pour-engine 1.41.0 → 1.42.0

package/config/project.config.js

@@ -6,6 +6,6 @@
 export default {
   engine: {
     name: 'pour engine',
-    version: '1.41.0',
+    version: '1.42.0',
   },
 };

package/engine/COVERAGE.md

@@ -17,9 +17,9 @@ meaning that only a person can settle, even where a rule decides most real pages
 | 1.1.1 | [Non-text Content](https://www.w3.org/WAI/WCAG22/Understanding/non-text-content.html) | A | Partially automated | area-alt, canvas-alt, embed-alt, image-alt, input-image-alt, object-alt, svg-img-alt |
 | 1.2.1 | [Audio-only and Video-only (Prerecorded)](https://www.w3.org/WAI/WCAG22/Understanding/audio-only-and-video-only-prerecorded.html) | A | Partially automated | audio-transcript |
 | 1.2.2 | [Captions (Prerecorded)](https://www.w3.org/WAI/WCAG22/Understanding/captions-prerecorded.html) | A | Partially automated | media-captions |
-| 1.2.3 | [Audio Description or Media Alternative (Prerecorded)](https://www.w3.org/WAI/WCAG22/Understanding/audio-description-or-media-alternative-prerecorded.html) | A | Manual review | — |
+| 1.2.3 | [Audio Description or Media Alternative (Prerecorded)](https://www.w3.org/WAI/WCAG22/Understanding/audio-description-or-media-alternative-prerecorded.html) | A | Partially automated | video-audio-description |
 | 1.2.4 | [Captions (Live)](https://www.w3.org/WAI/WCAG22/Understanding/captions-live.html) | AA | Manual review | — |
-| 1.2.5 | [Audio Description (Prerecorded)](https://www.w3.org/WAI/WCAG22/Understanding/audio-description-prerecorded.html) | AA | Manual review | — |
+| 1.2.5 | [Audio Description (Prerecorded)](https://www.w3.org/WAI/WCAG22/Understanding/audio-description-prerecorded.html) | AA | Partially automated | video-audio-description |
 | 1.2.6 | [Sign Language (Prerecorded)](https://www.w3.org/WAI/WCAG22/Understanding/sign-language-prerecorded.html) | AAA | Manual review | — |
 | 1.2.7 | [Extended Audio Description (Prerecorded)](https://www.w3.org/WAI/WCAG22/Understanding/extended-audio-description-prerecorded.html) | AAA | Manual review | — |
 | 1.2.8 | [Media Alternative (Prerecorded)](https://www.w3.org/WAI/WCAG22/Understanding/media-alternative-prerecorded.html) | AAA | Manual review | — |
@@ -29,7 +29,7 @@ meaning that only a person can settle, even where a rule decides most real pages
 | 1.3.3 | [Sensory Characteristics](https://www.w3.org/WAI/WCAG22/Understanding/sensory-characteristics.html) | A | Manual review | — |
 | 1.3.4 | [Orientation](https://www.w3.org/WAI/WCAG22/Understanding/orientation.html) | AA | Partially automated | orientation-lock |
 | 1.3.5 | [Identify Input Purpose](https://www.w3.org/WAI/WCAG22/Understanding/identify-input-purpose.html) | AA | Partially automated | autocomplete-valid |
-| 1.3.6 | [Identify Purpose](https://www.w3.org/WAI/WCAG22/Understanding/identify-purpose.html) | AAA | Manual review | — |
+| 1.3.6 | [Identify Purpose](https://www.w3.org/WAI/WCAG22/Understanding/identify-purpose.html) | AAA | Partially automated | region-purpose |
 | 1.4.1 | [Use of Color](https://www.w3.org/WAI/WCAG22/Understanding/use-of-color.html) | A | Partially automated | link-in-text-block |
 | 1.4.2 | [Audio Control](https://www.w3.org/WAI/WCAG22/Understanding/audio-control.html) | A | Partially automated | audio-control |
 | 1.4.3 | [Contrast (Minimum)](https://www.w3.org/WAI/WCAG22/Understanding/contrast-minimum.html) | AA | Partially automated | color-contrast, control-contrast |
@@ -37,7 +37,7 @@ meaning that only a person can settle, even where a rule decides most real pages
 | 1.4.5 | [Images of Text](https://www.w3.org/WAI/WCAG22/Understanding/images-of-text.html) | AA | Manual review | — |
 | 1.4.6 | [Contrast (Enhanced)](https://www.w3.org/WAI/WCAG22/Understanding/contrast-enhanced.html) | AAA | Partially automated | color-contrast-enhanced |
 | 1.4.7 | [Low or No Background Audio](https://www.w3.org/WAI/WCAG22/Understanding/low-or-no-background-audio.html) | AAA | Manual review | — |
-| 1.4.8 | [Visual Presentation](https://www.w3.org/WAI/WCAG22/Understanding/visual-presentation.html) | AAA | Manual review | — |
+| 1.4.8 | [Visual Presentation](https://www.w3.org/WAI/WCAG22/Understanding/visual-presentation.html) | AAA | Partially automated | text-justified |
 | 1.4.9 | [Images of Text (No Exception)](https://www.w3.org/WAI/WCAG22/Understanding/images-of-text-no-exception.html) | AAA | Manual review | — |
 | 1.4.10 | [Reflow](https://www.w3.org/WAI/WCAG22/Understanding/reflow.html) | AA | Partially automated | reflow |
 | 1.4.11 | [Non-text Contrast](https://www.w3.org/WAI/WCAG22/Understanding/non-text-contrast.html) | AA | Partially automated | non-text-contrast |
@@ -55,7 +55,7 @@ meaning that only a person can settle, even where a rule decides most real pages
 | 2.2.1 | [Timing Adjustable](https://www.w3.org/WAI/WCAG22/Understanding/timing-adjustable.html) | A | Partially automated | meta-refresh |
 | 2.2.2 | [Pause, Stop, Hide](https://www.w3.org/WAI/WCAG22/Understanding/pause-stop-hide.html) | A | Partially automated | pause-stop-hide, video-loop-motion |
 | 2.2.3 | [No Timing](https://www.w3.org/WAI/WCAG22/Understanding/no-timing.html) | AAA | Manual review | — |
-| 2.2.4 | [Interruptions](https://www.w3.org/WAI/WCAG22/Understanding/interruptions.html) | AAA | Manual review | — |
+| 2.2.4 | [Interruptions](https://www.w3.org/WAI/WCAG22/Understanding/interruptions.html) | AAA | Partially automated | meta-refresh-no-exceptions |
 | 2.2.5 | [Re-authenticating](https://www.w3.org/WAI/WCAG22/Understanding/re-authenticating.html) | AAA | Manual review | — |
 | 2.2.6 | [Timeouts](https://www.w3.org/WAI/WCAG22/Understanding/timeouts.html) | AAA | Manual review | — |
 | 2.3.1 | [Three Flashes or Below Threshold](https://www.w3.org/WAI/WCAG22/Understanding/three-flashes-or-below-threshold.html) | A | Manual review | — |
@@ -66,15 +66,15 @@ meaning that only a person can settle, even where a rule decides most real pages
 | 2.4.3 | [Focus Order](https://www.w3.org/WAI/WCAG22/Understanding/focus-order.html) | A | Partially automated | visual-order-divergence |
 | 2.4.4 | [Link Purpose (In Context)](https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-in-context.html) | A | Partially automated | area-alt, link-name, link-text-generic |
 | 2.4.5 | [Multiple Ways](https://www.w3.org/WAI/WCAG22/Understanding/multiple-ways.html) | AA | Manual review | — |
-| 2.4.6 | [Headings and Labels](https://www.w3.org/WAI/WCAG22/Understanding/headings-and-labels.html) | AA | Manual review | — |
+| 2.4.6 | [Headings and Labels](https://www.w3.org/WAI/WCAG22/Understanding/headings-and-labels.html) | AA | Partially automated | heading-label-placeholder |
 | 2.4.7 | [Focus Visible](https://www.w3.org/WAI/WCAG22/Understanding/focus-visible.html) | AA | Partially automated | focus-visible |
 | 2.4.8 | [Location](https://www.w3.org/WAI/WCAG22/Understanding/location.html) | AAA | Manual review | — |
 | 2.4.9 | [Link Purpose (Link Only)](https://www.w3.org/WAI/WCAG22/Understanding/link-purpose-link-only.html) | AAA | Partially automated | link-text-generic-only |
-| 2.4.10 | [Section Headings](https://www.w3.org/WAI/WCAG22/Understanding/section-headings.html) | AAA | Manual review | — |
+| 2.4.10 | [Section Headings](https://www.w3.org/WAI/WCAG22/Understanding/section-headings.html) | AAA | Partially automated | section-heading |
 | 2.4.11 | [Focus Not Obscured (Minimum)](https://www.w3.org/WAI/WCAG22/Understanding/focus-not-obscured-minimum.html) | AA | Partially automated | focus-not-obscured |
-| 2.4.12 | [Focus Not Obscured (Enhanced)](https://www.w3.org/WAI/WCAG22/Understanding/focus-not-obscured-enhanced.html) | AAA | Manual review | — |
+| 2.4.12 | [Focus Not Obscured (Enhanced)](https://www.w3.org/WAI/WCAG22/Understanding/focus-not-obscured-enhanced.html) | AAA | Partially automated | focus-not-obscured-enhanced |
 | 2.4.13 | [Focus Appearance](https://www.w3.org/WAI/WCAG22/Understanding/focus-appearance.html) | AAA | Manual review | — |
-| 2.5.1 | [Pointer Gestures](https://www.w3.org/WAI/WCAG22/Understanding/pointer-gestures.html) | A | Manual review | — |
+| 2.5.1 | [Pointer Gestures](https://www.w3.org/WAI/WCAG22/Understanding/pointer-gestures.html) | A | Partially automated | pointer-gesture-alternative |
 | 2.5.2 | [Pointer Cancellation](https://www.w3.org/WAI/WCAG22/Understanding/pointer-cancellation.html) | A | Manual review | — |
 | 2.5.3 | [Label in Name](https://www.w3.org/WAI/WCAG22/Understanding/label-in-name.html) | A | Manual review | — |
 | 2.5.4 | [Motion Actuation](https://www.w3.org/WAI/WCAG22/Understanding/motion-actuation.html) | A | Manual review | — |
@@ -97,17 +97,17 @@ meaning that only a person can settle, even where a rule decides most real pages
 | 3.2.2 | [On Input](https://www.w3.org/WAI/WCAG22/Understanding/on-input.html) | A | Partially automated | on-input-navigation |
 | 3.2.3 | [Consistent Navigation](https://www.w3.org/WAI/WCAG22/Understanding/consistent-navigation.html) | AA | Manual review | — |
 | 3.2.4 | [Consistent Identification](https://www.w3.org/WAI/WCAG22/Understanding/consistent-identification.html) | AA | Manual review | — |
-| 3.2.5 | [Change on Request](https://www.w3.org/WAI/WCAG22/Understanding/change-on-request.html) | AAA | Manual review | — |
+| 3.2.5 | [Change on Request](https://www.w3.org/WAI/WCAG22/Understanding/change-on-request.html) | AAA | Partially automated | meta-refresh-no-exceptions |
 | 3.2.6 | [Consistent Help](https://www.w3.org/WAI/WCAG22/Understanding/consistent-help.html) | A | Manual review | — |
 | 3.3.1 | [Error Identification](https://www.w3.org/WAI/WCAG22/Understanding/error-identification.html) | A | Partially automated | error-message-linkage |
 | 3.3.2 | [Labels or Instructions](https://www.w3.org/WAI/WCAG22/Understanding/labels-or-instructions.html) | A | Partially automated | form-label |
 | 3.3.3 | [Error Suggestion](https://www.w3.org/WAI/WCAG22/Understanding/error-suggestion.html) | AA | Manual review | — |
-| 3.3.4 | [Error Prevention (Legal, Financial, Data)](https://www.w3.org/WAI/WCAG22/Understanding/error-prevention-legal-financial-data.html) | AA | Manual review | — |
+| 3.3.4 | [Error Prevention (Legal, Financial, Data)](https://www.w3.org/WAI/WCAG22/Understanding/error-prevention-legal-financial-data.html) | AA | Partially automated | financial-form-confirmation |
 | 3.3.5 | [Help](https://www.w3.org/WAI/WCAG22/Understanding/help.html) | AAA | Manual review | — |
 | 3.3.6 | [Error Prevention (All)](https://www.w3.org/WAI/WCAG22/Understanding/error-prevention-all.html) | AAA | Manual review | — |
 | 3.3.7 | [Redundant Entry](https://www.w3.org/WAI/WCAG22/Understanding/redundant-entry.html) | A | Partially automated | redundant-entry |
 | 3.3.8 | [Accessible Authentication (Minimum)](https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-minimum.html) | AA | Partially automated | auth-field-obstruction |
-| 3.3.9 | [Accessible Authentication (Enhanced)](https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-enhanced.html) | AAA | Manual review | — |
+| 3.3.9 | [Accessible Authentication (Enhanced)](https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-enhanced.html) | AAA | Partially automated | auth-field-obstruction, captcha-alternative |
 
