diff --git a/CLAUDE.md b/CLAUDE.md
index fc5bd7a..6c65ff3 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -34,6 +34,7 @@ CI (`.github/workflows/ci.yml`) gates on: lint → format:check → typecheck 
 | `./async` | Promises & async (spec 037) — `$q` (digest-scheduled, Promises/A+-aligned promise toolkit: `defer`/executor constructor/`resolve`/`when`/`reject`/`.then`/`.catch`/`.finally` + the three combiners `all`/`race`/`allSettled`, plus always-on unhandled-rejection reporting), `$timeout` (cancellable one-off deferred task settling a `$q` promise), `$interval` (cancellable repeating task reporting per-tick progress + count-cap resolve). All three are PURE ESM-first factories (injected digest/timer seams) with DI registrations on `ngModule`. `EXCEPTION_HANDLER_CAUSES` grew 10→13 here (`'$q'` / `'$timeout'` / `'$interval'`). | `createQ`, `createTimeout`, `createInterval`, types `QService`, `QPromise`, `QDeferred`, `QExecutor`, `QSettledResult`, `QOptions`, `Thenable`, `AwaitedQ`, `TimeoutService`, `TimeoutOptions`, `IntervalService`, `IntervalOptions`, `TimerId` (the internal promise class is deliberately NOT exported — it would shadow the global `Promise`) |
 | `./cache` | General-purpose cache factory (spec 038 Slice 1) — `$cacheFactory(id, options?)` produces named, `Map`-backed caches (`put` / `get` / `remove` / `removeAll` / `info` + `destroy` which detaches from the registry so the id is reusable); the factory carries a registry surface (`get` / `info`). Backs `$http`'s opt-in response cache and is usable standalone. PURE ESM-first factory (`createCacheFactory`, fresh registry closure per injector) + DI registration on `ngModule`. **No LRU / `capacity` eviction** (documented deviation — `CacheOptions.capacity` accepted for shape parity, ignored; every cache is an unbounded `Map`). | `createCacheFactory`, types `Cache`, `CacheFactory`, `CacheInfo`, `CacheOptions` |
 | `./http` | Networking (spec 038) — `$http` (callable returning a `$q` promise of a typed `HttpResponse<T>`; general `$http<T>(config)` form + `get`/`delete`/`head`/`post`/`put`/`patch`/`jsonp` shortcuts), `$httpBackend` (the transport seam — native `fetch` + a `<script>`-tag JSONP path; the single `ngMock`-decoration / test-stub point), `$HttpProvider` (config-phase `defaults` + `interceptors`). The pipeline does header merge → request transforms → param serialization → XSRF → cache check → backend send → response transforms → status classify; interceptors (request/response/error hooks) resolved once at `$get`. All registered on `ngModule`. PURE ESM-first factories (`createHttp` / `createHttpBackend`) with injected seams. `EXCEPTION_HANDLER_CAUSES` STAYS 13 — `$http` failures are promise rejections, never routed through `$exceptionHandler`. | `createHttp`, `createHttpBackend`, `$HttpProvider`, `HttpTransportError`, `isHttpTransportError`, `JSONP_CALLBACK_PLACEHOLDER`, `mergeHeaders`, `parseHeaders`, `buildUrl`, `paramSerializer`, `paramSerializerJQLike`, `applyRequestTransforms`, `applyResponseTransforms`, `defaultTransformRequest`, `defaultTransformResponse`, `resolveTransforms`, `applyXsrfHeader`, `defaultCookieReader`, `DEFAULT_XSRF_COOKIE_NAME`, `DEFAULT_XSRF_HEADER_NAME`, `readCookieValue`, `resolveBaseUrl`, types `CreateHttpArgs`, `CreateHttpBackendArgs`, `FetchFn`, `JsonpDocument`, `JsonpGlobal`, `InterceptorRegistration`, `ApplyXsrfHeaderArgs`, `CookieReader`, `HttpBackend`, `HttpBackendOptions`, `HttpConfig`, `HttpDefaults`, `HttpHeaders`, `HttpHeadersGetter`, `HttpResponse`, `HttpService`, `HttpTransportErrorKind`, `ParamSerializer`, `RawResponse`, `RequestTransform`, `ResponseTransform` |
+| `./forms` | Forms & validation (spec 039) — the interactive layer: `ngModel` two-way binding + the `NgModelController` value pipeline (`$viewValue`/`$modelValue`, `$parsers`/`$formatters`/`$render`/`$setViewValue`/`$commitViewValue`/`$rollbackViewValue`, state + state-classes), the `form`/`ngForm` `FormController` (per-key control-failure-set aggregation, named form/control publish, submit + native suppression), the SINGLE `input` directive + internal `inputType` registry (`text`/`email`/`url`/`number`/`range`/`checkbox`/`radio`/`date`-family/no-model) + `textarea` + `select`/`ngOptions`/`ngList`, built-in validators (`required`/`ngRequired`/`ngMinlength`/`ngMaxlength`/`pattern`/`ngPattern` + type `email`/`number`/`url` + `min`/`max`) and custom sync/async `$validators`/`$asyncValidators` (sync-before-async, tri-state `$setValidity`, `$pending`+`ng-pending`, stale-async generation guard), `ngModelOptions` (`updateOn`/`debounce`/`allowInvalid`/`getterSetter`/`timezone`), `ngChange`. Directives are DI-only core `ng` (registered on `ngModule` via `registerForms`, NOT exported as a factory barrel — only the CONTRACT types are public). `EXCEPTION_HANDLER_CAUSES` STAYS 13 (forms errors reuse `'$compile'`). | types `NgModelController`, `FormController`, `FormControlLike`, `NgModelOptions`, `ModelOptions`, `ModelParser`, `ModelFormatter`, `SyncValidator`, `AsyncValidator`, `SelectController`, `NgOptionsDescriptor`; values `NgModelControllerImpl`, `FormControllerImpl`, `nullFormCtrl`, `SelectControllerImpl`, `createModelOptions`, `defaultModelOptions`, `resolveDebounceDelay`, `registerForms`, error classes `NgModelNonAssignableError`, `NgOptionsBadExpressionError` |
 
 ## Non-obvious invariants
 
@@ -58,6 +59,7 @@ CI (`.github/workflows/ci.yml`) gates on: lint → format:check → typecheck 
 - **Child-scope cleanup via private element properties.** When `scope: true` is requested, the compiler stashes the child scope on `(element as any).$$ngScope` and lets directives push cleanup callbacks onto `(element as any).$$ngCleanupQueue` — both non-enumerable. Future structural directives (`ng-if`, `ng-repeat`, …) MUST call `destroyElementScope(element)` before removing nodes; there is no `MutationObserver` or auto-detection. Without that call, removed-subtree scopes stay attached to the parent's watcher tree forever.
 - **Transclusion scope is a child of the OUTER scope, not the directive's.** The scope the directive was linked against (`parentScope` inside the per-element linker) is captured by the `$transclude` closure BEFORE the `scope: true` `$new()` runs, so every clone's transclusion scope is `parentScope.$new()` — never `directiveScope.$new()`. This is what lets `<my-card scope="true">` keep its own variable namespace internally while consumer markup inside `<my-card>` still binds to OUTER variables.
 - **Captured children compile EXACTLY ONCE at capture time.** Capture runs during the host directive's compile phase, before the walker descends into the host's child positions, so the OUTER walker sees no children to link. Each `$transclude(...)` call deep-clones the master via `Node.cloneNode(true)` and re-links the clone against a fresh transclusion scope through the internal `cloneMap` indirection (the public `Linker` type is unchanged). The master fragment is never inserted into the DOM.
+- **`cloneAttachFn` runs BEFORE the clone links (AngularJS `publicLinkFn` parity — PR-44 audit fix).** `buildTranscludeFn` invokes `cloneAttachFn(clones, transclusionScope)` FIRST, then the clone linker — the structural directives (`ng-if` / `ng-switch` / `ng-repeat` / `ng-include`) insert the clone into the live DOM inside that callback, so ancestor lookups during the clone's link phase (`require: '^'/'^^'` resolution, the `$$ngControllers` stash walks used by forms / `ngModelOptions`, the `$$ngBoundTransclude` marker walk) see real DOM parents. The pre-fix link-first order resolved every ancestor lookup against a detached fragment — an `<input ng-model>` inside `ng-if` silently never registered with its enclosing `<form>`.
 - **Multi-clone is supported.** Each `$transclude(...)` call yields an independent clone with an independent scope, pushed onto the host element's `$$ngCleanupQueue` so `destroyElementScope(host)` tears every clone down regardless of how many were produced. This is the infrastructure `ng-repeat` will lean on. The outer scope's `$destroy()` also tears clones down via normal scope-tree propagation — both paths converge on `transcludedScope.$$destroyed === true`.
 - **`ng-transclude` finds its enclosing transcluding directive by walking `element.parentElement`** until it finds an ancestor carrying the non-enumerable `$$ngBoundTransclude` slot. Decoupled from the walker — works for programmatically-inserted markers AND (in the future) for markers inside compiled `template` strings. The slot stashes `{ fn, declaredSlots, kind, directiveName }` so the marker validates slot-name lookups before invoking `$transclude`.
 - **`transclude: 'element'` is deliberately deferred and REJECTED at registration** so a future structural-directives spec can add it without a silent semantic change. The `'$compile'` cause is reused for every transclusion error site — no new `EXCEPTION_HANDLER_CAUSES` entry (the tuple stays at 10). The nine new error classes are exported from `@compiler/index`; registration-time errors route via the existing factory try/catch in `$$buildDirectiveArrayProvider`, link-time errors route via direct `invokeExceptionHandler(handler, err, '$compile')` calls.
@@ -143,6 +145,14 @@ CI (`.github/workflows/ci.yml`) gates on: lint → format:check → typecheck 
 - **Response caching is GET-only, opt-in, with `inFlight` dedup serving CLONES (spec 038).** `config.cache` (`true` → the lazily-created `$cacheFactory('$http')` default cache; a `Cache` object → that store; falsy/absent → no caching) caches a 2xx success keyed by the fully-serialized URL — GET ONLY (a POST/PUT/etc. is never cached even with `cache` set). A hit resolves a CLONE (`data` + `config` shallow-copied; the `headers` getter reused) so a caller mutating the bundle cannot corrupt the stored entry; two concurrent identical cacheable GETs share a single outstanding promise via the `inFlight: Map<url, promise>` (the `$templateRequest` dedup precedent), cleared on settle. `$http.pendingRequests` is the observational in-flight array (pushed on send, spliced on settle).
 - **`useApplyAsync` / `$cacheFactory` LRU / upload-download progress are DEFERRED (documented, NOT spec 038).** `$httpProvider.useApplyAsync` (batching response delivery through `$rootScope.$applyAsync`) is not implemented — responses settle through the standard `$q` → `$evalAsync` path. `$cacheFactory` is unbounded (no `capacity`/LRU — `CacheOptions.capacity` accepted for shape parity, ignored). Request-body upload + download progress notifications are out of scope (the native `fetch` API does not expose them).
 - **`$cacheFactory` is a per-injector-isolated `Map`-backed registry; re-using a live id throws (spec 038).** `createCacheFactory()` builds a fresh registry closure (per-injector isolation, the `$templateCache` precedent); `$cacheFactory(id)` throws `cacheId <id> taken` if the id is in use. `Cache.destroy()` clears entries AND removes the cache from the registry so the id is re-creatable (the instance you hold stays usable but is no longer discoverable via `$cacheFactory.get`). `Cache<T>` is generic over the stored value; `put(k, v)` returns `v` for chaining.
+- **The forms directives are DI-only core `ng`; only the CONTRACT types are public (spec 039).** `ngModel` / `input` / `textarea` / `select` / `option` / `form` / `ngForm` / `ngChange` / `ngModelOptions` / `ngOptions` / `ngList` / the six validator directives are registered on `ngModule` via `registerForms($compileProvider)` (`src/forms/forms-register.ts`, invoked from `src/core/ng-module.ts`'s config block) — the `ngTransclude` / event-directive precedent. The factory functions stay file-local (NOT exported from a factory barrel); `@forms/index` exports only the CONTRACT types (`NgModelController`, `FormController`, `NgModelOptions` / `ModelOptions`, `SyncValidator` / `AsyncValidator`, `SelectController`, …) plus the concrete `*Impl` classes (used for `instanceof` narrowing in tests + cross-file `require` resolution) and the two error classes. Because they register through a config block (not a typed `.directive` widening), they are NOT in `ModuleRegistry` — reachable via `injector.get('ngModelDirective')` at runtime but with no static `injector.get` type. A SINGLE `input` directive dispatches on `attrs.type` into the internal `inputTypeHandlers` registry (parity — not one directive per type); `textarea` delegates to the `text` handler.
+- **Model write-back via `buildParentWriter`; non-assignable `ng-model` routes `'$compile'` (spec 039).** `ngModel`'s link builds the parent-side writer with `buildParentWriter` (`@compiler/expression-assign` — the same assignable-write machinery `ngRef` / the `=` isolate binding use), so a dotted `ng-model="a.b.c"` auto-creates its intermediates. A non-assignable model (`ng-model="a + b"`, `ng-model="fn()"`) → `NgModelNonAssignableError` via `$exceptionHandler('$compile')` and the directive goes inert. In `getterSetter` mode the expression need NOT be assignable — it is a function read via `fn()` / written via `fn(value)`. `$parsers` run view→model in registration order (a parser returning `undefined` short-circuits → the `parse` key fails, value withheld); `$formatters` run model→view in REVERSE. A model→view feedback guard on the model watch runs the pipeline only when the scope model diverges from the cached `$modelValue`, so the watch never clobbers a live keystroke and async validators don't fire twice per keystroke.
+- **Validation is sync-before-async with a tri-state `$setValidity` + a stale-async generation guard (spec 039).** `$$runValidators` (`src/forms/validation.ts`) runs three stages: a failed `$parsers` chain fails only the `parse` key (skips every validator); then sync `$validators` (any failure skips async); then — only when every sync rule passes — async `$asyncValidators`, marking each key pending (`$setValidity(key, undefined)`) with `ng-pending` on until `$q.all(...)` settles. `$setValidity` is tri-state: `true` (valid) / `false` (invalid) / `undefined` (pending), and the three maps (`$error` / `$$success` / `$pending`) are mutually exclusive per key; `$pending` drops back to `undefined` (not `{}`) when empty. A monotonic `$$currentValidationRunId` cancels stale async passes (a slow server check resolving after the user typed again no-ops). By default an invalid value is kept OUT of the model (`$modelValue → undefined`); `ngModelOptions.allowInvalid` flips the `$$allowInvalid` seam. Length / pattern validators PASS on an empty value (emptiness is `required`'s concern) so `required` + `ng-minlength` compose.
+- **State-class toggles are SYNCHRONOUS + append-only; `$animate` deferred to Phase 4 (spec 039).** `src/forms/state-classes.ts` toggles the full parity surface (`ng-valid`/`ng-invalid`, `ng-dirty`/`ng-pristine`, `ng-touched`/`ng-untouched`, `ng-empty`/`ng-not-empty`, `ng-pending`, `ng-submitted` on forms, and per-rule `ng-valid-<key>`/`ng-invalid-<key>` with the key dasherized via `snake_case(name, '-')`) via `classList` — append-only, only ever touching classes IT manages + their mutually-exclusive partner (the `ng-class` guarantee; author classes are never stripped). There is NO `$animate` integration — validation / visibility transitions are synchronous today. The `FormController` aggregates per-key control-FAILURE SETS (not a boolean per control): `$setValidity(key, isValid, control)` is TRI-STATE (`true` / `false` / `undefined` = PENDING — a control's in-flight async rule populates the form's `$pending[key]` set and toggles `ng-pending` on the form element, and the combined per-key state bubbles up the `$$parentForm` chain), so control removal (via `ng-if`) is correct for free — a form invalid only because of a since-removed control flips back to valid without the control un-failing, and `$removeControl` also clears the control from every pending set.
+- **ng-submit / `<form>` parity change: a `<form>` with NO `action` now SUPPRESSES native submit by default (spec 039 §2.3).** The `form` directive owns a native `submit` listener that calls `$setSubmitted()` (in a `$$phase`-guarded `$apply` / `$evalAsync`) and `preventDefault()`s when the form has no `action` attribute. This SUPERSEDES the spec-026 "ng-submit does NOT auto-preventDefault" note. The `ngSubmit` directive itself still runs its expression WITHOUT `preventDefault`, and the `form` directive does NOT double-run the `ngSubmit` expression — it owns only the `$setSubmitted` state transition + suppression, so `<form ng-submit="…">` runs the handler exactly once.
+- **directive-collector `byPriority` NAME tie-break is a compiler change (spec 039).** `applySortAndTerminalCutoff` in `src/compiler/directive-collector.ts` now tie-breaks same-priority directives on directive NAME (ascending) BEFORE the collection-index tie-break — AngularJS `byPriority` parity. This makes `ngModel` link before `select` (`ngModel < select`) so `select`'s `require: '?ngModel'` resolves. General compiler behavior, not forms-specific, but forms motivated it.
+- **`ngModelOptions` resolves via a `$$ngControllers` STASH WALK, not `^^?ngModelOptions` require (spec 039 — parity departure).** `ngModel`'s link (`readEnclosingOptions` in `src/forms/ng-model.ts`) walks the element's OWN `$$ngControllers` stash then its `parentElement` chain for the nearest resolved `ngModelOptions` — because same-element `require` resolution runs during `runControllerSeam`, BEFORE the `ngModelOptions` controller is stashed / re-inherited, while `ngModel`'s LINK runs after every stash + pre-link. `ngModelOptions` publishes a MUTABLE resolved `ModelOptions` (stable reference re-resolved in pre-link once the inherited parent is known); a `'*'` token in `updateOn` resets inheritance. `debounce` is backed by `$timeout` (`$$phase`-guarded, cancelled on `$destroy` / supersession); `updateOn` buffers non-committing events via `$$updateEvents` (the input handler still commits on its own default events unless `default` is absent from `updateOn`); `getterSetter` degrades a non-function model to a raw read / no-op write; `timezone` is resolved once (`resolveTimezone`) onto `$$timezone`, read LAZILY by the date handlers.
+- **`EXCEPTION_HANDLER_CAUSES` STILL 13 after spec 039 — forms errors reuse `'$compile'`.** Every forms error site (`NgModelNonAssignableError`, `NgOptionsBadExpressionError`, a malformed date/number parse, a native-listener throw dispatched via `applyDuringEvent`, the `form` submit `$apply` wrapper) routes via `$exceptionHandler('$compile')` — no new cause token. The tuple stays at the spec-037 length 13; grep the suite for any hardcoded `=== 13` before changing.
