Sponsor attribution: last touch (30-day cookie), locked at account creation; 'Joining under' line at the code step; chatbot answer

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

public/assets/join.js

@@ -28,6 +28,8 @@
     const r = await api('/api/auth/email/start', { email: $('jnEmail').value });
     $('jnCodeRow').hidden = false; $('jnVerify').hidden = false; $('jnSend').hidden = true; $('jnResend').hidden = false;
     if (r.devCode) $('jnCode').value = r.devCode;
+    // the last thing they see before the account is created: who they are joining under
+    if (sponsorName) { $('jnUnder').textContent = 'Joining under ' + sponsorName + '. Not who invited you? Open their invite link first, then come back for the code.'; $('jnUnder').hidden = false; }
     IAP.status(r.sent ? 'Code sent. Check your inbox (and spam, the first time).' : 'Dev mode: code filled in.', 'ok');
     $('jnCode').focus();
   });
@@ -45,9 +47,11 @@
   $('jnEmail').addEventListener('keydown', e => { if (e.key === 'Enter') ($('jnVerify').hidden ? $('jnSend') : $('jnVerify')).click(); });
   $('jnCode').addEventListener('keydown', e => { if (e.key === 'Enter') $('jnVerify').click(); });
 
-  // sponsor line
+  // sponsor line (the link opened most recently sets the sponsor; it locks at account creation)
+  let sponsorName = '';
   fetch('/api/sponsor').then(r => r.json()).then(sp => {
     if (sp && sp.invited && sp.name) {
+      sponsorName = sp.name;
       $('jnSponName').textContent = sp.name;
       if (sp.avatarUrl) { $('jnSponImg').src = sp.avatarUrl; $('jnSponImg').hidden = false; }
       $('jnSpon').hidden = false;

public/join.html

@@ -88,6 +88,7 @@
       <p class="muted small" style="margin:0 0 12px">Type your email and we send a 6-digit code. No password, no wallet needed today.</p>
       <p><input id="jnEmail" type="email" placeholder="Your email" autocomplete="email"></p>
       <p id="jnCodeRow" hidden><input id="jnCode" inputmode="numeric" placeholder="6-digit code from your inbox"></p>
+      <p id="jnUnder" class="small muted" hidden style="margin:-4px 0 12px"></p>
       <label class="small muted" style="display:flex;gap:8px;align-items:flex-start;margin:0 0 12px;cursor:pointer">
         <input type="checkbox" id="jnNews" checked style="margin-top:3px;width:auto">
         <span>Send me the getting-started emails (a few short ones over the first week). Unsubscribe any time.</span>
@@ -128,6 +129,6 @@
   </div>
 </div>
 <script src="/assets/common.js?v=20260910c"></script>
-<script src="/assets/join.js?v=20260910a"></script>
+<script src="/assets/join.js?v=20260910b"></script>
 </body>
 </html>