Constraint validation contracts

The browser ships a whole form-validation engine — required, type, pattern, min/max, minlength/maxlength, step, plus a JS API and CSS pseudo-classes. The bugs come from driving it slightly wrong, and they're pure spec behavior, not framework quirks: a form that shows every field red before the user types a character, and a field that is permanently invalid because a custom message was set and never cleared, silently blocking submit. Both pass a quick happy-path test and surface only in real use.

This skill is the native validity mechanics. For the ARIA role/name/focus contract around errors use a11y-contract-testing; for the wording and localization of messages use i18n-copy-and-layout; for autocomplete tokens and auth-field specifics use frontend-auth-flow-contracts.

Checklist (lead with the trap; details in references/)

→ validation-api-and-states