 
 ## Coding conventions
 
@@ -258,6 +268,16 @@ CI (`.github/workflows/ci.yml`) gates on: lint → format:check → typecheck 
 | How are `$http` query params / headers / transforms / XSRF handled? | `src/http/http-params.ts` (`paramSerializer` / `paramSerializerJQLike` / `buildUrl`), `src/http/http-headers.ts` (`mergeHeaders` / `parseHeaders`), `src/http/http-transforms.ts` (default JSON transforms + `resolveTransforms`), `src/http/http-xsrf.ts` (`applyXsrfHeader` + same-origin gate) |
 | How does `$cacheFactory` create + register named caches? | `src/cache/cache-factory.ts` (`createCacheFactory` — fresh registry closure, `Map`-backed `Cache`, `cacheId <id> taken`, `destroy` detaches from the registry) |
 | Worked `$http` / `$cacheFactory` examples + the digest / interceptor / XSRF / JSONP / caching contracts? | `src/http/README.md` + `src/cache/README.md` |
+| How does `ngModel`'s value pipeline + state engine work? | `src/forms/ng-model-controller.ts` (`NgModelControllerImpl` — `$parsers`/`$formatters`/`$render`/`$setViewValue`/`$commitViewValue`/`$rollbackViewValue`, `$setValidity` tri-state, state + `$setPristine`/`$setDirty`/`$setTouched`) + `src/forms/ng-model.ts` (`ngModel` directive — `buildParentWriter` write-back, the model watch + feedback guard, `getterSetter`, the `ngModelOptions` stash walk, `ngChange`) |
+| How does the validation engine order sync vs async + cancel stale passes? | `src/forms/validation.ts` (`runValidators` — parse → sync → async stages, `$q.all`, the `$$currentValidationRunId` stale-pass guard, `ng-pending` toggle) |
+| How are the built-in / type validators wired? | `src/forms/validators.ts` (`required`/`ngRequired`/`ngMinlength`/`ngMaxlength`/`pattern`/`ngPattern` directives) + `src/forms/input-validators.ts` (the type `email`/`number`/`url` regexps + numeric / date `min`/`max` wiring) |
+| How does the `form` / `ngForm` aggregation + submit work? | `src/forms/form-controller.ts` (`FormControllerImpl` — per-key control-failure-set aggregation, `nullFormCtrl`, `$setPristine` fan-out, `$$renameControl`) + `src/forms/form.ts` (the shared factory — pre-link `'form'` publish, named form/control publish, submit + native suppression) |
+| How does the single `input` directive dispatch on `type`? | `src/forms/input.ts` (the `input` / `textarea` directives) + `src/forms/input-types.ts` (`inputTypeHandlers` registry — text / number / range / checkbox / radio / date-family / no-model handlers + `registerInputListeners`) + `src/forms/input-date.ts` (date/time `Date` ↔ string parse/format + `resolveTimezone`) |
+| How does `select` / `ngOptions` / `ngList` bind option collections? | `src/forms/select.ts` (`SelectControllerImpl` + `option` self-registration) + `src/forms/ng-options.ts` (option generation on `$watchCollection`) + `src/forms/ng-options-parse.ts` (`parseNgOptions` grammar) + `src/forms/ng-list.ts` (delimited-string ↔ array transform) |
+| How is `ngModelOptions` resolved + threaded? | `src/forms/ng-model-options.ts` (`ngModelOptions` directive + `createModelOptions` / `resolveDebounceDelay` / the `$$updateEvents` + inheritance model; consumed via the `readEnclosingOptions` stash walk in `ng-model.ts`) |
+| How are the forms state CSS classes toggled? | `src/forms/state-classes.ts` (append-only `classList` toggles + `snakeCase` per-rule dasherizing) |
+| How are the forms directives registered on `ngModule`? | `src/forms/forms-register.ts` (`registerForms($compileProvider)`, invoked from `src/core/ng-module.ts`) |
+| Worked forms examples (controllers, pipeline, state classes, input matrix, validators, `ngModelOptions`)? | `src/forms/README.md` |
 | How do all Phase 2 services fit together (whole-picture diagrams)? | context/diagrams/README.md |
 | How does the Scope / digest cycle work end-to-end (diagram)? | context/diagrams/scope-and-digest.md |
 | How does the expression parser work end-to-end (diagram)? | context/diagrams/expression-parser.md |
diff --git a/context/product/roadmap.md b/context/product/roadmap.md
index 9a136a8..5929f55 100644
--- a/context/product/roadmap.md
+++ b/context/product/roadmap.md
@@ -132,13 +132,13 @@ _High-level services that enable real application development._
   - [x] **$http Service:** Implement request methods (`GET`, `POST`, `PUT`, `DELETE`), default headers, and parameter serialization.
   - [x] **Interceptors:** Support request/response interceptors and transformations.
 
-- [ ] **Forms & Validation**
-  - [ ] **ngModel:** Implement two-way data binding for form elements with `$viewValue` / `$modelValue` pipeline.
-  - [ ] **Form-element directives:** Implement `form` and `ng-form` (nested-form support), `input` (with every HTML5 type: `text`, `number`, `email`, `url`, `date`, `datetime-local`, `time`, `week`, `month`, `radio`, `checkbox`, `range`, `hidden`, `button`, `submit`, `reset`), `select`, `textarea`. Each form element registers itself with the enclosing `FormController`.
-  - [ ] **ngModel helpers:** Implement `ng-model-options` (debounce, `updateOn`, `getterSetter`, timezone, etc.), `ng-options` (typed `<option>` generation for `<select>`), `ng-list` (comma-separated-list viewValue ↔ array modelValue transformation), `ng-change` (on-`$viewValue`-change callback).
-  - [ ] **Form & NgModelController:** Implement `$dirty`, `$pristine`, `$valid`, `$invalid`, `$touched`, `$untouched` state tracking.
-  - [ ] **Built-in Validators:** Implement `required` (also available as the `ng-required` attribute directive), `minlength`, `maxlength`, `pattern`, `email`, `number`, `url`.
-  - [ ] **Custom Validators:** Support `$validators` and `$asyncValidators` pipeline.
+- [x] **Forms & Validation** _(spec 039 — shipped.)_
+  - [x] **ngModel:** Implement two-way data binding for form elements with `$viewValue` / `$modelValue` pipeline. _(spec 039 — model write-back via `buildParentWriter` (non-assignable `ng-model` routes `'$compile'`); the `$parsers` (forward) / `$formatters` (reverse) transform lists + `$render` + the model→view feedback guard.)_
+  - [x] **Form-element directives:** Implement `form` and `ng-form` (nested-form support), `input` (with every HTML5 type: `text`, `number`, `email`, `url`, `date`, `datetime-local`, `time`, `week`, `month`, `radio`, `checkbox`, `range`, `hidden`, `button`, `submit`, `reset`), `select`, `textarea`. Each form element registers itself with the enclosing `FormController`. _(spec 039 — a SINGLE `input` directive dispatches on `type` into an internal handler registry (parity — not one directive per type); `textarea` delegates to `text`; a `<form>` with no `action` now suppresses native submit by default.)_
+  - [x] **ngModel helpers:** Implement `ng-model-options` (debounce, `updateOn`, `getterSetter`, timezone, etc.), `ng-options` (typed `<option>` generation for `<select>`), `ng-list` (comma-separated-list viewValue ↔ array modelValue transformation), `ng-change` (on-`$viewValue`-change callback). _(spec 039 — `ngModelOptions` resolved via a `$$ngControllers` stash walk (a parity departure from `^^?ngModelOptions`); `debounce` backed by `$timeout`.)_
+  - [x] **Form & NgModelController:** Implement `$dirty`, `$pristine`, `$valid`, `$invalid`, `$touched`, `$untouched` state tracking. _(spec 039 — full state-class surface incl. per-rule `ng-valid-<rule>` / `ng-invalid-<rule>` + `ng-pending`, toggled synchronously / append-only; `$animate` deferred to Phase 4. The form aggregates per-key control-failure sets so control removal is correct for free.)_
+  - [x] **Built-in Validators:** Implement `required` (also available as the `ng-required` attribute directive), `minlength`, `maxlength`, `pattern`, `email`, `number`, `url`. _(spec 039 — plus `min` / `max` on number / range / date; each re-validates when its bound parameter changes.)_
+  - [x] **Custom Validators:** Support `$validators` and `$asyncValidators` pipeline. _(spec 039 — sync-before-async ordering, tri-state `$setValidity`, `$pending` + `ng-pending`, and a generation-counter that cancels stale async passes.)_
 
 ---
 
diff --git a/context/spec/039-forms-and-validation/functional-spec.md b/context/spec/039-forms-and-validation/functional-spec.md
new file mode 100644
index 0000000..06d1a73
--- /dev/null
+++ b/context/spec/039-forms-and-validation/functional-spec.md
@@ -0,0 +1,135 @@
+# Functional Specification: Forms & Validation
+
+- **Roadmap Item:** Forms & Validation — `ngModel` two-way binding, form-element directives, `ngModel` helpers, Form & control state tracking, built-in validators, custom validators.
+- **Status:** Completed
+- **Author:** Mgrdich
+
+---
+
+## 1. Overview and Rationale (The "Why")
+
+Today a developer using this framework can render data into the page (interpolation, `ng-bind`), react to events (`ng-click` and friends), and structure the DOM (`ng-if`, `ng-repeat`). What they **cannot** do is capture input from the user and feed it back into their data — there is no two-way data binding, no form controls, and no validation. This is the single largest remaining gap before the framework can power a real interactive application (the TodoMVC / form-validation demos on the roadmap depend on it).
+
+This change delivers the complete forms layer: a developer can bind any form control to a piece of their data so that typing in a field updates the data and changing the data updates the field; group controls into forms that report their own validity; validate input with both built-in rules and their own custom rules (synchronous and asynchronous); and style controls based on their state (touched, dirty, valid, pending, …) using the same state-class conventions AngularJS established.
+
+**Success is measured by:** a developer can build a non-trivial validated form — text, numeric, date, checkbox, radio, and dropdown controls bound to their data, with required/length/pattern/format rules plus a custom async rule — and the form behaves identically to the same markup running on AngularJS 1.x (same model values, same validity, same state classes, same timing).
+
+---
+
+## 2. Functional Requirements (The "What")
+
+### 2.1 Two-way binding with `ng-model`
+
+- **As a** developer, **I want to** bind a form control to a property of my data with `ng-model="…"`, **so that** user input and my data stay in sync automatically.
+  - **Acceptance Criteria:**
+    - [x] Given `<input ng-model="user.name">`, when the user types "Ada", then the bound property becomes "Ada" without any extra wiring.
+    - [x] Given the bound property is changed in code, when the next update cycle runs, then the control on screen shows the new value.
+    - [x] The binding target may be a nested path (`a.b.c`); intermediate objects are created as needed when the user first types.
+    - [x] When `ng-model` points at an expression that cannot be assigned to (e.g. a literal or a function call), the developer sees a clear error explaining the field is not assignable.
+
+- **The value pipeline:** each control exposes a controller (the "model controller") with two ordered transformation lists — one that runs when the user's input travels **toward** the data, and one that runs when the data travels **toward** the screen — plus a render step and a programmatic "the user changed the value" entry point.
+  - **Acceptance Criteria:**
+    - [x] A developer can register a transformation that converts the on-screen text into the stored value (e.g. trim whitespace) and see it applied on every keystroke commit.
+    - [x] A developer can register a transformation that converts the stored value into what is shown (e.g. format a number) and see it applied whenever the data changes.
+    - [x] The on-screen value and the stored value are exposed separately so a developer can read either.
+    - [x] Calling the "value changed" entry point with a new on-screen value runs the toward-data transformations, runs validation, and (when valid, or when configured to allow invalid) writes the result to the data.
+
+### 2.2 Control state tracking & state CSS classes
+
+- **As a** developer, **I want** each control and form to track whether it has been visited, changed, and whether it is valid, **so that** I can show validation feedback at the right moment.
+  - **Acceptance Criteria:**
+    - [x] A fresh control reports itself as untouched, pristine, and (absent failing rules) valid; the form reflects the same.
+    - [x] After the user focuses then leaves a control, it reports itself touched.
+    - [x] After the user changes a control's value, it reports itself dirty (and no longer pristine).
+    - [x] A developer can reset a control/form back to pristine programmatically.
+    - [x] **State classes (full parity), toggled synchronously:** the control element carries `ng-valid`/`ng-invalid`, `ng-dirty`/`ng-pristine`, `ng-touched`/`ng-untouched`, `ng-empty`/`ng-not-empty`, and `ng-pending` while async validation is running.
+    - [x] **Per-rule classes:** for each named rule, the element carries `ng-valid-<rule>` or `ng-invalid-<rule>` (e.g. `ng-invalid-required`, `ng-valid-maxlength`); rule names with separators are dasherized consistently with AngularJS.
+    - [x] A form element additionally carries `ng-submitted` once a submit has been attempted.
+    - [x] Classes only ever added by the framework are removed when their condition flips; classes the developer put on the element themselves are never removed.
+
+### 2.3 Forms and the form controller
+
+- **As a** developer, **I want** to group controls inside a `<form>` (or `ng-form` for nested groups) that aggregates their state, **so that** I can enable/disable a submit button on overall validity.
+  - **Acceptance Criteria:**
+    - [x] A `<form>` automatically becomes a form group without extra attributes; `ng-form` provides the same for nesting a group inside another form.
+    - [x] A form is invalid if any control inside it is invalid, and valid only when all are valid; the form is dirty if any control is dirty.
+    - [x] A named form (`<form name="myForm">`) and named controls (`<input name="email">`) are reachable by name so a developer can read their state in expressions (e.g. show a message when `myForm.email` is invalid and touched).
+    - [x] Nested forms contribute their validity up to the parent form; removing a control or sub-form from the page removes its contribution.
+    - [x] Submitting the form marks it submitted and runs any `ng-submit` handler; by default the browser's native submit/navigation is suppressed.
+    - [x] A developer can programmatically mark the form submitted, reset it to pristine, and reset which controls are considered "submitted".
+
+### 2.4 Form-element directives & input types
+
+- **As a** developer, **I want** every standard form control to work with `ng-model`, **so that** I can bind text, numbers, dates, choices, and free text.
+  - **Acceptance Criteria (typed model values — full parity):**
+    - [x] `<textarea ng-model>` and `<input type="text|email|url|password|search|tel">` bind a **string**.
+    - [x] `<input type="number">` and `<input type="range">` bind a **number**; non-numeric input makes the control invalid rather than storing a bad value.
+    - [x] `<input type="checkbox">` binds a **boolean**; the true/false values are overridable via `ng-true-value` / `ng-false-value`.
+    - [x] `<input type="radio">` binds the **value of the selected radio** among a group sharing the same model.
+    - [x] `<input type="date|datetime-local|time|month|week">` binds a **date value**; the displayed text follows the input type's format and honors a configured timezone.
+    - [x] `<input type="hidden|button|submit|reset">` behave as standard controls (no model parsing surprises).
+    - [x] `<select ng-model>` binds the chosen option's value; a `multiple` select binds an **array** of chosen values.
+    - [x] Empty input maps to an empty model value consistently (e.g. empty text → empty string/undefined per parity), and the `ng-empty`/`ng-not-empty` classes reflect it.
+
+### 2.5 `ng-model` helpers
+
+- **As a** developer, **I want** fine control over when and how the model updates and how options are generated, **so that** I can tune UX (debounce, update-on-blur) and build dropdowns from data.
+  - **Acceptance Criteria:**
+    - [x] **`ng-model-options` (full parity):**
+      - [x] `updateOn` lets the developer choose which events commit the value (e.g. only on `blur`), instead of every keystroke.
+      - [x] `debounce` delays the commit by a number of milliseconds, optionally per-event (`{ default: 300, blur: 0 }`).
+      - [x] `allowInvalid` lets invalid values still be written to the data.
+      - [x] `getterSetter` lets the bound expression be a function used both to read and write the value.
+      - [x] `timezone` controls how date/time controls interpret and display their value.
+    - [x] **`ng-options`** generates `<option>`s for a `<select>` from an array or object, supporting label/value/grouping/`track by`/`disable when` per AngularJS grammar.
+    - [x] **`ng-list`** transforms a delimited string in the field into an **array** in the data (and back), with a configurable delimiter.
+    - [x] **`ng-change`** runs a developer-supplied expression whenever the committed on-screen value changes (not merely when the data changes in code).
+
+### 2.6 Built-in validators
+
+- **As a** developer, **I want** ready-made validation rules I can attach with attributes, **so that** I don't hand-write common checks.
+  - **Acceptance Criteria:** for each rule, an invalid value makes the control (and its form) invalid, surfaces the matching `ng-invalid-<rule>` class, and (unless `allowInvalid`) keeps the bad value out of the data:
+    - [x] **`required`** (also as the `ng-required="expr"` conditional form) — fails when the control is empty.
+    - [x] **`ng-minlength` / `ng-maxlength`** — fail when the text is too short / too long.
+    - [x] **`ng-pattern`** (and the native `pattern` attribute) — fails when the text doesn't match the supplied pattern.
+    - [x] **`email`** type — fails on a malformed email address.
+    - [x] **`number`** type — fails on non-numeric input.
+    - [x] **`url`** type — fails on a malformed URL.
+    - [x] **`min` / `max`** on number/range/date controls — fail when the value is out of range.
+    - [x] Each rule re-evaluates whenever its input or its own bound parameter changes (e.g. changing the `ng-minlength` expression re-validates the current value).
+
+### 2.7 Custom validators
+
+- **As a** developer, **I want** to add my own synchronous and asynchronous rules, **so that** I can enforce app-specific constraints (including server checks).
+  - **Acceptance Criteria:**
+    - [x] A developer can register a **synchronous** rule under a name; returning false marks the control invalid under that name (`ng-invalid-<name>`), and the rule runs on every value change.
+    - [x] A developer can register an **asynchronous** rule under a name that resolves/rejects; while any async rule is outstanding the control reports **pending** and carries `ng-pending`, and the data is not written until async rules settle (per parity).
+    - [x] Async rules only run after all synchronous rules pass (parity ordering).
+    - [x] A developer can read the per-rule pass/fail map and the overall pending state from the model controller.
+    - [x] A developer can force re-validation programmatically.
+
+### 2.8 Error routing & timing (developer-visible behavior)
+
+- **Acceptance Criteria:**
+    - [x] Programming errors in form setup (e.g. a non-assignable `ng-model`, a malformed `ng-options` expression) surface as clear, named errors through the framework's existing error-reporting path — they do not silently no-op.
+    - [x] State-class updates and validity changes are applied within the normal update cycle (synchronously with respect to animations, which are deferred to a later phase) so feedback appears at the same time as the rest of the page updates.
+
+---
+
+## 3. Scope and Boundaries
+
+### In-Scope
+
+- `ng-model` two-way binding and the model controller value pipeline (toward-data / toward-screen transforms, render, programmatic value-changed entry point, on-screen vs stored value).
