fix(interactive-roles): per-branch visited set in COMPOSITE_WIDGET_CHILDREN expansion (Copilot review)

Author: johanrd

lib/rules/template-no-nested-interactive.js

@@ -24,8 +24,10 @@ function getTextAttr(node, name) {
   return undefined;
 }
 
-// Menu submenu pattern — per WAI-ARIA APG, a `menuitem` with `aria-haspopup`
-// may own a nested `menu`. aria-query's `requiredOwnedElements` does not
+// Menu submenu pattern — per WAI-ARIA APG, a `menuitem` may own a nested
+// `menu` (APG convention: such menuitems are also marked with
+// `aria-haspopup`, but this rule does not require the attribute before
+// allowing the nesting). aria-query's `requiredOwnedElements` does not
 // express this "menu-inside-menuitem" direction, so it is handled explicitly.
 const MENUITEM_ROLES = new Set(['menuitem', 'menuitemcheckbox', 'menuitemradio']);
 

lib/utils/interactive-roles.js

@@ -106,13 +106,17 @@ function buildCompositeWidgetChildren() {
     const out = new Set();
     const kids = direct.get(role);
     if (!kids) {
+      closed.set(role, out);
       return out;
     }
     for (const child of kids) {
       out.add(child);
       if (!visited.has(child)) {
-        visited.add(child);
-        for (const grandchild of expand(child, visited)) {
+        // Pass a fresh branch-specific visited set so sibling branches do not
+        // contaminate each other's traversal. A shared Set across branches
+        // makes memoized results order-dependent, because whether `child` is
+        // recursed into depends on which sibling ran first.
+        for (const grandchild of expand(child, new Set([...visited, child]))) {
           out.add(grandchild);
         }
       }