pour-engine 1.33.0 → 1.34.0

package/engine/rules/wcag/2.2.1-meta-refresh.js

@@ -1,4 +1,28 @@
 // WCAG SC 2.2.1 Timing Adjustable (Level A)
+
+/**
+ * The destination the browser would navigate to, read the way the HTML
+ * "shared declarative refresh steps" read it: after the time and its
+ * separator (";", "," or whitespace) everything that remains is the URL,
+ * with or without a "url" keyword, an "=" and quotes, none of which the
+ * parser requires. Only a bare number, or a number followed by nothing,
+ * points the refresh back at the page itself. (2026-08-25 overnight audit:
+ * the old test demanded the literal "url=", so content="0;https://…" was
+ * asserted as a reload loop while the browser redirected from it.)
+ */
+function refreshDestination(content) {
+  let rest = content.replace(/^\s*[\d.]*\s*(?:[;,]\s*)?/, '');
+  // "url" is consumed letter by letter, then optional whitespace and "=".
+  rest = rest.replace(/^url\s*(?:=\s*)?/i, '');
+  const quote = rest[0] === '"' || rest[0] === "'" ? rest[0] : '';
+  if (quote) {
+    rest = rest.slice(1);
+    const close = rest.indexOf(quote);
+    if (close !== -1) rest = rest.slice(0, close);
+  }
+  return rest.trim();
+}
+
 export default {
   id: 'meta-refresh',
   name: 'Timed page refresh',
@@ -14,7 +38,7 @@ export default {
     // A refresh with no destination reloads THIS page. At zero seconds that
     // is not the allowed instant redirect — it is a loop that throws the
     // user back to the top of the page over and over (failure F41).
-    const hasDestination = /;\s*url\s*=/i.test(content);
+    const hasDestination = refreshDestination(content) !== '';
     if (delay === 0 && !hasDestination) {
       return {
         status: 'fail',

package/engine/rules/wcag/2.2.2-pause-stop-hide.js

@@ -43,6 +43,17 @@ function keyframesBlink(keyframes) {
   return opacities.some((value) => value <= 0.25) && opacities.some((value) => value >= 0.75);
 }
 
+/** Does a pseudo-element's generated content put TEXT on the screen? A
+ *  quoted string with something in it, an attr() or counter() value, or
+ *  quotes do; "none", "normal", the empty string and url() images do not. */
+function generatedText(content) {
+  if (!content || content === 'none' || content === 'normal') return false;
+  const withoutImages = content.replace(/url\([^)]*\)/g, '');
+  const strings = withoutImages.match(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g) ?? [];
+  if (strings.some((string) => string.slice(1, -1).trim())) return true;
+  return /\b(?:attr|counters?)\(|(?:open|close)-quote/.test(withoutImages);
+}
+
 /**
  * Elements that an endlessly repeating animation is currently moving,
  * mapped to the evidence. One document-wide getAnimations() call, never one
@@ -69,9 +80,21 @@ function endlesslyMoving(doc) {
     try { keyframes = effect.getKeyframes(); } catch { continue; }
     const moves = keyframesMove(keyframes);
     if (!moves && !keyframesBlink(keyframes)) continue;
-    // A pseudo-element's motion is still the host element's motion.
+    // A pseudo-element's motion is still the host element's motion, but
+    // the text gate belongs to the pseudo-element: a ::after spinner on a
+    // button labelled "Saving" carries no text of its own, so it is the
+    // text-free indicator this rule leaves alone, whatever the host says.
+    // One getComputedStyle per endless pseudo animation, never per element
+    // (2026-08-25 overnight audit).
+    let pseudoText = false;
+    if (effect.pseudoElement) {
+      let content = '';
+      try { content = target.ownerDocument.defaultView.getComputedStyle(target, effect.pseudoElement).content; } catch { /* detached */ }
+      if (!generatedText(content)) continue;
+      pseudoText = true;
+    }
     if (!moving.has(target)) {
-      moving.set(target, { name: animation.animationName, verb: moves ? 'moves' : 'blinks' });
+      moving.set(target, { name: animation.animationName, verb: moves ? 'moves' : 'blinks', pseudoText });
     }
   }
   return moving;
@@ -107,7 +130,7 @@ export default {
         };
       }
       const animation = moving.get(element);
-      if (!animation || !element.textContent.trim()) return { status: 'pass' };
+      if (!animation || !(animation.pseudoText || element.textContent.trim())) return { status: 'pass' };
       const named = animation.name ? ` (the “${animation.name}” animation)` : '';
       return {
         status: 'incomplete',

