From e8e0b65186609782ee917c68f8cdb7c331f22989 Mon Sep 17 00:00:00 2001
From: TaprootFreakAI <315477232+TaprootFreakAI@users.noreply.github.com>
Date: Wed, 9 Sep 2026 17:48:16 +0200
Subject: [PATCH] Revert "48a09586 - Invite and promo links answer 404 in
 production (#34)"

This reverts commit 1555d9346a845a7442fe8df9b2a43628f04d5b3e.
---
 CONTRIBUTING.md                      |  42 +-
 README.md                            |  16 +-
 functions/_middleware.js             | 251 +--------
 functions/lib/itunes-banner.js       |  51 --
 test/itunes-banner-function.test.mjs |  84 +--
 test/middleware.test.mjs             | 781 ---------------------------
 vitest.config.mjs                    |  20 +-
 7 files changed, 36 insertions(+), 1209 deletions(-)
 delete mode 100644 test/middleware.test.mjs

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 63a43a8..d2719b1 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -9,16 +9,8 @@ This repo is the **realunit.app** website — public, static. See the
   `public/` ships verbatim to Cloudflare Pages — what you commit is what gets
   served. The one exception is the invite/promo HTML: `functions/_middleware.js`
   rewrites those bytes on the way out so crawlers see the code in
-  `apple-itunes-app`, `og:*` and the App Links before any script runs. It also
-  reports a rewritten landing as `200`: Pages resolves `/invite/<code>` to the
-  code-less shell through the `_redirects` rewrite but keeps the not-found
-  status of the path that was asked for, and a crawler drops a `404` before it
-  reads the tags. The promotion is guarded on the two landing marks — `id="state-loading"` and `aria-busy="true"`, which both landings carry together in one tag and no other page the site ships carries together — so the site's
-  own 404 page keeps saying 404, and HEAD answers with the same status as GET.
-  Both methods are resolved internally as one full GET, without `Range` /
-  `If-Range` and without the conditional request headers, because the whole document
-  is rewritten and the status is decided from its body. The conditional request headers are dropped rather than evaluated, which is a deliberate deviation from RFC 9110 §13.1: a rewritten landing emits no validator to condition on, so the answer is always the current representation and never a 304 or a 412. A pass-through answer keeps the origin's own headers, validator included. `scripts/dev-server.mjs` shares the injection and answers HEAD without a body, but has no promotion, no marker guard and no header stripping: its own routing serves the landings as `200` and never produces the not-found status the promotion exists to correct. Nothing else is transformed, and there is no server-side
-  rendering. The dev dependencies exist **only** for the quality gates below
+  `apple-itunes-app`, `og:*` and the App Links before any script runs. Nothing
+  else is transformed, and there is no server-side rendering. The dev dependencies exist **only** for the quality gates below
   (formatting, HTML validation, unit tests, screenshots); nothing compiles or
   bundles the site.
 - **Invite/promo HTML rewrite is banner, canonical, and store handoff.** Safari,
@@ -53,9 +45,8 @@ This repo is the **realunit.app** website — public, static. See the
     adding any other host to that allowlist needs a reason in the PR.
   - Inline `style="…"` attributes and `<style>` blocks are fine (`style-src`
     allows `'unsafe-inline'`).
-- **Put the reusable, side-effect-free JS in `public/js/lib/`.** It carries a
-  unit-coverage gate (see below), as do `functions/lib/**` and the Function
-  entry point `functions/_middleware.js`; DOM/network glue stays in the
+- **Put the reusable, side-effect-free JS in `public/js/lib/`.** That is the only
+  code with a unit-coverage gate (see below); DOM/network glue stays in the
   page-level scripts and is covered by the Playwright suite.
 - **Don't put mutable files under `public/assets/`.** That path has an immutable,
   one-year cache header — only content-hashed or otherwise stable-named assets
@@ -82,14 +73,14 @@ sanity-check anything touching scripts/images in the dev deployment.
 Every pull request must pass the gates below; CI runs them as required status
 checks.
 
-| Gate              | Command                 | What it enforces                                                                                                                                            |
-| ----------------- | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Formatting        | `npm run format:check`  | Prettier formatting of the maintained code (the hand-written HTML pages are validated, not reformatted)                                                     |
-| HTML validity     | `npm run validate:html` | Valid markup on every page under `public/`                                                                                                                  |
-| Site completeness | `npm run check:site`    | Every `<html lang>`, every internal link/asset resolves, and each glue script loads its `js/lib` core first                                                 |
-| Unit coverage     | `npm run test:coverage` | 100% line/branch/function/statement coverage of `public/js/lib/**` and `functions/_middleware.js`; `functions/lib/**` at its ratchet in `vitest.config.mjs` |
-| Functional        | `npm run test:e2e`      | Playwright smoke + behavior suite (every page loads, platform detection, the full confirm flow)                                                             |
-| Visual regression | `npm run e2e:docker`    | Every view in the visual matrix (page × viewport × language × state) matches its committed baseline, then `check:visual`                                    |
+| Gate              | Command                 | What it enforces                                                                                                         |
+| ----------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| Formatting        | `npm run format:check`  | Prettier formatting of the maintained code (the hand-written HTML pages are validated, not reformatted)                  |
+| HTML validity     | `npm run validate:html` | Valid markup on every page under `public/`                                                                               |
+| Site completeness | `npm run check:site`    | Every `<html lang>`, every internal link/asset resolves, and each glue script loads its `js/lib` core first              |
+| Unit coverage     | `npm run test:coverage` | 100% line/branch/function/statement coverage of the extracted browser logic (`public/js/lib/**`)                         |
+| Functional        | `npm run test:e2e`      | Playwright smoke + behavior suite (every page loads, platform detection, the full confirm flow)                          |
+| Visual regression | `npm run e2e:docker`    | Every view in the visual matrix (page × viewport × language × state) matches its committed baseline, then `check:visual` |
 
 `npm run check` runs the first four locally in one go. The Playwright suites run
 against a local dev server (`test:e2e`); the visual gate runs in a pinned
@@ -110,12 +101,9 @@ The shipped page scripts (`public/platform.js`,
 than chase 100% coverage through the DOM, the **pure** logic — platform
 detection, language resolution, API-base derivation, response→state mapping, and
 the i18n copy — is extracted into `public/js/lib/` (side-effect free, exposed on
-a `window.*` global) and unit-tested to 100% with Vitest + jsdom. The rest of
-those page scripts is covered end-to-end by the Playwright functional suite
-(`tests/behavior.spec.mjs`). Two more surfaces carry their own unit-coverage
-gate and are not page scripts at all: `functions/lib/**` at the ratchet set in
-`vitest.config.mjs`, and the Pages Function entry point
-`functions/_middleware.js` at 100% — see the quality-gates table above.
+a `window.*` global) and unit-tested to 100% with Vitest + jsdom. Everything else
+is covered end-to-end by the Playwright functional suite
+(`tests/behavior.spec.mjs`).
 
 If you add a file under `public/js/lib/`, it must reach 100% coverage or the
 Quality gate fails (the threshold reports every matched file, tested or not). A
diff --git a/README.md b/README.md
index 779c843..ba7c321 100644
--- a/README.md
+++ b/README.md
@@ -45,17 +45,7 @@ uploaded to Cloudflare Pages.
   custom scheme; `twitter:app:country` is CH) are injected
   into the HTML bytes from the request URL (`functions/_middleware.js` on
   Cloudflare Pages, and the local dev-server) so Safari, Play, WhatsApp, X,
-  and share crawlers can snapshot them before JS. On Cloudflare Pages, and only
-  there, `functions/_middleware.js` also reports a rewritten landing as `200`:
-  Pages resolves `/invite/<code>` to the code-less shell through the
-  `_redirects` rewrite but keeps the not-found status of the path that was asked
-  for, and a crawler drops a `404` before it reads the tags. The promotion is
-  guarded on two marks the landings carry and the site's 404 page does not, and
-  HEAD answers with the same status as GET. Both methods are resolved internally
-  as one full GET, without `Range` / `If-Range` and without the conditional
-  request headers, because the whole document is rewritten and the status is decided
-  from its body. The conditional request headers are dropped rather than evaluated, which is a deliberate deviation from RFC 9110 §13.1: a rewritten landing emits no validator to condition on, so the answer is always the current representation and never a 304 or a 412. A pass-through answer keeps the origin's own headers, validator included. `scripts/dev-server.mjs` shares the injection and answers HEAD without a body, but has no promotion, no marker guard and no header stripping: its own routing serves the landings as `200` and never produces the not-found status the promotion exists to correct.
-  `og:title`, `og:description`,
+  and share crawlers can snapshot them before JS. `og:title`, `og:description`,
   and image alt name the campaign code; `?lang=en` sets English copy and `og:locale=en_GB`;
   invitee names wait for lookup JS. `/js/invite-banner.js` in `<head>`
   is the CSP-safe JS fallback — Cloudflare Pages CSP blocks inline `<script>`.
