diff --git a/apps/web/app/lib/csv-export.test.ts b/apps/web/app/lib/csv-export.test.ts
index 105c4778..2dd56383 100644
--- a/apps/web/app/lib/csv-export.test.ts
+++ b/apps/web/app/lib/csv-export.test.ts
@@ -335,6 +335,8 @@ describe('isUnfilteredCsvExport', () => {
     bidder: 'acme',
     q: 'rail',
     bids: 'one',
+    flags: ['no_competition'],
+    authorityTypes: ['министерство'],
     types: ['municipality'],
     kinds: ['company'],
     countBucket: '2-5',
diff --git a/apps/web/app/lib/csv-export.ts b/apps/web/app/lib/csv-export.ts
index 078dfc0c..2385a16f 100644
--- a/apps/web/app/lib/csv-export.ts
+++ b/apps/web/app/lib/csv-export.ts
@@ -5,7 +5,15 @@ const CSV_CONTENT_TYPE = 'text/csv; charset=utf-8';
 const CSV_CACHE_CONTROL = 'public, max-age=3600';
 const CSV_MULTIPART_PART_SIZE = 8 * 1024 * 1024;
 
-const ARRAY_FILTERS = ['years', 'sectors', 'procedureGroups', 'kinds', 'types'] as const;
+const ARRAY_FILTERS = [
+  'years',
+  'sectors',
+  'procedureGroups',
+  'kinds',
+  'types',
+  'flags',
+  'authorityTypes',
+] as const;
 // `bids` ('one' | null) is a response-affecting filter: without it here a „само една оферта" export
 // was misclassified as unfiltered and served from / written to the shared unfiltered cache object —
 // a cache-poisoning variant of #56/#122 on top of the wrong-data bug (#138). hasScalarFilter treats
diff --git a/apps/web/app/lib/filters.test.ts b/apps/web/app/lib/filters.test.ts
index 158f1609..660900ac 100644
--- a/apps/web/app/lib/filters.test.ts
+++ b/apps/web/app/lib/filters.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import { CPV_SECTORS } from '@sigma/config';
+import { FLAG_TYPES } from '@sigma/db';
 import {
   authorityListFilters,
   companyListFilters,
@@ -13,9 +14,44 @@ import {
   withParams,
 } from './filters';
 import { CANONICAL_QUERY_PARAMS } from './query-params';
+import type { RiskFlagType } from './riskLogic';
 
 const sp = (q: string) => new URLSearchParams(q);
 
+describe('contract risk-signal + authority-type filters (#218)', () => {
+  it('parses valid ?flag tokens and drops unknown ones', () => {
+    const f = contractListFilters(new URLSearchParams('flag=no_competition,all&flag=bogus'));
+    expect(f.flags).toEqual(['no_competition', 'all']);
+  });
+
+  it('leaves flags empty when the param is absent', () => {
+    expect(contractListFilters(new URLSearchParams('')).flags).toEqual([]);
+  });
+
+  it('parses ?type into authorityTypes', () => {
+    const f = contractListFilters(new URLSearchParams('type=министерство&type=община'));
+    expect(f.authorityTypes).toEqual(['министерство', 'община']);
+  });
+
+  it('drops unknown ?type buckets (cache-cardinality / DoS allow-list guard, #218 review)', () => {
+    const f = contractListFilters(
+      new URLSearchParams('type=министерство&type=<script>&type=zzz-unbounded'),
+    );
+    expect(f.authorityTypes).toEqual(['министерство']);
+  });
+
+  it('the flagged.ts signal set matches riskLogic RiskFlagType (homepage ↔ contract-page parity)', () => {
+    // Compile-time: every FLAG_TYPES entry is a valid RiskFlagType. Runtime: the sets are equal.
+    const expected: RiskFlagType[] = [
+      'no_competition',
+      'eu_no_competition',
+      'high_markup',
+      'anomalies',
+    ];
+    expect(new Set<string>(FLAG_TYPES)).toEqual(new Set<string>(expected));
+  });
+});
+
 describe('contractListFilters', () => {
   it('parses the bids filter the HTML list and CSV export must share (issue #138)', () => {
     const sp = new URLSearchParams('bids=1&year=2025&authority=123');
diff --git a/apps/web/app/lib/filters.ts b/apps/web/app/lib/filters.ts
index 6e5d621b..1269e97c 100644
--- a/apps/web/app/lib/filters.ts
+++ b/apps/web/app/lib/filters.ts
@@ -4,7 +4,13 @@
 
 import { CPV_CATEGORIES, CPV_SECTORS, categoryForDivision } from '@sigma/config';
 import type { EntityKind } from '@sigma/api-contract';
-import { normalizeAuthoritySort, normalizeCompanySort, normalizeContractSort } from '@sigma/db';
+import {
+  AUTHORITY_TYPE_GROUPS,
+  FLAG_TYPES,
+  normalizeAuthoritySort,
+  normalizeCompanySort,
+  normalizeContractSort,
+} from '@sigma/db';
 import type { CpvCategory } from '@sigma/config';
 import type { FilterCategory, FilterGroup, FilterOption } from '../components/FilterRail';
 import { CANONICAL_QUERY_PARAMS, INTENTIONALLY_UNKEYED } from './query-params';
@@ -13,6 +19,12 @@ export const PAGE_SIZE = { contracts: 15, companies: 25, authorities: 25 } as co
 export const MAX_MULTI_VALUES = 50;
 
 const KNOWN_SECTORS = new Set(CPV_SECTORS.map((s) => s.code));
+// Risk-signal tokens accepted on ?flag= (#218): each FlagType plus `all` (any signal).
+const KNOWN_FLAGS = new Set<string>([...FLAG_TYPES, 'all']);
+// Authority type_group buckets accepted on ?type=. Bounding this is a cache-cardinality / DoS guard:
+// unlike /authorities (rate-limited aggregation page), /contracts is not, so an unvalidated ?type=
+// would let each distinct value mint a fresh edge-cache key AND an uncached full-table scan (#218 review).
+const KNOWN_TYPES = new Set<string>(AUTHORITY_TYPE_GROUPS);
 
 function allowedMulti(key: string, value: string): boolean {
   if (key === 'sector') return KNOWN_SECTORS.has(value);
@@ -51,6 +63,11 @@ export function contractListFilters(sp: URLSearchParams) {
     bidder: sp.get('bidder'),
     q: sp.get('q'),
     bids: (sp.get('bids') === '1' ? 'one' : null) as 'one' | null,
+    flags: getMulti(sp, 'flag').filter((v) => KNOWN_FLAGS.has(v)),
+    // Validate against the closed bucket set: unlike /authorities (a rate-limited aggregation page),
+    // /contracts is not rate-limited, so an unvalidated ?type= would let each distinct value mint a
+    // fresh edge-cache key AND an uncached full-table scan (cache-cardinality / DoS guard, #218 review).
+    authorityTypes: getMulti(sp, 'type').filter((v) => KNOWN_TYPES.has(v)),
   };
 }
 
@@ -191,6 +208,7 @@ export const PARAM_ORDER = [
   'eu',
   'bids', // /contracts single-bid filter
   'value',
+  'flag',
   'authority',
   'bidder',
   'center', // /network focus entity
diff --git a/apps/web/app/lib/query-params.ts b/apps/web/app/lib/query-params.ts
index e7b603a3..9827f598 100644
--- a/apps/web/app/lib/query-params.ts
+++ b/apps/web/app/lib/query-params.ts
@@ -9,6 +9,7 @@ export const CANONICAL_QUERY_PARAMS = new Set([
   'count',
   'cursor',
   'eu',
+  'flag', // /contracts: risk-signal filter (#218) — changes the result set + headline totals
   'funding',
   'g',
   'kind',
diff --git a/apps/web/app/routes/conflicts.loaders.test.ts b/apps/web/app/routes/conflicts.loaders.test.ts
index a2bf72c0..4aa191b6 100644
--- a/apps/web/app/routes/conflicts.loaders.test.ts
+++ b/apps/web/app/routes/conflicts.loaders.test.ts
@@ -17,7 +17,19 @@ const q = vi.hoisted(() => ({
   // DB is the identity sentinel the query mocks assert on, so getDb just returns env.DB unchanged.
   getDb: vi.fn((env: { DB: unknown }) => env.DB),
 }));
-vi.mock('@sigma/db', () => q);
+// `../lib/filters` (imported transitively by the conflicts loaders) builds its `?flag=`/`?type=` allow-lists
+// from `[...FLAG_TYPES]` and `AUTHORITY_TYPE_GROUPS` at module load (#218), so the mock must carry those
+// non-fn constants or the import throws. Pull them from the real module (no drift) while keeping the query
+// functions mocked. Spread the real constants first, then `q`, so the mocked fns win. Added via the factory
+// (not `q`) so afterEach's mockReset loop over `q` stays fn-only.
+vi.mock('@sigma/db', async (importActual) => {
+  const actual = await importActual<typeof import('@sigma/db')>();
+  return {
+    FLAG_TYPES: actual.FLAG_TYPES,
+    AUTHORITY_TYPE_GROUPS: actual.AUTHORITY_TYPE_GROUPS,
+    ...q,
+  };
+});
 
 import { loader as leaderboardLoader } from './conflicts';
 import { loader as officialLoader } from './conflict.official';
diff --git a/apps/web/app/routes/contracts.tsx b/apps/web/app/routes/contracts.tsx
index 5f7d8a06..da68e339 100644
--- a/apps/web/app/routes/contracts.tsx
+++ b/apps/web/app/routes/contracts.tsx
@@ -29,14 +29,21 @@ const VALUE_BUCKETS = [
   { value: 'gt100m', label: 'Над 100 млн. €' },
 ];
 
