diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d2719b1..e92aa5f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -9,7 +9,7 @@ This repo is the **realunit.app** website — public, static. See the
   `public/` ships verbatim to Cloudflare Pages — what you commit is what gets
   served. The one exception is the invite/promo HTML: `functions/_middleware.js`
   rewrites those bytes on the way out so crawlers see the code in
-  `apple-itunes-app`, `og:*` and the App Links before any script runs. Nothing
+  `apple-itunes-app`, `og:*` and the App Links before any script runs. The landing for a code-bearing path is served by that Function too, not by `_redirects`: `_routes.json` hands `/invite`, `/invite/*`, `/promo` and `/promo/*` to it first, so the 200-rewrites never run and the asset lookup behind `context.next()` answers the path as asked — `404`, with the site's own 404 page. The platform is therefore asked first and only its `404` is replaced: the shell is read from the asset binding by name (`env.ASSETS.fetch`), checked against the two landing marks `id="state-loading"` and `aria-busy="true"`, injected, and answered `200`, for `HEAD` as well as `GET`. Every other answer stands — `/invite/` and `/promo/` are real files served `200`, rewritten in place for a `GET`, and `/invite` and `/invite/index.html` keep the `308` that canonicalises them. A `HEAD` carries no body to recognise the shell in, so it reads the shell from the binding like the `404` case does and answers as the `GET` would, without a body. Without the binding, or when the file under that name is not the shell, the platform's answer stands rather than an invented one. Nothing
   else is transformed, and there is no server-side rendering. The dev dependencies exist **only** for the quality gates below
   (formatting, HTML validation, unit tests, screenshots); nothing compiles or
   bundles the site.
@@ -46,7 +46,8 @@ This repo is the **realunit.app** website — public, static. See the
   - Inline `style="…"` attributes and `<style>` blocks are fine (`style-src`
     allows `'unsafe-inline'`).
 - **Put the reusable, side-effect-free JS in `public/js/lib/`.** That is the only
-  code with a unit-coverage gate (see below); DOM/network glue stays in the
+  browser code with a unit-coverage gate (see below); `functions/_middleware.js`
+  and `functions/lib/**` have their own. DOM/network glue stays in the
   page-level scripts and is covered by the Playwright suite.
 - **Don't put mutable files under `public/assets/`.** That path has an immutable,
   one-year cache header — only content-hashed or otherwise stable-named assets
@@ -73,14 +74,14 @@ sanity-check anything touching scripts/images in the dev deployment.
 Every pull request must pass the gates below; CI runs them as required status
 checks.
 
-| Gate              | Command                 | What it enforces                                                                                                         |
-| ----------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------ |
-| Formatting        | `npm run format:check`  | Prettier formatting of the maintained code (the hand-written HTML pages are validated, not reformatted)                  |
-| HTML validity     | `npm run validate:html` | Valid markup on every page under `public/`                                                                               |
-| Site completeness | `npm run check:site`    | Every `<html lang>`, every internal link/asset resolves, and each glue script loads its `js/lib` core first              |
-| Unit coverage     | `npm run test:coverage` | 100% line/branch/function/statement coverage of the extracted browser logic (`public/js/lib/**`)                         |
-| Functional        | `npm run test:e2e`      | Playwright smoke + behavior suite (every page loads, platform detection, the full confirm flow)                          |
-| Visual regression | `npm run e2e:docker`    | Every view in the visual matrix (page × viewport × language × state) matches its committed baseline, then `check:visual` |
+| Gate              | Command                 | What it enforces                                                                                                                                                                                  |
+| ----------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Formatting        | `npm run format:check`  | Prettier formatting of the maintained code (the hand-written HTML pages are validated, not reformatted)                                                                                           |
+| HTML validity     | `npm run validate:html` | Valid markup on every page under `public/`                                                                                                                                                        |
+| Site completeness | `npm run check:site`    | Every `<html lang>`, every internal link/asset resolves, and each glue script loads its `js/lib` core first                                                                                       |
+| Unit coverage     | `npm run test:coverage` | 100% line/branch/function/statement coverage of the extracted browser logic (`public/js/lib/**`) and of `functions/_middleware.js`; `functions/lib/**` is ratcheted at the level it reaches today |
+| Functional        | `npm run test:e2e`      | Playwright smoke + behavior suite (every page loads, platform detection, the full confirm flow)                                                                                                   |
+| Visual regression | `npm run e2e:docker`    | Every view in the visual matrix (page × viewport × language × state) matches its committed baseline, then `check:visual`                                                                          |
 
 `npm run check` runs the first four locally in one go. The Playwright suites run
 against a local dev server (`test:e2e`); the visual gate runs in a pinned
diff --git a/README.md b/README.md
index ba7c321..724d5b2 100644
--- a/README.md
+++ b/README.md
@@ -45,7 +45,16 @@ uploaded to Cloudflare Pages.
