testaro 78.0.8 → 78.6.0

package/validation/act/score.js

@@ -0,0 +1,184 @@
+/*
+  © 2026 Jeff Witt.
+
+  Licensed under the MIT License. See LICENSE file at the project root or
+  https://opensource.org/license/mit/ for details.
+
+  SPDX-License-Identifier: MIT
+*/
+
+/*
+  score.js
+  Track-A scoring: computes a per-engine, per-ACT-rule confusion matrix from a
+  capture JSONL (capture.js output).
+
+  Usage:
+    node validation/act/score.js --in results/act-....jsonl [--band asserted|review|both]
+      [--json out.json]
+
+  Scoring policy (criterion-level comparability layer, v1):
+  - An ACT rule's positive criteria are its forConformance WCAG 2.x success
+    criteria from the testcase feed. Rules with none (technique/ARIA-only
+    rules) are reported separately as unscoreable.
+  - An engine FLAGS a testcase when it reports ≥1 finding on any of the rule's
+    criteria. Band `asserted` (default) counts definite failures only (standard
+    instance outcome `failed`); `review` counts engine-flagged uncertainty
+    (outcome `cantTell`); `both` counts either.
+  - failed testcases are the positive class; passed + inapplicable are the
+    negative class. Sensitivity = TP/(TP+FN); specificity = TN/(TN+FP).
+  Known generosities/strictnesses, stated wherever results publish: a finding
+  on the right criterion from an unrelated check still counts (generous); a
+  real finding reported under a different criterion does not (strict).
+*/
+
+// IMPORTS
+
+const fs = require('fs');
+const path = require('path');
+
+// FUNCTIONS
+
+const parseArgs = argv => {
+  const args = {};
+  for (let i = 2; i < argv.length; i += 2) {
+    args[argv[i].replace(/^--/, '')] = argv[i + 1];
+  }
+  return args;
+};
+
+const percent = (numerator, denominator) =>
+  denominator ? `${(100 * numerator / denominator).toFixed(1)}%` : '—';
+
+// OPERATION
+
+const args = parseArgs(process.argv);
+if (! args.in) {
+  console.log('Usage: node validation/act/score.js --in <capture.jsonl> [--band asserted|review|both]');
+  process.exit(1);
+}
+const band = args.band || 'asserted';
+const rows = fs.readFileSync(args.in, 'utf8')
+.split('\n')
+.filter(Boolean)
+.map(line => JSON.parse(line));
+
+// ACT-rule criterion sets from the cached feed.
+const feed = JSON.parse(
+  fs.readFileSync(path.join(__dirname, 'cache', 'testcases.json'), 'utf8')
+);
+const ruleCriteria = {};
+const ruleNames = {};
+feed.testcases.forEach(testcase => {
+  ruleNames[testcase.ruleId] = testcase.ruleName;
+  if (! ruleCriteria[testcase.ruleId]) {
+    const criteria = Object.entries(testcase.ruleAccessibilityRequirements || {})
+    .filter(([key, value]) => /^wcag2\d:/.test(key) && value && value.forConformance)
+    .map(([key]) => key.split(':')[1]);
+    ruleCriteria[testcase.ruleId] = new Set(criteria);
+  }
+});
+
+// Whether a capture row flags its testcase under the scoring policy. Rows
+// with exact ACT-rule maps (actAsserted/actReview — qualWeb) are scored on
+// those; rows scored at the exact level bypass the unscoreable-criteria gate
+// since the mapping needs no WCAG SC bridge.
+const flags = row => {
+  if (row.actAsserted || row.actReview) {
+    const buckets = [];
+    if (band === 'asserted' || band === 'both') {
+      buckets.push(row.actAsserted || {});
+    }
+    if (band === 'review' || band === 'both') {
+      buckets.push(row.actReview || {});
+    }
+    return buckets.some(bucket => !! bucket[row.ruleId]);
+  }
+  const criteria = ruleCriteria[row.ruleId];
+  if (! criteria || ! criteria.size) {
+    return null;
+  }
+  const buckets = [];
+  if (band === 'asserted' || band === 'both') {
+    buckets.push(row.asserted || {});
+  }
+  if (band === 'review' || band === 'both') {
+    buckets.push(row.review || {});
+  }
+  return buckets.some(
+    bucket => Object.entries(bucket).some(([criterion, count]) => count && criteria.has(criterion))
+  );
+};
+
+// Tally per engine × rule.
+const tallies = {};
+const unscoreable = new Set();
+const errored = {};
+rows.forEach(row => {
+  if (row.prevented) {
+    errored[row.engine] = (errored[row.engine] || 0) + 1;
+    return;
+  }
+  const flagged = flags(row);
+  if (flagged === null) {
+    unscoreable.add(row.ruleId);
+    return;
+  }
+  tallies[row.engine] ??= {};
+  const tally = tallies[row.engine][row.ruleId] ??= {TP: 0, FP: 0, TN: 0, FN: 0};
+  if (row.expected === 'failed') {
+    tally[flagged ? 'TP' : 'FN']++;
+  }
+  else {
+    tally[flagged ? 'FP' : 'TN']++;
+  }
+});
+
+// Report.
