Manifest position 400 · CrUX rank bucket 1000

https://outlook.live.com

Coverage complete

Coverage-complete audit of the unauthenticated entry, redirected product page, related product/pricing templates and sign-in journey up to the credential boundary. Authenticated mailbox content and account-management internals were not covered.

Attempts

3 / 3

Judged checks

58 / 58

Blocked

Not run

This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.

All 58 atomic check outcomes

Principle / check	Status	Confidence	Evidence or reason
respect-user-preferences `respects-color-scheme`	issues	high	Desktop captures under default and prefers-color-scheme: dark are pixel-identical in the visible consent and navigation surface; both remain light. F01 medium: The public Outlook landing experience does not adapt to a dark color-scheme preference.
respect-user-preferences `respects-reduced-motion`	pass	high	The emulated preference matched; getAnimations() returned none and loaded CSS contains repeated prefers-reduced-motion rules.
respect-user-preferences `respects-contrast`	pass	high	Controls, text and consent choices remain visible under forced-colors: active; CSS includes forced-colors handling.
implement-natural-interactions `view-transitions`	issues	high	The interaction video records a product-tab change and smooth scroll but no transition connecting the old and new tab state; the CSS feature probe found no view-transition usage. F02 low: State changes use abrupt swaps rather than coherent view transitions.
implement-natural-interactions `scroll-driven-animations`	not-applicable	high	No parallax, scrollytelling or scroll-linked reveal behavior was present on the representative public paths, so there is no scroll animation implementation to assess.
implement-natural-interactions `physical-gestures`	pass	high	Observed scrolling and tabs use native scroll/button behavior; no hostile custom drag or pointer-only interaction was found on the public paths.
provide-guided-navigation `scroll-state-aware-chrome`	issues	medium	The mobile layout is 16,783 CSS px tall, while the interaction video and CSS probe show no progress indicator or scroll-state-aware page chrome. F03 low: The very long product page offers little position-aware guidance.
provide-guided-navigation `anchored-positioning`	not-applicable	high	No tooltip, context menu or edge-positioned transient overlay was encountered on the representative paths; the consent surface is assessed under semantic overlays instead.
provide-guided-navigation `directs-attention`	pass	high	Tab selection and in-page destinations provide labelled controls and visible focus; the page includes a skip link and “Back to tabs” return links.
maximize-content-reduce-noise `no-intrusive-interruptions`	issues	high	The first desktop screenshot shows the cookie choice taking roughly two thirds of the viewport, followed immediately by navigation and another announcement banner; core Outlook content is not visible. F04 medium: Consent and announcement chrome dominate the initial viewport.
maximize-content-reduce-noise `semantic-dismissible-primitives`	issues	high	The rendered DOM probe found 0 dialog, 0 popover and 0 details elements while the initial surface presents cookie controls and dismissible announcement UI. F05 medium: Overlay-like UI is implemented without semantic dialog or popover primitives.
maximize-content-reduce-noise `reduced-chrome`	issues	high	The initial desktop viewport contains consent copy, three consent controls, two navigation rows and an announcement bar, with no product heading or primary Outlook action visible. F06 medium: Application chrome crowds out the product message on entry.
adapt-to-the-form-factor `responsive-no-horizontal-scroll`	pass	high	Layout reported scrollWidth=clientWidth=360 and 0 horizontal overflow with a viewport meta present.
adapt-to-the-form-factor `component-level-responsiveness`	pass	high	The same product template reflows to 360 px without overflow and uses mobile-specific hero content; behavior is adaptive even though container-query use was not observed.
adapt-to-the-form-factor `input-modality-aware`	pass	high	Visible controls produced dotted/auto focus outlines up to 3 px, and the narrow layout retained usable controls.
support-core-task-success `clear-purpose-and-primary-action`	issues	high	The entry screenshot exposes no Outlook heading, sign-in or account-creation action before consent, global navigation and an announcement; the product H1 exists lower in the DOM. F07 medium: The page purpose and primary Outlook action are hidden on initial load.
support-core-task-success `primary-flow-completion`	pass	high	Entry navigation exposes Sign in and Create free account, and the sign-in page presents one email field and a clear Next action without a detour.
support-core-task-success `clear-system-state-and-recovery`	pass	high	Sign-in keeps the task in context and exposes “Forgot your username?” and “Create an account” recovery paths; focus is placed in the email field.
