diff --git a/docs/superpowers/specs/2026-08-16-a11y-rule-validity-review.md b/docs/superpowers/specs/2026-08-16-a11y-rule-validity-review.md
new file mode 100644
index 000000000..b3c0eb41a
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-16-a11y-rule-validity-review.md
@@ -0,0 +1,114 @@
+# a11y rule-validity review — all 15 rules
+
+Date: 2026-08-16
+Status: Review record (findings only — fixes tracked separately)
+Phase B-4 of `2026-08-16-v1-roadmap.md`. The a11y category shipped **after**
+`2026-08-09-v1-rule-validity-review.md`, so it never had that pass; this is it, at the same
+standard.
+
+Method: four parallel reviewers (ARIA-data rules · element-level rules · route/project rules ·
+cross-cutting docs/severity/messages), every Svelte claim checked against the Svelte MCP
+documentation server, every web-standards claim verified by fetching a primary source (tagged
+`[fetched]` in the reviewers' records) or labeled `[unverified-knowledge]`, every shipped and
+documented snippet run through `svelte-autofixer`, and every detection claim re-run against the
+built `packages/core/dist` before this record was written. The coordinator independently reproduced
+the element-level and route-scoped Priority 1 rows.
+
+**Headline: 3 of 15 rules carry no Priority 1 defect; 12 do.** That is a materially worse ratio
+than the August review's 38-of-73, and the reason is structural rather than accidental — see the
+pattern below. No rule is misconceived: every row is fixable by narrowing detection, extending a
+data table, or correcting prose.
+
+## The pattern worth naming
+
+The category's own design principle is **"false negatives are acceptable, false positives are
+not"** (`2026-08-14-a11y-category-design.md`). **Twelve of the fourteen Priority 1 rows are false
+positives** — every row but 2 (a false negative) and 14 (a docs defect) — and they cluster in three
+mechanisms:
+
+1. **A pinned data source that has drifted from the spec.** `aria-query@5.3.2` is not the clean
+   ARIA 1.2 snapshot it was taken for — it is a mixed one (1.2's 48 attributes plus three 1.3
+   additions, and the 1.3-only role `mark`), while missing five roles and two attributes that
+   ship in browsers today. Three P1 rows come from this alone. The v1 roadmap already flags the
+   data-source decision as a pre-1.0 dependency question (Phase C item 9); this review is the
+   evidence for taking it seriously.
+2. **A literal-only read where the sibling read accepts an expression.** `accessible-name` accepts
+   any expression for `aria-label`, but only a literal for `alt` — so the idiomatic
+   `<img alt={siteName}>` inside a link is "unnamed". The rule contradicts its own principle
+   within one function.
+3. **"Absent" conflated with "unknowable".** Legacy `<slot />`, `<svelte:fragment />`, and
+   form-associated custom elements are treated as empty content rather than content the analyzer
+   cannot see — the exact distinction the same functions already draw correctly for components.
+
+## Priority 1 — detection/premise defects with user-facing harm
+
+| #   | rule                                    | defect                                                                                                                                                                                                                                                                                                                                                         | disposition                                                                                                                                                                                                              |
+| --- | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| 1   | `duplicate-landmark` + `id-duplication` | **The docs promise something the engine cannot deliver, verbatim in en and ja:** "so mutually exclusive branches never fire a false duplicate". Exclusivity is syntactic only — `{:else if}` chains fold into one group, but two adjacent guards do not: `{#if a}<main/>{/if}{#if !a}<main/>{/if}` reports `Duplicate main landmark (2 of 2)`.                 | No cheap sound test for `!a` vs `a` exists. Delete the promise from all four pages and fold it into the existing "can pick a branch that would not actually render" caveat, which is the true statement.                 |
+| 2   | `top-level-landmark`                    | **A bare `<aside>` is not a landmark in either mode**, so the rule's flagship scenario is undetectable in the markup people write. HTML-AAM maps `aside` scoped to `body`/`main` to `complementary`; APG says complementary should be top level. Worse, the docs' `<aside role="complementary">` example is flagged by Svelte's own `a11y_no_redundant_roles`. | Add `aside → complementary` to the source `LANDMARK_TAGS` and the rendered walk. Strictly widening. Rewrite the docs example to bare `<aside>` (en+ja).                                                                  |
+| 3   | `required-aria-props`                   | **`option` and `treeitem` carry stale ARIA 1.1 `aria-selected` requirements**, so APG-idiomatic listbox and tree markup is flagged. Neither 1.2 nor the 1.3 ED lists required props for those roles — and the ED's explicit re-listing of `menuitemradio → aria-checked` proves the tables do restate inherited requirements, so the absence is deliberate.    | Override both rows in `aria-data.ts` (a small spec-fixed table, same shape as `HOST_SUPPLIED`). Narrowing, so recorded suppressions stay valid.                                                                          |
