pour-engine 1.33.0 → 1.34.1

package/engine/rules/wcag/2.5.8-target-size.js

@@ -173,6 +173,68 @@ function isInTextLine(element) {
   return false;
 }
 
+// ── User Agent Control, proved from the stylesheets ──────────────────
+// The exception covers a native control whose size "is determined by the
+// user agent and is not modified by the author". A bare <button>Save</button>
+// at 46×21 was asserted under 2.5.5, and two stacked ones under 2.5.8's
+// spacing test, until this proof existed (2026-08-25 overnight audit).
+// Proof: no inline style and no readable author rule that matches the
+// element declares a property that can change its box. An unreadable
+// (cross-origin) sheet, or a selector the browser cannot parse, leaves the
+// proof open: the finding then reviews instead of asserting. The sheet walk
+// happens once per root and is cached on it for the audit; media rules that
+// do not apply now are skipped, since they size nothing now.
+const NATIVE_CONTROL = /^(button|input|select|textarea)$/i;
+const SIZING = /^(width|height|(min|max)-(width|height|inline-size|block-size)|inline-size|block-size|padding(-.+)?|border(-.+)?|font(-.+)?|line-height|box-sizing|transform|scale|zoom|appearance|all)$/;
+const sizingRulesByRoot = new WeakMap();
+
+function declaresSizing(style) {
+  for (let k = 0; k < style.length; k++) if (SIZING.test(style[k])) return true;
+  return false;
+}
+
+function authorSizingRules(root) {
+  const sheets = [...(root.styleSheets ?? []), ...(root.adoptedStyleSheets ?? [])];
+  const key = sheets.map((s) => { try { return s.cssRules.length; } catch { return 'x'; } }).join(',');
+  const cached = sizingRulesByRoot.get(root);
+  if (cached?.key === key) return cached;
+  const win = (root.ownerDocument ?? root).defaultView;
+  const probe = (root.ownerDocument ?? root).createElement('div');
+  const entry = { key, selectors: [], open: false };
+  const walk = (rules, parent) => {
+    for (const rule of rules) {
+      if (rule.media && win?.matchMedia && !win.matchMedia(rule.media.mediaText).matches) continue;
+      let selector = rule.selectorText ?? parent; // nested declarations belong to the parent
+      // CSS nesting: "& .x" means ":is(parent) .x", and a child with no "&" is
+      // a descendant of the parent.
+      if (parent && rule.selectorText) {
+        selector = /&/.test(selector) ? selector.replace(/&/g, `:is(${parent})`) : `:is(${parent}) ${selector}`;
+      }
+      if (selector && rule.style && declaresSizing(rule.style)) {
+        try { probe.matches(selector); entry.selectors.push(selector); } catch { entry.open = true; }
+      }
+      if (rule.cssRules?.length) walk(rule.cssRules, rule.selectorText ? selector : parent);
+    }
+  };
+  for (const sheet of sheets) {
+    try { walk(sheet.cssRules, null); } catch { entry.open = true; }
+  }
+  entry.combined = entry.selectors.join(', ');
+  sizingRulesByRoot.set(root, entry);
+  return entry;
+}
+
+/** 'yes' when the browser provably sized this native control, 'no' when the
+ *  author touched its box (or it is not a native control), 'open' when a
+ *  sheet or selector could not be read. */
+function uaSized(element) {
+  if (!NATIVE_CONTROL.test(element.tagName) || element.type === 'image') return 'no';
+  if (declaresSizing(element.style)) return 'no';
+  const entry = authorSizingRules(element.getRootNode());
+  if (entry.combined && element.matches(entry.combined)) return 'no';
+  return entry.open ? 'open' : 'yes';
+}
+
 /** Nearest distance from a point to a rectangle (0 when inside it). */
 function pointToRectDistance(point, rect) {
   const dx = Math.max(rect.left - point.x, 0, point.x - rect.right);
@@ -188,6 +250,21 @@ function pointToRectDistance(point, rect) {
  * lists only equivalent/inline/user-agent/essential there)
  */
 export function createTargetSizeRule({ id, tags, help, helpUrl, min, spacingException }) {
+  // The verdict compares exact floats, so display must not round a failing
+  // dimension up to the minimum: a 43.8px-tall button failing the AAA 44px
+  // bar must not read "44×44px — below the 44×44px minimum" (World Bank,
+  // 2026-08-25). One decimal only where integer rounding would cross the line,
+  // and a second decimal where one decimal STILL rounds up to it: toFixed
+  // rounds too, so 23.98 printed "24.0" and 43.98 printed "44.0" (2026-08-25
+  // overnight audit). Anything closer than that reads "just under".
+  const px = (v) => {
+    if (!(Math.round(v) >= min && v < min)) return String(Math.round(v));
+    for (const digits of [1, 2]) {
+      const shown = v.toFixed(digits);
+      if (Number(shown) < min) return shown;
+    }
+    return `just under ${min}`;
+  };
   return {
   id,
   impact: 'serious',
@@ -396,6 +473,36 @@ export function createTargetSizeRule({ id, tags, help, helpUrl, min, spacingExce
       return effective;
     };
 
