Release 2026.08.02-1

SQLite replaces Postgres, and two fixes from using the thing. - The database is a file under ./storage instead of a second container. Ten members never needed a database server, and the driver is pure Go, so the build stays CGO_ENABLED=0 and the dependency count is unchanged. One bind mount is now the whole backup: no pgdata, no healthcheck-gated depends_on, no startup retry loop. Timestamps are UTC text, idle_ttl is seconds, the divisive/unified boards carry their own stddev, and foreign keys are on by pragma. Tests get a database file each and run without any setup - Invites are copied, not clicked. An invite is something to send, and the anchor opened the join form in the admin's own browser - Feedback asks for more than faults: the footer reads "Ongelmia? Ideoita? Palautetta?" and the page behind it invites ideas rather than only bugs - Kuuntele YouTubessa opens in a new tab, so a half-typed review survives it
Release 2026.08.01-1
2026-08-02 20:58:52 +03:00 · 2026-08-01 00:45:55 +03:00 · 2026-07-31 23:39:03 +03:00
58 changed files with 253 additions and 917 deletions
@@ -1,9 +0,0 @@
 # The build needs the source and nothing else. storage/ holds the live database and audio, .env
 # holds the admin password, and pgdata is a leftover from the Postgres era that the build cannot
 # even read.
 .git
 .env
 storage/
 pgdata/
 levyraati
 levyraati26-go
@@ -1,18 +1,10 @@
-# Copy to .env and edit.
+# Copy to .env and edit. The admin password has no default.
-
+ADMIN_USER=admin
 # The first account. Only read when the database has no users: the app creates that account,
 # marks it admin, and ignores these afterwards. Everyone else joins by invite.
 ADMIN_EMAIL=
 ADMIN_PASSWORD=
 ADMIN_NAME=Ylläpito
 # Set to false only for local development over plain HTTP.
 SECURE_COOKIES=true
-# debug, info, warn or error. debug adds the per-request noise; failures are logged at error
+# Public address of the member site. Used to build pasteable invite links in the admin panel.
 # regardless, with the same code the submitter is shown.
 LOG_LEVEL=info
 # Public address of the site. Used to build pasteable invite links on the admin page.
 # Unset falls back to a relative link, which is fine locally.
 PUBLIC_URL=https://levyraati.example.com
@@ -13,9 +13,9 @@ A person with an account. Every account is a member; there is no other kind.
 _Avoid_: user, käyttäjä, account
 **Admin** — _ylläpitäjä_:
-A member who also operates the installation. The same account, the same session, one extra flag —
+The operator of the installation. Not a member and not an account — a set of credentials on a
-so an admin submits and reviews like anyone else and does appear in lists of people.
+separate surface. Never submits, reviews, or appears in any list of people.
-_Avoid_: superuser, role, admin account (there is no separate account)
+_Avoid_: admin user, superuser, role
 **Invite** — _kutsu_ / **invite code** — _kutsukoodi_:
 A one-time code that permits one registration. Spent only by a registration that succeeds.
@@ -1,11 +1,11 @@
-FROM golang:1.27-alpine AS build
+FROM golang:1.26-alpine AS build
 # CalVer, injected at build so no file needs bumping by hand: docker build --build-arg VERSION=…
 ARG VERSION=dev
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN CGO_ENABLED=0 go build -ldflags "-X main.version=${VERSION}" -o /levyraati ./src
+RUN CGO_ENABLED=0 go build -ldflags "-X main.version=${VERSION}" -o /levyraati .
 FROM alpine:3.24
 # yt-dlp rots against YouTube. Alpine's active branch tracks it closely (3.24 carries the current
@@ -1,63 +0,0 @@
 # `make` is everything that has to pass before a commit. The rest are the workflows that were
 # otherwise copy-pasted out of README.md and docs/deployment.md.
 #
 # gofmt needs a wrapper because it reports offending files on stdout and still exits 0.
 .PHONY: check fmt vet test fix build run image db backup clean
 # Overridable, so a target never bakes in one person's environment.
 BIN     ?= levyraati26-go
 ADDR    ?= 127.0.0.1:8080
 STORAGE ?= ./storage
 check: fmt vet test
 fmt:
 	@out=$$(gofmt -l .); test -z "$$out" || { echo "not gofmt'd:"; echo "$$out"; exit 1; }
 vet:
 	go vet ./...
 test:
 	go test ./...
 # Suggestions only. go fix rewrites files in place without -diff, and it is not always right —
 # read the hunks before applying any of them.
 fix:
 	@go fix -diff ./... || true
 # -o is required, not stylistic: the package lives in ./src, and without it `go build` would try to
 # write a binary named "src" over the directory.
 build:
 	go build -o $(BIN) ./src
 # Templates, static files and migrations are embedded, so seeing a change means rebuilding.
 # The admin credentials seed the first account on an empty database and are ignored after that.
 run: build
 	ADMIN_EMAIL=$${ADMIN_EMAIL:[email protected]} \
 	ADMIN_PASSWORD=$${ADMIN_PASSWORD:-dev} \
 	SECURE_COOKIES=false STORAGE_DIR=$(STORAGE) ADDR=$(ADDR) ./$(BIN)
 # A release image. VERSION comes from the tag, because that is the only way it reaches the binary
 # and /healthz must not claim a version that was never tagged. IMAGE names the registry and stays
 # out of this file: pass it in, or put it in the .env this reads nothing from.
 #
 #   make image IMAGE=registry.example.com/owner/levyraati26-go
 image:
 	@test -n "$(IMAGE)" || { echo "set IMAGE, e.g. make image IMAGE=registry.example.com/owner/levyraati26-go"; exit 1; }
 	@v=$$(git describe --tags --exact-match 2>/dev/null) || { echo "HEAD is not tagged; tag the release first"; exit 1; }; \
 	podman build --build-arg VERSION=$$v -t $(IMAGE):$$v -t $(IMAGE):latest . && \
 	echo "built $(IMAGE):$$v — push with: podman push $(IMAGE):$$v"
 # Operations against the running container, straight out of docs/deployment.md.
 db:
 	docker compose exec app sqlite3 /storage/levyraati.db
 # Copying the file while the app runs is not a backup: WAL keeps recent writes in a sidecar.
 backup:
 	docker compose exec app sqlite3 /storage/levyraati.db ".backup '/storage/tmp/backup.db'"
 	gzip -c $(STORAGE)/tmp/backup.db > backup-$$(date +%F).db.gz
 	rm $(STORAGE)/tmp/backup.db
 	@echo "wrote backup-$$(date +%F).db.gz"
 clean:
 	rm -f $(BIN)
@@ -18,7 +18,6 @@ Invite-only, no public registration. Built for about ten friends.
 | [docs/decisions.md](docs/decisions.md) | Why it is that way. Append-only |
 | [docs/theme.md](docs/theme.md) | The visual language: tokens, type, and what differs from the theme handoff |
 | [docs/later.md](docs/later.md) | Deliberately not in v1, with the reasoning kept |
 | [docs/deployment.md](docs/deployment.md) | Running it on a server: the compose file, releases, upgrades, backups |
 ## Branches and releases
@@ -56,67 +55,60 @@ build stays `CGO_ENABLED=0`. No Node, no npm, no bundler.
 ## Running it
 ```sh
-cp .env.example .env      # then edit — set ADMIN_EMAIL and ADMIN_PASSWORD before the first start
+cp .env.example .env      # then edit — ADMIN_PASSWORD has no default and the app won't start without it
 docker compose up -d
 ```
-Migrations apply themselves at startup, before the server accepts connections. On an empty database
+Migrations apply themselves at startup, before the server accepts connections. The first launch
-the first launch creates one account from `ADMIN_EMAIL` / `ADMIN_PASSWORD` and marks it admin; log
+creates no users: log into the admin panel and mint an invite.
 in as that account and mint invites for everyone else. The two variables are read only while the
 `users` table is empty, so once that account exists they do nothing and can leave the environment.
 ### Configuration
 | Variable | Default | Notes |
 |---|---|---|
 | `DB_PATH` | `$STORAGE_DIR/levyraati.db` | The SQLite file. Created on first start |
-| `ADMIN_EMAIL` | — | Login address of the first account. Required on an empty database, ignored afterwards |
+| `ADMIN_USER` | `admin` | Admin panel username |
-| `ADMIN_PASSWORD` | — | Password for that account. Required on an empty database, ignored afterwards |
+| `ADMIN_PASSWORD` | — | **Required.** No default; the app refuses to start without it |
-| `ADMIN_NAME` | `Ylläpito` | Display name for that account |
+| `ADDR` | `:8080` | Member-facing listener |
-| `ADDR` | `:8080` | The only listener |
+| `ADMIN_ADDR` | `127.0.0.1:8081` | Admin listener. Keep it on loopback. Under Compose it binds `:8081` inside the container and is published only to the host's loopback |
 | `STORAGE_DIR` | `./storage` | Audio, avatars, in-flight conversions |
 | `SECURE_COOKIES` | `true` | Set `false` for local development over plain HTTP |
-| `LOG_LEVEL` | `info` | `debug`, `info`, `warn` or `error`. An unparseable value falls back to `info` |
+| `PUBLIC_URL` | — | Public address of the member site, e.g. `https://levyraati.example.com`. Used to build invite links in the admin panel; unset gives relative links |
 | `PUBLIC_URL` | — | Public address of the site, e.g. `https://levyraati.example.com`. Used to build invite links on the admin page; unset gives relative links |
 ### Local development
 ```sh
-export ADMIN_EMAIL=[email protected] ADMIN_PASSWORD=dev SECURE_COOKIES=false
+export ADMIN_PASSWORD=dev SECURE_COOKIES=false
-go run ./src
+go run .
