diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d2719b1..63a43a8 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -9,8 +9,16 @@ This repo is the **realunit.app** website — public, static. See the
   `public/` ships verbatim to Cloudflare Pages — what you commit is what gets
   served. The one exception is the invite/promo HTML: `functions/_middleware.js`
   rewrites those bytes on the way out so crawlers see the code in
-  `apple-itunes-app`, `og:*` and the App Links before any script runs. Nothing
-  else is transformed, and there is no server-side rendering. The dev dependencies exist **only** for the quality gates below
+  `apple-itunes-app`, `og:*` and the App Links before any script runs. It also
+  reports a rewritten landing as `200`: Pages resolves `/invite/<code>` to the
+  code-less shell through the `_redirects` rewrite but keeps the not-found
+  status of the path that was asked for, and a crawler drops a `404` before it
+  reads the tags. The promotion is guarded on the two landing marks — `id="state-loading"` and `aria-busy="true"`, which both landings carry together in one tag and no other page the site ships carries together — so the site's
+  own 404 page keeps saying 404, and HEAD answers with the same status as GET.
+  Both methods are resolved internally as one full GET, without `Range` /
+  `If-Range` and without the conditional request headers, because the whole document
+  is rewritten and the status is decided from its body. The conditional request headers are dropped rather than evaluated, which is a deliberate deviation from RFC 9110 §13.1: a rewritten landing emits no validator to condition on, so the answer is always the current representation and never a 304 or a 412. A pass-through answer keeps the origin's own headers, validator included. `scripts/dev-server.mjs` shares the injection and answers HEAD without a body, but has no promotion, no marker guard and no header stripping: its own routing serves the landings as `200` and never produces the not-found status the promotion exists to correct. Nothing else is transformed, and there is no server-side
+  rendering. The dev dependencies exist **only** for the quality gates below
   (formatting, HTML validation, unit tests, screenshots); nothing compiles or
   bundles the site.
 - **Invite/promo HTML rewrite is banner, canonical, and store handoff.** Safari,
@@ -45,8 +53,9 @@ This repo is the **realunit.app** website — public, static. See the
     adding any other host to that allowlist needs a reason in the PR.
   - Inline `style="…"` attributes and `<style>` blocks are fine (`style-src`
     allows `'unsafe-inline'`).
-- **Put the reusable, side-effect-free JS in `public/js/lib/`.** That is the only
-  code with a unit-coverage gate (see below); DOM/network glue stays in the
+- **Put the reusable, side-effect-free JS in `public/js/lib/`.** It carries a
+  unit-coverage gate (see below), as do `functions/lib/**` and the Function
+  entry point `functions/_middleware.js`; DOM/network glue stays in the
   page-level scripts and is covered by the Playwright suite.
 - **Don't put mutable files under `public/assets/`.** That path has an immutable,
   one-year cache header — only content-hashed or otherwise stable-named assets
@@ -73,14 +82,14 @@ sanity-check anything touching scripts/images in the dev deployment.
 Every pull request must pass the gates below; CI runs them as required status
 checks.
 
-| Gate              | Command                 | What it enforces                                                                                                         |
-| ----------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------ |
-| Formatting        | `npm run format:check`  | Prettier formatting of the maintained code (the hand-written HTML pages are validated, not reformatted)                  |
-| HTML validity     | `npm run validate:html` | Valid markup on every page under `public/`                                                                               |
-| Site completeness | `npm run check:site`    | Every `<html lang>`, every internal link/asset resolves, and each glue script loads its `js/lib` core first              |
-| Unit coverage     | `npm run test:coverage` | 100% line/branch/function/statement coverage of the extracted browser logic (`public/js/lib/**`)                         |
-| Functional        | `npm run test:e2e`      | Playwright smoke + behavior suite (every page loads, platform detection, the full confirm flow)                          |
-| Visual regression | `npm run e2e:docker`    | Every view in the visual matrix (page × viewport × language × state) matches its committed baseline, then `check:visual` |
+| Gate              | Command                 | What it enforces                                                                                                                                            |
+| ----------------- | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Formatting        | `npm run format:check`  | Prettier formatting of the maintained code (the hand-written HTML pages are validated, not reformatted)                                                     |
+| HTML validity     | `npm run validate:html` | Valid markup on every page under `public/`                                                                                                                  |
+| Site completeness | `npm run check:site`    | Every `<html lang>`, every internal link/asset resolves, and each glue script loads its `js/lib` core first                                                 |
+| Unit coverage     | `npm run test:coverage` | 100% line/branch/function/statement coverage of `public/js/lib/**` and `functions/_middleware.js`; `functions/lib/**` at its ratchet in `vitest.config.mjs` |
+| Functional        | `npm run test:e2e`      | Playwright smoke + behavior suite (every page loads, platform detection, the full confirm flow)                                                             |
+| Visual regression | `npm run e2e:docker`    | Every view in the visual matrix (page × viewport × language × state) matches its committed baseline, then `check:visual`                                    |
 
 `npm run check` runs the first four locally in one go. The Playwright suites run
 against a local dev server (`test:e2e`); the visual gate runs in a pinned
@@ -101,9 +110,12 @@ The shipped page scripts (`public/platform.js`,
 than chase 100% coverage through the DOM, the **pure** logic — platform
 detection, language resolution, API-base derivation, response→state mapping, and
 the i18n copy — is extracted into `public/js/lib/` (side-effect free, exposed on
-a `window.*` global) and unit-tested to 100% with Vitest + jsdom. Everything else
-is covered end-to-end by the Playwright functional suite
-(`tests/behavior.spec.mjs`).
+a `window.*` global) and unit-tested to 100% with Vitest + jsdom. The rest of
+those page scripts is covered end-to-end by the Playwright functional suite
+(`tests/behavior.spec.mjs`). Two more surfaces carry their own unit-coverage
+gate and are not page scripts at all: `functions/lib/**` at the ratchet set in
+`vitest.config.mjs`, and the Pages Function entry point
+`functions/_middleware.js` at 100% — see the quality-gates table above.
 
 If you add a file under `public/js/lib/`, it must reach 100% coverage or the
 Quality gate fails (the threshold reports every matched file, tested or not). A
diff --git a/README.md b/README.md
index ba7c321..779c843 100644
--- a/README.md
+++ b/README.md
@@ -45,7 +45,17 @@ uploaded to Cloudflare Pages.
   custom scheme; `twitter:app:country` is CH) are injected
   into the HTML bytes from the request URL (`functions/_middleware.js` on
   Cloudflare Pages, and the local dev-server) so Safari, Play, WhatsApp, X,
-  and share crawlers can snapshot them before JS. `og:title`, `og:description`,
+  and share crawlers can snapshot them before JS. On Cloudflare Pages, and only
+  there, `functions/_middleware.js` also reports a rewritten landing as `200`:
+  Pages resolves `/invite/<code>` to the code-less shell through the
+  `_redirects` rewrite but keeps the not-found status of the path that was asked
+  for, and a crawler drops a `404` before it reads the tags. The promotion is
+  guarded on two marks the landings carry and the site's 404 page does not, and
+  HEAD answers with the same status as GET. Both methods are resolved internally
+  as one full GET, without `Range` / `If-Range` and without the conditional
+  request headers, because the whole document is rewritten and the status is decided
+  from its body. The conditional request headers are dropped rather than evaluated, which is a deliberate deviation from RFC 9110 §13.1: a rewritten landing emits no validator to condition on, so the answer is always the current representation and never a 304 or a 412. A pass-through answer keeps the origin's own headers, validator included. `scripts/dev-server.mjs` shares the injection and answers HEAD without a body, but has no promotion, no marker guard and no header stripping: its own routing serves the landings as `200` and never produces the not-found status the promotion exists to correct.
+  `og:title`, `og:description`,
   and image alt name the campaign code; `?lang=en` sets English copy and `og:locale=en_GB`;
   invitee names wait for lookup JS. `/js/invite-banner.js` in `<head>`
   is the CSP-safe JS fallback — Cloudflare Pages CSP blocks inline `<script>`.
