pour-engine 1.32.0 → 1.34.0

package/engine/rules/wcag/2.5.8-target-size.js

@@ -98,7 +98,22 @@ function reachableRects(element, rect) {
     if (x < 0 || y < 0 || x >= win.innerWidth || y >= win.innerHeight) continue;
     const stack = doc.elementsFromPoint(x, y);
     const index = stack.indexOf(element);
-    if (index < 0) continue; // this fragment isn't hit-testable; try the next
+    if (index < 0) {
+      // The probe ran and the stack came back without the element.
+      // elementsFromPoint reports covered elements too, so for a light-DOM
+      // element this is not don't-know but a definitive no: nothing at this
+      // point accepts a pointer for it. The sr-only WRAPPER pattern makes
+      // exactly this shape — the clipped 1×1 box is the wrapper, the skip
+      // link inside keeps its full-size rect, and every self-applied hiding
+      // check (own rect, own opacity, own clip) passes; that phantom rect
+      // crowded frame.work's 160×21 header wordmark out of the spacing
+      // exception its layout plainly earns. Shadow-tree elements are
+      // invisible to the document's hit-test by design (the stack shows
+      // their host), so absence proves nothing there and the fragment keeps
+      // the benefit of the doubt.
+      if (element.getRootNode() === doc) testable = true;
+      continue;
+    }
     testable = true;
     // Anything above it that is part of the same control is not an
     // obstruction: a button's own icon paints over the button, an overlay
@@ -107,9 +122,9 @@ function reachableRects(element, rect) {
       reachable.push(fragment);
     }
   }
-  // Nothing could be probed at all (entirely out of viewport,
-  // pointer-events: none, nothing laid out): the OCCLUSION question is
-  // unanswerable, and don't-know must not silence a finding — but the
+  // Nothing could be probed at all (entirely out of viewport, or a
+  // shadow-tree element the document's hit-test cannot see): the OCCLUSION
+  // question is unanswerable, and don't-know must not silence a finding — but the
   // fragment GEOMETRY is measurable regardless, so the fragments stand,
   // never the bounding box. A wrapped link's box is mostly leading and
   // line-gap no pointer can activate; counting that empty space as
@@ -158,6 +173,68 @@ function isInTextLine(element) {
   return false;
 }
 
