Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@backend/main.py`:
- Line 393: The uncertain_flag expression in the row processing logic is using a
falsy fallback, so a real confidence_score of 0 or 0.0 gets replaced with 1.0
and marked certain. Update the confidence handling in the code path that builds
the row dict in main.py to use an explicit None check instead of “or 1.0”, so
only missing confidence_score values default while valid zero values are
preserved.
- Around line 257-272: The ensemble weight calculation in the main scan payload
is using random.uniform values, so replace the randomized quality signals and
derived weights with real scan-driven metrics or a fixed 50/25/25 weighting in
the payload-building logic. Update the weight computation in the block that sets
gill_quality, eye_quality, body_quality, weight_body, weight_eye, and
weight_gill, and make the matching _row_to_payload path use the same
deterministic source so ensemble.weights reflects the actual documented
weighting instead of per-request randomness.
- Around line 663-702: The edge ONNX scan path is storing the human-readable
freshness label directly into the scan grade field, so history/dashboard records
the wrong grade. In the edge_onnx branch inside the scan insert flow, map
freshness_label to the same stored grade enum used by the demo/real paths before
calling _db().table("scans").insert, and ensure the value passed through
_to_db_grade matches the app’s existing grade format rather than the raw
"Fresh"/"Moderate"/"Spoiled" label.

In `@backend/vendors.py`:
- Around line 104-166: The default review seed is duplicated in both the GET
fallback and the POST initialization inside the vendors review handlers, which
risks them drifting apart. Extract the repeated seed list into a shared helper
such as _default_reviews() in the same module and use it from both the reviews
lookup and add_vendor_review paths so the seed data is defined in one place
only.
- Around line 139-145: The review creation logic in the vendors endpoint
currently reads `review_data` as a raw dict and casts `rating` with
`int(rating)`, which can raise on bad input and accepts invalid scores. Update
the review input handling around the `new_review` construction to use a Pydantic
model (for example, a `ReviewIn` type) with `rating` constrained to 1–5 and a
default `comment`, then access `review_data.rating` and `review_data.comment`
instead of dict lookups and manual casting.
- Around line 8-9: The module-level _REVIEWS_DB fallback in the vendors module
is only in-memory and will not survive restarts or work across multiple workers.
Replace this temporary storage with the same persistent backend used by vendors
and scans, or if it must remain as a stub, add an explicit TODO with an issue
reference so it is clearly temporary. Update the code around _REVIEWS_DB and any
review accessors to use the shared persistent store instead of a dict.
- Around line 129-137: The user lookup in the vendor author resolution block is
passing the Request object into get_current_user, which causes authentication to
fail and fall back to Anonymous Consumer. Update the call in the code path
around auth_header handling to pass the raw Authorization header value instead
of request, and make sure the exception handling in this block does not silently
swallow auth errors so failures are visible. Use the get_current_user call site
and the author assignment logic as the main points to update.
- Around line 122-127: The add_vendor_review route is effectively
unauthenticated because get_current_user is being called with a Request instead
of an Authorization header, so all reviews fall back to Anonymous Consumer.
Update add_vendor_review to require auth via Depends(get_current_user) (or
otherwise pass the proper Authorization value) and use the authenticated user
for review attribution.

In `@src/components/AnalyticsTrends.tsx`:
- Line 4: The AnalyticsTrends component has an unused Calendar import, which is
triggering the no-unused-vars lint error. Update the import in AnalyticsTrends
to remove Calendar, or if it is intended for future use, reference it somewhere
in the component so the import is actually used alongside TrendingUp,
TrendingDown, MapPin, and Award.
- Around line 283-297: The list rendering in AnalyticsTrends uses array indexes
as keys for vendors (and the similar regions list), which can break React
reconciliation when the sorted order changes. Update the map callbacks to use a
stable unique identifier from each item in the AnalyticsTrends render logic,
such as v.name for vendors and the corresponding region identifier for regions,
so re-sorts do not misassociate DOM/state.
- Line 26: The date labels in AnalyticsTrends are hardcoded to the en-IN locale,
so they won’t follow the active language. Update the date formatting logic in
AnalyticsTrends (the dateStr and weekStr computations) to use the current i18n
language from useTranslation() instead of a fixed locale. Keep the formatting
logic centralized so both day and week labels localize consistently for English,
Hindi, and Bengali users.
- Around line 153-169: The tab-toggle buttons in AnalyticsTrends are missing an
explicit type, so they default to submit behavior inside a form. Update both
button elements in the tab switcher to use the button type explicitly while
keeping their existing onClick handlers and styling, so clicking the
daily/weekly tabs only changes activeTab and does not submit a parent form.
- Around line 56-68: The `useMemo` in `AnalyticsTrends` is using `Date.now()`
while building the `vendorMap`, which makes the “recent” cutoff depend on render
time without being tracked as a dependency. Move the current-time value out of
the memoized calculation (or pass it in as an explicit dependency/state) and use
that stable reference inside the `scans.forEach` loop so the split logic
recalculates when time changes, not only when `scans` or `t` changes.
- Around line 82-90: The regional averages data in AnalyticsTrends is hardcoded
and does not use the scans input, so replace the static regions literal with
logic that derives regional values from the scans prop like the daily, weekly,
and vendors sections do. Update the data-building code in AnalyticsTrends to
aggregate scans by region name/key, compute each region’s value and scan count
from actual scan history, and keep the existing t(...) labels only for display
names. Ensure the returned regions array reflects live scan data rather than
fixed mock values.