@@ -102,9 +92,7 @@ From v2 a build toolchain (Astro) is introduced; the plain-image landing stays t
 ## Testing
 
 The site still ships verbatim — the tooling is dev-only. Pure browser logic lives
-in `public/js/lib/**` and is unit-tested to 100% (Vitest + jsdom), as is the
-Pages Function entry point `functions/_middleware.js`; `functions/lib/**` is
-measured at its ratchet in `vitest.config.mjs`. The pages,
+in `public/js/lib/**` and is unit-tested to 100% (Vitest + jsdom); the pages,
 platform detection and the full confirm flow are covered by Playwright
 (functional + screenshot regression). See [CONTRIBUTING](CONTRIBUTING.md#quality-gates)
 for the gate list and commands (`npm run check`, `npm run test:e2e`,
diff --git a/functions/_middleware.js b/functions/_middleware.js
index 301e2d7..b1d59d2 100644
--- a/functions/_middleware.js
+++ b/functions/_middleware.js
@@ -6,256 +6,27 @@
  * Facebook App Links are present. Safari and share
  * crawlers snapshot those from the HTML bytes before
  * /js/invite-banner.js and invite.js run.
- * The same pass reports a rewritten landing as found: Pages resolves
- * /invite/<code> to the code-less shell through the _redirects rewrite but
- * keeps the not-found status of the path that was asked for, and a crawler
- * drops a 404 before it reads the tags this pass just wrote.
  * public/ stays generic; this is not a site-wide renderer.
  */
-import {
-  injectLandingFromRequestUrl,
-  isLandingShell,
-  landingStatus,
-  shouldRewriteItunesBanner,
-} from './lib/itunes-banner.js';
+import { injectLandingFromRequestUrl, shouldRewriteItunesBanner } from './lib/itunes-banner.js';
 
 export async function onRequest(context) {
   const url = new URL(context.request.url);
-  // The same gate as the meta rewrite, which therefore also decides the
-  // promotion. It excludes twelve asset-like suffixes, so a code whose text
-  // ends in one of them never reaches the rest of this pass. Measured on the
-  // deploy: /invite/AB.JSON and /promo/EVT1.HTML are answered with the site's
-  // own 404 page, not with the landing shell, so the promotion would refuse
-  // them on the marks in any case. What such a code loses is the landing, not
-  // the status — which is the follow-up #30 left open, where this gate and the
-  // suffix list in parseLandingFromUrl have to be reconciled.
   if (!shouldRewriteItunesBanner(url.pathname)) {
     return context.next();
   }
-  const method = context.request.method;
-  if (method !== 'GET' && method !== 'HEAD') {
-    return context.next();
-  }
-  const isHead = method === 'HEAD';
-  // Both methods ask for the same thing: the whole document as a GET.
-  //
-  // HEAD, because the status has to be decided from the body — the marks in it
-  // is what tells the landing shell from the site's own 404 page. A HEAD
-  // response carries none, and without this the same link would read as found
-  // by GET and as dead by the HEAD a link checker sends first.
-  //
-  // A full document, because this pass rewrites all of it. A partial
-  // representation would be injected into a fragment and returned under a
-  // Content-Range describing the bytes before the rewrite.
-  const response = await context.next(asFullGet(context.request));
-  // Answers that carry no representation of their own, or only part of one,
-  // are not rewritten: a GET gets the origin's answer back untouched, a HEAD a
-  // body-less copy of it. A 206 body is a fragment the rewrite would corrupt; a
-  // 304 has to keep the ETag it was matched on, which the rewrite would strip.
-  // Range and the conditional headers are removed above, so an origin only
-  // reaches this line unasked.
-  if (PASSED_ON.has(response.status)) {
-    return isHead ? bodyless(response, response.status, response.statusText) : response;
-  }
-  if (!isRewritableHtml(response.headers.get('content-type'))) {
-    // Not ours to rewrite. Note that the request was already stripped of Range
-    // and the conditional headers before we could know that — under these
-    // paths only HTML is served, and shouldRewriteItunesBanner keeps the asset
-    // extensions out, so no caller loses a partial answer it could have had.
-    // A HEAD still must not carry the body the GET-equivalent came back with.
-    return isHead ? bodyless(response, response.status, response.statusText) : response;
-  }
-  // Read from a clone, so that an answer this pass decides not to touch keeps
-  // the origin's own body and headers — handed straight on to a GET, copied
-  // without the body to a HEAD — instead of being rebuilt from a decoded
-  // string under headers that described the original.
-  const html = await response.clone().text();
-  if (!isLandingShell(html)) {
-    // Something else is being served here — the site's own 404 page after a
-    // broken deploy is the case this guards. Rewriting its title into an
-    // invitation would misdescribe it, and its status is right as it stands.
-    return isHead ? bodyless(response, response.status, response.statusText) : response;
+  const response = await context.next();
+  const type = response.headers.get('content-type') || '';
+  if (context.request.method !== 'GET' || !type.includes('text/html')) {
+    return response;
   }
+  const html = await response.text();
   const injected = injectLandingFromRequestUrl(html, context.request.url);
   const headers = new Headers(response.headers);
-  // The headers that rewriting the representation invalidates or makes
-  // unreliable: the length, the content coding, both validators, the range
-  // metadata — including the offer to serve ranges of bytes that no longer
-  // exist — and the integrity digests of RFC 9530 and its predecessors. A
-  // stale validator is worse than none — a conditional request would be
-  // answered 304 against a document the client never received — and a body
-  // labelled gzip that is not gzip does not render at all. The body handed on
-  // from here is always the decoded, rewritten string.
-  //
-  // Content-Encoding goes because response.text() decoded the body: whatever
-  // the origin declared, what leaves here is plain text. Whether the header
-  // was on the object at all is a separate question — the gzip visible on the
-  // deploy is applied by the edge after this Function — and deleting a header
-  // that was never there costs nothing.
-  //
-  // Measured on the deploy: ETag and Last-Modified are not set on these paths
-  // today, so those two are a guard rather than a live fix.
-  for (const stale of [
-    'content-length',
-    'content-encoding',
-    'etag',
-    'last-modified',
-    'content-range',
-    'accept-ranges',
-    'content-digest',
-    'repr-digest',
-    'digest',
-    'content-md5',
-  ]) {
-    headers.delete(stale);
-  }
-  // The body was read as UTF-8 and goes out as UTF-8. Anything the origin
-  // declared as another encoding was handed on above rather than reaching
-  // here, so this states the fact rather than papering over one.
-  headers.set('content-type', 'text/html; charset=utf-8');
-  const status = landingStatus(response.status, injected);
-  // A promoted status must not keep "Not Found" as its reason phrase.
-  const statusText = status === response.status ? response.statusText : '';
-  return new Response(isHead ? null : injected, { status, statusText, headers });
-}
-
-/**
- * Whether this pass may rewrite the body it is about to read.
- *
- * The media type is compared as a media type, not as a substring: RFC 9110
- * makes it case-insensitive, so `Text/HTML` is the same thing, and a parameter
- * that merely contains the words — `application/json; profile="text/html"` —
- * is not.
- *
- * The charset has to be UTF-8 or absent, because response.text() decodes as
- * UTF-8 whatever the header says. A body in another encoding would come back
- * as replacement characters and leave here labelled UTF-8, so it is handed on
- * untouched instead.
- */
-function isRewritableHtml(contentType) {
-  const [media, ...params] = splitContentType(contentType || '');
-  if (media.trim().toLowerCase() !== 'text/html') return false;
-  const charsets = params
-    .map((param) => param.trim())
-    .filter((param) => param.slice(0, param.indexOf('=')).trim().toLowerCase() === 'charset')
-    .map((param) => unquote(param.slice(param.indexOf('=') + 1).trim()));
-  // No charset at all means the default, which is what we assume. Two that
-  // disagree, or one that is not UTF-8, means hands off.
-  return charsets.every((charset) => /^utf-?8$/i.test(charset));
-}
-
-/**
- * A Content-Type split on its parameter separators, quotes respected.
- *
- * A quoted parameter value may contain a semicolon, so splitting on the
- * character alone would read `foo="x;charset=utf-8"` as a charset and miss the
- * real one behind it.
- */
-function splitContentType(type) {
-  const parts = [];
-  let start = 0;
-  let quoted = false;
-  for (let i = 0; i < type.length; i += 1) {
-    const char = type[i];
-    // A quoted-pair (RFC 9110 §5.6.4) escapes whatever follows it, including a
-    // closing quote — skipping the next character keeps `foo="a\";x=y"` from
-    // being read as two parameters.
