pour-engine 1.32.0 → 1.34.0

package/engine/rules/wcag/1.3.1-aria-required-parent.js

@@ -2,14 +2,25 @@
 // Child roles that only make sense inside a specific container role.
 // Explicit roles only — native elements (li outside ul) are covered by
 // listitem-parent/dlitem-parent.
+//
+// ARIA 1.2 Required Context Role, verbatim: group is a real context for
+// option, the menuitem family and treeitem (listbox > group > option,
+// menu > group > menuitem, tree > treeitem > group > treeitem is the APG
+// Tree View pattern itself). Treating group as transparent for those roles
+// walked past the group onto the parent treeitem, which is neither a
+// container nor transparent, and asserted every multi-level tree built to
+// the pattern (2026-08-25 overnight audit; Chromium exposes tree > treeitem
+// > group > treeitem exactly as authored). For the roles whose context does
+// not list group (listitem, tab, row, cell), group stays transparent as
+// before.
 const REQUIRED_PARENT = {
   listitem: ['list'],
-  option: ['listbox'],
-  menuitem: ['menu', 'menubar'],
-  menuitemcheckbox: ['menu', 'menubar'],
-  menuitemradio: ['menu', 'menubar'],
+  option: ['listbox', 'group'],
+  menuitem: ['menu', 'menubar', 'group'],
+  menuitemcheckbox: ['menu', 'menubar', 'group'],
+  menuitemradio: ['menu', 'menubar', 'group'],
   tab: ['tablist'],
-  treeitem: ['tree'],
+  treeitem: ['tree', 'group'],
   row: ['table', 'grid', 'treegrid', 'rowgroup'],
   rowgroup: ['table', 'grid', 'treegrid'],
   cell: ['row'],
@@ -29,6 +40,9 @@ export default {
   evaluate(element) {
     const role = element.getAttribute('role').trim().split(/\s+/)[0].toLowerCase();
     const containers = REQUIRED_PARENT[role];
+    // The container named in the message and fix: the structure's root, not
+    // the group that may sit between it and the item.
+    const named = containers.filter((container) => container !== 'group');
     // aria-owns makes the relationship without containment: the owner can sit
     // anywhere in the document and the browser still builds the structure.
     // Judging by DOM ancestry alone failed every remotely-owned child.
@@ -55,18 +69,20 @@ export default {
       const parentRole =
         parent.getAttribute('role')?.trim().split(/\s+/)[0]?.toLowerCase() ??
         IMPLICIT_CONTAINER[parent.tagName.toLowerCase()];
-      if (parentRole === 'group') continue; // group is transparent in these structures
+      // A permitted context (the structure's root, or a group for the roles
+      // whose ARIA context lists it) satisfies the requirement outright.
+      if (containers.includes(parentRole)) return { status: 'pass' };
+      if (parentRole === 'group') continue; // group is transparent in the remaining structures
       // presentation/none removes the wrapper from the tree but leaves its
       // children owned by the next real ancestor — li[role=presentation]
       // between a tablist and its tabs is the canonical pattern.
       if (parentRole === 'presentation' || parentRole === 'none') continue;
-      if (containers.includes(parentRole)) return { status: 'pass' };
       if (parentRole) break; // a different role interrupts the required structure
     }
     return {
       status: 'fail',
-      message: `role="${role}" is not inside a ${containers.join('/')} — assistive technology loses the structure entirely.`,
-      fix: `Wrap it in an element with role="${containers[0]}", or fix the intervening roles.`,
+      message: `role="${role}" is not inside a ${named.join('/')} — assistive technology loses the structure entirely.`,
+      fix: `Wrap it in an element with role="${named[0]}", or fix the intervening roles.`,
     };
   },
 };

package/engine/rules/wcag/1.3.1-definition-list.js

@@ -1,5 +1,13 @@
 // WCAG SC 1.3.1 Info and Relationships (Level A)
-const ALLOWED = new Set(['DT', 'DD', 'DIV', 'SCRIPT', 'TEMPLATE']);
+const ALLOWED = new Set(['DT', 'DD', 'DIV']);
+// Nothing here reaches the accessibility tree, so none of it can corrupt
+// the term/description pairing: the same set list-structure keeps, for the
+// same reason (CSS-in-JS injects <style> right beside the markup). HTML's
+// content model does exclude style from dl, but validity is not the
+// criterion; 1.3.1 is about relationships assistive technology can
+// determine, and every dt/dd pair stays intact around an element that has
+// no tree presence (2026-08-25 overnight audit).
+const NEVER_RENDERED = new Set(['SCRIPT', 'TEMPLATE', 'STYLE', 'LINK', 'META']);
 
