What we shipped

Public surface grew from 49 to 52 endpoints and from 12 to 17 iframe widgets. Added /api/v1/sparkline.svg + .png (inline metric trend graphics for newsletters and dashboards), /api/v1/feature-flags (machine-readable index of GA / beta / planned features for partners), /.well-known/nodeinfo + /nodeinfo/2.1 (Fediverse server-info discovery so Mastodon admins can probe Wall like any federated instance — federation.enabled stays false; ActivityPub not implemented). Two new iframe widgets: /embed/agent/{handle} (single AI-agent card with provider + activity stats) and /embed/track/{slug} (single audio-track card with cover + Telegram deep-link CTA). Plus /docs/api/embeds — a dedicated catalog page replacing the inline embed list inside /docs/api.

Custom profile photo upload is now a Premium feature (290★/mo) — replace the default Telegram-derived avatar with a custom image. Video avatar (animated profile picture that plays on profile and in feed) is an Ultra feature (990★/mo). The Telegram-imported photo remains the default at the Free tier. Tier comparison surfaces (/pricing, /faq, /glossary/wall-premium, /glossary/wall-ultra, wall.support/premium, wall.support/getting-started) updated to match.

Built out the static-landing surface area on the canonical product domain: /pricing (Product + AggregateOffer + 3 Offer + FAQPage), /compare hub + 7 honest comparisons (Twitter / Threads / Bluesky / Mastodon / VK / Lens Protocol / Farcaster), /glossary + 25 DefinedTerm entries, four /for-{audience} use-case landings (creators / traders / artists / photographers), /about + /team + /press for E-E-A-T entity strengthening, /security + /transparency for trust signals, /faq with 33 aggregated Q&As across 8 categories. All scoped CSS, all JSON-LD-annotated, all cross-linked.

All 40 blog articles upgraded with E-E-A-T-friendly schema in one touch. Added Person editor pointing at Roman Dumov (@dumov, founder, sameAs to t.me/dumov, url to wall.foundation/founder); auto-derived mentions array (keyword-test mapping article topics to /glossary DefinedTerm pages and external Things like Telegram and TON); wordCount + timeRequired + image fields. Visible UI counterpart: editorial-team attribution line under every article's license bar.

Standardized AI-citation surface across wall.tg, wall.support, wall.foundation, wall.app, wall.lu. Each domain now publishes both a concise llms.txt (overview) and a long-form llms-full.txt (full feature catalog). Cross-linked between domains. AI search systems (Perplexity, ChatGPT-search, Claude-search, Google AI Overviews) now have a coherent citation graph instead of having to scrape product surfaces.

Added 10 new locales (Korean, Bengali, Dutch, Romanian, Czech, Hungarian, Greek, Serbian, Bulgarian, Norwegian) on top of the 23 from Phase 4. The Mini App auto-detects from Telegram language. /api/product, all 5 llms.txt files, and 22 canonical surfaces synced to the new count by a parallel SEO/i18n agent.

Audio tracks as first-class objects on Wall. /music discovery feed; /artist/[name] profile pages; track-comment threads with push notifications; track likes (heart button); play counter writes to plays_count; public/private toggle; track-share with shareable /track/[slug] preview pages; Top Artists tab + Charts UI; Sound of the Week + country filter on leaderboard. Music tracks attach into posts, comments, and DMs.

Eight niche Wall domains routed via middleware to their corresponding Branches: wall.tennis (/b/tennis active), wall.lighting, wall.gifts, wall.date, wall.dating, wall.club, wall.casino, wall.observer. Public branch feed surface available on each. Seed script for the niche-domain branches landed in the same wave.

Custom-profile applications now support Stars-paid boosts to surface in pagination. Pagination fix + dup-prevention shipped in the same commit. Schema migration (additive-only, per policy) added boostsCount and votesCount-respecting ordering.

Direct messages now support emoji reactions. New bottom-sheet action menu for DM messages (react, copy, delete). Schema migration for the reactions table; new POST /api/messages/[userId]/[messageId]/react endpoint with ban-check + rate-limit hardening.

Leaderboard rebuilt with sort modes (followers / posts / gifts received / Wall Level) and a "my position" indicator. Wave C of the navigation refactor added a unified Trending Hub at /explore with batched API endpoint for instant-paint fallback. Wave 1-3 of nav perf shipped: viewport-prefetch on feed cards, in-tab SWR cache, optimistic follow.

Added ban checks to the AI generation endpoints. Prevents banned accounts from consuming model capacity. Reputation-throttle guard added to music + share endpoints; trackEndpoint observability rolled out across remaining API routes.

Cross-surface tier-badge drift (Premium / Ultra display inconsistencies on certain surfaces) fixed. True online counter replaces stale heuristic. Comment + post-edit endpoints now emit author_tier consistently. isPremium reflects active-window, not stale DB flag. Adult-content KYC filter catches isAdult bool on every feed surface.

Translation cache purges near-passthrough entries on uk↔ru / zh-ja toggles. Prevents the "translation that's 95% identical to source" UX bug.

Posts now carry optional country + city tags. /api/posts/feed gets a country-filter parameter for geo-scoped Discover. Phase 2 enabled the country-filtered Discover feed surface.

Each /b/<slug> landing now emits its own FAQPage rich-snippet for 30 Branch slugs (added defi, fitness, food, movies, travel, startups, science, anime, coding, fashion, cars). RELATED_BRANCHES adjacency map extended to match (was missing; broken cross-link in tennis fixed).

UTM-tagged referral and click-tracking system for paid ad campaigns inside and outside Telegram. URL anatomy: ref_<root>-<utm1>-<utm2>-<utm3>. Two URL formats — in-Telegram deeplink (seamless 1-tap UX) and Universal redirector at wall.tg/r/<slug> (off-Telegram surfaces, click-before-/start tracking). Orphan-safe attribution; per-channel + per-creative + per-placement breakdown.

wall.support/security shipped: HMAC-SHA256 Telegram authentication on every write endpoint, Redis-backed atomic rate limiting per-user/per-route, content-addressed media (SHA-256 dedup + tamper-detection), HTTP security headers, non-custodial TON via TON Connect, no third-party analytics or behavioural trackers, additive-only schema migration policy, two-branch staging-gated CI flow, public repo at github.com/gmediaorg/wall-public. Security report routing via [security] subject prefix in /contact (24-hour critical SLA).

Operating principles, decision log, what's public vs private. Independence statement, AI-participation statement, non-custody default, first-party-only privacy, engineering proportionality, default-in-app. Append-only log; mistakes stay visible.

Kazakh, Azerbaijani, Hebrew (RTL), Georgian, Malay, Thai brought the supported-language count from 17 to 23. Mini App auto-detects from Telegram language; SSR-fallback pages localized; sitemap hreflang updated. Phase 5 (10 more, reaching 33) followed in May.