 ```
-The package lives in `src/`, together with the `templates/`, `static/` and `migrations/` it embeds —
+Requires Go 1.25+, plus `ffmpeg`, `ffprobe`, and `yt-dlp` on `PATH`. There is nothing to start first:
 `//go:embed` cannot reach outside its own directory, so the assets live beside the code that reads
 them. `storage/` stays at the root, since it is runtime data rather than source.
 Requires Go 1.27+, plus `ffmpeg`, `ffprobe`, and `yt-dlp` on `PATH`. There is nothing to start first:
 the database is a file under `./storage`, created on the first run.
-Tests get a fresh database file in a temp directory each, so they need no setup and touch nothing.
+Tests get a fresh database file in a temp directory each, so they need no setup and touch nothing:
 `make` is everything that has to pass before a commit — formatting, `go vet`, and the tests:
 ```sh
-make            # gofmt -l, go vet, go test
+go test ./...
 make test       # just the tests
 ```
 Templates, stylesheet, and migrations are embedded with `embed.FS`, so a rebuild is needed to see
-template changes. `make run` is the loop.
+template changes. `go build && ./levyraati` is the loop.
-## Admin page
+## Admin panel
-An admin is **an ordinary member with `is_admin` set** — the same account, the same login, the same
+The admin is **not a user account**. It exists only as `ADMIN_USER` / `ADMIN_PASSWORD`, authenticates
-session cookie. Admins submit and review like anyone else; the flag adds a Ylläpito link to the nav
+with HTTP Basic Auth, and is bound to loopback so it is not reachable from the internet. Reach it
-and unlocks `/admin` on the normal listener. A signed-in member without the flag gets a 404 there.
+through an SSH tunnel:
-From `/admin`: mint invites, reset member passwords, ban members, delete songs, read issue reports.
+```sh
 ssh -L 8081:127.0.0.1:8081 you@server
 # then open http://localhost:8081
 ```
-An admin cannot ban themselves, since banning drops every session for the target and nothing would
+From there: mint invites, reset member passwords, ban members, delete songs, read issue reports.
 be left to undo it.
-**Lost the admin password?** There is no recovery endpoint and no recovery key. Reset the hash
+**Lost the admin password?** Edit `.env` and `docker compose restart app`. There is no recovery
-directly in the SQLite file, the same as for any locked-out member.
+endpoint and no recovery key — the credentials are the environment.
 ## Operations
@@ -163,23 +155,11 @@ docker compose exec app sqlite3 /storage/levyraati.db
 ## Layout
-`src/` is the whole program: one flat `package main`, with the assets it embeds beside it, because
+Go source is flat at the repository root, one package. Beyond that: `templates/` and `static/` are
-`//go:embed` cannot reach outside its own directory. `templates/` and `static/` are those assets,
+embedded assets, `migrations/` holds numbered `.sql` files applied in order at startup, and
-`migrations/` holds numbered `.sql` files applied in order at startup, and `testdata/` holds the
+`testdata/` holds the golden JSON files that guard the API contract, plus `ytdlp-noose.json` — a real
-golden JSON files that guard the API contract, plus `ytdlp-noose.json` — a real `yt-dlp -J` dump of
+`yt-dlp -J` dump of an ordinary upload, used to test metadata prefill against a video that has no
-an ordinary upload, used to test metadata prefill against a video that has no `track`, `artist` or
+`track`, `artist` or `album` at all.
 `album` at all.
 The root keeps what is not source: `docs/`, the container and compose files, the `Makefile`, and
 `storage/` once the app has run.
 | Command | Does |
 |---|---|
 | `make` | gofmt, `go vet`, `go test` — everything that must pass before a commit |
 | `make run` | Build and start on `127.0.0.1:8080` with development defaults |
 | `make fix` | Show `go fix` modernizer suggestions as a diff, without applying them |
 | `make image IMAGE=…` | Build a release image tagged from `git describe`; refuses an untagged HEAD |
 | `make db` / `make backup` | SQLite shell, and a WAL-safe snapshot, against the running container |
 ## Notes
@@ -135,13 +135,6 @@ func (a *app) toggleBan(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "not found", http.StatusNotFound)
 		return
 	}
 	// Banning drops every session for the target, so an admin doing it to themselves would be
 	// locked out with nothing left that could unban them. The only route back is the database.
 	if me := memberFrom(r.Context()); me != nil && me.ID == id {
 		a.flash(w, "Et voi estää itseäsi.")
 		http.Redirect(w, r, "/admin", http.StatusSeeOther)
 		return
 	}
 	var banned bool
 	err = a.db.QueryRowContext(r.Context(),
 		`update users set banned = not banned where id = $1 returning banned`, id).Scan(&banned)
@@ -30,17 +30,15 @@ type member struct {
 	Email     string
 	Avatar    *string
 	Banned    bool
 	IsAdmin   bool
 	CreatedAt time.Time
 }
 // Initials for the avatar circle: no default image on disk, no identicon generator.
 func (m *member) Initials() string {
-	out, n := "", 0
+	out := ""
 	for _, f := range strings.Fields(m.Name) {
 		out += strings.ToUpper(string([]rune(f)[0]))
-		// ponytail: count runes taken, not bytes — "Ä" is 2 bytes and used to end the loop early.
+		if len(out) == 2 {
 		if n++; n == 2 {
 			break
 		}
 	}
@@ -110,10 +108,10 @@ func (a *app) session(w http.ResponseWriter, r *http.Request) *member {
 	)
 	err := a.db.QueryRowContext(r.Context(), `
 		select s.expires_at, s.idle_ttl,
-		       u.id, u.name, u.email, u.avatar, u.banned, u.is_admin, u.created_at
+		       u.id, u.name, u.email, u.avatar, u.banned, u.created_at
 		  from sessions s join users u on u.id = s.user_id
 		 where s.token = $1 and s.expires_at > datetime('now')`, tok).
-		Scan(&expires, &ttlSeconds, &m.ID, &m.Name, &m.Email, &m.Avatar, &m.Banned, &m.IsAdmin, &m.CreatedAt)
+		Scan(&expires, &ttlSeconds, &m.ID, &m.Name, &m.Email, &m.Avatar, &m.Banned, &m.CreatedAt)
 	if err != nil {
 		if !errors.Is(err, sql.ErrNoRows) {
 			slog.Error("session lookup", "ctx", "auth", "error", err)
@@ -25,22 +25,13 @@ func testApp(t *testing.T) *app {
 	if err := migrate(ctx, db); err != nil {
 		t.Fatal(err)
 	}
-	return &app{db: db}
+	return &app{cfg: config{adminUser: "admin", adminPass: "s3cret"}, db: db}
 }
 func post(t *testing.T, h http.Handler, path string, form url.Values) *httptest.ResponseRecorder {
 	t.Helper()
 	return postAs(t, h, path, form, "")
 }
 // postAs is post with a session cookie, which is now the only way to reach an admin route.
 func postAs(t *testing.T, h http.Handler, path string, form url.Values, token string) *httptest.ResponseRecorder {
 	t.Helper()
 	r := httptest.NewRequest("POST", path, strings.NewReader(form.Encode()))
 	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	if token != "" {
 		r.AddCookie(&http.Cookie{Name: sessionCookie, Value: token})
 	}
 	w := httptest.NewRecorder()
 	h.ServeHTTP(w, r)
 	return w
@@ -141,21 +132,6 @@ func (a *app) seedMember(t *testing.T, email string) int64 {
 	return id
 }
 // seedAdminMember returns an admin account and a live session token for it.
 func (a *app) seedAdminMember(t *testing.T, email string) (int64, string) {
 	t.Helper()
 	id := a.seedMember(t, email)
 	if _, err := a.db.ExecContext(context.Background(),
 		`update users set is_admin = 1 where id = $1`, id); err != nil {
 		t.Fatal(err)
 	}
 	tok, _, err := a.startSession(context.Background(), id, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	return id, tok
 }
 func (a *app) sessionFor(t *testing.T, token string) *member {
 	t.Helper()
 	r := httptest.NewRequest("GET", "/", nil)
@@ -226,8 +202,8 @@ func TestBanDropsSessionsAndBlocksLogin(t *testing.T) {
 		t.Fatal(err)
 	}
-	_, adminTok := a.seedAdminMember(t, "[email protected]")
+	adminMux := a.adminMux()
-	if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", id), nil, adminTok); w.Code != http.StatusSeeOther {
+	if w := post(t, adminMux, fmt.Sprintf("/admin/users/%d/ban", id), nil); w.Code != http.StatusSeeOther {
 		t.Fatalf("ban: status = %d, want 303", w.Code)
 	}
@@ -246,7 +222,7 @@ func TestBanDropsSessionsAndBlocksLogin(t *testing.T) {
 	}
 	// Reversible: unban, and the same credentials work again.