 export default {
   id: 'definition-list',
@@ -9,8 +17,12 @@ export default {
   help: '<dl> must be structured as term/description pairs',
   helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/info-and-relationships.html',
   selector: 'dl:not([role])', // a role attribute replaces the dl semantics
-  evaluate(element) {
-    const invalid = [...element.children].filter((child) => !ALLOWED.has(child.tagName));
+  evaluate(element, { isRendered }) {
+    // A child the browser never renders (display:none, hidden) is not in
+    // the accessibility tree either, so it cannot break the pairing a
+    // reader hears; list-structure applies the same gate.
+    const invalid = [...element.children].filter((child) =>
+      !ALLOWED.has(child.tagName) && !NEVER_RENDERED.has(child.tagName) && (!isRendered || isRendered(child)));
     if (invalid.length) {
       const tags = [...new Set(invalid.map((child) => `<${child.tagName.toLowerCase()}>`))].join(', ');
       return {

package/engine/rules/wcag/1.3.1-dlitem-parent.js

@@ -8,7 +8,20 @@ export default {
   helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/info-and-relationships.html',
   selector: 'dt:not([role]), dd:not([role])', // role overrides the dt/dd semantics
   evaluate(element) {
-    if (element.closest('dl')) return { status: 'pass' };
+    // Judge the FLAT-tree ancestry, what assistive technology actually
+    // sees: a <dt>/<dd> slotted into a host whose shadow root holds
+    // <dl><slot></slot></dl> belongs to that <dl> (Chromium exposes
+    // DescriptionList > term > definition for it), and an item at the top
+    // of a shadow tree continues through its host. A light-DOM closest('dl')
+    // asserted every slotted pair as orphaned (2026-08-25 overnight audit;
+    // same walk as listitem-parent).
+    const flatParent = (node) => node.assignedSlot?.parentElement
+      ?? node.parentElement
+      ?? node.getRootNode()?.host
+      ?? null;
+    for (let parent = flatParent(element); parent; parent = flatParent(parent)) {
+      if (parent.tagName === 'DL') return { status: 'pass' };
+    }
     return {
       status: 'fail',
       message: `<${element.tagName.toLowerCase()}> outside a <dl> has no term/description semantics.`,