@@ -92,7 +102,9 @@ From v2 a build toolchain (Astro) is introduced; the plain-image landing stays t
 ## Testing
 
 The site still ships verbatim — the tooling is dev-only. Pure browser logic lives
-in `public/js/lib/**` and is unit-tested to 100% (Vitest + jsdom); the pages,
+in `public/js/lib/**` and is unit-tested to 100% (Vitest + jsdom), as is the
+Pages Function entry point `functions/_middleware.js`; `functions/lib/**` is
+measured at its ratchet in `vitest.config.mjs`. The pages,
 platform detection and the full confirm flow are covered by Playwright
 (functional + screenshot regression). See [CONTRIBUTING](CONTRIBUTING.md#quality-gates)
 for the gate list and commands (`npm run check`, `npm run test:e2e`,
diff --git a/functions/_middleware.js b/functions/_middleware.js
index b1d59d2..301e2d7 100644
--- a/functions/_middleware.js
+++ b/functions/_middleware.js
@@ -6,27 +6,256 @@
  * Facebook App Links are present. Safari and share
  * crawlers snapshot those from the HTML bytes before
  * /js/invite-banner.js and invite.js run.
+ * The same pass reports a rewritten landing as found: Pages resolves
+ * /invite/<code> to the code-less shell through the _redirects rewrite but
+ * keeps the not-found status of the path that was asked for, and a crawler
+ * drops a 404 before it reads the tags this pass just wrote.
  * public/ stays generic; this is not a site-wide renderer.
  */
-import { injectLandingFromRequestUrl, shouldRewriteItunesBanner } from './lib/itunes-banner.js';
+import {
+  injectLandingFromRequestUrl,
+  isLandingShell,
+  landingStatus,
+  shouldRewriteItunesBanner,
+} from './lib/itunes-banner.js';
 
 export async function onRequest(context) {
   const url = new URL(context.request.url);
+  // The same gate as the meta rewrite, which therefore also decides the
+  // promotion. It excludes twelve asset-like suffixes, so a code whose text
+  // ends in one of them never reaches the rest of this pass. Measured on the
+  // deploy: /invite/AB.JSON and /promo/EVT1.HTML are answered with the site's
+  // own 404 page, not with the landing shell, so the promotion would refuse
+  // them on the marks in any case. What such a code loses is the landing, not
+  // the status — which is the follow-up #30 left open, where this gate and the
+  // suffix list in parseLandingFromUrl have to be reconciled.
   if (!shouldRewriteItunesBanner(url.pathname)) {
     return context.next();
   }
-  const response = await context.next();
-  const type = response.headers.get('content-type') || '';
-  if (context.request.method !== 'GET' || !type.includes('text/html')) {
-    return response;
+  const method = context.request.method;
+  if (method !== 'GET' && method !== 'HEAD') {
+    return context.next();
+  }
+  const isHead = method === 'HEAD';
+  // Both methods ask for the same thing: the whole document as a GET.
+  //
+  // HEAD, because the status has to be decided from the body — the marks in it
+  // is what tells the landing shell from the site's own 404 page. A HEAD
+  // response carries none, and without this the same link would read as found
+  // by GET and as dead by the HEAD a link checker sends first.
+  //
+  // A full document, because this pass rewrites all of it. A partial
+  // representation would be injected into a fragment and returned under a
+  // Content-Range describing the bytes before the rewrite.
+  const response = await context.next(asFullGet(context.request));
+  // Answers that carry no representation of their own, or only part of one,
+  // are not rewritten: a GET gets the origin's answer back untouched, a HEAD a
+  // body-less copy of it. A 206 body is a fragment the rewrite would corrupt; a
+  // 304 has to keep the ETag it was matched on, which the rewrite would strip.
+  // Range and the conditional headers are removed above, so an origin only
+  // reaches this line unasked.
+  if (PASSED_ON.has(response.status)) {
+    return isHead ? bodyless(response, response.status, response.statusText) : response;
+  }
+  if (!isRewritableHtml(response.headers.get('content-type'))) {
+    // Not ours to rewrite. Note that the request was already stripped of Range
+    // and the conditional headers before we could know that — under these
+    // paths only HTML is served, and shouldRewriteItunesBanner keeps the asset
+    // extensions out, so no caller loses a partial answer it could have had.
+    // A HEAD still must not carry the body the GET-equivalent came back with.
+    return isHead ? bodyless(response, response.status, response.statusText) : response;
+  }
+  // Read from a clone, so that an answer this pass decides not to touch keeps
+  // the origin's own body and headers — handed straight on to a GET, copied
+  // without the body to a HEAD — instead of being rebuilt from a decoded
+  // string under headers that described the original.
+  const html = await response.clone().text();
+  if (!isLandingShell(html)) {
+    // Something else is being served here — the site's own 404 page after a
+    // broken deploy is the case this guards. Rewriting its title into an
+    // invitation would misdescribe it, and its status is right as it stands.
+    return isHead ? bodyless(response, response.status, response.statusText) : response;
   }
-  const html = await response.text();
   const injected = injectLandingFromRequestUrl(html, context.request.url);
   const headers = new Headers(response.headers);
+  // The headers that rewriting the representation invalidates or makes
+  // unreliable: the length, the content coding, both validators, the range
+  // metadata — including the offer to serve ranges of bytes that no longer
+  // exist — and the integrity digests of RFC 9530 and its predecessors. A
+  // stale validator is worse than none — a conditional request would be
+  // answered 304 against a document the client never received — and a body
+  // labelled gzip that is not gzip does not render at all. The body handed on
+  // from here is always the decoded, rewritten string.
+  //
+  // Content-Encoding goes because response.text() decoded the body: whatever
+  // the origin declared, what leaves here is plain text. Whether the header
+  // was on the object at all is a separate question — the gzip visible on the
+  // deploy is applied by the edge after this Function — and deleting a header
+  // that was never there costs nothing.
+  //
+  // Measured on the deploy: ETag and Last-Modified are not set on these paths
+  // today, so those two are a guard rather than a live fix.
+  for (const stale of [
+    'content-length',
+    'content-encoding',
+    'etag',
+    'last-modified',
+    'content-range',
+    'accept-ranges',
+    'content-digest',
+    'repr-digest',
+    'digest',
+    'content-md5',
+  ]) {
+    headers.delete(stale);
+  }
+  // The body was read as UTF-8 and goes out as UTF-8. Anything the origin
+  // declared as another encoding was handed on above rather than reaching
+  // here, so this states the fact rather than papering over one.
+  headers.set('content-type', 'text/html; charset=utf-8');
+  const status = landingStatus(response.status, injected);
+  // A promoted status must not keep "Not Found" as its reason phrase.
+  const statusText = status === response.status ? response.statusText : '';
+  return new Response(isHead ? null : injected, { status, statusText, headers });
+}
+
+/**
+ * Whether this pass may rewrite the body it is about to read.
+ *
+ * The media type is compared as a media type, not as a substring: RFC 9110
+ * makes it case-insensitive, so `Text/HTML` is the same thing, and a parameter
+ * that merely contains the words — `application/json; profile="text/html"` —
+ * is not.
+ *
+ * The charset has to be UTF-8 or absent, because response.text() decodes as
+ * UTF-8 whatever the header says. A body in another encoding would come back
+ * as replacement characters and leave here labelled UTF-8, so it is handed on
+ * untouched instead.
+ */
+function isRewritableHtml(contentType) {
+  const [media, ...params] = splitContentType(contentType || '');
+  if (media.trim().toLowerCase() !== 'text/html') return false;
+  const charsets = params
+    .map((param) => param.trim())
+    .filter((param) => param.slice(0, param.indexOf('=')).trim().toLowerCase() === 'charset')
+    .map((param) => unquote(param.slice(param.indexOf('=') + 1).trim()));
+  // No charset at all means the default, which is what we assume. Two that
+  // disagree, or one that is not UTF-8, means hands off.
+  return charsets.every((charset) => /^utf-?8$/i.test(charset));
+}
+
+/**
+ * A Content-Type split on its parameter separators, quotes respected.
+ *
+ * A quoted parameter value may contain a semicolon, so splitting on the
+ * character alone would read `foo="x;charset=utf-8"` as a charset and miss the
+ * real one behind it.
+ */
+function splitContentType(type) {
+  const parts = [];
+  let start = 0;
+  let quoted = false;
+  for (let i = 0; i < type.length; i += 1) {
+    const char = type[i];
+    // A quoted-pair (RFC 9110 §5.6.4) escapes whatever follows it, including a
+    // closing quote — skipping the next character keeps `foo="a\";x=y"` from
+    // being read as two parameters.
+    if (quoted && char === '\\') i += 1;
+    else if (char === '"') quoted = !quoted;
+    else if (char === ';' && !quoted) {
+      parts.push(type.slice(start, i));
+      start = i + 1;
+    }
+  }
+  parts.push(type.slice(start));
+  return parts;
+}
+
+/** A quoted-string parameter value with its quotes and escapes resolved. */
+function unquote(value) {
+  if (value.length < 2 || !value.startsWith('"') || !value.endsWith('"')) return value;
+  return value.slice(1, -1).replace(/\\(.)/g, '$1');
+}
+
+/**
+ * Statuses this pass does not rewrite: they carry no representation of their
+ * own, or only part of one, so there is nothing to rewrite and their headers
+ * still describe what the origin meant. A GET gets the origin's answer back
+ * unchanged; a HEAD gets a new, body-less one with the same status and headers.
