/* SLPT-R28-B16PWA3A-OWNER-NAV-ROLE-BRIDGE-CORRECTION-20260830
   Corrects B16PWA3's role-root mismatch.
   Canonical authenticated role bridge is body[data-role], while B16PU1 also
   owns html.r28pu1-owner. Use both trusted owner signals.
   No general typography/contrast or unrelated mobile ownership changes.
*/

/* Owner duplicate admin routes remain hidden. */
body[data-role="owner"] #nav button[data-page="clients"],
body[data-role="owner"] #nav button[data-page="coaches"],
body[data-role="owner"] #nav button[data-page="services"],
body[data-role="owner"] #nav button[data-page="plans-r25"],
html.r28pu1-owner #nav button[data-page="clients"],
html.r28pu1-owner #nav button[data-page="coaches"],
html.r28pu1-owner #nav button[data-page="services"],
html.r28pu1-owner #nav button[data-page="plans-r25"]{
  display:none!important;
}

/* Override B16PWA3's erroneous html:not([data-role="owner"]) hide rule.
   body[data-role="owner"] is the canonical role bridge proven by inherited
   role-isolation gates; html.r28pu1-owner is the B16PU1 workspace owner flag. */
body[data-role="owner"] #nav [data-r28pu1-nav="plans-users"],
html.r28pu1-owner #nav [data-r28pu1-nav="plans-users"]{
  display:flex!important;
  visibility:visible!important;
  opacity:1!important;
}

/* Fail closed only when NEITHER trusted owner signal is present. */
html:not(.r28pu1-owner) body:not([data-role="owner"]) #nav [data-r28pu1-nav="plans-users"]{
  display:none!important;
}