pour-engine 1.1.0

package/engine/rules/wcag/4.1.2-aria-attr-valid.js

@@ -0,0 +1,50 @@
+// WCAG SC 4.1.2 Name, Role, Value (Level A)
+// ARIA 1.2 attribute names (shared vocabulary in lib/roles.js), and the
+// allowed values for enumerated ones.
+import { KNOWN_ARIA as KNOWN } from '../../lib/roles.js';
+
+// Note: "undefined" is a legal token for the tristate/undefinable attributes
+// (aria-expanded, aria-selected, aria-checked, aria-pressed) per ARIA 1.2.
+const ENUMS = {
+  'aria-atomic': ['true', 'false'], 'aria-busy': ['true', 'false'],
+  'aria-disabled': ['true', 'false'], 'aria-expanded': ['true', 'false', 'undefined'],
+  'aria-hidden': ['true', 'false'], 'aria-modal': ['true', 'false'],
+  'aria-multiline': ['true', 'false'], 'aria-multiselectable': ['true', 'false'],
+  'aria-readonly': ['true', 'false'], 'aria-required': ['true', 'false'],
+  'aria-selected': ['true', 'false', 'undefined'],
+  'aria-checked': ['true', 'false', 'mixed', 'undefined'], 'aria-pressed': ['true', 'false', 'mixed', 'undefined'],
+  'aria-live': ['off', 'polite', 'assertive'],
+  'aria-orientation': ['horizontal', 'vertical'],
+  'aria-sort': ['none', 'ascending', 'descending', 'other'],
+  'aria-autocomplete': ['none', 'inline', 'list', 'both'],
+  'aria-invalid': ['true', 'false', 'grammar', 'spelling'],
+  'aria-haspopup': ['true', 'false', 'menu', 'listbox', 'tree', 'grid', 'dialog'],
+  'aria-current': ['true', 'false', 'page', 'step', 'location', 'date', 'time'],
+};
+
+export default {
+  id: 'aria-attr-valid',
+  impact: 'critical',
+  tags: ['wcag2a', 'wcag412'],
+  help: 'aria attributes must exist and have valid values',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
+  selector: '*',
+  visibleOnly: false, // applies to hidden elements too; also avoids visibility cost on every node
+  evaluate(element) {
+    const problems = [];
+    for (const { name, value } of element.attributes) {
+      if (!name.startsWith('aria-')) continue;
+      if (!KNOWN.has(name.slice(5))) {
+        problems.push(`${name} is not an ARIA attribute`);
+      } else if (ENUMS[name] && !ENUMS[name].includes(value.trim().toLowerCase())) {
+        problems.push(`${name}="${value}" — allowed values: ${ENUMS[name].join(', ')}`);
+      }
+    }
+    if (!problems.length) return { status: 'pass' };
+    return {
+      status: 'fail',
+      message: `Invalid ARIA: ${problems.join('; ')}. Assistive technology ignores attributes it doesn't recognise.`,
+      fix: 'Correct the attribute name/value against the ARIA specification, or remove it.',
+    };
+  },
+};

