Manifest position 120 · CrUX rank bucket 1000
https://x.com
Coverage complete
Coverage complete for the logged-out public experience. Authenticated timelines, compose, messages, settings and purchase flows were not covered because no test account was supplied.
Attempts
1 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | pass | high | Light and dark emulation produced fully retinted, usable surfaces; computed html color-scheme was dark in dark mode. |
respect-user-preferencesrespects-reduced-motion | pass | high | Under prefers-reduced-motion: reduce the page reported no active animations and includes a matching reduce rule. |
respect-user-preferencesrespects-contrast | pass | high | Forced-colors plus prefers-contrast:more kept text, controls, links and focus boundaries visible. |
implement-natural-interactionsview-transitions | issues | medium | Rendered DOM/CSS and interaction evidence showed ordinary instant SPA state changes and no ::view-transition rules; the platform API exists but was not used by the page. F03 low: State and route changes do not expose evidence of View Transition use. |
implement-natural-interactionsscroll-driven-animations | not-applicable | high | No scroll-linked decorative or scrollytelling animation was present on the audited public templates. |
implement-natural-interactionsphysical-gestures | pass | high | The public feed uses native scrolling and responsive tab/navigation controls; no custom pointermove gesture override was observed. |
provide-guided-navigationscroll-state-aware-chrome | pass | high | The long public profile retains clear sticky/profile navigation and tab state while content scrolls without horizontal drift. |
provide-guided-navigationanchored-positioning | not-applicable | high | No tooltip, popover or edge-positioned menu requiring anchored positioning appeared in the audited logged-out and public-profile states. |
provide-guided-navigationdirects-attention | pass | high | The profile clearly marks the selected Posts tab with a high-contrast underline and preserves directional back navigation. |
maximize-content-reduce-noiseno-intrusive-interruptions | issues | high | Desktop screenshots show a fixed banner consuming the bottom 153 px; at 360x800 it occupies roughly 276 px and covers the sign-in action. The TOS and profile pages are also covered. F01 high: The cookie prompt obscures primary content on every public surface. |
maximize-content-reduce-noisesemantic-dismissible-primitives | issues | high | DOM probe found no <dialog> or [popover] despite the fixed consent surface and the modal authentication surface shown after an unknown route redirect. F02 medium: Consent and authentication overlays are custom role-based structures rather than native dialog/popover primitives. |
maximize-content-reduce-noisereduced-chrome | pass | high | Outside the separately reported consent banner, the profile gives the central column to posts and the TOS template prioritizes its document. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | pass | high | Both 360px layout captures reported scrollWidth=clientWidth=360 and zero horizontal overflow. |
adapt-to-the-form-factorcomponent-level-responsiveness | pass | high | The same authentication/profile surfaces visibly recompose between 1440px and 360px without clipping; condition-based component adaptation is directly visible. |
adapt-to-the-form-factorinput-modality-aware | pass | high | Primary buttons are 40-46px high, touch spacing is adequate per Lighthouse, and focus probe showed browser focus indication across controls. |
support-core-task-successclear-purpose-and-primary-action | pass | high | Home says “Happening now” and presents direct phone/Google/Apple/email actions; profile identity and posts are immediately clear. |
support-core-task-successprimary-flow-completion | pass | high | Logged-out users can choose a sign-in method and public users can read a profile/feed; the consent prompt offers equally prominent accept/refuse actions. |
support-core-task-successclear-system-state-and-recovery | pass | high | Authentication controls expose disabled/enabled state and a focused modal step with Back; invalid-route recovery is separately reported. |
be-fast-and-stablegood-core-web-vitals | issues | high | Lighthouse measured LCP 12.2 s, CLS 0.147, TBT 440 ms and TTI 12.7 s (performance score 0.55). The raw-CDP trace still measured LCP 2.40 s and 84 ms TBT, showing high run variance but a fragile load. F04 high: The logged-out home misses Core Web Vitals and interactivity targets. |
be-fast-and-stablevisual-stability | issues | high | The 360x800 layout observer recorded CLS 0.135 across three shifts around 1.58-2.11 s; Lighthouse independently measured CLS 0.147 and two large shifts. F05 medium: The logged-out mobile page shifts materially during load. |