   custom scheme; `twitter:app:country` is CH) are injected
   into the HTML bytes from the request URL (`functions/_middleware.js` on
   Cloudflare Pages, and the local dev-server) so Safari, Play, WhatsApp, X,
-  and share crawlers can snapshot them before JS. `og:title`, `og:description`,
+  and share crawlers can snapshot them before JS. The Function also serves the
+  landing for a code-bearing path: `_routes.json` claims `/invite`, `/invite/*`,
+  `/promo` and `/promo/*`, so the `_redirects` 200-rewrites never run and,
+  on a code-bearing path, `context.next()` answers with the site's 404 page. The platform is
+  asked first and only its `404` is replaced — the shell is read from the asset
+  binding by name, checked against the two landing marks, injected and answered
+  `200`. `/invite/` and `/promo/` are real files, rewritten in place for a
+  `GET`; a `HEAD` reads the shell from the binding like the `404` case, because
+  its answer carries no body to recognise the shell in. `/invite` and
+  `/invite/index.html` keep their `308`. `og:title`, `og:description`,
   and image alt name the campaign code; `?lang=en` sets English copy and `og:locale=en_GB`;
   invitee names wait for lookup JS. `/js/invite-banner.js` in `<head>`
   is the CSP-safe JS fallback — Cloudflare Pages CSP blocks inline `<script>`.
@@ -92,7 +101,10 @@ From v2 a build toolchain (Astro) is introduced; the plain-image landing stays t
 ## Testing
 
 The site still ships verbatim — the tooling is dev-only. Pure browser logic lives
-in `public/js/lib/**` and is unit-tested to 100% (Vitest + jsdom); the pages,
+in `public/js/lib/**` and is unit-tested to 100% (Vitest + jsdom), as is
+`functions/_middleware.js`, which decides which page a landing path is answered
+with; `functions/lib/**` is measured and ratcheted at the level it reaches
+today. The pages,
 platform detection and the full confirm flow are covered by Playwright
 (functional + screenshot regression). See [CONTRIBUTING](CONTRIBUTING.md#quality-gates)
 for the gate list and commands (`npm run check`, `npm run test:e2e`,
diff --git a/functions/_middleware.js b/functions/_middleware.js
index b1d59d2..19aa277 100644
--- a/functions/_middleware.js
+++ b/functions/_middleware.js
@@ -1,32 +1,173 @@
 /**
- * Rewrite invite/promo HTML so apple-itunes-app already carries
- * app-argument, og:url / canonical / twitter:url already name the
- * landing URL, og:title / twitter:title / og:description already name
- * the campaign code, ?lang=en already sets html lang / og:locale, and
- * Facebook App Links are present. Safari and share
- * crawlers snapshot those from the HTML bytes before
- * /js/invite-banner.js and invite.js run.
+ * Serve the invite and promo landings for the paths people actually share, and
+ * rewrite their metadata so a share crawler sees the campaign in the HTML
+ * bytes: apple-itunes-app already carries app-argument, og:url / canonical /
+ * twitter:url already name the landing URL, og:title / twitter:title /
+ * og:description already name the code, ?lang=en already sets html lang and
+ * og:locale, the Facebook App Links are present, and a code-bearing store
+ * hand-off names the code. Safari, Play and share crawlers can snapshot those
+ * before /js/invite-banner.js and invite.js run.
+ *
  * public/ stays generic; this is not a site-wide renderer.
  */
-import { injectLandingFromRequestUrl, shouldRewriteItunesBanner } from './lib/itunes-banner.js';
+import {
+  injectLandingFromRequestUrl,
+  isLandingShell,
+  shouldRewriteItunesBanner,
+} from './lib/itunes-banner.js';
+
+/**
+ * The shell each landing path is served from. `_redirects` names the same two
+ * files, but its 200-rewrites never run for these paths: `_routes.json` hands
+ * the request to this Function first, and the asset lookup behind
+ * context.next() resolves the path as asked rather than as rewritten.
+ *
+ * Measured on the deploy, with the three lookups side by side on
+ * /invite/AB12CD: context.next() answers 404 with the site's own 404 page,
+ * context.next() handed a request for /invite/index.html answers 308, and
+ * env.ASSETS.fetch() of that same file answers 200 with the shell. So the
+ * shell is read from the asset binding, by name.
+ */
+const LANDING_SHELL = { invite: '/invite/index.html', promo: '/promo/index.html' };
 
 export async function onRequest(context) {
   const url = new URL(context.request.url);
   if (!shouldRewriteItunesBanner(url.pathname)) {
     return context.next();
   }
-  const response = await context.next();
-  const type = response.headers.get('content-type') || '';
-  if (context.request.method !== 'GET' || !type.includes('text/html')) {
-    return response;
-  }
-  const html = await response.text();
-  const injected = injectLandingFromRequestUrl(html, context.request.url);
-  const headers = new Headers(response.headers);
-  headers.delete('content-length');
-  return new Response(injected, {
-    status: response.status,
-    statusText: response.statusText,
-    headers,
-  });
+  const method = context.request.method;
+  if (method !== 'GET' && method !== 'HEAD') {
+    return context.next();
+  }
+  // The platform's own answer first, because most of what it says is right and
+  // only one case is not. A real file under these paths comes back 200 — that
+  // is /invite/ and /promo/ themselves — and /invite/index.html comes back as
+  // the 308 that canonicalises it. The redirect stands as it is; the real file
+  // needs only its metadata written in. Only the code-bearing paths come back
+  // 404, because the 200-rewrite that was meant to resolve them never runs.
