@junixlabs/uxcli 0.2.0 → 0.3.0

package/src/probes/error-prevention/spec.md

@@ -3,11 +3,11 @@
 - **why:** SC text: at least one of *reversible*, *checked*, *confirmed* must be true for pages that cause legal/financial commitments or modify user data.
 - **applies-when:** the journey has a step marked `commit`, and at least one value was entered in an earlier step of the same process. Values of `type=password` are excluded. Credential fields are identity, not the information being submitted, and are excluded from the *confirmed* comparison: `type=password`, and, on a step whose fill includes a password, fields with `type=email`, `autocomplete` username/email, or name/id/label matching /user|login|email/i. Other fields on that step (a sign-up form's address) count. Credentials stay recorded for 3.3.7. If no non-credential value was recorded before the commit step (single-screen commit), the probe is `not-applicable`: it measures cross-screen review only.
 - **correct-when (any one branch):**
-  - *confirmed*: on the screen holding the commit control, or on the screen of the step immediately before it when that step entered no values (a review step "before finalizing the submission", SC text), every recorded non-secret value is present as visible text or as the value of a read-only/disabled/pre-populated field (comparison after trimming, case-folding, collapsing whitespace; for `select`, the option's display text also counts), **and** a mechanism to correct exists: a link or button, outside site chrome (`header`, `nav`, `footer`, landmarks), whose href or text targets an earlier step that recorded non-authentication values (`href` equals that step's URL, or text matches /change|edit|back|modify/i), or the values are editable on the same screen. A logo or Home link to the journey's first step is not a correction mechanism.
+  - *confirmed*: on the screen holding the commit control, or on the screen of the step immediately before it when that step entered no values (a review step "before finalizing the submission", SC text), every recorded non-secret value is present as visible text or as the value of a read-only/disabled/pre-populated field (comparison after trimming, case-folding, collapsing whitespace; for `select`, the option's display text also counts), **and** a mechanism to correct exists: a link or button, outside site chrome (`header`, `nav`, `footer`, landmarks), whose href or text targets an earlier step that recorded non-authentication values (`href` equals that step's URL, or text matches /\b(change|edit|modify)\b/i, or is exactly "back" / "go back"), or every recorded value is editable on the same screen (one editable copy of one value is not a correction mechanism). A logo or Home link to the journey's first step is not a correction mechanism.
   - *checked*: the runner, in a separate pass, submits the entry step with one recorded field carrying a deliberate input error and reads the outcome. Field choice: a `required`/`aria-required` field emptied; else a `type=email` field set to `not-an-email`, `type=url` to `not-a-url`, a `minlength` field to one character; else the first recorded field emptied. Outcome: the step does not advance (same URL, or the same form still present) **and** either new visible text appears or native constraint validation fired (`:invalid` with a non-empty `validationMessage`) → *checked* holds. The step advances → *checked* is false only when the probed field was declared constrained (required, typed, minlength); an undeclared field may simply be optional, so advancing proves nothing and *checked* is `untested`. Programmatic association of the message is SC 3.3.1, not 3.3.4. The pass mutates the site and runs only where the journey marks `checkedPass: true`; otherwise `untested`.
   - *reversible*: declared in the journey (`reversible: <url or text>`), provenance `project`; the runner does not measure it.
 - **verdict:** `pass` with the satisfied branch named; `fail` only if *confirmed* is false, *checked* was **tested** and false, and *reversible* is not declared, listing the missing values; `unmeasurable` with `checked: untested` if *confirmed* is false and the checked pass was not allowed; `not-committed` if no `commit` step; `not-applicable` if no non-credential value was recorded before the commit step; `unmeasurable` if the commit screen could not be reached, was reached by direct navigation after the previous step's submit did not change the page (flow break: recorded values may not have carried), or the recorded values are empty.
-- **invalid-if:** a value was reformatted by the site (dates, phone numbers, card numbers) so that normalized comparison fails; then that value is reported as `finding`, not counted as missing. Screen reached by a redirect to a different origin (third-party payment) is out of scope for this probe and reported as `unmeasurable`.
+- **invalid-if:** a value was reformatted by the site (dates, phone numbers, card numbers, reordered names such as "Doe, Jane") so that normalized comparison fails while every word of it is present; then that value is reported as `finding`, not counted as missing. Screen reached by a redirect to a different origin (third-party payment) is out of scope for this probe and reported as `unmeasurable`.
 - **known-infidelity:** matching is textual, not semantic (a review that shows "J. Smith" for "John Smith" fails); *checked* mutates the flow and is skipped when the entry step has side effects declared in the journey; *reversible* is trusted, not measured.
 
 ## Input: Journey input (the commitment)
@@ -33,3 +33,12 @@ Acceptance (from P0-B round 2, runner v6 issued `fail`): Sylius register→login
 ## Falsification pair
 
 See `pair.json`: one fixture where this probe must return `fail` for the stated operator, one where it must stay silent. `uxcli gate` runs both and checks the hashes. Written from the WCAG 2.2 Understanding text before any fixture or site was opened; revision history is kept outside the package.
+
+## Method status
+
+`method-unproven`. Validated means: a recorded run with the packaged code on at least 20 pages or flows the probe had not seen when its definition was last revised, 0 false fails, plus a recall record (ACT cases or seeded defects). Until then a would-be `fail` is reported as `finding`. Record so far: P0-B ran pre-package code on 20 flows with two contested fails; no unseen-flow run with the packaged code yet.
+
+## Revisions
+
+- 2026-09-06 change-control text rule: `back` only as the whole label ("Back to shop" is a logo-class link, a constructed false pass); a value whose every word is present in another order is reformatted (`finding`), not missing (a constructed false fail); a flow break joined by `sameProcess` reaches the verdict instead of `unmeasurable`. A submit that leaves the URL unchanged no longer breaks the process when the journey's `expect` selector appears or the submitted form is gone / the main heading changed (same-URL wizards).
+- 2026-09-06 'editable on the same screen' requires every recorded value, not any. Reason: a seeded removal of all Change links was missed because the pre-populated receipt email (one value) was editable on the review screen.

package/src/probes/focus-visible/must-fail/index.html

@@ -1 +1 @@
-<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Account settings</title><style>body{font:16px/1.4 system-ui,sans-serif;margin:2rem;color:#222;background:#fff}form{display:grid;gap:.75rem;max-width:22rem}a,button{color:#1a4fd6}input,select{transition:box-shadow .3s}input:focus-visible,select:focus-visible{box-shadow:0 0 0 3px #9cc4ff}.dot{display:inline-block;width:8px;height:8px;border-radius:50%;background:#1a9c4a;animation:pulse 1.2s ease-in-out infinite}@keyframes pulse{50%{opacity:.4;transform:scale(.8)}}*:focus,*:focus-visible{outline:none}</style></head><body><h1>Account settings</h1><p><span class="dot" aria-hidden="true"></span> Signed in</p><nav><a href="#profile">Profile</a> · <a href="#security">Security</a></nav><form><label>Email <input id="email" type="email" autofocus value="jane@example.com"></label><label>Display name <input id="name" value="Jane"></label><label>Language <select id="lang"><option>English</option><option>Tiếng Việt</option></select></label><button type="submit">Save</button></form></body></html>
+<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Account settings</title><style>body{font:16px/1.4 system-ui,sans-serif;margin:2rem;color:#222;background:#fff}form{display:grid;gap:.75rem;max-width:22rem}a,button{color:#1a4fd6}input,select{transition:box-shadow .3s}.dot{display:inline-block;width:8px;height:8px;border-radius:50%;background:#1a9c4a;animation:pulse 1.2s ease-in-out infinite}@keyframes pulse{50%{opacity:.4;transform:scale(.8)}}*:focus,*:focus-visible{outline:none;box-shadow:0 0 0 3px rgba(0,0,0,0)}:focus{outline:none;box-shadow:none}.kb-focus{outline:2px solid rgba(0,0,0,0);outline-offset:2px}.late.kb-focus{outline:none}.late.kb-late{outline:2px solid rgba(0,0,0,0);outline-offset:2px}.stack{position:relative;height:0;overflow:hidden}.ghost{opacity:0}</style><script>let kb=0;addEventListener('keydown',()=>{kb=performance.now()},true);addEventListener('focusin',e=>{if(performance.now()-kb<100)e.target.classList.add('kb-focus')},true);addEventListener('focusin',e=>{if(e.target.classList.contains('late')&&performance.now()-kb<100)setTimeout(()=>{if(document.activeElement===e.target)e.target.classList.add('kb-late')},200)},true);addEventListener('focusout',e=>{e.target.classList.remove('kb-focus');e.target.classList.remove('kb-late')},true)</script></head><body><h1>Account settings</h1><p><span class="dot" aria-hidden="true"></span> Signed in</p><nav><a href="#profile">Profile</a> · <a href="#security">Security</a></nav><form><label>Email <input id="email" type="email" autofocus value="jane@example.com"></label><label>Display name <input id="name" value="Jane"></label><label>Language <select id="lang"><option>English</option><option>Tiếng Việt</option></select></label><button type="submit" class="late">Save</button></form><div class="stack"><button type="button">Copy code</button></div><p class="ghost"><a href="#promo">Promotion (hidden panel)</a></p><ins class="adsbygoogle" style="display:block;margin-top:2rem;padding:1rem;background:#fff"><a href="#ad" style="outline:none;color:#999">Sponsored: a link with no focus style</a><p style="letter-spacing:0 !important;color:#9a9a9a">Ad copy locked at zero letter spacing in low contrast, inside a third-party container.</p></ins></body></html>

