diff --git a/.github/workflows/update-live-feed.yml b/.github/workflows/update-live-feed.yml
index 34850426..48aa2982 100644
--- a/.github/workflows/update-live-feed.yml
+++ b/.github/workflows/update-live-feed.yml
@@ -171,20 +171,13 @@ jobs:
           echo 'Initial push failed (likely non-fast-forward). Rebasing and retrying once.'
           git fetch origin main
           if git pull --rebase origin main; then
-            git push
+            git push --force-with-lease
             exit 0
           fi
-          echo 'Rebase conflict detected in generated artifacts; resolving in favor of newly generated files.'
-          git checkout --theirs live-alerts.json || true
-          git checkout --theirs data/quarantined-sources.json || true
-          git checkout --theirs source-quarantine.html || true
-          git checkout --theirs data/source-remediation-sweep.json || true
-          git checkout --theirs data/top-20-source-remediation.json || true
-          git checkout --theirs data/brialert.sqlite || true
-          git add live-alerts.json data/quarantined-sources.json source-quarantine.html \
-            data/source-remediation-sweep.json data/top-20-source-remediation.json data/brialert.sqlite || true
-          git rebase --continue
-          git push
+          echo 'Rebase conflict on generated artifacts — aborting rebase and using merge strategy.'
+          git rebase --abort
+          git merge origin/main -X ours --no-edit
+          git push --force-with-lease
 
   verify-live-feed-freshness:
     needs: commit-live-feed
diff --git a/.gitignore b/.gitignore
index 9451ab94..0b41ad1a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,5 +2,6 @@ node_modules/
 .debug-artifacts/
 .DS_Store
 Thumbs.db
+data/*.sqlite
 data/*.sqlite-wal
 data/*.sqlite-shm
diff --git a/404.html b/404.html
index b0025d94..43e16ebc 100644
--- a/404.html
+++ b/404.html
@@ -5,16 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
   <title>Brialert redirect</title>
   <meta http-equiv="refresh" content="0; url=/index.html">
-  <script>
-    const canonicalTarget = location.pathname.toLowerCase().includes('/brialert')
-      ? '/Brialert/index.html'
-      : '/index.html';
-    const query = location.search || '';
-    const hash = location.hash || '';
-    if (location.pathname.toLowerCase() !== canonicalTarget.toLowerCase()) {
-      location.replace(canonicalTarget + query + hash);
-    }
-  </script>
+  <script src="app/redirect.js"></script>
   <style>
     body {
       margin: 0;
diff --git a/api/_lib/admin-session.js b/api/_lib/admin-session.js
index f57724a6..235701ab 100644
--- a/api/_lib/admin-session.js
+++ b/api/_lib/admin-session.js
@@ -95,8 +95,12 @@ function verifySignedToken(rawToken) {
   const expectedSignature = signToken(encodedPayload);
   const expectedBuffer = Buffer.from(expectedSignature);
   const receivedBuffer = Buffer.from(encodedSignature);
-  if (expectedBuffer.length !== receivedBuffer.length) return null;
-  if (!crypto.timingSafeEqual(expectedBuffer, receivedBuffer)) return null;
+  const maxLen = Math.max(expectedBuffer.length, receivedBuffer.length);
+  const paddedExpected = Buffer.alloc(maxLen);
+  const paddedReceived = Buffer.alloc(maxLen);
+  expectedBuffer.copy(paddedExpected);
+  receivedBuffer.copy(paddedReceived);
+  if (!crypto.timingSafeEqual(paddedExpected, paddedReceived) || expectedBuffer.length !== receivedBuffer.length) return null;
   try {
     const payload = JSON.parse(base64UrlDecode(encodedPayload));
     if (!payload || typeof payload !== 'object') return null;
@@ -146,17 +150,15 @@ function serializeCookie(parts, value, maxAgeSeconds) {
 export function applyCorsHeaders(request, response, methods) {
   const requestOrigin = normaliseOrigin(request?.headers?.origin);
   const allowedOrigins = new Set(getAllowedOrigins());
-  if (requestOrigin && allowedOrigins.has(requestOrigin)) {
+  const originAllowed = !requestOrigin || allowedOrigins.has(requestOrigin);
+  if (requestOrigin && originAllowed) {
     response.setHeader('Access-Control-Allow-Origin', requestOrigin);
     response.setHeader('Access-Control-Allow-Credentials', 'true');
     response.setHeader('Vary', 'Origin');
   }
   response.setHeader('Access-Control-Allow-Methods', methods);
   response.setHeader('Access-Control-Allow-Headers', 'Content-Type');
-  if (request?.method === 'OPTIONS') {
-    return !requestOrigin || allowedOrigins.has(requestOrigin);
-  }
-  return true;
+  return originAllowed;
 }
 
 export function readAdminSession(request) {
diff --git a/api/_lib/github-persistence.js b/api/_lib/github-persistence.js
index 4b135aba..86a08a84 100644
--- a/api/_lib/github-persistence.js
+++ b/api/_lib/github-persistence.js
@@ -66,18 +66,62 @@ function encodeBase64(plainText) {
   return Buffer.from(plainText, 'utf8').toString('base64');
 }
 
-function parseJsonFile(raw, filePath) {
+function parseJsonFile(raw) {
   try {
     return JSON.parse(raw);
-  } catch (error) {
+  } catch {
     throw new ApiError(
       'persistence-failure',
-      `Invalid JSON in ${filePath}: ${error instanceof Error ? error.message : String(error)}`,
+      'Repository data file contains invalid JSON.',
       500
     );
   }
 }
 
+/**
+ * Returns true when a hostname looks like a private, loopback, link-local, or
+ * otherwise non-routable address that must be rejected to prevent SSRF.
+ * Checks the raw hostname string — no DNS resolution is performed, so only
+ * literal IP addresses and well-known internal hostnames are caught.
+ */
+function isPrivateOrReservedHost(hostname) {
+  const host = String(hostname || '').toLowerCase();
+  if (!host) return true;
+
+  // Loopback / localhost
+  if (host === 'localhost' || host === '[::1]') return true;
+
+  // Strip IPv6 brackets for numeric checks
+  const bare = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+
+  // IPv6 loopback & link-local
+  if (bare === '::1' || bare.startsWith('fe80:') || bare.startsWith('fc00:') || bare.startsWith('fd00:')) return true;
+
+  // IPv4 dotted-quad checks
+  const ipv4Parts = bare.split('.');
+  if (ipv4Parts.length === 4 && ipv4Parts.every((p) => /^\d{1,3}$/.test(p))) {
+    const octets = ipv4Parts.map(Number);
+    if (octets.some((o) => o > 255)) return true;             // malformed — block as suspicious
+    const [a, b] = octets;
+    if (a === 127) return true;                              // 127.0.0.0/8   loopback
+    if (a === 10) return true;                               // 10.0.0.0/8    private
+    if (a === 172 && b >= 16 && b <= 31) return true;        // 172.16.0.0/12 private
+    if (a === 192 && b === 168) return true;                 // 192.168.0.0/16 private
+    if (a === 169 && b === 254) return true;                 // 169.254.0.0/16 link-local
+    if (a === 0) return true;                                // 0.0.0.0/8
+    if (a === 100 && b >= 64 && b <= 127) return true;      // 100.64.0.0/10 CGN shared
+    if (a === 198 && (b === 18 || b === 19)) return true;    // 198.18.0.0/15 benchmarking
+    if (a >= 224) return true;                               // 224+  multicast / reserved
+  }
+
+  // Block common internal / metadata hostnames
+  if (host.endsWith('.local') || host.endsWith('.internal') || host.endsWith('.localhost')) return true;
+  // Cloud provider metadata endpoints
+  if (host === '169.254.169.254' || host === 'metadata.google.internal') return true;
+
+  return false;
+}
+
 export function validateAbsoluteHttpUrl(value, code = 'invalid-url') {
   const trimmed = String(value || '').trim();
   if (!trimmed) {
@@ -92,6 +136,9 @@ export function validateAbsoluteHttpUrl(value, code = 'invalid-url') {
   if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
     throw new ApiError(code, 'Replacement URL must use http or https.', 400);
   }
+  if (isPrivateOrReservedHost(parsed.hostname)) {
+    throw new ApiError(code, 'URL must not point to a private or internal network address.', 400);
+  }
   return parsed.toString();
 }
 