package/engine/rules/wcag/4.1.2-aria-field-name.js

@@ -0,0 +1,54 @@
+// WCAG SC 4.1.2 Name, Role, Value (Level A)
+// ARIA-built form fields (role="textbox" divs etc.) need names just like
+// native inputs — native fields are handled by form-label.
+//
+// Spec note (accname): input-like roles are NOT "name from content" — the
+// text inside a listbox/textbox does not name it, only author-provided
+// naming counts. Toggle roles (checkbox/radio/switch) DO name from content.
+const AUTHOR_ONLY = ['textbox', 'searchbox', 'combobox', 'listbox', 'spinbutton', 'slider'];
+const FROM_CONTENT = ['checkbox', 'radio', 'switch'];
+
+function authorName(element) {
+  const labelledby = element.getAttribute('aria-labelledby');
+  if (labelledby) {
+    const text = labelledby
+      .split(/\s+/)
+      .map((id) => element.getRootNode().getElementById?.(id)?.textContent ?? '')
+      .join(' ')
+      .trim();
+    if (text) return text;
+  }
+  return element.getAttribute('aria-label')?.trim() || element.getAttribute('title')?.trim() || '';
+}
+
+export default {
+  id: 'aria-field-name',
+  impact: 'serious',
+  tags: ['wcag2a', 'wcag412'],
+  help: 'ARIA form fields must have an accessible name',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
+  selector: [...AUTHOR_ONLY, ...FROM_CONTENT]
+    .map((role) => `[role="${role}"]:not(input):not(select):not(textarea)`)
+    .join(', '),
+  evaluate(element, { accessibleName }) {
+    const role = element.getAttribute('role');
+    const name = FROM_CONTENT.includes(role) ? accessibleName(element) : authorName(element);
+    if (name) return { status: 'pass' };
+    // ARIA 1.1 combobox pattern: a non-focusable wrapper div carries the
+    // role while the real, focusable input inside carries the label. The
+    // wrapper's missing name is spec-untidy but the field users actually
+    // reach IS named — not a 4.1.2 failure in practice.
+    if (role === 'combobox' && element.tabIndex < 0) {
+      const input = element.querySelector('input, [role="textbox"], [role="searchbox"]');
+      if (input && (input.labels?.length || input.getAttribute('aria-label') || input.getAttribute('aria-labelledby'))) {
+        return { status: 'pass' };
+      }
+    }
+    return {
+      status: 'fail',
+      message: `This role="${role}" field has no accessible name — screen readers announce the role with no idea what it's for.${
+        AUTHOR_ONLY.includes(role) ? ' (Content inside it does not count as a name for this role.)' : ''}`,
+      fix: 'Add aria-label="…" or aria-labelledby pointing at its visible label.',
+    };
+  },
+};

package/engine/rules/wcag/4.1.2-aria-hidden-focus.js

@@ -0,0 +1,48 @@
+// WCAG SC 4.1.2 Name, Role, Value (Level A)
+const FOCUSABLE = 'a[href], area[href], button, input, select, textarea, summary, iframe, '
+  + 'audio[controls], video[controls], [contenteditable]:not([contenteditable="false"]), [tabindex]';
+
+export default {
+  id: 'aria-hidden-focus',
+  impact: 'serious',
+  tags: ['wcag2a', 'wcag412'],
+  help: 'Nothing focusable may sit inside aria-hidden="true"',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
+  selector: '[aria-hidden="true"]',
+  visibleOnly: false, // these elements are hidden from AT by definition
+  evaluate(element, { isRendered }) {
+    // Only elements that are actually rendered can receive focus — an
+    // aria-hidden menu that is ALSO display:none is fine until it opens.
+    // Fully transparent controls are excluded too: nothing is SEEN when
+    // focus lands there, so the harm this rule describes (sighted keyboard
+    // users interacting with SR-invisible content) doesn't materialise —
+    // an invisible tab stop is a focus-order/visible-focus concern instead.
+    const focusable = [element, ...element.querySelectorAll(FOCUSABLE)].filter(
+      (el) => el.matches?.(FOCUSABLE) && el.getAttribute('tabindex') !== '-1' && !el.disabled
+        // `inert` removes focusability outright — aria-hidden + inert is
+        // the CORRECT modern pattern for off-canvas content, not a defect.
+        && !el.closest('[inert]')
+        && isRendered(el) && getComputedStyle(el).opacity !== '0',
+    );
+    if (!focusable.length) return { status: 'pass' };
+    // While a modal dialog is open, the page behind it is DELIBERATELY
+    // aria-hidden and its focusability is script-managed (focus traps).
+    // A static snapshot can't tell a correct trap from a broken one —
+    // that's a human check, not an assertable failure.
+    const doc = element.ownerDocument;
+    let modal = null;
+    try { modal = doc.querySelector('dialog:modal'); } catch { /* older engine */ }
+    modal ??= [...doc.querySelectorAll('[aria-modal="true"]')].find(isRendered) ?? null;
+    if (modal && !element.contains(modal) && !modal.contains(element)) {
+      return {
+        status: 'incomplete',
+        message: `This aria-hidden element contains ${focusable.length} focusable element(s) while a modal dialog is open — fine if the modal traps keyboard focus, a failure if Tab can reach them. Check the trap by keyboard.`,
+      };
+    }
+    return {
+      status: 'fail',
+      message: `This aria-hidden element contains ${focusable.length} focusable element(s) — keyboard users can Tab into content that screen readers cannot see.`,
+      fix: 'Add tabindex="-1" (or disabled) to focusable elements inside aria-hidden regions, or remove aria-hidden.',
+    };
+  },
+};