-export function meta({ matches }: Route.MetaArgs) {
-  return seoMeta({
+export function meta({ matches, location }: Route.MetaArgs) {
+  const tags = seoMeta({
     matches,
     path: '/contracts',
     title: 'Договори — СИГМА',
     description:
       'Всеки сключен договор по обществена поръчка. Филтрите са в адреса, има и сваляне в CSV.',
   });
+  // GDPR/ЗЗЛД (#218 review): a risk-signal-filtered list (?flag=…) can surface named natural persons
+  // (sole-trader ЕТ) under a „сигнали за риск" heading. Keep such views out of search indexes, mirroring
+  // the noindex on sole-trader company profiles (company.tsx). The unfiltered /contracts stays indexable.
+  if (new URLSearchParams(location.search).has('flag')) {
+    tags.push({ name: 'robots', content: 'noindex' });
+  }
+  return tags;
 }
 
 export function headers() {
diff --git a/apps/web/app/routes/home.tsx b/apps/web/app/routes/home.tsx
index 3a160a0f..9324cac3 100644
--- a/apps/web/app/routes/home.tsx
+++ b/apps/web/app/routes/home.tsx
@@ -3,6 +3,7 @@ import { count, date, moneyBare } from '@sigma/shared';
 import { getHomeData, getDb } from '@sigma/db';
 import type { ContractListItem } from '@sigma/api-contract';
 import type { Route } from './+types/home';
+import type { RiskFlagType } from '../lib/riskLogic';
 import { PageHeader } from '../components/PageHeader';
 import { SmartSearch } from '../components/SmartSearch';
 import { TotalsStrip } from '../components/TotalsStrip';
@@ -33,13 +34,21 @@ export async function loader({ context }: Route.LoaderArgs) {
   return getHomeData(getDb(env));
 }
 
-function SingleOfferTable({ items, allHref }: { items: ContractListItem[]; allHref: string }) {
+function SingleOfferTable({
+  items,
+  allHref,
+  caption = 'Поръчки с една оферта',
+}: {
+  items: ContractListItem[];
+  allHref: string;
+  caption?: string;
+}) {
   if (items.length === 0) return <p className="small muted">Няма данни за този изглед.</p>;
   return (
     <>
       <div className="table-wrap tbl-cards">
         <table>
-          <caption className="sr-only">Поръчки с една оферта</caption>
+          <caption className="sr-only">{caption}</caption>
           <thead>
             <tr>
               <th scope="col">Дата</th>
@@ -79,9 +88,21 @@ function SingleOfferTable({ items, allHref }: { items: ContractListItem[]; allHr
   );
 }
 
+// Bulgarian labels for the risk-signal types. `satisfies Record<RiskFlagType, string>` makes TypeScript
+// enforce that every signal type has a label (and none is misspelled) — a renamed/added RiskFlagType now
+// fails the build here instead of silently falling through to the raw key at runtime (#236 review).
+const FLAG_LABELS = {
+  no_competition: 'Липса на конкуренция',
+  eu_no_competition: 'Липса на конкуренция (със средства от ЕС)',
+  high_markup: 'Ръст на стойността чрез анекси',
+  anomalies: 'Стойностна или времева аномалия',
+} satisfies Record<RiskFlagType, string>;
+
 export default function Home({ loaderData }: Route.ComponentProps) {
   const {
     totals,
+    flagged,
+    topFlagged,
     topCompanies,
     topMinistries,
     topMunicipalities,
@@ -129,6 +150,89 @@ export default function Home({ loaderData }: Route.ComponentProps) {
         {totals.asOf ? `, последен договор ${date(totals.asOf)}` : ''}.
       </p>
 
+      <section className="section flagged" aria-labelledby="flagged">
+        <h2 id="flagged">
+          Договори със <em>сигнали за риск</em>
+        </h2>
+        <p className="section-hint">
+          Обща стойност на договорите, при които СИГМА отбелязва поне един структурен сигнал — липса
+          на конкуренция, ръст на стойността чрез анекси или стойностна/времева аномалия. Сигналите
+          са ориентири за преглед, не присъда. <Link to="/methodology#flagged">Как ги четем →</Link>
+          {' · '}
+          <Link to="/methodology#contact">Смятате сигнал за грешен? →</Link>
+        </p>
+
+        <SingleOfferPortion
+          valueEur={flagged.totalEur}
+          totalEur={totals.valueEur}
+          scopeLabel="на всички договори"
+        />
+
+        <div className="flagged-cols">
+          <div>
+            <h3 className="flagged-h3">По вид сигнал</h3>
+            <ul className="flagged-list">
+              {flagged.byType
+                .filter((r) => r.contracts > 0)
+                .map((r) => (
+                  <li key={r.type}>
+                    <Link to={`/contracts?flag=${r.type}&sort=value-desc`}>
+                      <span>{FLAG_LABELS[r.type as RiskFlagType] ?? r.type}</span>
+                      <span className="flagged-val">
+                        {moneyBare(r.eur)} € · {count(r.contracts)}
+                      </span>
+                    </Link>
+                  </li>
+                ))}
+            </ul>
+            <p className="small muted flagged-note">
+              Един договор може да носи няколко сигнала, затова редовете тук се застъпват и сборът
+              им надхвърля общата (де-дублирана) сума.
+            </p>
+          </div>
+
+          <div>
+            <h3 className="flagged-h3">По сектор</h3>
+            <ul className="flagged-list">
+              {flagged.bySector.map((s) => (
+                <li key={s.code}>
+                  <Link to={`/contracts?flag=all&sector=${s.code}&sort=value-desc`}>
+                    <span>{s.label}</span>
+                    <span className="flagged-val">
+                      {moneyBare(s.eur)} € · {count(s.contracts)}
+                    </span>
+                  </Link>
+                </li>
+              ))}
+            </ul>
+          </div>
+
+          <div>
+            <h3 className="flagged-h3">По тип институция</h3>
+            <ul className="flagged-list">
+              {flagged.byAuthorityType.map((a) => (
+                <li key={a.typeGroup}>
+                  <Link
+                    to={`/contracts?flag=all&type=${encodeURIComponent(a.typeGroup)}&sort=value-desc`}
+                  >
+                    <span>{a.typeGroup}</span>
+                    <span className="flagged-val">
+                      {moneyBare(a.eur)} € · {count(a.contracts)}
+                    </span>
+                  </Link>
+                </li>
+              ))}
+            </ul>
+          </div>
+        </div>
+
+        <SingleOfferTable
+          items={topFlagged}
+          caption="Договори с най-висока стойност със сигнали за риск"
+          allHref="/contracts?flag=all&sort=value-desc"
+        />
+      </section>
+
       <section className="section" aria-labelledby="find-yours">
         <h2 id="find-yours">
           Най-активните <em>институции</em>
diff --git a/apps/web/app/routes/methodology.tsx b/apps/web/app/routes/methodology.tsx
index 7d5cd791..5c3807ba 100644
--- a/apps/web/app/routes/methodology.tsx
+++ b/apps/web/app/routes/methodology.tsx
@@ -509,9 +509,10 @@ export default function Methodology({ loaderData }: Route.ComponentProps) {
                 </table>
               </div>
               <p className="small muted mt-s3">
-                <strong>Място на изпълнение</strong>, <strong>собственици и свързани лица</strong> и{' '}
-                <strong>рискови сигнали</strong> са в процес на разработка за следваща версия —
-                изискват пълно сливане с допълнителни източници и отделен аналитичен слой.
+                <strong>Място на изпълнение</strong> и <strong>собственици и свързани лица</strong>{' '}
+                са в процес на разработка за следваща версия — изискват пълно сливане с допълнителни
+                източници и отделен аналитичен слой. Първите структурни сигнали за риск вече са
+                налични — виж <a href="#flagged">§10</a>.
               </p>
             </section>
 
