pour-engine 1.38.0 → 1.41.0

package/engine/rules/wcag/1.3.1-table-headers.js

@@ -65,7 +65,7 @@ export default {
       const headers = cell.getAttribute('headers');
       return headers && headers.trim().split(/\s+/).filter(Boolean).some((id) => {
         const target = element.getRootNode().getElementById?.(id);
-        return !target || !cells.includes(target) || !(/^T[HD]$/.test(target.tagName) || isHeaderCell(target));
+        return !target || !cells.includes(target) || !isHeaderCell(target);
       });
     });
     if (badRefs.length) {
@@ -84,13 +84,34 @@ export default {
           message: 'This table has no header cells and its cells hold block content (headings, paragraphs, lists or forms), which is a layout-table signature. If it really presents data, mark its header cells with <th>; if it is layout scaffolding, add role="presentation".',
         };
       }
+      // A grid whose every filled cell is nothing but a link or a button is a
+      // navigation block laid out as a table, not data with labels: asked,
+      // not asserted (2026-09-12).
+      const filled = cells.filter((cell) => cell.textContent.trim());
+      const navigational = filled.every((cell) => {
+        const controls = [...cell.querySelectorAll('a, button')];
+        return controls.length
+          && controls.map((control) => control.textContent.trim()).join(' ').replace(/\s+/g, ' ')
+            === cell.textContent.trim().replace(/\s+/g, ' ');
+      });
+      if (navigational) {
+        return {
+          status: 'incomplete',
+          message: 'This table has no header cells and every cell holds only a link or a button, which is the shape of a navigation block laid out as a table. If it presents data, mark its header cells with <th>; if it is layout, add role="presentation".',
+        };
+      }
+      // Everything that remains is a grid of at least four short text cells
+      // with no nested table, no block content and no layout role: a data
+      // table by every signal the markup gives, which is the determination
+      // F91 asks for before it applies. Asserted, as the shipped engine
+      // asserted it; the message says what to do if it is layout after all.
       // A two-column table is a list of label-and-value pairs; its first
       // column is the row headers, and that is the whole fix (gov.uk
       // inheritance tax guidance, 2026-09-01: five such tables, all td).
       const twoColumns = Math.max(0, ...rows.map((row) => row.cells.length)) === 2;
       return {
         status: 'fail',
-        message: 'This looks like a data table but has no header cells — screen reader users get the data with no way to tell what each row/column means.',
+        message: 'This looks like a data table but has no header cells, so screen reader users get the data with no way to tell what each row or column means. If it only arranges content, mark it role="presentation" and dismiss this finding.',
         fix: twoColumns
           ? 'Mark the first cell of each row as <th scope="row">: in a two-column table the first column names what the second holds.'
           : 'Mark header cells with <th> (add scope="col" or scope="row" when the table has both).',

package/engine/rules/wcag/1.3.4-orientation.js

@@ -3,58 +3,108 @@
 // orientation, such as portrait or landscape, unless a specific display
 // orientation is essential."
 //
-// What a stylesheet can PROVE: a rule inside an @media (orientation: …)
-// block that hides or counter-rotates the page root is restricting the
-// whole page to the other orientation — the "please rotate your device"
-// wall (body { display: none }) and the forced-landscape hack
-// (body { transform: rotate(90deg) }). The rotate hack even disproves the
-// "essential" escape by itself: content that renders rotated demonstrably
-// works in both orientations.
+// What a stylesheet can show: a rule inside an @media (orientation: …)
+// block that hides or counter-rotates the page root restricts the whole
+// page to the other orientation, the "please rotate your device" wall
+// (body { display: none }) and the forced-landscape hack
+// (body { transform: rotate(90deg) }). Asserted the way ACT rule b33eff
+// asserts a quarter turn between orientations, under its stated assumption
+// that no orientation is essential; the message names that exception. Both
+// orientations count: a rule for the orientation the device is not in right
+// now is still a restriction, and ACT evaluates both.
 //
-// Deliberately NOT flagged: orientation media queries that restyle or hide
-// individual regions — that is ordinary responsive design, not a lock.
-// Script-driven locks (screen.orientation.lock()) and cross-origin
-// stylesheets (unreadable under CORS) are invisible to a static pass; the
-// rule asserts only what it can see and stays silent otherwise.
-// The root ELEMENT only, optionally qualified by pseudo-classes. A pseudo-
-// element (body::before, html::backdrop) is one generated box, and hiding
-// it in portrait is the region restyling this rule deliberately leaves
-// alone; matching it asserted "hides the page" over a decorative band
-// (2026-08-25 overnight audit). Pseudo-classes are kept, but only assert
-// when the live root actually matches them (see rootSelector).
+// What the live page adds (2026-09-12): when the block IS active, computed
+// style shows whether the declaration is in force, so an overridden or
+// cancelled declaration is not a failure. When the block is dormant, a
+// later declaration for the same root in the same orientation undoes an
+// earlier one, in cascade order (display: block after display: none,
+// transform: none after a rotation). Unsupported @supports branches and
+// disabled sheets are skipped. Script locks (screen.orientation.lock()) and
+// cross-origin sheets stay invisible to a static pass.
+//
+// Deliberately NOT flagged: orientation queries that restyle or hide
+// individual regions (ordinary responsive design), and a root pseudo-element
+// (body::before is one generated box). Root pseudo-class selectors only
+// count when the live root matches them (body:not(.ready) once .ready is on
+// locks nothing).
+// https://www.w3.org/WAI/WCAG22/Understanding/orientation.html
+// https://www.w3.org/WAI/standards-guidelines/act/rules/b33eff/
 const ROOT_PART = /^(html|body|:root)((?::[a-z-]+(?:\([^()]*\))?)*)$/i;
 const LOCK_ROTATE = /rotate(?:3d\([^)]*,\s*)?\(?\s*(?:-?(?:90|270)deg|0\.25turn|-0\.25turn|100grad|-100grad)/i;
 
