dommy 0.9.0 → 0.10.0

data/lib/dommy/html_elements.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "date"
+
 module Dommy
   # Base for specialized HTMLElement subclasses. Inherits reflection
   # helpers from Internal::ReflectedAttributes (also shared with
@@ -7,15 +9,74 @@ module Dommy
   class HTMLElement < Element
     include Internal::ReflectedAttributes
 
-    # HTML attribute names are case-insensitive — the browser DOM
-    # lowercases everything. Override to make this explicit at the
-    # HTMLElement level (Element's default would already pick this up
-    # via namespace inspection, but spelling it out shortcuts the
-    # namespace check for HTML's hot path).
-    def case_sensitive_attribute_names?
+    # WHATWG "actually disabled": a form control is disabled if it (or an
+    # ancestor <fieldset disabled>) is disabled — EXCEPT a control within that
+    # fieldset's first <legend> child is NOT disabled by the fieldset. This drives
+    # willValidate / constraint validation (the `:disabled` selector has its own
+    # equivalent in SelectorMatcher).
+    def disabled_by_ancestor_fieldset?
+      node = parent_element
+      while node
+        if node.local_name.to_s.casecmp?("fieldset") && node.has_attribute?("disabled")
+          legend = node.child_nodes.to_a.find do |c|
+            c.respond_to?(:local_name) && c.local_name.to_s.casecmp?("legend")
+          end
+          return false if legend&.contains?(self)
+
+          return true
+        end
+        node = node.parent_element
+      end
       false
     end
 
+    # Shared "limited to only non-negative numbers" long reflection (maxLength /
+    # minLength on input and textarea): a missing / negative / non-numeric
+    # content attribute reads as -1; assigning a negative value throws.
+    def parse_non_negative_reflected(attr)
+      raw = @__node__[attr]
+      return -1 if raw.nil?
+      # HTML "rules for parsing non-negative integers": leading ASCII whitespace,
+      # then digits; anything else (a sign, letters) is an error → -1.
+      m = raw.to_s.match(/\A[\t\n\f\r ]*(\d+)/)
+      m ? m[1].to_i : -1
+    end
+
+    def set_non_negative_reflected(attr, value)
+      n = value.to_i
+      raise DOMException::IndexSizeError, "#{attr} must be non-negative" if n.negative?
+
+      set_reflected_string(attr, n.to_s)
+    end
+
+    # HTML attribute names are case-insensitive only in an HTML document — the
+    # browser DOM lowercases everything there. In a non-HTML (XML) document even an
+    # HTML-namespaced element preserves case. Shortcuts Element's namespace check
+    # for HTML's hot path while honoring the document-kind condition.
+    def case_sensitive_attribute_names?
+      !@document.html_document?
+    end
+
+    # The `labels` NodeList for a labelable control: every <label> in the
+    # document whose labeled `control` resolves to this element — via an explicit
+    # `for=` reference OR by wrapping it as the label's first labelable
+    # descendant (so nested/ancestor labels count). Shared by button, input,
+    # meter, output, progress, select, and textarea. Live, so a retained
+    # reference reflects later DOM/type changes (e.g. an input turning `hidden`
+    # drops out of its labels). Memoized so it is the [SameObject] across reads.
+    def labels_node_list
+      el = self
+      @__labels_node_list ||= LiveNodeList.new do
+        me = el.__dommy_backend_node__
+        el.document.query_selector_all("label").select do |label|
+          next false unless label.respond_to?(:control)
+
+          c = label.control
+          c.respond_to?(:__dommy_backend_node__) && c.__dommy_backend_node__.equal?(me)
+        end
+      end
+    end
+
     private
 
     # HTML "rules for parsing integers": optional leading ASCII whitespace, an
@@ -32,8 +93,90 @@ module Dommy
 
   # `<a>` — exposes URL-component getters/setters via the `href`
   # attribute, plus reflected `target` / `download` / `rel` / `type`.
+  # Follow-the-hyperlink activation behavior shared by <a> and <area>. A
+  # non-canceled click on a hyperlink (with an href, no download attribute)
+  # navigates to its resolved URL: a same-document fragment change fires
+  # hashchange and updates :target; anything else is handed to the navigation
+  # delegate (which performs the real navigation, or records it by default).
+  module HyperlinkActivation
+    def activation_target?
+      has_attribute?("href")
+    end
+
+    def activation_behavior(_event)
+      return unless has_attribute?("href")
+      # download turns the click into a save, not a navigation — out of scope.
+      return if has_attribute?("download")
+
+      target = anchor_href
+      win = @document&.default_view
+      return if target.to_s.empty? || win.nil? || win.location.nil?
+
+      # A cross-document link hands off to the delegate without pre-mutating the
+      # location; a same-document fragment still updates the hash + :target.
+      win.location.__internal_navigate_to__(target, source: :link, sync_cross_doc: false)
+    end
+  end
+
+  # The activation behavior of a submit button: run the owning form's
+  # submission algorithm with this button as the submitter. This makes a click
+  # — a real user click, a synthesized driver click, or `button.click()` from
+  # JS — on a submit button submit its form (fire a SubmitEvent, then hand
+  # navigation to the delegate), with no driver-level special-casing. Mirrors
+  # HyperlinkActivation for the form side.
+  module SubmitButtonActivation
+    def activation_target?
+      __submit_button__?
+    end
+
+    def activation_behavior(_event)
+      return unless __submit_button__?
+
+      # `form` follows the form-owner algorithm (honoring a `form=` attribute) on
+      # both input and button, so a form-associated submit button outside its
+      # form still submits the right one.
+      form&.__run_form_submission__(self)
+    end
+  end
+
+  # The "Window-reflecting body element event handler set": setting one of these
+  # event handler IDL attributes on <body>/<frameset> (`body.onload = fn`)
+  # actually targets the WINDOW, per HTML — so `window.onload` fires. A
+  # non-reflected handler (`body.onclick`) stays on the element.
+  module WindowReflectingHandlers
+    REFLECTED_HANDLERS = %w[
+      onblur onerror onfocus onload onresize onscroll onafterprint onbeforeprint
+      onbeforeunload onhashchange onlanguagechange onmessage onmessageerror onoffline
+      ononline onpagehide onpageshow onpopstate onrejectionhandled onstorage
+      onunhandledrejection onunload
+    ].to_set.freeze
+
+    def __js_set__(key, value)
+      if key.is_a?(String) && REFLECTED_HANDLERS.include?(key) && (win = @document&.default_view)
+        return win.__js_set__(key, value)
+      end
+
+      super
+    end
+
+    def __js_get__(key)
+      if key.is_a?(String) && REFLECTED_HANDLERS.include?(key) && (win = @document&.default_view)
+        return win.__js_get__(key)
+      end
+
+      super
+    end
+  end
+
   class HTMLAnchorElement < HTMLElement
+    include HyperlinkActivation
     reflect_string :target, :download, :rel, :hreflang, :type
+
+    # WebIDL stringifier: `String(anchor)` / `anchor.toString()` is its href (the
+    # resolved absolute URL), not the element's serialization.
+    def to_s
+      anchor_href
+    end
     # URL-decomposition helpers. The anchor's `href` is resolved to
     # an absolute URL (inherited from Element#anchor_href); break it
     # into the standard components on demand.
@@ -69,6 +212,15 @@ module Dommy
       uri.scheme && uri.host ? "#{uri.scheme}://#{uri.host}#{port_suffix}" : ""
     end
 
+    # `a.text` is an alias for the element's descendant text content.
+    def text
+      text_content
+    end
+
+    def text=(v)
+      self.text_content = v.to_s
+    end
+
     def __js_get__(key)
       case key
       when "hash"
@@ -87,6 +239,17 @@ module Dommy
         port
       when "origin"
         origin
+      when "text"
+        text
+      else
+        super
+      end
+    end
+
+    def __js_set__(key, value)
+      case key
+      when "text"
+        self.text = value
       else
         super
       end
@@ -126,28 +289,50 @@ module Dommy
     # input/select/textarea/button/output/fieldset). Returned as a
     # live HTMLCollection so listening to `submit`/`reset` and
     # adding fields between accesses works as expected.
+    # `form.elements` — the listed controls owned by this form, in document tree
+    # order, excluding input type=image. Membership follows the WHATWG form-owner
+    # algorithm (a `form` content attribute overrides DOM nesting), NOT plain
+    # descendant containment, so controls associated via `form=id` are included
+    # and a control in a nested inner form is excluded. Memoized so the live
+    # collection is the [SameObject] each access returns.
+    LISTED_CONTROL_SELECTOR = "input, select, textarea, button, output, fieldset, object"
+
     def elements
       el = self
-      HTMLCollection.new do
-        el
-          .__dommy_backend_node__
-          .css("input, select, textarea, button, output, fieldset")
-          .map do |n|
-            el.document.wrap_node(n)
-          end
-          .compact
+      @elements ||= HTMLFormControlsCollection.new do
+        el.document.query_selector_all(LISTED_CONTROL_SELECTOR).select do |c|
+          next false if c.tag_name.to_s.casecmp?("input") && c.respond_to?(:type) && c.type.to_s.casecmp?("image")
+
+          el.__owns_control__(c)
+        end
       end
     end
 
+    # The form owner of a listed control, per WHATWG: when the control carries a
+    # `form` content attribute, its owner is the form element with that id (or
+    # nothing, if the id resolves to a non-form / nothing); otherwise it is the
+    # nearest ancestor form element.
+    def __owns_control__(control)
+      form_id = control.__dommy_backend_node__["form"].to_s
+      owner =
+        if form_id.empty?
+          control.closest("form")
+        else
+          target = control.document.get_element_by_id(form_id)
+          (target && target.tag_name.to_s.casecmp?("form")) ? target : nil
+        end
+      !owner.nil? && owner.__dommy_backend_node__.equal?(__dommy_backend_node__)
+    end
+
     def length
       elements.size
     end
 
-    # Spec: `submit()` performs form submission directly WITHOUT
-    # firing a `submit` event. This is the JS-only entry point —
-    # browsers don't run constraint validation either. Dommy has no
-    # navigation engine, so this is effectively a no-op (returns nil).
+    # Spec: `submit()` performs form submission directly WITHOUT firing a
+    # `submit` event and without constraint validation. Navigation is handed to
+    # the delegate (a no-op recording by default).
     def submit
+      __internal_navigate_for_submit__(nil)
       nil
     end
 
@@ -158,10 +343,11 @@ module Dommy
       dispatch_event(Event.new("reset", "bubbles" => true, "cancelable" => true))
     end
 
-    # Spec: `requestSubmit(submitter?)` is the JS counterpart that
-    # MIRRORS user-initiated submission — it runs constraint validation
-    # and fires a `submit` event. Returns true if not default-prevented.
-    # `submitter` (if given) must be a button inside this form.
+    # Spec: `requestSubmit(submitter?)` MIRRORS user-initiated submission — it
+    # fires a `submit` event (with the submitter), and on a non-canceled event
+    # hands the form navigation to the delegate. Returns true if not
+    # default-prevented. `submitter` (if given) must be a submit button inside
+    # this form.
     def request_submit(submitter = nil)
       if submitter
         unless submitter.respond_to?(:__dommy_backend_node__) && submitter.__dommy_backend_node__.ancestors.include?(@__node__)
@@ -174,7 +360,38 @@ module Dommy
         end
       end
 
