# eval-0 souls — WITH skill — returned audit

> Subagent could not persist the repaired HTML (Bash denied for this run) or write report.md;
> returned as text, saved by main loop. Original input untouched.

**Profile:** Advanced-tier, pure-JS distro → §13.12 fully applies. Custom EN/ES i18n. Single
source of truth = `state`; `summary()` (4491) and `portraitRows()` (4344) both read it.

## Per-axis
- **Axis 1 Summary parity — PASS, 1 nav-risk gap.** All items flow from one `state` into summary +
  every export (no per-format DOM re-read → no drift). Blanks filtered (4365). **Gap:** export
  controls not disabled on empty model — `refreshGates()` (4486) only gates `[data-next]`, not the
  save-row `[data-action]`, so an empty portrait still downloads (contract B FAIL). Surveyed.
- **Axis 2 Views ↔ raters — N/A (auto-pass).** App has no `raters[]` and no chart Views — it's a
  5-layer projective portrait, not a rating app. Nothing to "tune"; no drift possible.
- **Axis 3 Six formats — md/json/xml/html/csv PASS; jpg + filename Safe-fixed.** json
  (`JSON.stringify(portraitData())`, 4575) round-trips; xml (`portraitXml` 4382) well-formed via
  `esc`/`escAttr`; html (`buildPortraitHtml` 4391) standalone + escaped (no injection); csv (4370)
  RFC-4180 holds hostile `"x, y\n<&✺"` in one field; md fences `summary()`. All MIMEs
  `;charset=utf-8`. **Safe 3a:** JPG silently truncates (`.slice(0,16/22/3)`, 4472-4477) with no
  `…` → fix adds visible `…`. **Safe 3b:** filename `soul-portrait.<ext>` (4586) → `souls-summary`
  / `souls-resumen` localized.
- **Axis 4 Share — FAIL→fixed-on-recommendation.** `share-mobile` (4592) shares text only; the
  `buildPortraitHtml()` artifact never attached, no `canShare({files})` guard, no clipboard
  fallback. Fixed: guarded HTML-file ladder.

## Bucketing
Safe (applied): jpg `…`, filename localization. Surveyed (headless, applied-on-recommendation):
Q1 disable save-row on empty model; Q2 guarded mobile-share HTML ladder; Q3 localize MD/HTML title
→ left as-is (prose, no round-trip impact). House rule respected: 3 duplicate escapers
(`escapeHtml` 3411, local 4564, `esc` 4392) all equivalent → not churned.

## Re-verify
node parse-back NOT RUN (Bash denied) → manual trace only (flagged as weaker evidence): json
round-trips, xml/html escaped+well-formed, csv quoting holds, md fenced — PASS by inspection.
Interactive paths reasoned intact (only `disabled` toggles + `share-mobile` body + canvas text +
`a.download` string touched; dispatcher/cycle popovers/CSS nav untouched).

**Net:** Axis1 PASS(+gate fix), Axis2 N/A, Axis3 PASS (jpg+filename Safe-fixed), Axis4 FAIL→fixed.
Two Safe + two surveyed fixes from full §13.12 compliance.
