testaro 78.0.8 → 78.4.0

package/validation/act/stage3b-mapping-proposals.md

@@ -0,0 +1,94 @@
+# Stage-3b mapping proposals — pour
+
+Capture: `validation/act/results/stage3a-2026-08-22.jsonl` · taxonomy: `tic50.js` · thresholds: rate ≥ 0.25, ≥ 5 elements on ≥ 3 pages. Exact-path co-occurrence is a floor; proposals require human accept/reject/split review.
+
+| Candidate rule | Elements | Pages | Proposed issue | Co-rate | Lift | Runners-up | Suggestion | Verdict |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| color-contrast-enhanced | 12965 | 222 | contrastAAA | 43% (5611) | 4.5 | contrastAA (5058, lift 4.1); contrastRisk (1746, lift 3.0) | map | |
+| target-size-enhanced | 8992 | 248 | — | 2% (171) | 5.1 | linkTextsSame (667, lift 3.4); newTabSurprise (565, lift 3.5) | new-issue candidate | |
+| color-contrast | 8775 | 213 | contrastAA | 49% (4287) | 5.1 | contrastRisk (1639, lift 4.2); linkVaguenessRisk (27, lift 8.0) | map | |
+| region | 8013 | 150 | — | 0% (28) | 9.0 | contentBeyondLandmarks (722, lift 3.1); imageNoText (141, lift 3.5) | new-issue candidate | |
+| new-window-link | 1697 | 196 | newTabSurprise | 63% (1064) | 34.4 | nonWebLink (18, lift 20.4); linkIndication (31, lift 16.2) | map | |
+| svg-img-alt | 818 | 87 | — | 24% (194) | 8.4 | svgImageNoText (1, lift 11.1); eventKeyboardRisk (2, lift 6.2) | new-issue candidate | |
+| target-size | 678 | 58 | — | 1% (8) | 26.7 | ignorable (551, lift 1.2); linkConfusionRisk (8, lift 3.2) | new-issue candidate | |
+| text-spacing | 580 | 61 | — | 2% (10) | 22.3 | dialogNoText (1, lift 31.2); inputNoText (1, lift 22.3) | new-issue candidate | |
+| link-name | 536 | 88 | imageLinkNoText | 60% (319) | 115.4 | linkNoText (509, lift 91.1); newTabSurprise (127, lift 13.0) | map | |
+| redundant-aria-label | 510 | 63 | — | 2% (9) | 53.3 | linkTextsSame (47, lift 4.3); ariaAttributeBad (16, lift 5.8) | new-issue candidate | |
+| image-alt | 484 | 69 | imageNoText | 67% (322) | 133.9 | imageTextBad (31, lift 175.8); linkPair (7, lift 13.2) | map | |
+| landmark-unique | 480 | 75 | bannerNotTop | 27% (131) | 177.9 | mainNotTop (111, lift 179.0); landmarkConfusion (91, lift 177.0) | map | |
+| redundant-tabindex | 479 | 60 | — | 3% (16) | 10.9 | ariaAttributeBad (23, lift 8.9); visibleLabelNotInName (19, lift 4.7) | new-issue candidate | |
+| redundant-aria | 337 | 61 | — | 15% (52) | 57.8 | activeEmbedding (8, lift 76.8); focusableDescendants (8, lift 21.7) | new-issue candidate | |
+| landmark-top-level | 302 | 37 | bannerNotTop | 45% (135) | 291.3 | mainNotTop (112, lift 287.1); footerNotTop (6, lift 257.1) | map | |
+| link-text-generic | 279 | 77 | — | 12% (33) | 306.1 | linkTextsSame (172, lift 28.5); linkConfusionRisk (36, lift 34.9) | new-issue candidate | |
+| link-text-generic-only | 279 | 77 | — | 12% (33) | 306.1 | linkTextsSame (172, lift 28.5); linkConfusionRisk (36, lift 34.9) | new-issue candidate | |
+| aria-hidden-focus | 231 | 27 | focusableHidden | 88% (204) | 377.4 | ignorable (120, lift 0.8); boxSizeAbsolute (5, lift 0.8) | map | |
+| non-text-contrast | 190 | 90 | — | 3% (6) | 476.8 | labelConfusionRisk (86, lift 121.7); controlLabelInvisible (2, lift 476.8) | new-issue candidate | |
+| nested-interactive | 183 | 29 | — | 14% (25) | 442.0 | focusableDescendants (20, lift 100.0); ariaAttributeBad (17, lift 17.1) | new-issue candidate | |
+| aria-allowed-attr | 170 | 30 | ariaAttributeBad | 48% (81) | 87.9 | duplicateID (1, lift 5.5); landmarkConfusion (1, lift 5.5) | map | |
+| focus-visible | 167 | 167 | — | 21% (35) | 287.7 | mainNone (48, lift 252.8); skipRepeatedContent (6, lift 191.4) | new-issue candidate | |
+| aria-valid-refs | 167 | 36 | — | 22% (36) | 39.8 | activeEmbedding (4, lift 77.5); dialogNoText (1, lift 108.5) | new-issue candidate | |
+| heading-order | 153 | 87 | headingLevelSkip | 95% (146) | 313.2 | headingEmpty (2, lift 16.9); headingLength (1, lift 20.4) | map | |
