testaro 78.0.8 → 78.4.0

package/validation/act/capture.js

@@ -0,0 +1,424 @@
+/*
+  © 2026 Jeff Witt.
+
+  Licensed under the MIT License. See LICENSE file at the project root or
+  https://opensource.org/license/mit/ for details.
+
+  SPDX-License-Identifier: MIT
+*/
+
+/*
+  capture.js
+  Runs tool reporters over a page set and records raw per-page findings to
+  JSONL. Two page sources:
+  - Default: the W3C ACT-Rules test cases (Track A; score with score.js).
+  - --urls <file>: a plain list of URLs, one per line (the Stage-3 real-world
+    stress/mapping capture). Rows carry per-instance element paths
+    (`instances`) so element-level co-occurrence can be computed downstream.
+  Scoring/analysis is separate and cheap, so an expensive capture never has
+  to repeat to try a different policy.
+
+  Usage (cwd must be the repository root, for tool assets such as aceconfig):
+    node validation/act/capture.js --engines pour,axe [--match regex]
+      [--rules id,id] [--max N] [--out path.jsonl]
+      [--urls path.txt] [--recycle N]
+
+  Each output line: {testcaseId, ruleId, expected, engine, prevented,
+  instanceCount, outcomeTotals: {failed, cantTell}, asserted: {SC: count},
+  review: {SC: count}, ruleIDs: {engineRuleID: count}, ms}
+  `asserted` counts definite failures (standard-instance outcome `failed`);
+  `review` counts engine-flagged uncertainty (outcome `cantTell`). Criteria
+  are dotted WCAG SC numbers, extracted per engine from native results;
+  engines without an extractor still record ruleIDs, instanceCount, and
+  outcomeTotals. Every standard instance must carry a valid outcome; a row
+  whose instances do not is marked as an error (adapter drift).
+*/
+
+// IMPORTS
+
+const fs = require('fs');
+const fsp = require('fs/promises');
+const path = require('path');
+const {chromium} = require('playwright');
+const {OUTCOMES} = require('../../procs/standard');
+
+// CONSTANTS
+
+const TESTCASES_URL = 'https://www.w3.org/WAI/content-assets/wcag-act-rules/testcases.json';
+const CACHE_DIR = path.join(__dirname, 'cache');
+const RESULTS_DIR = path.join(__dirname, 'results');
+// Per-reporter time limit, matching the production limits in procs/doActs.js.
+const REPORTER_TIMEOUT_MS = 45000;
+
+// Mirrors procs/doTestAct.js xPathNeeds for the engines this harness supports.
+const XPATH_NEEDS = {
+  alfa: 'own',
+  aslint: 'own',
+  axe: 'attribute',
+  ed11y: 'script',
+  htmlcs: 'attribute',
+  ibm: 'attribute',
+  pour: 'script',
+  qualWeb: 'attribute',
+  surea11y: 'script'
+};
+
+// Converts a wcag### tag (axe/pour style) to a dotted criterion.
+const tagToCriterion = tag => {
+  const digits = tag.slice(4);
+  return `${digits[0]}.${digits[1]}.${digits.slice(2)}`;
+};
+
+/*
+  Per-engine criterion extractors: nativeResult → {asserted, review}, each
+  {dottedSC: count}. Engines without one record ruleIDs only; add extractors
+  here as engines join Track A.
+*/
+const criterionExtractors = {
+  // Shared by pour and surea11y: both adapters flatten to violations/incomplete
+  // arrays of findings carrying a dotted `wcag` criterion.