@@ -120,7 +167,7 @@ export async function loadJsonFile(pathName) {
     config,
     path: pathName,
     sha: payload.sha,
-    data: parseJsonFile(content, pathName)
+    data: parseJsonFile(content)
   };
 }
 
diff --git a/api/approve-source.js b/api/approve-source.js
index 3d5c9141..c202da95 100644
--- a/api/approve-source.js
+++ b/api/approve-source.js
@@ -156,7 +156,9 @@ async function resolveShardPath(config, approvedSource, shardPaths) {
 }
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'POST,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'POST,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     response.setHeader('Allow', 'POST,OPTIONS');
     return response.status(204).end();
@@ -251,8 +253,8 @@ export default async function handler(request, response) {
       try {
         await dispatchWorkflow(requestsFile.config, FEED_WORKFLOW_FILENAME);
         workflowTriggered = true;
-      } catch (error) {
-        workflowMessage = error instanceof Error ? error.message : String(error);
+      } catch {
+        workflowMessage = 'Feed refresh workflow could not be triggered.';
       }
     }
 
diff --git a/api/auth/logout.js b/api/auth/logout.js
index 53fbf738..1b29d9fd 100644
--- a/api/auth/logout.js
+++ b/api/auth/logout.js
@@ -4,7 +4,9 @@ import {
 } from '../_lib/admin-session.js';
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'POST,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'POST,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     return response.status(204).end();
   }
diff --git a/api/auth/session.js b/api/auth/session.js
index 8c9b9982..68dd401e 100644
--- a/api/auth/session.js
+++ b/api/auth/session.js
@@ -19,7 +19,9 @@ function startLoginUrlFor(originHint) {
 }
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'GET,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'GET,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     return response.status(204).end();
   }
diff --git a/api/quarantined-sources.js b/api/quarantined-sources.js
index 448ab893..d5f660b9 100644
--- a/api/quarantined-sources.js
+++ b/api/quarantined-sources.js
@@ -61,7 +61,9 @@ function sanitiseRequests(rawRequests) {
 }
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'GET,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'GET,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     response.setHeader('Allow', 'GET,OPTIONS');
     return response.status(204).end();
diff --git a/api/request-source.js b/api/request-source.js
index e54cf0a6..9a31576b 100644
--- a/api/request-source.js
+++ b/api/request-source.js
@@ -235,7 +235,9 @@ function sortNewestFirst(items) {
 }
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'GET,POST,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'GET,POST,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     response.setHeader('Allow', 'GET,POST,OPTIONS');
     return response.status(204).end();
diff --git a/api/restore-source.js b/api/restore-source.js
index 8ae89803..daedaa4c 100644
--- a/api/restore-source.js
+++ b/api/restore-source.js
@@ -160,7 +160,9 @@ async function resolveShardPath(config, restoredSource, shardPaths) {
 }
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'POST,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'POST,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     response.setHeader('Allow', 'POST,OPTIONS');
     return response.status(204).end();
@@ -274,8 +276,8 @@ export default async function handler(request, response) {
       try {
         await dispatchWorkflow(quarantinedFile.config, FEED_WORKFLOW_FILENAME);
         workflowTriggered = true;
-      } catch (error) {
-        workflowMessage = error instanceof Error ? error.message : String(error);
+      } catch {
+        workflowMessage = 'Feed refresh workflow could not be triggered.';
       }
     }
 
diff --git a/api/trigger-live-feed.js b/api/trigger-live-feed.js
index ee133a65..cdf957f3 100644
--- a/api/trigger-live-feed.js
+++ b/api/trigger-live-feed.js
@@ -34,7 +34,9 @@ function sendError(response, error) {
 }
 
 export default async function handler(request, response) {
-  applyCorsHeaders(request, response, 'POST,OPTIONS');
+  if (!applyCorsHeaders(request, response, 'POST,OPTIONS')) {
+    return response.status(403).json({ ok: false, error: 'origin-not-allowed', detail: 'Cross-origin request from disallowed origin.' });
+  }
   if (request.method === 'OPTIONS') {
     response.setHeader('Allow', 'POST,OPTIONS');
     return response.status(204).end();
@@ -60,6 +62,11 @@ export default async function handler(request, response) {
       });
     }
 
+    // Claim the slot before the async dispatch so concurrent requests see
+    // the lock immediately (avoids check-then-act race).
+    const previousTriggerTime = lastTriggerTime;
+    lastTriggerTime = now;
+
     const config = getRepoConfig();
 
     const dispatchUrl = `${GITHUB_API_BASE}/repos/${config.owner}/${config.repo}/actions/workflows/${WORKFLOW_FILENAME}/dispatches`;
@@ -79,26 +86,19 @@ export default async function handler(request, response) {
     });
 
     if (!dispatchResponse.ok) {
-      const errorText = await dispatchResponse.text().catch(() => '');
+      // Roll back so the next request can retry after a real failure.
+      lastTriggerTime = previousTriggerTime;
       let errorMessage = 'Failed to trigger workflow dispatch.';
-      try {
-        const errorPayload = JSON.parse(errorText);
-        errorMessage = errorPayload.message || errorMessage;
-      } catch {
-        // Use default error message
-      }
 
       if (dispatchResponse.status === 401 || dispatchResponse.status === 403) {
-        throw new ApiError('unauthorized', errorMessage, 503);
+        throw new ApiError('unauthorized', 'GitHub API authentication failed.', 503);
       }
       if (dispatchResponse.status === 404) {
-        throw new ApiError('workflow-not-found', `Workflow ${WORKFLOW_FILENAME} not found.`, 404);
+        throw new ApiError('workflow-not-found', 'Workflow not found.', 404);
       }
       throw new ApiError('trigger-failed', errorMessage, 500);
     }
 
-    lastTriggerTime = now;
-
     return response.status(200).json({
       ok: true,
       detail: 'Live feed workflow triggered successfully. New feed data should appear within 2-5 minutes.',
diff --git a/app/boot/index.mjs b/app/boot/index.mjs
index ec9bf58a..8fdb36ac 100644
--- a/app/boot/index.mjs
+++ b/app/boot/index.mjs
@@ -14,7 +14,6 @@ import {
 import { MAP_VIEW_MODES } from '../../shared/ui-constants.mjs';
 import { createModalRuntime } from '../render/modal.mjs';
 import {
-  BRIEFING_MODE_STORAGE_KEY,
   GEO_LOOKUP_URL,
   MAP_INIT_FALLBACK_DELAY_MS,
   MAP_INIT_IDLE_TIMEOUT_MS,
diff --git a/app/feed/index.mjs b/app/feed/index.mjs
index c4675f5c..4833cf1e 100644
--- a/app/feed/index.mjs
+++ b/app/feed/index.mjs
@@ -4,6 +4,7 @@ import {
   loadWatchGeography
 } from '../../shared/feed-controller.mjs';
 import { reportBackgroundError } from '../../shared/logger.mjs';
+import { DEFAULT_API_BASE } from '../../shared/api-base.mjs';
 
 const MANUAL_REFRESH_POLL_INTERVAL_MS = 5_000;
 const MANUAL_REFRESH_MAX_WAIT_MS = 90_000;
@@ -15,7 +16,7 @@ function currentOriginBase() {
 }
 
 const LIVE_FEED_TRIGGER_API_BASES = [
-  'https://brialertbackend.vercel.app',
+  DEFAULT_API_BASE,
   currentOriginBase()
 ].filter(Boolean);
 const LIVE_FEED_TRIGGER_API_PATHS = [
diff --git a/app/feed/source-requests.mjs b/app/feed/source-requests.mjs
index 58a40395..77a4fb8d 100644
--- a/app/feed/source-requests.mjs
+++ b/app/feed/source-requests.mjs
@@ -1,17 +1,19 @@
 import { reportBackgroundError } from '../../shared/logger.mjs';
+import { DEFAULT_API_BASE } from '../../shared/api-base.mjs';
 
 const SOURCE_REQUEST_TIMEOUT_MS = 12_000;
 const SOURCE_REQUEST_WINDOW_MS = 5 * 60 * 1000;
 const SOURCE_REQUEST_MAX_PER_WINDOW = 30;
 const SOURCE_REQUEST_COOLDOWN_MS = 2_000;
-const SOURCE_REQUEST_BACKEND_BASE = 'https://brialertbackend.vercel.app';
+const SOURCE_REQUEST_BACKEND_BASE = DEFAULT_API_BASE;
 
 const sourceRequestRateState = {
   recentAttemptsMs: [],
   lastAttemptAtMs: 0
 };
 