+- Per-control and per-form state tracking (touched/untouched, dirty/pristine, valid/invalid, empty/not-empty, pending, submitted) and the **full** AngularJS state-class surface including per-rule classes.
+- Form-element directives: `form`, `ng-form` (nested forms) and the form controller; `input` for every listed HTML5 type; `select` (including `multiple`); `textarea`. Typed model values (number/boolean/Date/array) per AngularJS parity.
+- `ng-model` helpers: `ng-model-options` (full parity set — `updateOn`, `debounce`, `allowInvalid`, `getterSetter`, `timezone`), `ng-options`, `ng-list`, `ng-change`.
+- Built-in validators: `required`/`ng-required`, `ng-minlength`, `ng-maxlength`, `ng-pattern`/`pattern`, `email`, `number`, `url`, `min`/`max`.
+- Custom validators: synchronous and asynchronous rule pipelines, pending state, per-rule result map, programmatic re-validation.
+
+### Out-of-Scope
+
+- **Animations on state changes** — class toggles are synchronous now; `$animate` integration lands with the Animations roadmap item (Phase 4).
+- **Routing, `$http`-backed form submission helpers** — separate roadmap items; this spec only provides the validation/binding building blocks (a custom async validator may call `$http`, but no form-specific networking is added).
+- **All other roadmap items** are out of scope for this spec: Routing, Animations, Package & Distribution, and the entire Phase 5 AngularJS Compatibility Layer.
+- **Legacy/IE quirks** and non-modern-browser input behaviors (consistent with the project's stated non-goals).
diff --git a/context/spec/039-forms-and-validation/tasks.md b/context/spec/039-forms-and-validation/tasks.md
new file mode 100644
index 0000000..e68cb27
--- /dev/null
+++ b/context/spec/039-forms-and-validation/tasks.md
@@ -0,0 +1,61 @@
+# Tasks: Forms & Validation
+
+- **Specification:** `context/spec/039-forms-and-validation/`
+- **Status:** Draft
+
+---
+
+- [x] **Slice 1: `src/forms/` scaffold + `NgModelController` + `ngModel` two-way binding on text `input` / `textarea`**
+  - [x] Scaffold `src/forms/`: `index.ts` barrel, `ng-model-controller.ts`, `ng-model.ts`, `input.ts`, `input-types.ts`, `state-classes.ts`, `forms-register.ts`; add packaging wiring — `@forms/*` in `tsconfig.json`, `@forms` alias in `vitest.config.ts`, `./forms` in `package.json` `exports`, the `src/forms/index.ts` rollup entry + `@forms/*` dts alias in `rollup.config.mjs`, and a root-barrel re-export in `src/index.ts`. **[Agent: rollup-build]**
+  - [x] Implement `NgModelController` (`ng-model-controller.ts`): the `$viewValue`/`$modelValue` pipeline (`$parsers`/`$formatters`/`$render`/`$setViewValue`/`$commitViewValue`/`$rollbackViewValue`), state (`$dirty`/`$pristine`/`$touched`/`$untouched`/`$valid`/`$invalid`, `$setPristine`/`$setDirty`/`$setTouched`/`$setUntouched`), `$setValidity`/`$error`, `$isEmpty`, `$viewChangeListeners`, and the model→view feedback guard. Export the `NgModelController` contract type from the barrel. **[Agent: typescript-framework]**
+  - [x] Implement `ngModel` directive (`ng-model.ts`): parse the model expression (`@parser`), build write-back via `buildParentWriter` (`@compiler/expression-assign`; non-assignable → `'$compile'` error), install `scope.$watch(modelExpr)` running `$formatters` reverse + `$render`, publish the controller for `require: 'ngModel'`, and wire `ngChange` into `$viewChangeListeners`. Implement the `text` handler in `input-types.ts` + the single `input` directive (`restrict: 'E'`, `require: '?ngModel'`) dispatching on `type` (default→text), plus the `textarea` directive delegating to `text`; native `input`/`change` listeners call `$setViewValue`. **[Agent: typescript-framework]**
+  - [x] Implement `state-classes.ts`: append-only `classList` toggling (`ng-valid`/`ng-invalid`, `ng-dirty`/`ng-pristine`, `ng-touched`/`ng-untouched`, `ng-empty`/`ng-not-empty`, per-key `ng-valid-<key>`/`ng-invalid-<key>` dasherized) that never strips author classes. Register `ngModel`/`input`/`textarea`/`ngChange` on `ngModule` via `forms-register.ts` `.config(['$compileProvider', …])` blocks invoked from `src/core/ng-module.ts`. **[Agent: typescript-framework]**
+  - [x] Create `src/forms/__tests__/ng-model.test.ts`: typing into a text `input` updates a nested model path (intermediate objects created); model change in code re-renders the field; non-assignable `ng-model` routes `'$compile'`; dirty/pristine/touched transitions + the matching classes; `ng-empty`/`ng-not-empty`; `ngChange` fires on committed view change only; `textarea` binds a string. Use `bootstrapInjector` + `$compile`. **[Agent: vitest-testing]**
+  - [x] Run `pnpm lint`, `pnpm format:check`, `pnpm typecheck`, `pnpm test`, `pnpm build`; new `./forms` entry emits ESM+CJS+`.d.ts`. **[Agent: rollup-build]**
+
+- [x] **Slice 2: `FormController` + `form` / `ngForm` aggregation**
+  - [x] Implement `FormController` (`form-controller.ts`): `$addControl`/`$removeControl`, `$setValidity(key, isValid, control)` aggregation into form `$error`/`$pending`, `$setDirty`/`$setPristine` (parent propagation), `$setSubmitted` (+`ng-submitted`), `$$renameControl`, and the `$valid`/`$invalid`/`$dirty`/`$pristine`/`$submitted` aggregate state. Export the `FormController` contract type. **[Agent: typescript-framework]**
+  - [x] Implement `form` + `ngForm` directives (`form.ts`, shared factory): `require: '?^^form'` nesting with a `nullFormCtrl` fallback so `ngModel` works form-less; publish a named form onto scope and named controls onto the form instance (so `myForm.email.$invalid` reads in expressions); a `submit` listener calling `$setSubmitted` + running `ngSubmit`, `preventDefault` when no `action`. Wire `ngModel` to register itself with the enclosing form (and deregister on `$destroy`). Register on `ngModule`. **[Agent: typescript-framework]**
+  - [x] Create `src/forms/__tests__/form.test.ts`: `<form>` auto-creates a group; form invalid iff any control invalid; form dirty iff any control dirty; named form/control reachable in expressions; nested `ng-form` bubbles validity to the parent; control removal (via `ng-if`) removes its contribution; submit marks `$submitted` + `ng-submitted` + runs `ng-submit` with native submit suppressed; programmatic `$setPristine`/`$setSubmitted`. **[Agent: vitest-testing]**
+  - [x] Run all five gates. **[Agent: rollup-build]**
+
+- [x] **Slice 3: Input type matrix — number/range, checkbox, radio, date/time family**
+  - [x] Implement the typed `inputType` handlers (`input-types.ts` + `input-date.ts`): `number`/`range` (numeric parse, invalid→control invalid not bad model, `range` clamp), `checkbox` (boolean + `ng-true-value`/`ng-false-value`, `$isEmpty`=unchecked), `radio` (group shares model, `$render` sets `checked`), and `date`/`datetime-local`/`time`/`month`/`week` (`Date` model, per-type parse/format; default/local timezone — full `timezone` option wiring lands in Slice 6); `hidden`/`button`/`submit`/`reset` as no-model controls; `email`/`url`/`search`/`tel`/`password` baseline string handlers. **[Agent: typescript-framework]**
+  - [x] Create `src/forms/__tests__/input-types.test.ts`: `number`→Number (+ bad input invalid), `range`→Number clamp, `checkbox`→boolean (+ true/false overrides), `radio`→selected value across a group, each date/time type round-trips a `Date`, empty mapping per type. Port relevant `inputSpec.js` vectors. **[Agent: vitest-testing]**
+  - [x] Run all five gates. **[Agent: rollup-build]**
+
+- [x] **Slice 4: `select` + `ngOptions` + `ngList`**
+  - [x] Implement `select.ts` (`select` directive + `SelectController`): option registration/tracking, single-select binds the chosen value, `multiple` binds an **array**, unknown-value "unknown option" handling; integrate with `NgModelController`. **[Agent: typescript-framework]**
+  - [x] Implement `ng-options.ts`: parse the AngularJS `ngOptions` grammar (`select [as label] [group by g] [disable when d] for (k,v) in coll [track by t]`) into a descriptor, regenerate `<option>`s on a `$watchCollection`, integrate with `SelectController`. Implement `ng-list.ts` (`$parser` split→trimmed array / `$formatter` join, configurable delimiter). Register all on `ngModule`. **[Agent: typescript-framework]**
+  - [x] Create `src/forms/__tests__/select.test.ts` + `ng-options.test.ts` + `ng-list.test.ts`: single + `multiple` select binding; `ngOptions` label/value/group-by/disable-when/track-by from array and object collections; `ngList` string↔array with default and custom delimiter. Port `selectSpec.js`/`ngOptionsSpec.js` vectors. **[Agent: vitest-testing]**
+  - [x] Run all five gates. **[Agent: rollup-build]**
+
+- [x] **Slice 5: Validators — built-in + custom sync/async + `$pending`**
+  - [x] Implement the validation engine in `NgModelController`: `$validators`/`$asyncValidators` maps, `$validate()`, and `$$runValidators(modelValue, viewValue, done)` — sync first, async only if all sync pass, `$pending`+`ng-pending` while outstanding, `$q.all(...)` settle, and a generation counter cancelling stale async passes; default keeps invalid values out of the model (model→`undefined`). **[Agent: typescript-framework]**
+  - [x] Implement built-in validator directives (`validators.ts`): `required`/`ngRequired`, `ngMinlength`/`ngMaxlength`, `pattern`/`ngPattern`, `min`/`max` (each `$observe`s its attribute to re-validate), and wire the `email`/`number`/`url` type validators through their `inputType` handlers. Register on `ngModule`. **[Agent: typescript-framework]**
+  - [x] Create `src/forms/__tests__/validators.test.ts`: each built-in rule flips control+form validity and the `ng-invalid-<rule>` class; conditional `ng-required`; re-validation when a rule's bound expression changes; a custom sync `$validators` entry; a custom `$asyncValidators` entry → `$pending`+`ng-pending` until settle, model written only on pass; async runs only after sync pass; stale async cancelled; programmatic `$validate`. **[Agent: vitest-testing]**
+  - [x] Run all five gates. **[Agent: rollup-build]**
+
+- [x] **Slice 6: `ngModelOptions` — `updateOn` / `debounce` / `allowInvalid` / `getterSetter` / `timezone`**
+  - [x] Implement `ng-model-options.ts` (directive + resolved-options helper) and thread it through `NgModelController`: `updateOn` (which events commit), `debounce` (per-event delay via timers cleared on `$destroy`), `allowInvalid` (write invalid values), `getterSetter` (model expression used as read/write fn), and `timezone` (date handlers honor it). `$$phase`-guarded commit dispatch. Register on `ngModule`. **[Agent: typescript-framework]**
+  - [x] Create `src/forms/__tests__/ng-model-options.test.ts` (vitest fake timers): `updateOn: 'blur'` defers commit; `debounce` (number + per-event map) delays the model write and cancels on destroy; `allowInvalid` writes invalid values; `getterSetter` round-trips through the function; `timezone` shifts a date round-trip. **[Agent: vitest-testing]**
+  - [x] Run all five gates. **[Agent: rollup-build]**
+
+- [x] **Slice 7: Type-level safety, parity hardening, docs, coverage & final regression**
+  - [x] Create `src/forms/__tests__/forms-types.test.ts` (`expectTypeOf`): exported `NgModelController` / `FormController` / `NgModelOptions` contracts compile against representative consumer usage. Create `src/forms/__tests__/parity.test.ts`: port remaining upstream `ngModelSpec.js`/`formSpec.js` edge-case vectors per the reference-implementation rule. **[Agent: vitest-testing]**
+  - [x] Add `src/forms/README.md` (the controllers, pipeline, state classes, input-type matrix, validator + ngModelOptions contracts, worked examples). Update `CLAUDE.md` (`./forms` Modules row + "Non-obvious invariants" bullets: model write-back via `buildParentWriter`; sync-before-async validation + `$pending` generation guard; synchronous class toggles / `$animate` deferred; single-`input`-directive type registry; `EXCEPTION_HANDLER_CAUSES` STILL 13) and the "Where to look when…" table. Tick the **Forms & Validation** roadmap items in `context/product/roadmap.md`. Add `forms` to the per-module 90% coverage set in `vitest.config.ts` (n/a — the config uses a single global `lines: 90` threshold, not per-module; `async`/`http` are not enumerated either, so `forms` is covered by the same global gate). **[Agent: typedoc-docs]**
+  - [x] Final regression: `pnpm lint`, `pnpm format:check`, `pnpm typecheck`, `pnpm test`, `pnpm build` — all green; full prior-spec suite green; **`EXCEPTION_HANDLER_CAUSES.length === 13`** (no new token); `./forms` resolves from both `dist` root entries (ESM + CJS + `.d.ts`). **[Agent: rollup-build]**
+
+---
+
+## Notes for the Implementation Agent
+
+- **Verification is Vitest + jsdom + the five gates** — forms are DOM directives but jsdom covers them (the existing `$compile` test pattern); no browser MCP or external services required. Async-validator and `ngModelOptions` timing use vitest fake timers.
+- **Keep `NgModelController`/`FormController` parity-faithful** — port behavior and tests from `angular/angular.js/test/ng/directive/` (`ngModelSpec.js`, `inputSpec.js`, `formSpec.js`, `selectSpec.js`, `ngOptionsSpec.js`).
+- **No new `EXCEPTION_HANDLER_CAUSES` token** — directive-side errors reuse `'$compile'`; tuple stays at 13. Grep for hardcoded `=== 13` before any change.
+- **Single `input` directive + internal `inputType` registry** (parity) — not one directive per type. `textarea` delegates to the `text` handler.
+- **Slice 3/6 timezone seam** — date handlers ship with a default/local timezone in Slice 3; the `ngModelOptions.timezone` wiring generalizes it in Slice 6. Keep date parse/format isolated in `input-date.ts` to make that handoff clean.
+- **Model write-back via `buildParentWriter`** (`@compiler/expression-assign`) — don't reimplement assignment; non-assignable `ng-model` routes `'$compile'`.
+- **Async validators use `$q`** — `$$runValidators` runs sync `$validators` first, async only if all sync pass; a per-run generation counter cancels stale async passes; deregister watches/listeners/timers on `$destroy`.
+- **Synchronous state-class toggles** — `$animate` integration is deferred to Phase 4; toggle via `classList`, append-only, never stripping author classes (the `ng-class` guarantee).
+- **Tick task checkboxes in the SAME commit as the implementation** per `CLAUDE.md`.
diff --git a/context/spec/039-forms-and-validation/technical-considerations.md b/context/spec/039-forms-and-validation/technical-considerations.md
new file mode 100644
index 0000000..36000da
--- /dev/null
+++ b/context/spec/039-forms-and-validation/technical-considerations.md
@@ -0,0 +1,152 @@
+# Technical Specification: Forms & Validation
+
+- **Functional Specification:** `context/spec/039-forms-and-validation/functional-spec.md`
+- **Status:** Completed
+- **Author(s):** Mgrdich
+
+---
+
+## 1. High-Level Technical Approach
+
+Forms ships as a **new `src/forms/` subpath** (`@forms/*` alias, `./forms` in `package.json` exports + `rollup.config.mjs`), mirroring how `./controller` and `./async` are packaged. The directives themselves are **core `ng` directives** — they register on `ngModule` via `.config(['$compileProvider', …])` blocks (DI-only, exactly like every other built-in directive), so an app reaching `'ng'` gets them for free. The subpath exists for code organization and to **export the controller/type contracts** (`NgModelController`, `FormController`, `NgModelOptions`, `ModelValidators`, …) so consumers can type against them.
+
+The centerpiece is **`NgModelController`** — a per-control controller (published via the existing `$$ngControllers` element stash so `require: 'ngModel'` resolves it) implementing the bidirectional value pipeline (`$formatters` / `$parsers` / `$render` / `$setViewValue` / `$validate`). Form-element directives (`input`, `textarea`, `select`) `require: '?ngModel'` and wire type-specific format/parse/render + native DOM event listeners onto it. **`FormController`** (from `form` / `ngForm`) aggregates child control + sub-form validity and publishes itself under its `name` on scope. Validators attach to `NgModelController.$validators` / `$asyncValidators`; async validators use **`$q`**. Model write-back reuses **`buildParentWriter`** from `@compiler/expression-assign`. No new `EXCEPTION_HANDLER_CAUSES` token — directive-side errors reuse `'$compile'` (the established precedent; tuple stays at 13).
+
+`$animate` is **not** wired — all state-class toggles are synchronous via `classList`, consistent with `ng-show`/`ng-hide` and deferred to Phase 4.
+
+---
+
+## 2. Proposed Solution & Implementation Plan (The "How")
+
+### 2.1 Module layout & packaging
+
+New subpath `src/forms/` (register on `ngModule`, barrel exports the public contracts):
+
+| File | Responsibility |
+| --- | --- |
+| `src/forms/index.ts` | Barrel: re-export public types + `forms-register.ts` wiring; **no** directive factories in the public surface (DI-only, matches `ngTransclude` precedent) |
+| `src/forms/ng-model-controller.ts` | `NgModelController` class — the value pipeline + state + validation engine |
+| `src/forms/ng-model.ts` | `ngModel` directive — instantiates the controller, installs the model `$watch`, wires `ngChange` |
+| `src/forms/ng-model-options.ts` | `ngModelOptions` directive + the resolved-options helper (`updateOn` / `debounce` / `allowInvalid` / `getterSetter` / `timezone`) |
+| `src/forms/form-controller.ts` | `FormController` class — child registration + validity aggregation + `$setSubmitted`/`$setPristine` |
+| `src/forms/form.ts` | `form` + `ngForm` directives (share one factory); submit handling; name publishing |
+| `src/forms/input.ts` | the single `input` directive (`restrict: 'E'`, `require: '?ngModel'`) dispatching on `type` |
+| `src/forms/input-types.ts` | the internal `inputType` registry (text/number/date-family/checkbox/radio/url/email/range/…) |
+| `src/forms/input-date.ts` | date/time family parse/format helpers + `timezone` handling |
+| `src/forms/select.ts` | `select` directive + `SelectController` (option registration, `multiple`) |
+| `src/forms/ng-options.ts` | `ngOptions` directive — grammar parse + option generation |
+| `src/forms/validators.ts` | built-in validator directives (`required`/`ngRequired`, `ngMinlength`/`ngMaxlength`, `pattern`/`ngPattern`, `min`/`max`) + the `email`/`number`/`url` type validators (registered through `input-types`) |
+| `src/forms/ng-list.ts` | `ngList` directive (string ↔ array transform) |
+| `src/forms/forms-register.ts` | the `.config([...])` blocks registering every directive on `ngModule` |
+| `src/forms/state-classes.ts` | shared CSS-class toggling helper (`ng-valid`/`ng-dirty`/per-key/…), append-only, consumer-class-safe |
+
+**Build wiring:** add `"./forms"` to `package.json` exports, `@forms/*` to `tsconfig.json` paths, a `{ name: 'forms/index', input: 'src/forms/index.ts' }` rollup entry + the `tsPathAliases` mirror, and `./forms` to the coverage-threshold module list.