package/src/probes/focus-visible/must-pass/index.html

@@ -1 +1 @@
-<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Account settings</title><style>body{font:16px/1.4 system-ui,sans-serif;margin:2rem;color:#222;background:#fff}form{display:grid;gap:.75rem;max-width:22rem}a,button{color:#1a4fd6}input,select{transition:box-shadow .3s}input:focus-visible,select:focus-visible{box-shadow:0 0 0 3px #9cc4ff}.dot{display:inline-block;width:8px;height:8px;border-radius:50%;background:#1a9c4a;animation:pulse 1.2s ease-in-out infinite}@keyframes pulse{50%{opacity:.4;transform:scale(.8)}}</style></head><body><h1>Account settings</h1><p><span class="dot" aria-hidden="true"></span> Signed in</p><nav><a href="#profile">Profile</a> · <a href="#security">Security</a></nav><form><label>Email <input id="email" type="email" autofocus value="jane@example.com"></label><label>Display name <input id="name" value="Jane"></label><label>Language <select id="lang"><option>English</option><option>Tiếng Việt</option></select></label><button type="submit">Save</button></form></body></html>
+<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Account settings</title><style>body{font:16px/1.4 system-ui,sans-serif;margin:2rem;color:#222;background:#fff}form{display:grid;gap:.75rem;max-width:22rem}a,button{color:#1a4fd6}input,select{transition:box-shadow .3s}.dot{display:inline-block;width:8px;height:8px;border-radius:50%;background:#1a9c4a;animation:pulse 1.2s ease-in-out infinite}@keyframes pulse{50%{opacity:.4;transform:scale(.8)}}:focus{outline:none;box-shadow:none}.kb-focus{outline:2px solid #1a4fd6;outline-offset:2px}.late.kb-focus{outline:none}.late.kb-late{outline:2px solid #1a4fd6;outline-offset:2px}.stack{position:relative;height:0;overflow:hidden}.ghost{opacity:0}</style><script>let kb=0;addEventListener('keydown',()=>{kb=performance.now()},true);addEventListener('focusin',e=>{if(performance.now()-kb<100)e.target.classList.add('kb-focus')},true);addEventListener('focusin',e=>{if(e.target.classList.contains('late')&&performance.now()-kb<100)setTimeout(()=>{if(document.activeElement===e.target)e.target.classList.add('kb-late')},200)},true);addEventListener('focusout',e=>{e.target.classList.remove('kb-focus');e.target.classList.remove('kb-late')},true)</script></head><body><h1>Account settings</h1><p><span class="dot" aria-hidden="true"></span> Signed in</p><nav><a href="#profile">Profile</a> · <a href="#security">Security</a></nav><form><label>Email <input id="email" type="email" autofocus value="jane@example.com"></label><label>Display name <input id="name" value="Jane"></label><label>Language <select id="lang"><option>English</option><option>Tiếng Việt</option></select></label><button type="submit" class="late">Save</button></form><div class="stack"><button type="button">Copy code</button></div><p class="ghost"><a href="#promo">Promotion (hidden panel)</a></p><ins class="adsbygoogle" style="display:block;margin-top:2rem;padding:1rem;background:#fff"><a href="#ad" style="outline:none;color:#999">Sponsored: a link with no focus style</a><p style="letter-spacing:0 !important;color:#9a9a9a">Ad copy locked at zero letter spacing in low contrast, inside a third-party container.</p></ins></body></html>

package/src/probes/focus-visible/pair.json

@@ -1,12 +1,12 @@
 {
  "kind": "page",
- "operator": "index.html: a stylesheet rule *:focus,*:focus-visible{outline:none} removes the default focus ring from every control; the must-pass twin is identical without that rule. Both carry an autofocus input whose focus ring transitions over 300 ms and an infinitely pulsing status dot.",
+ "operator": "index.html: a stylesheet rule *:focus,*:focus-visible{outline:none;box-shadow:0 0 0 3px rgba(0,0,0,0)} replaces the focus ring with a fully transparent shadow: the computed style changes, no pixel does. The must-fail twin's detector class is a transparent outline too. The must-pass twin draws its ring through a keyboard-mode detector: a class added on focusin only when a keydown happened within 100 ms, as focus-visible polyfills do, so focus that does not arrive by a key press shows nothing. The Save button draws its ring 200 ms after keyboard focus, by script. Both twins carry an autofocus input with a 300 ms box-shadow transition, an infinitely pulsing status dot, a button inside a zero-height overflow:hidden container and a link inside an opacity:0 paragraph (in the tab order, never painted: reported as a finding, not measured), and an ins.adsbygoogle block with a focus-less link, a zero letter-spacing lock and low-contrast text: the third-party exclusion must keep all three probes silent on it.",
  "hashes": {
   "mustFail": {
-   "index.html": "331ed671dfa5ab5a23cc39bbf6a99973017a9f7719a3afcf3d591b42346d823e"
+   "index.html": "526b20d6322d02032535585237cc613a88eac6210fd1dee774f5ee1c32f99bce"
   },
   "mustPass": {
-   "index.html": "6ab04dd5a3dad058ca4743bcb1f1f6d1c257c60e3ffc921bf2ef81122659e4f7"
+   "index.html": "ce9f4f891ed9651acfa96f952d28e1f227752dcf147fba1307204a556b189e38"
   }
  }
 }

package/src/probes/focus-visible/probe.js

@@ -1,44 +1,100 @@
 // page.focus-visible · WCAG 2.4.7. Spec in spec.md; falsification pair in pair.json.
 import { THIRD } from '../../util.js';
+import { PNG } from '../../png.js';
+const PAD = 48, VW = 1280, VH = 800;
 