+| 4   | `invalid-role`                          | **Role fallback lists are flagged even when a valid role wins.** ARIA: user agents use the first token matching a non-abstract role — the list form exists for progressive enhancement. `role="unknown-thing button"` and `role="widget checkbox"` both fire on correct markup.                                                                                | Flag only when no token resolves to a concrete role. Strictly narrowing. If per-token hygiene is wanted instead, it must be `info` and the docs must say the markup still works.                                         |
+| 5   | `invalid-role`                          | **Five roles the 1.3 ED defines are rejected**: `comment`, `image`, `sectionheader`, `sectionfooter`, `suggestion`. `image` is the sharp one — html-aria added it as the **preferred synonym** for `img`, so the tool rejects the name the spec now prefers.                                                                                                   | One `ARIA_1_3_ADDITIONS` allowlist in `aria-data.ts`, shared with row 6, commented with the aria-query version it patches.                                                                                               |
+| 6   | `unknown-aria-attribute`                | **Warns on two attributes that exist, ship, and are documented**: `aria-colindextext`, `aria-rowindextext` (MDN documents both, with IDL reflections). The message says "not a WAI-ARIA attribute" unqualified, so a user cannot tell the tool means "1.2 only".                                                                                               | Same allowlist as row 5, or qualify the message to ARIA 1.2 and document the gap. The allowlist is the smaller diff and the honest behaviour.                                                                            |
+| 7   | `accessible-name`                       | **An expression-valued `alt` is invisible as a name source.** `<a href="/about"><img src="/logo.png" alt={siteName} /></a>` is flagged unnamed; the same element with a literal `alt` is clean. The rule accepts any expression for `aria-label`/`aria-labelledby`/`title` — the two `alt` reads are the exception.                                            | Mirror `hasNamingAttr`: an expression `alt` is a present name source. Strictly narrowing.                                                                                                                                |
+| 8   | `accessible-name`                       | **A `<label>` names a `button` and an `input type="image"`** — it is step 2 of their accname computation — but both wrapped and `for=`-associated forms are flagged. (`<a>` has no label route, so `<a>` targets are spec-complete.)                                                                                                                           | The wrapped case is a same-file fix (track `<label>` ancestry). The `for=` case is cross-element: reuse the route id map, or document it under "Not flagged" rather than only in Disabling.                              |
+| 9   | `accessible-name` + `label-has-control` | **Legacy `<slot />` / `<svelte:fragment />` is read as empty, not unknowable**, so `<button><slot /></button>` and `<label>Name<slot name="control" /></label>` are flagged though the parent supplies the content. A `<slot>` with fallback text correctly passes.                                                                                            | Add `SlotElement`/`SvelteFragment` to the unknowable set in both subtree scanners — the rule these functions already apply to components.                                                                                |
+| 10  | `label-has-control`                     | **Form-associated custom elements are omitted from `LABELABLE_TAGS`**, so `<label>Name <my-input></my-input></label>` is flagged. Spec lists them as labelable, and Svelte's own `customElement.extend` + `formAssociated` recipe produces exactly this.                                                                                                       | Treat a descendant whose tag contains `-` as unknowable — one condition. Consider the same for `accessible-name`, where such a tag also has a shadow-DOM name route.                                                     |
+| 11  | `interactive-nesting`                   | **`role="gridcell"` and `role="combobox"` open a nesting container**, so the APG grid pattern (`<div role="gridcell"><button>`) and the ARIA 1.1 wrapping combobox are flagged. The container set reuses the whole `INTERACTIVE_ROLES`; the roles that actually suppress descendants are the Children-Presentational set, which excludes both.                 | Split a `CONTAINER_ROLES` constant from `INTERACTIVE_ROLES`; at minimum drop `gridcell` and `combobox`. Full re-derivation from the children-presentational list (plus `link`) is a maintainer call.                     |
+| 12  | `require-datetime`                      | **5 of the spec's 10 permitted `<time>` content syntaxes are implemented**, so valid content is reported "not machine-readable": time-zone offset (`+09:00`), week (`2026-W33`), the alternative duration form (`4h 18m 3s`), and years of four **or more** digits (`12026`). The alternative duration form is the realistic one — recipes, media lengths.     | Extend the table with the three grammars and relax the year regex to `\d{4,}`. Strictly narrowing.                                                                                                                       |