+
+### 2.2 `NgModelController` (the value pipeline)
+
+Contract (method/field names are public API — AngularJS parity):
+
+| Member | Purpose |
+| --- | --- |
+| `$viewValue` / `$modelValue` | current on-screen value / current stored value |
+| `$parsers: Array<(v) => unknown>` | view → model transforms (run in order on `$setViewValue`) |
+| `$formatters: Array<(v) => unknown>` | model → view transforms (run reverse on model change) |
+| `$validators` / `$asyncValidators` | sync rule map (`(modelValue, viewValue) => boolean`) / async rule map (`=> QPromise`) |
+| `$viewChangeListeners` | callbacks fired after a committed view change (backs `ngChange`) |
+| `$render()` | directive-supplied; writes `$viewValue` to the DOM control |
+| `$setViewValue(value, trigger?)` | entry point from the control; runs parsers → validate → write-back (honoring `updateOn`/`debounce`) |
+| `$validate()` | re-run all validators against current model/view value |
+| `$commitViewValue()` / `$rollbackViewValue()` | debounce/updateOn buffer flush + revert |
+| `$setValidity(key, isValid)` | set a single rule's result; updates `$error`/`$pending`, toggles `ng-valid-<key>`/`ng-invalid-<key>` |
+| `$error` / `$pending` | failing-rule map / outstanding-async-rule map |
+| `$setPristine()`/`$setDirty()`/`$setTouched()`/`$setUntouched()` | state transitions |
+| `$dirty`/`$pristine`/`$touched`/`$untouched`/`$valid`/`$invalid` | booleans mirrored to state classes |
+| `$isEmpty(value)` | overridable emptiness test (drives `ng-empty`/`required`) |
+
+- Instantiated in the `ngModel` directive's controller seam; published on the element so `require: 'ngModel'` resolves it (LinkFn 4th arg).
+- Model→view: `ngModel` installs `scope.$watch(modelExpr, …)`; on change runs `$formatters` reverse, sets `$viewValue`, calls `$render()`.
+- View→model write-back: parsed model expression → `buildParentWriter(parsedModelExpr)` from `@compiler/expression-assign`; non-assignable model surfaces the existing assignability error via `'$compile'`. `getterSetter` mode wraps read/write through the bound function instead.
+
+### 2.3 Validation engine & timing
+
+- `$setViewValue` / model-change → `$$runValidators(modelValue, viewValue, doneCallback)`: run `$validators` synchronously (set each key), then — only if all sync pass — run `$asyncValidators`, marking `$pending` and `ng-pending` until the `$q.all(...)` settles. A newer run **cancels** an in-flight async pass (generation counter) so stale resolutions don't write validity.
+- `allowInvalid` (from `ngModelOptions`) decides whether an invalid parse/validation still writes `$modelValue` to scope; default keeps invalid values out (model set to `undefined`).
+- Built-in validators register as **directives** that push onto `$validators`/`$parsers` (e.g. `ngMinlength` adds a `minlength` validator and `$observe`s its attribute to re-validate); the `number`/`email`/`url`/`date` **type** validators are wired by the corresponding `inputType` handler.
+
+### 2.4 `input` directive + type registry
+
+One `input` directive (`restrict: 'E'`, `require: '?ngModel'`, link no-op when no `ngModel`). Link dispatches `attrs.type` (default/unknown → `text`) into the internal `inputType` map:
+
+| Type(s) | Model value | Notes |
+| --- | --- | --- |
+| `text`, `search`, `tel`, `password`, (`textarea` reuses) | string | baseline format/parse + `input`/`change` listeners |
+| `email` / `url` | string | add `email`/`url` validators |
+| `number` / `range` | number | numeric parse + `min`/`max`/`step` validators; `range` clamps |
+| `date`/`datetime-local`/`time`/`month`/`week` | `Date` | per-type parse/format via `input-date.ts`, honoring `ngModelOptions.timezone`; `min`/`max` as dates |
+| `checkbox` | boolean | `ng-true-value`/`ng-false-value` overrides; `$isEmpty` = not-checked |
+| `radio` | the radio's value | group shares the model; `$render` sets `checked` |
+| `hidden`/`button`/`submit`/`reset` | n/a | no model parsing |
+
+`textarea` is a thin directive delegating to the `text` handler. Default `updateOn` is `input change`.
+
+### 2.5 `select`, `ngOptions`, `ngList`
+
+- `select`: `SelectController` tracks registered `<option>` values; single-select binds the chosen value, `multiple` binds an **array**; unknown-value renders an "unknown option" per parity.
+- `ngOptions`: parse the AngularJS grammar (`select [as label] [group by g] [disable when d] for (k,v) in coll [track by t]`) into a small descriptor; regenerate options on a `$watchCollection` over the collection; integrate with `SelectController`.
+- `ngList`: a `$parser` (split on delimiter → trimmed array) + `$formatter` (join), delimiter from the attribute (default `,`).
+
+### 2.6 `FormController` (`form` / `ngForm`)
+
+| Member | Purpose |
+| --- | --- |
+| `$addControl` / `$removeControl` | child control + sub-form registration |
+| `$setValidity(key, isValid, control)` | bubble a child's validity; aggregate into form `$error`/`$pending` |
+| `$setDirty()` / `$setPristine()` | propagate up to parent form; toggle `ng-dirty`/`ng-pristine` |
+| `$setSubmitted()` | mark submitted (+ `ng-submitted`), propagate to parent |
+| `$valid`/`$invalid`/`$dirty`/`$pristine`/`$pending`/`$submitted` | aggregate state |
+| `$$renameControl` | support changing a control's `name` |
+
+- `form`/`ngForm` share one factory; `require: '?^^form'` for nesting; a `nullFormCtrl` lets `ngModel` work without an enclosing form.
+- Named form publishes itself on scope (`buildParentWriter`-style assignment under `attrs.name`); named controls publish onto the form instance so `myForm.email.$invalid` reads in expressions.
+- `form` adds a `submit` listener that calls `$setSubmitted()` + runs `ngSubmit`, and `preventDefault`s native submit when there's no `action` (parity).
+
+### 2.7 State CSS classes
+
+Shared `state-classes.ts` helper toggles via `classList` (append-only; never strips author classes — same guarantee as `ng-class`): `ng-valid`/`ng-invalid`, `ng-dirty`/`ng-pristine`, `ng-touched`/`ng-untouched`, `ng-empty`/`ng-not-empty`, `ng-pending`, per-rule `ng-valid-<key>`/`ng-invalid-<key>` (key dasherized), and `ng-submitted` on forms.
+
+### 2.8 DI registration & dependencies
+
+- All directives registered through `forms-register.ts` `.config` blocks on `ngModule` (in `src/core/ng-module.ts` import + invoke, matching the existing built-in registration site).
+- Factory deps: `ngModel`/validators need `$parse` (or `@parser` `parse`), `$q` (async validators), `$exceptionHandler` (error routing), and the date helpers; resolved via the standard array-form DI.
+
+### 2.9 Proposed implementation slices (for `/awos:tasks`)
+
+1. **NgModelController + ngModel + text `input`/`textarea`** — pipeline, state, classes, write-back, `ngChange`.
+2. **FormController + `form`/`ngForm`** — aggregation, naming, submit, `ng-submitted`, nullFormCtrl.
+3. **Input type matrix** — number/range, checkbox, radio, date/time family (+ timezone).
+4. **`select` + `ngOptions` + `ngList`.**
+5. **Validators** — built-in (`required`/length/pattern/min/max + email/number/url) and custom `$validators`/`$asyncValidators` + `$pending`.
+6. **`ngModelOptions`** — `updateOn`/`debounce`/`allowInvalid`/`getterSetter`/`timezone` threaded through the controller.
+
+---
+
+## 3. Impact and Risk Analysis
+
+- **System Dependencies:** `$compile` (controller seam, `require`, `$observe`/`$set`), `@parser` (`parse` + `expression-assign` write-back), `$q` (async validators), `$exceptionHandler`, core `Scope` (`$watch`/`$on('$destroy')`/`$evalAsync`/`$$phase`). No changes to those modules' public contracts are anticipated.
+- **Potential Risks & Mitigations:**
+  - *Two-way binding feedback loops* (model watch ↔ view write). Mitigation: AngularJS's last-value guard — `$render` only on model-vs-view divergence; commit path sets `$modelValue` before writing scope.
+  - *Async validator races / leaks.* Mitigation: per-run generation counter cancels stale passes; deregister on `$destroy`.
+  - *Date parsing/timezone correctness* is the highest-fidelity-risk area. Mitigation: port upstream `input.js` date specs verbatim; isolate logic in `input-date.ts`.
+  - *`debounce`/`updateOn` timers* must integrate with the digest and cancel on destroy. Mitigation: route through `$evalAsync`/`$applyAsync` patterns already used elsewhere; clear timers on `$destroy`.
+  - *`$$phase` reentrancy* when events fire mid-digest. Mitigation: the established `$$phase`-guarded `$apply` vs `$evalAsync` dispatch used by event directives.
+  - *Subpath build wiring* (4 coordinated edits). Mitigation: follow the `./async` precedent exactly; a build smoke check.
+  - *Same-element conflicts* (e.g. `ngModel` requiring a missing control). Mitigation: `require: '?ngModel'` optional flags + clear `'$compile'`-routed errors.
+
+---
+
+## 4. Testing Strategy
+
+- **Unit (Vitest + jsdom), parity-first:** port test vectors from `angular/angular.js/test/ng/directive/` (`ngModelSpec.js`, `inputSpec.js`, `formSpec.js`, `selectSpec.js`, `ngOptionsSpec.js`, validators) and `test/ng/` for the controller. Each slice lands its own `src/forms/__tests__/*.test.ts`.
+- **Coverage:** add `forms` to the 90%-line-threshold module set in `vitest.config.ts`.
+- **Behavioral focus areas:** typed model values per input type; state-class toggling (incl. per-key + `ng-pending` + `ng-submitted`); validation ordering (sync before async) and `$pending`; `ngModelOptions` timing (debounce/updateOn) with fake timers; date/timezone round-trips; nested-form aggregation and control add/remove on `ng-if`/`ng-repeat` teardown.
+- **Type-level:** assert the exported `NgModelController` / `FormController` / `NgModelOptions` contracts compile against representative consumer usage (compile-only test file).
diff --git a/package.json b/package.json
index 1c3dc18..d5000cf 100644
--- a/package.json
+++ b/package.json
@@ -84,6 +84,11 @@
       "import": "./dist/esm/http/index.mjs",
       "require": "./dist/cjs/http/index.cjs",
       "types": "./dist/types/http/index.d.ts"
+    },
+    "./forms": {
+      "import": "./dist/esm/forms/index.mjs",
+      "require": "./dist/cjs/forms/index.cjs",
+      "types": "./dist/types/forms/index.d.ts"
     }
   },
   "repository": "https://github.com/Mgrdich/my_own_angularjs.git",
diff --git a/rollup.config.mjs b/rollup.config.mjs
index ca9644d..598045d 100644
--- a/rollup.config.mjs
+++ b/rollup.config.mjs
@@ -40,6 +40,7 @@ const entries = [
   { name: 'async/index', input: 'src/async/index.ts' },
   { name: 'cache/index', input: 'src/cache/index.ts' },
   { name: 'http/index', input: 'src/http/index.ts' },
+  { name: 'forms/index', input: 'src/forms/index.ts' },
 ];
 
 // Path aliases declared in `tsconfig.json` are used across the codebase
@@ -64,6 +65,7 @@ const tsPathAliases = {
   '@async/*': ['src/async/*'],
   '@cache/*': ['src/cache/*'],
   '@http/*': ['src/http/*'],
+  '@forms/*': ['src/forms/*'],
 };
 
 const bundleConfigs = entries.map((entry) => ({
diff --git a/src/compiler/__tests__/dom-guards.ts b/src/compiler/__tests__/dom-guards.ts
new file mode 100644
index 0000000..cad2369
--- /dev/null
+++ b/src/compiler/__tests__/dom-guards.ts
@@ -0,0 +1,42 @@
+/**
+ * Shared DOM-narrowing guards for the test suite.
+ *
+ * Tests routinely pull nodes out of `querySelector` / `querySelectorAll` /
+ * `firstElementChild` reads, which type as `Element | null` (or
+ * `| undefined` under `noUncheckedIndexedAccess`). An `as HTMLInputElement`
+ * cast silences BOTH the null/undefined case and the wrong-element case;
+ * these wrappers narrow via `@core`'s throwing `asInstanceOf` guard
+ * instead, failing the test at the read rather than at a downstream
+ * property access.
+ *
+ * This file is INTERNAL to the test suite (the `test-helpers.ts`
+ * precedent): it lives under `__tests__/`, is not re-exported from any
+ * public barrel, and is imported cross-module as
+ * `@compiler/__tests__/dom-guards`.
+ */
+
+import { asInstanceOf } from '@core/index';
+
+export function asHtmlElement(node: Node | null | undefined): HTMLElement {
+  return asInstanceOf(node, HTMLElement);
+}
+
+export function asInput(node: Node | null | undefined): HTMLInputElement {
+  return asInstanceOf(node, HTMLInputElement);
+}
+
+export function asTextarea(node: Node | null | undefined): HTMLTextAreaElement {
+  return asInstanceOf(node, HTMLTextAreaElement);
+}
+
+export function asForm(node: Node | null | undefined): HTMLFormElement {
+  return asInstanceOf(node, HTMLFormElement);
+}
+
+export function asSelect(node: Node | null | undefined): HTMLSelectElement {
+  return asInstanceOf(node, HTMLSelectElement);
+}
+
+export function asOption(node: Node | null | undefined): HTMLOptionElement {
+  return asInstanceOf(node, HTMLOptionElement);
+}
diff --git a/src/compiler/__tests__/ng-event-directives.test.ts b/src/compiler/__tests__/ng-event-directives.test.ts
index cd534b5..8050d8d 100644
--- a/src/compiler/__tests__/ng-event-directives.test.ts
+++ b/src/compiler/__tests__/ng-event-directives.test.ts
@@ -360,8 +360,8 @@ describe('expression-throw routing through $exceptionHandler', () => {
   });
 });
 
-describe('ng-submit does NOT auto-preventDefault', () => {
-  it('a submit handler that does not call $event.preventDefault leaves event.defaultPrevented === false', () => {
+describe('ng-submit does NOT auto-preventDefault (the `form` directive owns native-submit suppression)', () => {
+  it('a `<form ng-submit>` with NO action suppresses native submit by default (forms spec 039 §2.3)', () => {
     const b = bootstrap();
     const scope = Scope.create({ exceptionHandler: b.exceptionSpy });
     scope.submitted = false;
@@ -374,10 +374,32 @@ describe('ng-submit does NOT auto-preventDefault', () => {
     const ev = new Event('submit', { bubbles: false, cancelable: true });
     form.dispatchEvent(ev);
 
-    // The handler ran (the directive evaluated the expression) but the
-    // directive itself does NOT call preventDefault. The native event's
-    // `defaultPrevented` flag stays false unless the consumer's
-    // expression calls $event.preventDefault() explicitly.
+    // The `ng-submit` directive itself does NOT call preventDefault, but the
+    // `form` directive (spec 039) suppresses the native submit by default when
+    // the form carries no `action` attribute (AngularJS parity — a form without
+    // an action must not navigate). The ng-submit handler still runs exactly
+    // once (the two directives divide responsibilities — see `src/forms/form.ts`).
+    expect(scope.submitted).toBe(true);
+    expect(ev.defaultPrevented).toBe(true);
+  });
+
+  it('a `<form ng-submit>` WITH an action does NOT suppress native submit by default', () => {
+    const b = bootstrap();
+    const scope = Scope.create({ exceptionHandler: b.exceptionSpy });
+    scope.submitted = false;
+
+    const form = document.createElement('form');
+    form.setAttribute('action', '/submit');
+    form.setAttribute('ng-submit', 'submitted = true');
+
+    b.$compile(form)(scope);
+
+    const ev = new Event('submit', { bubbles: false, cancelable: true });
+    form.dispatchEvent(ev);
+
+    // A form WITH an action is left to navigate — neither `ng-submit` nor the
+    // `form` directive prevents default; only an explicit
+    // `$event.preventDefault()` in the handler would.
     expect(scope.submitted).toBe(true);
     expect(ev.defaultPrevented).toBe(false);
   });
diff --git a/src/compiler/directive-collector.ts b/src/compiler/directive-collector.ts
index bea0155..f5cc83a 100644
--- a/src/compiler/directive-collector.ts
+++ b/src/compiler/directive-collector.ts
@@ -266,6 +266,21 @@ function applySortAndTerminalCutoff(matched: readonly Directive[], suppressConfl
     if (a.priority !== b.priority) {
       return b.priority - a.priority;
     }
+    // AngularJS `byPriority` tie-breaks same-priority directives by NAME
+    // (ascending) BEFORE the global registration `index`. This matters when
+    // two DIFFERENTLY-named directives share an element AND one requires the
+    // other's controller: e.g. `<select ng-model>` (`select` requires
+    // `?ngModel`). Directive `index` is assigned lazily at first-normalize
+    // time — driven by the E/A/C collection passes, not registration order —
+    // so the element-name `select` always indexes before the attribute-name
+    // `ngModel`, which would sort `select`'s controller seam (and thus its
+    // `require` resolution) BEFORE `ngModel`'s controller exists. The name
+    // tie-break (`ngModel` < `select`) restores the parity ordering so the
+    // required controller is already stashed when the requiring directive
+    // resolves it.
