@richscripts/richtexteditor 2.7.0 → 2.7.1

package/richtexteditor/all_plugins.js

@@ -519,6 +519,29 @@ function RTE_Plugin_AccessibilityChecker() {
                 }
             }
 
+            // 2026-09-04 A link with no accessible name is announced as just
+            // "link", giving a keyboard or screen-reader user nothing to decide
+            // on (WCAG 2.4.4 / 4.1.2). Reached the editor easily: an image-only
+            // link whose <img> has empty alt, or a link left empty after its
+            // text was deleted.
+            //
+            // Only elements with href are links. A bare <a name="x"> or an <a>
+            // with no href is an anchor TARGET and has no name to announce, so
+            // flagging it would be an error with no valid fix.
+            var links = tag === "a" ? [node] : (node.querySelectorAll ? node.querySelectorAll("a") : []);
+            for (var linkIndex = 0; linkIndex < links.length; linkIndex++) {
+                var link = links[linkIndex];
+                if (!link.getAttribute || link.getAttribute("href") === null) continue;
+                if (accessibleNameOf(link)) continue;
+                issues.push({
+                    code: "link-empty",
+                    severity: "error",
+                    message: "Link has no text, so it is announced only as \"link\". Add link text, an aria-label, or alt text on the image inside it.",
+                    path: path + ".link[" + linkIndex + "]",
+                    _target: link
+                });
+            }
+
             var tables = tag === "table" ? [node] : (node.querySelectorAll ? node.querySelectorAll("table") : []);
             for (var tableIndex = 0; tableIndex < tables.length; tableIndex++) {
                 var table = tables[tableIndex];
@@ -553,11 +576,168 @@ function RTE_Plugin_AccessibilityChecker() {
                         _target: table
                     });
                 }
+                else {
+                    // 2026-09-04 A table can HAVE headers and still be unusable if
+                    // one is blank: the screen reader announces the column's name as
+                    // an empty string, which is worse than no header at all because
+                    // the relationship exists and says nothing (WCAG 1.3.1).
+                    // `table-missing-header` above only fires when there is not a
+                    // single <th>, so this case reported valid. Found by testing
+                    // CKEditor issue #19204 against this checker.
+                    //
+                    // THE CORNER CELL IS EXEMPT. In a cross-tab - column headers
+                    // across the top, row headers down the side - the top-left cell
+                    // is conventionally and correctly empty; it names neither axis.
+                    // Flagging it would be an error the author can only clear by
+                    // inventing a word, which is how a checker teaches people to
+                    // ignore it. Same reasoning that exempts layout tables above.
+                    var headerCells = table.querySelectorAll("th");
+                    var hasRowHeaders = false;
+                    for (var probeIndex = 0; probeIndex < headerCells.length; probeIndex++) {
+                        var probeRow = headerCells[probeIndex].parentNode;
+                        if (probeRow && probeRow.rowIndex > 0) { hasRowHeaders = true; break; }
+                    }
+                    for (var headerIndex = 0; headerIndex < headerCells.length; headerIndex++) {
+                        var headerCell = headerCells[headerIndex];
+                        if (accessibleNameOf(headerCell)) continue;
+                        var ownerRow = headerCell.parentNode;
+                        if (hasRowHeaders && ownerRow && ownerRow.rowIndex === 0 && headerCell.cellIndex === 0) continue;
+                        issues.push({
+                            code: "table-header-empty",
+                            severity: "error",
+                            message: "Header cell is empty, so the column or row it labels is announced with no name. Give it text, or make it a normal cell if it labels nothing.",
+                            path: path + ".table[" + tableIndex + "].th[" + headerIndex + "]",
+                            _target: headerCell
+                        });
+                    }
+                }
+            }
+
+
+            // 2026-09-07 COLOUR CONTRAST (WCAG 1.4.3). The most-cited criterion in
+            // any accessibility audit and the checker had no rule for it -- and
+            // our own comparison page once claimed one, which had to be retracted.
+            //
+            // Only INLINE colour is judged. Contrast against a stylesheet the
+            // editor cannot see would be a guess, and a checker that guesses
+            // teaches people to ignore it. Where no background is declared on the
+            // element or an ancestor, white is assumed and stated in the message,
+            // because that is the editing surface's own ground.
+            var coloured = node.querySelectorAll ? node.querySelectorAll("[style*='color']") : [];
