Wire GET /welcome on the root mux alongside /healthz, outside Auth.Middleware. handleWelcome peeks the session via CurrentUser (no redirect) and renders the logged-out or logged-in WelcomePage variant. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>