Accuracy first. Measured performance. Explicit uncertainty.

wcag111, wcag244 · critical

1.1.1-area-alt.js:9. Unused maps still fail (measured); must find associated rendered image and exposed active area.

Primary reference

wcag111 · moderate

1.1.1-canvas-alt.js:23-43. Correctly reviews roleless graphics; tiny canvas and fallback text heuristics can miss meaningful content. Raw fallback text can include hidden text.

Primary reference

wcag111 · serious

1.1.1-embed-alt.js:25-38. Document type demotion sensible. Nameless unknown resource fails without knowing resource type or whether actual non-text content is presented. Need resource/error/decorative cases; no measured defect in this branch.

Primary reference

wcag111 · critical

1.1.1-image-alt.js:24-25. Focusable role=presentation img passes although browser exposes unnamed image (measured). Generic/filename alternatives appropriately reviewed.

Primary reference

wcag111, wcag412 · critical

1.1.1-input-image-alt.js:13. Default Submit name is measurable, so message claiming it cannot describe this action overstates evidence when actual action is submission. Requires content/context test before classifying as false positive.

Primary reference

wcag111 · serious

1.1.1-object-alt.js:16. Raw textContent permits hidden or script fallback, and no successful resource check. Document demotion follows embed. Needs render-level tests.

Primary reference

wcag111 · serious

1.1.1-svg-img-alt.js:31. svg role=img containing only text returns helper name Chart/pass although CDP image itself is unnamed. Child text is present in AX, so accessible graphic quality requires context; name claim is definitely wrong. role=image/fallback strings missed.

Primary reference

wcag121 · serious

1.2.1-audio-transcript.js:35-44. Review-only is appropriate. Custom unmute controls can make muted/no-controls assumption false; video-only/live distinctions remain manual.

Primary reference

wcag122 · critical

1.2.2-media-captions.js:11,54. Caption-track presence passes even failed/empty resource; custom unmute missed. Missing captions correctly review rather than assertion.

Primary reference

wcag131 · critical

1.3.1-aria-required-children.js:109. Hidden listitem satisfies required content while visible stray text remains. Exact selectors miss fallback roles. Ownership is intentionally broad; this does not verify real required ownership.

Primary reference

wcag131 · critical

1.3.1-aria-required-parent.js:58,74. Measured valid fallback parent list fails. Flat-tree slots handled better than global visibility but parent semantics are independently reimplemented.

Primary reference

wcag131 · serious

1.3.1-definition-list.js:18,43. All role-bearing dl excluded, including empty/invalid role retaining native semantics. Wrapper validity is equated with guaranteed relationship loss without browser evidence for each shape. Slotted dl pairs likely fail wrapper check; unprobed.

Primary reference

wcag131 · serious

1.3.1-dlitem-parent.js:9,23. Any ancestor DL passes regardless of replaced role or intervening semantics. Explicit unknown role on orphan item skips. Composed ancestor support is a strength.

Primary reference

wcag131, wcag332, wcag412 · critical

1.3.1-form-label.js:45-61. Measured CSS-generated visible label missed. Own accessible-text implementation drifts from shared helper and browser algorithm.

Primary reference

wcag131 · serious

1.3.1-list-structure.js:63-68. Measured focusable role=none LI retains listitem but fails. Uses raw role rather than effective role.

Primary reference

wcag131 · serious

1.3.1-listitem-parent.js:11,45. Good role-token fallback on container, inconsistent exclusion for role-bearing LI; unknown role on orphan LI silently skips. Wrapper whitelist needs effective-role / display:contents coverage.

Primary reference

wcag131 · serious

1.3.1-p-as-heading.js:11-22. Narrow evidence, review-only with explicit human condition. Misses CSS bold/plain text heading styles by design.

Primary reference

wcag131 · serious

1.3.1-table-headers.js:68,79,92. Measured layout-table assertion and plain TD header-reference pass.

Primary reference

wcag132 · moderate

1.3.2-reading-order-divergence.js:32-70. Review-only preserves verdict discipline. Grid placement, vertical writing and nested wrappers outside scope.

Primary reference

wcag134 · serious

1.3.4-orientation.js:40,84. Two measured ineffective CSS declarations still fail.

Primary reference

wcag135 · serious

1.3.5-autocomplete-valid.js:99-110. Measured non-personal search wrongly included in criterion scope. No missing-purpose branch; grammar only.

Primary reference

wcag141 · serious

Descendant glyph colour differs from anchor colour: false violation. Invisible background cue: false pass. src/engine/rules/wcag/1.4.1-link-in-text-block.js:208,179

Primary reference

wcag142 · critical

Correct review-only discipline for custom controls/audio-track uncertainty, <=3s exemption and looping. src/engine/rules/wcag/1.4.2-audio-control.js:25. Script-started media and Web Audio remain outside the declared selector.

Primary reference

wcag143 · serious

Measured own-filter and first-line false violations, translucent-image false pass. src/engine/rules/wcag/1.4.3-color-contrast.js:592,962; lib/contrast.js:901,1270

Primary reference

wcag143 · serious

Three independent measured false violations: background image, group opacity, text fill. src/engine/rules/wcag/1.4.3-control-contrast.js:62,88,97

Primary reference

wcag144 · critical

Definitive failure ignores an available G178 text-resize mechanism. src/engine/rules/wcag/1.4.4-meta-viewport.js:19

Primary reference

wcag146 · serious

Factory shares the main rule's paint and pseudo-candidate defects. src/engine/rules/wcag/1.4.6-contrast-enhanced.js:5. AAA derivation source-verified, not separately browser-run. Control text remains excluded from this AAA rule and has no AAA counterpart.

Primary reference

wcag1410 · moderate

Review-only geometry is appropriately cautious; wording incorrectly guarantees desktop overflow worsens at 320px. src/engine/rules/wcag/1.4.10-reflow.js:23. No mobile viewport or horizontal-writing-mode test.

Primary reference

wcag1411 · serious

Snug wrapper passes on presence of any painted border without checking its contrast. src/engine/rules/wcag/1.4.11-non-text-contrast.js:117. Field-only scope is disclosed; graphics and state indicators not examined.

Primary reference

wcag1412 · serious

Shadow styles can defeat document-only probe, yet result passes. 20,000-candidate cutoff also returns pass without probing. src/engine/rules/wcag/1.4.12-text-spacing.js:47,63. Review verdict for uncertain ink clipping is sound.

Primary reference

wcag211, wcag213 · serious

Source: src/engine/rules/wcag/2.1.1-scrollable-region-focusable.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/keyboard.html

Negative tabindex and no tabbable descendants do not prove keyboard inoperability. External keyboard-operable scroll buttons or scripted focus are valid alternatives. Original full-engine reproduction scroll-with-keyboard-buttons fails despite two working native buttons. The other branch appropriately reviews browser-dependent auto-focus. Sources: 2.1.1 evaluate lines91-109; DOM isInert helper inspected.

Primary reference

wcag221 · critical

Source: src/engine/rules/wcag/2.2.1-meta-refresh.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/timing-adjustable.html

Delay parser handles malformed refresh syntax and >20h carefully. But all positive delays <=20h are asserted without observing prior user adjustment, a mechanism or a real-time/essential exception. This is a scope risk, not a confirmed working cancel-control reproduction. Do not use the experimental remove-meta button as proof: removing a scheduled meta directive may not cancel the browser navigation. Missing tests for a time limit explicitly adjusted before entering this page.

Primary reference

wcag222 · serious

Source: src/engine/rules/wcag/2.2.2-pause-stop-hide.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/pause-stop-hide.html

Full-engine reproductions confirm static BLINK and stopped MARQUEE with real Pause button still assert at lines120-130. Motion, duration, parallel content, controls and essentiality are not established in this tag branch. CSS animation branch appropriately reviews; finite animations >5s are a disclosed-or-undisclosed missed family, since only Infinity iterations considered.

Primary reference

wcag222 · serious

Source: src/engine/rules/wcag/2.2.2-video-loop-motion.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/pause-stop-hide.html

Correctly asks for review rather than asserting a missing arbitrary script control; native controls and actually paused videos are accepted. An aria-controls button proves only association, not pause behavior, so the pass branch can suppress a genuine missing-control review. Tiny video exception is a noise policy, not a WCAG size threshold.

Primary reference

wcag233 · moderate

Source: src/engine/rules/wcag/2.3.3-reduced-motion.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/animation-from-interactions.html

Review-only avoids false violations. Any prefers-reduced-motion occurrence anywhere silences all motion, even an empty or unrelated media block. Arbitrary 8px/15% filters and first-five-subject sample intentionally miss some motion; report scope as heuristic. CSSOM scans can repeat queries/style reads.

Primary reference

wcag241 · serious

Source: src/engine/rules/wcag/2.4.1-bypass-blocks.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/bypass-blocks.html

Full-engine four-colour-buttons reproduction fails at lines79-85, although a one-page colour picker contains no repeated blocks. Four controls prove neither repetition across pages nor a header to skip. Existing tests pin this assumption. Also any heading/landmark, including hidden or irrelevant ones, is accepted without proving bypass of the repeated block.