+            var colouredList = (node.getAttribute && /(^|;)\s*color\s*:/i.test(node.getAttribute("style") || ""))
+                ? [node].concat(Array.prototype.slice.call(coloured))
+                : Array.prototype.slice.call(coloured);
+            for (var cIndex = 0; cIndex < colouredList.length; cIndex++) {
+                var cEl = colouredList[cIndex];
+                var fg = parseCssColour(cEl.style && cEl.style.color);
+                if (!fg) continue;
+                var bg = nearestBackground(cEl);
+                var ratio = contrastRatio(fg, bg.rgb);
+                // 4.5:1 is the AA threshold for body text; 3:1 for large text
+                // (>=18pt, or >=14pt bold). Using the body number on a heading
+                // would report a failure that is not one.
+                var large = isLargeText(cEl);
+                var need = large ? 3 : 4.5;
+                // Epsilon absorbs float noise ONLY. 0.05 was 1% of the threshold and
+                // swallowed real near-misses: #777777 on white is 4.48:1, a genuine
+                // failure, and went unreported. It must also not fire on a colour that
+                // passes at exactly 4.5, so the comparison errs toward silence.
+                if (ratio < need - 0.001) {
+                    issues.push({
+                        code: "contrast-insufficient",
+                        severity: "error",
+                        message: "Text contrast is " + ratio.toFixed(2) + ":1 against " +
+                            (bg.assumed ? "an assumed white background" : "its background") +
+                            ", below the " + need + ":1 needed for " +
+                            (large ? "large text" : "body text") + " (WCAG 1.4.3).",
+                        path: path + ".contrast[" + cIndex + "]",
+                        _target: cEl
+                    });
+                }
+            }
+
+            // 2026-09-07 BLOCKQUOTE USED AS INDENTATION (WCAG 1.3.1). A quotation
+            // element used for visual offset is announced as a quotation by screen
+            // readers and exported to Word as the Quote style.
+            //
+            // This is OUR OWN historical output: until 2026-09-04 the indent button
+            // fell through to the browser's execCommand, which wraps the block in
+            // <blockquote style="margin:0 0 0 40px;border:none;padding:0px">. Every
+            // document indented in an older build carries these, so the rule
+            // matters most for content we produced ourselves.
+            //
+            // Recognise only that SHAPE -- an offset with the quote decoration
+            // explicitly switched off. A blockquote that keeps its border is a real
+            // quotation and must not be flagged.
+            var quotes = tag === "blockquote" ? [node] : (node.querySelectorAll ? node.querySelectorAll("blockquote") : []);
+            for (var qIndex = 0; qIndex < quotes.length; qIndex++) {
+                var q = quotes[qIndex];
+                var qs = q.style;
+                if (!qs) continue;
+                var hasOffset = /^\s*[\d.]+\s*[a-z%]+\s*$/i.test(qs.marginLeft || "") && parseFloat(qs.marginLeft) > 0;
+                var borderOff = /^(none|0|0px)$/i.test(String(qs.borderStyle || qs.border || "").trim());
+                if (hasOffset && borderOff) {
+                    issues.push({
+                        code: "blockquote-as-indent",
+                        severity: "warning",
+                        message: "This looks like indentation, not a quotation: a <blockquote> with a left margin and no quote styling. Screen readers announce it as a quotation. Use the indent button instead.",
+                        path: path + ".blockquote[" + qIndex + "]",
+                        _target: q
+                    });
+                }
+            }
+
+            // 2026-09-07 AMBIGUOUS LINK TEXT (WCAG 2.4.4). "Click here" read out of
+            // context -- which is how a screen-reader user listing links hears it --
+            // conveys nothing about the destination.
+            var ambiguous = /^(click here|here|read more|more|link|this|this link|learn more|details|go)$/i;
+            var namedLinks = tag === "a" ? [node] : (node.querySelectorAll ? node.querySelectorAll("a") : []);
+            for (var aIndex = 0; aIndex < namedLinks.length; aIndex++) {
+                var aEl = namedLinks[aIndex];
+                if (!aEl.getAttribute || aEl.getAttribute("href") === null) continue;
+                var aName = accessibleNameOf(aEl);
+                if (aName && ambiguous.test(aName.replace(/[\s.,!:;]+$/g, "").replace(/^\s+/, ""))) {
+                    issues.push({
+                        code: "link-ambiguous-text",
+                        severity: "warning",
+                        message: "Link text \"" + aName + "\" does not say where it goes. Out of context a screen reader announces only this text.",
+                        path: path + ".link[" + aIndex + "]",
+                        _target: aEl
+                    });
+                }
             }
 