-    if (quoted && char === '\\') i += 1;
-    else if (char === '"') quoted = !quoted;
-    else if (char === ';' && !quoted) {
-      parts.push(type.slice(start, i));
-      start = i + 1;
-    }
-  }
-  parts.push(type.slice(start));
-  return parts;
-}
-
-/** A quoted-string parameter value with its quotes and escapes resolved. */
-function unquote(value) {
-  if (value.length < 2 || !value.startsWith('"') || !value.endsWith('"')) return value;
-  return value.slice(1, -1).replace(/\\(.)/g, '$1');
-}
-
-/**
- * Statuses this pass does not rewrite: they carry no representation of their
- * own, or only part of one, so there is nothing to rewrite and their headers
- * still describe what the origin meant. A GET gets the origin's answer back
- * unchanged; a HEAD gets a new, body-less one with the same status and headers.
- */
-const PASSED_ON = new Set([204, 205, 206, 304]);
-
-/**
- * The request headers RFC 9110 defines as able to turn the answer into
- * something other than the current full representation: 206 for the first two,
- * 304 or 412 for the rest.
- */
-const PARTIAL_OR_CONDITIONAL = [
-  'range',
-  'if-range',
-  'if-none-match',
-  'if-modified-since',
-  'if-match',
-  'if-unmodified-since',
-];
-
-/**
- * The same request as a GET for the whole document. The six request headers
- * that RFC 9110 defines as able to change the answer into something other than
- * the current full representation are dropped: Range and If-Range would allow
- * 206, the four conditional ones 304 or 412. None of those bodies is the
- * landing shell, and the status here is decided from the body. Everything else
- * the client sent is kept — except in the body-carrying fallback below, which
- * also drops the body, the headers that described it, and the request metadata
- * that cannot be rebuilt from a URL.
- *
- * This is a deliberate deviation from RFC 9110 §13.1, stated rather than
- * hidden: a client sending `If-None-Match: *` is answered 200 with the whole
- * document where 304 was called for, and `If-Match` never produces 412.
- *
- * The two kinds of precondition are not equally hard. A tag or date condition
- * would need a validator minted for the rewritten document, which none of
- * these paths emits and which is a larger change than this one. The wildcard
- * forms need no validator at all — they ask only whether a current
- * representation exists, which is already known here — so they are dropped for
- * uniformity, not out of necessity.
- *
- * What a client gets either way is the current representation, so the body is
- * never stale. The status is what diverges: RFC 9110 puts 304 and 412 at
- * SHOULD, and this pass answers 200 instead. The cost is a larger answer than
- * was called for, not a wrong one.
- *
- * Measured on the deploy with a Range GET, reading the body rather than only
- * the headers: Pages answers with the full document today and no 206, so this
- * is a guard rather than a live fix.
- */
-function asFullGet(request) {
-  const headers = new Headers(request.headers);
-  for (const name of PARTIAL_OR_CONDITIONAL) {
-    headers.delete(name);
-  }
-  if (request.body === null) {
-    return new Request(request, { method: 'GET', headers });
-  }
-  // A GET or HEAD carrying a body cannot be re-methoded: the constructor
-  // refuses to pair one with GET. Rebuild from the URL instead, which drops the
-  // platform's request metadata but keeps the request answerable. The headers
-  // that described that body go with it, or the new request would announce one
-  // it does not carry.
-  //
-  // Asked rather than caught, so that any other constructor failure still
-  // surfaces instead of being quietly rerouted through here.
   headers.delete('content-length');
-  headers.delete('content-type');
-  return new Request(request.url, { method: 'GET', headers });
-}
-
-/**
- * The same status and headers with the body left off. Nothing was rewritten on
- * the paths that reach here, so every header still describes what the origin
- * sent — Content-Length included, which RFC 9110 wants a HEAD to carry as the
- * GET would have.
- */
-function bodyless(response, status, statusText) {
-  return new Response(null, { status, statusText, headers: new Headers(response.headers) });
+  return new Response(injected, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
 }
diff --git a/functions/lib/itunes-banner.js b/functions/lib/itunes-banner.js
index e2e2e22..6711830 100644
--- a/functions/lib/itunes-banner.js
+++ b/functions/lib/itunes-banner.js
@@ -424,57 +424,6 @@ export function parseLangFromUrl(urlLike) {
   }
 }
 
-/**
- * The marks the landing shells carry and the site's 404 page does not. The
- * caller has already established that the path is a landing, so the only
- * question left is whether the asset server handed back the shell or the 404
- * page — but see isLandingShell for why one mark was not enough.
- */
-const LANDING_MARKERS = ['id="state-loading"', 'aria-busy="true"'];
-
-/**
- * Whether these bytes are a landing shell rather than some other page.
- *
- * Two marks rather than one, because a single substring is a thin thing to
- * promote a status on: an error document that happened to carry the id — in a
- * comment, in a script, in a copied snippet — would be answered 200 with an
- * invitation's metadata.
- *
- * This stays a substring test, so it does not require the two marks to sit in
- * the same element, or in an element at all. What makes two of them enough is
- * therefore not this function but a property of the site, and that property is
- * held by a test rather than by a parser: of every page the repo ships, only
- * the two landings reach both marks. The 404 page carries neither, and the two
- * other shells that carry the id — account-merge and confirm-aktionariat —
- * carry no aria-busy. test/middleware.test.mjs walks public/ and pins exactly
- * that.
- */
-export function isLandingShell(html) {
-  return typeof html === 'string' && LANDING_MARKERS.every((mark) => html.includes(mark));
-}
-
-/**
- * Report a rewritten landing as found.
- *
- * _routes.json sends /invite/<code> to the Function, and the asset lookup
- * behind context.next() resolves the code-less shell through the _redirects
- * 200-rewrite while keeping the not-found status of the path that was asked
- * for. Measured on the deploy: the body is the landing, the status is 404.
- * Browsers render it anyway, but share crawlers drop a 404 before they read
- * the tags injectLandingFromRequestUrl has by now written into the body. The
- * injection is why these pages exist; this function is what stops the status
- * from throwing the injected tags away.
- *
- * Only a body that really is the landing shell is promoted. If a broken deploy
- * ever serves the site's 404 page on these paths, it has to keep saying 404
- * instead of looking healthy.
- */
-export function landingStatus(status, html) {
-  if (status !== 404) return status;
-  if (!isLandingShell(html)) return status;
-  return 200;
-}
-
 /** Crawlers snapshot og:title / twitter:title from the HTML bytes. Names wait for lookup JS. */
 export function shareTitle(kind, code, lang) {
   // Keep the kind guard first: this function is exported, and a missing kind
diff --git a/test/itunes-banner-function.test.mjs b/test/itunes-banner-function.test.mjs
index d3ff8b1..6350db0 100644
--- a/test/itunes-banner-function.test.mjs
+++ b/test/itunes-banner-function.test.mjs
@@ -16,7 +16,6 @@ import {
   shareTitle,
   injectShareDescriptionHtml,
   shareDescription,
-  landingStatus,
   parseLangFromUrl,
   injectShareLocaleHtml,
   injectSiteNameHtml,
@@ -33,22 +32,11 @@ describe('shouldRewriteItunesBanner', () => {
   test('invite and promo HTML paths only', () => {
     expect(shouldRewriteItunesBanner('/invite')).toBe(true);
     expect(shouldRewriteItunesBanner('/invite/AB12CD')).toBe(true);
-    expect(shouldRewriteItunesBanner('/promo')).toBe(true);
     expect(shouldRewriteItunesBanner('/promo/EVT1')).toBe(true);
     expect(shouldRewriteItunesBanner('/invite/invite.js')).toBe(false);
     expect(shouldRewriteItunesBanner('/js/invite-banner.js')).toBe(false);
     expect(shouldRewriteItunesBanner('/')).toBe(false);
     expect(shouldRewriteItunesBanner('/.well-known/apple-app-site-association')).toBe(false);
-    // The prefix has to end at a segment boundary: a path that merely starts
-    // with the same letters is somebody else's.
-    expect(shouldRewriteItunesBanner('/invitee')).toBe(false);
-    expect(shouldRewriteItunesBanner('/invite-old')).toBe(false);
-    expect(shouldRewriteItunesBanner('/promotion')).toBe(false);
-    expect(shouldRewriteItunesBanner('/promo-old')).toBe(false);
-    // A doubled slash makes the first segment empty, so neither the exact
-    // comparison nor the prefix matches.
