Positions policy: cap of five per account, refuse wallets registered under anything but the main member, admin members shows positions; Qualified Start card states the rule

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

server.js

@@ -717,6 +717,19 @@ const server = http.createServer(async (req, res) => {
         // Qualified Start: a second (third…) wallet on the same account. It becomes
         // its own on-chain member under this member's id when it buys; the session
         // stays on the main wallet.
+        // policy (Marty, 2026-09-10): positions exist to qualify, so at most five per account, and a
+        // wallet that is already registered on-chain under anything other than this account's main
+        // member is refused (a position-under-position chain would recapture 70% of a self-buy)
+        const MAX_POS = 5;
+        const have = await accounts.positions(s.email);
+        if (!have.find(p => p.address === r.address.toLowerCase()) && have.length >= MAX_POS)
+          return json(res, 400, { error: 'You can link up to ' + MAX_POS + ' positions, which is everything Qualified Start needs. Once qualified, buy from your main wallet so your sponsor is paid in full.' });
+        if (memberId) {
+          const mainId = await auth.refreshMemberId(s);
+          let mm = null; try { mm = await chain.member(memberId); } catch (e) {}
+          if (mm && mainId && mm.sponsorId !== mainId)
+            return json(res, 400, { error: 'That wallet is already registered on-chain under ' + (mm.sponsorId ? 'member #' + mm.sponsorId : 'no sponsor') + ', not under your main member #' + mainId + '. Only positions registered directly under you can be linked.' });
+        }
         const pr = await accounts.addPosition(s.email, r.address);
         if (pr.error) return json(res, 400, pr);
         if (memberId) await accounts.setPositionMember(r.address, memberId);
@@ -1641,7 +1654,9 @@ const server = http.createServer(async (req, res) => {
     }
     if (p === '/api/admin/members' && req.method === 'GET') {
       if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
-      return json(res, 200, { members: await accounts.listAll(500) });
+      const members = await accounts.listAll(500);
+      for (const m of members) { try { const ps = await accounts.positions(m.email); m.positions = ps.length; m.positionIds = ps.map(p => p.memberId).filter(Boolean); } catch (e) { m.positions = 0; } }
+      return json(res, 200, { members });
     }
     if (p === '/api/admin/members' && req.method === 'PATCH') {
       if (!isAdmin(req)) return json(res, 401, { error: 'auth' });