QA fixes: HEAD on page routes, Shorts signed-out 401, invite-page onboarding handoff, viewer check buttons clear of the overlay close button

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

public/assets/join.js

@@ -40,7 +40,7 @@
   $('jnVerify').addEventListener('click', busy($('jnVerify'), async () => {
     await api('/api/auth/email/verify', { email: $('jnEmail').value, code: $('jnCode').value, newsletter: !!$('jnNews').checked, followups: !!$('jnNews').checked });
     IAP.status('You are in. Taking you to your dashboard…', 'ok');
-    location.href = '/my';
+    location.href = '/my?welcome=1'; // dashboard runs the username step + welcome tour on arrival
   }));
   $('jnEmail').addEventListener('keydown', e => { if (e.key === 'Enter') ($('jnVerify').hidden ? $('jnSend') : $('jnVerify')).click(); });
   $('jnCode').addEventListener('keydown', e => { if (e.key === 'Enter') $('jnVerify').click(); });

public/assets/my.js

@@ -476,6 +476,15 @@
     if ($('mcFinish')) $('mcFinish').hidden = !walletOnly;
     if (!signedIn) return;
     if ($('adminLink')) $('adminLink').hidden = !me.isAdmin; // admin portal link, only for ADMIN_EMAIL
+    // arrived from an invite page: run onboarding once (username, welcome tour, login ad)
+    if (/[?&]welcome=1/.test(location.search) && !render.welcomed) {
+      render.welcomed = true;
+      history.replaceState(null, '', '/my' + (location.hash || ''));
+      (async () => {
+        try { if (!me.username) await showOnboard(); if (!(await showGauntlet())) await showLoginAd(); } catch (e) {}
+        await render();
+      })();
+    }
     setPane(location.hash.slice(1) || 'overview');
     $('campGate').hidden = !!me.memberId;
     $('earnGate').hidden = !!me.memberId;

public/assets/shorts.js

@@ -13,7 +13,9 @@
     st.token = null; st.maxSeen = 0; st.credited = false; st.done = false;
     $('shOver').hidden = true; $('shCta').hidden = true; $('shNext').hidden = true;
     let r = null;
-    try { r = await j('/api/my/videos?orientation=portrait'); } catch (e) {}
+    // signed-out visitors get the sign-in note without a 401 round trip
+    let me = null; try { me = await j('/api/me'); } catch (e) {}
+    if (me && me.signedIn && me.email) { try { r = await j('/api/my/videos?orientation=portrait'); } catch (e) {} }
     if (!r || r.error) { $('shVideo').hidden = true; $('shMsg').hidden = false; $('shMsg').textContent = 'Sign in on the dashboard to watch shorts and earn.'; return; }
     $('shStat').textContent = 'today: ' + (r.status.count || 0) + ' / ' + r.status.cap;
     if (!r.ad) {

public/join.html

@@ -105,6 +105,6 @@
   </div>
 </div>
 <script src="/assets/common.js?v=20260909a"></script>
-<script src="/assets/join.js?v=20260909a"></script>
+<script src="/assets/join.js?v=20260909b"></script>
 </body>
 </html>

public/my.html

@@ -739,7 +739,7 @@
 <script src="/assets/common.js?v=20260909a"></script>
 <script src="/assets/wallet.js?v=20260909c"></script>
 <script src="/assets/promo.js?v=20260909b"></script>
-<script src="/assets/my.js?v=20260909g"></script>
+<script src="/assets/my.js?v=20260909h"></script>
 <script src="/assets/chat.js?v=20260907l"></script>
 </body>
 </html>

public/view.html

@@ -9,7 +9,8 @@
 <style>
   html,body{height:100%;margin:0;overflow:hidden}
   .vw{display:flex;flex-direction:column;height:100vh;height:100dvh;background:var(--bg,#04110c);color:var(--ink,#e8fff7)}
-  .vbar{flex:0 0 auto;display:flex;align-items:center;gap:14px;padding:10px 16px;
+  /* right padding keeps the check buttons clear of the dashboard overlay's ✕ close button */
+  .vbar{flex:0 0 auto;display:flex;align-items:center;gap:14px;padding:10px 68px 10px 16px;
     background:var(--panel-solid,#071a12);border-bottom:1px solid var(--line,rgba(67,232,195,.18));flex-wrap:wrap}
   .vbrand{font-family:var(--disp,sans-serif);font-weight:800;font-size:15px;white-space:nowrap}
   .vbrand em{color:var(--mint,#43e8c3);font-style:normal}

server.js

@@ -1548,8 +1548,8 @@ const server = http.createServer(async (req, res) => {
       return json(res, 200, { ok: true, config: chain.getConfig() });
     }
 
-    // -- pages
+    // -- pages (HEAD answered like GET so link previewers and crawlers see 200; Node drops the body)
-    if (req.method === 'GET') {
+    if (req.method === 'GET' || req.method === 'HEAD') {
       if (p === '/') return sendFile(res, path.join(PUBLIC_DIR, 'index.html'));
       if (p === '/ledger') return sendFile(res, path.join(PUBLIC_DIR, 'ledger.html'));
       if (p === '/contract') return sendFile(res, path.join(PUBLIC_DIR, 'contract.html'));