+    // ── Equivalent targets ────────────────────────────────────────────
+    // Both criteria except a target whose function is available through
+    // another control on the same page that meets the minimum. Same
+    // destination is the one form of "same function" the DOM can prove,
+    // and obscuredRect above already reads matching hrefs that way. The
+    // card pattern (a 200×150 image link over a 16px title link to the
+    // same article) failed on the title link until the undersized path
+    // asked the same question (2026-08-25 overnight audit). A bare "#" or
+    // a javascript: URL names no destination, so it never pairs.
+    const destinationOf = (element) => {
+      if (typeof element.href !== 'string' || !element.href) return null;
+      const attr = (element.getAttribute('href') ?? '').trim();
+      if (!attr || attr === '#' || /^javascript:/i.test(attr)) return null;
+      return element.href;
+    };
+    let adequateDestinations = null;
+    const equivalentElsewhere = (i) => {
+      const destination = destinationOf(elements[i]);
+      if (!destination) return false;
+      if (!adequateDestinations) {
+        adequateDestinations = new Set();
+        elements.forEach((other, j) => {
+          if (!laidOut[j] || undersized[j] || other.ownerDocument !== elements[i].ownerDocument) return;
+          const d = destinationOf(other);
+          if (d) adequateDestinations.add(d);
+        });
+      }
+      return adequateDestinations.has(destination);
+    };
+
     return elements.map((element, i) => {
       if (!laidOut[i]) return { status: 'pass' }; // not laid out / not a pointer target
       if (!undersized[i]) {
@@ -432,7 +539,7 @@ export function createTargetSizeRule({ id, tags, help, helpUrl, min, spacingExce
         const rect = rects[i];
         return {
           status: 'fail',
-          message: `This target's box is ${Math.round(rect.width)}×${Math.round(rect.height)}px, but another target overlaps it and clicks in the overlap go there — the part that still accepts the pointer is ${Math.round(effective.width)}×${Math.round(effective.height)}px, below the ${min}×${min}px minimum.`,
+          message: `This target's box is ${Math.round(rect.width)}×${Math.round(rect.height)}px, but another target overlaps it and clicks in the overlap go there — the part that still accepts the pointer is ${px(effective.width)}×${px(effective.height)}px, below the ${min}×${min}px minimum.`,
           fix: 'Space the targets so they no longer overlap, or enlarge this one until the uncovered part reaches the minimum.',
           data: {
             box: { width: Math.round(rect.width), height: Math.round(rect.height) },
@@ -441,6 +548,11 @@ export function createTargetSizeRule({ id, tags, help, helpUrl, min, spacingExce
         };
       }
       if (uaControlled(element)) return { status: 'pass' }; // UA Control exception
+      // The same exception for every other native control, proved from the
+      // sheets; an open proof (unreadable sheet) reviews at the end instead
+      // of asserting, and only if nothing else rescues the target first.
+      const uaProof = uaSized(element);
+      if (uaProof === 'yes') return { status: 'pass' };
       if (isInTextLine(element)) return { status: 'pass' };
       if (spacingException) {
         // Spacing exception: the min-sized circle around this target must
@@ -486,12 +598,19 @@ export function createTargetSizeRule({ id, tags, help, helpUrl, min, spacingExce
         // dismissed, and suppressing it would hide a real defect behind a
         // transient overlay, which is the wrong way round.
       }
+      if (equivalentElsewhere(i)) return { status: 'pass' }; // Equivalent exception, proved by href
       const rect = rects[i];
+      if (uaProof === 'open') {
+        return {
+          status: 'incomplete',
+          message: `This native control is ${px(rect.width)}×${px(rect.height)}px, under the ${min}×${min}px minimum${spacingException ? ', and another target crowds it' : ''}. The browser sizes an unstyled control (the User Agent Control exception), but a stylesheet this audit cannot read might set its size. Check whether author CSS sizes this control; if nothing does, it passes.`,
+        };
+      }
       return {
         status: 'fail',
         message: spacingException
-          ? `This target is ${Math.round(rect.width)}×${Math.round(rect.height)}px AND another target crowds it (within ${min}px) — small targets are only acceptable with clear space around them; crowded ones are hard to hit for users with motor impairments.`
-          : `This target is ${Math.round(rect.width)}×${Math.round(rect.height)}px — below the ${min}×${min}px minimum, hard to hit for users with motor impairments.`,
+          ? `This target is ${px(rect.width)}×${px(rect.height)}px AND another target crowds it (within ${min}px) — small targets are only acceptable with clear space around them; crowded ones are hard to hit for users with motor impairments.`
+          : `This target is ${px(rect.width)}×${px(rect.height)}px — below the ${min}×${min}px minimum, hard to hit for users with motor impairments.`,
         fix: `Increase the element’s size or padding to at least ${min}×${min}px${spacingException ? ', or add spacing between the targets' : ''}.`,
       };
     });