+// ── User Agent Control, proved from the stylesheets ──────────────────
+// The exception covers a native control whose size "is determined by the
+// user agent and is not modified by the author". A bare <button>Save</button>
+// at 46×21 was asserted under 2.5.5, and two stacked ones under 2.5.8's
+// spacing test, until this proof existed (2026-08-25 overnight audit).
+// Proof: no inline style and no readable author rule that matches the
+// element declares a property that can change its box. An unreadable
+// (cross-origin) sheet, or a selector the browser cannot parse, leaves the
+// proof open: the finding then reviews instead of asserting. The sheet walk
+// happens once per root and is cached on it for the audit; media rules that
+// do not apply now are skipped, since they size nothing now.
+const NATIVE_CONTROL = /^(button|input|select|textarea)$/i;
+const SIZING = /^(width|height|(min|max)-(width|height|inline-size|block-size)|inline-size|block-size|padding(-.+)?|border(-.+)?|font(-.+)?|line-height|box-sizing|transform|scale|zoom|appearance|all)$/;
+const sizingRulesByRoot = new WeakMap();
+
+function declaresSizing(style) {
+  for (let k = 0; k < style.length; k++) if (SIZING.test(style[k])) return true;
+  return false;
+}
+
+function authorSizingRules(root) {
+  const sheets = [...(root.styleSheets ?? []), ...(root.adoptedStyleSheets ?? [])];
+  const key = sheets.map((s) => { try { return s.cssRules.length; } catch { return 'x'; } }).join(',');
+  const cached = sizingRulesByRoot.get(root);
+  if (cached?.key === key) return cached;
+  const win = (root.ownerDocument ?? root).defaultView;
+  const probe = (root.ownerDocument ?? root).createElement('div');
+  const entry = { key, selectors: [], open: false };
+  const walk = (rules, parent) => {
+    for (const rule of rules) {
+      if (rule.media && win?.matchMedia && !win.matchMedia(rule.media.mediaText).matches) continue;
+      let selector = rule.selectorText ?? parent; // nested declarations belong to the parent
+      // CSS nesting: "& .x" means ":is(parent) .x", and a child with no "&" is
+      // a descendant of the parent.
+      if (parent && rule.selectorText) {
+        selector = /&/.test(selector) ? selector.replace(/&/g, `:is(${parent})`) : `:is(${parent}) ${selector}`;
+      }
+      if (selector && rule.style && declaresSizing(rule.style)) {
+        try { probe.matches(selector); entry.selectors.push(selector); } catch { entry.open = true; }
+      }
+      if (rule.cssRules?.length) walk(rule.cssRules, rule.selectorText ? selector : parent);
+    }
+  };
+  for (const sheet of sheets) {
+    try { walk(sheet.cssRules, null); } catch { entry.open = true; }
+  }
+  entry.combined = entry.selectors.join(', ');
+  sizingRulesByRoot.set(root, entry);
+  return entry;
+}
+
+/** 'yes' when the browser provably sized this native control, 'no' when the
+ *  author touched its box (or it is not a native control), 'open' when a
+ *  sheet or selector could not be read. */
+function uaSized(element) {
+  if (!NATIVE_CONTROL.test(element.tagName) || element.type === 'image') return 'no';
+  if (declaresSizing(element.style)) return 'no';
+  const entry = authorSizingRules(element.getRootNode());
+  if (entry.combined && element.matches(entry.combined)) return 'no';
+  return entry.open ? 'open' : 'yes';
+}
+
 /** Nearest distance from a point to a rectangle (0 when inside it). */
 function pointToRectDistance(point, rect) {
   const dx = Math.max(rect.left - point.x, 0, point.x - rect.right);
@@ -173,6 +250,21 @@ function pointToRectDistance(point, rect) {
  * lists only equivalent/inline/user-agent/essential there)
  */
 export function createTargetSizeRule({ id, tags, help, helpUrl, min, spacingException }) {
+  // The verdict compares exact floats, so display must not round a failing
+  // dimension up to the minimum: a 43.8px-tall button failing the AAA 44px
+  // bar must not read "44×44px — below the 44×44px minimum" (World Bank,
+  // 2026-08-25). One decimal only where integer rounding would cross the line,
+  // and a second decimal where one decimal STILL rounds up to it: toFixed
+  // rounds too, so 23.98 printed "24.0" and 43.98 printed "44.0" (2026-08-25
+  // overnight audit). Anything closer than that reads "just under".
+  const px = (v) => {
+    if (!(Math.round(v) >= min && v < min)) return String(Math.round(v));
+    for (const digits of [1, 2]) {
+      const shown = v.toFixed(digits);
+      if (Number(shown) < min) return shown;
+    }
+    return `just under ${min}`;
+  };
   return {
   id,
   impact: 'serious',
@@ -381,6 +473,36 @@ export function createTargetSizeRule({ id, tags, help, helpUrl, min, spacingExce
       return effective;
     };
 