+ */
+const PASSED_ON = new Set([204, 205, 206, 304]);
+
+/**
+ * The request headers RFC 9110 defines as able to turn the answer into
+ * something other than the current full representation: 206 for the first two,
+ * 304 or 412 for the rest.
+ */
+const PARTIAL_OR_CONDITIONAL = [
+  'range',
+  'if-range',
+  'if-none-match',
+  'if-modified-since',
+  'if-match',
+  'if-unmodified-since',
+];
+
+/**
+ * The same request as a GET for the whole document. The six request headers
+ * that RFC 9110 defines as able to change the answer into something other than
+ * the current full representation are dropped: Range and If-Range would allow
+ * 206, the four conditional ones 304 or 412. None of those bodies is the
+ * landing shell, and the status here is decided from the body. Everything else
+ * the client sent is kept — except in the body-carrying fallback below, which
+ * also drops the body, the headers that described it, and the request metadata
+ * that cannot be rebuilt from a URL.
+ *
+ * This is a deliberate deviation from RFC 9110 §13.1, stated rather than
+ * hidden: a client sending `If-None-Match: *` is answered 200 with the whole
+ * document where 304 was called for, and `If-Match` never produces 412.
+ *
+ * The two kinds of precondition are not equally hard. A tag or date condition
+ * would need a validator minted for the rewritten document, which none of
+ * these paths emits and which is a larger change than this one. The wildcard
+ * forms need no validator at all — they ask only whether a current
+ * representation exists, which is already known here — so they are dropped for
+ * uniformity, not out of necessity.
+ *
+ * What a client gets either way is the current representation, so the body is
+ * never stale. The status is what diverges: RFC 9110 puts 304 and 412 at
+ * SHOULD, and this pass answers 200 instead. The cost is a larger answer than
+ * was called for, not a wrong one.
+ *
+ * Measured on the deploy with a Range GET, reading the body rather than only
+ * the headers: Pages answers with the full document today and no 206, so this
+ * is a guard rather than a live fix.
+ */
+function asFullGet(request) {
+  const headers = new Headers(request.headers);
+  for (const name of PARTIAL_OR_CONDITIONAL) {
+    headers.delete(name);
+  }
+  if (request.body === null) {
+    return new Request(request, { method: 'GET', headers });
+  }
+  // A GET or HEAD carrying a body cannot be re-methoded: the constructor
+  // refuses to pair one with GET. Rebuild from the URL instead, which drops the
+  // platform's request metadata but keeps the request answerable. The headers
+  // that described that body go with it, or the new request would announce one
+  // it does not carry.
+  //
+  // Asked rather than caught, so that any other constructor failure still
+  // surfaces instead of being quietly rerouted through here.
   headers.delete('content-length');
-  return new Response(injected, {
-    status: response.status,
-    statusText: response.statusText,
-    headers,
-  });
+  headers.delete('content-type');
+  return new Request(request.url, { method: 'GET', headers });
+}
+
+/**
+ * The same status and headers with the body left off. Nothing was rewritten on
+ * the paths that reach here, so every header still describes what the origin
+ * sent — Content-Length included, which RFC 9110 wants a HEAD to carry as the
+ * GET would have.
+ */
+function bodyless(response, status, statusText) {
+  return new Response(null, { status, statusText, headers: new Headers(response.headers) });
 }
diff --git a/functions/lib/itunes-banner.js b/functions/lib/itunes-banner.js
index 6711830..e2e2e22 100644
--- a/functions/lib/itunes-banner.js
+++ b/functions/lib/itunes-banner.js
@@ -424,6 +424,57 @@ export function parseLangFromUrl(urlLike) {
   }
 }
 
+/**
+ * The marks the landing shells carry and the site's 404 page does not. The
+ * caller has already established that the path is a landing, so the only
+ * question left is whether the asset server handed back the shell or the 404
+ * page — but see isLandingShell for why one mark was not enough.
+ */
+const LANDING_MARKERS = ['id="state-loading"', 'aria-busy="true"'];
+
+/**
+ * Whether these bytes are a landing shell rather than some other page.
+ *
+ * Two marks rather than one, because a single substring is a thin thing to
+ * promote a status on: an error document that happened to carry the id — in a
+ * comment, in a script, in a copied snippet — would be answered 200 with an
+ * invitation's metadata.
+ *
+ * This stays a substring test, so it does not require the two marks to sit in
+ * the same element, or in an element at all. What makes two of them enough is
+ * therefore not this function but a property of the site, and that property is
+ * held by a test rather than by a parser: of every page the repo ships, only
+ * the two landings reach both marks. The 404 page carries neither, and the two
+ * other shells that carry the id — account-merge and confirm-aktionariat —
+ * carry no aria-busy. test/middleware.test.mjs walks public/ and pins exactly
+ * that.
+ */
+export function isLandingShell(html) {
+  return typeof html === 'string' && LANDING_MARKERS.every((mark) => html.includes(mark));
+}
+
+/**
+ * Report a rewritten landing as found.
+ *
+ * _routes.json sends /invite/<code> to the Function, and the asset lookup
+ * behind context.next() resolves the code-less shell through the _redirects
+ * 200-rewrite while keeping the not-found status of the path that was asked
+ * for. Measured on the deploy: the body is the landing, the status is 404.
+ * Browsers render it anyway, but share crawlers drop a 404 before they read
+ * the tags injectLandingFromRequestUrl has by now written into the body. The
+ * injection is why these pages exist; this function is what stops the status
+ * from throwing the injected tags away.
+ *
+ * Only a body that really is the landing shell is promoted. If a broken deploy
+ * ever serves the site's 404 page on these paths, it has to keep saying 404
+ * instead of looking healthy.
+ */
+export function landingStatus(status, html) {
+  if (status !== 404) return status;
+  if (!isLandingShell(html)) return status;
+  return 200;
+}
+
 /** Crawlers snapshot og:title / twitter:title from the HTML bytes. Names wait for lookup JS. */
 export function shareTitle(kind, code, lang) {
   // Keep the kind guard first: this function is exported, and a missing kind
diff --git a/test/itunes-banner-function.test.mjs b/test/itunes-banner-function.test.mjs
index 6350db0..d3ff8b1 100644
--- a/test/itunes-banner-function.test.mjs
+++ b/test/itunes-banner-function.test.mjs
@@ -16,6 +16,7 @@ import {
   shareTitle,
   injectShareDescriptionHtml,
   shareDescription,
+  landingStatus,
   parseLangFromUrl,
   injectShareLocaleHtml,
   injectSiteNameHtml,
@@ -32,11 +33,22 @@ describe('shouldRewriteItunesBanner', () => {
   test('invite and promo HTML paths only', () => {
     expect(shouldRewriteItunesBanner('/invite')).toBe(true);
     expect(shouldRewriteItunesBanner('/invite/AB12CD')).toBe(true);
+    expect(shouldRewriteItunesBanner('/promo')).toBe(true);
     expect(shouldRewriteItunesBanner('/promo/EVT1')).toBe(true);
     expect(shouldRewriteItunesBanner('/invite/invite.js')).toBe(false);
     expect(shouldRewriteItunesBanner('/js/invite-banner.js')).toBe(false);
     expect(shouldRewriteItunesBanner('/')).toBe(false);
     expect(shouldRewriteItunesBanner('/.well-known/apple-app-site-association')).toBe(false);
+    // The prefix has to end at a segment boundary: a path that merely starts
+    // with the same letters is somebody else's.
+    expect(shouldRewriteItunesBanner('/invitee')).toBe(false);
+    expect(shouldRewriteItunesBanner('/invite-old')).toBe(false);
+    expect(shouldRewriteItunesBanner('/promotion')).toBe(false);
+    expect(shouldRewriteItunesBanner('/promo-old')).toBe(false);
+    // A doubled slash makes the first segment empty, so neither the exact
+    // comparison nor the prefix matches.