 ## Robust
 
@@ -116,4 +116,4 @@ meaning that only a person can settle, even where a rule decides most real pages
 | 4.1.2 | [Name, Role, Value](https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html) | A | Partially automated | input-image-alt, form-label, link-name, aria-allowed-attr, aria-attr-valid, aria-field-name, aria-hidden-focus, aria-label-misuse, aria-valid-refs, button-name, composite-widget-name, dialog-name, frame-title, invoker-target, label-for-valid, nested-interactive, role-required-aria, summary-name, valid-role |
 | 4.1.3 | [Status Messages](https://www.w3.org/WAI/WCAG22/Understanding/status-messages.html) | AA | Manual review | — |
 
-**Totals:** 39 partially automated · 47 manual — with 88 rules.
+**Totals:** 51 partially automated · 35 manual — with 98 rules.

package/engine/README.md

@@ -117,7 +117,7 @@ assessment, including interaction states and any checks reported as skipped.
 
 ## Honest current state
 
-88 rules, hardened on real sites and the `testbeds/` pages. Audits walk into
+98 rules, hardened on real sites and the `testbeds/` pages. Audits walk into
 open shadow roots (targets come back as `host >>> inner` selector chains);
 iframe traversal is the host's job, and the extension does it. Known gaps:
 the full accname spec (ours is a close approximation) and the language

package/engine/rules/best-practice/region.js

@@ -9,7 +9,7 @@
 // showing one (the open attribute is set by show() and showModal()) counts,
 // so a closed dialog cannot make a landmark-less page look landmarked
 // (2026-08-25 overnight audit).
-const LANDMARK =
+export const LANDMARK =
   'main, nav, aside, search, form[aria-label], form[aria-labelledby], ' +
   'header:not(:is(article, aside, main, nav, section) header), ' +
   'footer:not(:is(article, aside, main, nav, section) footer), ' +

package/engine/rules/index.js

@@ -109,6 +109,25 @@ import onInputNavigation from './wcag/3.2.2-on-input-navigation.js';
 import errorMessageLinkage from './wcag/3.3.1-error-message-linkage.js';
 import compositeWidgetName from './wcag/4.1.2-composite-widget-name.js';
 import summaryName from './wcag/4.1.2-summary-name.js';
+// 2026-09-12 manual-to-partial batch (reports/coverage-gaps/2026-09-12): the
+// slices of twelve criteria that had no rule where the DOM shows a real
+// candidate. Two AAA siblings built from existing factories (a timed refresh
+// with no 20-hour allowance, any overlap of a focused element); eight
+// review questions on declared facts (a video without a descriptions
+// track, a declared <section> with no heading, a touch-action surface, a
+// payment form, a CAPTCHA beside a credential, a page with no landmarks,
+// justified running text) and one assert on template text left in a
+// heading or label. Two assert, the rest ask.
+import metaRefreshNoExceptions from './wcag/2.2.4-meta-refresh-no-exceptions.js';
+import focusNotObscuredEnhanced from './wcag/2.4.12-focus-not-obscured-enhanced.js';
+import videoAudioDescription from './wcag/1.2.3-video-audio-description.js';
+import headingLabelPlaceholder from './wcag/2.4.6-heading-label-placeholder.js';
+import textJustified from './wcag/1.4.8-text-justified.js';
+import sectionHeading from './wcag/2.4.10-section-heading.js';
+import captchaAlternative from './wcag/3.3.9-captcha-alternative.js';
+import regionPurpose from './wcag/1.3.6-region-purpose.js';
+import financialFormConfirmation from './wcag/3.3.4-financial-form-confirmation.js';
+import pointerGestureAlternative from './wcag/2.5.1-pointer-gesture-alternative.js';
 