-function rootSelector(selectorText, doc) {
-  return (selectorText ?? '').split(',').some((part) => {
+function matchingRoots(selectorText, doc) {
+  const roots = new Set();
+  for (const part of (selectorText ?? '').split(',')) {
     const match = ROOT_PART.exec(part.trim());
-    if (!match) return false;
-    if (!match[2]) return true; // bare root: always in force
-    // body:not(.ready) { visibility: hidden } locks nothing once the class
-    // is on; the selector must match the root as it stands to be a lock.
+    if (!match) continue;
     const root = /^body$/i.test(match[1]) ? doc.body : doc.documentElement;
-    try { return !!root && root.matches(part.trim()); } catch { return false; }
-  });
+    try { if (root?.matches(part.trim())) roots.add(root); } catch { /* invalid selector */ }
+  }
+  return [...roots];
+}
+
+// CSS transforms and the independent rotate property compose. A 90-degree
+// declaration can be overridden, or cancelled by an opposite rotation.
+function quarterTurn(style, win) {
+  let angle = 0;
+  if (style.transform && style.transform !== 'none') {
+    try {
+      const matrix = new win.DOMMatrixReadOnly(style.transform);
+      if (!matrix.is2D) return null;
+      angle += Math.atan2(matrix.b, matrix.a) * 180 / Math.PI;
+    } catch { return null; }
+  }
+  if (style.rotate && style.rotate !== 'none') {
+    const rotation = /^(?:(?:z|0\s+0\s+1)\s+)?(-?[\d.]+)(deg|rad|grad|turn)$/.exec(style.rotate);
+    if (!rotation) return null;
+    const scale = { deg: 1, rad: 180 / Math.PI, grad: 0.9, turn: 360 }[rotation[2]];
+    angle += Number(rotation[1]) * scale;
+  }
+  return Math.abs(((angle % 180) + 180) % 180 - 90) < 0.01;
 }
 
