[Regression] Country-risk index still uses substring country-code matching — #160 was closed Completed without any code change

Severity: Medium (fabricated attribution in a displayed intelligence index; confirmed regression) Confidence: Confirmed by direct inspection of the current, unmodified route plus real current USGS feed examples matching the originally reported pattern. Audited commit: bd4057567de8ee18d49a8b2744c9746bcd67f3e0 (master, 2026-09-13 audit).

This is the third report of the identical defect. #31 originally reported that the country-risk index attributes earthquakes to countries by testing whether a two-letter country code is a substring of the USGS place string, causing accidental matches. #160 re-reported the same code after #31 was closed NOT_PLANNED, with concrete false-positive examples, and #160 was itself closed COMPLETED on 2026-05-21. On the audited commit, four months later, the exact same substring check is still present.

Evidence

• src/app/api/country-risk/route.ts:77-79:

for (const [code, _] of Object.entries(RISK_FACTORS)) {
  if (place.toLowerCase().includes(code.toLowerCase())) {
    quakeRisks[code] = (quakeRisks[code] || 0) + mag;
  }
}

• This reproduces the exact false-positive class #160 documented: a USGS place string like "258 km WSW of Tual, Indonesia" contains the substring "ua" (inside "Tual"), so it inflates Ukraine's (UA) risk score for an earthquake in Indonesia; "South Sandwich Islands region" contains "so" (inside "South"), inflating Somalia's (SO) score for an earthquake near Antarctica.

Why this matters

• country_risk is a ranked, displayed intelligence index (risk_score, risk_level, sorted by score) — false attribution directly corrupts the ranking a viewer sees, inflating scores for countries with zero relationship to the actual seismic event.
• As with the health endpoint (a separate, similarly-patterned regression from this same audit), #160 was closed as Completed without the underlying line changing.

Smallest correction and acceptance criteria

• Replace substring matching with a real place→country mapping: parse the trailing country/region name out of the USGS place string (it is a structured "<distance> km <direction> of <location>, <Country>" format) and match against a country name→ISO code table, not a raw substring test on the two-letter code.
• Acceptance: the exact fixtures from #160 ("258 km WSW of Tual, Indonesia", "South Sandwich Islands region") must not attribute risk to UA or SO respectively; a genuine Ukraine- or Somalia-located event must still attribute correctly.

Prior-issue check: this is a confirmed, unresolved regression of #31 (closed Not Planned) and #160 (closed as Completed, 2026-05-21) — not a new independent finding.