be-fast-and-stableefficient-main-thread | issues | high | Lighthouse measured 2.5 s of main-thread work, 1.7 s JS execution and 440 ms TBT; CDP trace recorded three long tasks up to 84.9 ms. F06 medium: JavaScript blocks the main thread during startup. |
be-fast-and-stableefficient-resource-delivery | issues | high | HAR captured 105 requests and 2.61 MB transferred, including 66 scripts and 1.83 MB script transfer. Several low-priority route bundles took about 1.2 s. F07 high: The simple logged-out page requires an oversized dependency graph. |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse estimated 639 KiB unused JS: main was 50% unused, vendor 47%, Google Identity 75%, and modules.common 98.8%. F08 high: The logged-out route ships hundreds of KiB of unused JavaScript. |
be-inclusivenames-roles-labels | issues | high | The image probe found 10 of 32 images without alt, including the profile banner and multiple post/video thumbnails. Some may be decorative, but post media requires a text alternative when meaningful. F09 medium: Profile media includes images without alternative text. |
be-inclusivesufficient-contrast | pass | high | Lighthouse contrast audit passed and forced-colors screenshot retained legible text and control boundaries. |
be-inclusivestructure-and-focus | pass | high | Home has one h1 plus main/nav landmarks; heading order and Lighthouse focus-related automated audits passed; focus follows DOM order. |
be-inclusivelegible-text | pass | high | Desktop, mobile, profile and TOS screenshots show readable line lengths and no clipping or cramped wrapping. |
be-inclusivezoom-reflow-targets-and-media | issues | high | The live viewport meta contains maximum-scale=1,user-scalable=0; Lighthouse fails the meta-viewport accessibility audit. F10 high: The viewport explicitly disables user zoom. |
follow-best-practicesno-console-errors | issues | high | Lighthouse captured a Google FedCM AbortError, two identity-provider errors, and a blocked inline script caused by the page CSP. F11 low: The logged-out page emits console and CSP errors. |
follow-best-practicessound-document-and-assets | issues | high | 27 of 32 images lacked width/height, 11 lacked srcset, five were oversized, and 27 used legacy PNG/JPEG delivery. F12 medium: Profile images lack intrinsic dimensions and responsive delivery. |
follow-best-practicesbrowser-platform-hygiene | issues | high | Lighthouse reported a CSP inspector issue and a BFCache failure (SharedWorkerWithNoActiveClient), alongside legacy JavaScript estimated at 54 KiB. F13 medium: Browser inspector and lifecycle hygiene are not clean. |
be-discoverabletitle-and-description | pass | high | The entry page has a descriptive title and matching meta description; profile raw HTML preserves template-specific metadata. |
be-discoverablecrawlable-and-mobile-friendly | pass | high | Visible links use real href values and descriptive text; viewport exists and Lighthouse SEO scored 1.0. Zoom restriction is reported under inclusion. |
be-discoverablecanonical-and-indexing-signals | issues | high | The DOM probe found no canonical URL. robots.txt advertises /sitemap.xml, but fetching that endpoint returned the SPA HTML document rather than an XML sitemap. Generic User-agent:* is disallowed, while Googlebot/Bingbot have selective access. F17 medium: Canonical and sitemap signals are inconsistent on the public entry surface. |
be-discoverablestructured-and-shareable-metadata | pass | high | The homepage exposes matching Open Graph title, description, URL and site-name metadata; the profile has template-specific title/description in server HTML. |
be-private-and-securesecure-transport-and-headers | issues | high | Cookie audit found six cookies flagged insecure by the primitive: g_state and two __cuid cookies were not Secure; all six were SameSite=None; guest_id and __cuid persist about 396-400 days. F14 high: Several first-party cookies use weak transport and cross-site settings. |
be-private-and-securedata-minimisation-and-third-parties | issues | high | HAR attributed 91/105 requests and 2.51/2.61 MB to origins classified as third party relative to x.com, mostly abs.twimg.com, plus Google and Apple identity scripts. Tracker matching found no known analytics tracker. F15 medium: Most logged-out network traffic goes to additional origins before user intent. |
be-private-and-securein-context-permissions-and-modern-auth | pass | high | No permission prompt fired on load; login offers phone, Google, Apple, username and autocomplete="username webauthn". |
be-private-and-securedefensive-browser-policies | issues | high | Headers include HSTS, nosniff and X-Frame-Options DENY, but omit Referrer-Policy and Permissions-Policy. CSP includes unsafe-inline and produced a blocked-script inspector error. F16 medium: Defensive headers are incomplete and CSP still permits unsafe inline styling/script patterns. |
