Share links served in place with og:url carrying the ref (Facebook was dropping the name); portrait 9:16 teaser for TikTok/Reels/Shorts/Facebook; test updated

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

public/promo.html

@@ -35,7 +35,7 @@
     <h2>The teaser</h2>
     <div class="sub">Thirty seconds. Post it with your link, or send people to the page and let it play there.</div>
     <video class="hero-video" controls playsinline preload="metadata" poster="/video/polhunter-teaser-poster.jpg" src="/video/polhunter-teaser.mp4" style="border-radius:18px;max-height:60vh"></video>
-    <p style="margin-top:10px"><a class="btn ghost sm" href="/video/polhunter-teaser.mp4" download="polhunter-teaser.mp4">Download the mp4</a></p>
+    <p style="margin-top:10px"><a class="btn ghost sm" href="/video/polhunter-teaser.mp4?v=20260921a" download="polhunter-teaser.mp4">Download the mp4 (16:9)</a> <a class="btn ghost sm" href="/video/polhunter-teaser-portrait.mp4?v=20260921a" download="polhunter-teaser-portrait.mp4">Download the portrait cut (9:16 for TikTok, Reels, Shorts, Facebook)</a></p>
   </section>
 
   <section class="section">

server.js

@@ -163,11 +163,17 @@ const server = http.createServer(async (req, res) => {
     if (curtained(req, res, u)) return;
     // a member's share link: /?r=<their IAP username or id> becomes a 30-day cookie; the landing then
     // sends sign-ups to instantadpay.com/join/<ref>, so IAP's own last-touch sponsor rule applies
+    // Served in place, not redirected (Marty, 2026-09-21): Facebook's crawler follows redirects and canonicalizes a
+    // share to og:url, so a redirect to the bare home page lost the member's name on every share. og:url carries
+    // the ref; the cookie rides on the same response.
     if (p === '/' && u.searchParams.get('r')) {
-      const r = String(u.searchParams.get('r')).trim().slice(0, 40); u.searchParams.delete('r');
-      const h = { Location: '/' + (u.searchParams.toString() ? '?' + u.searchParams : ''), 'Cache-Control': 'no-store' };
-      if (/^[A-Za-z0-9_.-]{1,40}$/.test(r)) h['Set-Cookie'] = 'ph.ref=' + encodeURIComponent(r) + '; Path=/; Max-Age=2592000; SameSite=Lax; Secure';
-      res.writeHead(302, h); return res.end();
+      const r = String(u.searchParams.get('r')).trim().slice(0, 40);
+      const ok = /^[A-Za-z0-9_.-]{1,40}$/.test(r);
+      let html = fs.readFileSync(path.join(PUBLIC_DIR, 'index.html'), 'utf8');
+      if (ok) html = html.replace('<meta property="og:url" content="https://polhunter.com/">', '<meta property="og:url" content="https://polhunter.com/?r=' + encodeURIComponent(r) + '">');
+      const h = Object.assign({ 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' }, SEC);
+      if (ok) h['Set-Cookie'] = 'ph.ref=' + encodeURIComponent(r) + '; Path=/; Max-Age=2592000; SameSite=Lax; Secure';
+      res.writeHead(200, h); return res.end(html);
     }
 
     // ---- sign-in by hand-off from InstantAdPay

test/run.js

@@ -117,7 +117,7 @@ const sleep = ms => new Promise(r => setTimeout(r, ms));
   eq([!!pr, pr && pr.status, pr && pr.pol, b4.body.badges.some(x => x.id === 'top'), b4.body.rank.all.finds], [true, 'due', 3, true, 1], 'the prize is a due drip on the board, Top Hunter badge on, finds unchanged');
   const lb2 = await call('/api/leaders?period=all'); eq(lb2.body.rows[0].finds, 1, 'the prize drip is not a find on the leaderboard');
   const b3 = await call('/api/my/board'); eq([b3.body.badges.some(b => b.id === 'first'), b3.body.rank.all.rank, b3.body.share.link], [true, 1, B + '/?r=hunter42'], 'board: First Find badge, rank #1, share link carries the username');
-  const rv = await fetch(B + '/?r=hunter42', { redirect: 'manual' }); eq([rv.status, /ph\.ref=hunter42/.test(rv.headers.get('set-cookie') || ''), rv.headers.get('location')], [302, true, '/'], 'a share-link visit sets the referral cookie and lands on the landing');
+  const rv = await fetch(B + '/?r=hunter42', { redirect: 'manual' }); const rvb = await rv.text(); eq([rv.status, /ph\.ref=hunter42/.test(rv.headers.get('set-cookie') || ''), /og:url" content="https:\/\/polhunter\.com\/\?r=hunter42"/.test(rvb)], [200, true, true], 'a share-link visit serves the landing in place (no redirect: Facebook keeps the name), sets the referral cookie, and og:url carries the ref');
   const cf = await (await fetch(B + '/api/config', { headers: { Cookie: 'ph.ref=hunter42' } })).json(); eq([cf.ref, cf.joinUrl], ['hunter42', 'https://instantadpay.com/join/hunter42?from=polhunter'], 'with the cookie, sign-ups go to that member\u2019s IAP join link');
   const badRef = await fetch(B + '/?r=<script>', { redirect: 'manual' }); eq(/ph\.ref/.test(badRef.headers.get('set-cookie') || ''), false, 'a malformed ref sets no cookie');
   for (const pg of ['/leaders', '/promo']) { const r = await fetch(B + pg); eq([r.status, /<title>/.test(await r.text())], [200, true], pg + ' serves'); }