appstore-precheck 1.8.0 → 1.9.0

package/CHANGELOG.md

@@ -5,6 +5,51 @@ All notable changes to this project are documented here. Versioning follows
 
 ## [Unreleased]
 
+## [1.9.0] - 2026-07-02
+
+Smarter analysis (roadmap #2a): **screenshot vision**, in two layers.
+
+**Layer 1 (deterministic, offline, zero-dependency).** The static scanner now
+reads each in-repo screenshot's file format and, for PNGs, its pixel dimensions —
+a new `screenshot-dimensions` check (catalog vector 42) under guideline 2.3.3. It
+WARNs on a file whose content does not match its extension, a truncated PNG, or a
+PNG whose dimensions match no known App Store screenshot size (either orientation).
+WARN-only: it never forces a RED verdict, and the offline scan stays
+byte-identical on inputs without real screenshots. Parsing uses only `bash`+`od`+
+`awk` — no new runtime dependency.
+
+**Layer 2 (agent-mode, non-blocking).** A dedicated structured screenshot vision
+review that uses the host model's vision capability to check screenshots for
+placeholder / dev-debug / empty-state content, text overflow / truncation, wrong
+device frame / aspect, misleading marketing (2.3.3 "show the app in use" / 2.3.10),
+and metadata mismatches. Like Pierre deep-review it is advisory (`REVIEW-FINDING`)
+and never changes the GREEN/YELLOW/RED verdict. It runs only in agent-skill mode
+(host vision model), never in the CLI / npx / GitHub-Action path.
+
+### Added
+- **`skills/appstore-precheck/scripts/image-dims.sh`** — zero-dependency PNG
+  magic-byte + IHDR pixel-dimension parser (pure `bash`+`od`+`awk`) and the Apple
+  accepted-screenshot-size table (verified against Apple's screenshot
+  specifications page).
+- **`scan.sh` §7b** — screenshot format + PNG-dimension validation (rule
+  `screenshot-dimensions`, catalog vector 42), WARN-only.
+- **`skills/appstore-precheck/references/screenshot-vision-review.md`** — agent-mode
+  structured screenshot vision checklist (5 checks), non-blocking, wired into
+  Pierre deep-review check #8 and SKILL.md Phase 4.
+- Tests: `tests/test-image-dims.sh` (parser unit tests) and
+  `tests/fixtures/screenshots-app/` (end-to-end fixture); `tests/make-png.py`
+  fixture generator.
+
+### Changed
+- Advertised deterministic rejection-vector count **41 → 42** (the new
+  screenshot-dimensions check) across README, SKILL.md, and methodology.
+- Existing screenshot test fixtures: replaced 1-byte placeholders with real
+  accepted-size PNGs (scan output byte-identical).
+
+### Notes
+- JPEG dimensions are not parsed in this release; JPEGs are format-validated
+  (magic bytes) and counted only.
+
 ## [1.8.0] - 2026-07-02
 
 Smarter analysis (roadmap #2c): a deterministic **semantic guideline-drift**

package/README.md

@@ -44,7 +44,7 @@ each, divided by horizontal rules), not one compressed sentence. The breakdown b
 
 ## What it checks
 
-41 rejection vectors across code, fastlane metadata, screenshots, `PrivacyInfo.xcprivacy`, and the paywall:
+42 rejection vectors across code, fastlane metadata, screenshots, `PrivacyInfo.xcprivacy`, and the paywall:
 
 | Guideline | Check |
 |-----------|-------|
@@ -56,6 +56,7 @@ each, divided by horizontal rules), not one compressed sentence. The breakdown b
 | **2.3.1** | Metadata length limits (name, subtitle, keywords, promo, description) |
 | **2.3.1** | Misleading marketing claims (iOS virus / malware scanners, fake speed boosters) in metadata |
 | **2.3.3** | At least one screenshot per locale |
+| **2.3.3** | Screenshot format + PNG dimensions match a known App Store screenshot size *(advisory, WARN-only)* |
 | **2.3.7** | Localized metadata parity across every locale |
 | **2.3.8** | "For Kids" / "For Children" wording outside the Kids Category |
 | **2.3.10** | No other-platform / competitor names in metadata |
@@ -146,7 +147,7 @@ how the app is built:
 
 | App type | Coverage |
 |----------|----------|
-| 🟢 **Native Swift / SwiftUI** | **Full.** All 41 vectors apply. |
+| 🟢 **Native Swift / SwiftUI** | **Full.** All 42 vectors apply. |
 | 🟡 **React Native / Flutter** | Metadata, privacy manifest, screenshots, and export compliance apply in full. The Swift-source checks (ATT, paywall links, private API, SDK detection, navigation) **under-detect rather than misfire**: that logic lives in JS/Dart, so they stay quiet instead of blocking. |
 
