The log out button sat in a corner it shared with nothing, offered to everyone, and never said whose account it would close. The canvas keeps a 1080-unit vertical system at any viewport, so the empty band between the wordmark and start is addressable from CSS and the button can sit where the eye already is. oskiewar.com is a different registrable domain from aesthetic.computer, so no cookie or localStorage crosses and the shell knew nobody. The Auth0 SSO cookie is the only shared ground: ask it silently, then read the handle off the same endpoint the fight coordinator verifies against. A failed check shows no handle but keeps the button, because silent auth failing on a cold allow-list looks exactly like being logged out, and hiding the way out from someone signed in is the worse mistake.