package/engine/rules/wcag/3.1.1-html-lang.js

@@ -21,13 +21,24 @@ export default {
   visibleOnly: false,
   evaluate(element) {
     const lang = element.getAttribute('lang')?.trim();
-    if (!lang) {
+    if (!element.hasAttribute('lang')) {
       return {
         status: 'fail',
         message: 'No lang attribute: screen readers will guess the language and may mispronounce everything.',
         fix: 'Add lang to the html element, e.g. <html lang="en">.',
       };
     }
+    // H57 step 1 (the attribute exists) passes here and step 2 (a BCP 47
+    // value) fails: an empty value declares nothing. Named separately so
+    // the author looks at the value, not for a missing attribute
+    // (2026-08-25 overnight audit).
+    if (!lang) {
+      return {
+        status: 'fail',
+        message: 'The lang attribute is present but empty, so the page declares no language: screen readers will guess it and may mispronounce everything.',
+        fix: 'Give lang a BCP 47 value, e.g. <html lang="en">.',
+      };
+    }
     if (!LANG_PATTERN.test(lang)) {
       return {
         status: 'fail',

package/engine/rules/wcag/3.2.2-on-input-navigation.js

@@ -16,7 +16,12 @@
 // Writes and calls only: reading location (analytics, hash checks) is not
 // navigation, so the pattern demands an assignment to location or one of
 // the navigating members/calls.
-const NAVIGATES = /\blocation\s*(=|\.\s*(href|assign|replace|reload))|\.(submit|requestSubmit)\s*\(|window\.open\s*\(/;
+// The href branch demands an assignment too (2026-08-25 overnight audit):
+// `location.href` READ as an argument (track(location.href, …)) matched the
+// old pattern, so an analytics handler was reported as navigation. Now
+// `location =`, `location.href =` (or `+=`) write, and assign / replace /
+// reload must be called.
+const NAVIGATES = /\blocation\s*(\+?=(?!=)|\.\s*(href\s*\+?=(?!=)|(assign|replace|reload)\s*\())|\.(submit|requestSubmit)\s*\(|window\.open\s*\(/;
 