+  //
+  // A HEAD is the exception to the middle case: its answer carries no body, so
+  // the shell cannot be recognised in it. A HEAD that still has a 200 or a 404
+  // after the two guards below therefore takes the same route as that 404. A
+  // redirect and a non-HTML answer leave before those guards, whatever the
+  // method.
+  const platform = await context.next();
+  if (platform.status !== 200 && platform.status !== 404) {
+    return platform;
+  }
+  if (platform.status === 200 && !isHtml(platform.headers.get('content-type'))) {
+    // Some other asset under these paths. Not ours to rewrite.
+    return platform;
+  }
+  if (method === 'GET' && platform.status === 200) {
+    // The file is already the right one; what the URL supports has to be
+    // written into it, and its own status stays. A code can reach even this
+    // path as a query parameter, so nothing here assumes there is none. Read inside a
+    // guard for the same reason as the shell below: a body stream that fails
+    // would take the Function down, and a Function that throws makes Pages
+    // serve the assets directly.
+    let html;
+    try {
+      html = await platform.clone().text();
+    } catch {
+      return platform;
+    }
+    if (!isLandingShell(html)) {
+      return platform;
+    }
+    return answer(html, platform.headers, context.request, method, platform.status);
+  }
+  // What is left is a 404 to replace, or a HEAD. A HEAD answer carries no
+  // body, and the body is what tells the landing shell from any other page —
+  // deciding from an empty one would hand back the file's own validators
+  // beside a GET that had them stripped. Both cases therefore read the shell
+  // from the binding, and both answer as the GET would — a HEAD without a
+  // body, which the platform expects of it anyway.
+  const assets = context.env && context.env.ASSETS;
+  if (!assets) {
+    // No binding, no shell to read. The platform's answer stands: it is the
+    // wrong page, but it is not one this pass invented.
+    return platform;
+  }
+  const shellPath = url.pathname.startsWith('/promo') ? LANDING_SHELL.promo : LANDING_SHELL.invite;
+  // Always a GET, whatever the client sent: the body is what tells the landing
+  // shell from any other file under that name, and a HEAD would come back
+  // without one. Asked in a try, because a binding that rejects would
+  // otherwise take the whole Function down — and a Function that throws makes
+  // Pages serve the assets directly, which is the very answer this replaces.
+  let shell;
+  let html;
+  try {
+    shell = await assets.fetch(new Request(new URL(shellPath, url).toString()));
+    if (!shell.ok) {
+      return platform;
+    }
+    html = await shell.text();
+  } catch {
+    return platform;
+  }
+  if (!isLandingShell(html)) {
+    // The file under that name is not the landing shell any more. Serving it
+    // as one would describe something the visitor is not looking at.
+    return platform;
+  }
+  // The headers describe the URL that was asked for, so they come from the
+  // platform's answer wherever that answer was the file itself —
+  // public/_headers matches on the request path, and the shell's own answer was
+  // matched on /invite/index.html. Only when the platform answered something
+  // other than 200 does the shell's set stand in.
+  const source = platform.status === 200 ? platform.headers : shell.headers;
+  return answer(html, source, context.request, method);
+}
+
+/** Whether the answer is HTML at all, read as a media type and not a substring. */
+function isHtml(contentType) {
+  return (
+    String(contentType || '')
+      .split(';')[0]
+      .trim()
+      .toLowerCase() === 'text/html'
+  );
+}
+
+/**
+ * The landing with injectLandingFromRequestUrl applied. What that writes
+ * depends on the URL — the campaign tags and the store hand-off on a code, the
+ * English copy and locale on ?lang=en — and functions/lib/itunes-banner.js is
+ * where each of those decisions lives.
+ */
+function answer(html, sourceHeaders, request, method, status = 200) {
+  const injected = injectLandingFromRequestUrl(html, request.url);
+  // The source's headers, minus the ones the rewrite invalidates. They have to
+  // be carried: public/_headers is applied to the asset, not to an answer this
+  // Function builds, so starting from an empty set drops the site's
+  // Content-Security-Policy, X-Frame-Options, X-Content-Type-Options,
+  // Referrer-Policy and Cache-Control from every landing. Measured on a
+  // preview deploy, with and without the copy.
+  //
+  // What must not be carried is anything describing the bytes before the
+  // injection: the length, the content coding — text() decoded the body and
+  // what leaves here is plain text — both validators, and the integrity
+  // digests of RFC 9530 and its predecessors. A stale validator is the one
+  // that does damage: a conditional request would be answered 304 against a
+  // document the client never received.
+  const headers = new Headers(sourceHeaders);
+  for (const stale of [
+    'content-length',
+    'content-encoding',
+    'etag',
+    'last-modified',
+    'content-digest',
+    'repr-digest',
+    'digest',
+    'content-md5',
+  ]) {
+    headers.delete(stale);
+  }
+  headers.set('content-type', 'text/html; charset=utf-8');
+  // A landing that exists is answered as found. For a code-bearing path that
+  // is the whole point: WhatsApp, iMessage, Slack, Facebook and X drop a 404
+  // before they read the tags just written. A GET on a real file keeps the
+  // status the platform gave it, which is the same 200.
