@cssints/apg-specs 0.0.0-stage → 0.5.2

package/shared/focusgroup.qnt

@@ -0,0 +1,152 @@
+// shared/focusgroup.qnt — the platform contract of the `focusgroup` attribute:
+// the roving-tabindex behaviour a widget gets for free from the browser (or
+// from @microsoft/focusgroup-polyfill) so a pattern spec models only its delta.
+//
+// Pure defs only: import with `import focusgroup.* from "../../shared/focusgroup"`.
+// Every def is prefixed `fg` so it never collides with a pattern's own defs.
+// State (focus, tab stop) is passed IN and the next value comes back OUT; the
+// pattern owns the vars. A `val` here would be inlined as an invariant into
+// every importer, so invariants are predicate defs the importer wraps in a `val`.
+//
+// Provided (the contract):
+//   - ordered items 0..n-1, exactly ONE tab stop (`fgTabIndex`)
+//   - arrows along the axis move focus (`fgDelta`, `fgStep`), perpendicular
+//     arrows are left to the author; Home / End jump to first / last
+//     (`fgLanding`); `wrap` / `nowrap`; Shift/Ctrl/Meta+key are ignored
+//   - last-focused memory on sequential re-entry, `nomemory`, `focusgroupstart`
+//     (`fgEntry`, `fgStopOnLeave`)
+//   - Tab / Shift+Tab inside a native key-conflict control (<input>, per the
+//     explainer also <textarea>, <select>, contenteditable) steps to the
+//     NEIGHBOURING item instead of leaving the group (`fgEscape`); at either
+//     end it leaves
+//   - a keydown whose default was prevented by an item handler is not moved
+//   - behaviour tokens: default axis / wrap and the inferred owner and item
+//     roles (`fgDefaultAxis`, `fgDefaultWrap`, `fgInferredItemRole`)
+//
+// NOT provided, so still the pattern's own (the gap list):
+//   - selection (explicitly decoupled), activation (Enter/Space), typeahead
+//   - `aria-activedescendant` focus models (a combobox popup is not a focusgroup)
+//   - submenu open/close keys, tree expand/collapse, grids (V2, unreleased),
+//     `itemcontrols`, `menuitemcheckbox` / `menuitemradio` (never inferred)
+//   - `aria-orientation`: the axis does NOT set it (verified: `toolbar block`
+//     still exposes orientation=horizontal)
+//
+// NOT expressible as pure defs (no collections / vars here), so NOT modelled:
+//   - item eligibility: disabled / hidden / `tabindex=-1` / `focusgroup=none`
+//     items are skipped by the platform. These defs assume all n items are
+//     focusable; a pattern that wants a disabled item to stay reachable uses
+//     aria-disabled (a native `disabled` button is skipped, verified).
+//   - segments and nested groups (one segment is assumed), insert / remove of
+//     items, RTL and vertical writing modes (left-to-right, horizontal-tb)
+//   Both need `Set[int]` / `List[int]` collections: see
+//   docs/research/quint-generator-ui-extensions.md (item 6) and the follow-ups
+//   of effects-of-atmosphere-dx00.
+//
+// Pins (bump deliberately; the explainer is the only spec text):
+//   explainer  open-ui scoped-focusgroup.explainer, lastUpdated 2026-07-28
+//   polyfill   @microsoft/focusgroup-polyfill 1.6.0 (MIT)
+//   verified   Chromium 153.0.8010.12 (Playwright 1.63.0, 2026-10-07): native
+//              `focusgroup` (`'focusGroup' in HTMLElement.prototype` is true) and
+//              the polyfill, forced with --disable-blink-features=Focusgroup,
+//              replayed the same 40 focus/key traces (toolbar, tablist, listbox,
+//              menu, menubar, radiogroup): 38 agree. The 2 that differ are
+//              Alt+Arrow / Alt+End, which move focus in the polyfill and are
+//              ignored natively. Tab-escape was checked for <input type=text>
+//              only (arrows consumed on both axes; <select> consumes the inline
+//              arrows; <input type=number> consumes them all). Role inference
+//              (CDP accessibility tree, 10 markup cases): 7 agree; the polyfill
+//              infers `option` on a <button> and `tab` inside a non-generic or
+//              role'd owner, native does not. Native `FocusGroup` / `polyfill()`
+//              are inert in Chromium >= 150, so a Solid layer sets the attribute
+//              there and drives the polyfill's low-level `FocusGroup` + `update()`
+//              only where `focusGroup` is absent (teardown: `update({ definition:
+//              {} })` BEFORE `disconnect()`, which alone leaves tabindex rewritten).