-    expect(shouldRewriteItunesBanner('//invite/AB12CD')).toBe(false);
-    expect(shouldRewriteItunesBanner('/invites/AB12CD')).toBe(false);
   });
 });
 
@@ -371,7 +359,7 @@ describe('injectLandingFromRequestUrl', () => {
       '<meta name="description" content="Öffne die RealUnit-App mit diesem Code." />';
     const out = injectLandingFromRequestUrl(shell, 'https://www.realunit.app/invite/AB12CD?mock=1');
     expect(out).toContain('app-argument=realunit-wallet://invite/AB12CD');
-    expect(out).toContain('property="og:url" content="https://realunit.app/invite/AB12CD"');
+    expect(out).toContain('content="https://realunit.app/invite/AB12CD"');
     expect(out).toContain('href="https://realunit.app/invite/AB12CD"');
     expect(out).toContain('name="twitter:url" content="https://realunit.app/invite/AB12CD"');
     expect(out).toContain('property="og:title" content="RealUnit — Einladung AB12CD"');
@@ -401,17 +389,8 @@ describe('injectLandingFromRequestUrl', () => {
     expect(out).toContain(
       'https://play.google.com/store/apps/details?id=swiss.realunit.app&referrer=invite%3DAB12CD',
     );
-    // The hrefs, not just the attribute names: swapping the two would send
-    // Android users to the iOS hand-off and back, and the names alone would
-    // not notice.
-    expect(out).toContain(
-      'data-android-app href="android-app://swiss.realunit.app/https/realunit.app/invite/AB12CD"',
-    );
-    expect(out).toContain('data-ios-app href="ios-app://6759720010/realunit-wallet/invite/AB12CD"');
-    // The iPad card carries the same scheme as the phone one and was asserted
-    // nowhere; a wrong value there would have gone unnoticed.
-    expect(out).toContain('name="twitter:app:url:ipad" content="realunit-wallet://invite/AB12CD"');
-    expect(out).toContain('name="twitter:app:id:ipad" content="6759720010"');
+    expect(out).toContain('data-android-app');
+    expect(out).toContain('data-ios-app');
     expect(out).toContain('al:android:url');
     expect(out).toContain('property="al:android:url" content="realunit-wallet://invite/AB12CD"');
     expect(out).toContain('property="al:android:class" content="swiss.realunit.app.MainActivity"');
@@ -541,28 +520,6 @@ describe('referral code injection hardening', () => {
     expect(out).toContain('AB&quot;&gt;&lt;');
   });
 
-  test('an alternate link that already exists is replaced, not doubled', () => {
-    // The fixtures so far only ever reached the insert branch, because no shell
-    // ships these links; the replace branch had never run.
-    for (const existing of [
-      '<link rel="alternate" data-android-app href="android-app://old" />',
-      '<link data-android-app rel="alternate" href="android-app://old" />',
-      // href before the attribute: the upsert has a separate branch for that
-      // order, and the two fixtures above both leave it unrun.
-      '<link rel="alternate" href="android-app://old" data-android-app />',
-    ]) {
-      const out = injectLandingFromRequestUrl(
-        '<head>' + existing + '</head>',
-        'https://realunit.app/invite/AB12CD',
-      );
-      expect(out).toContain(
-        'href="android-app://swiss.realunit.app/https/realunit.app/invite/AB12CD"',
-      );
-      expect(out).not.toContain('android-app://old');
-      expect(out.match(/data-android-app/g)).toHaveLength(1);
-    }
-  });
-
   test('injectShareTitleHtml escapes a raw code and never breaks the attribute', () => {
     const out = injectShareTitleHtml(base, 'invite', 'A"><B', 'de');
     expect(out).not.toContain('<B');
@@ -652,9 +609,7 @@ describe('an English locale without a code keeps English copy', () => {
     const promo = injectLandingFromRequestUrl(shell, 'https://realunit.app/promo/?lang=en');
     expect(promo).toContain('<title>RealUnit — Promo code</title>');
 
-    // Without ?lang=en the German copy must be left as it is. The pass still
-    // adds og:site_name, which is language-independent, so this checks the copy
-    // rather than byte equality.
+    // Without ?lang=en the German shell must be left exactly as it is.
     const de = injectLandingFromRequestUrl(shell, 'https://realunit.app/invite/');
     expect(de).toContain('<title>RealUnit — Einladung</title>');
     expect(de).toContain(
@@ -678,37 +633,6 @@ describe('an English locale without a code keeps English copy', () => {
   });
 });
 
-describe('landingStatus', () => {
-  // Both marks, as the shipped shells carry them.
-  const shell = '<section id="state-loading" role="status" aria-busy="true"></section>';
-
-  test('promotes a not-found landing to found', () => {
-    expect(landingStatus(404, shell)).toBe(200);
-  });
-
-  test('leaves every other status alone, including its 4xx neighbours', () => {
-    expect(landingStatus(200, shell)).toBe(200);
-    expect(landingStatus(500, shell)).toBe(500);
-    expect(landingStatus(302, shell)).toBe(302);
-    // Only 404 is the Pages artefact this exists for. Widening the condition to
-    // the whole 4xx range would promote a real refusal or a withdrawn code.
-    expect(landingStatus(403, shell)).toBe(403);
-    expect(landingStatus(410, shell)).toBe(410);
-    expect(landingStatus(451, shell)).toBe(451);
-  });
-
-  test('refuses to promote a body that is not a landing', () => {
-    // The site's own 404 page must keep saying 404 rather than look healthy.
-    expect(landingStatus(404, '<title>Seite nicht gefunden — RealUnit</title>')).toBe(404);
-    // One mark alone is not a landing shell.
-    expect(landingStatus(404, '<section id="state-loading"></section>')).toBe(404);
-    expect(landingStatus(404, '<section aria-busy="true"></section>')).toBe(404);
-    expect(landingStatus(404, '')).toBe(404);
-    expect(landingStatus(404, null)).toBe(404);
-    expect(landingStatus(404, undefined)).toBe(404);
-  });
-});
-
 describe('the browser mirror and the function module say the same thing', () => {
   // public/js/lib/invite-core.js carries a second copy of shareTitle and
   // shareDescription. Nothing in production calls its HTML injectors, so a
diff --git a/test/middleware.test.mjs b/test/middleware.test.mjs
deleted file mode 100644
index 60cc4a6..0000000
--- a/test/middleware.test.mjs
+++ /dev/null
@@ -1,781 +0,0 @@
-import { readdirSync, readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { describe, expect, test } from 'vitest';
-import { onRequest } from '../functions/_middleware.js';
-import { isLandingShell } from '../functions/lib/itunes-banner.js';
-
-// The real files, not a hand-written stand-in. The status promotion keys on a
-// marks that live in the landing shells and must never appear in the site's
-// 404 page; a synthetic fixture would keep passing after someone moved that
-// marker, and production would answer 404 again with nothing going red.
-// Resolved from the project root: vitest runs from there, and the jsdom
-// environment does not give this module a usable import.meta.url.
-const page = (name) => readFileSync(resolve('public', name), 'utf8');
-
-// Every page the site ships, named the way page() wants them.
-const shippedHtml = (dir = 'public') =>
-  readdirSync(resolve(dir), { withFileTypes: true }).flatMap((entry) => {
-    const path = `${dir}/${entry.name}`;
-    if (entry.isDirectory()) return shippedHtml(path);
-    return entry.name.endsWith('.html') ? [path.slice('public/'.length)] : [];
-  });
-
-// The header values public/_headers really sets, read from the file so the
-// fixture cannot drift from production. This checks that the middleware passes
-// them through — a dropped security header does not show up in coverage, which
-// measures execution and not values. It does not review the policy itself:
-// changing _headers moves both sides together, by design.
-function headerRule(pattern, name) {
-  const rules = page('_headers').split(/\r?\n/);
-  const start = rules.findIndex((line) => line.trim() === pattern);
-  if (start < 0) throw new Error(`public/_headers has no rule for ${pattern}`);
-  for (const line of rules.slice(start + 1)) {
-    if (!line.startsWith(' ') && !line.startsWith('\t')) break;
-    const [key, ...rest] = line.trim().split(':');
-    if (key.toLowerCase() === name) return rest.join(':').trim();
-  }
-  throw new Error(`public/_headers sets no ${name} for ${pattern}`);
-}
-
-const SITE_HEADERS = {
-  'content-security-policy': headerRule('/*', 'content-security-policy'),
-  'x-content-type-options': headerRule('/*', 'x-content-type-options'),
-  'x-frame-options': headerRule('/*', 'x-frame-options'),
-  'referrer-policy': headerRule('/*', 'referrer-policy'),
-  'cache-control': headerRule('/invite/*', 'cache-control'),
-};
-const SHELL = page('invite/index.html');
-const PROMO_SHELL = page('promo/index.html');
-const NOT_FOUND_PAGE = page('404.html');
-// .length counts UTF-16 units; a Content-Length counts bytes, and these pages
-// carry multi-byte characters.
