW)2HEFgY0%8(?AO__I
zpn<VzK>}57#>-Fumhs>x$ZCIfyq4VP4^q1FCam)f(4i@J)qGket?eIjm#UxCAouC+
zgb@PsbDSRzcU&3n24TQWUIYwHsp=z@+e~|t-#xpI`y>|GnzB3}D0!)|xXMb=@KDM$
zew&Taw!-J?-kq_xcy65s<_4FebU%X@J60J}gJf+Cs6Ys;ouz9iW!9@G<h&`wi4NX9
z`ZBIRfS-6@l6P3t&@5dFu$)e>$N1j+HJUR2(44nBQXr(MP4D@qAOzk@(QBzC1ObQQ
zB}P>HG?9~7E`!te^zd-?hlR40)tB5RkaF3rlb`-2J=W@`fn?>@?A|cqF@Aklj9L+a
zKzDpDHr!+sA7pRkap;s=g21WRcbwyFS77eR?>McxI?i@)1fXF_$SRN!)2Bj1Fd(?p
z&dwGLAC-WgW>wYnmuC@BM<9JvNaPidz75LtQiv5bJG!`+8LL#X7G?fm@qWwpwaiTM
z<1mU|9>%a8B$vD<td9qE_+_;>`aupG&uOlSJ28N`{wITd8vC9yKWr1*o^SDgQE83>
zsmVj0Wu_&himxTtt+1#(aq74UVN;e#xzFZXEp78#El2%2W@mOyebz@-Kk0g$mDoR;
z;CJ}3t3Ykr@2Od{I953)8`SEBz=KmIe!<Whg!JuyyG`QwcI93xrz4>krM;ma2mE8U
z6QAM)q+xbvY4;~co{9NC<6czo^M}0`5o0H8YCU22oC{VbDf8iOTmV5l=f=MXWtUKv
zj6s@}UOW}1$jBDXg(83aY2u(C#RJeeLOE&eNgfpzF#=~hB>`q#URCwl_&rvlqPU$R
zeiJ$QHG0oE9P6gyB(un%a6sGu&7Yi2y+<hR@5M;I^Mkcl36kXXxzQk*J-d+t323Js
zbwR~}sq^tEhm%@&b0I{^)uKc!EcHrKs~+8}QI|%Dg@<&hB3g9p7gkL()L&OS?9653
zH%JC-A!&UnXz~N>GRvxXgS{T_^lCDN$6i*52<r29zt8`2C%a;mu<}B;v;5gvWG(|e
z^W$XgPs`^KDLttO;LUIe!X=KlfILAIsK7qu^olGgy&m#12;c6MCfo~%+IBUcY<y-&
zi+8bVx?2C}nuKAJ%jsYHz6Va(c+azod^2y4sxAU0Bg)(uCA#?On`?lpTk`z{5wKl-
z-5aw)zqvm-u);G+U!KHsGT?~t-e_5LFR9vw^JVi*tL4feBIdsz(YL^W+WkgTvu8)8
zmbvB0T=_$q!}MN8k$?WPHS#0t4x!J#-Ow@&-$~fN>NRh|ptla%3jEvSsi0KTuvu4=
zX$KNk8l4Vbwzg;Tu}2^H$f8tVVwmUCJM9}qeDHULxZH6b`?ti6*PvAp&8r88-@rOg
zga}iH4C!w^V=MXYqH7<s>l$)&SpLy}2)VSRk-a|sbkvTyZ6m>ZEsMV2<~Ry`AVgc3
zX7Qaeof5-y^FwKobIftI(B{d0ju{gdn0Dl|-QyO1XMFWUqIu~xoBOGHZ`GIGPSIxD
z2?3+vBZ@kE;y3w$hNlfp2QpJlU_`N>BX-5WgbUeXLl#T|S&ZWQIxEPZ>ag|oNY*?=
zvG=2;&nVT^8h}*)vmB1e(B&O$5*+uS53Qw4v=j_68r88K3btvsu#5;W5FbcIT!pP?
z{b0j8lW4qw`f2`lI#%?dm7UJ`)uE=+Wk>1|HLPzCag@pyOFJ=a6!e#bI~rc4GyQeA
zuEOz;Mw1PnNH6dp3#bpf%{aMM#vNt`251*=w~QB85D4eR!_o=xYZUK^c+HI`_W@uv
z0$K5`XR^iE55TR>%-(u)|DZ7Gd^Q?IPwMhnbw(}7-vsevAYYXE;G|)M8MY3t6_OUt
zr1;()4a8R-2WgNn2NqJ5YuZZKk?nt#t|+;T=2gk2j0DX}%|meYeDj*p@>5f2HWVFw
zx$Shu`Orm4M<4)1>#ug`X9yJf#(w?N3N;@@ElGGh%zxgW<K`+<P%13T*knc9nu2Sy
z3z1H`U~aG~Zh{@ucC7PFRi*RJP-$(jK9Cj>3|TFE00*pXiX*kahgeO8+RU@`iO68{
z^Ky@;QGL<OhEmMJ>kz}!t`uC6b7cQI*5EkIMv;T>ZA?%7gUAI~f{rWO=iP?o7-CJ;
zK=Gi})2Z3M+jV2vH82DqQz3d?!K{2WRcf2%7USPQYI@`U?um25F&-OQQ*eXJGTOA2
zJWpchj%bDA`m#8TS?gjg#P-`jzLbCf+Z3UK$M$Wx-uT$zw>C0QqtBw)2S;2}SqV<U
z|3rv-*e8e3?Kv}+Wtvc44_Cg221UD{TG7hb+!gKf6mWX)PC5Y&(Qa-SC(=8fQGkHz
zAXyf_KMDIpAIN#gjOJ-6f7_w)zbQd2`%YnLk*!(H&rk-?=Wy^ie26!+RAqUmPC$s^
z?4X)Q=Ql(NO}_B67Y#h68?IB-bg0*r7NKH59rD2not7X|e|Sc(OojsOVsa!kVg=Nd
z&!;75ji}#WD<^mrJV&O#)1*8g+qHOj^uj#wY|D>mhwB&qGP=@kxzK=YE$(fKr`r|v
zfq`1VcQs}sRpHAq1k{A7OM+SdOYO0Q3G6y_sh5Yxh2b_pZKC7==vRKTW>27)&0|?i
zPq)6%Q5<tY8uGIO=`1;KnN8kOl2Nu)s+i}Jpi~?fqia)A_w!Q+f>4ciq#Mg7;HI<h
z5D^Lh(hUmEGpUqzFReO`&6dZ?o0DM7?F5TT3=Gf8gNA8AtB3t{{ijPF7J%q$q{m>P
zr-z=t=);ie&G?0PV?*d>z^3{|cAIPYrC>@m-;4$hk!cE7d^<(4#V%fK*jPW87PF2!
zdHH<drqfPTLwH})Ic6355mCB)BuukD@ecOadkRuhKYUt`tO%>Kt<4B<i>`u~2Ln)A
zSxl-Iv78Pa{e<aeqj!*Y9k=1V+avrg`*OaiUl?)~p(y(*WS<f**R72Z{%xc?m=Q1U
ztw}3!ZEKqh@yO9NwTYG8SQ$NziWil{JDNxe^|v*gg(#bWN8VoJTt767me-`m37q0S
zY6k@)7@k`Cj!-6%v~iDkT9Pf_=9U+}dt2S)Igc2IQH!fmhMOg%gOgsLea*x6EeT*<
z8X}7}{wc+;TJgb%FG+K#x!8KOzo)}&$m|!OEoYEIv(F^N_!-f>#)Aa96wV;If5PWy
zY)pPLDDek!tgCK+k<UW_L9>_CKuUfxx3QImSy}N_S5S@}zNu6CC<{D+t&7WHD5(}*
zDxy~SntzVPq@n=H^Pqlww-{Ub4~lq5MSe)8J+6Yj&fUH>Eo69Xib&*j329tvO8NI*
z?myiavIm#*5a3^f8Jv}7%%6W;VbzV+=NsFGSs}@3!d#`y+26YVmS728$_rr^TxvjS
zijc+Qjb^XY%U1=)VPv*ieQUbq`zRvQTo-LUgCj0J?}*<kI-uC%)wmNc4I2R3L|VH|
zeQ!5*5x!6uL>LT^XDZMu>0q3Wz>{J`QZ=B6t-YN8MN$~jCnlyej8+EbR!gT4EX@?6
z=)ohMswq0{^!e=f8mjrfs2h(Nec|wJac}Wv&ukOkoeMR)&_}F?vmk-*pbbpvvJ?p`
zsLL;mgR~a0EINJObY2bgJQ5cGmKC7_^eB)v51)3Aqz<Z6L};H1fP>z?teyJEaca!-
z#BVzMK&@`g{{76oZJNb08p^Z76I(MSco5RncJrr46^R=3ssD_!uKrs#c{L@?xiQk9
zBc89w2c71CN9kVDyz@OhT|Qmj#pPA?BOOhxhx!refU;5|<z#H!G9*QFMfc#n=GAMv
z;FK3=MG=a?M7Noc820SFW~{+U+F|Kg|2xcx$mGYLKZbxb7)oNqkQy6>489Jt1!K~Q
z0fi#@-(f`r>GrtfofUN<xpp~rcuzw-;p$3Xj6Y9vB7{gdj^MCzG-_V;PU3Z|v{k&*
zjxX_J3lp~B%Zg*q-~XDa$MK^D2wMAav?Fu$7zioRqYaDW>??tO6a`D)#y#r&MM@T=
z<k<Gu3|R8Wi6}xLpZz)U(iip!Ck$%GidKtN^+!b{m;LxhJ5euAo2V9aJ$51-M>Cu$
z_d?hHM>D&@MdbQoYG*Uk9~o9P`u`UF`o93~0ulW<T<vu(TnN@s$(Q|}Hy=}>T^);t
zA?QC7IrUdmOu1fBAxycLW)Kt`dI6IxKEGH@Ty)#4ob6$`z@WUXB(_{X?uSJ%**G*{
zF_93!iYH+%l9J7qd>?fx)lV^>5~LGGL?OKjN)~lhFyA=mBUQyMe+lIBU;?I9r+qBb
z)2-9(!wsNlo8#@q|6VpB8*yg)tVt_ck%_$lla<2+t(p9@nSB~TxQ0rE)r5LtMtW%(
zJ)=~^z(6=pyD3A9(aDY>%MA&GVh>;elSJ%9s>Q+AU+bev=jr8QO7$vZQClN5H<F%g
z92zjaIRvocNmz@dL^$mrpEM0$T#WH&<pF*kI$_SGDJYTr-#9CO@hz23PMPG<5~=#b
zyBbTtbnA2@@gf`I?Er6#AMyHY$!;(OK`w_uy9M=f`5=$QAV@gIIV<Tlx)E%Ew+oCv
zL+hO+6@4yOZ<`Gd@dQ5M80V~{+h_>Z!TSq6Jd%mQ+x?K_?39CP!w^s46OL8RO1h<Z
zp4CD6cosTzc0)l{LYxL*Zi1i3IP3^|Y}5lUrJP@Yq)qrs!MA|eF;wUldTU(9@4bBh
zTt<6u;K@MlYX#3IE9=Do@~gMi1A*l1?ZI{$0xM7$l)~`yX~<FT;R;MB#Vl{2ilXn>
z?_RFv4xp4=OTM3gf>d4JPvfUh%BPKKBvqIAIp=(k+Zb{yFv^=ldfL*Qb7J0sooTq1
zQ@IZarC3|nkU{Uh#?At&Z|5%OByI*i`F&JL&i2tPpkk-9Rj28mCADWz>Q}%e6@KZz
zwIw~%R7cX;svs}3QKoo1Ej>=*7>?jD4h1Ovc<@gj^l0f@%tUBjW|bru*Uvmas;RF0
zQa%Ms|17U-N_~~_(FEfv%am_K?P6JTt}j@cYc4C=G?HY>S7FMBbuq2R_E(5$Q1mNA
z+YPC&OHw|pICsg89{K$!SlZ8zbVriAWI#^BGZ<%+8jjPV4aWKX2IxeUgY8~89IGA(
E0&DeuF8}}l