+//              The toolbar model replays against both providers with no
+//              divergence (see specs/apg/toolbar.qnt).
+module focusgroup {
+  // --- behaviour tokens ----------------------------------------------------
+  def fgBehaviorKnown(b: str): bool =
+    or(
+      or(or(b == "toolbar", b == "tablist"), or(b == "radiogroup", b == "listbox")),
+      or(b == "menu", b == "menubar")
+    )
+
+  // axis: "inline" | "block" | "both" (no explicit axis token)
+  def fgDefaultAxis(b: str): str =
+    if (or(b == "listbox", b == "menu")) "block"
+    else if (b == "radiogroup") "both"
+    else "inline"
+
+  def fgDefaultWrap(b: str): bool = and(b != "toolbar", b != "listbox")
+
+  // --- role inference (generic owners only; explicit roles always win) -----
+  // ownerKind: "generic" (div/span) | "native"; itemKind: "generic" | "button" | "native"
+  // "" means no role is inferred.
+  def fgItemRole(b: str): str =
+    if (b == "tablist") "tab"
+    else if (b == "radiogroup") "radio"
+    else if (b == "listbox") "option"
+    else if (or(b == "menu", b == "menubar")) "menuitem"
+    else ""
+  // ARIA-in-HTML: a <button> may take tab / radio / menuitem but not option
+  def fgButtonMayTakeRole(role: str): bool =
+    or(or(role == "tab", role == "radio"), role == "menuitem")
+  def fgInferredOwnerRole(b: str, ownerKind: str, ownerHasRole: bool): str =
+    if (and(ownerKind == "generic", not(ownerHasRole))) b else ""
+  def fgInferredItemRole(
+    b: str,
+    ownerKind: str,
+    ownerHasRole: bool,
+    itemKind: str,
+    itemHasRole: bool
+  ): str =
+    if (or(fgInferredOwnerRole(b, ownerKind, ownerHasRole) == "", itemHasRole)) ""
+    else if (itemKind == "generic") fgItemRole(b)
+    else if (and(itemKind == "button", fgButtonMayTakeRole(fgItemRole(b)))) fgItemRole(b)
+    else ""
+
+  // --- keys ------------------------------------------------------------------
+  def fgInlineDelta(axis: str, key: str): int =
+    if (axis == "block") 0 else if (key == "Right") 1 else if (key == "Left") -1 else 0
+  def fgBlockDelta(axis: str, key: str): int =
+    if (axis == "inline") 0 else if (key == "Down") 1 else if (key == "Up") -1 else 0
+  // +1 / -1 for a key along the axis, 0 for a perpendicular or unrelated key
+  def fgDelta(axis: str, key: str): int = fgInlineDelta(axis, key) + fgBlockDelta(axis, key)
+  def fgIsEdgeKey(key: str): bool = or(key == "Home", key == "End")
+  // a key the group would act on; a control that consumes it blocks the group
+  def fgIsNavKey(axis: str, key: str): bool = or(fgDelta(axis, key) != 0, fgIsEdgeKey(key))
+
+  def fgStep(n: int, wrap: bool, f: int, d: int): int =
+    if (d == 1) (if (f >= n - 1) (if (wrap) 0 else f) else f + 1)
+    else if (d == -1) (if (f <= 0) (if (wrap) n - 1 else f) else f - 1)
+    else f
+
+  // where focus lands after a key; outside the group (f < 0) nothing happens
+  def fgLanding(n: int, axis: str, wrap: bool, f: int, key: str): int =
+    if (f < 0) f
+    else if (key == "Home") 0
+    else if (key == "End") n - 1
+    else fgStep(n, wrap, f, fgDelta(axis, key))
+
+  // Tab (back = false) / Shift+Tab (back = true) from a native key-conflict
+  // control: the neighbouring item, or -1 when it is the last / first (leave)