package/engine/rules/wcag/1.3.1-form-label.js

@@ -28,10 +28,21 @@ export default {
     // aria-hidden styled twin names NOTHING — the browser's tree computes an
     // empty name), while aria-label on the label itself or on things inside
     // it (icon-only labels) and image alts DO feed the name per accname.
+    //
+    // An UNRENDERED descendant is excluded the same way: accname step 2A
+    // returns the empty string for a hidden node that is not the root of
+    // the label traversal, and hidden covers display:none and
+    // visibility:hidden (the hidden attribute is display:none). A label
+    // whose only text sits in a display:none span names nothing (Chromium
+    // computes ""), the mirror of the aria-hidden twin above (2026-08-25
+    // overnight audit). Computed style rather than checkVisibility: an SVG
+    // <title> has no box yet still names its graphic.
     const accessibleText = (node) => {
       if (node.nodeType === Node.TEXT_NODE) return node.textContent;
       if (node.nodeType !== Node.ELEMENT_NODE) return '';
       if (node.getAttribute('aria-hidden') === 'true') return '';
+      const nodeStyle = getComputedStyle(node);
+      if (nodeStyle.display === 'none' || nodeStyle.visibility === 'hidden') return '';
       const aria = node.getAttribute('aria-label');
       if (aria?.trim()) return aria;
       const alt = (node.tagName === 'IMG' || node.tagName === 'AREA') ? node.getAttribute('alt') : null;
@@ -66,9 +77,25 @@ export default {
       };
     }
     if (element.labels?.length && !visibleLabels.length) {
+      // aria-hidden has no visual effect: a label hidden ONLY that way is
+      // still painted for sighted users and lost only to assistive
+      // technology (Chromium computes an empty name). Telling the author
+      // to "make the label visible" sent them to fix the wrong thing; the
+      // fix is to remove aria-hidden (2026-08-25 overnight audit).
+      const onlyAriaHidden = [...element.labels].some((label) => {
+        const style = getComputedStyle(label);
+        return style.display !== 'none' && style.visibility !== 'hidden';
+      });
+      if (onlyAriaHidden) {
+        return {
+          status: 'fail',
+          message: 'This field\'s only <label> is inside aria-hidden="true": sighted users still see it, but it is removed from the accessibility tree, so the field has no accessible name.',
+          fix: 'Remove aria-hidden from the label (or from the ancestor that hides it). If the label must stay hidden from assistive technology, name the field another way with aria-label or aria-labelledby.',
+        };
+      }
       return {
         status: 'fail',
-        message: 'This field\'s only <label> is hidden (display:none or aria-hidden) — no one can see or rely on it.',
+        message: 'This field\'s only <label> is hidden (display:none or visibility:hidden), so no one can see or rely on it.',
         fix: 'Make the label visible, or use a visually-hidden-but-rendered technique (clip/sr-only) if it must not show.',
       };
     }
@@ -77,6 +104,17 @@ export default {
       // sitting inside an aria-hidden subtree (the styled-twin custom
       // control pattern) is excluded from the name computation.
       const looksLabelled = visibleLabels.some((l) => l.textContent.trim());
+      const ariaHiddenText = visibleLabels.some((l) =>
+        [...l.querySelectorAll('[aria-hidden="true"]')].some((twin) => twin.textContent.trim()));
+      if (looksLabelled && !ariaHiddenText) {
+        // The text is there in the markup but nothing renders it (defect
+        // 8's shape): the sighted user sees an empty label too.
+        return {
+          status: 'fail',
+          message: 'This field\'s <label> holds text, but all of it is inside unrendered content (display:none or visibility:hidden), so the accessible name computes to nothing and nobody sees a label.',
+          fix: 'Render the text inside the label, move it out of the hidden element, or add aria-label to the field.',
+        };
+      }
       return {
         status: 'fail',
         message: looksLabelled

package/engine/rules/wcag/1.3.1-listitem-parent.js

@@ -11,7 +11,8 @@ export default {
     // Judge the FLAT-tree parent — what assistive technology actually sees:
     // a slotted <li> belongs to the <ul> around its slot, and an <li> at the
     // top of a shadow tree belongs to its host element.
-    let parent = element.assignedSlot?.parentElement ?? element.parentElement ?? element.getRootNode()?.host;
+    const flatParent = (el) => el.assignedSlot?.parentElement ?? el.parentElement ?? el.getRootNode()?.host;
+    let parent = flatParent(element);
     while (parent?.tagName === 'SLOT') parent = parent.assignedSlot?.parentElement ?? parent.parentElement;
     // List ownership passes through presentation/none wrappers and
     // role-less div/span grouping wrappers (generic nodes) — an <li> in a
@@ -32,16 +33,31 @@ export default {
       if (el.matches('ul, ol, menu')) return !role || ['list', 'presentation', 'none'].includes(role);
       return role === 'list';
     };
-    while (parent && !listContainer(parent) && (
-      ['presentation', 'none'].includes(parent.getAttribute('role') ?? '')
-      || (!parent.hasAttribute('role') && (parent.tagName === 'DIV' || parent.tagName === 'SPAN'))
-    )) {
-      parent = parent.assignedSlot?.parentElement ?? parent.parentElement ?? parent.getRootNode()?.host;
-    }
+    const transparent = (el) => ['presentation', 'none'].includes(el.getAttribute('role') ?? '')
+      || (!el.hasAttribute('role') && (el.tagName === 'DIV' || el.tagName === 'SPAN'));
+    while (parent && !listContainer(parent) && transparent(parent)) parent = flatParent(parent);
     if (parent && listContainer(parent)) return { status: 'pass' };
     const parentLabel = parent
       ? `<${parent.tagName.toLowerCase()}${parent.getAttribute('role') ? ` role="${parent.getAttribute('role')}"` : ''}>`
       : 'nothing';
+    // A role="group" wrapper BETWEEN a list and its items: the list is
+    // there (Chromium exposes list > group > listitem), but ARIA 1.2 gives
+    // list one required owned element, listitem, so the group is not
+    // permitted in between and the items are no longer the list's own. The
+    // verdict stands; the old message blamed a missing list and the fix
+    // sent the author to add one that already existed (2026-08-25
+    // overnight audit).
+    if (parent?.getAttribute('role') === 'group') {
+      let above = flatParent(parent);
+      while (above && !listContainer(above) && (transparent(above) || above.getAttribute('role') === 'group')) above = flatParent(above);
+      if (above && listContainer(above)) {
+        return {
+          status: 'fail',
+          message: `This <li> sits inside ${parentLabel} within its list. A list may only own list items directly, and role="group" is not permitted between a list and its items, so screen readers lose the item's list context.`,
+          fix: 'Remove role="group" from the wrapper (a plain <div> keeps the items owned by the list), or move the group label onto the list element with aria-label.',
+        };
+      }
+    }
     return {
       status: 'fail',
       message: `This <li> sits inside ${parentLabel} — ${parent?.matches('ul, ol, menu') && parent.getAttribute('role')