-const bytes = (text) => new TextEncoder().encode(text).length;
-const SHELL_BYTES = bytes(SHELL);
-const NOT_FOUND_BYTES = bytes(NOT_FOUND_PAGE);
-
-function context({
-  url,
-  method = 'GET',
-  status = 404,
-  body = SHELL,
-  type = 'text/html; charset=utf-8',
-  requestHeaders = {},
-}) {
-  const headers = new Headers({
-    'content-type': type,
-    'content-length': String(bytes(body)),
-    ...SITE_HEADERS,
-  });
-  const forwarded = [];
-  const next = (request) => {
-    forwarded.push(request || ctx.request);
-    // 204, 205 and 304 cannot be built with a body — which is the very thing
-    // the middleware has to respect when it rebuilds the response.
-    const upstream = status === 204 || status === 205 || status === 304 ? null : body;
-    return Promise.resolve(
-      new Response(upstream, { status, statusText: status === 404 ? 'Not Found' : 'OK', headers }),
-    );
-  };
-  // A real Request, because the middleware derives the GET-equivalent from it.
-  const ctx = { request: new Request(url, { method, headers: requestHeaders }), next, forwarded };
-  return ctx;
-}
-
-describe('the landing middleware', () => {
-  test('reports a rewritten landing as found instead of not found', async () => {
-    // Measured on the deploy: Pages resolves /invite/<code> to the shell through
-    // the _redirects rewrite but keeps the not-found status of the asked path.
-    // Share crawlers drop a 404 before they read the rewritten meta tags.
-    const res = await onRequest(context({ url: 'https://realunit.app/invite/AB12CD' }));
-    expect(res.status).toBe(200);
-    // A promoted status must not keep "Not Found" as its reason phrase.
-    expect(res.statusText).toBe('');
-    const html = await res.text();
-    expect(html).toContain('RealUnit — Einladung AB12CD');
-    expect(res.headers.get('content-length')).toBeNull();
-    expect(res.headers.get('content-type')).toBe('text/html; charset=utf-8');
-    for (const [name, value] of Object.entries(SITE_HEADERS)) {
-      expect(res.headers.get(name)).toBe(value);
-    }
-  });
-
-  test('the media type is read as a media type, not as a substring', async () => {
-    // RFC 9110 makes it case-insensitive, and a parameter that merely contains
-    // the words is not the type.
-    const mixedCase = await onRequest(
-      context({ url: 'https://realunit.app/invite/AB12CD', type: 'Text/HTML; charset=UTF-8' }),
-    );
-    expect(mixedCase.status).toBe(200);
-    expect(await mixedCase.text()).toContain('RealUnit — Einladung AB12CD');
-
-    // The body is the shell, so a substring match would actually rewrite it —
-    // with '{}' the marker guard would hand it on either way and the check
-    // would prove nothing.
-    const lookalike = await onRequest(
-      context({
-        url: 'https://realunit.app/invite/AB12CD',
-        type: 'application/json; profile="text/html"',
-      }),
-    );
-    expect(lookalike.status).toBe(404);
-    expect(await lookalike.text()).toBe(SHELL);
-    expect(lookalike.headers.get('content-type')).toBe('application/json; profile="text/html"');
-  });
-
-  test('a body in another encoding is handed on byte for byte', async () => {
-    // Real ISO-8859-1 bytes, not a JS string: 0xE9 is 'é' there and is not
-    // valid UTF-8 at all. The body carries both landing marks, so only the
-    // charset guard stands between it and the rewrite — without it,
-    // response.text() would turn that byte into U+FFFD and the answer would go
-    // out as different bytes under a UTF-8 label.
-    const latin1 = new Uint8Array([
-      ...new TextEncoder().encode('<section id="state-loading" aria-busy="true">'),
-      0xe9,
-      ...new TextEncoder().encode('</section>'),
-    ]);
-    const ctx = context({ url: 'https://realunit.app/invite/AB12CD' });
-    ctx.next = () =>
-      Promise.resolve(
-        new Response(latin1, {
-          status: 404,
-          statusText: 'Not Found',
-          headers: new Headers({ 'content-type': 'text/html; charset=iso-8859-1' }),
-        }),
-      );
-    const res = await onRequest(ctx);
-    expect(res.status).toBe(404);
-    expect(res.headers.get('content-type')).toBe('text/html; charset=iso-8859-1');
-    expect(new Uint8Array(await res.arrayBuffer())).toEqual(latin1);
-  });
-
-  test('the charset is read whatever shape it comes in', async () => {
-    // A rewritten answer is promoted, declares UTF-8 and carries the injected
-    // title; an untouched one keeps the origin's status, type and bytes.
-    const rewritten = async (type) => {
-      const res = await onRequest(context({ url: 'https://realunit.app/invite/AB12CD', type }));
-      const html = await res.text();
-      if (res.status === 200) {
-        expect(res.headers.get('content-type')).toBe('text/html; charset=utf-8');
-        expect(html).toContain('RealUnit — Einladung AB12CD');
-        return true;
-      }
-      expect(res.status).toBe(404);
-      expect(res.headers.get('content-type')).toBe(type);
-      expect(html).toBe(SHELL);
-      return false;
-    };
-    // Quoted, unusually spelled and differently cased UTF-8 all still count —
-    // the parameter name is case-insensitive too.
-    expect(await rewritten('text/html; charset="utf-8"')).toBe(true);
-    expect(await rewritten('Text/HTML;Charset="utf-8"')).toBe(true);
-    expect(await rewritten('text/html; CHARSET=iso-8859-1')).toBe(false);
-    expect(await rewritten('text/html; charset=UTF8')).toBe(true);
-    expect(await rewritten('text/html;charset=utf-8')).toBe(true);
-    // Anything else is handed on rather than decoded as UTF-8 and relabelled.
-    expect(await rewritten('text/html; charset=utf-16')).toBe(false);
-    expect(await rewritten('text/html; charset=windows-1252')).toBe(false);
-    expect(await rewritten('text/html; charset="iso-8859-1"')).toBe(false);
-    // A semicolon inside a quoted value is not a parameter separator, so the
-    // charset that counts is the real one behind it.
-    expect(await rewritten('text/html; foo="x;charset=utf-8"; charset=iso-8859-1')).toBe(false);
-    expect(await rewritten('text/html; foo="x;charset=iso-8859-1"; charset=utf-8')).toBe(true);
-    // Two that disagree means hands off rather than picking one, whichever way
-    // round they come: neither the first nor the last wins.
-    expect(await rewritten('text/html; charset=utf-8; charset=iso-8859-1')).toBe(false);
-    // An unterminated quote is not a quoted value, so the raw text is compared
-    // and does not read as UTF-8. The trailing X makes the case tell the two
-    // apart: stripping quotes without checking for a closing one would leave
-    // exactly `utf-8` behind and wrongly accept it.
-    expect(await rewritten('text/html; charset="utf-8X')).toBe(false);
-    expect(await rewritten('text/html; charset=iso-8859-1; charset=utf-8')).toBe(false);
-    // A backslash escapes the next character inside a quoted value, so the
-    // closing quote here is part of the value and the real charset follows.
-    expect(await rewritten('text/html; foo="a\\";charset=utf-8"; charset=iso-8859-1')).toBe(false);
-    expect(await rewritten('text/html; foo="a\\";charset=iso-8859-1"; charset=utf-8')).toBe(true);
-  });
-
-  test('a rewritten answer says UTF-8 even when the origin left it out', async () => {
-    // The body was read as UTF-8 and goes out as UTF-8, so the answer says so
-    // rather than leaving the client to guess.
-    const res = await onRequest(
-      context({ url: 'https://realunit.app/invite/AB12CD', type: 'text/html' }),
-    );
-    expect(res.status).toBe(200);
-    expect(res.headers.get('content-type')).toBe('text/html; charset=utf-8');
-  });
-
-  test('a promo landing is promoted the same way', async () => {
-    const res = await onRequest(
-      context({ url: 'https://realunit.app/promo/EVT1', body: PROMO_SHELL }),
-    );
-    expect(res.status).toBe(200);
-    expect(res.statusText).toBe('');
-    expect(await res.text()).toContain('RealUnit — Promo-Code EVT1');
-  });
-
-  test('a refusal on a landing path is passed on, not promoted', async () => {
-    // Only the 404 Pages produces for these paths is an artefact. A 403 or a
-    // 410 means what it says, even when the body happens to be the shell.
-    for (const status of [403, 410]) {
-      // The encoding has to be there for its absence afterwards to mean
-      // anything — asserting against a header the fixture never set is no test.
