# Audit: range-calendar
audit-version: 1
audited-at: 2026-06-26
scope:   (SCOPE-DRIFT → SYS-1)
method: adversarially-verified workflow (analyze → refute); HIGH/CRITICAL personally re-verified by the lead. Batch-3 ground-truth: each picker fires trigger(close) (close NOT inert), but open/commit-reset ARE inert; calendar/range-calendar are MID-REFACTOR (uncommitted view-switch work).
provider: src/uix/soma/components/range-calendar/range-calendar-provider.svelte.ts

> **MID-REFACTOR CAVEAT:** this component has uncommitted view-switch changes on this branch (M/D/?? files). Findings reflect the current in-flight state; treat structural inconsistencies as in-progress, not shipped defects.

## Summary
Counts (post-verification): CRITICAL 0 · HIGH 0 · MEDIUM 2 · LOW 2.
systemic hits: SYS-1 scope-drift (morfo includes eidos but no recipe entry).

## Findings
### MEDIUM: Keyboard route must match morfo contract; Home/End APG grid pattern — range-calendar-002   <!-- id: range-calendar-002 -->
- dimension: B: Behavior (soma)
- rule: Keyboard route must match morfo contract; Home/End APG grid pattern
- location: src/uix/soma/components/range-calendar/range-calendar-provider.svelte.ts:566-567
- evidence: Morfo declares (line 88-89): `{ key: 'Home', action: 'first-day-of-week' }, { key: 'End', action: 'last-day-of-week' }`. Provider implements (lines 566-567): `else if (e.key === KEYS.HOME) target = startOfMonth(date); else if (e.key === KEYS.END) target = endOfMonth(date);`. This is month-based, not week-based.
- impact: User pressing Home/End navigates to first/last day of month instead of first/last day of current week, violating both the morfo contract and APG grid pattern expectations.
- proposed-fix: Replace `startOfMonth(date)` with calculation to first day of current week using weekStartsOnResolved. Replace `endOfMonth(date)` with calculation to last day of current week.
- verify: [downgraded] Behavior is real but NOT a range-calendar-specific HIGH. Provider lines 566-567: `else if (e.key === KEYS.HOME) target = startOfMonth(date); else if (e.key === KEYS.END) target = endOfMonth(date);` — month-based, while morfo lines 88-89 declare actions named `first-day-of-week`/`last-day-of-week`. HOWEVER the sibling `calendar` provider does the IDENTICAL thing: calendar-provider.svelte.ts:481-485 `if (e.key === KEYS.HOME) { const monthStart = startOfMonth(date); ... } else if (e.key === KEYS.END) { target = endOfMonth(date); }`, against the IDENTICAL morfo declaration calendar.ts:76-77 (`{ key: 'Home', action: 'first-day-of-week' }, { key: 'End', action: 'last-day-of-week' }`). This is a family-wide naming/implementation divergence, and `keyboard[].action` is advisory morfo metadata (not enforced by the runtime — the provider's keydown handler owns the actual behavior). Not a latent bug introduced here, not a contract-validator catch; at most a LOW doc/naming inconsistency that should be raised against the whole calendar family, not range-calendar alone.
- fix-status: open

### MEDIUM: INERT EVENTS: declared keyboard action never fired via runtime.trigger — range-calendar-003   <!-- id: range-calendar-003 -->
- dimension: A: Contract (morfo)
- rule: INERT EVENTS: declared keyboard action never fired via runtime.trigger
- location: src/uix/morfo/components/range-calendar.ts:92
- evidence: Morfo declares (line 92): `{ key: 'Escape', action: 'cancel-selection' }`. Grep for 'Escape' or 'escape' or 'KEYS.ESCAPE' in range-calendar provider + components returns no matches. No runtime.trigger fires this action.
- impact: User pressing Escape expects to cancel/clear the range selection, but nothing happens. Event is declared only to satisfy schema validation.
- proposed-fix: Implement Escape key handling in handleDayKeydown to call clearSelection(). Or remove Escape from morfo if not intended.
- verify: [confirmed] CONFIRMED as MEDIUM. Morfo line 92 declares `{ key: 'Escape', action: 'cancel-selection' }`. I read the entire keydown chain `handleDayKeydown` (provider lines 555-602): branches exist for horizNext/horizPrev, ArrowDown/Up, Home, End, PageUp, PageDown, Enter/Space — but NO `KEYS.ESCAPE` branch. There is also no other keydown handler on any part (the Day part's `onkeydown` at line 1172-1174 delegates solely to `handleDayKeydown`). The provider never fires `commit-reset` or `clearSelection()` in response to Escape. The declared `cancel-selection` action is therefore inert — it exists only to satisfy the morfo schema, exactly the INERT-events class the rubric calls out. Severity MEDIUM is appropriate: a user mid-selection who presses Escape expecting to abandon the partial range gets nothing, but it is not an a11y/data-corruption break.
- fix-status: open