+  return new Response(method === 'HEAD' ? null : injected, { status, headers });
 }
diff --git a/functions/lib/itunes-banner.js b/functions/lib/itunes-banner.js
index 6711830..8458f47 100644
--- a/functions/lib/itunes-banner.js
+++ b/functions/lib/itunes-banner.js
@@ -81,6 +81,32 @@ function capCode(raw) {
   return code;
 }
 
+/**
+ * The two marks the landing shells carry in one element and no other page the
+ * site ships carries together: the loading section's id and its aria-busy.
+ */
+const LANDING_MARKS = ['id="state-loading"', 'aria-busy="true"'];
+
+/**
+ * Whether these bytes are a landing shell rather than some other page.
+ *
+ * Two marks rather than one, because a single substring is a thin thing to
+ * serve a page on: an error document that happened to carry the id — in a
+ * comment, in a script, in a copied snippet — would be dressed up as an
+ * invitation.
+ *
+ * This stays a substring test, so it does not require the two marks to sit in
+ * the same element, or in an element at all. What makes two of them enough is
+ * a property of the site rather than of this function, and the property is
+ * held by a test: of every page the repo ships, only the two landings reach
+ * both marks. The 404 page carries neither, and the two other shells that
+ * carry the id — account-merge and confirm-aktionariat — carry no aria-busy.
+ * test/middleware.test.mjs walks public/ and pins exactly that.
+ */
+export function isLandingShell(html) {
+  return typeof html === 'string' && LANDING_MARKS.every((mark) => html.includes(mark));
+}
+
 export function shouldRewriteItunesBanner(pathname) {
   const path = String(pathname || '');
   if (/\.(js|css|map|png|svg|json|jpg|jpeg|webp|ico|txt|xml)$/i.test(path)) {
diff --git a/test/middleware.test.mjs b/test/middleware.test.mjs
new file mode 100644
index 0000000..2b38783
--- /dev/null
+++ b/test/middleware.test.mjs
@@ -0,0 +1,553 @@
+import { readdirSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { describe, expect, test } from 'vitest';
+import { onRequest } from '../functions/_middleware.js';
+import { isLandingShell } from '../functions/lib/itunes-banner.js';
+
+// The real files, not a hand-written stand-in. The pass keys on marks that
+// live in the landing shells and must never appear in the site's 404 page; a
+// synthetic fixture would keep passing after someone moved one of them, and
+// production would go back to serving the 404 page with nothing going red.
+const page = (name) => readFileSync(resolve('public', name), 'utf8');
+
+// Every page the site ships, named the way page() wants them.
+const shippedHtml = (dir = 'public') =>
+  readdirSync(resolve(dir), { withFileTypes: true }).flatMap((entry) => {
+    const path = `${dir}/${entry.name}`;
+    if (entry.isDirectory()) return shippedHtml(path);
+    return entry.name.endsWith('.html') ? [path.slice('public/'.length)] : [];
+  });
+
+const SHELL = page('invite/index.html');
+const PROMO_SHELL = page('promo/index.html');
+const NOT_FOUND_PAGE = page('404.html');
+// .length counts UTF-16 units; a Content-Length counts bytes, and these pages
+// carry multi-byte characters.
+const bytes = (text) => new TextEncoder().encode(text).length;
+
+// The platform's own answer on a code-bearing landing path, which is what this
+// pass exists to replace: `_routes.json` hands the request here first, so the
+// 200-rewrite in `_redirects` never runs and the asset lookup answers with the
+// 404 page. /invite/ and /promo/ are real files and are answered 200; the
+// cases that need that override this.
+function notFoundAnswer(method) {
+  return new Response(method === 'HEAD' ? null : NOT_FOUND_PAGE, {
+    status: 404,
+    statusText: 'Not Found',
+    headers: new Headers({
+      'content-type': 'text/html; charset=utf-8',
+      'content-length': String(bytes(NOT_FOUND_PAGE)),
+      etag: 'W/"the-404-page"',
+    }),
+  });
+}
+
+function context({
+  url,
+  method = 'GET',
+  shell = SHELL,
+  shellStatus = 200,
+  shellHeaders = {},
+  withAssets = true,
+  platformAnswer: makePlatform = notFoundAnswer,
+} = {}) {
+  const nextCalls = [];
+  const assetFetches = [];
+  const assetMethods = [];
+  let platform;
+  const ctx = {
+    request: new Request(url, { method }),
+    next: (request) => {
+      nextCalls.push(request);
+      platform = makePlatform(method);
+      return Promise.resolve(platform);
+    },
+    nextCalls,
+    assetFetches,
+    assetMethods,
+    platform: () => platform,
+  };
+  if (withAssets) {
+    ctx.env = {
+      ASSETS: {
+        fetch: (request) => {
+          assetFetches.push(request.url);
+          assetMethods.push(request.method);
+          // Path-aware, so that asking for the wrong shell returns the wrong
+          // page rather than the one the case expects anyway.
+          const file = request.url.endsWith('/promo/index.html') ? PROMO_SHELL : shell;
+          return Promise.resolve(
+            new Response(shellStatus === 200 ? file : 'no such asset', {
+              status: shellStatus,
+              headers: new Headers({
+                // Without the charset, so that the assertion on the answer's
+                // content-type fails if the pass stops setting it.