be-resilientprogressive-enhancement | issues | high | Discoverability comparison found only 22% rendered-word coverage in raw HTML; title, h1 and meta description were absent from raw content. The public profile performed much better at 93%, showing the gap is template-specific. F18 medium: The logged-out home is mostly unavailable to no-JavaScript clients. |
be-resilientresilient-runtime-behaviour | pass | high | Profile and authentication overlays remained within viewport bounds; no cut-off menu or broken async state was observed. |
be-resilientoffline-and-installable | issues | high | A complete manifest with standalone display and shortcuts is linked, but the runtime probe found no service-worker controller or registration. F19 medium: The app advertises installability but has no service-worker offline fallback. |
be-resilientnetwork-and-http-failure-states | issues | high | A deliberately missing URL redirected to /i/jf/onboarding/...mode=login and displayed “See what’s happening,” with no not-found explanation or route recovery. F20 medium: Unknown routes are converted into an authentication prompt instead of a truthful recoverable 404. |
be-internationalisedlang-dir-and-logical-properties | pass | high | html uses lang=en-GB and dir=ltr; inspected CSS includes explicit ltr/rtl variants for directional layout. |
be-internationalisedlocale-aware-data | pass | high | Visible profile dates use localized day-month rendering (for example “16 Jul”) rather than ambiguous numeric formatting. |
be-internationalisedtime-zone-correctness | pass | high | No time-zone-sensitive scheduling or cross-zone event flow appears in the audited logged-out/public-profile templates. |
be-trustworthyno-dark-patterns | pass | high | Consent accept and refuse actions have equal prominence and account terms are linked; no confirmshaming or forced continuity was observed. |
be-trustworthyhumane-error-handling | pass | high | Authentication preserves the entered-field context and uses disabled states rather than premature blame; no hostile validation copy was observed. |
be-trustworthytrustworthy-input-assistance | pass | high | Username input declares autocomplete="username webauthn" and provides Google/Apple/phone alternatives. |
be-trustworthysafe-commercial-and-account-flows | pass | high | The visible account entry offers multiple methods and linked terms/privacy, with a Back control; no purchase or subscription commitment appears. |
be-sustainableoptimised-assets | issues | high | Image probe found five oversized images, 11 without responsive sources, and 27 legacy-format assets among 32 images. F21 medium: Public feed imagery is not consistently resolution- or format-optimized. |
be-sustainableno-wasteful-work | pass | high | No continuous autoplay media or idle animation was observed after load; expensive initial delivery is captured by the separate budget finding. |
be-sustainablethird-party-and-media-budget | issues | high | A text-and-authentication surface transferred 2.61 MB across 105 requests; 2.51 MB and 91 requests were cross-origin by host classification, with 66 scripts. F22 medium: The logged-out page spends a disproportionate resource budget before interaction. |
be-agent-readystructured-agent-capabilities | not-applicable | high | X explicitly blocks generic and named AI crawlers in robots.txt and exposes no declared agent-facing intent; emerging agent capability is therefore judged out of scope. |
be-agent-readyon-device-inference | not-applicable | high | No user-facing task in the audited logged-out/public-profile scope requires on-device inference, and no agent-facing intent is declared. |
be-memory-efficientno-leak-under-repeated-interaction | pass | high | After ten full-feed scroll cycles DOM elements fell from 4,029 to 2,143 as virtualization reclaimed nodes; JS heap settled at about 112 MB after lazy loading rather than DOM growing without bound. |
be-memory-efficientbounded-footprint | pass | high | Repeated-interaction heap summary was 42.6 MB self size for a media feed and same-page JS heap was about 112 MB, proportionate though worth monitoring. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | high | Neither heap constructor summary surfaced Detached* among dominant populations, and live DOM count decreased after repeated scrolling. |
Provenance
Canonical report: results/atomic/reports/0120-x_com.json
Report SHA-256: 41d55a2f37b83ffd2f0dd5974fe79c45876a74c7ea1791e559d0c32b26037d97
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/x_com/2026-07-18T13-50-59-100Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/x_com/2026-07-18T13-50-59-100Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.