             collectUnmarkedLanguageRuns(node, editable, path, issues);
         }
 
+        // 2026-09-07 DUPLICATE id (WCAG 4.1.1). Two elements sharing an id break
+        // every aria-labelledby / aria-describedby / label that points at it --
+        // the reference silently resolves to the first one. Reached easily by
+        // copying and pasting a block that carries an id.
+        //
+        // Runs ONCE over the whole editable, deliberately NOT inside the per-node
+        // walk: querySelectorAll returns DESCENDANTS only, so a walk visiting each
+        // sibling separately sees one id at a time and can never detect a pair.
+        // The same trap already cost this file its top-level image check.
+        if (editable && editable.querySelectorAll) {
+            var allWithIds = editable.querySelectorAll("[id]");
+            var idSeen = {};
+            for (var dupIndex = 0; dupIndex < allWithIds.length; dupIndex++) {
+                var dupId = allWithIds[dupIndex].getAttribute("id");
+                if (!dupId) continue;
+                if (idSeen[dupId]) {
+                    issues.push({
+                        code: "duplicate-id",
+                        severity: "error",
+                        message: "id \"" + dupId + "\" is used more than once. Any aria-labelledby, aria-describedby or label pointing at it resolves to only the first element.",
+                        path: "document.id[" + dupIndex + "]",
+                        _target: allWithIds[dupIndex]
+                    });
+                }
+                idSeen[dupId] = true;
+            }
+        }
+
         return { document: null, issues: issues, valid: !issues.length, source: "dom" };
     }
 
@@ -587,6 +767,29 @@ function RTE_Plugin_AccessibilityChecker() {
         else if (issue.code === "layout-table-semantics") {
             markTableAsLayout(target);
         }
+        else if (issue.code === "table-header-empty") {
+            // Two valid outcomes and only the author knows which: the cell labels
+            // something (give it text) or it labels nothing (it is not a header).
+            var headerText = String((options && options.headerText) || "").replace(/^\s+|\s+$/g, "");
+            if (headerText) target.textContent = headerText;
+            else if (options && options.demoteToCell) {
+                var cell = target.ownerDocument.createElement("td");
+                while (target.firstChild) cell.appendChild(target.firstChild);
+                copyAttributes(target, cell);
+                cell.removeAttribute("scope");
+                target.parentNode.replaceChild(cell, target);
+            }
+        }
+        else if (issue.code === "link-empty") {
+            // Prefer real text: an aria-label is invisible, so a sighted editor
+            // cannot see what the link says and it drifts out of date.
+            var linkText = String((options && options.linkText) || "").replace(/^\s+|\s+$/g, "");
+            if (linkText) target.textContent = linkText;
+            else {
+                var linkLabel = String((options && options.linkLabel) || "").replace(/^\s+|\s+$/g, "");
+                if (linkLabel) target.setAttribute("aria-label", linkLabel);
+            }
+        }
         else if (issue.code === "language-of-parts") {
             markLanguageRuns(target, options && options.lang ? options.lang : issue._lang, issue._script);
         }
@@ -673,6 +876,86 @@ function RTE_Plugin_AccessibilityChecker() {
     // Delegates to layouttable.js when it is loaded so there is ONE definition of
     // what "layout table" means; the fallback keeps the repair working in builds
     // where that plugin was left out of the bundle.
+    // The accessible name of an element, as a screen reader would compute it:
