docs: record audit fixes (tiers 1–2, H15) + deferred items

AGENTS.md

@@ -1822,6 +1822,48 @@ similar are internal endpoints/hook names, not credits — leave them.)
 - ⚠️ **When wiring a file, keep `en.ts`/`es.ts` key-for-key in sync** and run
   `node scripts/check-i18n.mjs` before committing.
 
+## Security & correctness audit fixes (2026-10-04)
+
+A five-part audit (security · bugs/logic · UI/UX · Nostr interop · flows) was run;
+this is what was FIXED (each behind `npm test` + smoke) and what remains.
+
+**Fixed — money & auth.** Marketplace payments verify the invoice amount
+(`usePayPaymentPointer` → `assertInvoiceAmount`), so a seller can't overcharge via
+a raw BOLT11 or an inflated LNURL invoice. NIP-17 DMs call `verifyEvent(seal)` in
+all four read paths (sender impersonation). `push-service` enforces endpoint
+ownership on subscribe/unsubscribe and validates the endpoint (`isSafePushEndpoint`,
+SSRF) — ⚠️ **requires `npm run deploy:push` to take effect**. The Amber callback no
+longer logs in from a bare `?event=<pubkey>` (must match a pending
+`get_public_key`) and no longer logs the pending-op payload. `usePlatformFee`
+records are per-pubkey (was device-global).
+
+**Fixed — trust/data integrity.** `useAdminModeration` fetches the `cleared` label
+(Admin Undo now propagates cross-device). Admin takedowns publish the NIP-32
+`hidden` label instead of an ignored kind-5. The `/stats` "partial outage" banner
+works (`queryCanonical` gained an `onError` hook). `useShops` has its own cache
+namespace (no longer collides with `useSkateShops`). Listing NIP-05 is verified
+(`verifyNip05`), not self-asserted. NIP-22 spot comments/transfers use uppercase
+root `A`/`K`/`P` and readers accept legacy `#a`. Lab profile edits preserve foreign
+`a` spot refs; collections preserve foreign NIP-51 tags; `LAB_KINDS` = all 13.
+Skip-to-content is a button that focuses `<main>` (HashRouter-safe).
+`CustomizeNavSheet` is translated; `useLocalStorage` re-reads on key change and
+keeps `stateRef` in sync cross-tab; the backup flag is per-account
+(`lib/backup.ts`). Listing detail / Events render `ErrorState` on outage.
+
+**Deferred (documented, NOT fixed).**
+- `H1` — a spot "claim" CLONES rather than transferring (`claim-from` is written
+  but **never read**); needs a designed handoff/resolution, not a patch.
+- `C5b` — a self-asserted `featured` tag still drives **ranking** (ProBadge
+  verifies, ordering doesn't); needs a batch provider-receipt verification pass.
+- `H12` — `paymentVerified` preimage branch is replayable (not bound to the trade).
+- `H13` — offer threads trust the self-declared `role` tag for seller identity.
+- `H14` — an NWC timeout can fall through to a second rail with no
+  `lookupInvoice`, risking a double payment.
+- Medium/Low (offline `publishing` rows never retried; `user-listings` query key
+  built from `Date.now()`; route-cache key ignores origin; Overpass `.elements`
+  crash; number `.toLocaleString()`; assorted i18n/a11y). Ask for the full audit
+  report if needed — it was produced but not stored in the repo.
+
 ## Nostr Protocol Integration
 
 This project comes with custom hooks for querying and publishing events on the Nostr network.