-	if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", id), nil, adminTok); w.Code != http.StatusSeeOther {
+	if w := post(t, adminMux, fmt.Sprintf("/admin/users/%d/ban", id), nil); w.Code != http.StatusSeeOther {
 		t.Fatalf("unban: status = %d, want 303", w.Code)
 	}
 	w = post(t, mux, "/login", url.Values{"email": {"[email protected]"}, "password": {"salasana1"}})
@@ -254,52 +230,3 @@ func TestBanDropsSessionsAndBlocksLogin(t *testing.T) {
 		t.Fatalf("login after unban: status = %d, want 303", w.Code)
 	}
 }
 // Self-banning drops your own sessions, and only an admin could undo it. Refuse.
 func TestAdminCannotBanSelf(t *testing.T) {
 	a := testApp(t)
 	mux := a.withMember(a.memberMux())
 	adminID, adminTok := a.seedAdminMember(t, "[email protected]")
 	if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", adminID), nil, adminTok); w.Code != http.StatusSeeOther {
 		t.Fatalf("self-ban: status = %d, want 303", w.Code)
 	}
 	var banned bool
 	if err := a.db.QueryRowContext(context.Background(),
 		`select banned from users where id = $1`, adminID).Scan(&banned); err != nil {
 		t.Fatal(err)
 	}
 	if banned {
 		t.Fatal("admin banned themselves")
 	}
 }
 // A signed-in member who is not an admin must not be able to ban anyone.
 func TestMemberCannotReachAdminRoutes(t *testing.T) {
 	a := testApp(t)
 	mux := a.withMember(a.memberMux())
 	victim := a.seedMember(t, "[email protected]")
 	plain := a.seedMember(t, "[email protected]")
 	tok, _, err := a.startSession(context.Background(), plain, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if w := postAs(t, mux, fmt.Sprintf("/admin/users/%d/ban", victim), nil, tok); w.Code != http.StatusNotFound {
 		t.Fatalf("member ban: status = %d, want 404", w.Code)
 	}
 }
 func TestInitials(t *testing.T) {
 	for name, want := range map[string]string{
 		"Esa Kataja":  "EK",
 		"Ärväs Öhman": "ÄÖ", // multi-byte initials must not end the loop early
 		"Åke":         "Å",
 		"":            "",
 		"a b c":       "AB",
 	} {
 		if got := (&member{Name: name}).Initials(); got != want {
 			t.Errorf("Initials(%q) = %q, want %q", name, got, want)
 		}
 	}
 }
@@ -5,17 +5,18 @@ services:
      args:
        VERSION: ${VERSION:-dev}
    environment:
-      # Only used to create the first account on an empty database; inert after that.
+      ADMIN_USER: ${ADMIN_USER:-admin}
-      ADMIN_EMAIL: ${ADMIN_EMAIL:-}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set ADMIN_PASSWORD in .env}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
      ADMIN_NAME: ${ADMIN_NAME:-Ylläpito}
      ADDR: ":8080"
      # Inside the container the admin listener must bind the container's own interface; it is not
      # published below, so it stays unreachable from outside without a tunnel or the proxy.
      ADMIN_ADDR: ":8081"
      SECURE_COOKIES: ${SECURE_COOKIES:-true}
      LOG_LEVEL: ${LOG_LEVEL:-info}
      PUBLIC_URL: ${PUBLIC_URL:-}
    # The SQLite file sits in here beside the audio, so this one mount is the whole backup.
    volumes:
      - ./storage:/storage
    ports:
      - "8080:8080"
      - "8081:8081"
    restart: unless-stopped
@@ -33,21 +33,15 @@ and `storage` was test data, so **the schema has no legacy to respect.**
   retention `DELETE`, a table and a filtered page — ~150 lines to avoid `docker compose logs`. If
   in-app visibility is ever wanted, build an *audit* view of domain events instead; those are
   queries over tables that already exist.
-8. **The admin is a member with `is_admin` set.** ~~The admin is not a user.~~ *Reversed.* The
+8. **The admin is not a user.** Env credentials, Basic Auth, its own loopback listener. This deletes
-   original call — env credentials, Basic Auth, its own loopback listener — bought network isolation
+   the `role` column, first-launch seeding, admin sessions, the "cannot ban the last admin" rules,
-   at the price of a second port to tunnel and proxy, and a second credential in the password
+   and every "exclude the admin" clause that would otherwise appear in user and stats queries.
-   manager. Basic Auth also sat outside the `SameSite` protection the member cookie already had, and
+9. **Same process, two listeners** — not a second binary. A management binary would need its own
-   left admin actions with no actor to log. One boolean column reuses the session, the login rate
+   deploy and would race the startup migrations. Two listeners give the network isolation, which was
-   limiter, the ban-drops-sessions path and CSRF protection that all existed anyway. The costs the
+   the only real benefit.
   original entry named are real but small here: seeding is `seedAdmin` on an empty database, and
   the only lockout rule is that an admin cannot ban themselves. Banning a *second* admin is allowed
   — with one admin per installation there is no last-admin case to protect.
 9. **No moderator tier.** A four-level role enum was considered and dropped: nothing in the admin
   surface distinguishes a superadmin from an admin, and moderator is a second column on the day
   somebody needs to resolve reports without also being able to reset passwords.
 10. **The admin recovery endpoint is dropped.** The old app had a key-gated credential reset with a
-    `qwerty123` default in `docker-compose.yml`. There is no route, no key and no default: an admin
+    `qwerty123` default in `docker-compose.yml`. The password is an env var now, so recovery is
-    who loses their password is reset from the database, the same as any locked-out member.
+    editing it and restarting. No route, no key, no default.
 11. **Conversion runs in the background; nothing enters `songs` until it succeeds and the submitter
    confirms.** Costs a `submissions` table, buys a `songs` table where every row is a real song and
    no query filters on readiness.
@@ -1,275 +0,0 @@
 # Deployment
 How Levyraati gets onto a server and how it is changed once it is there. Configuration variables are
 tabulated in the [README](../README.md#configuration); this file is the procedures.
 The whole deployment is **one container and one directory**. There is no database server, no
 migration step to run by hand, and no build on the target machine.
 ---
 ## The server's compose file
 The `docker-compose.yml` in the repository root **builds from source** — that is the development
 one, and it is what you want on a machine that has the code checked out. A server has no source, so
 it runs a published image instead. Keep this second file on the server; it is not in the repository
 because it describes one particular deployment rather than the app.
 ```yaml
 services:
  app:
    # Registry included. Pin a release tag, never :latest — a restart must not quietly change the
    # running version. Kept in .env so this file carries no host of yours.
    image: ${IMAGE:?set IMAGE in .env}
    environment:
      # Only read while the users table is empty: they create the first account and are ignored
      # from then on. Safe to remove once that account exists.
      ADMIN_EMAIL: ${ADMIN_EMAIL:-}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
      ADMIN_NAME: ${ADMIN_NAME:-Ylläpito}
      ADDR: ":8080"
      SECURE_COOKIES: ${SECURE_COOKIES:-true}
      PUBLIC_URL: ${PUBLIC_URL:-}
    # The SQLite file sits in here beside the audio, so this one mount is the whole backup.
    volumes:
      - ./storage:/storage
    ports:
      - "8080:8080"
    restart: unless-stopped
 ```
 Two differences from the development file, and the reason for each:
 | | Development | Server |
 |---|---|---|
 | Source of the binary | `build:` from the checkout | `image:` pulled from the registry |
 | Version | `VERSION` build arg, `dev` by default | baked into the tagged image |
 There is one port. `/admin` rides the member listener behind the same session cookie as everything
 else, so there is nothing extra to publish, tunnel or firewall.
 Alongside it, a `.env` — same variables as [.env.example](../.env.example), plus the image:
 ```sh
 IMAGE=registry.example.com/owner/levyraati26-go:2026.08.02-1
 ADMIN_EMAIL=…          # first start only
 ADMIN_PASSWORD=…       # first start only
 SECURE_COOKIES=true
 PUBLIC_URL=https://levyraati.example.com
 ```
 ---
 ## What the server needs
 - Docker with the Compose plugin, or Podman with `podman-compose`.
 - Credentials for the registry holding the image (`docker login <registry>`), unless it is public.
 - A reverse proxy terminating TLS in front of port 8080. Cookies are `Secure`, so the members' site
  over plain HTTP will not keep anyone logged in.
 - Outbound network access: yt-dlp reaches YouTube, and the lyrics lookup reaches LRCLIB. Neither is
  fatal to lose — submissions fail with a visible message and lyrics stay empty.
 Nothing else. No Go toolchain, no ffmpeg on the host — those live in the image.
 ---
 ## Building and publishing a release
 Done from a checkout, not on the server. The version reaches the binary only through the build arg,
 so it must match the tag or `/healthz` will lie about what is deployed:
 ```sh
 git switch main && git merge dev
 git tag 2026.08.02-1
 podman build --build-arg VERSION=2026.08.02-1 \
  -t registry.example.com/owner/levyraati26-go:2026.08.02-1 \
  -t registry.example.com/owner/levyraati26-go:latest .
 podman push registry.example.com/owner/levyraati26-go:2026.08.02-1
 podman push registry.example.com/owner/levyraati26-go:latest
 ```
 Check before pushing that the tag took: `podman run --rm -p 8099:8080 -e ADMIN_PASSWORD=x IMAGE`
 then `curl localhost:8099/healthz` should answer `ok 2026.08.02-1`, not `ok dev`.
 ---
 ## First deployment
 Two files go on the server — the compose file above and `.env`. **Not** a git clone; the source is
 not needed to run this.
 ```sh
 mkdir -p /srv/levyraati && cd /srv/levyraati
 # put docker-compose.yml and .env here
 chmod 600 .env        # it holds the only admin credential there is
 docker compose pull
 docker compose up -d
 docker compose logs -f app     # watch the migrations apply
 ```
 The first start creates `./storage` with `audio/`, `avatars/`, `tmp/` and `levyraati.db`, applies
 every migration, and only then accepts connections. It creates **no users** — nobody can register
 until you mint an invite.
 Confirm it is alive, and that the version is the one you meant to deploy:
 ```sh
 curl -s localhost:8080/healthz     # -> ok 2026.08.02-1
 ```
 ### Reverse proxy
 Proxy your public hostname to `127.0.0.1:8080`. Two things matter beyond the defaults:
 - **Upload size.** Submissions are capped at 50 MB by the app; a proxy with a 1 MB default body
  limit rejects them first, and the error is not the app's clear one. Raise it past 50 MB
  (`client_max_body_size 64m` in nginx, `MaxRequestBodySize` in Caddy).