+                'content-type': 'text/html',
+                'content-length': String(bytes(file)),
+                ...shellHeaders,
+              }),
+            }),
+          );
+        },
+      },
+    };
+  }
+  return ctx;
+}
+
+describe('the landing middleware', () => {
+  test('an invite link is answered 200 with the landing and its code', async () => {
+    // The reason this pass exists. Before it, `/invite/<code>` was answered
+    // with the site's 404 page — dressed in the campaign's title by the older
+    // rewrite, but still the wrong page and still a 404, which WhatsApp,
+    // iMessage, Slack, Facebook and X drop before reading any of the tags.
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD' });
+    const res = await onRequest(ctx);
+    expect(res.status).toBe(200);
+    expect(ctx.assetFetches).toEqual(['https://realunit.app/invite/index.html']);
+    // The platform is asked first and with no argument of ours; its 404 is
+    // what says the rewrite never resolved this path.
+    expect(ctx.nextCalls).toEqual([undefined]);
+    const html = await res.text();
+    expect(html).toContain('RealUnit — Einladung AB12CD');
+    // The tag itself is in both shells already, so the value is what proves
+    // the injection ran.
+    expect(html).toContain('<meta property="og:title" content="RealUnit — Einladung AB12CD"');
+    // The shell it was built from, not the 404 page.
+    expect(isLandingShell(html)).toBe(true);
+  });
+
+  test('the shell is always asked for with GET, whatever the client sent', async () => {
+    // The body is what tells the landing shell from any other file under that
+    // name. A HEAD forwarded to the binding would come back without one, the
+    // marks would not be found, and the answer would fall back to the 404 the
+    // platform gave — which is the bug this pass exists to remove.
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD', method: 'HEAD' });
+    const res = await onRequest(ctx);
+    expect(ctx.assetMethods).toEqual(['GET']);
+    expect(res.status).toBe(200);
+  });
+
+  test('a shell whose body cannot be read leaves the platform answer standing', async () => {
+    // The status can be fine and the stream still fail. Reading it outside the
+    // guard would take the Function down, and a Function that throws makes
+    // Pages serve the assets directly — the very answer this replaces.
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD' });
+    ctx.env = {
+      ASSETS: {
+        fetch: () =>
+          Promise.resolve({
+            ok: true,
+            status: 200,
+            headers: new Headers(),
+            text: () => Promise.reject(new Error('the stream gave up')),
+          }),
+      },
+    };
+    const res = await onRequest(ctx);
+    expect(res).toBe(ctx.platform());
+    expect(res.status).toBe(404);
+  });
+
+  test('a binding that rejects leaves the platform answer standing', async () => {
+    // A Function that throws makes Pages serve the assets directly, which is
+    // exactly the wrong answer this pass replaces. Measured once, the hard way.
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD' });
+    ctx.env = { ASSETS: { fetch: () => Promise.reject(new Error('binding is having a day')) } };
+    const res = await onRequest(ctx);
+    expect(res).toBe(ctx.platform());
+    expect(res.status).toBe(404);
+  });
+
+  test('a promo link is served from the promo shell, not the invite one', async () => {
+    const ctx = context({ url: 'https://realunit.app/promo/EVT1' });
+    const res = await onRequest(ctx);
+    expect(ctx.assetFetches).toEqual(['https://realunit.app/promo/index.html']);
+    expect(res.status).toBe(200);
+    // The code alone would also appear on an invitation-shaped injection; the
+    // kind is what this case is about.
+    expect(await res.text()).toContain('RealUnit — Promo-Code EVT1');
+  });
+
+  test('a HEAD gets the same status and no body', async () => {
+    // A link checker sends HEAD first. It has to read what a GET would, or the
+    // same link is found by one and dead by the other.
+    const head = await onRequest(
+      context({ url: 'https://realunit.app/invite/AB12CD', method: 'HEAD' }),
+    );
+    const get = await onRequest(context({ url: 'https://realunit.app/invite/AB12CD' }));
+    expect(head.status).toBe(get.status);
+    expect(head.status).toBe(200);
+    // No body at all, not an empty one: `new Response('')` still carries a
+    // stream, and text() cannot tell the two apart.
+    expect(head.body).toBeNull();
+    // The value, not only that the two agree: a wrong type on both would
+    // otherwise pass.
+    expect(head.headers.get('content-type')).toBe('text/html; charset=utf-8');
+    expect(head.headers.get('content-type')).toBe(get.headers.get('content-type'));
+  });
+
+  test('the whole request URL reaches the injection, not just its path', async () => {
+    // ?lang=en is what switches the copy and og:locale, and it lives in the
+    // query. Passing the pathname alone would still produce a landing, in the
+    // wrong language, with nothing here to notice.
+    const res = await onRequest(context({ url: 'https://realunit.app/invite/AB12CD?lang=en' }));
+    const html = await res.text();
+    expect(res.status).toBe(200);
+    expect(html).toContain('RealUnit — Invitation AB12CD');
+    // The shell already carries en_GB as the alternate locale, so only the
+    // main tag and the document language tell the injection apart from it.