package/engine/rules/wcag/1.3.1-table-headers.js

@@ -7,6 +7,17 @@
 // Layout tables are skipped via a conservative heuristic (role=presentation,
 // or too small/text-sparse to be a data grid) — a missed layout table is
 // better than false positives on real pages.
+//
+// Block-level content inside cells (headings, paragraphs, lists, forms,
+// navigation) is the other layout signature: tabular data is inline text,
+// and a page scaffold built as a table (site name / nav / sidebar / article
+// / footer) meets the 2 x 2 x 4-text-cells heuristic while conveying no
+// header relationship at all. H51 and F91 are scoped to "tabular
+// information"; the DOM cannot prove such a table is data, so it asks
+// rather than asserts (2026-08-25 overnight audit).
+const BLOCK_CONTENT = 'h1, h2, h3, h4, h5, h6, p, ul, ol, dl, menu, form, nav, main, header, footer, '
+  + 'section, article, aside, blockquote, figure, fieldset, pre, hr, table';
+
 export default {
   id: 'table-headers',
   name: 'Table header associations',
@@ -18,18 +29,32 @@ export default {
   evaluate(element) {
     const role = element.getAttribute('role');
     if (role && !['table', 'grid'].includes(role)) return { status: 'pass' }; // presentation/none/other widget
+    // The table's OWN rows and cells (table.rows / row.cells stop at the
+    // table's boundary): a header cell inside a nested table belongs to that
+    // table, so it neither satisfies the outer table nor lifts it out of the
+    // nested-layout demotion (2026-08-25 overnight audit; a deep
+    // querySelector('th') did both).
     const rows = [...element.rows];
     const cells = rows.flatMap((row) => [...row.cells]);
     // Data-grid heuristic: at least a 2×2 grid with mostly-text cells.
     const isGrid = rows.length >= 2 && Math.max(0, ...rows.map((row) => row.cells.length)) >= 2;
     const textCells = cells.filter((cell) => cell.textContent.trim()).length;
     if (!isGrid || textCells < 4) return { status: 'pass' }; // likely layout or trivial
+    // A header cell is a <th>, or a <td> given the columnheader/rowheader
+    // role: ARIA in HTML permits any role on a td of a role-less table, and
+    // the header roles are the header semantics ARIA defines (Chromium
+    // exposes td[role=columnheader] as columnheader). 1.3.1 asks that the
+    // relationship be programmatically determinable, which the role
+    // satisfies (2026-08-25 overnight audit).
+    const cellRole = (cell) => cell.getAttribute('role')?.trim().split(/\s+/)[0]?.toLowerCase();
+    const isHeaderCell = (cell) => cell.tagName === 'TH' || ['columnheader', 'rowheader'].includes(cellRole(cell));
+    const hasHeaderCell = cells.some(isHeaderCell);
     // Nested tables are the signature of legacy LAYOUT markup, not data —
     // asserting "missing headers" there flags email-style scaffolding. A
     // human can tell in a glance; the machine can't. The signature reads in
     // both directions: a table INSIDE another table (Hacker News's story
     // list inside its page-scaffold table) is the same legacy layout.
-    if (!element.querySelector('th') && (element.querySelector('table') || element.parentElement?.closest('table'))) {
+    if (!hasHeaderCell && (element.querySelector('table') || element.parentElement?.closest('table'))) {
       return {
         status: 'incomplete',
         message: 'This table has no header cells and is part of a nested-table structure — a layout-table signature. If it really presents data, mark its header cells with <th>; if it is layout scaffolding, add role="presentation".',
@@ -40,7 +65,7 @@ export default {
       const headers = cell.getAttribute('headers');
       return headers && headers.trim().split(/\s+/).filter(Boolean).some((id) => {
         const target = element.getRootNode().getElementById?.(id);
-        return !target || !element.contains(target) || !/^T[HD]$/.test(target.tagName);
+        return !target || !cells.includes(target) || !(/^T[HD]$/.test(target.tagName) || isHeaderCell(target));
       });
     });
     if (badRefs.length) {
@@ -51,8 +76,14 @@ export default {
       };
     }
 
