§10 public pages + menu items, the blessed explicit alias (todo §10); a plugin may mark a page and its menu option public. A no-permission route/nav node is already anonymous-reachable, so per the human's pick this BLESSES that as a first-class, explicit choice (keep the default; add an explicit alias — not a secure-by-default flip). New optional public?: boolean on Route (src/plugin.ts) + NavNode (src/nav.ts) = "open to everyone, signed in or not", honored outright in isAuthorized (router.ts) + filterByRoles (nav.ts), and MUTUALLY EXCLUSIVE with permission — discovery shapeError recursively rejects a route/nav node setting both, failing the boot loud (never silently picks one). public is filter-only (toRenderNode never emits it). The shell (views/partials/shell.ejs) now renders a Sign in link instead of the profile/sign-out block for an anonymous visitor, so a public page in the native shell (ctx.chrome; ctx.user may be null) isn't a broken "Guest / Sign out". Reference plugin demos it: a public /scheduling Overview route + a public "Overview" nav child (the "Scheduling" header now shows for everyone), the shifts list still behind scheduling:read. Hardened the latent gap the shell newly leans on: claimsToUser rejects an empty email like it does an empty sub. Tests-first (348 → 354 units): router/nav/discovery (public open + reject-both + loads), shell (anon → Sign in, no logout form), app (public route anon-200), shifts (overview handler), jwt-middleware (empty email). Docs: plugin-contract.md ("Public pages & menu items" + route shape + shape-error note) + README (menu system + reference snippet). E2E: visual.spec asserts the public Overview is anon-200 + shown in the member's nav while the gated Shifts redirects/filters. stability-reviewer: APPROVE, no Critical/High/Medium (addressed its one Low — the empty-email hardening). typecheck + 354 units + full scripts/ci.sh gate (visual 10 · auth 1 · oauth 2 · full 7) green.

e2e/visual.spec.ts

@@ -154,19 +154,28 @@ test("unknown routes serve the 404 page (a real user-facing flow, covered end-to
   await expect(page.getByRole("link", { name: "Back home" })).toBeVisible();
 });
 
-// The reference plugin (plugins/scheduling) ships discovered in the image. Its nav + routes are
-// permission-gated, so an anonymous visitor is bounced to sign in (and never sees it in the nav).
-// The authenticated list/form flow is the §8 full E2E (full-flow.spec). Side-effect-free.
-test("the reference plugin is permission-gated: anonymous → redirect to /login, hidden from the dashboard nav", async ({ page, request }) => {
-  // `request` is the isolated API context — it doesn't carry the beforeEach session cookie, so this
-  // probe is genuinely anonymous. Don't follow the redirect (this Ory-free suite has no /login
-  // handler); assert the gate's 303 itself, with the requested page preserved as return_to (§9).
+// The reference plugin (plugins/scheduling) ships discovered in the image. Its public Overview is
+// reachable by anyone and its menu header shows for everyone; the shifts list stays permission-gated,
+// so an anonymous visitor is bounced to sign in. The authenticated list/form flow is the §8 full
+// E2E (full-flow.spec). Side-effect-free.
+test("the reference plugin: public Overview is open to all, the gated Shifts redirects to /login (§10)", async ({ page, request }) => {
+  // `request` is the isolated API context — it doesn't carry the beforeEach session cookie, so these
+  // probes are genuinely anonymous.
+  // The public overview is reachable with no session (200), not bounced to sign in.
+  const pub = await request.get("/scheduling", { maxRedirects: 0 });
+  expect(pub.status()).toBe(200);
+  expect(await pub.text()).toContain("Scheduling");
+
+  // The gated shifts list still bounces (don't follow — this Ory-free suite has no /login handler);
+  // assert the gate's 303 with the requested page preserved as return_to (§9).
   const res = await request.get("/scheduling/shifts", { maxRedirects: 0 });
   expect(res.status()).toBe(303);
   expect(res.headers()["location"]).toBe("/login?return_to=%2Fscheduling%2Fshifts");
 
-  // The signed-in member (no scheduling role) sees the dashboard, but the gated leaf is filtered out.
+  // The signed-in member (no scheduling role) sees the public Scheduling → Overview leaf in the nav,
+  // but the gated Shifts leaf is filtered out.
   await page.goto("/dashboard");
   await expect(page.locator(".sidebar")).toContainText("People"); // dashboard nav renders
-  await expect(page.locator(".sidebar")).not.toContainText("Scheduling"); // gated leaf filtered out
+  await expect(page.locator('.sidebar a[href="/scheduling"]')).toHaveCount(1); // public Overview shown
+  await expect(page.locator('.sidebar a[href="/scheduling/shifts"]')).toHaveCount(0); // gated leaf filtered out
 });