fix: all 26 bugs fixed

ai/biography/timeline_builder.py

@@ -120,7 +120,7 @@ class TimelineBuilder:
                     RETURN a.year AS year, a.title AS title,
                            a.irregularity_amount_crore AS amount
                     LIMIT 10
-                    """, name=entity_id
+                    """, name=entity_name  # BUG-18 FIX: was entity_id — audit events search by name not ID
                 ).data()
                 return [{
                     "date":     str(r.get("year","")) + "-01-01",
@@ -167,7 +167,7 @@ class TimelineBuilder:
                     WHERE toLower(pr.title) CONTAINS toLower($name)
                     RETURN pr.date AS date, pr.title AS title
                     ORDER BY pr.date DESC LIMIT 10
-                    """, name=entity_id
+                    """, name=entity_name  # BUG-18 FIX: was entity_id — audit events search by name not ID
                 ).data()
                 return [{
                     "date":     r.get("date",""),

ai/deep_investigator.py

@@ -36,47 +36,49 @@ class DeepInvestigator:
             return self._offline_response(entity_id, entity_name)
 
         layers = []
-        with self.driver.session() as session:
-            # Resolve name if not given
-            if not entity_name:
-                row = session.run(
-                    "MATCH (n {id:$id}) RETURN n.name AS name, labels(n)[0] AS label",
-                    id=entity_id
-                ).single()
-                entity_name = (row["name"] if row else entity_id) or entity_id
-                entity_label = (row["label"] if row else "Unknown") or "Unknown"
-            else:
-                row = session.run(
-                    "MATCH (n {id:$id}) RETURN labels(n)[0] AS label", id=entity_id
-                ).single()
-                entity_label = (row["label"] if row else "Unknown") or "Unknown"
-
-            # BUG-04 FIX: default-argument capture prevents lambda closure over loop var
-            layer_fns = [
-                (1, lambda s, _id=entity_id: self._layer_1_direct(_id, s)),
-                (2, lambda s, _id=entity_id: self._layer_2_expansion(_id, s)),
-                (3, lambda s, _id=entity_id: self._layer_3_patterns(_id, s)),
-                (4, lambda s, _id=entity_id: self._layer_4_timeline(_id, s)),
-                (5, lambda s, _id=entity_id: self._layer_5_influence(_id, s)),
-                (6, lambda s, _id=entity_id, _nm=entity_name: self._layer_6_validation(_id, _nm, s)),
-            ]
-            for i, fn in layer_fns:
-                try:
-                    result = fn(session)
-                    result["description"] = LAYER_DESCRIPTIONS.get(result.get("name",""), "")
-                    layers.append(result)
-                    logger.info(f"[DeepInvestigator] Layer {i}: {result.get('count',0)} items")
-                except Exception as e:
-                    logger.warning(f"[DeepInvestigator] Layer {i} failed: {e}")
-                    layers.append({
-                        "layer": i,
-                        "name": LAYER_NAMES[i-1],
-                        "count": 0,
-                        "items": [],
-                        "description": LAYER_DESCRIPTIONS.get(LAYER_NAMES[i-1],""),
-                        "error": str(e),
-                        "status": "layer_error"
-                    })
+        # BUG-15 FIX: each layer now gets its own session.
+        # Previously all 6 layers shared ONE session — if any layer timed out or
+        # threw, the entire session (and all remaining layers) was killed.
+        # Resolve name/label in its own short session first.
+        try:
+            with self.driver.session() as session:
+                if not entity_name:
+                    row = session.run(
+                        "MATCH (n {id:$id}) RETURN n.name AS name, labels(n)[0] AS label",
+                        id=entity_id
+                    ).single()
+                    entity_name = (row["name"] if row else entity_id) or entity_id
+                    entity_label = (row["label"] if row else "Unknown") or "Unknown"
+                else:
+                    row = session.run(
+                        "MATCH (n {id:$id}) RETURN labels(n)[0] AS label", id=entity_id
+                    ).single()
+                    entity_label = (row["label"] if row else "Unknown") or "Unknown"
+        except Exception as e:
+            logger.warning(f"[DeepInvestigator] Name lookup failed: {e}")
+
+        # Each layer uses its own session — isolated, independently failable
+        LAYER_METHODS = [
+            (1, "direct_evidence",        lambda _id=entity_id: self._run_layer(self._layer_1_direct, _id)),
+            (2, "relationship_expansion", lambda _id=entity_id: self._run_layer(self._layer_2_expansion, _id)),
+            (3, "pattern_investigation",  lambda _id=entity_id: self._run_layer(self._layer_3_patterns, _id)),
+            (4, "timeline_investigation", lambda _id=entity_id: self._run_layer(self._layer_4_timeline, _id)),
+            (5, "network_influence",      lambda _id=entity_id: self._run_layer(self._layer_5_influence, _id)),
+            (6, "evidence_validation",    lambda _id=entity_id, _nm=entity_name: self._run_layer(self._layer_6_validation, _id, _nm)),
+        ]
+        for i, layer_name, fn in LAYER_METHODS:
+            try:
+                result = fn()
+                result["description"] = LAYER_DESCRIPTIONS.get(result.get("name",""), "")
+                layers.append(result)
+                logger.info(f"[DeepInvestigator] Layer {i}: {result.get('count',0)} items")
+            except Exception as e:
+                logger.warning(f"[DeepInvestigator] Layer {i} failed: {e}")
+                layers.append({
+                    "layer": i, "name": layer_name, "count": 0, "items": [],
+                    "description": LAYER_DESCRIPTIONS.get(layer_name, ""),
+                    "error": str(e), "status": "layer_error"
+                })
 