 ## Quick start
@@ -268,7 +269,7 @@ a RED verdict. No App Store Connect credentials are needed; the action runs the
 | Phase | Step |
 |-------|------|
 | **0** | **Guideline drift**: diff the live App Store Review Guidelines against a tracked baseline. Never blocks. |
-| **1** | **Static scan**: `scan.sh` over the 41 vectors above. |
+| **1** | **Static scan**: `scan.sh` over the 42 vectors above. |
 | **2** | **`fastlane precheck`**: Apple's own metadata rule engine. |
 | **3** | **Pierre commentary**: explains **every** FAIL and WARN from Phases 0–2 in 2–3 sentences each. |
 | **4** | **Pierre deep review**: 28 semantic checks (22 Tier A + 6 Tier B v1 heuristic). Advisory only. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appstore-precheck",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "Read-only iOS App Store pre-submission check, packaged as a portable Agent Skill with native Claude Code, Cursor, and Codex plugins, plus an npx CLI.",
   "license": "MIT",
   "author": "Berkay Turk (https://github.com/berkayturk)",

package/skills/appstore-precheck/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: appstore-precheck
-description: Read-only pre-submission check for an iOS app before App Store review. Scans Swift code, fastlane metadata, screenshots, PrivacyInfo.xcprivacy, and the paywall for 41 rejection vectors, wraps Apple's official `fastlane precheck`, watches for live App Store Review Guideline drift, has Pierre explain every FAIL and WARN, then runs 22 semantic deep-review checks (Tier A) plus 6 heuristic checks (Tier B v1) — 28 total. Emits a GREEN/YELLOW/RED verdict and a `.precheck-pass` token an upload guard can gate on. Use when preparing an iOS App Store submission (before Archive, before "Submit for Review", before TestFlight, or before any `fastlane deliver/pilot/release`), or when the user mentions App Store rejection, app review, or fastlane upload.
+description: Read-only pre-submission check for an iOS app before App Store review. Scans Swift code, fastlane metadata, screenshots, PrivacyInfo.xcprivacy, and the paywall for 42 rejection vectors, wraps Apple's official `fastlane precheck`, watches for live App Store Review Guideline drift, has Pierre explain every FAIL and WARN, then runs 22 semantic deep-review checks (Tier A) plus 6 heuristic checks (Tier B v1) — 28 total. Emits a GREEN/YELLOW/RED verdict and a `.precheck-pass` token an upload guard can gate on. Use when preparing an iOS App Store submission (before Archive, before "Submit for Review", before TestFlight, or before any `fastlane deliver/pilot/release`), or when the user mentions App Store rejection, app review, or fastlane upload.
 license: MIT
 metadata:
   author: Berkay Turk
-  version: 1.8.0
+  version: 1.9.0
 allowed-tools: Bash Read Grep Glob WebFetch
 ---
 