+    expect(html).toContain('<meta property="og:locale" content="en_GB"');
+    expect(html).not.toContain('<meta property="og:locale" content="de_CH"');
+    expect(html).toContain('<html lang="en"');
+  });
+
+  test('the headers the rewrite invalidates are dropped', async () => {
+    // Each of these described the bytes before the injection. A length that no
+    // longer matches, a coding the decoded body no longer has, a validator for
+    // a document the client never received, a digest of other bytes.
+    const ctx = context({
+      url: 'https://realunit.app/invite/AB12CD',
+      shellHeaders: {
+        'cache-control': 'public, max-age=60',
+        'content-security-policy': "default-src 'self'",
+        'content-encoding': 'gzip',
+        etag: 'W/"the-shell"',
+        'last-modified': 'Tue, 09 Sep 2026 00:00:00 GMT',
+        'content-digest': 'sha-256=:abc:',
+        'repr-digest': 'sha-256=:abc:',
+        digest: 'sha-256=abc',
+        'content-md5': 'abc',
+      },
+    });
+    const res = await onRequest(ctx);
+    for (const name of [
+      'content-length',
+      'content-encoding',
+      'etag',
+      'last-modified',
+      'content-digest',
+      'repr-digest',
+      'digest',
+      'content-md5',
+    ]) {
+      expect(res.headers.get(name)).toBeNull();
+    }
+    expect(res.headers.get('content-type')).toBe('text/html; charset=utf-8');
+    // And the ones that still describe the answer are carried: public/_headers
+    // is applied to the asset, not to what this Function builds, so dropping
+    // them would take the site's security headers off every landing.
+    expect(res.headers.get('cache-control')).toBe('public, max-age=60');
+    expect(res.headers.get('content-security-policy')).toBe("default-src 'self'");
+  });
+
+  test('a path the pass does not own is handed straight on', async () => {
+    const ctx = context({ url: 'https://realunit.app/js/invite-banner.js' });
+    const res = await onRequest(ctx);
+    expect(res).toBe(ctx.platform());
+    expect(ctx.assetFetches).toEqual([]);
+    // Handed on as it came, with no argument of ours.
+    expect(ctx.nextCalls).toEqual([undefined]);
+  });
+
+  test('a method other than GET or HEAD is handed straight on', async () => {
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD', method: 'POST' });
+    const res = await onRequest(ctx);
+    expect(res).toBe(ctx.platform());
+    expect(ctx.assetFetches).toEqual([]);
+    expect(ctx.nextCalls).toEqual([undefined]);
+  });
+
+  test('without the asset binding the request is handed on, not invented', async () => {
+    // The binding is what reaches the shell. Without it there is nothing
+    // truthful to answer with, so the platform's own answer stands.
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD', withAssets: false });
+    const res = await onRequest(ctx);
+    expect(res).toBe(ctx.platform());
+    expect(res.status).toBe(404);
+    expect(ctx.nextCalls).toEqual([undefined]);
+  });
+
+  test('a shell that cannot be read leaves the platform answer standing', async () => {
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD', shellStatus: 404 });
+    const res = await onRequest(ctx);
+    expect(res).toBe(ctx.platform());
+    expect(res.status).toBe(404);
+    expect(await res.text()).toBe(NOT_FOUND_PAGE);
+  });
+
+  test('a file under the shell name that is not the shell is refused', async () => {
+    // A broken deploy that puts the 404 page at invite/index.html must not be
+    // served as an invitation: the visitor would be told about something they
+    // are not looking at.
+    const ctx = context({ url: 'https://realunit.app/invite/AB12CD', shell: NOT_FOUND_PAGE });
+    const res = await onRequest(ctx);
+    expect(res).toBe(ctx.platform());
+    expect(res.status).toBe(404);
+  });
+
+  test('the codeless landing is rewritten in place, not fetched again', async () => {
+    // /invite/ is a real file, so the platform already answers it correctly.
+    // Only the metadata has to be written in; the asset binding is not touched
+    // and the status the platform gave stays.
+    const ctx = context({
+      url: 'https://realunit.app/invite/?lang=en',
+      platformAnswer: () =>
+        new Response(SHELL, {
+          status: 200,
+          headers: new Headers({
+            'content-type': 'text/html; charset=utf-8',
+            'content-length': String(bytes(SHELL)),
+            etag: 'W/"the-shell"',
+          }),
+        }),
+    });
+    const res = await onRequest(ctx);
+    expect(ctx.assetFetches).toEqual([]);
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    // Asked in English, because on the German codeless landing the injection
+    // writes back what the shell already said and nothing here could tell the
+    // two apart. The locale and the document language do change.
+    expect(html).toContain('<meta property="og:locale" content="en_GB"');
+    expect(html).not.toContain('<meta property="og:locale" content="de_CH"');
+    expect(html).toContain('<html lang="en"');
+    expect(isLandingShell(html)).toBe(true);
+    // Rewritten, so the headers that described the bytes before it are gone.
+    expect(res.headers.get('etag')).toBeNull();
+    expect(res.headers.get('content-length')).toBeNull();
+  });
+
+  test('the in-place rewrite drops the same headers the shell route does', async () => {
+    // The stale list has to hold on both routes, not only on the one that
+    // reads the shell from the binding.