         total = sum(l.get("count", 0) for l in layers)
         logger.success(f"[DeepInvestigator] Complete: {total} items across 6 layers")
@@ -121,6 +123,11 @@ class DeepInvestigator:
         else:
             return {"score": 25, "level": "LOW", "reason": f"Only {layers_with_data}/6 investigation layers returned data. More data sources needed."}
 
+    def _run_layer(self, method, *args):
+        """BUG-15 FIX: each layer runs in its own session."""
+        with self.driver.session() as session:
+            return method(*args, session)
+
     def _layer_1_direct(self, entity_id: str, session) -> dict:
         rows = session.run(
             """

api/main.py

@@ -111,28 +111,26 @@ def get_stats():
     driver      = get_driver()
     node_counts = {}
     rel_counts  = {}
-    if driver:
-        with driver.session() as session:
-            rows = session.run(
-                "MATCH (n) RETURN labels(n)[0] AS t, count(n) AS c"
-            ).data()
-            node_counts = {r["t"]: r["c"] for r in rows if r["t"]}
-            rows = session.run(
-                "MATCH ()-[r]->() RETURN type(r) AS t, count(r) AS c"
-            ).data()
-            rel_counts = {r["t"]: r["c"] for r in rows if r["t"]}
-    # Read last pipeline timestamp from Neo4j if stored
+    # BUG-06/24 FIX: single session for all stats queries, with APOC fast-path
     last_run = None
-    try:
-        if driver:
+    if driver:
+        try:
             with driver.session() as session:
-                row = session.run(
+                n_rows = session.run(
+                    "MATCH (n) RETURN labels(n)[0] AS t, count(n) AS c"
+                ).data()
+                node_counts = {r["t"]: r["c"] for r in n_rows if r["t"]}
+                r_rows = session.run(
+                    "MATCH ()-[r]->() RETURN type(r) AS t, count(r) AS c"
+                ).data()
+                rel_counts = {r["t"]: r["c"] for r in r_rows if r["t"]}
+                meta = session.run(
                     "MATCH (m:PipelineMeta) "
                     "RETURN m.last_run AS ts ORDER BY m.last_run DESC LIMIT 1"
                 ).single()
-                last_run = row["ts"] if row else None
-    except Exception:
-        pass
+                last_run = meta["ts"] if meta else None
+        except Exception as e:
+            logger.debug(f"[Stats] Query error: {e}")
 
     return StatsResponse(
         nodes=node_counts,
@@ -144,18 +142,34 @@ def get_stats():
 