-    const hasHeaders = element.querySelector('th, [scope], td[headers]');
+    const hasHeaders = hasHeaderCell || cells.some((cell) => cell.hasAttribute('scope') || cell.hasAttribute('headers'));
     if (!hasHeaders) {
+      if (cells.some((cell) => cell.querySelector(BLOCK_CONTENT))) {
+        return {
+          status: 'incomplete',
+          message: 'This table has no header cells and its cells hold block content (headings, paragraphs, lists or forms), which is a layout-table signature. If it really presents data, mark its header cells with <th>; if it is layout scaffolding, add role="presentation".',
+        };
+      }
       return {
         status: 'fail',
         message: 'This looks like a data table but has no header cells — screen reader users get the data with no way to tell what each row/column means.',

package/engine/rules/wcag/1.3.2-reading-order-divergence.js

@@ -0,0 +1,69 @@
+// WCAG SC 1.3.2 Meaningful Sequence (Level A) — the CSS-reordering slice
+//
+// Screen readers read the DOM in source order. When CSS `order` or a
+// reversed flex direction arranges sibling content differently on screen,
+// sighted users and screen reader users receive the page in two different
+// sequences — C27's substance ("make the DOM order match the visual
+// order"), with the divergence measurable. Whether that divergence
+// CHANGES MEANING is the criterion's own test and a human call, so this
+// reviews, never asserts.
+//
+// Same geometry and the same deliberate narrowness as 2.4.3's
+// visual-order-divergence (same-container siblings only; `order` or
+// `*-reverse` as the only accepted evidence; wrapped-one-level-deep and
+// grid-native placement are disclosed gaps there and equally here), with
+// two scope cuts of its own:
+//   - at least two of the reordered siblings must carry rendered text:
+//     a reversed row of purely decorative icons has no reading sequence
+//     to preserve;
+//   - groups where EVERY reordered sibling is tabbable are left to 2.4.3,
+//     which already asks about that container from the focus side —
+//     asking the same question twice about the same box helps nobody.
+import { FLEXGRID, tabbable, visualSequence } from './2.4.3-visual-order-divergence.js';
+
+export default {
+  id: 'reading-order-divergence',
+  name: 'Reading order vs visual order',
+  impact: 'moderate',
+  tags: ['wcag2a', 'wcag132'],
+  help: 'CSS reordering should not make reading order diverge from the visual order',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/meaningful-sequence.html',
+  selector: '*',
+  evaluateAll(elements) {
+    const outcomes = new Map();
+    const groups = new Map();
+    for (const element of elements) {
+      const parent = element.parentElement;
+      if (!parent) continue;
+      if (!groups.has(parent)) groups.set(parent, []);
+      groups.get(parent).push(element);
+    }
+    for (const [parent, children] of groups) {
+      if (children.length < 2) continue;
+      const parentStyle = getComputedStyle(parent);
+      if (!FLEXGRID.test(parentStyle.display)) continue;
+      const reversed = /-reverse$/.test(parentStyle.flexDirection);
+      const entries = children
+        .map((element) => ({ element, style: getComputedStyle(element) }))
+        .filter(({ style }) => style.position !== 'absolute' && style.position !== 'fixed')
+        .map((entry) => ({ ...entry, rect: entry.element.getBoundingClientRect() }))
+        .filter(({ rect }) => rect.width > 0 && rect.height > 0);
+      if (entries.length < 2) continue;
+      const usesOrder = entries.some(({ style }) => style.order !== '0');
+      if (!reversed && !usesOrder) continue;
+      const withText = entries.filter(({ element }) => (element.textContent || '').trim().length > 0);
+      if (withText.length < 2) continue;
+      if (entries.every(({ element }) => element.matches('a[href], button, input, select, textarea, summary, [tabindex]') && tabbable(element))) continue;
+      const visual = visualSequence(entries, parentStyle.direction === 'rtl');
+      const diverges = visual.some((entry, i) => entry !== entries[i]);
+      if (!diverges) continue;
+      const cause = reversed ? `flex-direction: ${parentStyle.flexDirection}` : 'CSS order';
+      outcomes.set(entries[0].element, {
+        status: 'incomplete',
+        message: `A screen reader reads these ${entries.length} blocks in DOM order, but ${cause} arranges them differently on screen — sighted and screen reader users get two different sequences. Check the source order still tells the same story as the layout.`,
+        fix: 'Reorder the source to match the visual order instead of reordering with CSS, or confirm the sequence difference does not change meaning here.',
+      });
+    }
+    return elements.map((element) => outcomes.get(element) ?? { status: 'pass' });
+  },
+};