@@ -536,10 +537,12 @@ export default function Methodology({ loaderData }: Route.ComponentProps) {
             <section className="section" aria-labelledby="flagged">
               <h2 id="flagged">10. Сигнали за риск</h2>
               <p>
-                На страницата на всеки договор СИГМА отбелязва{' '}
-                <strong>структурни сигнали за риск</strong>, когато поне един признак заслужава
-                преглед. Сигналите са <em>ориентири</em>, не присъда: те не твърдят нарушение, а
-                насочват към договори, които си струва да се погледнат по-внимателно.
+                На началната страница СИГМА показва{' '}
+                <strong>общата стойност на договорите със сигнали за риск</strong> — договори, при
+                които поне един структурен признак заслужава преглед. Същите сигнали се отбелязват и
+                на страницата на всеки договор. Сигналите са <em>ориентири</em>, не присъда: те не
+                твърдят нарушение, а насочват към договори, които си струва да се погледнат
+                по-внимателно. Всяко число води до самите договори.
               </p>
               <p>Отбелязваме четири признака:</p>
               <dl className="glossary">
@@ -577,6 +580,18 @@ export default function Methodology({ loaderData }: Route.ComponentProps) {
                   <span className="src">→ value_flag / date_flag</span>
                 </dd>
               </dl>
+              <Callout title="Как се смята сумата">
+                <p className="m-0">
+                  Общата сума е <strong>де-дублирана</strong> — договор с няколко сигнала се брои
+                  веднъж. Разбивката „по вид сигнал" обаче се <em>застъпва</em> (един договор може
+                  да попадне в няколко реда), затова сборът ѝ надхвърля общата сума. Разбивките по
+                  сектор (първите шест) и по тип институция показват къде се концентрира рискът; те
+                  не сумират непременно до общата сума — договори без известен сектор или тип
+                  институция остават извън тях. Стойностите стъпват на каноничната изчистена
+                  стойност в евро (сумираме само договорите с достоверна стойност — договор с
+                  непотвърдена стойност се брои в бройката, но с 0 €).
+                </p>
+              </Callout>
               <p>
                 <strong>Ограничения.</strong> Сигналите стъпват на публични данни и структурни
                 признаци, не на разследване. Възможни са грешки или празнини в източника (виж{' '}
diff --git a/apps/web/app/routes/privacy.tsx b/apps/web/app/routes/privacy.tsx
index 9e1a6788..eae71f81 100644
--- a/apps/web/app/routes/privacy.tsx
+++ b/apps/web/app/routes/privacy.tsx
@@ -82,6 +82,24 @@ export default function Privacy({ loaderData }: Route.ComponentProps) {
           </p>
         </section>
 
+        <section className="section" aria-labelledby="derived">
+          <h2 id="derived">Производни показатели (сигнали за риск)</h2>
+          <p>
+            Освен публикуваните полета СИГМА изчислява <strong>структурни сигнали за риск</strong>{' '}
+            върху вече публичните данни — например липса на конкуренция, ръст на стойността чрез
+            анекси или стойностна/времева аномалия — и показва обобщена стойност на договорите с
+            поне един такъв сигнал.
+          </p>
+          <p>
+            Тези сигнали са <em>ориентири за преглед, а не констатация за нарушение</em>, и не
+            оценяват поведението на конкретно лице. Логиката е публична и възпроизводима — виж{' '}
+            <a href="/methodology#flagged">методологията</a>. Обработването се основава на същите
+            правни основания по-горе (чл. 6, пар. 1, букви (e) и (f) от GDPR) и не създава нови
+            категории лични данни. Ако смятате конкретен сигнал за неточен, важат правото на
+            коригиране (чл. 16) и на възражение (чл. 21) — вижте по-долу.
+          </p>
+        </section>
+
         <section className="section" aria-labelledby="rights">
           <h2 id="rights">Права на субектите на данни</h2>
           <p>
diff --git a/apps/web/app/styles/home.css b/apps/web/app/styles/home.css
index 6f2777ec..341016a8 100644
--- a/apps/web/app/styles/home.css
+++ b/apps/web/app/styles/home.css
@@ -183,3 +183,50 @@
   font-size: 12px;
   white-space: nowrap;
 }
+
+/* Flagged-value section (#218): a SingleOfferPortion bar + three drill-down breakdown columns + a
+   top-flagged contracts table (SingleOfferTable). Only the breakdown columns need custom styling. */
+.flagged-cols {
+  margin-block: var(--s-5);
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(230px, 1fr));
+  gap: var(--s-5) var(--s-7);
+}
+.flagged-h3 {
+  font: 500 10.5px/1 var(--font-mono);
+  letter-spacing: 0.14em;
+  text-transform: uppercase;
+  color: var(--ink-mid);
+  margin: 0 0 var(--s-2);
+  padding-bottom: var(--s-2);
+  border-bottom: 1px solid var(--ink);
+}
+.flagged-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+.flagged-list a {
+  display: flex;
+  justify-content: space-between;
+  align-items: baseline;
+  gap: var(--s-3);
+  padding: var(--s-3) 0;
+  border-bottom: 1px solid var(--rule-soft);
+  font: 14px/1.35 var(--font-sans);
+  text-decoration: none;
+  color: var(--ink);
+}
+.flagged-list a:hover {
+  color: var(--accent);
+}
+.flagged-val {
+  color: var(--ink-soft);
+  font-family: var(--font-mono);
+  font-variant-numeric: tabular-nums;
+  font-size: 12px;
+  white-space: nowrap;
+}
+.flagged-note {
+  margin-top: var(--s-3);
+}
diff --git a/packages/api-contract/src/index.ts b/packages/api-contract/src/index.ts
index d1d9f709..5f27feb5 100644
--- a/packages/api-contract/src/index.ts
+++ b/packages/api-contract/src/index.ts
@@ -53,8 +53,22 @@ export interface HomeTotals {
   refreshedAt: string;
 }
 
+/** Homepage flagged-value summary (issue #218). `totalEur` is de-duplicated (a contract with several
+ *  signals counts once); `byType` slices overlap; `bySector`/`byAuthorityType` partition the flagged set. */
+export interface FlaggedValue {
+  totalEur: number;
+  contracts: number;
+  byType: { type: string; eur: number; contracts: number }[];
+  bySector: { code: string; label: string; eur: number; contracts: number }[];
+  byAuthorityType: { typeGroup: string; eur: number; contracts: number }[];
+}
+
 export interface HomeData {
   totals: HomeTotals;
+  /** Total € running through contracts with a risk signal, + breakdowns (issue #218). */
+  flagged: FlaggedValue;
+  /** Top flagged contracts by value — for the homepage table (issue #218). */
+  topFlagged: ContractListItem[];
   topCompanies: CompanyListItem[];
   topMinistries: AuthorityListItem[];
   topMunicipalities: AuthorityListItem[];
diff --git a/packages/db/src/queries/contracts.ts b/packages/db/src/queries/contracts.ts
index 4bbb7020..c9a6699a 100644
--- a/packages/db/src/queries/contracts.ts
+++ b/packages/db/src/queries/contracts.ts
@@ -6,6 +6,7 @@ import { CPV_SECTORS, PROCEDURE_GROUPS, procedureGroup } from '@sigma/config';
 import { cleanName, entityName } from '@sigma/shared';
 import { csvCell } from './csv';
 import { assertCovers } from './filter-guard';
+import { flagPredicate } from './flagged';
 import {
   authoritySlug,
   bareContractId,
@@ -30,6 +31,12 @@ export interface ContractListParams {
   bidder?: string | null; // bidder slug
   q?: string | null;
   bids?: 'one' | null;
+  flags?: string[]; // risk-signal tokens (#218): a FlagType or `all`; OR-combined
+  authorityTypes?: string[]; // authority `type_group` buckets (#218 breakdown drill-down, `?type=`)
+  // Server-internal (not a user-facing filter, so absent from CONTRACT_FILTER_KEYS / the cache signature):
+  // drop natural-person (sole-trader ЕТ) bidders at SQL level. Set only by the flagged homepage table so an
+  // identifiable individual never appears under a „сигнали за риск" label on that indexed page (#236 review).
+  excludeNaturalPersons?: boolean;
   cursor?: string | null;
   pageSize?: number;
 }
@@ -44,6 +51,8 @@ export const CONTRACT_FILTER_KEYS = [
   'bidder',
   'q',
   'bids',
+  'flags',
+  'authorityTypes',
 ] as const satisfies readonly (keyof ContractListParams)[];
 