package/engine/rules/wcag/2.4.1-bypass-blocks.js

@@ -1,5 +1,24 @@
 // WCAG SC 2.4.1 Bypass Blocks (Level A)
 import { collectRoots, isEmbeddedDocument } from '../../lib/dom.js';
+import { effectiveRole } from '../../lib/roles.js';
+
+// ARIA11 lists the landmark roles: banner, complementary, contentinfo,
+// form, main, navigation, region, search. Judged by EFFECTIVE role, not tag
+// (2026-08-25 overnight audit): HTML-AAM makes a <header>/<footer> inside
+// article, aside, main, nav or section generic rather than a landmark, and
+// a named <section> or <form> IS one. The tag selector counted the first
+// and missed the second. region and form are landmarks only when named
+// (ARIA 1.2 requires an accessible name for region; HTML-AAM maps form to
+// the form landmark only with one), so the name is checked here.
+const LANDMARK_ROLES = new Set(['banner', 'complementary', 'contentinfo', 'form', 'main', 'navigation', 'region', 'search']);
+const NAMED_ONLY = new Set(['form', 'region']);
+const LANDMARK_CANDIDATES = 'main, header, footer, nav, aside, section, form, [role]';
+const hasName = (el) => Boolean(
+  el.getAttribute('aria-label')?.trim() || el.getAttribute('aria-labelledby')?.trim() || el.getAttribute('title')?.trim());
+const isLandmark = (el) => {
+  const role = effectiveRole(el);
+  return LANDMARK_ROLES.has(role) && (!NAMED_ONLY.has(role) || hasName(el));
+};
 
 export default {
   id: 'bypass-blocks',
@@ -10,7 +29,7 @@ export default {
   helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/bypass-blocks.html',
   selector: 'html',
   visibleOnly: false,
-  evaluate(element) {
+  evaluate(element, { isRendered }) {
     // 2.4.1 governs blocks "repeated on multiple Web pages", and a WCAG
     // Web page is a non-embedded resource: an embedded frame's document
     // owes no skip link of its own (the frame's title is itself the bypass
@@ -28,17 +47,22 @@ export default {
     // banner and a navigation region are exactly what landmark navigation
     // skips between. Requiring `main` failed pages that were already using
     // the technique the spec names.
-    const LANDMARKS = 'main, [role="main"], header, [role="banner"], nav, [role="navigation"],'
-      + ' aside, [role="complementary"], footer, [role="contentinfo"], [role="search"], form[role="search"]';
-    if (inAnyRoot(LANDMARKS)) return { status: 'pass' };
+    if (roots.some((root) => [...(root.querySelectorAll?.(LANDMARK_CANDIDATES) ?? [])].some(isLandmark))) {
+      return { status: 'pass' };
+    }
     if (inAnyRoot('h1, h2, h3, h4, h5, h6, [role="heading"]')) return { status: 'pass' };
     // G1/G123/G124: ANY in-page link that resolves is a bypass mechanism.
     // Reading only the first one hid a real skip link behind the href="#"
-    // that scripts use as a button.
+    // that scripts use as a button. The link must be RENDERED to count:
+    // G1's test is that it is visible, or visible on keyboard focus, and
+    // a display:none link is never in the tab order, so nobody can use it.
+    // Clip/sr-only skip links are rendered and still count (2026-08-25
+    // overnight audit).
     for (const root of roots) {
       for (const link of root.querySelectorAll?.('a[href^="#"]') ?? []) {
         const id = link.getAttribute('href').slice(1);
         if (!id) continue;
+        if (isRendered && !isRendered(link)) continue;
         if (roots.some((r) => r.getElementById?.(id) || r.querySelector?.(`[id="${CSS.escape(id)}"]`))) {
           return { status: 'pass' };
         }