+const report = {band, engines: {}};
+Object.entries(tallies).forEach(([engine, ruleTallies]) => {
+  console.log(`\n## ${engine} (band: ${band})\n`);
+  console.log('| ACT rule | Name | TP | FN | FP | TN | Sens | Spec |');
+  console.log('| --- | --- | --- | --- | --- | --- | --- | --- |');
+  const totals = {TP: 0, FP: 0, TN: 0, FN: 0};
+  const perRule = {};
+  Object.entries(ruleTallies)
+  .sort(([, a], [, b]) => (b.TP + b.FN) - (a.TP + a.FN))
+  .forEach(([ruleId, tally]) => {
+    ['TP', 'FP', 'TN', 'FN'].forEach(key => {
+      totals[key] += tally[key];
+    });
+    perRule[ruleId] = {
+      ...tally,
+      sensitivity: tally.TP + tally.FN ? tally.TP / (tally.TP + tally.FN) : null,
+      specificity: tally.TN + tally.FP ? tally.TN / (tally.TN + tally.FP) : null
+    };
+    // Rows where the engine saw nothing at all and nothing was expected are
+    // uninformative for display; keep them in totals and JSON regardless.
+    if (tally.TP + tally.FN === 0 && tally.FP === 0) {
+      return;
+    }
+    console.log(
+      `| ${ruleId} | ${ruleNames[ruleId].slice(0, 45)} | ${tally.TP} | ${tally.FN} | ${tally.FP} `
+      + `| ${tally.TN} | ${percent(tally.TP, tally.TP + tally.FN)} `
+      + `| ${percent(tally.TN, tally.TN + tally.FP)} |`
+    );
+  });
+  console.log(
+    `| **all** | | ${totals.TP} | ${totals.FN} | ${totals.FP} | ${totals.TN} `
+    + `| ${percent(totals.TP, totals.TP + totals.FN)} `
+    + `| ${percent(totals.TN, totals.TN + totals.FP)} |`
+  );
+  report.engines[engine] = {totals, perRule, errored: errored[engine] || 0};
+});
+if (unscoreable.size) {
+  console.log(
+    `\nUnscoreable (no forConformance WCAG 2.x SC): ${[...unscoreable].join(', ')}`
+  );
+}
+Object.entries(errored).forEach(([engine, count]) => {
+  console.log(`Errored/prevented rows for ${engine}: ${count}`);
+});
+if (args.json) {
+  fs.writeFileSync(args.json, JSON.stringify(report, null, 2));
+  console.log(`\nJSON → ${args.json}`);
+}

package/validation/act/stage3a-stress-report.md

@@ -0,0 +1,69 @@
+# Stage-3a stress report — pour on 300 real pages (2026-08-22)
+
+Capture: `results/stage3a-2026-08-22.jsonl` — 300 pages (250 seeded-random US CrUX tail + 50
+top-1000 head; `yra-100k/data/stage3a-sample-300.txt`, seed 42) × pour, axe, ed11y, qualWeb, via
+the hardened URL-mode harness (per-instance element paths captured for Stage 3b). The run
+completed unattended: 4 canary-triggered browser replacements, zero stalls.
+
+## Gate verdict: PASS
+
+| Engine | Raw ran-rate | Effective ran-rate¹ | p50 | p95 | Instances |
+| --- | --- | --- | --- | --- | --- |
+| pour | 96.3% | **99.0%** | 2.0 s | 7.7 s | 50,123 |
+| axe | 97.0% | 99.7% | 1.7 s | 6.5 s | 32,071 |
+| ed11y | 96.7% | 99.3% | 1.0 s | 4.3 s | 6,029 |
+| qualWeb | 94.7% | 97.3% | 4.1 s | 13.4 s | 113,656 |
+
+¹ Excluding the 8 pages unreachable for **every** engine (dead/hostile sites — page problems,
+not engine problems). Pour's gate was ≥95%: passed on either denominator. Latency is well inside
+the worker budget. No trigger-happy rule: nothing asserts on >90% of pages (max:
+`target-size-enhanced`, 86% — an AAA rule where near-ubiquity is plausible; flagged for tic
+quality review, not a defect).
+
+## Prevention taxonomy (engine-specific residue is small)
+
+Navigation failures/timeouts dominate (6–7 per engine — the dead-site class). Residue:
+`navigated-during-eval` 1–3/engine (meta-refresh-class pages; results legitimately unobtainable);
+reporter timeouts on 2 extremely heavy pages (pour 1, ed11y 3); qualWeb "No DOM" ×7 (its own
+HTML ingestion fails on some pages — an incumbent robustness datum, not a candidate problem);
+one axe adapter TypeError on one page (page-specific, pre-existing adapter code). Zero CSP
+preventions — the nonce passthrough works in the wild.
+
+## Volume anatomy — the kitchen-sink effect
+
+Pour's headline 50k instances is dominated by AAA and best-practice rules (~30k: contrast-
+enhanced 13.1k, target-size-enhanced 9.2k, region 8.1k), a direct consequence of the adapter's
+run-every-rule setting (matching axe's). The A/AA-comparable picture is much closer, and on the
+single biggest A/AA category the two engines nearly agree:
+
+- **color-contrast (1.4.3): pour 8,829 instances / 74% of pages vs axe 8,795 / 76%** — near-
+  identical at scale.