 // Compile-time completeness guard (issue #138 bug class) — see filter-guard.ts. If this line
@@ -116,6 +125,35 @@ const FROM = `
   JOIN authorities a ON a.id = t.authority_id
   JOIN bidders b ON b.id = c.bidder_id`;
 
+// A bidder that is a natural person (sole trader / ЕТ). Two independent signals, OR-combined:
+//   • name prefix — the АОП convention records sole traders as "ЕТ <name>" (the only populated signal in
+//     the current data, where `legal_form` is largely NULL); mirrors `isNaturalPersonProfileName`.
+//   • legal form — the registry `legal_form` code where present (ЕТ / ЕДНОЛИЧЕН ТЪРГОВЕЦ / SOLE TRADER /
+//     INDIVIDUAL); mirrors `isSingleNaturalPersonProfile`. Hardens prod, where the field is populated.
+// Consortiums are never a single natural person.
+//
+// Case handling (#236 review): `bidders.name` keeps the raw source case (normalize-raw.sql stores
+// MIN(contractor_name); only the bidder *id* is uppercased), and SQLite `LIKE`/`UPPER` fold case for
+// ASCII only — a lowercased Cyrillic „ет " would slip past `LIKE 'ЕТ %'`. So the name prefix is matched
+// with a GLOB character class that spells out both cases of both scripts (`[ЕеEe][ТтTt]`), independent
+// of any ETL uppercasing. The trailing space is required, so „ЕТАЖ…"/„ETO…" (no space) don't false-match.
+// The `legal_form` tokens stay literal — they are a controlled uppercase registry vocabulary, not free text.
+// Used at SQL level (pre-LIMIT) so the flagged homepage never surfaces an identifiable individual under a
+// „сигнали за риск" label (GDPR/ЗЗЛД — mirrors the noindex on sole-trader company profiles). Residual,
+// accepted limitation: a sole trader whose name carries no „ЕТ " marker AND has a NULL legal_form is not
+// detectable here without Trade-Register data — documented, out of scope for this predicate.
+const NATURAL_PERSON_BIDDER_SQL = `(
+  b.kind <> 'consortium' AND (
+    TRIM(b.name) GLOB '[ЕеEe][ТтTt] *'
+    OR (b.legal_form IS NOT NULL AND (
+      TRIM(b.legal_form) IN ('ЕТ', 'ET')
+      OR b.legal_form LIKE '%ЕДНОЛИЧЕН ТЪРГОВЕЦ%'
+      OR b.legal_form LIKE '%SOLE TRADER%'
+      OR b.legal_form LIKE '%INDIVIDUAL%'
+    ))
+  )
+)`;
+
 /**
  * Build the WHERE fragment (with a leading ' WHERE ') + params shared by list, summary and CSV.
  * Keep consumed filter keys in sync with CONTRACT_FILTER_KEYS and contractFilterSignature().
@@ -184,6 +222,20 @@ function buildFilters(p: ContractListParams): { sql: string; params: unknown[] }
     );
     params.push(match);
   }
+  if (p.flags?.length) {
+    // Risk-signal filter (#218): OR the requested flag predicates. An unrecognised token yields no
+    // predicate; if none are valid the filter matches nothing (rather than silently showing all).
+    const preds = p.flags
+      .map(flagPredicate)
+      .filter((x): x is string => x != null)
+      .map((x) => `(${x})`);
+    where.push(preds.length ? `(${preds.join(' OR ')})` : '1=0');
+  }
+  if (p.authorityTypes?.length) {
+    where.push(`a.type_group IN (${qs(p.authorityTypes.length)})`);
+    params.push(...p.authorityTypes);
+  }
+  if (p.excludeNaturalPersons) where.push(`NOT ${NATURAL_PERSON_BIDDER_SQL}`);
   return { sql: where.length ? ' WHERE ' + where.join(' AND ') : '', params };
 }
 
@@ -199,6 +251,8 @@ function contractFilterSignature(p: ContractListParams): string {
     bidder,
     q: searchMatchQuery(p.q ?? ''),
     bids: p.bids ?? null,
+    flags: p.flags?.length ? [...p.flags].sort() : null,
+    authorityTypes: p.authorityTypes?.length ? [...p.authorityTypes].sort() : null,
   } satisfies Record<(typeof CONTRACT_FILTER_KEYS)[number], unknown>;
   return filterSignature(filters);
 }
diff --git a/packages/db/src/queries/filter-guard.ts b/packages/db/src/queries/filter-guard.ts
index 14731953..28b6c159 100644
--- a/packages/db/src/queries/filter-guard.ts
+++ b/packages/db/src/queries/filter-guard.ts
@@ -16,8 +16,14 @@
 //   export const FOO_FILTER_KEYS = [...] as const satisfies readonly (keyof FooListParams)[];
 //   assertCovers<FooListParams, typeof FOO_FILTER_KEYS>();
 
-/** Param fields that are route/pagination state, never row filters. */
-type NonFilterField = 'sort' | 'cursor' | 'pageSize';
+/**
+ * Param fields exempt from the FILTER_KEYS coverage requirement: route/pagination state (`sort`,
+ * `cursor`, `pageSize`) plus server-internal row filters that are never derived from the request URL.
+ * `excludeNaturalPersons` is set only server-side (the flagged homepage table), so it must NOT enter a
+ * `*_FILTER_KEYS` array — it is absent from the URL parser, the CSV classifier and the cache signature by
+ * design. If it is ever exposed as a URL param, move it into the FILTER_KEYS array instead.
+ */
+type NonFilterField = 'sort' | 'cursor' | 'pageSize' | 'excludeNaturalPersons';
 