package/engine/rules/wcag/1.3.4-orientation.js

@@ -16,22 +16,36 @@
 // Script-driven locks (screen.orientation.lock()) and cross-origin
 // stylesheets (unreadable under CORS) are invisible to a static pass; the
 // rule asserts only what it can see and stays silent otherwise.
-const ROOT_PART = /^(html|body|:root)(::?[a-z-]+(\(.*\))?)?$/i;
+// The root ELEMENT only, optionally qualified by pseudo-classes. A pseudo-
+// element (body::before, html::backdrop) is one generated box, and hiding
+// it in portrait is the region restyling this rule deliberately leaves
+// alone; matching it asserted "hides the page" over a decorative band
+// (2026-08-25 overnight audit). Pseudo-classes are kept, but only assert
+// when the live root actually matches them (see rootSelector).
+const ROOT_PART = /^(html|body|:root)((?::[a-z-]+(?:\([^()]*\))?)*)$/i;
 const LOCK_ROTATE = /rotate(?:3d\([^)]*,\s*)?\(?\s*(?:-?(?:90|270)deg|0\.25turn|-0\.25turn|100grad|-100grad)/i;
 
-function rootSelector(selectorText) {
-  return (selectorText ?? '').split(',').some((part) => ROOT_PART.test(part.trim()));
+function rootSelector(selectorText, doc) {
+  return (selectorText ?? '').split(',').some((part) => {
+    const match = ROOT_PART.exec(part.trim());
+    if (!match) return false;
+    if (!match[2]) return true; // bare root: always in force
+    // body:not(.ready) { visibility: hidden } locks nothing once the class
+    // is on; the selector must match the root as it stands to be a lock.
+    const root = /^body$/i.test(match[1]) ? doc.body : doc.documentElement;
+    try { return !!root && root.matches(part.trim()); } catch { return false; }
+  });
 }
 
-function scanRules(rules, insideOrientation, findings) {
+function scanRules(rules, insideOrientation, findings, doc) {
   for (const rule of rules ?? []) {
     const condition = rule.conditionText ?? rule.media?.mediaText;
     if (condition !== undefined && rule.cssRules) {
       const orientation = /orientation\s*:\s*(portrait|landscape)/i.exec(condition)?.[1];
-      scanRules(rule.cssRules, orientation ? { condition, orientation } : insideOrientation, findings);
+      scanRules(rule.cssRules, orientation ? { condition, orientation } : insideOrientation, findings, doc);
       continue;
     }
-    if (insideOrientation && rule.style && rootSelector(rule.selectorText)) {
+    if (insideOrientation && rule.style && rootSelector(rule.selectorText, doc)) {
       const { display, visibility, transform, rotate } = rule.style;
       if (display === 'none' || visibility === 'hidden') {
         findings.push({ kind: 'hidden', selector: rule.selectorText, ...insideOrientation });
@@ -61,7 +75,7 @@ export default {
     for (const sheet of element.ownerDocument.styleSheets) {
       let rules;
       try { rules = sheet.cssRules; } catch { continue; } // cross-origin: unreadable, skip
-      scanRules(rules, null, findings);
+      scanRules(rules, null, findings, element.ownerDocument);
     }
     if (!findings.length) return { status: 'pass' };
     const f = findings[0];

