A member asked for a delete button. Deleting would orphan the credit ledger,
the hourly view rows and the P&L, and throw away the figures they actually
want, so a campaign is archived instead: out of the working table, listed in
full underneath with its views, clicks and spend, and restorable.
The credits are the real point. Reserved budget is computed from campaigns
that are active or paused, so a paused campaign quietly holds credits the
member cannot spend anywhere else. Archiving releases them the moment the
status changes, with nothing to refund and nothing that can double-refund.
Only a paused or finished campaign can be archived, so pause stays the
deliberate first step, and restoring brings it back paused rather than live.
The syndication rails are stopped on the way in.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Marty's call: someone arriving from PolHunter stays on the dashboard rather
than being bounced back, because that is where the business is. That makes the
return card their only way back, and it was sitting third, below the launch
announcement for the site they had just come from and the Friday promotion.
It is hidden for everyone who did not arrive that way, so no other member's
page changes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The email-code endpoint refuses a request that arrives within two seconds of
the page loading, because a script fills a form instantly and a person does
not. A member whose email is already filled in by the browser has nothing to
type, taps straight away, and gets "Give the page a second, then tap again."
The page now waits out the remainder itself and sends when the window has
passed, so the person sees the normal sending state instead of an error.
The server check is untouched, so anything posting at the endpoint without a
page behind it still fails exactly as before.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
PolHunter now pays a bounty when a hunter brings someone who turns up and
hunts, and the person who gets it has to be the one that member actually
joined under here. The sign-in payload carries sponsorRef and the join date
across so PolHunter is never guessing from a cookie.
Its payouts are real POL from its own faucet and none of it passes through the
ad contract, so the P&L could not derive it. It now reads the figures across,
cached and fail-soft, and shows finds, bounties and matches as their own card.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Michael Camire reported the video tab locking up after the fifth watch each
day. Three separate faults behind it.
A campaign could go live with a video address that resolves nowhere, because
the form only checked the shape of the URL. One has been sitting there since
11 September pointing at the example host, serving every Tier 1 member a black
player it could never finish. The create route now fetches the address and
refuses a host that does not answer, a 404, or a page that is not a video.
The Watch tab holds the landscape videos and Shorts holds the upright ones,
but they share one daily count. A member who cleared the tab was told to come
back tomorrow while clips were still waiting one tap away. When the other
surface still has something, the done screen now says so and links to it.
When a browser refused to autoplay, the button offered "Tap to play" but was
wired to fetch a different video, so the loaded one was thrown away and the
next also would not start. On a phone the clip could never be played at all.
The button now starts what is already loaded.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The done-check read the stored value, so a mark recorded as 0 counted as never
celebrated. Seeding the already-passed hundreds that way would have made the
site announce "400 members" to a channel watching 528. It now tests that the
mark is present at all. Caught before it posted; the live state has been
re-stamped either way.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Marty, 2026-09-22. The ladder was 500 / 1000 / 2500 / 5000 / 10000, so most of
the year would pass with nothing to cheer. It is now every 100, with the fuller
write-up kept for the half-thousands and thousands and a short cheer in
between, so the small ones do not read as a repeated speech. Both are laid out
in short lines for a phone, like the daily snapshot. The hundreds already
passed are recorded as done on the live volume, so the next post is 600.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The post was one paragraph per subject, and on a phone every line wrapped into
a block of text with nothing to catch the eye. It is now a heading and two or
three short lines per subject, with a blank line between, the date under the
title, and no line long enough to wrap on a narrow screen.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The PolHunter launch card, the Five Dollar Friday card and the "you came from
PolHunter" card repeat on a timer, so anyone who has read one had no way to
clear it. Each now carries a small close control in its heading: the card
stays hidden for the rest of that browser session and comes back at the next
sign-in, so a message nobody acted on is never lost for good.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
socialpix.club was being used as a free ad board by posting bots; its signup/onboarding/post flows
now redirect here. No legacy credits for these arrivals. Referrer tagging (traffic.js) already covers /from/*.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
/api/my/polhunter signs a member across to polhunter.com with a five-minute single-use HMAC
token (memberId, email, wallet, username); PolHunter has no sign-up and no mailer, this is the
only way in. A PolHunter entry in the dashboard nav. The PolHunter embed on the public ledger
with one slot beside the payout feed; CSP allows polhunter.com.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Marty (2026-09-19): show every missed qualification so the whole chain is visible. The old
notice fired once per passed-up tier and showed only that tier. AdminPaid is the last event of
every purchase transaction (119 of 119 in the index), so the notice now fires there, gathers
every PassedUp and TierPaid of the tx, and missed.js composes one message: each tier's walk,
every person passed over with their buyer count, who finally caught it (or that the company
kept it), and the total POL that walked past how many people on that one sale.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Marty (2026-09-19): cap the login-ad slots. About 124 members sign in a day and every live
slot shares those views, so a fourth slot only thins the other three. Member slots only;
house login ads now step aside whenever a member slot is running (JSON: filtered out of the
pool; MySQL: ORDER BY house ASC). The 14 slots already running keep their term; new buys are
refused until one ends. Format label and chatbot updated.