literal 0
HcmV?d00001

diff --git a/docs/img/troubleshooting/troubleshooting-firefox.webp b/docs/img/troubleshooting/troubleshooting-firefox.webp
new file mode 100644
index 0000000000000000000000000000000000000000..93c151fee5fbd81666471678cdebaae040a4f074
GIT binary patch
literal 14950
zcmY*=bx<8o(Cx(?0t5*X9D=*MyItH#aCdiig1fu>#T|m{#odCtJAC=Q`d+<y^T*U|
z)$~rE(`UA3dwYS>5)%460Dy+Lh?2Szmz?syF=Ka-20#rd$lqpdd3U;fItq@Mlu~G;
z*-IB0nk`*ziI{{0%;_KLF|{JEEM%eh_xYD`X8(7Dxb(Jd((6o~SbMCzUpd)VV}}{2
zWvSc5P2Hb@evu~cm`<D*zP6@Yk3J<%X1r@>0~==NUg>SJ)7jOBj%KHsTCY={DIHmB
zhg02`vRhdui;YE2uL{%McI(w<x%rpfm-nyUf?Ec&SqIMVj%cBYhRVUjG&s8Xv@s+$
zNWg-?D%X&|jKul6WU}(G;0jD~>Ihxcm_MZBae466%K7p3ZX$6Zr+|{9CXp2Dm3Gxq
zoec)*IB0PZ**J<QX!ZsQuGpZYvN+e$AWI+~f^>udJYqzdU|u}5xORL$d!DKARG=ln
zh)nw@00`+Yj}R%89@<1oFKyvSD4kv^g#I;95P%FJt&L8O0Q&)ej%*^`A(J6q+mvbb
z3L-5-+=xsG$H?-_qoLMH08+#?=Fw~)sXHqzNRbyxB^0T?v@|HV23$TvlG)=)W01S3
znWAJnO?yJy@t44D`e{Xzuh^*IV{!#xq)2Ki9yr2l2<o4I`Z1J#_89FZl@vd2dNJN@
zdR=yv{2N_%J$65yw%6o0)<&T+(8huYk=B035r{f<J)R^;(Qyp>BeT%jo*5c(Lm1O_
z5%ycfjN?VXtc))&FAKB8h73QR;I_mEAt!_&?O{a41dWIRhk(<0th5Y~H9~<ggBY9<
zne47~7;8Uc{q^bgOhq=V&P0C&;ge(QMv|=+W}IAp2!ytrO@e=h4@z{OuMKs3`Bm2R
zcl2yIL0;Yq0F14_LPG$?CE7ke^PBnC9&DR!YJ-RYfPB*>leK1>HP^}JNj9CGws*Hd
zjs()S*!th;uLA0SKMgoX+y1bKrltS?t#P8W=JoUQ-B0nzgGLbD_L~xtV%h$xi&IeV
z4J$*T4lFqc?^_#38=yU!0AwFtokDBjE>W$=?P%;i`p0&XglCUbV;4ca`HZ_S0lDz|
zw;^>}GBV6I@#(+}ZD}41HA>F3iYbT(<Vr|eo7gW4dywOKz-ke=@W0-c6$^_5q<K2>
zpo~b72ul_Y$DL}H$^%Fe5KC4uKD0Lt4Hmv6T)w(aHMZ&zG^Qc3&DwlR&1DanRKiz^
zSLDNe4&<w6jqGwx#}~%Z&;QruK*ho9m7?t{AY>>RoXFn=XtgFk59ZYzwe-gB#ki^n
zORUs>?OT*8{z_Pi4iI5~cb=EgEmQjo^;o<<lcj+XcPddNOc(}PwQSU-@|LNM8fV^N
zl3Px6jtGFvD7_2+*qck4r@kiiEBXFeyykQxVBeokpwVFTw)E|JU!|=$$@O%T8%Q@z
zxYgwr1$;?j-5p2xFk<g^lI|YPG!JI&0Eg?rH4QZLJ5Xse-OP5chR-;FzrW)X0BwW2
zo|e{U7-MGyf3J%g#D`2swlh&bW(#$VW+w;&#3EN_*myT@5x>;mQ@WUUQ>CZ{H>+TM
zd%(<&5>zYIMJhy@c$Y9sq%-L!w|TLTXUzHnvU7-j2Wpe8_KG}pX_U(%bt_r35NKK+
z`IUtl%w&Oe%tK!07!kXb0R?x}s#t^%-}L8w5{JH>0-CDiUSlVMCjGBd{PqawhRVeG
zZqQ<9w}cL)Pw0t$Xly8;JTD<1aFtDKOMg(6JZ?AeKD5O+-LUq_g)r2VwM^;%*>r)-
z{AFP7mSeN(WQgJ~d$PfHo`Y1h3ZE2T5BC8fr1;^o+DS?~{braX6Zpsexr*;WD)nBD
zkWbG+*tat#T9Pt`bHSL01!(uQa4xg_<w0gw&KY(Ak#BaHW;`NgPbP96q=PT_6$xgh
z)5JMO$^l<BkjeliWA?juCg4kdmn2f>j6d4*MGdN<i4UPl)YKBh6@v?#7-A2)P(J6)
zWRWbj21PV<bL?<MSTG3PIggavj=a56(<$RrK^1P!+=umNnYA($mg;uAfd5)MQ!F_$
znRC{9ve2VN%S04sJuOjp9M*D4u=6EY80Z41N!MUM`@|!jOmS=HeL(2#Er&f{>>3a-
z>7J!w7P+kz*7%0^DVcOw!TO|JE5hl$o-B5;l7*Rz-Vtj9zG(FYjqf08{gk)s!)n)z
zAc7XU%TLdEz|vYy)eV3C)$};SQt3<TB*`Rw$~NLb5qZNQTCId4=tjZs$=L(DP5D!v
z^+cyj9RN6iVVe5!uD=^X0LbHtJ@DApx}<Bk(ZF3TCnjrPz+O*wzFfiMQ~Akc#h6xK
zfYz9#gnH81F;bTNlo?cF8F6@Hg)xcMoqSpgA!<Bko0e)%?=~EZ&Wp;io*b=(_9?mA
zyX{3Pu)hX@NlylGK9v#g={iAFvcEwXJ(ycjyD;==j<zXZH%!uMwbdQN7rs}<uY>_8
zTq@WsssUNOfOH;X17X}KDExYr+6v^bzAaWSz^C=uXMOq$Jt{@m^79UgQeZa*`r}#D
z2B=wTIe8pFVWrkuJdckN3ERu(qk&sI<ul_IF^T6*iyR|kH{c<SKH-i}0;{Xc@YpxZ
z$<&OW#w|#e4{mp<%6u?H>`JZ-6h8Ow{_7_Cw=TPzeTCW8j>Q(iuAX2NVI14v?kMBi
zD<2A88K!6-Tm}<f5vDRXdg2y)2x?J%p%eNowlVhvZ9TelrwaC@_eZmRu5stijApX~
z2mQODy6W2RXE+b2)%M7_H3rqWT9T%z3>@}VE<7K&?;%f{q%PYGGz~4+4d9P))Luj&
z+6B4imF`f8M~!i!rq9aYPxfQSh6Ko0q2N3tIJk)UYXan49oyF<qmM$%z{XKi+v6Tk
z&+3JsolFy6AaLya6Wqq$6>Lfqhmo%ZOqIdh{OPjbvA>)u;~qN`aOQf%ymt3poiV5@
zp^G(FS$u~Gzt(ED*6`B!H%p%ZwOuBKiXg}51-Q-K{RX0U{Sp0njc-kI4M)8%R({jl
z&p=^mrSRB=S64XYb)|?<C-e0TCO+6j1|G?egD)64=TR|g9W5m)`3n*Jc4bu93w*Bz
zc5#j_Gq3_Y7#1x2hM$fhG9!!Na4ps5x7lSh2CjNJ<s%6}3&RSdm0@1A+Xz=^qxXJD
z8tIpmc&?pS94rqpQ%Acmx%&)d5iK7Uy;7Hxl6pEN%&MHP-}(FliUy`au+H1nWq;Or
znJB*R3}S4?6n0Apf-Zm+q*ns@^Sma{i+>DOG2hG|sX?DD<J2!yBIVP;hAJW=BI?ha
zu+;aGg~PESCrj@9+ujRpCtGLT)pGA8zxJ;icTT6IdAc6@RDb%J?G<--1Fkyc+Dakq
za!)vfNdTTd?mwWxhm}hly|*B_F0J;8R8Wr^-5%*S+}I`40vhC*T7%Z(ZmebG-LGlQ
zd)H@1o-1b!2KyLoc*FhcMD9xRV><BIA*iq468?j2v)^%E9k${Twih#he(Tg&{l`5g
zjA1JfL5K*gcwU7z<<F~fIU--#JOufKB3Lj%{3RQ|!Zy{idepkJ9da{y%;*M>7FELq
zVK4Be<N=xh@ZcE7sj6a-kuYdL%kr$s25X?2OoO&vph`lXLF<xeSPXnN&Y)%w>z1LA
zN!tpMi53Co!W73iUilQq0t5DXiZw0Xs_LvSu#?_IPm3c!1p9wpNRt|T_9-PYbi?xs
ze&iJbrMFbbC8+N$)R+{@A4}y7iWL~xfR-tP8!}xujY)Y#Cl@ob8s$n3qDX)oSvP8|
zwhfs*v&zNaa@@J|dD8G75}emRoAYgHCNgz+g1UlRmK=7qw?Y(z{KrGLF5ZPp4$9nN
zE11~w=UP{{2Z%W=%Qcz;Phyj`7m_T=p1>9JS}gQQ6%roB0uUHP1T^HRQXFZ;s;mJ$
zz|*+UmL&$0tzMcvDh4NpR(d~Fc&qY!U(rm1O=@`F`+bwetU|i>r<Xy_`s?lY6gsfc
z;eJn2VZV;biYt={S}_aURg0{d3;vaf+Ww=UIMjk9%xbGRcPgNtC`ZOeGQRG6zKp0+
zRr??LQ^gSNCLpa$`6%QmImm(Hrd6)|LmjKZP!om%zuV^Er(L)ZlDJuBpXUcvNC<#S
zc?ps=dvYS$8c9%-ue<SYnW~!Q-L8|TypQ6GltUX3)G452(1XDFcM-TB#FX5uVpRbo
zA@c7g(lA(1IeA3yqgO23E7{6Zb=WQxEw>VAd-39*HUt4Lr|2lUMbLj*o&4Ae)2_Wh
z6;D2Cay~EshkcL-jMBeRO;Q)BvR5J+WcQA}oK;z+Seu12A)&QGHgRVZV9*eFR{n^M
zf&<v<WETcn`BI3fwdpb{iO@l`SM&*jg|A>2WX5&nBA9tog)mcVp$S-&5q^GgP8wCu
zuZ<I?g0CnIzN#Bq(?D>5r;S>s@}8o3m3`R(kzLmtbQrt&V^xc3RH~X+dUJ(Z;M0-b
zFp`Fa5HfU}E$Po1rw~ABbP;<xSHAkgdodpt%S<M1Nad$kFz(w}qsJZ*vKSr2c0U!w
z!#m6sXOqD#t-M_WcJa6HF}R*GA}S%&1-E&*o(CY@KUFJdnjC*O4ee+W;f!_%U?TE;
zHQWDb23J@0@k13&mx2x`hE7Ul+GJ@JZl5EMFiBJDrRl;|4u06;1v_a;ih`=6zwsGt
zPR%X6{h`MNsN@)Tll`e|c@kxx-mnK*@ws@|(K$XA4eFQhhHjW((#UKGEI-7dwM$JC
z?4P;Wuu?>d-DaJ515L__aZ(Xd-m@z{!HcCou*XgJ1+k;<h5H{;^uhb8PAgiq{Af-o
zw`f(4U2Qp^If)<>`HzSrC+{t((TTa-LxVC?+4APe>4Vp(>m1c#JR|Gcxu{1)7g>wk
zjS5`4HK)n7zLR0nOh@O5P<6#daNMaAmY&s{3>UPSXz3U^8O)M>oMx_Us%RqB@rW}V
z!UlAhUou|dMlPDsC6<I*3*9FZRoLB`)DwAIM4PeKMK1zYcYQSL-GF<^d%SfSm`gMF
zbfU=u&cD;eOlvU^FBBK>(p}+g3|LWWTwM{G=6-RLqc-iu<v%ob%3%l7Tg|2Zh$FO6
zU*j^&I}by^J+9$xq`zd&3Mux<{AIm9&-B^?!k=b|l{BH%9xqXanmFu)Q=y!OOj%Im
z=8zDs8RE$7xUa4;vf_LyVc9c}B_bPb*f16B@ygT4Ov?GV3Vu1Hoxn68o<2q(zX*dG
z9-6(gdecRTqFWnS-Xkp@RjC*%-*<m<p|#y<x>)AQNMG)s6N${-a{firt@A;G{Ts*S
z`nHmG9Q0gYzhcK@j!E#{G!cB;)|(+Ld7Jh`#})pd_;C8*v7ob<?8>iVji+^Wdz)!?
z#SZ$oxlS*vD5?edaC_I}=Hdu%*o2;s!`z~3taJvuYLp=B@R`lzi&D+UGc~QP8@Xd%
z;aacpSzrGqaUR-q$>68(N@jMcHAqWb9!^lDQpj{<6HF>LwBl6m2+i;vk(1n3u{5YA
z@j47e3DGsNp}eRjggbCid5ew8fnB{wJjbl%*ei`TnPD;XBh7L_=DgIKtI0S0?QDm3
zm+oM?97|~fvAW>a;F}-APVunVxgdzy(^0oT$yIZH^&6S2$tk8hr)Cm(3-6_nxw%M{
z`cvl_POrs;z?Xz4wD$JSJLAPBSpY+yYht$j@!}8(Y=df??4bxmLWP>RCW_5X;7hB8
zhZnGlGtEyty>eMFsw$3>IL?`@)J)Vrl|8M-V!3@T5Kio8M7AP79kW%N%&{u^-Edxm
z*aJFfc1ajy^WoOjY;AvOB^<@+RnP3v+YS8I&G5tY_{Jm$ibc}N-iftT?^Pa#Qozml
ztz^f3r|!m9Szwi)!sEDGFs<1^gh*DU%c9q!cq8AC|5&K-H6Ul4d;kx|Be%deG-is%
zL6Ea7TRc|77G;YDqeHP-@xlr?w@M{s`YWQ<(5{al4{V#K)yUe%GR#Ee-ztjUoBSEz
zV+M8J64g_)<Lg>L<8r#FM{oIK68N{ykj~zaS@q<h9}Ts!W~}#Q0Ju~Qo8xt)9`uSQ
zi(egOX-tjONzy9oFGaPqlN@6qS3c;21Bks;R2DU?ly#9lMAm^FVTT?v-IeOv#8h*N
zfI!?DUbJ1+r723=>6Qmv&3w83)~bS|_+3R13Gg3AOy7o}=KNHefu1@%BcLAZ;+|2Q
zL}KTzgrI!KZXI836|?m>u+MH?9)`avgV3)cSv&%q@hRvv)k=G&ZPmgWak|IS%$@JM
zFIX7{nf>|&0)2gbi+Er<kk&e4QXPbErv#ovxt4gv8Yfn-*Dsi$&=@vv4!!hC{$-Ut
zi}sZ|Enh3K8{HVyRzATCv-mQ3{BL0l=m}E}oxaCgU&!3uo)K&=N1qj8xs-HiIwiQ|
z?2tVKSt4B;Eht%*aD`e-{(&gQ65w-sGj@sBuRw0=#XYc@HaUWW)2?iGp*?7jQ@!Pv
zs=-^J2>wsVrFc0hq61Kat?oJBY~7b^ccHB;p@|2X&!GGlSHPhubh63}eNOb6oLXSn
zq*jAr5@CZ`&7BtYI~6?H3@w$-ez?BvK8hQ)qBfbynJ-JcmArXgwZz8+>p2FGrFY!U
z5i<`tx+Y}d2)wQo%YSD3I#oN-zAT<{sCSg!kzTs|S%mkg$~*}e?!`sc>YG2bx=&{r
z=VOuk_sBsa3sE!Ppjx47vm8Wt$Srs=g}>ooo_-nOO7sS~f(~}#BB*d?cbS30VKTUq
z3B|s9d-eR4x^`5pS8*-#?G1s`wP>R`{){+yjC>3ekYRWNapw8<R(X#HM2QK9G%Bs2
z^@t4a3C|nTU;ktR5MU4N>X=AubV2|><S54+OK1tgEHi-I%Uu<ZhcPX^@_)Oi(6=in
z%%KU44`dcu5L!T-r8>0wrrWbyJX$<P4BTV{3M&HnSNVV0Hhe^+d6+)m9(1RZg^~<k
z8OnLuX$n5dS|ynwAo==$ov<z~IT9#kZLl8+@wFlkv*fbGCMktgQJk2<Pn&sq8!P&n
zR4DSM^GyN=ZEZe<HBdT!zVl=1E<${%vyrpB55_}nt*VJF3^|V~3|vY>^0QAu%ve&F
zNT^Jq6pna;!Sbn)9E=j6gbcjthRbC<&B|CHd?^~N^OKsG{$sVJlF42c-~8xY_f!D^
zk!w)v!YXreP)omg@Bs99mk25S3^rCYNuCaD5!NAcQe9d2MKlhiSLUy@zC57h^17*R
zvI=h|Dyi0lq|<|{E7XA@fE~T+*G}exio`eXP;5|4X_vdnIvkjIGz7(8YmAvc!W(Gg
zEJcPzQYEtvOoZ7DdgqR>dw-(hdg?x@Q4<U<iZ1E(yj3|z7mWgMR%$db2T;-<A0cj|
z)d1wq^697GrT%Mp*-?U6_z5i5dKn~KUQt(3!RF(a$t4C3m5QUA{k0*X`Ku(O<)}2~
z=YwXCj4=Vb#RHmrX{EsC8nw5FRE)Q<ci%l$Nj0rQcLjxSJ>=-kp_5&Xl@FNJ+M=DH
zuF~Pg=9sN+UEGl4ptp+Fr}3*T&ywZn_%rH`NmKvaiI(RVZ027?vcN8etpl1rha^&r
zUhy!}g5>jDa1(nikZJhr+!-8~)6n1E;9?$iz(g~yxyHF^it`*!Ezf%!Wfy}mF_qH)
zh*+=@pzQ7RgEs^JQ+Punu6{aej`>pD87sk~(~H=|&5!Hz_cKOHDo8_~*}A3UK3)FK
zSJ%87wg%3e7KKX-j{33#56`rgH>E#Zc>#*9W)WLE9)Hh>d0Zq%W9^JM2T53(8ujq}
zVEHWUDI6Md?y=P822MPRtd1?fC`oUPGR6fO(x+#=CpSawvqS*z2lB|FcY|z#p{kID
z(!glAnf$LtXq=UN)LJF?A4eI(t5k55`E;c{M0E7LxTiLb6+g-<F?k6C!WVLsa?zuX
z1w>?ZeF=RGG3I9WAguo^Yy6$Y*Yv9Ocr(q)cdAEc(@Z)qUE|N&QVr_*9uN?4N@D&P
zrDMG;b#72ai0-JN6GL4iv|hS&i?0fuH#{(*hSM9(w3GKqFV&DH3Kb=KH!pmmcM%@q
zd@gaUMd4=zodrzVj>e#ST6X7dWNdvrA;?PaW`;d<A;m|k&~t3co7sR@K2u)IUnP8H
zck8?GX&6gl+1!l}$8;2SuY6Bdhg52uV$>SKJk&vNcezAPoQ4{4ELixU^(S&xYvH${
z@biMAQZID+u_jsP^y+b*WiiJKH=KV94B~8&Ph+GZ1RDNO?IPm|YGZQIxC?j5(tQA+
zxgdLxRU)2sP!4`XDi_>%ohQI>R^jBbi(Le(%x}so9r#{lDSh)Fr-WQ<di>Itjj9mO
z_1GM@1cDMWgk;60pa4N!>dD~pXdF#-p&0&k1R`XJne#$C0c}zLoL;0IKJ%;*LT-nd
zS|0UqmUpy;v+%hFzNcBk0w}CUh)3Jg52UrG*hCb&Q6AS5X;_>i{oGDB+c1PeDyzD}
z-$iE|tecTwr0Ow}84&=6r{6nuFsfqyWh+rwh1IYA0NJS|m-9}Ah)E~mmRO3{r?gK)
zt-72~=Yx-ep12SgPSTDZLKa#C$qn|g8%G!AFWH^U&;IBY8ZHbVGcn?se7Ru8mJ*<|
z=Vl;Y@ZDKOaoO;{R*6sVXcX>1U`1g=a);e+48|2L)O~|#{+H%#gm7NPO+ue=h}#pX
z(3~be1|qV}FxOh#Xbi#o*U|r0+;65~`JRRth{(6vc!cwCx*15@mjzc)`#4KCtE<es
zsmiK%lid0>tzGcf5`?w%+~tapT|n{+MpecgrqYV_xZq5SDiPGNb$(DyILc__cRb@?
zZ3dSs0`d_nM5|2-esB5%JgdK3FQRo)Fxp@rV$6)sJoBa!zb?@T6(4!{_X(bIsKTN$
z&aW#ry+szhrf3MAs^h@Twx9})L&2htAuO-K`iErpR_dN!<;vDTo+Fa5W7+%AjuEmV
zku1ds(UJ@Vm^^Asx-QRc24;cH%pFFo5yZ|grjo2BY9-$B4^aV9$^NP1*dN4Kqp1*V
zXOY@Ik_Q3XHSd)}HE=&k40HlP2!;G+%}orIh;lJ&H;^|gBENY+s;BMa_`K|mk28k1
zYkzGN!P)u(PoNCn9dO?o_dx7z?Lg<Lune_ZRGN~mnBpUrLLiU^KCN4QZ?c;4r8Zr%
z`Hk)>y>-ZN5Ez6y23Kc6x(vn<C{F3SiuN^88ip2DmzI&Kpr;|CZRzs@0Nzw_L``K(
zQf3O>oF+VR$&!KmFC4<!?X@F;M<<Q`L*>`rvGoSjnb>Nbve`58TbC=#U~3%2_4?_l
zQN^V@tBv-Df2iWUDN?kK%>UrxcHCO0LaM-dV8g~4o}&_Q9=zs^BB$`sT|L_K98F?-
zni$KUsRESPgFwmbk(9X(9p!~>Clah$k(K~|SRB*XWhZ0|=)$IiQoMl45N-@wHf{Vt
z_bRw4J(AYbV8j@a07RO~r`Pt5jxeqsBTq>&vDOHQ6-3Kpx)}rKlC2|a2Yl;<dpYr{
z_{~(uAjK2R@IM<DIX*IN*xFy;`xR&kAu;3ZYdWn3pkN&x8rFmd)lYv}R1SSUzt=sl
zFOh308j7;7il?b!*RPp=df}2~(mT&wAK_?II<`wJ8HgMRjk4N0c$s2bLeRo#%tQP+
zmBNRj-~Z8(yFGGA$22cM=#RfTAhlKzNGr&-ofn4rv<7*^DL{~lq)s4uy;~|Rzu}}P
zUkRY_{i2l+GV$%hq}Mb}w|n}k;E9Hf`d=>B)iBCd6qRJ718Q)Mc<$cHiT&SZkCE6c