-function clean(value) {
+/** Trim-only string coercion — intentionally simpler than taxonomy.clean() which also splits camelCase. */
+function trimString(value) {
   return String(value || '').trim();
 }
 
@@ -22,7 +24,7 @@ function currentOriginBase() {
 }
 
 function resolveApiUrls(apiUrl) {
-  const trimmed = clean(apiUrl);
+  const trimmed = trimString(apiUrl);
   if (!trimmed) return [];
   if (/^https?:\/\//i.test(trimmed)) return [trimmed];
   const bases = [SOURCE_REQUEST_BACKEND_BASE, currentOriginBase()].filter(Boolean);
@@ -32,7 +34,7 @@ function resolveApiUrls(apiUrl) {
 function normaliseRequestUrl(value) {
   let parsed;
   try {
-    parsed = new URL(clean(value));
+    parsed = new URL(trimString(value));
   } catch {
     throw new Error('Enter a valid http(s) source link.');
   }
@@ -44,10 +46,17 @@ function normaliseRequestUrl(value) {
 }
 
 function enforceClientRateLimit(nowMs = Date.now()) {
+  // Discard timestamps from the future (clock skew / backwards adjustment)
+  // and timestamps outside the rate-limit window in a single pass.
   sourceRequestRateState.recentAttemptsMs = sourceRequestRateState.recentAttemptsMs.filter(
-    (attemptMs) => nowMs - attemptMs < SOURCE_REQUEST_WINDOW_MS
+    (attemptMs) => attemptMs <= nowMs && nowMs - attemptMs < SOURCE_REQUEST_WINDOW_MS
   );
 
+  if (sourceRequestRateState.lastAttemptAtMs > nowMs) {
+    // Clock moved backward — reset cooldown so the user isn't locked out.
+    sourceRequestRateState.lastAttemptAtMs = 0;
+  }
+
   if (
     sourceRequestRateState.lastAttemptAtMs
     && (nowMs - sourceRequestRateState.lastAttemptAtMs) < SOURCE_REQUEST_COOLDOWN_MS
@@ -65,11 +74,11 @@ function enforceClientRateLimit(nowMs = Date.now()) {
 
 function normalisedEndpointKey(endpoint) {
   try {
-    const url = new URL(clean(endpoint));
+    const url = new URL(trimString(endpoint));
     url.hash = '';
     return url.toString().replace(/\/$/, '');
   } catch {
-    return clean(endpoint).replace(/\/$/, '');
+    return trimString(endpoint).replace(/\/$/, '');
   }
 }
 
@@ -150,7 +159,7 @@ export async function submitSourceRequest(state, { apiUrl, url, regionHint }) {
         return {};
       });
       if (!response.ok) {
-        throw new Error(clean(payload?.detail) || `HTTP ${response.status}`);
+        throw new Error(trimString(payload?.detail) || `HTTP ${response.status}`);
       }
 
       const requests = Array.isArray(payload?.requests)
diff --git a/app/redirect.js b/app/redirect.js
new file mode 100644
index 00000000..76170695
--- /dev/null
+++ b/app/redirect.js
@@ -0,0 +1,10 @@
+(function () {
+  var canonicalTarget = location.pathname.toLowerCase().includes('/brialert')
+    ? '/Brialert/index.html'
+    : '/index.html';
+  var query = location.search || '';
+  var hash = location.hash || '';
+  if (location.pathname.toLowerCase() !== canonicalTarget.toLowerCase()) {
+    location.replace(canonicalTarget + query + hash);
+  }
+})();
diff --git a/app/render/live.mjs b/app/render/live.mjs
index d28a6b06..bea4386b 100644
--- a/app/render/live.mjs
+++ b/app/render/live.mjs
@@ -90,7 +90,7 @@ export function renderPriority({ state, elements, view, modalController }) {
   elements.priorityCard.onclick = () => modalController.openDetail(alert);
 }
 
-export function renderBriefingMode({ state, elements, view, modalController }) {
+export function renderBriefingMode({ state, elements, view, modalController: _modalController }) {
   if (!state.briefingMode) {
     elements.briefingModePanel.classList.add('hidden');
     return;
diff --git a/app/render/modal-remote-client.mjs b/app/render/modal-remote-client.mjs
index 1c04f841..cef7e53e 100644
--- a/app/render/modal-remote-client.mjs
+++ b/app/render/modal-remote-client.mjs
@@ -1,5 +1,7 @@
+import { DEFAULT_API_BASE } from '../../shared/api-base.mjs';
+
 const LONG_BRIEF_API_URLS = [
-  'https://brialertbackend.vercel.app/api/generate-brief'
+  `${DEFAULT_API_BASE}/api/generate-brief`
 ];
 const LONG_BRIEF_TIMEOUT_MS = 25_000;
 const TERMINAL_HTTP_STATUSES = new Set([400, 401, 403, 404, 405, 410, 501]);
diff --git a/app/render/modal-ui-controller.mjs b/app/render/modal-ui-controller.mjs
index 8bd44d86..d9a374c9 100644
--- a/app/render/modal-ui-controller.mjs
+++ b/app/render/modal-ui-controller.mjs
@@ -1,5 +1,4 @@
 import {
-  buildAuditBlock,
   buildBriefing,
   effectiveSummary,
   renderCorroboratingSources,
diff --git a/data/brialert.sqlite b/data/brialert.sqlite
deleted file mode 100644
index f4a17897..00000000
Binary files a/data/brialert.sqlite and /dev/null differ
diff --git a/eslint.config.mjs b/eslint.config.mjs
index ef3fca03..46b77cc3 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -18,6 +18,14 @@ export default [
     rules: {
       "no-undef": "error",
       "no-unreachable": "error",
+      "prefer-const": ["error", { destructuring: "all" }],
+      "no-unused-vars": ["error", { argsIgnorePattern: "^_", caughtErrorsIgnorePattern: "^_" }],
+    },
+  },
+  {
+    files: ["tests/**/*.{js,mjs}"],
+    rules: {
+      "no-unused-vars": "off",
     },
   },
 ];
diff --git a/index.html b/index.html
index c406de77..de453f85 100644
--- a/index.html
+++ b/index.html
@@ -3,6 +3,7 @@
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover, interactive-widget=resizes-content, shrink-to-fit=no">
+  <!-- CSP connect-src must include the backend URL from shared/api-base.mjs -->
   <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https://unpkg.com; style-src 'self' https://unpkg.com; img-src 'self' data: https://*.basemaps.cartocdn.com; connect-src 'self' https://brialertbackend.vercel.app; font-src 'self' https://unpkg.com data:; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests">
   <title>Brialert</title>
   <meta name="mobile-web-app-capable" content="yes">
@@ -163,7 +164,9 @@ <h3>Tracked Queue</h3>
             <h3>Analyst Notes</h3>
             <p class="panel-copy">Capture assessments, follow-up tasks, and things to chase next.</p>
             <form id="note-form" class="note-form">
+              <label for="note-title" class="sr-only">Note title</label>
               <input id="note-title" type="text" placeholder="Note title" required>
+              <label for="note-body" class="sr-only">Note body</label>
               <textarea id="note-body" placeholder="Add your assessment or follow-up task" required></textarea>
               <button class="primary-button" type="submit">Save Note</button>
             </form>
@@ -179,6 +182,7 @@ <h3>Analyst Notes</h3>
             <h3>Add Source</h3>
             <p class="panel-copy" id="source-request-hint">Brialert will validate the link and queue it for the next hourly run.</p>
             <form id="source-request-form" class="source-request-form">
+              <label for="source-request-url" class="sr-only">Source URL</label>
               <input id="source-request-url" type="url" placeholder="https://example.com/feed" inputmode="url" autocomplete="off" required>
               <button class="primary-button" id="source-request-submit" type="submit">Add source</button>
             </form>
@@ -261,7 +265,7 @@ <h2 id="modal-title"></h2>
     </div>
   </div>
 
