Add /contract — plain-language security review of the smart contract

Shareable page from the 2026-08-13 source review: code immutability
(no proxy/delegatecall/selfdestruct, Sourcify exact match), same-tx
distribution (no pooled funds), locked prices and fee constants, the
honest list of owner powers with the 50% entry-fee cap, where unmatched
pass-ups go, and verify-yourself links. Linked from all public footers,
the payment-proof note, and the chatbot (canned + AI prompt).

Also: passed-over lists now exclude structurally-skipped uplines — a
level-N payment never checks the first N-1 uplines, so listing them as
"not eligible" was misleading.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

chain.js

@@ -247,7 +247,9 @@ async function processRange(fromBlock, toBlock) {
       };
       if (!isRef) {
         if (txUpgrades[tx]) p.upgrade = txUpgrades[tx];
-        p.passed = passedOver(p.fromId, p.toId);
+        // a level-N payment structurally skips the first N-1 uplines (they're
+        // never checked) — only list uplines that failed the eligibility test
+        p.passed = passedOver(p.fromId, p.toId).slice(Math.max(0, p.level - 1));
       }
       // upgrade a snapshot-sourced twin in place, else append (twin = already known from snapshot, so not a NEW event)
       const twinIdx = state.payouts.findIndex(x => !x.tx && samePayout(x, p));

public/chat.js

@@ -28,6 +28,8 @@
      a:()=>{const s=sponsorInfo&&sponsorInfo.sponsor;return s?`The current team sponsor is <strong>ID ${esc(s.id)}${s.name?' ('+esc(s.name)+')':''}</strong> — always verify on the <a href="/start">Getting Started page</a> right before you join, because placements rotate as positions qualify. Don't use an old screenshot or saved link.`:`The current sponsor is always shown live on the <a href="/start">Getting Started page</a> — check there right before joining, because placements rotate as positions qualify.`}},
     {k:['qualified','qualification','2 directs','two directs','directs','retire'],
      a:()=>`A position is <strong>qualified</strong> once it has 2 directs. The team recommendation: retire your link at that point and help your 2 get <em>their</em> 2 using their own links — that's the only thing that qualifies them. And if someone happens to join through your link after 2/2, it's a bonus, not a problem: the entry reward still pays your position and they spill downward, adding depth to your leg. Just remember spillover never qualifies the people below — their own directs do.`},
+    {k:['safe','scam','rug','rug pull','security','audit','trust','legit','contract code','smart contract','can they change','steal'],
+     a:()=>`Fair question — don't take anyone's word for it. We reviewed the complete verified source of the RM Circle smart contract and published a plain-language breakdown at <a href="/contract">rmcircle.saasy.top/contract</a>: the code can never change (no upgrade mechanism exists), member money never sits in the contract (every payment distributes in the same transaction), prices and payout rules are locked forever, and the operator's powers are limited to a short, honest list. Every claim links to the blockchain so you can verify it yourself. Code security isn't an income guarantee though — results depend on real participation, and POL's value moves.`},
     {k:['spillover','spill over','spill','under me but not qualified','people under me','not my direct','passed over','missed payment','skipped','why am i not qualified'],
      a:()=>`<strong>Spillover</strong> happens when someone's sponsor already has both matrix slots full — the smart contract then places the new member in the next open slot further down, which can be under YOU. Spillover fills your matrix and sets up future upgrade payments to your position, but it does <strong>not</strong> count toward your qualification: only people who join using <em>your</em> ID are your directs. That's why you can see 2 under you and still show 1/2. And important: upgrade payments only stop at positions that are qualified (2 directs) AND at the required level — otherwise the payment passes you by to the next eligible upline. Check your position on your <a href="/my">Member Dashboard</a> — spillover placements are tagged there.`},
     {k:['level','levels','upgrade','scintilla','ascensus','fabrica','culmen','apex','fastigium','vertex','corona','8 levels'],

