Marty, 2026-09-16, after @megamol created megamol2/megamol3 under his own link and bought $20 on each
to fake his two qualifying buyers. fraud.js records sign-up IP/UA/browser id (iap.dev cookie set with
the code request) and last-seen on sign-in. New accounts: dup-device (browser already has an account)
and sponsor-device are refused, ip-burst (> fraudMaxSignupsPerIpDay, default 2, per 24h) is refused;
sponsor-ip and shared-ip are flagged only. Flagged/suspended accounts never count on the leaderboard
and cannot adopt from the tank; suspended accounts are signed out everywhere (auth.fromRequest
wrapper) and refused at sign-in. Admin > Members: Duplicate signals card (shared browser / IP,
flagged, suspended), flags badge, Suspend/Unsuspend; GET /api/admin/fraud; PATCH members {suspend,
reason, flags}. Telegram admin alert on every block/flag. Privacy page + chatbot prompt updated.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Marty, 2026-09-16, after the third "why didn't my sponsor get paid" thread of the day (livedreams / gracie25,
Morten / Terry's linked wallets). GET /api/my/trace?who=<#|username> (yourself, anyone up to 3 levels
below you, or your own 3 uplines) and GET /api/admin/trace?who= list every purchase the member was
part of, newest first: buyer, sponsor, package, then levels 1-3 with the recipient, the skipped
positions and the reason ("not qualified: had N of 2 qualifying buyers then"), the platform share, and
a verify link. Linked extra wallets are named after their owner. Earnings tab card "Trace a payment";
admin member card gets a "Payment trace" section; chatbot canned answer + AI prompt route the
question there.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Same class of bug as the campaign #27 false report: the Shorts report was a prompt() pre-filled with
'inappropriate'. Members now tap a reason button on purpose or cancel. Script tags bumped.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
promos.js (promo_codes + promo_redemptions, JSON fallback): create/update codes with
credits, partner, optional cap and expiry, on/off. Redeemed once per account either
from a join link ?promo=CODE (cookie, applied at signup) or the Overview box
'Have a promo code?' (/api/my/promo/redeem). Admin > Traffic gets a Partner promo
codes card (create, toggle, uses, recent redemptions). Chatbot line added.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
traffic.js logs public page views by referring domain (30 s buffered; page_hits
table or traffic.json), coach exposes all join-page views, and
/api/admin/traffic merges page views, join-page views, signups, registrations
and $20+ buyers by first-touch source for 7/30/90/365-day ranges.
Also: line-tree chips no longer truncate own-position labels.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- /from/faucetwave and /from/tieroneads (?seg=advertiser): the squeeze page with
brand copy and no video, sponsor cookie cleared so arrivals land in the holding
tank, angle + a legacy:<brand> source recorded on the account.
- legacy.js: private list DATA_DIR/legacy.json (email -> brand, segment); listed
emails get a one-time credit grant at account creation (legacyCreditsAdvertiser
500 / legacyCreditsEarner 150, admin-editable), recorded in legacy-grants.json.
- Holding-tank alerts: dashboard payload carries who is waiting (Overview notice
with usernames + adopt link), and a 15-minute tick posts new arrivals to the
shared Telegram payments topic.
- Chatbot prompt lines + admin setting labels.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
telegramOnEvent now builds the line once per target: the existing proof feed
(telegramChatId) and a new echo target (telegramEchoChatId + telegramEchoTopicId,
telegramEchoEvents). AwardPaid events are now posted too. Echo lines carry an
InstantAdPay prefix since RM Circle shares the topic. Admin labels added.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- /join/<token>[?v=angle] now serves a capture page (email first, wallet
later) with angle-matched hook copy, sponsor line, worked-example ledger,
how-it-works, live package ladder, and per-angle og tags (og:url keeps ?v=).
The sponsor cookie is set exactly as before; ?v= is remembered and stored
on the account as joined_via (shown in admin Members).
- drip.js: 4-step getting-started sequence (24h/48h/96h/168h) queued when a
free account is created with the pre-checked opt-in; ticker every 10 min;
signed /unsubscribe link in every email; MySQL + JSON storage.
- Admin > Settings: edit the sequence as JSON, reset to defaults, send any
step to the admin inbox; Overview shows follow-ups in flight.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- /admin: email magic-code sign-in allowlisted to ADMIN_EMAIL, 12h admin
session (cookie iap.adm, persisted in the volume). Bearer ADMIN_PASSWORD
API access still works. Member area shows an Admin link for that email.
- House ads: admin places banner/text/login/solo/video/featured/visits
campaigns owned by house@instantadpay.com that cost nothing; budget is
only a delivery cap, spend is never charged or burned.
- Admin APIs: overview, all campaigns (+pause/resume any), members
(+re-point sponsor), reports (+resolve), pending burns, rates/site
config get+patch, creative upload.
- fmtPol rounds to two decimals everywhere (dashboard, toasts, prices).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
martbost