 export default {
   id: 'page.focus-visible', sc: '2.4.7', kind: 'page',
+  method: { status: 'method-validated', record: '20 unseen pages (list 4, 2026-09-06, drawn after the v3.8 definition was committed): 62 failing controls on 7 pages, 58 re-measured by a real Tab press and a whole-viewport diff, 4 by the viewport diff alone (the check could not land Tab on them), 0 false fails, 2 pages no verdict; 60 earlier unseen pages found and fixed seven false-fail classes (spec Revisions); ACT oj04fd 7/7 with the packaged code' },
   async measure(page) {
-    const r = await page.evaluate(async ([THIRD, maxTargets]) => {
-      const PROPS = ['outline-style', 'outline-width', 'outline-color', 'box-shadow', 'border-color', 'background-color', 'color', 'text-decoration-line', 'opacity', 'visibility', 'display'];
-      const raf2 = () => new Promise(r => requestAnimationFrame(() => requestAnimationFrame(r)));
-      // Elements with an infinitely repeating animation (pulses, spinners) are excluded from the document diff; a target is always diffed itself.
-      const animating = new Set(document.getAnimations().filter(a => a.effect?.getTiming?.().iterations === Infinity).map(a => a.effect.target).filter(Boolean));
-      const all = keep => [...document.querySelectorAll('body, body *')].filter(e => e === keep || !animating.has(e));
-      const snap = els => els.map(el => { const cs = getComputedStyle(el); const r = el.getBoundingClientRect(); const pinned = cs.position === 'fixed' || cs.position === 'sticky'; const zero = r.width === 0 && r.height === 0; const rect = zero ? [0] : pinned ? [r.width, r.height] : [r.x + scrollX, r.y + scrollY, r.width, r.height]; return PROPS.map(p => cs.getPropertyValue(p)).join('|') + '|' + rect.map(v => Math.round(v)).join(','); });
-      const sel = el => el.tagName.toLowerCase() + (el.id ? '#' + el.id : '') + (typeof el.className === 'string' && el.className.trim() ? '.' + el.className.trim().split(/\s+/).slice(0, 2).join('.') : '');
-      const cands = [...document.querySelectorAll('a[href],button,input,select,textarea,summary,[tabindex],[contenteditable]')]
-        .filter(e => { const ti = e.getAttribute('tabindex'); if (ti !== null && parseInt(ti) < 0) return false; if (e.disabled) return false; if (e.closest(THIRD)) return false; const cs = getComputedStyle(e); if (cs.visibility === 'hidden' || cs.display === 'none') return false; return e.getClientRects().length > 0; });
-      const targets = cands.slice(0, maxTargets);
-      // Revision 2026-09-06: blur first, so an autofocused control is not already focused in its own before-snapshot.
-      if (document.activeElement && document.activeElement !== document.body) document.activeElement.blur(); await raf2();
-      // Quiesce: wait for a 400 ms window with no change (up to six windows, transitions from the blur included) before the noise window is judged.
-      const els0 = all(); let noise = 0, quiet = 0;
-      for (let w = 0; w < 6; w++) { const n0 = snap(els0); await new Promise(r => setTimeout(r, 400)); const n1 = snap(els0); noise = 0; for (let i = 0; i < n0.length; i++) if (n0[i] !== n1[i]) noise++; if (noise === 0) break; quiet = w + 1; }
-      const items = [];
-      for (const el of targets) {
-        const els = all(el); const before = snap(els);
-        el.focus({ focusVisible: true, preventScroll: false }); await raf2();
-        if (document.activeElement !== el) { items.push({ sel: sel(el), skipped: 'no-focus' }); continue; }
-        const after = snap(els);
-        let changed = 0, selfChanged = false; for (let i = 0; i < before.length; i++) if (before[i] !== after[i] && els[i].isConnected) { changed++; if (els[i] === el) selfChanged = true; }
-        el.blur(); await raf2();
-        const r = el.getBoundingClientRect();
-        items.push({ sel: sel(el), text: (el.textContent || el.value || '').trim().slice(0, 40), changed, selfChanged, shift: !selfChanged && changed > Math.max(20, els.length * 0.3), inViewport: r.bottom > 0 && r.top < innerHeight });
+    const n = await page.evaluate(THIRD => {
+      window.__uxfv = [...document.querySelectorAll('a[href],button,input,select,textarea,summary,[tabindex],[contenteditable]')]
+        .filter(e => { const ti = e.getAttribute('tabindex'); if (ti !== null && parseInt(ti) < 0) return false; if (e.disabled) return false; if (e.closest(THIRD)) return false; const cs = getComputedStyle(e); if (cs.visibility === 'hidden' || cs.display === 'none') return false; return e.getClientRects().length > 0; })
+        .slice(0, 80);
+      if (document.activeElement && document.activeElement !== document.body) document.activeElement.blur();
+      return window.__uxfv.length;
+    }, THIRD);
+    if (n === 0) return { verdict: 'not-applicable', why: 'no focusable element', candidates: 0 };
+    const shot = clip => page.screenshot({ clip, animations: 'disabled', caret: 'hide', timeout: 5000 });
+    const full = () => page.screenshot({ animations: 'disabled', caret: 'hide', timeout: 8000 });
+    const frames = () => page.evaluate(() => new Promise(r => requestAnimationFrame(() => requestAnimationFrame(r))));
+    const blur = () => page.evaluate(() => { if (document.activeElement && document.activeElement !== document.body) document.activeElement.blur(); }).catch(() => {});
+    const items = [], hidden = [];
+    for (let i = 0; i < n; i++) {
+      const readBox = (i, scroll) => page.evaluate(async ([i, scroll]) => {
+        const el = window.__uxfv[i]; if (scroll) { el.scrollIntoView({ block: 'center', inline: 'center', behavior: 'instant' }); await new Promise(r => requestAnimationFrame(r)); }
+        // Finish finite animations (scroll-reveal transforms) so the box is read in the state the screenshots freeze to.
+        for (const a of document.getAnimations()) { try { const tm = a.effect?.getTiming?.(); if (tm && tm.iterations !== Infinity) a.finish(); } catch {} } await new Promise(r => requestAnimationFrame(r));
+        // The box is the union of the control's own box and its content's box: an inline link wrapping an image has a one-line box while its ring is drawn around the image.
+        const r0 = el.getBoundingClientRect(); const rg = document.createRange(); rg.selectNodeContents(el); const rc = rg.getBoundingClientRect();
+        const x1 = Math.min(r0.left, rc.width ? rc.left : r0.left), y1 = Math.min(r0.top, rc.height ? rc.top : r0.top), x2 = Math.max(r0.right, rc.width ? rc.right : r0.right), y2 = Math.max(r0.bottom, rc.height ? rc.bottom : r0.bottom);
+        const r = { x: x1, y: y1, width: x2 - x1, height: y2 - y1 };
+        const sel = el.tagName.toLowerCase() + (el.id ? '#' + el.id : '') + (typeof el.className === 'string' && el.className.trim() ? '.' + el.className.trim().split(/\s+/).slice(0, 2).join('.') : '');
+        // Painted: effective opacity above zero, and a hit test at the box centre or one of four inner points lands on the control or its content.
+        // Clipped: an overflow-hidden ancestor whose box the control lies outside of. A hit on an ancestor means the control is not painted there (hidden tab panel).
+        let opacity = 1, clipped = false; for (let a = el; a; a = a.parentElement) { const cs = getComputedStyle(a); opacity *= parseFloat(cs.opacity); if (a !== el && /hidden|clip|scroll|auto/.test(cs.overflow + cs.overflowX + cs.overflowY)) { const b = a.getBoundingClientRect(); if (Math.min(r.x + r.width, b.right) - Math.max(r.x, b.left) <= 0 || Math.min(r.y + r.height, b.bottom) - Math.max(r.y, b.top) <= 0) clipped = true; } }
+        const pts = [[.5, .5], [.25, .5], [.75, .5], [.5, .25], [.5, .75]].map(([fx, fy]) => [Math.min(innerWidth - 1, Math.max(0, r.x + r.width * fx)), Math.min(innerHeight - 1, Math.max(0, r.y + r.height * fy))]);
+        const hits = pts.map(([x, y]) => document.elementFromPoint(x, y)); const own = hits.some(h => h && (h === el || el.contains(h)));