 - **Response buffering off**, or at least generous timeouts, for `/audio/{id}` — it serves Range
  requests so the player can seek.
 ### Admin access
 Log in as your own account and open `/admin`. Nothing to tunnel, nothing extra to proxy: the page is
 part of the site and is gated on the `is_admin` flag on your user row. A signed-in member without the
 flag gets a 404 there, so the page does not advertise itself.
 TLS at the proxy is what makes the invite *Kopioi* button work — the clipboard API needs a secure
 context, and `https://` is one. Over plain HTTP on a real hostname the button will not fire.
 From the page: mint invites, reset passwords, ban members, delete songs, read feedback.
 **First start.** On an empty database the app creates one account from `ADMIN_EMAIL` /
 `ADMIN_PASSWORD` and marks it admin. Once it exists those variables do nothing; drop them from
 `.env` if you would rather not keep a password there.
 **Lost the admin password?** There is no recovery endpoint and no recovery key. Set a new bcrypt
 hash directly in the SQLite file — re-running the app with `ADMIN_PASSWORD` will not help, because
 seeding only fires on an empty `users` table.
 ---
 ## Upgrading
 ```sh
 cd /srv/levyraati
 # back up first — see below; it takes a second and this is exactly when you want it
 $EDITOR .env                   # point IMAGE at the new tag
 docker compose pull
 docker compose up -d
 curl -s localhost:8080/healthz # confirm the new version is answering
 ```
 Migrations run at startup, inside the new container, before it serves. There is no separate step.
 **Expect a few seconds of downtime.** One container, one SQLite file, no rolling deploy — and a
 restart deliberately fails every in-flight submission. Deploy when nobody is mid-review.
 ### Rolling back
 Point `IMAGE` at the previous tag and `docker compose up -d`. **Only safe if the release you are
 leaving added no migration** — migrations are forward-only and the old binary will not understand a
 schema it has never seen. Check `migrations/` between the two tags first; if one landed, restore the
 backup taken before the upgrade instead.
 ### What a restart does to work in progress
 Conversions run as goroutines inside the process, so a restart kills them. This is handled, not
 ignored: the startup sweep marks every submission still `queued`, `downloading` or `converting` as
 `failed` with "interrupted by restart", so nothing is stuck saying "converting" forever. The
 submitter sees the failure and can retry a URL submission or re-upload a file. Published songs and
 reviews are untouched.
 ---
 ## Backups
 `./storage` holds everything — audio, avatars, and `levyraati.db`.
 **Do not just copy the database file while the app is running.** WAL mode means recent writes live
 in `levyraati.db-wal`, and a bare copy can miss them or catch a torn state. Ask SQLite for a
 consistent snapshot instead — it is safe against a live, writing database:
 ```sh
 cd /srv/levyraati
 docker compose exec app sqlite3 /storage/levyraati.db ".backup '/storage/tmp/backup.db'"
 gzip -c storage/tmp/backup.db > /backups/levyraati-$(date +%F).db.gz
 rm storage/tmp/backup.db
 tar czf /backups/levyraati-audio-$(date +%F).tar.gz -C storage audio avatars
 ```
 `storage/tmp/` is in-flight conversions and is safe to skip; it is cleared at startup anyway.
 A daily cron of those four lines is a complete backup strategy for this app.
 ### Restoring
 ```sh
 docker compose down
 gunzip -c /backups/levyraati-2026-08-02.db.gz > storage/levyraati.db
 rm -f storage/levyraati.db-wal storage/levyraati.db-shm   # stale sidecars of the old file
 tar xzf /backups/levyraati-audio-2026-08-02.tar.gz -C storage
 docker compose up -d
 ```
 Deleting the `-wal` and `-shm` files matters: left behind, they belong to the database you just
 replaced, and SQLite will try to apply them to the restored one.
 Audio and rows are backed up separately but must be restored together — a song row whose `.ogg` is
 missing gives a broken player, and an orphan `.ogg` is invisible to everyone.
 ---
 ## Operations
 ### Logs
 ```sh
 docker compose logs -f app
 ```
 JSON to stdout, nothing else. Every line carries a `ctx` field (`startup`, `auth`, `songs`,
 `submissions`, `invites`, `reports`) to filter on.
 Two startup warnings are worth reading rather than skipping: `submissions interrupted by restart`
 says the sweep cleaned up after a restart, and `failed submissions present` is often the first sign
 that yt-dlp has gone stale.
 ### yt-dlp goes stale
 yt-dlp rots against YouTube — routine maintenance, not an incident. It comes from Alpine's community
 repository in the image, so **the fix is a rebuild**, which means publishing a new image rather than
 anything on the server. Rebuild monthly. Failures show the yt-dlp error to the submitter, so members
 usually notice before you read a log.
 ### Database shell
 ```sh
 docker compose exec app sqlite3 /storage/levyraati.db
 ```
 Writes here are unaudited and unvalidated — the schema holds the constraints, but the app's rules
 (the review window, the reveal rule, the lock) are in Go. Prefer the admin panel.
 ### Disk
 Audio is Opus at 96 kbps: roughly 2–3 MB per song, so a hundred songs is a few hundred megabytes.
 `storage/tmp/` briefly holds a 50 MB upload plus its converted copy per in-flight submission,
 bounded by the two conversion slots.
 ---
 ## Troubleshooting
 | Symptom | Cause |
 |---|---|
 | Container exits immediately on a first start | `ADMIN_EMAIL` or `ADMIN_PASSWORD` unset on an empty database. The log says so; a site nobody can log into is worse than one that will not boot |
 | `set IMAGE in .env` | Compose has no image to run; `IMAGE` is required and unset |
 | `/healthz` says `ok dev` | The image was built without `--build-arg VERSION`, so what is deployed cannot be identified |
 | Login never sticks | Plain HTTP with `SECURE_COOKIES=true`. Terminate TLS, or set it `false` for a local test |
 | Uploads fail near 50 MB | The reverse proxy's body limit, not the app's |
 | Invite links are relative | `PUBLIC_URL` unset |
 | Everything 500s after a restore | `-wal`/`-shm` sidecars from the replaced database were left in place |
 | Submissions all fail at download | yt-dlp is stale, or YouTube is refusing this server's IP; rebuild and publish the image first. `docker compose logs app \| grep '"stage":"download"'` shows yt-dlp's own stderr under `detail` |
 | A submitter reports a *virhekoodi* | `docker compose logs app \| grep <code>` — one line, with the stage, the submission id, the URL and the tool's stderr |
 | `/admin` returns 404 while logged in | That account has no `is_admin`. Set it in the database; nothing in the UI grants it |
 | Setting `ADMIN_PASSWORD` again changes nothing | Seeding only fires on an empty `users` table. Reset the hash in the database instead |
@@ -4,8 +4,7 @@ What the app does. This file and the code must never disagree; when behaviour ch
 with it. Terms are defined in [CONTEXT.md](../CONTEXT.md), decisions and their reasons in
 [decisions.md](./decisions.md), and anything explicitly not in v1 in [later.md](./later.md).
-Stack and configuration are in the [README](../README.md); running it on a server is in
+Stack, configuration, and operations are in the [README](../README.md).
 [deployment.md](./deployment.md).
 ---
@@ -364,58 +363,56 @@ template renders a circle with the member's initials, in CSS. No default image o
 ## 6. Admin
-**An admin is a member with `is_admin` set.** One boolean column on `users`, no role enum. They
+**The admin is not a user.** They never submit, never review, and never see the member-facing site.
-submit and review like anyone else and appear in every list and leaderboard, so no query has to
+No `role` column, no admin row, no admin session, no admin login page, no first-launch seeding — and
-exclude them. The admin UI is Finnish, like everything else.
+no query anywhere has to exclude the admin from a list, a leaderboard, or an aggregate. The admin UI
 is Finnish, like everything else.
 ```go
-// ponytail: one flag, no roles. A moderator tier is a second column on the day someone needs to
+// ponytail: Basic Auth, no admin session, no admin row. Ceiling: one admin, no logout
-// resolve reports without also being able to reset passwords.
+// (close the browser). Add a cookie session if a second admin ever needs one.
-func (a *app) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
+func requireAdmin(next http.Handler) http.Handler {
-	return func(w http.ResponseWriter, r *http.Request) {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		m := memberFrom(r.Context())
+		u, p, ok := r.BasicAuth()
-		if m == nil {
+		if !ok || subtle.ConstantTimeCompare([]byte(u), []byte(adminUser)) != 1 ||
-			http.Redirect(w, r, "/login", http.StatusSeeOther)
+			subtle.ConstantTimeCompare([]byte(p), []byte(adminPass)) != 1 {
 			w.Header().Set("WWW-Authenticate", `Basic realm="levyraati admin"`)
 			http.Error(w, "unauthorized", http.StatusUnauthorized)
 			return
 		}
-		if !m.IsAdmin {
+		next.ServeHTTP(w, r)
-			http.NotFound(w, r)
+	})
 			return
 		}
 		next(w, r)
 	}
 }
 ```
-A signed-in member who is not an admin gets **404, not 403**: the admin pages are none of their
+No bcrypt here: hashing protects *stored* passwords against a database leak, and this one lives in
-business, and "forbidden" confirms there is something to be forbidden from. Everything else — the
+the env file already. The constant-time compare is the part that
-session cookie, `SameSite` CSRF protection, the login rate limiter, ban-drops-sessions — is reused
+matters. **Fatal at startup if `ADMIN_PASSWORD` is unset** — an admin panel that silently opens is
-rather than reimplemented, which is the whole point of the flag.
+worse than one that will not boot.