+| redundant-role | 135 | 72 | — | 5% (7) | 48.4 | asideNotTop (3, lift 15.0); labelConfusionRisk (4, lift 8.0) | new-issue candidate | |
+| landmark-one-main | 133 | 133 | mainNone | 77% (102) | 674.5 | pageLanguage (29, lift 564.3); h1Not1 (44, lift 454.1) | map | |
+| redundant-image-alt | 120 | 19 | imageTextRedundant | 69% (83) | 482.0 | ignorable (74, lift 0.9) | map | |
+| button-name | 111 | 32 | buttonNoText | 97% (108) | 318.2 | linkNoText (13, lift 11.2); ignorable (90, lift 1.2) | map | |
+| focus-not-obscured | 108 | 8 | — | 16% (17) | 51.5 | newTabSurprise (16, lift 8.1); linkConfusionRisk (2, lift 5.0) | new-issue candidate | |
+| control-contrast | 103 | 52 | labelConfusionRisk | 57% (59) | 154.0 | labelNot1 (4, lift 390.9); selectNoText (2, lift 293.2) | map | |
+| form-label | 88 | 55 | — | 2% (2) | 1029.4 | selectNoText (4, lift 686.3); labelConfusionRisk (66, lift 201.6) | new-issue candidate | |
+| redundant-alt-phrase | 87 | 27 | — | 1% (1) | 69.4 | ignorable (85, lift 1.4); contentBeyondLandmarks (7, lift 2.8) | new-issue candidate | |
+| listitem-parent | 86 | 7 | listItemOrphan | 45% (39) | 708.3 | ignorable (2, lift 0.0) | map | |
+| page-heading-one | 80 | 80 | h1Not1 | 71% (57) | 977.9 | pageTitle (5, lift 1132.3); skipRepeatedContent (10, lift 666.1) | map | |
+| pause-stop-hide | 79 | 21 | — | 1% (1) | 11.8 | footerNot1 (1, lift 11.4); contrastAA (16, lift 2.1) | new-issue candidate | |
+| aria-label-misuse | 77 | 16 | attributeBad | 95% (73) | 825.8 | ariaAttributeBad (69, lift 165.3); contentBeyondLandmarks (5, lift 2.3) | map | |
+| link-in-text-block | 61 | 25 | linkIndication | 57% (35) | 509.6 | linkVaguenessRisk (2, lift 84.9); linkFileName (1, lift 40.1) | map | |
+| empty-heading | 47 | 24 | headingEmpty | 100% (47) | 1294.1 | headingLevelSkip (3, lift 20.9); ignorable (36, lift 1.1) | map | |
+| area-alt | 47 | 1 | — | 100% (47) | 1927.4 | linkNoText (47, lift 96.0); ignorable (47, lift 1.5) | low support | |
+| meta-viewport | 38 | 37 | metaBansZoom | 95% (36) | 1751.4 | — | map | |
+| aria-field-name | 38 | 7 | — | 82% (31) | 2383.9 | inputNoText (6, lift 2043.3); controlNoText (6, lift 185.8) | new-issue candidate | |
+| media-captions | 38 | 4 | — | 21% (8) | 346.7 | videoNoTranscript (3, lift 255.4); videoNoAudioTrack (3, lift 255.4) | new-issue candidate | |
+| scrollable-region-focusable | 32 | 12 | keyboardScroll | 28% (9) | 849.3 | contentBeyondLandmarks (1, lift 1.1) | map | |
+| html-lang | 31 | 31 | pageLanguage | 100% (31) | 2588.2 | pageTitle (5, lift 2922.2); mainNone (26, lift 737.6) | map | |
+| frame-title | 26 | 18 | iframeTitleBad | 73% (19) | 1085.2 | boxSizeAbsolute (4, lift 5.5); ignorable (19, lift 1.1) | map | |
+| meta-refresh | 24 | 24 | refresh | 96% (23) | 3617.2 | — | map | |
+| p-as-heading | 24 | 14 | — | 17% (4) | 112.7 | — | new-issue candidate | |
+| definition-list | 24 | 1 | — | 100% (24) | 1.5 | — | low support | |
+| video-loop-motion | 23 | 23 | videoNoAudioDescription | 83% (19) | 2078.7 | audioNoText (19, lift 1626.8); videoNoTranscript (13, lift 1828.6) | map | |
+| list-structure | 20 | 12 | listChild | 95% (19) | 4098.0 | descendantMissing (13, lift 550.3); ignorable (19, lift 1.4) | map | |
+| button-type | 17 | 10 | — | 12% (2) | 38.5 | visibleLabelNotInName (3, lift 21.1); ariaAttributeBad (1, lift 10.9) | new-issue candidate | |
+| positive-tabindex | 14 | 7 | tabIndexPositive | 100% (14) | 6470.5 | skipRepeatedContent (1, lift 380.6); labelConfusionRisk (4, lift 76.8) | map | |
+| reflow | 12 | 12 | h1Not1 | 42% (5) | 571.9 | mainNone (3, lift 219.9); iframeTitleBad (1, lift 123.8) | map | |
+| aria-attr-valid | 9 | 4 | ariaAttributeBad | 100% (9) | 184.5 | ignorable (4, lift 0.7) | map | |
+| canvas-alt | 8 | 5 | — | 50% (4) | 17.8 | ignorable (3, lift 0.6) | new-issue candidate | |
+| no-autofocus | 8 | 7 | — | 25% (2) | 134.0 | labelConfusionRisk (3, lift 100.8); ignorable (8, lift 1.5) | new-issue candidate | |