zvK@>0l3=~4{PBy)jcB}TA1ZS(%r$uuyM6QzTFMC#i%g+9rA+q5bF_C_&Px4p@6|Kw
zo(d*=!<cZ`)i;=6wTl%lHp2}=Nu%UkO!n=-+1tEH9S8Z4FtY=H#X$!MxC5f-E&es(
zy1Pk~3C`&lMS8Hv77T>4N@51m)QS<#y*v!TLWZ%i&GOe?*3eKx%r+~hVF5F)I;C}3
zUTI|otZ&VnGWFOI)!FBA^)ri^nWFsccYbG{N*(o2v}8H;qwPHIj;x|mO?do__f02)
zh?j;v@g|X*beZ&b0~1JTd1|yqG9GQY0Z~NjSiNuVouMmX`sK5Q3fjO*>0Oj;CC2BN
zoIfbvPWS3(1s)#lslGI=x%MXue|b27<wGaSK&|p8HVs1K>M~MDQ`!<<%8PxNoz9Hy
z?HDy&>pFAq#u~XhGvIXnQd^41@<KwpM#5s!!E>`!ybABHgwms)J?01VrTuu$(x_JF
zDrVPzk~WizO0aejLP@7-yTCy6d6;D7z+ER4F4uDp?A2neygYGlbj-gj!=Yn-$XM;D
zKdZo#qZjdOVAK`;3GEIbbVXm@<tSoBPZP|-+r^&HLyv2GUFcD8Ais|D{H(^Ia}*)2
zFx$+Y*wlG@*U=%S_G#wDH8~Az*udr704y8yb{MB=>xd2^M|W>{rSQ0kCuuVEs+63`
z$kH@?U9rwTe3q|cd^|8M6@IBlUv1i!pMEg3IJGW$>m!~)&?IIyn}B37bLohQ(=@{r
z{8KhA&)MK><UY)6U6+(HCm(XY(nqS1IkHdD++Ei$BCbKkzFB3bA6b2Aw&VQQ&kVeZ
zM1R;v)jvqOGXMxX#be+ESD3y$lt2#;=KAh3to-F>oO0By#I-9eOy(c{C;Y(X*=lCW
z=q6QalQTa!$s=mZH>j81zNtncsPPlRT@>6sFqNvm$wLY&*~FOspEsmGe%xH2iYB5u
zOgyBR(cht+os~<=v{JQRW;#+i<(O@&mR8VzFn>N+G+Z}L$^2`#`+plG56<`>Zfn7N
z+Aye-zX`I7XI{ZaQ)|1#Ogz-1xt8}?OYOm|7X9R!Hy3O_^7$a1x%5UcMJV;*6~Qc+
z;0u05XUEapq`#=iMCP8-NQNqX;!~9__q5xcX01@pH;|^eP?u?B*v|~sQKoS<b>DhF
z-qlYL%?@&Z)At@=2er!#&q1CRR^`W51-6MDR!G3FGlNG-Tt2{g(zRRdqK1%PK&AHT
zZS9-I*g6i4Znx;yfE^SL2&v)Y3T(3t7qZq5UkMlxgHM2zW>!Hr+&YHAM!V>Z%i^_d
zI}f+SeVa{#>h_Omh=Bxlq)LxJ*gA)<MPg<5yV~IEraVnV9)P6}msr#~{caPf3?Q;c
z6cR3$B_`Aj^0=G-YHCmW3LX%>0Y1)mz8gB`0sZ}rnH#F{{fyel>!+cr^_NkV7#p_V
z%_%be!0$Wi&j*_${NEBqGtFnkd2+B%WlBz|{f=w+t<1s^xwL|{OobCVI$l>}SLq@l
z-@wCAo?a8;`0NAv>jK4NL&uTjen}yl1(0H>-#tvm)L;l8skB70hCTT=Y5Hll+I$?W
z?0+2-C^XXlbKHCJLP)aaXu8&6bHj85pCt?yB2T%PxfdIWY96QRotu1?tRcy`EI@eF
z!g(h0R+F*uP`I~Gv|`*osG@%4!q{|+ij1(x>Jx+3U0feJj5Uq6>XeF5(dx~YO@QSD
zF;!4r2l6$B<6OTnpmXOSQ%dAeMYcL%<kwXYhKE3xNYY}~5$^j?Fmd`2CPd`HEH3AA
zhAii(6x^{V@`+Yor4zIQ?JIt7h2B4z(S(&)fqr~3Ztd(Z=pdZ1iRLgAt+!k}g)@hq
zCfX$4eHh<KT{ZF<{SvhKht|EB{w$M5`3wwE#eDP^ccD;4!}#E7^J`tzw#$fW)YJrB
z@ww>3Dcw9$EVV&9@4CTDX5^ti59u+n9xv;11Rkb|(I4AxvR`NJ4v8_P>;f#Kqz#e6
zCydVsskOes2{wJ_L%*!}*NRr)Kw3!^hkUCP{w|GOI~V9VLX&P2>jCwt45Fki-iJj~
z9)b4fk5_UTg6qPOV{UBpD<WoWwckgBL}MFBdJ~;p6P~V9L^U3JQKoM><Iuo=6uUyj
zc~Z4v5a@L)<M@Z1reL_=AG5B!E$A((8I5X~i)DU9319_Cv(puNJI<}d3Jvxaq36Qq
z`BnB^AT>mG4<aCplzN$|{pFz0P<{H$S0+hNp?N7SuzXeT-D%!0#Tv$GaWcHTo0Adw
zzA?abm`tB82$6lfsfE&JfMq%|o*A%v-d1NLKHQXoW(ixDg#4}in>mn$viP7DU7Z2!
zeCN`%fy@8X&R_1mt+zO&t;31Hxd#(qOH+MV(2oL1|KH*i#(k-`JIuup&Gv)+py5Je
zs}@TXHYiQYu;?UYHtKJQK&J5)JN4_f7XuesvI(duMjDkOnC<qEQM+8BTX9+#lxayp
z<iB%WjTkH(I_w?|$2S#BJ`HU<@Ogy2Ko;Yo3!y~%-|&{!qWHNXlIe2CP`h`@C(RHQ
z)KvbP`9?A1xfg_t#-RNUeGP2=Z#l_82!B_A>}XtkJCuBP+dWp&Eo7cH<st&%wFIR*
zF|`FmM|U0MBw~Ucr#)y4#yj(j2VZ!)s0i$MbG&&iQZW8{L(!8>^kQSR?@QC+yH~TW
z$R8!6L<TVlNWp`qJVIql=UWhxgJrllmLQwW2oLvI_a?Jn5NmdUc#(_^{=Pp(X88qO
zSy(|}gV*;+B9%SefTK^~J7FTJ(-J<Fhi@h`(S-Vo!R%d(b(MO=noXjqV)LNxg9}H6
z`lOjKEmafjKkmk)U^C|H?O}wnDqs)8gVP+?0y-jh*|#9R{|=+7ve5c&F)~`}HSC4p
zwfT~5pzY@6{gXmR@+B10Qu{p+Pq~njlc>WvjdO+aEc2EQcX*F|f|;*6gUi1-+Bi>|
za4*Y`hK8LHA4#Wiz8`uL^VV_-YXG0yt#@ZL=QyI!0D5CH7gye_-R&*4MbZBoOyj%Y
zJvW}Of=A@4_%MV$>=0jd;XCb0sm4D_FjfO7@9iH^NUVONpbCspB7fh31c@$Lq2bhD
zx&a|bVI@*u-2v}>kn{ze%FZQT!-;K-O1yUFZncKLgL+qPDOe*HCn#2}0-@^Ks<!cE
zVP%Ia3m-<{x8m`%#`L7~O$hxRU<x>wnP?F5?zoli@LrF8BdmAP{U}DA{$X6#N2DT!
zY~M^_#Am?bz65Y>Z<(LK$8%$}<w7d6BTH9qGG&<EdEob-sQ{$eO%X&;yjr0-Hk>EW
zTxn(2KHh<ezRmCiVVyHKH6*<XbYv`uNfs3Fy~7O)Uyj(Tgb$d1g9Mf&z~m~HcR!k&
z+L_I?exI=jca@k;XcMDC3quXCg`d@HTN1-Jva?;KggEl7<!o}|yuEUUh`WWPGshE_
z-p^M?mm^l7X8Vw8XC|_k_{QcR))iKvf?l3a!kneeqS<LIF{|f?Ap9DYe<=ZIy-0D*
zr{Cu1`pWzU2a6iU+YSk(x_0$8M;}#~p03nVMm=aN91F?vqoW5f>Z(y1L{Mw|IJ?Wx
z#2T40LBYdiL&XsVGkzwk{OfK$9&>SovU{63F+m!iP9&KNRJIv-JUeu{f6*IGSn`Dz
zItorJOH!waLt_bUnB<}p`8>LS!YRV^&DiOPrB6!(AZipwK^7IW=1xYtw)n*XqT+X+
zq%Ry<Fc;)tTWv#B469oDS3L`RWUfaH4{_dzp_rWRVY=@jor@6WMG9qLv=IG)hwG0w
ziow?WQsT<Lg66@`R5SphSdlr@pB4St6j3Dq0%XiEYyXEn5rTM=f2#-xva$K)g&$r1
z$yUu>Ap?Z8vB8OMz~}s`E{-kWe#L_8E_qr#xpZRR=A@pR&P4o@pjJXFI<HCof8gVx
zmSu#;b8@dfd;6UTj!pDR??0@^H@l(0oNY352CwU&KY=}+?n0xFg)C*PjSmBO_rbo@
z#=bxE<S)49VyyH_1o%c{3uKh#tZAy+>_kt`BvODoIiT_qjv$t03PEw#y&tk(hTlri
zz2M+P;>clLD|6f4e^w3u8mf9V2MH#q$QKs;7!q4r%=zo-#Q(pw6aN)Zyz6iU7htnZ
zmN=&9b8loB7INv`_a2Xt2w&tlwrJ^94^VH?72dx(G=@@VZzFw{@$t;L&|Ro$BrFJB
z+XWWks2P!&t>KubS{x2HD*~rY$d5VPC|4R7XHe(d{2tc)WPyqaMU@?{ekV9*FOcU<
zgf!%%X+B|_|1NBPV0d~3ERUpU<Yyx`At)ihB0Xi>U9oj^3*kowKdkXJKOQdit$|bm
zI3U_tjWS#gmY-JcU{+Pho5~?(@b%<^V=SR{N5A{uFV!&4bd%=Gqxhpv3vP&+XG#ho
z@H)*!=^5nth>K+60emc#yX1poaUXCRjVVE=NKLg;=0uEckg7zO`Hz!v;25cdgOs9p
z*6-^7dn=USa-mFkqte5Uv?*JXW2`gg6rX?xECidpf38x`^fWHN#bkvOlGMO@U{$?B
zR{z1B5aYlyhf8~{9(}UWZu|%U4+LwIH&x1ojMWZj9*Z(ytm-jji9FcPQH~+hOPLR+
zL*K94o{|@IjUJDU#Gg*yznOhIV0I&?SXeR6_&Z-b7nS*5FpD3R(h$udLtXrkPPsxY
zU&N0-G+wD1(1=+|l}5KhaGk+J2P{{X=#VT&1W?KnVFKooGpw54X`tt*4k`nMdL@T!
z<azDBBijGm!7C*5`P~o{OiiMoynTC`0^4n8{5TAew3W@rWj~Oa$?g-DypqWAv`)yI
zsr#$P%p)aGKUokKh2{?OQM^rO0|j7Zxqz^u^p`|yQm~yYwM@rwl708|vP0O*PFa4a
zPZ6P>LJ0URjvj<iHX^l?vhH(N@y4uXQNSVedtC%|t%&{eDDv(>>9C)X`uFf&=2&7=
z-WVa^CymW9YHg@yxI$exaSgCS?UsyM#s<^bvU^Wl6ghzw?fvegGRdI!gF}WeMdP`!
z1e@54Z7t8bnxs3cfswD~26N{}?Xx5fdD(zjeiLv~>g%QG5Y56AF@jKvP+WC88EUIK
zOijFMcos*%9~ltLrQ?aWN3x*I$*-yo;GSV3&}a6axki)Z$+;87uxPn1pioV*ut~il
z-ab=Cp1mKvSOS85UgAHKWono2*2=eC{~2(Se<BSH_A#rjY8oa<$e_UB=FQuak<+ka
zj+Bb*t9|^4ubAhrlkJiZ^!>+H-fO1h^DvZ>#y%sxgpbiZ(-rd+OL3<^^_ZUe{%@dP
z$B%nlAq&u#JFAabnCj}72AWU4L8j(eIhESqD)i$2=190Fm20rf{98G7P`NxO1^sJf
z4KBh#z?e}Cg^OC0I-W%?5H4=vt<dXNw@P`44^fqSAHo8cZn0{N>!cm$dR*~H#oH{r
zLbK&;!mBzcm$Ld<vNX67iH3v&Z*<3;hUBJIE4FHkD5jUjj3gI)li}wq6Q1iT9u%j;
zKxjlh(PcUKl48MyF&_Uf1_Gub|Bi>l`dQo)|0Z^B>PlyhU3(hI_sm&&vOb=q{_fR4
z`}TYF3x7+i?i^$rs;jtgd{P-djtP80Pdhf2-%N1vsPG;rx9-lB{#msf8+2!ix!j{y
zXWc+s#<t=>druXNUsO?#w`Jg(Dr<H8DF5dN;ZWwu8w>;6386&8Pa7+*oY?w8D{o)<
zs&=muWrbOxxh$gMeH9rXM2LkTV)OfMrRjL}Sz5#<APo`3m{>FFzqlp^?y^HRR^*YI
z;Rl<kjr7P_N=Y%{?IQ(uCeXY3dpOCKaJOU_3sV<MM0}1<uQrM0ba0AoIyy3obC;z+
zNN@!zkV$7ydO+t*{9HI%8{C6KIwZmef?x|AfYNKJkJ6r_9Ca#cjC@=z#srO!pRN&+
zk(i&Uxgd*(v4_f}Q;YVYuf@!QYm5ASZ*zT5Z^(3&5_(&dJDtnK>En7$-*eIt{;J{p
zDuwK|nH?2hvwut|r8sKXQeCLQJF^ko`=s1tG|L5&usdeU4Rr#^`23vwdCu!qAcV5@
zS#Fx3E3-9%GfT20UICF*(<j#j$Bq8#UZ%|DXUqWHrw8i9+PI-|aT97-JKI;b8ZJeN
zoRrqFi9+iEO3VcsxLLluu`P<OcEmW&Vh>uEWTo5HZ)Z)Uv*RoBjY{tjC*FK)n<GOr
z1EP&_rNv#^`!m=jRrrz8?IC}@cbQ+Y@kW&;sq6IH_~H+?dI&11tc*?oQ3j)2!0n$9
z!D+5x(x>+EZmayde+Ti;VSCr<8wSL+c^R_=oU=~ln-tbGZZBkSNcIR<O|AE3NVT-*
z;QUm6Zp4NQaIU4*p)O9CF4cL}nFhhYt9w+%6IQjk2%G;6jn?``vqb=`5zqR%cL8F2
zB8{i3PIlpCS>d;DlCMLsO8Q+w*M%h@rsDQWLv-HuV~hNyl8Jt3=CAxkT}#o3-{;Gv
z5j(G3ZwcO%0p+&!So|a5=X4~bb!UteIsR8RF;}|j7_*@XER;P)Fst$m28{yERJd4!
zu&}7HS+_ia$&!~y_CR{+j~^5U0@(sdqyTLL@3#-MbQR~oycr|=p+dKC&baJ!^c0lw
z;-6=pOyMr%%6#LJKIs?`?yS$+6B^lqX5lZFePjM#wPpahte?@CEyhi^?8V!%R_P@$
zeu#0Z=whCUIGkHa5D6+XIEmbgFPq5#XNzy?UXSzm1&0RE2t8~(4aQMBEo@yaH0CsT
zBAzKPGFh3b4B~$*IAk)zhtBuGcm$KE3C`>$=s$IZMWtF4)M3!wwwSmaHN=Ve=-lSK
zeAqU~M_j5K&#~D;MvBXw;3w}BN@Y6sixQ}cEc$N0SS87Z`F_@0c$Gf6F$RDPpfd3*
z^FJHVWi0?*VJRjy6D+w$S_*9Z&ts-g6d8yj6#R`GuD=!cv~V@;u<a@!;_l@@vq@;U
zc32<8fZNsB`mL#!d~(3zbuYgFPA^yG5Rr!p7GdN)VK$tCXAeqDV^=PwjwFkZ^J!iM
z<_lnzCQxb$C+l>k_#X!vWlEqbAV*U`z9)&gdh5;)-lLVyW8sX$2dx#OtNcoSJ8uX4
zh>`*lW3zHbm-C%VMnaBqu5$?sj9GYRWJgcGsc9Opvs<*YBU4Qt$zL6+%D`~Xa$&`}
zq67P-{Y1#c!eh$5z;<Q_-dSwYRPUd{i}Y~Wf{jCibh&|=g}OWycZBJmRu}j?%W*Y&
zd3qfQfRQ>gc4i!QQ{{vZIc3lwT7omRi+tBXCpy-edn#`&rhqT?G@-#dEaT?hvSP8(
zV*dkT6O(@9Mkz-Di$Tlmr%yK=cI~TrZDW>&M4?8ZBiZIiU5M^rjp$&D>jp&Sy8&4?
zNcoAr`&1%t@>PWm3%9)wBI^duN<nywGx^BfaGd{38UTxxvaXJ!pV4CsX8U|yr?!AZ
z#v@qeZI)6%a>+J{61^IF8{IX#^9yM-y*Ye#_1r(yFl)H@*=iqZROggIR=<&ifZ@9B
z#v3djP!I$;1?9>NZI++Ra1}J7dp!w$$}2>XnY7a0sz2#2?ioK{xO=O1Udd7u{HseK
zBx=P|A@dCOel;j2e%<GVWQyiyxe`}c8a7O)*|5Qxca!nvWCL$8j6N<lhdMShp0{;y
zj!-q~m2n~-(iJBmGA(zbZ<CRUJ5N~~j@i$?Itb3xcj}9ax>v$i$YD!!RE!z>4DS)D
z=)j{pdLFhYnw{QN5dRX_Ywn2;Xv##kyckQXoJbJ)%aYI%nYT|9@L!a)yN)w_vBaGe
z$g^lg+g%S?Q~YA|3fc;gGKGQn3IN}B>=$JE@2CLJy*D^1MiqzIxe%*1kHYv1zBLL6
zL-dNBX~%-SrHeL6nic_jiryjofSZ=flWP7+7M5Hf<03bVj|vhl!Q#~kbkhoD20H9K
zcY)6AmjDD+YMKOV)#L(+qXKyih0C{xW9w{vEU{K~bRMx)dH7R5Y|~tPGHS6J?LckE
ze$U&UCPX&&F$$cLW4$k8Q})sC5*I53)~^v$4o}NzlS`;jhPZYGeOOLW{Jl(6KAC3P
zQdEGRmLdX37ELSSg=Y)I-c1f<@7$T>*0Sn{uXob;b95%FU8ekIT@mRpt1&F(1*bQ^
zkwx2I$PZhle|SWSCaL}|>RHM^rnIO!bN?^ow6Xc_{62@ZGl9D<e}PrvcKXs~hdDlw
zGZyP)rML@R8S_7XpFWioTl6;TOrt(-h`aVQELjQd-kS0nx`9>>Q}J%uKn5q6_P}_S
zp0*7w>XHFB>~rcPqa6@Bin{X@O-g>XIehvydIzm0<11$qezCOJI4Ee&=u3x0W=+=L
zw})?{Re|u-w<#hz18x!)?b2~+Y7@Lpf@Sn#4E0kagQv$_%GtR^JG?D&v-3Yvf7E%<
zVHF3X)VF$;e~a?oUSa$@9=|8!>4f4G6}lJDGZs2|xH;vTuZz77LX)stl_#^>a$G2U
zCO5J2iE`9={<)mo=Xgm70Ev<rtUr_ttcWLAZ>|3_4&NfQ+^TQ=`}Hm)tlFiU7Giv+
z+#KGat2up{xZzgB?p#6|13iWjr>hv_#`zuzum8s?O?Vt}x8_Aj%d>1df;-xfMDsco
z_5XD`@6skpf8)aXznz3$zjue9Ej|vhYePSm8_B>vy)W9$>Y(83iT+wW#NTOMXyK}3
zRFVL|1z|jr-pPYt<(k|J)-tKUFXl8%0j$BAj)dwN%>0L<6ggdSmBEK&Hy0k&9Di^#
zKKibO{?vX70st}?+>VkQp@Z00kp5>4zgo9F6X*Q6-%}eUpe7M!Yrj(yh8Hm>Eb1B(
zzBj4dvuSSDY7s715USWgm`LQ-e2K*mvxNBY(~rOF4l@SO+GaCT5NfDUwKlY>{4R8p
z1{>~ChWltFIM0Rg^<`JouQN*HHGvxV@z18ddNtO#U|yPLfQJhbk_MqcML!>Kv@b8o
zHyC`jo?Bw_n;WCkpUeY_W|JF}r}Rsx1-&(OWlGxJ>|%Qaqc{>v{ADPA{`YcY_;~Q(
z^a7UT-1K0o#I@KMkW1}|7#sTC=E4fprw4J8#Za?*ZJsi+dLk2u#!SiAg~LZjs@+1!
zd3_8rI8a73uX0w}GB6d)$2mymuy<LYP3<BTa!$?T%lYvn9rBmOy~@}XjuEMpQJrI1
z?~sp%W+QGJ4q1QU7Ssp!P3OWFCpji~^TJtWGbZ`9<WO6&YGy~m`o0$+#X^u`OK^6P
zjXB>P+AsyrgX%(u7V7z`gidDn9a_Fbw~;f;9y3;MA2N?BD=V9hwm30W+?oZFSv5xH
zm>^&=Sgo%0ul-G&|NJ<@Cz<YOm@hXWEFmk^#}#WQl$F-zwvuY6R_llde1E{Mm${P&
zZ3@f{VJq6264qyH7a1Low(M-<FS3ZX_#%16T~chyaQ0NBHU4IA{J!U5#bMDmnqNfs
z5f-$=l7Q%oE!C49RLA`&<m`ieGvQ~W!z(o)9aF41+R-I1^)V&GONCO5UXCYAL3Isp
zJ!XpAXBiS*6qpMGwmT$VuN^zl#_M?Lzjq^8v{$OW{<uZ=T%%C|FC^G5aebyo3O)#6
zCcQMN=2k$-_3h@zt6nwM#rg8WS*+#xNKx>!n*!LIx_iq06)V4H3YfDbj4othyQjRB
z%k99ZgUm7Tq+tY+{)4qia?1LQYDah<i_~`d5Uzz%Wx@jFH%R!7=Ve|1)8h5!%5;oo
z{VGyey=@kMx5ll>J|A=C2omph4b}7z+1OUge=M9ZRNB0M1+VrE4}4nI&Q8in{QEYV
z0FWje^NikQOuQpKfRFeGOuWJFFt1I{YrC;-SS2qw{K}TkFa8zfbbD;6F761@K>O$4
zVzkB)4cn+mN;1KFIiOU0Y&#mM6F?d-M3;Nc_{LS*jp%a0Y$Jx?WBjB8V)SBO_l|jg
z1CFc9_wOel+WvQbdrI4|*>Ux$Qcr(#iTiCbkLV>~NcY~h`fJqsoB|`Zj$hA89g(!2
aboSQpuLbZ2-BRZ1^S}Sva>&pj0RICVxKFYG

