{ "url": "https://xhclub.live", "auditedAt": "2026-07-26T17:36:37.132Z", "mode": "report", "status": "completed", "statusDetail": "Coverage complete across 58 atomic checks and seven representative paths. No local source was supplied; no fixes were applied.", "page": { "appType": "mpa", "framework": "Server-rendered multi-page application with deferred client-side enhancement", "notes": "Public media catalog with homepage/listings, search, detail, sign-up, localisation, service worker, and legal age-verification gate. Not covered: authenticated library/history, completed identity verification, upload/creator workflows, payments, or actual media playback because they require account/identity state or consequential interaction." }, "evidenceUsed": [ "screenshot", "dom", "layout-metrics", "evaluate-probe", "discoverability", "trace", "har", "headers", "cookies", "trackers", "secrets", "images", "heap-summary", "lighthouse", "curl-http-status", "modern-web-guidance" ], "guidanceConsulted": [ "dark-mode", "accessibility", "same-document-transitions", "scrollytelling", "physics-based-easing", "shrinking-header-on-scroll", "position-aware-tooltips", "directional-navigation-transitions", "declarative-dialog-popover-control", "fluid-scaling", "size-aware-styling", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "identify-inp-causes", "break-up-long-tasks", "optimize-script-priority", "optimize-image-priority", "identify-heavy-scripts", "html", "security", "privacy", "passkeys", "flicker-free-client-side-ab-testing", "resilient-context-menus-and-nested-dropdowns", "translator", "autofill-sign-up-form", "deliver-optimized-decorative-images", "deprioritize-background-fetches", "webmcp", "manage-recurring-intervals" ], "artifacts": [ { "type": "other", "path": "evidence/404-probe.json", "caption": "404 probe", "findingIds": [] }, { "type": "layout", "path": "evidence/category-layout.json", "caption": "category layout", "findingIds": [ "F07" ] }, { "type": "screenshot", "path": "evidence/category-mobile.png", "caption": "category mobile", "findingIds": [ "F08" ] }, { "type": "other", "path": "evidence/contrast-probe.json", "caption": "contrast probe", "findingIds": [] }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies", "findingIds": [ "F21" ] }, { "type": "other", "path": "evidence/css-script-probe.json", "caption": "css script probe", "findingIds": [ "F02", "F03", "F04", "F08", "F12" ] }, { "type": "screenshot", "path": "evidence/detail-mobile.png", "caption": "detail mobile", "findingIds": [ "F06" ] }, { "type": "other", "path": "evidence/detail-probe.json", "caption": "detail probe", "findingIds": [ "F20" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler", "findingIds": [ "F19" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered", "findingIds": [ "F19" ] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "discoverability", "findingIds": [ "F19" ] }, { "type": "other", "path": "evidence/guidance-list.json", "caption": "guidance list", "findingIds": [] }, { "type": "other", "path": "evidence/guidance-retrieved.md", "caption": "guidance retrieved", "findingIds": [] }, { "type": "other", "path": "evidence/headers.json", "caption": "headers", "findingIds": [ "F21", "F23" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark", "findingIds": [ "F15" ] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop", "findingIds": [] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom", "findingIds": [] }, { "type": "heap", "path": "evidence/home-heap.json", "caption": "home heap", "findingIds": [ "F30" ] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "home mobile layout", "findingIds": [ "F07", "F11", "F17", "F19" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile", "findingIds": [ "F03", "F06", "F07", "F08" ] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "home summary", "findingIds": [ "F12", "F22", "F28" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary", "findingIds": [ "F10", "F11" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "home trace", "findingIds": [ "F10" ] }, { "type": "har", "path": "evidence/home.har", "caption": "home", "findingIds": [ "F12", "F22", "F28" ] }, { "type": "other", "path": "evidence/i18n-german.json", "caption": "i18n german", "findingIds": [] }, { "type": "other", "path": "evidence/images.json", "caption": "images", "findingIds": [ "F18", "F27" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-home.json", "caption": "lighthouse home", "findingIds": [ "F10", "F13", "F14", "F15", "F16", "F17", "F18", "F29" ] }, { "type": "other", "path": "evidence/memory-samples.json", "caption": "memory samples", "findingIds": [] }, { "type": "other", "path": "evidence/platform-probe.json", "caption": "platform probe", "findingIds": [ "F09", "F14", "F16", "F29" ] }, { "type": "other", "path": "evidence/preferences.json", "caption": "preferences", "findingIds": [ "F01" ] }, { "type": "other", "path": "evidence/recon.json", "caption": "recon", "findingIds": [] }, { "type": "other", "path": "evidence/routes.json", "caption": "routes", "findingIds": [] }, { "type": "screenshot", "path": "evidence/search-mobile.png", "caption": "search mobile", "findingIds": [] }, { "type": "other", "path": "evidence/search-probe.json", "caption": "search probe", "findingIds": [] }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets", "findingIds": [] }, { "type": "other", "path": "evidence/signup-email-state.json", "caption": "signup email state", "findingIds": [ "F05", "F14", "F24", "F25", "F26" ] }, { "type": "screenshot", "path": "evidence/signup-mobile.png", "caption": "signup mobile", "findingIds": [ "F04", "F05", "F07", "F08", "F24" ] }, { "type": "other", "path": "evidence/signup-probe.json", "caption": "signup probe", "findingIds": [] }, { "type": "other", "path": "evidence/site-files.json", "caption": "site files", "findingIds": [ "F20" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers", "findingIds": [ "F22" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "pass", "confidence": "high", "method": "HINT (not mandatory): a screenshot or computed background under an emulated prefers-color-scheme: dark condition will reveal whether surfaces re-tint; the page CSS / a color-scheme declaration is corroborating evidence. The model chooses the method. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Under prefers-color-scheme: dark the page selected dark theme tokens and retinted surfaces; the dark screenshot confirms a coherent dark presentation.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dark.png", "evidence/preferences.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "issues", "confidence": "high", "method": "HINT: a transition video, or an in-page probe of getAnimations()/computed animation under an emulated prefers-reduced-motion: reduce condition, can show whether motion stops. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The preference probe matched prefers-reduced-motion: reduce but still found eight running animations, each with a 2000 ms duration.", "pathIds": [ "home" ], "artifacts": [ "evidence/preferences.json" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "HINT: a screenshot under emulated prefers-contrast: more / forced-colors, or an axe/contrast probe, can show whether controls and text survive. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Under forced-colors: active and prefers-contrast: more, links resolved to system yellow and controls to system black/white with visible borders.", "pathIds": [ "home" ], "artifacts": [ "evidence/contrast-probe.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "HINT: a transition video of a route/state change shows whether it animates; the page source / ::view-transition usage corroborates. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "CSS/DOM inspection found no view-transition rules or calls even though the site has many MPA navigations and modal state changes.", "pathIds": [ "home", "detail" ], "artifacts": [ "evidence/css-script-probe.json" ], "findingIds": [ "F02" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "pass", "confidence": "medium", "method": "HINT: source/CSS inspection for animation-timeline: scroll()/view(); a long-task / scroll-handler probe can flag the main-thread anti-pattern. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "CSS inspection found no animation-timeline or scroll-driven animation implementation and layout evidence found only two startup long tasks, not continuous scroll-handler work.", "pathIds": [ "home", "detail" ], "artifacts": [ "evidence/css-script-probe.json", "evidence/home-mobile-layout.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "medium", "method": "HINT: CSS inspection for scroll-snap / overscroll-behavior / physics-based easing vs custom pointermove listeners. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The audited listing uses native scrolling and links; inspection found no scroll-snap surface or custom pointer gesture that overrides platform physics.", "pathIds": [ "home", "detail" ], "artifacts": [ "evidence/css-script-probe.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "issues", "confidence": "high", "method": "HINT: a transition video of scrolling, or CSS inspection for scroll-state container queries. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The narrow screenshot shows multiple fixed-height header, verification, and promotional bands consuming the initial viewport; CSS inspection found no scroll-state adaptation.", "pathIds": [ "home", "search", "signup" ], "artifacts": [ "evidence/home-mobile.png" ], "findingIds": [ "F03" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "issues", "confidence": "high", "method": "HINT: CSS inspection for anchor-name / position-anchor / position-try on overlays; a screenshot of an open overlay near a viewport edge can show drift. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The page exposes dropdown and sign-up overlay surfaces, but CSS inspection found no anchor-positioning signals; the sign-up panel is mostly offscreen at 360 px.", "pathIds": [ "home", "search", "signup" ], "artifacts": [ "evidence/signup-mobile.png", "evidence/css-script-probe.json" ], "findingIds": [ "F04" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "HINT: CSS inspection for ::highlight / scroll-marker; a transition video can show whether attention is cued after navigation. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Home, search, detail, and error surfaces each expose a prominent heading or primary recovery/action label, and search redirects to a clearly titled results page.", "pathIds": [ "home", "search", "signup" ], "artifacts": [ "evidence/home-desktop.png", "evidence/search-probe.json", "evidence/404-probe.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "HINT: a screenshot on load, or a DOM probe for full-viewport overlays present before interaction. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The load screenshots show age and consent messaging without a full-viewport blocking interstitial over the catalog; core headings and listings remain present.", "pathIds": [ "home", "detail", "signup" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "HINT: DOM/source inspection for popover / /
vs custom overlay divs with manual dismiss handling. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "After expanding email sign-up, the probe found a DIV role=dialog rather than a dialog element; controls and focus behavior are manually assembled.", "pathIds": [ "home", "detail", "signup" ], "artifacts": [ "evidence/signup-email-state.json" ], "findingIds": [ "F05" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "issues", "confidence": "high", "method": "HINT: a screenshot plus layout metrics can show the proportion of the viewport given to chrome vs content. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The 360x800 homepage shows two navigation rows, an age-verification strip, a sale banner, and a 200 px sidebar before the clipped listing; the detail page repeats the stack.", "pathIds": [ "home", "detail", "signup" ], "artifacts": [ "evidence/home-mobile.png" ], "findingIds": [ "F06" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "issues", "confidence": "high", "method": "HINT: layout metrics (scrollWidth vs innerWidth) and a screenshot at an emulated narrow mobile viewport reveal overflow. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "At a 360 px visual viewport, layout reported scrollWidth and innerWidth 1024 with 664 px overflow on both home and category pages. The sign-up panel appears mostly offscreen.", "pathIds": [ "home", "category", "search", "detail", "signup" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/category-layout.json" ], "findingIds": [ "F07" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "HINT: CSS inspection for @container / container-type; a computed-style probe of the same component in a wide vs narrow container shows whether it adapts. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The same desktop sidebar/card composition remains 1024 px wide at a 360 px viewport; computed inspection found zero container-query containers.", "pathIds": [ "home", "category", "search", "detail", "signup" ], "artifacts": [ "evidence/css-script-probe.json", "evidence/signup-mobile.png" ], "findingIds": [ "F08" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "HINT: a focus probe (focus an element, read the computed outline) or an axe target-size check; a screenshot of a focused control corroborates. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The active focus probe found outline-style none on search input/button, login, navigation links, and numerous sidebar links; most also had no focus box shadow.", "pathIds": [ "home", "category", "search", "detail", "signup" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F09" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "HINT: screenshot the first viewport and key scrolled states; inspect heading structure, nav labels, button text, and visual hierarchy; a task walkthrough can show whether the next action is obvious. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The homepage title, H1, navigation labels, search field, and listing make content discovery purpose and next actions explicit.", "pathIds": [ "home", "search", "detail", "signup", "error404" ], "artifacts": [ "evidence/recon.json", "evidence/home-desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "HINT: run the flow manually with screenshots/DOM snapshots at each step; compare expected vs actual path length; inspect form requirements, navigation continuity, and blockers. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "A query reached /search/british with an H1 and 62 result links; the representative detail and sign-up entry states loaded with clear actions.", "pathIds": [ "home", "search", "detail", "signup", "error404" ], "artifacts": [ "evidence/search-probe.json", "evidence/detail-probe.json", "evidence/signup-email-state.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "pass", "confidence": "high", "method": "HINT: exercise network delay/failure, invalid input, empty data and success states; screenshot the state messaging and recovery controls; inspect whether browser history and focus remain sensible. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "A nonexistent route returned HTTP 404, titled itself Page not found, explained the error, and provided Return to Home Page recovery.", "pathIds": [ "home", "search", "detail", "signup", "error404" ], "artifacts": [ "evidence/404-probe.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "HINT: Lighthouse reports LCP/CLS/TBT directly and the model may run it; layout metrics + a layout-shift observer + a long-task observer (the evidence primitives) give the same signal first-party. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Lighthouse measured FCP and LCP at 4.0 s (performance 0.77); the desktop trace measured LCP 2.15 s, showing the mobile path is the weak condition.", "pathIds": [ "home", "category" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "HINT: the layout primitive's CLS observer captures shifts; a transition video of the first seconds shows content jumping. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The narrow layout observer recorded CLS 0 with no layout-shift entries over the observation window on home and category pages.", "pathIds": [ "home", "category" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/category-layout.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "HINT: the layout primitive records long tasks; a heap summary shows the object population; Lighthouse reports TBT. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The trace recorded two long tasks, the longest 151.73 ms, and 142.54 ms total blocking time; mobile layout observation also found a 155 ms task.", "pathIds": [ "home", "category" ], "artifacts": [ "evidence/home-trace-summary.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "HINT: a HAR summary can reveal cache headers, redirects, render-blocking candidates, weight offenders and dependency shape; a trace/Lighthouse insight report can corroborate LCP discovery, render-blocking, font-display and document latency. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "HAR captured 143 requests and 1.77 MB transferred, including 62 scripts (997 KB), 11 stylesheets, and 116 third-party-origin requests. Several parser-inserted stylesheets are VeryHigh priority.", "pathIds": [ "home", "category" ], "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "findingIds": [ "F12" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "HINT: Lighthouse/trace/code-coverage style evidence can flag unused JS/CSS, duplicated JavaScript and legacy code; a HAR summary shows third-party byte cost and request count. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Lighthouse estimated 56 KiB unused CSS (89-94% of two sheets) and 26 KiB unused JavaScript (56% of assetsLoader.js).", "pathIds": [ "home", "category" ], "artifacts": [ "evidence/lighthouse-home.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "HINT: axe-core (injectable via the evaluate primitive) or Lighthouse's a11y audits enumerate these; a DOM probe of the accessibility-relevant attributes is a first-party alternative. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Lighthouse found two unnamed buttons, multiple visible-duration/aria-label mismatches, and a video list containing direct div/role children instead of list items. The sign-up form has unlabeled duplicate email inputs.", "pathIds": [ "home", "signup" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/signup-email-state.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "HINT: axe contrast rules, a Lighthouse contrast audit, or an in-page probe computing contrast ratios from computed colours. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Lighthouse found 13 contrast failures, including 2.15:1 and 1.75:1 text on the green verification banner and 3.29:1 metadata on #202020.", "pathIds": [ "home", "signup" ], "artifacts": [ "evidence/lighthouse-home.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "HINT: axe/Lighthouse structural audits; a focus-walk probe (tab through, read activeElement + computed outline) is a first-party alternative. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Programmatic focus showed no visible outline across primary controls, while Lighthouse found malformed list structure and an accessibility-tree failure.", "pathIds": [ "home", "signup" ], "artifacts": [ "evidence/platform-probe.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "HINT: a screenshot of body and heading text, plus CSS inspection for text-wrap / text alignment / font fallback handling. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Screenshots show consistent text sizing and hierarchy, with one H1 followed by H2 on home; no text-overlap failure was observed on the desktop canvas.", "pathIds": [ "home", "signup" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "HINT: Lighthouse/axe target-size, meta-viewport and media-caption audits are useful signals; screenshots at narrow and zoomed conditions plus DOM/media inspection can corroborate. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Lighthouse reports user-scalable=no, target-size failures, and the narrow layout probe reports 664 px horizontal overflow.", "pathIds": [ "home", "signup" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-mobile-layout.json" ], "findingIds": [ "F17" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "HINT: capture Runtime/Log CDP events, or a probe that reads collected errors; Lighthouse reports this too. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Lighthouse reported no browser errors logged to the console.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "HINT: a DOM/source probe for doctype/charset/img dimensions; CSS inspection for repetition; Lighthouse best-practices audits cover the rest. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The image audit found 29 of 36 images without explicit dimensions, 12 oversized images, one missing alt, and Lighthouse found invalid list children.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F18" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "pass", "confidence": "high", "method": "HINT: Lighthouse best-practices audits and DevTools inspector/deprecation signals can surface these; DOM/source probes can verify paste handlers and prompt timing. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Lighthouse reported no DevTools Issues and confirmed the page did not prevent back/forward cache restoration; no permission prompt fired on load.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/platform-probe.json" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "HINT: a DOM probe reads and meta[name=description]; Lighthouse SEO audits cover the same ground. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Home and detail probes found unique, descriptive titles and meta descriptions that match visible content.", "pathIds": [ "home", "detail" ], "artifacts": [ "evidence/recon.json", "evidence/detail-probe.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "HINT: a DOM probe for anchor hrefs, viewport meta, and robots; Lighthouse SEO audits corroborate. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Raw HTML contains 88% of rendered content and links have hrefs, but home/category layout remains 1024 px wide in a 360 px viewport.", "pathIds": [ "home", "detail" ], "artifacts": [ "evidence/discoverability.json", "evidence/home-mobile-layout.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "pass", "confidence": "high", "method": "HINT: inspect response status and headers, <link rel=canonical>, hreflang links, robots meta, robots.txt and sitemap.xml; Lighthouse SEO audits cover several of these. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Home and detail expose canonical URLs, robots.txt returned 200, public content returned 200, and a synthetic missing path correctly returned 404.", "pathIds": [ "home", "detail" ], "artifacts": [ "evidence/recon.json", "evidence/detail-probe.json", "evidence/site-files.json", "evidence/404-probe.json" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "HINT: inspect JSON-LD/microdata and social preview tags against visible content; Lighthouse has a manual structured-data audit, and ad-hoc probes can parse schema.org blocks. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The representative detail page provides Open Graph metadata but no application/ld+json block; /sitemap.xml also returned 404.", "pathIds": [ "home", "detail" ], "artifacts": [ "evidence/detail-probe.json", "evidence/site-files.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "HINT: inspect response headers / page protocol via an evaluate probe or the network layer; Lighthouse best-practices flags HTTPS and CSP issues. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Headers use CSP only for frame-ancestors, omit X-Content-Type-Options and Referrer-Policy, and four of five cookies were flagged insecure; settings and g_state are SameSite=None without Secure.", "pathIds": [ "home", "signup" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F21" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "HINT: inspect network requests and third-party origins; a probe of analytics/beacon calls. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "HAR attributed 116 of 143 requests and 1.58 MB of 1.77 MB to third-party origins; tracker enumeration saw 12 third-party origins, including an ad endpoint and Google identity.", "pathIds": [ "home", "signup" ], "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "HINT: a probe for permission requests fired on load; source inspection for passkey / WebAuthn / navigator.credentials usage in auth flows. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "No permission prompt or permission-related request fired on load; sign-up offers user-initiated identity choices and correctly marks the new password autocomplete token.", "pathIds": [ "home", "signup" ], "artifacts": [ "evidence/platform-probe.json", "evidence/signup-email-state.json" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "HINT: inspect response headers and browser security state; Lighthouse/DevTools security audits can corroborate HSTS, clickjacking, Trusted Types, origin isolation and third-party cookie findings. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The headers probe found no nosniff or Referrer-Policy and a CSP limited to frame-ancestors; the Permissions-Policy only declares two client-hint features.", "pathIds": [ "home", "signup" ], "artifacts": [ "evidence/headers.json" ], "findingIds": [ "F23" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "high", "method": "HINT: load with scripting disabled or compare a no-JS fetch of the HTML against the rendered page; check for Baseline-aware fallbacks in source. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Discoverability measured 88% raw/rendered content overlap, with title, H1, and description in raw HTML and no empty JS shell.", "pathIds": [ "home", "signup", "error404" ], "artifacts": [ "evidence/discoverability.json" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "issues", "confidence": "high", "method": "HINT: exercise menus near viewport edges with a screenshot; a probe of async/visibility behaviour. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "At 360x800 the sign-up surface is rendered largely beyond the right edge; after interaction it is a custom role=dialog rather than a platform top-layer primitive.", "pathIds": [ "home", "signup", "error404" ], "artifacts": [ "evidence/signup-mobile.png", "evidence/signup-email-state.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "pass", "confidence": "medium", "method": "HINT: a probe for a service worker registration and a web app manifest; test behaviour offline. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The platform probe found an active service-worker registration and a 200 web app manifest with start_url, scope, icons, and display mode.", "pathIds": [ "home", "signup", "error404" ], "artifacts": [ "evidence/platform-probe.json", "evidence/site-files.json" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "pass", "confidence": "high", "method": "HINT: simulate failed fetches/offline mode or inspect representative 404/500 routes; screenshots and DOM snapshots of error/loading/empty states show whether recovery is possible. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The server returned a real HTTP 404 with explanatory text, support guidance, and a home recovery link.", "pathIds": [ "home", "signup", "error404" ], "artifacts": [ "evidence/404-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "HINT: a DOM probe for <html lang>/dir and CSS inspection for logical vs physical properties. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The English page declares lang=en; the German locale declares lang=de and renders translated title and H1 content.", "pathIds": [ "home", "german" ], "artifacts": [ "evidence/recon.json", "evidence/i18n-german.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "pass", "confidence": "medium", "method": "HINT: source inspection for Intl.* usage vs hand-rolled formatting; a probe of rendered dates/numbers under a different locale. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The German locale changed page language and core labels rather than serving English-only content; compact view counts and media durations remain understandable.", "pathIds": [ "home", "german" ], "artifacts": [ "evidence/i18n-german.json" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "HINT: source inspection for time-zone-aware date handling vs naive local Date math. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "No selected public archetype displays or edits a calendar/time-zone-sensitive value; visible media durations are elapsed durations, not civil times.", "reason": "No selected public archetype displays or edits a calendar/time-zone-sensitive value; visible media durations are elapsed durations, not civil times." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "HINT: a screenshot of consent/upsell/cancel flows; source inspection for declarative button actions vs misleading controls. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The consent surface presents explicit Accept and Reject controls, third-party content is labelled, and the age-verification requirement is explained as a legal requirement.", "pathIds": [ "home", "signup" ], "artifacts": [ "evidence/signup-probe.json", "evidence/home-desktop.png" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "HINT: exercise a form, submit invalid input, and observe timing and clarity of errors via a screenshot or a :user-invalid / aria-invalid probe. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "After choosing email sign-up, two text inputs share name=email, neither is required or labelled, and the form exposes no field-level error semantics before submission.", "pathIds": [ "home", "signup" ], "artifacts": [ "evidence/signup-email-state.json" ], "findingIds": [ "F25" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "HINT: source/DOM inspection for autocomplete attributes on form fields; a probe of autofill affordances. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The sign-up probe found both email fields set to autocomplete=off while the password correctly uses autocomplete=new-password.", "pathIds": [ "home", "signup" ], "artifacts": [ "evidence/signup-email-state.json" ], "findingIds": [ "F26" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "high", "method": "HINT: walkthrough checkout/subscription/auth/account flows when present; screenshot pricing, confirmation, cancellation and reauthentication states; inspect passkey/autocomplete support for sign-in and payment. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The sign-up surface discloses age-verification implications, public-data use, Terms of Use, and Privacy Policy before account creation.", "pathIds": [ "home", "signup" ], "artifacts": [ "evidence/signup-probe.json" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "HINT: inspect transferred image bytes vs displayed size; source inspection for modern formats and resolution handling. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The image audit found 12 oversized images, 14 legacy-format detections, 29 missing dimensions, and 8 below-fold images not lazy-loaded.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json" ], "findingIds": [ "F27" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "pass", "confidence": "high", "method": "HINT: a long-task / network probe for background fetches and processing while idle or backgrounded. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The sampled repeated-scroll sequence kept DOM nodes fixed at 1,955 and animations fixed at 13; no unbounded fetch/list growth was observed during the short idle interaction window.", "pathIds": [ "home" ], "artifacts": [ "evidence/memory-samples.json", "evidence/home-summary.json" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "HINT: a HAR summary shows third-party bytes, font/media weight and caching; screenshots/video reveal autoplay and decorative media; trace/layout evidence shows whether media/animation keeps work running. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Third-party origins account for 1.58 MB and 116 requests; scripts alone transfer 997 KB, with a 400 KB index bundle and 98 KB Google identity script among the largest offenders.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "findingIds": [ "F28" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "issues", "confidence": "high", "method": "HINT: source inspection for WebMCP / agentic-tool registration and agent-readable affordances. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The platform probe found no agent/WebMCP surface and Lighthouse agentic-browsing scored 0.5 despite a clear search/filter task and form journey.", "pathIds": [ "home", "search", "signup" ], "artifacts": [ "evidence/platform-probe.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F29" ] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "HINT: source inspection for built-in AI (language model / summariser) usage. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The audited catalog/search/account journeys do not offer summarisation, generation, or another core inference feature that should run on-device.", "reason": "The audited catalog/search/account journeys do not offer summarisation, generation, or another core inference feature that should run on-device." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "medium", "method": "HINT (not mandatory): compare heap snapshots for retained growth - a baseline, then one taken after repeating the interaction with `--interact` about 10x (the memory-tracer methodology: baseline -> repeat -> post -> compare). Performance.getMetrics (JSHeapUsedSize, Nodes) across the same before/after window is corroboration. If Chrome DevTools MCP is available, follow its memory-leak-debugging skill: capture baseline, target, and final snapshots, then use memlab or the provided comparison workflow rather than reading raw .heapsnapshot files directly. The package-native `heap` primitive remains the default path. This check is only meaningful where the page has a real interaction to repeat; for a static page with none, mark it not-applicable with a rationale rather than fabricating one. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "Across five repeated bottom/top scroll cycles, DOM nodes remained exactly 1,955 and JS heap rose only about 0.34 MB without monotonic DOM or animation accumulation.", "pathIds": [ "home" ], "artifacts": [ "evidence/memory-samples.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "issues", "confidence": "high", "method": "HINT: a single `heap` summary's totals (nodeCount, totalSelfSizeBytes, constructor population) plus Performance.getMetrics (Nodes, JSHeapUsedSize) give the current footprint to judge against the page's purpose. Chrome DevTools MCP heap snapshots and memlab snapshot analysis can provide the same memory distribution when available. Read summaries or derived analysis, never raw snapshots unless a dedicated heap-analysis tool is doing the analysis. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "A single heap summary contained 667,487 nodes, 3,128,195 edges, 35.5 MB self size, and 93,461 closures.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-heap.json" ], "findingIds": [ "F30" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "HINT: the `heap` summary by constructor (Detached* nodes) compared across a before/after pair shows a growing detached-DOM population; an `evaluate` probe can sample listener/timer counts (e.g. getEventListeners-style counting, or instrumenting addEventListener/setInterval) before and after the repeated interaction to spot growth. Chrome DevTools MCP heap snapshots plus the memory-leak-debugging skill's common-leak guidance can corroborate detached DOM, listeners, closures, globals, and unbounded caches. Caveat from the memory-tracer and Chrome DevTools MCP guidance: detached nodes can be intentional caches, so judge confidence rather than asserting a bug. The model chooses. Evidence was gathered with the referenced artifacts and representative path conditions.", "evidence": "The heap summary did not surface Detached* constructors among large populations, and repeated-scroll samples held DOM node and animation counts constant.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-heap.json", "evidence/memory-samples.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F02" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F03", "F04" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F05", "F06" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F07", "F08", "F09" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F10", "F11", "F12", "F13" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F14", "F15", "F16", "F17" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F18" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F19", "F20" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F21", "F22", "F23" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F24" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F25", "F26" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F27", "F28" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "issues", "findingIds": [ "F29" ] }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F30" ] } ], "paths": [ { "id": "home", "description": "Homepage and primary discovery surface; represents global navigation, promotions, recommendation listing, search entry, and consent/age messaging.", "url": "https://xhclub.live/", "conditions": [ "desktop viewport", "360x800 narrow viewport", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "forced-colors: active", "keyboard focus" ], "result": "issues" }, { "id": "category", "description": "Category listing archetype; represents taxonomy and repeated media-card grids.", "url": "https://xhclub.live/categories/british", "conditions": [ "360x800 narrow viewport" ], "result": "issues" }, { "id": "search", "description": "Primary search journey and results/filter listing reached from