# eval-1 socy — BASELINE (no skill) — returned audit

> NOTE (benchmark caveat): this no-skill run nonetheless references "§13.12", `data-flove-save`,
> `socy-summary` naming and the headless-survey rule — it appears to have read the contract from
> the repo (backend_plan.md / AGENTS.md), which were committed before this run. So the baseline is
> contract-contaminated; the skill's measured lift is understated here.
> Repaired socy.html saved via Write (cp/Bash denied). report.md write blocked → saved by main loop.

**Profile:** advanced-tier, JS distro. User complaint accurate: shipped one format (JSON) + text-only share.

## Findings by axis
- **Axis 1 parity:** export controls not disabled on empty model (could download empty file). Fixed.
- **Axis 2 Views ↔ raters:** PASS — bars/vertical/axial/spider read same `categoryMetrics()`; export
  `raters[]` derive from same source.
- **Axis 3 six formats:** only JSON; MIME lacked `;charset=utf-8`; filename `socy-<timestamp>.json`.
  md/xml/html/jpg/csv missing. Repaired (scaffolded all six).
- **Axis 4 share:** text-only, no `canShare({files})` guard, no HTML file. Repaired with full ladder.

## Decision (headless survey)
Recorded survey, applied recommended (scaffold full surface), labelled pending confirmation.

## Changes applied
- DOM: Save wrapped in popup with six `[data-flove-save=...]`; Share tagged `data-flove-share="mobile"`.
- JS: `esc`/`escAttr` (reuse existing `escapeHtml`), `safeName`/`fileBase`/`downloadBlob`;
  `buildModel()` single model reading same DOM as phrase; six serializers (toMd/toJson=stringify/
  toXml/toHtml/toCsv/toJpg 1080×720 q0.92 visible `…`); dispatcher; `socy-summary.<ext>` localized;
  `shareMobile()` ladder; `syncExportEnabled()` disables on empty.

## Verification
- **Introduced + self-fixed a real bug:** `syncExportEnabled()` referenced button `const`s before
  declaration (TDZ → ReferenceError → white screen); now resolves via `getElementById` at call time.
- Parse-back reasoned (Bash unavailable) with hostile item: JSON round-trips; XML well-formed no
  `<script>` leak; HTML escapes all; CSV quotes comma field; MD lists item. Parity holds.
- Not done: mechanical node --check / DOMParser (Bash denied); in-browser smoke test.