-      const ctx = context({ url: 'https://realunit.app/invite/AB12CD', status });
-      ctx.next = () =>
-        Promise.resolve(
-          new Response(SHELL, {
-            status,
-            statusText: 'OK',
-            headers: new Headers({
-              'content-type': 'text/html; charset=utf-8',
-              'content-length': String(SHELL_BYTES),
-              'content-encoding': 'gzip',
-              ...SITE_HEADERS,
-            }),
-          }),
-        );
-      const res = await onRequest(ctx);
-      expect(res.status).toBe(status);
-      expect(res.statusText).toBe('OK');
-      // The rewrite still runs; what must not change is the status. And since
-      // it runs, the headers it invalidates have to go here as well — a
-      // content-length from before the rewrite would contradict the body.
-      expect(await res.text()).toContain('RealUnit — Einladung AB12CD');
-      expect(res.headers.get('content-length')).toBeNull();
-      expect(res.headers.get('content-encoding')).toBeNull();
-    }
-  });
-
-  test('conditional headers are stripped from the GET-equivalent', async () => {
-    // Range would allow a 206, the conditional headers a 304 or a 412. None of
-    // those bodies is the landing shell, and the status is decided from the
-    // body.
-    const ctx = context({
-      url: 'https://realunit.app/invite/AB12CD',
-      requestHeaders: {
-        'if-none-match': 'W/"abc"',
-        'if-modified-since': 'Tue, 09 Sep 2026 00:00:00 GMT',
-        'if-match': 'W/"abc"',
-        'if-unmodified-since': 'Tue, 09 Sep 2026 00:00:00 GMT',
-        'accept-language': 'de-CH',
-      },
-    });
-    const res = await onRequest(ctx);
-    const [forwarded] = ctx.forwarded;
-    for (const name of ['if-none-match', 'if-modified-since', 'if-match', 'if-unmodified-since']) {
-      expect(forwarded.headers.get(name)).toBeNull();
-    }
-    expect(forwarded.headers.get('accept-language')).toBe('de-CH');
-    // And the answer that comes back is the whole document, not a 304.
-    expect(res.status).toBe(200);
-    expect(await res.text()).toContain('RealUnit — Einladung AB12CD');
-  });
-
-  test('a GET that carries a body is still answered, not thrown on', async () => {
-    // The Request constructor refuses to pair a body with GET, so re-methoding
-    // such a request throws. It is rebuilt from the URL instead, which drops
-    // the platform's request metadata but keeps the request answerable.
-    const ctx = context({ url: 'https://realunit.app/invite/AB12CD' });
-    const withBody = new Request('https://realunit.app/invite/AB12CD', {
-      method: 'POST',
-      body: 'not what a GET should carry',
-    });
-    withBody.headers.set('range', 'bytes=0-99');
-    withBody.headers.set('content-length', '27');
-    withBody.headers.set('if-none-match', 'W/"abc"');
-    withBody.headers.set('accept-language', 'de-CH');
-    Object.defineProperty(withBody, 'method', { value: 'GET' });
-    ctx.request = withBody;
-    const res = await onRequest(ctx);
-    const [forwarded] = ctx.forwarded;
-    expect(forwarded.method).toBe('GET');
-    expect(forwarded.url).toBe('https://realunit.app/invite/AB12CD');
-    // The fallback has to carry the cleaned headers, not the original ones.
-    expect(forwarded.headers.get('range')).toBeNull();
-    expect(forwarded.headers.get('if-none-match')).toBeNull();
-    expect(forwarded.headers.get('accept-language')).toBe('de-CH');
-    // The rebuilt request carries no body, so it must not announce one.
-    expect(forwarded.headers.get('content-length')).toBeNull();
-    expect(forwarded.headers.get('content-type')).toBeNull();
-    expect(res.status).toBe(200);
-    expect(await res.text()).toContain('RealUnit — Einladung AB12CD');
-  });
-
-  test('a status that must not carry a body is passed on instead of throwing', async () => {
-    // Pairing 204, 205 or 304 with a body throws, which would turn such an
-    // answer into a 500.
-    for (const status of [204, 205, 304]) {
-      const ctx = context({ url: 'https://realunit.app/invite/AB12CD', status });
-      let upstream;
-      ctx.next = () => {
-        upstream = new Response(null, {
-          status,
-          headers: new Headers({
-            'content-type': 'text/html; charset=utf-8',
-            etag: 'W/"the-one-it-was-matched-on"',
-            ...SITE_HEADERS,
-          }),
-        });
-        return Promise.resolve(upstream);
-      };
-      const res = await onRequest(ctx);
-      // The origin's own answer, like the other pass-through branches.
-      expect(res).toBe(upstream);
-      expect(res.status).toBe(status);
-      expect(res.body).toBeNull();
-      // A 304 has to keep the validator it was matched on, and none of these
-      // carries a representation this pass could rewrite.
-      expect(res.headers.get('etag')).toBe('W/"the-one-it-was-matched-on"');
-    }
-  });
-
-  test('the length, encoding, validators and range are dropped after a rewrite', async () => {
-    // A stale validator is worse than none: a conditional request would be
-    // answered 304 against a document the client never received.
-    const ctx = context({ url: 'https://realunit.app/invite/AB12CD' });
-    ctx.next = () => {
-      const res = new Response(SHELL, {
-        status: 404,
-        statusText: 'Not Found',
-        headers: new Headers({
-          'content-type': 'text/html; charset=utf-8',
-          'content-length': String(SHELL_BYTES),
-          etag: 'W/"before-the-rewrite"',
-          'last-modified': 'Tue, 09 Sep 2026 00:00:00 GMT',
-          'content-range': 'bytes 0-99/4162',
-          'accept-ranges': 'bytes',
-          // The body left here decoded, so a carried-over encoding would be
-          // wrong whatever the origin declared.
-          'content-encoding': 'gzip',
-          // Not observed on this deploy, dropped for the same reason as the
-          // validators: they describe bytes this pass replaces.
-          'content-digest': 'sha-256=:before:',
-          'repr-digest': 'sha-256=:before:',
-          digest: 'sha-256=before',
-          'content-md5': 'before',
-          ...SITE_HEADERS,
-        }),
-      });
-      return Promise.resolve(res);
-    };
-    const res = await onRequest(ctx);
-    expect(res.status).toBe(200);
-    for (const stale of [
-      'content-length',
-      'content-encoding',
-      'etag',
-      'last-modified',
-      'content-range',
-      'accept-ranges',
-      'content-digest',
-      'repr-digest',
-      'digest',
-      'content-md5',
-    ]) {
-      expect(res.headers.get(stale)).toBeNull();
-    }
-    // The ones the rewrite does not invalidate stay.
-    for (const [name, value] of Object.entries(SITE_HEADERS)) {
-      expect(res.headers.get(name)).toBe(value);
-    }
-  });
-
-  test('a partial answer is passed on instead of being rewritten', async () => {
-    // The body is a fragment, so injecting into it and dropping the range
-    // metadata would produce a 206 that describes nothing.
-    let partialUpstream;
-    const partial = (method) => {
-      const ctx = context({ url: 'https://realunit.app/invite/AB12CD', status: 206, method });
-      // The realistic case: a partial view of the landing page itself. A body
-      // that is not the shell would be handed on by the marker guard anyway,
-      // and would not prove this guard does anything.
-      ctx.next = () => {
-        partialUpstream = new Response(SHELL, {
-          status: 206,
-          statusText: 'Partial Content',
-          headers: new Headers({
-            'content-type': 'text/html; charset=utf-8',
-            // Real byte counts: .length counts UTF-16 units, and a range has
-            // to describe bytes of something that exists.
-            'content-length': String(SHELL_BYTES),
-            'content-range': `bytes 0-${SHELL_BYTES - 1}/${SHELL_BYTES}`,
-            etag: 'W/"the-whole-thing"',
-            ...SITE_HEADERS,
-          }),
-        });
-        return Promise.resolve(partialUpstream);
-      };
-      return onRequest(ctx);
-    };
-
-    const res = await partial('GET');
-    // The origin's own answer on the GET path, as on the other branches.
-    expect(res).toBe(partialUpstream);
-    expect(res.status).toBe(206);
-    // Handed on as it came: not rewritten, though the body is the shell.
-    expect(await res.text()).toBe(SHELL);
-    expect(res.headers.get('content-length')).toBe(String(SHELL_BYTES));
-    // Nothing was rewritten, so the range metadata and the validator still
-    // describe what the origin sent.
-    expect(res.headers.get('content-range')).toBe(`bytes 0-${SHELL_BYTES - 1}/${SHELL_BYTES}`);
-    expect(res.headers.get('etag')).toBe('W/"the-whole-thing"');
-
-    // A HEAD on the same answer keeps the status and the headers, and drops
-    // only the body.