package/engine/rules/wcag/4.1.2-aria-valid-refs.js

@@ -0,0 +1,61 @@
+// WCAG SC 4.1.2 Name, Role, Value (Level A)
+// aria-activedescendant and aria-owns matter most: a dangling
+// activedescendant breaks composite-widget focus reporting entirely.
+const REF_ATTRIBUTES = [
+  'aria-labelledby', 'aria-describedby', 'aria-controls',
+  'aria-activedescendant', 'aria-owns', 'aria-errormessage', 'aria-details',
+];
+
+export default {
+  id: 'aria-valid-refs',
+  // Moderate, not critical: with 4.1.1 Parsing retired in WCAG 2.2 these
+  // are 4.1.2 name/state defects, and aria-controls in particular has weak
+  // assistive-technology support — real, but rarely blocking.
+  impact: 'moderate',
+  tags: ['wcag2a', 'wcag412'],
+  help: 'ARIA id references must point to elements that exist',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
+  selector: REF_ATTRIBUTES.map((attr) => `[${attr}]`).join(', '),
+  evaluate(element) {
+    // ARIA id references cannot cross shadow boundaries: they resolve only
+    // within the element's own root (document or shadow tree).
+    const root = element.getRootNode();
+    // Collapsed-disclosure pattern: a trigger with aria-expanded="false"
+    // whose aria-controls panel doesn't exist YET (rendered on expand) is
+    // ubiquitous and harmless while collapsed — name computation doesn't
+    // touch aria-controls, so nothing resolves wrongly today.
+    const collapsed = element.getAttribute('aria-expanded') === 'false';
+    const missing = [];
+    const ambiguous = [];
+    for (const attr of REF_ATTRIBUTES) {
+      for (const id of (element.getAttribute(attr) ?? '').split(/\s+/).filter(Boolean)) {
+        if (!root.getElementById?.(id)) {
+          if (attr === 'aria-controls' && collapsed) continue;
+          missing.push(`${attr}="${id}" points to nothing — assistive technology silently ignores it`);
+          continue;
+        }
+        const count = root.querySelectorAll(`[id="${CSS.escape(id)}"]`).length;
+        if (count > 1) {
+          ambiguous.push(`${attr}="${id}" — ${count} elements share this id; the reference binds to the FIRST one in the DOM`);
+        }
+      }
+    }
+    if (missing.length) {
+      return {
+        status: 'fail',
+        message: `Broken ARIA references: ${missing.join('; ')}.`,
+        fix: 'Correct or remove the reference, or give the target element that id.',
+      };
+    }
+    if (ambiguous.length) {
+      // Duplicate ids resolve deterministically to the first copy — often
+      // the right one (desktop/mobile double-renders). Real, but a human
+      // must judge whether the first copy is the wrong copy.
+      return {
+        status: 'incomplete',
+        message: `Ambiguous ARIA references: ${ambiguous.join('; ')}. If the first copy in the DOM is the intended target, this works today — but it's fragile.`,
+      };
+    }
+    return { status: 'pass' };
+  },
+};

package/engine/rules/wcag/4.1.2-button-name.js

@@ -0,0 +1,17 @@
+// WCAG SC 4.1.2 Name, Role, Value (Level A)
+export default {
+  id: 'button-name',
+  impact: 'critical',
+  tags: ['wcag2a', 'wcag412'],
+  help: 'Buttons must have an accessible name',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
+  selector: 'button, [role="button"], input[type="button"], input[type="submit"], input[type="reset"]',
+  evaluate(element, { accessibleName }) {
+    if (accessibleName(element)) return { status: 'pass' };
+    return {
+      status: 'fail',
+      message: 'This button has no accessible name — a screen reader announces just "button".',
+      fix: 'Add visible text inside the button, or aria-label="What it does" for icon-only buttons.',
+    };
+  },
+};