-      dispatch_event(Event.new("submit", "bubbles" => true, "cancelable" => true))
+      __run_form_submission__(submitter)
+    end
+
+    # The form submission algorithm's observable core, shared by
+    # `requestSubmit()`, a submit button's activation (driver click), and Enter's
+    # implicit submission: fire a cancelable `SubmitEvent` (carrying the
+    # submitter), and — when nothing canceled it — hand the resulting navigation
+    # to the delegate. Returns true if not default-prevented. This is the single
+    # home for "a form was submitted"; callers that previously dispatched a bare
+    # `submit` event route here so the event is a real SubmitEvent (with
+    # submitter) and the navigation reaches the delegate.
+    def __run_form_submission__(submitter = nil)
+      not_canceled = dispatch_event(
+        SubmitEvent.new("submit", "bubbles" => true, "cancelable" => true, "submitter" => submitter)
+      )
+      __internal_navigate_for_submit__(submitter) if not_canceled
+      not_canceled
+    end
+
+    # Build the form data set and hand the resulting navigation to the delegate.
+    # Reuses the core FormSubmission serializer (submitter, method, action,
+    # enctype, GET query-stripping) — method-override is a host concern, so it's
+    # left off here (the delegate applies its own policy).
+    def __internal_navigate_for_submit__(submitter)
+      win = @document&.default_view
+      return if win.nil?
+
+      result = Dommy::Interaction::FormSubmission.new(self, submitter).submit!
+      win.__internal_navigate__(
+        url: result[:url], method: result[:method], params: result[:params],
+        enctype: result[:enctype], source: :form
+      )
     end
 
     # Walk all listed elements; the form is "valid" iff every
@@ -200,6 +417,12 @@ module Dommy
     end
 
     def __js_get__(key)
+      # HTMLFormElement is [LegacyOverrideBuiltIns]: a control whose name/id
+      # matches a builtin (`elements`, `length`, `submit`, `action`, …) shadows
+      # that builtin. So the named getter is consulted BEFORE the builtins.
+      named = named_controls[key.to_s]
+      return __named_getter_result__(key.to_s, named) if named && !named.empty?
+
       case key
       when "elements"
         elements
@@ -210,6 +433,39 @@ module Dommy
       end
     end
 
+    # A single matching control is returned directly; multiple matches yield a
+    # RadioNodeList. The list is memoized per name and refreshed in place so
+    # repeated named-getter reads return the [SameObject] (WebIDL requires
+    # `form.d === form.d`), while still reflecting live membership.
+    def __named_getter_result__(name, matches)
+      return matches.first if matches.length == 1
+
+      form = self
+      (@__radio_lists ||= {})[name] ||= RadioNodeList.new { form.named_controls[name] || [] }
+    end
+
+    # WebIDL named getter: the form's supported property names are the name/id
+    # of each of its listed controls.
+    def __js_named_props__
+      named_controls.keys
+    end
+
+    # name/id -> [controls], for the named getter (a name matching more than one
+    # control yields a RadioNodeList-like NodeList).
+    def named_controls
+      map = ::Hash.new { |h, k| h[k] = [] }
+      elements.each do |el|
+        next unless el.respond_to?(:__dommy_backend_node__)
+
+        node = el.__dommy_backend_node__
+        name = node["name"].to_s
+        map[name] << el unless name.empty?
+        id = node["id"].to_s
+        map[id] << el unless id.empty? || id == name
+      end
+      map
+    end
+
     js_methods %w[submit reset requestSubmit checkValidity reportValidity]
     def __js_call__(method, args)
       case method
@@ -231,6 +487,7 @@ module Dommy
 
   # `<input>` — covers the most-used form control surface.
   class HTMLInputElement < HTMLElement
+    include SubmitButtonActivation
     reflect_string :name, :placeholder, :min, :max, :step, :pattern, :autocomplete, default_value: "value"
     reflect_boolean :autofocus, :disabled, :required, :readonly, default_checked: "checked"
     # Own __js_call__ methods, on top of Element's.
@@ -239,6 +496,8 @@ module Dommy
       raw.empty? ? "text" : raw.downcase
     end
 
+    def __submit_button__? = %w[submit image].include?(type) && !disabled
+
     def type=(v)
       set_reflected_string("type", v)
     end
@@ -248,11 +507,21 @@ module Dommy
     # separately thereafter — matching browser semantics where the
     # `value` IDL attribute can drift from the `value` content attr.
     def value
-      sanitize_value(@__value.nil? ? reflected_string("value") : @__value)
+      raw = @__value.nil? ? reflected_string("value") : @__value
+      # checkbox/radio use the "default/on" value mode: with no value content
+      # attribute (and no assigned value) the IDL value is "on".
+      return "on" if raw.to_s.empty? && !@__node__.key?("value") && %w[checkbox radio].include?(type)
+
+      sanitize_value(raw)
     end
 
     def value=(v)
       raw = v.to_s
+      # WHATWG: a file input's value IDL setter throws unless set to the empty
+      # string (which clears the selection).
+      if type == "file" && !raw.empty?
+        raise DOMException::InvalidStateError, "a file input's value may only be set to the empty string"
+      end
       @__raw_value = raw
       @__value = raw
     end
@@ -260,6 +529,9 @@ module Dommy
     # `files` — for `<input type="file">`. Browsers populate this via
     # user interaction; in tests, code uses `__driver_set_files__` to seed it.
     def files
+      # `files` is null for every type other than file (WHATWG).
+      return nil unless type == "file"
+
       @__files ||= FileList.new
     end
 
@@ -269,21 +541,39 @@ module Dommy
       @__files = files_input.is_a?(FileList) ? files_input : FileList.new(Array(files_input))
     end
 
+    # maxLength / minLength reflect a "limited to only non-negative numbers"
+    # long: a missing / negative / non-numeric content attribute reads as -1.
+    def max_length = parse_non_negative_reflected("maxlength")
+    def min_length = parse_non_negative_reflected("minlength")
+
+    def max_length=(value)
+      set_non_negative_reflected("maxlength", value)
+    end
+
+    def min_length=(value)
+      set_non_negative_reflected("minlength", value)
+    end
+
     # Spec: the "value sanitization algorithm" runs lazily on read.
     # type=email/url trim leading/trailing ASCII whitespace; type=number
     # rejects non-finite floats by returning "" (badInput stays true
     # so validity surfaces the original raw value).
     def sanitize_value(raw)
       case type
+      # The one-line text types "strip newlines from the value" (WHATWG value
+      # sanitization) — a pasted multi-line string collapses to one line.
+      when "text", "search", "tel", "password"
+        strip_newlines(raw.to_s)
       when "email"
+        stripped = strip_newlines(raw.to_s)
         if @__node__.key?("multiple")
-          raw.to_s.split(",").map(&:strip).join(",")
+          stripped.split(",").map(&:strip).join(",")
         else
-          raw.to_s.strip
+          stripped.strip
         end
-
       when "url"
-        raw.to_s.strip
+        # Strip newlines, then leading/trailing whitespace.
+        strip_newlines(raw.to_s).strip
       when "number", "range"
         sanitize_number(raw)
       when "color"
@@ -294,6 +584,10 @@ module Dommy
       end
     end
 
+    def strip_newlines(str)
+      str.gsub(/[\r\n]/, "")
+    end
+
     def sanitize_number(raw)
       s = raw.to_s
       Float(s)
@@ -400,54 +694,489 @@ module Dommy
       @document&.__internal_bump_style_generation__
     end
 
-    # The radio button group: radios sharing this element's non-empty name and
-    # form owner (or, with no form, no form either). Orphan-tree grouping for
-    # detached radios is not modeled.
+    # Two controls share a form owner when both are formless, or both point at
+    # the same form element (compared by backend node identity).
+    def same_form_owner?(a, b)
+      return b.nil? if a.nil?
+      return false if b.nil?
+
+      a.__dommy_backend_node__.equal?(b.__dommy_backend_node__)
+    end
+
+    # The radio button group: radios in the SAME tree (root node — so an orphan
+    # subtree groups too) that share this element's non-empty name and form
+    # owner (two radios with no form owner still group, as long as they share a
+    # tree and name).
     def radio_group_members
       group_name = get_attribute("name").to_s
       return [self] if group_name.empty?
 
-      owner_form = form
-      scope = owner_form || @document
-      return [self] unless scope.respond_to?(:query_selector_all)
+      owner = form_owner
+      root = get_root_node
+      return [self] unless root.respond_to?(:query_selector_all)
+
+      members = root.query_selector_all("input[type='radio']").to_a.select do |radio|
+        next false unless radio.respond_to?(:form_owner)
+        next false unless radio.get_attribute("name").to_s == group_name
 
-      scope.query_selector_all("input[type='radio']").to_a.select do |radio|
-        radio.get_attribute("name").to_s == group_name && radio.form.equal?(owner_form)
+        same_form_owner?(owner, radio.form_owner)
       end
+      # `query_selector_all` searches descendants, so a detached radio (whose
+      # root node is itself) isn't returned — a radio is always in its own group.
+      members.any? { |m| m.__dommy_backend_node__.equal?(__dommy_backend_node__) } ? members : members + [self]
     end
 
     def labels
-      return [] if id.empty?
+      # A hidden input is not a labelable element, so it has no labels list.
+      return nil if type == "hidden"
 
-      @document.query_selector_all("label[for='#{id}']")
+      labels_node_list
     end
 
-    # Closest enclosing form (or nil if detached / not in a form).
+    # The form owner (WebIDL `input.form`): the form referenced by a `form=`
+    # content attribute (when it resolves to a form element), otherwise the
+    # nearest ancestor form.
     def form
+      form_owner
+    end
+
+    def form_owner
+      form_id = get_attribute("form").to_s
+      unless form_id.empty?
+        target = @document.get_element_by_id(form_id)
+        return (target && target.tag_name.to_s.casecmp?("form")) ? target : nil
+      end
+
       closest("form")
     end
 
-    # No real text selection; method stubs let callers proceed.
+    # Only these input types expose a variable-length text selection; the rest
+    # return null for the selection attributes and throw on the setters/methods.
+    SELECTION_TYPES = %w[text search url tel password].freeze
+
+    def supports_selection?
+      SELECTION_TYPES.include?(type)
+    end
+
+    def selection_start
+      return nil unless supports_selection?
+
+      @__selection_start ||= value.to_s.length
+    end
+
+    def selection_start=(v)
+      require_selection!
+      @__selection_start = clamp_selection_index(v)
+    end
+
+    def selection_end
+      return nil unless supports_selection?
+
+      @__selection_end ||= value.to_s.length
+    end
+
+    def selection_end=(v)
+      require_selection!
+      @__selection_end = clamp_selection_index(v)
+    end
+
+    def selection_direction
+      return nil unless supports_selection?
+
+      @__selection_direction || "none"
+    end
+
+    def selection_direction=(v)
+      require_selection!
+      @__selection_direction = normalize_selection_direction(v)
+    end
+
+    # `select()` selects the whole control on a text control; on any other type
+    # it is a silent no-op (it does NOT throw).
     def select
+      return nil unless supports_selection?
+
+      @__selection_start = 0
+      @__selection_end = value.to_s.length
+      @__selection_direction = "none"
       nil
     end
 
-    def set_selection_range(_start, _end, _direction = nil)
+    def set_selection_range(start, finish, direction = nil)
+      require_selection!
+      len = value.to_s.length
+      e = clamp_selection_index(finish, len)
+      s = [clamp_selection_index(start, len), e].min
+      @__selection_start = s
+      @__selection_end = e
+      @__selection_direction = normalize_selection_direction(direction)
       nil
     end
 
     def set_range_text(_replacement, *_)
+      require_selection!
       nil
     end
 
-    def step_up(_n = 1)
-      nil
+    # Raise on the selection setters/methods for a type that has no text
+    # selection (email, number, checkbox, …).
+    def require_selection!
+      return if supports_selection?
+
+      raise DOMException::InvalidStateError, "The input element's type ('#{type}') does not support selection."
+    end
+
+    def clamp_selection_index(v, len = value.to_s.length)
+      n = v.to_i
+      n.negative? ? 0 : [n, len].min
+    end
+
+    def normalize_selection_direction(v)
+      d = v.to_s
+      %w[forward backward].include?(d) ? d : "none"
+    end
+
+    # Input types whose value has a numeric representation (valueAsNumber /
+    # stepUp / stepDown apply).
+    def numeric_value_type?
+      %w[number range date month week time datetime-local].include?(type)
+    end
+
+    def range_min
+      Float(@__node__["min"].to_s) rescue 0.0
+    end
+
+    def range_max
+      Float(@__node__["max"].to_s) rescue 100.0
+    end
+
+    # A range with no (valid) value defaults to the midpoint of its range, or the
+    # minimum when the maximum is below it.
+    def default_range_value(lo, hi)
+      hi < lo ? lo : lo + (hi - lo) / 2.0
+    end
+
+    # The declared step (default 1 for number, 1 for range); "any" disables
+    # stepping (returns nil).
+    def step_base_value
+      raw = @__node__["step"].to_s.strip
+      return nil if raw.casecmp?("any")
+
+      s = (Float(raw) rescue nil)
+      s && s > 0 ? s : default_step
     end
 