package/engine/rules/wcag/2.4.2-document-title.js

@@ -10,6 +10,11 @@
 // defaults. Almost always a leftover, but a gallery page really can be about
 // an artwork called "Untitled", and "Example Domain" really is the subject
 // of example.com. Those are somebody's call to make, not the engine's.
+// "New document", "New page" and "New tab" sit in tier two as well: a
+// document editor's creation screen, a wiki's new-page form or a
+// browser-style app's new-tab page is about exactly that, so only the
+// numbered editor default ("New Page 1", F25's example) is a certain
+// placeholder (2026-08-25 overnight audit).
 //
 // Deliberately NOT judged: whether a real-looking title matches the page it
 // sits on. That needs someone who can read the page, and guessing at it
@@ -18,12 +23,13 @@ import { isEmbeddedDocument } from '../../lib/dom.js';
 
 const PLACEHOLDER = new Set([
   'untitled document', 'untitled page', 'untitled-1', 'untitled 1',
-  'new document', 'new page', 'new tab', 'no title',
+  'no title',
   'insert title here', 'title here', 'page title', 'document title',
   'web page', 'webpage',
 ]);
 const UNDESCRIPTIVE = new Set([
   'untitled', 'document', 'page', 'title', 'default', 'index',
+  'new document', 'new page', 'new tab',
   'react app', 'create react app', 'vite app', 'vite + react', 'vite + vue', 'vite + svelte',
   'next app', 'create next app', 'vue app', 'nuxt app', 'svelte app', 'angular app',
   'my app', 'my site', 'my website', 'site title', 'your site title',
@@ -55,7 +61,7 @@ export default {
     }
     // Collapsed and lowercased so "Untitled   Document" is caught too.
     const normalized = title.replace(/\s+/g, ' ').toLowerCase();
-    if (PLACEHOLDER.has(normalized) || /^untitled[\s-]*\d+$/.test(normalized)) {
+    if (PLACEHOLDER.has(normalized) || /^(?:untitled|new (?:document|page|tab))[\s-]*\d+$/.test(normalized)) {
       return {
         status: 'fail',
         message: `“${title}” is a placeholder left by an editor or template. It gives no topic and no purpose, so a screen reader announces nothing useful when the page loads, and a row of open tabs, bookmarks or history entries becomes impossible to tell apart.`,

package/engine/rules/wcag/2.4.3-visual-order-divergence.js

@@ -22,17 +22,19 @@
 // grid-auto-flow: dense) reorders without `order` or `*-reverse` and is not
 // treated as evidence. Both are honest gaps to widen later with measured
 // cases, not silently.
-const FLEXGRID = /^(inline-)?(flex|grid)$/;
+export const FLEXGRID = /^(inline-)?(flex|grid)$/;
 
 /** DOM-order focusable children grouped per flex/grid parent. */
-function tabbable(element) {
+export function tabbable(element) {
   if (element.disabled || element.tabIndex < 0) return false;
   return true;
 }
 
 /** Visual reading order of sibling rects: group into rows by vertical
- *  overlap, rows top-to-bottom, within a row along the inline direction. */
-function visualSequence(entries, rightToLeft) {
+ *  overlap, rows top-to-bottom, within a row along the inline direction.
+ *  Shared with 1.3.2's reading-order rule — same geometry, different
+ *  audience (Tab order there, screen-reader reading order here). */
+export function visualSequence(entries, rightToLeft) {
   const rows = [];
   for (const entry of [...entries].sort((a, b) => a.rect.top - b.rect.top)) {
     const row = rows.find((candidates) => {

package/engine/rules/wcag/2.4.4-link-name.js

@@ -1,4 +1,6 @@
 // WCAG SC 2.4.4 Link Purpose (In Context) (Level A) · SC 4.1.2 Name, Role, Value (Level A)
+import { effectiveRole, implicitRole } from '../../lib/roles.js';
+
 export default {
   id: 'link-name',
   name: 'Link names',
@@ -10,6 +12,15 @@ export default {
   // (Links without href have no link role and are correctly excluded.)
   selector: 'a[href], [role="link"]',
   evaluate(element, { accessibleName }) {
+    // Route by EFFECTIVE role (2026-08-25 overnight audit): an <a href
+    // role="button"> is exposed as a button, not a link (ARIA 1.2 section
+    // 9.1, the role attribute overrides the host role), so its missing name
+    // is button-name's finding, worded for a button; <a href role="tab"> is
+    // composite-widget-name's. One nameless control, one finding. An
+    // unknown explicit role is ignored by the browser and the native link
+    // role survives, which is what the implicitRole fallback answers.
+    const role = effectiveRole(element) ?? implicitRole(element);
+    if (role !== 'link') return { status: 'pass' };
     if (accessibleName(element)) return { status: 'pass' };
     return {
       status: 'fail',