package/engine/rules/wcag/4.1.2-dialog-name.js

@@ -0,0 +1,35 @@
+// WCAG SC 4.1.2 Name, Role, Value (Level A)
+// ARIA 1.2 marks dialog/alertdialog as name-required roles, and dialogs are
+// NOT name-from-content — the body text is the dialog's content, never its
+// name. An open, unnamed modal announces as just "dialog", leaving
+// screen-reader users with no idea what interrupted them (cookie-consent
+// modals are the canonical offender).
+export default {
+  id: 'dialog-name',
+  impact: 'serious',
+  tags: ['wcag2a', 'wcag412'],
+  help: 'Dialogs must have an accessible name',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
+  // Default visibility filter: a closed <dialog> is display:none, so only
+  // dialogs the user can actually encounter are judged.
+  selector: 'dialog, [role="dialog"], [role="alertdialog"]',
+  evaluate(element) {
+    const labelledby = element.getAttribute('aria-labelledby');
+    if (labelledby) {
+      const text = labelledby
+        .split(/\s+/)
+        .map((id) => element.getRootNode().getElementById?.(id)?.textContent ?? '')
+        .join(' ')
+        .trim();
+      if (text) return { status: 'pass' };
+    }
+    if (element.getAttribute('aria-label')?.trim() || element.getAttribute('title')?.trim()) {
+      return { status: 'pass' };
+    }
+    return {
+      status: 'fail',
+      message: 'This dialog has no accessible name — screen readers announce just "dialog" with no hint of what it is or why it appeared.',
+      fix: 'Point aria-labelledby at the dialog\'s heading, or add aria-label="What this dialog is".',
+    };
+  },
+};

package/engine/rules/wcag/4.1.2-frame-title.js

@@ -0,0 +1,17 @@
+// WCAG SC 4.1.2 Name, Role, Value (Level A)
+export default {
+  id: 'frame-title',
+  impact: 'serious',
+  tags: ['wcag2a', 'wcag412'],
+  help: 'Frames must have a title describing their content',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
+  selector: 'iframe, frame',
+  evaluate(element, { accessibleName }) {
+    if (element.getAttribute('title')?.trim() || accessibleName(element)) return { status: 'pass' };
+    return {
+      status: 'fail',
+      message: 'This frame has no title — screen-reader users cannot tell what it contains before entering it.',
+      fix: `Add title="…" describing the embedded content, e.g. <iframe title="Newsletter signup" src="${element.getAttribute('src') ?? ''}">.`,
+    };
+  },
+};

package/engine/rules/wcag/4.1.2-label-for-valid.js

@@ -0,0 +1,25 @@
+// WCAG SC 4.1.2 Name, Role, Value (Level A)
+const LABELABLE = 'input, select, textarea, button, meter, output, progress';
+
+export default {
+  id: 'label-for-valid',
+  impact: 'serious',
+  tags: ['wcag2a', 'wcag412'],
+  help: 'label[for] must reference a form control that exists',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
+  selector: 'label[for]',
+  evaluate(element) {
+    const id = element.getAttribute('for');
+    // id references resolve within the element's own root — a label in a
+    // shadow tree can only point at controls in that same tree.
+    const target = element.getRootNode().getElementById?.(id);
+    if (target?.matches(LABELABLE)) return { status: 'pass' };
+    return {
+      status: 'fail',
+      message: target
+        ? `for="${id}" points at a <${target.tagName.toLowerCase()}>, which cannot be labelled — the association is ignored.`
+        : `for="${id}" points at nothing — the label is not associated with any field.`,
+      fix: 'Point the for attribute at the id of the input/select/textarea it labels.',
+    };
+  },
+};