+  def fgEscape(n: int, f: int, back: bool): int =
+    if (back) (if (f <= 0) -1 else f - 1)
+    else (if (f >= n - 1) -1 else f + 1)
+
+  // --- tab stop and memory ---------------------------------------------------
+  // last = -1 is an empty memory; start is the `focusgroupstart` item (or 0)
+  def fgEntry(memory: bool, last: int, start: int): int =
+    if (and(memory, last >= 0)) last else start
+  // the tab stop once focus has left the group
+  def fgStopOnLeave(memory: bool, current: int, start: int): int =
+    if (memory) current else start
+  // the rendered tabindex of item i given the tab stop
+  def fgTabIndex(stop: int, i: int): int = if (stop == i) 0 else -1
+
+  // --- invariant predicates (wrap in a `val` in the pattern) -----------------
+  def fgStopInRange(n: int, stop: int): bool = and(stop >= 0, stop <= n - 1)
+  def fgFocusInRange(n: int, focus: int): bool = and(focus >= -1, focus <= n - 1)
+  // roving tabindex: whatever holds focus inside the group is the tab stop
+  def fgFocusIsStop(focus: int, stop: int): bool = or(focus < 0, focus == stop)
+}

package/shared/invokers.qnt

@@ -0,0 +1,81 @@
+// shared/invokers.qnt — the platform contract of invoker commands
+// (`<button commandfor="id" command="...">`) on the element they target.
+//
+// Pure defs only: import with `import invokers.* from "../../shared/invokers"`.
+// Defs are prefixed `invoker`. The target's open flag is passed in and the next
+// one comes back out. For a popover target feed `invokerPopoverEvent(cmd)` to
+// popover.qnt's `popoverOpenAfter`, so a menu-button imports both modules and
+// states only its own delta.
+//
+// Built-in commands (exactly six in the WHATWG source):
+//   popover target   toggle-popover | show-popover | hide-popover
+//   dialog target    show-modal | close | request-close
+//   custom           any `--name`: no state change, only a `command` event
+//                    on the target (the author's listener decides)
+// A built-in command aimed at the wrong kind of target does nothing (a
+// `show-modal` on a popover is a no-op). A disabled button or a `commandfor`
+// that resolves to no element does nothing. A command that is neither built in
+// nor `--`-prefixed is not delivered (verified).
+//
+// Provided: the activation (click, Enter, Space) -> command mapping and the
+// implicit `aria-expanded` on an invoker of a popover (verified: false closed,
+// true open), no script.
+//
+// NOT provided, still the pattern's: any state beyond open/closed, the
+// `request-close` outcome (the target's `cancel` handler may veto it, so the
+// platform contract leaves `open` unchanged here), `aria-haspopup`, menu keys,
+// `details` commands (none exist yet), focus placement inside the target.
+//
+// Verified in Chromium 153.0.8010.12 (Playwright 1.63.0, native, 2026-10-07):
+// toggle/show/hide-popover (incl. show twice stays open, hide when closed is a
+// no-op), show-modal makes the dialog `:modal`, request-close closes it,
+// `--foo` reaches the target as a `command` event, `nonsense` does not,
+// show-modal on a popover is a no-op. Not verified: `aria-expanded` for dialog
+// invokers (the modal makes the invoker inert).
