# eval-2 blogyadvanced — WITH skill — returned audit

> Repaired HTML WAS saved (blogyadvanced.html, +~4.8KB). report.md write blocked → saved by main
> loop. This run's Bash worked: `node --check` + a real `@xmldom/xmldom` DOMParser ran.

**Profile:** Advanced tier (`tier-pop-step--current`, 6986), JS distro, translaty i18n. Full
§13.12 applies.

## Pass/fail per axis
- **Axis 1 Summary parity — PASS.** phrase/raters/picked read live (~8602–8627); empty-model guard
  `if(!files.length) return;` prevents empty downloads.
- **Axis 2 Views ↔ raters — PASS (the focus, no drift).** All four Views derive from one array:
  `svgFor(view)` (~8746) calls `readRaters()` once → bars/vertical/axial/spider; live radial paint
  calls the same `svgFor`. Magnitude `frac=n/max` (clamped) drives bar width / column height /
  spoke length / spider radius (3/5 reads 60% everywhere). Harness asserted Views' source and JSON
  share `raters.n === [3,0,5,0,2]`.
- **Axis 3 Six formats — PASS after Safe fixes** (details below).
- **Axis 4 Share — was FAIL, now wired** (pending confirmation).
- **Hostile-input probe — PASS, no injection.** Probe `a < b & "c" 'd', e\n<script>alert(1)</script> ✺😀`.
  XML DOMParser: no parsererror, 5 raters round-trip, `getElementsByTagName('script').length===0`.
  HTML: `<script>`→escaped, no real node. CSV: comma/quote/newline in one quoted field. JSON: exact.

## Safe auto-fixes
1. CSV RFC-4180 quoter (`csvQ`) wired into `toCsv` (comma-free rows byte-identical → no behavior change).
2. XML root `<blogynormal>`→`<blogyadvanced>` (copy-paste leftover); emoji attr via new `escAttr`.
3. Shared `escAttr` alias (one escaping pair for XML+HTML).
4. Filename localization (`safeName`/`SUMMARY_WORD`/`fileBase`) → `blogyadvanced-resumen.<ext>` (es)
   / `-summary` (en); applied to single-file, ZIP, and view-SVG names.
5. HTML export i18n — `lang`, viewport, localized title `PAGE · resumen`, all values escaped.

## Surveyed (headless, applied-on-recommendation, pending confirmation)
- **Q1 JPG advertised but unimplemented** (`buildFmtFile` had no `jpg` case → bundled nothing).
  Applied (a): `renderJpgBytes` canvas 1080×720 q0.92 with visible `…` truncation + async download.
- **Q2 `navigator.share` never wired** (📱/🌐/🖨 had no handlers, only mailto). Applied (a):
  `shareMobile()` ladder — Web Share + standalone HTML guarded by `canShare({files})` → text →
  clipboard+toast; print → `window.print()`. CSS cycle nav untouched.
- **Q3 CSV omits phrase+picked** (parity gap vs json). Applied (a) leave-as-is — raters-table is a
  valid row-per-element; phrase/picked present in md/json/xml/html. Flagged only.

## Re-verify (clean)
`node --check` modified IIFE = OK. Harness JSON/XML/HTML/CSV/i18n/filename = PASS. xmldom DOMParser
on modified XML = clean. Nav paths reasoned intact. Deep a11y of exported HTML → deferred to `/validaty`.