a query.", "url": "https://xhclub.live/search/british", "conditions": [ "360x800 narrow viewport" ], "result": "issues" }, { "id": "detail", "description": "Representative media detail page, including title, publisher, metadata, and required age-verification state.", "url": "https://xhclub.live/videos/stepmommys-boy-is-back-xhNYAjv", "conditions": [ "360x800 narrow viewport", "unverified visitor" ], "result": "issues" }, { "id": "signup", "description": "Primary account creation journey through the email-sign-up state.", "url": "https://xhclub.live/signup?source=menuSignup", "conditions": [ "360x800 narrow viewport", "email option expanded" ], "result": "issues" }, { "id": "error404", "description": "Representative HTTP failure and recovery state.", "url": "https://xhclub.live/this-path-should-not-exist-web-uplift", "conditions": [ "HTTP 404" ], "result": "pass" }, { "id": "german", "description": "German locale variant used to verify language metadata and translated content.", "url": "https://ge.xhclub.live/", "conditions": [ "German locale" ], "result": "pass" } ], "findings": [ { "id": "F01", "pathId": "home", "url": "https://xhclub.live/", "principleId": "respect-user-preferences", "principleCheckId": "respects-reduced-motion", "guidanceId": "accessibility", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "Animations continue when reduced motion is requested.", "evidence": "The preference probe matched prefers-reduced-motion: reduce but still found eight running animations, each with a 2000 ms duration.", "artifacts": [ "evidence/preferences.json" ], "suggestedFix": "Disable non-essential animations and reduce essential transitions inside a prefers-reduced-motion: reduce query.", "effort": "small" }, { "id": "F02", "pathId": "home", "url": "https://xhclub.live/", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "guidanceCategory": "modern-web-guidance", "severity": "low", "confidence": "high", "summary": "Route and state changes do not use transition continuity.", "evidence": "CSS/DOM inspection found no view-transition rules or calls even though the site has many MPA navigations and modal state changes.", "artifacts": [ "evidence/css-script-probe.json" ], "suggestedFix": "Use cross-document view transitions for same-origin navigation and same-document transitions for modal/state changes, with reduced-motion safeguards.", "effort": "medium" }, { "id": "F03", "pathId": "home", "url": "https://xhclub.live/", "principleId": "provide-guided-navigation", "principleCheckId": "scroll-state-aware-chrome", "guidanceId": "shrinking-header-on-scroll", "guidanceCategory": "modern-web-guidance", "severity": "low", "confidence": "high", "summary": "Persistent chrome does not adapt to scroll state.", "evidence": "The narrow screenshot shows multiple fixed-height header, verification, and promotional bands consuming the initial viewport; CSS inspection found no scroll-state adaptation.", "artifacts": [ "evidence/home-mobile.png", "evidence/css-script-probe.json" ], "suggestedFix": "Collapse or simplify non-essential header bands after scroll using a scroll-state-aware pattern while preserving access to primary navigation.", "effort": "medium" }, { "id": "F04", "pathId": "signup", "url": "https://xhclub.live/signup?source=menuSignup", "principleId": "provide-guided-navigation", "principleCheckId": "anchored-positioning", "guidanceId": "position-aware-tooltips", "guidanceCategory": "modern-web-guidance", "severity": "low", "confidence": "high", "summary": "Overlay/menu positioning does not use resilient anchoring.", "evidence": "The page exposes dropdown and sign-up overlay surfaces, but CSS inspection found no anchor-positioning signals; the sign-up panel is mostly offscreen at 360 px.", "artifacts": [ "evidence/signup-mobile.png", "evidence/css-script-probe.json" ], "suggestedFix": "Anchor overlays to their trigger and define position-try fallbacks so they remain visible near viewport edges.", "effort": "medium" }, { "id": "F05", "pathId": "signup", "url": "https://xhclub.live/signup?source=menuSignup", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "The sign-up modal is a custom div rather than a platform dialog.", "evidence": "After expanding email sign-up, the probe found a DIV role=dialog rather than a dialog element; controls and focus behavior are manually assembled.", "artifacts": [ "evidence/signup-email-state.json", "evidence/signup-mobile.png" ], "suggestedFix": "Use a modal dialog element with showModal(), a labelled heading, autofocus management, and platform Escape dismissal.", "effort": "medium" }, { "id": "F06", "pathId": "home", "url": "https://xhclub.live/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "reduced-chrome", "guidanceId": "improve-text-layout-and-legibility", "guidanceCategory": "modern-web-guidance", "severity": "high", "confidence": "high", "summary": "Promotional and navigation chrome crowds out the core content.", "evidence": "The 360x800 homepage shows two navigation rows, an age-verification strip, a sale banner, and a 200 px sidebar before the clipped listing; the detail page repeats the stack.", "artifacts": [ "evidence/home-mobile.png", "evidence/detail-mobile.png" ], "suggestedFix": "Prioritise the core listing/player in the first viewport and consolidate secondary promotions and navigation into progressively disclosed surfaces.", "effort": "medium" }, { "id": "F07", "pathId": "home", "url": "https://xhclub.live/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "responsive-no-horizontal-scroll", "guidanceId": "fluid-scaling", "guidanceCategory": "modern-web-guidance", "severity": "critical", "confidence": "high", "summary": "Narrow viewports render a 1024 px desktop canvas and clip primary content.", "evidence": "At a 360 px visual viewport, layout reported scrollWidth and innerWidth 1024 with 664 px overflow on both home and category pages. The sign-up panel appears mostly offscreen.", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/home-mobile.png", "evidence/category-layout.json", "evidence/signup-mobile.png" ], "suggestedFix": "Remove fixed desktop minimum widths, ensure a single device-width viewport, and switch layout/navigation/card sizing at narrow widths without horizontal overflow.", "effort": "large" }, { "id": "F08", "pathId": "home", "url": "https://xhclub.live/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "guidanceCategory": "modern-web-guidance", "severity": "high", "confidence": "high", "summary": "Cards, sidebars, and account panels do not adapt within narrow containers.", "evidence": "The same desktop sidebar/card composition remains 1024 px wide at a 360 px viewport; computed inspection found zero container-query containers.", "artifacts": [ "evidence/home-mobile.png", "evidence/category-mobile.png", "evidence/signup-mobile.png", "evidence/css-script-probe.json" ], "suggestedFix": "Make listing, sidebar, promo, and modal components size-aware with container queries or equivalent intrinsic responsive rules.", "effort": "large" }, { "id": "F09", "pathId": "home", "url": "https://xhclub.live/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "guidanceCategory": "modern-web-guidance", "severity": "high", "confidence": "high", "summary": "Keyboard focus is not visibly indicated on key controls.", "evidence": "The active focus probe found outline-style none on search input/button, login, navigation links, and numerous sidebar links; most also had no focus box shadow.", "artifacts": [ "evidence/platform-probe.json" ], "suggestedFix": "Add strong :focus-visible styles with sufficient contrast and preserve them independently of hover styling.", "effort": "small" }, { "id": "F10", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "identify-inp-causes", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "Mobile loading is slower than the recommended LCP target.", "evidence": "Lighthouse measured FCP and LCP at 4.0 s (performance 0.77); the desktop trace measured LCP 2.15 s, showing the mobile path is the weak condition.