Profile read endpoint answers 200 signedIn:false for visitors, so a shared /my link logs no console error

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

public/my.html

@@ -31,5 +31,5 @@
 </section>
 </main>
 <footer class="wrap disclaimer">All figures are read live from the RM Circle smart contract on Polygon and are historical facts, not a promise of future results. Participation involves cryptocurrency and smart-contract risk. Never use funds you cannot afford to lose.<div class="footer-links"><a href="/">Home</a><a href="/contract">Contract Security</a><a href="/disclaimer">Disclaimers</a><a href="/tools">Promo Tools</a><a href="/privacy">Privacy</a><a href="/refunds">Refunds</a></div></footer>
-<script src="/track.js"></script><script src="/qrlib.js"></script><script src="/rmc-wallet.js"></script><script src="/inapp-browser.js"></script><script src="/profile-gate.js?v=20260916a"></script><script src="/my.js"></script><script src="/payouts.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/tg-app.js" defer></script><script src="/wallet-notice.js" defer></script>  <script src="/announce.js?v=20260916a"></script>
+<script src="/track.js"></script><script src="/qrlib.js"></script><script src="/rmc-wallet.js"></script><script src="/inapp-browser.js"></script><script src="/profile-gate.js?v=20260916b"></script><script src="/my.js"></script><script src="/payouts.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/tg-app.js" defer></script><script src="/wallet-notice.js" defer></script>  <script src="/announce.js?v=20260916a"></script>
 </body></html>

public/profile-gate.js

@@ -167,7 +167,8 @@
   // who has not proved they own the position (the API 401s them).
   async function require_() {
     try { state = await api('/api/public/profile'); }
-    catch (e) { return null; }                      // not signed in: nothing to gate
+    catch (e) { return null; }
+    if (!state || state.signedIn === false) return null;   // a visitor on a shared link: never gate
     if (state.profile && state.profile.complete) return state.profile;
     if (back) return null;                          // already open
     shell();

server.js

@@ -1449,7 +1449,9 @@ async function handleApi(req,res,pathname){
   // Telegram Mini App bridge) can read or write one; /my/<id> is public and can not.
   if(req.method==='GET'&&pathname==='/api/public/profile'){
     const s=messages.authFromCookie(req);
-    if(!s)return json(res,401,{error:'Not signed in.'});
+    // 200 with signedIn:false, not 401: a shared /my/<id> link is opened by people
+    // who are not members, and a 401 there prints a console error that reads like a broken page.
+    if(!s)return json(res,200,{ok:true,signedIn:false});
     return json(res,200,Object.assign({ok:true,id:s.id,suggest:profiles.suggest(s.id)},profiles.status(s.id)));
   }
   if(req.method==='POST'&&pathname==='/api/public/profile/username'){