 // --- Best practice ---
 import headingOrder from './best-practice/heading-order.js';
@@ -210,6 +229,16 @@ export default [
   errorMessageLinkage,
   compositeWidgetName,
   summaryName,
+  metaRefreshNoExceptions,
+  focusNotObscuredEnhanced,
+  videoAudioDescription,
+  headingLabelPlaceholder,
+  textJustified,
+  sectionHeading,
+  captchaAlternative,
+  regionPurpose,
+  financialFormConfirmation,
+  pointerGestureAlternative,
   contrastEnhanced,
   targetSizeEnhanced,
   headingOrder,

package/engine/rules/wcag/1.2.3-video-audio-description.js

@@ -0,0 +1,42 @@
+// WCAG SC 1.2.3 Audio Description or Media Alternative (Prerecorded)
+// (Level A) and SC 1.2.5 Audio Description (Prerecorded) (Level AA)
+//
+// Prerecorded video in synchronized media needs audio description of the
+// visual track (1.2.5), or at Level A alternatively a full text alternative
+// for the media (1.2.3). Whether either exists is not decidable from the
+// DOM: description can be a second audio track chosen in the player, a
+// separately produced version, narration mixed into the soundtrack, or a
+// transcript beside the player. And the Understanding of 1.2.5 says no
+// description is needed when the soundtrack already carries every
+// important thing the picture shows (a talking head). So this rule never
+// asserts. It asks, once per video that can actually present sound to
+// someone, and stays silent where the page shows the one thing the DOM can
+// show: a <track kind="descriptions"> (technique H96).
+//
+// Same media gating as media-captions, for the same reasons: no resource
+// means nothing is presented, and muted-with-no-controls is the decorative
+// loop nobody can hear, which is not synchronized media for a viewer.
+// Video-only files (no audio stream at all) are 1.2.1 territory and not
+// visible from the DOM either; the message says so.
+export default {
+  id: 'video-audio-description',
+  name: 'Video audio description',
+  impact: 'serious',
+  tags: ['wcag2a', 'wcag123', 'wcag125'],
+  help: 'Video content needs audio description or a text alternative',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/audio-description-prerecorded.html',
+  selector: 'video',
+  visibleOnly: false,
+  evaluate(element) {
+    if (element.querySelector('track[kind="descriptions" i]')) return { status: 'pass' };
+    if (!element.currentSrc && !element.getAttribute('src') && !element.querySelector('source')) {
+      return { status: 'pass' };
+    }
+    if (element.muted && !element.controls) return { status: 'pass' };
+    return {
+      status: 'incomplete',
+      message: 'This video has no audio-description track. If it shows something its soundtrack does not say (text on screen, actions, charts, who is speaking), blind and low-vision users miss it. 1.2.5 asks for audio description; at Level A, 1.2.3 is also met by a full text alternative describing the visuals, linked near the player. A talking-head video whose soundtrack already carries everything needs neither, and a video with no soundtrack at all is 1.2.1\'s question instead: check which this is, and where the description or alternative lives.',
+      fix: 'Provide a described audio track or a described version of the video (a <track kind="descriptions"> file works for text-based description), or publish a full transcript that describes the visuals next to the player.',
+    };
+  },
+};

package/engine/rules/wcag/1.3.6-region-purpose.js

@@ -0,0 +1,35 @@
+// WCAG SC 1.3.6 Identify Purpose (Level AAA)
+// "The purpose of user interface components, icons, and regions can be
+// programmatically determined." Its sufficient technique for regions is
+// ARIA11, landmarks; the purpose of components and icons has no DOM-visible
+// technique at all (personalization semantics never shipped), so that half
+// of the criterion stays with a person. What a page can show is the
+// regions half: a document with no landmark whatsoever has identified the
+// purpose of none of its regions. That is one question per page, asked
+// once, and it never asserts, because the criterion lists other routes
+// (microdata, other programmatic means) the DOM does not reveal.
+//
+// Pages that HAVE landmarks pass here; stray content outside them is the
+// best-practice region rule's finding, which stays opt-in because A and AA
+// never require landmarks. This rule is the AAA criterion's own question.
+import { LANDMARK } from '../best-practice/region.js';
+
+export default {
+  id: 'region-purpose',
+  name: 'Regions with a purpose',
+  impact: 'moderate',
+  tags: ['wcag21aaa', 'wcag136'],
+  help: 'The purpose of page regions should be programmatically determinable (AAA)',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/identify-purpose.html',
+  selector: 'html',
+  visibleOnly: false,
+  evaluate(element) {
+    const doc = element.ownerDocument;
+    if (doc.querySelector(LANDMARK)) return { status: 'pass' };
+    return {
+      status: 'incomplete',
+      message: 'This page declares no landmark regions (no main, nav, header, footer, aside, search or labelled region), so the purpose of its regions is not exposed to assistive technology or personalisation tools. 1.3.6 (AAA) lists landmarks as the way to identify regions; the purpose of components and icons still needs a person to check.',
+      fix: 'Wrap the page\'s regions in <main>, <nav>, <header>, <footer>, <aside> and labelled <section> elements (or the matching ARIA roles).',
+    };
+  },
+};

package/engine/rules/wcag/1.4.8-text-justified.js

@@ -0,0 +1,49 @@
+// WCAG SC 1.4.8 Visual Presentation (Level AAA) — the justified-text slice
+//
+// 1.4.8 lists five things a reader must be able to achieve for blocks of
+// text; the third is "text is not justified (aligned to both the left and
+// the right margins)". Justified text is the one of the five that the page
+// itself imposes and that shows in a computed style; F88 ("using text that
+// is justified") is its failure technique. The criterion is met when a
+// mechanism lets the reader undo it, and the Understanding says the
+// browser may provide that mechanism, so a justified block is asked about,
+// not failed: the DOM cannot show whether a style switcher or a reader
+// mode is on offer. The other four requirements (colour selection, 80
+// character measure, line spacing, 200% resize) are met by browser
+// mechanisms on ordinary pages and are not judged here.
+//
+// Only blocks with real running text count: the block's own text and the
+// text of its inline children, at least 120 characters, so a justified
+// wrapper is reported once at the paragraph that carries the words, not at
+// every ancestor that inherits the alignment.
+const BLOCK = /^(?:block|list-item|table-cell|flow-root)$/;
+
+function inlineText(element) {
+  let text = '';
+  for (const node of element.childNodes) {
+    if (node.nodeType === 3) text += node.textContent;
+    else if (node.nodeType === 1 && getComputedStyle(node).display.startsWith('inline')) text += node.textContent;
+  }
+  return text.replace(/\s+/g, ' ').trim();
+}
+
+export default {
+  id: 'text-justified',
+  name: 'Justified text',
+  impact: 'moderate',
+  tags: ['wcag2aaa', 'wcag148'],
+  help: 'Blocks of text should not be justified to both margins (AAA)',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/visual-presentation.html',
+  selector: 'p, li, dd, dt, td, th, blockquote, figcaption, summary, address, div, section, article, main, aside, header, footer',
+  evaluate(element) {
+    const style = getComputedStyle(element);
+    if (style.textAlign !== 'justify' && style.textAlign !== 'justify-all') return { status: 'pass' };
+    if (!BLOCK.test(style.display)) return { status: 'pass' };
+    if (inlineText(element).length < 120) return { status: 'pass' };
+    return {
+      status: 'incomplete',
+      message: 'This block of text is justified to both margins. The uneven spaces between words form "rivers of white" down the page that some readers with dyslexia or low vision cannot read across (failure F88). 1.4.8 allows justified text only where a mechanism lets the reader switch it off; check that one exists, in the page or the browser.',
+      fix: 'Set text-align: start (or left) on running text, or offer a control that turns justification off.',
+    };
+  },
+};

package/engine/rules/wcag/2.2.1-meta-refresh.js

@@ -10,7 +10,7 @@
  * the old test demanded the literal "url=", so content="0;https://…" was
  * asserted as a reload loop while the browser redirected from it.)
  */
-function refreshDestination(content) {
+export function refreshDestination(content) {
   let rest = content.replace(/^\s*[\d.]*\s*(?:[;,]\s*)?/, '');
   // "url" is consumed letter by letter, then optional whitespace and "=".
   rest = rest.replace(/^url\s*(?:=\s*)?/i, '');
@@ -33,7 +33,7 @@ function refreshDestination(content) {
  * rule asserted a time limit on pages the browser never moves. Verified in
  * Chromium: both of those pages stay put while content="1; url=…" navigates.
  */
-function refreshDelay(content) {
+export function refreshDelay(content) {
   const isAsciiSpace = (c) => c === ' ' || c === '\t' || c === '\n' || c === '\f' || c === '\r';
   const isDigit = (c) => c >= '0' && c <= '9';
   let i = 0;