+        const covered = !own && hits.some(h => h && !h.contains(el));
+        return { sel, text: (el.textContent || el.value || el.getAttribute('aria-label') || '').trim().slice(0, 40), x: r.x, y: r.y, w: r.width, h: r.height, opacity, clipped, own, covered };
+      }, [i, scroll]);
+      const cropOf = t => { const x0 = Math.max(0, t.x - PAD), y0 = Math.max(0, t.y - PAD); return { x: x0, y: y0, width: Math.min(VW - x0, t.x + t.w + PAD - x0), height: Math.min(VH - y0, t.y + t.h + PAD - y0) }; };
+      const offscreen = (t, clip) => clip.width < 1 || clip.height < 1 || t.x + t.w < 0 || t.y + t.h < 0 || t.x > VW || t.y > VH;
+      const t = await readBox(i, true); let clip = cropOf(t);
+      const item = { sel: t.sel, text: t.text };
+      if (t.w === 0 || t.h === 0) { items.push({ ...item, unmeasured: 'zero-size' }); continue; }
+      if (offscreen(t, clip)) { items.push({ ...item, unmeasured: 'outside the viewport after scrolling' }); continue; }
+      if (t.opacity === 0 || t.clipped || (!t.own && !t.covered)) { hidden.push({ ...item, how: t.opacity === 0 ? 'opacity 0 on the control or an ancestor' : t.clipped ? 'clipped by an overflow-hidden ancestor it lies outside of' : 'not painted at its own box' }); items.push({ ...item, unmeasured: 'not painted' }); continue; }
+      if (t.covered) { items.push({ ...item, unmeasured: 'covered by another element' }); continue; }
+      // Focus arrives by a real Tab key press: focus the control, Shift+Tab to whatever precedes it, Tab back. Pages that draw rings only when
+      // focus follows a key event are measured as a keyboard user meets them.
+      const tabTo = async i => {
+        const landed = await page.evaluate(i => { const el = window.__uxfv[i]; el.focus({ preventScroll: true }); return document.activeElement === el; }, i);
+        if (!landed) return 'did not take focus';
+        await page.keyboard.press('Shift+Tab'); await page.keyboard.press('Tab');
+        return (await page.evaluate(i => document.activeElement === window.__uxfv[i], i)) ? null : 'Tab did not reach the control';
+      };
+      const notReached = await tabTo(i); if (notReached) { await blur(); items.push({ ...item, unmeasured: notReached }); continue; }
+      await frames();
+      // The predecessor's focus may have opened something or scrolled the page: read the box again in the focused state.
+      const t2 = await readBox(i, false); clip = cropOf(t2);
+      if (t2.w === 0 || t2.h === 0 || offscreen(t2, clip)) { await blur(); items.push({ ...item, unmeasured: 'outside the viewport after Tab' }); continue; }
+      if (t2.opacity === 0 || t2.clipped || (!t2.own && !t2.covered)) { await blur(); items.push({ ...item, unmeasured: 'not painted after Tab' }); continue; }
+      if (t2.covered) { await blur(); items.push({ ...item, unmeasured: 'covered after Tab' }); continue; }
+      let b, bv; try { b = await shot(clip); bv = await full(); } catch { await blur(); items.push({ ...item, unmeasured: 'screenshot timed out' }); continue; }
+      await blur(); await frames();
+      // A focus trap that takes focus back on blur would put the ring into the "unfocused" shots.
+      const stillFocused = await page.evaluate(() => document.activeElement && document.activeElement !== document.body && document.activeElement !== document.documentElement);
+      if (stillFocused) { items.push({ ...item, unmeasured: 'focus returned on blur' }); continue; }
+      let a1, a2; try { a1 = await shot(clip); a2 = await shot(clip); } catch { items.push({ ...item, unmeasured: 'screenshot timed out' }); continue; }
+      if (PNG.diff(a1, a2) > 0) { items.push({ ...item, unmeasured: 'changes with no interaction' }); continue; }
+      let changed = PNG.diff(a1, b), av = null;
+      if (changed === 0) {
+        // Nothing changed near the control. Before calling that a fail, look at the whole viewport: a change away from the control
+        // (a card highlighted, a heading underlined, a menu opening) may be the indicator, or may be unrelated; either way it is not a measured absence.
+        try { av = await full(); } catch { items.push({ ...item, unmeasured: 'screenshot timed out' }); continue; }
+        const away = PNG.diff(av, bv);
+        if (away > 0) { items.push({ ...item, unmeasured: 'changes away from the control', awayPixels: away }); continue; }
       }
-      const focusable = items.filter(i => !i.skipped);
-      return { candidates: cands.length, tested: targets.length, focusable: focusable.length, noise, settledAfter: quiet, animatingExcluded: animating.size, fails: focusable.filter(i => i.changed === 0), shifted: focusable.filter(i => i.shift).length };
-    }, [THIRD, 80]);
-    const base = { candidates: r.candidates, tested: r.tested, noise: r.noise, settledAfter: r.settledAfter, animatingExcluded: r.animatingExcluded, shifted: r.shifted };
-    if (r.focusable === 0) return { verdict: 'not-applicable', why: 'no focusable element', ...base };
-    if (r.noise > 0) return { verdict: 'unmeasurable', why: `document keeps changing with no interaction (${r.noise} elements in the last 400 ms window of 2.4 s)`, ...base };
-    if (r.fails.length) return { verdict: 'fail', why: `${r.fails.length} of ${r.focusable} focusable elements change nothing on focus`, targets: r.fails, ...base };
-    if (r.shifted) return { verdict: 'unmeasurable', why: `${r.shifted} targets move most of the page without changing themselves (layout shift)`, ...base };
-    return { verdict: 'pass', why: `${r.focusable} focusable elements each change on focus`, ...base };
+      if (changed === 0) {
+        // Still nothing. An indicator drawn by script on a timer would be missed two frames after focus: Tab again, wait 250 ms, look once more.
+        const again = await tabTo(i); if (again) { await blur(); items.push({ ...item, unmeasured: again }); continue; }
+        await page.waitForTimeout(250);
+        let b2, bv2; try { b2 = await shot(clip); bv2 = await full(); } catch { await blur(); items.push({ ...item, unmeasured: 'screenshot timed out' }); continue; }
+        await blur(); await frames();
+        changed = PNG.diff(a1, b2); if (changed > 0) b = b2;
+        else if (PNG.diff(av, bv2) > 0) { items.push({ ...item, unmeasured: 'changes away from the control', awayPixels: PNG.diff(av, bv2) }); continue; }
+      }
+      items.push({ ...item, changedPixels: changed, crop: clip, before: a1, after: b });
+    }
+    const measured = items.filter(i => i.changedPixels !== undefined), unmeasured = items.filter(i => i.unmeasured);
+    const fails = measured.filter(i => i.changedPixels === 0);
+    const reasons = {}; for (const u of unmeasured) reasons[u.unmeasured] = (reasons[u.unmeasured] || 0) + 1;
+    const pub = i => ({ sel: i.sel, text: i.text, changedPixels: i.changedPixels });
+    const base = { candidates: n, measured: measured.length, unmeasured: reasons };
+    if (hidden.length) base.finding = { kind: 'hidden-focusable', why: `${hidden.length} control${hidden.length > 1 ? 's are' : ' is'} in the tab order but not painted (${[...new Set(hidden.map(h => h.how))].join('; ')}); not measured for 2.4.7`, targets: hidden.slice(0, 5) };
+    if (fails.length) return { verdict: 'fail', why: `${fails.length} of ${measured.length} measured controls show no pixel change on focus`, targets: fails.map(pub), evidence: fails.map(i => ({ sel: i.sel, before: i.before, after: i.after })), ...base };
+    if (measured.length < Math.max(1, (n - hidden.length) / 2)) return { verdict: 'unmeasurable', why: `only ${measured.length} of ${n - hidden.length} controls could be measured (${Object.entries(reasons).map(([k, v]) => `${v} ${k}`).join(', ')})`, ...base };
+    return { verdict: 'pass', why: `${measured.length} controls each change visibly on focus${unmeasured.length ? `, ${unmeasured.length} not measured` : ''}`, ...base };
   },
 };