+    if (a.name !== b.name) {
+      return a.name < b.name ? -1 : 1;
+    }
     return a.index - b.index;
   });
 
diff --git a/src/compiler/element-slots.ts b/src/compiler/element-slots.ts
index 62c3c0d..f68bc87 100644
--- a/src/compiler/element-slots.ts
+++ b/src/compiler/element-slots.ts
@@ -141,3 +141,35 @@ export function isNgManagedElement(el: Element): el is NgManagedElement {
 export function isNgManagedComment(el: Comment): el is NgManagedComment {
   return NG_CLEANUP_QUEUE in el || NG_BOUND_TRANSCLUDE in el;
 }
+
+/**
+ * Stash a controller instance under `name` in the element's
+ * `$$ngControllers` map, creating the (non-enumerable) map lazily on
+ * first use — the same write the compiler's per-element controller seam
+ * performs, exposed so a directive can publish a controller under an
+ * ADDITIONAL key beyond its own directive name.
+ *
+ * The motivating case (spec 039 Slice 2) is `form` / `ngForm`: both
+ * directives share one `FormController`, and `ngModel` / nested forms
+ * resolve the enclosing form via `require: '?^^form'`. The controller
+ * seam stashes each directive's controller under its own directive name
+ * (`form` for `<form>`, `ngForm` for `<ng-form>`), so the `ngForm`
+ * variant additionally stashes itself under `'form'` here to make the
+ * single `'form'` require key resolve for BOTH element shapes.
+ */
+export function stashController(element: Element, name: string, instance: unknown): void {
+  let map: Map<string, unknown> | undefined;
+  if (isNgManagedElement(element)) {
+    map = element[NG_CONTROLLERS];
+  }
+  if (map === undefined) {
+    map = new Map<string, unknown>();
+    Object.defineProperty(element, NG_CONTROLLERS, {
+      value: map,
+      writable: true,
+      configurable: true,
+      enumerable: false,
+    });
+  }
+  map.set(name, instance);
+}
diff --git a/src/compiler/index.ts b/src/compiler/index.ts
index a013c14..5a5368a 100644
--- a/src/compiler/index.ts
+++ b/src/compiler/index.ts
@@ -59,6 +59,7 @@ export {
   setElementScope,
   setIsolateHostScope,
 } from './cleanup';
+export { stashController } from './element-slots';
 export type {
   Attributes,
   CompileFn,
diff --git a/src/compiler/transclude-fn.ts b/src/compiler/transclude-fn.ts
index 95a3eb6..534f925 100644
--- a/src/compiler/transclude-fn.ts
+++ b/src/compiler/transclude-fn.ts
@@ -175,6 +175,24 @@ export function buildTranscludeFn(args: BuildTranscludeFnArgs): TranscludeFn {
       }
     }
 
+    // Invoke `cloneAttachFn` BEFORE linking (AngularJS `publicLinkFn`
+    // parity — `cloneConnectFn` runs before `compositeLinkFn`). The
+    // structural directives (`ng-if` / `ng-switch` / `ng-repeat` /
+    // `ng-include`) insert the clone into the live DOM inside this
+    // callback, so by the time the clone LINKS its `parentElement`
+    // chain is real — `require: '^' / '^^'` resolution, the
+    // `$$ngControllers` stash walks (forms / `ngModelOptions`), and the
+    // `$$ngBoundTransclude` marker walk all see their DOM ancestors.
+    // Linking first (the pre-fix order) resolved every ancestor lookup
+    // against a detached fragment and silently missed.
+    if (cloneAttachFn !== undefined) {
+      try {
+        cloneAttachFn(clones, transclusionScope);
+      } catch (err) {
+        invokeExceptionHandler(exceptionHandler, err, '$compile');
+      }
+    }
+
     // Forward through the internal cloneMap-aware Linker call form.
     // The PUBLIC `Linker` type at `directive-types.ts` is
     // `(scope) => Element | NodeList | Comment`; the runtime callable
@@ -187,14 +205,6 @@ export function buildTranscludeFn(args: BuildTranscludeFnArgs): TranscludeFn {
       invokeExceptionHandler(exceptionHandler, err, '$compile');
     }
 
-    if (cloneAttachFn !== undefined) {
-      try {
-        cloneAttachFn(clones, transclusionScope);
-      } catch (err) {
-        invokeExceptionHandler(exceptionHandler, err, '$compile');
-      }
-    }
-
     return clones;
   };
 }
diff --git a/src/core/ng-module.ts b/src/core/ng-module.ts
index 1313de5..a396fb4 100644
--- a/src/core/ng-module.ts
+++ b/src/core/ng-module.ts
@@ -97,6 +97,7 @@ import { NG_TRANSCLUDE_NAME, ngTranscludeDirective } from '@compiler/ng-transclu
 import { $ControllerProvider } from '@controller/controller-provider';
 import type { ControllerService } from '@controller/controller-types';
 import { createModule } from '@di/module';
+import { registerForms } from '@forms/forms-register';
 import { Scope } from './scope';
 import { consoleErrorExceptionHandler, type ExceptionHandler } from '@exception-handler/index';
 import { lowercaseFilterFactory, uppercaseFilterFactory } from '@filter/case';
@@ -662,5 +663,14 @@ export const ngModule = createModule('ng', [])
       $compileProvider.directive(NG_SWITCH_NAME, ngSwitchDirective);
       $compileProvider.directive(NG_SWITCH_DEFAULT_NAME, ngSwitchDefaultDirective);
       $compileProvider.directive(NG_SWITCH_WHEN_NAME, ngSwitchWhenDirective);
+      // Spec 039 Slice 1 — forms & validation. `ngModel` two-way binding
+      // (publishing the `NgModelController` so `require: 'ngModel'`
+      // resolves it), the single `input` directive dispatching on `type`
+      // (default → text), `textarea` (delegates to the `text` handler),
+      // and `ngChange` (fires on committed view change only). All four are
+      // DI-only core `ng` directives — their factories stay file-local in
+      // `src/forms/`; only the `NgModelController` contract type is
+      // exported from `@forms`. See `src/forms/forms-register.ts`.
+      registerForms($compileProvider);
     },
   ]);
diff --git a/src/core/utils.ts b/src/core/utils.ts
index 44cd1b6..a4be679 100644
--- a/src/core/utils.ts
+++ b/src/core/utils.ts
@@ -422,3 +422,22 @@ export function toInterpolationString(value: unknown): string {
   }
   return JSON.stringify(value);
 }
+
+/**
+ * Narrow `value` to an instance of `ctor`, throwing on a mismatch instead
+ * of casting. The throwing companion to the boolean `is*` guards above —
+ * use it where a value's runtime class is a structural invariant (an
+ * element-name directive's `element`, a `querySelector` read in a test)
+ * so a violation fails loudly at the read instead of surfacing as an
+ * `undefined` property access downstream.
+ *
+ * The `never[]` parameter spread keeps the signature `any`-free while
+ * accepting every constructor shape, including the DOM interface
+ * constructors (`HTMLInputElement`, …).
+ */
+export function asInstanceOf<T>(value: unknown, ctor: abstract new (...args: never[]) => T): T {
+  if (!(value instanceof ctor)) {
+    throw new Error(`expected an instance of ${ctor.name}`);
+  }
+  return value;
+}
diff --git a/src/forms/README.md b/src/forms/README.md
new file mode 100644
index 0000000..16a321a
--- /dev/null
+++ b/src/forms/README.md
@@ -0,0 +1,302 @@
+# `@forms` — forms & validation: `ngModel`, `form`, validators
+
+The `@forms` module is the interactive layer: it lets a control capture
+user input and feed it back into the app's data (**two-way binding**),
+groups controls into forms that report their own validity, and validates
+input with built-in and custom rules — synchronous and asynchronous —
+mirroring the state-class conventions AngularJS established.
+
+Unlike most modules, `@forms` exposes almost no callable API. Its
+directives (`ngModel`, `input`, `select`, `textarea`, `form`, `ngForm`,
+the validators, `ngModelOptions`, `ngOptions`, `ngList`, `ngChange`) are
+**core `ng` directives** — registered on `ngModule` via a config block
+(the `ngTransclude` / event-directive precedent), reachable for free by
+any app that lists `'ng'` in its dependency chain. What `@forms/index`
+publishes is the **contract types** a developer types against:
+`NgModelController`, `FormController`, `NgModelOptions` / `ModelOptions`,
+`SelectController`, and the `SyncValidator` / `AsyncValidator` /
+`ModelParser` / `ModelFormatter` transform types.
+
+```ts
+const injector = createInjector(['ng']);
+const $compile = injector.get('$compile');
+const $rootScope = injector.get('$rootScope');
+
+const el = document.createElement('div');
+el.innerHTML = '<input ng-model="user.name">';
+$compile(el.firstElementChild!)($rootScope);
+$rootScope.$digest();
+// Typing into the input now updates $rootScope.user.name (intermediates created).
+```
+
+## The controllers
+
+Two controllers carry the whole surface.
+
+### `NgModelController` — the per-control engine
+
+Every `ng-model` control publishes an `NgModelController`, stashed on the
+element under the `ngModel` key. Collaborating directives (the input-type
+handlers, validators, `ngChange`) reach it via `require: 'ngModel'` /
+`require: '?ngModel'`. It owns:
+
+- **the value pipeline** — `$viewValue` (what the screen shows) and
+  `$modelValue` (what binds to the data), the `$parsers` /
+  `$formatters` transform lists, `$render`, and the programmatic
+  `$setViewValue` / `$commitViewValue` / `$rollbackViewValue` entry
+  points;
+- **state** — `$dirty` / `$pristine`, `$touched` / `$untouched`,
+  `$valid` / `$invalid`, plus `$setPristine` / `$setDirty` /
+  `$setTouched` / `$setUntouched`;
+- **validation** — `$validators` / `$asyncValidators`, `$validate()`,
+  `$setValidity`, `$error`, `$pending`, and the overridable `$isEmpty`.
+
+### `FormController` — the aggregation engine
+
+Every `<form>` / `<ng-form>` publishes a `FormController` that
+aggregates the validity + dirty + submitted state of every control and
+nested sub-form beneath it. It does NOT store a boolean per control — it
+counts, **per validation key**, how many controls currently fail that
+key (`$setValidity(key, isValid, control)` pushes / removes the control
+from the key's failure set). That makes control removal correct for
+free: dropping a control (via `ng-if`) removes it from every key's set,
+so a form invalid only because of a since-removed control flips back to
+valid on its own.
+
+A named form (`<form name="myForm">`) publishes onto the surrounding
+scope, and named controls publish onto the form instance, so an
+expression reads `myForm.$invalid` and `myForm.email.$invalid`. A
+form-less `ngModel` (`<input ng-model>` with no enclosing form) targets a
+shared no-op `nullFormCtrl`, so no call site needs a null-check.
+
+## The value pipeline
+
+```
+  user types                                    model changes in code
+      │                                                   │
+   $setViewValue(v)                              scope.$watch(modelExpr)
+      │                                                   │
+   $parsers (forward, registration order)        $formatters (REVERSE order)
+      │                                                   │
+   $$runValidators ── valid? ── write model      $render → DOM control
+      │
+   $viewChangeListeners (backs ng-change)
+```
+
+- **`$parsers`** run view → model in **registration order** on every
+  committed view change; a parser returning `undefined` short-circuits
+  the rest (a failed parse — the `parse` validity key fails and the
+  value is kept out of the model).
+- **`$formatters`** run model → view in **reverse** registration order
+  whenever the bound model changes; the final string feeds `$render`.
+- The model write-back is built with `buildParentWriter`
+  (`@compiler/expression-assign` — the same assignable-write machinery
+  `ngRef` / the `=` isolate binding use), so a dotted `ng-model="a.b.c"`
+  auto-creates its intermediate objects. A **non-assignable** model
+  (`ng-model="a + b"`, `ng-model="fn()"`) routes
+  `NgModelNonAssignableError` via `$exceptionHandler('$compile')` and the
+  directive goes inert.
+- A **model→view feedback guard** on the model watch runs the pipeline
+  only when the scope model actually diverges from the cached
+  `$modelValue`, so the watch never clobbers a live keystroke and async
+  validators do not fire twice per keystroke.
+
+## State + CSS classes
+
+Every state is reflected onto the element as a CSS class so an app styles
+validation feedback with plain CSS
+(`.ng-invalid.ng-touched { border-color: red; }`). The full parity
+surface:
+
+| Pair / class | Meaning |
+| --- | --- |
+| `ng-valid` / `ng-invalid` | no failing rules / at least one |
+| `ng-pristine` / `ng-dirty` | unchanged / changed by the user |
+| `ng-untouched` / `ng-touched` | not visited / focused-then-blurred |
+| `ng-empty` / `ng-not-empty` | `$isEmpty($viewValue)` |
+| `ng-pending` | at least one async validator is outstanding |
+| `ng-valid-<rule>` / `ng-invalid-<rule>` | per-rule validity (key dasherized) |
+| `ng-submitted` (form) | a submit has been attempted |
+
+Class toggling is **append-only and synchronous**: the framework only
+ever toggles classes it manages and its mutually-exclusive partner —
+author classes (`<input class="form-control">`) are never stripped (the
+`ng-class` guarantee). There is **no `$animate` integration** — visibility
+/ validation transitions are synchronous today; `$animate` lands with the
+Animations roadmap item (Phase 4). Per-rule class names are dasherized
+(`maxLength` → `ng-invalid-max-length`) via the AngularJS
+`snake_case(name, '-')` rule.
+
+## The input-type matrix
+
+A **single** `input` directive matches every `<input>` and dispatches on
+`attrs.type` into an internal handler registry (AngularJS parity — not
+one directive per type). `textarea` delegates to the `text` handler.
+Unknown / absent types fall back to `text`.
+
+| `type` | Model value | Notes |
+| --- | --- | --- |
+| `text` / `search` / `tel` / `password` | string | baseline |
+| `email` | string | ALSO wires the `email` shape validator |
+| `url` | string | ALSO wires the `url` shape validator |
+| `number` | number | bad input → `number` invalid, not a bad model |
+| `range` | number | clamps to `min` / `max` / `step` |
+| `checkbox` | boolean | `ng-true-value` / `ng-false-value` overrides; `$isEmpty` = unchecked |
+| `radio` | selected value | a group shares the model; `$render` sets `.checked` |
+| `date` / `datetime-local` / `time` / `month` / `week` | `Date` | per-type parse/format, honors `ngModelOptions.timezone` |
+| `hidden` / `button` / `submit` / `reset` | — | no-model no-ops |
+| `<select>` | value | `multiple` binds an **array** |
+
+`number` / `date` controls read the native `validity.badInput` flag: the
+browser reports `value === ''` when it could not sanitize the raw input,
+so `badInput` is the only signal the garbage is still present.
+
+## Validators
+
+Built-in validators are attribute directives; each `require: '?ngModel'`
+and pushes a rule onto the control's `$validators` map under a fixed key,
+so a failure surfaces `ng-invalid-<key>` + `$error[key]` and bubbles to
+the enclosing form. Length / pattern validators **pass on an empty
+value** — emptiness is `required`'s concern alone, so `required` +
+`ng-minlength` compose.
+
+| Directive | Key | Rule |
+| --- | --- | --- |
+| `required` / `ng-required="expr"` | `required` | non-empty (conditional form gates on `expr`) |
+| `minlength` / `maxlength` / `ng-minlength` / `ng-maxlength` | `minlength` / `maxlength` | text length bound (native + `ng-` spellings both register) |
+| `pattern` / `ng-pattern` | `pattern` | regex match (literal `/…/`, expression `RegExp`, or string) |
+| `min` / `max` (on `number` / `range` / date) | `min` / `max` | numeric / `Date` range |
+| `email` / `number` / `url` (type) | `email` / `number` / `url` | wired by the input-type handler, not a standalone attribute |
+
+Each re-validates when its bound parameter changes: the native attribute
+is `$observe`d when present, otherwise the `ng-*` expression is
+`$watch`ed (observing a missing attribute would fire a spurious one-shot
+`undefined`).
+
+### Custom validators + `$pending`
+
+```ts
+// A synchronous rule (require: 'ngModel' → the controller):
+ctrl.$validators['evenLength'] = (modelValue, viewValue) => String(viewValue).length % 2 === 0;
+
+// An asynchronous rule — resolves for valid, rejects for invalid:
+ctrl.$asyncValidators['unique'] = (modelValue) =>
+  $http.get(`/check?name=${modelValue}`).then((res) => {
+    if (res.data.taken) return $q.reject();
+    return true;
+  });
+```
+
+The validation engine (`validation.ts`) runs in **three stages**:
+
+1. **Parse** — a failed `$parsers` chain fails only the `parse` key and
+   skips every validator.
+2. **Sync** — every `$validators` rule runs against
+   `(modelValue, viewValue)`; if any fails, async is skipped.
+3. **Async** — reached only when every sync rule passes. Each async key
+   is marked pending (`$setValidity(key, undefined)` — the tri-state),
+   `ng-pending` goes on, and `$q.all(...)` awaits. On settle each key
+   resolves valid / invalid by whether its promise resolved / rejected.
+
+`$setValidity` is **tri-state**: `true` (valid) / `false` (invalid) /
+`undefined` (pending) — the three maps (`$error`, `$$success`,
+`$pending`) are mutually exclusive per key. A monotonic
+`$$currentValidationRunId` **cancels stale async passes**: a slow server
+check that resolves after the user has typed again captures the id at
+start and no-ops if a newer pass has begun. By default an invalid value
+is kept **out of the model** (`$modelValue → undefined`);
+`ngModelOptions.allowInvalid` flips that.
+
+## `ngModelOptions`
+
+`ng-model-options="{ … }"` tunes how and when a descendant `ng-model`
+commits and reads/writes:
+
+| Option | Effect |
+| --- | --- |
+| `updateOn` | which DOM events COMMIT (e.g. `'blur'`); non-committing events still BUFFER the pending value |
+| `debounce` | delay (ms) before commit — a number, or a per-event map (`{ default: 300, blur: 0 }`) |
+| `allowInvalid` | write invalid values to the model |
+| `getterSetter` | the `ng-model` expression is a function used both to read (`fn()`) and write (`fn(v)`) |
+| `timezone` | how date/time controls interpret + display their value |
+
+Resolution is a **`$$ngControllers` stash walk** (not a
+`require: '^^?ngModelOptions'` — a deliberate parity departure): the
+control's link walks its own element's stash then the `parentElement`
+chain for the nearest resolved `ngModelOptions`, because same-element
+`require` resolution runs too early to see the fully-inherited options.
+A nested `ngModelOptions` inherits its ancestor's options unless the
+special `'*'` token appears in `updateOn` (which resets inheritance).
+`debounce` is backed by `$timeout` (`$$phase`-guarded, cancelled on
+`$destroy` / supersession).
+
+## `ngOptions` + `ngList` + `ngChange`
+
+- **`ngOptions`** generates `<option>`s from an array or object per the
+  AngularJS grammar
+  (`select [as label] [group by g] [disable when d] for (k,v) in coll [track by t]`),
+  regenerating on a `$watchCollection`. It lets a `<select>` bind
+  objects / numbers, not just strings.