package/engine/rules/wcag/2.2.4-meta-refresh-no-exceptions.js

@@ -0,0 +1,50 @@
+// WCAG SC 2.2.4 Interruptions (Level AAA) and SC 3.2.5 Change on Request
+// (Level AAA) — the timed meta refresh, with none of 2.2.1's escapes.
+//
+// Both criteria list the same two failure techniques: F40 (a meta redirect
+// with a time limit) and F41 (a meta refresh that reloads the page). 2.2.1
+// excuses a limit longer than 20 hours; neither AAA criterion does. An
+// interruption the reader cannot postpone or suppress breaks 2.2.4, and a
+// change of context the reader did not ask for breaks 3.2.5, however long
+// the timer. The instant redirect (zero seconds with a destination) stays
+// allowed: G110 and H76 are sufficient techniques of 3.2.5 itself.
+//
+// One rule, two tags, on the twin-tag precedent (2.1.1/2.1.3): the same
+// fact fails both. It runs beside 2.2.1's rule at AAA scope, so a refresh
+// inside 20 hours is reported by both; each names its own criterion.
+// 2.2.4 exempts emergencies, which a meta tag cannot show, so the message
+// names that assumption the way the 2.2.1 rule names its own.
+import { refreshDelay, refreshDestination } from './2.2.1-meta-refresh.js';
+
+export default {
+  id: 'meta-refresh-no-exceptions',
+  name: 'Timed refresh (AAA)',
+  impact: 'serious',
+  tags: ['wcag2aaa', 'wcag224', 'wcag325'],
+  help: 'The page must not refresh or redirect itself on any timer (AAA)',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/interruptions.html',
+  selector: 'meta[http-equiv="refresh" i]',
+  visibleOnly: false,
+  evaluate(element) {
+    const content = element.getAttribute('content') ?? '';
+    const delay = refreshDelay(content);
+    // The browser discards the directive: nothing is scheduled.
+    if (delay === null) return { status: 'pass' };
+    const hasDestination = refreshDestination(content) !== '';
+    // Zero seconds with a destination is the instant client-side redirect
+    // that G110 and H76 permit.
+    if (delay === 0 && hasDestination) return { status: 'pass' };
+    if (!hasDestination) {
+      return {
+        status: 'fail',
+        message: `The page reloads itself${delay > 0 ? ` every ${delay}s` : ' immediately, over and over'} (failure F41). The reader cannot postpone or suppress the reload, which 2.2.4 requires, and it changes the page without being asked, which 3.2.5 forbids. Neither AAA criterion has 2.2.1's 20-hour allowance.`,
+        fix: 'Remove the timed refresh and update the content in place, or let the reader request an update with a control.',
+      };
+    }
+    return {
+      status: 'fail',
+      message: `The page redirects itself after ${delay}s (failure F40). The reader cannot postpone or suppress the move, which 2.2.4 requires, and the change of context is not requested, which 3.2.5 forbids; the AAA criteria allow no 20-hour exemption. 2.2.4 excuses only an emergency, which the tag cannot show, so this finding assumes there is none.`,
+      fix: 'Redirect instantly (content="0; url=…") or on the server, or give the reader a link and let them choose when to move.',
+    };
+  },
+};

package/engine/rules/wcag/2.4.10-section-heading.js

@@ -0,0 +1,86 @@
+// WCAG SC 2.4.10 Section Headings (Level AAA)
+// "Section headings are used to organize the content." The Understanding
+// defines a section as a self-contained portion of written content, says
+// the criterion covers sections within writing rather than UI components,
+// and gives H69 (a heading element at the beginning of each section) as
+// the technique. Where a page's sections begin is a judgement about the
+// writing, except in one case the author has made for us: an HTML
+// <section> element is a declared section. A declared section that holds
+// running text and starts with no heading is the honest candidate; whether
+// it is really a section of writing or a layout wrapper stays the
+// reader's call, so this asks and never asserts.
+//
+// A section has its heading when one of its own sits anywhere inside it
+// (a nested section's or article's heading is that element's), when it
+// BEGINS with one however the markup nests it (inside a header, a div or a
+// nested article), or when the element immediately before it is that
+// heading or ends with it: the blog pattern of an article's title followed by a
+// section holding the post body (measured on the corpus: 292 such bodies
+// on one feed page, none of them a missing heading). A section named by
+// aria-labelledby or aria-label has a title by another route and is left
+// alone. Sections with little text, or none, are the UI-component case the
+// criterion excludes.
+const HEADING = 'h1, h2, h3, h4, h5, h6, [role="heading"]';
+const SUBSTANTIVE = 'img, svg, video, audio, canvas, iframe, input, select, textarea, button';
+const SKIP = 'script, style, template, noscript';
+
+/** The first (or, reversed, the last) substantive thing inside an element,
+ *  in document order: a heading, or text or media that is not one. */
+function edgeIsHeading(element, fromEnd) {
+  const children = (node) => (fromEnd ? [...node.childNodes].reverse() : [...node.childNodes]);
+  const stack = children(element).reverse();
+  while (stack.length) {
+    const node = stack.pop();
+    if (node.nodeType === 3) { if (node.textContent.trim()) return false; continue; }
+    if (node.nodeType !== 1) continue;
+    if (node.matches(HEADING)) return true;
+    if (node.matches(SKIP)) continue;
+    if (node.matches(SUBSTANTIVE)) return false;
+    for (const child of children(node).reverse()) stack.push(child);
+  }
+  return false;
+}
+
+export default {
+  id: 'section-heading',
+  name: 'Section headings',
+  impact: 'moderate',
+  tags: ['wcag2aaa', 'wcag2410'],
+  help: 'Sections of written content should begin with a heading (AAA)',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/section-headings.html',
+  selector: 'section',
+  evaluate(element) {
+    if (element.hasAttribute('aria-label') || element.hasAttribute('aria-labelledby')) return { status: 'pass' };
+    const role = element.getAttribute('role');
+    if (role && role !== 'region') return { status: 'pass' };
+    // Any heading of the section's own (not a nested section's or article's)
+    // organises it, wherever it sits; a section that BEGINS with a heading,
+    // however nested, is headed too.
+    const ownHeading = [...element.querySelectorAll(HEADING)]
+      .some((heading) => heading.closest('section, article') === element);
+    if (ownHeading || edgeIsHeading(element, false)) return { status: 'pass' };
+    const before = element.previousElementSibling;
+    if (before && (before.matches(HEADING) || (before.matches('header, hgroup') && before.querySelector(HEADING)) || edgeIsHeading(before, true))) {
+      return { status: 'pass' };
+    }
+    // A feed of untitled notes: the section is the body of an article with
+    // no heading of its own, in a run of at least three such items. Whether
+    // the notes of a feed need headings is one question about the feed, for
+    // the reviewer to ask once; asking it per item put 292 findings on one
+    // corpus page and helped nobody.
+    const item = element.closest('article');
+    if (item && item.parentElement && !item.querySelector(HEADING)) {
+      const items = (node) => [...node.children].filter((child) => child.matches('article') || child.querySelector(':scope > article')).length;
+      const container = item.parentElement;
+      if (items(container) >= 3 || (container.parentElement && items(container.parentElement) >= 3)) return { status: 'pass' };
+    }
+    const text = (element.textContent ?? '').replace(/\s+/g, ' ').trim();
+    const paragraphs = element.querySelectorAll('p').length;
+    if (text.length < 200 && paragraphs < 2) return { status: 'pass' };
+    return {
+      status: 'incomplete',
+      message: 'This section holds written content but begins with no heading of its own, so readers scanning by headings cannot find or skip it. 2.4.10 asks for a heading at the start of each section of writing; check whether this is a section of content that needs one, or a purely structural wrapper.',
+      fix: 'Start the section with a heading that names its topic, at the level below its parent heading, or name it with aria-labelledby pointing at its visible title.',
+    };
+  },
+};

package/engine/rules/wcag/2.4.11-focus-not-obscured.js

@@ -2,7 +2,8 @@
 // An opaque fixed/sticky overlay covering a focusable element is the
 // criterion's core case (bottom cookie bars over footer links). Partial
 // overlap passes by definition ("not entirely hidden"), so only full
-// containment counts.
+// containment counts. The AAA sibling built from the same factory (2.4.12,
+// "no part of the component is hidden") counts any overlap at all.
 //
 // This REVIEWS rather than fails, deliberately. What a snapshot can see is
 // "element X is under the panel right now", and that is a fact about the
@@ -31,85 +32,140 @@ function edgeReserved(doc, edge, needed) {
   return px >= needed - 1;
 }
 