package/src/probes/focus-visible/spec.md

@@ -1,18 +1,36 @@
 # page.focus-visible · WCAG 2.4.7 · provenance spec
 
-- **why:** SC text: any keyboard operable user interface has a mode of operation where the keyboard focus indicator is visible. A focusable element that changes nothing when it receives focus has no indicator.
-- **applies-when:** element is in the sequential focus order (`a[href], button, input, select, textarea, summary, [tabindex>=0], [contenteditable]`), not disabled, computed `visibility != hidden`, `display != none`, at least one client rect, and not inside a third-party subtree (`iframe`, ad containers). First 80 such elements per page.
-- **correct-when:** after the active element is blurred and the document has been quiet for one 400 ms window (up to six windows are waited), then `focus({focusVisible:true})` on the target and two animation frames, at least one element in the document changed any of: `outline-style, outline-width, outline-color, box-shadow, border-color, background-color, color, text-decoration-line, opacity, visibility, display`, or its document-relative rect. Rect is document-relative (`+scrollX/Y`); fixed/sticky elements compare size only; 0×0 elements are recorded as a constant. Detached nodes and elements carrying an infinitely repeating animation (`getAnimations()` with infinite iterations) are excluded from the diff; the focused target itself is always compared. The count of excluded animating elements is reported.
-- **verdict:** `fail` if any target changes nothing, listing the targets; `unmeasurable` if the document still changes with no interaction after six 400 ms windows (noise > 0) or a target changes more than max(20, 30%) of elements without changing itself (layout shift); `pass` otherwise; `not-applicable` if no focusable element.
-- **invalid-if:** element still outside the viewport after focus; static CSSOM read instead of runtime; document self-mutating; mass change with target unchanged; page title matches a bot-challenge pattern (`unmeasurable · blocked`).
-- **known-infidelity:** computed style ≠ pixels (a border→outline swap of the same colour passes); AT-specific focus not simulated; a change on a sibling counts as an indicator even when it is not near the target.
+- **why:** SC text: any keyboard operable user interface has a mode of operation where the keyboard focus indicator is visible. A focusable control whose rendered pixels do not change when it receives focus has no visible indicator.
+- **applies-when:** element is in the sequential focus order (`a[href], button, input, select, textarea, summary, [tabindex>=0], [contenteditable]`), not disabled, computed `visibility != hidden`, `display != none`, at least one client rect, not inside a third-party subtree (`iframe`, ad containers), and painted: effective opacity above zero (product over the control and its ancestors), its box intersects every `overflow` hidden/clip/scroll ancestor's box, and a hit test at the centre of its box or at one of four inner points lands on the control or its content. First 80 such elements per page, in document order. A control in the tab order that is not painted (opacity 0, clipped by a zero-height `overflow:hidden` ancestor, behind a hidden tab panel) is reported as a `finding` (`hidden-focusable`) and not measured.
+- **correct-when:** per control: the active element is blurred; the control is scrolled to the centre of a 1280×800 viewport (instant scroll, so a page's smooth-scroll setting cannot leave it in flight) and every finite animation is finished, so the box is read in the state the screenshots freeze to. Focus then arrives by a real key press: the control is focused, Shift+Tab moves to whatever precedes it, Tab moves back; the control must be the active element afterwards. Two animation frames pass; the box and the hit test are read again in this state (the predecessor's focus may have opened or scrolled something); a screenshot of the control's box (the union of its own box and its content's box) padded by 48 px and a whole-viewport screenshot are taken in the focused state; the control is blurred, two frames pass, nothing may hold focus, and the crop is taken twice in the unfocused state. When the crop and the viewport show no change, focus is given the same way once more, 250 ms pass, and both are read again, so an indicator drawn by script on a timer is not missed. Screenshots freeze CSS animations and transitions at their end state and hide the caret. The control is *indicated* when at least one pixel of the crop differs by more than 8/255 in any RGB channel between the focused and unfocused screenshots. When the crop shows no change, the whole viewport is compared the same way: a change anywhere else on screen means the control is *not measured* (the change may be the indicator drawn elsewhere, or unrelated); only a control whose focus changes no pixel in the entire viewport is *not indicated*.
+- **verdict:** `fail` if any measured control is not indicated, listing the controls with their before and after crops; `pass` if every measured control is indicated and at least half of the candidates could be measured; `unmeasurable` if fewer than half could be measured, with the reasons; `not-applicable` if no focusable element.
+- **invalid-if (per control, reported as not measured, never as fail):** focus changes pixels away from the control but none near it; zero-size box; box outside the viewport after scrolling; centre of the box covered by another element (`elementFromPoint`); the two unfocused screenshots differ (content changing with no interaction); the control did not take focus; Tab did not reach the control (a focus trap, a widget that moves focus on its own); after Tab the control is off-screen, not painted or covered (the predecessor's focus changed the page); focus returned on blur (a trap); a screenshot timed out (fonts still loading). Page title matches a bot-challenge pattern → `unmeasurable · blocked`.
+- **known-infidelity:** a control with no indicator whose focus changes something else on screen is not measured, not failed; an unrelated change within 48 px of the control (a tooltip, a menu opening, a layout shift) counts as indicated; an indicator drawn only in the unmeasured region of a partly visible control is missed; the 8/255 threshold treats a ring of nearly the background colour as no indicator; focus is measured as it arrives by Tab, never by mouse or script; a change that persists after blur (a tooltip that stays) is not seen; AT-specific focus is not simulated. A painted control whose five-point hit test lands on an ancestor is reported as `hidden-focusable` and not measured (six carousel cards on one unseen page, 2026-09-07): a false finding, never a false fail.
 
 ## Revisions
 
-v1 frozen 2026-09-05 (P0-A, sha256 `375832c3…da11bc`, verdicts `passed/failed/inapplicable/blocked`). ACT oj04fd 7/7 with v1.
+v1 frozen 2026-09-05 (P0-A, sha256 `375832c3…da11bc`): computed-style and rect diff over the whole document after focus; verdicts `passed/failed/inapplicable/blocked`. ACT oj04fd 7/7.
 
-- 2026-09-06 **blur before the before-snapshot.** v1 took the before-snapshot with the page's autofocused control already focused, so that control read as "changes nothing" (false fail on two real login screens). The must-pass twin carries an `autofocus` control so the gate guards this.
-- 2026-09-06 **quiesce before the noise window.** The blur itself starts the focus ring's fade-out transition, which v1's single 400 ms window read as noise (two real screens went `unmeasurable`). Up to six 400 ms windows are waited for one quiet window; the must-pass twin transitions its focus ring so the gate guards this. Pages that never go quiet stay `unmeasurable`.
-- 2026-09-06 **infinitely animating elements excluded from the diff.** A pulsing status dot kept one real screen `unmeasurable` after quiesce; such elements can never be quiet and carry no focus information unless they are the target. The must-pass twin carries a pulsing dot so the gate guards this.
-- 2026-09-06 **third-party subtrees excluded** from targets, carried from the P0-A text-spacing finding.
-- 2026-09-06 verdict names mapped to the repo's list: `pass`, `fail`, `not-applicable`, `unmeasurable`; `blocked` is an `unmeasurable` reason.
+v2 2026-09-06 (0.2.0, 0.2.1): v1 plus blur before the snapshot (autofocus false fail on two real screens), quiesce over up to six 400 ms windows, infinitely animating elements excluded from the diff, third-party subtrees excluded, verdict names mapped to the repo's list. ACT 7/7; 20 P0-A pages 0 false fails.
+
+v3 2026-09-06: **the measurement is pixels, not computed style.** An independent screenshot check of v2's results found 17 of 64 controls on one page and 4 of 18 on another whose computed style changed on focus while no pixel did (a transparent box-shadow, a colour change under `opacity:0`), which v2 called indicated. v3 measures the rendered crop of each control; per-control conditions that make a real ring invisible in a crop (off-viewport, covered, zero-size, changing on its own, no focus taken) are reported as not measured, never as fail. Document-wide noise, the quiesce wait and the animation exclusion are retired: screenshots freeze animations and each control is checked for self-change. The must-fail twin's mutation is a focus style that changes computed values without pixels, which v2 passed and v3 fails.
+
+## Method status
+
+`method-validated` (2026-09-06). Validated means: a recorded run with the packaged code on at least 20 pages or flows the probe had not seen when its definition was last revised, 0 false fails, plus a recall record (ACT cases or seeded defects). Record: 20 unseen pages (list 4, 2026-09-06, drawn after the v3.8 definition was committed): 62 failing controls on 7 pages, 58 re-measured by a real Tab press and a whole-viewport diff, 4 by the viewport diff alone (the check could not land Tab on them), 0 false fails, 2 pages no verdict; 60 earlier unseen pages found and fixed seven false-fail classes (spec Revisions); ACT oj04fd 7/7 with the packaged code. The lists, their hashes and the per-page output are in the working notes, not in this repository.
+
+v3.1 2026-09-06: **instant scroll.** On pages with `scroll-behavior: smooth` the control was still in flight when its box was read, so the crop covered the wrong region and a real ring fell outside it: one false fail (Wikipedia home) and 66 of 80 controls reported off-viewport on MDN. Scrolling is instant and one frame is waited before the box is read.
+
+v3.2 2026-09-06: **the box includes the content.** An inline link wrapping an image has a one-line box in the middle of the image while its focus ring is drawn around the image; the crop missed the ring on three image links of one page (a false fail). The crop is now the union of the control's own box and its content's box.
+
+v3.3 2026-09-06: **48 px padding.** On the first unseen-page run a link whose focus ring is drawn on an ancestor card (GitHub home) showed 0 changed pixels within 12 px and 694 within 40 px: a false fail. Rings drawn by wrappers (input pills, cards) sit outside a tight crop. Padding is 48 px; the cost, unrelated changes near the control counting as an indicator, is listed under known-infidelity. The first unseen run (20 domains, `unseen/out-unseen.json`) is kept as a record but does not count toward validation: its second-reader confirmations were made on 12 px crops that could not show such rings. A second list is drawn from the next Tranco entries.
+
+v3.4 2026-09-06: **finite animations are finished before the box is read.** On the second unseen run four links on one page (scroll-reveal transform still running) showed 0 changed pixels in their crop while the whole viewport changed 870 pixels: the screenshots freeze animations to their end state, so the ring was drawn 100 px above the box read mid-animation. A false fail. Every finite animation is finished before the box is read, matching the screenshot state.
+
+v3.5 2026-09-06: **fail means no pixel changed anywhere in the viewport.** On the second unseen run four card links on one page drew their ring 100 px above the control's box (on a `:focus-within` ancestor), outside the 48 px crop: a false fail under v3.3/v3.4. A crop that changes is an indicator; a crop that does not change while the viewport does is now *not measured*; only a focus that changes nothing on the whole screen is a fail. The cost is recall (a control with no ring on a page where focus also opens a menu elsewhere is not measured), listed under known-infidelity.
+
+v3.6 2026-09-06: **one real Tab key press before measuring.** A real Tab press on every seen focus-visible fail (`fv-tab-check.mjs`) found one page (Spotify home, 19 controls) whose `<html>` carries a `no-focus-outline` class removed on the first keydown: programmatic focus with no prior key event shows nothing, a real Tab shows the ring, and after one Tab press programmatic focus shows the same ring (0 pixels between the two). Every v3.x fail on that page was a false fail; the other pages checked (SharePoint 13, Cloudflare DNS 12, Zoom 8) show 0 pixels under Tab too. The probe now presses Tab once and blurs before measuring. Both twins start in such a mode, so v3.5 fails the must-pass twin and v3.6 is needed to pass the gate. The third unseen run had started under v3.5 and was stopped after 4 of 20 pages; its partial output is kept unread as a record and the third list is run again under v3.6 (see the workspace rule).
+
+v3.7 2026-09-06: **focus arrives by a real Tab press; unpainted controls are a finding, not a measurement.** The third unseen run (20 pages under v3.6) found two more false-fail classes. (1) One page draws its ring only when the focus event follows a key event (a per-event keyboard detector, as focus-visible polyfills do): after v3.6's single priming press, programmatic focus still changed 0 pixels while a real Tab drew 411 to 1597 pixels on three controls. Focus is now given by focusing the control, Shift+Tab and Tab, and the control must be the active element afterwards. (2) Controls in the tab order that are never painted: 37 copy buttons inside zero-height `overflow:hidden` snippets on one page, 41 controls inside `opacity:0` panels on another, 2 on a third. Their centre hit test lands on an ancestor, which v3.x counted as not covered. Such controls are excluded from applies-when and reported as a `hidden-focusable` finding with their reason. The unfocused screenshots are now taken after blur (so the predecessor's ring is gone in both states). The must-pass twin draws its ring only through a per-event detector and both twins carry a zero-height button and an opacity-0 link; v3.6 fails the must-pass twin, v3.7 passes. List 3 was read to find these classes, so a fourth list is drawn.
+
+v3.8 2026-09-06: **three false-fail paths closed by analysis, before the fourth list was drawn.** (1) The predecessor's focus (Shift+Tab) can open a menu that covers the control or scroll the page, so the crop read before the key presses is stale: the box and the hit test are read again after Tab, and a control now off-screen, unpainted or covered is not measured. (2) A focus trap that takes focus back on blur would put the ring into the unfocused shots: nothing may hold focus after blur, else not measured. (3) An indicator drawn by script on a timer later than two frames was invisible to the focused shot: when crop and viewport show no change, focus is given again and both are re-read after 250 ms. The must-pass twin's Save button now draws its ring 200 ms after keyboard focus; v3.7 fails it, v3.8 passes. No page informed this revision.

