Explain a dead share link and a broken invite in the reader's terms

A practice opening an expired or revoked share link met the app's own
404, 'this page does not exist', with a button to a dashboard it has no
account for. The share segment now has its own not-found page: link
expired or invalid, ask the person who shared it for a new one, and no
link anywhere. It still answers 404 for every failure class alike.

A malformed invite link fell through to the plain registration form.
It now says the invitation is invalid and offers sign-in; the shape
check is public, so this reveals nothing about which tokens exist, and
a well-formed token still goes on to registration.

src/app/c/[token]/not-found.tsx

@@ -0,0 +1,40 @@
+import { LinkIcon } from "lucide-react";
+
+import { resolveShareViewLocale } from "@/lib/clinician-share/request-locale";
+import { getServerTranslator } from "@/lib/i18n/server-translator";
+
+/**
+ * What a practice sees when a shared link no longer opens: expired, revoked,
+ * mistyped. The page still answers 404 for every failure class alike (the
+ * share page's `notFound()`), so a probe learns nothing from it; what changes
+ * is the copy. The app's own 404 said "this page does not exist" and offered
+ * a dashboard the reader has no account for. This one says what happened in
+ * the reader's terms and what to do, and links nowhere.
+ */
+export default async function ClinicianShareNotFound() {
+  const locale = await resolveShareViewLocale();
+  const { t } = getServerTranslator(locale);
+
+  return (
+    <main
+      id="main-content"
+      data-slot="clinician-share-unavailable"
+      className="bg-background text-foreground flex min-h-dvh flex-col items-center justify-center gap-6 px-4 py-12 pt-[calc(env(safe-area-inset-top)+3rem)]"
+    >
+      <div
+        aria-hidden="true"
+        className="bg-muted text-muted-foreground flex size-14 items-center justify-center rounded-xl"
+      >
+        <LinkIcon className="size-6" />
+      </div>
+      <div className="max-w-md space-y-2 text-center">
+        <h1 className="text-2xl font-bold tracking-tight">
+          {t("clinicianView.unavailable.title")}
+        </h1>
+        <p className="text-foreground text-sm">
+          {t("clinicianView.unavailable.description")}
+        </p>
+      </div>
+    </main>
+  );
+}

src/app/invite/[token]/__tests__/page.test.tsx

@@ -24,6 +24,11 @@ vi.mock("next/navigation", () => ({
   redirect: (href: string) => redirectMock(href),
 }));
 
+vi.mock("@/lib/i18n/server-locale", () => ({
+  resolveServerLocale: async () => "en",
+}));
+
+import { renderToStaticMarkup } from "react-dom/server";
 import InviteLandingPage from "../page";
 
 beforeEach(() => {
@@ -56,9 +61,10 @@ describe("<InviteLandingPage> universal-link landing", () => {
     expect(url.searchParams.get("invite")).toBe(VALID_TOKEN);
   });
 
-  it("drops a malformed token to plain register (no enumeration oracle)", async () => {
-    // Wrong prefix, wrong length, and outright garbage all land on the
-    // identical target — the page never reveals whether a token exists.
+  it("names a malformed link as invalid instead of opening registration", async () => {
+    // Wrong prefix, wrong length, and outright garbage all render the same
+    // invalid-invite state. The shape is public, so this reveals nothing
+    // about which well-formed tokens exist; those still go on to register.
     for (const bad of [
       "not-a-token",
       `hlk_${"a".repeat(64)}`,
@@ -66,8 +72,14 @@ describe("<InviteLandingPage> universal-link landing", () => {
       `hlv_${"G".repeat(64)}`,
     ]) {
       redirectMock.mockClear();
-      const href = await runRedirect(bad);
-      expect(href).toBe("/auth/register");
+      const node = await InviteLandingPage({
+        params: Promise.resolve({ token: bad }),
+      });
+      expect(redirectMock).not.toHaveBeenCalled();
+      const html = renderToStaticMarkup(node);
+      expect(html).toContain('data-slot="invite-invalid"');
+      expect(html).toContain("Invitation invalid");
+      expect(html).not.toContain("/auth/register");
     }
   });
 });

src/app/invite/[token]/page.tsx

@@ -1,6 +1,10 @@
+import Link from "next/link";
 import { redirect } from "next/navigation";
+import { MailX } from "lucide-react";
 
 import { looksLikeInviteToken } from "@/lib/auth/invite-token";
+import { resolveServerLocale } from "@/lib/i18n/server-locale";
+import { getServerTranslator } from "@/lib/i18n/server-translator";
 
 /**
  * v1.17.0 — invite universal-link landing (iOS #16).
@@ -41,7 +45,40 @@ export default async function InviteLandingPage({
     redirect(`/auth/register?invite=${encodeURIComponent(token)}`);
   }
 
-  // Malformed token: behave exactly like a visitor with no invite. No DB
-  // hit, no leak of whether any token exists.
-  redirect("/auth/register");
+  // Malformed token: say so. This used to fall through to the plain
+  // registration form, which on an open instance invited a stranger to sign
+  // up and on a closed one refused them without saying why. The shape check
+  // is public knowledge and needs no database, so naming a malformed link as
+  // invalid leaks nothing about which tokens exist: a well-formed unknown
+  // token still goes on to register, where the signup decides.
+  const locale = await resolveServerLocale();
+  const { t } = getServerTranslator(locale);
+  return (
+    <main
+      id="main-content"
+      data-slot="invite-invalid"
+      className="bg-background text-foreground flex min-h-dvh flex-col items-center justify-center gap-6 px-4 py-12 pt-[calc(env(safe-area-inset-top)+3rem)]"
+    >
+      <div
+        aria-hidden="true"
+        className="bg-muted text-muted-foreground flex size-14 items-center justify-center rounded-xl"
+      >
+        <MailX className="size-6" />
+      </div>
+      <div className="max-w-md space-y-2 text-center">
+        <h1 className="text-2xl font-bold tracking-tight">
+          {t("auth.inviteInvalid.title")}
+        </h1>
+        <p className="text-foreground text-sm">
+          {t("auth.inviteInvalid.description")}
+        </p>
+      </div>
+      <Link
+        href="/auth/login"
+        className="border-border hover:bg-accent inline-flex min-h-11 items-center justify-center rounded-md border px-4 text-sm font-medium transition-colors"
+      >
+        {t("auth.inviteInvalid.toLogin")}
+      </Link>
+    </main>
+  );
 }