+    expect(shouldRewriteItunesBanner('//invite/AB12CD')).toBe(false);
+    expect(shouldRewriteItunesBanner('/invites/AB12CD')).toBe(false);
   });
 });
 
@@ -359,7 +371,7 @@ describe('injectLandingFromRequestUrl', () => {
       '<meta name="description" content="Öffne die RealUnit-App mit diesem Code." />';
     const out = injectLandingFromRequestUrl(shell, 'https://www.realunit.app/invite/AB12CD?mock=1');
     expect(out).toContain('app-argument=realunit-wallet://invite/AB12CD');
-    expect(out).toContain('content="https://realunit.app/invite/AB12CD"');
+    expect(out).toContain('property="og:url" content="https://realunit.app/invite/AB12CD"');
     expect(out).toContain('href="https://realunit.app/invite/AB12CD"');
     expect(out).toContain('name="twitter:url" content="https://realunit.app/invite/AB12CD"');
     expect(out).toContain('property="og:title" content="RealUnit — Einladung AB12CD"');
@@ -389,8 +401,17 @@ describe('injectLandingFromRequestUrl', () => {
     expect(out).toContain(
       'https://play.google.com/store/apps/details?id=swiss.realunit.app&referrer=invite%3DAB12CD',
     );
-    expect(out).toContain('data-android-app');
-    expect(out).toContain('data-ios-app');
+    // The hrefs, not just the attribute names: swapping the two would send
+    // Android users to the iOS hand-off and back, and the names alone would
+    // not notice.
+    expect(out).toContain(
+      'data-android-app href="android-app://swiss.realunit.app/https/realunit.app/invite/AB12CD"',
+    );
+    expect(out).toContain('data-ios-app href="ios-app://6759720010/realunit-wallet/invite/AB12CD"');
+    // The iPad card carries the same scheme as the phone one and was asserted
+    // nowhere; a wrong value there would have gone unnoticed.
+    expect(out).toContain('name="twitter:app:url:ipad" content="realunit-wallet://invite/AB12CD"');
+    expect(out).toContain('name="twitter:app:id:ipad" content="6759720010"');
     expect(out).toContain('al:android:url');
     expect(out).toContain('property="al:android:url" content="realunit-wallet://invite/AB12CD"');
     expect(out).toContain('property="al:android:class" content="swiss.realunit.app.MainActivity"');
@@ -520,6 +541,28 @@ describe('referral code injection hardening', () => {
     expect(out).toContain('AB&quot;&gt;&lt;');
   });
 
+  test('an alternate link that already exists is replaced, not doubled', () => {
+    // The fixtures so far only ever reached the insert branch, because no shell
+    // ships these links; the replace branch had never run.
+    for (const existing of [
+      '<link rel="alternate" data-android-app href="android-app://old" />',
+      '<link data-android-app rel="alternate" href="android-app://old" />',
+      // href before the attribute: the upsert has a separate branch for that
+      // order, and the two fixtures above both leave it unrun.
+      '<link rel="alternate" href="android-app://old" data-android-app />',
+    ]) {
+      const out = injectLandingFromRequestUrl(
+        '<head>' + existing + '</head>',
+        'https://realunit.app/invite/AB12CD',
+      );
+      expect(out).toContain(
+        'href="android-app://swiss.realunit.app/https/realunit.app/invite/AB12CD"',
+      );
+      expect(out).not.toContain('android-app://old');
+      expect(out.match(/data-android-app/g)).toHaveLength(1);
+    }
+  });
+
   test('injectShareTitleHtml escapes a raw code and never breaks the attribute', () => {
     const out = injectShareTitleHtml(base, 'invite', 'A"><B', 'de');
     expect(out).not.toContain('<B');
@@ -609,7 +652,9 @@ describe('an English locale without a code keeps English copy', () => {
     const promo = injectLandingFromRequestUrl(shell, 'https://realunit.app/promo/?lang=en');
     expect(promo).toContain('<title>RealUnit — Promo code</title>');
 
-    // Without ?lang=en the German shell must be left exactly as it is.
+    // Without ?lang=en the German copy must be left as it is. The pass still
+    // adds og:site_name, which is language-independent, so this checks the copy
+    // rather than byte equality.
     const de = injectLandingFromRequestUrl(shell, 'https://realunit.app/invite/');
     expect(de).toContain('<title>RealUnit — Einladung</title>');
     expect(de).toContain(
@@ -633,6 +678,37 @@ describe('an English locale without a code keeps English copy', () => {
   });
 });
 
+describe('landingStatus', () => {
+  // Both marks, as the shipped shells carry them.
+  const shell = '<section id="state-loading" role="status" aria-busy="true"></section>';
+
+  test('promotes a not-found landing to found', () => {
+    expect(landingStatus(404, shell)).toBe(200);
+  });
+
+  test('leaves every other status alone, including its 4xx neighbours', () => {
+    expect(landingStatus(200, shell)).toBe(200);
+    expect(landingStatus(500, shell)).toBe(500);
+    expect(landingStatus(302, shell)).toBe(302);
+    // Only 404 is the Pages artefact this exists for. Widening the condition to
+    // the whole 4xx range would promote a real refusal or a withdrawn code.
+    expect(landingStatus(403, shell)).toBe(403);
+    expect(landingStatus(410, shell)).toBe(410);
+    expect(landingStatus(451, shell)).toBe(451);
+  });
+
+  test('refuses to promote a body that is not a landing', () => {
+    // The site's own 404 page must keep saying 404 rather than look healthy.
+    expect(landingStatus(404, '<title>Seite nicht gefunden — RealUnit</title>')).toBe(404);
+    // One mark alone is not a landing shell.
+    expect(landingStatus(404, '<section id="state-loading"></section>')).toBe(404);
+    expect(landingStatus(404, '<section aria-busy="true"></section>')).toBe(404);
+    expect(landingStatus(404, '')).toBe(404);
+    expect(landingStatus(404, null)).toBe(404);
+    expect(landingStatus(404, undefined)).toBe(404);
+  });
+});
+
 describe('the browser mirror and the function module say the same thing', () => {
   // public/js/lib/invite-core.js carries a second copy of shareTitle and
   // shareDescription. Nothing in production calls its HTML injectors, so a
diff --git a/test/middleware.test.mjs b/test/middleware.test.mjs
new file mode 100644
index 0000000..60cc4a6
--- /dev/null
+++ b/test/middleware.test.mjs
@@ -0,0 +1,781 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { describe, expect, test } from 'vitest';
+import { onRequest } from '../functions/_middleware.js';
+import { isLandingShell } from '../functions/lib/itunes-banner.js';
+
+// The real files, not a hand-written stand-in. The status promotion keys on a
+// marks that live in the landing shells and must never appear in the site's
+// 404 page; a synthetic fixture would keep passing after someone moved that
+// marker, and production would answer 404 again with nothing going red.
+// Resolved from the project root: vitest runs from there, and the jsdom
+// environment does not give this module a usable import.meta.url.
+const page = (name) => readFileSync(resolve('public', name), 'utf8');
+
+// Every page the site ships, named the way page() wants them.
+const shippedHtml = (dir = 'public') =>
+  readdirSync(resolve(dir), { withFileTypes: true }).flatMap((entry) => {
+    const path = `${dir}/${entry.name}`;
+    if (entry.isDirectory()) return shippedHtml(path);
+    return entry.name.endsWith('.html') ? [path.slice('public/'.length)] : [];
+  });
+
+// The header values public/_headers really sets, read from the file so the
+// fixture cannot drift from production. This checks that the middleware passes
+// them through — a dropped security header does not show up in coverage, which
+// measures execution and not values. It does not review the policy itself:
+// changing _headers moves both sides together, by design.
+function headerRule(pattern, name) {
+  const rules = page('_headers').split(/\r?\n/);
+  const start = rules.findIndex((line) => line.trim() === pattern);
+  if (start < 0) throw new Error(`public/_headers has no rule for ${pattern}`);
+  for (const line of rules.slice(start + 1)) {
+    if (!line.startsWith(' ') && !line.startsWith('\t')) break;
+    const [key, ...rest] = line.trim().split(':');
+    if (key.toLowerCase() === name) return rest.join(':').trim();
+  }
+  throw new Error(`public/_headers sets no ${name} for ${pattern}`);
+}
+
+const SITE_HEADERS = {
+  'content-security-policy': headerRule('/*', 'content-security-policy'),
+  'x-content-type-options': headerRule('/*', 'x-content-type-options'),
+  'x-frame-options': headerRule('/*', 'x-frame-options'),
+  'referrer-policy': headerRule('/*', 'referrer-policy'),
+  'cache-control': headerRule('/invite/*', 'cache-control'),
+};
+const SHELL = page('invite/index.html');
+const PROMO_SHELL = page('promo/index.html');
+const NOT_FOUND_PAGE = page('404.html');
+// .length counts UTF-16 units; a Content-Length counts bytes, and these pages
+// carry multi-byte characters.