+// Pin: WHATWG HTML button `command` (Baseline newly 2025-12-12:
+// C135 / F144 / S26.2); polyfill `invokers-polyfill` 1.0.4.
+//
+// Strings are opaque in the supported subset (no prefix test), so the pattern
+// says whether a command is `--`-prefixed via the `custom` flag.
+module invokers {
+  def invokerIsPopoverCmd(cmd: str): bool =
+    or(or(cmd == "toggle-popover", cmd == "show-popover"), cmd == "hide-popover")
+  def invokerIsDialogCmd(cmd: str): bool =
+    or(or(cmd == "show-modal", cmd == "close"), cmd == "request-close")
+  def invokerIsBuiltin(cmd: str): bool =
+    or(invokerIsPopoverCmd(cmd), invokerIsDialogCmd(cmd))
+
+  // targetKind: "popover" | "dialog" | "other"
+  def invokerCmdApplies(cmd: str, targetKind: str): bool =
+    or(
+      and(invokerIsPopoverCmd(cmd), targetKind == "popover"),
+      and(invokerIsDialogCmd(cmd), targetKind == "dialog")
+    )
+
+  // the button fires only when enabled and its commandfor resolves
+  def invokerFires(disabled: bool, targetExists: bool): bool =
+    and(not(disabled), targetExists)
+
+  // the `command` event is dispatched on the target for built-ins and `--` names
+  def invokerDispatches(cmd: str, custom: bool): bool = or(invokerIsBuiltin(cmd), custom)
+
+  // the popover.qnt event a popover command stands for
+  def invokerPopoverEvent(cmd: str): str =
+    if (cmd == "toggle-popover") "toggle"
+    else if (cmd == "show-popover") "show"
+    else if (cmd == "hide-popover") "hide"
+    else ""
+
+  // open flag of the target after the command (request-close: unchanged, the
+  // target's cancel handler decides)
+  def invokerOpenAfter(cmd: str, targetKind: str, open: bool): bool =
+    if (not(invokerCmdApplies(cmd, targetKind))) open
+    else if (cmd == "toggle-popover") not(open)
+    else if (or(cmd == "show-popover", cmd == "show-modal")) true
+    else if (or(cmd == "hide-popover", cmd == "close")) false
+    else open
+
+  // implicit aria-expanded of a popover invoker; no value for other targets
+  def invokerExpandedKnown(cmd: str, targetKind: str): bool =
+    and(invokerIsPopoverCmd(cmd), targetKind == "popover")
+}

package/shared/popover.qnt

@@ -0,0 +1,71 @@
+// shared/popover.qnt — the platform contract of the `popover` attribute
+// (`:popover-open`, light dismiss, Esc, focus return) for ONE popover.
+//
+// Pure defs only: import with `import popover.* from "../../shared/popover"`.
+// Defs are prefixed `popover`. The open flag is passed in and the next flag
+// comes back out; the pattern owns the var and feeds platform events to it, so
+// a menu-button writes `open' = popoverOpenAfter(kind, open, "outsidePress")`
+// and models only its own delta (menu keys, typeahead, aria-haspopup).
+//
+// Kinds: "auto" (light dismiss, closes unrelated autos and hints), "hint"
+// (light dismiss, closes only other hints, built for tooltips), "manual"
+// (no light dismiss, no Esc, closes nothing).
+//
+// Events a pattern may pass to `popoverOpenAfter`:
+//   show | hide | toggle          invoker command or showPopover()/hidePopover()
+//   esc                           the close request reached THIS popover (it is
+//                                 the topmost one)
+//   outsidePress                  pointer press outside the popover AND its invoker
+//                                 (a press on the invoker is `toggle`, not a dismiss
+//                                 followed by a re-open)
+//   focusOut                      focus moved elsewhere: never closes a popover
+//   showUnrelatedAuto | showUnrelatedHint   another popover of that kind opened
+//                                 and is neither an ancestor nor a descendant
+//
+// Provided: `:popover-open` is the open flag; show on an open popover and hide
+// on a closed one are no-ops; focus that was inside returns to the element
+// focused before it opened.