mindfulmojo (email, 2026-09-19): the viewer frames the advertiser's page and both controls
meant "back"; some sites refuse to load inside a frame and signing up is easier in a full tab.
The viewer bar now carries "Open site in a new tab", set from the ad's target URL.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Marty (2026-09-19): partner codes keep working with no monthly cap, but the credits stop
being a dump. A fifth is paid the day the code is redeemed, then a fifth on each day the
member finishes their daily ad set, five days in all, and whatever is unclaimed 30 days after
redemption is never paid. Same headline number for the partner to promote; paid only to
people who show up. 49 of the 52 PARTNER redemptions were still sitting on 500+ unspent.
Every redemption now records the site the ?promo= link was opened from (iap.promoref cookie
set from the Referer at link-open), so a code's traffic can be attributed to the partner page
it was supposed to come from. Member-funded codes charge the funder one installment at a
time; a short funder leaves the installment due, not lost.
Pre-drip redemptions were paid in full up front and are marked paid=credits at start-up, so
nothing is paid twice. Covered by a module test (13 checks: per-day cadence, gaps, rounding,
expiry, pre-drip rows, declined payer) and an end-to-end HTTP test on a local copy (9 checks).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Marty (2026-09-19): once a membership gets large, My line and the other lists scroll forever.
One helper, pageList(), pages what each pane already renders: rows past the current page are
hidden and a solid-mint control bar (row range, Previous/Next 25, page count) goes under the
list. Row markup and bindings are untouched, so it goes on every growing list at once: My
line per level (the Activity drawer pages with its row, and a chip drill-down opens on the
right page), the Overview roster, the Campaigns table and its credit ledger, each Pipeline
column, and the Messages thread list. Asset tags bumped.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Marty asked for a NAS zone on the two legacy squeeze pages (2026-09-19). Injected server-side
in serveJoinPage for the fw-*/t1-* angles only, below the fine print and above the footer
links; the regular join pages stay ad-free. script-src now allows networkadspace.com, which
it did not, so the tag would otherwise have died silently under the CSP.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
fraud-allow.json says "never block this person". There was nothing for the opposite case.
fraud-block.json: an address on it cannot open an account through /api/signup or the
email-code door, and the admin fraud report carries the list with a matching
/api/admin/fraud/block route. Existing accounts are untouched; Suspend covers those.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
today() was a UTC day, which rolls over at 7 PM Central. Sign in at 6:55 PM and again at
7:05 PM and those were two different days, so the once-per-day sign-in bonus paid twice,
ten minutes apart. On the live ledger 83 of the first 364 sign-in bonuses landed less than
24 hours after the previous one, one pair 24 minutes apart, worth 618 credits.
The same boundary governs the daily-credit claim, the claim streak, each campaign's daily
spend cap and the login-ad daily meter, all of which could turn over twice in one Central
evening.
ctDay() puts every member-facing daily rule on America/Chicago, which tracks CST/CDT on its
own. Reporting slices elsewhere are left alone rather than re-bucketing chart history.
The bonus also records login_ts now and refuses to pay again inside 20 hours, whatever the
day string says. 20 rather than 24 so signing in at the same time each morning never skips.
Safe to deploy between midnight and 7 PM Central, when the two day strings agree.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The daily meter charged 100 credits for every day a campaign was shown,
with no end date. It produced 74-day queues, and worse, each new campaign
added 100/day of charges while adding no inventory: on 18 September, 15
campaigns were charged 1,500 credits against a platform that had produced
367 login impressions in its entire life. That had stopped being a pricing
inefficiency and become members paying for delivery that did not exist.