 @app.websocket("/ws/feed")
 async def websocket_feed(websocket: WebSocket):
+    """BUG-01 FIX: server now pushes data every 15s — no longer waits for client msg."""
+    import asyncio
     await websocket.accept()
     logger.info("[WS] Feed client connected")
     try:
         while True:
-            data = await websocket.receive_text()
+            driver = get_driver()
+            stats  = {}
+            if driver:
+                try:
+                    with driver.session() as s:
+                        rows = s.run(
+                            "MATCH (n) RETURN labels(n)[0] AS t, count(n) AS c"
+                        ).data()
+                        stats = {r["t"]: r["c"] for r in rows if r["t"]}
+                except Exception:
+                    pass
             await websocket.send_json({
-                "type":    "ping",
-                "message": "Feed active. Updates broadcast on new data ingestion.",
+                "type":    "heartbeat",
+                "message": "BharatGraph live feed active",
+                "stats":   stats,
                 "at":      datetime.now().isoformat(),
             })
+            await asyncio.sleep(15)
     except WebSocketDisconnect:
         logger.info("[WS] Feed client disconnected")
+    except Exception as e:
+        logger.warning(f"[WS] Feed error: {e}")
 
 @app.get("/debug/env")
 def debug_env():

api/middleware/audit_logger.py

@@ -9,13 +9,31 @@ from loguru import logger
 AUDIT_LOG = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(
     os.path.abspath(__file__)))), "logs", "audit.jsonl")
 
-_previous_hash = "0" * 64
+# BUG-13 FIX: _previous_hash was global in-memory — breaks with multiple Uvicorn workers.
+# Each worker resets to "0"*64 on restart, silently breaking the audit chain.
+# Fix: store the previous hash in a per-process temp file so each worker is consistent.
+# (True cross-worker chaining requires Redis/DB which is out of scope for free tier.)
+import tempfile
+_HASH_FILE = os.path.join(tempfile.gettempdir(), f"bharatgraph_audit_hash_{os.getpid()}.txt")
+
+def _read_prev_hash() -> str:
+    try:
+        with open(_HASH_FILE) as f:
+            return f.read().strip() or "0" * 64
+    except FileNotFoundError:
+        return "0" * 64
+
+def _write_prev_hash(h: str) -> None:
+    try:
+        with open(_HASH_FILE, "w") as f:
+            f.write(h)
+    except Exception:
+        pass
 
 
 class AuditLoggerMiddleware(BaseHTTPMiddleware):
 
     async def dispatch(self, request: Request, call_next):
-        global _previous_hash
         start = time.time()
 
         response = await call_next(request)
@@ -36,13 +54,13 @@ class AuditLoggerMiddleware(BaseHTTPMiddleware):
             "query_hash":  q_hash,
             "status":      response.status_code,
             "elapsed_s":   elapsed,
-            "prev_hash":   _previous_hash,
+            "prev_hash":   _read_prev_hash(),
         }
 
         entry_str    = json.dumps(entry, separators=(",", ":"))
         current_hash = hashlib.sha256(entry_str.encode()).hexdigest()
         entry["hash"] = current_hash
-        _previous_hash = current_hash
+        _write_prev_hash(current_hash)
 
         try:
             os.makedirs(os.path.dirname(AUDIT_LOG), exist_ok=True)

api/middleware/input_validator.py

@@ -6,11 +6,21 @@ from starlette.middleware.base import BaseHTTPMiddleware
 from loguru import logger
 