+| 13  | `use-list`                              | **Fires on text that merely follows an expression**, and inside code contexts. `<p>{count} - results found</p>` is flagged because the trimmed text node is `- results found`; `<pre>- removed</pre>`, `<code>`, `<kbd>`, `<samp>`, `<textarea>` likewise. `info` limits the harm, but the premise "this text is a bullet" is false.                           | Skip a text node whose previous sibling is an `ExpressionTag`; exempt `pre`/`code`/`kbd`/`samp`/`textarea` ancestry. Do **not** require "first significant child" — that kills the `<br>`-separated case WCAG H48 names. |
+| 14  | `placeholder-label-option`              | **The documented fix does not fix anything.** Both languages teach `<option value="" disabled>Choose…</option>` as the first option. The select reset algorithm skips a disabled option, the browser selects the next one, `required` is satisfied, and the user submits a value they never chose — the exact harm the rule describes. Verified in jsdom.      | Drop `disabled`, or write `disabled selected` (both verified correct). Docs-only, en+ja; the rule's own `recommendation` is already right.                                                                               |
+
+## Priority 2 — severity and framing decisions (maintainer calls)
+
+| #   | rule                  | question                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| --- | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 15  | `require-datetime`    | Its rationale's a11y claim is **false**: "cannot be parsed by assistive technology … lost to anything that isn't a sighted reader". A screen reader reads "last Tuesday" exactly as a sighted reader does; the loss is to machine consumers. Basis is HTML conformance, not any WCAG SC. By #428's standard — severity tracks evidence — that argues `info`; the counter-argument is that `<time>` misuse is a semantics defect regardless of consumer. Reword either way. Demotion moves `a11y::component` 46→42.                                                                                                                                  |
+| 16  | `doctype`             | Rationale's a11y half is **unsourced** — "breaking CSS and accessibility tree behavior"; MDN's quirks-mode page documents layout only, and WCAG 4.1.1 Parsing is obsolete and removed. It is also the **most expensive single a11y finding**: project scope means a flat 5 points regardless of project size, against ~0.4 for a route rule on a 50-route project. Options: keep `warning` and fix the rationale to the sourceable layout claim (recommended — near-zero FP rate, one-line fix), or demote to `info`. The rationale edit is not optional either way.                                                                                |
+| 17  | `invalid-aria-value`  | `aria-data.ts` drops aria-query's `allowundefined` flag, so the literal `undefined` is rejected on `aria-hidden`/`aria-expanded`/`aria-selected`/`aria-grabbed`. ARIA maps that type to "true, false, **and undefined**", so the spec says accept it; `tristate` correctly excludes it, so the fix is exactly `allowundefined`, nothing broader. Counterweight: Svelte's compiler also rejects it, so following the spec diverges from the compiler.                                                                                                                                                                                                |
+| 18  | `interactive-nesting` | Two claims stronger than their sources. "Unreachable by keyboard (the outer element consumes the click/Enter)" has no source found and a nested `<button>` is Tab-focusable; and "violates the HTML content model" is false for the rule's own role-based container arm, since `<div>`'s content model permits interactive descendants. Reword to browser-inconsistency, scoping the content-model sentence to `<a href>`/`<button>`. Separately, the docs exempt `tabindex="-1"` descendants while the spec's content model excludes **any** tabindex descendant — a defensible a11y judgement that needs reconciling with the sentence beside it. |
+| 19  | `accessible-name`     | The shipped `recommendation` — printed in every finding and the JSON report — **recommends `title` as a way to name a control**, which fails exactly the users the rule protects (touch, keyboard, magnifier, and many screen-reader users). Detection is right to read `title` (accname does); the advice is not. Drop it from the recommendation, or qualify it as a last resort.                                                                                                                                                                                                                                                                 |
+| 20  | `no-missing-id-ref`   | **Text-fragment URLs are a false positive.** `href="#:~:text=…"` is a shipped platform feature, not an id, and the message prints the percent-**decoded** form, so the user is told to look for a string that is not in their file. One-line skip for `:~:`; consider echoing the raw attribute text.                                                                                                                                                                                                                                                                                                                                               |