package/src/probes/redundant-entry/pair.json

@@ -1,17 +1,17 @@
 {
  "journey": "test/journeys/checkout.json",
- "operator": "review.html: a \"Confirm your email for the receipt\" field is added inside the order form, empty, not pre-populated, no way to select the value entered on details.html",
+ "operator": "review.html: the \"Email for the receipt\" field, pre-populated from details.html in the clean fixture, is replaced by an empty \"Confirm your email for the receipt\" field with no way to select the value entered earlier",
  "hashes": {
   "site": {
    "account.html": "3972383a0e127789055e87f517e5812e7d0aadf98a979748b9468cbf5cdcef29",
-   "cart.html": "c40a826acc5df143e6c8bdb8b2ad95b6c236a1bf24315ef4a729902209fa3125",
+   "cart.html": "a0fca9a16b3311361845c593b6000fd845112a9474e1dbd327166f985cd17db0",
    "contact.html": "fe0b4f737714599aea8ffc61a0e3e66e66eb2ef900f97f29970d90085bdfb457",
-   "details.html": "866dedf0b0ff5baea57490907b07d2f726f00c69add81128e7938438e8f4d987",
-   "done.html": "714bfde7c1ba4e24d162f1faf9ab781ac0d06f44b149441c4845e740dcc32102",
+   "details.html": "2e26fd9639b1838cc3477b1c9063b36558fada4d9ffd4590d95131ed95eb5578",
+   "done.html": "edf53d01f5ecd357656926e96eb4c2f38cc692ddcc685bac82ad7af1938498a1",
    "help.html": "e457b0e9a716019065de458d89114c37fbd14e67ada1ec69c8a2f65efbd1acbf",
    "home.html": "287874d84b918ed8d6c16ce73d9ab631a489a5f9263933811e8ea960702126b2",
    "privacy.html": "24d287f9a4e59218d69eb38360f674a92ada08860f2b194f71b7be2b9dbbdeff",
-   "review.html": "6a2191f30dc103062e986c7fada8f036f0931bc2247a70ed599c8b7d50b361b4",
+   "review.html": "5b251489b736f55ae1fab7f91f196c32d65696ded0b4d16b26e40c71489a2c02",
    "shop.html": "56a4d04abc3ca851bc29aff43be027c7f6406aeb0eb90d5dccc39c6088a1e679",
    "style.css": "7f85da7845e02428fb480f86b8bcc3e32ae491882f27bcf35c10caef88999586",
    "terms.html": "bd6a5c83a4e786574107a3aa02dc18e5b327624ebc14739fd0ae1785d180c187"
@@ -20,4 +20,4 @@
    "review.html": "ff15027d89634b159a4e8a73475c9282cfd668a10301a68174cc7904c6bb505b"
   }
  }
-}
+}

package/src/probes/redundant-entry/probe.js

@@ -23,10 +23,14 @@ function match(inputs, recorded, idx) {
 
 export default {
   id: 'flow.redundant-entry', sc: '3.3.7',
+  method: { status: 'method-unproven', record: 'P0-B ran pre-package code on 20 flows; no unseen-flow run with the packaged code yet' },
   async onStep(page, rec, ctx) {
     if (rec.i === 0 || !ctx.recorded.length) return;
     const details = [];
+    const step = ctx.J.steps[rec.i]; let passwordStep = false;
+    for (const sel of Object.keys(step.fill || {})) { try { if (await page.locator(sel).first().evaluate(el => el.type === 'password')) { passwordStep = true; break; } } catch {} }
     for (const m of match(rec.inputsOnArrival, ctx.recorded, rec.i)) {
+      if (passwordStep && (m.field.type === 'email' || /^(username|email)$/.test(m.field.autocomplete) || /user|login|email/i.test(m.field.name + ' ' + m.field.id + ' ' + m.field.label))) { details.push({ field: { name: m.field.name, id: m.field.id, type: m.field.type, label: m.field.label, autocomplete: m.field.autocomplete }, matchedBy: m.by, firstEnteredStep: m.prior.step, currentValue: m.field.value, mechanism: 'security: login identity on a step that enters a password (spec)' }); continue; }
       const f = m.field, p = m.prior; let mechanism = null;
       if (norm(f.value) === norm(p.value) || norm(f.value) === norm(p.display)) mechanism = 'auto-populated';
       else if (p.essential) mechanism = 'essential (project)'; else if (p.security) mechanism = 'security (project)';

package/src/probes/redundant-entry/spec.md

@@ -2,7 +2,7 @@
 
 - **why:** SC text: information previously entered or provided in the same process that is required again must be auto-populated or available to select, except when re-entry is essential, required for security, or the earlier information is no longer valid.
 - **applies-when:** step index > 1 in the journey, evaluated **on arrival at the step, before that step's own fill**; a visible, enabled, editable input (`input` not hidden/password/submit/button/search, `textarea`, `select`) inside the process form — the `form` ancestor of the control the journey submits on that step. A step with no `submit`, or whose control is not inside a form, contributes no inputs: other forms on the page (product review, newsletter, search, site chrome) are not part of the process. The input's identity matches a value recorded in an earlier step. Identity match, in order: same non-empty `autocomplete` token; same `name`; same `type` in {email, tel, url}; accessible label equal after normalization.
-- **correct-when:** for each matched field, one of: its current value equals the earlier value (auto-populated); or a control on the same page offers the earlier value for selection (a `select`, `datalist`, radio group, or checkbox whose option/label text contains the earlier value, or a checkbox/radio whose label matches /same as|use (my|the|this) .*(address|details|information)/i); or the journey marks the field `essential` or `security` (provenance `project`).
+- **correct-when:** for each matched field, one of: its current value equals the earlier value (auto-populated); or a control on the same page offers the earlier value for selection (a `select`, `datalist`, radio group, or checkbox whose option/label text contains the earlier value, or a checkbox/radio whose label matches /same as|use (my|the|this) .*(address|details|information)/i); or the journey marks the field `essential` or `security` (provenance `project`); or the step enters a password and the field is login identity (`type=email`, `autocomplete` username/email, or name/id/label matching /user|login|email/i): re-entering the identifier next to a password is the SC's security exception (provenance `spec`).
 - **verdict:** `pass` if no matched field lacks a mechanism; `fail` listing each re-asked field with the step where it was first entered; `not-applicable` if no field matches; `unmeasurable` if earlier steps recorded no values.
 - **invalid-if:** the earlier step's values were not recorded (journey started mid-process); the field is inside a third-party subtree (`iframe`, ad container) — excluded.
 - **known-infidelity:** identity by `name`/label can conflate distinct fields (billing vs shipping address) — a `fieldset` legend or `autocomplete` section token (`shipping`, `billing`) that differs between the two occurrences suppresses the match; "same as" detection is a text heuristic and is reported in `why`.
@@ -35,3 +35,11 @@ Acceptance: Toolshop register→checkout billing step must report the house-numb
 ## Falsification pair
 