-  <script src="https://unpkg.com/leaflet@1.9.4/dist/leaflet.js" integrity="sha256-20nQCchB9co0qIjJZRGuk2/Z9VM+kNiyxNV1lvTlZBo=" crossorigin=""></script>
+  <script defer src="https://unpkg.com/leaflet@1.9.4/dist/leaflet.js" integrity="sha256-20nQCchB9co0qIjJZRGuk2/Z9VM+kNiyxNV1lvTlZBo=" crossorigin=""></script>
   <script type="module" src="app.js"></script>
 </body>
 </html>
diff --git a/scripts/build-live-feed.mjs b/scripts/build-live-feed.mjs
index 097567c8..ed2cd25b 100644
--- a/scripts/build-live-feed.mjs
+++ b/scripts/build-live-feed.mjs
@@ -40,6 +40,8 @@ import {
   SOURCE_BLOCKED_FAILURE_COOLDOWN_HOURS,
   SOURCE_FAILURE_COOLDOWN_HOURS,
   TARGET_SUCCESSFUL_SOURCES_PER_RUN,
+  CONTINUATION_RUNTIME_HEADROOM_MS,
+  ROTATION_WEIGHT_BUCKETS,
   computeDynamicItemLimit,
   AUTO_QUARANTINE_FAILURE_THRESHOLD,
   isMachineReadableSourceKind,
@@ -72,7 +74,6 @@ import {
   mapWithConcurrency,
   readExisting,
   readJsonFile,
-  mergeSourceCatalogs,
   normaliseSourcesPayload,
   normaliseSourceRequestsPayload,
   sleep,
@@ -159,7 +160,7 @@ function sourceFailureCooldownHours(source, errorCategory) {
   return SOURCE_FAILURE_COOLDOWN_HOURS;
 }
 
-function sourceMayAutoCooldown(source, previousEntry, buildDate) {
+function getAutoCooldownStatus(source, previousEntry, buildDate) {
   if (!previousEntry) return null;
   if (previousEntry.quarantined) {
     const quarantinedAtMs = parseIsoMs(previousEntry.quarantinedAt);
@@ -261,7 +262,7 @@ function nextSourceHealthEntry(source, stat, previousEntry, generatedAt) {
     next.lastErrorCategory = stat?.lastErrorCategory || null;
     next.lastErrorMessage = stat?.lastErrorMessage || null;
     if (blockedNonContent && next.consecutiveBlockedFailures >= BLOCKED_NON_CONTENT_FAIL_THRESHOLD) {
-      next.cooldownUntil = new Date(Date.parse(generatedAt) + BLOCKED_NON_CONTENT_COOLDOWN_HOURS * 3600000).toISOString();
+      next.cooldownUntil = new Date(generatedAtMs + BLOCKED_NON_CONTENT_COOLDOWN_HOURS * 3600000).toISOString();
       next.autoSkipReason = 'blocked-cooldown';
       next.nextFetchAt = next.cooldownUntil;
       return next;
@@ -272,7 +273,7 @@ function nextSourceHealthEntry(source, stat, previousEntry, generatedAt) {
       next.quarantineReason = 'HTTP 404 not found; needs manual source URL review';
       next.autoSkipReason = 'review-quarantine';
       next.cooldownUntil = null;
-      next.nextFetchAt = new Date(Date.parse(generatedAt) + AUTO_QUARANTINE_RECHECK_HOURS * 3600000).toISOString();
+      next.nextFetchAt = new Date(generatedAtMs + AUTO_QUARANTINE_RECHECK_HOURS * 3600000).toISOString();
       return next;
     }
     if (!next.quarantined && source?.kind === 'html' && next.consecutiveBlockedFailures >= AUTO_QUARANTINE_BLOCKED_HTML_THRESHOLD) {
@@ -281,7 +282,7 @@ function nextSourceHealthEntry(source, stat, previousEntry, generatedAt) {
       next.quarantineReason = 'Repeated blocked-or-auth failures on html source';
       next.autoSkipReason = 'review-quarantine';
       next.cooldownUntil = null;
-      next.nextFetchAt = new Date(Date.parse(generatedAt) + AUTO_QUARANTINE_RECHECK_HOURS * 3600000).toISOString();
+      next.nextFetchAt = new Date(generatedAtMs + AUTO_QUARANTINE_RECHECK_HOURS * 3600000).toISOString();
       return next;
     }
     if (!next.quarantined && next.consecutiveDeadUrlFailures >= AUTO_QUARANTINE_DEAD_URL_THRESHOLD) {
@@ -290,7 +291,7 @@ function nextSourceHealthEntry(source, stat, previousEntry, generatedAt) {
       next.quarantineReason = 'Repeated dead-or-moved-url failures';
       next.autoSkipReason = 'review-quarantine';
       next.cooldownUntil = null;
-      next.nextFetchAt = new Date(Date.parse(generatedAt) + AUTO_QUARANTINE_RECHECK_HOURS * 3600000).toISOString();
+      next.nextFetchAt = new Date(generatedAtMs + AUTO_QUARANTINE_RECHECK_HOURS * 3600000).toISOString();
       return next;
     }
     if (!next.quarantined && next.consecutiveFailures >= AUTO_QUARANTINE_FAILURE_THRESHOLD) {
@@ -299,12 +300,12 @@ function nextSourceHealthEntry(source, stat, previousEntry, generatedAt) {
       next.quarantineReason = `Repeated failures (${next.consecutiveFailures}) need manual review`;
       next.autoSkipReason = 'review-quarantine';
       next.cooldownUntil = null;
-      next.nextFetchAt = new Date(Date.parse(generatedAt) + AUTO_QUARANTINE_RECHECK_HOURS * 3600000).toISOString();
+      next.nextFetchAt = new Date(generatedAtMs + AUTO_QUARANTINE_RECHECK_HOURS * 3600000).toISOString();
       return next;
     }
     if (next.consecutiveFailures >= AUTO_SKIP_FAILURE_THRESHOLD) {
       const cooldownHours = sourceFailureCooldownHours(source, stat?.lastErrorCategory || '');
-      next.cooldownUntil = new Date(Date.parse(generatedAt) + cooldownHours * 3600000).toISOString();
+      next.cooldownUntil = new Date(generatedAtMs + cooldownHours * 3600000).toISOString();
       next.autoSkipReason = 'failure-cooldown';
       next.nextFetchAt = next.cooldownUntil;
     }
@@ -320,7 +321,7 @@ function nextSourceHealthEntry(source, stat, previousEntry, generatedAt) {
   next.lastErrorMessage = null;
   next.lastEmptyAt = generatedAt;
   if (!source.isTrustedOfficial && source.lane !== 'incidents' && next.consecutiveEmptyRuns >= AUTO_SKIP_EMPTY_THRESHOLD) {
-    next.cooldownUntil = new Date(Date.parse(generatedAt) + SOURCE_EMPTY_COOLDOWN_HOURS * 3600000).toISOString();
+    next.cooldownUntil = new Date(generatedAtMs + SOURCE_EMPTY_COOLDOWN_HOURS * 3600000).toISOString();
     next.autoSkipReason = 'empty-cooldown';
     next.nextFetchAt = next.cooldownUntil;
   }
@@ -412,7 +413,6 @@ function sourceDomain(source) {
 function selectHtmlSourcesForRun(rankedHtmlEntries, buildDate, maxSources) {
   const safeEntries = Array.isArray(rankedHtmlEntries) ? rankedHtmlEntries : [];
   const runSeed = Math.floor(buildDate.getTime() / 3600000);
-  const ROTATION_WEIGHT_BUCKETS = 7;
   const runCap = Math.max(0, Number(maxSources || 0));
   const domainUse = new Map();
   const domainCappedSourceIds = new Set();
@@ -429,9 +429,10 @@ function selectHtmlSourcesForRun(rankedHtmlEntries, buildDate, maxSources) {
   }
 
   const rotateTier = (entries, weighted = false) => {
-    const sorted = [...entries].sort((left, right) => {
-      const leftSource = left?.source || {};
-      const rightSource = right?.source || {};
+    const withJitter = entries.map((entry) => ({ entry, jitter: Math.random() }));
+    const sorted = withJitter.sort((left, right) => {
+      const leftSource = left.entry?.source || {};
+      const rightSource = right.entry?.source || {};
       const leftWeight = weighted
         ? sourceDeterministicHash(`${leftSource.id || leftSource.endpoint}|${runSeed}`) % ROTATION_WEIGHT_BUCKETS
         : 0;
@@ -439,11 +440,9 @@ function selectHtmlSourcesForRun(rankedHtmlEntries, buildDate, maxSources) {
         ? sourceDeterministicHash(`${rightSource.id || rightSource.endpoint}|${runSeed}`) % ROTATION_WEIGHT_BUCKETS
         : 0;
       if (rightWeight !== leftWeight) return rightWeight - leftWeight;
-      return left.index - right.index;
+      return left.jitter - right.jitter;
     });
-    if (!sorted.length) return [];
-    const offset = runSeed % sorted.length;
-    return [...sorted.slice(offset), ...sorted.slice(0, offset)];
+    return sorted.map((item) => item.entry);
   };
 
