docs: note tier-3 fixes + remaining lower-priority items

AGENTS.md

@@ -1859,10 +1859,19 @@ keeps `stateRef` in sync cross-tab; the backup flag is per-account
 - `H13` — offer threads trust the self-declared `role` tag for seller identity.
 - `H14` — an NWC timeout can fall through to a second rail with no
   `lookupInvoice`, risking a double payment.
-- Medium/Low (offline `publishing` rows never retried; `user-listings` query key
-  built from `Date.now()`; route-cache key ignores origin; Overpass `.elements`
-  crash; number `.toLocaleString()`; assorted i18n/a11y). Ask for the full audit
-  report if needed — it was produced but not stored in the repo.
+- Medium/Low **mostly fixed in a follow-up "tier 3" commit**: tour sponsor URL
+  sanitized (XSS); stats persisted-cache reads null-guarded; Overpass no longer
+  assumes `.elements`; `user-listings` query key memoized; Pro grant requires the
+  `l` label; verify-card RSVP maps accepted/tentative; expired listings can't be
+  bought by URL; batch spot photo/status hooks take the relay suffix +
+  `querySkateContent`; offline `publishing` rows requeued; replaceable-event
+  dedupe by author+kind; route cache key includes origin; MarketplacePage uses
+  `<Link>`; EventCountdown reacts to language.
+- Still open (lower priority): self-asserted `featured` gating is the C5b item
+  above; manual Pro "paid" isn't receipt-verified; crew "pending" false positives;
+  background poll tokens aren't unregistered; offer `role` trust (H13); NWC
+  double-pay (H14); a few i18n leftovers (error boundaries, DesktopNavManager,
+  some StashPage literals) and gray-500/600 contrast.
 
 ## Nostr Protocol Integration