Now: 3,000 credits buys 30 days of unlimited impressions, charged once at
purchase, with no delivery promise — the model Marty wanted, matching how
ClickBaitPays sells theirs. The price is deliberately identical to 30 days
at the old daily rate, so nobody pays more than before; they just get a
known end instead of an open-ended drain.
It reuses the `featured` shape, which was already a flat up-front buy that
runs to `expires`. Both daily meters — MySQL and JSON — now skip any
campaign with an expiry, so a slot can never be metered. The existing
sweep closes it on day 30 and returns anything unspent.
qa/login-slot.mjs, 9 checks, including that the slot price still equals
30 days at the old rate and that neither meter can touch a slot campaign.
Member walk clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Marty's call. Sign-ins expired after 24 hours, which meant a member passed
the login gate roughly once a day — and that gate is the entire inventory
behind the login-ad product. The platform has served 356 login impressions
in its life while members have bought 20,526 credits of them.
Four hours, env-tunable via SESSION_TTL_HOURS.
Said out loud in three places rather than left to feel like a glitch:
the login gate itself now explains it, the chatbot has a canned answer for
"why do I keep getting logged out", and the same fact is in the assistant's
system prompt so the AI never calls it a bug. Wording throughout is
Marty's: to keep resources optimised we do not keep anyone signed in
longer than 4 hours, and nothing about the account, credits or line is
affected.
The canned pattern was checked against the neighbours it sits beside —
seven phrasings reach it, and withdraw / pyramid / earnings / second
account / payout answers are all untouched. CANNED is first-match-wins,
so that check matters.
Member walk clean, chatbot suite 35 green.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Splitting system messages out of the modal was right for payout receipts,
but it would have silenced two that a member genuinely loses money by
ignoring:
- "@someone is trying to buy. Link your wallet so it pays you" — a sale
is blocked right now, and the referral is lost permanently once it
routes to someone else.
- "You missed 43 POL on InstantAdPay" — a payout passed them by, and the
message explains exactly how to stop the next one doing the same.
So the dividing line is not system-versus-human, it is "does this need you
to do something". Those two become kind 'alert' and still interrupt; the
receipts stay kind 'notice' and stay in the inbox.
The modal no longer credits an alert to a person either. It was saying "A
message from @martbost" over machine-generated text, because system mail
is sent by member 1 at ADMIN_EMAIL. Alerts now read "Action needed on your
account".
Also reclassified "X is now in your line for good" as a notice — it is
good news about a referral the member gained, with nothing at stake.
qa/messages-notice.mjs now covers both lanes: 14 checks, including that an
alert interrupts and a flood of 25 receipts does not.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Marty hit this viewing daily ads: a popup after every single return to
the dashboard, each one a different payout notice.
Two causes, both fixed.
The channel was shared. "You just got paid 40.8923 POL" and "Welcome to
my line, here are your first three moves" were stored identically, as
kind 'broadcast' — the kind the sign-in modal is meant to interrupt for.
Dismissing one just promoted the next unread notice, so a backlog became
a carousel. System messages are now kind 'notice': they land in the
inbox, count toward its badge, and never pop. Only a message a person
actually wrote can interrupt.
The modal also had no memory. loadDashboard() runs on far more than
sign-in — after every ad view, campaign edit and chat close — and it
re-popped each time. It now shows at most once per page load and never
twice for the same message.
The 79 existing machine-generated rows are retagged by a migration in
ensureSchema, 15 of them unread and currently popping. Matched on
subject rather than sender on purpose: these come from member 1 at
ADMIN_EMAIL, which is also Marty's own member address, so his genuine
broadcasts sit under the same sender and must be left alone. Verified
against the live data first — "Credits returned: a counting error on our
side" and the broken-banner note are his, and stay as broadcasts.
qa/messages-notice.mjs covers it: a flood of 25 notices produces no
interruption, the human message still does, and chat stays in its own
lane. Member walk clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
I read campaigns.received_today as a per-day counter and told Marty the
platform delivers about 2,700 clicks a day. It doesn't. That column is
only a daily figure while the nightly cron resets it, and that reset has
stopped running, so the value is an accumulation since it last ran.
The permanent click ledger is unambiguous: roughly 40 to 50 clicks a day
across the whole platform. It also agrees exactly with ordered-minus-
remaining on every campaign, which is a good independent check that the
read-never-derive design is reading the right thing.