+    // aria-label wins, then visible text, then title, then the alt text of an
+    // image standing in for the text. Empty string means "announced as nothing".
+    // Deliberately NOT aria-labelledby - resolving it needs the whole document
+    // and a wrong answer here would produce an error the author cannot clear.
+
+    // --- contrast helpers (WCAG 1.4.3) ---------------------------------------
+    function parseCssColour(v) {
+        if (!v) return null;
+        var str = String(v).trim();
+        var m = /^#([0-9a-f]{3}|[0-9a-f]{6})$/i.exec(str);
+        if (m) {
+            var hex = m[1];
+            if (hex.length === 3) hex = hex[0] + hex[0] + hex[1] + hex[1] + hex[2] + hex[2];
+            return [parseInt(hex.slice(0, 2), 16), parseInt(hex.slice(2, 4), 16), parseInt(hex.slice(4, 6), 16)];
+        }
+        var rgb = /^rgba?\(\s*([\d.]+)\s*,\s*([\d.]+)\s*,\s*([\d.]+)/i.exec(str);
+        if (rgb) return [Math.round(+rgb[1]), Math.round(+rgb[2]), Math.round(+rgb[3])];
+        return null;   // named colours are not resolved: a guess is worse than silence
+    }
+    // Nearest ancestor that DECLARES a background. Reports whether it had to
+    // fall back, so the message can say "assumed white" rather than asserting a
+    // background the document never set.
+    function nearestBackground(el) {
+        var n = el;
+        while (n && n.style) {
+            var c = parseCssColour(n.style.backgroundColor);
+            if (c) return { rgb: c, assumed: false };
+            n = n.parentElement;
+        }
+        return { rgb: [255, 255, 255], assumed: true };
+    }
+    function relativeLuminance(rgb) {
+        var a = [rgb[0], rgb[1], rgb[2]].map(function (v) {
+            v = v / 255;
+            return v <= 0.03928 ? v / 12.92 : Math.pow((v + 0.055) / 1.055, 2.4);
+        });
+        return 0.2126 * a[0] + 0.7152 * a[1] + 0.0722 * a[2];
+    }
+    function contrastRatio(fg, bg) {
+        var l1 = relativeLuminance(fg), l2 = relativeLuminance(bg);
+        var hi = Math.max(l1, l2), lo = Math.min(l1, l2);
+        return (hi + 0.05) / (lo + 0.05);
+    }
+    // WCAG "large text": >=18pt, or >=14pt bold. A heading judged against the
+    // body threshold reports a failure that is not one.
+    function isLargeText(el) {
+        var st = el.style || {};
+        var size = String(st.fontSize || "");
+        var pt = null;
+        var m = /^([\d.]+)(px|pt)$/i.exec(size.trim());
+        if (m) pt = m[2].toLowerCase() === "pt" ? parseFloat(m[1]) : parseFloat(m[1]) * 0.75;
+        if (pt === null) {
+            var tagName = (el.tagName || "").toLowerCase();
+            if (/^h[1-3]$/.test(tagName)) return true;
+            return false;
+        }
+        var bold = /bold|^[6-9]00$/.test(String(st.fontWeight || ""));
+        return pt >= 18 || (pt >= 14 && bold);
+    }
+
+    function accessibleNameOf(element) {
+        if (!element) return "";
+        var trim = function (v) { return String(v || "").replace(/^\s+|\s+$/g, ""); };
+        var label = trim(element.getAttribute && element.getAttribute("aria-label"));
+        if (label) return label;
+        var text = trim(element.textContent);
+        if (text) return text;
+        var title = trim(element.getAttribute && element.getAttribute("title"));
+        if (title) return title;
+        if (element.querySelectorAll) {
+            var imgs = element.querySelectorAll("img");
+            for (var i = 0; i < imgs.length; i++) {
+                var alt = trim(imgs[i].getAttribute("alt"));
+                if (alt) return alt;
+            }
+        }
+        return "";
+    }
+
     function markTableAsLayout(table) {
         if (!table) return;
         if (editor && typeof editor.setTableLayoutMode === "function") {
@@ -23020,9 +23303,24 @@ function RTE_Plugin_DialogA11y() {
         }
     }
 