package/engine/rules/wcag/2.4.4-link-text-generic.js

@@ -55,6 +55,22 @@ export function normalizeName(name) {
   return name.toLowerCase().replace(/[^\p{L}\p{N}]+/gu, ' ').replace(/\s+/g, ' ').trim();
 }
 
+// A name WRAPPED in a paired bracket or quote reads as a literal token —
+// "<details>" names an element, and the brackets are the signal — so the
+// phrase inside it is not provably generic. One-sided decoration cannot
+// change a phrase's meaning and stays provable: python.org's links are
+// named ">>>More" because a CSS-generated REPL prompt joins the accessible
+// name, and "Read more →" identifies no more than "Read more". Apostrophes
+// fold to spaces so the French entries compare in their listed form.
+function provablyGeneric(name) {
+  const trimmed = name.trim();
+  if (/^[<\[({"'«‹「『].*[>\])}"'»›」』]$/su.test(trimmed)) return false;
+  const plain = trimmed.toLowerCase().replace(/[’']/gu, ' ')
+    .replace(/^[^\p{L}\p{N}\s]+\s*/u, '').replace(/[^\p{L}\p{N}\s]+\s*$/u, '')
+    .replace(/\s+/g, ' ').trim();
+  return GENERIC.has(plain);
+}
+
 export function createLinkPurposeRule({ id, impact, tags, help, helpUrl, verdict }) {
   return {
     id,
@@ -71,7 +87,12 @@ export function createLinkPurposeRule({ id, impact, tags, help, helpUrl, verdict
       if (!name) return { status: 'pass' }; // nameless: link-name reports it
       const normalized = normalizeName(name);
       if (!GENERIC.has(normalized)) return { status: 'pass' };
-      return verdict(name);
+      // The link's declared language (closest lang attribute, falling back
+      // to the document's), so a verdict can tell whether a French-only
+      // entry sits on a French page. Reached only for list matches, so the
+      // ancestor walk costs nothing on the page as a whole (2026-08-25).
+      const lang = (element.closest('[lang]')?.getAttribute('lang') ?? element.ownerDocument.documentElement.getAttribute('lang') ?? '').trim();
+      return verdict(name, { provable: provablyGeneric(name), normalized, lang });
     },
   };
 }