+- link-name: pour 536/30% vs axe 660/31%. heading-order: 153/30% vs 269/32%.
+- Divergences to watch in Stage 3b: `region` (pour 8.1k vs axe 2.7k — counting granularity) and
+  axe's `hidden-content` (11.3k, 87% of pages — its own kitchen-sink review rule).
+
+## Assertion-band inversion (the vendor claim, reproduced)
+
+Of pour's instances, **72% are asserted violations** (severity 2–3) and 28% review; axe inverts:
+**34% violations, 66% review/incomplete**. This independently reproduces pour.dev's "twice the
+failing elements with fewer check-by-eye verdicts" claim — and it makes Stage-4 triage of pour's
+*asserted* band the critical validation: pour stakes much more on definite assertions than axe
+does.
+
+## ACT-identified FP classes at real-world scale
+
+- **Contrast** (both rules): 21.9k instances = 44% of pour's volume — the FP mechanisms found on
+  ACT fixtures (symbol-only text, letter-as-icon glyphs) live inside this mass. Highest-priority
+  triage sample for Stage 4.
+- **Language applicability** (`valid-lang-parts`): fired on **zero** real pages — the ACT FP
+  class is real but rare in the wild. `html-lang` asserts on 31 pages (10.7%) — consistent with
+  WebAIM's ~13% missing-language prevalence, so likely mostly true positives.
+- `button-name` 111 instances / 32 pages, `link-name` 536 / 88 pages — moderate volumes; the
+  known name-computation gap (descendant `aria-labelledby`) warrants a targeted triage slice.
+
+## Next (Stage 3b)
+
+Per-instance element paths are already captured for all four engines. Run
+`propose-tic-mappings`-style co-occurrence between pour rule IDs and the mapped incumbents'
+issues over this same JSONL; disposition all 70 pour rules that fired (plus the ~16 that
+didn't); then Stage-4 triage sampling with the contrast and link/button-name slices prioritized.

package/validation/act/stage3b-mapping-proposals.md

@@ -0,0 +1,94 @@
+# Stage-3b mapping proposals — pour
+
+Capture: `validation/act/results/stage3a-2026-08-22.jsonl` · taxonomy: `tic50.js` · thresholds: rate ≥ 0.25, ≥ 5 elements on ≥ 3 pages. Exact-path co-occurrence is a floor; proposals require human accept/reject/split review.
+
+| Candidate rule | Elements | Pages | Proposed issue | Co-rate | Lift | Runners-up | Suggestion | Verdict |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| color-contrast-enhanced | 12965 | 222 | contrastAAA | 43% (5611) | 4.5 | contrastAA (5058, lift 4.1); contrastRisk (1746, lift 3.0) | map | |
+| target-size-enhanced | 8992 | 248 | — | 2% (171) | 5.1 | linkTextsSame (667, lift 3.4); newTabSurprise (565, lift 3.5) | new-issue candidate | |
+| color-contrast | 8775 | 213 | contrastAA | 49% (4287) | 5.1 | contrastRisk (1639, lift 4.2); linkVaguenessRisk (27, lift 8.0) | map | |
+| region | 8013 | 150 | — | 0% (28) | 9.0 | contentBeyondLandmarks (722, lift 3.1); imageNoText (141, lift 3.5) | new-issue candidate | |
+| new-window-link | 1697 | 196 | newTabSurprise | 63% (1064) | 34.4 | nonWebLink (18, lift 20.4); linkIndication (31, lift 16.2) | map | |
+| svg-img-alt | 818 | 87 | — | 24% (194) | 8.4 | svgImageNoText (1, lift 11.1); eventKeyboardRisk (2, lift 6.2) | new-issue candidate | |
+| target-size | 678 | 58 | — | 1% (8) | 26.7 | ignorable (551, lift 1.2); linkConfusionRisk (8, lift 3.2) | new-issue candidate | |
+| text-spacing | 580 | 61 | — | 2% (10) | 22.3 | dialogNoText (1, lift 31.2); inputNoText (1, lift 22.3) | new-issue candidate | |
+| link-name | 536 | 88 | imageLinkNoText | 60% (319) | 115.4 | linkNoText (509, lift 91.1); newTabSurprise (127, lift 13.0) | map | |
+| redundant-aria-label | 510 | 63 | — | 2% (9) | 53.3 | linkTextsSame (47, lift 4.3); ariaAttributeBad (16, lift 5.8) | new-issue candidate | |
+| image-alt | 484 | 69 | imageNoText | 67% (322) | 133.9 | imageTextBad (31, lift 175.8); linkPair (7, lift 13.2) | map | |