+- **`ngList`** adds a `$parser` (split → trimmed array) + `$formatter`
+  (join) so `<input ng-model="tags" ng-list>` turns a delimited string
+  into an **array**. The delimiter is the attribute value (default
+  `', '`); splitting trims it, joining uses the RAW value (upstream
+  `value.join(ngList)`); a `/…/` value is a regex split (a project
+  extension).
+- **`ngChange`** registers its expression into `$viewChangeListeners`, so
+  it fires ONLY on a committed **user** change — never on a programmatic
+  model change.
+
+## `form` / `ngForm` submit + native suppression
+
+A `<form>` auto-creates a form group. Its `submit` listener calls
+`$setSubmitted()` (inside a `$$phase`-guarded `$apply` / `$evalAsync`) and,
+when the form has **no `action` attribute**, `preventDefault()`s the
+native submit — so a `<form ng-submit="…">` no longer navigates by
+default. (This supersedes the earlier "`ng-submit` does not
+`preventDefault`" note: the `form` directive now owns suppression +
+`$setSubmitted`. The `ngSubmit` directive still runs the expression and
+does NOT `preventDefault`; the `form` directive does not double-run it.)
+
+## Worked example — a validated login form
+
+```html
+<form name="login" novalidate>
+  <input name="email" type="email" ng-model="creds.email" required
+         ng-model-options="{ updateOn: 'default blur', debounce: { default: 300, blur: 0 } }" />
+  <span ng-show="login.email.$touched && login.email.$invalid">
+    <span ng-show="login.email.$error.required">Email is required.</span>
+    <span ng-show="login.email.$error.email">That is not a valid email.</span>
+  </span>
+
+  <input name="password" type="password" ng-model="creds.password"
+         ng-minlength="8" required />
+  <span ng-show="login.password.$error.minlength">At least 8 characters.</span>
+
+  <button type="submit" ng-disabled="login.$invalid">Sign in</button>
+</form>
+```
+
+- `login.$invalid` disables the button until every control is valid.
+- `login.email.$error.email` / `login.password.$error.minlength` surface
+  per-rule failures for targeted messages.
+- The email field commits 300 ms after the last keystroke, but instantly
+  on blur (`{ default: 300, blur: 0 }`).
+- Add a custom async check to `login.email` by pushing onto
+  `$asyncValidators` from a directive `require`-ing `ngModel`: the field
+  reports `ng-pending` while the check runs and the model is not written
+  until it settles.
+
+## Notes / deviations
+
+- **Errors route through `'$compile'`.** A non-assignable `ng-model`, a
+  malformed `ngOptions` expression, and a native-listener throw all route
+  via `$exceptionHandler('$compile')` — no new cause token.
+  `EXCEPTION_HANDLER_CAUSES` stays at **13**.
+- **`$animate` deferred** — class toggles are synchronous now.
+- **Single `input` directive + internal type registry** — parity;
+  `textarea` delegates to `text`.
+- **`byPriority` name tie-break** — a compiler-level parity fix: same
+  priority directives now tie-break on directive NAME before collection
+  index, so `ngModel` links before `select` and `select`'s
+  `require: '?ngModel'` resolves.
diff --git a/src/forms/__tests__/form.test.ts b/src/forms/__tests__/form.test.ts
new file mode 100644
index 0000000..409c126
--- /dev/null
+++ b/src/forms/__tests__/form.test.ts
@@ -0,0 +1,348 @@
+/**
+ * `FormController` + `form` / `ngForm` aggregation (spec 039 Slice 2).
+ *
+ * End-to-end through the canonical `ngModule` (via `bootstrapInjector`),
+ * exercising the real `$compile` / `$rootScope` so the forms directives
+ * registered by `src/core/ng-module.ts` are reachable. Control input is
+ * simulated by setting `element.value` and dispatching native `input`
+ * events; a submit is simulated by dispatching a native `submit` event on
+ * the form element (matching how a browser drives the control).
+ */
+
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import type { CompileService } from '@compiler/directive-types';
+import type { Scope } from '@core/index';
+import { bootstrapInjector } from '@bootstrap/index';
+import { asForm, asHtmlElement, asInput } from '@compiler/__tests__/dom-guards';
+import { resetRegistry } from '@di/module';
+import { FormControllerImpl } from '@forms/form-controller';
+import { NgModelControllerImpl } from '@forms/ng-model-controller';
+
+interface Harness {
+  $compile: CompileService;
+  $rootScope: Scope;
+}
+
+function boot(): Harness {
+  const injector = bootstrapInjector([]);
+  return {
+    $compile: injector.get('$compile'),
+    $rootScope: injector.get('$rootScope'),
+  };
+}
+
+afterEach(() => {
+  resetRegistry();
+});
+
+function compile(html: string, $compile: CompileService, scope: Scope): HTMLElement {
+  const el = document.createElement('div');
+  el.innerHTML = html;
+  const child = asHtmlElement(el.firstElementChild);
+  $compile(child)(scope);
+  scope.$digest();
+  return child;
+}
+
+function fireInput(el: HTMLInputElement, value: string): void {
+  el.value = value;
+  el.dispatchEvent(new Event('input'));
+}
+
+function formCtrl(el: HTMLElement): FormControllerImpl {
+  const map = (el as unknown as { $$ngControllers?: Map<string, unknown> }).$$ngControllers;
+  const ctrl = map?.get('form');
+  if (!(ctrl instanceof FormControllerImpl)) {
+    throw new Error('FormController not found on element');
+  }
+  return ctrl;
+}
+
+function modelCtrl(el: HTMLElement): NgModelControllerImpl {
+  const map = (el as unknown as { $$ngControllers?: Map<string, unknown> }).$$ngControllers;
+  const ctrl = map?.get('ngModel');
+  if (!(ctrl instanceof NgModelControllerImpl)) {
+    throw new Error('ngModel controller not found on element');
+  }
+  return ctrl;
+}
+
+describe('form — registration', () => {
+  it('registers form / ngForm on ngModule', () => {
+    const injector = bootstrapInjector([]);
+    expect(injector.has('formDirective')).toBe(true);
+    expect(injector.has('ngFormDirective')).toBe(true);
+  });
+});
+
+describe('form — auto-creates a group (FS §2.3)', () => {
+  it('a <form> becomes a form group with no extra attributes', () => {
+    const { $compile, $rootScope } = boot();
+    const form = compile('<form><input ng-model="a"></form>', $compile, $rootScope);
+    expect(formCtrl(form)).toBeInstanceOf(FormControllerImpl);
+    expect(form.classList.contains('ng-pristine')).toBe(true);
+    expect(form.classList.contains('ng-valid')).toBe(true);
+  });
+});
+
+describe('form — validity aggregation (FS §2.3)', () => {
+  it('form is invalid iff any control is invalid', () => {
+    const { $compile, $rootScope } = boot();
+    const form = compile(
+      '<form><input name="a" ng-model="a"><input name="b" ng-model="b"></form>',
+      $compile,
+      $rootScope,
+    );
+    const fc = formCtrl(form);
+    const inputA = asInput(form.querySelectorAll('input')[0]);
+
+    expect(fc.$valid).toBe(true);
+
+    // A control failing a rule makes the form invalid.
+    modelCtrl(inputA).$setValidity('required', false);
+    expect(fc.$invalid).toBe(true);
+    expect(form.classList.contains('ng-invalid')).toBe(true);
+
+    // Clearing the failure returns the form to valid.
+    modelCtrl(inputA).$setValidity('required', true);
+    expect(fc.$valid).toBe(true);
+    expect(form.classList.contains('ng-valid')).toBe(true);
+  });
+
+  it('stays invalid while ANY control fails; valid only when all pass', () => {
+    const { $compile, $rootScope } = boot();
+    const form = compile(
+      '<form><input name="a" ng-model="a"><input name="b" ng-model="b"></form>',
+      $compile,
+      $rootScope,
+    );
+    const fc = formCtrl(form);
+    const inputs = form.querySelectorAll('input');
+    const a = modelCtrl(asInput(inputs[0]));
+    const b = modelCtrl(asInput(inputs[1]));
+
+    a.$setValidity('required', false);
+    b.$setValidity('required', false);
+    expect(fc.$invalid).toBe(true);
+
+    a.$setValidity('required', true);
+    // b still fails → form still invalid.
+    expect(fc.$invalid).toBe(true);
+
+    b.$setValidity('required', true);
+    expect(fc.$valid).toBe(true);
+  });
+});
+
+describe('form — dirty aggregation (FS §2.3)', () => {
+  it('form is dirty iff any control is dirty', () => {
+    const { $compile, $rootScope } = boot();
+    const form = compile('<form><input ng-model="a"></form>', $compile, $rootScope);
+    const fc = formCtrl(form);
+    const input = asInput(form.querySelector('input'));
+
+    expect(fc.$pristine).toBe(true);
+
+    fireInput(input, 'typed');
+
+    expect(fc.$dirty).toBe(true);
+    expect(fc.$pristine).toBe(false);
+    expect(form.classList.contains('ng-dirty')).toBe(true);
+  });
+});
+
+describe('form — named form + named control in expressions (FS §2.3)', () => {
+  it('a named form is reachable on scope; named controls read through it', () => {
+    const { $compile, $rootScope } = boot();
+    const form = compile('<form name="myForm"><input name="email" ng-model="email"></form>', $compile, $rootScope);
+    const scope = $rootScope as unknown as { myForm: FormControllerImpl & { email: NgModelControllerImpl } };
+
+    expect(scope.myForm).toBeInstanceOf(FormControllerImpl);
+    expect(scope.myForm.email).toBeInstanceOf(NgModelControllerImpl);
+
+    // `myForm.email.$invalid` reads correctly through the published form.
+    const input = asInput(form.querySelector('input'));
+    modelCtrl(input).$setValidity('required', false);
+    expect(scope.myForm.email.$invalid).toBe(true);
+    expect(scope.myForm.$invalid).toBe(true);
+  });
+});
+
+describe('form — nested ng-form bubbles validity to parent (FS §2.3)', () => {
+  it('a nested ng-form contributes its validity up to the parent <form>', () => {
+    const { $compile, $rootScope } = boot();
+    const form = compile(
+      '<form name="outer"><ng-form name="inner"><input name="x" ng-model="x"></ng-form></form>',
+      $compile,
+      $rootScope,
+    );
+    const outer = formCtrl(form);
+    const innerEl = asHtmlElement(form.querySelector('ng-form'));
+    const innerMap = (innerEl as unknown as { $$ngControllers?: Map<string, unknown> }).$$ngControllers;
+    const inner = innerMap?.get('ngForm') as FormControllerImpl;
+    const input = asInput(form.querySelector('input'));
+
+    expect(outer.$valid).toBe(true);
+    expect(inner).toBeInstanceOf(FormControllerImpl);
+
+    modelCtrl(input).$setValidity('required', false);
+
+    expect(inner.$invalid).toBe(true);
+    expect(outer.$invalid).toBe(true);
+
+    modelCtrl(input).$setValidity('required', true);
+    expect(inner.$valid).toBe(true);
+    expect(outer.$valid).toBe(true);
+  });
+});
+
+describe('form — control removal drops its contribution (FS §2.3)', () => {
+  it('destroying a control scope removes its contribution and the form returns to valid', () => {
+    // A structural directive (`ng-if` / `ng-repeat`) removing a control
+    // tears down the control's scope, firing the `ngModel` `$destroy`
+    // listener that calls `form.$removeControl(...)`. We drive the SAME
+    // teardown path here by compiling the form against a child scope and
+    // destroying it — the exact hook `ng-if` triggers — which keeps the
+    // test independent of the compiler's structural-directive internals.
+    const { $compile, $rootScope } = boot();
+    const child = $rootScope.$new();
+    const host = document.createElement('div');
+    host.innerHTML = '<form name="myForm"><input name="a" ng-model="a"></form>';
+    const form = asHtmlElement(host.firstElementChild);
+    $compile(form)(child);
+    child.$digest();
+
+    const fc = formCtrl(form);
+    const input = asInput(form.querySelector('input'));
+
+    // Make the control invalid → the form is invalid, and the named
+    // control is reachable through the published form.
+    modelCtrl(input).$setValidity('required', false);
+    expect(fc.$invalid).toBe(true);
+    expect('a' in (fc as unknown as Record<string, unknown>)).toBe(true);
+
+    // Tear down the control's scope (what `ng-if` does on removal).
+    child.$destroy();
+
+    // The control (and its failure) is gone → the form is valid again,
+    // and the named-control slot is cleared from the form instance.
+    expect(fc.$valid).toBe(true);
+    expect('a' in (fc as unknown as Record<string, unknown>)).toBe(false);
+  });
+});
+
+describe('form — submit (FS §2.3)', () => {
+  it('submit marks $submitted + ng-submitted + runs ng-submit with native submit suppressed', () => {
+    const { $compile, $rootScope } = boot();
+    ($rootScope as unknown as { submitted: number }).submitted = 0;
+    const form = asForm(
+      compile(
+        '<form name="myForm" ng-submit="submitted = submitted + 1"><input ng-model="a"></form>',
+        $compile,
+        $rootScope,
+      ),
+    );
+    const fc = formCtrl(form);
+
+    const event = new Event('submit', { cancelable: true });
+    form.dispatchEvent(event);
+
+    expect(fc.$submitted).toBe(true);
+    expect(form.classList.contains('ng-submitted')).toBe(true);
+    expect(($rootScope as unknown as { submitted: number }).submitted).toBe(1);
+    // No `action` attribute → native submit suppressed.
+    expect(event.defaultPrevented).toBe(true);
+  });
+
+  it('does NOT preventDefault when the form has an action', () => {
+    const { $compile, $rootScope } = boot();
+    const form = asForm(compile('<form action="/save"><input ng-model="a"></form>', $compile, $rootScope));
+
+    const event = new Event('submit', { cancelable: true });
+    form.dispatchEvent(event);
+
+    expect(event.defaultPrevented).toBe(false);
+    expect(formCtrl(form).$submitted).toBe(true);
+  });
+});
+
+describe('form — programmatic state transitions (FS §2.3)', () => {
+  it('$setPristine resets the form (and clears submitted)', () => {
+    const { $compile, $rootScope } = boot();
+    const form = asForm(compile('<form><input ng-model="a"></form>', $compile, $rootScope));
+    const fc = formCtrl(form);
+    const input = asInput(form.querySelector('input'));
+
+    fireInput(input, 'typed');
+    fc.$setSubmitted();
+    expect(fc.$dirty).toBe(true);
+    expect(fc.$submitted).toBe(true);
+
+    fc.$setPristine();
+    expect(fc.$pristine).toBe(true);
+    expect(fc.$dirty).toBe(false);
+    expect(fc.$submitted).toBe(false);
+    expect(form.classList.contains('ng-pristine')).toBe(true);
+    expect(form.classList.contains('ng-submitted')).toBe(false);
+  });
+
+  it('$setSubmitted sets the submitted state + class', () => {
+    const { $compile, $rootScope } = boot();
+    const form = asForm(compile('<form><input ng-model="a"></form>', $compile, $rootScope));
+    const fc = formCtrl(form);
+
+    fc.$setSubmitted();
+    expect(fc.$submitted).toBe(true);
+    expect(form.classList.contains('ng-submitted')).toBe(true);
+  });
+});
+
+describe('form — form-less ngModel still works via nullFormCtrl', () => {
+  it('an ngModel with no enclosing form binds without throwing', () => {
+    const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="text" ng-model="loose">', $compile, $rootScope));
+
+    fireInput(el, 'value');
+    expect(($rootScope as unknown as { loose: string }).loose).toBe('value');
+    // No form-registration errors routed anywhere.
+    expect(consoleSpy).not.toHaveBeenCalled();
+    consoleSpy.mockRestore();
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// PR-audit regression — a control inside a REAL ng-if registers with the form
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('form — controls inside structural directives (PR-audit regression)', () => {
+  it('an ng-model inside ng-if resolves the enclosing form (clone attaches BEFORE linking)', () => {
+    const { $compile, $rootScope } = boot();
+    const form = compile(
+      '<form name="f"><div ng-if="show"><input name="i" ng-model="v" required></div></form>',
+      $compile,
+      $rootScope,
+    );
+
+    ($rootScope as unknown as Record<string, unknown>)['show'] = true;
+    $rootScope.$digest();
+
+    const fc = formCtrl(form);
+    const el = asInput(form.querySelector('input'));
+    const ctrl = modelCtrl(el);
+
+    // The clone was attached to the live DOM before linking, so the
+    // `?^^form` require resolved the real form — the empty required
+    // control makes the FORM invalid, and the named slot is published.
+    expect(fc.$error['required']).toContain(ctrl);
+    expect(fc.$invalid).toBe(true);
+    expect((fc as unknown as Record<string, unknown>)['i']).toBe(ctrl);
+
+    // Toggling the branch away removes the contribution again.
+    ($rootScope as unknown as Record<string, unknown>)['show'] = false;
+    $rootScope.$digest();
+    expect(fc.$valid).toBe(true);
+    expect((fc as unknown as Record<string, unknown>)['i']).toBeUndefined();
+  });
+});
diff --git a/src/forms/__tests__/forms-types.test.ts b/src/forms/__tests__/forms-types.test.ts
new file mode 100644
index 0000000..ac87252
--- /dev/null
+++ b/src/forms/__tests__/forms-types.test.ts
@@ -0,0 +1,226 @@
+/**
+ * `@forms` type-level tests (spec 039 Slice 7).
+ *
+ * Compile-time assertions via `expectTypeOf` — these prove the PUBLIC contract
+ * types exported from `@forms/index` compile against representative consumer
+ * usage: the shapes a developer reads in an expression (`myForm.email.$invalid`)
+ * or types a custom validator / `ngModelOptions` record against.
+ *
+ * Unlike the async services, the forms DIRECTIVES are registered on `ngModule`
+ * via a config block (the `ngTransclude` / event-directive precedent), so they
+ * are NOT statically widened into the injector's `ModuleRegistry` — there is no
+ * `injector.get('ngModel')` service surface to assert. What IS public is the
+ * CONTRACT: `NgModelController`, `FormController`, `NgModelOptions` /
+ * `ModelOptions`, `SelectController`, and the `SyncValidator` / `AsyncValidator`
+ * / `ModelParser` / `ModelFormatter` transform types. Consumers type against
+ * these; this file pins that they mean what the implementation exposes.
+ *
+ * Every assertion mirrors what the barrel ACTUALLY exports today — where a
+ * signature is looser than ideal (e.g. `$viewValue: unknown`) it is asserted
+ * as-real with an inline note, never as an aspirational type.