-function scanRules(rules, insideOrientation, findings, doc) {
+/** Walk the sheet in cascade order, keeping the LAST relevant declaration
+ *  per root, orientation and property, so a later declaration in the same
+ *  orientation block undoes an earlier lock. */
+function scanRules(rules, orientationContext, active, state, doc) {
+  const win = doc.defaultView;
   for (const rule of rules ?? []) {
-    const condition = rule.conditionText ?? rule.media?.mediaText;
-    if (condition !== undefined && rule.cssRules) {
+    if (rule.type === win.CSSRule.SUPPORTS_RULE) {
+      // An unsupported branch cannot apply in either orientation.
+      if (win.CSS.supports(rule.conditionText)) scanRules(rule.cssRules, orientationContext, active, state, doc);
+      continue;
+    }
+    if (rule.type === win.CSSRule.MEDIA_RULE) {
+      const condition = rule.conditionText ?? rule.media.mediaText;
       const orientation = /orientation\s*:\s*(portrait|landscape)/i.exec(condition)?.[1];
-      scanRules(rule.cssRules, orientation ? { condition, orientation } : insideOrientation, findings, doc);
+      const context = orientation ? { condition, orientation } : orientationContext;
+      scanRules(rule.cssRules, context, active && win.matchMedia(condition).matches, state, doc);
       continue;
     }
-    if (insideOrientation && rule.style && rootSelector(rule.selectorText, doc)) {
+    if (orientationContext && rule.style) {
       const { display, visibility, transform, rotate } = rule.style;
-      if (display === 'none' || visibility === 'hidden') {
-        findings.push({ kind: 'hidden', selector: rule.selectorText, ...insideOrientation });
-      } else if (LOCK_ROTATE.test(transform ?? '') || LOCK_ROTATE.test(rotate ?? '')) {
-        findings.push({ kind: 'rotated', selector: rule.selectorText, ...insideOrientation });
+      const declared = {
+        display: display ? (display === 'none' ? 'hidden' : null) : undefined,
+        visibility: visibility ? (visibility === 'hidden' ? 'hidden' : null) : undefined,
+        transform: transform ? (LOCK_ROTATE.test(transform) ? 'rotated' : null) : undefined,
+        rotate: rotate ? (LOCK_ROTATE.test(`rotate(${rotate})`) ? 'rotated' : null) : undefined,
+      };
+      if (Object.values(declared).some((value) => value !== undefined)) {
+        for (const root of matchingRoots(rule.selectorText, doc)) {
+          const key = `${orientationContext.orientation.toLowerCase()}|${root === doc.body ? 'body' : 'html'}`;
+          if (!state.has(key)) state.set(key, {});
+          const entry = state.get(key);
+          for (const [property, kind] of Object.entries(declared)) {
+            if (kind === undefined) continue;
+            entry[property] = kind ? { kind, active, selector: rule.selectorText, ...orientationContext } : null;
+          }
+        }
       }
-    } else if (rule.cssRules) {
-      scanRules(rule.cssRules, insideOrientation, findings);
     }
+    // Layers and other grouping rules retain the surrounding media state.
+    // Unknown conditional groups cannot establish an active restriction.
+    if (rule.cssRules) scanRules(rule.cssRules, orientationContext,
+      active && rule.conditionText === undefined, state, doc);
   }
 }
 
@@ -66,24 +116,43 @@ export default {
   help: 'Content must work in both portrait and landscape',
   helpUrl: 'https://www.w3.org/WAI/WCAG22/Understanding/orientation.html',
   selector: 'html',
-  // The evidence is in the stylesheet, not in the root's own rendering — and
-  // the lock hides the root exactly when it is in force, so a visibility
-  // filter here would silence the rule in the only state that matters.
-  visibleOnly: false,
+  visibleOnly: false, // a restriction can hide the root itself
   evaluate(element) {
-    const findings = [];
-    for (const sheet of element.ownerDocument.styleSheets) {
+    const doc = element.ownerDocument;
+    const win = doc.defaultView;
+    const state = new Map();
+    for (const sheet of doc.styleSheets) {
+      if (sheet.disabled) continue;
+      const media = sheet.media?.mediaText;
+      if (media && !win.matchMedia(media).matches) continue;
       let rules;
       try { rules = sheet.cssRules; } catch { continue; } // cross-origin: unreadable, skip
-      scanRules(rules, null, findings, element.ownerDocument);
+      scanRules(rules, null, true, state, doc);
+    }
+    const findings = [];
+    for (const [key, entry] of state) {
+      const root = key.endsWith('|body') ? doc.body : doc.documentElement;
+      for (const finding of Object.values(entry)) {
+        if (!finding) continue;
+        if (finding.active) {
+          // The block applies right now, so the computed style is the truth:
+          // an overridden or cancelled declaration locks nothing.
+          const computed = win.getComputedStyle(root);
+          const effective = finding.kind === 'hidden'
+            ? computed.display === 'none' || computed.visibility === 'hidden'
+            : quarterTurn(computed, win);
+          if (effective === false) continue;
+        }
+        findings.push(finding);
+      }
     }
     if (!findings.length) return { status: 'pass' };
-    const f = findings[0];
-    const verb = f.kind === 'hidden' ? 'hides the page' : 'rotates the page to force the other orientation';
+    const finding = findings.find((candidate) => candidate.active) ?? findings[0];
+    const verb = finding.kind === 'hidden' ? 'hides the page' : 'rotates the page to force the other orientation';
     return {
       status: 'fail',
-      message: `A stylesheet rule (${f.selector} under @media ${f.condition}) ${verb} when the device is in ${f.orientation} — the content is locked to a single display orientation.`,
-      fix: 'Let the layout adapt to both orientations instead of hiding or rotating the page. If a single orientation is genuinely essential (rare), document why.',
+      message: `A stylesheet rule (${finding.selector} under @media ${finding.condition}) ${verb} when the device is in ${finding.orientation}${finding.active ? ', and it is in effect now' : ''}: the content is locked to a single display orientation. 1.3.4 allows that only where one orientation is essential, which a stylesheet cannot show; this finding assumes it is not.`,
+      fix: 'Let the layout adapt to both orientations instead of hiding or rotating the page. If a single orientation is genuinely essential (rare), document why and dismiss this finding.',
     };
   },
 };