-export default {
+/**
+ * Build the minimum (full containment) or enhanced (any overlap) rule.
+ * `partial: false` is 2.4.11 exactly as it has always run: one hit-test at
+ * the element's centre, and a blocker only counts when its box contains the
+ * whole element. `partial: true` is 2.4.12: the centre plus the four corners
+ * and four edge midpoints are hit-tested, and a blocker counts when it paints
+ * above the element at any of them and overlaps its box at all.
+ */
+export function createFocusObscuredRule({ id, name, tags, help, helpUrl, partial }) {
+  return {
+    id,
+    name,
+    impact: 'serious',
+    tags,
+    help,
+    helpUrl,
+    selector: FOCUSABLE,
+    visibility: 'visual',
+    evaluateAll(elements) {
+      const doc = elements[0]?.ownerDocument ?? document;
+      const win = doc.defaultView;
+      // While a modal (cookie-consent dialog etc.) is open, the page behind
+      // it is INTENTIONALLY covered and focus is supposed to be trapped in
+      // the modal — a snapshot in that state proves nothing about the
+      // criterion. The backdrop is often a separate sibling of the dialog,
+      // so the modal state is checked document-wide, not per overlay.
+      const modal = [...doc.querySelectorAll('dialog[open], [role="dialog"], [role="alertdialog"], [aria-modal="true"]')]
+        .some((el) => {
+          const rect = el.getBoundingClientRect();
+          return rect.width > 0 && rect.height > 0 && getComputedStyle(el).visibility !== 'hidden';
+        });
+      if (modal) return elements.map(() => ({ status: 'pass' }));
+
+      // Hit-test per IN-VIEWPORT focusable instead of style-scanning the
+      // whole document for overlays: elementsFromPoint at the target's
+      // centre surfaces whatever paints above it, and only the handful of
+      // on-screen targets pay any cost — a 200k-node spec page costs the
+      // same as a landing page. Per-overlay verdicts are memoized.
+      const overlayVerdict = new Map();
+      const isObscuringOverlay = (layer) => {
+        if (overlayVerdict.has(layer)) return overlayVerdict.get(layer);
+        let verdict = false;
+        const style = getComputedStyle(layer);
+        if (style.position === 'fixed' || style.position === 'sticky') {
+          const bg = style.backgroundColor.match(/rgba?\(([^)]+)\)/)?.[1]?.split(',');
+          const alpha = bg?.[3] === undefined ? 1 : parseFloat(bg[3]);
+          const rect = layer.getBoundingClientRect();
+          verdict = alpha >= 0.9 && rect.width >= 40 && rect.height >= 24;
+        }
+        overlayVerdict.set(layer, verdict);
+        return verdict;
+      };
+      const contained = (rect, overlay) =>
+        rect.left >= overlay.left && rect.right <= overlay.right
+        && rect.top >= overlay.top && rect.bottom <= overlay.bottom;
+      const overlaps = (rect, overlay) =>
+        Math.min(rect.right, overlay.right) - Math.max(rect.left, overlay.left) > 0
+        && Math.min(rect.bottom, overlay.bottom) - Math.max(rect.top, overlay.top) > 0;
+      const clampX = (x) => Math.min(Math.max(x, 0), win.innerWidth - 1);
+      const clampY = (y) => Math.min(Math.max(y, 0), win.innerHeight - 1);
+      // The layer painting above the element at one point, if it is an
+      // obscuring overlay whose box relates to the element's as the mode
+      // demands. elementsFromPoint lists the whole stack, covered elements
+      // included, so an element ABSENT from it does not paint at that point
+      // at all (a rounded corner, a clip-path): nothing is hidden there.
+      // Measured on the corpus: consent-dialog buttons with rounded corners
+      // over their own opaque backdrop were flagged from exactly that.
+      const blockerAt = (element, rect, x, y) => {
+        const stack = doc.elementsFromPoint(clampX(x), clampY(y));
+        const index = stack.indexOf(element);
+        if (index <= 0) return null;
+        const above = stack.slice(0, index);
+        return above.find((layer) =>
+          !layer.contains(element) && !element.contains(layer)
+          && isObscuringOverlay(layer)
+          && (partial ? overlaps : contained)(rect, layer.getBoundingClientRect())) ?? null;
+      };
+
+      return elements.map((element) => {
+        // `:disabled` catches controls disabled by an ancestor fieldset, which
+        // the `disabled` property does not reflect — those never take focus.
+        if (element.matches(':disabled')) return { status: 'pass' };
+        // Inert content cannot be focused, so nothing can obscure its focus.
+        if (isInert(element)) return { status: 'pass' };
+        const rect = element.getBoundingClientRect();
+        if (!rect.width || !rect.height) return { status: 'pass' };
+        // Only in-viewport geometry is trustworthy (or cheap).
+        if (rect.bottom < 0 || rect.right < 0 || rect.top > win.innerHeight || rect.left > win.innerWidth) {
+          return { status: 'pass' };
+        }
+        const cx = rect.left + rect.width / 2;
+        const cy = rect.top + rect.height / 2;
+        let blocker = blockerAt(element, rect, cx, cy);
+        if (!blocker && partial) {
+          // A strip of cookie bar over the bottom of a link leaves its
+          // centre clear; the corners and edge midpoints see it.
+          const inset = 1;
+          const xs = [rect.left + inset, cx, rect.right - inset];
+          const ys = [rect.top + inset, cy, rect.bottom - inset];
+          for (const x of xs) {
+            for (const y of ys) {
+              if (x === cx && y === cy) continue;
+              blocker = blockerAt(element, rect, x, y);
+              if (blocker) break;
+            }
+            if (blocker) break;
+          }
+        }
+        if (!blocker) return { status: 'pass' };
+        // Which viewport edge is the panel pinned to? That is the edge the
+        // browser's scroll-into-view has to clear.
+        const panel = blocker.getBoundingClientRect();
+        const edge = panel.top <= 1 && panel.bottom < win.innerHeight ? 'top'
+          : panel.bottom >= win.innerHeight - 1 ? 'bottom' : null;
+        if (edge && edgeReserved(doc, edge, panel.height)) return { status: 'pass' };
+        return partial ? {
+          status: 'incomplete',
+          message: 'Part of this element is currently underneath an opaque fixed panel. 2.4.12 (AAA) allows no part of a focused component to be hidden by author content, and whether that happens depends on where the page sits when focus reaches it — the browser does not scroll an element that is already in the viewport, merely overlapped, so focus can land half-hidden. Tab through the page and check the whole element, indicator included, stays clear of the panel.',
+          fix: `Reserve room for the panel with scroll-padding-${edge ?? 'bottom'} on the scrolling container, or move focus clear of it when the panel is up.`,
+        } : {
+          status: 'incomplete',
+          message: 'This element is currently underneath an opaque fixed panel. Whether that breaks 2.4.11 depends on where the page sits when focus reaches it — the browser does not scroll an element that is already in the viewport, merely covered, so focus can land invisibly. Tab through the page and check the focus indicator is never entirely hidden.',
+          fix: `Reserve room for the panel with scroll-padding-${edge ?? 'bottom'} on the scrolling container, or move focus clear of it when the panel is up.`,
+        };
+      });
+    },
+  };
+}
+
+export default createFocusObscuredRule({
   id: 'focus-not-obscured',
   name: 'Unobscured focus',
-  impact: 'serious',
   tags: ['wcag22aa', 'wcag2411'],
   help: 'Focused elements must not be fully hidden behind overlays',
   helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/focus-not-obscured-minimum.html',
-  selector: FOCUSABLE,
-  visibility: 'visual',
-  evaluateAll(elements) {
-    const doc = elements[0]?.ownerDocument ?? document;
-    const win = doc.defaultView;
-    // While a modal (cookie-consent dialog etc.) is open, the page behind
-    // it is INTENTIONALLY covered and focus is supposed to be trapped in
-    // the modal — a snapshot in that state proves nothing about 2.4.11.
-    // The backdrop is often a separate sibling of the dialog, so the modal
-    // state is checked document-wide, not per overlay.
-    const modal = [...doc.querySelectorAll('dialog[open], [role="dialog"], [role="alertdialog"], [aria-modal="true"]')]
-      .some((el) => {
-        const rect = el.getBoundingClientRect();
-        return rect.width > 0 && rect.height > 0 && getComputedStyle(el).visibility !== 'hidden';
-      });
-    if (modal) return elements.map(() => ({ status: 'pass' }));
-
-    // Hit-test per IN-VIEWPORT focusable instead of style-scanning the
-    // whole document for overlays: elementsFromPoint at the target's
-    // centre surfaces whatever paints above it, and only the handful of
-    // on-screen targets pay any cost — a 200k-node spec page costs the
-    // same as a landing page. Per-overlay verdicts are memoized.
-    const overlayVerdict = new Map();
-    const isObscuringOverlay = (layer) => {
-      if (overlayVerdict.has(layer)) return overlayVerdict.get(layer);
-      let verdict = false;
-      const style = getComputedStyle(layer);
-      if (style.position === 'fixed' || style.position === 'sticky') {
-        const bg = style.backgroundColor.match(/rgba?\(([^)]+)\)/)?.[1]?.split(',');
-        const alpha = bg?.[3] === undefined ? 1 : parseFloat(bg[3]);
-        const rect = layer.getBoundingClientRect();
-        verdict = alpha >= 0.9 && rect.width >= 40 && rect.height >= 24;
-      }
-      overlayVerdict.set(layer, verdict);
-      return verdict;
-    };
-    const covered = (rect, overlay) =>
-      rect.left >= overlay.left && rect.right <= overlay.right
-      && rect.top >= overlay.top && rect.bottom <= overlay.bottom;
-
-    return elements.map((element) => {
-      // `:disabled` catches controls disabled by an ancestor fieldset, which
-      // the `disabled` property does not reflect — those never take focus.
-      if (element.matches(':disabled')) return { status: 'pass' };
-      // Inert content cannot be focused, so nothing can obscure its focus.
-      if (isInert(element)) return { status: 'pass' };
-      const rect = element.getBoundingClientRect();
-      if (!rect.width || !rect.height) return { status: 'pass' };
-      // Only in-viewport geometry is trustworthy (or cheap).
-      if (rect.bottom < 0 || rect.right < 0 || rect.top > win.innerHeight || rect.left > win.innerWidth) {
-        return { status: 'pass' };
-      }
-      const x = Math.min(Math.max(rect.left + rect.width / 2, 0), win.innerWidth - 1);
-      const y = Math.min(Math.max(rect.top + rect.height / 2, 0), win.innerHeight - 1);
-      const stack = doc.elementsFromPoint(x, y);
-      const index = stack.indexOf(element);
-      if (index <= 0) return { status: 'pass' }; // topmost, or not hit-testable
-      const blocker = stack.slice(0, index).find((layer) =>
-        !layer.contains(element) && !element.contains(layer)
-        && isObscuringOverlay(layer) && covered(rect, layer.getBoundingClientRect()));
-      if (!blocker) return { status: 'pass' };
-      // Which viewport edge is the panel pinned to? That is the edge the
-      // browser's scroll-into-view has to clear.
-      const panel = blocker.getBoundingClientRect();
-      const edge = panel.top <= 1 && panel.bottom < win.innerHeight ? 'top'
-        : panel.bottom >= win.innerHeight - 1 ? 'bottom' : null;
-      if (edge && edgeReserved(doc, edge, panel.height)) return { status: 'pass' };
-      return {
-        status: 'incomplete',
-        message: 'This element is currently underneath an opaque fixed panel. Whether that breaks 2.4.11 depends on where the page sits when focus reaches it — the browser does not scroll an element that is already in the viewport, merely covered, so focus can land invisibly. Tab through the page and check the focus indicator is never entirely hidden.',
-        fix: `Reserve room for the panel with scroll-padding-${edge ?? 'bottom'} on the scrolling container, or move focus clear of it when the panel is up.`,
-      };
-    });
-  },
-};
+  partial: false,
+});