+| landmark-unique | 480 | 75 | bannerNotTop | 27% (131) | 177.9 | mainNotTop (111, lift 179.0); landmarkConfusion (91, lift 177.0) | map | |
+| redundant-tabindex | 479 | 60 | — | 3% (16) | 10.9 | ariaAttributeBad (23, lift 8.9); visibleLabelNotInName (19, lift 4.7) | new-issue candidate | |
+| redundant-aria | 337 | 61 | — | 15% (52) | 57.8 | activeEmbedding (8, lift 76.8); focusableDescendants (8, lift 21.7) | new-issue candidate | |
+| landmark-top-level | 302 | 37 | bannerNotTop | 45% (135) | 291.3 | mainNotTop (112, lift 287.1); footerNotTop (6, lift 257.1) | map | |
+| link-text-generic | 279 | 77 | — | 12% (33) | 306.1 | linkTextsSame (172, lift 28.5); linkConfusionRisk (36, lift 34.9) | new-issue candidate | |
+| link-text-generic-only | 279 | 77 | — | 12% (33) | 306.1 | linkTextsSame (172, lift 28.5); linkConfusionRisk (36, lift 34.9) | new-issue candidate | |
+| aria-hidden-focus | 231 | 27 | focusableHidden | 88% (204) | 377.4 | ignorable (120, lift 0.8); boxSizeAbsolute (5, lift 0.8) | map | |
+| non-text-contrast | 190 | 90 | — | 3% (6) | 476.8 | labelConfusionRisk (86, lift 121.7); controlLabelInvisible (2, lift 476.8) | new-issue candidate | |
+| nested-interactive | 183 | 29 | — | 14% (25) | 442.0 | focusableDescendants (20, lift 100.0); ariaAttributeBad (17, lift 17.1) | new-issue candidate | |
+| aria-allowed-attr | 170 | 30 | ariaAttributeBad | 48% (81) | 87.9 | duplicateID (1, lift 5.5); landmarkConfusion (1, lift 5.5) | map | |
+| focus-visible | 167 | 167 | — | 21% (35) | 287.7 | mainNone (48, lift 252.8); skipRepeatedContent (6, lift 191.4) | new-issue candidate | |
+| aria-valid-refs | 167 | 36 | — | 22% (36) | 39.8 | activeEmbedding (4, lift 77.5); dialogNoText (1, lift 108.5) | new-issue candidate | |
+| heading-order | 153 | 87 | headingLevelSkip | 95% (146) | 313.2 | headingEmpty (2, lift 16.9); headingLength (1, lift 20.4) | map | |
+| redundant-role | 135 | 72 | — | 5% (7) | 48.4 | asideNotTop (3, lift 15.0); labelConfusionRisk (4, lift 8.0) | new-issue candidate | |
+| landmark-one-main | 133 | 133 | mainNone | 77% (102) | 674.5 | pageLanguage (29, lift 564.3); h1Not1 (44, lift 454.1) | map | |
+| redundant-image-alt | 120 | 19 | imageTextRedundant | 69% (83) | 482.0 | ignorable (74, lift 0.9) | map | |
+| button-name | 111 | 32 | buttonNoText | 97% (108) | 318.2 | linkNoText (13, lift 11.2); ignorable (90, lift 1.2) | map | |
+| focus-not-obscured | 108 | 8 | — | 16% (17) | 51.5 | newTabSurprise (16, lift 8.1); linkConfusionRisk (2, lift 5.0) | new-issue candidate | |
+| control-contrast | 103 | 52 | labelConfusionRisk | 57% (59) | 154.0 | labelNot1 (4, lift 390.9); selectNoText (2, lift 293.2) | map | |
+| form-label | 88 | 55 | — | 2% (2) | 1029.4 | selectNoText (4, lift 686.3); labelConfusionRisk (66, lift 201.6) | new-issue candidate | |
+| redundant-alt-phrase | 87 | 27 | — | 1% (1) | 69.4 | ignorable (85, lift 1.4); contentBeyondLandmarks (7, lift 2.8) | new-issue candidate | |
+| listitem-parent | 86 | 7 | listItemOrphan | 45% (39) | 708.3 | ignorable (2, lift 0.0) | map | |
+| page-heading-one | 80 | 80 | h1Not1 | 71% (57) | 977.9 | pageTitle (5, lift 1132.3); skipRepeatedContent (10, lift 666.1) | map | |
+| pause-stop-hide | 79 | 21 | — | 1% (1) | 11.8 | footerNot1 (1, lift 11.4); contrastAA (16, lift 2.1) | new-issue candidate | |
+| aria-label-misuse | 77 | 16 | attributeBad | 95% (73) | 825.8 | ariaAttributeBad (69, lift 165.3); contentBeyondLandmarks (5, lift 2.3) | map | |
+| link-in-text-block | 61 | 25 | linkIndication | 57% (35) | 509.6 | linkVaguenessRisk (2, lift 84.9); linkFileName (1, lift 40.1) | map | |
+| empty-heading | 47 | 24 | headingEmpty | 100% (47) | 1294.1 | headingLevelSkip (3, lift 20.9); ignorable (36, lift 1.1) | map | |