Primary reference

wcag242 · serious

Source: src/engine/rules/wcag/2.4.2-document-title.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/page-titled.html

Missing title is demonstrable; placeholder meaning is not. Full engine falsely fails title Document title on documentation whose h1 and topic are Document title. Same risk for artworks literally named Untitled 1. Placeholder assertion at lines62-67 should be review under the requested precision policy.

Primary reference

wcag243 · moderate

Source: src/engine/rules/wcag/2.4.3-visual-order-divergence.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/focus-order.html

Review-only and narrow direct flex/grid siblings are appropriately cautious. Does not account for CSS reading-flow/new focus ordering or positive tabindex, and disabled-fieldset descendants may enter tabbable() because it reads element.disabled rather than :disabled. Vertical writing modes are not modeled. These affect review accuracy, not certain violations.

Primary reference

wcag244, wcag412 · serious

Source: src/engine/rules/wcag/2.4.4-link-name.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-in-context.html

Within modeled name-presence scope, role routing and unknown-role implicit fallback are sound. Depends on simplified accessibleName helper, whose coverage is audited separately. Missing names tagged both2.4.4 and4.1.2 are stronger under4.1.2; contextual purpose can satisfy2.4.4, so avoid interpreting each tag as independently demonstrated.

Primary reference

wcag244 · moderate

Source: src/engine/rules/wcag/2.4.4-link-text-generic.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-in-context.html

Review verdict correctly admits surrounding context. Missing effective-role filter means role=button anchors are incorrectly reviewed as links. English/French phrase list is bounded heuristic, not semantic proof. Existing2 cases are thin relative to localization and role routing.

Primary reference

wcag247 · serious

Source: src/engine/rules/wcag/2.4.7-focus-visible.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/focus-visible.html

Review-only declaration scan is conservative about certainty. Inactive media rules can both create suspects and falsely restore them; any box-shadow/background declaration is treated as replacement even none/transparent/unchanged. Shadow/adopted stylesheets not covered. Genuine computed-focus browser checks would add confidence without broadening assertions prematurely.

Primary reference

wcag249 · moderate

Source: src/engine/rules/wcag/2.4.9-link-text-generic-only.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-link-only.html

Full-engine role=button Show more anchor falsely fails link-purpose at createLinkPurposeRule evaluate lines87-96. Also a working Show descriptive link names button satisfies the SC mechanism allowance but Read more is still failed. Phrase meanings can be proper names in any language; current Go/Plus exceptions are not exhaustive. F84 specifically requires absence of a mechanism, unlike this rule.

Primary reference

wcag2411 · serious

Source: src/engine/rules/wcag/2.4.11-focus-not-obscured.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/focus-not-obscured-minimum.html

Review-only is appropriate for a snapshot. Only2 dedicated cases. Document-wide any visible role=dialog/open dialog suppresses even a nonmodal dialog and all unrelated obstruction findings. Alpha parser assumes opaque for modern colour syntax it cannot parse. Tests needed for nonmodal dialogs, opaque descendants of transparent overlays, shadow focusables and inactive popovers.

Primary reference

wcag255 · serious

Source: src/engine/rules/wcag/2.5.5-target-size-enhanced.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/target-size-enhanced.html

Shares target geometry and external-equivalence/essentiality gaps with target-size; disabled targets incorrectly considered. Largest-area uncovered slab can fail despite another adequate square. UA-sized native controls and no-spacing AAA distinction are useful. 8 dedicated cases do not exercise shared adversarial geometry independently at44px.

Primary reference

wcag257 · moderate

Source: src/engine/rules/wcag/2.5.7-drag-alternative.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/dragging-movements.html

Review-only scoped to explicit draggable attributes avoids speculative violations. Blanket exclusion of img and a[href] also misses authored drag/drop interactions built from native-draggable images/links, not merely their browser default. Pointer-event-only interactions are disclosed as unobservable.

Primary reference

wcag258 · serious

Source: src/engine/rules/wcag/2.5.8-target-size.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/target-size-minimum.html

Confirmed three independent failure families: disabled controls fail; adequate equivalent native buttons ignored because only matching href proves equivalence; largest-area uncovered slab rejects an intact24x50 strip. Unmeasured essential/legal presentation exceptions still asserted. Shape/clip/opacity/label-union approximations also create false passes. Small-target spacing tests every other target with elements.some(crowds), a quadratic workload despite spatial hash for the separate overlap branch.

Primary reference

wcag311 · serious

Source: src/engine/rules/wcag/3.1.1-html-lang.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/language-of-page.html

Missing/empty language is a sound check; regex is only tag shape and accepts unregistered primaries such as zz and malformed extension structure. Does not verify language matches prose, which is appropriately outside reliable static inference. Only2 dedicated cases for BCP47 parsing.

Primary reference

wcag312 · serious

Source: src/engine/rules/wcag/3.1.2-valid-lang-parts.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/language-of-parts.html

Zero dedicated cases. Same loose BCP47 regex; lang empty means language unknown, not reset to page language as comment claims. A malformed tag on a part whose text already matches inherited language does not necessarily prove wrong language exposure. Missing changes in unmarked foreign passages are a disclosed conceptual gap.

Primary reference

wcag322, wcag321 · serious

Source: src/engine/rules/wcag/3.2.2-on-input-navigation.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/on-input.html

Review verdict correctly distinguishes handler source from executed navigation and prior warning. Only inline handlers are observable; regex can match comments/strings or conditional code, but uncertainty is appropriately disclosed. Eight focused cases pin read-vs-write and event selection.

Primary reference

wcag331 · serious

Source: src/engine/rules/wcag/3.3.1-error-message-linkage.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/error-identification.html

Uses review rather than violation for missing programmatic linkage, correctly acknowledging visible adjacent error text can satisfy3.3.1. Empty/hidden/dangling targets and invalid-state inertness handled. Unrecognized nonfalse aria-invalid tokens absent aria-errormessage are outside selector; error text relevance still requires human review.

Primary reference

wcag337 · moderate

Source: src/engine/rules/wcag/3.3.7-redundant-entry.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/redundant-entry.html

Review-only correct because confirmation, security, stale values and different people may justify repeated fields. Prefilled editable duplicate fields still get review, although re-entry may not be required; disabled fieldsets not modeled with :disabled. Only within-form descendants, not controls associated via form= or cross-page process.

Primary reference

wcag338 · serious

Source: src/engine/rules/wcag/3.3.8-auth-field-obstruction.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-minimum.html

Full engine fails a password input with autocomplete=off and onpaste=if(false) event.preventDefault(), although paste cancellation does not execute. Regex at41 cannot prove behavior; off does not prove password managers blocked; adjacent email+one password does not establish existing-user login; alternatives are ignored. Assertion at57-63 should require real evidence or remain review.

Primary reference

wcag412 · moderate

4.1.2-aria-allowed-attr.js:63-74. Review-only discipline sound, but unknown role and unsupported new role return pass; blanket message browser drops property may oversimplify browser behavior.

Primary reference

wcag412 · critical

4.1.2-aria-attr-valid.js:29,75-85. Unknown current/invalid tokens and undefined current are rejected; state fallback exists. Numeric and relevant token-list validity not covered.

Primary reference

wcag412 · serious

4.1.2-aria-field-name.js:14-18,36. Measured native labelled meter rejected. Old combobox exemption checks mere label/ref presence, not resolved name.

Primary reference

wcag412 · serious

4.1.2-aria-hidden-focus.js:30-37. Role/query walk does not cross shadow descendants. Opacity-zero elements intentionally pass even though keyboard/AT mismatch remains possible. Script focus guards unmeasured.

Primary reference

wcag412 · moderate

4.1.2-aria-label-misuse.js:66-84. Review-only justified. Exact role selectors and light-DOM content ancestor can add noise on slots.

Primary reference

wcag412 · moderate

4.1.2-aria-valid-refs.js:129-132. Measured dormant error reference assertion. Broader broken-ref policy needs distinction from syntax errors.

Primary reference

wcag412 · critical

4.1.2-button-name.js:11,22. Shared name computation gives three confirmed false asserts, one false pass; exact fallback selectors miss controls.

Primary reference

wcag412 · serious

4.1.2-composite-widget-name.js:22. Correct role ownership, but exact selectors and shared name defects apply.

Primary reference

wcag412 · serious

4.1.2-dialog-name.js:18-20. Exact roles miss fallback; native dialog with semantic override still judged as dialog. Shared labelledby hidden logic applies.

Primary reference

wcag412 · serious

4.1.2-frame-title.js:11. Direct title/ARIA path sound; global inert and shared labelledby problems apply. No frame-resource distinction in rule.

Primary reference

wcag412 · serious

4.1.2-invoker-target.js:31,66. Measured static paragraph blamed as button. Event interception, disabled controls and reflection-target cases need coverage.