literal 0
HcmV?d00001

diff --git a/docs/user-guide/first-steps/troubleshooting-webgl.njk b/docs/user-guide/first-steps/troubleshooting-webgl.njk
new file mode 100644
index 0000000000..bf241d0b1f
--- /dev/null
+++ b/docs/user-guide/first-steps/troubleshooting-webgl.njk
@@ -0,0 +1,107 @@
+---
+title: Troubleshooting WebGL
+order: 5
+desc: Diagnose and fix common WebGL issues in Penpot with browser, GPU, and system checks so you can open the workspace canvas correctly.
+---
+
+<h1 id="troubleshooting-webgl">Troubleshooting WebGL</h1>
+
+<div class="advice">
+  <h3>Availability note</h3>
+  <p>WebGL renderer is currently not available yet in Penpot production (<code>design.penpot.app</code>).</p>
+  <p>Right now, this renderer is available only in <strong>testing environments</strong>. It is planned for an upcoming release and should be available soon.</p>
+</div>
+
+<p class="main-paragraph">Penpot uses WebGL to render the design canvas. If WebGL is unavailable, Penpot cannot open the workspace canvas correctly.</p>
+
+<p>Sometimes WebGL appears enabled in your browser, but Penpot still cannot create a graphics context. This is usually related to browser settings, GPU acceleration, drivers, or temporary GPU overload.</p>
+
+<h2>Before changing anything</h2>
+<ol>
+  <li>Open <a href="https://get.webgl.org/" target="_blank">https://get.webgl.org</a>.</li>
+  <li>Check the result:
+    <ul>
+      <li>If you see a spinning cube, WebGL works at browser level.</li>
+      <li>If it fails (blank page, error message, or no animation), continue with browser and system checks below.</li>
+    </ul>
+  </li>
+</ol>
+
+<h2>Quick checks (2 minutes)</h2>
+<ol>
+  <li>Close graphics-heavy tabs/apps (video editors, 3D apps, many design tabs).</li>
+  <li>Reload Penpot.</li>
+  <li>Fully restart the browser.</li>
+  <li>If needed, restart your computer.</li>
+</ol>
+<p>Why this helps: GPU memory or context slots can be temporarily exhausted, even when your configuration is correct.</p>
+
+<h2>Chrome</h2>
+<ol>
+  <li>Open <code>chrome://settings/system</code>.</li>
+  <li>Turn on <strong>Use graphics acceleration when available</strong>.</li>
+  <li>Restart Chrome.</li>
+  <li>Open <code>chrome://gpu</code> and review WebGL-related warnings.</li>
+</ol>
+<figure>
+  <a href="/img/troubleshooting/troubleshooting-chrome.webp" target="_blank">
+    <img src="/img/troubleshooting/troubleshooting-chrome.webp" alt="Chrome system settings with graphics acceleration option" />
+  </a>
+</figure>
+<p>Why this helps: WebGL depends on hardware acceleration and a healthy GPU process.</p>
+
+<h2>Mozilla Firefox</h2>
+<ol>
+  <li>Open Firefox and check that zoom is set to <strong>100%</strong> from the top-right menu.</li>
+  <li>From that same menu, open Settings/Preferences.</li>
+  <li>In General settings, confirm Firefox is up to date and run <strong>Check for updates</strong> if needed.</li>
+  <li>Enable hardware acceleration in Firefox settings.</li>
+  <li>Restart Firefox.</li>
+  <li>Open <code>about:support</code> and review the Graphics/WebGL section.</li>
+</ol>
+<figure>
+  <a href="/img/troubleshooting/troubleshooting-firefox.webp" target="_blank">
+    <img src="/img/troubleshooting/troubleshooting-firefox.webp" alt="Firefox settings showing hardware acceleration configuration" />
+  </a>
+</figure>
+<p>Why this helps: outdated browser builds, disabled acceleration, or blocked GPU features can prevent context creation.</p>
+
+<h2>Safari</h2>
+<ol>
+  <li>Update Safari/macOS to the latest available version.</li>
+  <li>Restart Safari.</li>
+  <li>Re-test in <a href="https://get.webgl.org/" target="_blank">https://get.webgl.org</a>.</li>
+</ol>
+<p>Why this helps: Safari WebGL behavior is strongly tied to OS/browser version and graphics stack updates.</p>
+
+<h2>Settings</h2>
+<p>Some advanced browser configurations or experimental settings can interfere with WebGL. If you have modified these in the past, consider restoring default browser settings or testing in a fresh profile.</p>
+
+<h2>About zoom and trackpad settings</h2>
+<p>In some cases, changing browser zoom or trackpad settings is suggested as a workaround.</p>
+<p>In Penpot, these are <strong>not baseline requirements</strong> for WebGL. Treat them only as temporary diagnostics if support explicitly asks for them.</p>
+<p>If you temporarily changed one of these settings and Penpot starts working, you can usually revert it and test again.</p>
+
+<h2>GPU drivers and OS checks</h2>
+<ol>
+  <li>Install any pending OS updates.</li>
+  <li>Update GPU drivers (especially on Windows/Linux).</li>
+  <li>Disable graphics overlays/tools (recording overlays, GPU tuning utilities) and test again.</li>
+</ol>
+<p>Why this helps: outdated or conflicting graphics layers can break WebGL context creation.</p>
+
+<h2>Known edge case: Linux + Nvidia</h2>
+<p>Some Linux + Nvidia combinations can report WebGL as available but still fail at runtime in specific browser/driver combinations.</p>
+<p>In some cases, switching between proprietary and open-source drivers or updating the NVIDIA driver resolves the issue.</p>
+<p>If this is your setup, collect diagnostics and contact support.</p>
+
+<h2>If the issue persists</h2>
+<p>Please share:</p>
+<ul>
+  <li>Browser and version.</li>
+  <li>Operating system and version.</li>
+  <li>Result from <a href="https://get.webgl.org/" target="_blank">https://get.webgl.org</a>.</li>
+  <li>A screenshot of browser graphics diagnostics (<code>chrome://gpu</code> or <code>about:support</code>).</li>
+</ul>
+
+<p>Then contact us at <a href="mailto:support@penpot.app">support@penpot.app</a> or open a GitHub issue at <a href="https://github.com/penpot/penpot/issues" target="_blank">https://github.com/penpot/penpot/issues</a>.</p>
\ No newline at end of file

From ce24fed32b46dc8f0fe2ef9123fcf9d12efa0362 Mon Sep 17 00:00:00 2001
From: Eva Marco <eva.marco@kaleidos.net>
Date: Wed, 6 May 2026 08:47:30 +0200
Subject: [PATCH 2/6] :bug: Fix incorrect text-edition warning when applying
 tokens (#9355)

---
 CHANGES.md                                                   | 1 +
 frontend/src/app/main/data/workspace/tokens/application.cljs | 4 +---
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index a7293b6411..f4b0796667 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -11,6 +11,7 @@
 ### :bug: Bugs fixed
 
 - Fix incorrect handling of version restore operation [Github #9041](https://github.com/penpot/penpot/pull/9041)
+- Fix false “text editing” warning when applying tokens [Github #6346](https://github.com/penpot/penpot/issues/9346)
 
 
 ## 2.14.4
diff --git a/frontend/src/app/main/data/workspace/tokens/application.cljs b/frontend/src/app/main/data/workspace/tokens/application.cljs
index 10c148fe9f..097ea14e85 100644
--- a/frontend/src/app/main/data/workspace/tokens/application.cljs
+++ b/frontend/src/app/main/data/workspace/tokens/application.cljs
@@ -660,13 +660,11 @@
     ptk/WatchEvent
     (watch [_ state _]
       ;; We do not allow to apply tokens while text editor is open.
-      ;; The classic text editor sets :workspace-editor-state; the WASM text editor
-      ;; does not, so we also check :workspace-local :edition for text shapes.
       (let [edition       (get-in state [:workspace-local :edition])
             objects       (dsh/lookup-page-objects state)
             text-editing? (and (some? edition)
                                (= :text (:type (get objects edition))))]
-        (if (and (empty? (get state :workspace-editor-state))
+        (if (and (some? token)
                  (not text-editing?))
           (let [attributes-to-remove
                 ;; Remove atomic typography tokens when applying composite and vice-verca

From 708c4065b3208e276ffc5d1cdae875a5579ff1a7 Mon Sep 17 00:00:00 2001
From: Alejandro Alonso <alejandroalonsofernandez@gmail.com>
Date: Wed, 6 May 2026 07:33:40 +0200
Subject: [PATCH 3/6] :bug: Fix drag and drop cache eligibility rules

---
 render-wasm/src/render.rs |  68 ++++++++++++++++--------
 render-wasm/src/shapes.rs | 106 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 152 insertions(+), 22 deletions(-)

diff --git a/render-wasm/src/render.rs b/render-wasm/src/render.rs
index 1b384e235d..a6822c991e 100644
--- a/render-wasm/src/render.rs
+++ b/render-wasm/src/render.rs
@@ -391,6 +391,9 @@ pub(crate) struct RenderState {
 pub struct InteractiveDragCrop {
     pub src_doc_bounds: Rect,
     pub src_selrect: Rect,
+    /// True if the captured crop bounds were fully inside the viewport at capture time.
+    /// Used to avoid serving partial/offscreen crops during interactive drag.
+    pub fits_viewport_at_capture: bool,
     pub image: skia::Image,
 }
 
@@ -444,13 +447,30 @@ impl RenderState {
             let Some(m) = tree.get_modifier(&node_id) else {
                 return false;
             };
-            return crate::math::is_move_only_matrix(m);
+            // Only allow using the cached pixels for pure translations.
+            // For non-translation transforms (scale/rotate/skew), cached pixels won't match.
+            if !crate::math::is_move_only_matrix(m) {
+                return false;
+            }
+
+            let Some(crop) = self.backbuffer_crop_cache.get(&node_id) else {
+                return false;
+            };
+            if !crop.fits_viewport_at_capture {
+                return false;
+            }
+
+            // Additionally require this node to be safe to serve from a rectangular backbuffer
+            // crop while moving; otherwise it must be rendered live (e.g. text, overflow frames).
+            return tree
+                .get(&node_id)
+                .is_some_and(|s| s.is_safe_for_drag_crop_cache(tree));
         }
 
-        // Invalidate cached top-level pixels whenever the moving content overlaps
-        // the cached pixel area. Use `src_doc_bounds` because it's the exact bounds
-        // captured from the Backbuffer crop (more reliable than extents derived
-        // from layout/layout-less container heuristics).
+        // If the moving content overlaps this cached crop, do not use the cached pixels
+        // for this frame. We intentionally keep the cache entry: overlap is typically
+        // transient during drag, and once the moving content leaves the area the crop
+        // becomes valid again (stationary shape unchanged).
         if let Some(moved) = moved_bounds {
             let intersects = self
                 .backbuffer_crop_cache
@@ -458,25 +478,12 @@ impl RenderState {
                 .is_some_and(|crop| moved.intersects(crop.src_doc_bounds));
 
             if intersects {
-                // Simplest "automatic invalidation": once something moves over this cached
-                // area, drop the cached crop so it won't be reused again until the next
-                // full-frame rebuild.
-                self.backbuffer_crop_cache.remove(&node_id);
                 return false;
             }
         }
         true
     }
 
-    fn is_recortable_for_drag_crop(&self, shape: &Shape) -> bool {
-        // "Recortable" (happy path): the shape is fully represented by the pixels
-        // already in Backbuffer and can be moved as a texture during drag.
-        shape.blur.is_none()
-            && shape.shadows.is_empty()
-            && (shape.opacity - 1.0).abs() <= 1e-4
-            && shape.blend_mode().0 == skia::BlendMode::SrcOver
-    }
-
     pub fn try_new(width: i32, height: i32) -> Result<RenderState> {
         // This needs to be done once per WebGL context.
         let mut gpu_state = GpuState::try_new()?;
@@ -1649,9 +1656,6 @@ impl RenderState {
             if shape.hidden {
                 continue;
             }
-            if !self.is_recortable_for_drag_crop(shape) {
-                continue;
-            }
 
             let doc_bounds = self.get_cached_extrect(shape, tree, 1.0);
             if !doc_bounds.intersects(viewport) {
@@ -1707,11 +1711,16 @@ impl RenderState {
                 src_irect.right as f32 / scale + vb_left,
                 src_irect.bottom as f32 / scale + vb_top,
             );
+            let fits_viewport_at_capture = doc_bounds.left >= viewport.left
+                && doc_bounds.top >= viewport.top
+                && doc_bounds.right <= viewport.right
+                && doc_bounds.bottom <= viewport.bottom;
             self.backbuffer_crop_cache.insert(
                 id,
                 InteractiveDragCrop {
                     src_doc_bounds,
                     src_selrect: selrect,
+                    fits_viewport_at_capture,
                     image,
                 },
             );
@@ -3024,16 +3033,31 @@ impl RenderState {
                             dst_doc_rect.height() * scale,
                         );
 
-                        // let canvas = self.surfaces.canvas_and_mark_dirty(target_surface);
                         let canvas = self.surfaces.canvas(target_surface);
                         canvas.save();
                         canvas.reset_matrix();
+                        // If the crop includes shadows/blur (extrect pixels outside the fill/stroke
+                        // silhouette), do NOT apply the silhouette clip or we'd cut those pixels.
+                        let should_clip_crop = element.shadows.is_empty() && element.blur.is_none();
+                        if should_clip_crop {
+                            if let Some(clip_path) = element.drag_crop_clip_path() {
+                                let mut doc_to_tile = Matrix::new_identity();
+                                // Map document-space coordinates into tile pixels.
+                                // Rendering surfaces apply: scale(scale) then translate(translation) in doc units.
+                                // Equivalent point mapping: (doc + translation) * scale.
+                                doc_to_tile.post_translate((translation.0, translation.1));
+                                doc_to_tile.post_scale((scale, scale), None);
+                                let clip_path = clip_path.make_transform(&doc_to_tile);
+                                canvas.clip_path(&clip_path, skia::ClipOp::Intersect, true);
+                            }
+                        }
                         canvas.draw_image_rect(
                             crop_image,
                             None,
                             dst_tile_rect,
                             &skia::Paint::default(),
                         );
+
                         canvas.restore();
                     }
                     continue;
diff --git a/render-wasm/src/shapes.rs b/render-wasm/src/shapes.rs
index ec99e7fef0..22e9e1e9d8 100644
--- a/render-wasm/src/shapes.rs
+++ b/render-wasm/src/shapes.rs
@@ -1358,6 +1358,112 @@ impl Shape {
         }
     }
 
