diff --git a/web/zebra-spaces.html b/web/zebra-spaces.html
index e609e4b..74701d9 100644
--- a/web/zebra-spaces.html
+++ b/web/zebra-spaces.html
@@ -1383,8 +1383,21 @@ $('btn-vault').addEventListener('click', () => $('vault-panel').classList.toggle
* otherwise the page would refuse to enter any space (no identity). */
$('btn-logout').addEventListener('click', async () => {
if (ws){ setStatus('leave the space first','err'); return; }
- if (!confirm('Log out wipes your identity key from this browser. ' +
- 'If you haven’t backed it up you cannot recover it. Continue?')) return;
+ /* destructive + permanent: the pubkey IS the user — it's how host
+ * claims, room reservations, cohost grants, blocks, and meeting-life
+ * blocklists key off you. Without a vault backup there's no way to
+ * be 'you' again from any device. Spell that out in plain language
+ * with the hex so the user can copy it if they panic mid-prompt. */
+ const msg =
+ 'Log out will permanently destroy this identity in this browser.\n\n' +
+ 'pubkey ' + (myKeys ? myKeys.pubHex : '(none)') + '\n\n' +
+ 'After this:\n' +
+ ' • You cannot reclaim host on any space you opened with this key\n' +
+ ' • Cohost / speaker grants tied to this key are gone\n' +
+ ' • The only way back is "backup / restore" — if you have not made a\n' +
+ ' backup, this is one-way.\n\n' +
+ 'Continue?';
+ if (!confirm(msg)) return;
try { localStorage.removeItem(ID_KEY); localStorage.removeItem(HANDLE_KEY); } catch(_){}
myHandle = ''; $('handle').value = '';
myKeys = await generateIdentity();
@@ -3681,8 +3694,8 @@ logLine('', 'ready — pick a handle, type a rendezvous code, enter the space');