svelte-kit-vice/audit/components/alert-dialog.md

# Audit: alert-dialog
audit-version: 1
audited-at: 2026-06-26
scope: ['soma', 'eidos']  (composes/delegates close to Dialog; Provider is virtual)
method: adversarially-verified workflow (analyze → refute); HIGH/CRITICAL personally re-verified against cited code by the lead.
provider: G:\dev\svelte\vicen\src\uix\soma\components\alert-dialog\alert-dialog-provider.svelte.ts

## Summary
Counts (post-verification): CRITICAL 0 · HIGH 1 · MEDIUM 0 · LOW 0.
systemic hits: none.

## Findings
### HIGH: A Contract(morfo): morfo MUST be 'as const satisfies Morfo' — alert-dialog-001   <!-- id: alert-dialog-001 -->
- dimension: A
- rule: A Contract(morfo): morfo MUST be 'as const satisfies Morfo'
- location: G:\dev\svelte\vicen\src\uix\morfo\components\alert-dialog.ts:4
- evidence: export const alertDialogMorfo: Morfo = { ... }
- impact: Type narrowing degraded in createAttrs; morfo loses const assertion benefits and exhaustiveness checks
- repro: Build and check TypeScript diagnostics; createAttrs will not narrow string literal keys correctly
- proposed-fix: Change to: export const alertDialogMorfo = { ... } as const satisfies Morfo;
- verify: [confirmed] Read src/uix/morfo/components/alert-dialog.ts line 4 verbatim: `export const alertDialogMorfo: Morfo = {`. This is a bare type annotation, not the canonical `as const satisfies Morfo` form. The file ends at line 76 with `};` (no `as const satisfies Morfo` closer). Confirmed against the four baseline morfos which all use the canonical pattern: dialog.ts:15 `export const dialogMorfo = {` closing at :303 `} as const satisfies Morfo;`, popover.ts:4 closing at :251, drawer.ts:4 closing at :313, toggle.ts:22 closing at :143. The `: Morfo` annotation widens literal types (e.g. `kebab: 'alert-dialog'`, part kebabs `'provider'|'action'|'cancel'`, the `v.literal('button')` aria values) to their base types, degrading the exact-key narrowing compileMorfo/createAttrs depend on — exactly the rule-A violation described. Severity HIGH is appropriate: it is a contract-shape rule the morfo validators should catch.
- fix-status: fixed (98954a7c)

## No-findings dimensions
B, C, D, E, E-bis, F, G

## Theming facts (E-bis)
- magic z-index: none
- magic literals: none
- undeclared parts: none
- roles clean: true · variants clean: true

## Tests (F)
- exists: true · env: jsdom
- covers: action/cancel data attribute projection; aria-label resolution and reactivity; onclick close delegation to Dialog; callback execution on button click
- untested: keyboard interaction (delegated to Dialog); focus trap/return (delegated to Dialog); Escape key behavior override (delegated to Dialog)

## Style observations (non-blocking)
- AlertDialog properly delegates all state/focus/keyboard to Dialog with variant='alertdialog' forced
- Escape key behavior override (close→ignore regression fix) is well-documented in README and implemented via wrapper
- Eidos Action/Cancel properly forward dialog intent to Button via snippet binding
- Action emits intent-driven color (risk→red), Cancel stays neutral—clear visual contrast matching WAI-ARIA guidance
docs(audit): deep component audit — 124/124 audited + executable fix plan Stateful deep audit of the whole UIX component system across 8 batches (words/palabras/chronos excluded). Read-only: zero code changes. Result: 0 CRITICAL · 18 HIGH · 129 MEDIUM · 60 LOW. Deliverables (audit/): - components/{kebab}.md one machine-reparseable report per component - 00_WORKLIST.md resumable index (all audited) - SUMMARY.md verdict + systemic findings + per-batch counts - THEMING_COHERENCE.md E-bis coherence roll-up (roles/sizes/variants clean) - SHARED_EXTRACTION.md extraction opportunities (EX-3 selectedSet highest value) - VALIDATOR_GAPS.md 12 proposed validator extensions (prevent the class) - FIX_PLAN.md prioritized, executable fix roadmap (Phase 1 = SYS-7) Method: per-batch adversarial workflow (analyze -> skeptical verify), with every HIGH/CRITICAL lead-verified against the cited source + independent greps. The verify stage refuted false positives in both directions (eidos->soma, CSS.escape on framework values, inert archetype metadata, content-color slots mistaken for non-canonical roles). Top systemic finding: SYS-7 — A31 O(N^2) per-item .includes selection across 9 components (6 HIGH), one ~3-line selectedSet/expandedSet lift each. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> 4 months ago			`# Audit: alert-dialog`
			`audit-version: 1`
			`audited-at: 2026-06-26`
			`scope: ['soma', 'eidos'] (composes/delegates close to Dialog; Provider is virtual)`
			`method: adversarially-verified workflow (analyze → refute); HIGH/CRITICAL personally re-verified against cited code by the lead.`
			`provider: G:\dev\svelte\vicen\src\uix\soma\components\alert-dialog\alert-dialog-provider.svelte.ts`