+    // ── Equivalent targets ────────────────────────────────────────────
+    // Both criteria except a target whose function is available through
+    // another control on the same page that meets the minimum. Same
+    // destination is the one form of "same function" the DOM can prove,
+    // and obscuredRect above already reads matching hrefs that way. The
+    // card pattern (a 200×150 image link over a 16px title link to the
+    // same article) failed on the title link until the undersized path
+    // asked the same question (2026-08-25 overnight audit). A bare "#" or
+    // a javascript: URL names no destination, so it never pairs.
+    const destinationOf = (element) => {
+      if (typeof element.href !== 'string' || !element.href) return null;
+      const attr = (element.getAttribute('href') ?? '').trim();
+      if (!attr || attr === '#' || /^javascript:/i.test(attr)) return null;
+      return element.href;
+    };
+    let adequateDestinations = null;
+    const equivalentElsewhere = (i) => {
+      const destination = destinationOf(elements[i]);
+      if (!destination) return false;
+      if (!adequateDestinations) {
+        adequateDestinations = new Set();
+        elements.forEach((other, j) => {
+          if (!laidOut[j] || undersized[j] || other.ownerDocument !== elements[i].ownerDocument) return;
+          const d = destinationOf(other);
+          if (d) adequateDestinations.add(d);
+        });
+      }
+      return adequateDestinations.has(destination);
+    };
+
     return elements.map((element, i) => {
       if (!laidOut[i]) return { status: 'pass' }; // not laid out / not a pointer target
       if (!undersized[i]) {
@@ -417,7 +539,7 @@ export function createTargetSizeRule({ id, tags, help, helpUrl, min, spacingExce
         const rect = rects[i];
         return {
           status: 'fail',
-          message: `This target's box is ${Math.round(rect.width)}×${Math.round(rect.height)}px, but another target overlaps it and clicks in the overlap go there — the part that still accepts the pointer is ${Math.round(effective.width)}×${Math.round(effective.height)}px, below the ${min}×${min}px minimum.`,
+          message: `This target's box is ${Math.round(rect.width)}×${Math.round(rect.height)}px, but another target overlaps it and clicks in the overlap go there — the part that still accepts the pointer is ${px(effective.width)}×${px(effective.height)}px, below the ${min}×${min}px minimum.`,
           fix: 'Space the targets so they no longer overlap, or enlarge this one until the uncovered part reaches the minimum.',
           data: {
             box: { width: Math.round(rect.width), height: Math.round(rect.height) },
@@ -426,6 +548,11 @@ export function createTargetSizeRule({ id, tags, help, helpUrl, min, spacingExce
         };
       }
       if (uaControlled(element)) return { status: 'pass' }; // UA Control exception
+      // The same exception for every other native control, proved from the
+      // sheets; an open proof (unreadable sheet) reviews at the end instead
+      // of asserting, and only if nothing else rescues the target first.
+      const uaProof = uaSized(element);
+      if (uaProof === 'yes') return { status: 'pass' };
       if (isInTextLine(element)) return { status: 'pass' };
       if (spacingException) {
         // Spacing exception: the min-sized circle around this target must
@@ -471,12 +598,19 @@ export function createTargetSizeRule({ id, tags, help, helpUrl, min, spacingExce
         // dismissed, and suppressing it would hide a real defect behind a
         // transient overlay, which is the wrong way round.
       }
+      if (equivalentElsewhere(i)) return { status: 'pass' }; // Equivalent exception, proved by href
       const rect = rects[i];
+      if (uaProof === 'open') {
+        return {
+          status: 'incomplete',
+          message: `This native control is ${px(rect.width)}×${px(rect.height)}px, under the ${min}×${min}px minimum${spacingException ? ', and another target crowds it' : ''}. The browser sizes an unstyled control (the User Agent Control exception), but a stylesheet this audit cannot read might set its size. Check whether author CSS sizes this control; if nothing does, it passes.`,
+        };
+      }
       return {
         status: 'fail',
         message: spacingException
-          ? `This target is ${Math.round(rect.width)}×${Math.round(rect.height)}px AND another target crowds it (within ${min}px) — small targets are only acceptable with clear space around them; crowded ones are hard to hit for users with motor impairments.`
-          : `This target is ${Math.round(rect.width)}×${Math.round(rect.height)}px — below the ${min}×${min}px minimum, hard to hit for users with motor impairments.`,
+          ? `This target is ${px(rect.width)}×${px(rect.height)}px AND another target crowds it (within ${min}px) — small targets are only acceptable with clear space around them; crowded ones are hard to hit for users with motor impairments.`
+          : `This target is ${px(rect.width)}×${px(rect.height)}px — below the ${min}×${min}px minimum, hard to hit for users with motor impairments.`,
         fix: `Increase the element’s size or padding to at least ${min}×${min}px${spacingException ? ', or add spacing between the targets' : ''}.`,
       };
     });

package/engine/rules/wcag/3.1.1-html-lang.js

@@ -21,13 +21,24 @@ export default {
   visibleOnly: false,
   evaluate(element) {
     const lang = element.getAttribute('lang')?.trim();
-    if (!lang) {
+    if (!element.hasAttribute('lang')) {
       return {
         status: 'fail',
         message: 'No lang attribute: screen readers will guess the language and may mispronounce everything.',
         fix: 'Add lang to the html element, e.g. <html lang="en">.',
       };
     }
+    // H57 step 1 (the attribute exists) passes here and step 2 (a BCP 47
+    // value) fails: an empty value declares nothing. Named separately so
+    // the author looks at the value, not for a missing attribute
+    // (2026-08-25 overnight audit).
+    if (!lang) {
+      return {
+        status: 'fail',
+        message: 'The lang attribute is present but empty, so the page declares no language: screen readers will guess it and may mispronounce everything.',
+        fix: 'Give lang a BCP 47 value, e.g. <html lang="en">.',
+      };
+    }
     if (!LANG_PATTERN.test(lang)) {
       return {
         status: 'fail',