+const bytes = (text) => new TextEncoder().encode(text).length;
+const SHELL_BYTES = bytes(SHELL);
+const NOT_FOUND_BYTES = bytes(NOT_FOUND_PAGE);
+
+function context({
+  url,
+  method = 'GET',
+  status = 404,
+  body = SHELL,
+  type = 'text/html; charset=utf-8',
+  requestHeaders = {},
+}) {
+  const headers = new Headers({
+    'content-type': type,
+    'content-length': String(bytes(body)),
+    ...SITE_HEADERS,
+  });
+  const forwarded = [];
+  const next = (request) => {
+    forwarded.push(request || ctx.request);
+    // 204, 205 and 304 cannot be built with a body — which is the very thing
+    // the middleware has to respect when it rebuilds the response.
+    const upstream = status === 204 || status === 205 || status === 304 ? null : body;
+    return Promise.resolve(
+      new Response(upstream, { status, statusText: status === 404 ? 'Not Found' : 'OK', headers }),
+    );
+  };
+  // A real Request, because the middleware derives the GET-equivalent from it.
+  const ctx = { request: new Request(url, { method, headers: requestHeaders }), next, forwarded };
+  return ctx;
+}
+
+describe('the landing middleware', () => {
+  test('reports a rewritten landing as found instead of not found', async () => {
+    // Measured on the deploy: Pages resolves /invite/<code> to the shell through
+    // the _redirects rewrite but keeps the not-found status of the asked path.
+    // Share crawlers drop a 404 before they read the rewritten meta tags.
+    const res = await onRequest(context({ url: 'https://realunit.app/invite/AB12CD' }));
+    expect(res.status).toBe(200);
+    // A promoted status must not keep "Not Found" as its reason phrase.
+    expect(res.statusText).toBe('');
+    const html = await res.text();
+    expect(html).toContain('RealUnit — Einladung AB12CD');
+    expect(res.headers.get('content-length')).toBeNull();
+    expect(res.headers.get('content-type')).toBe('text/html; charset=utf-8');
+    for (const [name, value] of Object.entries(SITE_HEADERS)) {
+      expect(res.headers.get(name)).toBe(value);
+    }
+  });
+
+  test('the media type is read as a media type, not as a substring', async () => {
+    // RFC 9110 makes it case-insensitive, and a parameter that merely contains
+    // the words is not the type.
+    const mixedCase = await onRequest(
+      context({ url: 'https://realunit.app/invite/AB12CD', type: 'Text/HTML; charset=UTF-8' }),
+    );
+    expect(mixedCase.status).toBe(200);
+    expect(await mixedCase.text()).toContain('RealUnit — Einladung AB12CD');
+
+    // The body is the shell, so a substring match would actually rewrite it —
+    // with '{}' the marker guard would hand it on either way and the check
+    // would prove nothing.
+    const lookalike = await onRequest(
+      context({
+        url: 'https://realunit.app/invite/AB12CD',
+        type: 'application/json; profile="text/html"',
+      }),
+    );
+    expect(lookalike.status).toBe(404);
+    expect(await lookalike.text()).toBe(SHELL);
+    expect(lookalike.headers.get('content-type')).toBe('application/json; profile="text/html"');
+  });
+
+  test('a body in another encoding is handed on byte for byte', async () => {
+    // Real ISO-8859-1 bytes, not a JS string: 0xE9 is 'é' there and is not
+    // valid UTF-8 at all. The body carries both landing marks, so only the
+    // charset guard stands between it and the rewrite — without it,
+    // response.text() would turn that byte into U+FFFD and the answer would go
+    // out as different bytes under a UTF-8 label.
+    const latin1 = new Uint8Array([
+      ...new TextEncoder().encode('<section id="state-loading" aria-busy="true">'),
+      0xe9,
+      ...new TextEncoder().encode('</section>'),
+    ]);
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD' });
+    ctx.next = () =>
+      Promise.resolve(
+        new Response(latin1, {
+          status: 404,
+          statusText: 'Not Found',
+          headers: new Headers({ 'content-type': 'text/html; charset=iso-8859-1' }),
+        }),
+      );
+    const res = await onRequest(ctx);
+    expect(res.status).toBe(404);
+    expect(res.headers.get('content-type')).toBe('text/html; charset=iso-8859-1');
+    expect(new Uint8Array(await res.arrayBuffer())).toEqual(latin1);
+  });
+
+  test('the charset is read whatever shape it comes in', async () => {
+    // A rewritten answer is promoted, declares UTF-8 and carries the injected
+    // title; an untouched one keeps the origin's status, type and bytes.
+    const rewritten = async (type) => {
+      const res = await onRequest(context({ url: 'https://realunit.app/invite/AB12CD', type }));
+      const html = await res.text();
+      if (res.status === 200) {
+        expect(res.headers.get('content-type')).toBe('text/html; charset=utf-8');
+        expect(html).toContain('RealUnit — Einladung AB12CD');
+        return true;
+      }
+      expect(res.status).toBe(404);
+      expect(res.headers.get('content-type')).toBe(type);
+      expect(html).toBe(SHELL);
+      return false;
+    };
+    // Quoted, unusually spelled and differently cased UTF-8 all still count —
+    // the parameter name is case-insensitive too.
+    expect(await rewritten('text/html; charset="utf-8"')).toBe(true);
+    expect(await rewritten('Text/HTML;Charset="utf-8"')).toBe(true);
+    expect(await rewritten('text/html; CHARSET=iso-8859-1')).toBe(false);
+    expect(await rewritten('text/html; charset=UTF8')).toBe(true);
+    expect(await rewritten('text/html;charset=utf-8')).toBe(true);
+    // Anything else is handed on rather than decoded as UTF-8 and relabelled.
+    expect(await rewritten('text/html; charset=utf-16')).toBe(false);
+    expect(await rewritten('text/html; charset=windows-1252')).toBe(false);
+    expect(await rewritten('text/html; charset="iso-8859-1"')).toBe(false);
+    // A semicolon inside a quoted value is not a parameter separator, so the
+    // charset that counts is the real one behind it.
+    expect(await rewritten('text/html; foo="x;charset=utf-8"; charset=iso-8859-1')).toBe(false);
+    expect(await rewritten('text/html; foo="x;charset=iso-8859-1"; charset=utf-8')).toBe(true);
+    // Two that disagree means hands off rather than picking one, whichever way
+    // round they come: neither the first nor the last wins.
+    expect(await rewritten('text/html; charset=utf-8; charset=iso-8859-1')).toBe(false);
+    // An unterminated quote is not a quoted value, so the raw text is compared
+    // and does not read as UTF-8. The trailing X makes the case tell the two
+    // apart: stripping quotes without checking for a closing one would leave
+    // exactly `utf-8` behind and wrongly accept it.
+    expect(await rewritten('text/html; charset="utf-8X')).toBe(false);
+    expect(await rewritten('text/html; charset=iso-8859-1; charset=utf-8')).toBe(false);
+    // A backslash escapes the next character inside a quoted value, so the
+    // closing quote here is part of the value and the real charset follows.
+    expect(await rewritten('text/html; foo="a\\";charset=utf-8"; charset=iso-8859-1')).toBe(false);
+    expect(await rewritten('text/html; foo="a\\";charset=iso-8859-1"; charset=utf-8')).toBe(true);
+  });
+
+  test('a rewritten answer says UTF-8 even when the origin left it out', async () => {
+    // The body was read as UTF-8 and goes out as UTF-8, so the answer says so
+    // rather than leaving the client to guess.
+    const res = await onRequest(
+      context({ url: 'https://realunit.app/invite/AB12CD', type: 'text/html' }),
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get('content-type')).toBe('text/html; charset=utf-8');
+  });
+
+  test('a promo landing is promoted the same way', async () => {
+    const res = await onRequest(
+      context({ url: 'https://realunit.app/promo/EVT1', body: PROMO_SHELL }),
+    );
+    expect(res.status).toBe(200);
+    expect(res.statusText).toBe('');
+    expect(await res.text()).toContain('RealUnit — Promo-Code EVT1');
+  });
+
+  test('a refusal on a landing path is passed on, not promoted', async () => {
+    // Only the 404 Pages produces for these paths is an artefact. A 403 or a
+    // 410 means what it says, even when the body happens to be the shell.
+    for (const status of [403, 410]) {
+      // The encoding has to be there for its absence afterwards to mean
+      // anything — asserting against a header the fixture never set is no test.