+  pour: nativeResult => {
+    const buckets = {asserted: {}, review: {}};
+    [['violations', 'asserted'], ['incomplete', 'review']].forEach(([source, target]) => {
+      (nativeResult[source] || []).forEach(finding => {
+        if (finding.wcag) {
+          buckets[target][finding.wcag] = (buckets[target][finding.wcag] || 0) + 1;
+        }
+      });
+    });
+    return buckets;
+  },
+  get surea11y() {
+    return this.pour;
+  },
+  axe: nativeResult => {
+    const buckets = {asserted: {}, review: {}};
+    const details = nativeResult && nativeResult.details;
+    [['violations', 'asserted'], ['incomplete', 'review']].forEach(([source, target]) => {
+      ((details && details[source]) || []).forEach(rule => {
+        const criteria = (rule.tags || [])
+        .filter(tag => /^wcag\d{3,4}$/.test(tag))
+        .map(tagToCriterion);
+        rule.nodes.forEach(() => {
+          criteria.forEach(criterion => {
+            buckets[target][criterion] = (buckets[target][criterion] || 0) + 1;
+          });
+        });
+      });
+    });
+    return buckets;
+  },
+  /*
+    QualWeb runs the ACT rules natively: each act-rules assertion carries the
+    exact ACT rule ID in `mapping`, so this extractor also emits actAsserted /
+    actReview maps keyed by ACT rule ID — score.js prefers those over the
+    criterion layer when present.
+  */
+  qualWeb: nativeResult => {
+    const buckets = {asserted: {}, review: {}, actAsserted: {}, actReview: {}};
+    const modules = (nativeResult && nativeResult.modules) || {};
+    ['act-rules', 'wcag-techniques', 'best-practices'].forEach(section => {
+      const assertions = (modules[section] && modules[section].assertions) || {};
+      Object.values(assertions).forEach(assertion => {
+        const criteria = ((assertion.metadata && assertion.metadata['success-criteria']) || [])
+        .map(criterion => criterion.name);
+        const actID = section === 'act-rules' ? assertion.mapping : null;
+        (assertion.results || []).forEach(assertionResult => {
+          const target = assertionResult.verdict === 'failed' ? 'asserted'
+            : assertionResult.verdict === 'warning' ? 'review' : null;
+          if (! target) {
+            return;
+          }
+          const count = (assertionResult.elements || []).length || 1;
+          criteria.forEach(criterion => {
+            buckets[target][criterion] = (buckets[target][criterion] || 0) + count;
+          });
+          if (actID) {
+            const actTarget = target === 'asserted' ? 'actAsserted' : 'actReview';
+            buckets[actTarget][actID] = (buckets[actTarget][actID] || 0) + count;
+          }
+        });
+      });
+    });
+    return buckets;
+  }
+};
+
+// Per-engine rule-ID counters from the standard result.
+const ruleIDCounts = standardResult => {
+  const counts = {};
+  ((standardResult && standardResult.instances) || []).forEach(instance => {
+    counts[instance.ruleID] = (counts[instance.ruleID] || 0) + instance.count;
+  });
+  return counts;
+};
+
+// FUNCTIONS
+
+// Parses CLI arguments of the form --name value.
+const parseArgs = argv => {
+  const args = {};
+  for (let i = 2; i < argv.length; i += 2) {
+    args[argv[i].replace(/^--/, '')] = argv[i + 1];
+  }
+  return args;
+};
+
+// Gets the testcase feed, cached on disk.
+const getTestcases = async () => {
+  await fsp.mkdir(CACHE_DIR, {recursive: true});
+  const cachePath = path.join(CACHE_DIR, 'testcases.json');
+  if (! fs.existsSync(cachePath)) {
+    const response = await fetch(TESTCASES_URL);
+    await fsp.writeFile(cachePath, await response.text());
+  }
+  return JSON.parse(await fsp.readFile(cachePath, 'utf8')).testcases;
+};
+
+// The window.getXPath injection, as in procs/launch.js.