@@ -116,7 +116,7 @@ check(s). It is non-blocking and never runs in the offline user scan; the finger
 bash skills/appstore-precheck/scripts/scan.sh
 ```
 
-Emits `FAIL:` / `WARN:` / `PASS:` lines covering 41 rejection vectors: Privacy Manifest /
+Emits `FAIL:` / `WARN:` / `PASS:` lines covering 42 rejection vectors: Privacy Manifest /
 Required Reason API parity (5.1.1), purpose strings (5.1.1), ATT (5.1.2), other-platform mentions
 (2.3.10), metadata limits (2.3.1), localized parity (2.3.7), screenshots (2.3.3), trial &
 auto-renew disclosures (3.1.2), Restore/Terms/Privacy links (3.1.2), private API (2.5.1), minimum
@@ -133,9 +133,10 @@ NetworkExtension usage (5.4), a demo account for a login-gated app (2.1), execut
 / native hot-patching (2.5.2), unused background modes (2.5.4), cryptocurrency wallet/mining
 (3.1.5(a)), thin WKWebView wrappers (4.2.3), remote-desktop apps (4.2.7), Safari extensions
 (4.4.2), account creation without in-app deletion (5.1.1(v) Account Sign-In), kids audience with
-third-party ads/analytics (5.1.4), real-money gambling copy (5.3.4), and MDM signals (5.5). The
-IAP checks (8–10) are skipped automatically when no in-app-purchase signals are present, and the
-signal-gated advisory checks (16–41) stay silent unless their triggering signal is found. The
+third-party ads/analytics (5.1.4), real-money gambling copy (5.3.4), MDM signals (5.5), and
+screenshot format/dimension mismatches (2.3.3). The IAP checks (8–10) are skipped automatically
+when no in-app-purchase signals are present, and the signal-gated advisory checks (16–42) stay
+silent unless their triggering signal is found. The
 full check table is in
 [`references/methodology.md`](references/methodology.md#phase-1-rejection-vectors).
 
@@ -226,7 +227,9 @@ After Phase 3, Pierre runs the **Review Simulator**: 28 read-only, evidence-base
 static scanner cannot fully judge (**22 Tier A** + **6 Tier B v1** heuristic — marked † below).
 The full checklist, per-check procedure, and output format live in
 [`references/pierre-deep-review.md`](references/pierre-deep-review.md) — read it before starting
-Phase 4.
+Phase 4. When screenshots are present, also run the structured screenshot vision review in
+[`references/screenshot-vision-review.md`](references/screenshot-vision-review.md) (non-blocking;
+host vision model; never changes the verdict).
 
 **What Pierre does:** read Swift, metadata, entitlements, xcstrings, paywall views, review notes,
 screenshot/preview assets; fetch privacy and support URLs; cross-check claims vs code, policy vs

package/skills/appstore-precheck/references/methodology.md

@@ -108,11 +108,31 @@ baseline the same deliberate way, with `guideline-drift.sh --reconcile`.
 | 39 | **5.1.4 Kids** *(advisory)* | Metadata targets a child audience **and** a third-party ads/analytics SDK is linked; Kids Category apps may not include third-party ads/analytics and need a parental gate |
 | 40 | **5.3.4 Gambling** *(advisory)* | Real-money gaming language in metadata (casino, sportsbook, real money, wager); real-money gambling needs licensing, geo-restriction, and must be free on the store |
 | 41 | **5.5 MDM** *(advisory)* | A Mobile Device Management signal (`DeviceManagement`, managed-app-config, `com.apple.mdm`); MDM apps need a commercial enterprise/education entity and purpose-limited data use |
+| 42 | **2.3.3 Screenshot format/dimensions** *(advisory)* | Reads each in-repo screenshot's magic bytes and, for PNGs, its IHDR pixel dimensions; WARNs on a file whose content does not match its extension, a truncated PNG, or a PNG whose size matches no known App Store screenshot size (either orientation). JPEG dimensions are not parsed (format-checked only). WARN-only — never forces a RED verdict. |
 
 Vectors 8–10 only run when in-app-purchase signals are detected (StoreKit / RevenueCat import,
-or a paywall view). Otherwise the scanner emits a single PASS and skips them. Vectors 16–41 are
+or a paywall view). Otherwise the scanner emits a single PASS and skips them. Vectors 16–42 are
