docs(audit): register updates — R-10 landed, CQRS/ngm verdicts, forum live-test findings

Folds in the R-10 version-truth sprint status (solid-pod-rs v0.4.0-alpha.16
tag + forum/agentbox repins, operator post-push steps), and records the
forum system live-test: deployed client severed by five unprovisioned
custom-domain API bases baked at compile time, workers verified live on
workers.dev, fix landed in the website repo, gap remediation in flight.

Co-Authored-By: jjohare <github@thedreamlab.uk>

Author: jjohare

docs/audit/2026-06-09-ecosystem/00-anomaly-register.md

@@ -131,6 +131,17 @@ All fixers complete. Per repo (all commits on `main`, none pushed):
 - R-09: provision the real admin KV namespace ID + `PRF_SERVER_SECRET` in Cloudflare.
 - R-14: move ruvector-postgres from bare `docker run` into the compose project.
 - R-11: after reviewing this sprint, push all five repos (nothing was pushed).
+- **R-10** (alpha.15 aliasing — landed this session, see status block below): push
+  solid-pod-rs `main` **and** the new annotated tag `v0.4.0-alpha.16`
+  (`git push origin main --follow-tags`, or `git push origin v0.4.0-alpha.16`
+  explicitly). Then, in nostr-rust-forum, run `cargo update -p solid-pod-rs`
+  (resolves the git+tag pin now that the tag exists, regenerating the
+  git-sourced Cargo.lock entry that was deliberately left at the alpha.15
+  registry entry) and build. Finally, in agentbox, resolve the `lib.fakeHash`
+  placeholder in `lib/solid-pod-rs.nix` via
+  `./scripts/prefetch-hashes.sh --service solid-pod-rs` (the tarball hash could
+  not be computed before the push). None of the three is buildable against the
+  remote until the push completes — this is by design, not breakage.
 
 ## Reconciliation Note — CQRS bus & `urn:ngm` (2026-06-09, dedicated fixer)
 
@@ -226,3 +237,44 @@ direction noted above must be resolved first (which of `urn:ngm:class:` vs
 Both findings supersede follow-on #5 and the `urn:ngm` Revert-vs-Reconcile row.
 Net code change this session: zero (verification-only). Scoped
 `cargo check -p visionclaw-server --features solid-pod-embed` green at HEAD.
+
+## Sprint Status — R-10 alpha.15 aliasing fixer (2026-06-09, follow-on session)
+
+Follow-on #2 ("tag solid-pod-rs `b81ce9f` as a real version; repin forum off
+registry `alpha.15`") executed. The tag was cut over the *current* solid-pod-rs
+HEAD (`f7785d7`, which already carried the R-04 debit fix on top of `b81ce9f`)
+via a version-bump commit, not over `b81ce9f` directly — `f7785d7` is the code
+all consumers should converge on. All commits on `main`, nothing pushed.
+
+| Repo | Item | Status | Commit / tag | Notes |
+|------|------|--------|--------------|-------|
+| solid-pod-rs | version bump 0.4.0-alpha.15 → alpha.16 | DONE | commit `6340a468`, annotated tag `v0.4.0-alpha.16` (object `20223fa`) | Workspace `version`, 7 member crates (via `version.workspace = true`), internal cross-crate path-dep pins, README/docs functional pins + per-crate Status headers, new CHANGELOG/RELEASE_NOTES alpha.16 entry. Cargo.lock is gitignored (library workspace), regenerated locally. `cargo check --workspace` green; wac filter 36 passed, payment filter 59 passed, debit filter 7 passed, 0 failed. First tag since `alpha.11`; cut to kill the aliasing. |
+| nostr-rust-forum | repin off registry alpha.15 → git+tag | DONE | commit `b374317` | Workspace dep `solid-pod-rs` → `{ git = "https://github.com/DreamLab-AI/solid-pod-rs", tag = "v0.4.0-alpha.16", … }`; `deny.toml` comments refreshed (allow-git already present). Verified API-compatible via temporary local **path override** (NOT committed) + native `cargo check -p nostr-bbs-core` — green (solid-pod-rs 0.4.0-alpha.16, `core`). A `[patch]` was insufficient (cargo resolves the git tag before patching); wasm32 cross-check deferred to operator post-push. Cargo.lock left at the alpha.15 registry entry — regenerated by the operator's `cargo update -p solid-pod-rs`. |
+| agentbox | repin `lib/solid-pod-rs.nix` onto alpha.16 | DONE | commit `2be8517f` | `version` → alpha.16, `rev` `b81ce9f` → `6340a468`, aliasing comment rewritten, vendored `solid-pod-rs.cargo-lock` 7 workspace versions → alpha.16 (version-only; closure unchanged). `srcHash` → `lib.fakeHash` placeholder (per troubleshooting.md) — the tarball hash cannot be computed before the operator pushes; `nix build` fails fast on the hash mismatch until resolved, rather than building stale alpha.15 code. Committed alongside, but NOT entangling, the repo's in-flight xr-runtime work (only the two solid-pod-rs files staged). |
+
+**Disposition update for R-10**: from "Tag + repin as follow-on; record in
+version-skew table" to **LANDED (this session)**, modulo the three operator
+push/resolve actions now listed under "Operator actions" above. After those, the
+version-skew matrix row for `solid-pod-rs 0.4.0-alpha.15` collapses: forum and
+agentbox both build `v0.4.0-alpha.16` from the same git commit.
+
+## Sprint Status — Forum system live-test (2026-06-09, Phase 5)
+
+Live browser-sidecar testing of dreamlab-ai.com/community/ found the deployed
+forum **backend-severed**: deploy.yml baked five branded custom-domain API
+bases (relay./api./pods./search./preview.dreamlab-ai.com) into the client at
+compile time, and none exist in DNS (apex is GitHub Pages). All five workers
+are live and healthy on solitary-paper-764d.workers.dev with correct CORS for
+the site origin; protocol-level validation from the page origin confirmed the
+WebAuthn registration challenge (auth-worker 200) and relay REQ/EOSE with
+NIP-42 AUTH (7 channel events). The window.__ENV__ runtime injection is dead
+code in the deployed build — URLs are compile-time only.
+
+Fixed: website 7096fea (API bases → workers.dev, dreamlab.toml pod URLs,
+wrangler POD_BASE_URL mirrors, config-pin tests 25/25), b920bbf (sequence-
+diagram cartography: docs/deployment/forum-flow-cartography.md with ranked
+gap list). Gap remediation (static admin bootstrap, admin-source unification,
+native-pod provisioning vars, fail-closed origin config, NIP-11 auth_required
+truthfulness) delegated to the kit/consumer fixer. Operator: a Pages deploy +
+worker redeploy after push activates the fix; custom-domain DNS provisioning
+remains the documented end-state.