 export default {
   id: 'on-input-navigation',
@@ -35,13 +40,18 @@ export default {
         fix: 'Trigger navigation from activation (click/Enter), never from focus.',
       };
     }
-    const onchange = element.getAttribute('onchange') ?? element.getAttribute('oninput');
-    if (onchange && NAVIGATES.test(onchange)) {
-      return {
-        status: 'incomplete',
-        message: 'Changing this control appears to navigate or submit (its onchange handler reaches for location/submit). WCAG 3.2.2 allows that only when users are told beforehand — check the page says so before the control.',
-        fix: 'Describe the behaviour before the control, or navigate from an explicit Go button instead of the change event.',
-      };
+    // Both change-shaped events are read on their own (2026-08-25 overnight
+    // audit): a harmless onchange used to hide a submitting oninput, and F36
+    // applies whichever event fires the submit.
+    for (const attr of ['onchange', 'oninput']) {
+      const handler = element.getAttribute(attr);
+      if (handler && NAVIGATES.test(handler)) {
+        return {
+          status: 'incomplete',
+          message: `Changing this control appears to navigate or submit (its ${attr} handler reaches for location/submit). WCAG 3.2.2 allows that only when users are told beforehand: check the page says so before the control.`,
+          fix: 'Describe the behaviour before the control, or navigate from an explicit Go button instead of the change event.',
+        };
+      }
     }
     return { status: 'pass' };
   },

package/engine/rules/wcag/3.3.7-redundant-entry.js

@@ -0,0 +1,55 @@
+// WCAG SC 3.3.7 Redundant Entry (Level A, new in 2.2)
+//
+// Information the user already gave in a process must be auto-populated or
+// available to select, unless re-entry is essential, needed for security,
+// or the earlier value has gone stale. A cross-page "process" is invisible
+// to a one-shot scan, but one slice is visible in a single form: two
+// enabled fields declaring the SAME autocomplete purpose. A form with two
+// `autocomplete="email"` fields is asking for the email twice — exactly
+// the shape the criterion exists for — or it is a confirmation field,
+// which is the human's call (the SC's "essential" escape). So this asks,
+// it never asserts.
+//
+// The security escape is honoured structurally: password and one-time-code
+// purposes never count (re-entering a password to confirm it IS the
+// documented security exception). Distinct scopes are honoured too: the
+// autocomplete grammar prefixes a field token with `section-*` / shipping /
+// billing, and a shipping address plus a billing address are two different
+// pieces of information — only fully identical normalized token lists pair
+// up. Fields must be user-reachable: hidden inputs, disabled and readonly
+// fields auto-populate without the user typing, which is the SC being
+// SATISFIED, not violated.
+const EXEMPT = new Set(['new-password', 'current-password', 'one-time-code', 'on', 'off']);
+
+export default {
+  id: 'redundant-entry',
+  name: 'Redundant entry',
+  impact: 'moderate',
+  tags: ['wcag22a', 'wcag337'],
+  help: 'A form should not ask for the same information twice',
+  helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/redundant-entry.html',
+  selector: 'form',
+  evaluate(element, { isVisible }) {
+    const seen = new Map();
+    for (const field of element.querySelectorAll('input[autocomplete], select[autocomplete], textarea[autocomplete]')) {
+      if (field.disabled || field.readOnly) continue;
+      // A field the user cannot reach (a display:none branch of a
+      // mutually-exclusive section, a collapsed disclosure) is not
+      // "required to be entered again" (2026-08-25 overnight audit).
+      if (!isVisible(field)) continue;
+      if (field instanceof HTMLInputElement && (field.type === 'hidden' || field.type === 'password')) continue;
+      const purpose = (field.getAttribute('autocomplete') || '').trim().toLowerCase().replace(/\s+/g, ' ');
+      if (!purpose || EXEMPT.has(purpose)) continue;
+      if (seen.has(purpose)) {
+        return {
+          status: 'incomplete',
+          message: `This form asks for "${purpose}" twice — 3.3.7 says information the user already entered must be auto-populated or selectable, not typed again. A deliberate confirmation field can be essential (the criterion's own escape); that judgement is yours.`,
+          fix: 'Auto-populate the second field from the first, offer the earlier value for selection, or drop the duplicate. Keep it only if re-entry is genuinely essential here.',
+          data: { purpose },
+        };
+      }
+      seen.set(purpose, field);
+    }
+    return { status: 'pass' };
+  },
+};

