Sign-in no longer tells an existing member they are joining somebody's line

Marty signed in and was told "You're joining the line of @bliss". He is member #1.

Cause: the last-touch sponsor cookie lives 30 days, and /api/sponsor set invited
purely from that cookie. So any member who had ever clicked a teammate's invite link
was greeted on the sign-in screen as though logging in would place them under that
person. Untrue, and alarming in exactly the wrong place: their sponsor locked at their
first purchase and nothing on that screen can move it. Anyone seeing that would
reasonably worry their line was about to change.

The greeting now shows when someone actually arrived through a link (?ref= in the URL),
or when the cookie is present AND this browser has never had an account, which is the
genuine "came back later to finish joining" case. A browser that already has an account,
or a signed-in session, never sees it.

Attribution is deliberately untouched: the cookie still resolves, the sponsor id is
still returned, and placement still works exactly as before. Only the greeting changed.

fraud.hasAccountOnDevice(req) is the new signal, reusing the device cookie the
one-account-per-person checks already set.

qa/sponsor-note.mjs (5 assertions) boots its own throwaway server and creates a REAL
account so the case is proven rather than assumed: still greeted with ?ref=, still
greeted from the cookie on a browser with no account, NOT greeted on the browser that
has one, and attribution still resolving. qa/run.sh member: 0 bugs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

server.js

@@ -1184,7 +1184,17 @@ const server = http.createServer(async (req, res) => {
         if (!a && /^\d+$/.test(nameTok)) a = await accounts.byMemberId(Number(nameTok));
         if (a) { name = a.username ? '@' + a.username : (a.memberId ? 'member #' + a.memberId : null); avatarUrl = a.avatarUrl || null; own = !!(acct && a.email === acct.email); var bio = null, cobrand = false; try { cobrand = (await ads.milestonesOf(a.email)).includes('level3'); if (cobrand) bio = a.bio ? String(a.bio).slice(0, 220) : null; } catch (e) {} }
       }
-      return json(res, 200, { ref: tok, sponsorId, sponsorBlocked, sponsorRouted, sponsorName: spd.name || null, invited: !!(tok || showTok), name, avatarUrl, own, bio: typeof bio === 'undefined' ? null : bio, cobrand: typeof cobrand === 'undefined' ? false : cobrand });
+      // "You're joining the line of X" must only greet someone who is actually about to
+      // join. The last-touch sponsor cookie lives 30 days, so an EXISTING member who once
+      // clicked a teammate's link was being told on the sign-in page that logging in would
+      // place them under that person (Marty, 2026-09-17). Alarming, and untrue: their
+      // sponsor locked at their first purchase and nothing here can move it.
+      // Show it when they just arrived through a link (?ref= in the URL), or when the cookie
+      // is there AND this browser has never had an account. Attribution itself is untouched.
+      let invited = !!showTok;
+      if (!invited && tok) { try { invited = !(await fraud.hasAccountOnDevice(req)); } catch (e) { invited = true; } }
+      if (acct) invited = false;   // already a member: they are not joining anybody's line
+      return json(res, 200, { ref: tok, sponsorId, sponsorBlocked, sponsorRouted, sponsorName: spd.name || null, invited, name, avatarUrl, own, bio: typeof bio === 'undefined' ? null : bio, cobrand: typeof cobrand === 'undefined' ? false : cobrand });
     }
     if (p === '/api/stats' && req.method === 'GET') {
       let members = 0; try { members = await chain.memberCount(); } catch (e) {}