public/contract.html

@@ -0,0 +1,31 @@
+<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="description" content="How the RM Circle smart contract works — what's locked forever, what the operator can and can't do, and how to verify every claim yourself on the blockchain."><title>Smart Contract Security | Crypto Team Build</title>
+<link rel="canonical" href="https://rmcircle.saasy.top/contract">
+<meta property="og:type" content="website"><meta property="og:site_name" content="Crypto Team Build Network"><meta property="og:title" content="How the RM Circle Smart Contract Works — and Why the Bottom Can't Fall Out"><meta property="og:description" content="The code can never change, member money never sits in the contract, and every rule is public. A plain-language review of the verified source — with links to check everything yourself."><meta property="og:image" content="https://rmcircle.saasy.top/og-card.jpg"><meta property="og:image:width" content="1200"><meta property="og:image:height" content="630">
+<meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="RM Circle Smart Contract — plain-language security review"><meta name="twitter:description" content="What's locked forever, what the operator can and can't do, and how to verify it all yourself."><meta name="twitter:image" content="https://rmcircle.saasy.top/og-card.jpg"><link rel="stylesheet" href="/styles.css"></head>
+<body>
+<header class="wrap nav"><a class="brand" href="/"><div class="brand-mark">RM</div><span><span id="brandName">Crypto Team Build</span><small>Contract Security</small></span></a><div class="nav-actions"><a class="btn btn-secondary hide-mobile" href="/">← Strategy</a><a class="btn btn-primary" href="/start">Get Started</a></div></header>
+<main>
+<section class="section"><div class="wrap" style="max-width:880px">
+<div class="section-head"><div class="eyebrow">Plain-language code review</div><h1 style="font-size:clamp(32px,5vw,50px);margin:8px 0 10px">Can the bottom fall out of this? <span class="gold">We read the code.</span></h1><p>Every payment in the RM Circle runs through one smart contract on the Polygon blockchain. We reviewed its complete, verified source line by line. Here's what it says — in plain language, with links so you can check every claim yourself. Nobody has to take our word for anything.</p></div>
+
+<div class="facts" style="grid-template-columns:repeat(3,1fr);margin:18px 0 26px"><div class="fact"><small>Contract</small><strong style="font-size:13px"><a href="https://polygonscan.com/address/0x33BdAEEfd6d17D80aE53816c916dFb26c4fB2DAF" target="_blank" rel="noopener noreferrer" style="color:var(--teal)">0x33Bd…2DAF ↗</a></strong></div><div class="fact"><small>Network</small><strong>Polygon Mainnet</strong></div><div class="fact"><small>Source verified</small><strong style="font-size:13px"><a href="https://repo.sourcify.dev/contracts/full_match/137/0x33BdAEEfd6d17D80aE53816c916dFb26c4fB2DAF/" target="_blank" rel="noopener noreferrer" style="color:var(--teal)">Exact match ↗</a></strong></div></div>
+
+<div class="card" style="margin-bottom:16px"><h2 style="margin:0 0 10px">1. The code can never change.</h2><p style="color:var(--muted);line-height:1.65;margin:0">Some crypto projects use "upgradeable" contracts — the operator can swap in new code after you've joined, changing the rules underneath you. <strong style="color:var(--text)">This contract has none of that machinery.</strong> No proxy, no delegatecall, no self-destruct — the three mechanisms that allow post-launch changes are simply absent from the code. What was deployed on May 27, 2026 is what runs today and what will run in ten years. And because the source is verified as an <em>exact bytecode match</em>, the code we reviewed is provably the code that's running — not a copy, not a claim.</p></div>
+
+<div class="card" style="margin-bottom:16px"><h2 style="margin:0 0 10px">2. Member money never sits in the contract.</h2><p style="color:var(--muted);line-height:1.65;margin:0">There is no pool, no vault, no balance an operator could run away with. When someone joins or upgrades, the contract splits and delivers every coin <strong style="color:var(--text)">in the same transaction</strong> — sponsor reward, upline payment, fees — straight to member wallets. If any single transfer fails, the whole transaction reverses and nobody pays anything. You can watch this happen live on the <a href="/#proof" style="color:var(--teal)">payment proof feed</a>: money in, money out, same block.</p></div>
+