+    // 2026-09-05 Widened. The original selector only matched
+    // <rte-dropdown-panel>/.rte-panel-general, but Find&Replace, Insert Link and
+    // their siblings render as <rte-dialog-float class="rte-panel-find"> wrapping
+    // an <rte-dialog-inner role="dialog">. Those carry EXACTLY the markup this
+    // plugin consumes - an <rte-dialog-header> and <rte-dialog-line-X> field
+    // wrappers - and were simply never visited, so the plugin reported nothing
+    // and covered nothing. Measured before the change: calling
+    // editor.applyDialogAccessibility() with the find dialog open labelled 0 of
+    // its 4 inputs, leaving "Find" and "Replace" announced as bare "edit"
+    // (WCAG 1.3.1 / 3.3.2 / 4.1.2) while the two checkboxes were fine because
+    // the core happens to wrap those in <label>.
+    //
+    // Widening is safe because enhancePanel() still requires an
+    // <rte-dialog-header>, which is what keeps colour/font dropdowns out.
     function isPanel(el) {
         return el && el.nodeType === 1 &&
-            (el.tagName === "RTE-DROPDOWN-PANEL" || /rte-panel-general/.test(el.className || ""));
+            (el.tagName === "RTE-DROPDOWN-PANEL" || el.tagName === "RTE-DIALOG-FLOAT" ||
+             /rte-panel-general/.test(el.className || ""));
     }
 
     function schedule(panel) {
@@ -23042,7 +23340,7 @@ function RTE_Plugin_DialogA11y() {
 
     function enhanceAll(host) {
         if (!host || !host.querySelectorAll) return;
-        var ps = host.querySelectorAll("rte-dropdown-panel,[class*='rte-panel-general']");
+        var ps = host.querySelectorAll("rte-dropdown-panel,rte-dialog-float,[class*='rte-panel-general']");
         for (var i = 0; i < ps.length; i++) enhancePanel(ps[i]);
     }
 
@@ -23054,12 +23352,22 @@ function RTE_Plugin_DialogA11y() {
         var name = (headerEl.textContent || "").trim()
             .replace(/\s*\((?:Ctrl|Cmd|Alt|Shift|⌘|⇧|⌥)[^)]*\)\s*$/i, "").trim();
 
