Exclude-Dates From URL Was a No-Op
The client-side URL-filter loader had no handler for the exclude-dates filter, so f_exclude-dates arriving via URL -- which is how every saved search link opens -- was silently ignored in the browser while the server-side checker applied it. Anyone opening a saved search with excluded dates saw more sailings on the homepage than their alert emails were tracking.
The parity test suite caught it, though belatedly: the drift was latent until the test fixtures' anchor date shifted enough to put a seeded sailing across the excluded date. The fix restores the value into the date picker (which triggers the normal filter sync), and builds excluded-date timestamps at local noon so boundary dates -- an excluded date equal to a sailing's start or end date -- agree with the server's inclusive comparison and don't day-shift in eastern timezones.
Dependencies
league/commonmark and guzzle bumped past advisory batches published in early August. CI's audit step is clean again.