-    def step_down(_n = 1)
+    # stepUp/stepDown throw when the type has no allowed value step: a type with
+    # no number representation, or step="any". Otherwise the value moves by
+    # `count` steps (in valueAsNumber units), clamped/aligned to the min & max.
+    def apply_step(count)
+      unless numeric_value_type?
+        raise DOMException::InvalidStateError, "stepUp/stepDown is not applicable to input type '#{type}'"
+      end
+
+      step = step_base_value
+      if step.nil?
+        raise DOMException::InvalidStateError, "stepUp/stepDown is not allowed when step is 'any'"
+      end
+      return if count.zero?
+
+      allowed = step * step_scale_factor
+      mn = step_boundary("min")
+      mx = step_boundary("max")
+      # A min above the max means no in-range value exists — do nothing.
+      return if mn && mx && mn > mx
+
+      before = value_as_number
+      base = before.nan? ? (mn || 0.0) : before
+      result = base + count * allowed
+
+      step_base = mn || 0.0
+      result = mx - (mx - step_base) % allowed if mx && result > mx
+      result = mn + (step_base - mn) % allowed if mn && result < mn
+
+      # Clamping must never move the value against the step direction (e.g. a
+      # stepDown on a value already below min must not jump UP to min).
+      unless before.nan?
+        return if count.positive? && result < before
+        return if count.negative? && result > before
+      end
+
+      self.value_as_number = result
       nil
     end
 
+    # The scale that turns one declared step into valueAsNumber units (ms for the
+    # date/time types, natural units for number/range/month).
+    def step_scale_factor
+      case type
+      when "date" then 86_400_000
+      when "week" then 604_800_000
+      when "time", "datetime-local" then 1000
+      else 1
+      end
+    end
+
+    # The default allowed step (in the type's own step units) when `step` is
+    # absent or invalid: 60 (seconds) for time/datetime-local, 1 otherwise.
+    def default_step
+      %w[time datetime-local].include?(type) ? 60.0 : 1.0
+    end
+
+    # The `min`/`max` boundary as a valueAsNumber, or nil when absent/unparseable.
+    def step_boundary(attr)
+      raw = @__node__[attr].to_s.strip
+      return nil if raw.empty?
+
+      case type
+      when "number", "range" then (Float(raw) rescue nil)
+      when "date" then nan_to_nil(date_string_to_ms(raw))
+      when "time" then nan_to_nil(time_string_to_ms(raw))
+      when "datetime-local" then nan_to_nil(datetime_local_string_to_ms(raw))
+      when "month" then nan_to_nil(month_string_to_number(raw))
+      when "week" then nan_to_nil(week_string_to_ms(raw))
+      end
+    end
+
+    def nan_to_nil(n)
+      n.nan? ? nil : n
+    end
+
+    # JS Number-to-string: an integral value drops the trailing ".0".
+    def number_to_string(n)
+      return "" if n.nan?
+
+      n == n.to_i ? n.to_i.to_s : n.to_s
+    end
+
+    # WHATWG "valid floating-point number": no surrounding whitespace (unlike
+    # Ruby's Float()), optional sign, digits with optional fraction, optional
+    # exponent. Anything else — including " 1 " or "1e" — yields NaN.
+    VALID_FLOAT_RE = /\A-?(?:\d+\.?\d*|\.\d+)(?:[eE][-+]?\d+)?\z/
+
+    def parse_valid_float(str)
+      s = str.to_s
+      VALID_FLOAT_RE.match?(s) ? (Float(s) rescue ::Float::NAN) : ::Float::NAN
+    end
+
+    # --- Date/time "convert a string to a number" algorithms (all UTC) --------
+
+    def date_string_to_ms(s)
+      m = /\A(\d{4,})-(\d{2})-(\d{2})\z/.match(s.strip)
+      return ::Float::NAN unless m
+
+      y, mo, d = m[1].to_i, m[2].to_i, m[3].to_i
+      return ::Float::NAN if y < 1 || !::Date.valid_date?(y, mo, d)
+
+      ::Time.utc(y, mo, d).to_i * 1000.0
+    end
+
+    def time_string_to_ms(s)
+      m = /\A(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,3}))?)?\z/.match(s.strip)
+      return ::Float::NAN unless m
+
+      h, mi, se = m[1].to_i, m[2].to_i, m[3].to_i
+      return ::Float::NAN if h > 23 || mi > 59 || se > 59
+
+      frac = m[4] ? m[4].ljust(3, "0").to_i : 0
+      ((h * 3600 + mi * 60 + se) * 1000 + frac).to_f
+    end
+
+    def datetime_local_string_to_ms(s)
+      # The date/time separator may be "T" or a space (the "parse a local date
+      # and time string" algorithm accepts both).
+      m = /\A(\d{4,})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,3}))?)?\z/.match(s.strip)
+      return ::Float::NAN unless m
+
+      y, mo, d, h, mi, se = m[1].to_i, m[2].to_i, m[3].to_i, m[4].to_i, m[5].to_i, m[6].to_i
+      return ::Float::NAN if y < 1 || !::Date.valid_date?(y, mo, d) || h > 23 || mi > 59 || se > 59
+
+      frac = m[7] ? m[7].ljust(3, "0").to_i : 0
+      (::Time.utc(y, mo, d, h, mi, se).to_i * 1000 + frac).to_f
+    end
+
+    def month_string_to_number(s)
+      m = /\A(\d{4,})-(\d{2})\z/.match(s.strip)
+      return ::Float::NAN unless m
+
+      y, mo = m[1].to_i, m[2].to_i
+      return ::Float::NAN if y < 1 || mo < 1 || mo > 12
+
+      ((y - 1970) * 12 + (mo - 1)).to_f
+    end
+
+    def week_string_to_ms(s)
+      m = /\A(\d{4,})-W(\d{2})\z/.match(s.strip)
+      return ::Float::NAN unless m
+
+      y, w = m[1].to_i, m[2].to_i
+      return ::Float::NAN if y < 1 || w < 1
+
+      # Date.commercial raises for a week beyond the ISO year's 52/53 weeks.
+      d = ::Date.commercial(y, w, 1)
+      ::Time.utc(d.year, d.month, d.day).to_i * 1000.0
+    rescue ::ArgumentError
+      ::Float::NAN
+    end
+
+    # --- Inverse: "convert a number to a string" for the date/time types -------
+
+    def utc_time_from_ms(ms)
+      ::Time.at(ms / 1000.0).utc
+    end
+
+    def ms_to_date_string(ms)
+      return "" if ms.nan?
+
+      t = utc_time_from_ms(ms)
+      format("%04d-%02d-%02d", t.year, t.month, t.day)
+    rescue ::RangeError, ::ArgumentError, ::FloatDomainError
+      ""
+    end
+
+    def ms_to_time_string(ms)
+      return "" if ms.nan?
+
+      v = (ms % 86_400_000).to_i
+      h = v / 3_600_000
+      mi = (v % 3_600_000) / 60_000
+      se = (v % 60_000) / 1000
+      frac = v % 1000
+      if se.zero? && frac.zero?
+        format("%02d:%02d", h, mi)
+      elsif frac.zero?
+        format("%02d:%02d:%02d", h, mi, se)
+      else
+        format("%02d:%02d:%02d.%03d", h, mi, se, frac)
+      end
+    end
+
+    def ms_to_datetime_local_string(ms)
+      return "" if ms.nan?
+
+      t = utc_time_from_ms(ms)
+      return "" if t.year < 1 || t.year > 9999
+
+      base = format("%04d-%02d-%02dT%02d:%02d", t.year, t.month, t.day, t.hour, t.min)
+      frac = (ms % 1000).to_i
+      if t.sec.zero? && frac.zero?
+        base
+      elsif frac.zero?
+        base + format(":%02d", t.sec)
+      else
+        base + format(":%02d.%03d", t.sec, frac)
+      end
+    rescue ::RangeError, ::ArgumentError, ::FloatDomainError
+      ""
+    end
+
+    def number_to_month_string(n)
+      return "" if n.nan?
+
+      months = n.to_i
+      y = 1970 + (months.fdiv(12).floor)
+      mo = months % 12
+      format("%04d-%02d", y, mo + 1)
+    end
+
+    def ms_to_week_string(ms)
+      return "" if ms.nan?
+
+      t = utc_time_from_ms(ms)
+      d = ::Date.new(t.year, t.month, t.day)
+      format("%04d-W%02d", d.cwyear, d.cweek)
+    rescue ::RangeError, ::ArgumentError, ::FloatDomainError
+      ""
+    end
+
+    # `valueAsNumber` — the control's value as a number, per the type's
+    # "convert a string to a number" algorithm (NaN when the type has no number
+    # representation or the value doesn't parse). number/range are plain floats;
+    # range additionally defaults to its midpoint and clamps to [min, max].
+    def value_as_number
+      case type
+      when "number"
+        parse_valid_float(value.to_s)
+      when "range"
+        n = parse_valid_float(value.to_s)
+        n = nil if n.nan?
+        lo = range_min
+        hi = range_max
+        n = default_range_value(lo, hi) if n.nil?
+        n.clamp(lo, hi)
+      when "date"
+        date_string_to_ms(value.to_s)
+      when "time"
+        time_string_to_ms(value.to_s)
+      when "datetime-local"
+        datetime_local_string_to_ms(value.to_s)
+      when "month"
+        month_string_to_number(value.to_s)
+      when "week"
+        week_string_to_ms(value.to_s)
+      else
+        ::Float::NAN
+      end
+    end
+
+    def value_as_number=(n)
+      f = n.to_f
+      case type
+      when "number", "range"
+        self.value = f.nan? ? "" : number_to_string(f)
+      when "date"
+        self.value = ms_to_date_string(f)
+      when "time"
+        self.value = ms_to_time_string(f)
+      when "datetime-local"
+        self.value = ms_to_datetime_local_string(f)
+      when "month"
+        self.value = number_to_month_string(f)
+      when "week"
+        self.value = ms_to_week_string(f)
+      else
+        raise DOMException::InvalidStateError, "valueAsNumber is not applicable to input type '#{type}'"
+      end
+    end
+
+    # Numeric-domain accessors shared with constraint validation (rangeUnderflow
+    # / rangeOverflow / stepMismatch), all in valueAsNumber units.
+    def min_as_number
+      step_boundary("min")
+    end
+
+    def max_as_number
+      step_boundary("max")
+    end
+
+    # The allowed value step in valueAsNumber units, or nil for step="any" / a
+    # type with no stepping.
+    def allowed_value_step
+      return nil unless numeric_value_type?
+
+      step = step_base_value
+      step.nil? ? nil : step * step_scale_factor
+    end
+
+    # The step base for validation: the min boundary if present, else 0.
+    def validation_step_base
+      return min_as_number if min_as_number
+
+      # The default step base is 0 for most types, but a `week` control aligns to
+      # the Monday of 1970-W01 (the epoch is mid-week), so an unmatched default
+      # base would report every whole week as a step mismatch.
+      type == "week" ? week_string_to_ms("1970-W01") : 0.0
+    end
+
+    # `stepUp(n)` / `stepDown(n)` add/subtract n steps to the current number. The
+    # WebIDL default for n is 1 (a missing/undefined arg crosses as nil).
+    def step_up(n = 1)
+      apply_step((n || 1).to_i)
+    end
+
+    def step_down(n = 1)
+      apply_step(-(n || 1).to_i)
+    end
+
     def validity
       @__validity ||= ValidityState.new(self)
     end
@@ -456,8 +1185,11 @@ module Dommy
     # Disabled / hidden / button-type inputs return false.
     def will_validate
       return false if reflected_boolean("disabled")
+      return false if disabled_by_ancestor_fieldset?
       return false if reflected_boolean("readonly")
       return false if %w[hidden button submit reset image].include?(type)
+      # A control with a datalist ancestor is barred from constraint validation.
+      return false unless closest("datalist").nil?
 
