Public-by-slug lookup so the referral-style claim URL (/publisher/claim/auto?ref=<slug>, sent by already-claimed authors to their peers) can resolve to a real claim link without leaking a hot claim_token in the email body.

Returns a never-fails 200 with {exists, name, claim_url, claimed, latest_article_slug}. When the publisher doesn't exist at all we return exists=False so the landing page can show a friendly 'we don't have this newsletter yet, forward us an issue' CTA.

🚨 MEASURED ACCOUNT-TAKEOVER (2026-09-14). This endpoint has no auth dependency, and it used to mint a fresh claim_token whenever the publisher didn't already carry one. A SUCCESSFUL CLAIM POPS THAT KEY (rj.pop("claim_token", None) in publisher_claim_accept), so "doesn't already carry one" is the state of every publisher who has ALREADY CLAIMED. The burn was real and this undid it: an anonymous GET knowing only a tenant_slug minted a live token, and redeeming it mints an access_token — the dashboard credential — and writes a fresh distribution_authorization in that author's name.

Two gates now, in this order:

1. A publisher that has claimed NEVER gets a URL and NEVER gets a mint. claimed is the same predicate the creator feed uses (opt_in_at OR raw_json.claimed_at), so a publisher onboarded before claimed_at existed is covered too.
2. Taken-down and do-not-contact publishers 404 rather than answering at all — copied verbatim from the creator-feed builder so the two surfaces cannot drift.

✅ CLOSED 2026-09-15: this endpoint no longer mints AT ALL. A claim token is ISSUED, on exactly two occasions, and neither of them is somebody reading a slug:

invite — every outreach path mints one and mails it to the publisher's OWN address. registration — /v1/publisher/onboard mints an access_token and returns it; a publisher who signs themselves up is already in and needs no claim link.

Tier is decided after that, on activation. Issuance is not the place to express it, which is what minting-on-read was quietly doing.