 See `pair.json`: one fixture where this probe must return `fail` for the stated operator, one where it must stay silent. `uxcli gate` runs both and checks the hashes. Written from the WCAG 2.2 Understanding text before any fixture or site was opened; revision history is kept outside the package.
+
+## Method status
+
+`method-unproven`. Validated means: a recorded run with the packaged code on at least 20 pages or flows the probe had not seen when its definition was last revised, 0 false fails, plus a recall record (ACT cases or seeded defects). Until then a would-be `fail` is reported as `finding`. Record so far: P0-B ran pre-package code on 20 flows; no unseen-flow run with the packaged code yet.
+
+## Revisions
+
+- 2026-09-06 login identity on a password step is the security exception, not a re-ask. Reason: sign-up → sign-in on the first real project read the email field as redundant entry.

package/src/probes/text-spacing/must-fail/index.html

@@ -1 +1 @@
-<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Delivery terms</title><style>body{font:16px/1.4 system-ui,sans-serif;margin:2rem;max-width:34rem;color:#222;background:#fff}</style></head><body><h1>Delivery terms</h1><p style="line-height:1.6 !important">Orders placed before noon leave the warehouse the same day. Deliveries to the islands take one extra working day and are not available on public holidays. Signatures are required for parcels above two hundred euro.</p><p style="letter-spacing:0 !important">Returns are accepted within thirty days of delivery when the seal is unbroken.</p></body></html>
+<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Delivery terms</title><style>body{font:16px/1.4 system-ui,sans-serif;margin:2rem;max-width:34rem;color:#222;background:#fff}</style></head><body><h1>Delivery terms</h1><p style="line-height:1.6 !important">Orders placed before noon leave the warehouse the same day. Deliveries to the islands take one extra working day and are not available on public holidays. Signatures are required for parcels above two hundred euro.</p><p style="letter-spacing:0 !important">Returns are accepted within thirty days of delivery when the seal is unbroken.</p><ins class="adsbygoogle" style="display:block;margin-top:2rem;padding:1rem;background:#fff"><a href="#ad" style="outline:none;color:#999">Sponsored: a link with no focus style</a><p style="letter-spacing:0 !important;color:#9a9a9a">Ad copy locked at zero letter spacing in low contrast, inside a third-party container.</p></ins></body></html>

package/src/probes/text-spacing/must-pass/index.html

@@ -1 +1 @@
-<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Delivery terms</title><style>body{font:16px/1.4 system-ui,sans-serif;margin:2rem;max-width:34rem;color:#222;background:#fff}</style></head><body><h1>Delivery terms</h1><p style="line-height:1.6 !important">Orders placed before noon leave the warehouse the same day. Deliveries to the islands take one extra working day and are not available on public holidays. Signatures are required for parcels above two hundred euro.</p><p style="letter-spacing:0.15em !important">Returns are accepted within thirty days of delivery when the seal is unbroken.</p></body></html>
+<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Delivery terms</title><style>body{font:16px/1.4 system-ui,sans-serif;margin:2rem;max-width:34rem;color:#222;background:#fff}</style></head><body><h1>Delivery terms</h1><p style="line-height:1.6 !important">Orders placed before noon leave the warehouse the same day. Deliveries to the islands take one extra working day and are not available on public holidays. Signatures are required for parcels above two hundred euro.</p><p style="letter-spacing:0.15em !important">Returns are accepted within thirty days of delivery when the seal is unbroken.</p><ins class="adsbygoogle" style="display:block;margin-top:2rem;padding:1rem;background:#fff"><a href="#ad" style="outline:none;color:#999">Sponsored: a link with no focus style</a><p style="letter-spacing:0 !important;color:#9a9a9a">Ad copy locked at zero letter spacing in low contrast, inside a third-party container.</p></ins></body></html>

package/src/probes/text-spacing/pair.json

@@ -1,12 +1,12 @@
 {
  "kind": "page",
- "operator": "index.html: the second paragraph locks letter-spacing at 0 with an !important style attribute; the must-pass twin locks it at 0.15em. Both lock line-height at 1.6 on a wrapped paragraph.",
+ "operator": "index.html: the second paragraph locks letter-spacing at 0 with an !important style attribute; the must-pass twin locks it at 0.15em. Both lock line-height at 1.6 on a wrapped paragraph. Both twins carry an ins.adsbygoogle block with a focus-less link, a zero letter-spacing lock and low-contrast text: the third-party exclusion must keep all three probes silent on it.",
  "hashes": {
   "mustFail": {
-   "index.html": "eab117b6dd089909104dd1f71ff6a10d7d02e595f35bd42fd7291e7bb6f7ceee"
+   "index.html": "b7d41185ce29efdf75afbc2a82ab7625c1a8ec916b51038a0d6a97febaad4567"
   },
   "mustPass": {
-   "index.html": "46ff4433e7c20347cdf9c4fbb7c4d50f4e2ed408e0645b803e3081f7e08f3e9d"
+   "index.html": "7ed2f5bfb357713da324fac24ddbaf243c3cb0a81ef591cee592f5493422c494"
   }
  }
 }

package/src/probes/text-spacing/probe.js

@@ -4,6 +4,7 @@ const RULES = [['letter-spacing', 0.12, '24afc2'], ['word-spacing', 0.16, '9e45e
 
 export default {
   id: 'page.text-spacing', sc: '1.4.12', kind: 'page',
+  method: { status: 'method-validated', record: '80 unseen pages (lists 1 to 4, 2026-09-06, definitions unchanged since 65ded6c, drawn before every list): 1 fail (reproduced), 0 false fails; ACT 24afc2/9e45ec/78fd32 62/62 with the packaged code' },
   async measure(page) {
     const act = await page.evaluate(([THIRD, RULES]) => {
       const sheetDeclares = (a, prop) => { try { for (const ss of document.styleSheets) for (const r of ss.cssRules || []) if (r.style && r.style.getPropertyValue(prop) && a.matches(r.selectorText)) return r.style.getPropertyPriority(prop) || 'normal'; } catch { } return null; };

package/src/probes/text-spacing/spec.md

@@ -13,3 +13,7 @@ v1 frozen 2026-09-05 (P0-A, sha256 `375832c3…da11bc`). ACT 62/62 with v1.
 
 - 2026-09-06 **third-party subtrees excluded** from targets: on ad-carrying pages every `!important` spacing lock sat inside AdSense containers (P0-A finding).
 - 2026-09-06 verdict names mapped to the repo's list; override breakage attached as `finding`.
+
+## Method status
+
+`method-validated` (2026-09-06). Validated means: a recorded run with the packaged code on at least 20 pages or flows the probe had not seen when its definition was last revised, 0 false fails, plus a recall record (ACT cases or seeded defects). Record: 80 unseen pages (lists 1 to 4, 2026-09-06, definitions unchanged since 65ded6c, drawn before every list): 1 fail (reproduced), 0 false fails; ACT 24afc2/9e45ec/78fd32 62/62 with the packaged code. The lists, their hashes and the per-page output are in the working notes, not in this repository.

package/src/refute.js

@@ -6,6 +6,7 @@ export function refuteQuestion(p) {
   if (p.sc === '3.3.7') { const fields = [...new Set(p.reasked.map(m => m.field.name || m.field.id))]; return `The tool claims: on the screen shown, the field(s) ${fields.join(', ')} (outlined in red) are empty although the user typed the value(s) earlier in the same process. Looking only at the image(s), is that claim supported?`; }
   if (p.sc === '3.3.4') { const c = p.branches.confirmed; return `The tool claims: on the screen shown (the one that places the order), the previously entered values ${c.missing.slice(0, 3).map(m => JSON.stringify(m.value)).join(', ')} are not shown and there is no control to change them before committing. Looking only at the image, is that claim supported?`; }
   if (p.sc === '3.2.3') { const x = p.inversion; return `The tool claims: the two navigation menus shown (from two pages of the same site) list the same items but in a different relative order; specifically ${x.firstInvertedPair.map(s => s.replace(/^[ht]:/, '').split('/').pop()).join(' and ')} are swapped. Looking only at the images, is that claim supported?`; }
+  if (p.sc === '2.4.7') { const t = p.targets[0]; return `The tool claims: the two images are the same crop of one control (${t.sel}${t.text ? ' "' + t.text + '"' : ''}) on a web page, the first before it received keyboard focus and the second after. It claims nothing visible changes between them, so a keyboard user cannot see that this control has focus. Look at both images. Is there any visible focus indicator (outline, ring, glow, underline, colour change) in the second image that is absent from the first?`; }
   return null;
 }
 
