Manifest position 869 · CrUX rank bucket 1000
https://a24.app.gree-pf.net
Coverage complete
Complete atomic audit of the unauthenticated redirect/login surface. Protected post-login game routes were not entered because no credentials were supplied.
Attempts
3 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | The dark-emulated screenshot is pixel-identical to the light capture and the probe reports color-scheme: normal with a light rgb(241,242,243) body. F01 medium: No dark color-scheme support |
respect-user-preferencesrespects-reduced-motion | pass | medium | Reduced-motion emulation was active and document.getAnimations() returned an empty list, so no non-essential motion persisted. |
respect-user-preferencesrespects-contrast | issues | high | The prefers-contrast: more screenshot is visually identical to the default mobile capture, showing no preference-specific adaptation. F02 low: Contrast preference does not change the presentation |
implement-natural-interactionsview-transitions | issues | high | The server-rendered login and registration/password-reset routes use ordinary full-document navigation with no view-transition declaration in the captured DOM. F03 low: Navigation swaps are abrupt |
implement-natural-interactionsscroll-driven-animations | pass | medium | DOM/CSS inspection and the static screenshot show no scroll-linked animation or JS scrollytelling behavior. |
implement-natural-interactionsphysical-gestures | pass | medium | The form uses native scrolling and controls; no custom pointer gesture or platform-fighting interaction was present. |
provide-guided-navigationscroll-state-aware-chrome | pass | medium | The single-viewport mobile form has no sticky chrome or scroll-dependent state that obscures orientation. |
provide-guided-navigationanchored-positioning | not-applicable | high | The audited login page exposes no tooltip, popover, or menu that requires anchored positioning. |
provide-guided-navigationdirects-attention | pass | medium | Screenshots show a direct top-to-bottom hierarchy from email login to alternatives, recovery, and registration. |
maximize-content-reduce-noiseno-intrusive-interruptions | pass | medium | Initial desktop and mobile screenshots contain no popup, interstitial, consent wall, or content-obscuring banner. |
maximize-content-reduce-noisesemantic-dismissible-primitives | not-applicable | high | No overlay, disclosure, picker, or transient rich control is present on this page. |
maximize-content-reduce-noisereduced-chrome | pass | medium | The first viewport is dominated by the login form with restrained header/footer chrome. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | pass | medium | At 360x800, layout reports scrollWidth=clientWidth=360 and zero horizontal overflow. |
adapt-to-the-form-factorcomponent-level-responsiveness | pass | medium | Desktop and mobile captures show the same form fluidly resizing from a centered max-width panel to the viewport without clipping. |
adapt-to-the-form-factorinput-modality-aware | issues | high | The focus probe reports outline none and box-shadow none for both email and password inputs; several text links are only 16px tall. F04 high: Keyboard focus is not visible on the two primary inputs |
support-core-task-successclear-purpose-and-primary-action | pass | medium | The first viewport clearly labels email login and presents a prominent login button, with recovery and registration alternatives. |
support-core-task-successprimary-flow-completion | pass | medium | The authentication form submits to the identity endpoint and an invalid attempt returns field-specific feedback without a dead end. |
support-core-task-successclear-system-state-and-recovery | issues | high | Empty submission returns clear Japanese errors, but the probe finds no role=alert messages and fields are not marked aria-invalid. F13 medium: Server errors are visible but not programmatically announced |
be-fast-and-stablegood-core-web-vitals | issues | high | Lighthouse measured FCP/LCP at 7.6s and the trace measured LCP at 4995ms. Five redirects add about 5.38s before the final login page. F05 high: Redirect chain makes first paint very slow |
be-fast-and-stablevisual-stability | pass | medium | The layout observer recorded CLS 0 with no shift entries. |
be-fast-and-stableefficient-main-thread | pass | medium | The trace recorded zero long tasks and 0ms total blocking time. |
be-fast-and-stableefficient-resource-delivery | issues | high | Lighthouse measured FCP/LCP at 7.6s and the trace measured LCP at 4995ms. Five redirects add about 5.38s before the final login page. F05 high: Redirect chain makes first paint very slow |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse reports 15,156 bytes, 92.99%, of reg.css unused on this small login page. F06 medium: Most of the page stylesheet is unused |
be-inclusivenames-roles-labels | issues | high | Both visible inputs have no associated label. Lighthouse also identifies two icon-only provider buttons and one icon-only help link with no accessible name. F07 high: Core authentication controls lack accessible names and labels |
be-inclusivesufficient-contrast | issues | high | Lighthouse measured ratios from 3.16:1 to 3.64:1 for password reset, help/contact links, and the app-login label, below 4.5:1. F08 medium: Important links and secondary action text fail WCAG contrast |
be-inclusivestructure-and-focus | issues | high | The DOM probe finds header, footer, and nav but no main; Lighthouse fails landmark-one-main. Input focus styling is also absent. F09 medium: The page has no main landmark |
be-inclusivelegible-text | pass | medium | Desktop and mobile screenshots show unclipped Japanese text, readable line lengths, and stable wrapping. |
be-inclusivezoom-reflow-targets-and-media | issues | high | The viewport meta contains maximum-scale=1 and user-scalable=0; Lighthouse flags this as preventing low-vision users from magnifying content. F10 high: Mobile zoom is explicitly disabled |
follow-best-practicesno-console-errors | pass | medium | Lighthouse best-practices scored 1.0 and did not report console errors or uncaught exceptions. |
follow-best-practicessound-document-and-assets | pass | medium | DOM inspection confirms HTML doctype, UTF-8 charset, viewport metadata, and no img elements with sizing/aspect-ratio defects. |