+<div class="card" style="margin-bottom:16px"><h2 style="margin:0 0 10px">3. The prices and payout rules are locked.</h2><p style="color:var(--muted);line-height:1.65;margin:0">Entry and upgrade costs for all 8 levels were fixed the moment the contract deployed — <strong style="color:var(--text)">there is no function to change them.</strong> The payout split is compiled into the code as constants: on entries, the sponsor receives the slot cost minus a 5% project fee (founders 1% + 1%, development 3%); on upgrades, <strong style="color:var(--text)">100% goes to the eligible upline — the project takes nothing.</strong> There's also no pause switch: nobody can freeze joins, upgrades, or payouts. The eligibility rule is public too: an upgrade payment stops at the first upline who is qualified (2 directs) and already at that level — otherwise it passes them and continues up.</p></div>
+
+<div class="card" style="margin-bottom:16px"><h2 style="margin:0 0 10px">4. What the operator CAN do — the honest list.</h2><p style="color:var(--muted);line-height:1.65;margin:0 0 10px">A fair review reports the levers, not just the locks. The contract owner can do exactly four things:</p><ul style="color:var(--muted);line-height:1.7;margin:0;padding-left:20px"><li>Raise or lower the <strong style="color:var(--text)">entry fee percentage</strong> (currently 5%, hard-capped at 50% in the code). This affects the price of <em>future</em> joins only — it can't touch anyone's earnings, and any change is instantly visible on the blockchain.</li><li>Redirect the <strong style="color:var(--text)">project's own fee wallets</strong> (founder/development shares) — their revenue, never member payouts.</li><li>Sweep out coins <strong style="color:var(--text)">accidentally sent</strong> to the contract address — member payment flows never leave a balance behind.</li><li>Transfer ownership of those same limited powers to someone else.</li></ul><p style="color:var(--muted);line-height:1.65;margin:10px 0 0">What the owner <strong style="color:var(--text)">cannot</strong> do: take member funds, change payout rules, change prices, reroute earnings, block withdrawals (there's nothing to withdraw — payments are instant), or replace the code. Even a fully hostile owner is limited to that list above.</p></div>
+
+<div class="card" style="margin-bottom:16px"><h2 style="margin:0 0 10px">5. Where "missed" payments go.</h2><p style="color:var(--muted);line-height:1.65;margin:0">When an upgrade payment finds no eligible upline within 16 levels (or reaches the root), it goes to the project's fee wallet rather than vanishing. That's the strongest built-in reason to <strong style="color:var(--text)">get your 2 directs and keep your level current</strong> — eligible positions catch payments; ineligible positions watch them pass by. The <a href="/my" style="color:var(--teal)">Member Dashboard</a> shows exactly this happening in real time.</p></div>
+
+<div class="card" style="margin-bottom:16px"><h2 style="margin:0 0 10px">Check it yourself — please.</h2><ul style="color:var(--muted);line-height:1.8;margin:0;padding-left:20px"><li><a href="https://polygonscan.com/address/0x33BdAEEfd6d17D80aE53816c916dFb26c4fB2DAF" target="_blank" rel="noopener noreferrer" style="color:var(--teal)">The contract on Polygonscan ↗</a> — every transaction, ever, public.</li><li><a href="https://repo.sourcify.dev/contracts/full_match/137/0x33BdAEEfd6d17D80aE53816c916dFb26c4fB2DAF/" target="_blank" rel="noopener noreferrer" style="color:var(--teal)">The verified source code ↗</a> — the exact code that's running, independently verified.</li><li><a href="/#proof" style="color:var(--teal)">The live payment feed</a> — every payout on this site links to its blockchain transaction.</li><li>Ask any developer you trust to read the source against this page. It's ~400 lines.</li></ul></div>
+
+<div class="callout warning"><strong>What this page is not:</strong> code security is not an income guarantee. This review says the <em>rules can't change underneath you</em> — it does not promise the program grows, that positions fill, or that POL holds its value. Results depend on real participation and duplication, and POL's market price moves. Never use funds you can't afford to lose.</div>
+
+<p class="micro" style="margin-top:18px">Review method: complete verified source (Sourcify exact-match, creation + runtime bytecode) read against the deployed contract on 2026-08-13; payout math cross-checked against live on-chain transactions. Reviewed independently by this team's tooling — not by the contract's developers.</p>
+</div></section>
+</main>
+<footer class="wrap disclaimer">This independent team page is educational and is not an earnings guarantee or investment advice. Cryptocurrency and smart-contract participation involve risk, including possible loss of funds. Never use funds you cannot afford to lose.<div class="footer-links"><a href="/">Strategy</a><a href="/start">Getting Started</a><a href="/training">Training</a><a href="/my">Member Dashboard</a></div></footer>
+<script src="/track.js"></script><script src="/chat.js" defer></script></body></html>

