nx_reader_library.nx

nx_reader_library.nx -- R1 of the shared/personal LIBRARY arc (operator 2026-07-02: "the library should have a shared area and a personal area so what i download or brad or kelli or jensen can have their privacy but i can keep the family books in the main library"). Two tiers, both behind THE WALL, keyed by the AUTHENTICATED user (sy_user_key from the auth handle -- identity is the auth layer's, never a client claim): SHARED = the family library (existing idx_book.wsl over the NAS + extracted comics at reader/<slug>/, slugs that do NOT start "u_"). Every authed user sees it. The owner PROMOTES a personal book here. PERSONAL = a per-user PRIVATE book whose SLUG ITSELF carries the owner: "u_<ukey>_<name>", stored at reader/u_<ukey>_<name>/. Because every reader route (open/zoomprep/book/pos/ann) keys off a single slug, encoding the owner IN the slug means ALL of them work unchanged + one guard: a "u_"-prefixed slug is reachable ONLY by the user whose ukey it carries. TRUE isolation BY CONSTRUCTION -- the slug is the capability. Each user has a private index idx_book_personal_<ukey>.wsl (rows = full slugs). LIB (fail-closed helpers + the isolation predicate); nx_reader_library_gate proves the isolation. Reuses zs_*. license_tier: ORIGINAL