+    const ctx = context({
+      url: 'https://realunit.app/invite/',
+      platformAnswer: () =>
+        new Response(SHELL, {
+          status: 200,
+          headers: new Headers({
+            'content-type': 'text/html',
+            'content-length': String(bytes(SHELL)),
+            'content-encoding': 'gzip',
+            etag: 'W/"the-shell"',
+            'last-modified': 'Tue, 09 Sep 2026 00:00:00 GMT',
+            'content-digest': 'sha-256=:abc:',
+            'repr-digest': 'sha-256=:abc:',
+            digest: 'sha-256=abc',
+            'content-md5': 'abc',
+            'content-security-policy': "default-src 'self'",
+          }),
+        }),
+    });
+    const res = await onRequest(ctx);
+    expect(res.status).toBe(200);
+    for (const name of [
+      'content-length',
+      'content-encoding',
+      'etag',
+      'last-modified',
+      'content-digest',
+      'repr-digest',
+      'digest',
+      'content-md5',
+    ]) {
+      expect(res.headers.get(name)).toBeNull();
+    }
+    expect(res.headers.get('content-type')).toBe('text/html; charset=utf-8');
+    expect(res.headers.get('content-security-policy')).toBe("default-src 'self'");
+  });
+
+  test('a platform body that cannot be read leaves its answer standing', async () => {
+    const ctx = context({
+      url: 'https://realunit.app/invite/',
+      platformAnswer: () => ({
+        status: 200,
+        headers: new Headers({ 'content-type': 'text/html; charset=utf-8' }),
+        clone: () => ({ text: () => Promise.reject(new Error('the stream gave up')) }),
+      }),
+    });
+    const res = await onRequest(ctx);
+    expect(res).toBe(ctx.platform());
+    expect(res.status).toBe(200);
+    expect(ctx.assetFetches).toEqual([]);
+  });
+
+  test('a HEAD on the codeless landing answers as the GET does', async () => {
+    // A HEAD answer carries no body, so the shell cannot be recognised in it.
+    // Deciding from the empty one handed back the file's own ETag and length
+    // beside a GET that had both stripped — a client could then be answered
+    // 304 against a document it never received.
+    const shellPlatform = (method) =>
+      new Response(method === 'HEAD' ? null : SHELL, {
+        status: 200,
+        headers: new Headers({
+          'content-type': 'text/html; charset=utf-8',
+          'content-length': String(bytes(SHELL)),
+          etag: 'W/"the-shell"',
+          'cache-control': 'public, max-age=60',
+        }),
+      });
+    const headCtx = context({
+      url: 'https://realunit.app/invite/',
+      method: 'HEAD',
+      platformAnswer: shellPlatform,
+    });
+    const head = await onRequest(headCtx);
+    const getCtx = context({ url: 'https://realunit.app/invite/', platformAnswer: shellPlatform });
+    const get = await onRequest(getCtx);
+    expect(head.status).toBe(get.status);
+    expect(head.status).toBe(200);
+    expect(head.body).toBeNull();
+    for (const name of ['etag', 'content-length']) {
+      expect(head.headers.get(name)).toBeNull();
+      expect(get.headers.get(name)).toBeNull();
+    }
+    expect(head.headers.get('content-type')).toBe('text/html; charset=utf-8');
+    expect(head.headers.get('cache-control')).toBe('public, max-age=60');
+    expect(head.headers.get('cache-control')).toBe(get.headers.get('cache-control'));
+    // And the two got there differently, which is the point of the case: the
+    // GET is rewritten in place, the HEAD reads the shell from the binding.
+    expect(headCtx.assetFetches).toEqual(['https://realunit.app/invite/index.html']);
+    expect(getCtx.assetFetches).toEqual([]);
+  });
+
+  test("the platform's redirect on /invite/index.html is left alone", async () => {
+    // Pages canonicalises the explicit file name to the directory. That is a
+    // 308 and not this pass's business; answering it with the landing instead
+    // would quietly create a second URL for the same page.
+    let redirect;
+    const ctx = context({
+      url: 'https://realunit.app/invite/index.html',
+      platformAnswer: () => {
+        redirect = new Response(null, {
+          status: 308,
+          headers: new Headers({ location: '/invite/' }),
+        });
+        return redirect;
+      },
+    });
+    const res = await onRequest(ctx);
+    expect(res).toBe(redirect);
+    expect(res.status).toBe(308);
+    expect(res.headers.get('location')).toBe('/invite/');
+    expect(ctx.assetFetches).toEqual([]);
+  });
+
+  test('the redirect and the non-HTML answer are left alone for a HEAD too', async () => {
+    // Both leave before the branch that reads the shell, whatever the method —
+    // which is the bound on "a HEAD takes the same route as the 404".
