fix: address code review on #27

- The empty state is about an empty library, not a brand-new Reader:
  listView.Fresh becomes EmptyLibrary and moves behind the tab-specific
  branches, so "No favourites yet" is no longer shadowed for a Reader whose
  library happens to be empty. The action key stays put — hiding it was
  never asked for.
- The owner is not a revocable Reader: their row offers no button and
  POST /readers/{owner}/revoke is a 404, so the one row where the control
  would sign out the tapping browser cannot be reached by a hand-rolled
  POST either.
- Modify isolation is asserted in both directions, and the owner's own
  sign-in through the OAuth callback is pinned to the seeded row.
- CUTOVER.md and REDEPLOY.md still grepped API_TOKEN out of .env for their
  smoke tests, which the last commit deleted; both now take the acting
  Reader's derived credential.
- Roster type follows the machine-fact spec (500 10-11px mono, tracked),
  and PRODUCT.md names the Readers panel instead of claiming there is no
  owner surface at all.

backend/internal/web/static/style.css

@@ -301,10 +301,15 @@ button { cursor: pointer; }
   border-top: 1px solid var(--rule);
 }
 .readerlist form { margin: 0 0 0 auto; }
-.reader-id { font: 400 13px/1.4 var(--font-mono); color: var(--paper); }
-.reader-sessions {
-  font: 400 11px/1.4 var(--font-mono);
+.reader-id {
+  font: 500 13px/1.4 var(--font-mono);
   letter-spacing: .04em;
+  color: var(--paper);
+}
+.reader-sessions {
+  font: 500 10px/1 var(--font-mono);
+  letter-spacing: .14em;
+  text-transform: uppercase;
   color: var(--mute);
 }
 /* Revocation cuts someone off, so it wears --danger. Ember stays reserved for

backend/internal/web/templates/chrome.html

@@ -30,11 +30,9 @@
 {{/* The action key. The icon strip on a card is unlabelled, so one permanent
      line under the tabs names every glyph. It follows the tab rather than the
      row: the archived and finished buckets swap Archive for Restore, and a
-     finished series has no Done to offer. A Reader with no cards at all has
-     nothing for it to name, so it hides rather than disappearing — see the
-     note above about out-of-band swaps needing their target to exist. */}}
+     finished series has no Done to offer. */}}
 {{define "keyrow"}}
-<div class="keyrow" id="keyrow" aria-label="Action key"{{if .OOB}} hx-swap-oob="true"{{end}}{{if .Fresh}} hidden{{end}}>
+<div class="keyrow" id="keyrow" aria-label="Action key"{{if .OOB}} hx-swap-oob="true"{{end}}>
   <span class="pair"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="#i-play"/></svg><span>Read</span></span>
   <span class="pair brass"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="#i-star"/></svg><span>Fav</span></span>
   <span class="pair"><svg viewBox="0 0 24 24" aria-hidden="true"><use href="#i-pencil"/></svg><span>Chapter</span></span>

backend/internal/web/templates/list.html

@@ -8,18 +8,6 @@
     <strong>No titles match “<span class="no-match-q"></span>”.</strong>
     <button type="button" class="clear-search">Clear search</button>
   </div>
-{{else if .Fresh}}
-  {{/* Nothing anywhere, not an empty bucket: this Reader has just registered,
-       so the empty state is the setup instruction rather than a filter
-       report. Both scripts, because the two libraries are separate installs. */}}
-  <div class="empty">
-    <strong>Your library is empty.</strong>
-    <p>Install both userscripts, then open a series and read a chapter — bookmarks arrive on their own.</p>
-    <p class="setup-links">
-      <a class="ghost" href="/install/manga-bookmark.user.js">Install Manga script</a>
-      <a class="ghost" href="/install/novel-bookmark.user.js">Install Novels script</a>
-    </p>
-  </div>
 {{else if eq .Tab "fav"}}
   <div class="empty"><strong>No favourites yet.</strong><p>Star a series to pin it here.</p></div>
 {{else if eq .Tab "new"}}
@@ -28,6 +16,17 @@
   <div class="empty"><strong>Nothing archived.</strong><p>Shelve a series to park it here — it keeps getting checked for new chapters.</p></div>
 {{else if eq .Tab "finished"}}
   <div class="empty"><strong>Nothing finished yet.</strong><p>Mark a series finished and it moves out of your reading list.</p></div>
+{{else if .EmptyLibrary}}
+  {{/* Nothing in either library, so the links are the only thing this page can
+       usefully say. Both scripts: the two libraries are separate installs. */}}
+  <div class="empty">
+    <strong>Nothing here yet.</strong>
+    <p>Install the userscripts, then open a series and read a chapter — bookmarks arrive on their own.</p>
+    <p class="setup-links">
+      <a class="ghost" href="/install/manga-bookmark.user.js">Install Manga script</a>
+      <a class="ghost" href="/install/novel-bookmark.user.js">Install Novels script</a>
+    </p>
+  </div>
 {{else}}
   <div class="empty"><strong>Nothing here yet.</strong><p>Bookmarks appear once the userscript records a chapter.</p></div>
 {{end}}