Primary reference

wcag412 · serious

4.1.2-label-for-valid.js:44-46. Measured independently named child falsely asserted as missing relationship/name. Broken for alone does not prove 4.1.2 failure.

Primary reference

wcag412 · serious

4.1.2-nested-interactive.js:65. Both native and ARIA outer buttons containing link fail while both names/roles remain in Chromium AX. This does NOT establish cross-AT conformformance; blanket critical claim needs stronger evidence and keyboard/AT study, likely review outside demonstrable lost-role cases.

Primary reference

wcag412 · serious

4.1.2-role-required-aria.js:76-87. Missing heading level fails despite measured AX level2; whether intended level is wrong is unknown. Negative tabindex separator treated non-focusable; exact role strings miss fallbacks. Distinguish strict ARIA requirement from actual 4.1.2 harm.

Primary reference

wcag412 · serious

4.1.2-summary-name.js:22-25. Correctly isolates first summary; shared descendant-generated/name faults still apply.

Primary reference

wcag412 · critical

4.1.2-valid-role.js:119. Native named button typo wrongly asserted. Prefix acceptance admits arbitrary doc-* and graphics-* roles as valid.

Primary reference

Best practice · serious

Source: src/engine/rules/best-practice/accesskeys.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/character-key-shortcuts.html

Zero dedicated cases. Treats whole accesskey string as one key, though HTML defines an ordered set of space-separated candidate keys. Fails duplicate empty values that assign no key; misses overlaps among different lists. visibleOnly false also compares nonusable controls. Advice only, no WCAG tags.

Primary reference

Best practice · minor

Source: src/engine/rules/best-practice/button-type.js:1. Primary reference: https://html.spec.whatwg.org/multipage/form-elements.html#attr-button-type

Correctly accepts sole implicit submit button. Multiple legitimate submit buttons still get style advice; not a WCAG violation. Current HTML Auto state and command/popover invocation exceptions require review because unconditional submitting prose may be wrong. External form-associated controls and named-property clobbering need tests.

Primary reference

Best practice · minor

Source: src/engine/rules/best-practice/empty-heading.js:1. Primary reference: https://www.w3.org/WAI/tutorials/page-structure/headings/

Zero dedicated cases. Checks raw role string, unlike effectiveRole helper: unknown or fallback roles can silently skip real headings. Name helper dependencies apply; advisory heading-name criterion is not taggedWCAG.

Primary reference

Best practice · moderate

Source: src/engine/rules/best-practice/fieldset-legend.js:1. Primary reference: https://www.w3.org/WAI/tutorials/forms/grouping/

Confirmed separate idless forms with single same-name checkboxes are merged into one nonexistent group because key uses element.form.id, not form identity, at18. First control's nearest group alone also need not contain remaining controls. Group identity should include tree/form object and actual memberships.

Primary reference

Best practice · moderate

Source: src/engine/rules/best-practice/heading-order.js:1. Primary reference: https://www.w3.org/WAI/tutorials/page-structure/headings/

Sound as best-practice advice, not WCAG assertion. Effective roles modeled, but aria-level parseInt accepts malformed partial numbers and slot/shadow order can differ from registry query order. Skipped levels are not universally usability failures; message is stronger than evidence.

Primary reference

Best practice · moderate

Source: src/engine/rules/best-practice/landmark-one-main.js:1. Primary reference: https://www.w3.org/WAI/ARIA/apg/practices/landmark-regions/

Visible shadow-root counting is useful. Native main elements overridden with another role still counted, and nested document/application scope not separated. These are best-practice findings only.

Primary reference

Best practice · moderate

Source: src/engine/rules/best-practice/landmark-top-level.js:1. Primary reference: https://www.w3.org/WAI/ARIA/apg/practices/landmark-regions/

Handles unnamed forms and contextual aside/header/footer cases. Raw role parsing and parentElement walk miss fallback roles and shadow ancestors; overridden native main/header elements can be mislabeled. APG allows main within nested document/application contexts, so absolute direct-body remedy is too broad.

Primary reference

Best practice · moderate

Source: src/engine/rules/best-practice/landmark-unique.js:1. Primary reference: https://www.w3.org/WAI/ARIA/apg/practices/landmark-regions/

Full-engine identical labeled pagination navs produce failures, contrary to APG explicit advice to give identical nav links the same label. Singleton grouping also ignores nested document/application contexts. Distinguish duplicates with same purpose/content from genuinely ambiguous landmarks.

Primary reference

Best practice · minor

Source: src/engine/rules/best-practice/multiple-labels.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/labels-or-instructions.html

Zero dedicated cases. HTML permits multiple labels; this is only advisory and correctly untaggedWCAG. Claim that screen readers differ needs current empirical evidence. Hidden-label accname behavior is more nuanced than visibleLabels filter.

Primary reference

Best practice · minor

Source: src/engine/rules/best-practice/new-window-link.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Techniques/general/G201

English-only warning regex and target=blank may misstate behavior; named blank context can reuse an existing window, and English wording outside the regex can warn adequately. Description targets included and nonEnglish cases review. Warnings are not a universal WCAG requirement; tags correctly best-practice.

Primary reference

Best practice · minor

Source: src/engine/rules/best-practice/no-autofocus.js:1. Primary reference: https://html.spec.whatwg.org/multipage/interaction.html#the-autofocus-attribute

Review-only and native dialog/popover exemption avoid a false violation. Message says HTML allows only when control is main purpose, which overstates nonnormative caution; soften advisory wording. ARIA dialog presence alone does not create native autofocus scoping.

Primary reference

Best practice · moderate

Source: src/engine/rules/best-practice/page-heading-one.js:1. Primary reference: https://www.w3.org/WAI/tutorials/page-structure/headings/

Includes open shadow roots and aria-level. However no visibility/effective-role filter means hidden or demoted h1 satisfies the check even with no exposed level1 heading. Only presence is checked though help says start outline.

Primary reference

Best practice · serious

Source: src/engine/rules/best-practice/positive-tabindex.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/focus-order.html

Zero dedicated cases. Appropriate as opt-in advice but positive tabindex can preserve meaningful operation; never surface as WCAG failure. parseInt accepts malformed strings, so must follow actual HTML integer parsing if expanded.

Primary reference

Best practice · minor

Source: src/engine/rules/best-practice/redundant-alt-phrase.js:1. Primary reference: https://www.w3.org/WAI/tutorials/images/tips/

Narrowed prefix matching avoids some damaging fixes. An icon's medium or an artwork's title may still legitimately begin Icon/Image of. Best-practice advisory rather than certain bad alt text; avoid automatic replacement.

Primary reference

Best practice · minor

Source: src/engine/rules/best-practice/redundant-aria.js:1. Primary reference: https://www.w3.org/TR/using-aria/#rule2

Zero dedicated cases. Presence-only comparison treats aria-required=false plus required as duplicate, not conflicting; dynamic native checked attribute vs checked property can diverge. Advice to remove may be fine but claim of equivalence is unproven. State-specific tests needed.

Primary reference

Best practice · minor

Source: src/engine/rules/best-practice/redundant-aria-label.js:1. Primary reference: https://www.w3.org/TR/using-aria/#rule2

Conservative gates for name-from-content, hidden children, image alts and pseudo text are useful. Raw DOM text vs actual name still differs for nested accessible names and slots. Walk makes2 pseudo-style reads per descendant plus computed style, costly on large matched containers.

Primary reference

Best practice · minor

Source: src/engine/rules/best-practice/redundant-image-alt.js:1. Primary reference: https://www.w3.org/WAI/tutorials/images/functional/

Correctly keeps sole naming alternative and handles title fallback. Does not inspect overriding aria-label/labelledby on image or parent link; says duplicate is announced when an explicit control name suppresses descendant text. ExposedText duplicates part of accname algorithm and can drift.

Primary reference

Best practice · minor

Source: src/engine/rules/best-practice/redundant-role.js:1. Primary reference: https://www.w3.org/TR/using-aria/#firstrule

Useful explicit exceptions for markerless lists, SVG images and CSS table semantics. Raw first role token and model-dependent native roles leave gaps; browser-dependent semantics claims should stay validated across engines. Advice only, notWCAG.

Primary reference

Best practice · minor

Source: src/engine/rules/best-practice/redundant-tabindex.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/focus-order.html

Zero dedicated cases. Summary element is not natively focusable unless first summary in details; standalone summary tabindex=0 creates focus and must not be removed as redundant. Disabled native controls and user-agent focus preferences complicate blanket prose.

Primary reference

Best practice · moderate

Source: src/engine/rules/best-practice/region.js:1. Primary reference: https://www.w3.org/WAI/ARIA/apg/practices/landmark-regions/

Deduplicating one per branch reduces output cost. Landmark selector disagrees with effective-role model, hidden/unlabeled/overridden landmarks and shadow roots; root doc.querySelector can miss shadow-only landmarks. Absolute claim regions-only users never reach stray content is overstated.13cases but cross-root variants still needed.