follow-best-practicesbrowser-platform-hygiene | pass | medium | Lighthouse best-practices scored 1.0; no notification/geolocation prompt, paste prevention, or visible runtime failure occurred. |
be-discoverabletitle-and-description | issues | high | The final login document title is only “gree.net” and its description is only “GREE”, which does not identify the login task. F15 low: Document metadata is generic |
be-discoverablecrawlable-and-mobile-friendly | not-applicable | high | The requested application is deliberately gated by authentication, so public crawling of the protected route is not applicable; mobile viewport behavior is judged elsewhere. |
be-discoverablecanonical-and-indexing-signals | not-applicable | high | The protected application route redirects to authentication and is not intended as an indexable public page. |
be-discoverablestructured-and-shareable-metadata | not-applicable | high | The authentication page is not an article, product, event, or other rich public entity. |
be-private-and-securesecure-transport-and-headers | issues | high | The headers primitive found no CSP, HSTS, nosniff, clickjacking protection, Referrer-Policy, or Permissions-Policy on the audited entry response. F11 high: Browser security headers are absent |
be-private-and-securedata-minimisation-and-third-parties | pass | medium | Tracker scan found no known trackers, cookies found no stored cookies, and the HAR traffic is limited to GREE identity/application domains. |
be-private-and-securein-context-permissions-and-modern-auth | issues | high | The login DOM exposes email/password and federated buttons but no WebAuthn/passkey capability; the page is an authentication surface where passkeys are relevant. F12 medium: Password-only authentication lacks a phishing-resistant option |
be-private-and-securedefensive-browser-policies | issues | high | The headers primitive found no CSP, HSTS, nosniff, clickjacking protection, Referrer-Policy, or Permissions-Policy on the audited entry response. F11 high: Browser security headers are absent |
be-resilientprogressive-enhancement | pass | medium | The final login form is server-rendered HTML and invalid submission is handled by a normal POST response; core credential entry does not depend on SPA rendering. |
be-resilientresilient-runtime-behaviour | pass | medium | The responsive form contains no overlays or fragile async widgets; password reveal repeated reliably ten times. |
be-resilientoffline-and-installable | not-applicable | high | This authentication gateway intrinsically requires a live identity service; installability and offline login are not meaningful. |
be-resilientnetwork-and-http-failure-states | pass | medium | Invalid authentication input returns a complete page with clear recovery links rather than a blank shell or infinite spinner. |
be-internationalisedlang-dir-and-logical-properties | pass | medium | The document declares lang=ja and the simple vertical form retains correct reading order and alignment at both viewports. |
be-internationalisedlocale-aware-data | not-applicable | high | No user-visible date, number, currency, duration, or calendar data appears on the audited login surface. |
be-internationalisedtime-zone-correctness | not-applicable | high | No user-visible event or time value appears on the audited login surface. |
be-trustworthyno-dark-patterns | pass | medium | The screenshots show clear login, recovery, provider, and registration options without forced consent, disguised advertising, or confirmshaming. |
be-trustworthyhumane-error-handling | issues | high | Empty submission returns clear Japanese errors, but the probe finds no role=alert messages and fields are not marked aria-invalid. F13 medium: Server errors are visible but not programmatically announced |
be-trustworthytrustworthy-input-assistance | issues | high | The visible email and password inputs have no labels and autocomplete is empty, preventing reliable password-manager and autofill assistance. F14 high: Login fields omit labels and autocomplete tokens |
be-trustworthysafe-commercial-and-account-flows | issues | high | The login DOM exposes email/password and federated buttons but no WebAuthn/passkey capability; the page is an authentication surface where passkeys are relevant. F12 medium: Password-only authentication lacks a phishing-resistant option |
be-sustainableoptimised-assets | pass | medium | The images primitive finds no img defects; total transfer is only 85,463 bytes and sprite assets are proportionate to the compact branded form. |
be-sustainableno-wasteful-work | pass | medium | The trace records no long tasks and the HAR shows only 15 load requests with no tracking or background media. |
be-sustainablethird-party-and-media-budget | pass | medium | No audio/video/autoplay or known trackers are present; total transferred bytes are 85,463 and all named origins belong to the GREE flow. |
be-agent-readystructured-agent-capabilities | not-applicable | high | This credential-entry gateway has no declared agent-facing capability and safely exposing authentication actions to generic agents is not an established requirement. |
be-agent-readyon-device-inference | not-applicable | high | The short login form has no summarisation, generation, or inference task where on-device AI would improve the experience. |
be-memory-efficientno-leak-under-repeated-interaction | pass | medium | After 10 password reveal/hide cycles, heap self size increased only 21,133 bytes (0.91%) in fresh comparable sessions, with no unbounded-growth signal. |
be-memory-efficientbounded-footprint | pass | medium | The post-interaction heap is about 2.35 MB self size with 52,552 nodes, proportionate to this small server-rendered form. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | medium | Before/post heap summaries show only a small bounded delta and no Detached* constructor among top retained constructors after repeated toggling. |
Provenance
Canonical report: results/atomic/reports/0869-a24_app_gree-pf_net.json
Report SHA-256: c96b96c9de64e454b9f50189565dbde54d1d13326d7fdc769f00dbb82e337002
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/a24_app_gree-pf_net/2026-07-28T10-02-42-026Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/a24_app_gree-pf_net/2026-07-28T10-02-42-026Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.