be-fast-and-stable `good-core-web-vitals`	issues	high	Lighthouse measured FCP 11.4 s, LCP 24.4 s, TBT 2,970 ms, CLS 0.53, and time to interactive 35.2 s; performance score was 0.05. F08 critical: Cold-load performance is far outside good Core Web Vitals ranges.
be-fast-and-stable `visual-stability`	issues	high	Lighthouse measured FCP 11.4 s, LCP 24.4 s, TBT 2,970 ms, CLS 0.53, and time to interactive 35.2 s; performance score was 0.05. F08 critical: Cold-load performance is far outside good Core Web Vitals ranges.
be-fast-and-stable `efficient-main-thread`	issues	high	Lighthouse measured FCP 11.4 s, LCP 24.4 s, TBT 2,970 ms, CLS 0.53, and time to interactive 35.2 s; performance score was 0.05. F08 critical: Cold-load performance is far outside good Core Web Vitals ranges.
be-fast-and-stable `efficient-resource-delivery`	issues	high	HAR captured 151 requests and 9,016,578 transferred bytes: 77 scripts (4.03 MB), 27 stylesheets, 1.12 MB fonts and a 1.65 MB media file, plus many parser-inserted VeryHigh-priority stylesheets. F09 high: The entry journey transfers an excessive, highly fragmented payload.
be-fast-and-stable `trim-unused-and-duplicate-code`	issues	high	Lighthouse estimated 951 KiB unused JavaScript and 342 KiB unused CSS; individual bundles were 55-73% unused and global CSS files were 81-98% unused. F10 high: Large amounts of unused JS and CSS ship on the landing journey.
be-inclusive `names-roles-labels`	issues	high	The images primitive found 15 images without alt text, and the quality probe found the visible search input had no associated label or ARIA label. F11 medium: Some rendered images and the global search input lack accessible alternatives.
be-inclusive `sufficient-contrast`	pass	high	Lighthouse color-contrast audit passed and forced-colors rendering preserved visible controls and text.
be-inclusive `structure-and-focus`	issues	high	The DOM probe found four identical H1 elements; Lighthouse reported invalid heading order where plan-card text jumps to H6. Keyboard focus indicators themselves were visible. F12 medium: Heading structure is repetitive and skips levels.
be-inclusive `legible-text`	pass	high	Visible text uses readable sizing, spacing and contrast; the 360 px layout does not clip or overflow horizontally.
be-inclusive `zoom-reflow-targets-and-media`	pass	high	The marketing viewport allows normal scaling, login explicitly allows user-scalable zoom to 2x, and mobile layout has no horizontal overflow.
follow-best-practices `no-console-errors`	issues	high	Lighthouse captured repeated SyntaxError exceptions: LocalStorageUtil and OneCloudUtil identifiers were declared more than once. F13 medium: Duplicate scripts throw repeated syntax errors.
follow-best-practices `sound-document-and-assets`	issues	high	The images primitive found all 100 img elements lacked width/height attributes, three were over 2x their display width, six lacked responsive sources, and one used a legacy format. F14 medium: Image markup does not reserve intrinsic space and some images are oversized.
follow-best-practices `browser-platform-hygiene`	issues	high	Lighthouse reported unload listeners in both the Outlook mini-index and Microsoft telemetry code, one actionable BFCache failure, and two deprecation warnings. F15 medium: Deprecated unload handlers block the back/forward cache.
be-discoverable `title-and-description`	pass	high	Rendered page has a descriptive Outlook title and meta description; both Lighthouse audits passed.
be-discoverable `crawlable-and-mobile-friendly`	issues	high	Lighthouse found six anchors using javascript:void(0) and 26 links labelled only “Learn more”; the rendered page otherwise has a viewport meta and robots.txt is valid. F16 medium: Several controls are not crawlable links and many link labels are generic.
be-discoverable `canonical-and-indexing-signals`	pass	high	The public page returned 200, declares index/follow and a canonical URL, and robots.txt passed Lighthouse.
be-discoverable `structured-and-shareable-metadata`	issues	high	The quality probe found five Open Graph tags but zero JSON-LD blocks on a public software/product page. F17 low: The product page lacks structured entity metadata.
be-private-and-secure `secure-transport-and-headers`	pass	high	HTTPS, HSTS, CSP, nosniff, strict-origin referrer policy, frame-ancestors and Trusted Types are present; scanned cookies are Secure and no client secrets were found.
be-private-and-secure `data-minimisation-and-third-parties`	issues	high	HAR attributed 143 of 151 requests and 8.80 MB to origins other than outlook.live.com; requests include Microsoft telemetry and a third-party video origin. Lighthouse also observed 15 third-party cookies. F18 high: The entry journey has a very large third-party and telemetry footprint before user intent.
be-private-and-secure `in-context-permissions-and-modern-auth`	pass	high	No browser permission prompt appeared on load; sign-in uses autocomplete="username webauthn", indicating conditional WebAuthn support.
be-private-and-secure `defensive-browser-policies`	issues	high	Headers include HTTPS, HSTS, nosniff, strict-origin referrer policy, frame-ancestors and Trusted Types; however Permissions-Policy is absent and style-src allows unsafe-inline. F19 medium: The security policy is strong but incomplete.