package/engine/rules/wcag/2.4.7-focus-visible.js

@@ -3,12 +3,35 @@
 // indicator is the classic 2.4.7 failure (F78). Cross-origin sheets are
 // unreadable and skipped; a replacement indicator can live in a different
 // rule entirely — so this flags for review, it never asserts a fail.
+// The focus pseudo-classes themselves, and nothing else: :focus-within is a
+// PARENT's state and stripping ":focus" out of it would leave "-within".
+const FOCUS_TOKEN = /:focus(?:-visible)?(?![\w-])/g;
+const HAS_FOCUS = /:focus(?:-visible)?(?![\w-])/;
+
 function focusSuppressors(doc) {
   const suspects = [];
   const replacementIn = (style) => style.getPropertyValue('box-shadow') || style.getPropertyValue('border')
     || style.getPropertyValue('border-color') || style.getPropertyValue('background')
     || style.getPropertyValue('background-color') || style.getPropertyValue('text-decoration');
-
+  const outlineOf = (style) => `${style.getPropertyValue('outline')} ${style.getPropertyValue('outline-style')} ${style.getPropertyValue('outline-width')}`;
+  const removesOutline = (outline) => /\bnone\b/.test(outline) || /(^|\s)0(px)?(\s|$)/.test(outline);
+  // The elements a focus selector reaches, with the focus state itself
+  // taken off, so `a:focus` and `a:focus-visible` both read "a".
+  const subjects = (selectorText) => selectorText.split(',')
+    .map((part) => part.replace(FOCUS_TOKEN, '').replace(/\s+/g, ' ').trim());
+  // Per sheet: the suppressors found, and the later rules that give the
+  // same elements an indicator back. A suspect is dismissed only when a
+  // LATER rule in the SAME sheet, keyed on :focus or :focus-visible, covers
+  // every subject it names and declares a visible outline or a replacement.
+  // That is the keyboard-only pattern in its other spelling
+  // (`a:focus{outline:0}` then `a:focus-visible{outline:3px solid}`) and
+  // the plain two-rule split (`a:focus{outline:none}` then
+  // `a:focus{box-shadow:...}`): both provably provide the mode of operation
+  // the criterion asks for, and both reviewed until 2026-08-25 (overnight
+  // audit). A replacement on a DIFFERENT element (a :focus-within parent)
+  // stays a review; whether that box reads as the focused control is a
+  // human question.
+  let sheet = null;
   const inspect = (rule) => {
     if (!rule.selectorText || !/:focus/.test(rule.selectorText)) return;
     // `:focus:not(:focus-visible) { outline: none }` is the PUBLISHED pattern
@@ -19,18 +42,29 @@ function focusSuppressors(doc) {
     if (/:not\(\s*:focus-visible\s*\)/.test(rule.selectorText)) return;
     const style = rule.style;
     if (!style) return;
-    const outline = `${style.getPropertyValue('outline')} ${style.getPropertyValue('outline-style')} ${style.getPropertyValue('outline-width')}`;
-    const removesOutline = /\bnone\b/.test(outline) || /(^|\s)0(px)?(\s|$)/.test(outline);
-    if (!removesOutline) return;
     // A replacement indicator may not sit in the rule's own style block: any
     // declaration written AFTER a nested rule is parsed into a separate
     // CSSNestedDeclarations child (a style-bearing rule with no selector), so
     // reading only rule.style would report a suppressor that is in fact
     // replaced two lines further down.
-    const nested = [...(rule.cssRules ?? [])]
-      .filter((child) => child.style && !child.selectorText);
-    if (replacementIn(style) || nested.some((child) => replacementIn(child.style))) return;
-    suspects.push(rule.selectorText);
+    const styles = [style, ...[...(rule.cssRules ?? [])]
+      .filter((child) => child.style && !child.selectorText).map((child) => child.style)];
+    const replaced = styles.some(replacementIn);
+    const outlines = styles.map(outlineOf).filter((o) => o.trim());
+    const showsOutline = outlines.some((o) => !removesOutline(o));
+    if (HAS_FOCUS.test(rule.selectorText) && (replaced || showsOutline)) {
+      sheet.providers.push({ order: sheet.order, subjects: subjects(rule.selectorText) });
+    }
+    if (!outlines.some(removesOutline) || replaced) return;
+    sheet.suspects.push({ order: sheet.order, selector: rule.selectorText, subjects: subjects(rule.selectorText) });
+  };
+  const covered = (subject, provider) => provider.subjects.some((p) => p === subject || p === '*' || p === '');
+  const settle = () => {
+    for (const suspect of sheet.suspects) {
+      const restored = suspect.subjects.every((subject) => sheet.providers.some((provider) =>
+        provider.order > suspect.order && covered(subject, provider)));
+      if (!restored) suspects.push(suspect.selector);
+    }
   };
   // Inspect each rule, THEN descend into any children. Testing `rule.cssRules`
   // first and skipping used to walk straight past every plain style rule:
@@ -40,12 +74,15 @@ function focusSuppressors(doc) {
   // A style rule can both declare and nest, so both halves have to run.
   const scan = (rules) => {
     for (const rule of rules) {
+      sheet.order++;
       inspect(rule);
       if (rule.cssRules?.length) scan(rule.cssRules); // @media/@supports/nesting
     }
   };
-  for (const sheet of doc.styleSheets) {
-    try { scan(sheet.cssRules); } catch { /* cross-origin sheet */ }
+  for (const styleSheet of doc.styleSheets) {
+    sheet = { order: 0, suspects: [], providers: [] };
+    try { scan(styleSheet.cssRules); } catch { /* cross-origin sheet */ }
+    settle();
   }
   return suspects;
 }

