Keep Xaman login in the current tab

README.md

@@ -115,15 +115,18 @@ probe the public backend `/health` endpoint directly so a Render cold start does
 not occupy the frontend proxy long enough to trigger frontend 429 responses.
 All authenticated requests continue through the same-origin proxy.
 
-Xaman sign-in opens in a separate tab while the original CalorieApp tab waits
-for a short-lived, one-time browser handoff. Every CalorieApp-owned Xaman login
-surface must clearly warn phone users before and during sign-in that the return
-page normally opens in their configured default browser, possibly in a new tab,
-and that they should keep the original CalorieApp tab open. The callback browser
-receives its normal session and the original tab securely claims a separate
-session for the same user. Only hashes of the handoff proof are stored, the
-proof is never sent through WordPress/Xaman URLs, and it cannot be claimed by a
-third browser after use.
+Xaman sign-in starts with same-tab navigation. CalorieApp does not call
+`window.open` and therefore does not create a launch tab. Mobile platforms can
+still return from Xaman through the configured default browser because they do
+not let a web flow select or reuse the original browser tab; this limitation is
+documented by Xaman in its
+[Payload Return URL guidance](https://docs.xaman.dev/concepts/payloads-sign-requests/payload-return-url).
+The callback browser receives its normal session. A short-lived, one-time
+browser handoff is kept only in the initiating tab's session storage so that
+the session can be securely restored if the user returns to that browsing
+context. Only hashes of the handoff proof are stored server-side, the proof is
+never sent through WordPress/Xaman URLs, and it cannot be claimed by a third
+browser after use.
 
 Create frontend/.env.local from the template before running the frontend.
 

frontend/app/auth/callback/page.tsx

@@ -157,9 +157,9 @@ function AuthCallbackContent() {
         </h1>
 
         <p className="mt-3 rounded-xl border border-amber-300 bg-amber-50 px-3 py-2.5 text-xs leading-relaxed text-amber-950">
-          Phone browser notice: Xaman normally opens this return page in your
-          configured default browser, possibly in a new tab. Your original
-          CalorieApp tab can remain open and will sign in automatically too.
+          Phone browser notice: mobile systems may return from Xaman through
+          your configured default browser instead of the tab where you started.
+          This page completes your CalorieApp session in the browser shown now.
         </p>
 
         <p
@@ -199,9 +199,9 @@ export default function AuthCallbackPage() {
             </h1>
 
             <p className="mt-3 rounded-xl border border-amber-300 bg-amber-50 px-3 py-2.5 text-xs leading-relaxed text-amber-950">
-              Phone browser notice: Xaman normally opens this return page in
-              your configured default browser, possibly in a new tab. Keep the
-              original CalorieApp tab open.
+              Phone browser notice: mobile systems may return from Xaman
+              through your configured default browser. CalorieApp itself does
+              not open an extra tab.
             </p>
 
             <p

frontend/app/auth/complete/page.tsx

@@ -46,21 +46,17 @@ function LoginCompleteContent() {
           Sign-in completed
         </h1>
         <p className="mt-3 rounded-xl border border-amber-300 bg-amber-50 px-3 py-2.5 text-xs leading-relaxed text-amber-950">
-          Phone browser notice: Xaman normally opens this return page in your
-          configured default browser, possibly in a new tab.
+          Xaman may have returned through your phone&apos;s configured default
+          browser. Your CalorieApp session is active here.
         </p>
         <p className="mt-4 text-sm leading-relaxed text-brand-secondary/90">
-          Your original CalorieApp tab is signing in automatically. You can
-          close this tab and return there.
-        </p>
-        <p className="mt-2 text-xs leading-relaxed text-brand-secondary/70">
-          You are also signed in in this browser, so continuing here is safe.
+          Continue below to use CalorieApp in this browser.
         </p>
         <Link
           href={next}
           className="mt-6 inline-flex items-center justify-center rounded-full bg-brand-primary px-6 py-2.5 text-sm font-semibold text-white transition hover:opacity-90"
         >
-          Continue in this browser
+          Continue to CalorieApp
         </Link>
       </section>
     </main>

frontend/components/FoodSearchPlaceholder.tsx

@@ -735,8 +735,8 @@ export function FoodSearchPlaceholder() {
             Food search is available to everyone. Sign in with Xaman to save and manage items.
           </p>
           <p className="mt-2 text-xs leading-relaxed">
-            Phone browser notice: Xaman normally returns in your configured default
-            browser, possibly in a new tab. Keep the original CalorieApp tab open.
+            CalorieApp starts Xaman from the current tab. Your phone may return
+            through its configured default browser after signing.
           </p>
         </div>
       ) : logError ? (