 ```go
-// One listener. /admin is a route on the member mux, gated per-route.
+// ponytail: two listeners, one process. Admin is loopback-only — reach it over an SSH tunnel
-log.Fatal(http.ListenAndServe(":8080", a.withMember(a.memberMux())))
+// or the reverse proxy. A separate binary would need its own deploy and would race the
 // startup migrations; it buys nothing else.
 go func() { log.Fatal(http.ListenAndServe("127.0.0.1:8081", requireAdmin(adminMux))) }()
 log.Fatal(http.ListenAndServe(":8080", memberMux))
 ```
-**Bootstrap:** registration needs an invite and invites are minted from `/admin`, so an empty
+**Bootstrap:** the admin logs in with the env credentials and mints the first invite. That is the
-database cannot grow a first user on its own. `seedAdmin` breaks the circle exactly once — on an
+entire first-launch story. Losing the password is an edit to `.env` and a restart.
 empty `users` table it creates account number one from `ADMIN_EMAIL` / `ADMIN_PASSWORD` and sets
 `is_admin`. Against a populated database it does nothing, which is what makes it safe to leave in
 the boot sequence. **Fatal at startup if those are unset on an empty database** — a site nobody can
 log into is worse than one that will not boot.
-**Routes:** `GET /admin` dashboard, `POST /admin/invites`, `POST /admin/users/{id}/password`,
+**Routes** (all on the loopback listener): `GET /admin` dashboard, `POST /admin/invites`,
-`POST /admin/users/{id}/ban`, `POST /admin/songs/{id}/delete`, `GET /admin/reports`,
+`POST /admin/users/{id}/password`, `POST /admin/users/{id}/ban`, `POST /admin/songs/{id}/delete`,
-`POST /admin/reports/{id}/resolve`. There is no `/admin/audio/{id}`: an admin is a member, so
+`GET /admin/reports`, `POST /admin/reports/{id}/resolve`, and `GET /admin/audio/{id}` — moderating a
-`GET /audio/{id}` already works for them.
+complaint means listening to the song, and a separate audio route avoids branching auth inside the
 member handler.
 **Ban** is a reversible toggle. It refuses login and deletes the member's sessions immediately.
 Their songs and reviews stay, keep counting in the stats, and keep their name on them: a ban ends
-participation, it does not rewrite history. An admin cannot ban *themselves* — the sessions would go
+participation, it does not rewrite history.
 with it and nothing would be left to undo it.
-**The admin surface has no API.** No client but a browser, so JSON would be contract surface with no
+**The admin surface has no API.** Basic Auth on loopback with no client but a browser — JSON would
-consumer.
+be contract surface with no consumer.
 ---
@@ -733,7 +730,7 @@ panel, so the admin surface comes first — before a single member can exist.
 1. **Skeleton** — `main.go`, embedded migrations at startup, `database/sql`, slog, Docker Compose,
   the two listeners.
-2. **Admin, invites, auth** — seed the first admin, mint an invite, register, log in, sessions, ban.
+2. **Admin, invites, auth** — Basic Auth listener, mint an invite, register, log in, sessions, ban.
 3. **Submission pipeline, upload path only** — submit, convert, waiting page, publish. No yt-dlp yet,
   so the hard parts (worker, publish transaction, restart recovery) are proven without a network
   dependency.
@@ -1,6 +1,6 @@
 module git.kessinen.com/kessinen/levyraati26-go
-go 1.27.0
+go 1.25.0
 require (
 	golang.org/x/crypto v0.32.0
@@ -67,7 +67,7 @@ func parseLRC(s string) []lyricLine {
 		return nil
 	}
 	var out []lyricLine
-	for raw := range strings.SplitSeq(s, "\n") {
+	for _, raw := range strings.Split(s, "\n") {
 		stamps := lrcOne.FindAllStringSubmatch(raw, -1)
 		if len(stamps) == 0 {
 			continue
@@ -2,6 +2,7 @@ package main
 import (
 	"context"
 	"crypto/subtle"
 	"database/sql"
 	"fmt"
 	"log/slog"
@@ -10,7 +11,6 @@ import (
 	"path/filepath"
 	"strings"
 	"golang.org/x/crypto/bcrypt"
 	_ "modernc.org/sqlite"
 )
@@ -18,31 +18,34 @@ import (
 var version = "dev"
 type config struct {
-	dbPath string
+	dbPath        string
-	// Only read when the database has no users at all: seedAdmin turns these into account number
+	adminUser     string
 	// one. Once that account exists they are dead weight and can leave the environment.
 	adminEmail    string
 	adminName     string
 	adminPass     string
 	addr          string
 	adminAddr     string
 	storageDir    string
 	secureCookies bool
-	// Public address of the site, so invite links are pasteable out of the admin page.
+	// Public address of the member site, so admin-side invite links are pasteable. The admin
 	// listener's own Host is a tunnel, not the site, so it cannot be derived.
 	publicURL string
 }
 func loadConfig() config {
 	c := config{
-		adminEmail:    os.Getenv("ADMIN_EMAIL"),
+		adminUser:     env("ADMIN_USER", "admin"),
 		adminName:     env("ADMIN_NAME", "Ylläpito"),
 		adminPass:     os.Getenv("ADMIN_PASSWORD"),
 		addr:          env("ADDR", ":8080"),
 		adminAddr:     env("ADMIN_ADDR", "127.0.0.1:8081"),
 		storageDir:    env("STORAGE_DIR", "./storage"),
 		secureCookies: env("SECURE_COOKIES", "true") != "false",
 		publicURL:     strings.TrimRight(os.Getenv("PUBLIC_URL"), "/"),
 	}
 	// The database lives beside the audio, so one volume is the whole backup.
 	c.dbPath = env("DB_PATH", filepath.Join(c.storageDir, "levyraati.db"))
 	// An admin panel that silently opens is worse than one that won't boot.
 	if c.adminPass == "" {
 		fatal("ADMIN_PASSWORD is not set")
 	}
 	return c
 }
@@ -91,23 +94,8 @@ func affected(res sql.Result) int64 {
 	return n
 }
 // LOG_LEVEL is debug, info, warn or error. slog parses those itself, so an unreadable value falls
 // back to info rather than refusing to boot over a logging setting.
 func logLevel() slog.Level {
 	var l slog.Level
 	if err := l.UnmarshalText([]byte(env("LOG_LEVEL", "info"))); err != nil {
 		return slog.LevelInfo
 	}
 	return l
 }
 func main() {
-	// AddSource puts file:line on every record, so a log line found by its error code leads
+	slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stdout, nil)))
 	// straight to the branch that wrote it.
 	slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
 		AddSource: true,
 		Level:     logLevel(),
 	})))
 	slog.Info("starting", "ctx", "startup", "version", version)
 	cfg := loadConfig()
@@ -134,48 +122,22 @@ func main() {
 	if err := sweep(ctx, db); err != nil {
 		fatal("startup sweep", "error", err)
 	}
 	if err := seedAdmin(ctx, db, cfg); err != nil {
 		fatal("seed admin", "error", err)
 	}
 	a := &app{cfg: cfg, db: db}
 	// ponytail: two listeners, one process. Admin is loopback-only — reach it over an SSH tunnel
 	// or the reverse proxy. A separate binary would need its own deploy and would race the
 	// startup migrations; it buys nothing else.
 	go func() {
 		slog.Info("admin listening", "ctx", "startup", "addr", cfg.adminAddr)
 		err := http.ListenAndServe(cfg.adminAddr, a.requireAdmin(a.adminMux()))
 		fatal("admin listener", "error", err)
 	}()
 	slog.Info("listening", "ctx", "startup", "addr", cfg.addr)
 	fatal("listener", "error", http.ListenAndServe(cfg.addr, a.withMember(a.memberMux())))
 }
 // Registration needs an invite and invites are minted from the admin page, so a database with no
 // users has no way to grow one. seedAdmin breaks that circle exactly once: on an empty users table
 // it creates account number one from the environment and marks it admin. Every account after it
 // arrives through an invite like anyone else.
 //
 // ponytail: no promote-existing-user path and no password reset here. Re-running against a
 // populated database does nothing, which is what makes it safe to leave in the boot sequence.
 func seedAdmin(ctx context.Context, db *sql.DB, cfg config) error {
 	var users int
 	if err := db.QueryRowContext(ctx, `select count(*) from users`).Scan(&users); err != nil {
 		return err
 	}
 	if users > 0 {
 		return nil
 	}
 	if cfg.adminEmail == "" || cfg.adminPass == "" {
 		// A site nobody can log into is worse than one that won't boot.
 		fatal("empty database: set ADMIN_EMAIL and ADMIN_PASSWORD to create the first account")
 	}
 	hash, err := bcrypt.GenerateFromPassword([]byte(cfg.adminPass), bcrypt.DefaultCost)
 	if err != nil {
 		return err
 	}
 	if _, err := db.ExecContext(ctx,
 		`insert into users (name, email, password_hash, is_admin) values ($1, $2, $3, 1)`,
 		cfg.adminName, strings.ToLower(cfg.adminEmail), string(hash)); err != nil {
 		return err
 	}
 	slog.Info("first admin created", "ctx", "startup", "email", cfg.adminEmail)
 	return nil
 }
 func (a *app) memberMux() *http.ServeMux {
 	mux := http.NewServeMux()
 	mux.Handle("GET /static/", http.FileServerFS(assetFS))
@@ -225,40 +187,41 @@ func (a *app) memberMux() *http.ServeMux {
 	mux.HandleFunc("POST /submit/{id}/lyrics", a.requireMember(a.suggestLyrics))
 	mux.HandleFunc("POST /submit/{id}/retry", a.requireMember(a.retry))
 	mux.HandleFunc("POST /submit/{id}/discard", a.requireMember(a.discard))
 	a.adminRoutes(mux)
 	return mux
 }
-// The admin pages sit on the same mux and the same session as everything else; only the guard
+func (a *app) adminMux() *http.ServeMux {
-// differs. There is no /admin/audio: requireAdmin members can reach GET /audio/{id} like anyone.
