Auditing the rest of the prospect paths after Terry's leak. Every entry
point funnels through /join/<id> — the Telegram Mini App redirects there,
member page-builder pages link there, the public /my/<id> share panel
links there — so the cookie covers all of them.
One gap left: ?direct=1 is the inviter's explicit decision to take the
join under themselves rather than route it down their leg, and only the
id was being remembered. A prospect who opened a direct link and then
wandered through the nav came back through the moving link instead — the
opposite of what the shared link asked for.
The flag now rides along in its own cookie, and both /start and /join-now
prefer an explicit choice over the position's default.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Terry hit this: he shares /join/840, his prospect taps "Training" in the
nav, and by the time they reach /start the site has forgotten him and
offers the COMPANY rotation position — #148. His referral, handed to a
stranger, because the prospect read the training first.
The invite now outlives the page it landed on:
- Serving /join/<id> sets an rmc_ref cookie (30 days, Lax).
- /start reads it (or an explicit ?ref=) and shows the INVITER instead of
the company rotation, routed by exactly the same rules the inviter's own
page uses — direct placement if their position is set that way, else the
next open spot in their leg. The two pages can no longer disagree.
- The Join button carries ?ref through to /join-now, which already knew how
to place a ref correctly but was never being given one from here.
- /join-now also falls back to the cookie when it arrives with no ?ref.
The page now says whose team it is ("Invited by Member #840") rather than
an anonymous "current placement", and when the inviter is already
qualified it says plainly that the entry fills the next open spot in their
team.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
#787 registered at 18:35 CT, 22 minutes after the first join-flow fix, and still had no profile. Two
causes, both fixed:
1. messages.verifyChallenge resolved the wallet through chain.memberIdByAccount, which reads the
CACHED index. Seconds after a registration that wallet is not in it, so the signature was rejected
with "No RM Circle position is registered to this wallet". It now accepts an idHint (the position
id from the member's own registration receipt) and, on a cache miss, reads that id live from the
contract via chain.verifyMember, minting only when the contract says this exact wallet owns it.
That is a stronger proof than the cache, not a weaker one. Now async; the single call site awaits.
2. join-now.js fired the sign-in and a 4.5s redirect in parallel, so the page could navigate away
while the wallet was still showing the signature prompt, and it did not wait for submit-id (which
runs the live verifyMember server-side that seeds the index). It now awaits the report, passes the
receipt id, and redirects only once the signature settles, with a 120s bailout.
qa/signin-fallback.mjs (7 assertions) proves the cold-index path with real secp256k1 signatures and
covers the abuse cases: a hint for a position the wallet does not own is refused, and a signature from
another wallet is refused. Existing suites still pass: profiles-unit 28, gate-e2e 47.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Found by checking the live data: 59 positions registered in the 36h to 2026-09-16 and not one has a
profile row, including #785 which registered 20 minutes after the gate deployed. The join flow
redirects to /my/<newId> but the member arrives with no inbox session, so the gate never runs and the
leader still cannot reach them. join-now.js now takes the one free personal_sign immediately after the
registration confirms, while the wallet is still connected, which is the cheapest moment to ask.
Best-effort: declining does not block the join, and they are asked again on their next sign-in.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The moving link is team-first by design: it routes a new join to whoever needs
directs next, so the position whose link was actually clicked earns no entry
reward. Measured on #21 that came to 80 joins in seven days and zero entry
rewards, while the traffic paying for those joins was the owner's.
For a position being deliberately built out, that default is backwards. Any ID
listed in the new directDefaultIds config now behaves as ?direct=1 on its own
/join/<id> link - including every promo tool, flyer QR and downline-builder
entry that resolves through it - without needing the parameter appended.
?direct=0 still forces rotation for a single share, so the team-first behaviour
stays available rather than being replaced.