-    const head = await partial('HEAD');
-    expect(head.status).toBe(206);
-    expect(head.statusText).toBe('Partial Content');
-    expect(head.body).toBeNull();
-    expect(head.headers.get('content-length')).toBe(String(SHELL_BYTES));
-    expect(head.headers.get('content-range')).toBe(`bytes 0-${SHELL_BYTES - 1}/${SHELL_BYTES}`);
-    expect(head.headers.get('etag')).toBe('W/"the-whole-thing"');
-  });
-
-  // The origin's own answer for the two cases below. The GET case can require
-  // that this very object comes back, which no look-alike would satisfy; the
-  // HEAD case cannot, because a body-less answer has to be a new object, so it
-  // compares the whole status and header set instead.
-  function notFoundUpstream(method) {
-    const ctx = context({ url: 'https://realunit.app/invite/AB12CD', method });
-    let upstream;
-    ctx.next = (request) => {
-      // The recorder the default next() provides, kept: the HEAD case has to
-      // show that a GET-equivalent was asked for.
-      ctx.forwarded.push(request || ctx.request);
-      upstream = new Response(NOT_FOUND_PAGE, {
-        status: 404,
-        statusText: 'Not Found',
-        headers: new Headers({
-          'content-type': 'text/html; charset=utf-8',
-          'content-length': String(NOT_FOUND_BYTES),
-          'content-encoding': 'gzip',
-          etag: 'W/"the-404-page"',
-          ...SITE_HEADERS,
-        }),
-      });
-      return Promise.resolve(upstream);
-    };
-    return { ctx, sent: () => upstream };
-  }
-
-  test('a real 404 page on a landing path keeps saying 404', async () => {
-    // A broken deploy has to stay visibly broken rather than look healthy.
-    const { ctx, sent } = notFoundUpstream('GET');
-    const res = await onRequest(ctx);
-    expect(res.status).toBe(404);
-    // Untouched status keeps its reason phrase.
-    expect(res.statusText).toBe('Not Found');
-    // Handed on as the origin's own answer, not rebuilt from its text: that is
-    // what keeps the encoding and the validator describing the actual bytes.
-    expect(res).toBe(sent());
-    expect(res.headers.get('content-encoding')).toBe('gzip');
-    expect(res.headers.get('etag')).toBe('W/"the-404-page"');
-    // And an untouched page keeps its own copy: rewriting the 404 page's title
-    // into an invitation would misdescribe what the visitor is looking at.
-    expect(await res.text()).toBe(NOT_FOUND_PAGE);
-  });
-
-  test('a landing that was already found keeps its status and is still rewritten', async () => {
-    // The promotion is not the only thing this pass does. An answer that
-    // already said 200 still gets its tags written, so a change that handed
-    // those through untouched has somewhere to fail.
-    const res = await onRequest(context({ url: 'https://realunit.app/invite/', status: 200 }));
-    expect(res.status).toBe(200);
-    expect(res.statusText).toBe('OK');
-    expect(res.headers.get('content-length')).toBeNull();
-    // Measured: on this codeless landing the rewrite normalises the canonical
-    // and the two URL tags to the form without a trailing slash. The shell
-    // ships them with one, so this holds only if the rewrite actually ran.
-    const html = await res.text();
-    expect(html).toContain('rel="canonical" href="https://realunit.app/invite"');
-    expect(html).toContain('property="og:url" content="https://realunit.app/invite"');
-    expect(html).toContain('name="twitter:url" content="https://realunit.app/invite"');
-  });
-
-  test('a path the rewrite does not own is passed through untouched', async () => {
-    const ctx = context({ url: 'https://realunit.app/', status: 200 });
-    let upstream;
-    const inner = ctx.next;
-    ctx.next = async (request) => {
-      upstream = await inner(request);
-      return upstream;
-    };
-    const res = await onRequest(ctx);
-    // The origin's own answer, as on every other pass-through branch.
-    expect(res).toBe(upstream);
-    expect(await res.text()).toBe(SHELL);
-    // Passed through, so the header the rewrite would have dropped is still there.
-    expect(res.headers.get('content-length')).toBe(String(SHELL_BYTES));
-  });
-
-  test('HEAD answers like GET by asking for the GET-equivalent', async () => {
-    // A link checker sends HEAD first. A HEAD response has no body, and the
-    // body is what tells the landing shell from the site's 404 page — so the
-    // status has to come from a GET-equivalent lookup, or the same link would
-    // read as found by GET and as dead by HEAD.
-    const ctx = context({ url: 'https://realunit.app/invite/AB12CD', method: 'HEAD' });
-    const head = await onRequest(ctx);
-    const get = await onRequest(context({ url: 'https://realunit.app/invite/AB12CD' }));
-    expect(ctx.forwarded.map((r) => r.method)).toEqual(['GET']);
-    expect(head.status).toBe(get.status);
-    expect(head.status).toBe(200);
-    expect(head.statusText).toBe('');
-    // No body at all, not an empty one: `new Response('')` would still carry a
-    // stream, and text() cannot tell the two apart.
-    expect(head.body).toBeNull();
-    expect(await head.text()).toBe('');
-    for (const name of ['content-type', ...Object.keys(SITE_HEADERS)]) {
-      expect(head.headers.get(name)).toBe(get.headers.get(name));
-    }
-    expect(head.headers.get('content-length')).toBeNull();
-  });
-
-  test('a plain GET with Range is forwarded without it', async () => {
-    // This pass rewrites the whole document, so a partial representation is
-    // never useful: it would be injected into a fragment and returned under a
-    // Content-Range describing the bytes before the rewrite.
-    const ctx = context({
-      url: 'https://realunit.app/invite/AB12CD',
-      requestHeaders: { range: 'bytes=0-99', 'if-range': 'W/"abc"' },
-    });
-    const res = await onRequest(ctx);
-    const [forwarded] = ctx.forwarded;
-    expect(forwarded.method).toBe('GET');
-    expect(forwarded.headers.get('range')).toBeNull();
-    expect(forwarded.headers.get('if-range')).toBeNull();
-    expect(res.status).toBe(200);
-    expect(await res.text()).toContain('RealUnit — Einladung AB12CD');
-  });
-
-  test('the GET-equivalent drops Range and keeps the unrelated headers', async () => {
-    // A HEAD carrying Range would otherwise come back as 206, whose body is not
-    // the landing shell — the status would neither be promoted nor mean what
-    // the client asked for. Headers unrelated to choosing the representation
-    // are kept; the conditional ones are covered by their own case above.
-    const ctx = context({
-      url: 'https://realunit.app/invite/AB12CD',
-      method: 'HEAD',
-      requestHeaders: {
-        range: 'bytes=0-99',
-        'if-range': 'W/"abc"',
-        'accept-language': 'en-GB',
-        'user-agent': 'link-checker/1.0',
-      },
-    });
-    const res = await onRequest(ctx);
-    const [forwarded] = ctx.forwarded;
-    expect(forwarded.method).toBe('GET');
-    expect(forwarded.headers.get('range')).toBeNull();
-    expect(forwarded.headers.get('if-range')).toBeNull();
-    expect(forwarded.headers.get('accept-language')).toBe('en-GB');
-    expect(forwarded.headers.get('user-agent')).toBe('link-checker/1.0');
-    expect(forwarded.url).toBe(ctx.request.url);
-    // And the answer is the whole document, not a partial one: stripping the
-    // header would mean little if the response were still treated as a 206.
-    expect(res.status).toBe(200);
-    expect(res.statusText).toBe('');
-    expect(res.body).toBeNull();
-  });
-
-  test('a HEAD on a real 404 page keeps saying 404', async () => {
-    // The marker guard has to hold on the HEAD path too, not only on GET.
-    const { ctx, sent } = notFoundUpstream('HEAD');
-    const res = await onRequest(ctx);
-    expect(ctx.forwarded.map((r) => r.method)).toEqual(['GET']);
-    expect(res.status).toBe(404);
-    expect(res.statusText).toBe('Not Found');
-    expect(res.body).toBeNull();
-    // Only the body is left off; every header the origin sent is still there.
-    for (const [name, value] of sent().headers) {
-      expect(res.headers.get(name)).toBe(value);
-    }
-    expect([...res.headers.keys()].sort()).toEqual([...sent().headers.keys()].sort());
-  });
-
-  test('a HEAD on a response that is not HTML keeps its status and carries no body', async () => {
-    const ctx = context({
-      url: 'https://realunit.app/invite/AB12CD',
-      method: 'HEAD',
-      type: 'application/json',
-      body: '{}',
-    });
-    // Nothing was rewritten here, so every header still describes what the
-    // origin sent and must survive — the length included, which RFC 9110 wants
-    // a HEAD to carry as the GET would have.
-    ctx.next = () => {
-      const headers = new Headers({
-        'content-type': 'application/json',
-        'content-length': '2',
-        etag: 'W/"unchanged"',
-        'content-encoding': 'gzip',
-        ...SITE_HEADERS,
-      });
-      return Promise.resolve(new Response('{}', { status: 404, statusText: 'Not Found', headers }));
-    };
-    const res = await onRequest(ctx);
-    // Every header the origin sent survives, name for name — listing a few by
-    // hand would miss a regression that drops one nobody thought to name.