package/engine/rules/wcag/4.1.2-nested-interactive.js

@@ -0,0 +1,30 @@
+// WCAG SC 4.1.2 Name, Role, Value (Level A)
+// Deliberately excludes bare [tabindex]: a focusable container (e.g. a
+// scrollable region with tabindex="0") holding links is correct markup.
+const INTERACTIVE =
+  'a[href], button, input, select, textarea, summary, audio[controls], video[controls], ' +
+  '[role="button"], [role="link"], [role="checkbox"], [role="radio"], [role="switch"], ' +
+  '[role="menuitem"], [role="tab"], [role="option"]';
+
+export default {
+  id: 'nested-interactive',
+  impact: 'serious',
+  tags: ['wcag2a', 'wcag412'],
+  help: 'A control must not contain another control',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
+  selector: INTERACTIVE,
+  evaluate(element, { isRendered }) {
+    // Only descendants a user can actually reach count: hidden inputs,
+    // disabled controls, display:none templates, and tabindex="-1" nodes
+    // inside a control are inert markup, not competing tab stops.
+    const nested = [...element.querySelectorAll(INTERACTIVE)].find((el) =>
+      !el.disabled && el.getAttribute('tabindex') !== '-1'
+      && !(el.tagName === 'INPUT' && el.type === 'hidden') && isRendered(el));
+    if (!nested) return { status: 'pass' };
+    return {
+      status: 'fail',
+      message: `This ${element.tagName.toLowerCase()} contains another interactive element (<${nested.tagName.toLowerCase()}>) — focus order and announcements become unpredictable.`,
+      fix: 'Restructure so interactive elements are siblings, not ancestors of each other.',
+    };
+  },
+};

package/engine/rules/wcag/4.1.2-role-required-aria.js

@@ -0,0 +1,36 @@
+// WCAG SC 4.1.2 Name, Role, Value (Level A)
+// Roles that are meaningless without a state attribute alongside them.
+const REQUIRED = {
+  checkbox: 'aria-checked',
+  switch: 'aria-checked',
+  radio: 'aria-checked',
+  slider: 'aria-valuenow',
+  scrollbar: 'aria-valuenow',
+  combobox: 'aria-expanded',
+};
+
+export default {
+  id: 'role-required-aria',
+  impact: 'serious',
+  tags: ['wcag2a', 'wcag412'],
+  help: 'Some roles require a state attribute to work',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
+  selector: Object.keys(REQUIRED).map((role) => `[role="${role}"]`).join(', '),
+  evaluate(element) {
+    const role = element.getAttribute('role');
+    const required = REQUIRED[role];
+    if (element.hasAttribute(required)) return { status: 'pass' };
+    // A redundant explicit role on the native element (input type=checkbox
+    // role=checkbox — common framework output) needs no ARIA state: the
+    // host language supplies checkedness/value natively.
+    const type = element.tagName === 'INPUT' ? element.type : null;
+    const NATIVE_STATE = { checkbox: 'checkbox', radio: 'radio', range: 'slider' };
+    if (type && NATIVE_STATE[type] === role) return { status: 'pass' };
+    if (element.tagName === 'SELECT' && role === 'combobox') return { status: 'pass' };
+    return {
+      status: 'fail',
+      message: `role="${role}" without ${required} — screen readers can't announce the control's state.`,
+      fix: `Add ${required} and keep it updated from your script, or use the native HTML element instead.`,
+    };
+  },
+};

