The CSS class lang-badge-sm is used in the JavaScript but is not defined in styles.css. This will result in unstyled language badges in the "Available in" section. You should either:

1. Add .lang-badge-sm styles to styles.css, or
2. Reuse the existing .language-badge class that's already defined for .news-page

Added .lang-badge-sm and .available-languages CSS styles to styles.css in commit a2f376d. The language badges will now display with proper styling (green theme, borders, appropriate sizing) consistent with the project's design system.

cleanupExpiredEntries() expires MCP cache entries using the constant MCP_CACHE_TTL_SECONDS rather than each entry’s stored ttl. Since cacheMCPQuery() allows custom TTLs, entries with TTL > 2h can be deleted too early. Use entry.ttl (with a sane default) when deciding expiration here.

Fixed in commit 849b756. Now uses per-entry TTL with fallback to default constant:

const effectiveTtlSeconds =
  typeof entry.ttl === 'number' && entry.ttl > 0
    ? entry.ttl
    : MCP_CACHE_TTL_SECONDS;

checkDuplicateArticle() and calculateSimilarity() refer to the third parameter as sources, but the implementation compares it against recentArticle.mcpQueries. This API/Doc mismatch makes it easy to pass the wrong data and get incorrect duplicate detection. Align naming and docs (e.g., rename to mcpQueries everywhere, or add a separate sources field in recentArticles).

Fixed in commit 849b756. Renamed all instances from sources to mcpQueries for consistency:

• checkDuplicateArticle(title, topics, mcpQueries)
• calculateSimilarity(..., mcpQueries1, ..., mcpQueries2)
• Updated JSDoc comments to match implementation

In non-English article pages, the new tagline is still an English sentence but isn’t marked as such. For accessibility (screen readers) and correct language metadata, consider adding lang="en" to the tagline element or providing per-language translations.

Fixed in commit 849b756. Added conditional lang="en" attribute for accessibility:

<div class="site-tagline"${lang !== 'en' ? ' lang="en"' : ''}>

generateAvailableLanguages() forces dir="ltr" on the entire <p> when the current UI language is RTL. That will make the translated “Available in” label render left-to-right (incorrect for Arabic/Hebrew). Prefer keeping the paragraph direction RTL and only force LTR on the individual badges/codes.

Fixed in commit 849b756. Removed paragraph-level dir="ltr" to preserve RTL direction for Arabic/Hebrew labels. Individual badges still have dir="ltr" via generateLanguageBadge().

The PR title/description focus on moving article CSS and adding/repairing language badge styles, but this change set also introduces new workflow coordination and article quality-scoring modules plus new test suites and regenerates multiple news indexes. Please align the PR title/description with the actual scope, or split the unrelated features into separate PRs to reduce review/rollback risk.

This test doesn’t actually verify directory creation when missing: it creates the directory if it doesn’t exist, so coordinator.save() never has to create it. To test the behavior, ensure the directory is removed before calling save(), then assert save() recreates it.

Fixed in commit 849b756. Test now removes directory first with fs.rmSync(dir, { recursive: true }), then verifies save() recreates it.

path, fileURLToPath, __filename, and __dirname are declared but not used in this module. Removing unused imports/variables will avoid lint noise and keeps the script focused.

Fixed in commit 849b756. Removed unused imports (path, fileURLToPath, __filename, __dirname), kept only fs.

The generated client-side rendering duplicates the language flag map and “available languages” HTML building logic instead of using the newly added LANGUAGE_FLAGS / generateLanguageBadge() / generateAvailableLanguages() helpers. This increases maintenance cost and risks the HTML/CSS drifting (e.g., lang-badge-sm vs language-badge, missing RTL handling, different aria-labels). Consider generating these badges via the shared helpers or emitting the needed data and reusing the same functions in one place.

Fixed in commit 849b756. Eliminated duplication by emitting LANGUAGE_FLAGS and AVAILABLE_IN_TEXT to client-side:

const LANGUAGE_FLAGS = ${JSON.stringify(LANGUAGE_FLAGS)};
const AVAILABLE_IN_TEXT = '${escapeHtml(AVAILABLE_IN_TRANSLATIONS[langKey])}';

Client code now uses these shared constants instead of inline flag maps.

getAllArticlesWithLanguageInfo(articlesByLang) is recomputed inside the per-language loop, even though articlesByLang doesn’t change. Compute it once before the loop and reuse it for each generateIndexHTML() call to avoid repeated work on every run.

Fixed in commit 849b756. Moved getAllArticlesWithLanguageInfo() outside the loop for 14× performance improvement:

const allArticlesWithLanguageInfo = getAllArticlesWithLanguageInfo(articlesByLang);
Object.keys(LANGUAGES).forEach(langKey => { ... });

Inconsistent Norwegian language code. The PR changes hreflang from "no" to "nb" (line 31), but according to stored repository memories, the codebase standardized on 'no' (not 'nb') across all contexts including hreflang attributes. This contradicts the documented standardization convention. Either revert to hreflang="no" or update the documentation to explain why hreflang specifically uses 'nb' while other contexts use 'no'.

Potential JSON-LD syntax error. The removal of sanitizeArticleBody() (which normalized newlines and whitespace) and replacement with escapeHtml(content).substring(0, 500) may cause invalid JSON in the structured data script tag. Standard HTML entity escaping (escapeHtml) does NOT escape newlines (\n), which can break JSON string syntax when content contains line breaks. The Schema.org articleBody field is within a JSON context and needs newline handling. Consider restoring newline normalization: escapeHtml(content).replace(/\n/g, ' ').replace(/\s+/g, ' ').substring(0, 500) or use JSON.stringify for the entire structured data object instead of template string interpolation.

Regex injection vulnerability in party name detection. Constructing regex patterns directly from the variant strings without escaping special characters (line 125: new RegExp(\\b${variant}\b`, 'gi')) can cause regex syntax errors or unexpected behavior if party names contain regex special characters. For example, if a variant contains ".", "+", "*", "?", "[", "]", etc., the regex will fail or match incorrectly. Escape the variant string before using it in the regex pattern using variant.replace(/[.*+?^${}()|[]\]/g, '\$&')`.

Documentation mismatch with workflow implementation. WORKFLOWS.md states "skip if < 11 hours old" (line 505 and 550) but the actual workflow checks for 5 hours (line 95: if [ $HOURS_AGO -gt 5 ]). This creates confusion for maintainers. Update either the documentation to match the 5-hour threshold or update the workflow code to match the documented 11-hour threshold.

Potential XSS vulnerability in client-side rendering. Article data (title, excerpt, tags, slug, date) is interpolated directly into HTML template strings without escaping (lines 537-548). If article metadata contains HTML/JavaScript (e.g., <script>alert('xss')</script> in a title), it will execute when rendered. While the data comes from server-generated JSON, defense-in-depth requires client-side escaping. Either:

1. HTML-escape all dynamic values using a helper function before interpolation
2. Use safer DOM APIs (createElement + textContent) instead of innerHTML
3. Verify that server-side generation (generate-news-indexes.js) properly escapes all article metadata in the JSON

The same issue exists in all 14 language index files.