svelte-kit-vice/audit/components/toolbar.md

# Audit: toolbar
audit-version: 1
audited-at: 2026-06-26
scope: soma, sema, eidos (eidos directory exists)  (SCOPE-DRIFT → SYS-1)
method: adversarially-verified workflow; HIGH lead-verified. B7 ground-truth: Toolbar A35 + Form A36 incidents STAYED FIXED (untrack present); toast/clipboard/drag-drop use uix.timers (no A6 leak); button is clean (its archetype finding was inert — Spinner not runtime-registered); data-size/data-shape are eidos visual attrs (not contract violations).
provider: src/uix/soma/components/toolbar/toolbar-provider.svelte.ts
cleanup-audit (A6/A35/A36): No timers, setInterval, addEventListener, ResizeObserver, IntersectionObserver, MutationObserver, setPointerCapture, or $effect blocks in provider code. No cleanup needed. A35/A36 loop check: PASSED (untrack in isTabStop prevents loop; no async patterns). Provider is event-driven (onkeydown, onfocus

## Summary
Counts (post-verification): CRITICAL 0 · HIGH 0 · MEDIUM 1 · LOW 0.

## Findings
### MEDIUM: SYS-1 scope-drift — toolbar-001   <!-- id: toolbar-001 -->
- dimension: A
- rule: SYS-1 scope-drift
- location: src/uix/morfo/components/toolbar.ts:7
- evidence: Morfo declares scope: ['soma', 'sema'] but eidos directory exists at src/uix/eidos/components/toolbar/ with CSS, components, and types
- impact: Morfo scope declaration incomplete; validator may not catch eidos-layer issues
- proposed-fix: Update morfo scope to ['soma', 'sema', 'eidos']
- verify: [confirmed] CONFIRMED. src/uix/morfo/components/toolbar.ts:7 reads `scope: ['soma', 'sema'],` yet a full eidos layer exists: src/uix/eidos/components/toolbar/ (toolbar.css, index.ts, types.ts, 5 part svelte files) plus a recipe entry at src/uix/eidos/lib/recipes/base.ts:2312 (`toolbar: {`). This is the documented SYS-1 scope-drift baseline (MEDIUM) — peers toggle/dialog/popover drift identically (scope omits 'eidos' despite eidos dirs), while button.ts:47/accordion.ts:7/checkbox.ts:7 correctly declare ['soma','sema','eidos']. Severity MEDIUM is correct.
- fix-status: fixed (212624e0)

## No-findings dimensions
B, C, D, E, E-bis, F

## Theming facts (E-bis)
- magic z-index: none
- magic literals: none
- undeclared parts: none
- roles clean: true · variants clean: true

## Tests (F)
- exists: true · env: jsdom
- covers: roving tabindex and keyboard navigation (ArrowRight, ArrowLeft, Home, End); group item toggle single/multiple; focusin event tracking; disabled state cascade; separator orientation projection
- untested: 

## Style observations (non-blocking)
- A35 fix verified: isTabStop() uses untrack() at line 86 to prevent dependency loop — fix is in place and documented
- No A36 async/microtask patterns found
- No A6 timers or listeners requiring disposal
- Roving focus via direct property assignment (no $effect), no cascading updates
- commit-toggle event correctly uses sequence: 'post' (state written before trigger)