package/engine/rules/wcag/2.4.9-link-text-generic-only.js

@@ -10,8 +10,32 @@
 // everyone — which is the exception failing to apply rather than rescuing
 // it. Nothing about the surrounding page can change that reading, so there
 // is nothing here for a human to settle.
+//
+// Two matches stay in the review lane because the failure is not provable
+// (2026-08-25 corpus adjudication):
+//   · a name wrapped in a paired bracket or quote — "<details>" is a code
+//     term that names its destination exactly (one-sided decoration like
+//     python.org's CSS-generated ">>>More" prompt still asserts);
+//   · a name that is exactly "go" — every corpus hit was a brand logo
+//     ("Go" is the language's name), and a brand name identifies the link.
+//
+// A third, beside "go" (2026-08-25 overnight audit): the French entries
+// "plus" and "suite" are ordinary English words and, more to the point,
+// common English plan and product names (a "Plus" tier, a "Suite"). A
+// pricing link named "Plus" identifies its destination the way the Go logo
+// does, so outside a page declared French they review rather than assert.
+// On a link whose closest lang is French the generic reading ("more",
+// "continued") is the only one and the assertion stands.
 import { createLinkPurposeRule } from './2.4.4-link-text-generic.js';
 
+const FRENCH_ONLY_ENGLISH_NAMES = new Set(['plus', 'suite']);
+const FRENCH = /^fr(-|$)/i;
+
+function mayBeBrandName(normalized, lang) {
+  if (normalized === 'go') return true;
+  return FRENCH_ONLY_ENGLISH_NAMES.has(normalized) && !FRENCH.test(lang);
+}
+
 export default createLinkPurposeRule({
   id: 'link-text-generic-only',
   name: 'Self-sufficient link text',
@@ -19,9 +43,16 @@ export default createLinkPurposeRule({
   tags: ['wcag2aaa', 'wcag249'],
   help: 'Link text alone must identify where the link goes (AAA)',
   helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-link-only.html',
-  verdict: (name) => ({
-    status: 'fail',
-    message: `“${name}” gives no purpose on its own. 2.4.9 asks that the link text alone identify where a link goes, without relying on the sentence or heading around it, so anyone reading the page's links as a list can tell them apart.`,
-    fix: 'Name the destination in the link text, e.g. "Read more about the 2026 budget".',
-  }),
+  verdict: (name, { provable, normalized, lang }) => {
+    if (!provable || mayBeBrandName(normalized, lang)) return {
+      status: 'incomplete',
+      message: `“${name}” matches a generic link phrase, but may identify its destination anyway: a code term keeps its meaning through the punctuation this comparison drops, and a brand or product name (a logo link named “Go”, a plan named “Plus”) is the destination. Check whether this name, read alone in a list of the page's links, says where it goes.`,
+      fix: 'If the name really is generic here, put the destination in the link text, e.g. "Read more about the 2026 budget".',
+    };
+    return {
+      status: 'fail',
+      message: `“${name}” gives no purpose on its own. 2.4.9 asks that the link text alone identify where a link goes, without relying on the sentence or heading around it, so anyone reading the page's links as a list can tell them apart.`,
+      fix: 'Name the destination in the link text, e.g. "Read more about the 2026 budget".',
+    };
+  },
 });