+	mux := http.NewServeMux()
-func (a *app) adminRoutes(mux *http.ServeMux) {
+	mux.Handle("GET /static/", http.FileServerFS(assetFS))
-	mux.HandleFunc("GET /admin", a.requireAdmin(a.adminDashboard))
+	mux.HandleFunc("GET /admin", a.adminDashboard)
-	mux.HandleFunc("POST /admin/invites", a.requireAdmin(a.createInvite))
+	mux.HandleFunc("POST /admin/invites", a.createInvite)
-	mux.HandleFunc("POST /admin/users/{id}/ban", a.requireAdmin(a.toggleBan))
+	mux.HandleFunc("POST /admin/users/{id}/ban", a.toggleBan)
-	mux.HandleFunc("POST /admin/users/{id}/password", a.requireAdmin(a.resetPassword))
+	mux.HandleFunc("POST /admin/users/{id}/password", a.resetPassword)
-	mux.HandleFunc("POST /admin/songs/{id}/delete", a.requireAdmin(a.adminDeleteSong))
+	mux.HandleFunc("POST /admin/songs/{id}/delete", a.adminDeleteSong)
-	mux.HandleFunc("GET /admin/reports", a.requireAdmin(a.adminReports))
+	mux.HandleFunc("GET /admin/reports", a.adminReports)
-	mux.HandleFunc("POST /admin/reports/{id}/resolve", a.requireAdmin(a.resolveReport))
+	mux.HandleFunc("POST /admin/reports/{id}/resolve", a.resolveReport)
 	mux.HandleFunc("GET /admin/audio/{id}", a.adminAudio)
 	mux.HandleFunc("GET /{$}", func(w http.ResponseWriter, r *http.Request) {
 		http.Redirect(w, r, "/admin", http.StatusSeeOther)
 	})
 	return mux
 }
-// ponytail: one flag, no roles. A moderator tier is a second column on the day someone needs to
+// ponytail: Basic Auth, no admin session, no admin row. Ceiling: one admin, no logout
-// resolve reports without also being able to reset passwords.
+// (close the browser). Add a cookie session if a second admin ever needs one.
 //
-// A signed-out visitor is sent to log in, the same as any member page. A signed-in member who is
+// No bcrypt: hashing protects stored passwords against a database leak, and this one lives in the
-// not an admin gets 404 rather than 403: the admin pages are none of their business, and saying
+// env file already. The constant-time compare is the part that matters.
-// "forbidden" confirms there is something there to be forbidden from.
+func (a *app) requireAdmin(next http.Handler) http.Handler {
-func (a *app) requireAdmin(next http.HandlerFunc) http.HandlerFunc {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-	return func(w http.ResponseWriter, r *http.Request) {
+		u, p, ok := r.BasicAuth()
-		m := memberFrom(r.Context())
+		userOK := subtle.ConstantTimeCompare([]byte(u), []byte(a.cfg.adminUser)) == 1
-		if m == nil {
+		passOK := subtle.ConstantTimeCompare([]byte(p), []byte(a.cfg.adminPass)) == 1
-			http.Redirect(w, r, "/login", http.StatusSeeOther)
+		if !ok || !userOK || !passOK {
 			w.Header().Set("WWW-Authenticate", `Basic realm="levyraati admin"`)
 			http.Error(w, "unauthorized", http.StatusUnauthorized)
 			return
 		}
-		if !m.IsAdmin {
+		next.ServeHTTP(w, r)
-			http.NotFound(w, r)
+	})
 			return
 		}
 		next(w, r)
 	}
 }
@@ -0,0 +1,58 @@
 package main
 import (
 	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 )
 func TestRequireAdmin(t *testing.T) {
 	a := &app{cfg: config{adminUser: "admin", adminPass: "s3cret"}}
 	h := a.requireAdmin(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusTeapot)
 	}))
 	for _, tc := range []struct {
 		name, user, pass string
 		auth             bool
 		want             int
 	}{
 		{name: "no credentials", want: http.StatusUnauthorized},
 		{name: "wrong password", user: "admin", pass: "hunter2", auth: true, want: http.StatusUnauthorized},
 		{name: "wrong user", user: "root", pass: "s3cret", auth: true, want: http.StatusUnauthorized},
 		{name: "correct", user: "admin", pass: "s3cret", auth: true, want: http.StatusTeapot},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			r := httptest.NewRequest("GET", "/admin", nil)
 			if tc.auth {
 				r.SetBasicAuth(tc.user, tc.pass)
 			}
 			w := httptest.NewRecorder()
 			h.ServeHTTP(w, r)
 			if w.Code != tc.want {
 				t.Fatalf("status = %d, want %d", w.Code, tc.want)
 			}
 		})
 	}
 }
 func TestMigrateIsIdempotent(t *testing.T) {
 	ctx := context.Background()
 	a := testApp(t) // already migrated once
 	if err := migrate(ctx, a.db); err != nil {
 		t.Fatalf("second migrate: %v", err)
 	}
 	if err := sweep(ctx, a.db); err != nil {
 		t.Fatalf("sweep: %v", err)
 	}
 	var n int
 	if err := a.db.QueryRowContext(ctx, `select count(*) from schema_migrations`).Scan(&n); err != nil {
 		t.Fatal(err)
 	}
 	if n != 1 {
 		t.Fatalf("applied migrations = %d, want 1", n)
 	}
 }
@@ -132,13 +132,6 @@ func (a *app) editProfile(w http.ResponseWriter, r *http.Request) {
 	}
 	if newPassword := r.FormValue("new_password"); newPassword != "" {
 		// A typo here would lock them out of an account they can still reach right now, and the
 		// only way back is an admin reset.
 		if newPassword != r.FormValue("new_password_repeat") {
 			a.flash(w, "Uudet salasanat eivät täsmää.")
 			http.Redirect(w, r, "/profile", http.StatusSeeOther)
 			return
 		}
 		if !a.changePassword(w, r, me.ID, r.FormValue("current_password"), newPassword) {
 			return
 		}
@@ -190,3 +190,9 @@ func (a *app) adminSongs(ctx context.Context) ([]adminSong, error) {
 	}
 	return out, rows.Err()
 }
 // Moderating a complaint means listening to the song, so the admin surface has its own audio route
 // rather than branching auth inside the member handler.
 func (a *app) adminAudio(w http.ResponseWriter, r *http.Request) {
 	a.audio(w, r)
 }
@@ -295,7 +295,7 @@ func (a *app) editSong(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if affected(res) == 0 {
-		a.flash(w, "Kappaletta on jo arvosteltu, joten sitä ei voi muokata.")
+		a.flash(w, "Kappaletta ei voi enää muokata — sitä on jo arvosteltu.")
 	} else {
 		a.flash(w, "Tiedot tallennettu.")
 	}
@@ -319,7 +319,7 @@ func (a *app) deleteSong(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if affected(res) == 0 {
-		a.flash(w, "Kappaletta on jo arvosteltu, joten sitä ei voi poistaa.")
+		a.flash(w, "Kappaletta ei voi enää poistaa — sitä on jo arvosteltu.")
 		http.Redirect(w, r, fmt.Sprintf("/songs/%d", id), http.StatusSeeOther)
 		return
 	}
@@ -1,95 +0,0 @@
 package main
 import (
 	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 )
 // A plain member must not be able to tell that /admin exists, and a stranger must be sent to log in.
 func TestRequireAdmin(t *testing.T) {
 	a := &app{}
 	h := a.requireAdmin(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusTeapot)
 	})
 	for _, tc := range []struct {
 		name string
 		as   *member
 		want int
 	}{
 		{name: "signed out", as: nil, want: http.StatusSeeOther},
 		{name: "member", as: &member{ID: 1}, want: http.StatusNotFound},
 		{name: "admin", as: &member{ID: 1, IsAdmin: true}, want: http.StatusTeapot},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			r := httptest.NewRequest("GET", "/admin", nil)
 			if tc.as != nil {
 				r = r.WithContext(context.WithValue(r.Context(), memberKey, tc.as))
 			}
 			w := httptest.NewRecorder()
 			h(w, r)
 			if w.Code != tc.want {
 				t.Fatalf("status = %d, want %d", w.Code, tc.want)
 			}
 		})
 	}
 }
 // The first account cannot arrive by invite, because minting an invite needs an admin.
 func TestSeedAdminOnlyOnEmptyDatabase(t *testing.T) {
 	a := testApp(t)
 	ctx := context.Background()
 	cfg := config{adminEmail: "[email protected]", adminName: "Ylläpito", adminPass: "salasana1"}
 	if err := seedAdmin(ctx, a.db, cfg); err != nil {
 		t.Fatal(err)
 	}
 	var name, email string
 	var isAdmin bool
 	if err := a.db.QueryRowContext(ctx,
 		`select name, email, is_admin from users`).Scan(&name, &email, &isAdmin); err != nil {
 		t.Fatal(err)
 	}
 	if !isAdmin || name != "Ylläpito" {
 		t.Fatalf("seeded %q is_admin=%v, want Ylläpito admin", name, isAdmin)
 	}
 	// Login is by lowercased email, so the seed must not smuggle in a capital.
 	if email != "[email protected]" {
 		t.Fatalf("email = %q, want lowercased", email)
 	}
 	// Re-running on a populated database must not add a second account or reset the first.
 	cfg.adminEmail = "[email protected]"
 	if err := seedAdmin(ctx, a.db, cfg); err != nil {
 		t.Fatal(err)
 	}
 	var n int
 	if err := a.db.QueryRowContext(ctx, `select count(*) from users`).Scan(&n); err != nil {
 		t.Fatal(err)
 	}
 	if n != 1 {
 		t.Fatalf("users = %d, want 1", n)
 	}
 }
 func TestMigrateIsIdempotent(t *testing.T) {
 	ctx := context.Background()
 	a := testApp(t) // already migrated once
 	if err := migrate(ctx, a.db); err != nil {
 		t.Fatalf("second migrate: %v", err)
 	}
 	if err := sweep(ctx, a.db); err != nil {
 		t.Fatalf("sweep: %v", err)
 	}
 	var n int
 	if err := a.db.QueryRowContext(ctx, `select count(*) from schema_migrations`).Scan(&n); err != nil {
 		t.Fatal(err)
 	}
 	if n != 2 {
 		t.Fatalf("applied migrations = %d, want 2", n)
 	}
 }
@@ -1,8 +0,0 @@
 -- The admin became an ordinary account with a flag, so the separate Basic Auth listener could go.