       true
     end
@@ -514,23 +1246,81 @@ module Dommy
         validation_message
       when "files"
         files
+      when "selectionStart"
+        selection_start
+      when "selectionEnd"
+        selection_end
+      when "selectionDirection"
+        selection_direction
+      when "valueAsNumber"
+        value_as_number
+      when "maxLength"
+        max_length
+      when "minLength"
+        min_length
+      when "list"
+        list
       else
         super
       end
     end
 
+    # HTML "cloning steps" for input: the dirty value flag + value and the dirty
+    # checkedness flag + checkedness (plus indeterminate) — the user-modified
+    # state a clone must retain beyond the default* content attributes. Returns
+    # nil when the control is still pristine, so the walk skips it.
+    def __cloning_state__
+      state = {}
+      state[:value] = @__value unless @__value.nil?
+      state[:raw_value] = @__raw_value unless @__raw_value.nil?
+      state[:checked] = @__checked unless @__checked.nil?
+      state[:indeterminate] = @__indeterminate unless @__indeterminate.nil?
+      state.empty? ? nil : state
+    end
+
+    def __apply_cloning_state__(state)
+      @__value = state[:value] if state.key?(:value)
+      @__raw_value = state[:raw_value] if state.key?(:raw_value)
+      @__checked = state[:checked] if state.key?(:checked)
+      @__indeterminate = state[:indeterminate] if state.key?(:indeterminate)
+    end
+
+    # HTMLInputElement.list — the <datalist> referenced by the `list` content
+    # attribute (resolved by id, first element in tree order). Null when there
+    # is no `list` attribute, no element with that id, or the referenced element
+    # is not a <datalist>.
+    def list
+      id = get_attribute("list")
+      return nil if id.nil? || id.empty?
+
+      element = @document.get_element_by_id(id)
+      element.is_a?(HTMLDataListElement) ? element : nil
+    end
+
     def __js_set__(key, value)
       case key
       when "type"
         set_reflected_string("type", value)
       when "value"
         self.value = value
+      when "valueAsNumber"
+        self.value_as_number = value
+      when "selectionStart"
+        self.selection_start = value
+      when "selectionEnd"
+        self.selection_end = value
+      when "selectionDirection"
+        self.selection_direction = value
       when "checked"
         self.checked = value
       when "indeterminate"
         self.indeterminate = value
       when "readonly", "readOnly"
         self.readonly = value
+      when "maxLength"
+        self.max_length = value
+      when "minLength"
+        self.min_length = value
       else
         super
       end
@@ -566,34 +1356,45 @@ module Dommy
 
   # `<button>` — type defaults to "submit" per spec.
   class HTMLButtonElement < HTMLElement
+    include SubmitButtonActivation
     reflect_string :name, form_action: "formaction", form_enctype: "formenctype", form_method: "formmethod", form_target: "formtarget"
-    reflect_boolean form_no_validate: "formnovalidate"
+    reflect_boolean :disabled, :autofocus, form_no_validate: "formnovalidate"
     def type
       raw = @__node__["type"].to_s.downcase
       %w[submit reset button].include?(raw) ? raw : "submit"
     end
 
+    def __submit_button__? = type == "submit" && !disabled
+
     def type=(v)
       set_reflected_string("type", v)
     end
 
+    # The form owner: a `form=` attribute pointing at a form (form-associated
+    # element, so a button can live outside its form), else the nearest ancestor
+    # form. Mirrors HTMLInputElement#form_owner.
     def form
+      form_id = get_attribute("form").to_s
+      unless form_id.empty?
+        target = @document.get_element_by_id(form_id)
+        return (target && target.tag_name.to_s.casecmp?("form")) ? target : nil
+      end
+
       closest("form")
     end
 
     def labels
-      return [] if id.empty?
-
-      @document.query_selector_all("label[for='#{id}']")
+      labels_node_list
     end
 
     def validity
       @__validity ||= ValidityState.new(self)
     end
 
-    # Buttons don't participate in constraint validation (per spec).
+    # Only a submit button is a candidate for constraint validation; reset /
+    # button types are barred, as are disabled controls and datalist descendants.
     def will_validate
-      false
+      type == "submit" && !disabled && !disabled_by_ancestor_fieldset? && closest("datalist").nil?
     end
 
     def validation_message
@@ -640,6 +1441,20 @@ module Dommy
         super
       end
     end
+
+    js_methods %w[checkValidity reportValidity setCustomValidity]
+    def __js_call__(method, args)
+      case method
+      when "checkValidity"
+        check_validity
+      when "reportValidity"
+        report_validity
+      when "setCustomValidity"
+        set_custom_validity(args[0])
+      else
+        super
+      end
+    end
   end
 
   # `<img>` — reflected URL/dimension attributes. Dommy has no real
@@ -898,7 +1713,8 @@ module Dommy
     ]
       .freeze
 
-    EMAIL_RE = /\A[^@\s]+@[^@\s]+\.[^@\s]+\z/
+    # The exact WHATWG "valid email address" production.
+    EMAIL_RE = %r{\A[a-zA-Z0-9.!\#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*\z}
     URL_SCHEMES = %w[http:// https:// ftp://].freeze
 
     def initialize(host = nil)
@@ -907,14 +1723,53 @@ module Dommy
 
     # ---- Computed flags ----
 
+    # A control that is disabled or readonly is barred from constraint
+    # validation — none of the "suffering from" flags apply.
+    def host_barred?
+      return false unless @host
+
+      disabled = host_attr_present?("disabled")
+      readonly = @host.respond_to?(:readonly) ? @host.readonly : host_attr_present?("readonly")
+      disabled || readonly
+    end
+
     def value_missing
       return false unless @host && host_attr_present?("required")
 
       case host_type
-      when "checkbox", "radio"
-        !host_attr_present?("checked")
+      when "checkbox"
+        # The checkbox/radio "being missing" flag reflects checkedness even when
+        # the control is barred (only willValidate gates participation).
+        !host_checked?
+      when "radio"
+        # An unnamed radio is not part of a group and is never missing.
+        return false if @host.respond_to?(:get_attribute) && @host.get_attribute("name").to_s.empty?
+
+        # A required radio is missing only when NO member of its group (same
+        # name/form owner/tree) is checked — using runtime checkedness.
+        if @host.respond_to?(:radio_group_members)
+          @host.radio_group_members.none? { |r| r.respond_to?(:checked) ? r.checked : false }
+        else
+          !host_checked?
+        end
+      when "file"
+        files = @host.respond_to?(:files) ? @host.files : nil
+        files.nil? || files.length.zero?
+      when "select-one", "select-multiple"
+        # A required select is missing when its selected option has an empty
+        # value (the placeholder label option); the flag isn't barred by disabled.
+        @host.respond_to?(:value) && @host.value.to_s.empty?
       else
-        host_value.to_s.empty?
+        # Text-like controls only "suffer from being missing" when mutable.
+        return false if host_barred?
+
+        # A date/number type with an unparseable value has no value (its
+        # sanitized value is empty), so it counts as missing.
+        if @host.respond_to?(:numeric_value_type?) && @host.send(:numeric_value_type?)
+          @host.value_as_number.nan?
+        else
+          host_value.to_s.empty?
+        end
       end
     end
 
@@ -926,7 +1781,12 @@ module Dommy
 
       case host_type
       when "email"
-        !v.match?(EMAIL_RE)
+        # A `multiple` email is a comma-separated list; every part must be valid.
+        if host_attr_present?("multiple")
+          v.split(",", -1).any? { |part| !part.strip.match?(EMAIL_RE) }
+        else
+          !v.match?(EMAIL_RE)
+        end
       when "url"
         URL_SCHEMES.none? { |s| v.start_with?(s) }
       else
@@ -943,71 +1803,74 @@ module Dommy
       v = host_value.to_s
       return false if v.empty?
 
+      # The pattern must be a valid regex ON ITS OWN — validate it before
+      # anchoring, so an unbalanced `a)(b` (which the `(?:…)` wrapper would
+      # otherwise balance) is correctly discarded rather than silently matched.
+      Regexp.new(pat)
       !Regexp.new("\\A(?:#{pat})\\z").match?(v)
     rescue RegexpError
       false
     end
 
+    # tooLong / tooShort apply ONLY when the value was last changed by a USER
+    # EDIT (not a script assignment), per the WHATWG "suffering from being too
+    # long/short" definitions. Dommy has no interactive text entry, so a value is
+    # never user-edited and these constraints never fire.
     def too_long
-      return false unless @host
-
-      max = host_attr_value("maxlength").to_s
-      return false if max.empty?
-
-      max_n = max.to_i
-      return false if max_n < 0
-
-      host_value.to_s.length > max_n
+      false
     end
 
     def too_short
-      return false unless @host
-
-      min = host_attr_value("minlength").to_s
-      return false if min.empty?
-
-      min_n = min.to_i
-      return false if min_n < 0
-
-      v = host_value.to_s
-      !v.empty? && v.length < min_n
+      false
     end
 
     def range_underflow
       return false unless numeric_host?
 
-      min = host_attr_value("min").to_s
-      return false if min.empty?
+      min = @host.min_as_number
+      return false if min.nil?
+
+      num = @host.value_as_number
+      return false if num.nan?
+      # A `time` control has a periodic domain: min > max means a REVERSED range
+      # whose accepted values are `>= min` OR `<= max`, so both underflow and
+      # overflow hold for a value in the excluded gap (max, min).
+      max = @host.max_as_number
+      return num > max && num < min if reversed_range?(min, max)
 
-      num = numeric_value
-      num && num < min.to_f
+      num < min
     end
 
     def range_overflow
       return false unless numeric_host?
 
-      max = host_attr_value("max").to_s
-      return false if max.empty?
+      max = @host.max_as_number
+      return false if max.nil?
+
+      num = @host.value_as_number
+      return false if num.nan?
+      min = @host.min_as_number
+      return num > max && num < min if reversed_range?(min, max)
+
+      num > max
+    end
 
-      num = numeric_value
-      num && num > max.to_f
+    # A reversed range only exists for the periodic `time` domain with min > max.
+    def reversed_range?(min, max)
+      host_type == "time" && min && max && min > max
     end
 
     def step_mismatch
       return false unless numeric_host?
 
-      step = host_attr_value("step").to_s
-      return false if step.empty? || step == "any"
-
-      step_n = step.to_f
-      return false if step_n <= 0
+      step = @host.allowed_value_step
+      return false if step.nil?
 
-      num = numeric_value
-      return false unless num
+      num = @host.value_as_number
+      return false if num.nan?
 
