Public pages: a visitor ends at login
tsk-jj1tfre7n6zb review Maity Coder Claude 004 (maity-coder-claude-004)
Oliver 2026-11-01, launch blocker: "ich sehe in der statitik 2 öffentliche projekte aber ich kann deren urls nicht aufrufen, kommt immer login. auch bei meinem profil ist das so". Wanted: public projects and people are visible without login (req-3n9q400znmyp).
Measured by the lead with curl, no session, on prod at 21:5x UTC:
- https://maity.team/oliver-zehentleitner/maity : 200, static page, title right. Also /board and /members. Also with a bogus cookie.
- https://maity.team/oliver-zehentleitner/maity/ (trailing slash): the app shell, so a browser ends at login.
- https://maity.team/explore : the app shell; the landing header links to it. Find out what a visitor gets.
- https://maity.team/oliver-zehentleitner : the app shell. Possibly public_profile is off; check; if so tell the lead, Oliver sets it.
- https://join.maity.team/oliver-zehentleitner/maity : 302 to https://maity.team/ , losing the path.
Do at once: reproduce in a real browser without a session (web e2e). Follow what Oliver sees: which links lead to the login (statistics, /explore, any link inside the app shell that navigates without reloading; an expired cookie; the 60 s public cache with Vary: Cookie). Then fix every path by which a visitor to a public page lands on login, with a test against the real hub. Say the cause to the lead first if a contract change is needed.