package/engine/rules/wcag/3.2.2-on-input-navigation.js

@@ -16,7 +16,12 @@
 // Writes and calls only: reading location (analytics, hash checks) is not
 // navigation, so the pattern demands an assignment to location or one of
 // the navigating members/calls.
-const NAVIGATES = /\blocation\s*(=|\.\s*(href|assign|replace|reload))|\.(submit|requestSubmit)\s*\(|window\.open\s*\(/;
+// The href branch demands an assignment too (2026-08-25 overnight audit):
+// `location.href` READ as an argument (track(location.href, …)) matched the
+// old pattern, so an analytics handler was reported as navigation. Now
+// `location =`, `location.href =` (or `+=`) write, and assign / replace /
+// reload must be called.
+const NAVIGATES = /\blocation\s*(\+?=(?!=)|\.\s*(href\s*\+?=(?!=)|(assign|replace|reload)\s*\())|\.(submit|requestSubmit)\s*\(|window\.open\s*\(/;
 
 export default {
   id: 'on-input-navigation',
@@ -35,13 +40,18 @@ export default {
         fix: 'Trigger navigation from activation (click/Enter), never from focus.',
       };
     }
-    const onchange = element.getAttribute('onchange') ?? element.getAttribute('oninput');
-    if (onchange && NAVIGATES.test(onchange)) {
-      return {
-        status: 'incomplete',
-        message: 'Changing this control appears to navigate or submit (its onchange handler reaches for location/submit). WCAG 3.2.2 allows that only when users are told beforehand — check the page says so before the control.',
-        fix: 'Describe the behaviour before the control, or navigate from an explicit Go button instead of the change event.',
-      };
+    // Both change-shaped events are read on their own (2026-08-25 overnight
+    // audit): a harmless onchange used to hide a submitting oninput, and F36
+    // applies whichever event fires the submit.
+    for (const attr of ['onchange', 'oninput']) {
+      const handler = element.getAttribute(attr);
+      if (handler && NAVIGATES.test(handler)) {
+        return {
+          status: 'incomplete',
+          message: `Changing this control appears to navigate or submit (its ${attr} handler reaches for location/submit). WCAG 3.2.2 allows that only when users are told beforehand: check the page says so before the control.`,
+          fix: 'Describe the behaviour before the control, or navigate from an explicit Go button instead of the change event.',
+        };
+      }
     }
     return { status: 'pass' };
   },

package/engine/rules/wcag/3.3.7-redundant-entry.js

@@ -0,0 +1,55 @@
+// WCAG SC 3.3.7 Redundant Entry (Level A, new in 2.2)
+//
+// Information the user already gave in a process must be auto-populated or
+// available to select, unless re-entry is essential, needed for security,
+// or the earlier value has gone stale. A cross-page "process" is invisible
+// to a one-shot scan, but one slice is visible in a single form: two
+// enabled fields declaring the SAME autocomplete purpose. A form with two
+// `autocomplete="email"` fields is asking for the email twice — exactly
+// the shape the criterion exists for — or it is a confirmation field,
+// which is the human's call (the SC's "essential" escape). So this asks,
+// it never asserts.
+//
+// The security escape is honoured structurally: password and one-time-code
+// purposes never count (re-entering a password to confirm it IS the
+// documented security exception). Distinct scopes are honoured too: the
+// autocomplete grammar prefixes a field token with `section-*` / shipping /
+// billing, and a shipping address plus a billing address are two different
+// pieces of information — only fully identical normalized token lists pair
+// up. Fields must be user-reachable: hidden inputs, disabled and readonly
+// fields auto-populate without the user typing, which is the SC being
+// SATISFIED, not violated.
+const EXEMPT = new Set(['new-password', 'current-password', 'one-time-code', 'on', 'off']);
+
+export default {
+  id: 'redundant-entry',
+  name: 'Redundant entry',
+  impact: 'moderate',
+  tags: ['wcag22a', 'wcag337'],
+  help: 'A form should not ask for the same information twice',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/redundant-entry.html',
+  selector: 'form',
+  evaluate(element, { isVisible }) {
+    const seen = new Map();
+    for (const field of element.querySelectorAll('input[autocomplete], select[autocomplete], textarea[autocomplete]')) {
+      if (field.disabled || field.readOnly) continue;
+      // A field the user cannot reach (a display:none branch of a
+      // mutually-exclusive section, a collapsed disclosure) is not
+      // "required to be entered again" (2026-08-25 overnight audit).
+      if (!isVisible(field)) continue;
+      if (field instanceof HTMLInputElement && (field.type === 'hidden' || field.type === 'password')) continue;
+      const purpose = (field.getAttribute('autocomplete') || '').trim().toLowerCase().replace(/\s+/g, ' ');
+      if (!purpose || EXEMPT.has(purpose)) continue;
+      if (seen.has(purpose)) {
+        return {
+          status: 'incomplete',
+          message: `This form asks for "${purpose}" twice — 3.3.7 says information the user already entered must be auto-populated or selectable, not typed again. A deliberate confirmation field can be essential (the criterion's own escape); that judgement is yours.`,
+          fix: 'Auto-populate the second field from the first, offer the earlier value for selection, or drop the duplicate. Keep it only if re-entry is genuinely essential here.',
+          data: { purpose },
+        };
+      }
+      seen.set(purpose, field);
+    }
+    return { status: 'pass' };
+  },
+};