+//
+// NOT provided, still the pattern's: menu semantics, typeahead, hover intent,
+// submenus, aria-haspopup, positioning (anchor positioning is CSS). The invoker
+// button exposes `aria-expanded` implicitly (see invokers.qnt).
+//
+// NOT expressible as pure defs, so NOT modelled: the stack of open popovers.
+// Which popover is topmost, ancestor / descendant relations (a nested auto
+// popover keeps its ancestors open) and "Esc closes only the topmost" need a
+// collection of open popovers, which a pure module cannot carry. A pattern with
+// nested popovers states the relation itself as environment events
+// (`esc` only reaches the topmost, `showUnrelatedAuto` only for non-ancestors).
+// Follow-up of effects-of-atmosphere-dx00 (collections, item 6).
+//
+// Verified in Chromium 153.0.8010.12 (Playwright 1.63.0, native, 2026-10-07):
+// toggle/show/hide, Esc with focus inside returns focus to the invoker, outside
+// click closes an auto popover and focus goes to the click target, Tab or
+// script focus moving outside does not close, `manual` ignores Esc and outside
+// press, opening an unrelated auto closes the other, a nested child keeps its
+// ancestor, Esc closes only the topmost, `hint` stays alongside an open auto,
+// a second hint closes the first, showing an auto closes an open hint.
+// Pin: WHATWG HTML popover API (Baseline newly: C114 / F125 / S17); `hint`
+// C151 / F153 per docs/research/apg-platform-features.md.
+module popover {
+  def popoverKindKnown(kind: str): bool =
+    or(or(kind == "auto", kind == "hint"), kind == "manual")
+
+  // Esc and an outside press dismiss every kind but manual
+  def popoverLightDismisses(kind: str): bool = kind != "manual"
+
+  def popoverOpenAfter(kind: str, open: bool, ev: str): bool =
+    if (ev == "show") true
+    else if (ev == "hide") false
+    else if (ev == "toggle") not(open)
+    else if (or(ev == "esc", ev == "outsidePress"))
+      (if (popoverLightDismisses(kind)) false else open)
+    else if (ev == "showUnrelatedAuto") (if (kind == "manual") open else false)
+    else if (ev == "showUnrelatedHint") (if (kind == "hint") false else open)
+    else open
+
+  // does closing by this event hand focus back to the pre-open element?
+  // (only when focus was inside; a pointer press moves focus to its target)
+  def popoverReturnsFocus(ev: str, focusInside: bool): bool =
+    and(focusInside, or(or(ev == "hide", ev == "toggle"), ev == "esc"))
+}

package/specs/apg/STATIC.md

@@ -0,0 +1,103 @@
+# APG static patterns — ARIA contracts
+
+Patterns covered by `effects-of-atmosphere-3wsk`: alert, breadcrumb, landmarks, link, meter, table.
+
+The rule for this workspace is _behaviour first_: a Quint state machine exists only where there is state that changes over time. This file holds everything else — the **static role/attribute contract** that a DOM test can assert, as a checklist, with the reason a pattern has (or has no) machine.
+
+| Pattern    | Machine                              | Why                                                                                                         |
+| ---------- | ------------------------------------ | ----------------------------------------------------------------------------------------------------------- |
+| alert      | [`alert.qnt`](./alert.qnt)           | announcement-after-load, no focus theft, no auto-dismiss are all about change over time                     |
+| breadcrumb | [`breadcrumb.qnt`](./breadcrumb.qnt) | `aria-current` must follow the last item as the trail changes                                               |
+| link       | [`link.qnt`](./link.qnt)             | Enter activation + focus move; non-native links must stay keyboard reachable                                |
+| meter      | [`meter.qnt`](./meter.qnt)           | clamping, range changes and `aria-valuetext` freshness are derived state                                    |
+| landmarks  | none                                 | purely structural; no states, no events, no keyboard interaction. Correctness is a property of the DOM tree |
+| table      | none                                 | "a static tabular structure … not an interactive widget"; the only dynamic bit (`aria-sort`) is data        |
+
+Each machine's invariants (`val …` in the `.qnt`) cover its dynamic rules. The sections for those four below list only the **static** remainder the machine does not model.
