A "Sign out" button implemented with `await supabase.auth.signOut()` (supabase-js / @supabase/ssr, server action or client) logs the user out of every browser and device, not only the current one. With two open sessions (e.g. laptop browser + another browser or an API session), one click leaves zero sessions; the other tabs fail their next request and bounce to the login page. Nothing errors, so it looks like random session expiry.

In an invite-only app on the Supabase CLI stack, setting `enable_signup = false` under both `[auth]` and `[auth.email]` in config.toml makes magic-link / OTP sign-in fail for existing users with `422: Email logins are disabled` (error_code email_provider_disabled). On top of that, config.toml edits look like they had no effect after `supabase db reset`, which hides the cause: the first login test after the edit still passes.