-    const sent = new Headers({
-      'content-type': 'application/json',
-      'content-length': '2',
-      etag: 'W/"unchanged"',
-      'content-encoding': 'gzip',
-      ...SITE_HEADERS,
-    });
-    for (const [name, value] of sent) {
-      expect(res.headers.get(name)).toBe(value);
-    }
-    expect([...res.headers.keys()].sort()).toEqual([...sent.keys()].sort());
-    expect(res.status).toBe(404);
-    expect(res.statusText).toBe('Not Found');
-    expect(res.body).toBeNull();
-    // The length still describes the representation a GET would have returned.
-    expect(res.headers.get('content-length')).toBe('2');
-    // This branch rebuilds the response too, so it has to carry the headers.
-    for (const [name, value] of Object.entries(SITE_HEADERS)) {
-      expect(res.headers.get(name)).toBe(value);
-    }
-  });
-
-  test('a method that is neither GET nor HEAD is passed through untouched', async () => {
-    const ctx = context({ url: 'https://realunit.app/invite/AB12CD', method: 'POST' });
-    let upstream;
-    ctx.next = () => {
-      upstream = new Response(SHELL, {
-        status: 404,
-        headers: new Headers({
-          'content-type': 'text/html; charset=utf-8',
-          'content-length': String(SHELL_BYTES),
-          etag: 'W/"untouched"',
-        }),
-      });
-      return Promise.resolve(upstream);
-    };
-    const res = await onRequest(ctx);
-    // The origin's own answer, as with the other pass-through branches.
-    expect(res).toBe(upstream);
-    expect(res.status).toBe(404);
-    expect(res.headers.get('etag')).toBe('W/"untouched"');
-    expect(await res.text()).toBe(SHELL);
-  });
-
-  test('a response that is not HTML is passed through untouched', async () => {
-    const ctx = context({ url: 'https://realunit.app/invite/AB12CD' });
-    let upstream;
-    ctx.next = () => {
-      upstream = new Response('{}', {
-        status: 404,
-        statusText: 'Not Found',
-        headers: new Headers({
-          'content-type': 'application/json',
-          'content-length': '2',
-          'content-encoding': 'gzip',
-          etag: 'W/"the-json"',
-          ...SITE_HEADERS,
-        }),
-      });
-      return Promise.resolve(upstream);
-    };
-    const res = await onRequest(ctx);
-    // The origin's own answer, not one rebuilt to look like it.
-    expect(res).toBe(upstream);
-    expect(res.status).toBe(404);
-    expect(await res.text()).toBe('{}');
-    expect(res.headers.get('content-encoding')).toBe('gzip');
-    expect(res.headers.get('etag')).toBe('W/"the-json"');
-  });
-
-  test('the marks have to be the attributes, not the words', async () => {
-    // A page that merely mentions state-loading is not a landing shell. A
-    // looser match would promote it from 404 to 200 and rewrite its title.
-    const mentionsIt =
-      '<html lang="de"><head><title>Seite nicht gefunden</title></head>' +
-      '<body><p>Der Abschnitt state-loading fehlt.</p></body></html>';
-    // And the exact attribute text, but in a comment rather than an element.
-    // With one mark this was the boundary the check could not see; the second
-    // mark closes it, and the assertion below is what holds that shut.
-    const quotesIt =
-      '<html lang="de"><head><title>Seite nicht gefunden</title></head>' +
-      '<body><!-- kein id="state-loading" hier --></body></html>';
-    const res = await onRequest(
-      context({ url: 'https://realunit.app/invite/AB12CD', body: mentionsIt }),
-    );
-    expect(res.status).toBe(404);
-    expect(await res.text()).toBe(mentionsIt);
-
-    // Both words as prose, without the attribute syntax: loosening the marks to
-    // bare words would accept this, and nothing else in the suite would notice.
-    const wordsOnly =
-      '<html lang="de"><head><title>Seite nicht gefunden</title></head>' +
-      '<body><p>state-loading und aria-busy sind hier nur Wörter.</p></body></html>';
-    const prose = await onRequest(
-      context({ url: 'https://realunit.app/invite/AB12CD', body: wordsOnly }),
-    );
-    expect(prose.status).toBe(404);
-    expect(await prose.text()).toBe(wordsOnly);
-
-    // Even the exact attribute in a comment is not enough on its own: the shell
-    // is recognised by two marks, and an error document does not arrive at both.
-    const quoted = await onRequest(
-      context({ url: 'https://realunit.app/invite/AB12CD', body: quotesIt }),
-    );
-    expect(quoted.status).toBe(404);
-    expect(await quoted.text()).toBe(quotesIt);
-  });
-
-  test('the marks the promotion keys on live where they have to', () => {
-    // The contract the promotion tests rely on, asserted against the shipped
-    // files rather than assumed.
-    for (const mark of ['id="state-loading"', 'aria-busy="true"']) {
-      expect(SHELL).toContain(mark);
-      expect(PROMO_SHELL).toContain(mark);
-      expect(NOT_FOUND_PAGE).not.toContain(mark);
-    }
-  });
-
-  test('of everything the site ships, only the two landings read as a shell', () => {
-    // The check is a substring test: it does not require the two marks to
-    // share an element, or to be in an element at all. What keeps that from
-    // mattering is this property, and it is worth asserting rather than
-    // describing — of every page the site ships, only the two the Function is
-    // routed to reach both marks. The account-merge and Aktionariat shells
-    // carry the id and no aria-busy; the 404 page carries neither. This goes
-    // red the day one of them gains the second mark, which is the day the
-    // guard would have to become a real parse.
-    // The inventory first, so that a walker which quietly stopped finding the
-    // other pages could not make the second assertion pass by having nothing
-    // left to disagree with.
-    const files = shippedHtml().sort();
-    expect(files).toEqual([
-      '404.html',
-      'account-merge/index.html',
-      'confirm-aktionariat/index.html',
-      'index.html',
-      'invite/index.html',
-      'promo/index.html',
-    ]);
-    expect(files.filter((file) => isLandingShell(page(file)))).toEqual([
-      'invite/index.html',
-      'promo/index.html',
-    ]);
-  });
-
-  test('a response with no content-type is passed through untouched', async () => {
-    // Constructing a Response from a string sets content-type on its own, so
-    // the header is removed again to reach the missing-header path.
-    const ctx = context({ url: 'https://realunit.app/invite/AB12CD' });
-    let upstream;
-    ctx.next = () => {
-      upstream = new Response(SHELL, { status: 404 });
-      upstream.headers.delete('content-type');
-      upstream.headers.set('etag', 'W/"no-type"');
-      return Promise.resolve(upstream);
-    };
-    const res = await onRequest(ctx);
-    // The origin's own answer again, not a look-alike.
-    expect(res).toBe(upstream);
-    expect(res.headers.get('content-type')).toBeNull();
-    expect(res.headers.get('etag')).toBe('W/"no-type"');
-    expect(res.status).toBe(404);
-    expect(await res.text()).toBe(SHELL);
-  });
-});
diff --git a/vitest.config.mjs b/vitest.config.mjs
index e66dd95..2369248 100644
--- a/vitest.config.mjs
+++ b/vitest.config.mjs
@@ -6,13 +6,10 @@ export default defineConfig({
     include: ['test/**/*.test.mjs'],
     coverage: {
       provider: 'v8',
-      // Three surfaces are measured: the extracted, side-effect-free browser
-      // logic, the library the Pages Function runs, and the Function entry
-      // point itself — which is not side-effect-free, but decides the status
-      // and headers every share crawler sees. The DOM/network glue in
-      // public/*.js is covered by the Playwright suite instead (see
-      // CONTRIBUTING.md).
-      include: ['public/js/lib/**/*.js', 'functions/lib/**/*.js', 'functions/_middleware.js'],
+      // Only the extracted, side-effect-free browser logic is unit-tested to
+      // 100%. The DOM/network glue in public/*.js is covered by the Playwright
+      // functional suite instead (see CONTRIBUTING.md).
+      include: ['public/js/lib/**/*.js', 'functions/lib/**/*.js'],
       // Report every matched file even if no test imports it, so a new, untested
       // public/js/lib/*.js drops coverage below 100% instead of silently passing.
       all: true,
@@ -37,15 +34,6 @@ export default defineConfig({
           branches: 87,
           statements: 98,
         },
-        // The Function entry point itself. It was unmeasured while it decided
-        // the status every share crawler sees, which is how a landing could
-        // answer 404 in production without a single test noticing.
-        'functions/_middleware.js': {
-          lines: 100,
-          functions: 100,
-          branches: 100,
-          statements: 100,
-        },
       },
     },
   },