package/engine/rules/wcag/2.4.12-focus-not-obscured-enhanced.js

@@ -0,0 +1,17 @@
+// WCAG SC 2.4.12 Focus Not Obscured (Enhanced) (Level AAA)
+// 2.4.11's geometry with the containment requirement relaxed to any
+// overlap: the enhanced criterion allows NO part of a focused component to
+// be hidden by author-created content, and its Understanding names the
+// sticky footer that clips the bottom of a focused link as the failure.
+// Same review-not-fail discipline as the minimum rule: the snapshot proves
+// where an element sits now, not where focus will find it.
+import { createFocusObscuredRule } from './2.4.11-focus-not-obscured.js';
+
+export default createFocusObscuredRule({
+  id: 'focus-not-obscured-enhanced',
+  name: 'Fully unobscured focus',
+  tags: ['wcag22aaa', 'wcag2412'],
+  help: 'No part of a focused element may be hidden behind overlays (AAA)',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/focus-not-obscured-enhanced.html',
+  partial: true,
+});

package/engine/rules/wcag/2.4.6-heading-label-placeholder.js

@@ -0,0 +1,69 @@
+// WCAG SC 2.4.6 Headings and Labels (Level AA)
+// "Headings and labels describe topic or purpose." The criterion does not
+// require a heading or label to exist; it requires that one that IS there
+// says what its section or field is about. Whether real words do that
+// needs a reader. What the DOM can show is the opposite case: a heading or
+// label whose text is a page builder's scaffold string ("Add Your Heading
+// Text Here", "Lorem ipsum", "Heading 1") left in place, which describes
+// nothing by construction. Same two tiers as the page-title rule:
+//   - scaffold strings and lorem ipsum FAIL: no page is about them;
+//   - a single generic word ("Heading", "Title", "Label") is REVIEWED: an
+//     article can genuinely be titled "Untitled" and a design-system page
+//     can be about headings.
+// Empty headings belong to the best-practice empty-heading rule; missing
+// labels belong to 3.3.2 and 4.1.2. This rule reads visible text only and
+// never judges the meaning of ordinary words.
+const SCAFFOLD = new Set([
+  'add your heading text here', 'add a heading', 'add heading', 'your heading here', 'heading here',
+  'your title goes here', 'your title here', 'title goes here', 'title here', 'insert title here',
+  'insert heading here', 'heading text', 'heading goes here', 'section title here',
+  'placeholder', 'placeholder text', 'placeholder heading', 'label text', 'your label here',
+  'text here', 'enter text here', 'your text here', 'type here', 'sample heading', 'sample text',
+  'dummy text', 'dummy heading', 'todo', 'tbd', 'xxx', 'xxxx', 'asdf',
+  'this is a heading', 'this is a title', 'this is the heading', 'this is a label',
+  'new heading', 'new label', 'new section',
+]);
+const GENERIC = new Set([
+  'heading', 'title', 'subtitle', 'headline', 'label', 'untitled', 'header', 'text', 'default',
+  'section', 'section title', 'section heading', 'page title', 'field', 'input',
+]);
+// "Heading 1" … "Heading 6", "h1" … "h6", "Title 2": the numbered defaults
+// editors and builders insert.
+const NUMBERED = /^(?:heading|title|label|h)\s*[1-6]$/;
+
+export default {
+  id: 'heading-label-placeholder',
+  name: 'Placeholder headings and labels',
+  impact: 'moderate',
+  tags: ['wcag2aa', 'wcag246'],
+  help: 'Headings and labels must describe their topic or purpose, not be template text',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/headings-and-labels.html',
+  selector: 'h1, h2, h3, h4, h5, h6, [role="heading"], label, legend',
+  evaluate(element) {
+    const role = element.getAttribute('role');
+    if (/^h[1-6]$/i.test(element.tagName) && role && role !== 'heading') return { status: 'pass' };
+    const text = (element.textContent ?? '').replace(/\s+/g, ' ').trim();
+    if (!text) return { status: 'pass' };
+    const normalized = text.toLowerCase().replace(/[\s.:!…-]+$/, '');
+    const kind = /^h[1-6]$/i.test(element.tagName) || role === 'heading' ? 'heading' : 'label';
+    if (SCAFFOLD.has(normalized) || normalized.startsWith('lorem ipsum') || NUMBERED.test(normalized)) {
+      return {
+        status: 'fail',
+        message: `“${text}” is template text left in a ${kind}. It describes nothing, so a screen-reader user scanning by ${kind}s, or anyone reading the form, learns nothing from it.`,
+        fix: kind === 'heading'
+          ? 'Replace it with words that name what the section is about.'
+          : 'Replace it with words that name what the field asks for.',
+      };
+    }
+    if (GENERIC.has(normalized)) {
+      return {
+        status: 'incomplete',
+        message: `“${text}” is a generic ${kind}. Check whether it describes the topic of its section or the purpose of its field; the same word can also be a real subject or name.`,
+        fix: kind === 'heading'
+          ? 'Name the section\'s actual topic in the heading.'
+          : 'Name what the field asks for in the label.',
+      };
+    }
+    return { status: 'pass' };
+  },
+};