 -- Same integer-as-boolean convention as `banned` above it.
 alter table users add column is_admin integer not null default 0;
 -- An existing database already has its admin sitting in row one: the person who was handed the
 -- first invite from the old panel. A fresh database has no rows, so this is a no-op there and
 -- seedAdmin creates the account from the environment instead.
 update users set is_admin = 1 where id = (select min(id) from users);
@@ -1,62 +0,0 @@
 package main
 import (
 	"context"
 	"net/http"
 	"net/url"
 	"testing"
 	"golang.org/x/crypto/bcrypt"
 )
 // The repeat field is the only guard against a typo in something nobody can read back: the account
 // is reachable right now, and a mistyped new password makes it reachable only through an admin.
 func TestPasswordChangeNeedsMatchingRepeat(t *testing.T) {
 	a := testApp(t)
 	ctx := context.Background()
 	mux := a.withMember(a.memberMux())
 	id := a.seedMember(t, "[email protected]")
 	hash, err := bcrypt.GenerateFromPassword([]byte("vanha1"), bcrypt.MinCost)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if _, err := a.db.ExecContext(ctx,
 		`update users set password_hash = $2 where id = $1`, id, string(hash)); err != nil {
 		t.Fatal(err)
 	}
 	tok, _, err := a.startSession(ctx, id, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	form := func(repeat string) url.Values {
 		return url.Values{
 			"name": {"Esa"}, "email": {"[email protected]"},
 			"current_password": {"vanha1"},
 			"new_password":     {"uusi1"}, "new_password_repeat": {repeat},
 		}
 	}
 	current := func() string {
 		var h string
 		if err := a.db.QueryRowContext(ctx,
 			`select password_hash from users where id = $1`, id).Scan(&h); err != nil {
 			t.Fatal(err)
 		}
 		return h
 	}
 	if w := postAs(t, mux, "/profile", form("uusi2"), tok); w.Code != http.StatusSeeOther {
 		t.Fatalf("mismatch: status = %d, want 303", w.Code)
 	}
 	if bcrypt.CompareHashAndPassword([]byte(current()), []byte("vanha1")) != nil {
 		t.Fatal("a mismatched repeat still changed the password")
 	}
 	if w := postAs(t, mux, "/profile", form("uusi1"), tok); w.Code != http.StatusSeeOther {
 		t.Fatalf("match: status = %d, want 303", w.Code)
 	}
 	if bcrypt.CompareHashAndPassword([]byte(current()), []byte("uusi1")) != nil {
 		t.Fatal("a matching repeat did not change the password")
 	}
 }
@@ -2,9 +2,7 @@ package main
 import (
 	"context"
 	"crypto/rand"
 	"database/sql"
 	"encoding/hex"
 	"errors"
 	"fmt"
 	"io"
@@ -328,11 +326,13 @@ func (a *app) process(subID int64, sourceURL, src string) {
 	if sourceURL != "" {
 		a.setStatus(ctx, subID, "downloading", "")
-		detail, err := downloadYouTube(ctx, sourceURL, a.tmpPath(subID, ".%(ext)s"))
+		msg, err := downloadYouTube(ctx, sourceURL, a.tmpPath(subID, ".%(ext)s"))
 		if err != nil {
-			a.fail(ctx, subID, "download",
+			if msg == "" {
-				"Kappaleen lataaminen ei onnistunut. Yritä myöhemmin uudelleen.",
+				msg = err.Error()
-				detail, err, "url", sourceURL)
+			}
 			a.setStatus(ctx, subID, "failed", msg)
 			slog.Warn("download failed", "ctx", "submissions", "submission", subID, "error", err)
 			return
 		}
 		// yt-dlp names the file after whatever container YouTube served.
@@ -344,9 +344,7 @@ func (a *app) process(subID int64, sourceURL, src string) {
 			}
 		}
 		if src == "" {
-			a.fail(ctx, subID, "download",
+			a.setStatus(ctx, subID, "failed", "lataus ei tuottanut tiedostoa")
 				"Kappaleen lataaminen ei onnistunut. Yritä myöhemmin uudelleen.",
 				"yt-dlp exited cleanly but produced no file", nil, "url", sourceURL)
 			return
 		}
 		if _, err := a.db.ExecContext(ctx,
@@ -358,12 +356,14 @@ func (a *app) process(subID int64, sourceURL, src string) {
 	a.setStatus(ctx, subID, "converting", "")
 	out := a.tmpPath(subID, ".ogg")
-	detail, err := convertToOpus(ctx, src, out)
+	msg, err := convertToOpus(ctx, src, out)
 	if err != nil {
 		os.Remove(out)
-		a.fail(ctx, subID, "convert",
+		if msg == "" {
-			"Tiedostoa ei voitu muuntaa. Onko se varmasti äänitiedosto?",
+			msg = err.Error()
-			detail, err)
+		}
 		a.setStatus(ctx, subID, "failed", msg)
 		slog.Warn("conversion failed", "ctx", "submissions", "submission", subID, "error", err)
 		return
 	}
 	// The original is discarded as soon as the Opus exists.
@@ -393,27 +393,6 @@ func (a *app) process(subID int64, sourceURL, src string) {
 	a.autoFetchLyrics(ctx, subID, title, artist, seconds)
 }
 // Short enough to read out over chat, long enough not to collide in a log worth grepping.
 func traceID() string {
 	b := make([]byte, 4)
 	rand.Read(b)
 	return hex.EncodeToString(b)
 }
 // fail is the only way a submission is marked failed. The submitter gets a sentence they can act
 // on plus a code; the log line gets that same code and everything that identifies the cause —
 // including the tool's own stderr, which used to go to the submitter and nowhere else. A download
 // that died on an HTTP 403 left "error: exit status 1" in the log and nothing else.
 func (a *app) fail(ctx context.Context, subID int64, stage, userMsg, detail string, err error, extra ...any) {
 	code := traceID()
 	args := []any{
 		"ctx", "submissions", "code", code, "stage", stage, "submission", subID,
 		"detail", detail, "error", err,
 	}
 	slog.Error("submission failed", append(args, extra...)...)
 	a.setStatus(ctx, subID, "failed", fmt.Sprintf("%s (virhekoodi %s)", userMsg, code))
 }
 func (a *app) setStatus(ctx context.Context, subID int64, status, msg string) {
 	if _, err := a.db.ExecContext(ctx,
 		`update submissions set status = $2, status_msg = nullif($3, '') where id = $1`,
@@ -8,8 +8,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
 )
@@ -222,37 +220,3 @@ func TestRestartRecovery(t *testing.T) {
 		t.Fatal("swept submission carries no explanation")
 	}
 }
 // The submitter must get a code they can quote, and must not get yt-dlp's stderr. The code is the
 // only thing tying their screenshot to the log line that says what actually broke.
 func TestFailGivesTraceableCodeNotToolOutput(t *testing.T) {
 	a := testApp(t)
 	ctx := context.Background()
 	uid := a.seedMember(t, "[email protected]")
 	var subID int64
 	if err := a.db.QueryRowContext(ctx,
 		`insert into submissions (user_id, status) values ($1, 'downloading') returning id`,
 		uid).Scan(&subID); err != nil {
 		t.Fatal(err)
 	}
 	const secret = "HTTP Error 403: Forbidden"
 	a.fail(ctx, subID, "download", "Kappaleen lataaminen ei onnistunut.", secret,
 		fmt.Errorf("exit status 1"), "url", "https://youtu.be/x")
 	var status, msg string
 	if err := a.db.QueryRowContext(ctx,
 		`select status, status_msg from submissions where id = $1`, subID).Scan(&status, &msg); err != nil {
 		t.Fatal(err)
 	}
 	if status != "failed" {
 		t.Fatalf("status = %q, want failed", status)
 	}
 	if strings.Contains(msg, secret) {
 		t.Fatalf("tool stderr leaked to the submitter: %q", msg)
 	}
 	if !regexp.MustCompile(`\(virhekoodi [0-9a-f]{8}\)$`).MatchString(msg) {
 		t.Fatalf("no traceable code in %q", msg)
 	}
 }
@@ -27,8 +27,8 @@
      {{end}}
    </tbody>
  </table>
-  <p class="muted small">Lähetä linkki kaverille. Koodi on valmiiksi täytettynä.