package/engine/rules/wcag/4.1.2-valid-role.js

@@ -0,0 +1,52 @@
+// WCAG SC 4.1.2 Name, Role, Value (Level A)
+// ARIA 1.2 roles (concrete, usable roles — abstract roles are invalid in markup).
+const VALID_ROLES = new Set([
+  'alert', 'alertdialog', 'application', 'article', 'banner', 'blockquote', 'button',
+  'caption', 'cell', 'checkbox', 'code', 'columnheader', 'combobox', 'complementary',
+  'contentinfo', 'definition', 'deletion', 'dialog', 'directory', 'document', 'emphasis',
+  'feed', 'figure', 'form', 'generic', 'grid', 'gridcell', 'group', 'heading', 'img',
+  'insertion', 'link', 'list', 'listbox', 'listitem', 'log', 'main', 'marquee', 'math',
+  'menu', 'menubar', 'menuitem', 'menuitemcheckbox', 'menuitemradio', 'meter', 'navigation',
+  'none', 'note', 'option', 'paragraph', 'presentation', 'progressbar', 'radio', 'radiogroup',
+  'region', 'row', 'rowgroup', 'rowheader', 'scrollbar', 'search', 'searchbox', 'separator',
+  'slider', 'spinbutton', 'status', 'strong', 'subscript', 'superscript', 'switch', 'tab',
+  'table', 'tablist', 'tabpanel', 'term', 'textbox', 'time', 'timer', 'toolbar', 'tooltip',
+  'tree', 'treegrid', 'treeitem',
+]);
+
+export default {
+  id: 'valid-role',
+  impact: 'critical',
+  tags: ['wcag2a', 'wcag412'],
+  help: 'role attributes must use valid ARIA roles',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html',
+  selector: '[role]',
+  evaluate(element) {
+    // A role attribute may list fallbacks; the first valid token wins.
+    // doc-* (DPub-ARIA) and graphics-* (Graphics-ARIA) modules are valid too.
+    const tokens = element.getAttribute('role').trim().split(/\s+/).filter(Boolean);
+    const isValid = (token) => {
+      const t = token.toLowerCase();
+      return VALID_ROLES.has(t) || t.startsWith('doc-') || t.startsWith('graphics-');
+    };
+    if (tokens.some(isValid)) return { status: 'pass' };
+    // An invalid role is ignored and the element falls back to its NATIVE
+    // role. When that fallback is generic anyway (plain div/span, not
+    // focusable, no ARIA states riding on the bogus role), nothing an AT
+    // user receives is wrong — role="text" on presentational spans is the
+    // canonical harmless case. The failure worth reporting is an invalid
+    // role MASKING real semantics or decorating an interactive element.
+    const tag = element.tagName.toLowerCase();
+    const genericFallback = tag === 'div' || tag === 'span';
+    const focusable = element.tabIndex >= 0
+      || element.matches('a[href], button, input, select, textarea, summary');
+    const hasAriaProps = [...element.attributes].some(
+      (attr) => attr.name.startsWith('aria-') && attr.name !== 'aria-hidden');
+    if (genericFallback && !focusable && !hasAriaProps) return { status: 'pass' };
+    return {
+      status: 'fail',
+      message: `role="${element.getAttribute('role')}" is not a valid ARIA role, so assistive technology ignores it${genericFallback ? '' : ` and falls back to the element’s native <${tag}> semantics`}.`,
+      fix: 'Use a valid role from the ARIA specification, or remove the attribute to keep the element’s native role.',
+    };
+  },
+};