Primary reference

Source: src/engine/rules/wcag/2.5.3-label-in-name.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/label-in-name.html

PARKED by explicit historical product decision, confirmed rules/index.js:20-27; SC2.5.3 remains on manual checklist. Zero dedicated behavior cases for maintained parked implementation. Digits-only visible labels are excluded by HAS_LETTERS, missing mismatched numbered pagination or calculator controls. Visible content ignores images of text, generated text, shadow-root text at the control itself; punctuation folding and concatenation can alter word boundaries. No live-engine behavior conclusion: hidden-label/dynamic-value runs had no registered label-in-name rule. Direct helper/source judgments only; do not reactivate without a deliberate decision.

Semantic engine audit, 2026-09-12

Scope: all 37 rule files beginning 1.1, 1.2, 1.3 or 4.1, read in full. Also read accessible-name.js, dom.js, roles.js, the runner, visual-order-divergence.js, and cumulativeOpacity's implementation. No competitor implementation was inspected. PROVENANCE.md and spec-sweep instructions were read. This is a read-only audit, with original temporary browser probes; no shipping source changed.

Evidence: pour-semantics-probe.mjs builds the actual source rules using esbuild, then invokes their evaluate methods in Chromium, with real selectors and the runner's visibility applicability check. pour-semantics-probes.json contains 30 cases, HTML, actual outcome, applicability, and Chromium CDP Accessibility.getFullAXTree output. These are focused rule probes, not the full runner or full regression suite. The extra Playwright ariaSnapshot field is NOT authoritative: it synthesizes roles and incorrectly shows inert content and layout tables. Use axNodes from CDP. Independent full-engine confirmations are recorded in evidence/confirmed-semantics.json; scope cautions below remain applicable.

Highest priority findings

1. Name computation reports named controls as nameless, and misses unnamed controls

src/engine/lib/accessible-name.js:67 uses raw label.textContent; :189 recurses descendants without their own generated content or aria-labelledby; :154 includes all hidden descendants whenever inside any labelledby traversal. Browser probes confirm:

• generated-child-name: <style>.label::before{content:"Save"}</style><button id="test"><span class="label"></span></button> yields button-name fail, CDP button name Save.
• descendant-ref-name: <span id="label">Save</span><button id="test"><span aria-labelledby="label"></span></button> yields fail, CDP name Save.
• label-image-name: <label for="test"><img alt="Save" src="icon.svg"></label><button id="test"></button> yields fail, CDP name Save.
• label-hidden-child-ref: <span id="label"><span hidden>Save</span></span><button id="test" aria-labelledby="label"></button> yields pass, engine name Save, CDP empty name.

These affect every rule sharing the helper. Repair the recursive traversal, with a visited/context model and browser-backed cases, before tightening individual name rules. Accessible Name Computation.

2. AT visibility fails to exclude inert subtrees

src/engine/lib/dom.js:47 checks aria-hidden and rendering, but never inert. Probe inert-name (<div inert><button id="test"></button></div>) is applicable and fails button-name despite no button in CDP AX. A global semantic visibility correction would improve several rules at once. Keep visual checks separate: inert content remains visible. The existing isInert helper also needs proper assigned-slot traversal. HTML inert subtrees.

3. Role handling is inconsistent across rules

aria-required-parent lines 58 and 74 uses the first written role token, whereas roles.js has a separate effective-role model. Probe required-parent-fallback: <div role="bogus list"><div id="test" role="listitem">First</div></div> fails despite AX list/listitem. list-structure:63 counts literal role=none as neutralised even when presentation is discarded: <ul id="test"><li role="none" tabindex="0">One</li></ul> fails despite AX listitem. Both confirmed.

Exact-match selectors also silently miss legal fallback strings: <div role="unknown button"></div> has an unnamed button in AX but does not match button-name's selector. Probe reports applies=false, not an engine fail. Many ARIA rules share this selector issue. effectiveRole:240 itself returns null for wholly unrecognised explicit roles instead of native fallback. ARIA role error handling.

4. Orientation raw CSS is mistaken for effective restriction

1.3.4-orientation.js:40-56,84 scans declarations without cascade or active ancestor condition evaluation. Two measured false assertions:

<style>@media (orientation:landscape){body{display:none}body{display:block}}</style>
<p>Visible in either orientation</p>

<style>@supports (display:completely-invalid){@media (orientation:landscape){body{display:none}}}</style>
<p>Always visible</p>

Both fail; both render and are exposed in AX. Essential-orientation exceptions also cannot be disproven from this selector alone. Use review unless effective restrictions in both orientations are demonstrated. SC 1.3.4.

5. Attribute validation and actual accessibility failure are conflated

• valid-role:119: <button id="test" role="buton">Save</button> fails; CDP still exposes named, focusable button Save. The native role survives. This is an authoring defect, not established 4.1.2 failure.
• aria-attr-valid:75-85: arbitrary aria-current="chapter" and aria-invalid="custom" fail. The ARIA token fallbacks preserve truth states; CDP confirms invalid=true for the latter. aria-current="undefined" is also explicitly false under the spec, but rejected by this enum.
• aria-valid-refs:129-132: <input aria-label="Email" aria-invalid="false" aria-errormessage="error"> fails despite a dormant error reference. AX has named, valid textbox. Missing controls/details/owns similarly need harm-sensitive handling.

ARIA current, ARIA invalid, ARIA errormessage.

6. Table heuristic asserts on navigation layout, while weak reference checks miss actual defects

table-headers:92 fails a 2x2 table of four independent navigation links; CDP classifies it LayoutTable. No label/value relationship exists. The suggested first-column row-header fix would change the meaning. HTML and source in probe layout-table.

table-headers:68 explicitly permits TD reference targets and :79 treats mere scope/headers presence as evidence of headers. table-nonheader-reference passes a headers attribute targeting a plain TD. CDP exposes only cells, no headers. HTML header-assignment behavior needs further validation before claiming the exact user-facing loss, but the source contradicts its own message requiring header cells. F91, Info and Relationships.

7. Several additional direct false assertions

• aria-field-name:14-18,36: native <meter role="meter"> with ordinary associated label fails, although CDP says meter Progress. This branch only accepts ARIA/title and ignores native labels.
• form-label:45-61: CSS-generated label text is missed. <style>label::before{content:"Email"}</style><label for="test"></label><input id="test"> fails, CDP textbox Email.
• area-alt:9-14: unused map areas are checked despite no associated image or AX presence. Probe map-unused fails an unused <map><area href=...></map>.
• invoker-target:31,66: <p popovertarget="missing">Static paragraph</p> fails as if it were a button. Scope the rule to invoker-capable controls, then distinguish functional faults from 4.1.2 evidence.
• label-for-valid:44-46: <label for="missing">Email<input aria-label="Email"></label> fails despite the independently named textbox and visible matching caption. A broken association does not prove missing name.
• autocomplete-valid:99-110: Search products with autocomplete=disabled fails 1.3.5, although product searches do not collect a listed purpose about the user. Invalid autocomplete is not enough to establish applicability.

HTML naming, HTML invokers, SC 1.3.5, F107.

Per-rule inventory and rating

Ratings describe the implemented rule and shared dependencies, not complete criterion coverage. SOLID does not mean proof of perfect accuracy. MINOR-GAPS includes narrow disclosed coverage; OVER-FLAGS requires direct or shared demonstrated false-assertion risk; UNDER-TESTS signals a demonstrated/sourced miss; WEAK combines over- and under-reporting in important paths.

Performance opportunities from source, not yet measured

• aria-valid-refs:86 does querySelectorAll for every reference to count duplicate IDs. Build a per-root ID index once per audit to remove repeated full-root selector scans and share it with name resolution.
• Required-children traverses entire descendant trees for each matching composite. Deep nested structures can repeat work. Resolve composed ownership once per root rather than per rule/element, while retaining context and hidden state.
• Name recursion is repeated across rules and overlapping ancestors. Correctness must precede caching. Per-audit context-sensitive caching can help, but avoid caching across yielded DOM mutations without invalidation.
• Reading-order checks read textContent for every flex/grid child's complete subtree; nested flex layouts can repeat deep traversal. Profile on a deep original fixture before optimizing.
• Improve role and visibility reuse. Today each rule implements small inconsistent approximations, creating both repeated work and accuracy drift.

Manual criteria in assigned families

1.1.1 meaningfulness/equivalence cannot be determined by text presence. 1.2 transcript/caption quality, synchronization, live/prerecorded and audio description require listening/viewing; media metadata can safely identify candidates. 1.3.1 real visual relationships and 1.3.2 meaningful order remain context dependent; rendered geometric probes can only nominate review. 1.3.3 sensory instructions can be searched linguistically but false alarms are high without task context. 1.3.4 can be tested in isolated alternate-orientation snapshots, but essential exceptions need a human. 1.3.5 missing personal-purpose candidates can be reviewed without asserting from vague field names. 1.3.6 purpose beyond input autocomplete needs role/content interpretation. 4.1.3 status announcements require observing controlled interaction and live-region changes; mere live-region presence cannot establish announcement success.