package/engine/rules/wcag/1.3.5-autocomplete-valid.js

@@ -97,19 +97,32 @@ export default {
       .split(/\s+/)
       .filter(Boolean);
     const invalid = tokens.filter((token) => !isKnown(token));
-    if (invalid.length) {
+    const fault = invalid.length ? null : (tokens.length ? grammarFault(tokens) : null);
+    if (!invalid.length && !fault) return { status: 'pass' };
+    // Asserted the way ACT rule 73f2c2 asserts it, under its assumption that
+    // an autocomplete attribute sits on a field collecting information about
+    // the user, which is what the attribute is for. A search box is the one
+    // common field that carries the attribute and collects nothing about the
+    // user, so it is asked about rather than failed. The message names the
+    // assumption so a reviewer can dismiss the finding on a field 1.3.5 does
+    // not cover. https://www.w3.org/WAI/standards-guidelines/act/rules/73f2c2/
+    const problem = invalid.length
+      ? `autocomplete contains unknown token(s): ${invalid.join(', ')}, so browsers and assistive tools cannot identify this field's purpose from it`
+      : `autocomplete="${element.getAttribute('autocomplete').trim()}" is not a valid autofill value: ${fault}. Browsers discard the whole value, so no purpose is exposed`;
+    const fix = invalid.length
+      ? 'Use tokens from the HTML input-purposes list, e.g. autocomplete="email" or autocomplete="given-name".'
+      : 'Use one field name from the HTML autofill list, optionally preceded by section-*, then shipping or billing, and (for tel, email and impp only) a contact type, e.g. autocomplete="shipping tel" or autocomplete="home email".';
+    if (element.type === 'search') {
       return {
-        status: 'fail',
-        message: `autocomplete contains unknown token(s): ${invalid.join(', ')} — browsers and assistive tools can't identify this field's purpose.`,
-        fix: 'Use tokens from the HTML input-purposes list, e.g. autocomplete="email" or autocomplete="given-name".',
+        status: 'incomplete',
+        message: `${problem}. 1.3.5 covers fields that collect information about the user, which a search box usually does not; if this one does, correct the value.`,
+        fix,
       };
     }
-    const fault = tokens.length ? grammarFault(tokens) : null;
-    if (!fault) return { status: 'pass' };
     return {
       status: 'fail',
-      message: `autocomplete="${element.getAttribute('autocomplete').trim()}" is not a valid autofill value: ${fault}. Browsers discard the whole value, so no purpose is exposed.`,
-      fix: 'Use one field name from the HTML autofill list, optionally preceded by section-*, then shipping or billing, and (for tel, email and impp only) a contact type, e.g. autocomplete="shipping tel" or autocomplete="home email".',
+      message: `${problem}. 1.3.5 covers fields that collect information about the user, which is what an autocomplete attribute is for; if this field collects nothing about the user, the criterion does not apply and this finding can be dismissed.`,
+      fix,
     };
   },
 };

package/engine/rules/wcag/1.4.1-link-in-text-block.js

@@ -121,16 +121,23 @@ export default {
   // embedded in prose exactly as 1.4.1 means it. Pure link lists (navs,
   // blogrolls) are still excluded, but by the ownText guard below rather than
   // by tag: in <li><a>Home</a></li> the item has no text of its own.
-  // <div> was measured too and added nothing on any test site, so it stays
-  // out rather than widening the blast radius for no gain.
-  selector: 'p a[href], dd a[href], blockquote a[href], td a[href], li a[href]',
+  // Prose in a generic container has the same requirement. F73 does not
+  // limit colour-only links to paragraph markup. The text and shared-line
+  // checks below keep navigation and separate blocks out of this lane.
+  // https://www.w3.org/WAI/WCAG22/Techniques/failures/F73
+  selector: 'p a[href], dd a[href], blockquote a[href], td a[href], li a[href], div a[href]',
   visibility: 'visual', // colour distinction is a purely visual concern
   evaluate(element, { ownText }) {
-    const parent = element.closest('p, dd, blockquote, td, li');
+    const parent = element.closest('p, dd, blockquote, td, li, div');
     if (!element.textContent.trim() || !parent) return { status: 'pass' };
     // Needs real surrounding text to blend into (1.4.1 is about links
     // embedded in prose, not a link that IS the content).
-    if (ownText(parent).replace(/\s+/g, '').length < 10) return { status: 'pass' };
+    const surroundingText = ownText(parent).trim();
+    if (!/[\p{L}\p{N}]/u.test(surroundingText)) return { status: 'pass' };
+    // A short fragment may be prose ("See ..."), an equation or a label.
+    // F73 has no minimum character count. Keep evaluating the visual cues
+    // and ask about ambiguous context instead of silently passing it.
+    const shortContext = surroundingText.replace(/\s+/g, '').length < 10;
 
     const style = getComputedStyle(element);
     const parentStyle = getComputedStyle(parent);
@@ -169,7 +176,14 @@ export default {
       if (sidePaints(s, 'Bottom')) return { status: 'pass' };
       if (boxShadowPaints(s.boxShadow)) return { status: 'pass' };
       const ownBackground = parseColor(s.backgroundColor);
-      if (ownBackground && ownBackground.a > 0) return { status: 'pass' };
+      if (ownBackground && ownBackground.a > 0) {
+        const surroundings = effectiveBackground(parent);
+        if (!surroundings) unclear = true;
+        else {
+          const shown = composite(ownBackground, surroundings);
+          if (['r', 'g', 'b'].some((channel) => Math.round(shown[channel]) !== Math.round(surroundings[channel]))) return { status: 'pass' };
+        }
+      }
       const painted = backgroundImagePaints(s, el.getBoundingClientRect()); // gradient/image underline technique
       if (painted === 'yes') return { status: 'pass' };
       if (painted === 'unclear') unclear = true;
@@ -198,8 +212,17 @@ export default {
     const sizeStep = Math.max(...textBearers.map((s) => Math.abs((parseFloat(s.fontSize) || parentSize) - parentSize)));
     const sizeCue = sizeStep >= 2 && sizeStep / parentSize >= 0.1;
 
-    let linkColor = parseColor(style.color);
-    let textColor = parseColor(parentStyle.color);
+    // A wrapper's colour need not paint any glyphs: inline spans commonly
+    // override it. Compare actual own-text bearers, and review multicolour
+    // text rather than attributing an unpainted wrapper colour to it.
+    const glyphColours = cueBearers.filter(({ el }) => ownText(el))
+      .map(({ s }) => s.webkitTextFillColor || s.color);
+    const distinctColours = [...new Set(glyphColours)];
+    if (distinctColours.length > 1) {
+      return { status: 'incomplete', message: 'This link presents text in several colours without a detected non-colour cue. Check that each part is distinguishable from the surrounding text.' };
+    }
+    let linkColor = parseColor(distinctColours[0] || style.webkitTextFillColor || style.color);
+    let textColor = parseColor(parentStyle.webkitTextFillColor || parentStyle.color);
     if (!linkColor || !textColor) return { status: 'pass' };
     // 2026-08-25 overnight audit: a translucent colour is presented
     // composited over its backdrop (rgba(0,0,0,.3) in black prose on white
@@ -330,6 +353,13 @@ export default {
         fix: reviewFix,
       };
     }
+    if (shortContext) {
+      return {
+        status: 'incomplete',
+        message: `This link has no detected non-colour cue and only ${shown}:1 colour difference from nearby text. The surrounding text is a short fragment. Check whether it forms a sentence or other prose with the link; if it does, colour alone does not distinguish the link sufficiently.`,
+        fix: reviewFix,
+      };
+    }
     return {
       status: 'fail',
       // The measured fact is the ratio against G183's threshold, and that is