-      base = host_attr_value("min").to_s
-      base_n = base.empty? ? 0.0 : base.to_f
-      ((num - base_n) / step_n - ((num - base_n) / step_n).round).abs > 1e-9
+      ratio = (num - @host.validation_step_base) / step
+      (ratio - ratio.round).abs > 1e-7
     end
 
     # `badInput` flags input that the user agent couldn't convert to
@@ -1106,6 +1969,12 @@ module Dommy
       @host.__dommy_backend_node__.key?(name.to_s)
     end
 
+    # Runtime checkedness of a checkbox/radio host (the `.checked` IDL state,
+    # which can drift from the `checked` content attribute).
+    def host_checked?
+      @host.respond_to?(:checked) ? @host.checked : host_attr_present?("checked")
+    end
+
     def host_type
       return nil unless @host
 
@@ -1119,7 +1988,8 @@ module Dommy
     end
 
     def numeric_host?
-      @host.is_a?(HTMLInputElement) && %w[number range].include?(host_type)
+      @host.is_a?(HTMLInputElement) && @host.respond_to?(:numeric_value_type?) &&
+        @host.send(:numeric_value_type?)
     end
 
     def numeric_value
@@ -1139,41 +2009,120 @@ module Dommy
 
   # `<option>` — value, label, selected, disabled, text, index, form.
   class HTMLOptionElement < HTMLElement
-    reflect_boolean :selected, :disabled
+    reflect_boolean :disabled
     def value
-      # Per spec, value defaults to text content if the `value`
-      # attribute is absent.
-      @__node__.key?("value") ? @__node__["value"].to_s : text_content
+      # `value`/`label` reflect the NO-namespace content attribute (a same-named
+      # attribute in another namespace, via setAttributeNS, does not count);
+      # both default to the option's `text` when their attribute is absent.
+      has_attribute_ns?(nil, "value") ? get_attribute_ns(nil, "value").to_s : text
+    end
+
+    def value=(v)
+      set_reflected_string("value", v)
+    end
+
+    def label
+      has_attribute_ns?(nil, "label") ? get_attribute_ns(nil, "label").to_s : text
+    end
+
+    def label=(v)
+      set_reflected_string("label", v)
+    end
+
+    # `defaultSelected` reflects the `selected` content attribute.
+    def default_selected
+      reflected_boolean("selected")
+    end
+
+    def default_selected=(v)
+      set_reflected_boolean("selected", v)
+    end
+
+    # `selected` is the selectedness state. It is a distinct boolean (the IDL
+    # getter returns it directly), initialised from defaultSelected. While the
+    # dirtiness flag is false, adding/removing the `selected` content attribute
+    # re-syncs selectedness to it; the IDL setter makes it dirty so it then holds
+    # its value independently of the attribute.
+    def selected
+      @selectedness = default_selected if @selectedness.nil?
+      @selectedness
+    end
+
+    def selected=(value)
+      @selectedness = !!value
+      @selectedness_dirty = true
     end
 
-    def value=(v)
-      set_reflected_string("value", v)
+    # Set selectedness WITHOUT marking it dirty (the Option constructor's step).
+    def __internal_set_selectedness__(value)
+      @selectedness = !!value
     end
 
-    def label
-      @__node__.key?("label") ? @__node__["label"].to_s : text_content
+    # Whether selectedness was set via the IDL setter (property), as opposed to
+    # only the content attribute — a single-select shows the most recently
+    # property-selected option in preference to an attribute-selected one.
+    def __selectedness_dirty__
+      @selectedness_dirty || false
     end
 
-    def label=(v)
-      set_reflected_string("label", v)
+    # Keep the `selected` content attribute and selectedness in sync (while not
+    # dirty) by hooking the attribute mutators, the way <details> tracks `open`.
+    def set_attribute(name, value)
+      result = super
+      sync_selectedness_from_attribute if name.to_s.casecmp?("selected")
+      result
     end
 
-    def default_selected
-      selected
+    def remove_attribute(name)
+      result = super
+      sync_selectedness_from_attribute if name.to_s.casecmp?("selected")
+      result
     end
 
-    def default_selected=(v)
-      self.selected = v
+    def sync_selectedness_from_attribute
+      @selectedness = default_selected unless @selectedness_dirty
     end
 
     def text
-      text_content
+      # WHATWG: strip-and-collapse ASCII whitespace over the concatenated Text
+      # node descendants — excluding any inside a script (HTML or SVG) element.
+      parts = []
+      collect_option_text(@__node__, parts)
+      parts.join.gsub(/[\t\n\f\r ]+/, " ").strip
     end
 
     def text=(v)
       self.text_content = v
     end
 
+    private
+
+    def collect_option_text(node, parts)
+      node.children.each do |child|
+        if child.text?
+          parts << child.content
+        elsif child.element? && !excluded_from_option_text?(child)
+          collect_option_text(child, parts)
+        end
+      end
+    end
+
+    # Per spec, option.text skips the descendants of an HTML/SVG `script` and an
+    # HTML `style` element — but NOT a same-named element in another namespace
+    # (a MathML or null-namespace `<script>` still contributes its text).
+    def excluded_from_option_text?(node)
+      name = node.name.to_s.downcase
+      return false unless %w[script style].include?(name)
+
+      el = @document.wrap_node(node)
+      ns = el.respond_to?(:namespace_uri) ? el.namespace_uri : nil
+      html = "http://www.w3.org/1999/xhtml"
+      svg = "http://www.w3.org/2000/svg"
+      name == "script" ? [html, svg].include?(ns) : ns == html
+    end
+
+    public
+
     def form
       closest("form")
     end
@@ -1194,6 +2143,8 @@ module Dommy
         label
       when "defaultSelected"
         default_selected
+      when "selected"
+        selected
       when "text"
         text
       when "form"
@@ -1211,8 +2162,10 @@ module Dommy
         self.value = v
       when "label"
         self.label = v
-      when "selected", "defaultSelected"
+      when "selected"
         self.selected = v
+      when "defaultSelected"
+        self.default_selected = v
       when "text"
         self.text = v
       else
@@ -1231,15 +2184,21 @@ module Dommy
   class HTMLTextAreaElement < HTMLElement
     reflect_string :name, :placeholder, :wrap, :autocomplete
     # Own __js_call__ methods, on top of Element's.
+
+    # The API value is the "raw value" — the dirty value once set (a wrapper-level
+    # flag, NOT a content attribute, so `setAttribute("value", …)` can't touch it),
+    # otherwise the default value (the element's child text content).
     def value
-      @__node__["value"] || text_content
+      @__value_dirty ? @__value.to_s : default_value
     end
 
     def value=(v)
-      @__node__["value"] = v.to_s
-      self.text_content = v.to_s
+      @__value = v.to_s
+      @__value_dirty = true
     end
 
+    # defaultValue is the child text content; setting it (or `text`) leaves the
+    # dirty value flag alone.
     def default_value
       text_content
     end
@@ -1248,6 +2207,19 @@ module Dommy
       self.text_content = v
     end
 
+    # HTML cloning steps: copy the dirty value flag + raw value so a clone keeps
+    # the user-entered text rather than reverting to the default (child text).
+    def __cloning_state__
+      @__value_dirty ? { value: @__value, dirty: true } : nil
+    end
+
+    def __apply_cloning_state__(state)
+      return unless state[:dirty]
+
+      @__value = state[:value]
+      @__value_dirty = true
+    end
+
     def rows
       (@__node__["rows"] || "2").to_i
     end
@@ -1264,14 +2236,28 @@ module Dommy
       set_reflected_string("cols", v.to_s)
     end
 
+    # `maxLength` / `minLength` reflect a "limited to only non-negative numbers"
+    # long: a missing / negative / non-numeric content attribute is -1.
     def max_length
-      (@__node__["maxlength"] || "-1").to_i
+      parse_non_negative_reflected("maxlength")
     end
 
     def min_length
-      (@__node__["minlength"] || "-1").to_i
+      parse_non_negative_reflected("minlength")
+    end
+
+    def max_length=(value)
+      set_non_negative_reflected("maxlength", value)
+    end
+
+    def min_length=(value)
+      set_non_negative_reflected("minlength", value)
     end
 
+    private
+
+    public
+
     def text_length
       value.length
     end
@@ -1285,9 +2271,7 @@ module Dommy
     end
 
     def labels
-      return [] if id.empty?
-
-      @document.query_selector_all("label[for='#{id}']")
+      labels_node_list
     end
 
     # No real selection — same stub story as input.
@@ -1308,7 +2292,8 @@ module Dommy
     end
 
     def will_validate
-      !reflected_boolean("disabled") && !reflected_boolean("readonly")
+      !reflected_boolean("disabled") && !disabled_by_ancestor_fieldset? &&
+        !reflected_boolean("readonly") && closest("datalist").nil?
     end
 
     def validation_message
@@ -1380,9 +2365,9 @@ module Dommy
       when "cols"
         self.cols = v
       when "maxLength"
-        set_reflected_string("maxlength", v.to_s)
+        self.max_length = v
       when "minLength"
-        set_reflected_string("minlength", v.to_s)
+        self.min_length = v
       else
         super
       end
@@ -1421,12 +2406,25 @@ module Dommy
     def control
       target = html_for
       if !target.empty?
-        @document.get_element_by_id(target)
+        el = @document.get_element_by_id(target)
+        el if el && labelable_control?(el)
       else
-        query_selector("input, select, textarea, button, output, meter, progress")
+        # The first labelable descendant in tree order (a hidden input, being
+        # non-labelable, is skipped).
+        query_selector_all("button, input, meter, output, progress, select, textarea")
+          .to_a.find { |c| labelable_control?(c) }
       end
     end
 
+    # Labelable elements: button, input (except type=hidden), meter, output,
+    # progress, select, textarea.
+    def labelable_control?(el)
+      tag = el.tag_name.to_s.downcase
+      return el.type.to_s.downcase != "hidden" if tag == "input"
+
+      %w[button meter output progress select textarea].include?(tag)
+    end
+
     def form
       closest("form")
     end
@@ -1445,7 +2443,7 @@ module Dommy
 
   # `<fieldset>` — disabled-state-propagating wrapper; exposes
   # `elements` collection like form.
-  class HTMLFieldsetElement < HTMLElement
+  class HTMLFieldSetElement < HTMLElement
     reflect_string :name
     reflect_boolean :disabled
     def type
@@ -1473,6 +2471,13 @@ module Dommy
       ValidityState.new
     end
 
+    # A fieldset is "barred from constraint validation": it never participates,
+    # so willValidate is always false and checkValidity/reportValidity are no-ops
+    # that report success.
+    def will_validate
+      false
+    end
+
     def check_validity
       true
     end
@@ -1491,6 +2496,20 @@ module Dommy
         elements
       when "validity"
         validity
+      when "willValidate"
+        will_validate
+      else
+        super
+      end
+    end
+
+    js_methods %w[checkValidity reportValidity]
+    def __js_call__(method, args)
+      case method
+      when "checkValidity"
+        check_validity
+      when "reportValidity"
+        report_validity
       else
         super
       end
@@ -1500,20 +2519,34 @@ module Dommy
   # `<output>` — calculation result element.
   class HTMLOutputElement < HTMLElement
     reflect_string :name
+
+    # `value` is always the descendant text content. `defaultValue` tracks a
+    # separate "default value override": while the value mode flag is "default"
+    # the two coincide (setting either updates the text), but once `value=` flips
+    # the flag to "value" they diverge — the override is frozen and further
+    # `defaultValue=` no longer touches the text content.
     def value
       text_content
     end
 
     def value=(v)
-      self.text_content = v
+      if @__value_mode != :value
+        @__default_override = text_content
+        @__value_mode = :value
+      end
+      self.text_content = v.to_s
     end
 
     def default_value
-      text_content
+      @__value_mode == :value ? @__default_override.to_s : text_content
     end
 
     def default_value=(v)
-      self.text_content = v
+      if @__value_mode == :value
+        @__default_override = v.to_s
+      else
+        self.text_content = v.to_s
+      end
     end
 
