diff --git a/drizzle/0011_fts5_external_content.sql b/drizzle/0011_fts5_external_content.sql
new file mode 100644
index 0000000..fa2e77d
--- /dev/null
+++ b/drizzle/0011_fts5_external_content.sql
@@ -0,0 +1,73 @@
+-- Fix #48: switch articles_fts from a contentless FTS5 table to an
+-- external-content table (content='article_localizations',
+-- content_rowid='rowid').
+--
+-- The contentless pattern from migration 0002 requires the
+-- ('delete', old.rowid, …all column values…) tuple to **exactly
+-- match** what's stored in the index. Any drift — different
+-- normalization, trailing newline, prior failed REPLACE — makes the
+-- delete-trigger fail with SQLITE_ERROR. UPDATE inherits that fault.
+-- After-effect on the CMS: editors couldn't update or delete an
+-- article_localizations row once any drift had occurred.
+--
+-- The external-content pattern lets the trigger reference rowid
+-- alone:
+--   INSERT INTO articles_fts(articles_fts, rowid) VALUES('delete', old.rowid);
+-- — no column values to match against, so drift becomes a non-issue.
+-- And `rebuild` can recover from any inconsistency without dropping
+-- the table.
+--
+-- Migration steps:
+--   1. Drop the old triggers (must happen before dropping the table).
+--   2. Drop the old virtual table.
+--   3. Recreate as external-content.
+--   4. Rebuild the index from article_localizations in one shot.
+--   5. Recreate triggers using the simpler delete pattern.
+
+DROP TRIGGER IF EXISTS articles_fts_ai;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS articles_fts_ad;
+--> statement-breakpoint
+DROP TRIGGER IF EXISTS articles_fts_au;
+--> statement-breakpoint
+DROP TABLE IF EXISTS articles_fts;
+--> statement-breakpoint
+
+CREATE VIRTUAL TABLE IF NOT EXISTS articles_fts USING fts5(
+  title,
+  excerpt,
+  body,
+  locale UNINDEXED,
+  article_id UNINDEXED,
+  content = 'article_localizations',
+  content_rowid = 'rowid',
+  tokenize = 'unicode61 remove_diacritics 2'
+);
+--> statement-breakpoint
+
+-- Build the index from current state. With external-content, this
+-- reads from article_localizations directly (the `content =` link
+-- above tells FTS5 where to look).
+INSERT INTO articles_fts(articles_fts) VALUES('rebuild');
+--> statement-breakpoint
+
+-- Triggers — simpler than before because external-content tables
+-- only need rowid for delete (the source-of-truth values come from
+-- the linked table itself).
+
+CREATE TRIGGER IF NOT EXISTS articles_fts_ai AFTER INSERT ON article_localizations BEGIN
+  INSERT INTO articles_fts(rowid, title, excerpt, body, locale, article_id)
+  VALUES (new.rowid, new.title, COALESCE(new.excerpt, ''), new.body, new.locale, new.article_id);
+END;
+--> statement-breakpoint
+
+CREATE TRIGGER IF NOT EXISTS articles_fts_ad AFTER DELETE ON article_localizations BEGIN
+  INSERT INTO articles_fts(articles_fts, rowid) VALUES('delete', old.rowid);
+END;
+--> statement-breakpoint
+
+CREATE TRIGGER IF NOT EXISTS articles_fts_au AFTER UPDATE ON article_localizations BEGIN
+  INSERT INTO articles_fts(articles_fts, rowid) VALUES('delete', old.rowid);
+  INSERT INTO articles_fts(rowid, title, excerpt, body, locale, article_id)
+  VALUES (new.rowid, new.title, COALESCE(new.excerpt, ''), new.body, new.locale, new.article_id);
+END;
diff --git a/drizzle/meta/_journal.json b/drizzle/meta/_journal.json
index 1960032..336d92d 100644
--- a/drizzle/meta/_journal.json
+++ b/drizzle/meta/_journal.json
@@ -78,6 +78,13 @@
       "when": 1777709468165,
       "tag": "0010_windy_carmella_unuscione",
       "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "6",
+      "when": 1778060000000,
+      "tag": "0011_fts5_external_content",
+      "breakpoints": true
     }
   ]
 }
\ No newline at end of file
diff --git a/src/lib/components/consent/CookieBanner.svelte b/src/lib/components/consent/CookieBanner.svelte
index 3742bee..9ada8ff 100644
--- a/src/lib/components/consent/CookieBanner.svelte
+++ b/src/lib/components/consent/CookieBanner.svelte
@@ -46,6 +46,7 @@
 				<p class="font-medium text-foreground mb-1">{m.cookie_banner_title()}</p>
 				<p>
 					{m.cookie_banner_body()}
+					<!-- eslint-disable-next-line svelte/no-navigation-without-resolve -- privacy href is operator-supplied (always /[locale]/privacy-policy from layout); not a build-time route -->
 					<a href={privacyHref} class="underline hover:text-foreground">{m.cookie_banner_learn_more()}</a>
 				</p>
 				{#if detailsOpen}
diff --git a/src/lib/components/seo/Seo.svelte b/src/lib/components/seo/Seo.svelte
index f04141f..0431ba6 100644
--- a/src/lib/components/seo/Seo.svelte
+++ b/src/lib/components/seo/Seo.svelte
@@ -88,9 +88,16 @@
 		<meta name="twitter:site" content={defaults.twitter} />
 	{/if}
 