+    /// Same `concat` applied around [`center`](Self::center) as in `render_shape` (non-text branch).
+    fn shape_document_transform(&self) -> Matrix {
+        let c = self.center();
+        let mut m = self.transform;
+        m.post_translate(c);
+        m.pre_translate(-c);
+        m
+    }
+
+    /// Fill silhouette only, document space (matches fill rendering).
+    fn drag_crop_fill_clip_path_skia(&self) -> Option<skia::Path> {
+        match &self.shape_type {
+            Type::Rect(r) => {
+                let p = Path::new(shape_to_path::rect_segments(self, r.corners));
+                Some(p.to_skia_path(self.svg_attrs.as_ref()))
+            }
+            Type::Circle => {
+                let p = Path::new(shape_to_path::circle_segments(self));
+                Some(p.to_skia_path(self.svg_attrs.as_ref()))
+            }
+            Type::Path(_) | Type::Bool(_) => {
+                let sk = self.get_skia_path()?;
+                Some(sk.make_transform(&self.shape_document_transform()))
+            }
+            _ => None,
+        }
+    }
+
+    /// Whether this shape may use the backbuffer crop fast path during interactive drag.
+    ///
+    /// Conservative: only effects and fills that match what we snapshot and clip in
+    /// [`drag_crop_clip_path`](Self::drag_crop_clip_path). Text is never safe (glyph layout,
+    /// no `drag_crop_clip_path`).
+    pub fn is_safe_for_drag_crop_cache(&self, shapes_pool: ShapesPoolRef) -> bool {
+        if matches!(self.shape_type, Type::Text(_)) {
+            return false;
+        }
+
+        // If a frame shows overflow (clip_content=false) and its visible content exceeds the
+        // frame bounds, a cached crop anchored to the frame can easily become incorrect while
+        // moving (children can extend beyond selrect). Be conservative and render live.
+        if matches!(self.shape_type, Type::Frame(_)) && !self.clip_content {
+            let extrect = self.extrect(shapes_pool, 1.0);
+            let sr = self.selrect;
+            let exceeds = extrect.left < sr.left
+                || extrect.top < sr.top
+                || extrect.right > sr.right
+                || extrect.bottom > sr.bottom;
+            if exceeds {
+                return false;
+            }
+        }
+
+        let has_opaque_fill = self
+            .fills
+            .iter()
+            .any(|f| math::is_close_to(f.opacity(), 1.0));
+
+        self.blur.is_none()
+            && self.shadows.is_empty()
+            && (self.opacity - 1.0).abs() <= 1e-4
+            && self.blend_mode().0 == skia::BlendMode::SrcOver
+            && has_opaque_fill
+    }
+
+    /// Fill + visible strokes in **document space** for clipping interactive drag textures.
+    ///
+    /// The backbuffer crop uses an axis-aligned `extrect`; we clip the blit so backdrop pixels
+    /// outside the real silhouette (fill and stroke regions) are not smeared. Strokes use
+    /// [`stroke_to_path`](stroke_to_path) like the main renderer, then union with the fill path.
+    pub fn drag_crop_clip_path(&self) -> Option<skia::Path> {
+        let mut acc = self.drag_crop_fill_clip_path_skia()?;
+        if !self.has_visible_strokes() {
+            return Some(acc);
+        }
+
+        let shape_path = match &self.shape_type {
+            Type::Rect(r) => Path::new(shape_to_path::rect_segments(self, r.corners)),
+            Type::Circle => Path::new(shape_to_path::circle_segments(self)),
+            Type::Path(_) | Type::Bool(_) => self.shape_type.path()?.clone(),
+            _ => return Some(acc),
+        };
+
+        let path_transform = self.to_path_transform();
+        let apply_doc_transform = path_transform.is_some();
+
+        for stroke in self.visible_strokes() {
+            let Some(stroke_region) = stroke_to_path(
+                stroke,
+                &shape_path,
+                path_transform.as_ref(),
+                &self.selrect,
+                self.svg_attrs.as_ref(),
+            ) else {
+                continue;
+            };
+            let mut sk = stroke_region.to_skia_path(self.svg_attrs.as_ref());
+            if apply_doc_transform {
+                sk = sk.make_transform(&self.shape_document_transform());
+            }
+            acc = acc.op(&sk, skia::PathOp::Union).unwrap_or(acc);
+        }
+
+        Some(acc)
+    }
+
     fn transform_selrect(&mut self, transform: &Matrix) {
         if math::is_move_only_matrix(transform) {
             let tx = transform.translate_x();

From 9e681260ccc4feb6c564ff0773fb9594b462c574 Mon Sep 17 00:00:00 2001
From: Andrey Antukh <niwi@niwi.nz>
Date: Wed, 6 May 2026 14:20:55 +0200
Subject: [PATCH 4/6] :bug: Fix incorrect invitation token handling on register
 process (#9380)

* :bug: Fix incorrect invitation token handling on register process

- Reject prepare-register-profile when an active profile already
  exists for the requested email.
- Stop embedding an existing profile's :profile-id into the
  prepared-register JWE. Profile resolution in register-profile is
  now done exclusively by email lookup, never by a JWE claim.
- Add created? guard to the invitation-success branch in
  register-profile, so existing profiles (active or not) cannot
  reach session creation via anonymous registration.

Signed-off-by: Andrey Antukh <niwi@niwi.nz>

* :recycle: Restructure invitation handling inside register-profile

Move the invitation-success branch into the created? sub-cond so it
sits alongside the other post-creation branches, making the control
flow consistent.

- Active new profile + matching invitation: mint session and return
  :invitation-token (frontend redirects to :auth-verify-token).
- Not-yet-active new profile + matching invitation: embed the
  invitation token inside the verify-email JWE and send the
  verification email. When the user clicks the link, they get
  logged in and the frontend completes the team-invitation flow.
- Extend send-email-verification! with an optional invitation-token
  parameter propagated into the verify-email JWE claims.
- Update the frontend verify-email handler to navigate to
  :auth-verify-token when the response carries :invitation-token.

Signed-off-by: Andrey Antukh <niwi@niwi.nz>

* :bug: Handle email-already-exists error on registration form

Add a specific handler for the [:validation :email-already-exists] error
code in the registration form's on-error callback. The backend raises
this error when an active profile already exists for the requested email,
but the frontend was falling through to the generic error message.

Now it shows the existing "Email already used" i18n message instead of
the generic "Something wrong has happened" toast.

* :bug: Reset submitted state on registration form error

The on-error handler in the registration form was not resetting the
submitted? state, causing the submit button to remain disabled after
any error. The completion callback in rx/subs! only fires on success,
not on error.

Add (reset! submitted? false) at the beginning of the on-error handler
so the form becomes submittable again after any error, allowing the user
to fix their input and retry.

---------

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
---
 backend/src/app/rpc/commands/auth.clj         | 219 ++++++++------
 backend/src/app/rpc/commands/verify_token.clj |   5 +
 .../test/backend_tests/rpc_profile_test.clj   | 285 ++++++++++++++++--
 frontend/src/app/main/ui/auth/register.cljs   |   4 +
 .../src/app/main/ui/auth/verify_token.cljs    |  12 +-
 5 files changed, 410 insertions(+), 115 deletions(-)

diff --git a/backend/src/app/rpc/commands/auth.clj b/backend/src/app/rpc/commands/auth.clj
index c3592d790c..26082e0488 100644
--- a/backend/src/app/rpc/commands/auth.clj
+++ b/backend/src/app/rpc/commands/auth.clj
@@ -258,24 +258,44 @@
   (validate-register-attempt! cfg params)
 
   (let [email   (profile/clean-email email)
-        profile (profile/get-profile-by-email pool email)
-        props   (-> (audit/extract-utm-params params)
-                    (cond-> (:accept-newsletter-updates params)
-                      (assoc :newsletter-updates true)))
-        params  {:email email
-                 :fullname fullname
-                 :password (:password params)
-                 :invitation-token (:invitation-token params)
-                 :backend "penpot"
-                 :iss :prepared-register
-                 :profile-id (:id profile)
-                 :exp (ct/in-future {:days 7})
-                 :props props}
-        params (d/without-nils params)
-        token  (tokens/generate cfg params)]
+        profile (profile/get-profile-by-email pool email)]
 
-    (-> {:token token}
-        (with-meta {::audit/profile-id uuid/zero}))))
+    ;; SECURITY: refuse to issue a prepared-register token when an active
+    ;; profile already exists for this email.
+    ;;
+    ;; Active accounts must use the standard login flow; existing-but-
+    ;; not-yet-active profiles fall through to the duplicate-detection branch in
+    ;; `register-profile`, which never creates a session.
+    (when (and (some? profile)
+               (true? (:is-active profile)))
+      (ex/raise :type :validation
+                :code :email-already-exists
+                :hint "email already exists"))
+
+    (let [props  (-> (audit/extract-utm-params params)
+                     (cond-> (:accept-newsletter-updates params)
+                       (assoc :newsletter-updates true)))
+          ;; SECURITY: do NOT embed `:profile-id` of an existing
+          ;; profile into the prepared-register JWE. Doing so would
+          ;; let an anonymous caller, in possession of a valid
+          ;; team-invitation JWE, ask `register-profile` to load that
+          ;; profile by id and mint a session for it without password
+          ;; verification. `register-profile` independently re-detects
+          ;; duplicates by email and handles them in the
+          ;; "repeated-registry" branch.
+          params {:email email
+                  :fullname fullname
+                  :password (:password params)
+                  :invitation-token (:invitation-token params)
+                  :backend "penpot"
+                  :iss :prepared-register
+                  :exp (ct/in-future {:days 7})
+                  :props props}
+          params (d/without-nils params)
+          token  (tokens/generate cfg params)]
+
+      (-> {:token token}
+          (with-meta {::audit/profile-id uuid/zero})))))
 
 (def schema:prepare-register-profile
   [:map {:title "prepare-register-profile"}
@@ -387,25 +407,32 @@
         (profile/decode-row))))
 
 (defn send-email-verification!
-  [{:keys [::db/conn] :as cfg} profile]
-  (let [vtoken (tokens/generate cfg
-                                {:iss :verify-email
-                                 :exp (ct/in-future "72h")
-                                 :profile-id (:id profile)
-                                 :email (:email profile)})
-        ;; NOTE: this token is mainly used for possible complains
-        ;; identification on the sns webhook
-        ptoken (tokens/generate cfg
-                                {:iss :profile-identity
-                                 :profile-id (:id profile)
-                                 :exp (ct/in-future {:days 30})})]
-    (eml/send! {::eml/conn conn
-                ::eml/factory eml/register
-                :public-uri (cf/get :public-uri)
-                :to (:email profile)
-                :name (:fullname profile)
-                :token vtoken
-                :extra-data ptoken})))
+  ([cfg profile] (send-email-verification! cfg profile nil))
+  ([{:keys [::db/conn] :as cfg} profile invitation-token]
+   (let [vclaims (cond-> {:iss :verify-email
+                          :exp (ct/in-future "72h")
+                          :profile-id (:id profile)
+                          :email (:email profile)}
+                   ;; If the user registered through a team-invitation flow but
+                   ;; their profile is not yet active, we carry the invitation
+                   ;; token inside the verify-email JWE so the team-invitation
+                   ;; flow can resume after the user clicks the email link.
+                   (some? invitation-token)
+                   (assoc :invitation-token invitation-token))
+         vtoken  (tokens/generate cfg vclaims)
+         ;; NOTE: this token is mainly used for possible complains
+         ;; identification on the sns webhook
+         ptoken  (tokens/generate cfg
+                                  {:iss :profile-identity
+                                   :profile-id (:id profile)
+                                   :exp (ct/in-future {:days 30})})]
+     (eml/send! {::eml/conn conn
+                 ::eml/factory eml/register
+                 :public-uri (cf/get :public-uri)
+                 :to (:email profile)
+                 :name (:fullname profile)
+                 :token vtoken
+                 :extra-data ptoken}))))
 
 (defn register-profile
   [{:keys [::db/conn ::wrk/executor] :as cfg} {:keys [token] :as params}]
@@ -414,23 +441,16 @@
                      (:accept-newsletter-updates params)
                      (update :props assoc :newsletter-updates true))
 
-        profile    (if-let [profile-id (:profile-id claims)]
-                     (profile/get-profile conn profile-id)
-                     ;; NOTE: we first try to match existing profile
-                     ;; by email, that in normal circumstances will
-                     ;; not return anything, but when a user tries to
-                     ;; reuse the same token multiple times, we need
-                     ;; to detect if the profile is already registered
-                     (or (profile/get-profile-by-email conn (:email claims))
-                         (let [is-active (or (boolean (:is-active claims))
-                                             (boolean (:email-verified claims))
-                                             (not (contains? cf/flags :email-verification)))
-                               params    (-> params
-                                             (assoc :is-active is-active)
-                                             (update :password auth/derive-password))
-                               profile   (->> (create-profile cfg params)
-                                              (create-profile-rels conn))]
-                           (vary-meta profile assoc :created true))))
+        profile    (or (profile/get-profile-by-email conn (:email claims))
+                       (let [is-active (or (boolean (:is-active claims))
+                                           (boolean (:email-verified claims))
+                                           (not (contains? cf/flags :email-verification)))
+                             params    (-> params
+                                           (assoc :is-active is-active)
+                                           (update :password auth/derive-password))
+                             profile   (->> (create-profile cfg params)
+                                            (create-profile-rels cfg))]
+                         (vary-meta profile assoc :created true)))
 
         created?   (-> profile meta :created true?)
 
@@ -461,48 +481,67 @@
            ::audit/profile-id (:id profile)
            ::audit/name "register-profile-retry"}))
 
-      ;; If invitation token comes in params, this is because the user
-      ;; comes from team-invitation process; in this case, regenerate
-      ;; token and send back to the user a new invitation token (and
-      ;; mark current session as logged). This happens only if the
-      ;; invitation email matches with the register email.
-      (and (some? invitation)
-           (= (:email profile)
-              (:member-email invitation)))
-      (let [invitation (assoc invitation :member-id  (:id profile))
-            token      (tokens/generate cfg invitation)]
-        (-> {:id (:id profile)
-             :email (:email profile)
-             :invitation-token token}
-            (rph/with-transform (session/create-fn cfg profile claims))
-            (rph/with-meta {::audit/replace-props props
-                            ::audit/context {:action "accept-invitation"}
-                            ::audit/profile-id (:id profile)})))
-
-      ;; When a new user is created and it is already activated by
-      ;; configuration or specified by OIDC, we just mark the profile
-      ;; as logged-in
+      ;; A profile was just created in this call. Invitation handling is a
+      ;; sub-case of "newly created profile": we never honor invitations for
+      ;; pre-existing profiles via this anonymous RPC. The split below mirrors
+      ;; the non-invitation branches but threads the invitation through the
+      ;; appropriate path:
+      ;;
+      ;;   - active     + matching invitation → mint session and
+      ;;     return :invitation-token. The frontend redirects to
+      ;;     :auth-verify-token, which immediately accepts the
+      ;;     invitation.
+      ;;   - active     + no/mismatched invitation → mint session
+      ;;     ("login" action). New profile, no further action.
+      ;;   - not-active + matching invitation → send the
+      ;;     verify-email mail with the invitation token EMBEDDED
+      ;;     into the verify-email JWE. No session yet. When the
+      ;;     user clicks the link, verify-token activates the
+      ;;     profile, mints a session, and propagates the
+      ;;     invitation token to the frontend so it can complete
+      ;;     the team-invitation flow.
+      ;;   - not-active + no/mismatched invitation → standard
+      ;;     "check your email" verification flow.
       created?
-      (if (:is-active profile)
-        (-> (profile/strip-private-attrs profile)
-            (rph/with-transform (session/create-fn cfg profile claims))
-            (rph/with-defer create-welcome-file-when-needed)
-            (rph/with-meta
-              {::audit/replace-props props
-               ::audit/context {:action "login"}
-               ::audit/profile-id (:id profile)}))
+      (let [accept-invitation? (and (some? invitation)
+                                    (= (:email profile)
+                                       (:member-email invitation)))]
+        (cond
+          (and (:is-active profile) accept-invitation?)
+          (let [invitation (assoc invitation :member-id (:id profile))
+                token      (tokens/generate cfg invitation)]
+            (-> {:id (:id profile)
+                 :email (:email profile)
+                 :invitation-token token}
+                (rph/with-transform (session/create-fn cfg profile claims))
+                (rph/with-defer create-welcome-file-when-needed)
+                (rph/with-meta {::audit/replace-props props
+                                ::audit/context {:action "accept-invitation"}
+                                ::audit/profile-id (:id profile)})))
 
-        (do
-          (when-not (eml/has-reports? conn (:email profile))
-            (send-email-verification! cfg profile))
-
-          (-> {:id (:id profile)
-               :email (:email profile)}
+          (:is-active profile)
+          (-> (profile/strip-private-attrs profile)
+              (rph/with-transform (session/create-fn cfg profile claims))
               (rph/with-defer create-welcome-file-when-needed)
               (rph/with-meta
                 {::audit/replace-props props
-                 ::audit/context {:action "email-verification"}
-                 ::audit/profile-id (:id profile)}))))
+                 ::audit/context {:action "login"}
+                 ::audit/profile-id (:id profile)}))
+
+          :else
+          (do
+            (when-not (eml/has-reports? conn (:email profile))
+              (send-email-verification! cfg profile
+                                        (when accept-invitation?
+                                          (:invitation-token params))))
+
+            (-> {:id (:id profile)
+                 :email (:email profile)}
+                (rph/with-defer create-welcome-file-when-needed)
+                (rph/with-meta
+                  {::audit/replace-props props
+                   ::audit/context {:action "email-verification"}
+                   ::audit/profile-id (:id profile)})))))
 
       :else
       (let [elapsed? (elapsed-verify-threshold? profile)
diff --git a/backend/src/app/rpc/commands/verify_token.clj b/backend/src/app/rpc/commands/verify_token.clj
index a3454f7135..38a3e2b42f 100644
--- a/backend/src/app/rpc/commands/verify_token.clj
+++ b/backend/src/app/rpc/commands/verify_token.clj
@@ -72,6 +72,11 @@
                   {:is-active true}
                   {:id (:id profile)}))
 
+    ;; NOTE: `claims` is returned verbatim (besides :profile). When the
+    ;; verify-email JWE was minted by `register-profile` for a not-yet-
+    ;; active profile that came from an invitation flow, `:invitation-
+    ;; token` will be present here and the frontend will use it to
+    ;; complete the team-invitation flow after login.
     (-> claims
         (rph/with-transform (session/create-fn cfg profile))
         (rph/with-meta {::audit/name "verify-profile-email"
diff --git a/backend/test/backend_tests/rpc_profile_test.clj b/backend/test/backend_tests/rpc_profile_test.clj
index 1cdf16a99f..22f0e966f2 100644
--- a/backend/test/backend_tests/rpc_profile_test.clj
+++ b/backend/test/backend_tests/rpc_profile_test.clj
@@ -514,32 +514,89 @@
           (t/is (= 0 (:call-count @mock))))))))
 