+        // Name the element that IS the dialog. The float-style panels already
+        // carry role="dialog" on an inner <rte-dialog-inner>; adding a second
+        // role="dialog" to the wrapper would announce two nested dialogs, so
+        // when an inner one exists it is the target and the wrapper is left
+        // alone. When there is none (the original dropdown-panel shape) this
+        // resolves to the panel itself and behaves exactly as before.
+        var dialogEl = panel.getAttribute("role") === "dialog"
+            ? panel
+            : (panel.querySelector('[role="dialog"]') || panel);
+
         // A titled, form-bearing popup is a dialog, not a menu — override the
         // core's default role="menu" (a menu must not contain text fields).
-        var role = panel.getAttribute("role");
-        if (!role || role === "menu") panel.setAttribute("role", "dialog");
-        if (name && !panel.getAttribute("aria-label") && !panel.getAttribute("aria-labelledby")) {
-            panel.setAttribute("aria-label", name);
+        var role = dialogEl.getAttribute("role");
+        if (!role || role === "menu") dialogEl.setAttribute("role", "dialog");
+        if (name && !dialogEl.getAttribute("aria-label") && !dialogEl.getAttribute("aria-labelledby")) {
+            dialogEl.setAttribute("aria-label", name);
         }
 
         var fields = panel.querySelectorAll("input,select,textarea");
@@ -23074,6 +23382,25 @@ function RTE_Plugin_DialogA11y() {
     }
 
     function fieldLabel(f, dialogName) {
+        // 0) THE VISIBLE LABEL WINS. 2026-09-05: deriving the name from the
+        // <rte-dialog-line-X> suffix alone produced "Keyword" for a field whose
+        // visible label reads "Find". That fails WCAG 2.5.3 Label in Name, and
+        // it breaks speech input concretely: a user says "Find" and nothing
+        // matches, because the accessible name does not contain the words they
+        // can see. The markup already carries the right text in a sibling
+        // <rte-dialog-input-label>, so prefer it and keep the suffix as the
+        // fallback for fields that have no visible label.
+        var lineEl = f.parentElement;
+        for (var d = 0; d < 8 && lineEl; d++) {
+            if (/^RTE-DIALOG-LINE-/.test(lineEl.tagName || "")) break;
+            lineEl = lineEl.parentElement;
+        }
+        if (lineEl && lineEl.querySelector) {
+            var visEl = lineEl.querySelector("rte-dialog-input-label");
+            var vis = visEl ? (visEl.textContent || "").replace(/^\s+|\s+$/g, "").replace(/[:：]\s*$/, "") : "";
+            if (vis) return vis;
+        }
+
         // 1) nearest <rte-dialog-line-X> ancestor — the suffix is the field meaning
         var n = f.parentElement;
         for (var i = 0; i < 8 && n; i++) {
@@ -24333,6 +24660,25 @@ function RTE_Plugin_DocumentImport() {
                     var hv = hl.getAttributeNS(W, "val") || hl.getAttribute("w:val") || "";
                     if (hv && hv !== "none") css += "background-color:" + hv + ";";
                 }
+                // w:shd is the OTHER way Word carries a background, and it is the
+                // one our own exporter writes (w:highlight only accepts a fixed
+                // set of colour NAMES, shd takes any hex). Reading only
+                // w:highlight meant every highlight we exported came back
+                // unhighlighted - the two sides used different vocabulary for the
+                // same thing.
+                var shd = firstChildEl(rpr, "shd");
+                if (shd) {
+                    var fill = shd.getAttributeNS(W, "fill") || shd.getAttribute("w:fill") || "";
+                    if (fill && /^[0-9A-Fa-f]{6}$/.test(fill)) css += "background-color:#" + fill + ";";
+                }
+                // Monospace run -> inline code. Our exporter marks <code>/<kbd>/
+                // <samp>/<pre> with w:rFonts Consolas; nothing read it back.
+                var rf = firstChildEl(rpr, "rFonts");
+                if (rf) {
+                    var asc = rf.getAttributeNS(W, "ascii") || rf.getAttribute("w:ascii") || "";
+                    if (/consolas|courier|monospace|mono$/i.test(asc)) txt = "<code>" + txt + "</code>";
+                    else if (asc) css += "font-family:" + asc.replace(/[<>"]/g, "") + ";";
+                }
                 var sz = firstChildEl(rpr, "sz");
                 if (sz) {
                     var sv = parseInt(sz.getAttributeNS(W, "val") || sz.getAttribute("w:val") || "", 10);
@@ -24505,7 +24851,16 @@ function RTE_Plugin_DocumentImport() {
                 // without this they came back as plain <p> and the round-trip lost
                 // every blockquote. Match Quote / IntenseQuote / BlockQuote.
                 else if (/^(intense)?quote$|blockquote/i.test(v.replace(/\s+/g, ""))) info.quote = true;
+                // docxexport.js writes <w:pStyle w:val="Code"/> for <pre>; without
+                // this a code block came back as an ordinary paragraph and lost
+                // both its monospace and its whitespace.
+                else if (/^(code|sourcecode|htmlpre|preformatted)$/i.test(v.replace(/\s+/g, ""))) info.pre = true;
             }
+            // A horizontal rule is exported as an EMPTY paragraph carrying a
+            // bottom border - Word has no <hr>. Nothing read it back, so every
+            // rule became a stray blank paragraph on import.
+            var pbdr = firstChildEl(ppr, "pBdr");
+            if (pbdr && firstChildEl(pbdr, "bottom")) info.rule = true;
             var numPr = firstChildEl(ppr, "numPr");
             if (numPr) {
                 info.list = true;
@@ -24599,6 +24954,12 @@ function RTE_Plugin_DocumentImport() {
                     continue;
                 }
                 closeListsTo(0);
+                // Only a rule when the paragraph carries no text of its own -
+                // a bordered paragraph WITH content is a real bordered paragraph.
+                if (st.rule && !(inner || "").replace(/<[^>]*>/g, "").trim()) {
+                    closeListsTo(0); out.push("<hr>"); continue;
+                }
+                if (st.pre) { out.push("<pre>" + (inner || "<br>") + "</pre>"); continue; }
                 if (st.heading) {
                     // Headings carry w:ind too; without this an indented
                     // heading imported flush left.
@@ -25217,7 +25578,7 @@ function RTE_Plugin_DocxExport() {
             bold: inherited.bold, italic: inherited.italic, underline: inherited.underline,
             strike: inherited.strike, sizeHalfPoints: inherited.sizeHalfPoints,
             color: inherited.color, highlight: inherited.highlight, vertAlign: inherited.vertAlign,
-            mono: inherited.mono
+            mono: inherited.mono, font: inherited.font
         };
         var tag = node.tagName ? node.tagName.toLowerCase() : "";
         if (tag === "b" || tag === "strong") s.bold = true;
@@ -25227,6 +25588,10 @@ function RTE_Plugin_DocxExport() {
         if (tag === "sup") s.vertAlign = "superscript";
         if (tag === "sub") s.vertAlign = "subscript";
         if (tag === "code" || tag === "kbd" || tag === "samp" || tag === "pre") s.mono = true;
+        // <mark> carries no inline style, so the CSS branch below never sees it
+        // and highlighted text was dropped entirely on export. Word's own
+        // default highlight is yellow.
+        if (tag === "mark") s.highlight = s.highlight || "FFFF00";
 