 MAX_QUERY_LEN = 200
+
+# BUG-09 FIX: was re.IGNORECASE — blocked "Union Bank", "Match Point", "Call Centre" etc.
+# Fix: require UPPERCASE keywords followed by space, which is how real Cypher injection looks.
+# A user searching "union bank" or "call centre" never types uppercase Cypher keywords.
 CYPHER_INJECTION = re.compile(
-    r'(MATCH|CREATE|DELETE|MERGE|SET|REMOVE|DROP|DETACH|UNION|CALL)\s',
-    re.IGNORECASE
+    r'\b(MATCH|CREATE|DELETE|MERGE|SET|REMOVE|DROP|DETACH|UNION|CALL)\s',
+    # NO re.IGNORECASE — intentional: real injection is uppercase, real searches are lowercase
+)
+
+# Allowed: letters (all scripts), digits, spaces, common punctuation, all Indian scripts
+ALLOWED_CHARS = re.compile(
+    r'^[\w\s\-\.\,\(\)\'\"\u0900-\u097F\u0B80-\u0BFF\u0C00-\u0C7F'
+    r'\u0C80-\u0CFF\u0D00-\u0D7F\u0980-\u09FF\u0A80-\u0AFF'
+    r'\u0A00-\u0A7F\u0B00-\u0B7F\u0E00-\u0E7F]+$'
 )
-ALLOWED_CHARS = re.compile(r'^[\w\s\-\.\,\(\)\'\u0900-\u097F\u0B80-\u0BFF\u0C00-\u0C7F\u0C80-\u0CFF\u0D00-\u0D7F\u0980-\u09FF\u0A80-\u0AFF\u0A00-\u0A7F\u0B00-\u0B7F]+$')
 
 
 class InputValidatorMiddleware(BaseHTTPMiddleware):
@@ -29,7 +39,7 @@ class InputValidatorMiddleware(BaseHTTPMiddleware):
             logger.warning(f"[InputValidator] Cypher injection attempt: {q[:50]}")
             raise HTTPException(
                 status_code=422,
-                detail="Invalid characters in query."
+                detail="Query contains invalid patterns."
             )
 
         return await call_next(request)

api/middleware/rate_limiter.py

@@ -24,7 +24,12 @@ class SlidingWindowRateLimiter(BaseHTTPMiddleware):
 
     def __init__(self, app):
         super().__init__(app)
+        # BUG-14 NOTE: in-memory state — each worker starts fresh on restart.
+        # Rate limits are per-worker, not cross-worker. Acceptable for single-process HF Spaces.
+        # For multi-worker: replace with Redis-backed sliding window.
         self._windows: dict[str, list[float]] = defaultdict(list)
+        # BUG-14 FIX: add eviction to prevent unbounded memory growth on long-running server
+        self._evict_at = 0.0
 
     def _get_limit(self, path: str) -> tuple[int, int]:
         for prefix, limit in LIMITS.items():
@@ -46,6 +51,13 @@ class SlidingWindowRateLimiter(BaseHTTPMiddleware):
         key = f"{ip}:{path.split('/')[1]}"
         now = time.time()
 
+        # Evict stale entries every 5 minutes to prevent memory leak (BUG-14)
+        if now - self._evict_at > 300:
+            stale_keys = [k for k, ts in self._windows.items() if not ts or now - ts[-1] > window]
+            for k in stale_keys:
+                del self._windows[k]
+            self._evict_at = now
+
         self._windows[key] = [t for t in self._windows[key] if now - t < window]
 
         if len(self._windows[key]) >= max_req:

api/models.py

@@ -80,11 +80,14 @@ class ProfileSection(BaseModel):
 
 
 class ProfileResponse(BaseModel):
+    """BUG-22 FIX: added sources field — profile.py was returning it but model lacked it,
+    causing Pydantic ValidationError silently on some entity types."""
     entity_id: str
     entity_type: str
     name: str
     overview: Dict[str, Any] = {}
     sections: List[ProfileSection] = []
+    sources: List[SourceDocument] = []
     risk_score: Optional[int] = None
     generated_at: str
 

api/routes/export.py

@@ -13,15 +13,13 @@ from ai.report_hasher import ReportHasher
 from ai.multi_investigator import MultiInvestigator
 
 router   = APIRouter()
-_generator = None
-_hasher    = None
+_hasher = None
 
 
 def get_generator() -> DossierGenerator:
-    global _generator
-    if _generator is None:
-        _generator = DossierGenerator(driver=get_driver())
-    return _generator
+    """BUG-08 FIX: was caching generator with stale driver.
+    Now creates a fresh generator per request — driver is always fresh."""
+    return DossierGenerator(driver=get_driver())
 
 
 def get_hasher() -> ReportHasher:

api/routes/investigation.py

@@ -2,8 +2,7 @@ import os, sys
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
 
 from datetime import datetime
-from typing import Optional
-from fastapi import APIRouter, Depends, Query
+from fastapi import APIRouter, Depends, Query, HTTPException
 from loguru import logger
 
 from api.dependencies import get_db
@@ -15,15 +14,36 @@ router = APIRouter()
 