 (t/deftest prepare-and-register-with-invitation-and-enabled-registration-1
-  (let [itoken (tokens/generate th/*system*
-                                {:iss :team-invitation
-                                 :exp (ct/in-future "48h")
-                                 :role :editor
-                                 :team-id uuid/zero
-                                 :member-email "user@example.com"})
-        data  {::th/type :prepare-register-profile
-               :invitation-token itoken
-               :fullname "foobar"
-               :email "user@example.com"
-               :password "foobar"}
+  ;; With email-verification ENABLED (the default), a brand-new
+  ;; profile created via the invitation flow is NOT active yet, so
+  ;; `register-profile` must NOT mint a session and must NOT echo
+  ;; back the invitation token. Instead it must dispatch the
+  ;; verify-email mail with the invitation token EMBEDDED into the
+  ;; verify-email JWE (so the team-invitation flow can resume after
+  ;; the user clicks the email link).
+  (with-mocks [mock {:target 'app.email/send! :return nil}]
+    (let [itoken (tokens/generate th/*system*
+                                  {:iss :team-invitation
+                                   :exp (ct/in-future "48h")
+                                   :role :editor
+                                   :team-id uuid/zero
+                                   :member-email "user@example.com"})
+          prep-data {::th/type :prepare-register-profile
+                     :invitation-token itoken
+                     :fullname "foobar"
+                     :email "user@example.com"
+                     :password "foobar"}
 
-        {:keys [result error] :as out} (th/command! data)]
-    (t/is (nil? error))
-    (t/is (map? result))
-    (t/is (string? (:token result)))
+          {prep-result :result prep-error :error} (th/command! prep-data)]
+      (t/is (nil? prep-error))
+      (t/is (map? prep-result))
+      (t/is (string? (:token prep-result)))
 
-    (let [rtoken (:token result)
-          data   {::th/type :register-profile
-                  :token rtoken}
+      (let [reg-data {::th/type :register-profile
+                      :token (:token prep-result)}
 
-          {:keys [result error] :as out} (th/command! data)]
-      ;; (th/print-result! out)
-      (t/is (nil? error))
-      (t/is (map? result))
-      (t/is (string? (:invitation-token result))))))
+            {reg-result :result reg-error :error} (th/command! reg-data)
+            mdata    (meta reg-result)]
+        (t/is (nil? reg-error))
+        (t/is (map? reg-result))
+
+        ;; No invitation token echoed back, no session minted.
+        (t/is (nil? (:invitation-token reg-result)))
+        (t/is (empty? (:app.rpc/response-transform-fns mdata)))
+
+        ;; The verify-email mail was dispatched, and its token claims
+        ;; carry the invitation-token through to the verification step.
+        (t/is (= 1 (:call-count @mock)))
+        (let [send-args   (-> @mock :call-args)
+              email-token (->> send-args (some (fn [m] (when (map? m) (:token m)))))
+              vclaims     (tokens/decode th/*system* email-token)]
+          (t/is (= :verify-email (:iss vclaims)))
+          (t/is (= itoken (:invitation-token vclaims))))))))
+
+(t/deftest prepare-and-register-with-invitation-and-enabled-registration-1b
+  ;; With email-verification DISABLED, the brand-new profile is
+  ;; immediately active, so `register-profile` mints a session and
+  ;; returns the regenerated invitation token in the body — the
+  ;; frontend then redirects to :auth-verify-token to complete the
+  ;; team-invitation flow.
+  (with-redefs [app.config/flags #{:registration :login-with-password}]
+    (let [itoken (tokens/generate th/*system*
+                                  {:iss :team-invitation
+                                   :exp (ct/in-future "48h")
+                                   :role :editor
+                                   :team-id uuid/zero
+                                   :member-email "user@example.com"})
+          prep-data {::th/type :prepare-register-profile
+                     :invitation-token itoken
+                     :fullname "foobar"
+                     :email "user@example.com"
+                     :password "foobar"}
+
+          {prep-result :result prep-error :error} (th/command! prep-data)]
+      (t/is (nil? prep-error))
+      (t/is (string? (:token prep-result)))
+
+      (let [reg-data {::th/type :register-profile
+                      :token (:token prep-result)}
+
+            {reg-result :result reg-error :error} (th/command! reg-data)
+            mdata    (meta reg-result)]
+        (t/is (nil? reg-error))
+        (t/is (map? reg-result))
+
+        ;; Active branch: invitation-token is echoed back and a session
+        ;; is minted via `session/create-fn`.
+        (t/is (string? (:invitation-token reg-result)))
+        (t/is (seq (:app.rpc/response-transform-fns mdata)))
+        (t/is (= "accept-invitation"
+                 (get-in mdata [:app.loggers.audit/context :action])))))))
 
 (t/deftest prepare-and-register-with-invitation-and-enabled-registration-2
   (let [itoken (tokens/generate th/*system*
@@ -692,6 +749,188 @@
       (t/is (= :validation (:type edata)))
       (t/is (= :email-as-password (:code edata))))))
 
+(t/deftest prepare-register-rejects-active-profile-email
+  ;; SECURITY: `prepare-register` must reject any attempt to prepare a
+  ;; registration for an email that already belongs to an *active*
+  ;; profile, regardless of whether an invitation token is supplied.
+  ;; Active profiles must use the standard login flow.
+  (let [_victim (th/create-profile* 1 {:is-active true
+                                       :email "victim@corp.tld"})]
+
+    ;; Without invitation token.
+    (let [out (th/command! {::th/type :prepare-register-profile
+                            :fullname "Mallory"
+                            :email "victim@corp.tld"
+                            :password "Whatever1!"})]
+      (t/is (not (th/success? out)))
+      (let [edata (-> out :error ex-data)]
+        (t/is (= :validation (:type edata)))
+        (t/is (= :email-already-exists (:code edata)))))
+
+    ;; With invitation token (the GHSA-4937-35vc-hqjj exploit shape).
+    (let [itoken (tokens/generate th/*system*
+                                  {:iss :team-invitation
+                                   :exp (ct/in-future "48h")
+                                   :role :editor
+                                   :team-id uuid/zero
+                                   :member-email "victim@corp.tld"})
+          out    (th/command! {::th/type :prepare-register-profile
+                               :invitation-token itoken
+                               :fullname "Mallory"
+                               :email "victim@corp.tld"
+                               :password "Whatever1!"})]
+      (t/is (not (th/success? out)))
+      (let [edata (-> out :error ex-data)]
+        (t/is (= :validation (:type edata)))
+        (t/is (= :email-already-exists (:code edata)))))))
+
+(t/deftest prepare-register-must-not-leak-existing-profile-id
+  ;; Victim is a pre-existing profile that has not yet activated (e.g.
+  ;; freshly registered, has not clicked the email verification link).
+  ;; `prepare-register` allows the call (no active profile exists), but
+  ;; the issued JWE must NOT carry the existing profile's id.
+  (let [_victim (th/create-profile* 1 {:is-active false
+                                       :email "victim@corp.tld"})
+
+        ;; Attacker holds a cryptographically valid `:team-invitation` JWE
+        ;; for the victim's email. (In a real exploit this is obtained
+        ;; from `create-team-invitations` or `get-team-invitation-token`
+        ;; on a team the attacker owns.)
+        itoken (tokens/generate th/*system*
+                                {:iss :team-invitation
+                                 :exp (ct/in-future "48h")
+                                 :role :editor
+                                 :team-id uuid/zero
+                                 :member-email "victim@corp.tld"})
+
+        ;; Anonymous request — no ::rpc/profile-id.
+        data   {::th/type :prepare-register-profile
+                :invitation-token itoken
+                :fullname "Mallory"
+                :email "victim@corp.tld"
+                :password "Whatever1!"}
+
+        out    (th/command! data)]
+
+    ;; The current behaviour either returns a token or rejects the request;
+    ;; what MUST hold is that the issued prepared-register JWE does not
+    ;; carry the victim's profile id.
+    (t/is (th/success? out))
+
+    (let [token  (-> out :result :token)
+          claims (tokens/decode th/*system* token)]
+      (t/is (= :prepared-register (:iss claims)))
+      ;; This is the root-cause assertion: an anonymous prepare-register
+      ;; call must NEVER embed an existing profile's id.
+      (t/is (nil? (:profile-id claims))
+            "prepare-register must not embed existing profile id of an anonymous caller"))))
+
+(t/deftest register-profile-with-invitation-must-not-take-over-existing-account
+  (with-mocks [_mock {:target 'app.email/send! :return nil}]
+    (let [;; Victim profile exists but is not yet active (e.g. registered
+          ;; but has not clicked the verification link). This is the
+          ;; remaining attack surface after fix 1b: `prepare-register`
+          ;; will not reject this case, so the `register-profile` path
+          ;; must enforce the security invariants on its own.
+          victim   (th/create-profile* 1 {:is-active false
+                                          :email "victim@corp.tld"})
+
+          ;; Attacker mints a valid `:team-invitation` JWE for the victim's
+          ;; email. No member-id is included (matches what an attacker
+          ;; obtains via `create-team-invitations` against their own team
+          ;; before the victim has joined).
+          itoken   (tokens/generate th/*system*
+                                    {:iss :team-invitation
+                                     :exp (ct/in-future "48h")
+                                     :role :editor
+                                     :team-id uuid/zero
+                                     :member-email "victim@corp.tld"})
+
+          ;; Step 1 (anonymous): prepare-register-profile with the victim's
+          ;; email + the invitation token.
+          prep-out (th/command! {::th/type :prepare-register-profile
+                                 :invitation-token itoken
+                                 :fullname "Mallory"
+                                 :email "victim@corp.tld"
+                                 :password "Whatever1!"})
+
+          rtoken   (-> prep-out :result :token)
+
+          ;; Step 2 (anonymous): register-profile with the prepared token.
+          reg-out  (th/command! {::th/type :register-profile
+                                 :token rtoken})
+
+          result   (:result reg-out)
+          mdata    (meta result)]
+
+      ;; The first call may succeed; the issue is what the second call
+      ;; produces. We assert the security invariants on its result.
+      (t/is (th/success? prep-out))
+
+      ;; INVARIANT 1: register-profile must NOT install a session for the
+      ;; victim. `session/create-fn` is wired via
+      ;; `rph/with-transform`, which appends to
+      ;; `:app.rpc/response-transform-fns`. If that vector is non-empty
+      ;; for an anonymous register that targets an EXISTING profile, the
+      ;; server is about to mint an `auth-token` cookie bound to the
+      ;; victim — i.e. account takeover.
+      (t/is (empty? (:app.rpc/response-transform-fns mdata))
+            "register-profile must not create a session for an existing victim profile")
+
+      ;; INVARIANT 2: register-profile must NOT echo back an invitation
+      ;; token that authenticates as the victim. When the response
+      ;; contains both `:id` matching the victim and `:invitation-token`,
+      ;; the frontend treats the user as logged-in for that profile.
+      (when (and (map? result)
+                 (= (:id victim) (:id result)))
+        (t/is (not (contains? result :invitation-token))
+              "register-profile must not return an invitation-token bound to an existing victim profile"))
+
+      ;; INVARIANT 3: the server must NOT have taken the
+      ;; "accept-invitation" branch (which is the one that mints a
+      ;; session). For an existing victim profile, the operation
+      ;; should fall through to the harmless "repeated registry" path.
+      (t/is (not= "accept-invitation"
+                  (get-in mdata [:app.loggers.audit/context :action]))
+            "register-profile must not run the accept-invitation branch for an existing victim profile")
+      ;; The victim must remain inactive: nothing in this anonymous
+      ;; flow should have flipped `is-active` to true.
+      (let [reloaded (th/db-get :profile {:id (:id victim)})]
+        (t/is (false? (:is-active reloaded))
+              "register-profile must not activate the victim profile")))))
+
+(t/deftest verify-email-with-invitation-token-propagates-it
+  ;; A `:verify-email` JWE that carries `:invitation-token` (as
+  ;; produced by `register-profile` for the not-active+invitation
+  ;; case) must propagate that token through the verify-token RPC
+  ;; result so the frontend can resume the team-invitation flow.
+  (let [profile (th/create-profile* 1 {:is-active false})
+        itoken  (tokens/generate th/*system*
+                                 {:iss :team-invitation
+                                  :exp (ct/in-future "48h")
+                                  :role :editor
+                                  :team-id uuid/zero
+                                  :member-email (:email profile)})
+        vtoken  (tokens/generate th/*system*
+                                 {:iss :verify-email
+                                  :exp (ct/in-future "72h")
+                                  :profile-id (:id profile)
+                                  :email (:email profile)
+                                  :invitation-token itoken})
+
+        out     (th/command! {::th/type :verify-token
+                              :token vtoken})
+        result  (:result out)]
+
+    (t/is (th/success? out))
+    (t/is (= :verify-email (:iss result)))
+    (t/is (= itoken (:invitation-token result))
+          "verify-token must echo back the invitation-token from the verify-email JWE")
+
+    ;; And the profile must now be active.
+    (let [reloaded (th/db-get :profile {:id (:id profile)})]
+      (t/is (true? (:is-active reloaded))))))
+
 (t/deftest email-change-request
   (with-mocks [mock {:target 'app.email/send! :return nil}]
     (let [profile (th/create-profile* 1)
diff --git a/frontend/src/app/main/ui/auth/register.cljs b/frontend/src/app/main/ui/auth/register.cljs
index 917b272dd9..623b25d642 100644
--- a/frontend/src/app/main/ui/auth/register.cljs
+++ b/frontend/src/app/main/ui/auth/register.cljs
@@ -81,6 +81,7 @@
         on-error
         (mf/use-fn
          (fn [cause]
+           (reset! submitted? false)
            (let [{:keys [type code] :as edata} (ex-data cause)]
              (condp = [type code]
                [:restriction :email-does-not-match-invitation]
@@ -98,6 +99,9 @@
                [:restriction :email-has-complaints]
                (st/emit! (ntf/error (tr "errors.email-has-permanent-bounces" (:email edata))))
 
+               [:validation :email-already-exists]
+               (st/emit! (ntf/error (tr "errors.email-already-exists")))
+
                [:validation :email-as-password]
                (swap! form assoc-in [:errors :password]
                       {:message (tr "errors.email-as-password")})
diff --git a/frontend/src/app/main/ui/auth/verify_token.cljs b/frontend/src/app/main/ui/auth/verify_token.cljs
index 16e818e4b2..c401ac8f67 100644
--- a/frontend/src/app/main/ui/auth/verify_token.cljs
+++ b/frontend/src/app/main/ui/auth/verify_token.cljs
@@ -25,11 +25,19 @@
 (defmulti handle-token (fn [token] (:iss token)))
 
 (defmethod handle-token :verify-email
-  [data]
+  [{:keys [invitation-token] :as data}]
   (cf/external-notify-register-success (:profile-id data))
   (let [msg (tr "dashboard.notifications.email-verified-successfully")]
     (ts/schedule 1000 #(st/emit! (ntf/success msg)))
-    (st/emit! (da/login-from-token data))))
+    ;; If the verify-email JWE carries an :invitation-token, it means
+    ;; the user registered via a team-invitation flow but had to verify
+    ;; their email first. Log them in and then redirect to
+    ;; :auth-verify-token with the invitation token, which will accept
+    ;; the invitation as a logged-in user.
+    (if invitation-token
+      (st/emit! (da/login-from-token data)
+                (rt/nav :auth-verify-token {:token invitation-token}))
+      (st/emit! (da/login-from-token data)))))
 
 (defmethod handle-token :change-email
   [_data]

From 1e1ca82ba53780bf7dcacf6c3fc46dba2f26aae6 Mon Sep 17 00:00:00 2001
From: Andrey Antukh <niwi@niwi.nz>
Date: Wed, 6 May 2026 12:24:55 +0000
Subject: [PATCH 5/6] :books: Add missing changelog entry and document
 changelog locations

Add changelog entry for the fix-incorrect-invitation-token-handling
change (PR #9380) under `## 2.15.0 (Unreleased)` > `:bug: Bugs fixed`.
Add a `## Changelogs` section to AGENTS.md documenting both changelog
locations (main project: `CHANGES.md`, plugins: `plugins/CHANGELOG.md`).

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
---
 AGENTS.md  | 11 +++++++++++
 CHANGES.md |  1 +
 2 files changed, 12 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index 842cd15022..dac88e8261 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -32,6 +32,17 @@ precision while maintaining a strong focus on maintainability and performance.
 5. When searching code, prefer `ripgrep` (`rg`) over `grep` — it respects
    `.gitignore` by default.
 
+## Changelogs
+
+The project has two changelogs:
+
+- **Main project changelog**: `CHANGES.md` (root of the repository). Tracks changes for the core Penpot application (backend, frontend, common, render-wasm, exporter, mcp).
+- **Plugins changelog**: `plugins/CHANGELOG.md`. Tracks changes for the plugins subproject only.
+
+When making changes, add a changelog entry to the appropriate file under the
+`## <version> (Unreleased)` section in the correct category
+(`:sparkles: New features & Enhancements` or `:bug: Bugs fixed`).
+
 ## GitHub Operations
 
 To obtain the list of repository members/collaborators:
diff --git a/CHANGES.md b/CHANGES.md
index f4b0796667..b7e85343a2 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -10,6 +10,7 @@
 
 ### :bug: Bugs fixed
 
+- Fix incorrect invitation token handling on register process [Github #9380](https://github.com/penpot/penpot/pull/9380)
 - Fix incorrect handling of version restore operation [Github #9041](https://github.com/penpot/penpot/pull/9041)
 - Fix false “text editing” warning when applying tokens [Github #6346](https://github.com/penpot/penpot/issues/9346)
 

From df01f7605629a3176755faf28428627ef186e0dc Mon Sep 17 00:00:00 2001
From: Andrey Antukh <niwi@niwi.nz>
Date: Wed, 6 May 2026 14:20:55 +0200
Subject: [PATCH 6/6] :bug: Fix incorrect invitation token handling on register
 process (#9380)

* :bug: Fix incorrect invitation token handling on register process

- Reject prepare-register-profile when an active profile already
  exists for the requested email.
- Stop embedding an existing profile's :profile-id into the
  prepared-register JWE. Profile resolution in register-profile is
  now done exclusively by email lookup, never by a JWE claim.
- Add created? guard to the invitation-success branch in
  register-profile, so existing profiles (active or not) cannot
  reach session creation via anonymous registration.

Signed-off-by: Andrey Antukh <niwi@niwi.nz>

* :recycle: Restructure invitation handling inside register-profile

Move the invitation-success branch into the created? sub-cond so it
sits alongside the other post-creation branches, making the control
flow consistent.

- Active new profile + matching invitation: mint session and return
  :invitation-token (frontend redirects to :auth-verify-token).
- Not-yet-active new profile + matching invitation: embed the
  invitation token inside the verify-email JWE and send the
  verification email. When the user clicks the link, they get
  logged in and the frontend completes the team-invitation flow.
- Extend send-email-verification! with an optional invitation-token
  parameter propagated into the verify-email JWE claims.
- Update the frontend verify-email handler to navigate to
  :auth-verify-token when the response carries :invitation-token.

Signed-off-by: Andrey Antukh <niwi@niwi.nz>

* :bug: Handle email-already-exists error on registration form

Add a specific handler for the [:validation :email-already-exists] error
code in the registration form's on-error callback. The backend raises
this error when an active profile already exists for the requested email,
but the frontend was falling through to the generic error message.

