The landing page must render without a session. Add /welcome to isPublicPath so the auth middleware lets it through (alongside /healthz and /auth/*), and assert the bypass in the public-paths test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>