			`## Summary`
			`Counts (post-verification): CRITICAL 0 · HIGH 1 · MEDIUM 0 · LOW 0.`
			`systemic hits: none.`

			`## Findings`
			`### HIGH: A Contract(morfo): morfo MUST be 'as const satisfies Morfo' — alert-dialog-001 <!-- id: alert-dialog-001 -->`
			`- dimension: A`
			`- rule: A Contract(morfo): morfo MUST be 'as const satisfies Morfo'`
			`- location: G:\dev\svelte\vicen\src\uix\morfo\components\alert-dialog.ts:4`
			`- evidence: export const alertDialogMorfo: Morfo = { ... }`
			`- impact: Type narrowing degraded in createAttrs; morfo loses const assertion benefits and exhaustiveness checks`
			`- repro: Build and check TypeScript diagnostics; createAttrs will not narrow string literal keys correctly`
			`- proposed-fix: Change to: export const alertDialogMorfo = { ... } as const satisfies Morfo;`
			- verify: [confirmed] Read src/uix/morfo/components/alert-dialog.ts line 4 verbatim: `export const alertDialogMorfo: Morfo = {`. This is a bare type annotation, not the canonical `as const satisfies Morfo` form. The file ends at line 76 with `};` (no `as const satisfies Morfo` closer). Confirmed against the four baseline morfos which all use the canonical pattern: dialog.ts:15 `export const dialogMorfo = {` closing at :303 `} as const satisfies Morfo;`, popover.ts:4 closing at :251, drawer.ts:4 closing at :313, toggle.ts:22 closing at :143. The `: Morfo` annotation widens literal types (e.g. `kebab: 'alert-dialog'`, part kebabs `'provider'\|'action'\|'cancel'`, the `v.literal('button')` aria values) to their base types, degrading the exact-key narrowing compileMorfo/createAttrs depend on — exactly the rule-A violation described. Severity HIGH is appropriate: it is a contract-shape rule the morfo validators should catch.
docs(audit): mark the 16 HIGH code findings as fixed fix-status: open -> fixed (<commit>) for every HIGH whose code fix landed this session, across 12 component reports: - 92f988e7: listbox-001, grid-list-001/002, tree-view-002, tree-grid-001, tag-group-001 (SYS-7 A31) - 98954a7c: alert-dialog-001, breadcrumb-001, navigation-menu-006, select-001, dialog-002 - db33f66c: select-002, dialog-001, collapsible-NEW-001 - bac67315: combobox-001, select-003 The HIGH tier is now code-complete; the 2 remaining HIGH (select-004, combobox-002) are test-coverage gaps for Phase 6. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> 3 months ago			`- fix-status: fixed (98954a7c)`
docs(audit): deep component audit — 124/124 audited + executable fix plan Stateful deep audit of the whole UIX component system across 8 batches (words/palabras/chronos excluded). Read-only: zero code changes. Result: 0 CRITICAL · 18 HIGH · 129 MEDIUM · 60 LOW. Deliverables (audit/): - components/{kebab}.md one machine-reparseable report per component - 00_WORKLIST.md resumable index (all audited) - SUMMARY.md verdict + systemic findings + per-batch counts - THEMING_COHERENCE.md E-bis coherence roll-up (roles/sizes/variants clean) - SHARED_EXTRACTION.md extraction opportunities (EX-3 selectedSet highest value) - VALIDATOR_GAPS.md 12 proposed validator extensions (prevent the class) - FIX_PLAN.md prioritized, executable fix roadmap (Phase 1 = SYS-7) Method: per-batch adversarial workflow (analyze -> skeptical verify), with every HIGH/CRITICAL lead-verified against the cited source + independent greps. The verify stage refuted false positives in both directions (eidos->soma, CSS.escape on framework values, inert archetype metadata, content-color slots mistaken for non-canonical roles). Top systemic finding: SYS-7 — A31 O(N^2) per-item .includes selection across 9 components (6 HIGH), one ~3-line selectedSet/expandedSet lift each. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> 4 months ago
			`## No-findings dimensions`
			`B, C, D, E, E-bis, F, G`

			`## Theming facts (E-bis)`
			`- magic z-index: none`
			`- magic literals: none`
			`- undeclared parts: none`
			`- roles clean: true · variants clean: true`

			`## Tests (F)`
			`- exists: true · env: jsdom`
			`- covers: action/cancel data attribute projection; aria-label resolution and reactivity; onclick close delegation to Dialog; callback execution on button click`
			`- untested: keyboard interaction (delegated to Dialog); focus trap/return (delegated to Dialog); Escape key behavior override (delegated to Dialog)`

			`## Style observations (non-blocking)`
			`- AlertDialog properly delegates all state/focus/keyboard to Dialog with variant='alertdialog' forced`
			`- Escape key behavior override (close→ignore regression fix) is well-documented in README and implemented via wrapper`
			`- Eidos Action/Cancel properly forward dialog intent to Button via snippet binding`
			`- Action emits intent-driven color (risk→red), Cancel stays neutral—clear visual contrast matching WAI-ARIA guidance`