+const getXPathScript = () => {
+  window.getXPath = element => {
+    if (! element || element.nodeType !== Node.ELEMENT_NODE) {
+      return '';
+    }
+    const segments = [];
+    while (element && element.nodeType === Node.ELEMENT_NODE) {
+      const tag = element.tagName.toLowerCase();
+      if (element === document.documentElement) {
+        segments.unshift('html');
+        break;
+      }
+      const parent = element.parentNode;
+      if (! parent || parent.nodeType !== Node.ELEMENT_NODE) {
+        segments.unshift(tag);
+        break;
+      }
+      const cohort = Array.from(parent.childNodes).filter(
+        childNode => childNode.nodeType === Node.ELEMENT_NODE
+        && childNode.tagName === element.tagName
+      );
+      const subscript = tag === 'body' ? '' : `[${cohort.indexOf(element) + 1}]`;
+      segments.unshift(`${tag}${subscript}`);
+      element = parent;
+    }
+    return `/${segments.join('/')}`;
+  };
+};
+
+// OPERATION
+
+(async () => {
+  const args = parseArgs(process.argv);
+  const engines = (args.engines || 'pour').split(',');
+  const outPath = args.out
+    || path.join(RESULTS_DIR, `act-${new Date().toISOString().replace(/[:.]/g, '-')}.jsonl`);
+  await fsp.mkdir(path.dirname(outPath), {recursive: true});
+  let testcases;
+  if (args.urls) {
+    // URL-list mode: one synthetic testcase per line; the URL is the ID.
+    testcases = (await fsp.readFile(args.urls, 'utf8'))
+    .split('\n')
+    .map(line => line.trim())
+    .filter(line => line && ! line.startsWith('#'))
+    .map(url => ({testcaseId: url, url}));
+  }
+  else {
+    testcases = await getTestcases();
+  }
+  if (args.rules) {
+    const wanted = new Set(args.rules.split(','));
+    testcases = testcases.filter(testcase => wanted.has(testcase.ruleId));
+  }
+  if (args.match) {
+    const matcher = new RegExp(args.match, 'i');
+    testcases = testcases.filter(testcase => matcher.test(testcase.ruleName));
+  }
+  if (args.max) {
+    testcases = testcases.slice(0, Number(args.max));
+  }
+  // Resume support: skip (testcase, engine) pairs already in the out file.
+  const alreadyCaptured = new Set();
+  if (fs.existsSync(outPath)) {
+    fs.readFileSync(outPath, 'utf8').split('\n').filter(Boolean).forEach(line => {
+      try {
+        const row = JSON.parse(line);
+        alreadyCaptured.add(`${row.testcaseId}:${row.engine}`);
+      }
+      catch(error) {}
+    });
+  }
+  console.log(
+    `Capturing ${testcases.length} testcases × ${engines.join('+')} → ${outPath}`
+    + (alreadyCaptured.size ? ` (resuming; ${alreadyCaptured.size} rows already captured)` : '')
+  );
+  const out = fs.createWriteStream(outPath, {flags: 'a'});
+  /*
+    The browser is recycled every RECYCLE_EVERY testcases: a 2026-08-22 full
+    run showed script-tag injection silently failing (tool global never
+    defined) after ~270 testcases in one long-lived browser, while
+    evaluate-based injection kept working. Fresh processes reproduce none of
+    it, so periodic recycling is the guard.
+  */
+  const RECYCLE_EVERY = args.recycle === undefined ? 100 : Number(args.recycle);
+  let browser = await chromium.launch();
+  let context = await browser.newContext();
+  let done = 0;
+  /*
+    Hang guards. page.close() can hang FOREVER (not reject — hang) on a page
+    that performed a meta-refresh(0) navigation (reproduced locally,
+    playwright 1.62.1, ~50% of rounds on such pages; see isolation-notes.md).
+    So: every await that touches the browser is raced against a deadline, and
+    if the per-testcase watchdog trips, the browser is presumed wedged and
+    replaced (the old one is closed with its own deadline and abandoned if
+    that hangs too).
+  */
+  const withDeadline = (promise, ms, label) => Promise.race([
+    promise,
+    new Promise((resolve, reject) => setTimeout(
+      () => reject(new Error(`${label} deadline ${ms}ms`)), ms
+    ))
+  ]);
+  const replaceBrowser = async () => {
+    const oldBrowser = browser;
+    withDeadline(oldBrowser.close(), 10000, 'browser.close').catch(() => {});
+    browser = await chromium.launch();
+    context = await browser.newContext();
+  };
+  for (const testcase of testcases) {
+    if (done > 0 && RECYCLE_EVERY && done % RECYCLE_EVERY === 0) {
+      await replaceBrowser();
+    }
+    for (const engine of engines) {
+      if (alreadyCaptured.has(`${testcase.testcaseId}:${engine}`)) {
+        continue;
+      }
+      const row = {
+        testcaseId: testcase.testcaseId,
+        ruleId: testcase.ruleId,
+        ruleName: testcase.ruleName,
+        expected: testcase.expected,
+        engine
+      };
+      const started = Date.now();
+      let page;
+      let closeHung = false;
+      try {
+        page = await withDeadline(context.newPage(), 20000, 'newPage');
+        const xPathNeed = XPATH_NEEDS[engine] || 'none';
+        if (xPathNeed === 'script' || xPathNeed === 'attribute') {
+          await page.addInitScript(getXPathScript);
+        }
+        await page.goto(testcase.url, {waitUntil: 'load', timeout: args.urls ? 30000 : 20000});
+        if (xPathNeed === 'attribute') {
+          // Stamp data-xpath attributes, as procs/launch.js does.
+          await withDeadline(page.evaluate(() => {
+            document.querySelectorAll('*').forEach(element => {
+              element.setAttribute('data-xpath', window.getXPath(element));
+            });
+          }), 15000, 'stamping');
+        }
+        /*
+          Capture the page's script nonce (if its CSP uses one) so
+          script-injecting adapters can reuse it — mirroring the production
+          launch proc's jobData.lastScriptNonce.
+        */
+        const scriptNonce = await page.evaluate(() => {
+          const nonced = document.querySelector('script[nonce]');
+          return (nonced && nonced.nonce) || '';
+        }).catch(() => '');
+        const report = {
+          standard: 'also',
+          jobData: scriptNonce ? {lastScriptNonce: scriptNonce} : {},
+          catalog: {},
+          target: {url: testcase.url},
+          acts: [{type: 'test', which: engine, withItems: true}]
+        };
+        const actReport = await Promise.race([
+          require(`../../tests/${engine}`).reporter(page, report, 0, 40),
+          new Promise((resolve, reject) => setTimeout(
+            () => reject(new Error('reporter timeout')), REPORTER_TIMEOUT_MS
+          ))
+        ]);
+        const {data, result} = actReport;
+        row.prevented = !! (data && data.prevented);
+        if (row.prevented) {
+          row.error = data.error;
+        }
+        else {
+          row.instanceCount = result.standardResult.instances.length;
+          row.outcomeTotals = result.standardResult.outcomeTotals;
+          row.ruleIDs = ruleIDCounts(result.standardResult);
+          const unoutcomed = result.standardResult.instances
+          .filter(instance => ! OUTCOMES.includes(instance.outcome)).length;
+          if (unoutcomed) {
+            row.error = `${unoutcomed} instance(s) without a valid outcome`;
+          }
+          const extractor = criterionExtractors[engine];
+          if (extractor) {
+            Object.assign(row, extractor(result.nativeResult));
+          }
+          if (args.urls) {
+            // Per-instance element paths for element-level co-occurrence
+            // (Stage-3b mapping bootstrap). Capped: a pathological page must
+            // not blow up the output file.
+            row.instances = result.standardResult.instances
+            .slice(0, 2000)
+            .map(instance => ({
+              ruleID: instance.ruleID,
+              severity: instance.ordinalSeverity,
+              outcome: instance.outcome,
+              uncertainty: instance.uncertainty,
+              xPath: (report.catalog[instance.catalogIndex] || {}).pathID || ''
+            }));
+          }
+        }
+      }
+      catch(error) {
+        row.prevented = true;
+        row.error = error.message.slice(0, 200);
+      }
+      finally {
+        if (page) {
+          // close() can hang, not reject, after a meta-refresh navigation —
+          // race it and abandon the page if the deadline trips.
+          await withDeadline(page.close(), 5000, 'page.close').catch(error => {
+            closeHung = error.message.includes('deadline');
+          });
+        }
+      }
+      /*
+        Replace the browser on any sign of a wedged/dead browser, not just a
+        tripped deadline: a wedged browser's newPage first throws "Protocol
+        error (Target.createTarget)" and, once the process dies, "Target
+        page, context or browser has been closed" (observed 2026-08-22 after
+        a bc659a meta-refresh close-hang; a deadline-only trigger let 73
+        rows fail before the next scheduled recycle).
+      */
+      if (
+        closeHung
+        || (row.error && /deadline|has been closed|Protocol error/.test(row.error))
+        /*
+          Canary: a script-tag-injecting tool reporting its global undefined
+          on an ordinary text/html page means browser-wide script-element
+          execution is wedged (the injection cliff — a probabilistic wedge
+          that regional replays never reproduce; it once killed 41
+          consecutive rows in a browser only ~36 pages old). XML pages are
+          excluded: script elements legitimately never execute there.
+        */
+        || (row.error && /global not defined \(contentType text\/html/.test(row.error))
+      ) {
+        row.browserReplaced = true;
+        await replaceBrowser();
+      }
+      row.ms = Date.now() - started;
+      out.write(`${JSON.stringify(row)}\n`);
+    }
+    done++;
+    if (done % 25 === 0) {
+      console.log(`${done}/${testcases.length}`);
+    }
+  }
+  await browser.close();
+  out.end();
+  console.log(`Done: ${done} testcases → ${outPath}`);
+})();

package/validation/act/chromium-issue-draft.md

@@ -0,0 +1,66 @@
+# Chromium bug report — Target.closeTarget acks success without closing during navigation commit
+
+**NOT FILED as a new issue — already tracked upstream.** Pre-filing search (2026-08-22) found
+<https://issues.chromium.org/issues/536385539> (filed 2026-07-19 by a Google engineer, P2/S2,
+pending code change 8251379): `Target.closeTarget` is lost when a navigation commit swaps the
+main RenderFrameHost right after `ClosePage` — the pending `ClosePage` callback dies with the
+old RFH and is never re-issued. Same defect; their trigger was back-to-back failing navigations,
+ours (meta-refresh 0) is an additional ordinary-page trigger of the same race.
+
+**Actions taken instead:** corroborating comment posted as comment #2 on 536385539 (meta-refresh
+trigger, raw-CDP hit rates, workaround matrix, link to
+<https://github.com/microsoft/playwright/issues/42366>); issue upvoted; cross-link comment added
+on the Playwright issue. Repro retained here: `repro-cdp-raw.js`.
+
+The draft below is preserved for reference (its evidence went into the comment).
+
+---
+
+**Title:** Target.closeTarget returns success:true without closing the target when the close
+races a client-side (meta refresh) navigation commit; no Target.targetDestroyed is ever emitted
+
+## Environment
+
+- Chromium 151.0.7922.34, `--headless=new`, Linux
+- Raw CDP over WebSocket (no client library — reproduces identically through Playwright 1.62.1,
+  where it strands `page.close()` forever)
+- Not reproducible in Firefox or WebKit equivalents
+
+## Steps
+
+1. Create a target and navigate it to a page carrying
+   `<meta http-equiv="refresh" content="0; URL='/target.html'">` (immediate client-side
+   redirect).
+2. Leave a `Runtime.evaluate` (`awaitPromise: true`) in flight for the refresh navigation to
+   destroy.
+3. ~45–60 ms after the navigate (during the refresh navigation's commit window), send
+   `Target.closeTarget {targetId}` on the browser session.
+
+Reproduction rate ~3/10 rounds with the attached script (a timing race; the script sweeps the
+window).
+
+## Expected
+
+Either the target closes — `Target.targetDestroyed` fires and the target disappears from
+`Target.getTargets` — or `closeTarget` reports `success: false`/an error.
+
+## Actual
+
+`closeTarget` returns `{"result":{"success":true}}`, but:
+
+- no `Target.targetDestroyed` is ever emitted for the target;
+- the target remains listed in `Target.getTargets`;
+- the target proceeds to fully load the redirect destination (frameNavigated,
+  DOMContentLoaded, load, paint lifecycle events all arrive *after* the successful-looking
+  close acknowledgment).
+
+A second `Target.closeTarget` for the same target afterwards does close it, as does closing its
+browser context — the target is not stuck, the close was simply dropped.
+
+## Impact
+
+Any CDP client that treats `success: true` as "the target will be destroyed" waits forever.
+Playwright's `page.close()` does exactly this: its promise resolves on target destruction, so
+automation against pages using meta-refresh (common in the wild; the W3C ACT-Rules bc659a
+"passed" fixtures are examples) hangs nondeterministically with no error. Observed at ~70–80%
+per attempt via Playwright's timing on real fixture pages.

package/validation/act/fp-triage-2026-08-22.md

@@ -0,0 +1,86 @@
+# Pour FP triage — 2026-08-22 capture (440-testcase sample, asserted band)
+
+Manual read of every pour false-positive fixture from `results/merged-2026-08-22.jsonl`.
+Verdicts: **real** (pour asserts a failure ACT deems passed/inapplicable — upstream candidate) or
+**artifact** (correct finding counted against the wrong ACT rule by the criterion-level scoring
+policy — not a pour defect).
+
+## Real — upstream filing candidates
+
+1. **Contrast asserted on ACT-exempt text** (3 FPs, `afw4f7`/`09o5cg`). Symbol-only text
+   (`09o5cg` Passed Ex 6: a paragraph of `----====++++…` at 3.66:1) and letter-as-icon glyphs
+   (`afw4f7` Passed Ex 7 / `09o5cg` Passed Ex 6: `<button aria-label="Close">X</button>`) are
+   expected *passed* by the ACT contrast rules; pour's `color-contrast` /
+   `color-contrast-enhanced` assert failures. Axe returns no finding on all three (TN). Given
+   pour's "report what it cannot prove" ethos, asserting on ACT-consensus-exempt text is worth an
+   upstream issue.
+2. **`button-name` on `<button role="none" disabled>`** (1 FP, `97a4e1` Inapplicable Ex 5). With
+   the element disabled (not focusable), `role="none"` holds and the element is out of scope for
+   the button-name rule; pour flags it.
+3. **`link-name` misses descendant `aria-labelledby`** (1 FP, `c487ae` Passed Ex 8):
+   `<a href><img aria-labelledby="id1"></a>` — the link's name-from-content includes the image's
+   aria-labelledby name, so the link is correctly named; pour flags it empty. Accessible-name
+   computation gap.
+4. **Language rules skip ACT applicability conditions** (4 FPs, `de46e4`/`off6ek`/`ucwvc8`).
+   `valid-lang-parts` flags invalid `lang` values on elements whose text is overridden by a
+   descendant `lang` or entirely `display:none` (ACT: passed/inapplicable — the SC concerns text
+   that *uses* the language); `html-lang` flags a completely empty `<html></html>` page (ACT:
+   inapplicable without text). Defensible strictness, but a divergence from ACT consensus worth
+   raising upstream.
+
+## Artifact — scoring policy, not pour
+
+- **`c487ae` Inapplicable Ex 4** (`<a aria-hidden="true" href>…</a>`): pour's `aria-hidden-focus`
+  finding is a *correct* 4.1.2 issue (focusable content hidden from AT); it counts as an FP only
+  because the fixture tests a different ACT rule on the same criterion. This is the documented
+  generosity of criterion-level matching; an exact engine-rule → ACT-rule map would reclassify it.