be-resilient `progressive-enhancement`	issues	high	Discoverability captured 1% raw-to-rendered content coverage: raw HTML had 35 text characters and no title, H1 or meta description while the rendered page had 6,605 characters and 327 content tokens. F20 high: Core public product content is effectively absent without JavaScript.
be-resilient `resilient-runtime-behaviour`	pass	high	The tested tabs, navigation and consent controls stayed usable without clipping at desktop and 360 px.
be-resilient `offline-and-installable`	not-applicable	high	The audited unauthenticated surface is a public marketing/sign-in entry, not the mailbox app; installability and offline mailbox behavior require an authenticated application audit.
be-resilient `network-and-http-failure-states`	not-applicable	high	The selected public pages expose static marketing and an external credential boundary rather than an in-page data operation with a representative retry/stale-data state.
be-internationalised `lang-dir-and-logical-properties`	pass	high	Marketing declares lang=en-GB and dir=ltr; sign-in declares EN-GB/ltr and serves localized copy.
be-internationalised `locale-aware-data`	not-applicable	high	No rendered dates, currencies, durations or locale-sensitive numeric data appeared on the representative entry and sign-in surfaces.
be-internationalised `time-zone-correctness`	not-applicable	high	No event time or time-zone-sensitive data is rendered on the unauthenticated marketing/sign-in surfaces.
be-trustworthy `no-dark-patterns`	pass	high	Consent presents Accept, Reject and Manage cookies with equal visual weight; sign-in and account creation are explicit and pricing is separately reachable.
be-trustworthy `humane-error-handling`	pass	high	The credential step uses a labelled email input, keeps recovery adjacent, and does not validate before interaction.
be-trustworthy `trustworthy-input-assistance`	pass	high	The email field is labelled, type=email and autocomplete="username webauthn", supporting password managers and conditional passkeys.
be-trustworthy `safe-commercial-and-account-flows`	pass	high	Plans are reachable through descriptive pricing links; sign-in, account creation and username recovery are distinct, visible choices.
be-sustainable `optimised-assets`	issues	high	The images primitive found three oversized images, six without srcset and one legacy-format asset; the HAR includes a 424 KB PNG delivered at 2000x1283 for a 648 px display slot. F21 high: Image delivery wastes bytes and omits responsive sizing.
be-sustainable `no-wasteful-work`	issues	high	The 9.0 MB load includes 77 scripts, telemetry, feedback, Outlook app boot code and a video player; Lighthouse estimates 951 KiB of JS and 342 KiB CSS unused. F22 high: The page performs substantial work unrelated to the first user task.
be-sustainable `third-party-and-media-budget`	issues	high	The quality probe found an autoplay video without controls or captions; HAR transferred 1.65 MB of media and 8.80 MB cross-origin on initial load. F23 high: Autoplay media and cross-origin assets dominate the resource budget.
be-agent-ready `structured-agent-capabilities`	issues	medium	The site prominently links Copilot experiences, but DOM/source probes found no WebMCP or agent-tool registration and non-JS content coverage is only 1%. F24 low: The agent-oriented Outlook/Copilot surface exposes no structured browser capability on the public entry page.
be-agent-ready `on-device-inference`	not-applicable	high	The public marketing/sign-in surface has no user task where on-device summarization or language-model inference is necessary; Outlook mailbox inference requires authenticated product scope.
be-memory-efficient `no-leak-under-repeated-interaction`	issues	medium	Baseline summary was 49.5 MB/653,666 nodes; after dismissing consent and exercising tabs ten times it was 59.7 MB/839,165 nodes. The capture includes one-time full-page activation, so it is a risk signal rather than proof of a leak. F25 medium: Heap growth after exercising tabs warrants a stabilized same-session leak investigation.
be-memory-efficient `bounded-footprint`	issues	high	The post-interaction heap summary reports 59.7 MB self size, 839,165 nodes and 3,056,272 edges, alongside a 9.0 MB transfer and duplicated app/marketing code. F26 medium: The steady loaded footprint is large for a marketing entry page.
be-memory-efficient `no-detached-dom-or-unbounded-listeners`	pass	high	Neither heap summary reports Detached* constructors among retained top constructors; the Popover constructor remains stable at 167 across captures.

Provenance

Canonical report: results/atomic/reports/0400-outlook_live_com.json
Report SHA-256: 2f0ef166b5cae8b39872826d8963b4a60939f2d4a1b9e158215824c762168f62
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/outlook_live_com/2026-07-27T21-50-42-081Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/outlook_live_com/2026-07-27T21-50-42-081Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7

Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.