+| area-alt | 47 | 1 | — | 100% (47) | 1927.4 | linkNoText (47, lift 96.0); ignorable (47, lift 1.5) | low support | |
+| meta-viewport | 38 | 37 | metaBansZoom | 95% (36) | 1751.4 | — | map | |
+| aria-field-name | 38 | 7 | — | 82% (31) | 2383.9 | inputNoText (6, lift 2043.3); controlNoText (6, lift 185.8) | new-issue candidate | |
+| media-captions | 38 | 4 | — | 21% (8) | 346.7 | videoNoTranscript (3, lift 255.4); videoNoAudioTrack (3, lift 255.4) | new-issue candidate | |
+| scrollable-region-focusable | 32 | 12 | keyboardScroll | 28% (9) | 849.3 | contentBeyondLandmarks (1, lift 1.1) | map | |
+| html-lang | 31 | 31 | pageLanguage | 100% (31) | 2588.2 | pageTitle (5, lift 2922.2); mainNone (26, lift 737.6) | map | |
+| frame-title | 26 | 18 | iframeTitleBad | 73% (19) | 1085.2 | boxSizeAbsolute (4, lift 5.5); ignorable (19, lift 1.1) | map | |
+| meta-refresh | 24 | 24 | refresh | 96% (23) | 3617.2 | — | map | |
+| p-as-heading | 24 | 14 | — | 17% (4) | 112.7 | — | new-issue candidate | |
+| definition-list | 24 | 1 | — | 100% (24) | 1.5 | — | low support | |
+| video-loop-motion | 23 | 23 | videoNoAudioDescription | 83% (19) | 2078.7 | audioNoText (19, lift 1626.8); videoNoTranscript (13, lift 1828.6) | map | |
+| list-structure | 20 | 12 | listChild | 95% (19) | 4098.0 | descendantMissing (13, lift 550.3); ignorable (19, lift 1.4) | map | |
+| button-type | 17 | 10 | — | 12% (2) | 38.5 | visibleLabelNotInName (3, lift 21.1); ariaAttributeBad (1, lift 10.9) | new-issue candidate | |
+| positive-tabindex | 14 | 7 | tabIndexPositive | 100% (14) | 6470.5 | skipRepeatedContent (1, lift 380.6); labelConfusionRisk (4, lift 76.8) | map | |
+| reflow | 12 | 12 | h1Not1 | 42% (5) | 571.9 | mainNone (3, lift 219.9); iframeTitleBad (1, lift 123.8) | map | |
+| aria-attr-valid | 9 | 4 | ariaAttributeBad | 100% (9) | 184.5 | ignorable (4, lift 0.7) | map | |
+| canvas-alt | 8 | 5 | — | 50% (4) | 17.8 | ignorable (3, lift 0.6) | new-issue candidate | |
+| no-autofocus | 8 | 7 | — | 25% (2) | 134.0 | labelConfusionRisk (3, lift 100.8); ignorable (8, lift 1.5) | new-issue candidate | |
+| bypass-blocks | 6 | 6 | skipRepeatedContent | 100% (6) | 5328.6 | h1Not1 (3, lift 686.3); pageLanguage (2, lift 862.7) | map | |
+| document-title | 6 | 6 | pageTitle | 83% (5) | 15097.8 | pageLanguage (5, lift 2156.8); h1Not1 (6, lift 1372.5) | map | |
+| aria-required-children | 5 | 4 | — | 20% (1) | 2588.2 | descendantMissing (5, lift 846.6); controlNoText (1, lift 235.3) | new-issue candidate | |
+| multiple-labels | 5 | 4 | labelNot1 | 100% (5) | 10065.2 | duplicateID (4, lift 747.1); ariaMissing (1, lift 862.7) | map | |
+| autocomplete-valid | 5 | 3 | autocompleteBad | 100% (5) | 15097.8 | ignorable (5, lift 1.5); contrastAA (1, lift 2.1) | map | |
+| dialog-name | 4 | 4 | — | 100% (4) | 18117.4 | ariaAttributeBad (1, lift 46.1) | low support | |
+| fieldset-legend | 4 | 4 | — | 25% (1) | 2516.3 | controlNoText (1, lift 294.1); duplicateID (1, lift 233.5) | low support | |
+| aria-required-parent | 4 | 1 | — | 0% (0) | 0.0 | — | low support | |
+| label-for-valid | 3 | 3 | — | 33% (1) | 11.6 | contrastAA (2, lift 7.0); contrastAAA (2, lift 6.9) | low support | |
+| table-headers | 3 | 3 | — | 100% (3) | 2264.7 | tableHeaderless (2, lift 1830.0); tabularTableless (2, lift 1776.2) | low support | |
+| visual-order-divergence | 3 | 3 | — | 33% (1) | 3.4 | ignorable (1, lift 0.5) | low support | |
+| auth-field-obstruction | 3 | 1 | — | 100% (3) | 1.5 | — | low support | |
+| composite-widget-name | 2 | 2 | — | 50% (1) | 6470.5 | ariaAttributeBad (2, lift 184.5) | low support | |
+| valid-role | 1 | 1 | — | 100% (1) | 536.0 | focusableRole (1, lift 374.3); ignorable (1, lift 1.5) | low support | |
+
+Summary: 70 fired rules — 33 mapping proposals, 26 new-issue candidates, 11 low-support.