+| bypass-blocks | 6 | 6 | skipRepeatedContent | 100% (6) | 5328.6 | h1Not1 (3, lift 686.3); pageLanguage (2, lift 862.7) | map | |
+| document-title | 6 | 6 | pageTitle | 83% (5) | 15097.8 | pageLanguage (5, lift 2156.8); h1Not1 (6, lift 1372.5) | map | |
+| aria-required-children | 5 | 4 | — | 20% (1) | 2588.2 | descendantMissing (5, lift 846.6); controlNoText (1, lift 235.3) | new-issue candidate | |
+| multiple-labels | 5 | 4 | labelNot1 | 100% (5) | 10065.2 | duplicateID (4, lift 747.1); ariaMissing (1, lift 862.7) | map | |
+| autocomplete-valid | 5 | 3 | autocompleteBad | 100% (5) | 15097.8 | ignorable (5, lift 1.5); contrastAA (1, lift 2.1) | map | |
+| dialog-name | 4 | 4 | — | 100% (4) | 18117.4 | ariaAttributeBad (1, lift 46.1) | low support | |
+| fieldset-legend | 4 | 4 | — | 25% (1) | 2516.3 | controlNoText (1, lift 294.1); duplicateID (1, lift 233.5) | low support | |
+| aria-required-parent | 4 | 1 | — | 0% (0) | 0.0 | — | low support | |
+| label-for-valid | 3 | 3 | — | 33% (1) | 11.6 | contrastAA (2, lift 7.0); contrastAAA (2, lift 6.9) | low support | |
+| table-headers | 3 | 3 | — | 100% (3) | 2264.7 | tableHeaderless (2, lift 1830.0); tabularTableless (2, lift 1776.2) | low support | |
+| visual-order-divergence | 3 | 3 | — | 33% (1) | 3.4 | ignorable (1, lift 0.5) | low support | |
+| auth-field-obstruction | 3 | 1 | — | 100% (3) | 1.5 | — | low support | |
+| composite-widget-name | 2 | 2 | — | 50% (1) | 6470.5 | ariaAttributeBad (2, lift 184.5) | low support | |
+| valid-role | 1 | 1 | — | 100% (1) | 536.0 | focusableRole (1, lift 374.3); ignorable (1, lift 1.5) | low support | |
+
+Summary: 70 fired rules — 33 mapping proposals, 26 new-issue candidates, 11 low-support.
+
+Incumbent instances with no tic mapping (top 10 — taxonomy coverage gaps):
+- qualWeb:QW-BP30: 807
+- ed11y:altURLLinked: 107
+- axe:meta-refresh: 24
+- ed11y:altMeaningless: 21
+- ed11y:altMeaninglessLinked: 12
+- axe:aria-tab-name: 1
+
+## Reading notes for the triage pass
+
+- **High-confidence accepts** (semantic match + dominant co-rate + high lift): empty-heading→headingEmpty, button-name→buttonNoText, heading-order→headingLevelSkip, landmark-one-main→mainNone, page-heading-one→h1Not1, image-alt→imageNoText, aria-hidden-focus→focusableHidden, new-window-link→newTabSurprise, document-title→pageTitle, bypass-blocks→skipRepeatedContent, autocomplete-valid→autocompleteBad, multiple-labels→labelNot1, aria-label-misuse→attributeBad, link-in-text-block→linkIndication, listitem-parent→listItemOrphan, redundant-image-alt→imageTextRedundant, color-contrast→contrastAA, color-contrast-enhanced→contrastAAA.
+- **Split candidates**: link-name (linkNoText vs imageLinkNoText both co-fire strongly — tic distinguishes text links from image links; pour's one rule covers both); landmark-unique / landmark-top-level (bannerNotTop / mainNotTop / footerNotTop family).
+- **Likely genuine pour novelty** (new-issue candidates with no plausible runner-up): text-spacing (1.4.12 — no incumbent equivalent fired anywhere), target-size / target-size-enhanced (2.5.8/2.5.5 — tic appears to lack target-size issues), non-text-contrast (1.4.11), focus-visible, focus-not-obscured (2.4.11), and the redundant-* best-practice family (pour's "overdoing it" rules).
+- **Known ranking quirk**: extreme-lift/tiny-support pairs can outscore the right answer when a rule's true match has moderate lift (see form-label, where labelConfusionRisk — 66 elements, lift 202 — is the plausible mapping but a 2-element pair scored higher and then failed thresholds). The runners-up column carries the correction; this is why proposals are review inputs, not auto-accepts.
+- **Byproduct — taxonomy coverage gaps** (incumbent rules with no tic home; upstream-filing material): qualWeb QW-BP30 (807 instances), ed11y altURLLinked/altMeaningless/altMeaninglessLinked, axe meta-refresh, axe aria-tab-name.