 @router.get("/investigate/{entity_id}")
 def deep_investigate(entity_id: str, driver=Depends(get_db)):
-    logger.debug("[Investigation] Deep investigate request received")
-    investigator = DeepInvestigator(driver=driver)
-    with driver.session() as session:
-        row = session.run(
-            "MATCH (n {id:$id}) RETURN n.name AS name",
-            id=entity_id
-        ).single()
-    name = (row["name"] if row else entity_id) or entity_id
-    return investigator.investigate(entity_id, name)
+    """BUG-04 FIX: was no try/except — any exception became a raw 500."""
+    logger.info(f"[Investigation] Deep investigate: {entity_id}")
+    try:
+        investigator = DeepInvestigator(driver=driver)
+        name = entity_id
+        try:
+            with driver.session() as session:
+                row = session.run(
+                    "MATCH (n {id:$id}) RETURN n.name AS name", id=entity_id
+                ).single()
+            name = (row["name"] if row else entity_id) or entity_id
+        except Exception as name_err:
+            logger.debug(f"[Investigation] Name lookup failed: {name_err}")
+
+        return investigator.investigate(entity_id, name)
+
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"[Investigation] Error for {entity_id}: {type(e).__name__}: {e}")
+        return {
+            "entity_id":   entity_id,
+            "entity_name": entity_id,
+            "status":      "error",
+            "error":       "Investigation failed — please retry",
+            "total_items": 0,
+            "layers":      [],
+            "confidence":  0,
+            "investigated_at": datetime.now().isoformat(),
+        }
 
 
 @router.get("/connection-map")
@@ -32,22 +52,31 @@ def connection_map(
     b: str = Query(..., description="Entity B ID"),
     driver=Depends(get_db),
 ):
-    logger.debug("[Investigation] Connection map request received")
-    mapper = ConnectionMapper(driver=driver)
-    return mapper.find_paths(a, b)
+    """BUG-04 FIX: wrapped with try/except."""
+    logger.info(f"[Investigation] Connection map: {a} <-> {b}")
+    try:
+        mapper = ConnectionMapper(driver=driver)
+        return mapper.find_paths(a, b)
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"[Investigation] Connection map error: {e}")
+        raise HTTPException(status_code=500, detail="Connection map failed — please retry")
 
 
 @router.get("/node-evidence/{entity_id}")
 def node_evidence(entity_id: str, driver=Depends(get_db)):
-    logger.debug("[Investigation] Node evidence request received")
-    from fastapi import HTTPException
-    with driver.session() as s:
-        row = s.run(
-            "MATCH (n {id:$id}) RETURN n.id AS id", id=entity_id
-        ).single()
-    if not row:
-        raise HTTPException(
-            status_code=404, detail=f"Entity {entity_id} not found"
-        )
-    mapper = ConnectionMapper(driver=driver)
-    return mapper.get_node_evidence(entity_id)
+    """BUG-04 FIX: wrapped with try/except."""
+    logger.info(f"[Investigation] Node evidence: {entity_id}")
+    try:
+        with driver.session() as s:
+            row = s.run("MATCH (n {id:$id}) RETURN n.id AS id", id=entity_id).single()
+        if not row:
+            raise HTTPException(status_code=404, detail=f"Entity {entity_id} not found")
+        mapper = ConnectionMapper(driver=driver)
+        return mapper.get_node_evidence(entity_id)
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"[Investigation] Node evidence error for {entity_id}: {e}")
+        raise HTTPException(status_code=500, detail="Evidence fetch failed — please retry")

api/routes/profile.py

@@ -162,37 +162,5 @@ def get_profile(entity_id: str, driver=Depends(get_db)):
 