+
+Incumbent instances with no tic mapping (top 10 — taxonomy coverage gaps):
+- qualWeb:QW-BP30: 807
+- ed11y:altURLLinked: 107
+- axe:meta-refresh: 24
+- ed11y:altMeaningless: 21
+- ed11y:altMeaninglessLinked: 12
+- axe:aria-tab-name: 1
+
+## Reading notes for the triage pass
+
+- **High-confidence accepts** (semantic match + dominant co-rate + high lift): empty-heading→headingEmpty, button-name→buttonNoText, heading-order→headingLevelSkip, landmark-one-main→mainNone, page-heading-one→h1Not1, image-alt→imageNoText, aria-hidden-focus→focusableHidden, new-window-link→newTabSurprise, document-title→pageTitle, bypass-blocks→skipRepeatedContent, autocomplete-valid→autocompleteBad, multiple-labels→labelNot1, aria-label-misuse→attributeBad, link-in-text-block→linkIndication, listitem-parent→listItemOrphan, redundant-image-alt→imageTextRedundant, color-contrast→contrastAA, color-contrast-enhanced→contrastAAA.
+- **Split candidates**: link-name (linkNoText vs imageLinkNoText both co-fire strongly — tic distinguishes text links from image links; pour's one rule covers both); landmark-unique / landmark-top-level (bannerNotTop / mainNotTop / footerNotTop family).
+- **Likely genuine pour novelty** (new-issue candidates with no plausible runner-up): text-spacing (1.4.12 — no incumbent equivalent fired anywhere), target-size / target-size-enhanced (2.5.8/2.5.5 — tic appears to lack target-size issues), non-text-contrast (1.4.11), focus-visible, focus-not-obscured (2.4.11), and the redundant-* best-practice family (pour's "overdoing it" rules).
+- **Known ranking quirk**: extreme-lift/tiny-support pairs can outscore the right answer when a rule's true match has moderate lift (see form-label, where labelConfusionRisk — 66 elements, lift 202 — is the plausible mapping but a 2-element pair scored higher and then failed thresholds). The runners-up column carries the correction; this is why proposals are review inputs, not auto-accepts.
+- **Byproduct — taxonomy coverage gaps** (incumbent rules with no tic home; upstream-filing material): qualWeb QW-BP30 (807 instances), ed11y altURLLinked/altMeaningless/altMeaninglessLinked, axe meta-refresh, axe aria-tab-name.

package/validation/act/stage3b-triage-draft.md

@@ -0,0 +1,138 @@
+# Stage-3b triage draft — pour (for human review)
+
+Drafted 2026-09-01 by Claude from `stage3b-mapping-proposals.md` + the reading notes. Every
+verdict below is a **draft for Jeff's accept/override** — semantic judgment calls are marked
+⚠️ where the co-occurrence evidence and the rule semantics disagree (the known ranking quirk).
+Review workflow: scan the ⚠️ rows first (9 of them), then rubber-stamp or override the rest.
+Accepted verdicts become tic entries (initial `quality: 1`) in the next tic version.
+
+## A. Mapping proposals — draft ACCEPT as proposed (24)
+
+The 18 high-confidence accepts from the reading notes, plus 6 where semantics and evidence
+agree cleanly:
+
+| Pour rule | tic issue | Note |
+| --- | --- | --- |
+| empty-heading | headingEmpty | 100% co-rate |
+| button-name | buttonNoText | 97% |
+| heading-order | headingLevelSkip | 95% |
+| landmark-one-main | mainNone | 77% |
+| page-heading-one | h1Not1 | 71% |
+| image-alt | imageNoText | 67% |
+| aria-hidden-focus | focusableHidden | 88% |
+| new-window-link | newTabSurprise | 63% |
+| document-title | pageTitle | 83% |
+| bypass-blocks | skipRepeatedContent | 100% |
+| autocomplete-valid | autocompleteBad | 100% |
+| multiple-labels | labelNot1 | 100% |
+| aria-label-misuse | attributeBad | 95% |
+| link-in-text-block | linkIndication | 57% |
+| listitem-parent | listItemOrphan | 45%, no plausible rival |
+| redundant-image-alt | imageTextRedundant | 69% |
+| color-contrast | contrastAA | 49% — plus contrastRisk co-fire is expected (bands) |
+| color-contrast-enhanced | contrastAAA | 43% |
+| aria-allowed-attr | ariaAttributeBad | 48%, semantic exact |
+| meta-viewport | metaBansZoom | 95%, semantic exact |
+| scrollable-region-focusable | keyboardScroll | 28% co-rate but semantic exact — incumbents fire rarely |
+| html-lang | pageLanguage | 100% |
+| frame-title | iframeTitleBad | 73% |
+| meta-refresh | refresh | 96% — also fills the axe:meta-refresh coverage gap |
+| list-structure | listChild | 95% |
+| aria-attr-valid | ariaAttributeBad | 100% (9 el) |
+| positive-tabindex | tabIndexPositive | 100% |
+
+(27 rows — three of the "33 proposals" move to §B/§C below instead.)