   const ordered = [
@@ -557,6 +556,23 @@ function shouldTryPlaywrightForThinHtml(source, body, playwrightBudget) {
 async function attemptSourceBuild(source, requestState, playwrightBudget, priorHealthEntry) {
   const localErrors = [];
   const builtAlerts = [];
+  const failureReasonCounts = {
+    success: 0,
+    unchanged: 0,
+    'stale-endpoint': 0,
+    'blocked-or-anti-bot': 0,
+    'timeout-or-aborted': 0,
+    'parser-failure': 0,
+    'empty-or-no-items': 0,
+    unknown: 0
+  };
+  const discardReasons = {
+    parseNoItems: 0,
+    droppedByFilter: 0,
+    droppedByMissingOrInvalidDate: 0,
+    droppedByItemCap: 0,
+    buildFailures: 0
+  };
   let body;
   let usedPlaywrightFallback = false;
   let finalUrl = clean(source?.endpoint);
@@ -575,6 +591,10 @@ async function attemptSourceBuild(source, requestState, playwrightBudget, priorH
     }
   } catch (error) {
     const summary = summariseSourceError(source, error);
+    const reason = classifyFetchFailure(summary);
+    if (reason === 'stale-endpoint') failureReasonCounts['stale-endpoint'] += 1;
+    else if (reason === 'bot-block') failureReasonCounts['blocked-or-anti-bot'] += 1;
+    else if (reason === 'timeout') failureReasonCounts['timeout-or-aborted'] += 1;
     if (shouldTryPlaywrightFallback(source, summary, playwrightBudget)) {
       playwrightBudget.attempts += 1;
       body = await fetchTextWithPlaywright(source.endpoint, {
@@ -604,12 +624,16 @@ async function attemptSourceBuild(source, requestState, playwrightBudget, priorH
       usedPlaywrightFallback = true;
       playwrightBudget.successes += 1;
       parsed = parseHtmlItems(source, body);
-    } catch (error) {
-      // ignore, handled below
+    } catch {
+      // fall through to normal empty parse handling
     }
   }
 
   if (!parsed.length) {
+    discardReasons.parseNoItems += 1;
+    if (fetchOutcome !== 'unchanged') {
+      failureReasonCounts['empty-or-no-items'] += 1;
+    }
     localErrors.push(summariseSourceError(
       source,
       buildFetchError('No items parsed from source payload', 'brittle-selectors-or-js-rendering')
@@ -629,7 +653,11 @@ async function attemptSourceBuild(source, requestState, playwrightBudget, priorH
   const reliabilityProfile = inferReliabilityProfile(source, inferSourceTier(source));
   const filtered = hydrated.filter((item) => {
     try {
-      return discardReasonForItem(source, item) === null;
+      const discardReason = discardReasonForItem(source, item);
+      if (discardReason === 'missing-or-invalid-date') {
+        discardReasons.droppedByMissingOrInvalidDate += 1;
+      }
+      return discardReason === null;
     } catch (error) {
       localErrors.push(summariseSourceError(source, error));
       return false;
@@ -642,15 +670,28 @@ async function attemptSourceBuild(source, requestState, playwrightBudget, priorH
     filteredCount: filtered.length
   });
   const kept = filtered.slice(0, itemLimit);
+  discardReasons.droppedByFilter += Math.max(0, hydrated.length - filtered.length);
+  discardReasons.droppedByItemCap += Math.max(0, filtered.length - kept.length);
 
   kept.forEach((item, idx) => {
     try {
       builtAlerts.push(buildAlert(source, item, idx));
     } catch (error) {
       localErrors.push(summariseSourceError(source, error));
+      discardReasons.buildFailures += 1;
     }
   });
 
+  const parserFailures = localErrors
+    .map((errorSummary) => classifyFetchFailure(errorSummary))
+    .filter((reason) => reason === 'parser-failure').length;
+  if (parserFailures > 0) failureReasonCounts['parser-failure'] += parserFailures;
+  if (fetchOutcome === 'unchanged') {
+    failureReasonCounts.unchanged += 1;
+  } else if (builtAlerts.length > 0) {
+    failureReasonCounts.success += 1;
+  }
+
   return {
     alerts: builtAlerts,
     sourceErrors: localErrors,
@@ -671,7 +712,9 @@ async function attemptSourceBuild(source, requestState, playwrightBudget, priorH
       usedPlaywrightFallback,
       finalUrl,
       status: responseStatus,
-      fetchOutcome
+      fetchOutcome,
+      failureReasonCounts,
+      discardReasons
     }
   };
 }
@@ -1034,7 +1077,7 @@ function renderQuarantinedSourcesHtml(generatedAt, entries) {
   </main>
   <div id="toast" class="toast" aria-live="polite"></div>
   <script>
-    const DEFAULT_API_BASE = 'https://brialertbackend.vercel.app';
+    const DEFAULT_API_BASE = '${process.env.BRIALERT_API_BASE || 'https://brialertbackend.vercel.app'}';
     function normaliseApiBase(value) {
       const raw = String(value || '').trim();
       return raw ? raw.replace(/\\/$/, '') : '';
@@ -2020,7 +2063,6 @@ async function syncBuilderSQLite(snapshot) {
 
 async function main() {
   const runStartedAtMs = Date.now();
-  const CONTINUATION_RUNTIME_HEADROOM_MS = 20_000;
   const buildDate = new Date();
   const existing = await readExisting();
   const geoLookupFallbackNote = await safeLoadGeoLookup(existing);
@@ -2096,7 +2138,7 @@ async function main() {
   });
   const scheduledSources = eligibleSources.filter((source) => {
     const priorEntry = sourceHealthEntry(previousHealth, source.id);
-    const autoCooldown = sourceMayAutoCooldown(source, priorEntry, buildDate);
+    const autoCooldown = getAutoCooldownStatus(source, priorEntry, buildDate);
     if (autoCooldown) {
       autoDeferredSources.push({
         id: source.id,
@@ -2116,11 +2158,12 @@ async function main() {
     .map((source, index) => ({
       source,
       index,
-      priority: sourceSchedulingPriority(source)
+      priority: sourceSchedulingPriority(source),
+      jitter: Math.random()
     }))
     .sort((left, right) => {
       if (right.priority !== left.priority) return right.priority - left.priority;
-      return left.index - right.index;
+      return left.jitter - right.jitter;
     });
   const machineReadableScheduled = rankedScheduledSources
     .filter((entry) => isMachineReadableSourceKind(entry.source?.kind))
@@ -2151,10 +2194,11 @@ async function main() {
     }
   }
   const continuationCandidates = [...continuationCandidatesById.values()]
+    .map((entry) => ({ ...entry, jitter: Math.random() }))
     .sort((left, right) => {
       const priorityDelta = sourceSchedulingPriority(right.source) - sourceSchedulingPriority(left.source);
       if (priorityDelta !== 0) return priorityDelta;
-      return left.index - right.index;
+      return left.jitter - right.jitter;
     })
     .map((entry) => entry.source);
 