package/engine/rules/wcag/2.5.1-pointer-gesture-alternative.js

@@ -0,0 +1,98 @@
+// WCAG SC 2.5.1 Pointer Gestures (Level A)
+// Functionality operated by a path-based gesture (a swipe, a drag along a
+// track, a drawn shape) or a multipoint gesture (a pinch) must also work
+// with a single pointer and no path, unless the gesture is essential. The
+// gesture logic itself lives in script, which a scan cannot read. But a
+// page that implements its own swipe, pan or pinch has to tell the
+// browser to stand aside first, and it does that in one visible place: the
+// CSS touch-action property. `touch-action: none` hands every touch to
+// the script; `pan-y` keeps vertical scrolling native and hands horizontal
+// swipes (the carousel) to the script; `pan-x` the reverse; a value
+// without `pinch-zoom` hands the pinch (the map) to the script. Those
+// elements are the honest candidates. Whether the swipe or pinch has a
+// single-pointer twin (next and previous buttons, zoom buttons) is not
+// decidable from markup, so this asks and never asserts.
+//
+// Kept out, and why:
+//   - `auto` and `manipulation`: nothing is handed to script beyond the
+//     double-tap zoom delay.
+//   - `pan-x pan-y` (both axes native, only the pinch withheld): measured
+//     on the corpus as a scroll-snap carousel and "no pinch zoom" wrappers,
+//     never a pinch handler; the browser still does all the panning.
+//   - range inputs and role="slider": the Understanding says a slider that
+//     drifts off its track is not path-based, and G216 covers it.
+//   - draggable="true" elements: 2.5.7's question (drag-alternative).
+//   - elements under 100 by 60 px: a gesture surface that small is not one.
+// Only the outermost candidate in a subtree is reported, once; descendants
+// that inherit or repeat the declaration ride with it. Stylesheets a
+// cross-origin policy hides are not a problem here: the computed value on
+// the element is read, whatever sheet set it.
+const HANDLED = new Set(['auto', 'manipulation']);
+
+function handsGestureToScript(value) {
+  if (!value || HANDLED.has(value)) return false;
+  const tokens = value.split(/\s+/);
+  if (tokens.includes('none')) return true;
+  const panX = tokens.some((t) => /^pan-(x|left|right)$/.test(t));
+  const panY = tokens.some((t) => /^pan-(y|up|down)$/.test(t));
+  // One axis withheld is a swipe handler (pan-y is the carousel; pan-x the
+  // vertical one); both axes native is the browser scrolling as usual.
+  return !panX || !panY;
+}
+
+export default {
+  id: 'pointer-gesture-alternative',
+  name: 'Pointer gesture alternative',
+  impact: 'serious',
+  tags: ['wcag21a', 'wcag251'],
+  help: 'Swipe, pan and pinch gestures need a single-pointer alternative',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/pointer-gestures.html',
+  selector: '*',
+  visibleOnly: false,
+  evaluateAll(elements, { isRendered }) {
+    const candidates = new Set();
+    for (const element of elements) {
+      const tag = element.tagName;
+      if (tag === 'HTML' || tag === 'BODY' || tag === 'SCRIPT' || tag === 'STYLE' || tag === 'LINK' || tag === 'META' || tag === 'TEMPLATE') continue;
+      // Cheap gates first: the style read is paid only by rendered boxes
+      // that could be a gesture surface at all.
+      if (element.getAttribute('draggable') === 'true' || element.getAttribute('role') === 'slider' || (tag === 'INPUT' && element.type === 'range')) continue;
+      const rect = element.getBoundingClientRect();
+      if (rect.width < 100 || rect.height < 60) continue;
+      if (!isRendered(element)) continue;
+      const value = getComputedStyle(element).touchAction;
+      if (!handsGestureToScript(value)) continue;
+      candidates.add(element);
+    }
+    // Outermost only, and one per row of siblings: a carousel's track,
+    // slides and images all inherit the same declaration (and a cloned
+    // slide strip repeats it eleven times, measured on a corpus home), and
+    // one question per gesture surface is enough.
+    const outermost = new Set();
+    const reportedParents = new Set();
+    for (const element of candidates) {
+      let nested = false;
+      for (let parent = element.parentElement; parent; parent = parent.parentElement) {
+        if (candidates.has(parent)) { nested = true; break; }
+      }
+      if (nested || reportedParents.has(element.parentElement)) continue;
+      reportedParents.add(element.parentElement);
+      outermost.add(element);
+    }
+    return elements.map((element) => {
+      if (!outermost.has(element)) return { status: 'pass' };
+      const value = getComputedStyle(element).touchAction;
+      const tokens = value.split(/\s+/);
+      const handled = tokens.includes('none') ? 'every touch gesture'
+        : [
+          !tokens.some((t) => /^pan-(x|left|right)$/.test(t)) && 'horizontal swipes',
+          !tokens.some((t) => /^pan-(y|up|down)$/.test(t)) && 'vertical swipes',
+        ].filter(Boolean).join(' and ');
+      return {
+        status: 'incomplete',
+        message: `touch-action: ${value} tells the browser to hand ${handled} on this element to the page's own script, which is how custom swipe, pan and pinch interactions are built. 2.5.1 requires whatever those gestures do to also work with a single tap or click (previous and next buttons, zoom in and out, a choose-a-value control), unless the gesture is essential. Check a single-pointer way exists for everything the gesture does.`,
+        fix: 'Add plain buttons for the same actions (previous/next, zoom in/out), or make the element operable by simple clicks as well as gestures.',
+      };
+    });
+  },
+};

package/engine/rules/wcag/3.3.4-financial-form-confirmation.js

@@ -0,0 +1,32 @@
+// WCAG SC 3.3.4 Error Prevention (Legal, Financial, Data) (Level AA)
+// For a page that causes a financial transaction, a legal commitment or a
+// change to stored user data, a submission must be reversible, checked
+// with a chance to correct, or reviewable and confirmable before it is
+// final. Which of those a form offers is process, invisible to a scan; but
+// one class of page names itself: a form that collects card details
+// (autocomplete cc-number, cc-csc, cc-exp and the rest, or a
+// transaction-amount) is a payment form, and a payment is the financial
+// transaction the criterion describes. That form is asked about, once,
+// never failed: a review step may sit on the next page, and a purchase
+// may be refundable within a stated period (G164).
+//
+// Deletion of user data and legal commitments have no markup signature
+// and stay with the reviewer.
+export default {
+  id: 'financial-form-confirmation',
+  name: 'Payment form safeguards',
+  impact: 'serious',
+  tags: ['wcag2aa', 'wcag334'],
+  help: 'A form that takes a payment must be reversible, checked or confirmed before submission',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/error-prevention-legal-financial-data.html',
+  selector: 'form',
+  visibleOnly: false,
+  evaluate(element) {
+    if (!element.querySelector('input[autocomplete*="cc-" i], input[autocomplete~="transaction-amount" i]')) return { status: 'pass' };
+    return {
+      status: 'incomplete',
+      message: 'This form collects card details, so submitting it makes a financial transaction. 3.3.4 requires at least one of: the submission can be reversed, the entries are checked for errors with a chance to correct them, or a review-and-confirm step comes before the final submit. Check which applies to this checkout.',
+      fix: 'Add a review page before the final submit, validate the entries and let the user correct them, or state a period in which the order can be amended or cancelled.',
+    };
+  },
+};

package/engine/rules/wcag/3.3.8-auth-field-obstruction.js

@@ -32,7 +32,10 @@ export default {
   id: 'auth-field-obstruction',
   name: 'Accessible login fields',
   impact: 'serious',
-  tags: ['wcag22aa', 'wcag338'],
+  // 3.3.9 (AAA) drops 3.3.8's object-recognition and personal-content
+  // exceptions and keeps everything this rule looks at: F109 is listed as a
+  // failure of both. Twin-tagged on the 2.1.1/2.1.3 precedent.
+  tags: ['wcag22aa', 'wcag338', 'wcag339'],
   help: 'Login fields must not block paste or password managers',
   helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-minimum.html',
   selector: 'input[type="password"]:not([autocomplete~="new-password"]), input[autocomplete~="current-password"], input[autocomplete~="one-time-code"]',

package/engine/rules/wcag/3.3.9-captcha-alternative.js

@@ -0,0 +1,35 @@
+// WCAG SC 3.3.9 Accessible Authentication (Enhanced) (Level AAA)
+// 3.3.8 lets an authentication step use object recognition ("select every
+// bus") and personal content; 3.3.9 removes both exceptions, so a picture
+// puzzle in a login step needs an alternative method or a mechanism that
+// helps the user through it. The one CAPTCHA fact the DOM shows is the
+// widget itself: the reCAPTCHA, hCaptcha and Turnstile embeds and their
+// site-key hosts. Whether that widget will ever show a picture puzzle
+// (risk-based and invisible modes often do not) and whether another way in
+// exists are not visible, so this asks and never asserts.
+//
+// Scope: the criterion covers steps of an AUTHENTICATION process. A
+// CAPTCHA on a contact form or a comment box is outside it, so only a
+// widget inside a form that also takes a credential (a password or a
+// one-time code) is asked about.
+const CREDENTIAL = 'input[type="password"], input[autocomplete~="current-password"], input[autocomplete~="one-time-code"]';
+
+export default {
+  id: 'captcha-alternative',
+  name: 'CAPTCHA in a login step',
+  impact: 'serious',
+  tags: ['wcag22aaa', 'wcag339'],
+  help: 'A picture-puzzle CAPTCHA in an authentication step needs an alternative (AAA)',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-enhanced.html',
+  selector: 'iframe[src*="recaptcha" i], iframe[src*="hcaptcha" i], iframe[src*="turnstile" i], .g-recaptcha, .h-captcha, .cf-turnstile, [data-sitekey]',
+  visibleOnly: false,
+  evaluate(element) {
+    const form = element.closest('form');
+    if (!form || !form.querySelector(CREDENTIAL)) return { status: 'pass' };
+    return {
+      status: 'incomplete',
+      message: 'This login form carries a CAPTCHA widget. If the challenge can escalate to a picture puzzle, that is object recognition, which 3.3.8 allows but 3.3.9 (AAA) does not: a cognitive function test in an authentication step then needs another way in (a passkey, an emailed link, a federated sign-in) or a mechanism that helps the user through it. Check what the widget can show and what the alternatives are.',
+      fix: 'Use a risk-based or invisible challenge that never shows a puzzle, or offer another authentication method beside it.',
+    };
+  },
+};