Recommended order: shared name computation and visibility, effective-role routing, false-assertion exceptions, then coverage expansion. Each behavior change needs original adversarial cases and same-DOM differential results. No claim of zero false positives is supported by the present implementation or this finite audit.

Engine interaction and best-practice audit

Date: 2026-09-12. Read-only audit of all 23 principle2/3 source files (22 active, label-in-name parked) and all 20 best-practice rules. Each assigned source was read in full, plus dom.js, roles.js, accessible-name.js and shared target-size and generic-link helpers. Fresh source was bundled with esbuild and exercised through the full engine in Chromium. No competitor implementation was read. No shipping code changed.

Ratings describe current rule scope, not WCAG certification. SOLID means no new confirmed defect within that scope in this review; it does not mean complete criterion automation. Case counts refer only to scripts/spec-cases/cases.js, not all testbeds. All20 best-practice exports were imported and confirmed to carry only best-practice tags.

Confirmed browser evidence

Runnable original fixtures: pour-audit-interaction-repro.mjs. Full engine JSON: pour-audit-interaction-repro.json. The experimental meta-refresh-adjustable fixture only establishes engine assertion, not a compliant cancellation mechanism; exclude it from confirmed defects. Hidden-label and dynamic-value candidate cases produced no violations because label-in-name is not registered; those runs establish no rule behavior and are not evidence of correctness. Other fixtures establish the noted engine outcomes.

Priority: target-size uncovered-square geometry, disabled controls, external equivalent controls; conditional paste false failure; role-overridden and expandable link-purpose; stopped legacy motion; repeated-block assumption; semantic title assertion. Best-practice scope: separate form identity and identical navigation labels.

Per-rule review

scrollable-region-focusable | OVER-FLAGS | 8 dedicated cases

Source: src/engine/rules/wcag/2.1.1-scrollable-region-focusable.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/keyboard.html

Negative tabindex and no tabbable descendants do not prove keyboard inoperability. External keyboard-operable scroll buttons or scripted focus are valid alternatives. Original full-engine reproduction scroll-with-keyboard-buttons fails despite two working native buttons. The other branch appropriately reviews browser-dependent auto-focus. Sources: 2.1.1 evaluate lines91-109; DOM isInert helper inspected.

meta-refresh | OVER-FLAGS | 12 dedicated cases

Source: src/engine/rules/wcag/2.2.1-meta-refresh.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/timing-adjustable.html

Delay parser handles malformed refresh syntax and >20h carefully. But all positive delays <=20h are asserted without observing prior user adjustment, a mechanism or a real-time/essential exception. This is a scope risk, not a confirmed working cancel-control reproduction. Do not use the experimental remove-meta button as proof: removing a scheduled meta directive may not cancel the browser navigation. Missing tests for a time limit explicitly adjusted before entering this page.

pause-stop-hide | OVER-FLAGS | 9 dedicated cases

Source: src/engine/rules/wcag/2.2.2-pause-stop-hide.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/pause-stop-hide.html

Full-engine reproductions confirm static BLINK and stopped MARQUEE with real Pause button still assert at lines120-130. Motion, duration, parallel content, controls and essentiality are not established in this tag branch. CSS animation branch appropriately reviews; finite animations >5s are a disclosed-or-undisclosed missed family, since only Infinity iterations considered.

video-loop-motion | MINOR-GAPS | 8 dedicated cases

Source: src/engine/rules/wcag/2.2.2-video-loop-motion.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/pause-stop-hide.html

Correctly asks for review rather than asserting a missing arbitrary script control; native controls and actually paused videos are accepted. An aria-controls button proves only association, not pause behavior, so the pass branch can suppress a genuine missing-control review. Tiny video exception is a noise policy, not a WCAG size threshold.

reduced-motion | MINOR-GAPS | 10 dedicated cases

Source: src/engine/rules/wcag/2.3.3-reduced-motion.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/animation-from-interactions.html

Review-only avoids false violations. Any prefers-reduced-motion occurrence anywhere silences all motion, even an empty or unrelated media block. Arbitrary 8px/15% filters and first-five-subject sample intentionally miss some motion; report scope as heuristic. CSSOM scans can repeat queries/style reads.

bypass-blocks | OVER-FLAGS | 12 dedicated cases

Source: src/engine/rules/wcag/2.4.1-bypass-blocks.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/bypass-blocks.html

Full-engine four-colour-buttons reproduction fails at lines79-85, although a one-page colour picker contains no repeated blocks. Four controls prove neither repetition across pages nor a header to skip. Existing tests pin this assumption. Also any heading/landmark, including hidden or irrelevant ones, is accepted without proving bypass of the repeated block.

focus-not-obscured | UNDER-TESTS | 2 dedicated cases

Source: src/engine/rules/wcag/2.4.11-focus-not-obscured.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/focus-not-obscured-minimum.html

Review-only is appropriate for a snapshot. Only 2 dedicated cases. Document-wide any visible role=dialog/open dialog suppresses even a nonmodal dialog and all unrelated obstruction findings. Alpha parser assumes opaque for modern colour syntax it cannot parse. Tests needed for nonmodal dialogs, opaque descendants of transparent overlays, shadow focusables and inactive popovers.

document-title | OVER-FLAGS | 10 dedicated cases

Source: src/engine/rules/wcag/2.4.2-document-title.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/page-titled.html

Missing title is demonstrable; placeholder meaning is not. Full engine falsely fails title Document title on documentation whose h1 and topic are Document title. Same risk for artworks literally named Untitled 1. Placeholder assertion at lines62-67 should be review under the requested precision policy.

visual-order-divergence | MINOR-GAPS | 7 dedicated cases

Source: src/engine/rules/wcag/2.4.3-visual-order-divergence.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/focus-order.html

Review-only and narrow direct flex/grid siblings are appropriately cautious. Does not account for CSS reading-flow/new focus ordering or positive tabindex, and disabled-fieldset descendants may enter tabbable() because it reads element.disabled rather than :disabled. Vertical writing modes are not modeled. These affect review accuracy, not certain violations.

link-name | SOLID | 9 dedicated cases

Source: src/engine/rules/wcag/2.4.4-link-name.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-in-context.html

Within modeled name-presence scope, role routing and unknown-role implicit fallback are sound. Depends on simplified accessibleName helper, whose coverage is audited separately. Missing names tagged both2.4.4 and4.1.2 are stronger under4.1.2; contextual purpose can satisfy2.4.4, so avoid interpreting each tag as independently demonstrated.

link-text-generic | MINOR-GAPS | 2 dedicated cases

Source: src/engine/rules/wcag/2.4.4-link-text-generic.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-in-context.html

Review verdict correctly admits surrounding context. Missing effective-role filter means role=button anchors are incorrectly reviewed as links. English/French phrase list is bounded heuristic, not semantic proof. Existing2 cases are thin relative to localization and role routing.

focus-visible | MINOR-GAPS | 5 dedicated cases

Source: src/engine/rules/wcag/2.4.7-focus-visible.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/focus-visible.html

Review-only declaration scan is conservative about certainty. Inactive media rules can both create suspects and falsely restore them; any box-shadow/background declaration is treated as replacement even none/transparent/unchanged. Shadow/adopted stylesheets not covered. Genuine computed-focus browser checks would add confidence without broadening assertions prematurely.

link-text-generic-only | OVER-FLAGS | 18 dedicated cases

Source: src/engine/rules/wcag/2.4.9-link-text-generic-only.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-link-only.html

Full-engine role=button Show more anchor falsely fails link-purpose at createLinkPurposeRule evaluate lines87-96. Also a working Show descriptive link names button satisfies the SC mechanism allowance but Read more is still failed. Phrase meanings can be proper names in any language; current Go/Plus exceptions are not exhaustive. F84 specifically requires absence of a mechanism, unlike this rule.

label-in-name | UNDER-TESTS | 0 dedicated cases

Source: src/engine/rules/wcag/2.5.3-label-in-name.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/label-in-name.html

PARKED by explicit historical product decision, confirmed rules/index.js:20-27; SC2.5.3 remains on manual checklist. Zero dedicated behavior cases for maintained parked implementation. Digits-only visible labels are excluded by HAS_LETTERS, missing mismatched numbered pagination or calculator controls. Visible content ignores images of text, generated text, shadow-root text at the control itself; punctuation folding and concatenation can alter word boundaries. No live-engine behavior conclusion: hidden-label/dynamic-value runs had no registered label-in-name rule. Direct helper/source judgments only; do not reactivate without a deliberate decision.

target-size-enhanced | OVER-FLAGS | 8 dedicated cases

Source: src/engine/rules/wcag/2.5.5-target-size-enhanced.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/target-size-enhanced.html