@@ -2175,167 +2219,39 @@ async function main() {
       batch,
       FEED_SOURCE_CONCURRENCY,
       async (source, sourceIndex) => {
-        const localErrors = [];
-        const builtAlerts = [];
-        const failureReasonCounts = {
-          success: 0,
-          unchanged: 0,
-          'stale-endpoint': 0,
-          'blocked-or-anti-bot': 0,
-          'timeout-or-aborted': 0,
-          'parser-failure': 0,
-          'empty-or-no-items': 0,
-          unknown: 0
-        };
-        const discardReasons = {
-          parseNoItems: 0,
-          droppedByFilter: 0,
-          droppedByMissingOrInvalidDate: 0,
-          droppedByItemCap: 0,
-          buildFailures: 0
-        };
-
         try {
           const baseDelay = (sourceAttemptOffset + sourceIndex) * DEFAULT_FETCH_STAGGER_MS;
           const jitter = MAX_FETCH_STAGGER_JITTER_MS > 0
             ? Math.floor(Math.random() * (MAX_FETCH_STAGGER_JITTER_MS + 1))
             : 0;
           await sleep(baseDelay + jitter);
-          let body;
-          let usedPlaywrightFallback = false;
-          let finalUrl = clean(source?.endpoint);
-          let responseStatus = null;
-          let fetchOutcome = 'unknown';
-          try {
-            const fetched = await fetchText(source.endpoint, 1, { source, requestState, includeMeta: true });
-            if (typeof fetched === 'string') {
-              body = fetched;
-              fetchOutcome = 'success';
-            } else {
-              body = fetched.text;
-              finalUrl = clean(fetched.finalUrl || source.endpoint);
-              responseStatus = Number.isFinite(Number(fetched.status)) ? Number(fetched.status) : null;
-              fetchOutcome = (responseStatus === 304 || fetched.unchanged304) ? 'unchanged' : 'success';
-            }
-          } catch (error) {
-            const summary = summariseSourceError(source, error);
-            const reason = classifyFetchFailure(summary);
-            if (reason === 'stale-endpoint') failureReasonCounts['stale-endpoint'] += 1;
-            else if (reason === 'bot-block') failureReasonCounts['blocked-or-anti-bot'] += 1;
-            else if (reason === 'timeout') failureReasonCounts['timeout-or-aborted'] += 1;
-            if (shouldTryPlaywrightFallback(source, summary, playwrightBudget)) {
-              playwrightBudget.attempts += 1;
-              body = await fetchTextWithPlaywright(source.endpoint, {
-                source,
-                timeoutMs: PLAYWRIGHT_FALLBACK_TIMEOUT_MS
-              });
-              usedPlaywrightFallback = true;
-              playwrightBudget.successes += 1;
-              fetchOutcome = 'success';
-            } else {
-              throw error;
-            }
-          }
-          let parsed = source.kind === 'rss' || source.kind === 'atom' || source.kind === 'json'
-            ? parseFeedItems(source, body)
-            : parseHtmlItems(source, body);
-          if (!parsed.length && source.kind === 'html' && !usedPlaywrightFallback && shouldTryPlaywrightForThinHtml(source, body, playwrightBudget)) {
-            try {
-              playwrightBudget.attempts += 1;
-              body = await fetchTextWithPlaywright(source.endpoint, {
-                source,
-                timeoutMs: PLAYWRIGHT_FALLBACK_TIMEOUT_MS,
-                contentSelectors: source?.playwright?.contentSelectors
-              });
-              usedPlaywrightFallback = true;
-              playwrightBudget.successes += 1;
-              parsed = parseHtmlItems(source, body);
-            } catch (error) {
-              // fall through to normal empty parse handling
-            }
-          }
-          if (!parsed.length) {
-            discardReasons.parseNoItems += 1;
-            if (fetchOutcome !== 'unchanged') {
-              failureReasonCounts['empty-or-no-items'] += 1;
-            }
-            localErrors.push(summariseSourceError(
-              source,
-              buildFetchError('No items parsed from source payload', 'brittle-selectors-or-js-rendering')
-            ));
-          }
-          const preLimit = source.kind === 'html' ? MAX_HTML_PREFETCH_ITEMS : MAX_FEED_PREFETCH_ITEMS;
-          const preLimited = parsed.slice(0, preLimit);
-          const hydrated = source.kind === 'html' ? await enrichHtmlItems(source, preLimited) : preLimited;
-          const reliabilityProfile = inferReliabilityProfile(source, inferSourceTier(source));
-          const filtered = hydrated.filter((item) => {
-            try {
-              const discardReason = discardReasonForItem(source, item);
-              if (discardReason === 'missing-or-invalid-date') {
-                discardReasons.droppedByMissingOrInvalidDate += 1;
-              }
-              return discardReason === null;
-            } catch (error) {
-              localErrors.push(summariseSourceError(source, error));
-              console.error(`Source item filter failed: ${source.id} - ${error instanceof Error ? error.message : String(error)}`);
-              return false;
-            }
-          });
-          const itemLimit = computeDynamicItemLimit({
-            reliabilityProfile,
-            lane: source.lane,
-            sourceHealth: sourceHealthEntry(previousHealth, source.id),
-            filteredCount: filtered.length
-          });
-          const kept = filtered.slice(0, itemLimit);
-          discardReasons.droppedByFilter += Math.max(0, hydrated.length - filtered.length);
-          discardReasons.droppedByItemCap += Math.max(0, filtered.length - kept.length);
-
-          kept.forEach((item, idx) => {
-            try {
-              builtAlerts.push(buildAlert(source, item, idx));
-            } catch (error) {
-              localErrors.push(summariseSourceError(source, error));
-              discardReasons.buildFailures += 1;
-              console.error(`Alert build failed: ${source.id} - ${error instanceof Error ? error.message : String(error)}`);
-            }
-          });
-          const parserFailures = localErrors
-            .map((errorSummary) => classifyFetchFailure(errorSummary))
-            .filter((reason) => reason === 'parser-failure').length;
-          if (parserFailures > 0) failureReasonCounts['parser-failure'] += parserFailures;
-          if (fetchOutcome === 'unchanged') {
-            failureReasonCounts.unchanged += 1;
-          } else if (builtAlerts.length > 0) {
-            failureReasonCounts.success += 1;
-          }
 
+          const result = await attemptSourceBuild(source, requestState, playwrightBudget, sourceHealthEntry(previousHealth, source.id));
           return {
             checked: 1,
-            alerts: builtAlerts,
-            sourceErrors: localErrors,
-            sourceStat: {
-              id: source.id,
-              provider: source.provider,
-              lane: source.lane,
-              kind: source.kind,
-              parsed: parsed.length,
-              hydrated: hydrated.length,
-              filtered: filtered.length,
-              kept: kept.length,
-              built: builtAlerts.length,
-              errors: localErrors.length,
-              lastErrorCategory: localErrors[0]?.category || null,
-              lastErrorMessage: localErrors[0]?.message || null,
-              usedPlaywrightFallback,
-              finalUrl,
-              status: responseStatus,
-              fetchOutcome,
-              failureReasonCounts,
-              discardReasons
-            }
+            alerts: result.alerts,
+            sourceErrors: result.sourceErrors,
+            sourceStat: result.sourceStat
           };
         } catch (error) {
+          const localErrors = [];
+          const failureReasonCounts = {
+            success: 0,
+            unchanged: 0,
+            'stale-endpoint': 0,
+            'blocked-or-anti-bot': 0,
+            'timeout-or-aborted': 0,
+            'parser-failure': 0,
+            'empty-or-no-items': 0,
+            unknown: 0
+          };
+          const discardReasons = {
+            parseNoItems: 0,
+            droppedByFilter: 0,
+            droppedByMissingOrInvalidDate: 0,
+            droppedByItemCap: 0,
+            buildFailures: 0
+          };
           const summary = summariseSourceError(source, error);
           localErrors.push(summary);
           const reason = classifyFetchFailure(summary);
diff --git a/scripts/build-live-feed/config.mjs b/scripts/build-live-feed/config.mjs
index 17ee6d65..5f7d9a6f 100644
--- a/scripts/build-live-feed/config.mjs
+++ b/scripts/build-live-feed/config.mjs
@@ -94,6 +94,11 @@ export const PLAYWRIGHT_FALLBACK_TIMEOUT_MS = Math.max(
     ? Math.floor(Number(process.env.BRIALERT_PLAYWRIGHT_TIMEOUT_MS))
     : 12000
 );
+export const DEFAULT_PLAYWRIGHT_TIMEOUT_MS = envInt('BRIALERT_DEFAULT_PLAYWRIGHT_TIMEOUT_MS', 15000, 3000);
+export const DEFAULT_PLAYWRIGHT_PAGE_SETTLE_MS = envInt('BRIALERT_DEFAULT_PLAYWRIGHT_PAGE_SETTLE_MS', 2000, 500);
+export const MAX_PLAYWRIGHT_ITEM_SUMMARY_CHARS = 400;
+export const MAX_PLAYWRIGHT_RAW_CANDIDATES = 60;
+export const PLAYWRIGHT_SCRAPER_USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36';
 export const GUARDRAIL_MAX_RUNTIME_MS = Math.max(
   60_000,
   Number.isFinite(Number(process.env.BRIALERT_GUARDRAIL_MAX_RUNTIME_MS))
@@ -121,6 +126,8 @@ export const TARGET_SUCCESSFUL_SOURCES_PER_RUN = Math.max(
     ? Math.floor(Number(process.env.BRIALERT_TARGET_SUCCESSFUL_SOURCES_PER_RUN))
     : 60
 );
+export const CONTINUATION_RUNTIME_HEADROOM_MS = envInt('BRIALERT_CONTINUATION_RUNTIME_HEADROOM_MS', 20_000, 1000);
+export const ROTATION_WEIGHT_BUCKETS = envInt('BRIALERT_ROTATION_WEIGHT_BUCKETS', 7, 2);
 /** Base lane caps – used as the starting point before dynamic adjustments. */
 const BASE_LANE_LIMITS = Object.freeze({
   incidents: 6,
diff --git a/scripts/build-live-feed/geo.mjs b/scripts/build-live-feed/geo.mjs
index b5987687..35ffd2a4 100644
--- a/scripts/build-live-feed/geo.mjs
+++ b/scripts/build-live-feed/geo.mjs
@@ -18,9 +18,16 @@ function normaliseGeoText(value) {
     .trim();
 }
 
