Signing in with the wrong email no longer makes Miracle look unlocked. Public pages now show just Log in until the account is entitled, while members and protected pact users still see Open the app.
- Pricing is a focused sales page. It no longer displays email identity, data export, or account utilities inside the offer.
- An unpaid identity cannot enter the private app or create financial pact setup access.
- Try another email securely ends the restricted session and starts a fresh WorkOS sign-in.
- A separate private Account recovery page handles starting or restarting membership, Stripe billing, and data export.
- Stale callback links fail closed and never falsely claim that the visitor is signed out, locked, or entitled.
- OAuth state expires after ten minutes, native PKCE is required before token exchange, and failed callbacks revoke newly issued sessions.
- Phone and desktop headers keep one stable action slot: Log in or Open the app.