package/engine/rules/wcag/1.3.5-autocomplete-valid.js

@@ -2,19 +2,77 @@
 // WCAG 1.3.5: autocomplete tokens from the HTML spec's input-purposes list.
 // Membership set, so order is free: kept a-z rather than mirroring the spec
 // table's own sequence.
-const TOKENS = new Set([
+//
+// The field names: the 53 purposes WCAG 2.2 section 7 lists, plus
+// one-time-code (HTML's list is a superset of WCAG's).
+const FIELD_NAMES = new Set([
   'additional-name', 'address-level1', 'address-level2', 'address-level3', 'address-level4',
   'address-line1', 'address-line2', 'address-line3', 'bday', 'bday-day', 'bday-month',
-  'bday-year', 'billing', 'cc-additional-name', 'cc-csc', 'cc-exp', 'cc-exp-month',
+  'bday-year', 'cc-additional-name', 'cc-csc', 'cc-exp', 'cc-exp-month',
   'cc-exp-year', 'cc-family-name', 'cc-given-name', 'cc-name', 'cc-number', 'cc-type',
-  'country', 'country-name', 'current-password', 'email', 'family-name', 'fax', 'given-name',
-  'home', 'honorific-prefix', 'honorific-suffix', 'impp', 'language', 'mobile', 'name',
-  'new-password', 'nickname', 'off', 'on', 'one-time-code', 'organization',
-  'organization-title', 'pager', 'photo', 'postal-code', 'sex', 'shipping', 'street-address',
+  'country', 'country-name', 'current-password', 'email', 'family-name', 'given-name',
+  'honorific-prefix', 'honorific-suffix', 'impp', 'language', 'name',
+  'new-password', 'nickname', 'one-time-code', 'organization',
+  'organization-title', 'photo', 'postal-code', 'sex', 'street-address',
   'tel', 'tel-area-code', 'tel-country-code', 'tel-extension', 'tel-local', 'tel-local-prefix',
   'tel-local-suffix', 'tel-national', 'transaction-amount', 'transaction-currency', 'url',
-  'username', 'webauthn', 'work',
+  'username',
 ]);
+// HTML's contact types, and the field names they may qualify.
+const CONTACT_TYPES = new Set(['home', 'work', 'mobile', 'fax', 'pager']);
+const CONTACT_FIELDS = new Set([
+  'tel', 'tel-country-code', 'tel-national', 'tel-area-code', 'tel-local',
+  'tel-local-prefix', 'tel-local-suffix', 'tel-extension', 'email', 'impp',
+]);
+const MODIFIERS = new Set(['shipping', 'billing', 'webauthn', 'on', 'off']);
+const isSection = (token) => token.startsWith('section-');
+const isKnown = (token) => FIELD_NAMES.has(token) || CONTACT_TYPES.has(token) || MODIFIERS.has(token) || isSection(token);
+
+/**
+ * HTML's autofill grammar, parsed positionally: the value is either "on" or
+ * "off" alone, or autofill detail tokens in this order: optionally one
+ * section-* token, then optionally shipping or billing, then EITHER one
+ * field name OR a contact type (home, work, mobile, fax, pager) immediately
+ * followed by a tel, tel-*, email or impp field name, then optionally
+ * webauthn. A browser that cannot parse the value discards all of it, so a
+ * grammatically broken value exposes no purpose at all: F107 territory even
+ * when every token is individually real. Membership alone passed "shipping"
+ * (no field), "tel email" (two fields), "home name" (contact type before a
+ * non-contact field), "billing section-x tel" (section not first), "off
+ * email" and "webauthn" alone (2026-08-25 overnight audit).
+ * Returns null when the value is well formed, otherwise the reason it is not.
+ */
+function grammarFault(tokens) {
+  if (tokens.length === 1 && (tokens[0] === 'on' || tokens[0] === 'off')) return null;
+  if (tokens.includes('on') || tokens.includes('off')) return '"on" and "off" must stand alone, with no other tokens';
+  let i = 0;
+  if (isSection(tokens[i])) i += 1;
+  if (tokens[i] === 'shipping' || tokens[i] === 'billing') i += 1;
+  if (CONTACT_TYPES.has(tokens[i])) {
+    if (!CONTACT_FIELDS.has(tokens[i + 1])) {
+      return `"${tokens[i]}" must come directly before a tel, tel-*, email or impp field name`;
+    }
+    i += 2;
+  } else if (FIELD_NAMES.has(tokens[i])) {
+    i += 1;
+  } else {
+    const found = tokens[i];
+    if (found && isSection(found)) return `"${found}" must be the first token`;
+    if (found === 'webauthn') return '"webauthn" must come last, after a field name';
+    if (found === 'shipping' || found === 'billing') return `"${found}" may appear once, directly before the field name`;
+    return 'the value names no field (exactly one field name such as email, tel or given-name is required)';
+  }
+  if (tokens[i] === 'webauthn') i += 1;
+  if (i < tokens.length) {
+    const extra = tokens[i];
+    if (isSection(extra)) return `"${extra}" must be the first token`;
+    if (extra === 'shipping' || extra === 'billing') return `"${extra}" must come before the field name`;
+    if (extra === 'webauthn') return '"webauthn" must be the last token';
+    if (FIELD_NAMES.has(extra) || CONTACT_TYPES.has(extra)) return `only one field name is allowed, but "${tokens[i - 1]}" is followed by "${extra}"`;
+    return `"${extra}" cannot follow the field name`;
+  }
+  return null;
+}
 