 signal-gated advisory WARNs: each emits nothing unless its triggering signal is present.
 
+### Screenshot format + dimensions (§7b, 2.3.3)
+
+Vector 7 (above) checks that every locale has at least one screenshot. §7b goes one layer deeper,
+purely with zero-dependency byte reads (`image-dims.sh`, pure bash + `od`/`awk`): for every
+in-repo screenshot it reads the file's magic bytes to confirm the content actually matches its
+extension (`.png`/`.jpg`/`.jpeg`), and for PNGs it also parses the IHDR chunk for pixel width and
+height and checks that pair against a table of known App Store screenshot sizes (tried in both
+orientations, sourced from Apple's [screenshot specifications
+page](https://developer.apple.com/help/app-store-connect/reference/screenshot-specifications/)).
+JPEG dimensions are not parsed — JPEGs are format-checked only (magic-byte match), not size-checked.
+
+This is **WARN-only, never FAIL**: the accepted-size table can drift as Apple adds device sizes,
+and the scanner has no way to know which display slot (iPhone 6.9", iPad 13", …) a given file is
+meant to target, so a size that matches nothing in the table is a prompt to verify against the
+current spec, not proof of a rejection. A mismatched-format file (e.g. a renamed JPEG saved as
+`.png`) or an unreadable/truncated PNG WARNs the same way. Findings surface under
+`rule_id == "screenshot-dimensions"` (catalog vector 42) with messages beginning
+`WARN: 2.3.3 Screenshot …`.
+
 **Scope by app type.** The metadata, privacy-manifest, screenshots, and export-compliance checks
 apply to any iOS app regardless of how it is built. The code-level checks grep the app's Swift
 source (`*.swift`, plus `*.m`/`*.h` and `*.entitlements` where relevant), so they are most accurate

package/skills/appstore-precheck/references/pierre-deep-review.md

@@ -147,6 +147,9 @@ REVIEW-PASS: <guideline> — not applicable (<reason>)
 1. Open ≥1 screenshot per primary locale.
 2. List visible features (tabs, paywall, login, maps, etc.).
 3. Flag screenshots showing features absent from the build or metadata.
+4. For the full structured screenshot vision review (placeholder/empty-state, text overflow,
+   wrong device frame, misleading marketing, metadata mismatch), follow
+   `references/screenshot-vision-review.md`.
 
 ### 9 — 2.3.6 Pricing language
 

package/skills/appstore-precheck/references/screenshot-vision-review.md

@@ -0,0 +1,69 @@
+# Screenshot vision review (agent-mode, non-blocking)
+
+Deepens Pierre deep-review check #8 (2.3.5) into a dedicated, structured screenshot review.
+This is the **vision layer** of the Review Simulator: the host model reads the actual screenshot
+images and cross-checks their content against the metadata and the shipped app.
+
+**Identity:** this runs ONLY in agent-skill mode (Claude Code / Codex / …), using the host LLM's
+vision capability — exactly like Pierre reads code and the drift phase fetches URLs. It is NOT a
+bundled dependency and does NOT run in the offline CLI / npx / GitHub-Action path.
+
+**This phase does not change the GREEN/YELLOW/RED verdict** (verdict comes only from scan
+`FAIL:`/`WARN:` counts). It emits `REVIEW-PASS:` / `REVIEW-FINDING: … WARN` lines, like Pierre
+deep-review.
+
+## Rules
+
+- Read-only. Never modify project files.
+- Evidence-based: cite the screenshot **filename** (and locale) for every finding. If you cannot
+  read an image, say so — do not invent findings.
+- Read at least one screenshot per primary locale; when several are present, scan them all.
+- All five checks, every run: report each as `REVIEW-PASS:` or `REVIEW-FINDING: … WARN`.
+- If there are no in-repo screenshots, report each check as
+  `REVIEW-PASS: <guideline> — not applicable (no in-repo screenshots; managed in App Store Connect)`.
+- Severity is always WARN (advisory). Cautious language ("may trigger review questions").
+- Write Pierre's 2–3 sentence explanations in the user's conversation language.
+
+## The 5 checks
+
+| # | Guideline | Question |
+|---|-----------|----------|