 /**
  * Compiles only when `Keys` covers every filter field of `Params` (all fields except
diff --git a/packages/db/src/queries/flagged.test.ts b/packages/db/src/queries/flagged.test.ts
new file mode 100644
index 00000000..2389622d
--- /dev/null
+++ b/packages/db/src/queries/flagged.test.ts
@@ -0,0 +1,294 @@
+/// <reference types="node" />
+import { DatabaseSync } from 'node:sqlite';
+import { readFileSync, readdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { afterEach, describe, expect, it } from 'vitest';
+import { getFlaggedValue } from './flagged';
+import { listContracts } from './contracts';
+import { AUTHORITY_TYPE_GROUPS } from './rows';
+
+// Integration test against a REAL SQLite built from the production migrations (node:sqlite), so the
+// flag predicates and aggregate are proven to narrow/sum actual rows — the fake-D1 unit tests ignore
+// WHERE clauses. Fixture exercises: de-duplicated total, overlapping by-type, category sums-to-total,
+// and the amount_eur NULL basis (value_suspect contributes to the count but €0).
+const migrationsDir = resolve(dirname(fileURLToPath(import.meta.url)), '../../migrations');
+const migrations = readdirSync(migrationsDir)
+  .filter((f) => f.endsWith('.sql'))
+  .sort();
+
+// c1 no_competition (община, sector 45, 1000) · c2 eu_no_competition (министерство, 72, 2000)
+// c3 high_markup (община, 45, 1500) · c4 anomalies via value_suspect (министерство, 72, amount NULL)
+// c5 OVERLAP no_competition + high_markup (община, 45, 2000) · c6 clean, unflagged (5000)
+const FIXTURE = `
+INSERT INTO authorities (id, name, bulstat, type_group) VALUES
+  ('auth:obshtina', 'Община', '100000001', 'община'),
+  ('auth:min', 'Министерство', '100000002', 'министерство'),
+  ('auth:none', 'Без тип', '100000003', NULL);
+INSERT INTO bidders (id, name, bulstat, eik_normalized, eik_valid, kind) VALUES
+  ('eik:200000001', 'Фирма', '200000001', '200000001', 1, 'company');
+INSERT INTO tenders (id, source_id, title, authority_id, cpv_code, procedure_type, status) VALUES
+  ('t:o45', 'UNP-1', 'Строеж', 'auth:obshtina', '45000000', 'открита процедура', 'awarded'),
+  ('t:m72', 'UNP-2', 'ИТ', 'auth:min', '72000000', 'открита процедура', 'awarded'),
+  ('t:nocpv', 'UNP-3', 'Без CPV', 'auth:none', NULL, 'открита процедура', 'awarded');
+INSERT INTO contracts
+  (id, tender_id, bidder_id, amount, currency, signed_at, bids_received, bids_rejected, eu_funded,
+   value_flag, date_flag, signing_value_eur, current_value_eur, amount_eur) VALUES
+  ('c1', 't:o45', 'eik:200000001', 1000, 'EUR', '2024-01-01', 1, 0, 0, 'ok', 'ok', 1000, 1000, 1000),
+  ('c2', 't:m72', 'eik:200000001', 2000, 'EUR', '2024-01-02', 1, 0, 1, 'ok', 'ok', 2000, 2000, 2000),
+  ('c3', 't:o45', 'eik:200000001', 1500, 'EUR', '2024-01-03', 3, 0, 0, 'ok', 'ok', 1000, 1500, 1500),
+  ('c4', 't:m72', 'eik:200000001', 9000, 'EUR', '2024-01-04', 3, 0, 0, 'value_suspect', 'ok', NULL, NULL, NULL),
+  ('c5', 't:o45', 'eik:200000001', 2000, 'EUR', '2024-01-05', 1, 0, 0, 'ok', 'ok', 1000, 2000, 2000),
+  ('c6', 't:m72', 'eik:200000001', 5000, 'EUR', '2024-01-06', 3, 0, 0, 'ok', 'ok', 5000, 5000, 5000),
+  -- c7: flagged (no_competition) but on a tender with NULL cpv + authority with NULL type_group,
+  -- so it lands in the total/count but in NEITHER the bySector nor byAuthorityType breakdown.
+  ('c7', 't:nocpv', 'eik:200000001', 500, 'EUR', '2024-01-07', 1, 0, 0, 'ok', 'ok', 500, 500, 500),
+  -- c8: NEGATIVE signing base. Under the old (signing <> 0) guard the markup test passes, so it would
+  -- wrongly count as high_markup; riskLogic (deltaPct = -1) never badges it. With (signing > 0) it is
+  -- UNflagged (bids=3 → no single-offer, value_flag ok → no anomaly), so it stays out of every slice (#236).
+  ('c8', 't:o45', 'eik:200000001', 800, 'EUR', '2024-01-08', 3, 0, 0, 'ok', 'ok', -1000, 0, 800);
+`;
+
+function d1(db: DatabaseSync): D1Database {
+  return {
+    prepare(sql: string) {
+      let bound: (string | number | null)[] = [];
+      const stmt = {
+        bind(...params: (string | number | null)[]) {
+          bound = params;
+          return stmt;
+        },
+        async all<T>() {
+          return { results: db.prepare(sql).all(...bound) as T[] };
+        },
+        async first<T>() {
+          return (db.prepare(sql).get(...bound) ?? null) as T | null;
+        },
+      };
+      return stmt;
+    },
+  } as unknown as D1Database;
+}
+
+let open: DatabaseSync | null = null;
+function realDb(): D1Database {
+  const db = new DatabaseSync(':memory:');
+  for (const m of migrations) db.exec(readFileSync(resolve(migrationsDir, m), 'utf8'));
+  db.exec(FIXTURE);
+  open = db;
+  return d1(db);
+}
+afterEach(() => {
+  open?.close();
+  open = null;
+});
+
+const byType = (f: Awaited<ReturnType<typeof getFlaggedValue>>, t: string) =>
+  f.byType.find((r) => r.type === t)!;
+
+describe('getFlaggedValue', () => {
+  it('de-duplicates the total (a contract with two signals counts once)', async () => {
+    const f = await getFlaggedValue(realDb());
+    // c1..c5 + c7 flagged (c6 clean). c4 is value_suspect → NULL amount_eur → counted, €0.
+    expect(f.contracts).toBe(6);
+    expect(f.totalEur).toBe(7000); // 1000 + 2000 + 1500 + 0 + 2000 + 500
+  });
+
+  it('excludes a negative signing-value base from high_markup (parity with riskLogic > 0)', async () => {
+    const f = await getFlaggedValue(realDb());
+    // c8 (signing -1000) would satisfy the old `<> 0` guard but riskLogic shows no badge for a negative
+    // base, so it must be excluded here too — high_markup stays c3 + c5 only.
+    expect(byType(f, 'high_markup')).toMatchObject({ eur: 3500, contracts: 2 });
+    const r = await listContracts(realDb(), { flags: ['high_markup'], pageSize: 10 });
+    expect(r.total).toBe(2); // c3, c5 — not c8
+  });
+
+  it('reports overlapping by-type slices (their sum exceeds the de-duplicated total)', async () => {
+    const f = await getFlaggedValue(realDb());
+    expect(byType(f, 'no_competition')).toMatchObject({ eur: 3500, contracts: 3 }); // c1 + c5 + c7
+    expect(byType(f, 'eu_no_competition')).toMatchObject({ eur: 2000, contracts: 1 }); // c2
+    expect(byType(f, 'high_markup')).toMatchObject({ eur: 3500, contracts: 2 }); // c3 + c5
+    expect(byType(f, 'anomalies')).toMatchObject({ eur: 0, contracts: 1 }); // c4 (NULL amount)
+    const sum = f.byType.reduce((n, r) => n + r.eur, 0);
+    expect(sum).toBe(9000);
+    expect(sum).toBeGreaterThan(f.totalEur); // c5 double-counted across two types
+  });
+
+  it('breaks down by sector as top slices that need NOT sum to the total', async () => {
+    const f = await getFlaggedValue(realDb());
+    const s45 = f.bySector.find((s) => s.code === '45')!;
+    const s72 = f.bySector.find((s) => s.code === '72')!;
+    expect(s45).toMatchObject({ eur: 4500, contracts: 3 }); // c1 + c3 + c5
+    expect(s72).toMatchObject({ eur: 2000, contracts: 2 }); // c2 + c4
+    // c7 has a NULL cpv_code → excluded from every sector slice, so the slices sum to LESS than total.
+    expect(f.bySector.reduce((n, s) => n + s.eur, 0)).toBe(6500);
+    expect(f.bySector.reduce((n, s) => n + s.eur, 0)).toBeLessThan(f.totalEur);
+  });
+
+  it('breaks down by authority type as slices that need NOT sum to the total', async () => {
+    const f = await getFlaggedValue(realDb());
+    const obshtina = f.byAuthorityType.find((a) => a.typeGroup === 'община')!;
+    const min = f.byAuthorityType.find((a) => a.typeGroup === 'министерство')!;
+    expect(obshtina).toMatchObject({ eur: 4500, contracts: 3 });
+    expect(min).toMatchObject({ eur: 2000, contracts: 2 });
+    // c7's authority has a NULL type_group → excluded, so the slices sum to LESS than total.
+    expect(f.byAuthorityType.reduce((n, a) => n + a.eur, 0)).toBeLessThan(f.totalEur);
+  });
+});
+
+describe('/contracts flag filter', () => {
+  it('flag=no_competition narrows to the single-offer rows (incl. the overlapping one)', async () => {
+    const r = await listContracts(realDb(), { flags: ['no_competition'], pageSize: 10 });
+    expect(r.total).toBe(3); // c1, c5, c7
+  });
+
+  it('flag=high_markup narrows to the cost-growth rows', async () => {
+    const r = await listContracts(realDb(), { flags: ['high_markup'], pageSize: 10 });
+    expect(r.total).toBe(2); // c3, c5
+  });
+
+  it('flag=all matches every flagged contract', async () => {
+    const r = await listContracts(realDb(), { flags: ['all'], pageSize: 10 });
+    expect(r.total).toBe(6); // c1..c5, c7 — not the clean c6
+  });
+
+  it('multiple flag tokens are OR-combined (union)', async () => {
+    const r = await listContracts(realDb(), {
+      flags: ['no_competition', 'anomalies'],
+      pageSize: 10,
+    });
+    expect(r.total).toBe(4); // c1, c5, c7 (no_competition) ∪ c4 (anomalies)
+  });
+
+  it('an unrecognised flag token matches nothing (not everything)', async () => {
+    const r = await listContracts(realDb(), { flags: ['bogus'], pageSize: 10 });
+    expect(r.total).toBe(0);
+  });
+
+  it('type= narrows to contracts of that authority type_group', async () => {
+    const r = await listContracts(realDb(), { authorityTypes: ['министерство'], pageSize: 10 });
+    expect(r.total).toBe(3); // c2, c4, c6 (all министерство tenders)
+  });
+
+  it('flag composes with sector/type instead of replacing them', async () => {
+    const r = await listContracts(realDb(), {
+      flags: ['all'],
+      authorityTypes: ['министерство'],
+      pageSize: 10,
+    });
+    expect(r.total).toBe(2); // министерство ∩ flagged = c2, c4
+  });
+});
+
+// PII (#236 review): the flagged homepage table must never surface an identifiable individual (sole trader
+// / ЕТ) under a „сигнали за риск" label. `excludeNaturalPersons` drops them in SQL, on two signals — the
+// „ЕТ " name convention (the only populated signal in current data) and the registry `legal_form` — so the
+// suppression does not hinge on the winner's name spelling alone.
+describe('excludeNaturalPersons — sole-trader (ЕТ) suppression', () => {
+  it('drops ЕТ bidders by name prefix and by legal_form, keeps ordinary companies', async () => {
+    const db = realDb();
+    open!.exec(`
+      INSERT INTO bidders (id, name, bulstat, eik_normalized, eik_valid, kind, legal_form) VALUES
+        ('eik:300000001', 'ЕТ ИВАН ПЕТРОВ', '300000001', '300000001', 1, 'company', NULL),
+        ('eik:300000002', 'ИВАН ГЕОРГИЕВ', '300000002', '300000002', 1, 'company', 'ЕДНОЛИЧЕН ТЪРГОВЕЦ');
+      INSERT INTO tenders (id, source_id, title, authority_id, cpv_code, procedure_type, status) VALUES
+        ('t:np1', 'UNP-NP1', 'Строеж', 'auth:obshtina', '45000000', 'открита процедура', 'awarded'),
+        ('t:np2', 'UNP-NP2', 'Строеж', 'auth:obshtina', '45000000', 'открита процедура', 'awarded');
+      INSERT INTO contracts
+        (id, tender_id, bidder_id, amount, currency, signed_at, bids_received, bids_rejected, eu_funded,
+         value_flag, date_flag, signing_value_eur, current_value_eur, amount_eur) VALUES
+        ('cnp1', 't:np1', 'eik:300000001', 9999, 'EUR', '2024-02-01', 1, 0, 0, 'ok', 'ok', 9999, 9999, 9999),
+        ('cnp2', 't:np2', 'eik:300000002', 9998, 'EUR', '2024-02-02', 1, 0, 0, 'ok', 'ok', 9998, 9998, 9998);
+    `);
+    // Both natural-person contracts are single-offer (flagged) and top-value → they would head a value-desc
+    // list; without the flag they show, with it they are gone while the ordinary company stays.
+    const withNP = await listContracts(db, { flags: ['all'], sort: 'value-desc', pageSize: 20 });
+    const withNPNames = withNP.items.map((c) => c.bidderName);
+    expect(withNPNames).toContain('ЕТ ИВАН ПЕТРОВ');
+    expect(withNPNames).toContain('ИВАН ГЕОРГИЕВ');
+
+    const clean = await listContracts(db, {
+      flags: ['all'],
+      sort: 'value-desc',
+      pageSize: 20,
+      excludeNaturalPersons: true,
+    });
+    const names = clean.items.map((c) => c.bidderName);
+    expect(names).not.toContain('ЕТ ИВАН ПЕТРОВ'); // dropped via the "ЕТ " name prefix
+    expect(names).not.toContain('ИВАН ГЕОРГИЕВ'); // dropped via the ЕДНОЛИЧЕН ТЪРГОВЕЦ legal_form
+    expect(names).toContain('Фирма'); // ordinary company still present
+  });
+
+  it('never drops a consortium (a consortium is not a single natural person)', async () => {
+    const db = realDb();
+    open!.exec(`
+      INSERT INTO bidders (id, name, bulstat, eik_normalized, eik_valid, kind, legal_form) VALUES
+        ('eik:300000003', 'ЕТ-ГРУП КОНСОРЦИУМ', '300000003', '300000003', 1, 'consortium', NULL);
+      INSERT INTO tenders (id, source_id, title, authority_id, cpv_code, procedure_type, status) VALUES
+        ('t:np3', 'UNP-NP3', 'Строеж', 'auth:obshtina', '45000000', 'открита процедура', 'awarded');
+      INSERT INTO contracts
+        (id, tender_id, bidder_id, amount, currency, signed_at, bids_received, bids_rejected, eu_funded,
+         value_flag, date_flag, signing_value_eur, current_value_eur, amount_eur) VALUES