So MAX_CLICKS drops from 10,000 to 2,500. At the real volume a 10,000-click
booking would hold the top of the offerwall for most of a year.
The pack-2 placement is working as intended and is already measurable: the
three backfilled campaigns took 14 of the platform's 17 clicks today.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A campaign's name is the member's own internal label, and some of them are
two characters ("MG"). DripOffers rejects anything under five, and more to
the point a click-earner scanning the offerwall learns nothing from "MG".
So the ad's own headline comes first, then the label, and a very short
label is qualified with the destination host — "MG (mailer.gold)" — rather
than dropped or dressed up in marketing copy we invented on the member's
behalf. Nothing usable at all returns null instead of a made-up title.
Found by the backfill: campaign 88 failed on it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Third syndication rail. The first two send impressions; this one sends
clicks — a real person picks the offer off the offerwall, goes to the
member's link, and has to stay the dwell time before anyone is paid.
Two things it does that the other rails can't:
- It carries geo-targeted campaigns. DripOffers filters on an explicit
country list, so a campaign aimed at Tier 1 finally reaches an outside
audience instead of staying on our own site. Tier-3-only campaigns are
skipped rather than quietly sent worldwide, because an inclusion list
can't express "everywhere except the other tiers" and widening it would
deliver exactly the traffic the owner chose to exclude.
- Delivery is counted, not derived. It reads rows from the platform's
permanent click ledger. It never computes delivery as ordered minus
remaining, and pausing never zeroes remaining — that pair is what
charged members for impressions that never ran on Network Ad Space.
Also fixes two live bugs found while wiring it: the AdRevLinks pause was
nested inside the Network Ad Space check in both the end sweep and
setStatus, so with NAS switched off an ended or paused campaign kept
running on AdRevLinks. Each rail is now checked on its own.
Caps: 1,000 credits minimum, 10,000 clicks maximum per campaign. Not for
cost — Marty owns the platform and these placements are free — but because
the whole site delivers around 2,700 clicks a day, and one campaign
booking 50,000 would sit in the list for weeks.
Inert unless DRIPOFFERS_BRIDGE_URL and _KEY are set. 26 checks green
against the live endpoint; member walk clean.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Second delivery surface for member campaigns, and deliberately the opposite shape to the
Network Ad Space rail: that one is Tier 3 heavy, this one only has prices configured for
US, CA, GB, AU, NZ and UM, so its traffic is Tier 1 by construction.
The AdRevLinks database is not reachable from this server, so rather than opening a
database port to the internet there is a narrow authenticated endpoint on that box which
does the insert locally. Five actions, no general query surface: a leaked key can only
create or remove popup campaigns. The secret lives outside that server's webroot and is
compared in constant time; Apache there strips Authorization, so it travels as
X-Bridge-Key.
adrevlnks.js mirrors nas.js, with two rules carried over from this morning's billing bug:
- DELIVERY IS READ, NEVER DERIVED. status returns the rotator's own per-country counters.
Nothing is computed from a figure a stop could overwrite, which is exactly what charged
16 members for undelivered impressions on the NAS side.
- EVERY WRITE IS IDEMPOTENT. Each campaign carries ref "iap:<id>", so a retry after a
timeout returns the existing campaign instead of booking a second one.
Capped on purpose. That server serves roughly 5,500 popup impressions a DAY in total,
shared by every active campaign, and its rotator favours whichever has delivered least. So
syndicating everything unchecked would starve what is already running, Marty's own ads
included. Hence a credit floor and a per-campaign view cap. Cost is not the reason: he owns
the platform and treats the placements as free. Finite shared inventory is the reason.
Hooked into create, pause/resume and the scheduled end sweep so both networks stay in step.
Inert unless ADREVLNKS_BRIDGE_URL and _KEY are set, and a bridge hiccup can never block a
campaign going live.
qa/adrevlnks-bridge.mjs (15 assertions) drives the REAL endpoint: under-floor campaigns
skipped, full credit value booked, Tier 1 targeting, retry returns the same campaign,
delivery read back, pause/resume mirrored, then deleted and confirmed gone. Creates only
paused campaigns so no live traffic is spent, and leaves nothing behind.
nas-served 8, fraud-allow 12, sponsor-note 5, chatbot-parse 35, qa/run.sh member 0 bugs.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A correction that reads 'granted by admin' explains nothing to the member looking at
their ledger. The note now travels with the grant, so a credit-consumption correction
names itself where they will actually see it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
martbost