+| 21  | `duplicate-landmark`  | Source mode marks `<header>`/`<footer>` as landmarks only at chain-file top level, so the near-universal `<div class="app"><header>` shape is silently not a landmark — while rendered mode uses the spec's sectioning rule and fires. The two modes disagree, and no Mode-differences block says so. Either track a sectioning-ancestor counter (matches rendered mode and the spec, widening only) or document the divergence.                                                                                                                                                                                                                    |
+| 22  | `no-missing-id-ref`   | `IDREF_ATTRS` covers 5 of ~12 id-reference attributes; `aria-owns`, `aria-details`, `aria-errormessage`, `aria-flowto`, `headers`, `list`, `form`, `popovertarget` are all silent. False negatives only, and the design names the five deliberately — so this is a scope call. If the five stay, say so in the docs' attribute list.                                                                                                                                                                                                                                                                                                                |
+| 23  | `required-aria-props` | `HOST_SUPPLIED` has no `aria-expanded`/`aria-controls` rows, so `<input list>` and `<select>` with an explicit `role="combobox"` fire. Rare (the role is redundant there), hence P2. Separately, aria-query's `combobox`/`scrollbar` rows are correct against 1.2 but become wrong at 1.3 — the rows to watch when the data source is revisited.                                                                                                                                                                                                                                                                                                    |
+| 24  | `use-list`            | A **single** `- x` line is not a list, yet one occurrence fires. WCAG H48 is the citation the docs lack. Consider requiring ≥2 bullet text nodes under one parent. `info` is right either way.                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| 25  | severity, all fifteen | Verdict: **13 of the 14 `warning`s are right, and `use-list`'s `info` — the fifteenth rule — is right.** Zero `critical` is coherent with the post-#428 definition (deploy-blocking only). The open calls are rows 15 and 16. One asymmetry worth recording rather than changing: a layout `<main>` plus a page `<main>` trips **both** `duplicate-landmark` and `top-level-landmark` for one authoring mistake — 40 points off that route key.                                                                                                                                                                                                     |
+
+## Priority 3 — docs/message/test corrections (mechanical, no behaviour change)
+
+- **"Checked by static (CLI) analysis" is false on all ten component-scoped a11y pages, en and ja** (20 files), and the category design doc says it too. The Vite plugin runs the same rules from the same source parse, and `expected-findings.rendered.json` pins identical counts. Exactly the leftover class the August review found for the image rules. Drop the parenthetical; behaviour is mode-identical, so no Mode-differences block is needed for these ten.
+- **`a11y/doctype` never runs in Vite build mode** and is the only route/project page with no Mode-differences section. Its Disabling section also omits the suppressions-file option its four siblings offer, though `--update-suppressions` captures it fine.
+- **`--route` silences all ten component rules**, undocumented. Same gap the August review recorded for `architecture/doc-link-target`.
+- **Route-scoped findings cannot be silenced with an inline directive** (verified), which is the design's Phase-1 position — but no page says so, and users arriving from the component rules will try it first. What does work, verified: `--update-suppressions` and `overrides` by route or by files.
+- **Deprecated `<slot />` in four fix snippets** (`duplicate-landmark`, `top-level-landmark`, en+ja); `svelte-autofixer` flags `slot_element_deprecated`. Replace with `{@render children()}` — the kitchen-sink layout already does.
+- **`invalid-role`'s message never names the offending token**: it echoes the whole literal and picks "abstract role" vs "not a WAI-ARIA role" from the first bad token, so `role="widget bogus"` and `role="bogus widget"` describe the same pair of defects differently.
+- **`interactive-nesting`'s message omits the role** of a role-based container (`interactive <div>` rather than `interactive <div role="button">`), leaving the finding hard to act on.
+- **`required-aria-props` docs state the fallback rule wrongly** (en+ja): "only the first token would actually apply" — the spec rule is the first token matching a **non-abstract** role.
+- **`invalid-aria-value` docs omit `undefined`** from the boolean value set (the detection gap is row 17).
+- **Empty-string ARIA values are handled inconsistently and the message misstates the spec**: `aria-hidden=""` fires "not a valid boolean value" while `aria-relevant=""` silently passes. ARIA says a zero-length string SHOULD be treated as an absent attribute — warning is still defensible, but the message should say "treated as absent", and the tokenlist branch should match whichever way is chosen.
+- **Uppercase ARIA attribute names are invisible to the collector** (`ARIA-LABEL`, `ROLE`) — HTML lowercases them, and Svelte's own compiler catches the same typo. Lowercase before the prefix test, or record it as a known limitation.
+- **Spread-skip undocumented on three pages** (`label-has-control`, `placeholder-label-option`, `require-datetime`); only `accessible-name` mentions it, and a kitchen-sink clean canary depends on the behaviour.