package/engine/rules/wcag/3.3.8-auth-field-obstruction.js

@@ -11,6 +11,22 @@
 // emailed link) that this rule cannot see. Blocked paste is therefore
 // reported for REVIEW, not failed. Both mechanisms obstructed at once is the
 // case worth asserting.
+//
+// Paste only (2026-08-25 overnight audit): an ondrop handler used to count
+// as a paste blocker. It is not. Drag and drop is a different event and a
+// different user action, appears nowhere in the SC, its notes or F109, and
+// leaves copy and paste fully working, so ondrop is no evidence at all.
+//
+// Scope (2026-08-25 overnight audit): the Understanding says the criterion
+// "is focused on authentication of existing users. It does not cover
+// creation of a username or initiation of an account." Choosing a new
+// password recalls nothing. So autocomplete="new-password" fields are out
+// of the selector, and a bare type="password" is only PROVABLY a login
+// credential when the author says so (autocomplete="current-password") or
+// the form has the classic sign-in shape: exactly one password field beside
+// a username or email field. Two password fields in one form is the shape
+// of sign-up or a password change, and that field is asked about, never
+// failed. The fail branch fires only on a provable login credential.
 export default {
   id: 'auth-field-obstruction',
   name: 'Accessible login fields',
@@ -18,36 +34,50 @@ export default {
   tags: ['wcag22aa', 'wcag338'],
   help: 'Login fields must not block paste or password managers',
   helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-minimum.html',
-  selector: 'input[type="password"], input[autocomplete~="current-password"], input[autocomplete~="one-time-code"], input[autocomplete~="new-password"]',
+  selector: 'input[type="password"]:not([autocomplete~="new-password"]), input[autocomplete~="current-password"], input[autocomplete~="one-time-code"]',
   evaluate(element) {
     // Inline handlers are the only statically-visible blockers; framework
     // listeners are invisible to a DOM audit.
-    const blocking = ['onpaste', 'ondrop'].find((attr) => {
-      const handler = element.getAttribute(attr) ?? '';
-      return /return\s+false|preventDefault/.test(handler);
-    });
-    const autocompleteOff = (element.getAttribute('autocomplete') ?? '').trim().toLowerCase() === 'off';
-    const action = blocking === 'onpaste' ? 'pasting' : 'dropping';
-    if (blocking && autocompleteOff) {
-      return {
-        status: 'fail',
-        message: `This authentication field blocks ${action} AND sets autocomplete="off", so both of the mechanisms 3.3.8 names are obstructed at once: copy and paste, and password-manager entry. What is left is typing the credential from memory.`,
-        fix: 'Remove the paste/drop blocking, and drop autocomplete="off" so a password manager can fill the field.',
-      };
-    }
-    if (blocking) {
+    const blocksPaste = /return\s+false|preventDefault/.test(element.getAttribute('onpaste') ?? '');
+    const tokens = (element.getAttribute('autocomplete') ?? '').trim().toLowerCase().split(/\s+/).filter(Boolean);
+    const autocompleteOff = tokens.length === 1 && tokens[0] === 'off';
+    if (!blocksPaste && !autocompleteOff) return { status: 'pass' };
+
+    // Is this field provably an existing credential, i.e. inside 3.3.8?
+    const form = element.form ?? element.closest('form');
+    const passwordFields = form ? form.querySelectorAll('input[type="password"]').length : (element.type === 'password' ? 1 : 0);
+    const identityField = form?.querySelector('input[autocomplete~="username"], input[autocomplete~="email"], input[type="email"]');
+    const provenLogin = tokens.includes('current-password') || tokens.includes('one-time-code')
+      || (passwordFields === 1 && Boolean(identityField));
+    const scopeQuestion = passwordFields >= 2
+      ? 'This form holds more than one password field, the shape of account sign-up or a password change, which 3.3.8 does not cover unless the field takes an existing credential. Confirm whether this field is part of an authentication step at all.'
+      : 'Nothing here shows the field takes an existing credential (no current-password purpose, and no username or email field beside it), so confirm it is part of signing in before treating this as a failure.';
