Answer prose round 1: 0 🔴, 10 🟡 (0 misread); define code health, restore the topic index, give each decision a premise of its own

src/auth/gate.ts

@@ -10,9 +10,9 @@ export interface Gate {
   session?: boolean; // any signed-in user, no grant to hold; anonymous is sent to /login
 }
 
-// A gate naming none of the three allows everyone. Discovery refuses one on a route or a plugin's
-// nav node, so only the header nodes `config/menu.ts`'s `groups` builds get here without a gate,
-// and failing closed would hide every section an operator grouped.
+// A gate naming none of the three allows everyone. Discovery refuses one on a plugin's route, nav
+// node or profile-menu entry, so only the header nodes `config/menu.ts`'s `groups` builds get here
+// without a gate, and failing closed would hide every section an operator grouped.
 export function allows(gate: Gate, user: User | null): boolean {
   if (gate.public === true) return true;
   if (gate.session === true) return user !== null;