package/engine/wcag22.js

@@ -0,0 +1,116 @@
+// The complete WCAG 2.2 success-criteria catalog — all 86 criteria (2.2
+// removed 4.1.1 Parsing). This is the engine's source of truth for what
+// exists in the spec, independent of what we can automate.
+//
+// `automation` is an honest assessment:
+//   'auto'    — rules can meaningfully test this
+//   'partial' — rules catch some failures; humans must still review
+//   'manual'  — requires human judgment (most of the spec!)
+// The coverage report (scripts/wcag-coverage.js → src/engine/COVERAGE.md) joins
+// this catalog with the rule registry to show real coverage.
+
+const sc = (num, name, level, automation, since = '2.0') => ({
+  num,
+  name,
+  level,
+  automation,
+  since, // WCAG version that introduced this criterion
+  principle: { 1: 'Perceivable', 2: 'Operable', 3: 'Understandable', 4: 'Robust' }[num[0]],
+  url: `https://www.w3.org/WAI/WCAG22/Understanding/${name
+    .toLowerCase()
+    .replace(/[(),]/g, '')
+    .replace(/\s+/g, '-')}.html`,
+});
+
+export default [
+  // 1. Perceivable
+  sc('1.1.1', 'Non-text Content', 'A', 'partial'),
+  sc('1.2.1', 'Audio-only and Video-only (Prerecorded)', 'A', 'manual'),
+  sc('1.2.2', 'Captions (Prerecorded)', 'A', 'partial'),
+  sc('1.2.3', 'Audio Description or Media Alternative (Prerecorded)', 'A', 'manual'),
+  sc('1.2.4', 'Captions (Live)', 'AA', 'manual'),
+  sc('1.2.5', 'Audio Description (Prerecorded)', 'AA', 'manual'),
+  sc('1.2.6', 'Sign Language (Prerecorded)', 'AAA', 'manual'),
+  sc('1.2.7', 'Extended Audio Description (Prerecorded)', 'AAA', 'manual'),
+  sc('1.2.8', 'Media Alternative (Prerecorded)', 'AAA', 'manual'),
+  sc('1.2.9', 'Audio-only (Live)', 'AAA', 'manual'),
+  sc('1.3.1', 'Info and Relationships', 'A', 'partial'),
+  sc('1.3.2', 'Meaningful Sequence', 'A', 'manual'),
+  sc('1.3.3', 'Sensory Characteristics', 'A', 'manual'),
+  sc('1.3.4', 'Orientation', 'AA', 'manual', '2.1'),
+  sc('1.3.5', 'Identify Input Purpose', 'AA', 'partial', '2.1'), // partial: wrong tokens are provable; MISSING autocomplete on identity fields needs judgment
+  sc('1.3.6', 'Identify Purpose', 'AAA', 'manual', '2.1'),
+  sc('1.4.1', 'Use of Color', 'A', 'partial'), // link-in-text-block automates the link case
+  sc('1.4.2', 'Audio Control', 'A', 'partial'), // partial: declarative autoplay is provable; JS-initiated audio is not
+  sc('1.4.3', 'Contrast (Minimum)', 'AA', 'partial'),
+  sc('1.4.4', 'Resize Text', 'AA', 'partial'),
+  sc('1.4.5', 'Images of Text', 'AA', 'manual'),
+  sc('1.4.6', 'Contrast (Enhanced)', 'AAA', 'partial'),
+  sc('1.4.7', 'Low or No Background Audio', 'AAA', 'manual'),
+  sc('1.4.8', 'Visual Presentation', 'AAA', 'manual'),
+  sc('1.4.9', 'Images of Text (No Exception)', 'AAA', 'manual'),
+  sc('1.4.10', 'Reflow', 'AA', 'partial', '2.1'), // partial: reflow (current-viewport overflow heuristic); full test is at 320px
+  sc('1.4.11', 'Non-text Contrast', 'AA', 'partial', '2.1'), // partial: non-text-contrast covers field boundaries; icons/focus indicators need eyes
+  sc('1.4.12', 'Text Spacing', 'AA', 'partial', '2.1'), // partial: text-spacing probes the SC's own override test for clipping
+  sc('1.4.13', 'Content on Hover or Focus', 'AA', 'manual', '2.1'),
+  // 2. Operable
+  sc('2.1.1', 'Keyboard', 'A', 'partial'),
+  sc('2.1.2', 'No Keyboard Trap', 'A', 'manual'),
+  sc('2.1.3', 'Keyboard (No Exception)', 'AAA', 'partial'), // 2.1.1's rules apply; no-exception scope needs humans
+  sc('2.1.4', 'Character Key Shortcuts', 'A', 'manual', '2.1'),
+  sc('2.2.1', 'Timing Adjustable', 'A', 'partial'), // meta-refresh automates the redirect/refresh case
+  sc('2.2.2', 'Pause, Stop, Hide', 'A', 'partial'),