package/engine/rules/wcag/2.5.3-label-in-name.js

@@ -50,21 +50,30 @@ function visuallyErased(element) {
   return false;
 }
 
-/** The text a sighted user actually sees inside the component (slot-aware). */
-function visibleText(nodes) {
+// Form controls a wrapping <label> may contain. Their subtrees are the
+// control's VALUES (a <select>'s options, a <button>'s caption), not the
+// label's text, so a label walk skips them (2026-08-25 overnight audit:
+// "Country <select>" used to read as "Country United KingdomFrance").
+const CONTROL_TAGS = new Set(['input', 'select', 'textarea', 'button', 'meter', 'progress', 'output']);
+
+/** The text a sighted user actually sees inside the component (slot-aware).
+ *  With skipControls, form controls inside the walk are left out: that is
+ *  the wrapping-<label> case, where only the label's own text is the label. */
+function visibleText(nodes, skipControls = false) {
   let text = '';
   for (const node of nodes) {
     if (node.nodeType === 3 /* TEXT_NODE */) { text += node.textContent; continue; }
     if (node.nodeType !== 1 /* ELEMENT_NODE */) continue;
     const tag = node.tagName.toLowerCase();
     if (tag === 'script' || tag === 'style' || tag === 'noscript' || tag === 'template') continue;
+    if (skipControls && CONTROL_TAGS.has(tag)) continue;
     if (node.hasAttribute('hidden') || visuallyErased(node)) continue;
     if (tag === 'slot') {
       const assigned = node.assignedNodes?.() ?? [];
-      text += visibleText(assigned.length ? assigned : node.childNodes);
+      text += visibleText(assigned.length ? assigned : node.childNodes, skipControls);
       continue;
     }
-    text += visibleText(node.childNodes);
+    text += visibleText(node.childNodes, skipControls);
   }
   return text;
 }
@@ -90,7 +99,7 @@ export default {
       // form-label's finding, not a 2.5.3 mismatch.
       rawVisible = [...(element.labels ?? [])]
         .filter((label) => !visuallyErased(label))
-        .map((label) => visibleText(label.childNodes))
+        .map((label) => visibleText(label.childNodes, true))
         .join(' ');
     } else {
       rawVisible = visibleText(element.childNodes);

package/engine/rules/wcag/2.5.5-target-size-enhanced.js

@@ -7,7 +7,9 @@ import { createTargetSizeRule } from './2.5.8-target-size.js';
 export default createTargetSizeRule({
   id: 'target-size-enhanced',
   name: 'Enhanced target size',
-  tags: ['wcag2aaa', 'wcag255'],
+  // 2.5.5 was introduced in WCAG 2.1, so the versioned AAA tag is the true
+  // one (retagged 2026-08-25 overnight audit).
+  tags: ['wcag21aaa', 'wcag255'],
   help: 'Interactive targets must be at least 44×44 pixels (AAA)',
   helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/target-size-enhanced.html',
   min: 44,

package/engine/rules/wcag/2.5.7-drag-alternative.js

@@ -0,0 +1,38 @@
+// WCAG SC 2.5.7 Dragging Movements (Level AA, new in 2.2)
+//
+// Functionality operated by dragging must also work through single-pointer
+// clicks or taps, unless dragging is essential or the behaviour is the
+// user agent's. Custom drag logic is script and mostly invisible to a
+// scan, but one author signal is explicit in the DOM: draggable="true"
+// written on an element. Whether an equivalent no-drag path exists (an
+// up/down button beside a sortable row, a picker beside a slider) is not
+// decidable from markup, so this asks, it never asserts.
+//
+// Scoped to keep the question honest:
+//   - only the EXPLICIT attribute counts. Images, links and selections
+//     are draggable by browser default (drag-to-desktop, drag-to-text) —
+//     that is user-agent behaviour, which the SC itself exempts — so <img>
+//     and <a href> are skipped even with the attribute written out: authors
+//     write draggable="true" there to re-state or fine-tune a UA default,
+//     not to build an interaction.
+//   - native range inputs are UA controls: a single click on the track
+//     moves the thumb without dragging, which is the alternative already
+//     existing. They never carried the attribute anyway.
+// Drag interactions wired purely through pointer events with no draggable
+// attribute are a DISCLOSED gap: listeners are not enumerable from a page.
+export default {
+  id: 'drag-alternative',
+  name: 'Dragging alternative',
+  impact: 'moderate',
+  tags: ['wcag22aa', 'wcag257'],
+  help: 'Dragging must have a single-pointer alternative',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/dragging-movements.html',
+  selector: '[draggable="true" i]:not(img):not(a[href])',
+  evaluate() {
+    return {
+      status: 'incomplete',
+      message: 'This element declares itself draggable, and 2.5.7 requires everything achievable by dragging to also work with single clicks or taps — tremors, switch access and head pointers can press but not drag. Check an equivalent no-drag path exists (buttons to reorder, a menu to move, a field to set the value), unless dragging itself is essential here.',
+      fix: 'Add a single-pointer way to do the same thing, e.g. up/down buttons beside a sortable item or a "move to" action in a menu.',
+    };
+  },
+};