/explore was leaking 115 public-flagged articles from the private “Nemesis Untold!” campaign (private campaign in a private world, but individual articles had private: false). Flipped all 115 in prod via the MCP update_article tool (dogfooded 115 authenticated HTTP calls). Hardened Article.is_public and Campaign.is_public scopes to cascade via LEFT OUTER JOIN on parents; updated ArticlePolicy#show? and CampaignPolicy#show? with the same cascade for guests. Fixed broken Pundit rescue: added en.pundit.* locale keys (was rendering “Translation missing: en.pundit.article_policy.show?”) and routed guest denials to new_user_session_path instead of authenticated_root_path. Added Explore link to marketing nav. 391 tests green (+9). ADR-0043.
BL-021
Shipped