     # `for` attribute is a space-separated list of IDs.
@@ -1526,17 +2559,26 @@ module Dommy
     end
 
     def labels
-      return [] if id.empty?
-
-      @document.query_selector_all("label[for='#{id}']")
+      labels_node_list
     end
 
     def type
       "output"
     end
 
+    # An output has a validity state (customError is settable) but is barred
+    # from constraint validation: willValidate is false, validationMessage is
+    # always empty, and check/reportValidity always succeed.
     def validity
-      ValidityState.new
+      @__validity ||= ValidityState.new(self)
+    end
+
+    def will_validate
+      false
+    end
+
+    def validation_message
+      ""
     end
 
     def check_validity
@@ -1547,6 +2589,11 @@ module Dommy
       true
     end
 
+    def set_custom_validity(msg)
+      @custom_validity_message = msg.to_s
+      nil
+    end
+
     def __js_get__(key)
       case key
       when "value"
@@ -1561,6 +2608,10 @@ module Dommy
         labels
       when "validity"
         validity
+      when "willValidate"
+        will_validate
+      when "validationMessage"
+        validation_message
       when "htmlFor"
         # `output.htmlFor` is a DOMTokenList (unlike `label.htmlFor`, a string).
         reflected_token_list("htmlFor", "for")
@@ -1581,6 +2632,20 @@ module Dommy
         super
       end
     end
+
+    js_methods %w[checkValidity reportValidity setCustomValidity]
+    def __js_call__(method, args)
+      case method
+      when "checkValidity"
+        check_validity
+      when "reportValidity"
+        report_validity
+      when "setCustomValidity"
+        set_custom_validity(args[0])
+      else
+        super
+      end
+    end
   end
 
   # `<legend>` — primarily exposes its `form` back-ref.
@@ -1717,58 +2782,72 @@ module Dommy
     # back to the first option for non-multiple selects.
     def selected_options
       el = self
-      HTMLCollection.new do
-        opts = el.__dommy_backend_node__.css("option").map { |n| el.document.wrap_node(n) }.compact
-        chosen = opts.select { |o| o.__dommy_backend_node__.key?("selected") }
-        next chosen unless chosen.empty?
-        next [] if el.multiple
-
-        opts.first ? [opts.first] : []
-      end
+      @selected_options ||= HTMLCollection.new { el.__display_selected__ }
     end
 
     def length
       options.size
     end
 
+    # `select.length = n` resizes the options list (delegates to the collection):
+    # shrinks by removing trailing options, grows by appending blank ones.
+    def length=(n)
+      options.length = n
+    end
+
+    # `select.namedItem(name)` — the first option whose id or name matches.
+    def named_item(name)
+      options.named_item(name)
+    end
+
     def form
       closest("form")
     end
 
-    # `selectedIndex` — first option with `selected`, or 0 if none and
-    # not multiple, or -1 if multiple and none.
+    # The option(s) that display as selected, applying the selectedness rules at
+    # read time: a single-select shows the LAST option whose selectedness is
+    # true (last-selected wins), or — if none is — its first option ("ask for
+    # reset"); a multiple select shows every selected option (or none).
+    def __display_selected__
+      opts = options.to_a
+      chosen = opts.select { |o| o.respond_to?(:selected) && o.selected }
+      if multiple
+        chosen
+      elsif !chosen.empty?
+        # Single-select: the most recently property-selected option wins over an
+        # attribute-selected one; otherwise the last selected in document order.
+        dirty = chosen.select { |o| o.respond_to?(:__selectedness_dirty__) && o.__selectedness_dirty__ }
+        [(dirty.empty? ? chosen : dirty).last]
+      elsif !opts.empty?
+        [opts.first]
+      else
+        []
+      end
+    end
+
     def selected_index
-      opts = options
-      idx = opts.find_index { |o| o.__dommy_backend_node__.key?("selected") }
-      return idx if idx
+      opts = options.to_a
+      sel = __display_selected__.first
+      return -1 unless sel
 
-      multiple ? -1 : (opts.empty? ? -1 : 0)
+      opts.find_index { |o| o.__dommy_backend_node__.equal?(sel.__dommy_backend_node__) } || -1
     end
 
     def selected_index=(i)
-      opts = options
-      opts.each_with_index do |o, idx|
-        if idx == i.to_i
-          o.set_attribute("selected", "")
-        elsif o.__dommy_backend_node__.key?("selected")
-          o.remove_attribute("selected")
-        end
-      end
+      options.to_a.each_with_index { |o, idx| o.selected = (idx == i.to_i) }
     end
 
-    # `value` of the select = value of the selected option, or "".
+    # `value` of the select = value of the (displayed) selected option, or "".
     def value
-      opts = options
-      sel = opts.find { |o| o.__dommy_backend_node__.key?("selected") } || opts.first
-      sel ? (sel.__dommy_backend_node__["value"] || sel.text_content).to_s : ""
+      sel = __display_selected__.first
+      sel ? sel.value.to_s : ""
     end
 
     def value=(new_value)
-      target = options.find { |o| (o.__dommy_backend_node__["value"] || o.text_content).to_s == new_value.to_s }
-      return unless target
-
-      options.each { |o| o.remove_attribute("selected") if o.__dommy_backend_node__.key?("selected") }
-      target.set_attribute("selected", "")
+      opts = options.to_a
+      target = opts.find { |o| o.value.to_s == new_value.to_s }
+      opts.each { |o| o.selected = false }
+      target.selected = true if target
     end
 
     # `select.item(i)` — returns the option at index i.
@@ -1793,8 +2872,12 @@ module Dommy
     # inherits `remove()` from ChildNode for self-removal; spec lets
     # both forms coexist via overloading.)
     def remove_option(i)
-      target = options[i.to_i]
-      target&.remove
+      idx = i.to_i
+      # An index out of range (including a negative one) is a no-op — NOT Ruby's
+      # from-the-end negative indexing.
+      return if idx.negative? || idx >= options.length
+
+      options[idx]&.remove
     end
 
     def labels
@@ -1812,7 +2895,7 @@ module Dommy
     end
 
     def will_validate
-      !reflected_boolean("disabled")
+      !reflected_boolean("disabled") && !disabled_by_ancestor_fieldset? && closest("datalist").nil?
     end
 
     def validation_message
@@ -1852,6 +2935,8 @@ module Dommy
         size
       when "selectedIndex"
         selected_index
+      when "selectedOptions"
+        selected_options
       when "form"
         form
       when "labels"
@@ -1865,6 +2950,10 @@ module Dommy
       when "validationMessage"
         validation_message
       else
+        # Indexed getter: `select[i]` is the option at index i (WebIDL).
+        return item(key) if key.is_a?(Integer)
+        return item(key.to_i) if key.is_a?(String) && key.match?(/\A\d+\z/)
+
         super
       end
     end
@@ -1875,18 +2964,30 @@ module Dommy
         self.value = val
       when "selectedIndex"
         self.selected_index = val
+      when "length"
+        self.length = val
       else
+        # Indexed setter: `select[i] = option` delegates to the options
+        # collection's WebIDL "set an indexed property" algorithm.
+        return options.__set_indexed__(key.to_i, val) if key.is_a?(Integer) || (key.is_a?(String) && key.match?(/\A\d+\z/))
+
         super
       end
     end
 
-    js_methods %w[item add checkValidity reportValidity setCustomValidity]
+    js_methods %w[item namedItem add remove checkValidity reportValidity setCustomValidity]
     def __js_call__(method, args)
       case method
       when "item"
         item(args[0])
+      when "namedItem"
+        named_item(args[0])
       when "add"
         add(args[0], args[1])
+      when "remove"
+        # HTMLSelectElement.remove(index) removes an option; with no argument it
+        # is ChildNode.remove() (removes the <select> itself).
+        args.empty? ? super : remove_option(args[0])
       when "checkValidity"
         check_validity
       when "reportValidity"
@@ -1919,15 +3020,34 @@ module Dommy
       nil
     end
 
+    # `showModal()` requires the dialog to be connected and not already open;
+    # otherwise it throws InvalidStateError. (Dommy has no top layer, so the
+    # modal itself is functionally the same as show.)
     def show_modal
+      if has_attribute?("open")
+        raise DOMException::InvalidStateError, "showModal() called on an open dialog"
+      end
+      unless is_connected?
+        raise DOMException::InvalidStateError, "showModal() called on a dialog not connected to a document"
+      end
+
       self.open = true
       nil
     end
 
+    # `close(returnValue?)`: abort if the dialog isn't open; otherwise clear the
+    # open attribute, optionally set returnValue, and QUEUE (async) a trusted,
+    # non-bubbling `close` event.
     def close(value = nil)
+      return nil unless has_attribute?("open")
+
       self.open = false
       @return_value = value.to_s unless value.nil?
-      dispatch_event(Event.new("close", "bubbles" => false, "cancelable" => false))
+      fire = proc do
+        dispatch_event(Event.new("close", "bubbles" => false, "cancelable" => false).__internal_mark_trusted__)
+      end
+      scheduler = @document.respond_to?(:default_view) && @document.default_view&.scheduler
+      scheduler ? scheduler.set_timeout(fire, 0) : fire.call
       nil
     end
 
@@ -1971,6 +3091,8 @@ module Dommy
   # `details.toggleAttribute("open")` fire toggle, which Stimulus's `:open`
   # action option relies on.
   class HTMLDetailsElement < HTMLElement
+    reflect_string :name
+
     def open
       reflected_boolean("open")
     end
@@ -1980,7 +3102,11 @@ module Dommy
     end
 
     def set_attribute(name, value)
-      with_toggle_on_open_change { super }
+      result = with_toggle_on_open_change { super }
+      # Re-point this element to a new exclusive group: if it is open, close the
+      # other open members of the group it just joined.
+      enforce_group_exclusivity if name.to_s.casecmp?("name") && open
+      result
     end
 
     def remove_attribute(name)
@@ -2004,67 +3130,115 @@ module Dommy
     def with_toggle_on_open_change
       was = open
       result = yield
-      dispatch_event(Event.new("toggle", "bubbles" => false, "cancelable" => false)) if open != was
+      if open != was
+        # Opening a named details closes the other open members of its exclusive
+        # group (same `name`, same tree scope) before its own toggle is queued.
+        enforce_group_exclusivity if open
+        queue_toggle_event(was, open)
+      end
       result
     end
+
+    # WHATWG details name-group exclusivity: at most one details per (name, tree)
+    # may be open. When this element opens, remove `open` from every other open
+    # details in the same tree that shares its non-empty name.
+    def enforce_group_exclusivity
+      group = @__node__["name"].to_s
+      return if group.empty?
+
+      root = get_root_node
+      return unless root.respond_to?(:query_selector_all)
+
+      root.query_selector_all("details").each do |other|
+        next unless other.respond_to?(:__dommy_backend_node__)
+        next if other.__dommy_backend_node__.equal?(__dommy_backend_node__)
+        next unless other.__dommy_backend_node__["name"].to_s == group
+
+        other.open = false if other.respond_to?(:open) && other.open
+      end
+    end
+
+    # WHATWG "queue a details toggle event task": the trusted ToggleEvent fires
+    # asynchronously, and rapid changes coalesce into ONE event whose oldState is
+    # the state before the first change and newState the state after the last.
+    def queue_toggle_event(old_open, new_open)
+      if @__toggle_pending
+        @__toggle_new = new_open ? "open" : "closed"
+        return
+      end
+
+      @__toggle_pending = true
+      @__toggle_old = old_open ? "open" : "closed"
+      @__toggle_new = new_open ? "open" : "closed"
+      fire = proc do
+        @__toggle_pending = false
+        evt = ToggleEvent.new("toggle",
+          "oldState" => @__toggle_old, "newState" => @__toggle_new,
+          "bubbles" => false, "cancelable" => false)
+        dispatch_event(evt.__internal_mark_trusted__)
+      end
+      scheduler = @document.respond_to?(:default_view) && @document.default_view&.scheduler
+      scheduler ? scheduler.set_timeout(fire, 0) : fire.call
+    end
   end
 