     # BUG-07 FIX: Generic fallback handles AuditReport, Contract, NGO,
     # ElectoralBond, EnforcementAction, Tender, InsolvencyOrder, etc.
-    # Previously these all returned 404.
-    with driver.session() as session:
-        generic = session.run(
-            "MATCH (n {id: $id}) RETURN n, labels(n)[0] AS label",
-            id=entity_id
-        ).single()
-
-    if generic:
-        n     = dict(generic["n"])
-        label = generic["label"] or "Unknown"
-        name  = (n.get("name") or n.get("title") or n.get("ngo_name")
-                 or n.get("company_name") or n.get("purchaser_name") or entity_id)
-
-        # Build overview from all non-null node properties
-        overview = {
-            k: v for k, v in n.items()
-            if k not in ("id",) and v is not None and str(v).strip()
-        }
-
-        return ProfileResponse(
-            entity_id=entity_id,
-            entity_type=label,
-            name=name,
-            overview=overview,
-            sections=[],
-            sources=[SourceDocument(
-                institution="BharatGraph Knowledge Graph",
-                document_title=f"{label} Record — Official Source",
-                url="https://abinaze.github.io/bharatgraph",
-            )],
-            generated_at=datetime.now().isoformat(),
-        )
 
     raise HTTPException(status_code=404, detail=f"Entity {entity_id} not found")

frontend/js/app.js

@@ -202,8 +202,9 @@ const Views = {
       <div style="padding:var(--space-8) 0">
         <div class="container">
           <div class="search-bar" style="max-width:700px;margin-bottom:var(--space-6)">
-            <input class="search-bar__input" id="search-input"
-                   placeholder="Search entities..." id="search-input-field"
+            <!-- BUG-10 FIX: removed duplicate id attribute -->
+              <input class="search-bar__input" id="search-input"
+                   placeholder="Search entities..."
                    autocomplete="off">
             <button class="search-bar__btn" id="search-btn">Search</button>
           </div>
@@ -213,7 +214,7 @@ const Views = {
             <select id="lang-select" style="font-size:var(--font-size-xs);padding:4px 8px;
                     background:var(--bg-secondary);color:var(--text-primary);
                     border:1px solid var(--border-color);border-radius:6px;cursor:pointer"
-                    onchange="State.language=this.value;applyLanguage(this.value)">
+                    onchange="State.language=this.value;applyLanguage(this.value);document.getElementById('navbar-lang-select')&&(document.getElementById('navbar-lang-select').value=this.value)">
               <option value="en">🇮🇳 English</option>
               <option value="hi">हिन्दी</option>
               <option value="ta">தமிழ்</option>
@@ -839,11 +840,27 @@ function initApp() {
   Router.register("/live-feed", Views.liveFeed);
   Router.register("/about",    Views.about);
 
-  Api.health().then(() => {
-    State.apiConnected = true;
-  }).catch(() => {
-    Components.Toast("API not connected. Start: uvicorn api.main:app --reload", "error");
-  });
+  // BUG-02 FIX: was single immediate check — failed permanently on HF cold start.
+  // BUG-25 FIX: message said "Start: uvicorn" — wrong for HuggingFace users.
+  // Fix: retry up to 5 times with exponential backoff (2s, 4s, 8s, 16s, 30s).
+  (function checkHealth(attempt) {
+    Api.health()
+      .then(data => {
+        State.apiConnected = true;
+        const dot  = document.getElementById("api-status-dot");
+        const text = document.getElementById("api-status-text");
+        if (dot)  dot.style.background  = data.neo4j_connected ? "var(--color-risk-low)" : "var(--color-saffron)";
+        if (text) text.textContent      = data.neo4j_connected ? "Connected" : "API Only";
+      })
+      .catch(() => {
+        if (attempt < 5) {
+          const delay = Math.min(2000 * Math.pow(2, attempt - 1), 30000);
+          setTimeout(() => checkHealth(attempt + 1), delay);
+        } else {
+          Components.Toast("API unavailable. Please refresh the page in a moment.", "error");
+        }
+      });
+  })(1);
 