+| S1 | 2.3.3 / 2.3.7 | Placeholder / dev-debug / empty-state content: Lorem ipsum, debug overlays or logs, visible TODO/FIXME, empty lists or skeleton loaders shown as content, simulator status bar with placeholder carrier/time. |
+| S2 | 2.3.3 | Text overflow / truncation / clipping: clipped or overlapping labels, cut-off buttons, text running off-screen. |
+| S3 | 2.3.5 | Wrong device frame / aspect: an iPad screenshot in an iPhone slot (or vice-versa), letterboxing, obviously stretched/squished aspect. |
+| S4 | 2.3.3 / 2.3.10 | Misleading marketing: 2.3.3 "show the app in use" — the shot is a splash/title/logo/pure marketing art, not actual app UI; 2.3.10 — a feature is depicted that the app does not ship. |
+| S5 | 2.3.5 | Metadata ↔ screenshot claim mismatch: visible UI text/features contradict the description, keywords, or promo text. |
+
+## Per-check procedure
+
+### S1 — Placeholder / dev-debug / empty-state
+1. Open each screenshot; read visible text and UI state.
+2. Flag Lorem ipsum, debug HUDs, log text, "TODO"/"FIXME", empty/skeleton content presented as real, or a simulator status bar with placeholder carrier/time.
+3. Cite the filename. Not applicable if no screenshots.
+
+### S2 — Text overflow / truncation
+1. Inspect labels, buttons, and headings for clipping, overlap, or off-screen text.
+2. Flag any truncation that suggests an unfinished or broken layout.
+
+### S3 — Wrong device frame / aspect
+1. Compare each screenshot's aspect to its locale/slot (iPhone vs iPad).
+2. Flag an iPad-aspect image in an iPhone slot (or vice-versa), letterboxing, or stretched aspect.
+
+### S4 — Misleading marketing
+1. Determine whether each screenshot shows the app actually in use (real UI) vs pure title/splash/logo art.
+2. Flag shots that are marketing art rather than the app in use (2.3.3), or that depict a feature absent from the build (2.3.10).
+
+### S5 — Metadata ↔ screenshot mismatch
+1. Read the visible UI text/features and compare to the description, keywords, and promo text.
+2. Flag direct contradictions (a feature/claim in the screenshot not in metadata, or vice-versa).
+
+## Output format
+
+```
+REVIEW-PASS: <guideline> — <one-line why it looks OK, with screenshot filename>
+```
+or
+```
+REVIEW-FINDING: <guideline> WARN — <one-line concrete issue, with screenshot filename>
+Pierre: <2–3 sentences: why Apple cares, what you saw, what to fix or verify>
+```

package/skills/appstore-precheck/scripts/findings.sh

@@ -26,7 +26,8 @@ rule_slug() {
     35) echo webview-wrapper ;;                36) echo remote-desktop ;;
     37) echo safari-extension ;;               38) echo account-no-delete ;;
     39) echo kids-ads-analytics ;;             40) echo realmoney-gambling ;;
-    41) echo mdm ;;                            *) echo "" ;;
+    41) echo mdm ;;                            42) echo screenshot-dimensions ;;
+    *) echo "" ;;
   esac
 }
 

package/skills/appstore-precheck/scripts/image-dims.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# image-dims.sh — zero-dependency image format + PNG dimension helpers for scan.sh.
+# Pure bash + od + awk; bash 3.2 compatible; sourced, no side effects, no output on load.
+
+# img_format <file> -> "png" | "jpeg" | "unknown"
+img_format() {
+  local f="$1" sig
+  [[ -r "$f" ]] || { echo unknown; return; }
+  sig="$(od -An -tx1 -N8 "$f" 2>/dev/null | tr -d ' \n')"
+  case "$sig" in
+    89504e470d0a1a0a*) echo png ;;
+    ffd8ff*)           echo jpeg ;;
+    *)                 echo unknown ;;
+  esac
+}
+
+# png_dims <file> -> "W H" (decimal) and return 0, or return 1 with no output.
+# IHDR width = big-endian bytes 16-19, height = 20-23 (8-byte signature + 4-byte
+# length + "IHDR" tag precede the 8 dimension bytes at offset 16).
+png_dims() {
+  local f="$1"
+  [[ "$(img_format "$f")" == png ]] || return 1
+  local b
+  read -r -a b < <(od -An -tu1 -j16 -N8 "$f" 2>/dev/null)
+  [[ "${#b[@]}" -ge 8 ]] || return 1
+  local w=$(( b[0]*16777216 + b[1]*65536 + b[2]*256 + b[3] ))