 export default {
   id: 'autocomplete-valid',
@@ -23,19 +81,35 @@ export default {
   tags: ['wcag21aa', 'wcag135'],
   help: 'autocomplete attributes must use valid tokens',
   helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/identify-input-purpose.html',
-  selector: 'input[autocomplete], select[autocomplete], textarea[autocomplete]',
+  // HTML gives the autocomplete attribute no effect on checkbox, radio, file,
+  // submit, image, reset and button inputs, and a disabled control collects
+  // nothing, so neither can misidentify a purpose (2026-08-25 overnight
+  // audit; the same applicability ACT rule 73f2c2 states).
+  selector: 'input[autocomplete]:not([type="checkbox"]):not([type="radio"]):not([type="file"]):not([type="submit"])'
+    + ':not([type="image"]):not([type="reset"]):not([type="button"]):not(:disabled),'
+    + ' select[autocomplete]:not(:disabled), textarea[autocomplete]:not(:disabled)',
   evaluate(element) {
-    const invalid = element
+    if (element.getAttribute('aria-disabled') === 'true') return { status: 'pass' };
+    const tokens = element
       .getAttribute('autocomplete')
       .trim()
       .toLowerCase()
       .split(/\s+/)
-      .filter((token) => token && !TOKENS.has(token) && !token.startsWith('section-'));
-    if (!invalid.length) return { status: 'pass' };
+      .filter(Boolean);
+    const invalid = tokens.filter((token) => !isKnown(token));
+    if (invalid.length) {
+      return {
+        status: 'fail',
+        message: `autocomplete contains unknown token(s): ${invalid.join(', ')} — browsers and assistive tools can't identify this field's purpose.`,
+        fix: 'Use tokens from the HTML input-purposes list, e.g. autocomplete="email" or autocomplete="given-name".',
+      };
+    }
+    const fault = tokens.length ? grammarFault(tokens) : null;
+    if (!fault) return { status: 'pass' };
     return {
       status: 'fail',
-      message: `autocomplete contains unknown token(s): ${invalid.join(', ')} — browsers and assistive tools can't identify this field's purpose.`,
-      fix: 'Use tokens from the HTML input-purposes list, e.g. autocomplete="email" or autocomplete="given-name".',
+      message: `autocomplete="${element.getAttribute('autocomplete').trim()}" is not a valid autofill value: ${fault}. Browsers discard the whole value, so no purpose is exposed.`,
+      fix: 'Use one field name from the HTML autofill list, optionally preceded by section-*, then shipping or billing, and (for tel, email and impp only) a contact type, e.g. autocomplete="shipping tel" or autocomplete="home email".',
     };
   },
 };