package/validation/act/stage3b-triage-draft.md

@@ -0,0 +1,138 @@
+# Stage-3b triage draft — pour (for human review)
+
+Drafted 2026-09-01 by Claude from `stage3b-mapping-proposals.md` + the reading notes. Every
+verdict below is a **draft for Jeff's accept/override** — semantic judgment calls are marked
+⚠️ where the co-occurrence evidence and the rule semantics disagree (the known ranking quirk).
+Review workflow: scan the ⚠️ rows first (9 of them), then rubber-stamp or override the rest.
+Accepted verdicts become tic entries (initial `quality: 1`) in the next tic version.
+
+## A. Mapping proposals — draft ACCEPT as proposed (24)
+
+The 18 high-confidence accepts from the reading notes, plus 6 where semantics and evidence
+agree cleanly:
+
+| Pour rule | tic issue | Note |
+| --- | --- | --- |
+| empty-heading | headingEmpty | 100% co-rate |
+| button-name | buttonNoText | 97% |
+| heading-order | headingLevelSkip | 95% |
+| landmark-one-main | mainNone | 77% |
+| page-heading-one | h1Not1 | 71% |
+| image-alt | imageNoText | 67% |
+| aria-hidden-focus | focusableHidden | 88% |
+| new-window-link | newTabSurprise | 63% |
+| document-title | pageTitle | 83% |
+| bypass-blocks | skipRepeatedContent | 100% |
+| autocomplete-valid | autocompleteBad | 100% |
+| multiple-labels | labelNot1 | 100% |
+| aria-label-misuse | attributeBad | 95% |
+| link-in-text-block | linkIndication | 57% |
+| listitem-parent | listItemOrphan | 45%, no plausible rival |
+| redundant-image-alt | imageTextRedundant | 69% |
+| color-contrast | contrastAA | 49% — plus contrastRisk co-fire is expected (bands) |
+| color-contrast-enhanced | contrastAAA | 43% |
+| aria-allowed-attr | ariaAttributeBad | 48%, semantic exact |
+| meta-viewport | metaBansZoom | 95%, semantic exact |
+| scrollable-region-focusable | keyboardScroll | 28% co-rate but semantic exact — incumbents fire rarely |
+| html-lang | pageLanguage | 100% |
+| frame-title | iframeTitleBad | 73% |
+| meta-refresh | refresh | 96% — also fills the axe:meta-refresh coverage gap |
+| list-structure | listChild | 95% |
+| aria-attr-valid | ariaAttributeBad | 100% (9 el) |
+| positive-tabindex | tabIndexPositive | 100% |
+
+(27 rows — three of the "33 proposals" move to §B/§C below instead.)
+
+## B. Mapping proposals — draft SPLIT (3)
+
+| Pour rule | Draft | Rationale |
+| --- | --- | --- |
+| link-name | **split → imageLinkNoText / linkNoText** by flagged-element content (contains img/svg → imageLinkNoText, else linkNoText) | Both co-fire strongly (60% / 509-element runner-up); tic distinguishes text links from image links, pour's one rule covers both. Split at mapping time on the instance's element, not the rule. |
+| landmark-top-level | **split → bannerNotTop / mainNotTop / footerNotTop / asideNotTop** by landmark role | The tic *NotTop family is per-landmark; pour's one rule covers all. Runner-up evidence shows exactly this family. |
+| landmark-unique | ⚠️ **remap → landmarkConfusion** | Proposed bannerNotTop (27%) is a co-occurrence artifact — landmark-unique is about *duplicate/undifferentiated* landmarks, which is landmarkConfusion's semantics (91-element runner-up, lift 177). |
+
+## C. Mapping proposals — draft REJECT the proposed issue, re-disposition (3) — all ⚠️
+
+| Pour rule | Proposed (rejected) | Draft disposition | Rationale |
+| --- | --- | --- | --- |
+| video-loop-motion | videoNoAudioDescription (83%) | **new issue** `motionNoControl` (2.2.2), shared with pause-stop-hide | Rule is about looping/auto-playing motion, not audio description — co-occurrence artifact (pages with video have both defects). |
+| reflow | h1Not1 (42%) | **new issue** `reflowBroken` (1.4.10) | Semantic nonsense as a mapping; 1.4.10 has no incumbent coverage — this is novelty, mis-filed by base-rate. |
+| control-contrast | labelConfusionRisk (57%) | **fold into** the `nonTextContrast` new issue (1.4.11) with non-text-contrast | 1.4.11 control contrast ≠ label confusion; co-occurrence artifact. |
+
+## D. New-issue candidates — draft REMAP to an existing tic issue instead (8) — all ⚠️ except where noted
+
+The ranking quirk in reverse: the right mapping existed but lost on lift/threshold.
+
+| Pour rule | Draft map | Rationale |
+| --- | --- | --- |
+| region | contentBeyondLandmarks | Semantic exact; 722-element runner-up (lift 3.1) lost on co-rate only because region fires far more broadly than the incumbent. |
+| svg-img-alt | svgImageNoText | Semantic exact; incumbent fires so rarely (1 element) the co-rate is meaningless. |
+| nested-interactive | focusableDescendants | Semantic exact (interactive inside interactive), lift 100. |