+
+## B. Mapping proposals — draft SPLIT (3)
+
+| Pour rule | Draft | Rationale |
+| --- | --- | --- |
+| link-name | **split → imageLinkNoText / linkNoText** by flagged-element content (contains img/svg → imageLinkNoText, else linkNoText) | Both co-fire strongly (60% / 509-element runner-up); tic distinguishes text links from image links, pour's one rule covers both. Split at mapping time on the instance's element, not the rule. |
+| landmark-top-level | **split → bannerNotTop / mainNotTop / footerNotTop / asideNotTop** by landmark role | The tic *NotTop family is per-landmark; pour's one rule covers all. Runner-up evidence shows exactly this family. |
+| landmark-unique | ⚠️ **remap → landmarkConfusion** | Proposed bannerNotTop (27%) is a co-occurrence artifact — landmark-unique is about *duplicate/undifferentiated* landmarks, which is landmarkConfusion's semantics (91-element runner-up, lift 177). |
+
+## C. Mapping proposals — draft REJECT the proposed issue, re-disposition (3) — all ⚠️
+
+| Pour rule | Proposed (rejected) | Draft disposition | Rationale |
+| --- | --- | --- | --- |
+| video-loop-motion | videoNoAudioDescription (83%) | **new issue** `motionNoControl` (2.2.2), shared with pause-stop-hide | Rule is about looping/auto-playing motion, not audio description — co-occurrence artifact (pages with video have both defects). |
+| reflow | h1Not1 (42%) | **new issue** `reflowBroken` (1.4.10) | Semantic nonsense as a mapping; 1.4.10 has no incumbent coverage — this is novelty, mis-filed by base-rate. |
+| control-contrast | labelConfusionRisk (57%) | **fold into** the `nonTextContrast` new issue (1.4.11) with non-text-contrast | 1.4.11 control contrast ≠ label confusion; co-occurrence artifact. |
+
+## D. New-issue candidates — draft REMAP to an existing tic issue instead (8) — all ⚠️ except where noted
+
+The ranking quirk in reverse: the right mapping existed but lost on lift/threshold.
+
+| Pour rule | Draft map | Rationale |
+| --- | --- | --- |
+| region | contentBeyondLandmarks | Semantic exact; 722-element runner-up (lift 3.1) lost on co-rate only because region fires far more broadly than the incumbent. |
+| svg-img-alt | svgImageNoText | Semantic exact; incumbent fires so rarely (1 element) the co-rate is meaningless. |
+| nested-interactive | focusableDescendants | Semantic exact (interactive inside interactive), lift 100. |
+| aria-required-children | descendantMissing | Semantic exact (role's required owned children absent), lift 847. |
+| aria-field-name | inputNoText | 82% co-rate, lift 2043 — likely fell out of "proposed" on a threshold technicality. Not ⚠️: evidence and semantics agree. |
+| link-text-generic (+ -only) | linkVaguenessRisk | "Click here"-class generic text is exactly linkVaguenessRisk; runner-up linkTextsSame is a different defect (identical texts, different targets). Map both variants to the same issue; instance dedup absorbs the -only subset. This is pour's ACT sole-detector rule (aizyf1) — do not lose it. |
+| form-label | labelConfusionRisk | Per the reading notes: the 66-element, lift-202 runner-up is the plausible mapping; the 2-element top pair was the quirk example. |
+| media-captions | ⚠️ videoNoTranscript *or* new `mediaNoCaptions` (1.2.2) | Runner-up is close but captions ≠ transcript; Jeff's call whether tic's existing media family covers 1.2.2 or needs the new issue. |
+
+## E. New-issue candidates — draft CONFIRM as genuinely new tic issues (11 rules → 8 issues)
+
+The novelty pour was screened for. Suggested issue IDs follow tic naming style:
+
+| New tic issue | Pour rule(s) | WCAG | Evidence |
+| --- | --- | --- | --- |
+| textSpacingRigid | text-spacing | 1.4.12 | No incumbent equivalent fired anywhere (580 el / 61 pages) |
+| targetSmall | target-size | 2.5.8 AA | tic has no target-size issues (678 el) |
+| targetSmallEnhanced | target-size-enhanced | 2.5.5 AAA | Mirror the contrastAA/AAA banding pattern (8,992 el — volume driver, watch quality) |
+| nonTextContrast | non-text-contrast, control-contrast | 1.4.11 | No incumbent; control-contrast folded in from §C |
+| focusIndicatorMissing | focus-visible | 2.4.7 | 167 pages — page-level rule |
+| focusObscured | focus-not-obscured | 2.4.11 | New-in-2.2 criterion, no incumbent |
+| motionNoControl | pause-stop-hide, video-loop-motion | 2.2.2 | Both halves of the auto-playing/looping motion defect |
+| reflowBroken | reflow | 1.4.10 | From §C |
+| pseudoHeading | p-as-heading | 1.3.1 | Visual heading not marked up; no incumbent fired |
+| canvasNoText | canvas-alt | 1.1.1 | Canvas is not an img; imageNoText would blur element semantics |
+| ariaRedundant | redundant-aria, redundant-aria-label, redundant-tabindex, redundant-role | best practice | Pour's "overdoing it" family as one issue, `quality: 1`; per-rule granularity preserved in instances |
+
+Also: redundant-alt-phrase → new issue `altPhraseRedundant`, and note it likely also homes
+the unmapped incumbents ed11y:altMeaningless/altMeaninglessLinked (kills two coverage-gap
+birds). aria-valid-refs → new issue `ariaRefBroken` (broken ID references) unless Jeff reads
+tic's ariaMissing as covering it.