+      const ctx = context({ url: 'https://realunit.app/invite/AB12CD', status });
+      ctx.next = () =>
+        Promise.resolve(
+          new Response(SHELL, {
+            status,
+            statusText: 'OK',
+            headers: new Headers({
+              'content-type': 'text/html; charset=utf-8',
+              'content-length': String(SHELL_BYTES),
+              'content-encoding': 'gzip',
+              ...SITE_HEADERS,
+            }),
+          }),
+        );
+      const res = await onRequest(ctx);
+      expect(res.status).toBe(status);
+      expect(res.statusText).toBe('OK');
+      // The rewrite still runs; what must not change is the status. And since
+      // it runs, the headers it invalidates have to go here as well — a
+      // content-length from before the rewrite would contradict the body.
+      expect(await res.text()).toContain('RealUnit — Einladung AB12CD');
+      expect(res.headers.get('content-length')).toBeNull();
+      expect(res.headers.get('content-encoding')).toBeNull();
+    }
+  });
+
+  test('conditional headers are stripped from the GET-equivalent', async () => {
+    // Range would allow a 206, the conditional headers a 304 or a 412. None of
+    // those bodies is the landing shell, and the status is decided from the
+    // body.
+    const ctx = context({
+      url: 'https://realunit.app/invite/AB12CD',
+      requestHeaders: {
+        'if-none-match': 'W/"abc"',
+        'if-modified-since': 'Tue, 09 Sep 2026 00:00:00 GMT',
+        'if-match': 'W/"abc"',
+        'if-unmodified-since': 'Tue, 09 Sep 2026 00:00:00 GMT',
+        'accept-language': 'de-CH',
+      },
+    });
+    const res = await onRequest(ctx);
+    const [forwarded] = ctx.forwarded;
+    for (const name of ['if-none-match', 'if-modified-since', 'if-match', 'if-unmodified-since']) {
+      expect(forwarded.headers.get(name)).toBeNull();
+    }
+    expect(forwarded.headers.get('accept-language')).toBe('de-CH');
+    // And the answer that comes back is the whole document, not a 304.
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain('RealUnit — Einladung AB12CD');
+  });
+
+  test('a GET that carries a body is still answered, not thrown on', async () => {
+    // The Request constructor refuses to pair a body with GET, so re-methoding
+    // such a request throws. It is rebuilt from the URL instead, which drops
+    // the platform's request metadata but keeps the request answerable.
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD' });
+    const withBody = new Request('https://realunit.app/invite/AB12CD', {
+      method: 'POST',
+      body: 'not what a GET should carry',
+    });
+    withBody.headers.set('range', 'bytes=0-99');
+    withBody.headers.set('content-length', '27');
+    withBody.headers.set('if-none-match', 'W/"abc"');
+    withBody.headers.set('accept-language', 'de-CH');
+    Object.defineProperty(withBody, 'method', { value: 'GET' });
+    ctx.request = withBody;
+    const res = await onRequest(ctx);
+    const [forwarded] = ctx.forwarded;
+    expect(forwarded.method).toBe('GET');
+    expect(forwarded.url).toBe('https://realunit.app/invite/AB12CD');
+    // The fallback has to carry the cleaned headers, not the original ones.
+    expect(forwarded.headers.get('range')).toBeNull();
+    expect(forwarded.headers.get('if-none-match')).toBeNull();
+    expect(forwarded.headers.get('accept-language')).toBe('de-CH');
+    // The rebuilt request carries no body, so it must not announce one.
+    expect(forwarded.headers.get('content-length')).toBeNull();
+    expect(forwarded.headers.get('content-type')).toBeNull();
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain('RealUnit — Einladung AB12CD');
+  });
+
+  test('a status that must not carry a body is passed on instead of throwing', async () => {
+    // Pairing 204, 205 or 304 with a body throws, which would turn such an
+    // answer into a 500.
+    for (const status of [204, 205, 304]) {
+      const ctx = context({ url: 'https://realunit.app/invite/AB12CD', status });
+      let upstream;
+      ctx.next = () => {
+        upstream = new Response(null, {
+          status,
+          headers: new Headers({
+            'content-type': 'text/html; charset=utf-8',
+            etag: 'W/"the-one-it-was-matched-on"',
+            ...SITE_HEADERS,
+          }),
+        });
+        return Promise.resolve(upstream);
+      };
+      const res = await onRequest(ctx);
+      // The origin's own answer, like the other pass-through branches.
+      expect(res).toBe(upstream);
+      expect(res.status).toBe(status);
+      expect(res.body).toBeNull();
+      // A 304 has to keep the validator it was matched on, and none of these
+      // carries a representation this pass could rewrite.
+      expect(res.headers.get('etag')).toBe('W/"the-one-it-was-matched-on"');
+    }
+  });
+
+  test('the length, encoding, validators and range are dropped after a rewrite', async () => {
+    // A stale validator is worse than none: a conditional request would be
+    // answered 304 against a document the client never received.
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD' });
+    ctx.next = () => {
+      const res = new Response(SHELL, {
+        status: 404,
+        statusText: 'Not Found',
+        headers: new Headers({
+          'content-type': 'text/html; charset=utf-8',
+          'content-length': String(SHELL_BYTES),
+          etag: 'W/"before-the-rewrite"',
+          'last-modified': 'Tue, 09 Sep 2026 00:00:00 GMT',
+          'content-range': 'bytes 0-99/4162',
+          'accept-ranges': 'bytes',
+          // The body left here decoded, so a carried-over encoding would be
+          // wrong whatever the origin declared.
+          'content-encoding': 'gzip',
+          // Not observed on this deploy, dropped for the same reason as the
+          // validators: they describe bytes this pass replaces.
+          'content-digest': 'sha-256=:before:',
+          'repr-digest': 'sha-256=:before:',
+          digest: 'sha-256=before',
+          'content-md5': 'before',
+          ...SITE_HEADERS,
+        }),
+      });
+      return Promise.resolve(res);
+    };
+    const res = await onRequest(ctx);
+    expect(res.status).toBe(200);
+    for (const stale of [
+      'content-length',
+      'content-encoding',
+      'etag',
+      'last-modified',
+      'content-range',
+      'accept-ranges',
+      'content-digest',
+      'repr-digest',
+      'digest',
+      'content-md5',
+    ]) {
+      expect(res.headers.get(stale)).toBeNull();
+    }
+    // The ones the rewrite does not invalidate stay.
+    for (const [name, value] of Object.entries(SITE_HEADERS)) {
+      expect(res.headers.get(name)).toBe(value);
+    }
+  });
+
+  test('a partial answer is passed on instead of being rewritten', async () => {
+    // The body is a fragment, so injecting into it and dropping the range
+    // metadata would produce a 206 that describes nothing.
+    let partialUpstream;
+    const partial = (method) => {
+      const ctx = context({ url: 'https://realunit.app/invite/AB12CD', status: 206, method });
+      // The realistic case: a partial view of the landing page itself. A body
+      // that is not the shell would be handed on by the marker guard anyway,
+      // and would not prove this guard does anything.
+      ctx.next = () => {
+        partialUpstream = new Response(SHELL, {
+          status: 206,
+          statusText: 'Partial Content',
+          headers: new Headers({
+            'content-type': 'text/html; charset=utf-8',
+            // Real byte counts: .length counts UTF-16 units, and a range has
+            // to describe bytes of something that exists.
+            'content-length': String(SHELL_BYTES),
+            'content-range': `bytes 0-${SHELL_BYTES - 1}/${SHELL_BYTES}`,
+            etag: 'W/"the-whole-thing"',
+            ...SITE_HEADERS,
+          }),
+        });
+        return Promise.resolve(partialUpstream);
+      };
+      return onRequest(ctx);
+    };
+
+    const res = await partial('GET');
+    // The origin's own answer on the GET path, as on the other branches.
+    expect(res).toBe(partialUpstream);
+    expect(res.status).toBe(206);
+    // Handed on as it came: not rewritten, though the body is the shell.
+    expect(await res.text()).toBe(SHELL);
+    expect(res.headers.get('content-length')).toBe(String(SHELL_BYTES));
+    // Nothing was rewritten, so the range metadata and the validator still
+    // describe what the origin sent.
+    expect(res.headers.get('content-range')).toBe(`bytes 0-${SHELL_BYTES - 1}/${SHELL_BYTES}`);
+    expect(res.headers.get('etag')).toBe('W/"the-whole-thing"');
+
+    // A HEAD on the same answer keeps the status and the headers, and drops
+    // only the body.