@@ -14,6 +15,7 @@ export function refute(p, { cmd = process.env.UXCLI_REFUTER || 'claude -p --mode
   const prompt = `You are an independent second reader checking one claim made by an automated UI checker. You have not seen the checker. Do not trust the claim.\nOpen each image with the Read tool: ${p.proof.join(' , ')}\nQuestion: ${q}\nReply with JSON only, on one line: {"supported": true|false, "reason": "<one sentence, what you saw>"}`;
   const [bin, ...args] = cmd.split(/\s+/);
   const r = spawnSync(bin, [...args, prompt], { encoding: 'utf8', timeout: 180000, stdio: ['ignore', 'pipe', 'pipe'] });
+  if (r.error) return { tested: false, why: `refuter command not found: ${bin} (set UXCLI_REFUTER)` };
   if (r.status !== 0) return { tested: false, why: 'refuter exit ' + r.status + ': ' + (r.stderr || '').slice(0, 200) };
   let text = r.stdout;
   try { const j = JSON.parse(text); text = j.result ?? j.content ?? text; } catch {}

package/src/run.js

@@ -8,10 +8,18 @@ import consistentNavigation from './probes/consistent-navigation/probe.js';
 
 export const PROBES = [errorPrevention, redundantEntry, consistentNavigation];
 
+// README rule: an unproven method reports `finding` where it would say `fail`. The probe's own verdict is kept as rawVerdict.
+export function withMethod(probe, out) {
+  const r = { probe: probe.id, sc: probe.sc, provenance: 'spec', method: probe.method?.status || 'method-unproven', ...out };
+  if (r.verdict === 'fail' && r.method !== 'method-validated') { r.rawVerdict = 'fail'; r.verdict = 'finding'; }
+  return r;
+}
+
 export async function runJourney(J, { browser, outDir } = {}) {
   const own = !browser; if (own) browser = await launch();
   const ctx = { J, steps: [], recorded: [], authSteps: new Set(), commitIdx: J.steps.findIndex(s => s.commit), blocked: false, browser };
   const bctx = await browser.newContext({ viewport: { width: 1280, height: 800 } });
+  bctx.setDefaultTimeout(10000); // a selector that is not on the page fails in 10 s, not 30
   const page = await bctx.newPage();
   for (let i = 0; i < J.steps.length; i++) {
     const step = J.steps[i]; const rec = { i, url: null, arrivedBy: null, title: null, noise: null, inputsOnArrival: [] };
@@ -28,7 +36,7 @@ export async function runJourney(J, { browser, outDir } = {}) {
   await bctx.close();
   segment(ctx);
   const probes = [];
-  for (const p of PROBES) probes.push({ probe: p.id, sc: p.sc, provenance: 'spec', ...(await p.evaluate(ctx)) });
+  for (const p of PROBES) probes.push(withMethod(p, await p.evaluate(ctx)));
   if (own) await browser.close();
   if (outDir) writeEvidence(ctx, probes, outDir);
   for (const s of ctx.steps) delete s.evidence;
@@ -38,7 +46,7 @@ export async function runJourney(J, { browser, outDir } = {}) {
 // Process segments: a goto or a submit that did not navigate starts a new segment; sameProcess joins ranges (provenance project).
 function segment(ctx) {
   const { steps, J } = ctx; const segOf = []; let seg = 0;
-  for (let i = 0; i < steps.length; i++) { if (i > 0 && (steps[i].arrivedBy === 'goto' || steps[i - 1].flowBreak)) seg++; segOf[i] = seg; }
+  for (let i = 0; i < steps.length; i++) { if (i > 0 && (steps[i].arrivedBy === 'goto' || steps[i - 1].flowBreak === 'submitDidNotNavigate')) seg++; segOf[i] = seg; }
   for (const [from, to] of J.sameProcess || []) { const target = segOf[from]; for (let i = from; i <= to && i < segOf.length; i++) { const s0 = segOf[i]; for (let k = 0; k < segOf.length; k++) if (segOf[k] === s0) segOf[k] = target; } }
   steps.forEach((s, i) => { s.segment = segOf[i]; });
   ctx.segOf = segOf;

package/src/tokens.js

@@ -0,0 +1,11 @@
+// Design-token lookup: which custom property in the project's stylesheets declares a colour. Read-only scan of --src.
+import fs from 'node:fs'; import path from 'node:path';
+const EXT = new Set(['.css', '.scss', '.sass', '.less', '.pcss', '.styl']);
+export function tokenIndex(root) {
+  const idx = {}; if (!root || !fs.existsSync(root)) return idx;
+  const walk = d => { for (const f of fs.readdirSync(d, { withFileTypes: true })) { if (f.name === 'node_modules' || f.name.startsWith('.')) continue; const p = path.join(d, f.name); if (f.isDirectory()) walk(p); else if (EXT.has(path.extname(f.name))) scan(p); } };
+  const scan = file => { const text = fs.readFileSync(file, 'utf8'); for (const m of text.matchAll(/(--[a-zA-Z0-9_-]+)\s*:\s*(#[0-9a-fA-F]{3,8})\b/g)) { const hex = expand(m[2]); if (hex) (idx[hex] ||= []).push({ token: m[1], file: path.relative(root, file) }); } };
+  walk(root); return idx;
+}
+const expand = h => { h = h.toLowerCase(); if (h.length === 4) return '#' + [...h.slice(1)].map(c => c + c).join(''); if (h.length === 7) return h; if (h.length === 9) return h.slice(0, 7); return null; };
+export const tokenFor = (idx, hex) => (idx[String(hex || '').toLowerCase()] || [])[0]?.token || null;

package/test/fixtures/checkout/cart.html

@@ -20,6 +20,7 @@
       </ul>
     </nav>
   </div>
+  <nav aria-label="Account" class="account-nav"><button type="button" data-go="account.html#orders">Orders</button><button type="button" data-go="account.html#addresses">Addresses</button><button type="button" data-go="account.html#payment">Payment</button></nav>
 </header>
 <main class="wrap">
   <h1>Your cart</h1>

package/test/fixtures/checkout/details.html

@@ -20,6 +20,7 @@
       </ul>
     </nav>
   </div>
+  <nav aria-label="Account" class="account-nav"><button type="button" data-go="account.html#orders">Orders</button><button type="button" data-go="account.html#addresses">Addresses</button><button type="button" data-go="account.html#payment">Payment</button></nav>
 </header>
 <main class="wrap">
   <h1>Your details</h1>

package/test/fixtures/checkout/done.html

@@ -20,6 +20,7 @@
       </ul>
     </nav>
   </div>
+  <nav aria-label="Account" class="account-nav"><button type="button" data-go="account.html#orders">Orders</button><button type="button" data-go="account.html#addresses">Addresses</button><button type="button" data-go="account.html#payment">Payment</button></nav>
 </header>
 <main class="wrap">
   <h1>Order placed</h1>

package/test/fixtures/checkout/review.html

@@ -20,6 +20,7 @@
       </ul>
     </nav>
   </div>
+  <nav aria-label="Account" class="account-nav"><button type="button" data-go="account.html#orders">Orders</button><button type="button" data-go="account.html#addresses">Addresses</button><button type="button" data-go="account.html#payment">Payment</button></nav>
 </header>
 <main class="wrap">
   <h1>Review your order</h1>
@@ -47,6 +48,8 @@
   </dl>
 
   <form id="order-form" action="done.html" method="get">
+    <label for="receipt-email">Email for the receipt</label>
+    <input id="receipt-email" name="receipt-email" type="email" autocomplete="email">
     <button type="submit">Place order</button>
   </form>
   <script>
@@ -57,6 +60,7 @@
       fields.forEach(function (f) {
         document.getElementById('out-' + f).textContent = saved[f] || '';
       });
+      document.getElementById('receipt-email').value = saved.email || '';
       document.getElementById('order-form').addEventListener('submit', function (ev) {
         ev.preventDefault();
         sessionStorage.setItem('orderPlaced', '1');