+
+## F. New-issue candidates — draft QUALITY-0 / park (2)
+
+| Pour rule | Draft | Rationale |
+| --- | --- | --- |
+| button-type | quality-0 | Implicit-submit is a behavior bug more than an a11y defect; weak evidence (17 el) |
+| no-autofocus | quality-0 | Best-practice; genuine debate whether autofocus is a defect at all; 8 el |
+
+## G. Low-support (11) — draft: park all except three semantic gifts
+
+Park (insufficient evidence, revisit if Stage 4 surfaces them): definition-list,
+aria-required-parent, label-for-valid, visual-order-divergence, auth-field-obstruction,
+composite-widget-name, valid-role, fieldset-legend.
+
+Map now despite low support (semantics are exact and unambiguous):
+
+| Pour rule | tic issue | Note |
+| --- | --- | --- |
+| area-alt | linkNoText | Image-map areas are links; 100% co-rate, 47 el (one page) |
+| dialog-name | dialogNoText | 100% co-rate, semantic exact |
+| table-headers | tableHeaderless | Runner-up is semantically exact |
+
+## Tally
+
+- 24 accepts + 3 splits + 8 remaps + 3 low-support maps = **38 mapped pour rules**
+- 13 rules → **~13 new tic issues** (8 novel families incl. multi-rule groupings)
+- 2 quality-0, 8 parked
+- ⚠️ rows needing real human judgment: **9** (landmark-unique, the three §C rejects,
+  region/svg-img-alt/nested-interactive/aria-required-children remaps if the co-rate
+  bothers you, media-captions)
+
+## After sign-off
+
+1. Author tic entries (next tic version) in the testilo fork: mapped rules at `quality: 1`;
+   new issues with WCAG + weight; splits implemented in the mapping layer per §B.
+2. Re-run the evaluation slice as the Stage-4 `study_runs` row with mappings live
+   (this is also the app-tier load-baseline measured window).
+3. Byproduct filings: taxonomy coverage gaps (qualWeb QW-BP30 × 807, ed11y alt* family,
+   axe meta-refresh → homed by the §A/§E work above), pour FP classes with rates
+   (fp-triage-2026-08-22.md).

package/validation/act/surea11y-track-a-2026-09-01.md

@@ -0,0 +1,50 @@
+# Track A — surea11y, full ACT run (2026-09-01)
+
+Capture: `results/surea11y-full-2026-09-01.jsonl` (1,213 testcases, 1,196 ran, 17 prevented —
+the known redirecting-fixture class). Scored `--band asserted`;
+`results/surea11y-full-2026-09-01-asserted.json`. Comparison figures are the merged
+2026-08-22 full run (`merged-full-2026-08-22-asserted.json`), same fixtures, same
+criterion-level scoring layer for pour/axe/surea11y (qualWeb keeps its native-ACT scoring
+advantage).
+
+## Aggregate (any-engine detection subset — 47 rules with surea11y included, was 43)
+
+| Engine | Sensitivity | Specificity | TP | FN | FP | TN |
+| --- | --- | --- | --- | --- | --- | --- |
+| qualWeb | 85.9% | 99.1% | 213 | 35 | 5 | 527 |
+| **surea11y** | **68.6%** | **92.0%** | 151 | 69 | 37 | 425 |
+| pour | 51.1% | 91.7% | 112 | 107 | 37 | 407 |
+| axe | 33.2% | 96.0% | 73 | 147 | 19 | 453 |
+
+surea11y clears the Stage-2 gate: specificity ≥ incumbent median, and sensitivity is the
+best of any criterion-layer engine — +17.5 points over pour at equal specificity.
+
+## Net-new coverage
+
+Sole detector across all four engines: `e88epe` (image not in accessibility tree is
+decorative — 20% sens, but nobody else scores at all).
+
+Detects where pour misses (7): the three **1.4.12 text-spacing** rules (24afc2 / 78fd32 /
+9e45ec, all 100/100 — ACT-fixture confirmation of the same novelty pour's Stage-3b flagged
+in the wild), **b33eff orientation lock** (100/100), **bisz58 meta-refresh no-exception**
+(100/100), akn7bn iframe tab-order, e88epe.
+
+Misses where pour detects (3): aizyf1 (link is descriptive — pour's marquee sole-source
+stays unique to pour), 6cfa84 (aria-hidden focusable content), 80f0bf (auto-playing audio).
+**The engines are complementary, not redundant** — each keeps sole-source value if both
+were adopted.
+
+## FP hotspots (Stage-3 should measure their in-the-wild rates)
+
+| ACT rule | FP | Note |
+| --- | --- | --- |
+| 4b1c6c iframe identical accessible names | 11 (TP 2) | Dominant FP class — over-asserts equivalence judgments the fixture set treats as `cantTell` territory |
+| ucwvc8 page-language subtag matches content | 4 (TP 0) | Same lang-heuristic FP class pour had; pour's Stage-3a showed it ~absent in the wild |
+| e086e5 / 2t702h / akn7bn / qt1vmo / bc4a75 / e88epe | 2–3 each | Small; triage with Stage-3 rates |
+
+## Verdict
+
+Stage-2 gate **passed**. Next per pipeline: Stage-3 capture over the evaluation slice
+(`--urls yra-100k/data/stage3a-sample-300.txt`, engines surea11y + incumbents) — ran-rate,
+latency distribution, trigger-happy screen, and the 4b1c6c FP class's real-world rate; then
+3b mapping bootstrap off the same capture.