package/engine/rules/wcag/3.3.8-auth-field-obstruction.js

@@ -11,6 +11,22 @@
 // emailed link) that this rule cannot see. Blocked paste is therefore
 // reported for REVIEW, not failed. Both mechanisms obstructed at once is the
 // case worth asserting.
+//
+// Paste only (2026-08-25 overnight audit): an ondrop handler used to count
+// as a paste blocker. It is not. Drag and drop is a different event and a
+// different user action, appears nowhere in the SC, its notes or F109, and
+// leaves copy and paste fully working, so ondrop is no evidence at all.
+//
+// Scope (2026-08-25 overnight audit): the Understanding says the criterion
+// "is focused on authentication of existing users. It does not cover
+// creation of a username or initiation of an account." Choosing a new
+// password recalls nothing. So autocomplete="new-password" fields are out
+// of the selector, and a bare type="password" is only PROVABLY a login
+// credential when the author says so (autocomplete="current-password") or
+// the form has the classic sign-in shape: exactly one password field beside
+// a username or email field. Two password fields in one form is the shape
+// of sign-up or a password change, and that field is asked about, never
+// failed. The fail branch fires only on a provable login credential.
 export default {
   id: 'auth-field-obstruction',
   name: 'Accessible login fields',
@@ -18,36 +34,50 @@ export default {
   tags: ['wcag22aa', 'wcag338'],
   help: 'Login fields must not block paste or password managers',
   helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-minimum.html',
-  selector: 'input[type="password"], input[autocomplete~="current-password"], input[autocomplete~="one-time-code"], input[autocomplete~="new-password"]',
+  selector: 'input[type="password"]:not([autocomplete~="new-password"]), input[autocomplete~="current-password"], input[autocomplete~="one-time-code"]',
   evaluate(element) {
     // Inline handlers are the only statically-visible blockers; framework
     // listeners are invisible to a DOM audit.
-    const blocking = ['onpaste', 'ondrop'].find((attr) => {
-      const handler = element.getAttribute(attr) ?? '';
-      return /return\s+false|preventDefault/.test(handler);
-    });
-    const autocompleteOff = (element.getAttribute('autocomplete') ?? '').trim().toLowerCase() === 'off';
-    const action = blocking === 'onpaste' ? 'pasting' : 'dropping';
-    if (blocking && autocompleteOff) {
-      return {
-        status: 'fail',
-        message: `This authentication field blocks ${action} AND sets autocomplete="off", so both of the mechanisms 3.3.8 names are obstructed at once: copy and paste, and password-manager entry. What is left is typing the credential from memory.`,
-        fix: 'Remove the paste/drop blocking, and drop autocomplete="off" so a password manager can fill the field.',
-      };
-    }
-    if (blocking) {
+    const blocksPaste = /return\s+false|preventDefault/.test(element.getAttribute('onpaste') ?? '');
+    const tokens = (element.getAttribute('autocomplete') ?? '').trim().toLowerCase().split(/\s+/).filter(Boolean);
+    const autocompleteOff = tokens.length === 1 && tokens[0] === 'off';
+    if (!blocksPaste && !autocompleteOff) return { status: 'pass' };
+
+    // Is this field provably an existing credential, i.e. inside 3.3.8?
+    const form = element.form ?? element.closest('form');
+    const passwordFields = form ? form.querySelectorAll('input[type="password"]').length : (element.type === 'password' ? 1 : 0);
+    const identityField = form?.querySelector('input[autocomplete~="username"], input[autocomplete~="email"], input[type="email"]');
+    const provenLogin = tokens.includes('current-password') || tokens.includes('one-time-code')
+      || (passwordFields === 1 && Boolean(identityField));
+    const scopeQuestion = passwordFields >= 2
+      ? 'This form holds more than one password field, the shape of account sign-up or a password change, which 3.3.8 does not cover unless the field takes an existing credential. Confirm whether this field is part of an authentication step at all.'
+      : 'Nothing here shows the field takes an existing credential (no current-password purpose, and no username or email field beside it), so confirm it is part of signing in before treating this as a failure.';
+    const step = provenLogin ? 'this login' : 'this step';
+
+    if (blocksPaste && autocompleteOff) {
+      if (provenLogin) {
+        return {
+          status: 'fail',
+          message: `This authentication field blocks pasting AND sets autocomplete="off", so both of the mechanisms 3.3.8 names are obstructed at once: copy and paste, and password-manager entry. What is left is typing the credential from memory.`,
+          fix: 'Remove the paste blocking, and drop autocomplete="off" so a password manager can fill the field.',
+        };
+      }
       return {
         status: 'incomplete',
-        message: `This authentication field blocks ${action}, which removes copy and paste, one of the two mechanisms 3.3.8 names. A password manager fills the field directly and is unaffected, so this is only a failure if nothing else here helps. Check whether a password manager can complete this login, or whether the page offers another way in such as a passkey or a federated sign-in.`,
-        fix: `Remove the ${action === 'pasting' ? 'paste' : 'drop'} blocking, or make sure another way to sign in is available that does not rely on recalling the credential.`,
+        message: `This password field blocks pasting AND sets autocomplete="off". If it is part of signing in, both of the mechanisms 3.3.8 names are obstructed at once (copy and paste, and password-manager entry) and it fails. ${scopeQuestion}`,
+        fix: 'Remove the paste blocking, and drop autocomplete="off" so a password manager can fill the field.',
       };
     }
-    if (autocompleteOff) {
+    if (blocksPaste) {
       return {
         status: 'incomplete',
-        message: 'This authentication field sets autocomplete="off", discouraging password managers. Browsers often fill anyway — verify a password manager can complete this login without retyping.',
+        message: `This field blocks pasting, which removes copy and paste, one of the two mechanisms 3.3.8 names. A password manager fills the field directly and is unaffected, so this is only a failure if nothing else here helps. Check whether a password manager can complete ${step}, or whether the page offers another way in such as a passkey or a federated sign-in.${provenLogin ? '' : ` ${scopeQuestion}`}`,
+        fix: 'Remove the paste blocking, or make sure another way to sign in is available that does not rely on recalling the credential.',
       };
     }
-    return { status: 'pass' };
+    return {
+      status: 'incomplete',
+      message: `This field sets autocomplete="off", discouraging password managers. Browsers often fill anyway: verify a password manager can complete ${step} without retyping.${provenLogin ? '' : ` ${scopeQuestion}`}`,
+    };
   },
 };