         var css = node.style;
         if (css) {
@@ -25237,6 +25602,12 @@ function RTE_Plugin_DocxExport() {
             if (deco.indexOf("line-through") >= 0) s.strike = true;
             if (css.color) { var c = hexColor(css.color); if (c) s.color = c; }
             if (css.backgroundColor) { var h = hexColor(css.backgroundColor); if (h) s.highlight = h; }
+            // Font family was read by nothing, so an exported document lost every
+            // typeface choice. Word wants ONE family name, not a CSS stack.
+            if (css.fontFamily) {
+                var fam = String(css.fontFamily).split(",")[0].replace(/^\s*['"]?|['"]?\s*$/g, "");
+                if (fam) s.font = fam;
+            }
             if (css.fontSize) {
                 var pt = cssToPoints(css.fontSize);
                 // w:sz is in HALF-POINTS. Writing points here makes every
@@ -25273,7 +25644,10 @@ function RTE_Plugin_DocxExport() {
 
     function runProps(s) {
         var p = "";
-        if (s.mono) p += '<w:rFonts w:ascii="Consolas" w:hAnsi="Consolas"/>';
+        // One rFonts element only: mono wins, because <code> inside a styled span
+        // should still read as code.
+        var fontName = s.mono ? "Consolas" : (s.font || "");
+        if (fontName) p += '<w:rFonts w:ascii="' + esc(fontName) + '" w:hAnsi="' + esc(fontName) + '"/>';
         if (s.bold) p += "<w:b/>";
         if (s.italic) p += "<w:i/>";
         if (s.underline) p += '<w:u w:val="single"/>';
@@ -25691,7 +26065,17 @@ function RTE_Plugin_DocxExport() {
             for (var i = 0; i < node.childNodes.length; i++) {
                 var li = node.childNodes[i];
                 if (li.nodeType !== 1 || li.tagName.toLowerCase() !== "li") continue;
-                xml += para(li, styleFrom(li, style), { numId: numId, level: level, pageBreakBefore: pendingBreak });
+                // Serialise the item's OWN content only. para() walks every
+                // descendant, so passing the whole <li> emitted the nested list's
+                // text here AND again as its own items below - a round trip turned
+                // "xx" with a child "yy" into "xxyy". Content duplication, not loss.
+                var own = li.ownerDocument.createElement("li");
+                for (var k = 0; k < li.childNodes.length; k++) {
+                    var ch = li.childNodes[k];
+                    if (ch.nodeType === 1 && /^(ul|ol)$/.test(ch.tagName.toLowerCase())) continue;
+                    own.appendChild(ch.cloneNode(true));
+                }
+                xml += para(own, styleFrom(li, style), { numId: numId, level: level, pageBreakBefore: pendingBreak });
                 pendingBreak = false;
                 for (var j = 0; j < li.childNodes.length; j++) {
                     var sub = li.childNodes[j];
@@ -31379,6 +31763,21 @@ function RTE_Plugin_KeyboardA11y() {
         if (config.keyboardA11y === false) return;
 
         editor.focusToolbar = function () { return focusFirstToolbarButton(); };
+        // Public so plugins can report their own outcomes -- find/replace match
+        // counts, what the paste filter removed, export completion.
+        editor.announce = function (text, opts) { return announce(text, opts); };
+        // setReadOnly() lives in the core and cannot call into a plugin, so wrap
+        // it here rather than leaving the two states to drift apart.
+        if (typeof editor.setReadOnly === "function" && !editor.setReadOnly.__a11yWrapped) {
+            var origSetReadOnly = editor.setReadOnly;
+            var wrapped = function (v) {
+                var r = origSetReadOnly.apply(editor, arguments);
+                try { syncReadOnlyState(); } catch (e) { }
+                return r;
+            };
+            wrapped.__a11yWrapped = true;
+            editor.setReadOnly = wrapped;
+        }
 
         setup();
         try { editor.attachEvent("ready", setup); } catch (e) {}
@@ -31402,6 +31801,8 @@ function RTE_Plugin_KeyboardA11y() {
     function setup() {
         var root = shell();
         if (!root) return;
+        ensureLiveRegions();
+        syncReadOnlyState();
         bindEscapeHatch();
         applyRovingTabindex(root);
         syncToggleStates(root);
@@ -31409,6 +31810,97 @@ function RTE_Plugin_KeyboardA11y() {
         watch(root);
     }
 
