feat/ui-impact

anchor unit-dependency can silently shift 'cal' preset to a different calendar year

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx:124

anchor = lastCompleteMonth(coverages(STORES, unit)) depends on unit. If kwh anchor is 2026-01 but mxn anchor is 2025-12 (possible when some stores have no MXN data for the most recent month), buildSpecs computes y=2026 for kwh ('Año calendario 2025') but y=2025 for mxn ('Año calendario 2024'). Switching unit changes which prior year 'cal' describes with the same label. ytd months count also shifts. Not a bug with current hardcoded STORES but a latent trap once live data is wired.

monthSpan(from > to) silently collapses to 1-month window

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx:88

When customFrom > customTo, monthSpan returns a negative number. Math.max(1, negative) = 1, so months=1. The w.months < 12 warning fires but doesn't explain the reversed range. No input validation prevents from > to entry.

lastCompleteMonth and resolveWindow share a hidden threshold coupling

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/_lib/likeForLike.ts:153

Both use >= 2 as the minimum-stores threshold independently. If one is changed without the other, the anchor from lastCompleteMonth could point to a month that resolveWindow's candidate set excludes, making ytd/cal presets anchor on a month that never appears as a viable window end.

WeakMap cache acts as permanent cache — correct for frozen data

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/_lib/likeForLike.ts:132

Since STORES holds strong references to all Store objects, WeakMap entries are never GC'd. Correct for the current frozen dataset. Becomes a stale-cache trap if Store objects are ever created dynamically.

URL ?tienda= param used in state before STORES validation check

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx

The raw query string value is extracted before the STORES.some guard runs. Confirm the raw param is never interpolated into the DOM before the guard completes. React JSX escaping mitigates direct interpolation but an aria attribute or label assembled from the raw value before validation could be a reflected XSS vector.

useFindings data rendered without explicit sanitization gate

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx

Findings fetched via useFindings({ limit: 200 }) are used to build a flagged set of store IDs. If any finding field is ever passed to a component using dangerouslySetInnerHTML, server-originated strings could carry XSS payloads. React default escaping covers direct interpolation.

Module-level mutable WeakMap cache in nominally-pure module

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/_lib/likeForLike.ts:132

COV_CACHE is a module-level mutable singleton. The cache is never cleared for the module lifetime and test isolation requires object identity, not value equality. Pragmatic for a frozen demo dataset but breaks FCIS purity. Will not survive when STORES becomes a live-fetched array with different identity per org.

Hardcoded user-facing strings — i18n convention not followed

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx

All copy is hardcoded in Spanish inline. Convention requires messages/{locale}.json via next-intl. Consistent deviation across the energia module but still a blocker for any future locale addition.

COV_CACHE write-then-set is a no-op for existing entries

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/_lib/likeForLike.ts:136

coverages() retrieves perUnit, mutates it, then re-sets it. For an existing entry the COV_CACHE.set call is a no-op (mutation already updated the stored reference). Misleading — reads as copy-on-write semantics that don't exist. Cleaner: check presence first, only set on first use.

Unit type correctly moved to realConsumption.ts SSOT

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/_lib/anomaly.ts:170

Unit was in anomaly.ts; moved to realConsumption.ts (correct — data module owns its vocabulary). Re-export from anomaly.ts preserves backward compat. Dependency direction now flows correctly: likeForLike imports Unit from realConsumption, not anomaly.

useFindings on a mostly-static page — correct but creates implicit auth dependency

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx:173

The page is otherwise powered by static STORES constant. useFindings is the only live API call. The status === 200 guard handles failure correctly, but mixing live API state into a static demo surface creates an implicit auth/org context dependency not obvious from the component signature.

monthSpan() untested — year-boundary arithmetic unverified

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx

monthSpan(from, to) computes the inclusive month count for the 'custom' range, feeding directly into likeForLike()'s months param. An off-by-one at year boundaries (e.g. '2025-12' to '2026-01' should be 2) would silently produce the wrong window. No test covers this function.

buildSpecs() untested — all four range spec derivations unverified

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx

buildSpecs(anchor, customFrom, customTo) derives all four RangeSpec entries including year arithmetic for 'cal' (y-1) and month count for 'ytd'. A wrong year subtraction or month extraction would silently produce the wrong label and pinned end. No test covers any buildSpecs path.

subMonths() local copy untested — diverges from addMonths with no guard

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx

subMonths() in page.tsx is a near-copy of the exported addMonths() from likeForLike.ts with sign flipped. The local copy is untested and could diverge at year boundaries. Import addMonths instead to remove the duplication.

mix computation logic untested — financial formula has no unit test

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx

yoy.prev * (1 + other.deltaPct / 100) - yoy.cur with noise threshold, same-store-set guard, and unit guard are all untested. The formula is non-trivial; percent vs decimal confusion is a known trap. Extract to _lib and test.

windowLabel() — w.cur[0]! access unguarded on empty cur array

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx

windowLabel(res) accesses w.cur[0]! without null guard after checking w exists. An empty cur array on a degenerate result (months=0?) would throw at render. No test covers the empty-cur edge case.

sameSet check untested — set-equality logic for population coherence unverified

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx

sameSet verifies kWh and MXN results cover exactly the same store set before showing the tariff-mix insight. Its correctness gates a financial insight. A targeted test for a case where sets differ by one store would provide a regression anchor.

mix.diff formula obscures its intent — needs named intermediate

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx:164

yoy.prev * (1 + other.deltaPct / 100) - yoy.cur computes costAtLastYearPrices - actualCost. Add a named intermediate: const costAtPriorTariffs = yoy.prev * (1 + other.deltaPct / 100) so the subtraction is self-documenting. The current form requires the reader to verify the algebra to trust the sign of the UI sentence.

subMonths duplicates addMonths — import instead

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx:62

subMonths(ym, n) is identical in structure to addMonths(ym, -n) from likeForLike.ts, which is already exported. Replace the local copy with addMonths from _lib/likeForLike. Eliminates two implementations of the same arithmetic that can diverge silently.

signed() uses Unicode minus U+2212, pct() uses ASCII hyphen — inconsistent in financial table

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx:48

signed() emits '−' (U+2212) for negative values; pct() lets n.toFixed() emit '-' (U+002D). In cells showing both formatters side-by-side the glyphs differ. Either adopt Unicode minus in both, or ASCII in both.

completeTally duplicated in lastCompleteMonth and resolveWindow

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/_lib/likeForLike.ts:153

Both lastCompleteMonth and resolveWindow (non-pinned branch) build the same tally = Map<ym, storeCount> from covs. Extract a shared helper completeTally(covs) to remove the duplication and couple the >=2 threshold at one site.

Period picker's unit-dependency not surfaced to user

apps/platform/src/app/[locale]/(dashboard)/energia/comparativo/page.tsx:124

Switching kWh ↔ MXN can shift the anchor and thus 'ytd'/'cal' labels. The user sees options change with no explanation. A tooltip or note on those rows explaining 'basado en meses completos de la unidad seleccionada' would prevent confusion.