package/engine/wcag22.js

@@ -27,9 +27,9 @@ export default [
   sc('1.1.1', 'Non-text Content', 'A', 'partial'),
   sc('1.2.1', 'Audio-only and Video-only (Prerecorded)', 'A', 'partial'), // partial: the audio-only transcript question is askable; silent-video detection is not
   sc('1.2.2', 'Captions (Prerecorded)', 'A', 'partial'),
-  sc('1.2.3', 'Audio Description or Media Alternative (Prerecorded)', 'A', 'manual'),
+  sc('1.2.3', 'Audio Description or Media Alternative (Prerecorded)', 'A', 'partial'), // partial: video-audio-description asks per sound-capable video without a descriptions track; whether description or a text alternative exists, or is needed at all, is the reviewer's
   sc('1.2.4', 'Captions (Live)', 'AA', 'manual'),
-  sc('1.2.5', 'Audio Description (Prerecorded)', 'AA', 'manual'),
+  sc('1.2.5', 'Audio Description (Prerecorded)', 'AA', 'partial'), // partial: same question as 1.2.3 (video-audio-description); H96 descriptions track is the one DOM-visible pass
   sc('1.2.6', 'Sign Language (Prerecorded)', 'AAA', 'manual'),
   sc('1.2.7', 'Extended Audio Description (Prerecorded)', 'AAA', 'manual'),
   sc('1.2.8', 'Media Alternative (Prerecorded)', 'AAA', 'manual'),
@@ -39,7 +39,7 @@ export default [
   sc('1.3.3', 'Sensory Characteristics', 'A', 'manual'),
   sc('1.3.4', 'Orientation', 'AA', 'partial', '2.1'), // orientation-lock asserts CSS root hides/rotations as ACT b33eff does, essential exception assumed absent; script locks stay a human check
   sc('1.3.5', 'Identify Input Purpose', 'AA', 'partial', '2.1'), // partial: wrong tokens are asserted as ACT 73f2c2 does (search boxes asked); MISSING autocomplete on identity fields needs judgment
-  sc('1.3.6', 'Identify Purpose', 'AAA', 'manual', '2.1'),
+  sc('1.3.6', 'Identify Purpose', 'AAA', 'partial', '2.1'), // partial: region-purpose asks once per page with no landmark at all (ARIA11 is the regions technique); component and icon purpose stays human
   sc('1.4.1', 'Use of Color', 'A', 'partial'), // link-in-text-block automates the link case
   sc('1.4.2', 'Audio Control', 'A', 'partial'), // declarative autoplay identifies candidates; audibility and alternative controls need review
   sc('1.4.3', 'Contrast (Minimum)', 'AA', 'partial'),
@@ -47,7 +47,7 @@ export default [
   sc('1.4.5', 'Images of Text', 'AA', 'manual'),
   sc('1.4.6', 'Contrast (Enhanced)', 'AAA', 'partial'),
   sc('1.4.7', 'Low or No Background Audio', 'AAA', 'manual'),
-  sc('1.4.8', 'Visual Presentation', 'AAA', 'manual'),
+  sc('1.4.8', 'Visual Presentation', 'AAA', 'partial'), // partial: text-justified asks about justified running text (F88); the other four requirements are met by browser mechanisms and not judged
   sc('1.4.9', 'Images of Text (No Exception)', 'AAA', 'manual'),
   sc('1.4.10', 'Reflow', 'AA', 'partial', '2.1'), // partial: reflow (current-viewport overflow heuristic); full test is at 320px
   sc('1.4.11', 'Non-text Contrast', 'AA', 'partial', '2.1'), // partial: non-text-contrast covers field boundaries; icons/focus indicators need eyes
@@ -61,7 +61,7 @@ export default [
   sc('2.2.1', 'Timing Adjustable', 'A', 'partial'), // meta-refresh automates the redirect/refresh case
   sc('2.2.2', 'Pause, Stop, Hide', 'A', 'partial'),
   sc('2.2.3', 'No Timing', 'AAA', 'manual'),
-  sc('2.2.4', 'Interruptions', 'AAA', 'manual'),
+  sc('2.2.4', 'Interruptions', 'AAA', 'partial'), // partial: meta-refresh-no-exceptions asserts any timed refresh or redirect (F40, F41); scripted interruptions are invisible
   sc('2.2.5', 'Re-authenticating', 'AAA', 'manual'),
   sc('2.2.6', 'Timeouts', 'AAA', 'manual', '2.1'),
   sc('2.3.1', 'Three Flashes or Below Threshold', 'A', 'manual'),
@@ -72,15 +72,15 @@ export default [
   sc('2.4.3', 'Focus Order', 'A', 'partial'), // visual-order-divergence flags CSS order/*-reverse against DOM order; whether an order preserves MEANING stays human
   sc('2.4.4', 'Link Purpose (In Context)', 'A', 'partial'),
   sc('2.4.5', 'Multiple Ways', 'AA', 'manual'),
-  sc('2.4.6', 'Headings and Labels', 'AA', 'manual'),
+  sc('2.4.6', 'Headings and Labels', 'AA', 'partial'), // partial: heading-label-placeholder asserts template text left in a heading or label and asks about single generic words; whether real words describe the topic needs a reader
   sc('2.4.7', 'Focus Visible', 'AA', 'partial'), // partial: focus-visible flags outline suppression; the indicator itself needs eyes
   sc('2.4.8', 'Location', 'AAA', 'manual'),
   sc('2.4.9', 'Link Purpose (Link Only)', 'AAA', 'partial'), // generic wording nominates candidates; whether wording explains the destination needs a reader
-  sc('2.4.10', 'Section Headings', 'AAA', 'manual'),
+  sc('2.4.10', 'Section Headings', 'AAA', 'partial'), // partial: section-heading asks about a declared <section> of running text with no heading of its own; where sections begin in undeclared writing stays human
   sc('2.4.11', 'Focus Not Obscured (Minimum)', 'AA', 'partial', '2.2'), // covered resting targets are candidates; actual focus/scroll behavior needs review
-  sc('2.4.12', 'Focus Not Obscured (Enhanced)', 'AAA', 'manual', '2.2'),
+  sc('2.4.12', 'Focus Not Obscured (Enhanced)', 'AAA', 'partial', '2.2'), // partial: focus-not-obscured-enhanced reviews any overlap by an opaque fixed panel, 2.4.11's geometry without the containment requirement
   sc('2.4.13', 'Focus Appearance', 'AAA', 'manual', '2.2'),
-  sc('2.5.1', 'Pointer Gestures', 'A', 'manual', '2.1'),
+  sc('2.5.1', 'Pointer Gestures', 'A', 'partial', '2.1'), // partial: pointer-gesture-alternative asks about surfaces whose touch-action hands swipes or every touch to script (carousels, maps, canvases); pointer-event gesture logic with no declaration is invisible
   sc('2.5.2', 'Pointer Cancellation', 'A', 'manual', '2.1'),
   sc('2.5.3', 'Label in Name', 'A', 'manual', '2.1'), // manual WHILE label-in-name is parked (re-parked 2026-08-01, see rules/index.js) — 'auto' with no active rule would make this SC vanish from results AND the manual checklist
   sc('2.5.4', 'Motion Actuation', 'A', 'manual', '2.1'),
@@ -99,17 +99,17 @@ export default [
   sc('3.2.2', 'On Input', 'A', 'partial'), // on-input-navigation flags the inline jump-menu signature; "advised beforehand" stays a human call
   sc('3.2.3', 'Consistent Navigation', 'AA', 'manual'),
   sc('3.2.4', 'Consistent Identification', 'AA', 'manual'),
-  sc('3.2.5', 'Change on Request', 'AAA', 'manual'),
+  sc('3.2.5', 'Change on Request', 'AAA', 'partial'), // partial: meta-refresh-no-exceptions (F40, F41); scripted context changes and pop-ups on load are invisible
   sc('3.2.6', 'Consistent Help', 'A', 'manual', '2.2'),
   sc('3.3.1', 'Error Identification', 'A', 'partial'), // error-message-linkage proves broken aria-errormessage targets; only in force when the page is captured mid-error
   sc('3.3.2', 'Labels or Instructions', 'A', 'partial'),
   sc('3.3.3', 'Error Suggestion', 'AA', 'manual'),
-  sc('3.3.4', 'Error Prevention (Legal, Financial, Data)', 'AA', 'manual'),
+  sc('3.3.4', 'Error Prevention (Legal, Financial, Data)', 'AA', 'partial'), // partial: financial-form-confirmation asks once per form that takes card details; legal commitments and data deletion have no markup signature
   sc('3.3.5', 'Help', 'AAA', 'manual'),
   sc('3.3.6', 'Error Prevention (All)', 'AAA', 'manual'),
   sc('3.3.7', 'Redundant Entry', 'A', 'partial', '2.2'), // partial: duplicate autocomplete purposes in one form are visible; cross-page processes are not
   sc('3.3.8', 'Accessible Authentication (Minimum)', 'AA', 'partial', '2.2'), // partial: auth-field-obstruction catches paste blocking; alternatives need judgment
-  sc('3.3.9', 'Accessible Authentication (Enhanced)', 'AAA', 'manual', '2.2'),
+  sc('3.3.9', 'Accessible Authentication (Enhanced)', 'AAA', 'partial', '2.2'), // partial: auth-field-obstruction's F109 findings apply unchanged (twin tag) and captcha-alternative asks about a CAPTCHA beside a credential, the object-recognition exception 3.3.9 removes
   // 4. Robust (4.1.1 Parsing was removed in WCAG 2.2)
   sc('4.1.2', 'Name, Role, Value', 'A', 'partial'),
   sc('4.1.3', 'Status Messages', 'AA', 'manual', '2.1'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pour-engine",
-  "version": "1.41.0",
+  "version": "1.42.0",
   "description": "Accessibility (WCAG 2.2) audit engine written from the W3C specifications — runs entirely in the browser, no dependencies.",
   "type": "module",
   "main": "engine/index.js",