In `@src/fusionInference.js`:
- Around line 259-266: The confidence calculation in calculateConfidence is
indexing eyeProbs and gillProbs as if they had more than two elements, but
extractEyeScore and extractGillScore only return 2-element vectors. Update
calculateConfidence to use the actual two probabilities for each vector,
recompute the eye and gill confidences from those two values, and ensure the
final system confidence stays normalized so uncertain_flag can trigger
correctly.

In `@src/i18n/locales/bn.json`:
- Around line 262-269: The Bengali leaderboard locale currently has duplicate
aliases for the same strings: the `Leaderboard` page still references
`leaderboard.vendorTrustLeaderboard` and `leaderboard.vendorSubtitle`, so the
added `title` and `subtitle` entries in `src/i18n/locales/bn.json` are unused.
Either update `src/pages/Leaderboard.tsx` to consume the new `title`/`subtitle`
keys consistently, or remove the redundant aliases from the locale and keep the
existing `vendorTrustLeaderboard`/`vendorSubtitle` keys to avoid duplication.

In `@src/i18n/locales/en.json`:
- Line 170: The preservDefault locale string has a capitalization issue after
the period, making the second sentence start incorrectly. Update the text in
en.json for preservDefault so the sentence after “Store below 4°C.” begins with
a capital letter, keeping the rest of the wording unchanged.

In `@src/lib/offlineDb.ts`:
- Around line 23-106: The IndexedDB helpers in offlineDb are leaking open
connections because openDB() is used in addScan, getPendingScans,
updateScanStatus, and deleteScan without ever closing the returned db. Update
each method to close the database after the transaction/request finishes, using
the same transaction.oncomplete/db.close pattern already implied for the first
operation, and make sure the connection is always closed even when the request
fails.

In `@src/pages/AnalysisDashboard.tsx`:
- Line 79: The AnalysisDashboard image preview is creating a blob URL with
URL.createObjectURL(found.image) and never releasing it, which leaks memory.
Update the AnalysisDashboard component to track the generated photo_url value
and add a useEffect cleanup that calls URL.revokeObjectURL for that URL when the
component unmounts or the URL changes, so the created object URL is properly
released.
- Around line 447-491: The interactive spot elements in AnalysisDashboard are
pointer-only because the eye/gill/body hotspots use clickable divs without
button semantics. Update the spot wrappers to use accessible activation in the
same spot-rendering block: preferably switch them to button elements with
type="button", or add role="button", tabIndex={0}, and an onKeyDown handler
alongside the existing onClick/setActiveSpot logic. Ensure the same behavior is
available for each hotspot so keyboard and screen-reader users can select the
active spot and reach the details panel.
- Line 141: The AnalysisDashboard render path assigns alerts from
recommendations.alert_flags but never uses it; remove the unused alerts variable
from the component and keep the surrounding recommendation rendering logic in
place.

In `@src/pages/Leaderboard.tsx`:
- Line 53: The reviews state in Leaderboard is using any[], which triggers the
no-explicit-any lint rule. Define a Review interface with id, author, rating,
comment, and timestamp, then update the useState declaration in Leaderboard to
use Review[] instead of any[] and make sure any review-related code in that
component uses the new type.
- Line 276: The Leaderboard panel still contains hardcoded English literals that
bypass i18n, while nearby UI already uses t() for translated strings. Update the
strings in the Leaderboard component (including the Rating label, the
submit/loading button states, and the empty-state message) to use t() with the
existing locale keys pattern, so all text in this panel is consistently
translated across en/hi/bn.
- Around line 236-241: The close button in Leaderboard.tsx currently relies on
the default submit behavior, and the textarea only has placeholder text without
an accessible name. Update the button in the selected-vendor controls to use
type="button" so it won’t submit a parent form, and add an aria-label to the
textarea in the feedback/input section so screen readers can identify it. Use
the existing button and textarea elements in Leaderboard to locate the fix.
- Line 254: The selected vendor freshness score rendering in Leaderboard.tsx can
crash when avg_freshness_score is null or undefined. Update the selectedVendor
display to use the same null-safe fallback as the list view, in the
selectedVendor rendering path, so it formats a default numeric value before
calling toFixed(1). Keep the fix localized to the
selectedVendor.avg_freshness_score usage.
- Around line 74-80: The authorization header in Leaderboard is reading the
wrong storage key, so the Bearer token is usually missing. Update the token
lookup in Leaderboard to use the shared token helper from src/lib/api.ts instead
of reading 'supabase.auth.token' directly, and make the request reuse that
centralized auth logic so the Authorization header is attached consistently.
- Around line 59-67: The reviews loading effect in Leaderboard is vulnerable to
stale responses and ignores HTTP failures. Update the useEffect around
selectedVendor/fetch to check response status before parsing, and add request
cancellation or an ignore flag so earlier requests cannot overwrite newer vendor
reviews. Use the existing setReviewsLoading flow and the selectedVendor
dependency to ensure only the latest vendor’s data updates state.