-	<!-- JSON-LD: one <script> per entry for maximum tooling compatibility -->
+	<!-- JSON-LD: one <script> per entry for maximum tooling compatibility.
+		 Using {@html} is required to emit a literal <script> tag (Svelte
+		 strips them in normal markup). The payload is server-built JSON
+		 from our own typed builders ($lib/seo) — never user input — and
+		 we escape any "</script>" sequence before injection so a JSON
+		 value can't break out of the tag. -->
 	{#each jsonLd as ld, i (i)}
-		{@html `<script type="application/ld+json">${JSON.stringify(ld)}<\/script>`}
+		{@const safeJson = JSON.stringify(ld).replace(/<\/script>/gi, '<\\/script>')}
+		<!-- eslint-disable-next-line svelte/no-at-html-tags -- trusted: server-built JSON-LD with </script> escaped -->
+		{@html '<script type="application/ld+json">' + safeJson + '<' + '/script>'}
 	{/each}
 
 	<!-- RSS auto-discovery -->
diff --git a/src/lib/server/webhooks/index.ts b/src/lib/server/webhooks/index.ts
index 5defe63..097695f 100644
--- a/src/lib/server/webhooks/index.ts
+++ b/src/lib/server/webhooks/index.ts
@@ -79,7 +79,9 @@ async function deliverOne(
   for (let attempt = 1; attempt <= MAX_INLINE_ATTEMPTS; attempt++) {
     const t0 = Date.now();
     let responseStatus: number | null = null;
-    let responseExcerpt: string | null = null;
+    // Assigned in every code path below; no initializer to satisfy
+    // no-useless-assignment.
+    let responseExcerpt: string | null;
     let ok = false;
     try {
       const ctrl = new AbortController();
diff --git a/src/routes/(cms)/cms/dashboard/+page.server.ts b/src/routes/(cms)/cms/dashboard/+page.server.ts
index e182d83..06a7cc2 100644
--- a/src/routes/(cms)/cms/dashboard/+page.server.ts
+++ b/src/routes/(cms)/cms/dashboard/+page.server.ts
@@ -1,6 +1,6 @@
 import { redirect, error } from "@sveltejs/kit";
 import { drizzle } from "drizzle-orm/d1";
-import { desc, eq, and, gte } from "drizzle-orm";
+import { desc, eq, gte } from "drizzle-orm";
 import * as schema from "$lib/server/content/schema";
 import { canManageUsers } from "$lib/server/auth/permissions";
 import { AnalyticsService } from "$lib/server/analytics";
diff --git a/src/routes/(cms)/cms/media/+page.svelte b/src/routes/(cms)/cms/media/+page.svelte
index c4caf9d..5e3dbe3 100644
--- a/src/routes/(cms)/cms/media/+page.svelte
+++ b/src/routes/(cms)/cms/media/+page.svelte
@@ -34,8 +34,11 @@
 		Boolean(data.user && ['super_admin', 'admin', 'editor'].includes(data.user.role)),
 	);
 
-	// Build a parent → children map for the folder tree.
+	// Build a parent → children map for the folder tree. Local to the
+	// derived; never read reactively (rebuilt every invocation), so a
+	// plain Map is correct — no need for SvelteMap's reactivity overhead.
 	const childrenByParent = $derived.by(() => {
+		// eslint-disable-next-line svelte/prefer-svelte-reactivity -- local lookup, not reactive state
 		const map = new Map<string | null, MediaFolderRecord[]>();
 		for (const f of data.folders) {
 			const parent = f.parentId ?? null;
diff --git a/src/routes/(www)/[locale]/[...slug]/+page.svelte b/src/routes/(www)/[locale]/[...slug]/+page.svelte
index 98f099a..9f2ac6a 100644
--- a/src/routes/(www)/[locale]/[...slug]/+page.svelte
+++ b/src/routes/(www)/[locale]/[...slug]/+page.svelte
@@ -22,6 +22,7 @@
 		<h1 class="text-4xl font-bold mb-2">{data.title}</h1>
 	</header>
 	<div class="prose prose-neutral dark:prose-invert max-w-none">
+		<!-- eslint-disable-next-line svelte/no-at-html-tags -- trusted: server-rendered markdown from CMS -->
 		{@html data.htmlContent}
 	</div>
 </article>