+    let redirect;
+    const redirectCtx = context({
+      url: 'https://realunit.app/invite/index.html',
+      method: 'HEAD',
+      platformAnswer: () => {
+        redirect = new Response(null, {
+          status: 308,
+          headers: new Headers({ location: '/invite/' }),
+        });
+        return redirect;
+      },
+    });
+    expect(await onRequest(redirectCtx)).toBe(redirect);
+    expect(redirectCtx.assetFetches).toEqual([]);
+
+    let asset;
+    const assetCtx = context({
+      url: 'https://realunit.app/invite/',
+      method: 'HEAD',
+      platformAnswer: () => {
+        asset = new Response(null, {
+          status: 200,
+          headers: new Headers({ 'content-type': 'application/json' }),
+        });
+        return asset;
+      },
+    });
+    expect(await onRequest(assetCtx)).toBe(asset);
+    expect(assetCtx.assetFetches).toEqual([]);
+  });
+
+  test('a non-HTML answer the platform gives is handed on untouched', async () => {
+    let asset;
+    const ctx = context({
+      url: 'https://realunit.app/invite/',
+      platformAnswer: () => {
+        asset = new Response('{}', {
+          status: 200,
+          headers: new Headers({ 'content-type': 'application/json', etag: 'W/"json"' }),
+        });
+        return asset;
+      },
+    });
+    const res = await onRequest(ctx);
+    expect(res).toBe(asset);
+    expect(res.headers.get('etag')).toBe('W/"json"');
+  });
+
+  test('a 200 with no content-type at all is handed on untouched', async () => {
+    // Constructing a Response from a string sets the header on its own, so it
+    // is removed again to reach the missing-header case.
+    let bare;
+    const ctx = context({
+      url: 'https://realunit.app/invite/',
+      platformAnswer: () => {
+        bare = new Response(SHELL, { status: 200 });
+        bare.headers.delete('content-type');
+        return bare;
+      },
+    });
+    const res = await onRequest(ctx);
+    expect(res).toBe(bare);
+    expect(res.headers.get('content-type')).toBeNull();
+    expect(ctx.assetFetches).toEqual([]);
+  });
+
+  test('an HTML answer that is not the shell is handed on untouched', async () => {
+    // A broken deploy serving the site's 404 page under /invite/ with a 200
+    // must not be dressed up as an invitation.
+    let other;
+    const ctx = context({
+      url: 'https://realunit.app/invite/',
+      platformAnswer: () => {
+        other = new Response(NOT_FOUND_PAGE, {
+          status: 200,
+          headers: new Headers({ 'content-type': 'text/html; charset=utf-8' }),
+        });
+        return other;
+      },
+    });
+    const res = await onRequest(ctx);
+    expect(res).toBe(other);
+    expect(await res.text()).toBe(NOT_FOUND_PAGE);
+  });
+
+  test('the marks the pass keys on live where they have to', () => {
+    for (const mark of ['id="state-loading"', 'aria-busy="true"']) {
+      expect(SHELL).toContain(mark);
+      expect(PROMO_SHELL).toContain(mark);
+      expect(NOT_FOUND_PAGE).not.toContain(mark);
+    }
+  });
+
+  test('of everything the site ships, only the two landings read as a shell', () => {
+    // The check is a substring test: it does not require the two marks to
+    // share an element, or to be in an element at all. What keeps that from
+    // mattering is this property, and it is worth asserting rather than
+    // describing. It goes red the day another page gains the second mark,
+    // which is the day the guard would have to become a real parse.
+    const files = shippedHtml().sort();
+    expect(files).toEqual([
+      '404.html',
+      'account-merge/index.html',
+      'confirm-aktionariat/index.html',
+      'index.html',
+      'invite/index.html',
+      'promo/index.html',
+    ]);
+    expect(files.filter((file) => isLandingShell(page(file)))).toEqual([
+      'invite/index.html',
+      'promo/index.html',
+    ]);
+  });
+});
diff --git a/vitest.config.mjs b/vitest.config.mjs
index 2369248..f645a7a 100644
--- a/vitest.config.mjs
+++ b/vitest.config.mjs
@@ -6,10 +6,11 @@ export default defineConfig({
     include: ['test/**/*.test.mjs'],
     coverage: {
       provider: 'v8',
-      // Only the extracted, side-effect-free browser logic is unit-tested to
-      // 100%. The DOM/network glue in public/*.js is covered by the Playwright
+      // The extracted, side-effect-free browser logic and the Pages Function
+      // that decides which page a landing path is answered with. The
+      // DOM/network glue in public/*.js is covered by the Playwright
       // functional suite instead (see CONTRIBUTING.md).
-      include: ['public/js/lib/**/*.js', 'functions/lib/**/*.js'],
+      include: ['public/js/lib/**/*.js', 'functions/lib/**/*.js', 'functions/_middleware.js'],
       // Report every matched file even if no test imports it, so a new, untested
       // public/js/lib/*.js drops coverage below 100% instead of silently passing.
       all: true,
@@ -34,6 +35,16 @@ export default defineConfig({
           branches: 87,
           statements: 98,
         },
+        // The middleware decides which page and which status a crawler of an
+        // invite or promo landing sees. It was outside `include` while it did so, which is how a
+        // change that served the 404 page on every invite link passed a full
+        // review. It is measured at 100% and stays there.
+        'functions/_middleware.js': {
+          lines: 100,
+          functions: 100,
+          branches: 100,
+          statements: 100,
+        },
       },
     },
   },