+ */
+
+import { describe, expectTypeOf, it } from 'vitest';
+
+import type { QPromise } from '@async/q-types';
+import {
+  createModelOptions,
+  defaultModelOptions,
+  FormControllerImpl,
+  NgModelControllerImpl,
+  nullFormCtrl,
+  resolveDebounceDelay,
+  SelectControllerImpl,
+  type AsyncValidator,
+  type FormControlLike,
+  type FormController,
+  type ModelFormatter,
+  type ModelOptions,
+  type ModelParser,
+  type NgModelController,
+  type NgModelOptions,
+  type SelectController,
+  type SyncValidator,
+} from '@forms/index';
+
+describe('NgModelController — the value pipeline + state contract', () => {
+  it('exposes the two ordered transform lists as arrays of the transform types', () => {
+    expectTypeOf<NgModelController['$parsers']>().toEqualTypeOf<ModelParser[]>();
+    expectTypeOf<NgModelController['$formatters']>().toEqualTypeOf<ModelFormatter[]>();
+  });
+
+  it('the transform types are single-arg unknown → unknown functions', () => {
+    expectTypeOf<ModelParser>().toEqualTypeOf<(value: unknown) => unknown>();
+    expectTypeOf<ModelFormatter>().toEqualTypeOf<(value: unknown) => unknown>();
+  });
+
+  it('the validator maps are keyed records of the sync / async validator types', () => {
+    expectTypeOf<NgModelController['$validators']>().toEqualTypeOf<Record<string, SyncValidator>>();
+    expectTypeOf<NgModelController['$asyncValidators']>().toEqualTypeOf<Record<string, AsyncValidator>>();
+  });
+
+  it('a sync validator is (modelValue, viewValue) => boolean; async returns a QPromise', () => {
+    const sync: SyncValidator = (modelValue, viewValue) => {
+      expectTypeOf(modelValue).toEqualTypeOf<unknown>();
+      expectTypeOf(viewValue).toEqualTypeOf<unknown>();
+      return typeof modelValue === 'string';
+    };
+    expectTypeOf(sync).returns.toEqualTypeOf<boolean>();
+
+    // A consumer's async rule resolves for valid, rejects for invalid.
+    const asyncRule: AsyncValidator = () => null as unknown as QPromise<unknown>;
+    expectTypeOf(asyncRule).returns.toEqualTypeOf<QPromise<unknown>>();
+  });
+
+  it('$viewValue / $modelValue are unknown (untyped model — as-real)', () => {
+    expectTypeOf<NgModelController['$viewValue']>().toEqualTypeOf<unknown>();
+    expectTypeOf<NgModelController['$modelValue']>().toEqualTypeOf<unknown>();
+  });
+
+  it('the state booleans and the $name / $error / $pending shapes', () => {
+    expectTypeOf<NgModelController['$dirty']>().toEqualTypeOf<boolean>();
+    expectTypeOf<NgModelController['$pristine']>().toEqualTypeOf<boolean>();
+    expectTypeOf<NgModelController['$touched']>().toEqualTypeOf<boolean>();
+    expectTypeOf<NgModelController['$untouched']>().toEqualTypeOf<boolean>();
+    expectTypeOf<NgModelController['$valid']>().toEqualTypeOf<boolean>();
+    expectTypeOf<NgModelController['$invalid']>().toEqualTypeOf<boolean>();
+    expectTypeOf<NgModelController['$name']>().toEqualTypeOf<string | undefined>();
+    expectTypeOf<NgModelController['$error']>().toEqualTypeOf<Record<string, boolean>>();
+    expectTypeOf<NgModelController['$pending']>().toEqualTypeOf<Record<string, boolean> | undefined>();
+  });
+
+  it('the pipeline method signatures a consumer / input-type handler calls', () => {
+    expectTypeOf<NgModelController['$setViewValue']>().toEqualTypeOf<(value: unknown, trigger?: string) => void>();
+    expectTypeOf<NgModelController['$render']>().toEqualTypeOf<() => void>();
+    expectTypeOf<NgModelController['$isEmpty']>().toEqualTypeOf<(value: unknown) => boolean>();
+    expectTypeOf<NgModelController['$commitViewValue']>().toEqualTypeOf<() => void>();
+    expectTypeOf<NgModelController['$rollbackViewValue']>().toEqualTypeOf<() => void>();
+    expectTypeOf<NgModelController['$validate']>().toEqualTypeOf<() => void>();
+  });
+
+  it('$setValidity is tri-state (boolean | undefined for pending)', () => {
+    expectTypeOf<NgModelController['$setValidity']>().toEqualTypeOf<
+      (key: string, isValid: boolean | undefined) => void
+    >();
+  });
+
+  it('the state-transition methods are all () => void', () => {
+    expectTypeOf<NgModelController['$setPristine']>().toEqualTypeOf<() => void>();
+    expectTypeOf<NgModelController['$setDirty']>().toEqualTypeOf<() => void>();
+    expectTypeOf<NgModelController['$setTouched']>().toEqualTypeOf<() => void>();
+    expectTypeOf<NgModelController['$setUntouched']>().toEqualTypeOf<() => void>();
+  });
+
+  it('$options is a ModelOptions and $viewChangeListeners is a () => void[]', () => {
+    expectTypeOf<NgModelController['$options']>().toEqualTypeOf<ModelOptions>();
+    expectTypeOf<NgModelController['$viewChangeListeners']>().toEqualTypeOf<(() => void)[]>();
+  });
+
+  it('the concrete NgModelControllerImpl satisfies the NgModelController contract', () => {
+    expectTypeOf<NgModelControllerImpl>().toExtend<NgModelController>();
+  });
+});
+
+describe('FormController — the aggregation contract', () => {
+  it('exposes the aggregate state booleans + $submitted', () => {
+    expectTypeOf<FormController['$dirty']>().toEqualTypeOf<boolean>();
+    expectTypeOf<FormController['$pristine']>().toEqualTypeOf<boolean>();
+    expectTypeOf<FormController['$valid']>().toEqualTypeOf<boolean>();
+    expectTypeOf<FormController['$invalid']>().toEqualTypeOf<boolean>();
+    expectTypeOf<FormController['$submitted']>().toEqualTypeOf<boolean>();
+    expectTypeOf<FormController['$name']>().toEqualTypeOf<string | undefined>();
+  });
+
+  it('$error / $pending map keys to arrays of controls (not booleans — the form aggregates)', () => {
+    expectTypeOf<FormController['$error']>().toEqualTypeOf<Record<string, FormControlLike[]>>();
+    expectTypeOf<FormController['$pending']>().toEqualTypeOf<Record<string, FormControlLike[]> | undefined>();
+  });
+
+  it('$addControl / $removeControl / $setValidity accept a FormControlLike', () => {
+    expectTypeOf<FormController['$addControl']>().toEqualTypeOf<(control: FormControlLike) => void>();
+    expectTypeOf<FormController['$removeControl']>().toEqualTypeOf<(control: FormControlLike) => void>();
+    // The form's $setValidity is the THREE-arg control-aggregating shape
+    // (vs the control's two-arg form) and shares the tri-state isValid:
+    // `undefined` marks the key PENDING on the form (async rule in flight).
+    expectTypeOf<FormController['$setValidity']>().toEqualTypeOf<
+      (key: string, isValid: boolean | undefined, control: FormControlLike) => void
+    >();
+  });
+
+  it('the state-transition methods are () => void', () => {
+    expectTypeOf<FormController['$setDirty']>().toEqualTypeOf<() => void>();
+    expectTypeOf<FormController['$setPristine']>().toEqualTypeOf<() => void>();
+    expectTypeOf<FormController['$setSubmitted']>().toEqualTypeOf<() => void>();
+  });
+
+  it('an NgModelController is assignable where a FormControlLike is expected (only $name is read)', () => {
+    // A form tracks controls through the narrow FormControlLike surface, so
+    // registering an NgModelController with a form type-checks.
+    expectTypeOf<NgModelController>().toExtend<FormControlLike>();
+  });
+
+  it('the concrete FormControllerImpl + nullFormCtrl satisfy the FormController contract', () => {
+    expectTypeOf<FormControllerImpl>().toExtend<FormController>();
+    expectTypeOf(nullFormCtrl).toExtend<FormController>();
+  });
+
+  it('a nested FormController is itself a FormControlLike (nested forms bubble up)', () => {
+    expectTypeOf<FormController>().toExtend<FormControlLike>();
+  });
+});
+
+describe('NgModelOptions / ModelOptions — the ngModelOptions contract', () => {
+  it('every option key is optional and correctly typed', () => {
+    expectTypeOf<NgModelOptions['updateOn']>().toEqualTypeOf<string | undefined>();
+    expectTypeOf<NgModelOptions['debounce']>().toEqualTypeOf<number | Record<string, number> | undefined>();
+    expectTypeOf<NgModelOptions['allowInvalid']>().toEqualTypeOf<boolean | undefined>();
+    expectTypeOf<NgModelOptions['getterSetter']>().toEqualTypeOf<boolean | undefined>();
+    expectTypeOf<NgModelOptions['timezone']>().toEqualTypeOf<string | undefined>();
+  });
+
+  it('a consumer can author a full NgModelOptions record', () => {
+    const opts: NgModelOptions = {
+      updateOn: 'blur',
+      debounce: { default: 300, blur: 0 },
+      allowInvalid: true,
+      getterSetter: false,
+      timezone: 'UTC',
+    };
+    expectTypeOf(opts).toExtend<NgModelOptions>();
+  });
+
+  it('getOption is generic — it returns the exact per-key value type', () => {
+    const options: ModelOptions = defaultModelOptions;
+    expectTypeOf(options.getOption('updateOn')).toEqualTypeOf<string | undefined>();
+    expectTypeOf(options.getOption('debounce')).toEqualTypeOf<number | Record<string, number> | undefined>();
+    expectTypeOf(options.getOption('allowInvalid')).toEqualTypeOf<boolean | undefined>();
+    expectTypeOf(options.getOption('timezone')).toEqualTypeOf<string | undefined>();
+  });
+
+  it('$$updateEvents is a readonly string list and $$hasDefaultUpdateEvent a boolean', () => {
+    expectTypeOf<ModelOptions['$$updateEvents']>().toEqualTypeOf<readonly string[]>();
+    expectTypeOf<ModelOptions['$$hasDefaultUpdateEvent']>().toEqualTypeOf<boolean>();
+  });
+
+  it('createModelOptions produces a ModelOptions; resolveDebounceDelay returns a number', () => {
+    expectTypeOf(createModelOptions({ debounce: 200 })).toEqualTypeOf<ModelOptions>();
+    expectTypeOf(resolveDebounceDelay(defaultModelOptions, 'blur')).toEqualTypeOf<number>();
+  });
+});
+
+describe('SelectController — the option-management contract', () => {
+  it('multiple is a readonly boolean and the register / read / write surface is typed', () => {
+    expectTypeOf<SelectController['multiple']>().toEqualTypeOf<boolean>();
+    expectTypeOf<SelectController['registerOption']>().toEqualTypeOf<
+      (key: string, value: unknown, element: HTMLOptionElement) => void
+    >();
+    expectTypeOf<SelectController['removeOption']>().toEqualTypeOf<(key: string) => void>();
+    expectTypeOf<SelectController['readValue']>().toEqualTypeOf<() => unknown>();
+    expectTypeOf<SelectController['writeValue']>().toEqualTypeOf<(value: unknown) => void>();
+    expectTypeOf<SelectController['writeMultiValue']>().toEqualTypeOf<(values: readonly unknown[]) => void>();
+  });
+
+  it('the concrete SelectControllerImpl satisfies the SelectController contract', () => {
+    expectTypeOf<SelectControllerImpl>().toExtend<SelectController>();
+  });
+});
diff --git a/src/forms/__tests__/input-types.test.ts b/src/forms/__tests__/input-types.test.ts
new file mode 100644
index 0000000..bdb883f
--- /dev/null
+++ b/src/forms/__tests__/input-types.test.ts
@@ -0,0 +1,544 @@
+/**
+ * Typed `input` type matrix (spec 039 Slice 3 / FS §2.4).
+ *
+ * Drives each input type end-to-end through the real `ngModule` (via
+ * `bootstrapInjector`) so the forms directives registered by
+ * `src/core/ng-module.ts` are reachable. User input is simulated by
+ * setting `element.value` (+ `.checked` for checkbox / radio) and
+ * dispatching native `input` / `change` events, matching how a browser
+ * drives the control. Vectors ported from AngularJS `inputSpec.js`.
+ */
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import type { CompileService } from '@compiler/directive-types';
+import type { Scope } from '@core/index';
+import { bootstrapInjector } from '@bootstrap/index';
+import { asHtmlElement, asInput } from '@compiler/__tests__/dom-guards';
+import { resetRegistry } from '@di/module';
+
+interface Harness {
+  $compile: CompileService;
+  $rootScope: Scope;
+}
+
+function boot(): Harness {
+  const injector = bootstrapInjector([]);
+  return {
+    $compile: injector.get('$compile'),
+    $rootScope: injector.get('$rootScope'),
+  };
+}
+
+afterEach(() => {
+  resetRegistry();
+});
+
+/** Compile an HTML fragment's first element against `scope` + digest. */
+function compile(html: string, $compile: CompileService, scope: Scope): HTMLElement {
+  const el = document.createElement('div');
+  el.innerHTML = html;
+  const child = asHtmlElement(el.firstElementChild);
+  $compile(child)(scope);
+  scope.$digest();
+  return child;
+}
+
+/** Compile a whole fragment (multiple siblings) — used for radio groups. */
+function compileAll(html: string, $compile: CompileService, scope: Scope): HTMLElement {
+  const wrapper = document.createElement('div');
+  wrapper.innerHTML = html;
+  $compile(wrapper)(scope);
+  scope.$digest();
+  return wrapper;
+}
+
+function fireInput(el: HTMLInputElement, value: string): void {
+  el.value = value;
+  el.dispatchEvent(new Event('input'));
+}
+
+function fireChange(el: HTMLInputElement): void {
+  el.dispatchEvent(new Event('change'));
+}
+
+function model(scope: Scope, key: string): unknown {
+  return (scope as unknown as Record<string, unknown>)[key];
+}
+
+function modelDate(scope: Scope, key: string): Date {
+  const value = model(scope, key);
+  if (!(value instanceof Date)) {
+    throw new Error(`expected model '${key}' to be a Date`);
+  }
+  return value;
+}
+
+function setModel(scope: Scope, key: string, value: unknown): void {
+  (scope as unknown as Record<string, unknown>)[key] = value;
+}
+
+/**
+ * jsdom sanitizes an invalid `type=number` / `type=date` value to `''` and
+ * does NOT set `validity.badInput` (a documented jsdom limitation). To
+ * exercise the real `badInputChecker` code path — the handler reads
+ * `control.validity.badInput` — we override the element's `validity` to
+ * report `badInput: true`, matching what a real browser surfaces when the
+ * user types garbage into a typed control.
+ */
+function setBadInput(el: HTMLInputElement, bad: boolean): void {
+  const fake = { badInput: bad, valid: !bad } as unknown as ValidityState;
+  Object.defineProperty(el, 'validity', { configurable: true, get: () => fake });
+}
+
+/** Simulate typing bad input the browser can't sanitize (value → ''). */
+function fireBadInput(el: HTMLInputElement): void {
+  setBadInput(el, true);
+  el.value = '';
+  el.dispatchEvent(new Event('input'));
+}
+
+// ────────────────────────────────────────────────────────────────────────────
+// number
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('input[type=number] — model holds a Number (FS §2.4)', () => {
+  it('parses numeric input into a Number', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="number" ng-model="age">', $compile, $rootScope));
+
+    fireInput(el, '42');
+    expect(model($rootScope, 'age')).toBe(42);
+    expect(typeof model($rootScope, 'age')).toBe('number');
+
+    fireInput(el, '3.14');
+    expect(model($rootScope, 'age')).toBeCloseTo(3.14);
+  });
+
+  it('formats a numeric model back into the field', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="number" ng-model="age">', $compile, $rootScope));
+
+    setModel($rootScope, 'age', 99);
+    $rootScope.$digest();
+    expect(el.value).toBe('99');
+  });
+
+  it('bad (non-numeric) input makes the control invalid and does NOT write a bad model', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'age', 5);
+    const el = asInput(compile('<input type="number" ng-model="age">', $compile, $rootScope));
+
+    fireBadInput(el);
+    expect(el.classList.contains('ng-invalid')).toBe(true);
+    expect(el.classList.contains('ng-invalid-number')).toBe(true);
+    // Model is left as undefined (bad parse), never the string 'abc'.
+    expect(model($rootScope, 'age')).toBeUndefined();
+  });
+
+  it('recovering with a good value clears the number invalidity', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="number" ng-model="age">', $compile, $rootScope));
+
+    fireBadInput(el);
+    expect(el.classList.contains('ng-invalid-number')).toBe(true);
+
+    setBadInput(el, false);
+    fireInput(el, '7');
+    expect(el.classList.contains('ng-valid-number')).toBe(true);
+    expect(model($rootScope, 'age')).toBe(7);
+  });
+
+  it('empty input maps to a null model without failing the number rule', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="number" ng-model="age">', $compile, $rootScope));
+
+    fireInput(el, '5');
+    expect(model($rootScope, 'age')).toBe(5);
+
+    fireInput(el, '');
+    expect(model($rootScope, 'age')).toBeNull();
+    expect(el.classList.contains('ng-valid-number')).toBe(true);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// range
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('input[type=range] — Number with clamping (FS §2.4)', () => {
+  it('parses to a Number', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="range" ng-model="vol" min="0" max="10">', $compile, $rootScope));
+
+    fireInput(el, '5');
+    expect(model($rootScope, 'vol')).toBe(5);
+    expect(typeof model($rootScope, 'vol')).toBe('number');
+  });
+
+  it('clamps above max down to max', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="range" ng-model="vol" min="0" max="10">', $compile, $rootScope));
+
+    fireInput(el, '50');
+    expect(model($rootScope, 'vol')).toBe(10);
+  });
+
+  it('clamps below min up to min', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="range" ng-model="vol" min="5" max="10">', $compile, $rootScope));
+
+    fireInput(el, '1');
+    expect(model($rootScope, 'vol')).toBe(5);
+  });
+
+  it('snaps to the nearest step', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="range" ng-model="vol" min="0" max="10" step="2">', $compile, $rootScope));
+
+    fireInput(el, '5');
+    // 5 is between step boundaries 4 and 6; rounds to nearest → 6.