backend/internal/web/templates/readers.html

@@ -13,7 +13,10 @@
     <li>
       <span class="reader-id">{{.DiscordID}}</span>
       <span class="reader-sessions">{{.Sessions}} session{{if ne .Sessions 1}}s{{end}}</span>
-      {{if .Sessions}}
+      {{/* The owner's own row never offers Revoke: it is the one row where the
+           button would sign the tapping browser out, and the endpoint refuses
+           it anyway. Logout is the deliberate way to do that. */}}
+      {{if and .Sessions (ne .ID $.OwnerID)}}
       <form hx-post="/readers/{{.ID}}/revoke" hx-target="#readers" hx-swap="outerHTML"
             hx-confirm="Revoking signs this Reader out on every device immediately. Revoke?">
         <button type="submit" class="ghost danger">Revoke sessions</button>

backend/internal/web/web.go

@@ -72,16 +72,19 @@ type listView struct {
 	// Rotated marks the setup panel as having just rotated the credential:
 	// it swaps the reinstall warning in over the button row.
 	Rotated bool
-	// Fresh means this Reader has no bookmarks at all, in either library — a
-	// brand-new registration rather than an empty bucket. The empty state then
-	// explains how a library gets filled instead of describing a filter.
-	Fresh bool
+	// EmptyLibrary means this Reader holds no bookmarks in either library, so
+	// the empty state can offer the installs instead of reporting on a filter.
+	// It is not "newly registered": a Reader who deletes their last bookmark is
+	// in the same position and needs the same links.
+	EmptyLibrary bool
 	// Owner marks the acting Reader as the deployment's owner, which unlocks
 	// the Readers panel. Nothing else in the UI differs.
 	Owner bool
 	// Readers is the owner's roster, populated only for the owner's own page
-	// render and the revocation fragment.
+	// render and the revocation fragment. OwnerID travels with it so the roster
+	// can tell the owner's own row apart from the Readers they may revoke.
 	Readers []store.ReaderSummary
+	OwnerID int64
 }
 
 // PageURL and ListURL are the two link shapes every tab needs. Building them
@@ -238,7 +241,7 @@ func (h *Handler) index(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if readerID == h.store.OwnerID() {
-		view.Owner = true
+		view.Owner, view.OwnerID = true, readerID
 		if view.Readers, err = h.store.Readers(); err != nil {
 			log.Printf("index readers: %v", err)
 			http.Error(w, "internal error", http.StatusInternalServerError)
@@ -292,10 +295,10 @@ func (h *Handler) buildListView(readerID int64, lib, tab string) (listView, erro
 	if err != nil {
 		return listView{}, err
 	}
-	// Fresh is about the Reader, not the library, so it is taken before the
-	// filter narrows the slice: it decides whether an empty list reads as
-	// "install the scripts" or "this bucket is empty".
-	fresh := len(all) == 0
+	// Taken before the filter narrows the slice: a Reader with novels but no
+	// manga has a working install already, and does not need to be told to go
+	// and get one.
+	emptyLibrary := len(all) == 0
 	// Narrow to one library first: reading, withNew and recent all derive from
 	// this slice, so doing it later would let the other library's rows into the
 	// strip and the Updated badge.
@@ -340,7 +343,7 @@ func (h *Handler) buildListView(readerID int64, lib, tab string) (listView, erro
 		}
 	}
 	return listView{Lib: lib, Tab: tab, Recent: recent, Items: items,
-		NewCount: len(withNew), Fresh: fresh}, nil
+		NewCount: len(withNew), EmptyLibrary: emptyLibrary}, nil
 }
 
 func (h *Handler) uiList(w http.ResponseWriter, r *http.Request) {
@@ -631,6 +634,14 @@ func (h *Handler) revokeReaderSessions(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "bad reader id", http.StatusBadRequest)
 		return
 	}
+	// The owner is not one of the Readers this endpoint reaches: revoking
+	// themselves would sign out the browser making the request, which is what
+	// logout is for. The roster hides the button; this refuses the hand-rolled
+	// POST behind it.
+	if target == h.store.OwnerID() {
+		http.NotFound(w, r)
+		return
+	}
 	if err := h.store.DeleteReaderSessions(target); err != nil {
 		log.Printf("revoke sessions: %v", err)
 		http.Error(w, "internal error", http.StatusInternalServerError)
@@ -642,5 +653,5 @@ func (h *Handler) revokeReaderSessions(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	h.render(w, http.StatusOK, "readers", listView{Owner: true, Readers: readers})
+	h.render(w, http.StatusOK, "readers", listView{Owner: true, Readers: readers, OwnerID: h.store.OwnerID()})
 }