+        ('cnp3', 't:np3', 'eik:300000003', 9997, 'EUR', '2024-02-03', 1, 0, 0, 'ok', 'ok', 9997, 9997, 9997);
+    `);
+    const clean = await listContracts(db, {
+      flags: ['all'],
+      sort: 'value-desc',
+      pageSize: 20,
+      excludeNaturalPersons: true,
+    });
+    // Its name starts with "ЕТ" but the kind guard keeps it — consortiums are legal entities, not people.
+    expect(clean.items.some((c) => c.bidderKind === 'consortium')).toBe(true);
+  });
+
+  it('drops a lowercase / mixed-case Cyrillic „ет " prefix (GLOB is case-robust, unlike ASCII LIKE)', async () => {
+    // `bidders.name` keeps the raw source case; SQLite LIKE/UPPER fold ASCII only, so a lowercased
+    // Cyrillic prefix must still be caught. Guards the GLOB '[ЕеEe][ТтTt] *' predicate (#236 review).
+    const db = realDb();
+    open!.exec(`
+      INSERT INTO bidders (id, name, bulstat, eik_normalized, eik_valid, kind, legal_form) VALUES
+        ('eik:300000004', 'ет иван петров', '300000004', '300000004', 1, 'company', NULL),
+        ('eik:300000005', 'Ет Мария Георгиева', '300000005', '300000005', 1, 'company', NULL);
+      INSERT INTO tenders (id, source_id, title, authority_id, cpv_code, procedure_type, status) VALUES
+        ('t:np4', 'UNP-NP4', 'Строеж', 'auth:obshtina', '45000000', 'открита процедура', 'awarded'),
+        ('t:np5', 'UNP-NP5', 'Строеж', 'auth:obshtina', '45000000', 'открита процедура', 'awarded');
+      INSERT INTO contracts
+        (id, tender_id, bidder_id, amount, currency, signed_at, bids_received, bids_rejected, eu_funded,
+         value_flag, date_flag, signing_value_eur, current_value_eur, amount_eur) VALUES
+        ('cnp4', 't:np4', 'eik:300000004', 9996, 'EUR', '2024-02-04', 1, 0, 0, 'ok', 'ok', 9996, 9996, 9996),
+        ('cnp5', 't:np5', 'eik:300000005', 9995, 'EUR', '2024-02-05', 1, 0, 0, 'ok', 'ok', 9995, 9995, 9995);
+    `);
+    const clean = await listContracts(db, {
+      flags: ['all'],
+      sort: 'value-desc',
+      pageSize: 20,
+      excludeNaturalPersons: true,
+    });
+    const names = clean.items.map((c) => c.bidderName);
+    expect(names).not.toContain('ет иван петров'); // lowercase Cyrillic prefix
+    expect(names).not.toContain('Ет Мария Георгиева'); // mixed-case Cyrillic prefix
+  });
+});
+
+// #236 review note: the homepage builds a `?type=<typeGroup>` link per byAuthorityType row, and /contracts
+// only honours canonical `type=` buckets. Guard the breakdown so a drifted DB type_group can never emit a
+// link the allow-list silently swallows (which would show ALL flagged contracts under a specific label).
+describe('byAuthorityType canonical-bucket guard', () => {
+  it('drops a drifted (non-canonical) type_group from the breakdown', async () => {
+    const db = realDb();
+    open!.exec(`
+      INSERT INTO authorities (id, name, bulstat, type_group) VALUES
+        ('auth:drift', 'Странна', '100000009', 'странна-кофа');
+      INSERT INTO tenders (id, source_id, title, authority_id, cpv_code, procedure_type, status) VALUES
+        ('t:drift', 'UNP-D', 'Строеж', 'auth:drift', '45000000', 'открита процедура', 'awarded');
+      INSERT INTO contracts
+        (id, tender_id, bidder_id, amount, currency, signed_at, bids_received, bids_rejected, eu_funded,
+         value_flag, date_flag, signing_value_eur, current_value_eur, amount_eur) VALUES
+        ('cdrift', 't:drift', 'eik:200000001', 7000, 'EUR', '2024-03-01', 1, 0, 0, 'ok', 'ok', 7000, 7000, 7000);
+    `);
+    const f = await getFlaggedValue(db);
+    // Every emitted bucket is one the /contracts ?type= allow-list will honour.
+    expect(f.byAuthorityType.every((a) => AUTHORITY_TYPE_GROUPS.includes(a.typeGroup))).toBe(true);
+    expect(f.byAuthorityType.map((a) => a.typeGroup)).not.toContain('странна-кофа');
+  });
+});
diff --git a/packages/db/src/queries/flagged.ts b/packages/db/src/queries/flagged.ts
new file mode 100644
index 00000000..cf974749
--- /dev/null
+++ b/packages/db/src/queries/flagged.ts
@@ -0,0 +1,166 @@
+// Flagged value (issue #218): the total € running through contracts that carry a risk signal, plus a
+// breakdown by signal type and by category. Computed LIVE over existing columns (no schema/precompute
+// change) — the caller edge-caches it for an hour, same basis as the single-offer scan in home.ts.
+//
+// The signal predicates mirror the per-contract RiskIndicators (apps/web/app/lib/riskLogic.ts) so the
+// homepage number stays consistent with the badge a visitor sees on a contract page. Keep FLAG_TYPES in
+// sync with riskLogic's RiskFlagType (asserted by flagged.test.ts). `c` is the `contracts` alias.
+
+import { CPV_SECTORS } from '@sigma/config';
+import type { FlaggedValue } from '@sigma/api-contract';
+import { AUTHORITY_TYPE_GROUPS } from './rows';
+
+// The homepage builds a `?type=<typeGroup>` drill-down link from each byAuthorityType row, and /contracts
+// only honours a `type=` token that is one of these canonical buckets (the same allow-list). Guard the
+// breakdown against the same set so a drifted DB `type_group` (outside the canonical buckets) can never
+// emit a link the allow-list silently swallows — which would show ALL flagged contracts under a specific
+// type label (a label↔result mismatch, #236 review note).
+const CANONICAL_TYPE_GROUPS = new Set(AUTHORITY_TYPE_GROUPS);
+
+// The "unconfirmed value" flags (mirrors details.ts value.suspect: value_suspect | annex_suspect |
+// review | value_low). Kept as a SQL list literal so the fragments read cleanly.
+const SUSPECT_VALUE_FLAGS = "('value_suspect', 'annex_suspect', 'review', 'value_low')";
+
+/** Per-signal SQL predicates — the single source of truth reused by the aggregate and the /contracts
+ *  `flag` filter. Each is a self-contained boolean over the `contracts c` row. */
+export const FLAG_SQL = {
+  // Admitted bids (received − rejected) == 1, without EU funding.
+  no_competition:
+    'c.bids_received IS NOT NULL AND (c.bids_received - COALESCE(c.bids_rejected, 0)) = 1 ' +
+    'AND (c.eu_funded IS NULL OR c.eu_funded = 0)',
+  // Same, but EU-funded (surfaced separately, like riskLogic).
+  eu_no_competition:
+    'c.bids_received IS NOT NULL AND (c.bids_received - COALESCE(c.bids_rejected, 0)) = 1 ' +
+    'AND c.eu_funded = 1',
+  // Current value grew > 20% over the signing value (annex-driven cost growth); non-suspect only, so a
+  // value anomaly isn't double-counted here (mirrors details.ts deltaPct, which is null when suspect).
+  // Guard `signing_value_eur > 0` (not just `<> 0`): riskLogic's badge fires on deltaPct = (current −
+  // signing)/signing > 0.2, which for a NEGATIVE base is NOT algebraically equal to
+  // (current − signing) > 0.2·signing — so `<> 0` would count a negative-base row here that the contract
+  // page never badges. `> 0` makes the aggregate and the per-contract badge provably identical (#236 review).
+  // `value_flag NOT IN (...)` is safe against a NULL-swallow (a NULL would make NOT IN yield NULL → the row
+  // would silently drop from high_markup): `value_flag` is `NOT NULL DEFAULT 'ok'` (0000_init.sql:126), so a
+  // non-suspect row always reads a concrete 'ok'-family value here, never NULL (#236 review).
+  high_markup:
+    `c.value_flag NOT IN ${SUSPECT_VALUE_FLAGS} AND c.signing_value_eur IS NOT NULL ` +
+    'AND c.signing_value_eur > 0 AND (c.current_value_eur - c.signing_value_eur) > 0.2 * c.signing_value_eur',
+  // Value or date anomaly.
+  anomalies: `c.date_flag = 'signed_after_publication' OR c.value_flag IN ${SUSPECT_VALUE_FLAGS}`,
+} as const;
+
+export type FlagType = keyof typeof FLAG_SQL;
+export const FLAG_TYPES = Object.keys(FLAG_SQL) as FlagType[];
+
+/** A contract is "flagged" when it carries at least one signal. Each predicate is parenthesised because
+ *  `anomalies` is itself an OR. */
+export const ANY_FLAG_SQL = FLAG_TYPES.map((t) => `(${FLAG_SQL[t]})`).join(' OR ');
+
+/** Map a filter token (a FlagType, or `all`) to a WHERE fragment. Unknown tokens → null (ignored). */
+export function flagPredicate(token: string): string | null {
+  if (token === 'all') return ANY_FLAG_SQL;
+  return token in FLAG_SQL ? FLAG_SQL[token as FlagType] : null;
+}
+
+const SECTOR_LABEL = new Map(CPV_SECTORS.map((s) => [s.code, s.short ?? s.label]));
+
+const FROM = `FROM contracts c
+  JOIN tenders t ON t.id = c.tender_id
+  JOIN authorities a ON a.id = t.authority_id`;
+
+interface TotalRow {
+  total_eur: number;
+  total_contracts: number;
+  [k: string]: number;
+}
+interface SectorRow {
+  code: string | null;
+  eur: number;
+  contracts: number;
+}
+interface AuthTypeRow {
+  type_group: string | null;
+  eur: number;
+  contracts: number;
+}
+
+/**
+ * Homepage flagged-value summary. Money (€) sums only trustworthy figures — `SUM(amount_eur)` skips the
+ * NULLs the ETL leaves on unrecoverable `value_suspect` rows (canonical basis, #98) — while the CONTRACT
+ * tally counts every flagged row, so a value-suspect contract is counted but contributes €0. The `byType`
+ * slices OVERLAP (a contract can be both single-offer and cost-growth), so they sum to more than the
+ * de-duplicated total. `bySector` (top 6) and `byAuthorityType` are TOP slices that need not sum to the
+ * total: flagged rows with a NULL `cpv_code`/`type_group` are excluded, `bySector` is capped at 6, and
+ * `byAuthorityType` keeps only canonical buckets (see CANONICAL_TYPE_GROUPS).
+ *
+ * Cost (#236 review): the flag predicates are computed expressions (arithmetic on bids/values, membership
+ * on the flag columns), so no index turns these into a lookup — they are full aggregate scans of
+ * `contracts` by design, the same shape as the pre-existing single-offer scan in home.ts. There are three
+ * here (total+byType fold into ONE scan; bySector and byAuthorityType add one each with a covered JOIN via
+ * idx_contracts_tender / idx_tenders_authority), plus the LIMIT-10 flagged list in home.ts — four scans of
+ * a bounded corpus. That stays well inside D1's per-query rows-read ceiling and the D1_ROWS_READ_BUDGET
+ * DoW guard (a few × corpus rows), and the whole homepage response is edge-cached for 1h, so the scans run
+ * only on a cold cache. If the corpus grows an order of magnitude, precompute these into a summary table
+ * (the deliberately-avoided schema change) rather than widening the live scan.
+ */
+export async function getFlaggedValue(db: D1Database): Promise<FlaggedValue> {
+  const typeCols = FLAG_TYPES.flatMap((t) => [
+    `COALESCE(SUM(CASE WHEN (${FLAG_SQL[t]}) THEN c.amount_eur END), 0) AS ${t}_eur`,
+    `COUNT(CASE WHEN (${FLAG_SQL[t]}) THEN 1 END) AS ${t}_n`,
+  ]);
+
+  const [totalRow, sectors, authTypes] = await Promise.all([
+    db
+      .prepare(
+        `SELECT
+           COALESCE(SUM(CASE WHEN (${ANY_FLAG_SQL}) THEN c.amount_eur END), 0) AS total_eur,
+           COUNT(CASE WHEN (${ANY_FLAG_SQL}) THEN 1 END) AS total_contracts,
+           ${typeCols.join(',\n           ')}
+         FROM contracts c`,
+      )
+      .first<TotalRow>(),
+    db
+      .prepare(
+        `SELECT substr(t.cpv_code, 1, 2) AS code,
+                COALESCE(SUM(c.amount_eur), 0) AS eur, COUNT(*) AS contracts
+         ${FROM}
+         WHERE (${ANY_FLAG_SQL}) AND t.cpv_code IS NOT NULL
+         GROUP BY code ORDER BY eur DESC LIMIT 6`,
+      )
+      .all<SectorRow>(),
+    db
+      .prepare(
+        `SELECT a.type_group AS type_group,
+                COALESCE(SUM(c.amount_eur), 0) AS eur, COUNT(*) AS contracts
+         ${FROM}
+         WHERE (${ANY_FLAG_SQL}) AND a.type_group IS NOT NULL
+         GROUP BY a.type_group ORDER BY eur DESC`,
+      )
+      .all<AuthTypeRow>(),
+  ]);
+
+  const byType = FLAG_TYPES.map((t) => ({
+    type: t,
+    eur: totalRow?.[`${t}_eur`] ?? 0,
+    contracts: totalRow?.[`${t}_n`] ?? 0,
+  }));
+
+  return {
+    totalEur: totalRow?.total_eur ?? 0,
+    contracts: totalRow?.total_contracts ?? 0,
+    byType,
+    bySector: sectors.results
+      .filter((r): r is SectorRow & { code: string } => r.code != null)
+      .map((r) => ({
+        code: r.code,
+        label: SECTOR_LABEL.get(r.code) ?? r.code,
+        eur: r.eur,
+        contracts: r.contracts,
+      })),
+    byAuthorityType: authTypes.results
+      .filter(
+        (r): r is AuthTypeRow & { type_group: string } =>
+          r.type_group != null && CANONICAL_TYPE_GROUPS.has(r.type_group),
+      )
+      .map((r) => ({ typeGroup: r.type_group, eur: r.eur, contracts: r.contracts })),
+  };
+}
diff --git a/packages/db/src/queries/home.ts b/packages/db/src/queries/home.ts
index bcfbad63..b2fa6f07 100644
--- a/packages/db/src/queries/home.ts
+++ b/packages/db/src/queries/home.ts
@@ -5,7 +5,8 @@ import {
   type AuthorityTotalsRow,
   type CompanyTotalsRow,
 } from './rows';
-import { listSingleOfferContracts } from './contracts';
+import { listContracts, listSingleOfferContracts } from './contracts';
+import { getFlaggedValue } from './flagged';
 