public/index.html

@@ -11,7 +11,7 @@
 <section id="strategy" class="section"><div class="wrap"><div class="section-head"><div class="eyebrow">The strategy</div><h2>Simple enough to duplicate.</h2><p>Each position gets two directs to qualify, then retires its link and helps the next two positions repeat the process. Late signups on a qualified link are a welcome bonus — they pay that member and spill downward as depth.</p></div><div class="grid-3"><article class="card"><div class="card-icon">2</div><h3>Get exactly two</h3><p>Use your position's link until two direct positions are placed beneath you and your position is qualified.</p></article><article class="card"><div class="card-icon">↘</div><h3>Move the effort down</h3><p>Retire your link and help each of your two directs use their own links until they each have two — that's what qualifies them. If someone still joins through your link anyway, it's a bonus: it pays you and spills down as depth.</p></article><article class="card"><div class="card-icon">↑</div><h3>Upgrade responsibly</h3><p>Use earned POL to advance when practical. Active builders may also choose to self-fund, but only within their own risk tolerance.</p></article></div></div></section>
 <section class="section"><div class="wrap"><div class="section-head"><div class="eyebrow">Moving-link workflow</div><h2>Qualify. Then the effort moves down.</h2></div><div class="flow"><div class="flow-step"><b>Step 1</b><strong>Use link</strong><p>Share the current position's referral link.</p></div><div class="flow-step"><b>Step 2</b><strong>Get 2</strong><p>Place exactly two direct positions.</p></div><div class="flow-step"><b>Step 3</b><strong>Retire link</strong><p>Late signups still spill down — bonus depth, not a problem.</p></div><div class="flow-step"><b>Step 4</b><strong>Help your 2</strong><p>Shift the team effort to their links.</p></div><div class="flow-step"><b>Step 5</b><strong>Repeat</strong><p>Keep the qualification wave moving down.</p></div></div></div></section>
 <section class="section"><div class="wrap"><div class="section-head"><div class="eyebrow">Depth over width</div><h2>2 → 4 → 8 → 16 → 32</h2><p>The first major team milestone is 30 correctly placed positions across the first four generations: 2 + 4 + 8 + 16.</p></div><div class="matrix" aria-label="Matrix growth illustration"><div class="matrix-group"><div class="people"><span class="person"></span><span class="person"></span></div><b>2</b></div><div class="matrix-group"><div class="people"><span class="person"></span><span class="person"></span><span class="person"></span><span class="person"></span></div><b>4</b></div><div class="matrix-group"><div class="people" id="p8"></div><b>8</b></div><div class="matrix-group"><div class="people" id="p16"></div><b>16</b></div></div><div class="notice"><strong>Team principle:</strong> once your two are in place, retire your link and shift to helping them get <em>their</em> two — their own directs are the only thing that qualifies their positions to catch payments. And if an extra signup comes through your link anyway, it's a bonus, not a problem: it still pays your position the entry reward and spills downward to fill an open slot in your leg. Spillover never qualifies the people below, though — so the team effort always moves down.</div></div></section>