Now it shows the existing "Email already used" i18n message instead of
the generic "Something wrong has happened" toast.

* :bug: Reset submitted state on registration form error

The on-error handler in the registration form was not resetting the
submitted? state, causing the submit button to remain disabled after
any error. The completion callback in rx/subs! only fires on success,
not on error.

Add (reset! submitted? false) at the beginning of the on-error handler
so the form becomes submittable again after any error, allowing the user
to fix their input and retry.

---------

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
---
 CHANGES.md                                    |   7 +
 backend/src/app/binfile/v1.clj                |   2 +-
 backend/src/app/db.clj                        |   2 +-
 backend/src/app/email.clj                     |   6 +-
 backend/src/app/media.clj                     |   2 +-
 backend/src/app/metrics.clj                   |   4 +-
 backend/src/app/redis.clj                     |  20 +-
 backend/src/app/rpc/commands/auth.clj         | 219 ++++++++------
 backend/src/app/rpc/commands/verify_token.clj |   5 +
 backend/src/app/storage/s3.clj                |  14 +-
 .../test/backend_tests/rpc_profile_test.clj   | 285 ++++++++++++++++--
 frontend/src/app/main/ui/auth/register.cljs   |   4 +
 .../src/app/main/ui/auth/verify_token.cljs    |  12 +-
 13 files changed, 442 insertions(+), 140 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index f9fb9fe1a7..6a1a0f8da5 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,5 +1,12 @@
 # CHANGELOG
 
+## 2.14.5
+
+### :bug: Bugs fixed
+
+- Fix incorrect invitation token handling on register process [Github #9380](https://github.com/penpot/penpot/pull/9380)
+
+
 ## 2.14.4
 
 ### :bug: Bugs fixed
diff --git a/backend/src/app/binfile/v1.clj b/backend/src/app/binfile/v1.clj
index 04b390bb99..75f6f36994 100644
--- a/backend/src/app/binfile/v1.clj
+++ b/backend/src/app/binfile/v1.clj
@@ -40,8 +40,8 @@
    [promesa.util :as pu]
    [yetti.adapter :as yt])
   (:import
-   com.github.luben.zstd.ZstdIOException
    com.github.luben.zstd.ZstdInputStream
+   com.github.luben.zstd.ZstdIOException
    com.github.luben.zstd.ZstdOutputStream
    java.io.DataInputStream
    java.io.DataOutputStream
diff --git a/backend/src/app/db.clj b/backend/src/app/db.clj
index b00f84e3e2..c23ea07524 100644
--- a/backend/src/app/db.clj
+++ b/backend/src/app/db.clj
@@ -36,11 +36,11 @@
    java.sql.Connection
    java.sql.PreparedStatement
    java.sql.Savepoint
-   org.postgresql.PGConnection
    org.postgresql.geometric.PGpoint
    org.postgresql.jdbc.PgArray
    org.postgresql.largeobject.LargeObject
    org.postgresql.largeobject.LargeObjectManager
+   org.postgresql.PGConnection
    org.postgresql.util.PGInterval
    org.postgresql.util.PGobject))
 
diff --git a/backend/src/app/email.clj b/backend/src/app/email.clj
index 44d5cd7e67..b42206dc93 100644
--- a/backend/src/app/email.clj
+++ b/backend/src/app/email.clj
@@ -22,13 +22,13 @@
    [cuerdas.core :as str]
    [integrant.core :as ig])
   (:import
-   jakarta.mail.Message$RecipientType
-   jakarta.mail.Session
-   jakarta.mail.Transport
    jakarta.mail.internet.InternetAddress
    jakarta.mail.internet.MimeBodyPart
    jakarta.mail.internet.MimeMessage
    jakarta.mail.internet.MimeMultipart
+   jakarta.mail.Message$RecipientType
+   jakarta.mail.Session
+   jakarta.mail.Transport
    java.util.Properties))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
diff --git a/backend/src/app/media.clj b/backend/src/app/media.clj
index d54f19ab10..863d2e9df2 100644
--- a/backend/src/app/media.clj
+++ b/backend/src/app/media.clj
@@ -31,8 +31,8 @@
   (:import
    clojure.lang.XMLHandler
    java.io.InputStream
-   javax.xml.XMLConstants
    javax.xml.parsers.SAXParserFactory
+   javax.xml.XMLConstants
    org.apache.commons.io.IOUtils
    org.im4java.core.ConvertCmd
    org.im4java.core.IMOperation))
diff --git a/backend/src/app/metrics.clj b/backend/src/app/metrics.clj
index 1c7456b7ab..a1f816a304 100644
--- a/backend/src/app/metrics.clj
+++ b/backend/src/app/metrics.clj
@@ -15,16 +15,16 @@
    io.prometheus.client.CollectorRegistry
    io.prometheus.client.Counter
    io.prometheus.client.Counter$Child
+   io.prometheus.client.exporter.common.TextFormat
    io.prometheus.client.Gauge
    io.prometheus.client.Gauge$Child
    io.prometheus.client.Histogram
    io.prometheus.client.Histogram$Child
+   io.prometheus.client.hotspot.DefaultExports
    io.prometheus.client.SimpleCollector
    io.prometheus.client.Summary
    io.prometheus.client.Summary$Builder
    io.prometheus.client.Summary$Child
-   io.prometheus.client.exporter.common.TextFormat
-   io.prometheus.client.hotspot.DefaultExports
    java.io.StringWriter))
 
 (set! *warn-on-reflection* true)
diff --git a/backend/src/app/redis.clj b/backend/src/app/redis.clj
index 96e6b07be5..dc1bff9669 100644
--- a/backend/src/app/redis.clj
+++ b/backend/src/app/redis.clj
@@ -24,28 +24,28 @@
    [integrant.core :as ig])
   (:import
    clojure.lang.MapEntry
-   io.lettuce.core.KeyValue
-   io.lettuce.core.RedisClient
-   io.lettuce.core.RedisCommandInterruptedException
-   io.lettuce.core.RedisCommandTimeoutException
-   io.lettuce.core.RedisException
-   io.lettuce.core.RedisURI
-   io.lettuce.core.ScriptOutputType
-   io.lettuce.core.SetArgs
    io.lettuce.core.api.StatefulRedisConnection
    io.lettuce.core.api.sync.RedisCommands
    io.lettuce.core.api.sync.RedisScriptingCommands
    io.lettuce.core.codec.RedisCodec
    io.lettuce.core.codec.StringCodec
+   io.lettuce.core.KeyValue
+   io.lettuce.core.pubsub.api.sync.RedisPubSubCommands
    io.lettuce.core.pubsub.RedisPubSubListener
    io.lettuce.core.pubsub.StatefulRedisPubSubConnection
-   io.lettuce.core.pubsub.api.sync.RedisPubSubCommands
+   io.lettuce.core.RedisClient
+   io.lettuce.core.RedisCommandInterruptedException
+   io.lettuce.core.RedisCommandTimeoutException
+   io.lettuce.core.RedisException
+   io.lettuce.core.RedisURI
    io.lettuce.core.resource.ClientResources
    io.lettuce.core.resource.DefaultClientResources
+   io.lettuce.core.ScriptOutputType
+   io.lettuce.core.SetArgs
    io.netty.channel.nio.NioEventLoopGroup
+   io.netty.util.concurrent.EventExecutorGroup
    io.netty.util.HashedWheelTimer
    io.netty.util.Timer
-   io.netty.util.concurrent.EventExecutorGroup
    java.lang.AutoCloseable
    java.time.Duration))
 
diff --git a/backend/src/app/rpc/commands/auth.clj b/backend/src/app/rpc/commands/auth.clj
index c3592d790c..26082e0488 100644
--- a/backend/src/app/rpc/commands/auth.clj
+++ b/backend/src/app/rpc/commands/auth.clj
@@ -258,24 +258,44 @@
   (validate-register-attempt! cfg params)
 
   (let [email   (profile/clean-email email)
-        profile (profile/get-profile-by-email pool email)
-        props   (-> (audit/extract-utm-params params)
-                    (cond-> (:accept-newsletter-updates params)
-                      (assoc :newsletter-updates true)))
-        params  {:email email
-                 :fullname fullname
-                 :password (:password params)
-                 :invitation-token (:invitation-token params)
-                 :backend "penpot"
-                 :iss :prepared-register
-                 :profile-id (:id profile)
-                 :exp (ct/in-future {:days 7})
-                 :props props}
-        params (d/without-nils params)
-        token  (tokens/generate cfg params)]
+        profile (profile/get-profile-by-email pool email)]
 
-    (-> {:token token}
-        (with-meta {::audit/profile-id uuid/zero}))))
+    ;; SECURITY: refuse to issue a prepared-register token when an active
+    ;; profile already exists for this email.
+    ;;
+    ;; Active accounts must use the standard login flow; existing-but-
+    ;; not-yet-active profiles fall through to the duplicate-detection branch in
+    ;; `register-profile`, which never creates a session.
+    (when (and (some? profile)
+               (true? (:is-active profile)))
+      (ex/raise :type :validation
+                :code :email-already-exists
+                :hint "email already exists"))
+
+    (let [props  (-> (audit/extract-utm-params params)
+                     (cond-> (:accept-newsletter-updates params)
+                       (assoc :newsletter-updates true)))
+          ;; SECURITY: do NOT embed `:profile-id` of an existing
+          ;; profile into the prepared-register JWE. Doing so would
+          ;; let an anonymous caller, in possession of a valid
+          ;; team-invitation JWE, ask `register-profile` to load that
+          ;; profile by id and mint a session for it without password
+          ;; verification. `register-profile` independently re-detects
+          ;; duplicates by email and handles them in the
+          ;; "repeated-registry" branch.
+          params {:email email
+                  :fullname fullname
+                  :password (:password params)
+                  :invitation-token (:invitation-token params)
+                  :backend "penpot"
+                  :iss :prepared-register
+                  :exp (ct/in-future {:days 7})
+                  :props props}
+          params (d/without-nils params)
+          token  (tokens/generate cfg params)]
+
+      (-> {:token token}
+          (with-meta {::audit/profile-id uuid/zero})))))
 
 (def schema:prepare-register-profile
   [:map {:title "prepare-register-profile"}
@@ -387,25 +407,32 @@
         (profile/decode-row))))
 
 (defn send-email-verification!
-  [{:keys [::db/conn] :as cfg} profile]
-  (let [vtoken (tokens/generate cfg
-                                {:iss :verify-email
-                                 :exp (ct/in-future "72h")
-                                 :profile-id (:id profile)
-                                 :email (:email profile)})
-        ;; NOTE: this token is mainly used for possible complains
-        ;; identification on the sns webhook
-        ptoken (tokens/generate cfg
-                                {:iss :profile-identity
-                                 :profile-id (:id profile)
-                                 :exp (ct/in-future {:days 30})})]
-    (eml/send! {::eml/conn conn
-                ::eml/factory eml/register
-                :public-uri (cf/get :public-uri)
-                :to (:email profile)
-                :name (:fullname profile)
-                :token vtoken
-                :extra-data ptoken})))
+  ([cfg profile] (send-email-verification! cfg profile nil))
+  ([{:keys [::db/conn] :as cfg} profile invitation-token]
+   (let [vclaims (cond-> {:iss :verify-email
+                          :exp (ct/in-future "72h")
+                          :profile-id (:id profile)
+                          :email (:email profile)}
+                   ;; If the user registered through a team-invitation flow but
+                   ;; their profile is not yet active, we carry the invitation
+                   ;; token inside the verify-email JWE so the team-invitation
+                   ;; flow can resume after the user clicks the email link.
+                   (some? invitation-token)
+                   (assoc :invitation-token invitation-token))
+         vtoken  (tokens/generate cfg vclaims)
+         ;; NOTE: this token is mainly used for possible complains
+         ;; identification on the sns webhook
+         ptoken  (tokens/generate cfg
+                                  {:iss :profile-identity
+                                   :profile-id (:id profile)
+                                   :exp (ct/in-future {:days 30})})]
+     (eml/send! {::eml/conn conn
+                 ::eml/factory eml/register
+                 :public-uri (cf/get :public-uri)
+                 :to (:email profile)
+                 :name (:fullname profile)
+                 :token vtoken
+                 :extra-data ptoken}))))
 
 (defn register-profile
   [{:keys [::db/conn ::wrk/executor] :as cfg} {:keys [token] :as params}]
@@ -414,23 +441,16 @@
                      (:accept-newsletter-updates params)
                      (update :props assoc :newsletter-updates true))
 
-        profile    (if-let [profile-id (:profile-id claims)]
-                     (profile/get-profile conn profile-id)
-                     ;; NOTE: we first try to match existing profile
-                     ;; by email, that in normal circumstances will
-                     ;; not return anything, but when a user tries to
-                     ;; reuse the same token multiple times, we need
-                     ;; to detect if the profile is already registered
-                     (or (profile/get-profile-by-email conn (:email claims))
-                         (let [is-active (or (boolean (:is-active claims))
-                                             (boolean (:email-verified claims))
-                                             (not (contains? cf/flags :email-verification)))
-                               params    (-> params
-                                             (assoc :is-active is-active)
-                                             (update :password auth/derive-password))
-                               profile   (->> (create-profile cfg params)
-                                              (create-profile-rels conn))]
-                           (vary-meta profile assoc :created true))))
+        profile    (or (profile/get-profile-by-email conn (:email claims))
+                       (let [is-active (or (boolean (:is-active claims))
+                                           (boolean (:email-verified claims))
+                                           (not (contains? cf/flags :email-verification)))
+                             params    (-> params
+                                           (assoc :is-active is-active)
+                                           (update :password auth/derive-password))
+                             profile   (->> (create-profile cfg params)
+                                            (create-profile-rels cfg))]
+                         (vary-meta profile assoc :created true)))
 
         created?   (-> profile meta :created true?)
 
@@ -461,48 +481,67 @@
            ::audit/profile-id (:id profile)
            ::audit/name "register-profile-retry"}))
 
-      ;; If invitation token comes in params, this is because the user
-      ;; comes from team-invitation process; in this case, regenerate
-      ;; token and send back to the user a new invitation token (and
-      ;; mark current session as logged). This happens only if the
-      ;; invitation email matches with the register email.
-      (and (some? invitation)
-           (= (:email profile)
-              (:member-email invitation)))
-      (let [invitation (assoc invitation :member-id  (:id profile))
-            token      (tokens/generate cfg invitation)]
-        (-> {:id (:id profile)
-             :email (:email profile)
-             :invitation-token token}
-            (rph/with-transform (session/create-fn cfg profile claims))
-            (rph/with-meta {::audit/replace-props props
-                            ::audit/context {:action "accept-invitation"}
-                            ::audit/profile-id (:id profile)})))
-
-      ;; When a new user is created and it is already activated by
-      ;; configuration or specified by OIDC, we just mark the profile
-      ;; as logged-in
+      ;; A profile was just created in this call. Invitation handling is a
+      ;; sub-case of "newly created profile": we never honor invitations for
+      ;; pre-existing profiles via this anonymous RPC. The split below mirrors
+      ;; the non-invitation branches but threads the invitation through the
+      ;; appropriate path:
+      ;;
+      ;;   - active     + matching invitation → mint session and
+      ;;     return :invitation-token. The frontend redirects to
+      ;;     :auth-verify-token, which immediately accepts the
+      ;;     invitation.
+      ;;   - active     + no/mismatched invitation → mint session
+      ;;     ("login" action). New profile, no further action.
+      ;;   - not-active + matching invitation → send the
+      ;;     verify-email mail with the invitation token EMBEDDED
+      ;;     into the verify-email JWE. No session yet. When the
+      ;;     user clicks the link, verify-token activates the
+      ;;     profile, mints a session, and propagates the
+      ;;     invitation token to the frontend so it can complete
+      ;;     the team-invitation flow.
+      ;;   - not-active + no/mismatched invitation → standard
+      ;;     "check your email" verification flow.
       created?
-      (if (:is-active profile)
-        (-> (profile/strip-private-attrs profile)
-            (rph/with-transform (session/create-fn cfg profile claims))
-            (rph/with-defer create-welcome-file-when-needed)
-            (rph/with-meta
-              {::audit/replace-props props
-               ::audit/context {:action "login"}
-               ::audit/profile-id (:id profile)}))
+      (let [accept-invitation? (and (some? invitation)
+                                    (= (:email profile)
+                                       (:member-email invitation)))]
+        (cond
+          (and (:is-active profile) accept-invitation?)
+          (let [invitation (assoc invitation :member-id (:id profile))
+                token      (tokens/generate cfg invitation)]
+            (-> {:id (:id profile)
+                 :email (:email profile)
+                 :invitation-token token}
+                (rph/with-transform (session/create-fn cfg profile claims))
+                (rph/with-defer create-welcome-file-when-needed)
+                (rph/with-meta {::audit/replace-props props
+                                ::audit/context {:action "accept-invitation"}
+                                ::audit/profile-id (:id profile)})))
 
-        (do
-          (when-not (eml/has-reports? conn (:email profile))
-            (send-email-verification! cfg profile))
-
-          (-> {:id (:id profile)
-               :email (:email profile)}
+          (:is-active profile)
+          (-> (profile/strip-private-attrs profile)
+              (rph/with-transform (session/create-fn cfg profile claims))
               (rph/with-defer create-welcome-file-when-needed)
               (rph/with-meta
                 {::audit/replace-props props
-                 ::audit/context {:action "email-verification"}
-                 ::audit/profile-id (:id profile)}))))
+                 ::audit/context {:action "login"}
+                 ::audit/profile-id (:id profile)}))
+
+          :else
+          (do
+            (when-not (eml/has-reports? conn (:email profile))
+              (send-email-verification! cfg profile
+                                        (when accept-invitation?
+                                          (:invitation-token params))))
+
+            (-> {:id (:id profile)
+                 :email (:email profile)}
+                (rph/with-defer create-welcome-file-when-needed)
+                (rph/with-meta
+                  {::audit/replace-props props
+                   ::audit/context {:action "email-verification"}
+                   ::audit/profile-id (:id profile)})))))
 
       :else
       (let [elapsed? (elapsed-verify-threshold? profile)
diff --git a/backend/src/app/rpc/commands/verify_token.clj b/backend/src/app/rpc/commands/verify_token.clj
index a3454f7135..38a3e2b42f 100644
--- a/backend/src/app/rpc/commands/verify_token.clj
+++ b/backend/src/app/rpc/commands/verify_token.clj
@@ -72,6 +72,11 @@
                   {:is-active true}
                   {:id (:id profile)}))
 