Shares target geometry and external-equivalence/essentiality gaps with target-size; disabled targets incorrectly considered. Largest-area uncovered slab can fail despite another adequate square. UA-sized native controls and no-spacing AAA distinction are useful. 8 dedicated cases do not exercise shared adversarial geometry independently at44px.

drag-alternative | MINOR-GAPS | 2 dedicated cases

Source: src/engine/rules/wcag/2.5.7-drag-alternative.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/dragging-movements.html

Review-only scoped to explicit draggable attributes avoids speculative violations. Blanket exclusion of img and a[href] also misses authored drag/drop interactions built from native-draggable images/links, not merely their browser default. Pointer-event-only interactions are disclosed as unobservable.

target-size | OVER-FLAGS | 36 dedicated cases

Source: src/engine/rules/wcag/2.5.8-target-size.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/target-size-minimum.html

Confirmed three independent failure families: disabled controls fail; adequate equivalent native buttons ignored because only matching href proves equivalence; largest-area uncovered slab rejects an intact24x50 strip. Unmeasured essential/legal presentation exceptions still asserted. Shape/clip/opacity/label-union approximations also create false passes. Small-target spacing tests every other target with elements.some(crowds), a quadratic workload despite spatial hash for the separate overlap branch.

html-lang | MINOR-GAPS | 2 dedicated cases

Source: src/engine/rules/wcag/3.1.1-html-lang.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/language-of-page.html

Missing/empty language is a sound check; regex is only tag shape and accepts unregistered primaries such as zz and malformed extension structure. Does not verify language matches prose, which is appropriately outside reliable static inference. Only 2 dedicated cases for BCP47 parsing.

valid-lang-parts | UNDER-TESTS | 0 dedicated cases

Source: src/engine/rules/wcag/3.1.2-valid-lang-parts.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/language-of-parts.html

Zero dedicated cases. Same loose BCP47 regex; lang empty means language unknown, not reset to page language as comment claims. A malformed tag on a part whose text already matches inherited language does not necessarily prove wrong language exposure. Missing changes in unmarked foreign passages are a disclosed conceptual gap.

on-input-navigation | SOLID | 8 dedicated cases

Source: src/engine/rules/wcag/3.2.2-on-input-navigation.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/on-input.html

Review verdict correctly distinguishes handler source from executed navigation and prior warning. Only inline handlers are observable; regex can match comments/strings or conditional code, but uncertainty is appropriately disclosed. Eight focused cases pin read-vs-write and event selection.

error-message-linkage | SOLID | 6 dedicated cases

Source: src/engine/rules/wcag/3.3.1-error-message-linkage.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/error-identification.html

Uses review rather than violation for missing programmatic linkage, correctly acknowledging visible adjacent error text can satisfy3.3.1. Empty/hidden/dangling targets and invalid-state inertness handled. Unrecognized nonfalse aria-invalid tokens absent aria-errormessage are outside selector; error text relevance still requires human review.

redundant-entry | MINOR-GAPS | 5 dedicated cases

Source: src/engine/rules/wcag/3.3.7-redundant-entry.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/redundant-entry.html

Review-only correct because confirmation, security, stale values and different people may justify repeated fields. Prefilled editable duplicate fields still get review, although re-entry may not be required; disabled fieldsets not modeled with :disabled. Only within-form descendants, not controls associated via form= or cross-page process.

auth-field-obstruction | OVER-FLAGS | 7 dedicated cases

Source: src/engine/rules/wcag/3.3.8-auth-field-obstruction.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-minimum.html

Full engine fails a password input with autocomplete=off and onpaste=if(false) event.preventDefault(), although paste cancellation does not execute. Regex at41 cannot prove behavior; off does not prove password managers blocked; adjacent email+one password does not establish existing-user login; alternatives are ignored. Assertion at57-63 should require real evidence or remain review.

accesskeys | UNDER-TESTS | 0 dedicated cases

Source: src/engine/rules/best-practice/accesskeys.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/character-key-shortcuts.html

Zero dedicated cases. Treats whole accesskey string as one key, though HTML defines an ordered set of space-separated candidate keys. Fails duplicate empty values that assign no key; misses overlaps among different lists. visibleOnly false also compares nonusable controls. Advice only, no WCAG tags.

button-type | MINOR-GAPS | 3 dedicated cases

Source: src/engine/rules/best-practice/button-type.js:1. Primary reference: https://html.spec.whatwg.org/multipage/form-elements.html#attr-button-type

Correctly accepts sole implicit submit button. Multiple legitimate submit buttons still get style advice; not a WCAG violation. Current HTML Auto state and command/popover invocation exceptions require review because unconditional submitting prose may be wrong. External form-associated controls and named-property clobbering need tests.

empty-heading | UNDER-TESTS | 0 dedicated cases

Source: src/engine/rules/best-practice/empty-heading.js:1. Primary reference: https://www.w3.org/WAI/tutorials/page-structure/headings/

Zero dedicated cases. Checks raw role string, unlike effectiveRole helper: unknown or fallback roles can silently skip real headings. Name helper dependencies apply; advisory heading-name criterion is not taggedWCAG.

fieldset-legend | OVER-FLAGS | 4 dedicated cases

Source: src/engine/rules/best-practice/fieldset-legend.js:1. Primary reference: https://www.w3.org/WAI/tutorials/forms/grouping/

Confirmed separate idless forms with single same-name checkboxes are merged into one nonexistent group because key uses element.form.id, not form identity, at18. First control's nearest group alone also need not contain remaining controls. Group identity should include tree/form object and actual memberships.

heading-order | MINOR-GAPS | 6 dedicated cases

Source: src/engine/rules/best-practice/heading-order.js:1. Primary reference: https://www.w3.org/WAI/tutorials/page-structure/headings/

Sound as best-practice advice, not WCAG assertion. Effective roles modeled, but aria-level parseInt accepts malformed partial numbers and slot/shadow order can differ from registry query order. Skipped levels are not universally usability failures; message is stronger than evidence.

landmark-one-main | MINOR-GAPS | 4 dedicated cases

Source: src/engine/rules/best-practice/landmark-one-main.js:1. Primary reference: https://www.w3.org/WAI/ARIA/apg/practices/landmark-regions/

Visible shadow-root counting is useful. Native main elements overridden with another role still counted, and nested document/application scope not separated. These are best-practice findings only.

landmark-top-level | MINOR-GAPS | 8 dedicated cases

Source: src/engine/rules/best-practice/landmark-top-level.js:1. Primary reference: https://www.w3.org/WAI/ARIA/apg/practices/landmark-regions/

Handles unnamed forms and contextual aside/header/footer cases. Raw role parsing and parentElement walk miss fallback roles and shadow ancestors; overridden native main/header elements can be mislabeled. APG allows main within nested document/application contexts, so absolute direct-body remedy is too broad.

landmark-unique | OVER-FLAGS | 6 dedicated cases

Source: src/engine/rules/best-practice/landmark-unique.js:1. Primary reference: https://www.w3.org/WAI/ARIA/apg/practices/landmark-regions/

Full-engine identical labeled pagination navs produce failures, contrary to APG explicit advice to give identical nav links the same label. Singleton grouping also ignores nested document/application contexts. Distinguish duplicates with same purpose/content from genuinely ambiguous landmarks.

multiple-labels | UNDER-TESTS | 0 dedicated cases

Source: src/engine/rules/best-practice/multiple-labels.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/labels-or-instructions.html

Zero dedicated cases. HTML permits multiple labels; this is only advisory and correctly untaggedWCAG. Claim that screen readers differ needs current empirical evidence. Hidden-label accname behavior is more nuanced than visibleLabels filter.

new-window-link | MINOR-GAPS | 3 dedicated cases

Source: src/engine/rules/best-practice/new-window-link.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Techniques/general/G201

English-only warning regex and target=blank may misstate behavior; named blank context can reuse an existing window, and English wording outside the regex can warn adequately. Description targets included and nonEnglish cases review. Warnings are not a universal WCAG requirement; tags correctly best-practice.

no-autofocus | SOLID | 3 dedicated cases

Source: src/engine/rules/best-practice/no-autofocus.js:1. Primary reference: https://html.spec.whatwg.org/multipage/interaction.html#the-autofocus-attribute

Review-only and native dialog/popover exemption avoid a false violation. Message says HTML allows only when control is main purpose, which overstates nonnormative caution; soften advisory wording. ARIA dialog presence alone does not create native autofocus scoping.

page-heading-one | MINOR-GAPS | 4 dedicated cases

Source: src/engine/rules/best-practice/page-heading-one.js:1. Primary reference: https://www.w3.org/WAI/tutorials/page-structure/headings/

Includes open shadow roots and aria-level. However no visibility/effective-role filter means hidden or demoted h1 satisfies the check even with no exposed level1 heading. Only presence is checked though help says start outline.

positive-tabindex | UNDER-TESTS | 0 dedicated cases

Source: src/engine/rules/best-practice/positive-tabindex.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/focus-order.html

