fix(gate-37,gate-43): tabindex="-1" is NOT focusable, and one scope= does not green a table (#222)

[rubenvdlinde]

Closes #222.

Two gates whose remediation advice regressed the thing they measure.

gate-37 — tabindex="-1" counted as focusable

The check was grep -qE '(:?tabindex|v-bind:tabindex)=' — any value. But tabindex="-1" is the attribute that removes an element from the tab order: the one value that proves the opposite of what the gate concluded. The gate's own subject ("hidden from AT and still keyboard-reachable") was inverted for every element that had already been fixed.

The canonical hidden-file-input pattern trips it exactly:

<input type="file" :aria-hidden="true" tabindex="-1" @change="…">

The advice was to remove aria-hidden (exposing an unnamed control to screen readers) or to remove tabindex="-1" (putting a control screen readers cannot see back in the tab order — the very defect this gate exists to catch). Both remediations regress accessibility.

Measured: nextcloud-vue 2 → 0. Both were tabindex="-1" (CnFilesWidget's file input, CnCalendarEventCreate's submit bridge). Both 100% false.

Still flagged: tabindex="0"/positive, native focusables with no negative tabindex, interactive role=, and a bound :tabindex="expr" whose value cannot be read — unknown is not "safe", so the old behaviour is kept there.

gate-43 — one scope= greened the whole table

if re.search(r'<th\b[^>]*\bscope\s*=', body): continue   # whole table OK

A single scope= anywhere accepted every other header. Negative control: removing exactly one scope= from a passing table still reported PASS. The rule is now any unscoped named header fails the table. That experiment is now an assertion — test_removing_exactly_one_scope_flips_the_verdict.

A header with no name is not a header

Tightening to per-header immediately produced 8 findings in openconnector, a repo the old rule passed — and all 8 were the same false positive: the empty spacer column carrying a drag handle or row-actions menu (<th aria-hidden="true" />, <th />).

scope= declares which cells a header names. A header with no name names nothing, so the attribute is inert and demanding it is remediation theatre — the same trap as gate-40's aria-label advice. Exempt: aria-hidden="true", role="presentation"/none, empty content. A header with text and no scope= still fails. openconnector: back to 0.

Counting

One finding per table, not per <th>, with unscoped=N/M on the line. The number stays a count of defect sites and comparable with what this gate reported before. A finding count is not a defect count, and the two must not be silently swapped mid-repair.

Fleet effect, measured over 10 repos

gate-43 numbers identical before and after (opencatalogi 15, docudesk 11, procest 28, openbuild 8, openregister 56, pipelinq 43, doriath 14, openconnector 0). The tightening and the exemption are not cancelling each other — the tests prove each arm independently; the fleet simply has no partially-scoped table whose unscoped header is named.

Mutation-checked

reverted fix	suite result
gate-37 "any tabindex is focusable"	6 failures
gate-43 "at-least-one scope"	5 failures
gate-43 unnamed-header exemption widened to all	7 failures

Also caught by mutation rather than by reading: an optional (?:(.*?)</th>)? body group let a self-closed <th /> reach past itself to the first </th> in the file and swallow the next header whole — two headers counted as one.

Also

• Both implementations moved out of the runner into tested helpers (check_aria_hidden_focusable.py +24 tests, check_table_headers.py +23 tests).
• Both are quote-aware: the old [^>]* attribute runs ended a tag at the > inside :title="a > b", hiding attributes that followed.
• Both strip comments and <script>/<style> — markup that does not ship is not a control.
• A missing helper now reports SKIP-wiring, not PASS, for both gates (fix(gates): 16 gates reported PASS when their helper never ran — 2 are authorization gates #147).

Suites: 29 helper suites pass, 59 entry-point tests pass.