+| aria-required-children | descendantMissing | Semantic exact (role's required owned children absent), lift 847. |
+| aria-field-name | inputNoText | 82% co-rate, lift 2043 — likely fell out of "proposed" on a threshold technicality. Not ⚠️: evidence and semantics agree. |
+| link-text-generic (+ -only) | linkVaguenessRisk | "Click here"-class generic text is exactly linkVaguenessRisk; runner-up linkTextsSame is a different defect (identical texts, different targets). Map both variants to the same issue; instance dedup absorbs the -only subset. This is pour's ACT sole-detector rule (aizyf1) — do not lose it. |
+| form-label | labelConfusionRisk | Per the reading notes: the 66-element, lift-202 runner-up is the plausible mapping; the 2-element top pair was the quirk example. |
+| media-captions | ⚠️ videoNoTranscript *or* new `mediaNoCaptions` (1.2.2) | Runner-up is close but captions ≠ transcript; Jeff's call whether tic's existing media family covers 1.2.2 or needs the new issue. |
+
+## E. New-issue candidates — draft CONFIRM as genuinely new tic issues (11 rules → 8 issues)
+
+The novelty pour was screened for. Suggested issue IDs follow tic naming style:
+
+| New tic issue | Pour rule(s) | WCAG | Evidence |
+| --- | --- | --- | --- |
+| textSpacingRigid | text-spacing | 1.4.12 | No incumbent equivalent fired anywhere (580 el / 61 pages) |
+| targetSmall | target-size | 2.5.8 AA | tic has no target-size issues (678 el) |
+| targetSmallEnhanced | target-size-enhanced | 2.5.5 AAA | Mirror the contrastAA/AAA banding pattern (8,992 el — volume driver, watch quality) |
+| nonTextContrast | non-text-contrast, control-contrast | 1.4.11 | No incumbent; control-contrast folded in from §C |
+| focusIndicatorMissing | focus-visible | 2.4.7 | 167 pages — page-level rule |
+| focusObscured | focus-not-obscured | 2.4.11 | New-in-2.2 criterion, no incumbent |
+| motionNoControl | pause-stop-hide, video-loop-motion | 2.2.2 | Both halves of the auto-playing/looping motion defect |
+| reflowBroken | reflow | 1.4.10 | From §C |
+| pseudoHeading | p-as-heading | 1.3.1 | Visual heading not marked up; no incumbent fired |
+| canvasNoText | canvas-alt | 1.1.1 | Canvas is not an img; imageNoText would blur element semantics |
+| ariaRedundant | redundant-aria, redundant-aria-label, redundant-tabindex, redundant-role | best practice | Pour's "overdoing it" family as one issue, `quality: 1`; per-rule granularity preserved in instances |
+
+Also: redundant-alt-phrase → new issue `altPhraseRedundant`, and note it likely also homes
+the unmapped incumbents ed11y:altMeaningless/altMeaninglessLinked (kills two coverage-gap
+birds). aria-valid-refs → new issue `ariaRefBroken` (broken ID references) unless Jeff reads
+tic's ariaMissing as covering it.
+
+## F. New-issue candidates — draft QUALITY-0 / park (2)
+
+| Pour rule | Draft | Rationale |
+| --- | --- | --- |
+| button-type | quality-0 | Implicit-submit is a behavior bug more than an a11y defect; weak evidence (17 el) |
+| no-autofocus | quality-0 | Best-practice; genuine debate whether autofocus is a defect at all; 8 el |
+
+## G. Low-support (11) — draft: park all except three semantic gifts
+
+Park (insufficient evidence, revisit if Stage 4 surfaces them): definition-list,
+aria-required-parent, label-for-valid, visual-order-divergence, auth-field-obstruction,
+composite-widget-name, valid-role, fieldset-legend.
+
+Map now despite low support (semantics are exact and unambiguous):
+
+| Pour rule | tic issue | Note |
+| --- | --- | --- |
+| area-alt | linkNoText | Image-map areas are links; 100% co-rate, 47 el (one page) |
+| dialog-name | dialogNoText | 100% co-rate, semantic exact |
+| table-headers | tableHeaderless | Runner-up is semantically exact |
+
+## Tally
+
+- 24 accepts + 3 splits + 8 remaps + 3 low-support maps = **38 mapped pour rules**
+- 13 rules → **~13 new tic issues** (8 novel families incl. multi-rule groupings)
+- 2 quality-0, 8 parked
+- ⚠️ rows needing real human judgment: **9** (landmark-unique, the three §C rejects,
+  region/svg-img-alt/nested-interactive/aria-required-children remaps if the co-rate
+  bothers you, media-captions)
+
+## After sign-off
+
+1. Author tic entries (next tic version) in the testilo fork: mapped rules at `quality: 1`;
+   new issues with WCAG + weight; splits implemented in the mapping layer per §B.
+2. Re-run the evaluation slice as the Stage-4 `study_runs` row with mappings live
+   (this is also the app-tier load-baseline measured window).
+3. Byproduct filings: taxonomy coverage gaps (qualWeb QW-BP30 × 807, ed11y alt* family,
+   axe meta-refresh → homed by the §A/§E work above), pour FP classes with rates
+   (fp-triage-2026-08-22.md).