+    const head = await partial('HEAD');
+    expect(head.status).toBe(206);
+    expect(head.statusText).toBe('Partial Content');
+    expect(head.body).toBeNull();
+    expect(head.headers.get('content-length')).toBe(String(SHELL_BYTES));
+    expect(head.headers.get('content-range')).toBe(`bytes 0-${SHELL_BYTES - 1}/${SHELL_BYTES}`);
+    expect(head.headers.get('etag')).toBe('W/"the-whole-thing"');
+  });
+
+  // The origin's own answer for the two cases below. The GET case can require
+  // that this very object comes back, which no look-alike would satisfy; the
+  // HEAD case cannot, because a body-less answer has to be a new object, so it
+  // compares the whole status and header set instead.
+  function notFoundUpstream(method) {
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD', method });
+    let upstream;
+    ctx.next = (request) => {
+      // The recorder the default next() provides, kept: the HEAD case has to
+      // show that a GET-equivalent was asked for.
+      ctx.forwarded.push(request || ctx.request);
+      upstream = new Response(NOT_FOUND_PAGE, {
+        status: 404,
+        statusText: 'Not Found',
+        headers: new Headers({
+          'content-type': 'text/html; charset=utf-8',
+          'content-length': String(NOT_FOUND_BYTES),
+          'content-encoding': 'gzip',
+          etag: 'W/"the-404-page"',
+          ...SITE_HEADERS,
+        }),
+      });
+      return Promise.resolve(upstream);
+    };
+    return { ctx, sent: () => upstream };
+  }
+
+  test('a real 404 page on a landing path keeps saying 404', async () => {
+    // A broken deploy has to stay visibly broken rather than look healthy.
+    const { ctx, sent } = notFoundUpstream('GET');
+    const res = await onRequest(ctx);
+    expect(res.status).toBe(404);
+    // Untouched status keeps its reason phrase.
+    expect(res.statusText).toBe('Not Found');
+    // Handed on as the origin's own answer, not rebuilt from its text: that is
+    // what keeps the encoding and the validator describing the actual bytes.
+    expect(res).toBe(sent());
+    expect(res.headers.get('content-encoding')).toBe('gzip');
+    expect(res.headers.get('etag')).toBe('W/"the-404-page"');
+    // And an untouched page keeps its own copy: rewriting the 404 page's title
+    // into an invitation would misdescribe what the visitor is looking at.
+    expect(await res.text()).toBe(NOT_FOUND_PAGE);
+  });
+
+  test('a landing that was already found keeps its status and is still rewritten', async () => {
+    // The promotion is not the only thing this pass does. An answer that
+    // already said 200 still gets its tags written, so a change that handed
+    // those through untouched has somewhere to fail.
+    const res = await onRequest(context({ url: 'https://realunit.app/invite/', status: 200 }));
+    expect(res.status).toBe(200);
+    expect(res.statusText).toBe('OK');
+    expect(res.headers.get('content-length')).toBeNull();
+    // Measured: on this codeless landing the rewrite normalises the canonical
+    // and the two URL tags to the form without a trailing slash. The shell
+    // ships them with one, so this holds only if the rewrite actually ran.
+    const html = await res.text();
+    expect(html).toContain('rel="canonical" href="https://realunit.app/invite"');
+    expect(html).toContain('property="og:url" content="https://realunit.app/invite"');
+    expect(html).toContain('name="twitter:url" content="https://realunit.app/invite"');
+  });
+
+  test('a path the rewrite does not own is passed through untouched', async () => {
+    const ctx = context({ url: 'https://realunit.app/', status: 200 });
+    let upstream;
+    const inner = ctx.next;
+    ctx.next = async (request) => {
+      upstream = await inner(request);
+      return upstream;
+    };
+    const res = await onRequest(ctx);
+    // The origin's own answer, as on every other pass-through branch.
+    expect(res).toBe(upstream);
+    expect(await res.text()).toBe(SHELL);
+    // Passed through, so the header the rewrite would have dropped is still there.
+    expect(res.headers.get('content-length')).toBe(String(SHELL_BYTES));
+  });
+
+  test('HEAD answers like GET by asking for the GET-equivalent', async () => {
+    // A link checker sends HEAD first. A HEAD response has no body, and the
+    // body is what tells the landing shell from the site's 404 page — so the
+    // status has to come from a GET-equivalent lookup, or the same link would
+    // read as found by GET and as dead by HEAD.
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD', method: 'HEAD' });
+    const head = await onRequest(ctx);
+    const get = await onRequest(context({ url: 'https://realunit.app/invite/AB12CD' }));
+    expect(ctx.forwarded.map((r) => r.method)).toEqual(['GET']);
+    expect(head.status).toBe(get.status);
+    expect(head.status).toBe(200);
+    expect(head.statusText).toBe('');
+    // No body at all, not an empty one: `new Response('')` would still carry a
+    // stream, and text() cannot tell the two apart.
+    expect(head.body).toBeNull();
+    expect(await head.text()).toBe('');
+    for (const name of ['content-type', ...Object.keys(SITE_HEADERS)]) {
+      expect(head.headers.get(name)).toBe(get.headers.get(name));
+    }
+    expect(head.headers.get('content-length')).toBeNull();
+  });
+
+  test('a plain GET with Range is forwarded without it', async () => {
+    // This pass rewrites the whole document, so a partial representation is
+    // never useful: it would be injected into a fragment and returned under a
+    // Content-Range describing the bytes before the rewrite.
+    const ctx = context({
+      url: 'https://realunit.app/invite/AB12CD',
+      requestHeaders: { range: 'bytes=0-99', 'if-range': 'W/"abc"' },
+    });
+    const res = await onRequest(ctx);
+    const [forwarded] = ctx.forwarded;
+    expect(forwarded.method).toBe('GET');
+    expect(forwarded.headers.get('range')).toBeNull();
+    expect(forwarded.headers.get('if-range')).toBeNull();
+    expect(res.status).toBe(200);
+    expect(await res.text()).toContain('RealUnit — Einladung AB12CD');
+  });
+
+  test('the GET-equivalent drops Range and keeps the unrelated headers', async () => {
+    // A HEAD carrying Range would otherwise come back as 206, whose body is not
+    // the landing shell — the status would neither be promoted nor mean what
+    // the client asked for. Headers unrelated to choosing the representation
+    // are kept; the conditional ones are covered by their own case above.
+    const ctx = context({
+      url: 'https://realunit.app/invite/AB12CD',
+      method: 'HEAD',
+      requestHeaders: {
+        range: 'bytes=0-99',
+        'if-range': 'W/"abc"',
+        'accept-language': 'en-GB',
+        'user-agent': 'link-checker/1.0',
+      },
+    });
+    const res = await onRequest(ctx);
+    const [forwarded] = ctx.forwarded;
+    expect(forwarded.method).toBe('GET');
+    expect(forwarded.headers.get('range')).toBeNull();
+    expect(forwarded.headers.get('if-range')).toBeNull();
+    expect(forwarded.headers.get('accept-language')).toBe('en-GB');
+    expect(forwarded.headers.get('user-agent')).toBe('link-checker/1.0');
+    expect(forwarded.url).toBe(ctx.request.url);
+    // And the answer is the whole document, not a partial one: stripping the
+    // header would mean little if the response were still treated as a 206.
+    expect(res.status).toBe(200);
+    expect(res.statusText).toBe('');
+    expect(res.body).toBeNull();
+  });
+
+  test('a HEAD on a real 404 page keeps saying 404', async () => {
+    // The marker guard has to hold on the HEAD path too, not only on GET.
+    const { ctx, sent } = notFoundUpstream('HEAD');
+    const res = await onRequest(ctx);
+    expect(ctx.forwarded.map((r) => r.method)).toEqual(['GET']);
+    expect(res.status).toBe(404);
+    expect(res.statusText).toBe('Not Found');
+    expect(res.body).toBeNull();
+    // Only the body is left off; every header the origin sent is still there.
+    for (const [name, value] of sent().headers) {
+      expect(res.headers.get(name)).toBe(value);
+    }
+    expect([...res.headers.keys()].sort()).toEqual([...sent().headers.keys()].sort());
+  });
+
+  test('a HEAD on a response that is not HTML keeps its status and carries no body', async () => {
+    const ctx = context({
+      url: 'https://realunit.app/invite/AB12CD',
+      method: 'HEAD',
+      type: 'application/json',
+      body: '{}',
+    });
+    // Nothing was rewritten here, so every header still describes what the
+    // origin sent and must survive — the length included, which RFC 9110 wants
+    // a HEAD to carry as the GET would have.
+    ctx.next = () => {
+      const headers = new Headers({
+        'content-type': 'application/json',
+        'content-length': '2',
+        etag: 'W/"unchanged"',
+        'content-encoding': 'gzip',
+        ...SITE_HEADERS,
+      });
+      return Promise.resolve(new Response('{}', { status: 404, statusText: 'Not Found', headers }));
+    };
+    const res = await onRequest(ctx);
+    // Every header the origin sent survives, name for name — listing a few by
+    // hand would miss a regression that drops one nobody thought to name.
