The catch-all for unnamed concealment

How the text is hidden

Parsers translate format-native facts onto the run: run.visible — would a human see this — plus run.invisibleReason saying why not, a set of run.flags, and the block's role. Most named techniques key on the reason (docx.vanish on hidden-attr, pptx.off-slide on off-canvas); others key on a flag (pdf.zero-area-glyph on run.flags.zeroArea, docx.web-hidden on run.flags.webHidden) or on where the text sits (html.preheader, pptx.alt-text on block.role). This rule reads only the first: run.visible == false && run.text != ''.

Why a model still reads it

Whatever made the text invisible to a reader — a hidden attribute, an off-page position, a paint mode — did not remove it from the file. Extraction walks the runs regardless, so the words are in the string the model receives even though nobody rendering the document would see them.

What we do about it

The rule carries fallbackOnly: true, and the rule engine splits the pack into specific and fallback rules: for each run it evaluates every specific rule first, and only if none matched does it try the fallback. That keeps a supported format from reporting the same concealment twice. Runs containing no letter or digit are dropped before findings are grouped, so invisible spacing and punctuation runs produce nothing. The pack grades it severity: "high", action: "flag", family: "A", so the text is left in text.canonical, the technique appears in summary.concealedRetained, and the verdict is suspicious. On a document the caller declares first-party, provenance lowers the severity by exactly one step. The claim that a new format inherits this rule is tested rather than asserted: a corpus case runs a pack filtered down to fallback-only rules and asserts the finding list contains this technique and nothing else.

How often it fires

0% of 1,244 real documents — 400 web pages (distinct hosts), 630 PDFs (contracts and web), 150 government Word documents, 65 SEC filings, measured 2026-08-21.

This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.