+  sc('2.2.3', 'No Timing', 'AAA', 'manual'),
+  sc('2.2.4', 'Interruptions', 'AAA', 'manual'),
+  sc('2.2.5', 'Re-authenticating', 'AAA', 'manual'),
+  sc('2.2.6', 'Timeouts', 'AAA', 'manual', '2.1'),
+  sc('2.3.1', 'Three Flashes or Below Threshold', 'A', 'manual'),
+  sc('2.3.2', 'Three Flashes', 'AAA', 'manual'),
+  sc('2.3.3', 'Animation from Interactions', 'AAA', 'manual', '2.1'),
+  sc('2.4.1', 'Bypass Blocks', 'A', 'partial'), // partial: "repeated across pages" can't be established from one page
+  sc('2.4.2', 'Page Titled', 'A', 'auto'),
+  sc('2.4.3', 'Focus Order', 'A', 'manual'), // no rule automates this yet; order judgment needs humans
+  sc('2.4.4', 'Link Purpose (In Context)', 'A', 'partial'),
+  sc('2.4.5', 'Multiple Ways', 'AA', 'manual'),
+  sc('2.4.6', 'Headings and Labels', 'AA', 'manual'),
+  sc('2.4.7', 'Focus Visible', 'AA', 'partial'), // partial: focus-visible flags outline suppression; the indicator itself needs eyes
+  sc('2.4.8', 'Location', 'AAA', 'manual'),
+  sc('2.4.9', 'Link Purpose (Link Only)', 'AAA', 'manual'),
+  sc('2.4.10', 'Section Headings', 'AAA', 'manual'),
+  sc('2.4.11', 'Focus Not Obscured (Minimum)', 'AA', 'partial', '2.2'), // partial: focus-not-obscured catches fully-covered targets at rest
+  sc('2.4.12', 'Focus Not Obscured (Enhanced)', 'AAA', 'manual', '2.2'),
+  sc('2.4.13', 'Focus Appearance', 'AAA', 'manual', '2.2'),
+  sc('2.5.1', 'Pointer Gestures', 'A', 'manual', '2.1'),
+  sc('2.5.2', 'Pointer Cancellation', 'A', 'manual', '2.1'),
+  sc('2.5.3', 'Label in Name', 'A', 'manual', '2.1'), // manual WHILE the label-in-name rule is parked (see rules/index.js) — 'auto' with no active rule made this SC vanish from both the results AND the manual checklist
+  sc('2.5.4', 'Motion Actuation', 'A', 'manual', '2.1'),
+  sc('2.5.5', 'Target Size (Enhanced)', 'AAA', 'partial', '2.1'),
+  sc('2.5.6', 'Concurrent Input Mechanisms', 'AAA', 'manual', '2.1'),
+  sc('2.5.7', 'Dragging Movements', 'AA', 'manual', '2.2'),
+  sc('2.5.8', 'Target Size (Minimum)', 'AA', 'partial', '2.2'), // partial: size/spacing are computable; the equivalent-control and essential exceptions need judgment
+  // 3. Understandable
+  sc('3.1.1', 'Language of Page', 'A', 'auto'),
+  sc('3.1.2', 'Language of Parts', 'AA', 'partial'), // partial: invalid lang values are provable; UNMARKED foreign passages need language identification
+  sc('3.1.3', 'Unusual Words', 'AAA', 'manual'),
+  sc('3.1.4', 'Abbreviations', 'AAA', 'manual'),
+  sc('3.1.5', 'Reading Level', 'AAA', 'manual'),
+  sc('3.1.6', 'Pronunciation', 'AAA', 'manual'),
+  sc('3.2.1', 'On Focus', 'A', 'manual'),
+  sc('3.2.2', 'On Input', 'A', 'manual'),
+  sc('3.2.3', 'Consistent Navigation', 'AA', 'manual'),
+  sc('3.2.4', 'Consistent Identification', 'AA', 'manual'),
+  sc('3.2.5', 'Change on Request', 'AAA', 'manual'),
+  sc('3.2.6', 'Consistent Help', 'A', 'manual', '2.2'),
+  sc('3.3.1', 'Error Identification', 'A', 'manual'),
+  sc('3.3.2', 'Labels or Instructions', 'A', 'partial'),
+  sc('3.3.3', 'Error Suggestion', 'AA', 'manual'),
+  sc('3.3.4', 'Error Prevention (Legal, Financial, Data)', 'AA', 'manual'),
+  sc('3.3.5', 'Help', 'AAA', 'manual'),
+  sc('3.3.6', 'Error Prevention (All)', 'AAA', 'manual'),
+  sc('3.3.7', 'Redundant Entry', 'A', 'manual', '2.2'),
+  sc('3.3.8', 'Accessible Authentication (Minimum)', 'AA', 'partial', '2.2'), // partial: auth-field-obstruction catches paste blocking; alternatives need judgment
+  sc('3.3.9', 'Accessible Authentication (Enhanced)', 'AAA', 'manual', '2.2'),
+  // 4. Robust (4.1.1 Parsing was removed in WCAG 2.2)
+  sc('4.1.2', 'Name, Role, Value', 'A', 'partial'),
+  sc('4.1.3', 'Status Messages', 'AA', 'manual', '2.1'),
+];