+
+    // ------------------------------------------------- 4. status messages
+    //
+    // WCAG 4.1.3 Status Messages (Level AA): a change of state that is NOT
+    // given focus still has to reach assistive technology. Before this the
+    // editor had no live region at all -- not one aria-live node, in the page
+    // or in the iframe -- so a screen reader user got silence for every
+    // outcome the sighted user reads off the chrome: how many matches Find
+    // found, what the paste filter stripped, that the length limit was hit,
+    // that the document went read-only.
+    //
+    // Two regions, because politeness is not a detail: 'polite' waits for a
+    // pause in speech (counts, confirmations), 'assertive' interrupts (errors,
+    // refusals). aria-atomic="true" on both so the whole message is re-read
+    // rather than only the words that changed -- reading a diff aloud produces
+    // sentences that were never written.
+    //
+    // The region lives in the HOST document, not the editing iframe: a message
+    // announced from inside the document the user is editing would also become
+    // part of what they are editing.
+    var liveNodes = null;
+    function ensureLiveRegions() {
+        if (liveNodes && liveNodes.polite && liveNodes.polite.isConnected) return liveNodes;
+        var root = shell();
+        if (!root) return null;
+        function mk(politeness) {
+            var el = root.querySelector('[data-rte-live="' + politeness + '"]');
+            if (el) return el;
+            el = document.createElement("div");
+            el.setAttribute("data-rte-live", politeness);
+            el.setAttribute("aria-live", politeness);
+            el.setAttribute("aria-atomic", "true");
+            el.setAttribute("role", politeness === "assertive" ? "alert" : "status");
+            // Visually hidden but still rendered: display:none and
+            // visibility:hidden remove the node from the accessibility tree,
+            // which silences it. Clip is the technique that does not.
+            el.style.cssText = "position:absolute;width:1px;height:1px;margin:-1px;" +
+                "padding:0;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap;border:0;";
+            root.appendChild(el);
+            return el;
+        }
+        liveNodes = { polite: mk("polite"), assertive: mk("assertive") };
+        return liveNodes;
+    }
+
+    // editor.announce(text, {assertive}) -- also used by plugins.
+    function announce(text, opts) {
+        var msg = String(text == null ? "" : text).trim();
+        if (!msg) return false;
+        var nodes = ensureLiveRegions();
+        if (!nodes) return false;
+        var el = (opts && opts.assertive) ? nodes.assertive : nodes.polite;
+        // Re-announcing the SAME string is a no-op for most screen readers
+        // unless the node is cleared first, so "3 results" after "3 results"
+        // would be silent. Clear, then set on the next frame.
+        el.textContent = "";
+        setTimeout(function () { el.textContent = msg; }, 30);
+        return true;
+    }
+
+    // ------------------------------------------------- 5. read-only state
+    //
+    // setReadOnly() flips designMode, which genuinely blocks editing -- but
+    // designMode is invisible to assistive technology. The toolbar already
+    // marks its buttons aria-disabled; the editing region itself said nothing,
+    // so a screen reader user entered a field described as a rich text editor,
+    // typed, and got no response and no explanation. aria-readonly is the
+    // attribute that carries this, and the accessible name says it too because
+    // a name is what gets announced on entry.
+    var lastReadOnly = null;
+    function syncReadOnlyState() {
+        var ed;
+        try { ed = editor.getEditable(); } catch (e) { return; }
+        if (!ed) return;
+        var ro = false;
+        try { ro = !!(editor.getReadOnly ? editor.getReadOnly() : editor.isReadOnly && editor.isReadOnly()); } catch (e) { }
+        ed.setAttribute("aria-readonly", ro ? "true" : "false");
+        var suffix = config.a11yReadOnlySuffix || "Read only.";
+        // Plain string trimming rather than a built regex: the suffix is
+        // config-supplied and would otherwise need escaping to be safe.
+        var label = (ed.getAttribute("aria-label") || "");
+        if (label.length >= suffix.length && label.slice(-suffix.length) === suffix) {
+            label = label.slice(0, -suffix.length).replace(/\s+$/, "");
+        }
+        ed.setAttribute("aria-label", ro ? (label + " " + suffix) : label);
+        if (lastReadOnly !== null && lastReadOnly !== ro) {
+            announce(ro ? suffix : (config.a11yEditableAgain || "Editing enabled."));
+        }
+        lastReadOnly = ro;
+    }
+
     // ---------------------------------------------------- 1. keyboard trap
     //
     // Tab keeps its editing meaning (indent, next table cell) because that is
@@ -35797,7 +36289,7 @@ function RTE_Plugin_PdfExport() {
         return px * 0.75;
     }
 
-        function block(node, style, indent, listMarker, listId, listOrdered) {
+        function block(node, style, indent, listMarker, listId, listOrdered, roleOverride) {
             var tag = node.tagName.toLowerCase();
             var s = styleOf(node, style);
             var align = "left";
@@ -35823,12 +36315,18 @@ function RTE_Plugin_PdfExport() {
                 // untagged still fails an accessibility audit: assistive
                 // technology gets a flat stream with no headings, no list
                 // structure and no reliable reading order.
-                role: HEADING_SCALE[tag] ? "H" + tag.charAt(1) : (tag === "blockquote" ? "BlockQuote" : "P"),
+                // roleOverride carries the quotation down to the paragraphs INSIDE a
+                // <blockquote>. The role was only ever emitted for a blockquote
+                // holding inline text directly - and the editor writes
+                // <blockquote><p>...</p></blockquote>, so in practice every
+                // blockquote we produce was tagged /P and the quotation was absent
+                // from the accessibility tree we publish claims about.
+                role: roleOverride || (HEADING_SCALE[tag] ? "H" + tag.charAt(1) : (tag === "blockquote" ? "BlockQuote" : "P")),
                 listId: listId || null, listOrdered: !!listOrdered
             });
         }
 
-        function walk(node, style, indent) {
+        function walk(node, style, indent, roleOverride) {
             for (var i = 0; i < node.childNodes.length; i++) {
                 var c = node.childNodes[i];
                 if (c.nodeType === 3) {
@@ -35870,8 +36368,9 @@ function RTE_Plugin_PdfExport() {
                 }
                 if (isBlockTag(tag)) {
                     var own = (tag === "blockquote" ? self.baseSize * 1.5 : 0) + cssIndentPt(c);
-                    if (hasBlockChildren(c)) { walk(c, styleOf(c, style), indent + own); continue; }
-                    block(c, style, indent + own, null);
+                    var childRole = (tag === "blockquote") ? "BlockQuote" : roleOverride;
+                    if (hasBlockChildren(c)) { walk(c, styleOf(c, style), indent + own, childRole); continue; }
+                    block(c, style, indent + own, null, null, false, childRole);
                     continue;
                 }
                 // Inline content sitting directly under a container.