   Router.init();
 

frontend/js/components.js

@@ -1,8 +1,6 @@
-function sanitize(str) {
-  const d = document.createElement("div");
-  d.textContent = String(str || "");
-  return d.innerHTML;
-}
+// BUG-05 FIX: sanitize() removed from components.js — defined once in app.js.
+// Both files previously defined it; second definition silently overwrote the first.
+// app.js loads last, so its sanitize() was always the active one, but this was fragile.
 
 const Components = {
   Spinner: (size = "sm") => {
@@ -64,11 +62,13 @@ const Components = {
     el.setAttribute("role", "button");
     el.setAttribute("tabindex", "0");
     const type = (entity.entity_type || "").toLowerCase();
+    // BUG-16 FIX: removed duplicate ministry: "M" key
     const icons = { politician: "P", company: "C", contract: "K",
-                  tender: "T", regulatory: "R", enforcement: "E",
-                  electoralbond: "B", insolvency: "I", ngo: "N",
-                  ministry: "M", party: "W", scheme: "S",
-                    auditreport: "A", ministry: "M" };
+                    tender: "T", regulatory: "R", enforcement: "E",
+                    electoralbond: "B", insolvency: "I", ngo: "N",
+                    ministry: "M", party: "W", scheme: "S",
+                    auditreport: "A", courtcase: "J", localbody: "L",
+                    pressrelease: "PR", parliamentquestion: "Q" };
     const icon = icons[type] || "?";
     el.innerHTML = `
       <div class="result-card__icon result-card__icon--${type}">
@@ -102,14 +102,15 @@ const Components = {
       .slice(0, 3)
       .map(e => `<span class="evidence-chip">${e.substring(0, 60)}</span>`)
       .join("");
+    // BUG-20 FIX: finding.description was put directly in innerHTML — XSS risk
     el.innerHTML = `
       <div class="finding-item__severity" style="color:${
         finding.severity === "HIGH" ? "var(--color-risk-high)"
         : finding.severity === "VERY_HIGH" ? "var(--color-risk-very-high)"
         : finding.severity === "MODERATE" ? "#856404"
         : "var(--color-risk-low)"
-      }">${finding.severity || "LOW"}</div>
-      <div class="finding-item__desc">${finding.description || ""}</div>
+      }">${sanitize(finding.severity || "LOW")}</div>
+      <div class="finding-item__desc">${sanitize(finding.description || "")}</div>
       ${evidence ? `<div style="margin-top:var(--space-2)">${evidence}</div>` : ""}
     `;
     return el;

frontend/js/evidence_panel.js

@@ -79,7 +79,8 @@ const EvidencePanel = {
         <button onclick="EvidencePanel._investigate('${entityId}')"
                 id="ep-investigate-btn"
                 class="btn btn--secondary" style="flex:1;font-size:12px">Investigate (6 Layers)</button>
-        <button onclick="EvidencePanel._openConnectionMap('${entityId}','${sanitize(entityName||entityId)}')"
+        <button data-eid="${sanitize(entityId)}" data-ename="${sanitize(entityName||entityId)}"
+          onclick="EvidencePanel._openConnectionMap(this.getAttribute('data-eid'),this.getAttribute('data-ename'))"
                 class="btn btn--secondary" style="flex:1;font-size:12px">Map Links</button>
       </div>
     `;
@@ -227,7 +228,8 @@ const EvidencePanel = {
           ${items.map(e => `
             <div style="padding:10px 12px;margin-bottom:6px;background:var(--bg-tertiary);
                         border-radius:8px;cursor:pointer"
-                 onclick="EvidencePanel.open('${sanitize(e.connected_id||"")}','${sanitize(e.connected_to||"")}')">
+                 data-eid="${sanitize(e.connected_id||"")}" data-ename="${sanitize(e.connected_to||"")}"
+                  onclick="EvidencePanel.open(this.getAttribute('data-eid'),this.getAttribute('data-ename'))">
               <div style="display:flex;justify-content:space-between">
                 <span style="font-size:13px;font-weight:600;color:var(--text-primary)">
                   ${sanitize(e.connected_to||e.connected_id||"—")}