package/engine/rules/wcag/1.4.10-reflow.js

@@ -1,8 +1,8 @@
 // WCAG SC 1.4.10 Reflow (Level AA)
 // The full test renders at 320 CSS px; an audit runs at whatever viewport
 // the page is in. What IS knowable here: content that already forces
-// two-dimensional scrolling at the current width will only be worse at
-// 320px. Abstain-over-assert: this flags, it never fails — tables, maps,
+// horizontal scrolling at the current width is a candidate to check at
+// 320px; responsive breakpoints can change the layout. Abstain-over-assert: this flags, it never fails — tables, maps,
 // and images are exempt content the geometry can't distinguish.
 export default {
   id: 'reflow',
@@ -20,7 +20,7 @@ export default {
     if (overflow <= 1) return { status: 'pass' };
     return {
       status: 'incomplete',
-      message: `The page already scrolls horizontally by ${Math.round(overflow)}px at the current viewport — at the 320px reflow breakpoint it will be worse. Verify content reflows at 320 CSS px width (data tables, maps and images are exempt).`,
+      message: `The page already scrolls horizontally by ${Math.round(overflow)}px at the current viewport. Verify content reflows at 320 CSS px width (data tables, maps and images are exempt).`,
     };
   },
 };

package/engine/rules/wcag/1.4.11-non-text-contrast.js

@@ -114,7 +114,15 @@ export default {
       const wrapperHasBorder = ['Top', 'Right', 'Bottom', 'Left'].some((side) =>
         parseFloat(wrapperStyle[`border${side}Width`]) > 0 && wrapperStyle[`border${side}Style`] !== 'none'
         && (parseColor(wrapperStyle[`border${side}Color`])?.a ?? 0) > 0);
-      if (wrapperHasBorder) return { status: 'pass' };
+      if (wrapperHasBorder) {
+        const around = effectiveBackground(wrapper.parentElement ?? wrapper);
+        const contrastingBorder = around && ['Top', 'Right', 'Bottom', 'Left'].some((side) => {
+          if (!(parseFloat(wrapperStyle[`border${side}Width`]) > 0) || wrapperStyle[`border${side}Style`] === 'none') return false;
+          const colour = parseColor(wrapperStyle[`border${side}Color`]);
+          return colour && contrastRatio(composite(colour, around), around) >= 3;
+        });
+        if (contrastingBorder) return { status: 'pass' };
+      }
       const wrapperFill = parseColor(wrapperStyle.backgroundColor);
       if (wrapperFill && wrapperFill.a >= 1) {
         const around = effectiveBackground(wrapper.parentElement ?? wrapper);

package/engine/rules/wcag/1.4.12-text-spacing.js

@@ -44,7 +44,11 @@ export default {
     // ruinous on 200k-node single-page specs, whose plain flowing text is
     // also the least likely content on the web to clip. Past a scale where
     // the probe's cost dwarfs its yield, abstain wholesale.
-    if (elements.length > 20_000) return elements.map(() => ({ status: 'pass' }));
+    if (elements.length > 20_000) {
+      return elements.map((_, index) => index === 0
+        ? { status: 'incomplete', message: `The text-spacing probe was not run because this page has ${elements.length} candidate elements, exceeding its 20,000-element budget. Check the page with the WCAG spacing overrides applied.` }
+        : { status: 'skipped' });
+    }
     // Only containers that hide overflow and hold text can lose content.
     // Collapsed containers (accordion panels at height 0) show nothing —
     // there is no visible text for the override to clip.
@@ -64,13 +68,22 @@ export default {
     probe.dataset.pourAudit = 'probe';
     probe.textContent = override(doc.documentElement.scrollHeight);
     doc.documentElement.append(probe);
+    // Document selectors cannot cross a shadow boundary. Each candidate
+    // root receives the same override so the measured text is really probed.
+    const probes = [probe];
+    for (const root of new Set(candidates.filter(Boolean).map((element) => element.getRootNode()))) {
+      if (root === doc || !root.host) continue;
+      const scoped = probe.cloneNode(true);
+      root.append(scoped);
+      probes.push(scoped);
+    }
     let after;
     try {
       // Force the reflow the measurements depend on.
       void doc.documentElement.offsetHeight;
       after = candidates.map((element) => element && clipped(element));
     } finally {
-      probe.remove();
+      for (const applied of probes) applied.remove();
       // The audit must never move the page: put the scroll back exactly
       // where the user had it, after the removal's own reflow settles.
       void doc.documentElement.offsetHeight;