-<section class="section" id="proof"><div class="wrap"><div class="section-head"><div class="eyebrow">Live payment proof</div><h2>Real payouts, straight from the blockchain.</h2><p>Every payment in this program happens on a public smart contract on Polygon — nobody can fake, hide, or edit it. Below are the latest member payouts, read live from the contract. Tap any row to verify the transaction yourself on Polygonscan.</p></div><div id="payoutTotals" class="pp-totals"></div><div id="payoutFeed" class="pp-feed"><div class="empty">Reading the blockchain…</div></div><div class="pp-note">Data is read directly from the RM Circle smart contract (<a href="https://polygonscan.com/address/0x33BdAEEfd6d17D80aE53816c916dFb26c4fB2DAF" target="_blank" rel="noopener noreferrer" style="color:var(--teal)">0x33Bd…2DAF</a>) on Polygon Mainnet. Member numbers are on-chain IDs, not names. Past payouts are not a promise of future results.</div></div></section>
+<section class="section" id="proof"><div class="wrap"><div class="section-head"><div class="eyebrow">Live payment proof</div><h2>Real payouts, straight from the blockchain.</h2><p>Every payment in this program happens on a public smart contract on Polygon — nobody can fake, hide, or edit it. Below are the latest member payouts, read live from the contract. Tap any row to verify the transaction yourself on Polygonscan.</p></div><div id="payoutTotals" class="pp-totals"></div><div id="payoutFeed" class="pp-feed"><div class="empty">Reading the blockchain…</div></div><div class="pp-note">Data is read directly from the RM Circle smart contract (<a href="https://polygonscan.com/address/0x33BdAEEfd6d17D80aE53816c916dFb26c4fB2DAF" target="_blank" rel="noopener noreferrer" style="color:var(--teal)">0x33Bd…2DAF</a>) on Polygon Mainnet. Member numbers are on-chain IDs, not names. Past payouts are not a promise of future results. <a href="/contract" style="color:var(--gold)">How the contract works — and why the rules can't change →</a></div></div></section>
 <section class="section"><div class="wrap"><div class="card" style="text-align:center;padding:34px"><div class="eyebrow">Ready to start?</div><h2 style="font-size:38px;margin:10px 0">See the current team placement.</h2><p style="max-width:680px;margin:0 auto 20px;color:var(--muted)">The onboarding page automatically shows the sponsor position the team is currently helping. Always use the sponsor shown there instead of an old screenshot or saved link.</p><a class="btn btn-primary" href="/start">Open Getting Started Instructions →</a></div></div></section>
-</main><footer class="wrap disclaimer">This independent team page is educational and is not an earnings guarantee or investment advice. Cryptocurrency and smart-contract participation involve risk, including possible loss of funds. Never use funds you cannot afford to lose. Results depend on actual participation, qualification, upgrades, smart-contract behavior, and the market value of POL.<div class="footer-links"><a href="/training">Training</a><a href="/start">Getting Started</a><a href="/my">Member Dashboard</a><a href="/admin">Team Admin</a></div></footer>
+</main><footer class="wrap disclaimer">This independent team page is educational and is not an earnings guarantee or investment advice. Cryptocurrency and smart-contract participation involve risk, including possible loss of funds. Never use funds you cannot afford to lose. Results depend on actual participation, qualification, upgrades, smart-contract behavior, and the market value of POL.<div class="footer-links"><a href="/training">Training</a><a href="/start">Getting Started</a><a href="/my">Member Dashboard</a><a href="/contract">Contract Security</a><a href="/admin">Team Admin</a></div></footer>
 <script src="/track.js"></script><script src="/bridge.js"></script><script src="/payouts.js" defer></script><script src="/chat.js" defer></script></body></html>