+    ;; NOTE: `claims` is returned verbatim (besides :profile). When the
+    ;; verify-email JWE was minted by `register-profile` for a not-yet-
+    ;; active profile that came from an invitation flow, `:invitation-
+    ;; token` will be present here and the frontend will use it to
+    ;; complete the team-invitation flow after login.
     (-> claims
         (rph/with-transform (session/create-fn cfg profile))
         (rph/with-meta {::audit/name "verify-profile-email"
diff --git a/backend/src/app/storage/s3.clj b/backend/src/app/storage/s3.clj
index ef56e8a9b4..9322de70e6 100644
--- a/backend/src/app/storage/s3.clj
+++ b/backend/src/app/storage/s3.clj
@@ -30,21 +30,18 @@
    java.nio.file.Path
    java.time.Duration
    java.util.Collection
-   java.util.Optional
    java.util.concurrent.atomic.AtomicLong
+   java.util.Optional
    org.reactivestreams.Subscriber
    software.amazon.awssdk.auth.credentials.DefaultCredentialsProvider
-   software.amazon.awssdk.core.ResponseBytes
    software.amazon.awssdk.core.async.AsyncRequestBody
    software.amazon.awssdk.core.async.AsyncResponseTransformer
    software.amazon.awssdk.core.async.BlockingInputStreamAsyncRequestBody
    software.amazon.awssdk.core.client.config.ClientAsyncConfiguration
+   software.amazon.awssdk.core.ResponseBytes
    software.amazon.awssdk.http.nio.netty.NettyNioAsyncHttpClient
    software.amazon.awssdk.http.nio.netty.SdkEventLoopGroup
    software.amazon.awssdk.regions.Region
-   software.amazon.awssdk.services.s3.S3AsyncClient
-   software.amazon.awssdk.services.s3.S3AsyncClientBuilder
-   software.amazon.awssdk.services.s3.S3Configuration
    software.amazon.awssdk.services.s3.model.Delete
    software.amazon.awssdk.services.s3.model.DeleteObjectRequest
    software.amazon.awssdk.services.s3.model.DeleteObjectsRequest
@@ -54,9 +51,12 @@
    software.amazon.awssdk.services.s3.model.ObjectIdentifier
    software.amazon.awssdk.services.s3.model.PutObjectRequest
    software.amazon.awssdk.services.s3.model.S3Error
-   software.amazon.awssdk.services.s3.presigner.S3Presigner
    software.amazon.awssdk.services.s3.presigner.model.GetObjectPresignRequest
-   software.amazon.awssdk.services.s3.presigner.model.PresignedGetObjectRequest))
+   software.amazon.awssdk.services.s3.presigner.model.PresignedGetObjectRequest
+   software.amazon.awssdk.services.s3.presigner.S3Presigner
+   software.amazon.awssdk.services.s3.S3AsyncClient
+   software.amazon.awssdk.services.s3.S3AsyncClientBuilder
+   software.amazon.awssdk.services.s3.S3Configuration))
 
 (def ^:private max-retries
   "A maximum number of retries on internal operations"
diff --git a/backend/test/backend_tests/rpc_profile_test.clj b/backend/test/backend_tests/rpc_profile_test.clj
index 1cdf16a99f..22f0e966f2 100644
--- a/backend/test/backend_tests/rpc_profile_test.clj
+++ b/backend/test/backend_tests/rpc_profile_test.clj
@@ -514,32 +514,89 @@
           (t/is (= 0 (:call-count @mock))))))))
 
 (t/deftest prepare-and-register-with-invitation-and-enabled-registration-1
-  (let [itoken (tokens/generate th/*system*
-                                {:iss :team-invitation
-                                 :exp (ct/in-future "48h")
-                                 :role :editor
-                                 :team-id uuid/zero
-                                 :member-email "user@example.com"})
-        data  {::th/type :prepare-register-profile
-               :invitation-token itoken
-               :fullname "foobar"
-               :email "user@example.com"
-               :password "foobar"}
+  ;; With email-verification ENABLED (the default), a brand-new
+  ;; profile created via the invitation flow is NOT active yet, so
+  ;; `register-profile` must NOT mint a session and must NOT echo
+  ;; back the invitation token. Instead it must dispatch the
+  ;; verify-email mail with the invitation token EMBEDDED into the
+  ;; verify-email JWE (so the team-invitation flow can resume after
+  ;; the user clicks the email link).
+  (with-mocks [mock {:target 'app.email/send! :return nil}]
+    (let [itoken (tokens/generate th/*system*
+                                  {:iss :team-invitation
+                                   :exp (ct/in-future "48h")
+                                   :role :editor
+                                   :team-id uuid/zero
+                                   :member-email "user@example.com"})
+          prep-data {::th/type :prepare-register-profile
+                     :invitation-token itoken
+                     :fullname "foobar"
+                     :email "user@example.com"
+                     :password "foobar"}
 
-        {:keys [result error] :as out} (th/command! data)]
-    (t/is (nil? error))
-    (t/is (map? result))
-    (t/is (string? (:token result)))
+          {prep-result :result prep-error :error} (th/command! prep-data)]
+      (t/is (nil? prep-error))
+      (t/is (map? prep-result))
+      (t/is (string? (:token prep-result)))
 
-    (let [rtoken (:token result)
-          data   {::th/type :register-profile
-                  :token rtoken}
+      (let [reg-data {::th/type :register-profile
+                      :token (:token prep-result)}
 
-          {:keys [result error] :as out} (th/command! data)]
-      ;; (th/print-result! out)
-      (t/is (nil? error))
-      (t/is (map? result))
-      (t/is (string? (:invitation-token result))))))
+            {reg-result :result reg-error :error} (th/command! reg-data)
+            mdata    (meta reg-result)]
+        (t/is (nil? reg-error))
+        (t/is (map? reg-result))
+
+        ;; No invitation token echoed back, no session minted.
+        (t/is (nil? (:invitation-token reg-result)))
+        (t/is (empty? (:app.rpc/response-transform-fns mdata)))
+
+        ;; The verify-email mail was dispatched, and its token claims
+        ;; carry the invitation-token through to the verification step.
+        (t/is (= 1 (:call-count @mock)))
+        (let [send-args   (-> @mock :call-args)
+              email-token (->> send-args (some (fn [m] (when (map? m) (:token m)))))
+              vclaims     (tokens/decode th/*system* email-token)]
+          (t/is (= :verify-email (:iss vclaims)))
+          (t/is (= itoken (:invitation-token vclaims))))))))
+
+(t/deftest prepare-and-register-with-invitation-and-enabled-registration-1b
+  ;; With email-verification DISABLED, the brand-new profile is
+  ;; immediately active, so `register-profile` mints a session and
+  ;; returns the regenerated invitation token in the body — the
+  ;; frontend then redirects to :auth-verify-token to complete the
+  ;; team-invitation flow.
+  (with-redefs [app.config/flags #{:registration :login-with-password}]
+    (let [itoken (tokens/generate th/*system*
+                                  {:iss :team-invitation
+                                   :exp (ct/in-future "48h")
+                                   :role :editor
+                                   :team-id uuid/zero
+                                   :member-email "user@example.com"})
+          prep-data {::th/type :prepare-register-profile
+                     :invitation-token itoken
+                     :fullname "foobar"
+                     :email "user@example.com"
+                     :password "foobar"}
+
+          {prep-result :result prep-error :error} (th/command! prep-data)]
+      (t/is (nil? prep-error))
+      (t/is (string? (:token prep-result)))
+
+      (let [reg-data {::th/type :register-profile
+                      :token (:token prep-result)}
+
+            {reg-result :result reg-error :error} (th/command! reg-data)
+            mdata    (meta reg-result)]
+        (t/is (nil? reg-error))
+        (t/is (map? reg-result))
+
+        ;; Active branch: invitation-token is echoed back and a session
+        ;; is minted via `session/create-fn`.
+        (t/is (string? (:invitation-token reg-result)))
+        (t/is (seq (:app.rpc/response-transform-fns mdata)))
+        (t/is (= "accept-invitation"
+                 (get-in mdata [:app.loggers.audit/context :action])))))))
 
 (t/deftest prepare-and-register-with-invitation-and-enabled-registration-2
   (let [itoken (tokens/generate th/*system*
@@ -692,6 +749,188 @@
       (t/is (= :validation (:type edata)))
       (t/is (= :email-as-password (:code edata))))))
 
+(t/deftest prepare-register-rejects-active-profile-email
+  ;; SECURITY: `prepare-register` must reject any attempt to prepare a
+  ;; registration for an email that already belongs to an *active*
+  ;; profile, regardless of whether an invitation token is supplied.
+  ;; Active profiles must use the standard login flow.
+  (let [_victim (th/create-profile* 1 {:is-active true
+                                       :email "victim@corp.tld"})]
+
+    ;; Without invitation token.
+    (let [out (th/command! {::th/type :prepare-register-profile
+                            :fullname "Mallory"
+                            :email "victim@corp.tld"
+                            :password "Whatever1!"})]
+      (t/is (not (th/success? out)))
+      (let [edata (-> out :error ex-data)]
+        (t/is (= :validation (:type edata)))
+        (t/is (= :email-already-exists (:code edata)))))
+
+    ;; With invitation token (the GHSA-4937-35vc-hqjj exploit shape).
+    (let [itoken (tokens/generate th/*system*
+                                  {:iss :team-invitation
+                                   :exp (ct/in-future "48h")
+                                   :role :editor
+                                   :team-id uuid/zero
+                                   :member-email "victim@corp.tld"})
+          out    (th/command! {::th/type :prepare-register-profile
+                               :invitation-token itoken
+                               :fullname "Mallory"
+                               :email "victim@corp.tld"
+                               :password "Whatever1!"})]
+      (t/is (not (th/success? out)))
+      (let [edata (-> out :error ex-data)]
+        (t/is (= :validation (:type edata)))
+        (t/is (= :email-already-exists (:code edata)))))))
+
+(t/deftest prepare-register-must-not-leak-existing-profile-id
+  ;; Victim is a pre-existing profile that has not yet activated (e.g.
+  ;; freshly registered, has not clicked the email verification link).
+  ;; `prepare-register` allows the call (no active profile exists), but
+  ;; the issued JWE must NOT carry the existing profile's id.
+  (let [_victim (th/create-profile* 1 {:is-active false
+                                       :email "victim@corp.tld"})
+
+        ;; Attacker holds a cryptographically valid `:team-invitation` JWE
+        ;; for the victim's email. (In a real exploit this is obtained
+        ;; from `create-team-invitations` or `get-team-invitation-token`
+        ;; on a team the attacker owns.)
+        itoken (tokens/generate th/*system*
+                                {:iss :team-invitation
+                                 :exp (ct/in-future "48h")
+                                 :role :editor
+                                 :team-id uuid/zero
+                                 :member-email "victim@corp.tld"})
+
+        ;; Anonymous request — no ::rpc/profile-id.
+        data   {::th/type :prepare-register-profile
+                :invitation-token itoken
+                :fullname "Mallory"
+                :email "victim@corp.tld"
+                :password "Whatever1!"}
+
+        out    (th/command! data)]
+
+    ;; The current behaviour either returns a token or rejects the request;
+    ;; what MUST hold is that the issued prepared-register JWE does not
+    ;; carry the victim's profile id.
+    (t/is (th/success? out))
+
+    (let [token  (-> out :result :token)
+          claims (tokens/decode th/*system* token)]
+      (t/is (= :prepared-register (:iss claims)))
+      ;; This is the root-cause assertion: an anonymous prepare-register
+      ;; call must NEVER embed an existing profile's id.
+      (t/is (nil? (:profile-id claims))
+            "prepare-register must not embed existing profile id of an anonymous caller"))))
+
+(t/deftest register-profile-with-invitation-must-not-take-over-existing-account
+  (with-mocks [_mock {:target 'app.email/send! :return nil}]
+    (let [;; Victim profile exists but is not yet active (e.g. registered
+          ;; but has not clicked the verification link). This is the
+          ;; remaining attack surface after fix 1b: `prepare-register`
+          ;; will not reject this case, so the `register-profile` path
+          ;; must enforce the security invariants on its own.
+          victim   (th/create-profile* 1 {:is-active false
+                                          :email "victim@corp.tld"})
+
+          ;; Attacker mints a valid `:team-invitation` JWE for the victim's
+          ;; email. No member-id is included (matches what an attacker
+          ;; obtains via `create-team-invitations` against their own team
+          ;; before the victim has joined).
+          itoken   (tokens/generate th/*system*
+                                    {:iss :team-invitation
+                                     :exp (ct/in-future "48h")
+                                     :role :editor
+                                     :team-id uuid/zero
+                                     :member-email "victim@corp.tld"})
+
+          ;; Step 1 (anonymous): prepare-register-profile with the victim's
+          ;; email + the invitation token.
+          prep-out (th/command! {::th/type :prepare-register-profile
+                                 :invitation-token itoken
+                                 :fullname "Mallory"
+                                 :email "victim@corp.tld"
+                                 :password "Whatever1!"})
+
+          rtoken   (-> prep-out :result :token)
+
+          ;; Step 2 (anonymous): register-profile with the prepared token.
+          reg-out  (th/command! {::th/type :register-profile
+                                 :token rtoken})
+
+          result   (:result reg-out)
+          mdata    (meta result)]
+
+      ;; The first call may succeed; the issue is what the second call
+      ;; produces. We assert the security invariants on its result.
+      (t/is (th/success? prep-out))
+
+      ;; INVARIANT 1: register-profile must NOT install a session for the
+      ;; victim. `session/create-fn` is wired via
+      ;; `rph/with-transform`, which appends to
+      ;; `:app.rpc/response-transform-fns`. If that vector is non-empty
+      ;; for an anonymous register that targets an EXISTING profile, the
+      ;; server is about to mint an `auth-token` cookie bound to the
+      ;; victim — i.e. account takeover.
+      (t/is (empty? (:app.rpc/response-transform-fns mdata))
+            "register-profile must not create a session for an existing victim profile")
+
+      ;; INVARIANT 2: register-profile must NOT echo back an invitation
+      ;; token that authenticates as the victim. When the response
+      ;; contains both `:id` matching the victim and `:invitation-token`,
+      ;; the frontend treats the user as logged-in for that profile.
+      (when (and (map? result)
+                 (= (:id victim) (:id result)))
+        (t/is (not (contains? result :invitation-token))
+              "register-profile must not return an invitation-token bound to an existing victim profile"))
+
+      ;; INVARIANT 3: the server must NOT have taken the
+      ;; "accept-invitation" branch (which is the one that mints a
+      ;; session). For an existing victim profile, the operation
+      ;; should fall through to the harmless "repeated registry" path.
+      (t/is (not= "accept-invitation"
+                  (get-in mdata [:app.loggers.audit/context :action]))
+            "register-profile must not run the accept-invitation branch for an existing victim profile")
+      ;; The victim must remain inactive: nothing in this anonymous
+      ;; flow should have flipped `is-active` to true.
+      (let [reloaded (th/db-get :profile {:id (:id victim)})]
+        (t/is (false? (:is-active reloaded))
+              "register-profile must not activate the victim profile")))))
+
+(t/deftest verify-email-with-invitation-token-propagates-it
+  ;; A `:verify-email` JWE that carries `:invitation-token` (as
+  ;; produced by `register-profile` for the not-active+invitation
+  ;; case) must propagate that token through the verify-token RPC
+  ;; result so the frontend can resume the team-invitation flow.
+  (let [profile (th/create-profile* 1 {:is-active false})
+        itoken  (tokens/generate th/*system*
+                                 {:iss :team-invitation
+                                  :exp (ct/in-future "48h")
+                                  :role :editor
+                                  :team-id uuid/zero
+                                  :member-email (:email profile)})
+        vtoken  (tokens/generate th/*system*
+                                 {:iss :verify-email
+                                  :exp (ct/in-future "72h")
+                                  :profile-id (:id profile)
+                                  :email (:email profile)
+                                  :invitation-token itoken})
+
+        out     (th/command! {::th/type :verify-token
+                              :token vtoken})
+        result  (:result out)]
+
+    (t/is (th/success? out))
+    (t/is (= :verify-email (:iss result)))
+    (t/is (= itoken (:invitation-token result))
+          "verify-token must echo back the invitation-token from the verify-email JWE")
+
+    ;; And the profile must now be active.
+    (let [reloaded (th/db-get :profile {:id (:id profile)})]
+      (t/is (true? (:is-active reloaded))))))
+
 (t/deftest email-change-request
   (with-mocks [mock {:target 'app.email/send! :return nil}]
     (let [profile (th/create-profile* 1)
diff --git a/frontend/src/app/main/ui/auth/register.cljs b/frontend/src/app/main/ui/auth/register.cljs
index 917b272dd9..623b25d642 100644
--- a/frontend/src/app/main/ui/auth/register.cljs
+++ b/frontend/src/app/main/ui/auth/register.cljs
@@ -81,6 +81,7 @@
         on-error
         (mf/use-fn
          (fn [cause]
+           (reset! submitted? false)
            (let [{:keys [type code] :as edata} (ex-data cause)]
              (condp = [type code]
                [:restriction :email-does-not-match-invitation]
@@ -98,6 +99,9 @@
                [:restriction :email-has-complaints]
                (st/emit! (ntf/error (tr "errors.email-has-permanent-bounces" (:email edata))))
 
+               [:validation :email-already-exists]
+               (st/emit! (ntf/error (tr "errors.email-already-exists")))
+
                [:validation :email-as-password]
                (swap! form assoc-in [:errors :password]
                       {:message (tr "errors.email-as-password")})
diff --git a/frontend/src/app/main/ui/auth/verify_token.cljs b/frontend/src/app/main/ui/auth/verify_token.cljs
index 16e818e4b2..c401ac8f67 100644
--- a/frontend/src/app/main/ui/auth/verify_token.cljs
+++ b/frontend/src/app/main/ui/auth/verify_token.cljs
@@ -25,11 +25,19 @@
 (defmulti handle-token (fn [token] (:iss token)))
 
 (defmethod handle-token :verify-email
-  [data]
+  [{:keys [invitation-token] :as data}]
   (cf/external-notify-register-success (:profile-id data))
   (let [msg (tr "dashboard.notifications.email-verified-successfully")]
     (ts/schedule 1000 #(st/emit! (ntf/success msg)))
-    (st/emit! (da/login-from-token data))))
+    ;; If the verify-email JWE carries an :invitation-token, it means
+    ;; the user registered via a team-invitation flow but had to verify
+    ;; their email first. Log them in and then redirect to
+    ;; :auth-verify-token with the invitation token, which will accept
+    ;; the invitation as a logged-in user.
+    (if invitation-token
+      (st/emit! (da/login-from-token data)
+                (rt/nav :auth-verify-token {:token invitation-token}))
+      (st/emit! (da/login-from-token data)))))
 
 (defmethod handle-token :change-email
   [_data]