package/engine/rules/wcag/4.1.2-aria-attr-valid.js

@@ -1,20 +1,24 @@
 // WCAG SC 4.1.2 Name, Role, Value (Level A)
 // ARIA 1.2 attribute names (shared vocabulary in lib/roles.js), and the
 // allowed values for enumerated ones.
-import { KNOWN_ARIA as KNOWN } from '../../lib/roles.js';
+import { KNOWN_ARIA as KNOWN, GLOBAL_ARIA, ROLE_ARIA, effectiveRole } from '../../lib/roles.js';
 
 // Note: "undefined" is a legal token for the tristate/undefinable attributes
 // (aria-expanded, aria-selected, aria-checked, aria-pressed) per ARIA 1.2.
+// aria-hidden and aria-orientation list it too, as their default token
+// ("undefined (default): determined by the user agent" / "orientation is
+// unknown/ambiguous"). Added 2026-08-25 overnight audit: rejecting it was a
+// false assertion on conforming markup.
 const ENUMS = {
   'aria-atomic': ['true', 'false'], 'aria-busy': ['true', 'false'],
   'aria-disabled': ['true', 'false'], 'aria-expanded': ['true', 'false', 'undefined'],
-  'aria-hidden': ['true', 'false'], 'aria-modal': ['true', 'false'],
+  'aria-hidden': ['true', 'false', 'undefined'], 'aria-modal': ['true', 'false'],
   'aria-multiline': ['true', 'false'], 'aria-multiselectable': ['true', 'false'],
   'aria-readonly': ['true', 'false'], 'aria-required': ['true', 'false'],
   'aria-selected': ['true', 'false', 'undefined'],
   'aria-checked': ['true', 'false', 'mixed', 'undefined'], 'aria-pressed': ['true', 'false', 'mixed', 'undefined'],
   'aria-live': ['off', 'polite', 'assertive'],
-  'aria-orientation': ['horizontal', 'vertical'],
+  'aria-orientation': ['horizontal', 'vertical', 'undefined'],
   'aria-sort': ['none', 'ascending', 'descending', 'other'],
   'aria-autocomplete': ['none', 'inline', 'list', 'both'],
   'aria-invalid': ['true', 'false', 'grammar', 'spelling'],
@@ -32,20 +36,52 @@ export default {
   selector: '*',
   visibleOnly: false, // applies to hidden elements too; also avoids visibility cost on every node
   evaluate(element) {
-    const problems = [];
+    // Two different findings live here (split 2026-08-25 overnight audit).
+    //
+    // An UNKNOWN attribute name is ignored outright by the browser: it can
+    // alter no name, role or value, so by itself it proves no 4.1.2 failure
+    // (the criterion that policed validity, 4.1.1 Parsing, is gone from
+    // WCAG 2.2). What it may hide is a real state or name the author reached
+    // for and mistyped; where that leaves a control nameless the name rules
+    // already assert. So unknown names are a review question, the same
+    // stance aria-allowed-attr takes for an unsupported attribute.
+    //
+    // An enumerated VALUE the browser cannot parse, on a role that supports
+    // the state, is different: the author wrote a state and the browser drops
+    // it, so the state the element has is invisible. That stays asserted.
+    // When the element's role is modelled and does not support the attribute
+    // at all, the value is moot and aria-allowed-attr already reviews the
+    // attribute; reporting the value too would be the same finding twice.
+    const unknown = [];
+    const invalid = [];
+    let role;
     for (const { name, value } of element.attributes) {