Zero dedicated cases. Appropriate as opt-in advice but positive tabindex can preserve meaningful operation; never surface as WCAG failure. parseInt accepts malformed strings, so must follow actual HTML integer parsing if expanded.

redundant-alt-phrase | MINOR-GAPS | 4 dedicated cases

Source: src/engine/rules/best-practice/redundant-alt-phrase.js:1. Primary reference: https://www.w3.org/WAI/tutorials/images/tips/

Narrowed prefix matching avoids some damaging fixes. An icon's medium or an artwork's title may still legitimately begin Icon/Image of. Best-practice advisory rather than certain bad alt text; avoid automatic replacement.

redundant-aria-label | MINOR-GAPS | 4 dedicated cases

Source: src/engine/rules/best-practice/redundant-aria-label.js:1. Primary reference: https://www.w3.org/TR/using-aria/#rule2

Conservative gates for name-from-content, hidden children, image alts and pseudo text are useful. Raw DOM text vs actual name still differs for nested accessible names and slots. Walk makes2 pseudo-style reads per descendant plus computed style, costly on large matched containers.

redundant-aria | UNDER-TESTS | 0 dedicated cases

Source: src/engine/rules/best-practice/redundant-aria.js:1. Primary reference: https://www.w3.org/TR/using-aria/#rule2

Zero dedicated cases. Presence-only comparison treats aria-required=false plus required as duplicate, not conflicting; dynamic native checked attribute vs checked property can diverge. Advice to remove may be fine but claim of equivalence is unproven. State-specific tests needed.

redundant-image-alt | MINOR-GAPS | 5 dedicated cases

Source: src/engine/rules/best-practice/redundant-image-alt.js:1. Primary reference: https://www.w3.org/WAI/tutorials/images/functional/

Correctly keeps sole naming alternative and handles title fallback. Does not inspect overriding aria-label/labelledby on image or parent link; says duplicate is announced when an explicit control name suppresses descendant text. ExposedText duplicates part of accname algorithm and can drift.

redundant-role | MINOR-GAPS | 6 dedicated cases

Source: src/engine/rules/best-practice/redundant-role.js:1. Primary reference: https://www.w3.org/TR/using-aria/#firstrule

Useful explicit exceptions for markerless lists, SVG images and CSS table semantics. Raw first role token and model-dependent native roles leave gaps; browser-dependent semantics claims should stay validated across engines. Advice only, notWCAG.

redundant-tabindex | UNDER-TESTS | 0 dedicated cases

Source: src/engine/rules/best-practice/redundant-tabindex.js:1. Primary reference: https://www.w3.org/WAI/WCAG22/Understanding/focus-order.html

Zero dedicated cases. Summary element is not natively focusable unless first summary in details; standalone summary tabindex=0 creates focus and must not be removed as redundant. Disabled native controls and user-agent focus preferences complicate blanket prose.

region | MINOR-GAPS | 13 dedicated cases

Source: src/engine/rules/best-practice/region.js:1. Primary reference: https://www.w3.org/WAI/ARIA/apg/practices/landmark-regions/

Deduplicating one per branch reduces output cost. Landmark selector disagrees with effective-role model, hidden/unlabeled/overridden landmarks and shadow roots; root doc.querySelector can miss shadow-only landmarks. Absolute claim regions-only users never reach stray content is overstated.13cases but cross-root variants still needed.

Additional primary-source checks

• SC2.5.8 size requirement expressly permits any axis-aligned24x24 square fully inside a target: https://www.w3.org/WAI/WCAG22/Understanding/target-size-minimum.html#size-requirement . The geometry fixture retains24x50 but returns100x23.
• SC2.4.9 allows a mechanism to make names descriptive, not necessarily descriptive names in the initial state: https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-link-only.html ; see mechanism explanation and F84.
• APG explicitly recommends same label for identical navigation link sets: https://www.w3.org/WAI/ARIA/apg/practices/landmark-regions/#navigation .
• SC3.3.8 alternatives and mechanisms: https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-minimum.html . A string containing preventDefault is not observed execution.
• SC2.2.2 actual motion, duration and control requirements: https://www.w3.org/WAI/WCAG22/Understanding/pause-stop-hide.html .
• HTML accesskey is a space-separated candidate token list: https://html.spec.whatwg.org/multipage/interaction.html#the-accesskey-attribute .

Recommendations

• Put semantic/behavioral uncertainty into review rather than asserting through tag or phrase heuristics.
• Correct measurable geometry and disabled-state mistakes with adversarial cases before performance work.
• Add dedicated language-parts cases, and label-in-name cases if its maintained parked implementation is revisited, plus exception cases above. Existing expected-fail tests can encode incorrect assumptions and must be reviewed against primary text.
• Reuse spatial indexing for spacing as well as overlap. Benchmark many separated undersized links, deeply nested trees and repeated pseudo-name walks. Compare exact outcomes before and after optimization.
• Keep best-practice advice visibly distinct from WCAG violations in consuming UI and counts.

Manual criteria: meaningful opportunities and dead ends

These32 principle2/3 criteria are currently manual in src/engine/wcag22.js. Manual classification is appropriate for complete determination, but does not mean no useful candidate automation exists. This is a proposed testing roadmap, not authorization to reactivate parked behavior or report speculative violations.

Precision boundary

Confirmed fixture failures demonstrate that these implementation paths can emit false positives. They do not establish their prevalence in live corpus findings or imply that every finding from those rules is wrong. No corpus false-positive percentage was measured by this sub-audit. No production edits, releases or version changes were made.

Visual rule audit: WCAG 1.4.*, 2026-09-12

Read-only engine review. Shipping source was not changed. Read PROVENANCE.md, spec-sweep/SKILL.md, all nine 1.4.* rule files, the full 1,705-line contrast helper, and full dom.js. Coverage table reviewed at src/engine/COVERAGE.md:31. All scenarios below were authored during this audit. No other accessibility engine or its source was consulted.

Verdict and ratings

This family contains substantial original rendering work, including alpha groups, positioned backdrops, pseudo paints, image ranges and shadow-aware background resolution. Its principal correctness weakness is inconsistent paint handling between the main text rule and control rule. Several simple, fully readable fields receive definitive violations. The main rule also mistakes unpainted base text colours for visible text and overlooks filters applied to the element itself. An image alpha threshold silently clears real painted backgrounds.

Ratings are analyst judgments, not conformance scores. Defect behavior marked measured was run in bundled current source in headless Chromium. Independent full-engine confirmations of the main contrast and spacing defects are recorded in evidence/confirmed-more.json. Full-engine runner integration was not exercised here; these are direct rule calls with the real helpers.

Tally: OVER-FLAGS 5, SOLID 1, MINOR-GAPS 1, UNDER-TESTS 2, WEAK 0.

Measured defects and original reproductions

All basic field cases use font:16px Arial; width:400px; height:48px; border:0; padding:10px; box-sizing:border-box. Screenshot pour-visual-repro.png is 900x700. JSON retains exact bounding boxes and styles. pour-visual-repro.mjs reproduces the first three field defects and alpha case. Extended cases live in pour-visual-repro-extra.mjs and pour-visual-repro-final.mjs. Their JSON and PNG files use matching prefixes. Screenshots were visually inspected; pixel reads independently identify the painted backgrounds and glyph interiors. Pixel values establish rendered colours, rather than measuring anti-aliased edge contrast.

V1. Opaque field colour hides an actually painted gradient from the control rule

Measured false violation. src/engine/rules/wcag/1.4.3-control-contrast.js:62 selects the opaque background-color without consulting background-image. The background image guard only exists in the translucent branch at :69.

<input value="A readable field"
 style="font:16px Arial;color:white;background-color:white;background-image:linear-gradient(black,black)">

Observed verdict: fail, ratio 1, required 4.5. Computed image is a black-to-black gradient, screenshot background is rgb(0,0,0), glyphs white. Actual pair is 21:1. Measured rect x32 y66 width400 height48. Recommendation: share painted-background resolution or return incomplete for an own image that cannot be sampled, never assume its underlying colour is the painted background. SC 1.4.3.

V2. Control group opacity composites only the foreground

Measured false violation. src/engine/rules/wcag/1.4.3-control-contrast.js:88. In contrast, main text invokes opacityGroupPaint at 1.4.3-color-contrast.js:620.

<body style="background:#808080">
<input value="A readable field" style="font:16px Arial;color:black;background:white;opacity:.5">

Observed fail, 3.97:1. The actual ideal composited pair is rgb(64,64,64) on rgb(191.5,191.5,191.5), 5.66854:1. Screenshot glyph interiors are rgb(63,63,63), background inside the glyph region rgb(191,191,191), confirming both layers are composited. Recommendation: reuse the existing original opacity-group helper for form control text. Same primary contrast criterion.

V3. Control text fill is ignored

Measured false violation. src/engine/rules/wcag/1.4.3-control-contrast.js:97 always judges style.color; main text already prefers webkitTextFillColor at 1.4.3-color-contrast.js:537.