package/validation/act/surea11y-track-a-2026-09-01.md

@@ -0,0 +1,50 @@
+# Track A — surea11y, full ACT run (2026-09-01)
+
+Capture: `results/surea11y-full-2026-09-01.jsonl` (1,213 testcases, 1,196 ran, 17 prevented —
+the known redirecting-fixture class). Scored `--band asserted`;
+`results/surea11y-full-2026-09-01-asserted.json`. Comparison figures are the merged
+2026-08-22 full run (`merged-full-2026-08-22-asserted.json`), same fixtures, same
+criterion-level scoring layer for pour/axe/surea11y (qualWeb keeps its native-ACT scoring
+advantage).
+
+## Aggregate (any-engine detection subset — 47 rules with surea11y included, was 43)
+
+| Engine | Sensitivity | Specificity | TP | FN | FP | TN |
+| --- | --- | --- | --- | --- | --- | --- |
+| qualWeb | 85.9% | 99.1% | 213 | 35 | 5 | 527 |
+| **surea11y** | **68.6%** | **92.0%** | 151 | 69 | 37 | 425 |
+| pour | 51.1% | 91.7% | 112 | 107 | 37 | 407 |
+| axe | 33.2% | 96.0% | 73 | 147 | 19 | 453 |
+
+surea11y clears the Stage-2 gate: specificity ≥ incumbent median, and sensitivity is the
+best of any criterion-layer engine — +17.5 points over pour at equal specificity.
+
+## Net-new coverage
+
+Sole detector across all four engines: `e88epe` (image not in accessibility tree is
+decorative — 20% sens, but nobody else scores at all).
+
+Detects where pour misses (7): the three **1.4.12 text-spacing** rules (24afc2 / 78fd32 /
+9e45ec, all 100/100 — ACT-fixture confirmation of the same novelty pour's Stage-3b flagged
+in the wild), **b33eff orientation lock** (100/100), **bisz58 meta-refresh no-exception**
+(100/100), akn7bn iframe tab-order, e88epe.
+
+Misses where pour detects (3): aizyf1 (link is descriptive — pour's marquee sole-source
+stays unique to pour), 6cfa84 (aria-hidden focusable content), 80f0bf (auto-playing audio).
+**The engines are complementary, not redundant** — each keeps sole-source value if both
+were adopted.
+
+## FP hotspots (Stage-3 should measure their in-the-wild rates)
+
+| ACT rule | FP | Note |
+| --- | --- | --- |
+| 4b1c6c iframe identical accessible names | 11 (TP 2) | Dominant FP class — over-asserts equivalence judgments the fixture set treats as `cantTell` territory |
+| ucwvc8 page-language subtag matches content | 4 (TP 0) | Same lang-heuristic FP class pour had; pour's Stage-3a showed it ~absent in the wild |
+| e086e5 / 2t702h / akn7bn / qt1vmo / bc4a75 / e88epe | 2–3 each | Small; triage with Stage-3 rates |
+
+## Verdict
+
+Stage-2 gate **passed**. Next per pipeline: Stage-3 capture over the evaluation slice
+(`--urls yra-100k/data/stage3a-sample-300.txt`, engines surea11y + incumbents) — ran-rate,
+latency distribution, trigger-happy screen, and the 4b1c6c FP class's real-world rate; then
+3b mapping bootstrap off the same capture.

package/validation/executors/netWatch.js

@@ -1,5 +1,7 @@
 /*
   © 2022–2024 CVS Health and/or one of its affiliates. All rights reserved.
+  © 2026 Jonathan Robert Pool.
+  © 2026 Jeff Witt.
 
   Licensed under the MIT License. See LICENSE file at the project root or
   https://opensource.org/license/mit/ for details.
@@ -8,119 +10,207 @@
 */
 
 /*
-  watchNet.js
-  Validator for network watching.
+  netWatch.js
+  Validator for network watching, covering all three auth types.
 */
 
 // IMPORTS
 
 const fs = require('fs/promises');
+const client = require('http');
 
 // CONSTANTS
 
-// Override netWatch environment variables with validation-specific ones.
 const jobDir = `${__dirname}/../jobs/todo`;
-process.env.JOB_URLS = 'http://localhost:3007/api/job';
-process.env.AGENT = 'testarauth';
-const {netWatch} = require('../../netWatch');
-const client = require('http');
 const jobID = '240101T1200-simple-example';
+const workerID = 'testaro1';
+const workerSecret = 'testarosecret';
+// Override netWatch environment variables with validation-specific ones.
+process.env.NETWATCH_URL_JOB = 'http://localhost:3007/api/job';
+process.env.NETWATCH_URL_REPORT = 'http://localhost:3007/api/report';
+process.env.NETWATCH_WORKER_ID = workerID;
+process.env.NETWATCH_WORKER_SECRET = workerSecret;
+const {netWatch} = require('../../netWatch');
+/*
+  The authorization-header value netWatch is expected to send in header mode: per RFC 7617, Basic
+  followed by base64 of testaro1:testarosecret. Intentionally a literal, not derived from the
+  netWatch code, so an encoding regression there fails here.
+*/
+const workerAuth = 'Basic dGVzdGFybzE6dGVzdGFyb3NlY3JldA==';
+// Auth types to be validated.
+const authTypes = ['header', 'pathBody', 'none'];
 