+    const step = provenLogin ? 'this login' : 'this step';
+
+    if (blocksPaste && autocompleteOff) {
+      if (provenLogin) {
+        return {
+          status: 'fail',
+          message: `This authentication field blocks pasting AND sets autocomplete="off", so both of the mechanisms 3.3.8 names are obstructed at once: copy and paste, and password-manager entry. What is left is typing the credential from memory.`,
+          fix: 'Remove the paste blocking, and drop autocomplete="off" so a password manager can fill the field.',
+        };
+      }
       return {
         status: 'incomplete',
-        message: `This authentication field blocks ${action}, which removes copy and paste, one of the two mechanisms 3.3.8 names. A password manager fills the field directly and is unaffected, so this is only a failure if nothing else here helps. Check whether a password manager can complete this login, or whether the page offers another way in such as a passkey or a federated sign-in.`,
-        fix: `Remove the ${action === 'pasting' ? 'paste' : 'drop'} blocking, or make sure another way to sign in is available that does not rely on recalling the credential.`,
+        message: `This password field blocks pasting AND sets autocomplete="off". If it is part of signing in, both of the mechanisms 3.3.8 names are obstructed at once (copy and paste, and password-manager entry) and it fails. ${scopeQuestion}`,
+        fix: 'Remove the paste blocking, and drop autocomplete="off" so a password manager can fill the field.',
       };
     }
-    if (autocompleteOff) {
+    if (blocksPaste) {
       return {
         status: 'incomplete',
-        message: 'This authentication field sets autocomplete="off", discouraging password managers. Browsers often fill anyway — verify a password manager can complete this login without retyping.',
+        message: `This field blocks pasting, which removes copy and paste, one of the two mechanisms 3.3.8 names. A password manager fills the field directly and is unaffected, so this is only a failure if nothing else here helps. Check whether a password manager can complete ${step}, or whether the page offers another way in such as a passkey or a federated sign-in.${provenLogin ? '' : ` ${scopeQuestion}`}`,
+        fix: 'Remove the paste blocking, or make sure another way to sign in is available that does not rely on recalling the credential.',
       };
     }
-    return { status: 'pass' };
+    return {
+      status: 'incomplete',
+      message: `This field sets autocomplete="off", discouraging password managers. Browsers often fill anyway: verify a password manager can complete ${step} without retyping.${provenLogin ? '' : ` ${scopeQuestion}`}`,
+    };
   },
 };

package/engine/rules/wcag/4.1.2-aria-allowed-attr.js

@@ -68,7 +68,7 @@ export default {
     const names = disallowed.map((n) => `aria-${n}`);
     return {
       status: 'incomplete',
-      message: `${names.join(', ')} is not supported on role "${role}", so the browser drops it and assistive technology never sees it. Nothing is announced wrongly, but nothing is announced at all. Does this element really have that state? If it does, it is invisible to a screen reader and this is a 4.1.2 failure. If it does not, the attribute is simply stray and no one is affected.`,
+      message: `${names.join(', ')} is not supported on role "${role}", so the browser drops it and assistive technology never sees it. Nothing is announced wrongly, but nothing is announced at all. Does this element really have that state? If it does, it is invisible to a screen reader and this is a 4.1.2 failure. If it does not, the attribute is simply stray and no one is affected. Invalid markup is not by itself a WCAG failure: the criterion that policed validity, 4.1.1 Parsing, was removed in WCAG 2.2 (w3.org/WAI/WCAG22/Understanding/parsing.html), so what decides this is whether the state reaches users, not the syntax.`,
       fix: `Move ${names.join('/')} to the element whose role supports it, usually the control that toggles this one, or remove it if the element has no such state. Adding a role to this element to make the attribute legal is rarely right: the host language restricts which roles each element may take.`,
     };
   },