   # `<meter>` — gauge with `value` / `min` / `max` (default 0/0/1)
   # plus `low` / `high` / `optimum`. All numeric; `labels` via the
   # standard `<label for="...">` association.
   class HTMLMeterElement < HTMLElement
-    def value
-      numeric_attr("value", 0.0)
-    end
-
-    def value=(v)
-      set_reflected_string("value", v.to_s)
-    end
-
+    # The IDL getters return the WHATWG "actual" values, constrained in order:
+    # min → max (≥min) → value (∈[min,max]) → low (∈[min,max]) →
+    # high (∈[low,max]) → optimum (∈[min,max]).
     def min
       numeric_attr("min", 0.0)
     end
 
     def min=(v)
-      set_reflected_string("min", v.to_s)
+      set_reflected_string("min", format_double(restricted_double(v)))
     end
 
     def max
-      numeric_attr("max", 1.0)
+      [numeric_attr("max", 1.0), min].max
     end
 
     def max=(v)
-      set_reflected_string("max", v.to_s)
+      set_reflected_string("max", format_double(restricted_double(v)))
+    end
+
+    def value
+      clamp(numeric_attr("value", 0.0), min, max)
+    end
+
+    def value=(v)
+      set_reflected_string("value", format_double(restricted_double(v)))
     end
 
     def low
-      numeric_attr("low", min)
+      clamp(numeric_attr("low", min), min, max)
     end
 
     def low=(v)
-      set_reflected_string("low", v.to_s)
+      set_reflected_string("low", format_double(restricted_double(v)))
     end
 
     def high
-      numeric_attr("high", max)
+      clamp(numeric_attr("high", max), low, max)
     end
 
     def high=(v)
-      set_reflected_string("high", v.to_s)
+      set_reflected_string("high", format_double(restricted_double(v)))
     end
 
     def optimum
-      numeric_attr("optimum", (min + max) / 2.0)
+      clamp(numeric_attr("optimum", (min + max) / 2.0), min, max)
     end
 
     def optimum=(v)
-      set_reflected_string("optimum", v.to_s)
+      set_reflected_string("optimum", format_double(restricted_double(v)))
     end
 
     def labels
-      return [] if id.empty?
-
-      @document.query_selector_all("label[for='#{id}']")
+      labels_node_list
     end
 
     def __js_get__(key)
@@ -2090,10 +3264,13 @@ module Dommy
 
     def __js_set__(key, v)
       case key
-      when "value", "min", "max", "low", "high", "optimum"
-        set_reflected_string(key, v.to_s)
-      else
-        super
+      when "value" then self.value = v
+      when "min" then self.min = v
+      when "max" then self.max = v
+      when "low" then self.low = v
+      when "high" then self.high = v
+      when "optimum" then self.optimum = v
+      else super
       end
     end
 
@@ -2103,17 +3280,54 @@ module Dommy
       raw = @__node__[name].to_s
       raw.empty? ? default : Float(raw) rescue default
     end
+
+    def clamp(v, lo, hi)
+      return lo if v < lo
+      return hi if v > hi
+
+      v
+    end
+
+    # WebIDL `double` conversion (ToNumber) for the meter's IDL setters: a value
+    # that coerces to NaN/±Infinity — e.g. `meter.value = "foobar"` — is a
+    # restricted double and throws a TypeError.
+    def restricted_double(v)
+      n =
+        case v
+        when Numeric then v.to_f
+        when nil then 0.0
+        when true then 1.0
+        when false then 0.0
+        when String then (v.strip.empty? ? 0.0 : (Float(v.strip) rescue ::Float::NAN))
+        else ::Float::NAN
+        end
+      raise Bridge::TypeError, "The provided double value is non-finite." if n.nan? || n.infinite?
+
+      n
+    end
+
+    # The "best representation" of a double for a reflected content attribute:
+    # an integral value loses its trailing ".0".
+    def format_double(n)
+      n == n.to_i ? n.to_i.to_s : n.to_s
+    end
   end
 
   # `<progress>` — `value` and `max` (default max=1). `position`
   # returns `value / max` for a "determinate" progress bar, or -1
   # when no value is set ("indeterminate").
   class HTMLProgressElement < HTMLElement
+    # A progress bar is "determinate" iff it has a parseable `value` content
+    # attribute; otherwise it is "indeterminate" (position -1). The `value` IDL
+    # getter always returns a number: 0 when indeterminate/invalid, else the
+    # value clamped to [0, max].
     def value
       raw = @__node__["value"].to_s
-      raw.empty? ? nil : Float(raw)
-    rescue ArgumentError
-      nil
+      return 0.0 if raw.empty?
+
+      v = Float(raw) rescue 0.0
+      v = 0.0 if v < 0
+      [v, max].min
     end
 
     def value=(v)
@@ -2122,27 +3336,28 @@ module Dommy
 
     def max
       raw = @__node__["max"].to_s
-      raw.empty? ? 1.0 : (Float(raw) rescue 1.0)
+      m = raw.empty? ? 1.0 : (Float(raw) rescue 1.0)
+      # A `max` not greater than zero is invalid; the default (1) applies.
+      m > 0 ? m : 1.0
     end
 
+    # The `max` IDL attribute is limited to numbers greater than zero: a setter
+    # value that isn't is ignored (the content attribute is left unchanged).
     def max=(v)
-      set_reflected_string("max", v.to_s)
+      f = Float(v) rescue nil
+      set_reflected_string("max", v.to_s) if f && f > 0
     end
 
-    # `position` = value/max for determinate progress; -1 if value
-    # was never set (indeterminate).
+    # `position` = value/max for a determinate bar; -1 for an indeterminate one
+    # (no parseable value content attribute).
     def position
-      v = value
-      return -1.0 if v.nil?
+      return -1.0 unless determinate?
 
-      m = max
-      m <= 0 ? 1.0 : (v / m)
+      value / max
     end
 
     def labels
-      return [] if id.empty?
-
-      @document.query_selector_all("label[for='#{id}']")
+      labels_node_list
     end
 
     def __js_get__(key)
@@ -2162,12 +3377,24 @@ module Dommy
 
     def __js_set__(key, v)
       case key
-      when "value", "max"
-        set_reflected_string(key, v.to_s)
+      when "value"
+        self.value = v
+      when "max"
+        self.max = v
       else
         super
       end
     end
+
+    private
+
+    # Determinate iff the `value` content attribute is present and parseable.
+    def determinate?
+      raw = @__node__["value"].to_s
+      return false if raw.empty?
+
+      !!(Float(raw) rescue nil)
+    end
   end
 
   # `<template>` — `content` returns the DocumentFragment that
@@ -2194,8 +3421,10 @@ module Dommy
   class HTMLTableCellElement < HTMLElement
     reflect_string :headers, :scope, :abbr
     def cell_index
-      row = closest("tr")
-      return -1 unless row
+      # cellIndex is the position in the DIRECT parent row's cells — -1 unless the
+      # cell's immediate parent is a tr (a cell nested in a non-tr is not indexed).
+      row = parent_element
+      return -1 unless row.is_a?(HTMLTableRowElement)
 
       row.cells.find_index { |c| c.__dommy_backend_node__ == @__node__ } || -1
     end
@@ -2248,53 +3477,69 @@ module Dommy
   # `rowIndex` walks the enclosing table; `sectionRowIndex` walks
   # the enclosing thead/tbody/tfoot.
   class HTMLTableRowElement < HTMLElement
+    HTML_NAMESPACE = "http://www.w3.org/1999/xhtml"
+
     # Own __js_call__ methods, on top of Element's.
     def cells
       el = self
       HTMLCollection.new do
-        el
-          .__dommy_backend_node__
-          .element_children
-          .select { |n| %w[td th].include?(n.name) }
-          .map { |n| el.document.wrap_node(n) }
-          .compact
+        el.__dommy_backend_node__.element_children
+          .select { |n| %w[td th].include?(n.name) && el.__html_ns_node__(n) }
+          .map { |n| el.document.wrap_node(n) }.compact
       end
     end
 
     def row_index
       table = closest("table")
-      return -1 unless table
+      # Only an HTML <table> exposes a rows collection; a foreign (namespaced)
+      # <table> ancestor doesn't make this row a table row.
+      return -1 unless table.is_a?(HTMLTableElement)
 
       table.rows.find_index { |r| r.__dommy_backend_node__ == @__node__ } || -1
     end
 
     def section_row_index
-      section = @__node__.parent
-      return -1 unless section && section.element? && %w[thead tbody tfoot].include?(section.name)
+      parent = @__node__.parent
+      return -1 unless parent && parent.element? && __html_ns_node__(parent) &&
+                       %w[table thead tbody tfoot].include?(parent.name)
 
-      section.element_children.select { |n| n.name == "tr" }.find_index { |n| n == @__node__ } || -1
+      parent.element_children
+        .select { |n| n.name == "tr" && __html_ns_node__(n) }
+        .find_index { |n| n == @__node__ } || -1
     end
 
-    # `insertCell(index)` — adds a `<td>` at the given index
-    # (defaults to end). Returns the new cell.
+    # `insertCell(index)` — adds a `<td>` at the given index (defaults to end).
+    # index < −1 or > cells.length throws IndexSizeError. Returns the new cell.
     def insert_cell(index = -1)
+      list = cells.to_a
+      i = index.nil? ? -1 : index.to_i
+      raise DOMException::IndexSizeError, "insertCell index #{i} out of range" if i < -1 || i > list.size
+
       cell = @document.create_element("td")
-      list = cells
-      if index.to_i == -1 || index.to_i >= list.size
+      if i == -1 || i == list.size
         append_child(cell)
       else
-        insert_before(cell, list[index.to_i])
+        insert_before(cell, list[i])
       end
 
       cell
     end
 
     def delete_cell(index)
-      target = cells[index.to_i]
+      list = cells.to_a
+      i = index.to_i
+      raise DOMException::IndexSizeError, "deleteCell index #{i} out of range" if i < -1 || i >= list.size
+
+      target = i == -1 ? list.last : list[i]
       target&.remove
       nil
     end
 
+    def __html_ns_node__(node)
+      el = @document.wrap_node(node)
+      !el.respond_to?(:namespace_uri) || el.namespace_uri == HTML_NAMESPACE
+    end
+
     def __js_get__(key)
       case key
       when "cells"
@@ -2325,35 +3570,47 @@ module Dommy
   # collection + insertRow / deleteRow.
   class HTMLTableSectionElement < HTMLElement
     # Own __js_call__ methods, on top of Element's.
+    HTML_NAMESPACE = "http://www.w3.org/1999/xhtml"
+
     def rows
       el = self
       HTMLCollection.new do
-        el
-          .__dommy_backend_node__
-          .element_children
-          .select { |n| n.name == "tr" }
-          .map { |n| el.document.wrap_node(n) }
-          .compact
+        el.__dommy_backend_node__.element_children
+          .select { |n| n.name == "tr" && el.__html_ns_node__(n) }
+          .map { |n| el.document.wrap_node(n) }.compact
       end
     end
 
     def insert_row(index = -1)
+      list = rows.to_a
+      i = index.nil? ? -1 : index.to_i
+      raise DOMException::IndexSizeError, "insertRow index #{i} out of range" if i < -1 || i > list.size
+
       tr = @document.create_element("tr")
-      list = rows
-      if index.to_i == -1 || index.to_i >= list.size
+      if i == -1 || i == list.size
         append_child(tr)
       else
-        insert_before(tr, list[index.to_i])
+        insert_before(tr, list[i])
       end
 
       tr
     end
 
     def delete_row(index)
-      rows[index.to_i]&.remove
+      list = rows.to_a
+      i = index.to_i
+      raise DOMException::IndexSizeError, "deleteRow index #{i} out of range" if i < -1 || i >= list.size
+
+      target = i == -1 ? list.last : list[i]
+      target&.remove
       nil
     end
 
+    def __html_ns_node__(node)
+      el = @document.wrap_node(node)
+      !el.respond_to?(:namespace_uri) || el.namespace_uri == HTML_NAMESPACE
+    end
+
     def __js_get__(key)
       key == "rows" ? rows : super
     end
@@ -2380,56 +3637,89 @@ module Dommy
   # tbody elements. `insertRow(-1)` appends to the last tbody (or
   # creates one); `deleteRow` works against the merged `rows` list.
   class HTMLTableElement < HTMLElement
+    HTML_NAMESPACE = "http://www.w3.org/1999/xhtml"
+
     # Own __js_call__ methods, on top of Element's.
     def caption
-      @__node__.element_children.find { |n| n.name == "caption" }&.then { |n| @document.wrap_node(n) }
+      first_html_child("caption")
     end
 
     def caption=(new_caption)
+      if !new_caption.nil? && !new_caption.is_a?(HTMLTableCaptionElement)
+        raise Bridge::TypeError, "table.caption must be an HTMLTableCaptionElement or null"
+      end
+
       delete_caption
-      return unless new_caption.respond_to?(:__dommy_backend_node__)
+      return if new_caption.nil?
 