In `@src/pages/ResultsPage.tsx`:
- Around line 119-138: Apply the appropriate PR complexity label for this
compare-mode change in ResultsPage; the new compare flow and selection state
around compareMode and setSelectedIds fits complexity: intermediate, so add that
label unless you are labeling the broader stacked ensemble/ML pipeline work, in
which case use complexity: high. Follow the repo’s auto-labeling rule by
assigning exactly one complexity label for the PR.
- Line 284: The modal labels in ResultsPage are still hardcoded English, which
is inconsistent with the rest of the localized UI. Update the strings used in
the comparison modal and cards in ResultsPage—especially the `comparisonLoading`
fallback, the `SPECIMEN A`/`SPECIMEN B` headers, and the `GILLS`/`EYES`/`SCALES`
labels—to use `t(...)` like the existing `results.specimenA` usage. Add or wire
up the corresponding bn/hi/en translation keys for these labels so the same
symbols render correctly across locales.
- Around line 293-301: The comparison modal in ResultsPage is missing
accessibility and keyboard dismissal support. Update the modal container around
the comparison view to use dialog semantics with aria-modal and an accessible
label, add an Escape-to-close handler (for example via a useEffect tied to
comparisonData), allow backdrop clicks to close the modal, and give the
icon-only close button an aria-label so screen readers can identify it. Use the
existing setComparisonData(null) close path and the modal overlay/button markup
in ResultsPage to wire these fixes in.
- Line 19: The comparisonData state in ResultsPage should use the real scan
response type instead of any, since the modal accesses fields from the scan
shape and the current type is triggering the no-explicit-any lint error. Update
the useState declaration for comparisonData to reference the ScanResponse shape
returned by api.getScan, and keep the nested scan1/scan2 objects typed
consistently so accesses like species.common_name and
biomarkers.gill_saturation.score remain type-checked.

In `@src/pages/ScannerPage.tsx`:
- Line 149: The ScannerPage sync toast setup has an unused binding: the return
value from toast.loading in the offline sync flow is assigned to syncToastId but
never referenced. Remove that assignment and continue using the existing literal
id path in the ScannerPage background sync logic (including the toast
update/dismiss calls) so the no-unused-vars lint issue is resolved without
changing behavior.
- Line 492: The SYNC NOW control in ScannerPage’s button markup should
explicitly avoid implicit form submission. Update the `<button>` used for this
action to include `type="button"` so it stays a normal action button even if it
is rendered inside a form; locate the button in the ScannerPage component where
the sync action is defined.
- Line 337: The offline ID suffix in ScannerPage uses the deprecated
String.prototype.substr call. Update the offlineId generation logic to avoid
substr by using slice(2, 11) on the Math.random().toString(36) result, or switch
to crypto.randomUUID() if that fits the surrounding code better. Keep the change
localized to the offlineId creation expression so the ScannerPage flow remains
unchanged.
- Line 371: The catch block in ScannerPage’s fallback branch declares an unused
error variable, which triggers the lint rule; update the `catch (err)` in the
relevant error-handling path to use an optional catch binding since the error is
not referenced. Keep the surrounding fallback logic in `ScannerPage` the same,
and adjust only the catch syntax so the branch still handles failures without
introducing an unused `err` binding.
- Around line 477-501: ScannerPage renders GlassCard in the pending-scans banner
but does not import it, so the component will fail at render time when
pendingCount is greater than zero. Add the missing GlassCard import in
ScannerPage.tsx alongside the other top-level imports, and verify the pending
sync banner still renders correctly when syncingScans and checkAndSyncScans are
used.

---

Outside diff comments:
In `@src/pages/ScannerPage.tsx`:
- Line 397: The runScan callback in ScannerPage.tsx is missing t in its
dependency array, so the translator captured by useCallback can become stale
after a language change. Update the dependency list for runScan to include t,
and verify any related hooks in ScannerPage still satisfy exhaustive-deps after
the change.