# Accessibility

**Test family:** `A11Y`

Apply these to the task, not mechanically to every pixel. Cross-cutting failures often emerge only through interactions with domain item files.

- **A11Y-001** Every task is operable by keyboard alone with logical order and visible focus.
- **A11Y-002** Controls expose correct role, name, state, value, relationships, errors, and live updates.
- **A11Y-003** Headings, landmarks, lists, tables, forms, dialogs, and page title convey structure.
- **A11Y-004** Focus moves/restores intentionally after open/close, submit error/success, route change, add/delete/reorder, and live update.
- **A11Y-005** Text/controls/status meet contrast; meaning never depends on color, shape, position, hover, sound, or motion alone.
- **A11Y-006** At 200% text and 400% zoom/reflow, core task works without clipped content or two-dimensional scrolling except inherently 2D data.
- **A11Y-007** Touch targets, spacing, orientation, pointer cancellation, and alternatives for path/drag/multipoint gestures are usable.
- **A11Y-008** Screen reader reads labels, instructions, required/error, progress, toast, table/chart alternatives, and modal boundaries.
- **A11Y-009** Reduced-motion preference removes nonessential animation; essential motion has pause/stop.
- **A11Y-010** Captions/transcripts/audio description and no-audio alternatives fit media.
- **A11Y-011** Automated scans are only a floor; manually exercise keyboard, focus, reflow, and a screen-reader smoke path.

## Comprehensive per-item coverage

- **A11Y-012** Apply the quality concern to absent, empty, ordinary, boundary-size, malformed, stale, concurrent, and failure-state data.
- **A11Y-013** Include text containing ASCII emoticons, emoji/ZWJ sequences, kaomoji, accents, mixed scripts, RTL, combining marks, confusables, invisible characters, and control characters.
- **A11Y-014** Exercise UI, API, import/export, automation, mobile, background jobs, notifications, analytics, logs, caches, and stored representations.
- **A11Y-015** Test anonymous, ordinary, privileged, suspended, removed, and cross-tenant actors with least privilege and final-commit authorization.
- **A11Y-016** Use fresh, stale, conflicting, deleted, archived, and partially migrated records; expose uncertainty rather than silently choosing.
- **A11Y-017** Repeat and race operations before commit, after commit before response, and after partial downstream success; require safe idempotency.
- **A11Y-018** Force timeout, disconnect, quota, dependency error, malformed response, regional failover, and recovery failure.
- **A11Y-019** Use supported browsers, devices, network qualities, locales, time zones, input methods, and assistive technologies.
- **A11Y-020** Measure median and tail latency, throughput, resource use, queue depth, retries, and degradation at normal and supported boundary load.
- **A11Y-021** Use inert injection canaries across markup, script, SQL, templates, commands, paths, headers, CSV formulas, and logs.
- **A11Y-022** Inspect URL, referrer, DOM, storage, clipboard, telemetry, logs, traces, notifications, exports, caches, backups, and screenshots for leakage.
- **A11Y-023** Verify labels, roles, names, descriptions, focus, keyboard behavior, announcements, reflow, contrast, motion, alternatives, and error recovery.
- **A11Y-024** Translate and lengthen text, switch RTL/LTR direction, change number/date/currency formats, and use unsupported glyph fallbacks.
- **A11Y-025** Delete, restore, archive, expire, retain, export, anonymize, and purge; reconcile user-visible, indexed, cached, and backed-up state.
- **A11Y-026** Verify one coherent audit trail with actor, authority, target, old/new state, time, source, correlation ID, attempts, and outcome.
- **A11Y-027** Define observable success and failure signals, alert thresholds, dashboards, ownership, runbooks, and a way to test the monitors.
- **A11Y-028** Compare intended requirement, implementation, deployed behavior, and evidence; do not promote inspected code or a single run into a pass.
- **A11Y-029** Segment results by role, tenant, locale, platform, data shape, load, and consequential workflow so averages do not hide severe failures.
- **A11Y-030** Run destructive, high-volume, privacy-invasive, and security probes only in an authorized isolated environment with recovery and stop conditions.
- **A11Y-031** State residual risk, untested combinations, evidence tier, confidence limits, rollback trigger, and owner before recommending release.

[Back to Cross-cutting quality index](../../cross-cutting.md)