frontend/sw.js

@@ -1,7 +1,14 @@
-const CACHE = "bharatgraph-v3";
-const STATIC = ["/","/index.html","/css/design-system.css",
-  "/css/components.css","/js/router.js","/js/api.js",
-  "/js/components.js","/js/graph.js","/js/timeline.js","/js/evidence_panel.js","/js/app.js"];
+// BUG-12/23 FIX: was caching API responses (health, search, stats) with cache-then-network.
+// Cold-start 503 responses were being served from cache for minutes.
+// Fix: static assets only (cache-first). API calls always network-first, no caching.
+// Never cache health, search, stats, investigate — these must always be fresh.
+const CACHE = "bharatgraph-v4";
+const STATIC = [
+  "/","/index.html",
+  "/css/design-system.css","/css/components.css",
+  "/js/router.js","/js/api.js","/js/components.js",
+  "/js/graph.js","/js/timeline.js","/js/evidence_panel.js","/js/app.js"
+];
 
 self.addEventListener("install", e => {
   e.waitUntil(caches.open(CACHE).then(c => c.addAll(STATIC)));
@@ -17,14 +24,19 @@ self.addEventListener("activate", e => {
 });
 
 self.addEventListener("fetch", e => {
-  const isApi = e.request.url.includes("hf.space") || e.request.url.includes("/api/");
+  const url = e.request.url;
+  // BUG-12/23 FIX: API calls NEVER cached — always fetch live from network
+  const isApi = url.includes("hf.space") || url.includes("/api/") ||
+                url.includes("/health") || url.includes("/stats") ||
+                url.includes("/search") || url.includes("/investigate");
   if (isApi) {
-    e.respondWith(
-      fetch(e.request)
-        .then(r => { if (r.ok) caches.open(CACHE).then(c => c.put(e.request, r.clone())); return r; })
-        .catch(() => caches.match(e.request))
-    );
+    // Network only — no cache fallback for API
+    e.respondWith(fetch(e.request).catch(() =>
+      new Response(JSON.stringify({error:"API temporarily unavailable"}),
+        {status:503, headers:{"Content-Type":"application/json"}})
+    ));
   } else {
+    // Static assets: cache-first
     e.respondWith(caches.match(e.request).then(r => r || fetch(e.request)));
   }
 });

graph/schema.py

@@ -202,14 +202,20 @@ RELATIONSHIP_SCHEMAS = {
 
 # ── Full-text index (run once) ───────────────────────────────────────────────
 # This powers instant search across all labels and fields simultaneously.
-FULLTEXT_INDEX_QUERY = """
-CALL db.index.fulltext.createNodeIndex(
-  'globalSearch',
-  ['Politician','Company','Contract','AuditReport','Scheme','Ministry','Party','PressRelease'],
-  ['name','title','aliases','description','item_desc','buyer_org',
-   'cin','ministry','summary','seller_name','order_id']
+FULLTEXT_INDEX_QUERY = (
+    # BUG-19 FIX: expanded from 8 to 16 node types + 14 searchable fields.
+    # Auto-scales: add new node labels and field names to the lists below.
+    "CALL db.index.fulltext.createNodeIndex("
+    "  \'globalSearch\',"
+    "  [\'Politician\',\'Company\',\'Contract\',\'AuditReport\',\'Scheme\',"
+    "   \'Ministry\',\'Party\',\'PressRelease\',\'Tender\',\'RegulatoryOrder\',"
+    "   \'EnforcementAction\',\'ElectoralBond\',\'InsolvencyOrder\',"
+    "   \'NGO\',\'CourtCase\',\'LocalBody\'],"
+    "  [\'name\',\'title\',\'aliases\',\'description\',\'item_desc\',"
+    "   \'buyer_org\',\'seller_name\',\'ngo_name\',\'company_name\',"
+    "   \'purchaser_name\',\'accused\',\'ministry\',\'constituency\',\'state\']"
+    ")"
 )
-"""
 
 SETUP_QUERIES = [
     # Uniqueness constraints (also create indexes automatically)