+
+---
+
+## landmarks (no machine)
+
+APG: <https://www.w3.org/WAI/ARIA/apg/patterns/landmarks/> · practice: <https://www.w3.org/WAI/ARIA/apg/practices/landmark-regions/>
+
+Keyboard interaction: not applicable (navigation among landmarks is provided by the browser / assistive technology).
+
+Why no machine: a landmark is a role on a section of the page. There is no state to hold, no transition, and nothing to replay; a machine would only restate the DOM.
+
+Checklist (assert on the rendered document):
+
+- [ ] Every landmark is one of the eight roles: `banner`, `navigation`, `main`, `complementary`, `contentinfo`, `search`, `form`, `region` — either explicit `role=…` or the implied HTML element (`header`, `nav`, `main`, `aside`, `footer`, `form`, `section`).
+- [ ] The page has exactly one `main` landmark.
+- [ ] Top-level `banner` and `contentinfo` appear at most once each, and are not nested inside another landmark (`header`/`footer` inside `article`/`section` do not map to them).
+- [ ] When the page has **more than one** landmark of the same role (e.g. two `navigation`s), each carries a distinct accessible name (`aria-labelledby` preferred when a visible label exists, otherwise `aria-label`). The name does not repeat the role ("Main navigation", not "Main navigation navigation").
+- [ ] `form`, `region` and (when named) `search` landmarks have an accessible name — an unnamed `form` or `region` is not exposed as a landmark.
+- [ ] A `search` landmark wraps the whole search facility (input and button), not just the input.
+- [ ] All perceivable content sits inside some landmark (rule of thumb from the APG).
+- [ ] Landmark count stays small — the APG rule of thumb is seven or fewer; flag the page above that.
+- [ ] No landmark is hidden (`hidden`, `display: none`, `aria-hidden=true`) while its content stays reachable.
+
+## table (no machine)
+
+APG: <https://www.w3.org/WAI/ARIA/apg/patterns/table/> · practice: <https://www.w3.org/WAI/ARIA/apg/practices/grid-and-table-properties/>
+
+Keyboard interaction: not applicable. Cells are not focusable or selectable; each widget inside a cell is its own tab stop. An interactive tabular widget is the **grid** pattern, a different spec.
+
+Why no machine: a table is static structure. Sorting is the one dynamic aspect and it is plain data (`aria-sort` follows the sorted column) — if a sortable table gains real behaviour (sort cycle, focus on the header button) model that as its own sortable-table machine, not here.
+
+Checklist:
+
+- [ ] The container has `role=table` (or is a native `<table>`; a native element is strongly preferred and needs no role).
+- [ ] Every row has `role=row` and is a DOM descendant of, or owned (`aria-owns`) by, the `table` or by an element with `role=rowgroup`.
+- [ ] Every cell has exactly one of `columnheader`, `rowheader`, `cell`, and is a descendant of / owned by a `row`:
+  - [ ] `columnheader` for a cell that titles its column,
+  - [ ] `rowheader` for a cell that titles its row,
+  - [ ] `cell` otherwise.
+- [ ] The table has an accessible name: `aria-labelledby` pointing at a visible label if one exists, otherwise `aria-label`.
+- [ ] If the table has a caption or description, `aria-describedby` on the table refers to it.
+- [ ] Sortable table: at most one header has `aria-sort`, and its value is `ascending`, `descending` (or `other`); unsorted headers carry no `aria-sort="none"` noise unless the design needs it.