-// OPERATION
+// FUNCTIONS
 
-// Start a timer.
-const startTime = Date.now();
-// Initialize the state.
-let jobGiven = false;
-// Start checking for jobs every 5 seconds in 5 seconds.
-setTimeout(() => {
-  netWatch(false, 5, false);
-}, 5000);
-let server;
-// Handles Testaro requests to the server.
-const requestHandler = (request, response) => {
-  const {method} = request;
-  const bodyParts = [];
-  request.on('error', err => {
-    console.error(err);
-  })
-  .on('data', chunk => {
-    bodyParts.push(chunk);
-  })
-  .on('end', async () => {
-    // Remove any trailing slash from the URL.
-    const requestURL = request.url.replace(/\/$/, '');
-    // If the request method is GET:
-    if (method === 'GET') {
-      // If a job is validly requested:
-      console.log('Server got a job request from Testaro');
-      if (requestURL === `/api/job?agent=${process.env.AGENT}`) {
-        // If at least 7 seconds has elapsed since timing started:
-        if (Date.now() > startTime + 7000) {
-          // Respond with a job.
-          const jobJSON = await fs.readFile(`${jobDir}/${jobID}.json`);
-          await response.end(jobJSON);
-          console.log('Server sent job to Testaro');
-          jobGiven = true;
+// Returns an error description if a request carries wrong credentials for an auth type, else ''.
+const credentialError = (authType, request, bodyObj) => {
+  const authHeader = request.headers.authorization;
+  if (authType === 'header') {
+    if (authHeader !== workerAuth) {
+      return 'authorization header missing or wrong';
+    }
+    if (bodyObj.agentPW !== undefined) {
+      return 'agentPW unexpectedly in the request body';
+    }
+  }
+  else if (authType === 'pathBody') {
+    if (authHeader) {
+      return 'authorization header unexpectedly present';
+    }
+    if (bodyObj.agentPW !== workerSecret) {
+      return 'agentPW missing from or wrong in the request body';
+    }
+  }
+  else {
+    if (authHeader) {
+      return 'authorization header unexpectedly present';
+    }
+    if (bodyObj.agentPW !== undefined) {
+      return 'agentPW unexpectedly in the request body';
+    }
+  }
+  return '';
+};
+// Validates netWatch with one auth type; returns whether the scenario succeeded.
+const runScenario = authType => {
+  return new Promise(resolveScenario => {
+    process.env.NETWATCH_AUTH_TYPE = authType;
+    let jobGiven = false;
+    let noJobSent = false;
+    let reportOK = false;
+    let server;
+    // Responds to a request with a JSON object and a status code.
+    const respondWithObject = (object, response, statusCode = 200) => {
+      response.statusCode = statusCode;
+      response.setHeader('content-type', 'application/json; charset=utf-8');
+      response.end(JSON.stringify(object));
+    };
+    // Handles Testaro requests to the server.
+    const requestHandler = (request, response) => {
+      const {method} = request;
+      // Ignore any trailing slash on the request URL.
+      const url = request.url.replace(/\/$/, '');
+      const bodyParts = [];
+      request.on('error', err => {
+        console.error(err);
+      })
+      .on('data', chunk => {
+        bodyParts.push(chunk);
+      })
+      .on('end', async () => {
+        let bodyObj = {};
+        try {
+          bodyObj = JSON.parse(bodyParts.join('') || '{}');
         }
-        // Otherwise, i.e. if timing started less than 7 seconds ago:
-        else {
-          // Send an empty-object response.
-          await response.end('{}');
+        catch(error) {
+          console.log(`Scenario ${authType} failure: non-JSON request body (${error.message})`);
         }
-      }
-      else {
-        const error = {
-          error: 'ERROR: Job request invalid'
-        };
-        const errorJSON = JSON.stringify(error);
-        await response.end(errorJSON);
-      }
-    }
-    // Otherwise, if the request method is POST:
-    else if (method === 'POST') {
-      console.log('Server got report from Testaro');
-      const ack = {};
-      // If a report is validly submitted:
-      if (requestURL === '/api') {
-        // If a job was earlier given to Testaro:
-        if (jobGiven) {
-          // Respond, reporting success or failure.
-          try {
-            const bodyJSON = bodyParts.join('');
-            const body = JSON.parse(bodyJSON);
+        // If the request carries wrong credentials for this auth type:
+        const credError = credentialError(authType, request, bodyObj);
+        if (credError) {
+          // Report this and reject the request; netWatch is expected to abort on this.
+          console.log(`Scenario ${authType} failure: ${credError}`);
+          respondWithObject({error: 'ERROR: Authorization invalid'}, response, 401);
+          server.close();
+          return;
+        }
+        // Otherwise, if the request is a job request:
+        if (method === 'POST' && url === '/api/job') {
+          console.log(`Server got a job request from Testaro (${authType})`);
+          // If this is the first job request of the scenario:
+          if (! noJobSent) {
+            // Send a no-job response, to validate the no-job branch.
+            noJobSent = true;