 interface HomeTotalsRow {
   contracts: number;
@@ -50,39 +51,64 @@ export async function getHomeData(db: D1Database): Promise<HomeData> {
       };
 
   const placeholders = STATE_TYPES.map(() => '?').join(', ');
-  const [companies, ministries, municipalities, recentSingleOffer, topSingleOffer, singleOfferRow] =
-    await Promise.all([
-      db
-        .prepare(
-          `SELECT * FROM company_totals WHERE kind <> 'unknown' ORDER BY won_eur DESC, bidder_id LIMIT 10`,
-        )
-        .all<CompanyTotalsRow>(),
-      db
-        .prepare(
-          `SELECT * FROM authority_totals WHERE type_group IN (${placeholders}) ORDER BY spent_eur DESC, authority_id LIMIT 6`,
-        )
-        .bind(...STATE_TYPES)
-        .all<AuthorityTotalsRow>(),
-      db
-        .prepare(
-          `SELECT * FROM authority_totals WHERE type_group = 'община' ORDER BY spent_eur DESC, authority_id LIMIT 6`,
-        )
-        .all<AuthorityTotalsRow>(),
-      listSingleOfferContracts(db, 'recent', 10),
-      listSingleOfferContracts(db, 'value', 10),
-      // Money portion of single-offer contracts vs the whole corpus (totals.valueEur is the
-      // denominator). Keep the metric's bids = 1 filter, then use the same canonical value base as
-      // every rollup: all known amount_eur values, regardless of value_flag.
-      db
-        .prepare(
-          `SELECT COALESCE(SUM(amount_eur), 0) AS value_eur, COUNT(*) AS contracts
+  const [
+    companies,
+    ministries,
+    municipalities,
+    recentSingleOffer,
+    topSingleOffer,
+    singleOfferRow,
+    flagged,
+    topFlaggedPage,
+  ] = await Promise.all([
+    db
+      .prepare(
+        `SELECT * FROM company_totals WHERE kind <> 'unknown' ORDER BY won_eur DESC, bidder_id LIMIT 10`,
+      )
+      .all<CompanyTotalsRow>(),
+    db
+      .prepare(
+        `SELECT * FROM authority_totals WHERE type_group IN (${placeholders}) ORDER BY spent_eur DESC, authority_id LIMIT 6`,
+      )
+      .bind(...STATE_TYPES)
+      .all<AuthorityTotalsRow>(),
+    db
+      .prepare(
+        `SELECT * FROM authority_totals WHERE type_group = 'община' ORDER BY spent_eur DESC, authority_id LIMIT 6`,
+      )
+      .all<AuthorityTotalsRow>(),
+    listSingleOfferContracts(db, 'recent', 10),
+    listSingleOfferContracts(db, 'value', 10),
+    // Money portion of single-offer contracts vs the whole corpus (totals.valueEur is the
+    // denominator). Keep the metric's bids = 1 filter, then use the same canonical value base as
+    // every rollup: all known amount_eur values, regardless of value_flag.
+    db
+      .prepare(
+        `SELECT COALESCE(SUM(amount_eur), 0) AS value_eur, COUNT(*) AS contracts
          FROM contracts WHERE bids_received = 1 AND amount_eur IS NOT NULL`,
-        )
-        .first<{ value_eur: number; contracts: number }>(),
-    ]);
+      )
+      .first<{ value_eur: number; contracts: number }>(),
+    // Flagged-value summary (#218) — live aggregate over existing columns, under the 1h edge cache.
+    getFlaggedValue(db),
+    // Top flagged contracts by value, for the homepage table (same shape as the single-offer list).
+    // `excludeNaturalPersons` drops sole-trader (ЕТ) bidders in SQL, before the LIMIT — so an identifiable
+    // individual never appears under a „сигнали за риск" label on this indexed, edge-cached page (GDPR/ЗЗЛД
+    // — mirrors the noindex on sole-trader company profiles, #236 review), and the table still fills 10 rows
+    // (the exclusion no longer eats into the page as a post-hoc filter would). 0 rows degrades to the empty
+    // state. The exclusion keys on both the "ЕТ " name convention and the registry `legal_form`, so it does
+    // not depend on the winner's name spelling alone.
+    listContracts(db, {
+      flags: ['all'],
+      sort: 'value-desc',
+      pageSize: 10,
+      excludeNaturalPersons: true,
+    }),
+  ]);
 