<input value="A readable field" style="font:16px Arial;color:#eee;-webkit-text-fill-color:black;background:white">

Observed fail 1.16:1. Screenshot contains black glyph interiors on white, 21:1. This is relevant to restyled input values and browser autofill customizations. Resolve the actual glyph fill before calculating the ratio. SC 1.4.3.

V4. Semi-transparent images are declared wholly invisible

Measured false pass. src/engine/lib/contrast.js:1270 skips alpha bytes below 128. At :1284 a complete absence of pixels *above this threshold* becomes {transparent:true}, and the URL enters the persistent transparentImages set. Yet nonzero alpha paints.

const canvas = document.createElement('canvas');
canvas.width = canvas.height = 64;
const ctx = canvas.getContext('2d');
ctx.fillStyle = 'rgba(0,0,0,.49)';
ctx.fillRect(0,0,64,64);
p.style.cssText = 'color:#555;background-color:white;font:16px Arial;min-height:64px';
p.style.backgroundImage = `url("${canvas.toDataURL()}")`;
p.textContent = 'Grey text on white darkened by a translucent image.';

imageLuminanceRange returns {transparent:true,width:64,height:64}. Main rule returns pass. Screenshot background rgb(130,130,130) with text rgb(85,85,85) yields 1.93996:1. The unsullied white pair would pass at 7.45:1. Only exactly zero alpha can prove no paint; partial alpha needs compositing or uncertainty. Also review mixed images whose below-128 pixels are excluded from a range rather than the whole image. Contrast criterion.

V5. Own-element CSS filter is absent from the contrast pair

Measured false violation. src/engine/lib/contrast.js:901 immediately returns an element's own opaque background. Later filter checks inspect lower stack layers, and main text has no corresponding own-filter gate.

<p style="font:16px Arial;color:#777;background:white;filter:invert(1)">
Visible grey on black after inversion.
</p>

Observed fail 4.47:1, declared rgb119 on white. Screenshot has glyph interior rgb136 on black, a passing pair (approximately 5.92:1). Recommendation: detect filters affecting the text and return review unless their effects are resolved. Factory sharing carries this into AAA; e.g. #666 on white, inverted, crosses the AAA threshold in the opposite direction (source-derived variant). SC 1.4.3.

V6. Unpainted base colour is retained when first-line styling covers all text

Measured false violation. src/engine/rules/wcag/1.4.3-color-contrast.js:592 and :962 include the base colour in the worst candidate unconditionally.

<style>
p {font:16px Arial;width:450px;color:#aaa;background:white}
p::first-line {color:black}
</style>
<p>A single black first line.</p>

Observed fail 2.32:1 for #aaa on white. Screenshot contains black glyphs on white, 21:1. There is no second line or glyph painted in #aaa. More conservative response: prove that a losing candidate actually paints text, otherwise review. The same issue can occur with a one-character first-letter treatment. Contrast criterion.

V7. Link colour is read from its wrapper instead of the text-bearing descendant

Measured false violation. src/engine/rules/wcag/1.4.1-link-in-text-block.js:208. The rule collects descendant styles for decoration and weight, but the colour comparison still uses the anchor.

<p style="color:black;background:white">Read the
<a href="#" style="color:blue;text-decoration:none"><span style="color:black">account details</span></a>
before continuing.</p>

Observed fail 2.44:1. Both visible prose and link glyphs are black. The W3C explanation explicitly exempts a link that has no visual differentiation from adjacent text from this particular criterion. Poor discoverability alone is not a 1.4.1 failure. Use of Color, scope note.

Related measured false pass at :179: an own background is accepted as a shape even when it exactly matches surrounding white. <p style="color:#444;background:white">Read the <a style="color:#555;background:white;text-decoration:none">account details</a> before continuing.</p> passes. The white fill paints no distinction; only a sub-3:1 colour difference remains. Current G183 supports 3:1 as sufficient without requiring an extra hover treatment. Do not flag the absence of a hover treatment as a defect; the current July 2026 technique has no such requirement.

V8. Viewport rule disregards an available text enlargement control

Measured verdict and text resize behavior; normative classification follows G178. src/engine/rules/wcag/1.4.4-meta-viewport.js:19. pour-visual-probes.mjs builds a page with user-scalable=no and two prominent text-size buttons. All button and paragraph text inherit the root font size. Increase adds 4px, capped at 32px from a 16px initial size; decrease reverses it.

Observed rule fail. Four clicks produce [32px,32px,32px] from [16px,16px,16px], without horizontal overflow; four decreases restore 16px. A flowing paragraph and both controls remain available. This meets the specific supported enlargement alternative rather than requiring browser zoom. Rule cannot prove the absence of an alternative mechanism from a meta tag; incomplete is the supportable universal classification unless context proves failure. G178 sufficient technique.

V9. Wrapper borders bypass non-text contrast measurement

Measured false pass relative to the rule's claimed field-boundary review scope. src/engine/rules/wcag/1.4.11-non-text-contrast.js:117. In pour-visual-repro-final.mjs the snug wrapper has border:1px solid #808080 against body #808080; the input has no border or fill, no visible label, no value and no placeholder (only aria-label). The field disappears. The wrapper border is present but contributes 1:1 contrast; result is pass. Presence is not a sufficient contrast measurement. At least preserve the review outcome for an uncontrasted boundary rather than clearing it. Whether the input has other visual identifiers generally remains a human judgment. Non-text Contrast.

V10. Spacing probe can report pass without applying shadow-root styles

Measured false pass. src/engine/rules/wcag/1.4.12-text-spacing.js:63 appends a stylesheet to the document rather than the target root. In pour-visual-probes.mjs an open shadow root contains:

<style>p{font:16px/16px Arial;letter-spacing:normal;word-spacing:normal;
width:180px;height:16px;overflow:hidden;margin:0}</style>
<p>A short text sample</p>

Engine evaluateAll([p]) returns pass. Baseline scroll/client height 16px; applying the same spacing values *inside* the shadow root yields scrollHeight48, clientHeight16 and line-height24. The engine's probe was not applied to the judged glyphs. Some properties can inherit through the host; the explicit resets above make the failed scope boundary unambiguous. Text Spacing.

Other source-verified limits and policy distinctions

• Main bold cutoff is 600 at src/engine/lib/contrast.js:1697. Its comment records an explicit user policy. Do not label this an accidental defect or silently change it to 700. WCAG uses the word bold; equivalence across fonts remains an interpretation.
• Text spacing returns passes above 20,000 candidate elements (:47). This is a performance abstention expressed as success. Better expose not-tested/incomplete at rule level. Existing baseline clipping also clears later increased loss (:84). Containers with overflow:visible can overlap and lose legibility, but are excluded at :53. These are source-confirmed misses; no large stress run was performed here.
• Reflow's at 320px ... will be worse (:23) is an unjustified guarantee. A media query can replace a wide desktop layout with a single-column mobile layout. Current overflow is measured; future overflow is not. The rule should state a review prompt without the prediction. Horizontal writing needs the 256px height branch. No specific reflow reproduction run here.
• Control text does not use its own full text renderer's shadow/outline/filter safeguards. The three measured cases demonstrate the common architectural gap; avoid adding independent approximations that diverge again.
• The current G183 July 2026 revision was checked directly. A 3:1 link distinction alone is sufficient in the current text. An older assumption requiring an extra hover/focus cue would be an incorrect audit finding.

Performance findings: suspected costs, not measured bottlenecks

No full-site timing or large synthetic performance run was performed here while parent verification was active.

• imageRangeCache at lib/contrast.js:1209 and transparentImages at :221 persist across audits; the former keys by URL, overlays and grid and has no bound. Dynamic image URLs and many overlay/grid combinations grow retained entries. Main imageVsText first samples at 32x32 (:154), followed by a possibly larger grid (:714), duplicating image decode/draw work under different keys. Measure before choosing a cache policy.
• The 1,500ms image timeout at lib/contrast.js:1245 resolves null without cancelling image load. A timed-out load can later draw and walk up to a 1024x1024 grid. A failed result also remains cached, preventing later retry even after the image becomes available. Source-confirmed lifecycle behavior, not elapsed-time measurement.
• Pseudo, media, panel and opacity caches are valuable. Nevertheless pseudoBackdropForText scans the ancestor chain per text, backdropHazard scans collected media/panels per candidate, and out-of-flow fallback can style-scan up to 2,000 descendants per text at color-contrast.js:1039. Long deeply nested or many-card pages are natural stress dimensions. Preserve cache correctness across root/document boundaries.
• Text spacing intentionally forces layout twice. Its threshold bounds costs but currently hides the abstention. Prefer transparent budgeting over pass fabrication.

Manual 1.4 criteria: useful opportunities and dead ends

All five manual entries in COVERAGE.md:35,37,38,39,43 are reasonable manual classifications for complete conformance. None implies that every review candidate must be impossible to collect.

Prioritize fixing measured false assertions and reporting skips before extending new heuristic scope. All scratch results remain local for incorporation into the parent report.