+            respondWithObject({}, response);
+          }
+          // Otherwise, i.e. if the no-job branch was already validated:
+          else {
+            // Respond with a job.
+            const jobJSON = await fs.readFile(`${jobDir}/${jobID}.json`);
+            response.setHeader('content-type', 'application/json; charset=utf-8');
+            response.end(jobJSON);
+            console.log(`Server sent job to Testaro (${authType})`);
+            jobGiven = true;
+          }
+        }
+        // Otherwise, if the request is a report submission:
+        else if (method === 'POST' && url === '/api/report') {
+          console.log(`Server got report from Testaro (${authType})`);
+          const ack = {};
+          // If a job was earlier given to Testaro:
+          if (jobGiven) {
+            // Check the report, including the worker identification.
+            const {report} = bodyObj;
             if (
-              body.acts
-              && body.sources
-              && body.sources.agent
-              && body.sources.agent === process.env.AGENT
+              report
+              && report.acts
+              && report.jobData
+              && report.sources
+              && report.sources.agent === workerID
             ) {
               ack.message = 'Success: Valid report submitted';
+              reportOK = true;
             }
             else {
-              ack.message = 'Failure: Report invalid';
+              ack.message = 'Failure: Report invalid or worker not identified';
             }
           }
-          catch(error) {
-            ack.message = `ERROR: ${error.message}`;
+          else {
+            ack.message = 'ERROR: Report submitted before a job was given';
           }
+          respondWithObject(ack, response);
+          console.log(`Server responded: ${ack.message}`);
+          // This ends the scenario, so stop the server.
+          server.close();
+          console.log('Server closed');
         }
-      }
-      else {
-        ack.message = 'ERROR: Report submission invalid';
-      }
-      const ackJSON = JSON.stringify(ack);
-      response.end(ackJSON);
-      console.log(`Server responded: ${ack.message}`);
-      // This ends the validation, so stop the server.
+        // Otherwise, i.e. if the request is neither:
+        else {
+          // Report this and reject the request.
+          console.log(`Scenario ${authType} failure: unexpected request ${method} ${request.url}`);
+          respondWithObject({error: 'ERROR: Request invalid'}, response, 404);
+          server.close();
+        }
+      });
+    };
+    // Create a server.
+    server = client.createServer({}, requestHandler);
+    // Start the server listening for Testaro requests, then start a one-job watch.
+    server.listen(3007, async () => {
+      console.log(`Job and report server listening on port 3007 (auth type ${authType})`);
+      const watchOK = await netWatch(false, 5, false);
       server.close();
-      console.log('Server closed');
-    }
+      resolveScenario(reportOK && watchOK);
+    });
   });
 };
-// Create a server.
-server = client.createServer({}, requestHandler);
-// Start a server listening for Testaro requests.
-server.listen(3007, () => {
-  console.log('Job and report server listening on port 3007');
-});
+
+// OPERATION
+
+// Impose a deadline, so a hang becomes a failure instead of a silent stall.
+const watchdog = setTimeout(() => {
+  console.log('Failure: netWatch validation timed out');
+  process.exit(1);
+}, 600000);
+// Run the scenarios in sequence and exit with a code reporting the outcome.
+(async () => {
+  const failures = [];
+  for (const authType of authTypes) {
+    const isOK = await runScenario(authType);
+    // Drop any kept-alive connections to the closed server before the next scenario.
+    client.globalAgent.destroy();
+    console.log(`Scenario ${authType}: ${isOK ? 'valid' : 'INVALID'}\n`);
+    if (! isOK) {
+      failures.push(authType);
+    }
+  }
+  clearTimeout(watchdog);
+  if (failures.length) {
+    console.log(`Failure: Invalid scenarios: ${failures.join(', ')}`);
+    process.exit(1);
+  }
+  else {
+    console.log('Success: Valid reports submitted for all auth types');
+    process.exit(0);
+  }
+})();

package/validation/executors/test.js

@@ -1,5 +1,6 @@
 /*
   © 2022–2023 CVS Health and/or one of its affiliates. All rights reserved.
+  © 2026 Jeff Witt.
 
   Licensed under the MIT License. See LICENSE file at the project root or
   https://opensource.org/license/mit/ for details.
@@ -13,6 +14,20 @@
   Execution example: npm test focOp
 */
 
-const testID = process.argv[2];
 const {validateTest} = require('../validateTest');
-validateTest(testID);
+
+// Flushes the standard output and then exits, because lingering browser
+// processes otherwise keep the event loop alive indefinitely.
+const exitWith = code => {
+  process.stdout.write('', () => process.exit(code));
+};
+
+const testID = process.argv[2];
+validateTest(testID)
+.then(result => {
+  exitWith(result.success ? 0 : 1);
+})
+.catch(error => {
+  console.log(`ERROR validating test ${testID} (${error.message})`);
+  exitWith(1);
+});