   return {
     totals,
+    flagged,
+    topFlagged: topFlaggedPage.items,
     topCompanies: companies.results.map(toCompanyListItem),
     topMinistries: ministries.results.map(toAuthorityListItem),
     topMunicipalities: municipalities.results.map(toAuthorityListItem),
diff --git a/packages/db/src/queries/index.ts b/packages/db/src/queries/index.ts
index 705ad966..5d4d0370 100644
--- a/packages/db/src/queries/index.ts
+++ b/packages/db/src/queries/index.ts
@@ -7,6 +7,7 @@ export * from './keyset';
 export * from './sectors';
 export * from './rows';
 export * from './home';
+export * from './flagged';
 export * from './methodology';
 export * from './companies';
 export * from './authorities';
diff --git a/packages/db/src/queries/keyset.test.ts b/packages/db/src/queries/keyset.test.ts
index d82982eb..bd0647f3 100644
--- a/packages/db/src/queries/keyset.test.ts
+++ b/packages/db/src/queries/keyset.test.ts
@@ -6,8 +6,10 @@ import { decodeCursor, encodeCursor, filterSignature, keyset, pageCursors } from
 
 const FILTER_VALUE: Record<string, unknown> = {
   authority: '000695089',
+  authorityTypes: ['министерство'],
   bidder: '103267194',
   bids: 'one',
+  flags: ['no_competition'],
   countBucket: '2-5',
   eu: 'eu',
   kinds: ['company'],
@@ -76,6 +78,8 @@ describe('route filter signatures', () => {
       'bidder',
       'q',
       'bids',
+      'flags',
+      'authorityTypes',
     ]);
     expect([...COMPANY_FILTER_KEYS]).toEqual([
       'kinds',
diff --git a/packages/db/src/queries/rows.ts b/packages/db/src/queries/rows.ts
index 9d4a48a0..9d0a59cc 100644
--- a/packages/db/src/queries/rows.ts
+++ b/packages/db/src/queries/rows.ts
@@ -29,6 +29,11 @@ export function typeLabel(typeGroup: string | null): string | null {
   return TYPE_LABELS[typeGroup] ?? typeGroup;
 }
 
+/** The closed set of authority `type_group` buckets. Used as the allow-list for the `?type=` filter so
+ *  a request can't mint unbounded distinct values — each distinct value is otherwise a separate edge
+ *  cache key AND an uncached full-table scan on /contracts (cache-cardinality / DoS guard, #218 review). */
+export const AUTHORITY_TYPE_GROUPS = Object.keys(TYPE_LABELS);
+
 export interface CompanyTotalsRow {
   bidder_id: string;
   name: string;