package/engine/rules/wcag/4.1.2-aria-attr-valid.js

@@ -1,20 +1,24 @@
 // WCAG SC 4.1.2 Name, Role, Value (Level A)
 // ARIA 1.2 attribute names (shared vocabulary in lib/roles.js), and the
 // allowed values for enumerated ones.
-import { KNOWN_ARIA as KNOWN } from '../../lib/roles.js';
+import { KNOWN_ARIA as KNOWN, GLOBAL_ARIA, ROLE_ARIA, effectiveRole } from '../../lib/roles.js';
 
 // Note: "undefined" is a legal token for the tristate/undefinable attributes
 // (aria-expanded, aria-selected, aria-checked, aria-pressed) per ARIA 1.2.
+// aria-hidden and aria-orientation list it too, as their default token
+// ("undefined (default): determined by the user agent" / "orientation is
+// unknown/ambiguous"). Added 2026-08-25 overnight audit: rejecting it was a
+// false assertion on conforming markup.
 const ENUMS = {
   'aria-atomic': ['true', 'false'], 'aria-busy': ['true', 'false'],
   'aria-disabled': ['true', 'false'], 'aria-expanded': ['true', 'false', 'undefined'],
-  'aria-hidden': ['true', 'false'], 'aria-modal': ['true', 'false'],
+  'aria-hidden': ['true', 'false', 'undefined'], 'aria-modal': ['true', 'false'],
   'aria-multiline': ['true', 'false'], 'aria-multiselectable': ['true', 'false'],
   'aria-readonly': ['true', 'false'], 'aria-required': ['true', 'false'],
   'aria-selected': ['true', 'false', 'undefined'],
   'aria-checked': ['true', 'false', 'mixed', 'undefined'], 'aria-pressed': ['true', 'false', 'mixed', 'undefined'],
   'aria-live': ['off', 'polite', 'assertive'],
-  'aria-orientation': ['horizontal', 'vertical'],
+  'aria-orientation': ['horizontal', 'vertical', 'undefined'],
   'aria-sort': ['none', 'ascending', 'descending', 'other'],
   'aria-autocomplete': ['none', 'inline', 'list', 'both'],
   'aria-invalid': ['true', 'false', 'grammar', 'spelling'],
@@ -32,20 +36,52 @@ export default {
   selector: '*',
   visibleOnly: false, // applies to hidden elements too; also avoids visibility cost on every node
   evaluate(element) {
-    const problems = [];
+    // Two different findings live here (split 2026-08-25 overnight audit).
+    //
+    // An UNKNOWN attribute name is ignored outright by the browser: it can
+    // alter no name, role or value, so by itself it proves no 4.1.2 failure
+    // (the criterion that policed validity, 4.1.1 Parsing, is gone from
+    // WCAG 2.2). What it may hide is a real state or name the author reached
+    // for and mistyped; where that leaves a control nameless the name rules
+    // already assert. So unknown names are a review question, the same
+    // stance aria-allowed-attr takes for an unsupported attribute.
+    //
+    // An enumerated VALUE the browser cannot parse, on a role that supports
+    // the state, is different: the author wrote a state and the browser drops
+    // it, so the state the element has is invisible. That stays asserted.
+    // When the element's role is modelled and does not support the attribute
+    // at all, the value is moot and aria-allowed-attr already reviews the
+    // attribute; reporting the value too would be the same finding twice.
+    const unknown = [];
+    const invalid = [];
+    let role;
     for (const { name, value } of element.attributes) {
       if (!name.startsWith('aria-')) continue;
-      if (!KNOWN.has(name.slice(5))) {
-        problems.push(`${name} is not an ARIA attribute`);
+      const attr = name.slice(5);
+      if (!KNOWN.has(attr)) {
+        unknown.push(name);
       } else if (ENUMS[name] && !ENUMS[name].includes(value.trim().toLowerCase())) {
-        problems.push(`${name}="${value}" — allowed values: ${ENUMS[name].join(', ')}`);
+        if (!GLOBAL_ARIA.has(attr)) {
+          role ??= effectiveRole(element);
+          if (role && ROLE_ARIA[role] && !ROLE_ARIA[role].includes(attr)) continue;
+        }
+        invalid.push(`${name}="${value}" — allowed values: ${ENUMS[name].join(', ')}`);
       }
     }
-    if (!problems.length) return { status: 'pass' };
-    return {
-      status: 'fail',
-      message: `Invalid ARIA: ${problems.join('; ')}. Assistive technology ignores attributes it doesn't recognise.`,
-      fix: 'Correct the attribute name/value against the ARIA specification, or remove it.',
-    };
+    if (invalid.length) {
+      return {
+        status: 'fail',
+        message: `Invalid ARIA: ${invalid.join('; ')}. Assistive technology ignores attributes it doesn't recognise.`,
+        fix: 'Correct the attribute name/value against the ARIA specification, or remove it.',
+      };
+    }
+    if (unknown.length) {
+      return {
+        status: 'incomplete',
+        message: `${unknown.join(', ')} is not an ARIA attribute, so the browser ignores it and assistive technology never sees it. Nothing is announced wrongly, but nothing is announced at all. Was a real ARIA state or name intended here? If it was, that state or name is missing and this is a 4.1.2 failure. If not, the attribute is stray and no one is affected. Invalid markup is not by itself a WCAG failure: the criterion that policed validity, 4.1.1 Parsing, was removed in WCAG 2.2.`,
+        fix: 'Correct the attribute name against the ARIA specification, or remove it.',
+      };
+    }
+    return { status: 'pass' };
   },
 };