### LOW: querySelector with interpolated user/runtime value must use CSS.escape — range-calendar-004   <!-- id: range-calendar-004 -->
- dimension: C: DOM-selector
- rule: querySelector with interpolated user/runtime value must use CSS.escape
- location: src/uix/soma/components/range-calendar/range-calendar-provider.svelte.ts:595-596
- evidence: Code: `const el = root.querySelector<HTMLElement>(`[data-range-calendar-day][data-value="${target!.toString()}"]`);` The value is interpolated without CSS.escape. While ISO date format (2026-05-15) currently has no special CSS characters, the pattern is unsafe and violates defensive coding.
- impact: If date format changes or special characters are introduced (e.g., localized formats), the selector could fail to find the element or select an unintended element. Violates the untrusted selector safety pattern.
- proposed-fix: Use `CSS.escape(target!.toString())` to safely escape the interpolated value.
- verify: [downgraded] DOWNGRADED. Provider lines 595-596: `root.querySelector<HTMLElement>(`[data-range-calendar-day][data-value="${target!.toString()}"]`)`. The interpolated value is `DateValue.toString()` — an ISO `YYYY-MM-DD` string produced by `$libs/days`, a FRAMEWORK-controlled value, never user/consumer-derived input. ISO dates contain only digits and a hyphen — no CSS-special characters can ever appear, so CSS.escape changes nothing functionally. Dimension C targets interpolation of *user/consumer-derived* values; a synthesized date string is neither. The same pattern is used family-wide (calendar-provider.svelte.ts:514-516 `[data-calendar-day][data-value="${target!.toString()}"]`). Defensible-hardening LOW at most, not a HIGH untrusted-selector defect.
- fix-status: open

### LOW: MAGIC NUMBERS: bare pixel/em/rem values should use canonical spacing tokens — range-calendar-005   <!-- id: range-calendar-005 -->
- dimension: E-bis: Theming (recipe + css)
- rule: MAGIC NUMBERS: bare pixel/em/rem values should use canonical spacing tokens
- location: src/uix/eidos/components/range-calendar/range-calendar.css:323,332
- evidence: Lines 323, 332: `box-shadow: inset 2px 0 0 0 var(--_calendar-range-start-border);` and `box-shadow: inset -2px 0 0 0 var(--_calendar-range-end-border);` use bare `2px` and `-2px` values instead of canonical border or spacing tokens.
- impact: Spacing is hardcoded, not themable. Breaks token consistency and makes the stripe width inflexible for different design systems.
- proposed-fix: Define a token like `--_calendar-range-endpoint-stripe-width` and reference it instead: `box-shadow: inset calc(var(--_calendar-range-endpoint-stripe-width, 2px) * 1) 0 0 0 ...`
- verify: [confirmed] CONFIRMED as LOW (severity already correct). range-calendar.css line 323 `box-shadow: inset 2px 0 0 0 var(--_calendar-range-start-border);` and line 332 `box-shadow: inset -2px 0 0 0 var(--_calendar-range-end-border);` hardcode the `2px`/`-2px` endpoint-stripe width as bare literals rather than a recipe/border token. Genuine bare-literal drift, lowest severity — it is a decorative 2px hairline accent stripe on the range start/end endpoints, not a layout-load-bearing or themed dimension. Tokenizing as `--_calendar-range-endpoint-stripe-width` would be the canonical fix but the impact is purely cosmetic theme-flexibility.
- fix-status: open

## No-findings dimensions
D: Frontier (soma/eidos isolation), F: Tests (test coverage for existing keyboard/focus paths)

## Theming facts (E-bis)
- magic z-index: none
- magic literals: 2px inset stripe width (lines 323, 332)
- undeclared parts: none
- roles clean: true · variants clean: true

## Tests (F)
- exists: true · env: jsdom
- covers: initial placeholder resolution; range selection ordering; range length bounds enforcement; partial range clearing; endpoint amendment; transient anchor resilience; placeholder auto-page prevention; validation bounds checking
- untested: keyboard navigation (Home/End/arrows); Escape key; roving focus management; two-moments event sequencing