+  <p class="muted small">Lähetä linkki kaverille — se avaa liittymislomakkeen koodi valmiiksi
-    Lista näyttää käyttämättömät kutsut{{if .Data.SpentCount}}; käytettyjä on
+    täytettynä. Lista näyttää käyttämättömät kutsut{{if .Data.SpentCount}}; käytettyjä on
    {{.Data.SpentCount}}{{end}}.</p>
  </div>
 </section>
@@ -75,7 +75,7 @@
          <td>{{.Reviews}}</td>
          <td class="nowrap">{{fidate .CreatedAt}}</td>
          <td class="actions">
-            <a href="/audio/{{.ID}}">Kuuntele</a>
+            <a href="/admin/audio/{{.ID}}">Kuuntele</a>
            <form method="post" action="/admin/songs/{{.ID}}/delete"
                  onsubmit="return confirm('Poistetaanko kappale ja kaikki sen arvostelut?')">
              <button type="submit" class="ghost danger">Poista</button>
@@ -16,14 +16,15 @@
    <div class="topbar-inner">
      <a class="brand" href="/">Levyraati{{if .Admin}} <span class="badge admin">ylläpito</span>{{end}}</a>
-      {{if .Member}}
+      {{if .Admin}}
        <nav class="navlinks"><a href="/admin" aria-current="page">Ylläpito</a></nav>
        <span></span>
      {{else if .Member}}
        <nav class="navlinks">
          <a href="/" {{if eq .Path "/"}}aria-current="page"{{end}}>Jono{{if .Queued}} <span class="count">{{.Queued}}</span>{{end}}</a>
          <a href="/songs" {{if eq .Path "/songs"}}aria-current="page"{{end}}>Kappaleet</a>
          <a href="/submit" {{if eq .Path "/submit"}}aria-current="page"{{end}}>Lähetä</a>
          <a href="/stats" {{if eq .Path "/stats"}}aria-current="page"{{end}}>Tilastot</a>
          <!-- An admin is a member first: the same nav, with one link the others do not get. -->
          {{if .Member.IsAdmin}}<a href="/admin" {{if .Admin}}aria-current="page"{{end}}>Ylläpito</a>{{end}}
        </nav>
        <div class="userblock">
          <span class="lines">
@@ -44,7 +45,6 @@
              <a href="/songs">Kappaleet</a>
              <a href="/submit">Lähetä</a>
              <a href="/stats">Tilastot</a>
              {{if .Member.IsAdmin}}<a href="/admin">Ylläpito</a>{{end}}
              <a href="/profile">Oma profiili</a>
              <form method="post" action="/logout"><button type="submit">Kirjaudu ulos</button></form>
            </div>
@@ -62,7 +62,7 @@
  <footer class="sitefooter">
    {{if .Member}}
      <!-- The server already knows where they were, so the path travels in the link — no JS. -->
-      <a href="/report?from={{.Path}}">Anna palautetta</a> ·
+      <a href="/report?from={{.Path}}">Ongelmia? Ideoita? Palautetta?</a> ·
    {{end}}
    <span class="slogan">We know good music, baby!</span>
    <span class="copyright">© Kessinen</span>
@@ -11,7 +11,7 @@
  </div>
  <label class="follow">
    <input type="checkbox" checked> Seuraa kappaletta
-    <span class="muted small">(sivu ei vieri)</span>
+    <span class="muted small">— korostus jatkuu, sivu ei vieri</span>
  </label>
 {{else}}
  <div class="lyricsbox plain" data-duration="{{.Duration}}" data-song="{{.ID}}">
@@ -36,7 +36,7 @@
 {{define "songcard"}}
 <a class="songcard{{if and (not .Own) (not .Reviewed)}} unreviewed{{end}}" href="/songs/{{.ID}}">
  {{if .Average}}<span class="scorebadge">{{score .Average}}</span>
-  {{else if .ReviewCount}}<span class="scorebadge sealed" title="Muiden pisteet paljastuvat kun tallennat omasi"></span>{{end}}
+  {{else if .ReviewCount}}<span class="scorebadge sealed" title="Pisteet paljastuvat kun arvostelet"></span>{{end}}
  <span class="title">{{.Title}}</span>
  <span class="artist">{{.Artist}}</span>
  <span class="meta">
@@ -50,8 +50,6 @@
    <label>Kuva <input type="file" name="avatar" accept="image/*"></label>
    <label>Nykyinen salasana <input type="password" name="current_password" autocomplete="current-password"></label>
    <label>Uusi salasana <input type="password" name="new_password" autocomplete="new-password"></label>
    <!-- Neither field can be read back, and the new password has never been typed before. -->
    <label>Toista uusi salasana <input type="password" name="new_password_repeat" autocomplete="new-password"></label>
    <button type="submit">Tallenna</button>
  </form>
  <p class="muted small">Salasanan vaihto vaatii nykyisen salasanan ja kirjaa ulos muut laitteesi.</p>
@@ -2,8 +2,8 @@
 <h1>Jono</h1>
 {{if .Data.Items}}
-  <p class="muted">Arvostelemattomat kappaleet, vanhimmasta uusimpaan. Muiden pisteet paljastuvat
+  <p class="muted">Arvostelemattomat kappaleet, vanhimmasta uusimpaan. Pisteet paljastuvat kun
-    kun tallennat omasi.</p>
+    olet kirjoittanut oman arvostelusi.</p>
  <div class="songgrid">
    {{range .Data.Items}}{{template "songcard" .}}{{end}}
  </div>
@@ -1,6 +1,7 @@
 {{define "content"}}
 <h1>Palaute</h1>
-<p class="muted">Ongelmat, ideat ja kaikki muu palaute samaan paikkaan. Yksi virke riittää.</p>
+<p class="muted">Ongelmat, ideat ja kaikki muu palaute samaan paikkaan. Ei kategorioita eikä
  prioriteetteja — yksi virke riittää.</p>
 <form method="post" action="/report" class="stack">
  <input type="hidden" name="from" value="{{.Data.From}}">
@@ -81,7 +81,7 @@
 <!-- Only when the review strip is not already showing them: while reviewing, the lyrics live in
     the left pane. This panel is for reading afterwards and for the submitter's edits. -->
 <details class="lyrics">
-  <summary>Sanoitukset{{if not $s.Lyrics}} <span class="muted small">(ei vielä lisätty)</span>{{end}}</summary>
+  <summary>Sanoitukset{{if not $s.Lyrics}} <span class="muted small">— ei vielä lisätty</span>{{end}}</summary>
  {{if $s.Lyrics}}<pre class="lyricstext">{{lyricstext $s.Lyrics}}</pre>{{end}}
  {{if $s.Own}}
    <form method="post" action="/songs/{{$s.ID}}/lyrics" class="stack">
@@ -168,7 +168,7 @@
  {{else}}
    <p class="sealed-note">
      <span class="sealed" aria-hidden="true"></span>
-      Muiden pisteet paljastuvat kun tallennat omasi.
+      Muiden pisteet ja arvostelut paljastuvat kun kirjoitat omasi.
      {{if $s.ReviewCount}}Arvosteluja on {{$s.ReviewCount}}.{{end}}
    </p>
  {{end}}
@@ -49,7 +49,7 @@
 {{define "content"}}
 <h1>Tilastot</h1>
 <p class="muted">Kappale pääsee listoille kun sillä on vähintään {{.Data.MinReviews}} arvostelua.
-  Tilastot näkyvät kaikille.</p>
+  Tilastot näkyvät kaikille — täällä pisteitä ei piiloteta.</p>
 <div class="boards">
  {{template "songboard" dict "Title" "Parhaat" "Items" .Data.TopSongs}}
@@ -24,7 +24,7 @@
    <!-- Outside the form and attached to it with form=, so one button both submits the metadata
         and publishes. Disabled until the audio has finished converting. -->
    <button type="submit" form="meta" {{if not .Ready}}disabled{{end}}>Julkaise</button>
-    {{if not .Ready}}<p class="muted small">Julkaise aukeaa kun lähetys on valmis.</p>{{end}}
+    {{if not .Ready}}<p class="muted small">Julkaise aukeaa kun muunnos on valmis.</p>{{end}}
  {{end}}
 </div>
 {{end}}
@@ -45,7 +45,7 @@
            hx-post="/submit/{{.ID}}/lyrics"
            hx-include="[name='title'], [name='artist']"
            hx-target="#lyricsfield" hx-swap="outerHTML">Hae sanoitukset</button>
-    {{if .Found}}<span class="muted small">Löytyi. Tarkista teksti.</span>{{end}}
+    {{if .Found}}<span class="muted small">Löytyi — tarkista ja muokkaa tarvittaessa.</span>{{end}}
    {{if .Searched}}{{if not .Found}}
      <span class="muted small">Ei löytynyt. Tarkista nimi ja esittäjä tai liitä sanoitukset itse.</span>
    {{end}}{{end}}
@@ -84,7 +84,8 @@
  {{template "saved" ""}}
 </form>
-<p class="muted">Nimi, esittäjä ja genre tarvitaan ennen julkaisua.</p>
+<p class="muted">Tiedot tallentuvat itsestään kirjoittaessasi. Nimi, esittäjä ja genre tarvitaan
  ennen julkaisua.</p>
 {{template "submission-status" .Data}}
 {{end}}
@@ -32,10 +32,13 @@
      {{end}}
    </tbody>
  </table>
  <p class="muted small">Valmis lähetys odottaa Julkaise-painallusta — vasta se tuo kappaleen
    muiden nähtäville.</p>
 </section>
 {{end}}
-<p class="muted">Enintään 50 MB ja 15 minuuttia.</p>
+<p class="muted">Enintään 50 MB ja 15 minuuttia. Tiedosto muunnetaan Opus-muotoon, ja pääset
  kirjoittamaan esittelyn odotellessa. Kappale julkaistaan vasta kun painat Julkaise.</p>
 <script>
  // The native control can't be relabelled or styled, so it is hidden behind this one — which