+- [ ] If any rows or columns are absent from the DOM (virtualised or hidden): `aria-rowcount` / `aria-colcount` hold the **total** count (`-1` when unknown), and every row/cell present has `aria-rowindex` / `aria-colindex` with its 1-based position.
+- [ ] Cells spanning several rows or columns carry `aria-rowspan` / `aria-colspan`.
+- [ ] Rows or cells added through `aria-owns` are not forgotten in the owner's `aria-owns` list — owned elements are announced after the DOM descendants.
+- [ ] No cell has `tabindex` or a selection state (`aria-selected`): that would make it a grid.
+- [ ] Interactive content inside cells (buttons, links) is individually focusable; the cell itself is not.
+
+---
+
+## alert — static remainder (machine: `alert.qnt`)
+
+APG: <https://www.w3.org/WAI/ARIA/apg/patterns/alert/> · keyboard: not applicable.
+
+- [ ] The element carrying the message has `role=alert` (implicit `aria-live=assertive`, `aria-atomic=true`).
+- [ ] The alert has no `tabindex`, and showing it never calls `focus()` — needing focus means the alertdialog pattern instead.
+- [ ] For a message that must be announced, the `role=alert` container is rendered **empty first** (or the node is inserted/changed after load); content present at load time is not spoken.
+- [ ] No timer removes the alert; any dismiss control is an ordinary button in the tab order.
+- [ ] Machine invariants: `FocusNeverOnAlert`, `PreloadedNotAnnounced`, `LiveMessageAnnounced`, `SilentBeforeLoad`, `RoleWhenMounted`.
+
+## breadcrumb — static remainder (machine: `breadcrumb.qnt`)
+
+APG: <https://www.w3.org/WAI/ARIA/apg/patterns/breadcrumb/> · keyboard: not applicable (ordinary links).
+
+- [ ] The trail is inside a `navigation` landmark (`<nav>`).
+- [ ] The landmark has a label via `aria-label` or `aria-labelledby` (e.g. "Breadcrumb").
+- [ ] The trail is an ordered list (`<ol>`) of items, ancestors first, current page last.
+- [ ] Every ancestor item is a link; the current page item is last.
+- [ ] Machine invariants: `CurrentIsLastOrAbsent`, `LinkCurrentIsMarked` (`aria-current="page"` on the current-page link; optional on a non-link current item).
+
+## link — static remainder (machine: `link.qnt`)
+
+APG: <https://www.w3.org/WAI/ARIA/apg/patterns/link/> · keyboard: Enter executes and moves focus to the target; Shift+F10 (optional) opens the context menu.
+
+- [ ] Prefer a native `<a href>`; it needs no role, `tabindex`, or key handler.
+- [ ] A non-native element has `role=link`, `tabindex=0`, an accessible name from its content (or `aria-label`), and a click **and** Enter key handler. Space does not activate it.
+- [ ] Machine invariants: `KeyboardReachable`, `FocusOnLinkImpliesFocusable`, `TargetFocusImpliesArrived`, `ArrivedImpliesActivated`.
+
+## meter — static remainder (machine: `meter.qnt`)
+
+APG: <https://www.w3.org/WAI/ARIA/apg/patterns/meter/> · keyboard: not applicable.
+
+- [ ] The element has `role=meter` (or a native `<meter>`), and is not used for progress (`progressbar`) or for unbounded values.
+- [ ] `aria-valuenow`, `aria-valuemin`, `aria-valuemax` are decimals with `min < max` and `min <= now <= max`.
+- [ ] `aria-valuetext` is set when a bare percentage is not understandable (e.g. `50% (6 hours) remaining`).
+- [ ] Visible label → `aria-labelledby` on the meter; otherwise `aria-label`.
+- [ ] Machine invariants: `RangeValid`, `NowInRange`, `NowIsClampedRaw`, `TextWhenNotFriendly`, `TextNeverStale`.