+- **`no-missing-id-ref` docs' closed-world list omits the `$lib` barrel import**, a common in-repo pattern that opens the world with no `node_modules` involved. **`id-duplication` docs omit the `app.html` shell divergence** — source mode is silent where rendered mode fires (the roadmap's queued shell-id item; until it lands it belongs in Mode-differences).
+- **Ten of the fifteen ja page titles are still in English** — `Doctype` arguably being a proper noun — while five are translated; and one translated pair diverges in framing (en "Top-level landmark" vs ja「ランドマークのネスト」, opposite readings of the same rule).
+- **`plugin-mode.md` (en+ja) undersells a11y coverage** and contradicts `choosing-a-package.md` in the same breath.
+- **Route/project rule titles read as labels, not defects** (`Doctype`, `Id duplication`, `No missing id ref` — that last names the passing state), unlike the component rules' descriptive titles. This is the headline `svelte-vitals explain` prints.
+- **`no-missing-id-ref` docs hard-code their sibling list**, the rot AGENTS.md's convention targets.
+- **The design doc's "Deliberate overlap" paragraph lists three rules; it is four** (`invalid-aria-value` overlaps six Svelte compiler warnings).
+- **Test gaps**: none of the P1 negatives is pinned — expression `alt`, label-wrapped button, `<slot>` content, `role="gridcell"` container, `{expr}`-prefixed bullet text, week/offset/alt-duration `<time>`, dash-named custom element, adjacent guard `{#if}` blocks, `<div><header>` vs `<section><header>`, bare `<aside>`, text fragments, and the `HOST_SUPPLIED` `aria-level`/`aria-valuenow` rows.
+
+## Recorded, no action
+
+- **The branch fold and the open/closed-world split are sound — the design's central claim holds.** Six world-poisons (a `node_modules` import, a `$lib` barrel, `<svelte:component>`, `{@html}`, a spread attribute, a dynamic `id`) each planted both a duplicate id and a dangling `for`: `id-duplication` fired on all six, `no-missing-id-ref` on none, and the fully-resolved control fired both. Group re-basing per file instance, `{#key}` counted once, `{#await}` folded as one exclusive group, `{:else if}` chains folded, `{#each}` excluded from counting but included in id candidates — all verified.
+- **`doctype` handles every realistic variant** (uppercase, legacy-compat, BOM, missing `app.html` → silent) and the ReDoS fix holds: 50 leading comments resolve in 0.18 s.
+- **`duplicate-landmark`'s kind set matches APG exactly** — the one-per-page set, with `complementary` correctly excluded from duplication and included in `top-level-landmark`.
+- **`<template>` inertness, fragment decoding (`#top`, `#TOP`, `#caf%C3%A9`), and `<svelte:head>` exclusion are all correct.**
+- **`values.map(String)` is correct**, and a programmatic diff of every aria-query value list against the 1.2 value tables found no divergence. `separator`'s missing `requiredProps` row is benign (the spec conditions it on focusability); `menuitemradio → aria-checked` is correct and must not be removed while fixing row 3.
+- **`<svelte:element this={…}>` is invisible to every a11y rule** — a documented convention shared with three non-a11y collectors, not an a11y defect.
+- **All fifteen kitchen-sink samples exercise the intended arm**, not a degenerate one, including a genuinely cross-file id duplication and a fully-resolved route for the closed-world condition. Static and rendered expectations agree on every count.
+- **`explain` is correct for all fifteen.** Observation, not a defect: it never prints a rule's `recommendation`, so row 19's `title` advice reaches users through findings and the JSON report but not through `explain`.
+- **`translate:check` is honest** (117 up to date) and the ja **body text** is a faithful translation in all fifteen — including, faithfully, the row 1 overclaim. Titles are the exception, and are a Priority 3 row.
+- **Every "How to fix" snippet in the category passes `svelte-autofixer`** except the four deprecated-`<slot>` ones in Priority 3.
+- **Interactive-set and `INTERACTIVE_ROLES` deltas against the spec are false negatives only** (`details`, `label`, `img[usemap]`, `treeitem` absent; `summary` added). Recorded so the set is not re-derived without cause.
+- **Found outside this review's scope and already fixed**: `--route` with a leading-slash glob matched zero routes and exited 0, and the kitchen-sink clean canary could not have caught it (`#510`). It surfaced here because the route-scoped reviewer used `--route` to isolate its fixtures.
+- **Category gap for the roadmap, not this review**: nothing checks a control with no label at all, nor `iframe` without `title`. `no-missing-id-ref` catches a dangling `for=`, not a missing one.