+const geoTermRegexCache = new Map();
+
 function geoTermRegex(term) {
-  const escaped = escapeRegex(normaliseGeoText(term));
-  return new RegExp(`(^|\\W)${escaped}(?=$|\\W)`, 'i');
+  const normalised = normaliseGeoText(term);
+  let cached = geoTermRegexCache.get(normalised);
+  if (cached) return cached;
+  const escaped = escapeRegex(normalised);
+  cached = new RegExp(`(^|\\W)${escaped}(?=$|\\W)`, 'i');
+  geoTermRegexCache.set(normalised, cached);
+  return cached;
 }
 
 function scoreGeoEntryMatch(entry, haystack) {
diff --git a/shared/alert-view-model.mjs b/shared/alert-view-model.mjs
index e66b81f3..110358e9 100644
--- a/shared/alert-view-model.mjs
+++ b/shared/alert-view-model.mjs
@@ -8,6 +8,7 @@ import {
 import { laneLabels } from './ui-data.mjs';
 import { formatAgeFromDate } from './time-format.mjs';
 import { DEFAULT_LANE, LANE_KEYS, STATUS_LABELS } from './ui-constants.mjs';
+import { escapeHtml } from '../app/utils/text.mjs';
 
 export function formatAgeFrom(dateLike) {
   return formatAgeFromDate(dateLike);
@@ -103,6 +104,7 @@ function buildIncidentSummary(alert) {
   return alert.title;
 }
 
+// eslint-disable-next-line no-unused-vars -- Kept for future use: renders people referenced in high-confidence alerts.
 function extractPeopleInvolved(alert) {
   if (!Array.isArray(alert.peopleInvolved) || !alert.peopleInvolved.length) {
     return [];
@@ -438,7 +440,7 @@ export function renderSceneClock(alert) {
   return `<div class="scene-clock-grid">${items.map(({ label, entry, fallback }) => `
     <article class="scene-clock-item">
       <strong>${label}</strong>
-      <p>${entry ? `${clockDisplay(entry.publishedAt)} | ${sceneClockStamp(entry.publishedAt)}${entry.source ? ` | ${entry.source}` : ''}` : fallback}</p>
+      <p>${entry ? `${clockDisplay(entry.publishedAt)} | ${sceneClockStamp(entry.publishedAt)}${entry.source ? ` | ${escapeHtml(entry.source)}` : ''}` : fallback}</p>
     </article>`).join('')}</div>`;
 }
 
@@ -466,7 +468,7 @@ export function renderCorroboratingSources(alert) {
   }
   return `<div class="corroboration-list">${sources.map((entry) => `
     <article class="corroboration-item">
-      <a href="${entry.sourceUrl}" target="_blank" rel="noreferrer">${entry.source}</a>
+      <a href="${escapeHtml(entry.sourceUrl)}" target="_blank" rel="noreferrer">${escapeHtml(entry.source)}</a>
       <p>${reliabilityLabel(normaliseReliabilityProfile(entry.reliabilityProfile))} | ${clean(entry.sourceTier) || 'source tier unknown'} | ${clean(entry.publishedAt) ? formatAgeFrom(entry.publishedAt) : 'age unknown'}</p>
     </article>`).join('')}</div>`;
 }
@@ -554,7 +556,7 @@ export function normaliseAlert(alert, index, geoLookup = []) {
     freshUntil: clean(alert.freshUntil),
     needsHumanReview: !!alert.needsHumanReview,
     priorityScore: Number.isFinite(alert.priorityScore) ? alert.priorityScore : null,
-    confidenceScore: Number.isFinite(alert.confidenceScore) ? alert.confidenceScore : null,
+    confidenceScore: Number.isFinite(alert.confidenceScore) && alert.confidenceScore >= 0 && alert.confidenceScore <= 1 ? alert.confidenceScore : null,
     publishedAt: clean(alert.publishedAt),
     freshnessBucket: Number.isFinite(alert.freshnessBucket) ? alert.freshnessBucket : null,
     keywordHits: Array.isArray(alert.keywordHits) ? alert.keywordHits.filter(Boolean) : [],
diff --git a/shared/api-base.mjs b/shared/api-base.mjs
new file mode 100644
index 00000000..7d60e6f5
--- /dev/null
+++ b/shared/api-base.mjs
@@ -0,0 +1,10 @@
+/**
+ * Centralised backend base URL for client-side API calls.
+ *
+ * Every frontend module that needs to talk to the Brialert backend should
+ * import DEFAULT_API_BASE from here instead of hardcoding the URL.
+ *
+ * To point the frontend at a different backend, change this single constant.
+ * The CSP connect-src in index.html must also be kept in sync.
+ */
+export const DEFAULT_API_BASE = 'https://brialertbackend.vercel.app';
diff --git a/shared/feed-controller.mjs b/shared/feed-controller.mjs
index 4560c6f4..977bbdf1 100644
--- a/shared/feed-controller.mjs
+++ b/shared/feed-controller.mjs
@@ -376,6 +376,8 @@ export async function loadLiveFeed(state, options) {
     };
     console.error(`[feed] Fetch failed: ${liveFeedUrl}`, error);
   }
-  state.lastBrowserPollAt = new Date();
+  if (state.liveFeedFetchState === 'success') {
+    state.lastBrowserPollAt = new Date();
+  }
   if (typeof onAfterLoad === 'function') onAfterLoad();
 }
diff --git a/shared/fusion.mjs b/shared/fusion.mjs
index c604e85c..777dea3c 100644
--- a/shared/fusion.mjs
+++ b/shared/fusion.mjs
@@ -152,6 +152,7 @@ function normaliseFusionToken(token) {
   if (!value) return '';
   if (fusionTokenAliases.has(value)) return fusionTokenAliases.get(value);
   // English morphological stemming – applied in order of specificity
+  // Each guard ensures the result is at least 3 characters.
   if (value.endsWith('isation') && value.length > 9) return value.slice(0, -7);
   if (value.endsWith('ization') && value.length > 9) return value.slice(0, -7);
   if (value.endsWith('ement') && value.length > 7) return value.slice(0, -5);
@@ -161,12 +162,12 @@ function normaliseFusionToken(token) {
   if (value.endsWith('ous') && value.length > 5) return value.slice(0, -3);
   if (value.endsWith('ive') && value.length > 5) return value.slice(0, -3);
   if (value.endsWith('ful') && value.length > 5) return value.slice(0, -3);
-  if (value.endsWith('ing') && value.length > 6) return value.slice(0, -3);
+  if (value.endsWith('ing') && value.length > 5) return value.slice(0, -3);
   if (value.endsWith('ied') && value.length > 5) return value.slice(0, -3) + 'y';
-  if (value.endsWith('ed') && value.length > 5) return value.slice(0, -2);
+  if (value.endsWith('ed') && value.length > 4) return value.slice(0, -2);
   if (value.endsWith('ies') && value.length > 5) return value.slice(0, -3) + 'y';
-  if (value.endsWith('es') && value.length > 5 && !value.endsWith('ses')) return value.slice(0, -2);
-  if (value.endsWith('s') && value.length > 5 && !value.endsWith('is') && !value.endsWith('ss')) return value.slice(0, -1);
+  if (value.endsWith('es') && value.length > 4 && !value.endsWith('ses')) return value.slice(0, -2);
+  if (value.endsWith('s') && value.length > 4 && !value.endsWith('is') && !value.endsWith('ss')) return value.slice(0, -1);
   return value;
 }
 
diff --git a/shared/map-watch.mjs b/shared/map-watch.mjs
index 7bddb063..8729eef9 100644
--- a/shared/map-watch.mjs
+++ b/shared/map-watch.mjs
@@ -120,82 +120,83 @@ function countryLabelFromAlert(alert) {
   return '';
 }
 