package/engine/rules/wcag/4.1.2-aria-hidden-focus.js

@@ -23,8 +23,13 @@ export default {
     // Transparency is measured up the flat tree: opacity is not an inherited
     // property, so a faded WRAPPER (the standard off-canvas drawer) leaves
     // every control inside it computing opacity: 1 while none of them paint.
+    // Any NEGATIVE tabindex takes an element out of sequential focus (HTML:
+    // "a negative integer"), not only the literal "-1"; tabIndex parses the
+    // attribute the way the browser does. Guarded by hasAttribute because
+    // Chromium reports tabIndex -1 for a contenteditable div that has no
+    // attribute at all, and that one IS reachable. 2026-08-25 overnight audit.
     const focusable = [element, ...element.querySelectorAll(FOCUSABLE)].filter(
-      (el) => el.matches?.(FOCUSABLE) && el.getAttribute('tabindex') !== '-1' && !el.matches(':disabled')
+      (el) => el.matches?.(FOCUSABLE) && !(el.hasAttribute('tabindex') && el.tabIndex < 0) && !el.matches(':disabled')
         // `inert` removes focusability outright — aria-hidden + inert is
         // the CORRECT modern pattern for off-canvas content, not a defect.
         && !el.closest('[inert]')

package/engine/rules/wcag/4.1.2-aria-label-misuse.js

@@ -72,7 +72,7 @@ export default {
         })();
     return {
       status: 'incomplete',
-      message: `${attempt} on a plain <${element.tagName.toLowerCase()}> is prohibited by ARIA: this element's role does not support naming, so although many browser and screen reader pairings announce the label today, that support is not guaranteed anywhere and can differ between assistive technologies. Where it is announced it replaces the element's visible text; where it is not, users get the visible text alone. Check both presentations read correctly, and that nothing here relies on the label being heard.`,
+      message: `${attempt} on a plain <${element.tagName.toLowerCase()}> is prohibited by ARIA: this element's role does not support naming, so although many browser and screen reader pairings announce the label today, that support is not guaranteed anywhere and can differ between assistive technologies. Where it is announced it replaces the element's visible text; where it is not, users get the visible text alone. Check both presentations read correctly, and that nothing here relies on the label being heard. Prohibited markup is not by itself a WCAG failure: the criterion that policed validity, 4.1.1 Parsing, was removed in WCAG 2.2 (w3.org/WAI/WCAG22/Understanding/parsing.html), so what decides this is what users actually hear.`,
       fix: 'If this element must reliably announce something of its own, give it the role it is playing (a landmark, group, or widget role) so the name is legal and exposure is guaranteed — or move the spoken text into visible or visually-hidden real text. If the label is stray, remove it. Do not add a role solely to legalise the label.',
     };
   },