+  local h=$(( b[4]*16777216 + b[5]*65536 + b[6]*256 + b[7] ))
+  printf '%s %s\n' "$w" "$h"
+}
+
+# ACCEPTED_SIZES — Apple App Store screenshot pixel sizes (portrait "W H").
+# The matcher tries both orientations. This table is intentionally generous
+# (includes current + legacy device sizes) because this check is WARN-only.
+# Verified against Apple's official page:
+# https://developer.apple.com/help/app-store-connect/reference/screenshot-specifications/
+ACCEPTED_SIZES="
+1260 2736
+1290 2796
+1320 2868
+1284 2778
+1242 2688
+1179 2556
+1206 2622
+1170 2532
+1125 2436
+1080 2340
+1242 2208
+750 1334
+640 1096
+640 1136
+640 920
+640 960
+2064 2752
+2048 2732
+1488 2266
+1668 2420
+1668 2388
+1640 2360
+1668 2224
+1536 2008
+1536 2048
+768 1004
+768 1024
+"
+
+# dims_match_accepted <W> <H> -> return 0 if W×H or H×W is an accepted size.
+dims_match_accepted() {
+  local w="$1" h="$2" aw ah
+  while read -r aw ah; do
+    [[ -z "$aw" ]] && continue
+    if { [[ "$w" == "$aw" && "$h" == "$ah" ]]; } || { [[ "$w" == "$ah" && "$h" == "$aw" ]]; }; then
+      return 0
+    fi
+  done <<< "$ACCEPTED_SIZES"
+  return 1
+}

package/skills/appstore-precheck/scripts/scan.sh

@@ -15,6 +15,7 @@ cd "$ROOT" || { echo "FAIL: repo-root — could not enter repository root"; exit
 source "$(dirname "${BASH_SOURCE[0]}")/findings.sh"
 source "$(dirname "${BASH_SOURCE[0]}")/suppress.sh"
 source "$(dirname "${BASH_SOURCE[0]}")/project-model.sh"
+source "$(dirname "${BASH_SOURCE[0]}")/image-dims.sh"
 FINDINGS_TMP="$(mktemp)"; export FINDINGS_TMP
 trap 'rm -f "$FINDINGS_TMP"' EXIT
 FORMAT="text"
@@ -395,6 +396,42 @@ else
   pass "2.3.3 Screenshots — no in-repo screenshots dir; assumed managed in App Store Connect (set .screenshotsDir to check in-repo)"
 fi
 
+# ===================================================================
+# §7b — 2.3.3 Screenshot format + PNG dimensions (deterministic; PNG dims,
+# JPEG format only). WARN-only: the accepted-size table can drift, and we
+# cannot know which display slot a file targets, so mismatches never FAIL.
+# ===================================================================
+if [[ -n "$SCREEN_DIR" && -d "$SCREEN_DIR" ]]; then
+  set_rule "screenshot-dimensions"
+  while IFS= read -r img; do
+    [[ -z "$img" ]] && continue
+    fmt="$(img_format "$img")"
+    case "$img" in
+      *.png)
+        if [[ "$fmt" != png ]]; then
+          warn "2.3.3 Screenshot $img is not a valid PNG (file content does not match .png extension)" "$img"
+          continue
+        fi
+        dims="$(png_dims "$img")"
+        if [[ -z "$dims" ]]; then
+          warn "2.3.3 Screenshot $img — could not read PNG dimensions (possibly truncated)" "$img"
+        else
+          w="${dims% *}"; h="${dims#* }"
+          if ! dims_match_accepted "$w" "$h"; then
+            warn "2.3.3 Screenshot $img is ${w}x${h}, which matches no known App Store screenshot size — verify against the current spec" "$img"
+          fi
+        fi
+        ;;
+      *.jpg|*.jpeg)
+        if [[ "$fmt" != jpeg ]]; then
+          warn "2.3.3 Screenshot $img is not a valid JPEG (file content does not match extension)" "$img"
+        fi
+        ;;
+    esac
+  done < <(find "$SCREEN_DIR" -maxdepth 3 -type f \( -name '*.png' -o -name '*.jpg' -o -name '*.jpeg' \) 2>/dev/null | sort)
+  set_rule ""
+fi
+
 # ===================================================================
 # In-app purchase gate — only run 3.1.2 checks if IAP signals exist
 # ===================================================================
@@ -403,7 +440,7 @@ grep -rqE 'SKPaymentQueue|SKProduct|SKMutablePayment|Product\.products|Product\(
 [[ -n "$SUB_VIEW" ]] && iap_detected=1
 
 if [[ -z "$iap_detected" ]]; then
-  # Not one of the 41 catalog sections — clear the rule_id so this PASS doesn't
+  # Not one of the 42 catalog sections — clear the rule_id so this PASS doesn't
   # inherit §7's "screenshots-per-locale" slug in the JSON output.
   set_rule ""
   pass "3.1.2 IAP — no in-app purchase / subscription signals detected, skipping paywall checks"