# Audit: progress
audit-version: 1
audited-at: 2026-06-26
scope:   (SCOPE-DRIFT → SYS-1)
method: adversarially-verified workflow; HIGH lead-verified. B7 ground-truth: Toolbar A35 + Form A36 incidents STAYED FIXED (untrack present); toast/clipboard/drag-drop use uix.timers (no A6 leak); button is clean (its archetype finding was inert — Spinner not runtime-registered); data-size/data-shape are eidos visual attrs (not contract violations).
provider: G:\dev\svelte\vicen\src\uix\soma\components\progress\progress-provider.svelte.ts
cleanup-audit (A6/A35/A36): A6 cleanup audit: Zero timers, observers, listeners. No setTimeout, setInterval, ResizeObserver, IntersectionObserver, MutationObserver, addEventListener in soma/components/progress. Test uses $effect.root() with proper disposer cleanup (line 21-24 captured, line 126 cleanup called, line 127 dom.dis

## Summary
Counts (post-verification): CRITICAL 0 · HIGH 0 · MEDIUM 1 · LOW 0.

## Findings
### MEDIUM: SYS-1 scope-drift: morfo scope[] must include 'eidos' when an eidos recipe + component dir — PROGRESS-SCOPE-1   <!-- id: PROGRESS-SCOPE-1 -->
- dimension: A
- rule: SYS-1 scope-drift: morfo scope[] must include 'eidos' when an eidos recipe + component dir exist for the component.
- location: src/uix/morfo/components/progress.ts:7
- evidence: `scope: ['soma'],` — yet a full eidos recipe exists at src/uix/eidos/lib/recipes/base.ts:1799 (`progress: { 'height-xs': ... }`) plus a complete eidos component dir (src/uix/eidos/components/progress/{progress.svelte,progress.css,types.ts}). Compare button.ts:`scope: ['soma','sema','eidos']`, spinner.ts/skeleton.ts:`scope: ['eidos']` — all eidos-backed components declare 'eidos'.
- impact: The morfo contract under-declares the component's real consumer layers; any tooling that walks `scope` to know which layers materialize a component (lint/coverage/codegen) will skip eidos for Progress even though eidos owns its size/shape visual surface. Same drift class as meter.ts (also `['soma']`), so it is a shared B7-family systemic issue, not a one-off.
- proposed-fix: Add 'eidos' to the scope tuple: `scope: ['soma', 'eidos']`. (No 'sema' — Progress declares no events, expression is none/passive, which is correct.)
- verify: [verifier-added] added by adversarial verify pass
- fix-status: fixed (212624e0)

## No-findings dimensions
A_contract, B_behavior, C_dom_selector, D_frontier, E_theming, F_tests, G_redundancy

## Theming facts (E-bis)
- magic z-index: none
- magic literals: none
- undeclared parts: none
- roles clean: true · variants clean: true

## Tests (F)
- exists: true · env: jsdom
- covers: Provider state transitions (indeterminate, loading, loaded); Value/min/max/orientation ARIA/data attributes; Label id registration and aria-labelledby wiring; ValueText snippet props and default text generation; Indicator state inheritance; Vertical orientation support
- untested: