From 343710dfb52c352880e40ce57ef3929323afd673 Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Tue, 8 Sep 2026 13:23:23 +0700
Subject: [PATCH 1/8] fix(agent): name a form control from the label that names
 it

A semantic name came from `aria-label`, `alt` and `title` and from nothing
else, so the ordinary way to label a field -- a `<label for>` beside it, or a
`<label>` wrapped around it -- produced no name at all. Every text input on
every page in the fleet arrived in the tree anonymous.

That is not only a reporting defect. A harness addresses a control by name,
so an anonymous field cannot be typed into, and a check that means "enter a
URL and save" cannot be written at all. Measured on support.cafe's connection
settings: three fields, each with a correct `<Label for>` beside it, all three
reported as `textbox ""`. Measured against a probe page as well, where a
`for` association, a wrapping label and a placeholder all produced nothing and
only `aria-label` worked.

Resolution order follows a browser's: `aria-label` first, because that is the
author overriding the visible text on purpose; then the label, `for` before
containment; then `alt` and `title`; then the text content of the roles that
are named by their own content; and a placeholder last, which is the only
thing naming a great many search fields and must never displace a real label.

The index is built once per snapshot. The question a control asks is "which
label points at me", and answering that from the control means scanning the
document for every named node. It is built over the whole document even for a
rooted inspection, because a label is frequently a sibling of the control
rather than a descendant of the node the caller rooted at.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/tauri-runtime-blitz/src/agent.rs   | 121 ++++++++++++++++++++--
 crates/tauri-runtime-blitz/src/runtime.rs |  65 +++++++++++-
 2 files changed, 177 insertions(+), 9 deletions(-)

diff --git a/crates/tauri-runtime-blitz/src/agent.rs b/crates/tauri-runtime-blitz/src/agent.rs
index 3f134be..073bb15 100644
--- a/crates/tauri-runtime-blitz/src/agent.rs
+++ b/crates/tauri-runtime-blitz/src/agent.rs
@@ -300,6 +300,10 @@ pub fn snapshot_document(
     let inner = document.inner();
     let layout_node_limit = inner.tree().iter().count();
     let active_element = inner.get_focussed_node_id().map(|id| id.as_u64());
+    // Once for the whole snapshot: the question a control asks is "which label
+    // points at me", and answering it from the control costs a document scan
+    // each time.
+    let labels = LabelIndex::build(&inner);
     let nodes: Vec<SemanticNode> = inner
         .tree()
         .iter()
@@ -335,7 +339,7 @@ pub fn snapshot_document(
                 dom_id: element_attr(element, "id").map(str::to_owned),
                 id: id.as_u64(),
                 parent: semantic_parent(&inner, id, None).map(|id| id.as_u64()),
-                name: semantic_name(element, node, &role),
+                name: semantic_name(element, node, &role, &inner, id, &labels),
                 role,
                 value,
                 enabled: element_attr(element, "disabled").is_none()
@@ -518,20 +522,118 @@ pub(crate) fn semantic_role(element: &blitz_dom::ElementData) -> String {
     .into()
 }
 
+/// Where the labels are, so a control can be asked what names it.
+///
+/// # Why this exists
+///
+/// A name was computed from `aria-label`, `alt` and `title` and from nothing
+/// else, so the ordinary way to label a form control -- a `<label for>` beside
+/// it, or a `<label>` wrapped around it -- produced no name at all. Every text
+/// field on every page in the fleet arrived in the semantic tree anonymous.
+///
+/// That is not only a reporting defect. A harness addresses a control by name,
+/// so an anonymous field cannot be typed into, and a check that means "enter a
+/// URL and save" cannot be written. Measured on support.cafe's connection
+/// settings: three `Input.Field`s, each with a correct `<Label for>` beside it,
+/// all three reported as `textbox ""`.
+///
+/// Built once per snapshot rather than searched per node, because the lookup is
+/// "which label points at me" and answering that from the control costs a scan
+/// of the document each time.
+#[cfg(all(feature = "agent-control", unix))]
+pub(crate) struct LabelIndex {
+    /// The `for` attribute's value, to that label's text.
+    by_control_id: std::collections::HashMap<String, String>,
+    /// Labels by node id, so an ancestor walk can recognise one it is inside.
+    labels: std::collections::HashMap<blitz_dom::NodeId, String>,
+}
+
+#[cfg(all(feature = "agent-control", unix))]
+impl LabelIndex {
+    pub(crate) fn build(document: &blitz_dom::BaseDocument) -> Self {
+        let mut by_control_id = std::collections::HashMap::new();
+        let mut labels = std::collections::HashMap::new();
+        for (id, node) in document.tree().iter() {
+            let Some(element) = node.element_data() else {
+                continue;
+            };
+            if element.name.local.as_ref() != "label" {
+                continue;
+            }
+            let text = node.text_content();
+            if let Some(control) = element_attr(element, "for") {
+                by_control_id.insert(control.to_owned(), text.clone());
+            }
+            labels.insert(id, text);
+        }
+        Self {
+            by_control_id,
+            labels,
+        }
+    }
+
+    /// The label text for a control, by association or by containment.
+    ///
+    /// `for` first, matching the order a browser resolves them in: an explicit
+    /// association wins over the label the control happens to sit inside.
+    fn name_for(
+        &self,
+        document: &blitz_dom::BaseDocument,
+        id: blitz_dom::NodeId,
+        element: &blitz_dom::ElementData,
+    ) -> Option<String> {
+        if let Some(dom_id) = element_attr(element, "id")
+            && let Some(text) = self.by_control_id.get(dom_id)
+        {
+            return Some(text.clone());
+        }
+        // A wrapping label, walked outward. Bounded rather than open, because
+        // a malformed tree must not cost a traversal per node.
+        let mut current = document.get_node(id)?.parent;
+        for _ in 0..16 {
+            let ancestor = current?;
+            if let Some(text) = self.labels.get(&ancestor) {
+                return Some(text.clone());
+            }
+            current = document.get_node(ancestor)?.parent;
+        }
+        None
+    }
+}
+
 #[cfg(all(feature = "agent-control", unix))]
 pub(crate) fn semantic_name(
     element: &blitz_dom::ElementData,
     node: &blitz_dom::Node,
     role: &str,
+    document: &blitz_dom::BaseDocument,
+    id: blitz_dom::NodeId,
+    labels: &LabelIndex,
 ) -> String {
     let name = element_attr(element, "aria-label")
-        .or_else(|| element_attr(element, "alt"))
-        .or_else(|| element_attr(element, "title"))
         .map(std::borrow::Cow::Borrowed)
+        // The label a form control was given. After `aria-label`, which is the
+        // author overriding the visible text on purpose, and before `title`,
+        // which is a tooltip rather than a name.
+        .or_else(|| {
+            labels
+                .name_for(document, id, element)
+                .map(std::borrow::Cow::Owned)
+        })
+        .or_else(|| element_attr(element, "alt").map(std::borrow::Cow::Borrowed))
+        .or_else(|| element_attr(element, "title").map(std::borrow::Cow::Borrowed))
         .or_else(|| {
             matches!(role, "button" | "link" | "heading" | "option")
                 .then(|| std::borrow::Cow::Owned(node.text_content()))
         })
+        // A placeholder is the last resort a browser falls back to, and it is
+        // the only thing naming a great many search and filter fields. Last, so
+        // it never displaces a real label.
+        .or_else(|| {
+            matches!(role, "textbox" | "combobox")
+                .then(|| element_attr(element, "placeholder").map(std::borrow::Cow::Borrowed))
+                .flatten()
+        })
         .unwrap_or_default();
     let mut normalized = String::with_capacity(name.len().min(512));
     let mut characters = 0;
@@ -833,6 +935,10 @@ pub fn inspect_document(
         return control_error("unknownNode", "the requested root node does not exist");
     }
     let focused_node = inner.get_focussed_node_id().map(|id| id.as_u64());
+    // Built over the whole document even when a subtree was asked for: a label
+    // is frequently a sibling of the control rather than a descendant of the
+    // node the caller rooted at.
+    let labels = LabelIndex::build(&inner);
     let node_limit = inner.tree().iter().count();
     let candidates = if let Some(root) = root {
         semantic_subtree_ids(&inner, root, max_depth)
@@ -865,7 +971,7 @@ pub fn inspect_document(
                     .as_ref()
                     .is_some_and(|rect| rect.width > 0.0 && rect.height > 0.0);
             let role = semantic_role(element);
-            let name = semantic_name(element, node, &role);
+            let name = semantic_name(element, node, &role, &inner, id, &labels);
             let value = semantic_value(element);
             Some(SemanticNode {
                 dom_id: element_attr(element, "id").map(str::to_owned),
@@ -1073,7 +1179,6 @@ pub(crate) fn resolve_agent_node_inner(
     ))
 }
 
-
 #[cfg(all(feature = "agent-control", unix))]
 pub(crate) fn pointer_event(
     position: (f32, f32),
@@ -1579,9 +1684,9 @@ mod tests {
         let flat = node_id(&document, "#flat");
         // The premise: this really is the degenerate case, not an accident of
         // the fixture. Without it a passing test proves nothing.
-        let rect = document.inner().get_client_bounding_rect(
-            blitz_dom::NodeId::from_u64(flat),
-        );
+        let rect = document
+            .inner()
+            .get_client_bounding_rect(blitz_dom::NodeId::from_u64(flat));
         assert!(
             rect.is_some_and(|rect| rect.width == 0.0 || rect.height == 0.0),
             "the flat button should lay out with no area"
diff --git a/crates/tauri-runtime-blitz/src/runtime.rs b/crates/tauri-runtime-blitz/src/runtime.rs
index 0565a24..9527aca 100644
--- a/crates/tauri-runtime-blitz/src/runtime.rs
+++ b/crates/tauri-runtime-blitz/src/runtime.rs
@@ -1699,7 +1699,70 @@ mod tests {
         let shown_node = inner.get_node(shown).unwrap();
         let shown_element = shown_node.element_data().unwrap();
         assert_eq!(semantic_role(shown_element), "button");
-        assert_eq!(semantic_name(shown_element, shown_node, "button"), "Run");
+        let labels = crate::agent::LabelIndex::build(&inner);
+        assert_eq!(
+            semantic_name(shown_element, shown_node, "button", &inner, shown, &labels),
+            "Run"
+        );
+    }
+
+    /// A form control is named by the label pointing at it.
+    ///
+    /// The name came from `aria-label`, `alt` and `title` and from nothing
+    /// else, so the ordinary way to label a field produced no name at all and
+    /// every text input on every page arrived anonymous. That is not only a
+    /// reporting defect: a harness addresses a control by name, so an
+    /// anonymous field cannot be typed into and a check that means "enter a URL
+    /// and save" cannot be written.
+    ///
+    /// Measured on support.cafe's connection settings, whose three fields each
+    /// carry a correct `<Label for>` and all reported as `textbox ""`.
+    #[cfg(all(feature = "agent-control", unix))]
+    #[test]
+    fn a_field_is_named_by_its_label() {
+        let mut document = ScriptDocument::from_html(
+            "<main>\
+               <label for='endpoint'>Endpoint URL</label><input id='endpoint'>\
+               <label>Wrapped<input id='wrapped'></label>\
+               <label for='overridden'>Ignored</label>\
+               <input id='overridden' aria-label='Author own name'>\
+               <input id='placeheld' placeholder='Search everything'>\
+               <input id='nameless'>\
+             </main>",
+            DocumentConfig::default(),
+        );
+        document.inner_mut().resolve(0.0);
+        let inner = document.inner();
+        let labels = crate::agent::LabelIndex::build(&inner);
+        let named = |value: &str| {
+            let id = inner
+                .tree()
+                .iter()
+                .find_map(|(id, node)| {
+                    node.element_data()
+                        .is_some_and(|element| element_attr(element, "id") == Some(value))
+                        .then_some(id)
+                })
+                .unwrap();
+            let node = inner.get_node(id).unwrap();
+            let element = node.element_data().unwrap();
+            let role = semantic_role(element);
+            semantic_name(element, node, &role, &inner, id, &labels)
+        };
+
+        assert_eq!(named("endpoint"), "Endpoint URL", "a `for` association");
+        assert_eq!(named("wrapped"), "Wrapped", "a label wrapped around it");
+        assert_eq!(
+            named("overridden"),
+            "Author own name",
+            "`aria-label` is the author overriding the visible text, and wins"
+        );
+        assert_eq!(
+            named("placeheld"),
+            "Search everything",
+            "a placeholder is the last resort, and names most search fields"
+        );
+        assert_eq!(named("nameless"), "", "nothing names it, so it has no name");
     }
 
     #[cfg(all(feature = "agent-control", unix))]

From 2020ea47d14df2c7c61cac6d98d9f3643c97d667 Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Tue, 8 Sep 2026 13:25:03 +0700
Subject: [PATCH 2/8] fix(agent): name a live region by what it says

`alert` and `status` are the roles an application uses to report that
something happened -- a refusal, a saved confirmation -- and what they report
is their content. They arrived anonymous, so "the reason is shown" was not a
question a check could ask, and every validation outcome had to be
approximated by something else that moved at the same time.

Found writing checks for support.cafe's connection settings, where the
refusal and the success message are both bare paragraphs. Marking them as
live regions is the accessibility fix on the site's side; naming them is this
side of it.

Deliberately not `generic`. A wrapper's text content is its whole subtree, so
naming containers would give every one of them a name made of the entire
page, and any name-matching selector would then match everything. The test
pins that half too.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/tauri-runtime-blitz/src/agent.rs   | 19 ++++++++-
 crates/tauri-runtime-blitz/src/runtime.rs | 51 +++++++++++++++++++++++
 2 files changed, 68 insertions(+), 2 deletions(-)

diff --git a/crates/tauri-runtime-blitz/src/agent.rs b/crates/tauri-runtime-blitz/src/agent.rs
index 073bb15..3fced8f 100644
--- a/crates/tauri-runtime-blitz/src/agent.rs
+++ b/crates/tauri-runtime-blitz/src/agent.rs
@@ -622,9 +622,24 @@ pub(crate) fn semantic_name(
         })
         .or_else(|| element_attr(element, "alt").map(std::borrow::Cow::Borrowed))
         .or_else(|| element_attr(element, "title").map(std::borrow::Cow::Borrowed))
+        // Named by their own content.
+        //
+        // `alert` and `status` are here because they are the roles an
+        // application uses to say something happened -- a refusal, a saved
+        // confirmation -- and what they say is their content. Without them a
+        // live region arrives anonymous, so "the reason is shown" is not a
+        // question that can be asked, and every validation outcome in a suite
+        // has to be approximated by something else that moved.
+        //
+        // Deliberately not `generic`. A wrapper's text content is its entire
+        // subtree, so naming those would give every container on the page a
+        // name made of the whole page.
         .or_else(|| {
-            matches!(role, "button" | "link" | "heading" | "option")
-                .then(|| std::borrow::Cow::Owned(node.text_content()))
+            matches!(
+                role,
+                "button" | "link" | "heading" | "option" | "alert" | "status"
+            )
+            .then(|| std::borrow::Cow::Owned(node.text_content()))
         })
         // A placeholder is the last resort a browser falls back to, and it is
         // the only thing naming a great many search and filter fields. Last, so
diff --git a/crates/tauri-runtime-blitz/src/runtime.rs b/crates/tauri-runtime-blitz/src/runtime.rs
index 9527aca..0b4cc30 100644
--- a/crates/tauri-runtime-blitz/src/runtime.rs
+++ b/crates/tauri-runtime-blitz/src/runtime.rs
@@ -1765,6 +1765,57 @@ mod tests {
         assert_eq!(named("nameless"), "", "nothing names it, so it has no name");
     }
 
+    /// A live region is named by what it says.
+    ///
+    /// `alert` and `status` are the roles an application uses to report that
+    /// something happened -- a refusal, a saved confirmation -- and what they
+    /// report is their content. Anonymous, "the reason is shown" is not a
+    /// question a check can ask, so every validation outcome has to be
+    /// approximated by something else that moved.
+    ///
+    /// The negative half is the point of the test. A wrapper's text content is
+    /// its whole subtree, so naming generic containers would give every one of
+    /// them a name made of the entire page, and any name-matching selector
+    /// would then match everything.
+    #[cfg(all(feature = "agent-control", unix))]
+    #[test]
+    fn a_live_region_is_named_by_what_it_says() {
+        let mut document = ScriptDocument::from_html(
+            "<main>\
+               <p id='refusal' role='alert'>that is not an address</p>\
+               <p id='saved' role='status'>Settings saved</p>\
+               <div id='wrapper'><span>inner text</span></div>\
+             </main>",
+            DocumentConfig::default(),
+        );
+        document.inner_mut().resolve(0.0);
+        let inner = document.inner();
+        let labels = crate::agent::LabelIndex::build(&inner);
+        let named = |value: &str| {
+            let id = inner
+                .tree()
+                .iter()
+                .find_map(|(id, node)| {
+                    node.element_data()
+                        .is_some_and(|element| element_attr(element, "id") == Some(value))
+                        .then_some(id)
+                })
+                .unwrap();
+            let node = inner.get_node(id).unwrap();
+            let element = node.element_data().unwrap();
+            let role = semantic_role(element);
+            semantic_name(element, node, &role, &inner, id, &labels)
+        };
+
+        assert_eq!(named("refusal"), "that is not an address");
+        assert_eq!(named("saved"), "Settings saved");
+        assert_eq!(
+            named("wrapper"),
+            "",
+            "a container named by its subtree would make every selector match everything"
+        );
+    }
+
     #[cfg(all(feature = "agent-control", unix))]
     #[test]
     fn rooted_inspection_returns_only_the_requested_dom_subtree() {

From bfbae89ea9e413405b7ed5bca12ef6c1ca9966d6 Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Tue, 8 Sep 2026 14:40:34 +0700
Subject: [PATCH 3/8] release: 0.3.7

A version bump on master is the release trigger, and this is what carries the
naming fixes to the harness that needs them: without them every form field in
the fleet arrives anonymous and cannot be addressed by name at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 Cargo.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index 535825d..81f1c6c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ resolver = "3"
 members = ["crates/tauri-runtime-blitz"]
 
 [workspace.package]
-version = "0.3.6"
+version = "0.3.7"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 publish = true

From 485cf41a3704e97da22e26e29325f0cc7308fa1a Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Tue, 8 Sep 2026 16:54:58 +0700
Subject: [PATCH 4/8] fix(agent): build a name from rendered text, not from
 textContent

`textContent` is the DOM property and includes every text node in the
subtree, `<style>` and `<script>` among them. An accessible name does
not, because those elements are not rendered.

Measured on honey.id, whose header logo is an anchor wrapping an inline
SVG with a `<style>` in it. The site's home link arrived named
".animated-logo path { fill-opacity: 0; stroke: currentColor; ... }",
which is unusable to a person reading the page and unaddressable to a
check trying to press it. Any site whose logo is an inline SVG with
scoped styles has the same link.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/tauri-runtime-blitz/src/agent.rs   | 37 +++++++++++++++++-
 crates/tauri-runtime-blitz/src/runtime.rs | 47 +++++++++++++++++++++++
 2 files changed, 83 insertions(+), 1 deletion(-)

diff --git a/crates/tauri-runtime-blitz/src/agent.rs b/crates/tauri-runtime-blitz/src/agent.rs
index 3fced8f..8db437f 100644
--- a/crates/tauri-runtime-blitz/src/agent.rs
+++ b/crates/tauri-runtime-blitz/src/agent.rs
@@ -602,6 +602,41 @@ impl LabelIndex {
 }
 
 #[cfg(all(feature = "agent-control", unix))]
+/// The text a name is made of, which is not the same as `textContent`.
+///
+/// `textContent` is the DOM property and includes every text node under the
+/// element, `<style>` and `<script>` among them. An accessible name does not:
+/// those elements are not rendered, and a name computation that walks into
+/// them reads out a stylesheet.
+///
+/// Measured on honey.id, whose header logo is an anchor wrapping an inline SVG
+/// with a `<style>` in it. The site's home link arrived named
+/// ".animated-logo path { fill-opacity: 0; stroke: currentColor; ... }", which
+/// is unusable to a person and unaddressable to a check.
+fn name_text(node: &blitz_dom::Node, document: &blitz_dom::BaseDocument) -> String {
+    fn write(node: &blitz_dom::Node, document: &blitz_dom::BaseDocument, out: &mut String) {
+        if let Some(element) = node.element_data()
+            && matches!(
+                element.name.local.as_ref(),
+                "style" | "script" | "template" | "noscript"
+            )
+        {
+            return;
+        }
+        if let blitz_dom::node::NodeData::Text(text) = &node.data {
+            out.push_str(&text.content);
+        }
+        for child in &node.children {
+            if let Some(child) = document.get_node(*child) {
+                write(child, document, out);
+            }
+        }
+    }
+    let mut out = String::new();
+    write(node, document, &mut out);
+    out
+}
+
 pub(crate) fn semantic_name(
     element: &blitz_dom::ElementData,
     node: &blitz_dom::Node,
@@ -639,7 +674,7 @@ pub(crate) fn semantic_name(
                 role,
                 "button" | "link" | "heading" | "option" | "alert" | "status"
             )
-            .then(|| std::borrow::Cow::Owned(node.text_content()))
+            .then(|| std::borrow::Cow::Owned(name_text(node, document)))
         })
         // A placeholder is the last resort a browser falls back to, and it is
         // the only thing naming a great many search and filter fields. Last, so
diff --git a/crates/tauri-runtime-blitz/src/runtime.rs b/crates/tauri-runtime-blitz/src/runtime.rs
index 0b4cc30..31c933c 100644
--- a/crates/tauri-runtime-blitz/src/runtime.rs
+++ b/crates/tauri-runtime-blitz/src/runtime.rs
@@ -1706,6 +1706,53 @@ mod tests {
         );
     }
 
+    /// A name is made of rendered text, so a `<style>` inside a link is not
+    /// part of it.
+    ///
+    /// `textContent` is the DOM property and includes every text node in the
+    /// subtree, stylesheets and scripts among them. An accessible name does
+    /// not, because those elements are not rendered.
+    ///
+    /// Measured on honey.id, whose header logo is an anchor wrapping an inline
+    /// SVG with a `<style>` in it. The home link arrived named
+    /// ".animated-logo path { fill-opacity: 0; ... }", which is unusable to a
+    /// person and unaddressable to a check.
+    #[cfg(all(feature = "agent-control", unix))]
+    #[test]
+    fn a_style_element_is_not_part_of_a_name() {
+        let mut document = ScriptDocument::from_html(
+            "<main>\
+               <a id='logo' href='/'>\
+                 <svg><style>.logo path { fill: red; }</style></svg>\
+                 Honey\
+               </a>\
+               <a id='scripted' href='/x'><script>var noise = 1;</script>Docs</a>\
+             </main>",
+            DocumentConfig::default(),
+        );
+        document.inner_mut().resolve(0.0);
+        let inner = document.inner();
+        let labels = crate::agent::LabelIndex::build(&inner);
+        let named = |value: &str| {
+            let id = inner
+                .tree()
+                .iter()
+                .find_map(|(id, node)| {
+                    node.element_data()
+                        .is_some_and(|element| element_attr(element, "id") == Some(value))
+                        .then_some(id)
+                })
+                .unwrap();
+            let node = inner.get_node(id).unwrap();
+            let element = node.element_data().unwrap();
+            let role = semantic_role(element);
+            semantic_name(element, node, &role, &inner, id, &labels)
+        };
+
+        assert_eq!(named("logo"), "Honey", "a stylesheet is not part of a name");
+        assert_eq!(named("scripted"), "Docs", "and neither is a script");
+    }
+
     /// A form control is named by the label pointing at it.
     ///
     /// The name came from `aria-label`, `alt` and `title` and from nothing

From da6966f38d8bf64340c4aa10f0983a07ba85c69a Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Tue, 8 Sep 2026 18:14:51 +0700
Subject: [PATCH 5/8] fix(agent): separate a name's block-level lines with a
 space

An alert stacking two lines arrived named "This page could not
loadWebSocket connection failed", because every text node under the
element was concatenated with nothing between it and the next. A name
that reads as one run-on word is one a person cannot read and a check
cannot address.

accname separates each descendant's contribution with a space unless
the descendant is inline, which is why two adjacent spans are still one
word. The walk now asks the resolved style which of the two a child is,
and treats an element with no style as inline so a name never gains a
space the page does not draw.

Measured on crates.vip's failure alert.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/tauri-runtime-blitz/src/agent.rs   | 39 +++++++++++++++--
 crates/tauri-runtime-blitz/src/runtime.rs | 53 +++++++++++++++++++++++
 2 files changed, 88 insertions(+), 4 deletions(-)

diff --git a/crates/tauri-runtime-blitz/src/agent.rs b/crates/tauri-runtime-blitz/src/agent.rs
index 8db437f..4b72490 100644
--- a/crates/tauri-runtime-blitz/src/agent.rs
+++ b/crates/tauri-runtime-blitz/src/agent.rs
@@ -611,9 +611,30 @@ impl LabelIndex {
 ///
 /// Measured on honey.id, whose header logo is an anchor wrapping an inline SVG
 /// with a `<style>` in it. The site's home link arrived named
-/// ".animated-logo path { fill-opacity: 0; stroke: currentColor; ... }", which
-/// is unusable to a person and unaddressable to a check.
+/// ".animated-logo path { fill-opacity: 0; stroke: currentColor; ... }",
+/// which is unusable to a person and unaddressable to a check.
+///
+/// Measured on crates.vip, whose failure alert stacks two block-level lines.
+/// It arrived named "This page could not loadWebSocket connection failed",
+/// because every text node was concatenated with nothing between it and the
+/// next. A browser puts a space there: accname appends each descendant's
+/// contribution separated by a space unless the descendant is inline, which
+/// is why "<span>a</span><span>b</span>" is still "ab".
 fn name_text(node: &blitz_dom::Node, document: &blitz_dom::BaseDocument) -> String {
+    /// Whether this node's contribution runs into its siblings' or stands
+    /// apart from them. Text and inline-level elements run together; anything
+    /// laid out as a block, a flex item's container, a table cell and so on
+    /// is a separate run. An element with no resolved style is treated as
+    /// inline, which keeps a name from gaining spaces that are not there.
+    fn is_inline(node: &blitz_dom::Node) -> bool {
+        if node.element_data().is_none() {
+            return true;
+        }
+        node.primary_styles().is_none_or(|styles| {
+            styles.clone_display().outside() == style::values::specified::box_::DisplayOutside::Inline
+        })
+    }
+
     fn write(node: &blitz_dom::Node, document: &blitz_dom::BaseDocument, out: &mut String) {
         if let Some(element) = node.element_data()
             && matches!(
@@ -627,8 +648,18 @@ fn name_text(node: &blitz_dom::Node, document: &blitz_dom::BaseDocument) -> Stri
             out.push_str(&text.content);
         }
         for child in &node.children {
-            if let Some(child) = document.get_node(*child) {
-                write(child, document, out);
+            let Some(child) = document.get_node(*child) else {
+                continue;
+            };
+            // A boundary either side, so a block between two others is
+            // separated from both. `normalize_name` collapses the runs.
+            let separate = !is_inline(child);
+            if separate {
+                out.push(' ');
+            }
+            write(child, document, out);
+            if separate {
+                out.push(' ');
             }
         }
     }
diff --git a/crates/tauri-runtime-blitz/src/runtime.rs b/crates/tauri-runtime-blitz/src/runtime.rs
index 31c933c..e294d92 100644
--- a/crates/tauri-runtime-blitz/src/runtime.rs
+++ b/crates/tauri-runtime-blitz/src/runtime.rs
@@ -1753,6 +1753,59 @@ mod tests {
         assert_eq!(named("scripted"), "Docs", "and neither is a script");
     }
 
+    /// Two stacked lines make two words, not one run-on word.
+    ///
+    /// crates.vip's failure alert is a column of two block-level lines, and it
+    /// arrived named "This page could not loadWebSocket connection failed":
+    /// every text node was concatenated with nothing between it and the next.
+    /// A name a person cannot read is a name a check cannot address.
+    ///
+    /// The inline case is the other half of the assertion, and it is what
+    /// stops the fix being "put a space everywhere": a name built from two
+    /// spans is still one word, because that is what the page draws.
+    #[test]
+    fn stacked_lines_are_separated_and_inline_ones_are_not() {
+        let mut document = ScriptDocument::from_html(
+            "<main>\
+               <div id='stacked' role='alert'>\
+                 <div>This page could not load</div>\
+                 <div>WebSocket connection failed</div>\
+               </div>\
+               <div id='inline' role='alert'><span>Work</span><span>Tables</span></div>\
+             </main>",
+            DocumentConfig::default(),
+        );
+        document.inner_mut().resolve(0.0);
+        let inner = document.inner();
+        let labels = crate::agent::LabelIndex::build(&inner);
+        let named = |value: &str| {
+            let id = inner
+                .tree()
+                .iter()
+                .find_map(|(id, node)| {
+                    node.element_data()
+                        .is_some_and(|element| element_attr(element, "id") == Some(value))
+                        .then_some(id)
+                })
+                .unwrap();
+            let node = inner.get_node(id).unwrap();
+            let element = node.element_data().unwrap();
+            let role = semantic_role(element);
+            semantic_name(element, node, &role, &inner, id, &labels)
+        };
+
+        assert_eq!(
+            named("stacked"),
+            "This page could not load WebSocket connection failed",
+            "block-level lines are separate words"
+        );
+        assert_eq!(
+            named("inline"),
+            "WorkTables",
+            "inline spans are one word, as the page draws them"
+        );
+    }
+
     /// A form control is named by the label pointing at it.
     ///
     /// The name came from `aria-label`, `alt` and `title` and from nothing

From 2bf5fbee8385e3e02db7177388f5bc9d55d4a93d Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Tue, 8 Sep 2026 18:21:42 +0700
Subject: [PATCH 6/8] fix(agent): treat an atomic inline as its own run in a
 name

`inline-block` and `inline-flex` establish their own box, so a browser
separates them from their siblings the way it separates a block. The
first pass asked only whether the display was outside-inline, which put
an inline-block back in the same word as its neighbour.

Checked against `dom-accessibility-api`, which reaches the same result
by comparing the computed display against the string "inline", and
against the pair of names crates.vip's navbar and its failure alert
produce.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/tauri-runtime-blitz/src/agent.rs   |  9 ++++++++-
 crates/tauri-runtime-blitz/src/runtime.rs | 13 +++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/crates/tauri-runtime-blitz/src/agent.rs b/crates/tauri-runtime-blitz/src/agent.rs
index 4b72490..e455172 100644
--- a/crates/tauri-runtime-blitz/src/agent.rs
+++ b/crates/tauri-runtime-blitz/src/agent.rs
@@ -627,11 +627,18 @@ fn name_text(node: &blitz_dom::Node, document: &blitz_dom::BaseDocument) -> Stri
     /// is a separate run. An element with no resolved style is treated as
     /// inline, which keeps a name from gaining spaces that are not there.
     fn is_inline(node: &blitz_dom::Node) -> bool {
+        use style::values::specified::box_::{DisplayInside, DisplayOutside};
         if node.element_data().is_none() {
             return true;
         }
         node.primary_styles().is_none_or(|styles| {
-            styles.clone_display().outside() == style::values::specified::box_::DisplayOutside::Inline
+            let display = styles.clone_display();
+            // Inline flow only. `inline-block` and `inline-flex` are atomic
+            // inlines: they establish their own box and a browser separates
+            // them from their siblings, which is the same rule
+            // `dom-accessibility-api` applies by comparing the computed
+            // display against the string "inline".
+            display.outside() == DisplayOutside::Inline && display.inside() == DisplayInside::Flow
         })
     }
 
diff --git a/crates/tauri-runtime-blitz/src/runtime.rs b/crates/tauri-runtime-blitz/src/runtime.rs
index e294d92..67c92bc 100644
--- a/crates/tauri-runtime-blitz/src/runtime.rs
+++ b/crates/tauri-runtime-blitz/src/runtime.rs
@@ -1762,6 +1762,10 @@ mod tests {
     ///
     /// The inline case is the other half of the assertion, and it is what
     /// stops the fix being "put a space everywhere": a name built from two
+    ///
+    /// `inline-block` is the third case, and it is why the test is not
+    /// "outside is inline": an atomic inline establishes its own box, so a
+    /// browser separates it the way it separates a block.
     /// spans is still one word, because that is what the page draws.
     #[test]
     fn stacked_lines_are_separated_and_inline_ones_are_not() {
@@ -1772,6 +1776,10 @@ mod tests {
                  <div>WebSocket connection failed</div>\
                </div>\
                <div id='inline' role='alert'><span>Work</span><span>Tables</span></div>\
+               <div id='atomic' role='alert'>\
+                 <span style='display: inline-block'>Registry</span>\
+                 <span style='display: inline-block'>unavailable</span>\
+               </div>\
              </main>",
             DocumentConfig::default(),
         );
@@ -1804,6 +1812,11 @@ mod tests {
             "WorkTables",
             "inline spans are one word, as the page draws them"
         );
+        assert_eq!(
+            named("atomic"),
+            "Registry unavailable",
+            "an inline-block is an atomic inline, and a browser separates it"
+        );
     }
 
     /// A form control is named by the label pointing at it.

From ca251506fe7b6106a1914e1aa8247468865501dd Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Wed, 9 Sep 2026 06:08:18 +0700
Subject: [PATCH 7/8] fix(agent): name a menu item, tab and tree item from
 their own content

The "named by their own content" list had `option` but not its menu, tab and
tree equivalents, and `semantic_role` returns the `role` attribute verbatim. So
`<button role="menuitem">Platform Admin</button>` arrived with an empty name:
a screen reader announces nothing, and no check can name the option it means to
press. Writing the role is the author opting out of the native naming this list
exists to provide, which is exactly when it is needed.

Reduced from honey.id, where the role selector on the platform users table
offered two anonymous entries and promoting a user could not be driven or
described. It is not specific to that dropdown: every `Dropdown.Item` in
@pathscale/ui carries `role="menuitem"`, so the whole fleet was affected.

Confirmed against a minimal fixture, where a plain `<button>` and an `<a>` were
named and all three of `<button role="menuitem">`, the same wrapped in a span,
and `<div role="menuitem">` were not. All three are named now.

`cell` and `row` stay off the list. Their content is a whole subtree, which is
the objection the comment above already raises against `generic`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/tauri-runtime-blitz/src/agent.rs | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/crates/tauri-runtime-blitz/src/agent.rs b/crates/tauri-runtime-blitz/src/agent.rs
index e455172..a93612a 100644
--- a/crates/tauri-runtime-blitz/src/agent.rs
+++ b/crates/tauri-runtime-blitz/src/agent.rs
@@ -710,7 +710,30 @@ pub(crate) fn semantic_name(
         .or_else(|| {
             matches!(
                 role,
-                "button" | "link" | "heading" | "option" | "alert" | "status"
+                "button"
+                    | "link"
+                    | "heading"
+                    | "option"
+                    | "alert"
+                    | "status"
+                    // The menu, tab and tree equivalents of `option`. ARIA names all
+                    // of these from their own content, and leaving them out
+                    // made every dropdown item in the fleet anonymous: a
+                    // `<button role="menuitem">Platform Admin</button>` came
+                    // back with an empty name, so a screen reader announced
+                    // nothing and no check could name the option it meant to
+                    // press. `semantic_role` returns the `role` attribute
+                    // verbatim, so an author who writes one of these opts out
+                    // of the native naming this list is meant to provide.
+                    //
+                    // Still deliberately absent: `cell` and `row`. Their
+                    // content is a whole subtree, which is the same objection
+                    // the comment above raises against `generic`.
+                    | "menuitem"
+                    | "menuitemcheckbox"
+                    | "menuitemradio"
+                    | "tab"
+                    | "treeitem"
             )
             .then(|| std::borrow::Cow::Owned(name_text(node, document)))
         })

From 8801a0af07f6497cd8a971ad182a038c688d93dd Mon Sep 17 00:00:00 2001
From: meh <no-reply@pathscale.com>
Date: Wed, 9 Sep 2026 09:23:33 +0700
Subject: [PATCH 8/8] fix(agent): an empty label is not a name

`name_for` returned the first label it found, empty or not, and stopped. Labels
nested inside labels are invalid markup but they happen: a checkbox component that
draws its own `<label>` around a styled box, wrapped again by the page to put the
text beside it. The inner label's content is the box, so it is empty, and
returning that emptiness made the control anonymous while its name sat one level
further out.

Skipping an empty label costs nothing when the markup is well formed, because a
real label has text. The same guard on the `for` lookup, for the same reason.

Found in honey.id, where the sign-up form's accept-terms checkbox came back with
no name and nothing announced what was being accepted. That page is fixed at
source too -- the text belongs to the checkbox -- but a control should not go
anonymous because the markup around it is careless.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/tauri-runtime-blitz/src/agent.rs | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/crates/tauri-runtime-blitz/src/agent.rs b/crates/tauri-runtime-blitz/src/agent.rs
index a93612a..785784d 100644
--- a/crates/tauri-runtime-blitz/src/agent.rs
+++ b/crates/tauri-runtime-blitz/src/agent.rs
@@ -584,15 +584,26 @@ impl LabelIndex {
     ) -> Option<String> {
         if let Some(dom_id) = element_attr(element, "id")
             && let Some(text) = self.by_control_id.get(dom_id)
+            && !text.trim().is_empty()
         {
             return Some(text.clone());
         }
         // A wrapping label, walked outward. Bounded rather than open, because
         // a malformed tree must not cost a traversal per node.
+        //
+        // An empty label does not stop the walk. Labels nested inside labels
+        // are invalid markup, but they happen: a checkbox component that draws
+        // its own `<label>` around a styled box, wrapped again by the page to
+        // add the text beside it. The inner label has no text, and returning
+        // its emptiness here made the control anonymous while a name sat one
+        // level further out. Skipping it costs nothing when the markup is
+        // well formed, because a real label has text.
         let mut current = document.get_node(id)?.parent;
         for _ in 0..16 {
             let ancestor = current?;
-            if let Some(text) = self.labels.get(&ancestor) {
+            if let Some(text) = self.labels.get(&ancestor)
+                && !text.trim().is_empty()
+            {
                 return Some(text.clone());
             }
             current = document.get_node(ancestor)?.parent;