-      first = @__node__.children.first
-      first ? first.add_previous_sibling(new_caption.__dommy_backend_node__) : @__node__.add_child(new_caption.__dommy_backend_node__)
+      # Route through the validated insertion so a cycle (the caption already
+      # containing this table) raises HierarchyRequestError and a caption from
+      # another document is adopted, rather than corrupting the tree.
+      insert_before(new_caption, first_child)
     end
 
     def t_head
-      @__node__.element_children.find { |n| n.name == "thead" }&.then { |n| @document.wrap_node(n) }
+      first_html_child("thead")
     end
 
     def t_foot
-      @__node__.element_children.find { |n| n.name == "tfoot" }&.then { |n| @document.wrap_node(n) }
+      first_html_child("tfoot")
     end
 
     def t_bodies
       el = self
       HTMLCollection.new do
-        el
-          .__dommy_backend_node__
-          .element_children
-          .select { |n| n.name == "tbody" }
-          .map { |n| el.document.wrap_node(n) }
-          .compact
+        el.__dommy_backend_node__.element_children
+          .select { |n| n.name == "tbody" && el.__html_namespace_node__(n) }
+          .map { |n| el.document.wrap_node(n) }.compact
       end
     end
 
     def rows
       el = self
       HTMLCollection.new do
-        ordered = []
-        head = el.__dommy_backend_node__.element_children.find { |n| n.name == "thead" }
-        bodies = el.__dommy_backend_node__.element_children.select { |n| n.name == "tbody" }
-        direct = el.__dommy_backend_node__.element_children.select { |n| n.name == "tr" }
-        foot = el.__dommy_backend_node__.element_children.find { |n| n.name == "tfoot" }
-        [head, *bodies, foot].compact.each do |sec|
-          sec.element_children.select { |n| n.name == "tr" }.each { |n| ordered << n }
+        # Per spec: thead rows first, then the tr children of the table and of
+        # tbody sections IN TREE ORDER (a direct <tr> and a <tbody>'s rows
+        # interleave by document position), then tfoot rows.
+        head_rows = []
+        body_rows = []
+        foot_rows = []
+        el.__dommy_backend_node__.element_children.each do |n|
+          next unless el.__html_namespace_node__(n)
+
+          case n.name
+          when "thead"
+            el.__tr_children__(n).each { |c| head_rows << c }
+          when "tfoot"
+            el.__tr_children__(n).each { |c| foot_rows << c }
+          when "tbody"
+            el.__tr_children__(n).each { |c| body_rows << c }
+          when "tr"
+            body_rows << n
+          end
         end
-
-        direct.each { |n| ordered << n }
-        ordered.map { |n| el.document.wrap_node(n) }.compact
+        (head_rows + body_rows + foot_rows).map { |n| el.document.wrap_node(n) }.compact
       end
     end
 
+    # The HTML-namespaced <tr> element children of a section node.
+    def __tr_children__(section)
+      section.element_children.select { |n| n.name == "tr" && __html_namespace_node__(n) }
+    end
+
+    # The first HTML-namespaced element child with the given local name (a
+    # same-name element in another namespace, e.g. SVG's <caption>, is skipped).
+    def first_html_child(local)
+      node = @__node__.element_children.find { |n| n.name == local && __html_namespace_node__(n) }
+      node && @document.wrap_node(node)
+    end
+
+    # Whether a raw backend node is in the HTML namespace.
+    def __html_namespace_node__(node)
+      el = @document.wrap_node(node)
+      !el.respond_to?(:namespace_uri) || el.namespace_uri == HTML_NAMESPACE
+    end
+
     def create_caption
       existing = caption
       return existing if existing
@@ -2521,10 +3811,51 @@ module Dommy
     end
 
     def delete_row(index)
-      rows[index.to_i]&.remove
+      list = rows.to_a
+      i = index.to_i
+      raise DOMException::IndexSizeError, "deleteRow index #{i} out of range" if i < -1 || i >= list.size
+
+      target = i == -1 ? list.last : list[i]
+      target&.remove
       nil
     end
 
+    # `table.tHead = x` / `table.tFoot = x`: x must be a matching section element
+    # (or null). It replaces the existing one at the spec position.
+    def t_head=(value)
+      set_table_section("thead", value)
+    end
+
+    def t_foot=(value)
+      set_table_section("tfoot", value)
+    end
+
+    def set_table_section(local, value)
+      if value.nil?
+        first_html_child(local)&.remove
+        return
+      end
+      # A non-section value fails the WebIDL type check (TypeError); a section of
+      # the wrong local name fails the spec's algorithm (HierarchyRequestError).
+      unless value.is_a?(HTMLTableSectionElement)
+        raise Bridge::TypeError, "table.#{local} must be an HTMLTableSectionElement or null"
+      end
+      unless value.tag_name.to_s.casecmp?(local)
+        raise DOMException::HierarchyRequestError, "table.#{local} must be a <#{local}> element"
+      end
+
+      first_html_child(local)&.remove
+      # A validated insertion (cycle → HierarchyRequestError, cross-document →
+      # adopt). thead goes just after any caption; tfoot is appended last.
+      if local == "thead"
+        cap = caption
+        insert_before(value, cap ? cap.next_sibling : first_child)
+      else
+        append_child(value)
+      end
+      value
+    end
+
     def __js_get__(key)
       case key
       when "caption"
@@ -2546,6 +3877,10 @@ module Dommy
       case key
       when "caption"
         self.caption = value
+      when "tHead"
+        self.t_head = value
+      when "tFoot"
+        self.t_foot = value
       else
         super
       end
@@ -2561,18 +3896,22 @@ module Dommy
         insert_row(args[0] || -1)
       when "deleteRow"
         delete_row(args[0])
+        Bridge::UNDEFINED
       when "createCaption"
         create_caption
       when "deleteCaption"
         delete_caption
+        Bridge::UNDEFINED
       when "createTHead"
         create_t_head
       when "deleteTHead"
         delete_t_head
+        Bridge::UNDEFINED
       when "createTFoot"
         create_t_foot
       when "deleteTFoot"
         delete_t_foot
+        Bridge::UNDEFINED
       when "createTBody"
         create_t_body
       else
@@ -2910,19 +4249,45 @@ module Dommy
       set_reflected_string("height", v.to_s)
     end
 
-    # Dommy doesn't navigate iframes itself, but an integration/test layer can
-    # populate the nested browsing context's document (e.g. parsing the `src`
-    # resource) via `__internal_set_content_document__`.
+    # The nested browsing context's document. An integration/test layer may
+    # inject one via `__internal_set_content_document__` (e.g. the `src`
+    # resource); otherwise a connected iframe gets a lazily-created blank
+    # about:blank document (with its own Window), matching a browser where
+    # `iframe.contentDocument` is non-null once the frame is in a document.
+    # A disconnected iframe has no browsing context, so contentDocument is null.
     def content_document
-      @content_document
+      return @content_document if @content_document
+      return nil unless respond_to?(:is_connected?) && is_connected?
+      # An iframe with a `src` (or `srcdoc`) is navigated by the host / test layer
+      # (Dommy doesn't fetch), which injects the document via
+      # `__internal_set_content_document__`; only a truly blank iframe gets the
+      # auto about:blank document here, so we don't shadow a pending navigation.
+      return nil unless get_attribute("src").to_s.empty? && get_attribute("srcdoc").nil?
+
+      @content_document = build_blank_content_document
+    end
+
+    # Build the blank nested document + its Window, back-linking the Window to
+    # this frame (so getComputedStyle can detect a non-rendered frame's content).
+    def build_blank_content_document
+      win = Window.new(nil, backend_doc: Backend.parse("<!DOCTYPE html><html><head></head><body></body></html>"))
+      doc = win.document
+      win.frame_element = self if win.respond_to?(:frame_element=)
+      doc
     end
 
     def __internal_set_content_document__(doc)
       @content_document = doc
+      # Back-link the nested window to its hosting frame, so getComputedStyle can
+      # detect content inside a non-rendered (display:none / disconnected) frame.
+      view = doc.respond_to?(:default_view) ? doc.default_view : nil
+      view.frame_element = self if view.respond_to?(:frame_element=)
     end
 
     def content_window
-      @content_document&.default_view
+      # Go through the lazy accessor so a blank browsing context is created on
+      # first `contentWindow` access too (not only via `contentDocument`).
+      content_document&.default_view
     end
 
     def __js_get__(key)
@@ -3021,7 +4386,41 @@ module Dommy
     reflect_string :value
   end
 
+  # Element interfaces that are otherwise plain HTMLElement subclasses — their
+  # own IDL adds little beyond the base, but they must be distinct types so
+  # `createElement("col") instanceof HTMLTableColElement` (and cloneNode
+  # identity) holds. `col`/`colgroup` share HTMLTableColElement per spec.
+  class HTMLTableColElement < HTMLElement; end
+  class HTMLDataListElement < HTMLElement
+    # `options` — the <option> descendants, as a live HTMLCollection.
+    def options
+      el = self
+      HTMLCollection.new do
+        el.__dommy_backend_node__.css("option").map { |n| el.document.wrap_node(n) }.compact
+      end
+    end
+
+    def __js_get__(key)
+      return options if key == "options"
+
+      super
+    end
+  end
+  class HTMLDirectoryElement < HTMLElement; end
+  class HTMLDListElement < HTMLElement; end
+  class HTMLFontElement < HTMLElement
+    reflect_string :color, :face, :size
+  end
+  class HTMLFrameElement < HTMLElement; end
+  class HTMLFrameSetElement < HTMLElement
+    include WindowReflectingHandlers
+  end
+  class HTMLParamElement < HTMLElement
+    reflect_string :name, :value
+  end
+
   class HTMLAreaElement < HTMLElement
+    include HyperlinkActivation
     reflect_string :alt, :coords, :shape, :href, :target, :rel
   end
 
@@ -3263,6 +4662,7 @@ module Dommy
   end
 
   class HTMLBodyElement < HTMLElement
+    include WindowReflectingHandlers
   end
 
   class HTMLHeadElement < HTMLElement
@@ -3294,7 +4694,7 @@ module Dommy
     "optgroup" => HTMLOptGroupElement,
     "textarea" => HTMLTextAreaElement,
     "label" => HTMLLabelElement,
-    "fieldset" => HTMLFieldsetElement,
+    "fieldset" => HTMLFieldSetElement,
     "output" => HTMLOutputElement,
     "legend" => HTMLLegendElement,
     "slot" => HTMLSlotElement,
@@ -3348,7 +4748,16 @@ module Dommy
     "pre" => HTMLPreElement,
     "body" => HTMLBodyElement,
     "head" => HTMLHeadElement,
-    "html" => HTMLHtmlElement
+    "html" => HTMLHtmlElement,
+    "col" => HTMLTableColElement,
+    "colgroup" => HTMLTableColElement,
+    "datalist" => HTMLDataListElement,
+    "dir" => HTMLDirectoryElement,
+    "dl" => HTMLDListElement,
+    "font" => HTMLFontElement,
+    "frame" => HTMLFrameElement,
+    "frameset" => HTMLFrameSetElement,
+    "param" => HTMLParamElement
   }.freeze
 
   SVG_NAMESPACE_URI = "http://www.w3.org/2000/svg"