public/join.html

@@ -26,5 +26,5 @@
 <div class="callout" style="margin-top:16px;max-width:880px;margin-left:auto;margin-right:auto"><strong>What happens next:</strong> get your 2 directs to qualify, then retire your link and help your 2 get their 2 — that's the whole system. You'll get your own invite page just like this one the moment you're in.</div>
 <div class="callout warning" style="margin-top:12px;max-width:880px;margin-left:auto;margin-right:auto"><strong>Risk reminder:</strong> participation involves cryptocurrency and smart-contract risk. No income is guaranteed. Use only funds you can afford to lose.</div></div></section>
 
-</main><footer class="wrap disclaimer">This independent team page is educational and is not an earnings guarantee or investment advice. Cryptocurrency and smart-contract participation involve risk, including possible loss of funds. Never use funds you cannot afford to lose. Results depend on actual participation, qualification, upgrades, smart-contract behavior, and the market value of POL.<div class="footer-links"><a href="/training">Training</a><a href="/my">Member Dashboard</a></div></footer>
+</main><footer class="wrap disclaimer">This independent team page is educational and is not an earnings guarantee or investment advice. Cryptocurrency and smart-contract participation involve risk, including possible loss of funds. Never use funds you cannot afford to lose. Results depend on actual participation, qualification, upgrades, smart-contract behavior, and the market value of POL.<div class="footer-links"><a href="/training">Training</a><a href="/my">Member Dashboard</a><a href="/contract">Contract Security</a></div></footer>
 <script src="/track.js"></script><script src="/join.js"></script><script src="/payouts.js" defer></script><script src="/chat.js" defer></script></body></html>

public/start.html

@@ -15,5 +15,5 @@
 <div class="callout" style="margin-top:16px"><strong>What happens next:</strong> get your 2 directs to qualify, then retire your link and help your 2 get their 2 — their own directs are what qualify them. If an extra referral happens anyway, it's a bonus: it still pays you and spills down your leg. Upgrade with earned POL when practical, and stay ahead of your team's levels so payments never pass you by.</div>
 <div class="callout warning" style="margin-top:12px"><strong>Risk reminder:</strong> participation involves cryptocurrency and smart-contract risk. No income is guaranteed. Use only funds you can afford to lose.</div><div id="supportBox" class="notice" style="margin-top:12px"></div><div id="supportLinkWrap" class="hidden" style="margin-top:10px"><a id="supportLink" class="btn btn-secondary" target="_blank" rel="noopener noreferrer">Open Team Support ↗</a></div></section></div>
 <figure class="roadmap-figure"><a href="/roadmap.webp" target="_blank" rel="noopener"><img src="/roadmap.webp" alt="RM Circle Premium Team Build Roadmap — core strategy, step-by-step guide, premium levels, and duplication formula" width="1149" height="1369" loading="lazy"></a><figcaption>The RM Circle is a team build project of the <strong>Crypto Team Build Network</strong>. This roadmap is the plan every member follows — tap to view full size.</figcaption></figure></div></main>
-<footer class="wrap disclaimer">This is an independent Crypto Team Build onboarding resource, not an owner/principal page. Always confirm transaction details in your wallet before signing. Never disclose your Secret Recovery Phrase.<div class="footer-links"><a href="/my">Already joined? Open your Member Dashboard →</a></div></footer>
+<footer class="wrap disclaimer">This is an independent Crypto Team Build onboarding resource, not an owner/principal page. Always confirm transaction details in your wallet before signing. Never disclose your Secret Recovery Phrase.<div class="footer-links"><a href="/my">Already joined? Open your Member Dashboard →</a><a href="/contract">Contract Security</a></div></footer>
 <script src="/track.js"></script><script src="/start.js"></script><script src="/payouts.js" defer></script><script src="/chat.js" defer></script></body></html>

public/training.html

@@ -26,5 +26,5 @@
 <div class="callout warning" style="max-width:880px;margin:14px auto 0"><strong>Risk reminder:</strong> participation involves cryptocurrency and smart-contract risk. No income is guaranteed. Use only funds you can afford to lose.</div>
 </div></section>
 </main>
-<footer class="wrap disclaimer">This is an independent Crypto Team Build training resource. Always confirm transaction details in your wallet before signing. Never disclose your Secret Recovery Phrase.<div class="footer-links"><a href="/">Strategy</a><a href="/start">Getting Started</a><a href="/admin">Team Admin</a></div></footer>
+<footer class="wrap disclaimer">This is an independent Crypto Team Build training resource. Always confirm transaction details in your wallet before signing. Never disclose your Secret Recovery Phrase.<div class="footer-links"><a href="/">Strategy</a><a href="/start">Getting Started</a><a href="/contract">Contract Security</a><a href="/admin">Team Admin</a></div></footer>
 <script src="/track.js"></script><script src="/training.js"></script><script src="/chat.js" defer></script></body></html>

