diff --git a/server.js b/server.js
index 2593535..b06ecb9 100644
--- a/server.js
+++ b/server.js
@@ -428,7 +428,10 @@ const server = http.createServer(async (req, res) => {
       const s = await auth.fromRequest(req);
       const acct = s && s.email ? await accounts.byEmail(s.email) : null;
       const tok = (acct && acct.sponsorRef) || parseCookies(req)['iap.sponsor'] || '';
-      const sponsorId = await resolveSponsorToken(tok);
+      let sponsorId = await resolveSponsorToken(tok);
+      // orphan fallback: an unresolvable/absent sponsor (dead link, no link) lands
+      // the new member under the configured catch position (#1) instead of root
+      if (!sponsorId && (!acct || acct.memberId !== (Number(siteConfig().defaultSponsorId) || 1))) sponsorId = Number(siteConfig().defaultSponsorId) || 1;
       let name = null, avatarUrl = null;
       if (tok) {
         const t = tok.toLowerCase();
@@ -552,7 +555,9 @@ const server = http.createServer(async (req, res) => {
       if (!s) return json(res, 200, { signedIn: false });
       const memberId = await auth.refreshMemberId(s);
       const acct = (s.email && await accounts.byEmail(s.email)) || (s.address && await accounts.byAddress(s.address)) || null;
-      const sponsorId = await resolveSponsorToken((acct && acct.sponsorRef) || parseCookies(req)['iap.sponsor']);
+      let sponsorId = await resolveSponsorToken((acct && acct.sponsorRef) || parseCookies(req)['iap.sponsor']);
+      const _defSpon = Number(siteConfig().defaultSponsorId) || 1;
+      if (!sponsorId && memberId !== _defSpon) sponsorId = _defSpon; // orphan fallback → #1 (never self-sponsor)
       if (memberId && acct && acct.memberId !== memberId) accounts.setMemberId(acct.email, memberId).catch(() => {});
       const out = { signedIn: true, email: s.email || (acct && acct.email) || null,
         address: s.address || (acct && acct.address) || null, memberId,