Bump the contract for the new gate, and close the ways it could read as open

src/auth/gate.ts

@@ -1,16 +1,13 @@
-// The coarse gate a route or nav node declares. One home for the rule, so the router and the menu
-// can never disagree about what a visitor may reach.
+// One home for the gate rule, so the router and the menu can never disagree about what a visitor
+// may reach. README → Public pages & menu items.
 import type { User } from "../http/context.ts";
 
-// Widest first: whoever passes an earlier gate passes it without holding anything.
 const GATES = ["public", "session", "permission"] as const;
 
-// A route or nav node names exactly one of these; discovery refuses two. Omitting all three is the
-// same as `public`, which is why stating it outright makes an open gate a choice, not an oversight.
 export interface Gate {
-  permission?: string | undefined; // the Keto Permission the caller must hold, `<resource>:<action>`
-  public?: boolean | undefined; // anyone, signed in or not
-  session?: boolean | undefined; // any signed-in user, no grant to hold; anonymous is sent to /login
+  permission?: string; // the Keto Permission the caller must hold, `<resource>:<action>`
+  public?: boolean; // anyone, signed in or not
+  session?: boolean; // any signed-in user, no grant to hold; anonymous is sent to /login
 }
 
 export function allows(gate: Gate, user: User | null): boolean {
@@ -19,7 +16,6 @@ export function allows(gate: Gate, user: User | null): boolean {
   return gate.permission == null || (user?.permissions.includes(gate.permission) ?? false);
 }
 
-// Which gates a declaration sets — discovery refuses more than one, since they contradict.
 export function gatesSet(gate: Gate | null | undefined): string[] {
   if (gate == null) return [];
   return GATES.filter((name) => (name === "permission" ? gate.permission != null : gate[name] === true));

src/auth/login.ts

@@ -86,8 +86,10 @@ export interface Reminted {
 // anonymous instead of re-hitting Ory on every one.
 export async function remintSession(deps: LoginDeps, cookie: string | undefined, options: { secure?: boolean } = {}): Promise<Reminted> {
   const completed = await completeLogin(deps, cookie);
-  if (!completed) return { setCookie: clearSessionCookie(options), user: null };
-  return { setCookie: sessionCookie(completed.jwt, options), user: { email: completed.email ?? "", id: completed.userId, permissions: completed.permissions } };
+  // No email is no session, exactly as `claimsToUser` reads a token carrying none: a User with an
+  // empty email reads as anonymous in the shell, and is a blank key to whatever scopes on it.
+  if (!completed?.email) return { setCookie: clearSessionCookie(options), user: null };
+  return { setCookie: sessionCookie(completed.jwt, options), user: { email: completed.email, id: completed.userId, permissions: completed.permissions } };
 }
 
 // Build the Set-Cookie for our session JWT. HttpOnly + SameSite=Lax by default; `secure` is