Config rather than hard-coded, and editable from the admin settings form, so
which positions get this can change without a deploy.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Mobile users on SafePal/Coinbase/Rabby had no route in — the deep-link help
only offered MetaMask + Trust. Added a wallet-agnostic instruction (open your
wallet app -> Browser/DApp tab -> type the join URL) that works via the
injected provider our EIP-6963 picker already resolves; join-now fills the
sponsor path into the hint. Dashboard no-wallet message made wallet-agnostic
and names SafePal. No guessed SafePal deep-link scheme (unverified).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- /app decodes startapp=<sponsorId>[_<angle>] -> unlinked visitors land on the
sponsor squeeze page /join/<ref>?src=miniapp (linked members still go to
their dashboard); no-invite prospects get a gold Join button -> /join-now
- tg-app.js: sync __rmcInTg flag; external links route out of the webview via
openLink/openTelegramLink (wallet deep links reach the wallet app reliably)
- join-now.js in the webview leads with the MetaMask/Trust deep links (no
injected wallet can exist there); ref + src survive into the wallet browser
- tgbot: links command + weekly digest include the t.me/<bot>/<short>?startapp
Telegram-native invite once config.miniAppShortName is set (new PATCH key)
- Synced chat.js canned answer + AI prompt (prospects can join from the app)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The config API now carries the hourly-cached polUsd; the start page,
training callout, join-page shortfall, and chatbot (canned + AI
prompt) all compute entry dollars live instead of quoting stale
numbers. Post 6/7 copy drops hard "$27 = entry" claims for
pocket-change framing (the video's $27 stays - it describes weekly
wasted spending, which is evergreen).
- GET /api/public/moonpay-url: returns a MoonPay checkout link for POL on
Polygon (pol_polygon). With partner keys in config (moonpayPublicKey/
moonpaySecretKey, now PATCHable), the URL is HMAC-signed and prefilled
with the member's own wallet address + shortfall amount; without keys it
falls back to MoonPay's generic buy page. MoonPay is merchant of record -
the site never touches funds.
- Join page: when the connected wallet can't cover the Premium entry, a
funding box appears with the exact shortfall, a buy button (new tab), and
a refresh-balance button.
- Training page: "buy POL with a card" callout after the funding video with
the three things to get right (POL, Polygon network, own address).
- Start page: one-line card-buy pointer under the sponsor card.
- Chatbot canned answer + AI system prompt updated (funding guidance).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Self-enroll pageviews now tracked as the "joinnow" event (track.js loaded
on the page; server whitelist + admin tiles/columns extended)
- A confirmed on-chain registration in the wallet-connect flow now auto-posts
to the submit-id API, so every self-enroll join records a submission with
source + clickid attribution and fires the purchase event and BeMob postback
with no manual ID entry
- Optional name/handle field on the join page feeds the submission and the
team Telegram alert
- Admin Traffic panel: Join-now views tile, Join-now -> Confirmed conversion,
and a per-source Confirmed column for campaign-level ROI reading
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Both /join-now and /direct-join now discover every injected wallet (Brave,
MetaMask, SafePal, Trust, Coinbase…) via EIP-6963 and, when more than one is
present, show a 'Choose your wallet' picker on connect — instead of blindly
grabbing window.ethereum (which silently hangs when e.g. Brave's built-in wallet
wins the slot). Shared public/rmc-wallet.js; provider resolved on connect and
wallet events bound once after. Falls back to window.ethereum for legacy
single-provider wallets. CSP-safe (6963 icons are data URIs).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
/join-now now honors ?ref=<id> (resolves that member's moving-link joinTarget;
falls back to the global rotation sponsor). Repointed: /start 'Join With Current
Sponsor' -> /join-now; /my pitch buttons -> /join-now?ref=<id>; invite page
/join/<id> join button -> /join-now?ref=<id>; bare /join redirect -> /join-now.
'Get Started' learn CTAs still go to /start for onboarding. When the flag is off,
/join-now gracefully redirects to /start, so the wiring is safe either way.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
/join-now: public self-enroll page gated behind config.dappFallbackPublic
(default off -> redirects to /start, invisible until needed). Auto-assigns the
current rotation sponsor via /api/public/current-sponsor, registers the user's
own wallet, then redirects to /my/<newId> so new members land on their live
position instead of guessing their ID. HTML lives in private/, served only via
the flagged route. Reuses the proven contract engine. Admin /direct-join now
also shows a 'View position ->' link to /my/<newId> after a successful join.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
martbost