skatespots/SkateSpots
1
0
Fork 0
Code Issues Pull requests Projects Releases 11 Packages Wiki Activity Actions 1

docs: mark C5b/H12/H13 fixed; note remaining (H1, H14, manual Pro, i18n)

Browse source
This commit is contained in:
SkateSpots 2026-10-02 23:29:04 +07:00
parent a745bdbbcf
commit 0f0e3f9aa6
1 changed files with 14 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
AGENTS.md
View file

@ -1853,11 +1853,15 @@ keeps `stateRef` in sync cross-tab; the backup flag is per-account
**Deferred (documented, NOT fixed).** **Deferred (documented, NOT fixed).**
- `H1` — a spot "claim" CLONES rather than transferring (`claim-from` is written - `H1` — a spot "claim" CLONES rather than transferring (`claim-from` is written
but **never read**); needs a designed handoff/resolution, not a patch. but **never read**); needs a designed handoff/resolution, not a patch.
- `C5b` — a self-asserted `featured` tag still drives **ranking** (ProBadge - `C5b` — **FIXED**: `src/lib/featuredVerification.ts` verifies a provider-authored
verifies, ordering doesn't); needs a batch provider-receipt verification pass. NIP-57 receipt (cached provider lookup) and the tour/event/Lab list hooks rank
- `H12` — `paymentVerified` preimage branch is replayable (not bound to the trade). only receipt-backed `featured` items; falls back to the self-asserted tag when
- `H13` — offer threads trust the self-declared `role` tag for seller identity. the provider is unreachable (availability over strictness).
- `H14` — an NWC timeout can fall through to a second rail with no - `H12` — **FIXED**: a preimage/deposit proof counts at most once (dedupe), so a
real payment can't be reused to inflate `paymentVerified`.
- `H13` — **FIXED**: the offer seller is always the listing author (derived from
the event pubkey), never a self-declared `role` tag.
- `H14` — an NWC timeout can still fall through to a second rail with no
`lookupInvoice`, risking a double payment. `lookupInvoice`, risking a double payment.
- Medium/Low **mostly fixed in a follow-up "tier 3" commit**: tour sponsor URL - Medium/Low **mostly fixed in a follow-up "tier 3" commit**: tour sponsor URL
sanitized (XSS); stats persisted-cache reads null-guarded; Overpass no longer sanitized (XSS); stats persisted-cache reads null-guarded; Overpass no longer
@ -1867,11 +1871,11 @@ keeps `stateRef` in sync cross-tab; the backup flag is per-account
`querySkateContent`; offline `publishing` rows requeued; replaceable-event `querySkateContent`; offline `publishing` rows requeued; replaceable-event
dedupe by author+kind; route cache key includes origin; MarketplacePage uses dedupe by author+kind; route cache key includes origin; MarketplacePage uses
`<Link>`; EventCountdown reacts to language. `<Link>`; EventCountdown reacts to language.
- Still open (lower priority): self-asserted `featured` gating is the C5b item - Still open (lower priority): manual Pro "paid" isn't receipt-verified; the
above; manual Pro "paid" isn't receipt-verified; crew "pending" false positives; background poll tokens are cleaned up server-side (register replaces per
background poll tokens aren't unregistered; offer `role` trust (H13); NWC pubkey) but `disable()` doesn't unregister; **H1** spot-claim transfer (design);
double-pay (H14); a few i18n leftovers (error boundaries, DesktopNavManager, **H14** NWC double-pay; a few i18n leftovers (some StashPage literals) and
some StashPage literals) and gray-500/600 contrast. gray-500/600 contrast.
## Nostr Protocol Integration ## Nostr Protocol Integration