+const COUNTRY_CODE_MAP = new Map([
+  ['United Kingdom', 'GBR'],
+  ['United States', 'USA'],
+  ['France', 'FRA'],
+  ['Germany', 'DEU'],
+  ['Italy', 'ITA'],
+  ['Spain', 'ESP'],
+  ['Belgium', 'BEL'],
+  ['Netherlands', 'NLD'],
+  ['Ireland', 'IRL'],
+  ['Poland', 'POL'],
+  ['Sweden', 'SWE'],
+  ['Norway', 'NOR'],
+  ['Denmark', 'DNK'],
+  ['Finland', 'FIN'],
+  ['Switzerland', 'CHE'],
+  ['Austria', 'AUT'],
+  ['Greece', 'GRC'],
+  ['Turkey', 'TUR'],
+  ['Russia', 'RUS'],
+  ['Ukraine', 'UKR'],
+  ['Israel', 'ISR'],
+  ['Palestine', 'PSE'],
+  ['Iraq', 'IRQ'],
+  ['Iran', 'IRN'],
+  ['Syria', 'SYR'],
+  ['Afghanistan', 'AFG'],
+  ['Pakistan', 'PAK'],
+  ['India', 'IND'],
+  ['China', 'CHN'],
+  ['Japan', 'JPN'],
+  ['Australia', 'AUS'],
+  ['Canada', 'CAN'],
+  ['Brazil', 'BRA'],
+  ['Mexico', 'MEX'],
+  ['South Africa', 'ZAF'],
+  ['Nigeria', 'NGA'],
+  ['Somalia', 'SOM'],
+  ['Yemen', 'YEM'],
+  ['Saudi Arabia', 'SAU'],
+  ['United Arab Emirates', 'ARE'],
+  ['Qatar', 'QAT'],
+  ['Kuwait', 'KWT'],
+  ['Egypt', 'EGY'],
+  ['Libya', 'LBY'],
+  ['Algeria', 'DZA'],
+  ['Morocco', 'MAR'],
+  ['Tunisia', 'TUN'],
+  ['Philippines', 'PHL'],
+  ['Indonesia', 'IDN'],
+  ['Malaysia', 'MYS'],
+  ['Bangladesh', 'BGD'],
+  ['Sri Lanka', 'LKA'],
+  ['Myanmar', 'MMR'],
+  ['Thailand', 'THA'],
+  ['Vietnam', 'VNM'],
+  ['South Korea', 'KOR'],
+  ['North Korea', 'PRK'],
+  ['Czech Republic', 'CZE'],
+  ['Czechia', 'CZE'],
+  ['Romania', 'ROU'],
+  ['Bulgaria', 'BGR'],
+  ['Hungary', 'HUN'],
+  ['Portugal', 'PRT'],
+  ['Slovakia', 'SVK'],
+  ['Slovenia', 'SVN'],
+  ['Croatia', 'HRV'],
+  ['Serbia', 'SRB'],
+  ['Bosnia and Herzegovina', 'BIH'],
+  ['Albania', 'ALB'],
+  ['North Macedonia', 'MKD'],
+  ['Montenegro', 'MNE'],
+  ['Kosovo', 'XKX']
+]);
+
 function countryCodeFor(label) {
-  const codeMap = new Map([
-    ['United Kingdom', 'GBR'],
-    ['United States', 'USA'],
-    ['France', 'FRA'],
-    ['Germany', 'DEU'],
-    ['Italy', 'ITA'],
-    ['Spain', 'ESP'],
-    ['Belgium', 'BEL'],
-    ['Netherlands', 'NLD'],
-    ['Ireland', 'IRL'],
-    ['Poland', 'POL'],
-    ['Sweden', 'SWE'],
-    ['Norway', 'NOR'],
-    ['Denmark', 'DNK'],
-    ['Finland', 'FIN'],
-    ['Switzerland', 'CHE'],
-    ['Austria', 'AUT'],
-    ['Greece', 'GRC'],
-    ['Turkey', 'TUR'],
-    ['Russia', 'RUS'],
-    ['Ukraine', 'UKR'],
-    ['Israel', 'ISR'],
-    ['Palestine', 'PSE'],
-    ['Iraq', 'IRQ'],
-    ['Iran', 'IRN'],
-    ['Syria', 'SYR'],
-    ['Afghanistan', 'AFG'],
-    ['Pakistan', 'PAK'],
-    ['India', 'IND'],
-    ['China', 'CHN'],
-    ['Japan', 'JPN'],
-    ['Australia', 'AUS'],
-    ['Canada', 'CAN'],
-    ['Brazil', 'BRA'],
-    ['Mexico', 'MEX'],
-    ['South Africa', 'ZAF'],
-    ['Nigeria', 'NGA'],
-    ['Somalia', 'SOM'],
-    ['Yemen', 'YEM'],
-    ['Saudi Arabia', 'SAU'],
-    ['United Arab Emirates', 'ARE'],
-    ['Qatar', 'QAT'],
-    ['Kuwait', 'KWT'],
-    ['Egypt', 'EGY'],
-    ['Libya', 'LBY'],
-    ['Algeria', 'DZA'],
-    ['Morocco', 'MAR'],
-    ['Tunisia', 'TUN'],
-    ['Philippines', 'PHL'],
-    ['Indonesia', 'IDN'],
-    ['Malaysia', 'MYS'],
-    ['Bangladesh', 'BGD'],
-    ['Sri Lanka', 'LKA'],
-    ['Myanmar', 'MMR'],
-    ['Thailand', 'THA'],
-    ['Vietnam', 'VNM'],
-    ['South Korea', 'KOR'],
-    ['North Korea', 'PRK'],
-    ['Czech Republic', 'CZE'],
-    ['Czechia', 'CZE'],
-    ['Romania', 'ROU'],
-    ['Bulgaria', 'BGR'],
-    ['Hungary', 'HUN'],
-    ['Portugal', 'PRT'],
-    ['Slovakia', 'SVK'],
-    ['Slovenia', 'SVN'],
-    ['Croatia', 'HRV'],
-    ['Serbia', 'SRB'],
-    ['Bosnia and Herzegovina', 'BIH'],
-    ['Albania', 'ALB'],
-    ['North Macedonia', 'MKD'],
-    ['Montenegro', 'MNE'],
-    ['Kosovo', 'XKX']
-  ]);
-  return codeMap.get(label) || '';
+  return COUNTRY_CODE_MAP.get(label) || '';
 }
 
 function countryStatsUrl(label) {
diff --git a/styles.css b/styles.css
index c370531f..7bb6fac3 100644
--- a/styles.css
+++ b/styles.css
@@ -393,11 +393,11 @@ h1 {
 }
 
 .screen.briefing-mode .briefing-mode-hidden {
-  display: none !important;
+  display: none;
 }
 
 .screen.briefing-mode .briefing-mode-panel.hidden {
-  display: block !important;
+  display: block;
 }
 
 .screen.briefing-mode .tab-panel.active {
diff --git a/tests/modal-remote-client.test.mjs b/tests/modal-remote-client.test.mjs
index 159a48d1..1e4d97f2 100644
--- a/tests/modal-remote-client.test.mjs
+++ b/tests/modal-remote-client.test.mjs
@@ -2,6 +2,7 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 
 import { requestRemoteLongBrief } from '../app/render/modal-remote-client.mjs';
+import { DEFAULT_API_BASE } from '../shared/api-base.mjs';
 
 test('requestRemoteLongBrief stops retrying on terminal HTTP statuses like 501', async () => {
   const previousFetch = globalThis.fetch;
@@ -37,7 +38,7 @@ test('requestRemoteLongBrief uses Vercel backend URL as the primary endpoint', a
     const result = await requestRemoteLongBrief([{ headline: 'one' }]);
     assert.equal(result, 'remote brief');
     assert.deepEqual(calledUrls, [
-      'https://brialertbackend.vercel.app/api/generate-brief'
+      `${DEFAULT_API_BASE}/api/generate-brief`
     ]);
   } finally {
     globalThis.fetch = previousFetch;