+
+## Tally
+
+Of 15 criterion-level FPs in the sample, ~9 fixtures inspected covering all hotspots: 9 real
+across 4 defect classes, 1 artifact. The 4 classes are small, well-defined applicability/name-
+computation gaps — exactly the kind of finding the candidacy pipeline is meant to hand upstream
+(engine-candidacy-pipeline.md, Stage 5 / benchmarks §6 stewardship).
+
+## Recheck 2026-09-01 (pour 1.37.0, surea11y 1.7.0)
+
+Re-ran every fixture of the eight ACT rules above with the current bundles
+(`--engines pour,surea11y --rules afw4f7,09o5cg,97a4e1,c487ae,de46e4,off6ek,ucwvc8,4b1c6c`).
+
+- Pour classes 1–3 persist unchanged in 1.37.0 (contrast on `afw4f7`/`09o5cg` Passed Example 7,
+  `button-name` on `97a4e1` Inapplicable Example 5, `link-name` on `c487ae` Passed Example 8).
+  Contrast also asserts on `09o5cg` Inapplicable Examples 6 and 7 — label text of a disabled
+  control, which ACT's "disabled label" applicability exemption excludes — a third sub-case of
+  class 1. Class 4 narrows to `valid-lang-parts` (`de46e4` Passed Example 4, Inapplicable 3–5,
+  `off6ek` Inapplicable 5): the `html-lang` hits on empty documents (`ucwvc8` Inapplicable 2–3,
+  `97a4e1` Passed 6, `c487ae` Passed 9) are correct under ACT `b5c3f8`, whose applicability has
+  no content condition, and count as FPs only through criterion-level scoring. Same for
+  surea11y's `html-lang-attr-present` on those fixtures.
+- **surea11y `4b1c6c` (11 FP)** is `iframe-title-unique`, not the 1.7.0 rule
+  `identical-iframes-same-purpose` (which already reports differing resources as `cantTell`):
+  it fails any two frames sharing a title attribute, including Passed Examples 1, 4–9 where the
+  frames embed the same or equivalent resource, and Inapplicable Example 5.
+- Upstream filings prepared from this recheck: pour — presentational-role conflict ignoring
+  `disabled`, name-from-content ignoring descendant `aria-labelledby`, contrast on
+  non-human-language text / icon glyphs / disabled labels, `valid-lang-parts` applicability;
+  surea11y — `iframe-title-unique` vs ACT 4b1c6c.
+
+### Filed upstream 2026-09-01 (pour-engine)
+
+| Class | Issue | Pull request |
+| --- | --- | --- |
+| button-name on `<button role="none" disabled>` (presentational-role conflict ignores `:disabled`) | [#3](https://github.com/pourdev/pour-engine/issues/3) | [#7](https://github.com/pourdev/pour-engine/pull/7) |
+| link-name: name from content ignores a descendant's `aria-labelledby` | [#4](https://github.com/pourdev/pour-engine/issues/4) | [#8](https://github.com/pourdev/pour-engine/pull/8) |
+| contrast on symbol-only text, single-letter icons, labels of disabled widgets | [#5](https://github.com/pourdev/pour-engine/issues/5) | [#9](https://github.com/pourdev/pour-engine/pull/9) |
+| valid-lang-parts on `lang` attributes that govern no text | [#6](https://github.com/pourdev/pour-engine/issues/6) | [#10](https://github.com/pourdev/pour-engine/pull/10) |
+
+### Filed upstream 2026-09-01 (surea11y core)
+
+| Class | Issue | Pull request |
+| --- | --- | --- |
+| `iframe-title-unique` fails frames sharing a title that embed the same resource (ACT 4b1c6c) | [#16](https://github.com/SureA11y/core/issues/16) | [#17](https://github.com/SureA11y/core/pull/17) |
+
+The maintainers document the strict behaviour as deliberate (`docs/ACT_RULE_MAPPING.md`), so the
+issue asks them to choose between aligning the rule with 4b1c6c (the PR) and deprecating it in
+favour of `identical-iframes-same-purpose`. Fixture branches live on the forks
+`wittjeff/pour-engine` and `wittjeff/core`.