+    const sent = new Headers({
+      'content-type': 'application/json',
+      'content-length': '2',
+      etag: 'W/"unchanged"',
+      'content-encoding': 'gzip',
+      ...SITE_HEADERS,
+    });
+    for (const [name, value] of sent) {
+      expect(res.headers.get(name)).toBe(value);
+    }
+    expect([...res.headers.keys()].sort()).toEqual([...sent.keys()].sort());
+    expect(res.status).toBe(404);
+    expect(res.statusText).toBe('Not Found');
+    expect(res.body).toBeNull();
+    // The length still describes the representation a GET would have returned.
+    expect(res.headers.get('content-length')).toBe('2');
+    // This branch rebuilds the response too, so it has to carry the headers.
+    for (const [name, value] of Object.entries(SITE_HEADERS)) {
+      expect(res.headers.get(name)).toBe(value);
+    }
+  });
+
+  test('a method that is neither GET nor HEAD is passed through untouched', async () => {
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD', method: 'POST' });
+    let upstream;
+    ctx.next = () => {
+      upstream = new Response(SHELL, {
+        status: 404,
+        headers: new Headers({
+          'content-type': 'text/html; charset=utf-8',
+          'content-length': String(SHELL_BYTES),
+          etag: 'W/"untouched"',
+        }),
+      });
+      return Promise.resolve(upstream);
+    };
+    const res = await onRequest(ctx);
+    // The origin's own answer, as with the other pass-through branches.
+    expect(res).toBe(upstream);
+    expect(res.status).toBe(404);
+    expect(res.headers.get('etag')).toBe('W/"untouched"');
+    expect(await res.text()).toBe(SHELL);
+  });
+
+  test('a response that is not HTML is passed through untouched', async () => {
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD' });
+    let upstream;
+    ctx.next = () => {
+      upstream = new Response('{}', {
+        status: 404,
+        statusText: 'Not Found',
+        headers: new Headers({
+          'content-type': 'application/json',
+          'content-length': '2',
+          'content-encoding': 'gzip',
+          etag: 'W/"the-json"',
+          ...SITE_HEADERS,
+        }),
+      });
+      return Promise.resolve(upstream);
+    };
+    const res = await onRequest(ctx);
+    // The origin's own answer, not one rebuilt to look like it.
+    expect(res).toBe(upstream);
+    expect(res.status).toBe(404);
+    expect(await res.text()).toBe('{}');
+    expect(res.headers.get('content-encoding')).toBe('gzip');
+    expect(res.headers.get('etag')).toBe('W/"the-json"');
+  });
+
+  test('the marks have to be the attributes, not the words', async () => {
+    // A page that merely mentions state-loading is not a landing shell. A
+    // looser match would promote it from 404 to 200 and rewrite its title.
+    const mentionsIt =
+      '<html lang="de"><head><title>Seite nicht gefunden</title></head>' +
+      '<body><p>Der Abschnitt state-loading fehlt.</p></body></html>';
+    // And the exact attribute text, but in a comment rather than an element.
+    // With one mark this was the boundary the check could not see; the second
+    // mark closes it, and the assertion below is what holds that shut.
+    const quotesIt =
+      '<html lang="de"><head><title>Seite nicht gefunden</title></head>' +
+      '<body><!-- kein id="state-loading" hier --></body></html>';
+    const res = await onRequest(
+      context({ url: 'https://realunit.app/invite/AB12CD', body: mentionsIt }),
+    );
+    expect(res.status).toBe(404);
+    expect(await res.text()).toBe(mentionsIt);
+
+    // Both words as prose, without the attribute syntax: loosening the marks to
+    // bare words would accept this, and nothing else in the suite would notice.
+    const wordsOnly =
+      '<html lang="de"><head><title>Seite nicht gefunden</title></head>' +
+      '<body><p>state-loading und aria-busy sind hier nur Wörter.</p></body></html>';
+    const prose = await onRequest(
+      context({ url: 'https://realunit.app/invite/AB12CD', body: wordsOnly }),
+    );
+    expect(prose.status).toBe(404);
+    expect(await prose.text()).toBe(wordsOnly);
+
+    // Even the exact attribute in a comment is not enough on its own: the shell
+    // is recognised by two marks, and an error document does not arrive at both.
+    const quoted = await onRequest(
+      context({ url: 'https://realunit.app/invite/AB12CD', body: quotesIt }),
+    );
+    expect(quoted.status).toBe(404);
+    expect(await quoted.text()).toBe(quotesIt);
+  });
+
+  test('the marks the promotion keys on live where they have to', () => {
+    // The contract the promotion tests rely on, asserted against the shipped
+    // files rather than assumed.
+    for (const mark of ['id="state-loading"', 'aria-busy="true"']) {
+      expect(SHELL).toContain(mark);
+      expect(PROMO_SHELL).toContain(mark);
+      expect(NOT_FOUND_PAGE).not.toContain(mark);
+    }
+  });
+
+  test('of everything the site ships, only the two landings read as a shell', () => {
+    // The check is a substring test: it does not require the two marks to
+    // share an element, or to be in an element at all. What keeps that from
+    // mattering is this property, and it is worth asserting rather than
+    // describing — of every page the site ships, only the two the Function is
+    // routed to reach both marks. The account-merge and Aktionariat shells
+    // carry the id and no aria-busy; the 404 page carries neither. This goes
+    // red the day one of them gains the second mark, which is the day the
+    // guard would have to become a real parse.
+    // The inventory first, so that a walker which quietly stopped finding the
+    // other pages could not make the second assertion pass by having nothing
+    // left to disagree with.
+    const files = shippedHtml().sort();
+    expect(files).toEqual([
+      '404.html',
+      'account-merge/index.html',
+      'confirm-aktionariat/index.html',
+      'index.html',
+      'invite/index.html',
+      'promo/index.html',
+    ]);
+    expect(files.filter((file) => isLandingShell(page(file)))).toEqual([
+      'invite/index.html',
+      'promo/index.html',
+    ]);
+  });
+
+  test('a response with no content-type is passed through untouched', async () => {
+    // Constructing a Response from a string sets content-type on its own, so
+    // the header is removed again to reach the missing-header path.
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD' });
+    let upstream;
+    ctx.next = () => {
+      upstream = new Response(SHELL, { status: 404 });
+      upstream.headers.delete('content-type');
+      upstream.headers.set('etag', 'W/"no-type"');
+      return Promise.resolve(upstream);
+    };
+    const res = await onRequest(ctx);
+    // The origin's own answer again, not a look-alike.
+    expect(res).toBe(upstream);
+    expect(res.headers.get('content-type')).toBeNull();
+    expect(res.headers.get('etag')).toBe('W/"no-type"');
+    expect(res.status).toBe(404);
+    expect(await res.text()).toBe(SHELL);
+  });
+});
diff --git a/vitest.config.mjs b/vitest.config.mjs
index 2369248..e66dd95 100644
--- a/vitest.config.mjs
+++ b/vitest.config.mjs
@@ -6,10 +6,13 @@ export default defineConfig({
     include: ['test/**/*.test.mjs'],
     coverage: {
       provider: 'v8',
-      // Only the extracted, side-effect-free browser logic is unit-tested to
-      // 100%. The DOM/network glue in public/*.js is covered by the Playwright
-      // functional suite instead (see CONTRIBUTING.md).
-      include: ['public/js/lib/**/*.js', 'functions/lib/**/*.js'],
+      // Three surfaces are measured: the extracted, side-effect-free browser
+      // logic, the library the Pages Function runs, and the Function entry
+      // point itself — which is not side-effect-free, but decides the status
+      // and headers every share crawler sees. The DOM/network glue in
+      // public/*.js is covered by the Playwright suite instead (see
+      // CONTRIBUTING.md).
+      include: ['public/js/lib/**/*.js', 'functions/lib/**/*.js', 'functions/_middleware.js'],
       // Report every matched file even if no test imports it, so a new, untested
       // public/js/lib/*.js drops coverage below 100% instead of silently passing.
       all: true,
@@ -34,6 +37,15 @@ export default defineConfig({
           branches: 87,
           statements: 98,
         },
+        // The Function entry point itself. It was unmeasured while it decided
+        // the status every share crawler sees, which is how a landing could
+        // answer 404 in production without a single test noticing.
+        'functions/_middleware.js': {
+          lines: 100,
+          functions: 100,
+          branches: 100,
+          statements: 100,
+        },
       },
     },
   },