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-trace.json" ], "suggestedFix": "Shorten document response and critical request chains, prioritise the LCP asset, and defer non-critical third-party and UI code.", "effort": "medium" }, { "id": "F11", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-main-thread", "guidanceId": "break-up-long-tasks", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "Long main-thread work remains during startup.", "evidence": "The trace recorded two long tasks, the longest 151.73 ms, and 142.54 ms total blocking time; mobile layout observation also found a 155 ms task.", "artifacts": [ "evidence/home-trace-summary.json", "evidence/home-mobile-layout.json" ], "suggestedFix": "Profile the long tasks, split heavy work, and schedule non-urgent initialization after critical rendering.", "effort": "medium" }, { "id": "F12", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "guidanceCategory": "modern-web-guidance", "severity": "high", "confidence": "high", "summary": "The page loads a large, highly fragmented dependency set before settling.", "evidence": "HAR captured 143 requests and 1.77 MB transferred, including 62 scripts (997 KB), 11 stylesheets, and 116 third-party-origin requests. Several parser-inserted stylesheets are VeryHigh priority.", "artifacts": [ "evidence/home-summary.json", "evidence/home.har", "evidence/css-script-probe.json" ], "suggestedFix": "Reduce critical CSS and request chains, defer optional scripts, and load authentication/advertising integrations only when their surfaces are requested.", "effort": "large" }, { "id": "F13", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "Large portions of shipped CSS and JavaScript are unused on the initial mobile view.", "evidence": "Lighthouse estimated 56 KiB unused CSS (89-94% of two sheets) and 26 KiB unused JavaScript (56% of assetsLoader.js).", "artifacts": [ "evidence/lighthouse-home.json" ], "suggestedFix": "Split route/component CSS and JavaScript, remove duplicate initialization, and lazy-load code for hidden account and promotional surfaces.", "effort": "medium" }, { "id": "F14", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "modern-web-guidance", "severity": "high", "confidence": "high", "summary": "Interactive elements have missing or conflicting accessible names and invalid semantics.", "evidence": "Lighthouse found two unnamed buttons, multiple visible-duration/aria-label mismatches, and a video list containing direct div/role children instead of list items. The sign-up form has unlabeled duplicate email inputs.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/signup-email-state.json", "evidence/platform-probe.json" ], "suggestedFix": "Give every control a stable accessible name matching visible text, use valid list structure, and associate visible labels with each sign-up field.", "effort": "medium" }, { "id": "F15", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "guidanceCategory": "modern-web-guidance", "severity": "high", "confidence": "high", "summary": "Important text does not meet minimum contrast.", "evidence": "Lighthouse found 13 contrast failures, including 2.15:1 and 1.75:1 text on the green verification banner and 3.29:1 metadata on #202020.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-dark.png" ], "suggestedFix": "Adjust theme tokens so normal text reaches 4.5:1 and large text 3:1; verify each theme and forced-colors mode.", "effort": "small" }, { "id": "F16", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "modern-web-guidance", "severity": "high", "confidence": "high", "summary": "Keyboard and structural accessibility are incomplete.", "evidence": "Programmatic focus showed no visible outline across primary controls, while Lighthouse found malformed list structure and an accessibility-tree failure.", "artifacts": [ "evidence/platform-probe.json", "evidence/lighthouse-home.json" ], "suggestedFix": "Restore visible focus, keep logical DOM/list semantics, and test a complete keyboard walk through navigation, search, listing, modal, and consent controls.", "effort": "medium" }, { "id": "F17", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "fluid-scaling", "guidanceCategory": "modern-web-guidance", "severity": "high", "confidence": "high", "summary": "Zoom/reflow is restricted and some touch targets are undersized.", "evidence": "Lighthouse reports user-scalable=no, target-size failures, and the narrow layout probe reports 664 px horizontal overflow.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-mobile-layout.json" ], "suggestedFix": "Remove user-scalable=no, permit zoom, reflow at 320 CSS px, and make interactive targets at least 24x24 CSS px with adequate spacing.", "effort": "medium" }, { "id": "F18", "pathId": "home", "url": "https://xhclub.live/", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "Document and image semantics leave avoidable quality risks.", "evidence": "The image audit found 29 of 36 images without explicit dimensions, 12 oversized images, one missing alt, and Lighthouse found invalid list children.", "artifacts": [ "evidence/images.json", "evidence/lighthouse-home.json" ], "suggestedFix": "Reserve media dimensions/aspect ratios, select appropriately sized responsive sources, supply meaningful or empty alt, and restore valid list markup.", "effort": "medium" }, { "id": "F19", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "fluid-scaling", "guidanceCategory": "modern-web-guidance", "severity": "high", "confidence": "high", "summary": "The pages are crawlable but not mobile-friendly under a narrow viewport.", "evidence": "Raw HTML contains 88% of rendered content and links have hrefs, but home/category layout remains 1024 px wide in a 360 px viewport.", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png", "evidence/home-mobile-layout.json" ], "suggestedFix": "Keep server-rendered crawlability while fixing responsive reflow and zoom so mobile crawlers and users receive a usable layout.", "effort": "large" }, { "id": "F20", "pathId": "detail", "url": "https://xhclub.live/videos/stepmommys-boy-is-back-xhNYAjv", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "guidanceId": "html", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "Media detail pages lack structured VideoObject data.", "evidence": "The representative detail page provides Open Graph metadata but no application/ld+json block; /sitemap.xml also returned 404.", "artifacts": [ "evidence/detail-probe.json", "evidence/site-files.json" ], "suggestedFix": "Add content-matched VideoObject JSON-LD and publish discoverable sitemap indexes for canonical public URLs.", "effort": "medium" }, { "id": "F21", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "modern-web-guidance", "severity": "high", "confidence": "high", "summary": "Transport is HTTPS but cookie and CSP protections are weak.", "evidence": "Headers use CSP only for frame-ancestors, omit X-Content-Type-Options and Referrer-Policy, and four of five cookies were flagged insecure; settings and g_state are SameSite=None without Secure.", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "suggestedFix": "Set Secure on all HTTPS cookies, use appropriate SameSite, add nosniff and a strict referrer policy, and deploy a nonce/hash-based CSP covering script/style/connect sources.", "effort": "medium" }, { "id": "F22", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "The initial page has a broad third-party request footprint.", "evidence": "HAR attributed 116 of 143 requests and 1.58 MB of 1.77 MB to third-party origins; tracker enumeration saw 12 third-party origins, including an ad endpoint and Google identity.", "artifacts": [ "evidence/home-summary.json", "evidence/home.har", "evidence/trackers.json" ], "suggestedFix": "Gate optional third parties behind user action/consent, minimise identifiers and query payloads, and self-host or consolidate resources where practical.", "effort": "large" }, { "id": "F23", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "modern-web-guidance", "severity": "high", "confidence": "high", "summary": "Defensive response policy coverage is incomplete.", "evidence": "The headers probe found no nosniff or Referrer-Policy and a CSP limited to frame-ancestors; the Permissions-Policy only declares two client-hint features.", "artifacts": [ "evidence/headers.json" ], "suggestedFix": "Add comprehensive CSP, Referrer-Policy, X-Content-Type-Options, and least-privilege Permissions-Policy directives; review HSTS max-age.", "effort": "medium" }, { "id": "F24", "pathId": "signup", "url": "https://xhclub.live/signup?source=menuSignup", "principleId": "be-resilient", "principleCheckId": "resilient-runtime-behaviour", "guidanceId": "resilient-context-menus-and-nested-dropdowns", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "The account dialog fails viewport-edge resilience.", "evidence": "At 360x800 the sign-up surface is rendered largely beyond the right edge; after interaction it is a custom role=dialog rather than a platform top-layer primitive.", "artifacts": [ "evidence/signup-mobile.png", "evidence/signup-email-state.json" ], "suggestedFix": "Use a top-layer dialog with max-inline-size: min(..., 100vi), responsive padding, and edge-aware placement/fallbacks.", "effort": "medium" }, { "id": "F25", "pathId": "signup", "url": "https://xhclub.live/signup?source=menuSignup", "principleId": "be-trustworthy", "principleCheckId": "humane-error-handling", "guidanceId": "accessible-error-announcement", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "The email sign-up state lacks robust field semantics for timely validation.", "evidence": "After choosing email sign-up, two text inputs share name=email, neither is required or labelled, and the form exposes no field-level error semantics before submission.", "artifacts": [ "evidence/signup-email-state.json" ], "suggestedFix": "Use one type=email field with a visible label and required semantics; validate after interaction and announce errors with aria-describedby/live messaging.", "effort": "small" }, { "id": "F26", "pathId": "signup", "url": "https://xhclub.live/signup?source=menuSignup", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "autofill-sign-up-form", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "Email autofill is disabled in the sign-up form.", "evidence": "The sign-up probe found both email fields set to autocomplete=off while the password correctly uses autocomplete=new-password.", "artifacts": [ "evidence/signup-email-state.json" ], "suggestedFix": "Use type=email and autocomplete=email (or username where appropriate), retaining autocomplete=new-password for password creation.", "effort": "small" }, { "id": "F27", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "Image delivery wastes bytes and misses layout hints.", "evidence": "The image audit found 12 oversized images, 14 legacy-format detections, 29 missing dimensions, and 8 below-fold images not lazy-loaded.", "artifacts": [ "evidence/images.json" ], "suggestedFix": "Serve correctly sized AVIF/WebP candidates via srcset/sizes, reserve intrinsic dimensions, and lazy-load non-critical below-fold media.", "effort": "medium" }, { "id": "F28", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "deprioritize-background-fetches", "guidanceCategory": "modern-web-guidance", "severity": "high", "confidence": "high", "summary": "Third-party scripts dominate the transfer budget.", "evidence": "Third-party origins account for 1.58 MB and 116 requests; scripts alone transfer 997 KB, with a 400 KB index bundle and 98 KB Google identity script among the largest offenders.", "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "suggestedFix": "Set route budgets for scripts and third parties, defer identity and promotions until requested, and remove low-value integrations.", "effort": "large" }, { "id": "F29", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-agent-ready", "principleCheckId": "structured-agent-capabilities", "guidanceId": "webmcp", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "The public search and account surfaces expose no structured agent capabilities.", "evidence": "The platform probe found no agent/WebMCP surface and Lighthouse agentic-browsing scored 0.5 despite a clear search/filter task and form journey.", "artifacts": [ "evidence/platform-probe.json", "evidence/lighthouse-home.json" ], "suggestedFix": "Expose narrowly scoped, user-mediated WebMCP tools for search/filter and account actions with clear confirmation for consequential operations.", "effort": "large" }, { "id": "F30", "pathId": "home", "url": "https://xhclub.live/", "principleId": "be-memory-efficient", "principleCheckId": "bounded-footprint", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "modern-web-guidance", "severity": "medium", "confidence": "high", "summary": "The homepage memory footprint is high for a media listing before playback.", "evidence": "A single heap summary contained 667,487 nodes, 3,128,195 edges, 35.5 MB self size, and 93,461 closures.", "artifacts": [ "evidence/home-heap.json" ], "suggestedFix": "Reduce initial component/object populations, release hidden modal/promo state, virtualise long lists where appropriate, and profile retained paths for large closure groups.", "effort": "large" } ], "taskList": [ { "id": "T01", "title": "Fix narrow-screen reflow and zoom", "priority": 1, "findingIds": [ "F07", "F08", "F17", "F19" ], "guidanceId": "fluid-scaling", "status": "open" }, { "id": "T02", "title": "Reduce initial script, CSS, and third-party work", "priority": 2, "findingIds": [ "F10", "F11", "F12", "F13", "F22", "F28", "F30" ], "guidanceId": "optimize-script-priority", "status": "open" }, { "id": "T03", "title": "Restore accessible names, semantics, focus, and contrast", "priority": 3, "findingIds": [ "F09", "F14", "F15", "F16", "F18" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T04", "title": "Harden cookies and browser response policies", "priority": 4, "findingIds": [ "F21", "F23" ], "guidanceId": "security", "status": "open" }, { "id": "T05", "title": "Simplify promotional chrome and make dialogs resilient", "priority": 5, "findingIds": [ "F03", "F04", "F05", "F06", "F24" ], "guidanceId": "declarative-dialog-popover-control", "status": "open" }, { "id": "T06", "title": "Correct sign-up labels, validation, and autofill", "priority": 6, "findingIds": [ "F25", "F26" ], "guidanceId": "autofill-sign-up-form", "status": "open" }, { "id": "T07", "title": "Optimise responsive image delivery", "priority": 7, "findingIds": [ "F27" ], "guidanceId": "deliver-optimized-decorative-images", "status": "open" }, { "id": "T08", "title": "Add structured media and agent metadata", "priority": 8, "findingIds": [ "F20", "F29" ], "guidanceId": "webmcp", "status": "open" }, { "id": "T09", "title": "Respect reduced motion and add navigation continuity", "priority": 9, "findingIds": [ "F01", "F02" ], "guidanceId": "accessibility", "status": "open" } ], "budget": { "wallClockSeconds": 1500, "pathCount": 7, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-26T17-26-57-563Z" }