       if (!name.startsWith('aria-')) continue;
-      if (!KNOWN.has(name.slice(5))) {
-        problems.push(`${name} is not an ARIA attribute`);
+      const attr = name.slice(5);
+      if (!KNOWN.has(attr)) {
+        unknown.push(name);
       } else if (ENUMS[name] && !ENUMS[name].includes(value.trim().toLowerCase())) {
-        problems.push(`${name}="${value}" — allowed values: ${ENUMS[name].join(', ')}`);
+        if (!GLOBAL_ARIA.has(attr)) {
+          role ??= effectiveRole(element);
+          if (role && ROLE_ARIA[role] && !ROLE_ARIA[role].includes(attr)) continue;
+        }
+        invalid.push(`${name}="${value}" — allowed values: ${ENUMS[name].join(', ')}`);
       }
     }
-    if (!problems.length) return { status: 'pass' };
-    return {
-      status: 'fail',
-      message: `Invalid ARIA: ${problems.join('; ')}. Assistive technology ignores attributes it doesn't recognise.`,
-      fix: 'Correct the attribute name/value against the ARIA specification, or remove it.',
-    };
+    if (invalid.length) {
+      return {
+        status: 'fail',
+        message: `Invalid ARIA: ${invalid.join('; ')}. Assistive technology ignores attributes it doesn't recognise.`,
+        fix: 'Correct the attribute name/value against the ARIA specification, or remove it.',
+      };
+    }
+    if (unknown.length) {
+      return {
+        status: 'incomplete',
+        message: `${unknown.join(', ')} is not an ARIA attribute, so the browser ignores it and assistive technology never sees it. Nothing is announced wrongly, but nothing is announced at all. Was a real ARIA state or name intended here? If it was, that state or name is missing and this is a 4.1.2 failure. If not, the attribute is stray and no one is affected. Invalid markup is not by itself a WCAG failure: the criterion that policed validity, 4.1.1 Parsing, was removed in WCAG 2.2.`,
+        fix: 'Correct the attribute name against the ARIA specification, or remove it.',
+      };
+    }
+    return { status: 'pass' };
   },
 };

package/engine/rules/wcag/4.1.2-aria-hidden-focus.js

@@ -23,8 +23,13 @@ export default {
     // Transparency is measured up the flat tree: opacity is not an inherited
     // property, so a faded WRAPPER (the standard off-canvas drawer) leaves
     // every control inside it computing opacity: 1 while none of them paint.
+    // Any NEGATIVE tabindex takes an element out of sequential focus (HTML:
+    // "a negative integer"), not only the literal "-1"; tabIndex parses the
+    // attribute the way the browser does. Guarded by hasAttribute because
+    // Chromium reports tabIndex -1 for a contenteditable div that has no
+    // attribute at all, and that one IS reachable. 2026-08-25 overnight audit.
     const focusable = [element, ...element.querySelectorAll(FOCUSABLE)].filter(
-      (el) => el.matches?.(FOCUSABLE) && el.getAttribute('tabindex') !== '-1' && !el.matches(':disabled')
+      (el) => el.matches?.(FOCUSABLE) && !(el.hasAttribute('tabindex') && el.tabIndex < 0) && !el.matches(':disabled')
         // `inert` removes focusability outright — aria-hidden + inert is
         // the CORRECT modern pattern for off-canvas content, not a defect.
         && !el.closest('[inert]')