server.js

@@ -39,7 +39,7 @@ FACTS:
 - 8 Premium levels in order: Scintilla, Ascensus, Fabrica, Culmen, Apex, Fastigium, Vertex, Corona. Everyone starts at Scintilla. Upgrade as quickly as practical, ideally with earned POL; the first two payments at each level help fund the next upgrade. Stay aware of your active downline's levels so you don't fall behind and miss payments.
 - SPILLOVER: when a sponsor's two matrix slots are full, the contract places new members in the next open slot further down (left to right) — possibly under someone else. Spillover fills that member's matrix and sets up future upgrade income to their position, but does NOT count toward qualification: only people who join using a member's own ID are their directs. Upgrade payments travel up the MATRIX (not who-referred-whom) and only stop at positions that are qualified (2 directs) AND already at the level being bought — otherwise the payment passes them by to the next eligible upline. Members can see their own matrix, spillover tags, and payments at https://rmcircle.saasy.top/my
 - Current team sponsor: ${a ? `ID ${a.id}${c.showSponsorName && a.name ? ` (${a.name})` : ''}, ${a.directs}/2 directs` : 'shown on the start page'}. ${waiting} placement(s) waiting. Placements rotate as positions qualify — always verify on https://rmcircle.saasy.top/start right before joining.
-- Site pages: https://rmcircle.saasy.top/ (strategy overview + roadmap), https://rmcircle.saasy.top/start (current sponsor + join steps), https://rmcircle.saasy.top/training (4 videos: 1. How the team build works, 2. Create your MetaMask wallet, 3. Funding your wallet, 4. Buying the Premium position).
+- Site pages: https://rmcircle.saasy.top/ (strategy overview + roadmap), https://rmcircle.saasy.top/start (current sponsor + join steps), https://rmcircle.saasy.top/training (4 videos: 1. How the team build works, 2. Create your MetaMask wallet, 3. Funding your wallet, 4. Buying the Premium position), https://rmcircle.saasy.top/contract (plain-language security review of the verified smart contract — code can't change, no pooled funds, locked rules, honest list of operator powers).
 - Telegram group for live team help: ${c.telegramUrl || 'https://t.me/cryptoteambuild'}
 
 RULES:
@@ -414,7 +414,7 @@ const server=http.createServer(async(req,res)=>{
     if(pathname==='/health'||pathname.startsWith('/api/'))return await handleApi(req,res,pathname);
     if(req.method!=='GET'&&req.method!=='HEAD')return send(res,405,'Method Not Allowed',{'Content-Type':'text/plain; charset=utf-8'});
     let file;
-    if(pathname==='/')file=path.join(PUBLIC_DIR,'index.html');else if(pathname==='/start'||pathname==='/start/')file=path.join(PUBLIC_DIR,'start.html');else if(pathname==='/training'||pathname==='/training/')file=path.join(PUBLIC_DIR,'training.html');else if(pathname==='/admin'||pathname==='/admin/')file=path.join(PUBLIC_DIR,'admin.html');else if(pathname==='/my'||pathname==='/my/'||/^\/my\/\d{1,15}$/.test(pathname))file=path.join(PUBLIC_DIR,'my.html');else if(/^\/join\/\d{1,15}$/.test(pathname))file=path.join(PUBLIC_DIR,'join.html');else if(pathname==='/join'||pathname==='/join/'){res.writeHead(302,{Location:'/start'});return res.end();}else{
+    if(pathname==='/')file=path.join(PUBLIC_DIR,'index.html');else if(pathname==='/start'||pathname==='/start/')file=path.join(PUBLIC_DIR,'start.html');else if(pathname==='/training'||pathname==='/training/')file=path.join(PUBLIC_DIR,'training.html');else if(pathname==='/admin'||pathname==='/admin/')file=path.join(PUBLIC_DIR,'admin.html');else if(pathname==='/my'||pathname==='/my/'||/^\/my\/\d{1,15}$/.test(pathname))file=path.join(PUBLIC_DIR,'my.html');else if(pathname==='/contract'||pathname==='/contract/')file=path.join(PUBLIC_DIR,'contract.html');else if(/^\/join\/\d{1,15}$/.test(pathname))file=path.join(PUBLIC_DIR,'join.html');else if(pathname==='/join'||pathname==='/join/'){res.writeHead(302,{Location:'/start'});return res.end();}else{
       const safe=path.normalize(pathname).replace(/^([.][.][/\\])+/, '').replace(/^[/\\]+/,'');file=path.join(PUBLIC_DIR,safe);if(!file.startsWith(PUBLIC_DIR))file='';
     }
     if(file&&staticFile(req,res,file))return;return staticFile(req,res,path.join(PUBLIC_DIR,'404.html'),404);