From 5596c519c60c0c052dccbfe4e5f46881a909ff3b Mon Sep 17 00:00:00 2001 From: SkateSpots Date: Fri, 2 Oct 2026 22:31:28 +0700 Subject: [PATCH] docs: note tier-3 fixes + remaining lower-priority items --- AGENTS.md | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 7d2a839..dcb76fe 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1859,10 +1859,19 @@ keeps `stateRef` in sync cross-tab; the backup flag is per-account - `H13` — offer threads trust the self-declared `role` tag for seller identity. - `H14` — an NWC timeout can fall through to a second rail with no `lookupInvoice`, risking a double payment. -- Medium/Low (offline `publishing` rows never retried; `user-listings` query key - built from `Date.now()`; route-cache key ignores origin; Overpass `.elements` - crash; number `.toLocaleString()`; assorted i18n/a11y). Ask for the full audit - report if needed — it was produced but not stored in the repo. +- Medium/Low **mostly fixed in a follow-up "tier 3" commit**: tour sponsor URL + sanitized (XSS); stats persisted-cache reads null-guarded; Overpass no longer + assumes `.elements`; `user-listings` query key memoized; Pro grant requires the + `l` label; verify-card RSVP maps accepted/tentative; expired listings can't be + bought by URL; batch spot photo/status hooks take the relay suffix + + `querySkateContent`; offline `publishing` rows requeued; replaceable-event + dedupe by author+kind; route cache key includes origin; MarketplacePage uses + ``; EventCountdown reacts to language. +- Still open (lower priority): self-asserted `featured` gating is the C5b item + above; manual Pro "paid" isn't receipt-verified; crew "pending" false positives; + background poll tokens aren't unregistered; offer `role` trust (H13); NWC + double-pay (H14); a few i18n leftovers (error boundaries, DesktopNavManager, + some StashPage literals) and gray-500/600 contrast. ## Nostr Protocol Integration