+    expect(model($rootScope, 'vol')).toBe(6);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// checkbox
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('input[type=checkbox] — model holds a boolean (FS §2.4)', () => {
+  it('checking / unchecking writes true / false', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="checkbox" ng-model="agree">', $compile, $rootScope));
+
+    el.checked = true;
+    fireChange(el);
+    expect(model($rootScope, 'agree')).toBe(true);
+
+    el.checked = false;
+    fireChange(el);
+    expect(model($rootScope, 'agree')).toBe(false);
+  });
+
+  it('a boolean model checks / unchecks the box', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="checkbox" ng-model="agree">', $compile, $rootScope));
+
+    setModel($rootScope, 'agree', true);
+    $rootScope.$digest();
+    expect(el.checked).toBe(true);
+
+    setModel($rootScope, 'agree', false);
+    $rootScope.$digest();
+    expect(el.checked).toBe(false);
+  });
+
+  it('ng-true-value / ng-false-value override the stored values', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(
+      compile(
+        '<input type="checkbox" ng-model="answer" ng-true-value="\'YES\'" ng-false-value="\'NO\'">',
+        $compile,
+        $rootScope,
+      ),
+    );
+
+    el.checked = true;
+    fireChange(el);
+    expect(model($rootScope, 'answer')).toBe('YES');
+
+    el.checked = false;
+    fireChange(el);
+    expect(model($rootScope, 'answer')).toBe('NO');
+  });
+
+  it('$isEmpty is unchecked (drives ng-empty)', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="checkbox" ng-model="agree">', $compile, $rootScope));
+
+    // Fresh, unchecked → empty.
+    expect(el.classList.contains('ng-empty')).toBe(true);
+
+    el.checked = true;
+    fireChange(el);
+    expect(el.classList.contains('ng-not-empty')).toBe(true);
+    expect(el.classList.contains('ng-empty')).toBe(false);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// radio
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('input[type=radio] — selected value across a group (FS §2.4)', () => {
+  const groupHtml =
+    '<div>' +
+    '<input type="radio" ng-model="color" value="red">' +
+    '<input type="radio" ng-model="color" value="green">' +
+    '<input type="radio" ng-model="color" value="blue">' +
+    '</div>';
+
+  it('checking a radio writes its value to the shared model', () => {
+    const { $compile, $rootScope } = boot();
+    const wrapper = compileAll(groupHtml, $compile, $rootScope);
+    const radios = wrapper.querySelectorAll('input');
+    const green = asInput(radios[1]);
+
+    green.checked = true;
+    fireChange(green);
+    expect(model($rootScope, 'color')).toBe('green');
+  });
+
+  it('a model value checks the matching radio and unchecks the others', () => {
+    const { $compile, $rootScope } = boot();
+    const wrapper = compileAll(groupHtml, $compile, $rootScope);
+    const radios = wrapper.querySelectorAll('input');
+
+    setModel($rootScope, 'color', 'blue');
+    $rootScope.$digest();
+
+    expect(asInput(radios[0]).checked).toBe(false);
+    expect(asInput(radios[1]).checked).toBe(false);
+    expect(asInput(radios[2]).checked).toBe(true);
+  });
+
+  it('switching selection updates the model and the checked states', () => {
+    const { $compile, $rootScope } = boot();
+    const wrapper = compileAll(groupHtml, $compile, $rootScope);
+    const radios = wrapper.querySelectorAll('input');
+    const red = asInput(radios[0]);
+    const blue = asInput(radios[2]);
+
+    red.checked = true;
+    fireChange(red);
+    expect(model($rootScope, 'color')).toBe('red');
+
+    blue.checked = true;
+    fireChange(blue);
+    expect(model($rootScope, 'color')).toBe('blue');
+
+    $rootScope.$digest();
+    expect(red.checked).toBe(false);
+    expect(blue.checked).toBe(true);
+  });
+
+  it('ng-value binds a data-driven value', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'opt', 'beta');
+    const el = asInput(compile('<input type="radio" ng-model="choice" ng-value="opt">', $compile, $rootScope));
+
+    el.checked = true;
+    fireChange(el);
+    expect(model($rootScope, 'choice')).toBe('beta');
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// date / time family
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('input[type=date] — model holds a Date (FS §2.4)', () => {
+  it('parses YYYY-MM-DD into a local Date', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="date" ng-model="d">', $compile, $rootScope));
+
+    fireInput(el, '2020-03-15');
+    const d = modelDate($rootScope, 'd');
+    expect(d).toBeInstanceOf(Date);
+    expect(d.getFullYear()).toBe(2020);
+    expect(d.getMonth()).toBe(2);
+    expect(d.getDate()).toBe(15);
+  });
+
+  it('formats a Date model into the field', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="date" ng-model="d">', $compile, $rootScope));
+
+    setModel($rootScope, 'd', new Date(2019, 11, 25));
+    $rootScope.$digest();
+    expect(el.value).toBe('2019-12-25');
+  });
+
+  it('round-trips a Date through the field', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="date" ng-model="d">', $compile, $rootScope));
+
+    fireInput(el, '2021-07-04');
+    $rootScope.$digest();
+    expect(el.value).toBe('2021-07-04');
+    expect(modelDate($rootScope, 'd').getDate()).toBe(4);
+  });
+
+  it('malformed input invalidates and empty clears the date key', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="date" ng-model="d">', $compile, $rootScope));
+
+    fireBadInput(el);
+    expect(el.classList.contains('ng-invalid-date')).toBe(true);
+    expect(model($rootScope, 'd')).toBeUndefined();
+
+    setBadInput(el, false);
+    fireInput(el, '');
+    expect(el.classList.contains('ng-valid-date')).toBe(true);
+    expect(model($rootScope, 'd')).toBeNull();
+  });
+});
+
+describe('input[type=datetime-local] — model holds a Date', () => {
+  it('round-trips date + time components', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="datetime-local" ng-model="dt">', $compile, $rootScope));
+
+    fireInput(el, '2020-01-02T13:45');
+    const d = modelDate($rootScope, 'dt');
+    expect(d).toBeInstanceOf(Date);
+    expect(d.getHours()).toBe(13);
+    expect(d.getMinutes()).toBe(45);
+
+    setModel($rootScope, 'dt', new Date(2020, 0, 2, 13, 45, 0, 0));
+    $rootScope.$digest();
+    // The formatter emits the full `…:00.000` form (AngularJS parity); jsdom
+    // then normalizes a whole-minute datetime-local `.value` by dropping the
+    // trailing `:00.000` (matching the HTML sanitization algorithm), so the
+    // stored value is the minute-precision form.
+    expect(el.value).toBe('2020-01-02T13:45');
+  });
+});
+
+describe('input[type=time] — model holds a Date anchored to 1970-01-01', () => {
+  it('round-trips a time value', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="time" ng-model="t">', $compile, $rootScope));
+
+    fireInput(el, '09:30');
+    const d = modelDate($rootScope, 't');
+    expect(d).toBeInstanceOf(Date);
+    expect(d.getHours()).toBe(9);
+    expect(d.getMinutes()).toBe(30);
+
+    setModel($rootScope, 't', new Date(1970, 0, 1, 9, 30, 0, 0));
+    $rootScope.$digest();
+    expect(el.value).toBe('09:30:00.000');
+  });
+});
+
+describe('input[type=month] — model holds a Date on the 1st', () => {
+  it('round-trips a month value', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="month" ng-model="m">', $compile, $rootScope));
+
+    fireInput(el, '2022-06');
+    const d = modelDate($rootScope, 'm');
+    expect(d).toBeInstanceOf(Date);
+    expect(d.getFullYear()).toBe(2022);
+    expect(d.getMonth()).toBe(5);
+    expect(d.getDate()).toBe(1);
+
+    setModel($rootScope, 'm', new Date(2022, 5, 1));
+    $rootScope.$digest();
+    expect(el.value).toBe('2022-06');
+  });
+});
+
+describe('input[type=week] — model holds a Date on the ISO week Monday', () => {
+  it('round-trips a week value', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="week" ng-model="w">', $compile, $rootScope));
+
+    fireInput(el, '2020-W03');
+    const d = modelDate($rootScope, 'w');
+    expect(d).toBeInstanceOf(Date);
+
+    // Format it back and it must round-trip to the same week string.
+    setModel($rootScope, 'w', d);
+    $rootScope.$digest();
+    expect(el.value).toBe('2020-W03');
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// no-model types
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('input[type=hidden|button|submit|reset] — no model parsing', () => {
+  it('a hidden control does not round-trip through ng-model', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="hidden" ng-model="h">', $compile, $rootScope));
+
+    // The no-op handler installs no listeners; a native input event does
+    // not commit anything to the model.
+    fireInput(el, 'anything');
+    expect(model($rootScope, 'h')).toBeUndefined();
+  });
+
+  it('a button control is a no-op', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="button" ng-model="b">', $compile, $rootScope));
+    fireInput(el, 'x');
+    expect(model($rootScope, 'b')).toBeUndefined();
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// baseline string types
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('input[type=email|url|search|tel|password] — baseline string handlers', () => {
+  // Use a type-appropriate VALID value so the value binds — `email` / `url`
+  // now carry their Slice-5 shape validators, so an invalid value would be
+  // kept out of the model (AngularJS parity). `search` / `tel` / `password`
+  // have no shape validator, so any string binds.
+  it.each([
+    ['email', 'ada@example.com'],
+    ['url', 'http://example.com'],
+    ['search', 'hello'],
+    ['tel', 'hello'],
+    ['password', 'hello'],
+  ])('type=%s binds a string', (type, value) => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile(`<input type="${type}" ng-model="v">`, $compile, $rootScope));
+
+    fireInput(el, value);
+    expect(model($rootScope, 'v')).toBe(value);
+    expect(typeof model($rootScope, 'v')).toBe('string');
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// PR-audit regressions — radio ng-value liveness + change trigger
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('radio — data-driven ng-value (PR-audit regressions)', () => {
+  it('re-checks the radio when its ng-value expression changes to match the model', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'color', 'alpha');
+    setModel($rootScope, 'opt', 'gamma');
+    const el = asInput(compile('<input type="radio" ng-model="color" ng-value="opt">', $compile, $rootScope));
+
+    expect(el.checked).toBe(false);
+
+    // The contributed value now matches the model — the radio must check
+    // itself on the next digest (the ng-value EXPRESSION is watched; the
+    // `value` attribute is absent, so `$observe` alone would never fire).
+    setModel($rootScope, 'opt', 'alpha');
+    $rootScope.$digest();
+    expect(el.checked).toBe(true);
+  });
+
+  it("commits under the 'change' debounce trigger", () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(
+      compile(
+        '<input type="radio" ng-model="pick" value="a" ng-model-options="{ debounce: { change: 1000000 } }">',
+        $compile,
+        $rootScope,
+      ),
+    );
+
+    el.checked = true;
+    fireChange(el);
+    // The change-triggered commit is debounced — the model must NOT hold
+    // the value synchronously.
+    expect(model($rootScope, 'pick')).toBeUndefined();
+  });
+});
diff --git a/src/forms/__tests__/ng-list.test.ts b/src/forms/__tests__/ng-list.test.ts
new file mode 100644
index 0000000..0988dd9
--- /dev/null
+++ b/src/forms/__tests__/ng-list.test.ts
@@ -0,0 +1,167 @@
+/**
+ * `ngList` directive (spec 039 Slice 4 / FS §2.5).
+ *
+ * Drives an `<input ng-model ng-list>` end-to-end through the canonical
+ * `ngModule` (via `bootstrapInjector`). The delimited on-screen string
+ * round-trips to an **array** in the model (view → model) and back
+ * (model → view). Exercises the default `,` delimiter, a custom string
+ * delimiter, and the `/regex/` split form. Vectors ported from AngularJS
+ * `inputSpec.js` (ngList).
+ */
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { asInput } from '@compiler/__tests__/dom-guards';
+import type { CompileService } from '@compiler/directive-types';
+import type { Scope } from '@core/index';
+import { bootstrapInjector } from '@bootstrap/index';
+import { resetRegistry } from '@di/module';
+
+interface Harness {
+  $compile: CompileService;
+  $rootScope: Scope;
+}
+
+function boot(): Harness {
+  const injector = bootstrapInjector([]);
+  return {
+    $compile: injector.get('$compile'),
+    $rootScope: injector.get('$rootScope'),
+  };
+}
+
+afterEach(() => {
+  resetRegistry();
+});
+
+function compile(html: string, $compile: CompileService, scope: Scope): HTMLInputElement {
+  const el = document.createElement('div');
+  el.innerHTML = html;
+  const child = asInput(el.firstElementChild);
+  $compile(child)(scope);
+  scope.$digest();
+  return child;
+}
+
+function fireInput(el: HTMLInputElement, value: string): void {
+  el.value = value;
+  el.dispatchEvent(new Event('input'));
+}
+
+function model(scope: Scope, key: string): unknown {
+  return (scope as unknown as Record<string, unknown>)[key];
+}
+
+function setModel(scope: Scope, key: string, value: unknown): void {
+  (scope as unknown as Record<string, unknown>)[key] = value;
+}
+
+// ────────────────────────────────────────────────────────────────────────────
+// default `,` delimiter
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('ngList — default comma delimiter (FS §2.5)', () => {
+  it('splits a delimited string into a trimmed array (view → model)', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input ng-model="tags" ng-list>', $compile, $rootScope);
+
+    fireInput(el, 'a, b, c');
+    expect(model($rootScope, 'tags')).toEqual(['a', 'b', 'c']);
+  });
+
+  it('trims surrounding whitespace around each element', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input ng-model="tags" ng-list>', $compile, $rootScope);
+
+    fireInput(el, '  x ,y ,  z  ');
+    expect(model($rootScope, 'tags')).toEqual(['x', 'y', 'z']);
+  });
+
+  it('drops empty parts', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input ng-model="tags" ng-list>', $compile, $rootScope);
+
+    fireInput(el, 'a, , b, ');
+    expect(model($rootScope, 'tags')).toEqual(['a', 'b']);
+  });
+
+  it('joins an array back into a delimited string (model → view)', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input ng-model="tags" ng-list>', $compile, $rootScope);
+
+    setModel($rootScope, 'tags', ['one', 'two', 'three']);
+    $rootScope.$digest();
+    expect(el.value).toBe('one, two, three');
+  });
+
+  it('round-trips a value through the field', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input ng-model="tags" ng-list>', $compile, $rootScope);
+
+    fireInput(el, 'red, green, blue');
+    expect(model($rootScope, 'tags')).toEqual(['red', 'green', 'blue']);
+
+    setModel($rootScope, 'tags', ['x', 'y']);
+    $rootScope.$digest();
+    expect(el.value).toBe('x, y');
+  });
+
+  it('an empty field yields an undefined model', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input ng-model="tags" ng-list>', $compile, $rootScope);
+
+    fireInput(el, '');
+    expect(model($rootScope, 'tags')).toBeUndefined();
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// custom string delimiter
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('ngList — custom delimiter (FS §2.5)', () => {
+  it('splits on a custom delimiter', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input ng-model="tags" ng-list="; ">', $compile, $rootScope);
+
+    fireInput(el, 'a; b; c');
+    expect(model($rootScope, 'tags')).toEqual(['a', 'b', 'c']);
+  });
+
+  it('joins with the raw custom delimiter (AngularJS parity)', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input ng-model="tags" ng-list="; ">', $compile, $rootScope);
+
+    setModel($rootScope, 'tags', ['a', 'b']);
+    $rootScope.$digest();
+    expect(el.value).toBe('a; b');
+  });
+
+  it('a single-character custom delimiter round-trips', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input ng-model="tags" ng-list="|">', $compile, $rootScope);
+
+    fireInput(el, 'a|b|c');
+    expect(model($rootScope, 'tags')).toEqual(['a', 'b', 'c']);
+
+    setModel($rootScope, 'tags', ['p', 'q']);
+    $rootScope.$digest();
+    // Joins with the RAW attribute value (upstream `value.join(ngList)`) —
+    // no injected space.
+    expect(el.value).toBe('p|q');
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// regexp delimiter
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('ngList — /regex/ split form (FS §2.5)', () => {
+  it('splits on a whitespace-tolerant regexp delimiter', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input ng-model="tags" ng-list="/,\\s*/">', $compile, $rootScope);
+
+    fireInput(el, 'a,b,  c,   d');
+    expect(model($rootScope, 'tags')).toEqual(['a', 'b', 'c', 'd']);
+  });
+});
diff --git a/src/forms/__tests__/ng-model-options.test.ts b/src/forms/__tests__/ng-model-options.test.ts
new file mode 100644
index 0000000..61b26b2
--- /dev/null
+++ b/src/forms/__tests__/ng-model-options.test.ts
@@ -0,0 +1,375 @@
+/**
+ * `ngModelOptions` — `updateOn` / `debounce` / `allowInvalid` / `getterSetter`
+ * / `timezone` (spec 039 Slice 6 / FS §2.5).
+ *
+ * End-to-end through the canonical `ngModule` (via `bootstrapInjector`),
+ * exercising the real `$compile` / `$rootScope` / `$timeout`. Debounce +
+ * `updateOn` timing use vitest fake timers; a `$timeout`-backed debounce
+ * commit fires inside `$rootScope.$apply`, so advancing the timers is enough
+ * to drive the commit (no extra digest needed).
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { asHtmlElement } from '@compiler/__tests__/dom-guards';
+import type { CompileService } from '@compiler/directive-types';
+import type { Scope } from '@core/index';
+import { bootstrapInjector } from '@bootstrap/index';
+import { resetRegistry } from '@di/module';
+
+interface Harness {
+  $compile: CompileService;
+  $rootScope: Scope;
+}
+
+function boot(): Harness {
+  const injector = bootstrapInjector([]);
+  return {
+    $compile: injector.get('$compile'),
+    $rootScope: injector.get('$rootScope'),
+  };
+}
+
+afterEach(() => {
+  resetRegistry();
+});
+
+function compile(html: string, $compile: CompileService, scope: Scope): HTMLElement {
+  const el = document.createElement('div');
+  el.innerHTML = html;
+  const child = asHtmlElement(el.firstElementChild);
+  $compile(child)(scope);
+  scope.$digest();
+  return child;
+}
+
+function findInput(root: HTMLElement): HTMLInputElement {
+  const node = root instanceof HTMLInputElement ? root : root.querySelector('input');
+  if (node === null) {
+    throw new Error('no <input> found');
+  }
+  return node;
+}
+
+function type(el: HTMLInputElement, value: string): void {
+  el.value = value;
+  el.dispatchEvent(new Event('input'));
+}
+
+function fire(el: HTMLInputElement, event: string): void {
+  el.dispatchEvent(new Event(event));
+}
+
+function model(scope: Scope, key: string): unknown {
+  return (scope as unknown as Record<string, unknown>)[key];
+}
+
+function setModel(scope: Scope, key: string, value: unknown): void {
+  (scope as unknown as Record<string, unknown>)[key] = value;
+}
+
+describe('ngModelOptions — registration', () => {
+  it('registers ngModelOptions on ngModule', () => {
+    const injector = bootstrapInjector([]);
+    expect(injector.has('ngModelOptionsDirective')).toBe(true);
+  });
+});
+
+describe('ngModelOptions — updateOn (FS §2.5)', () => {
+  it("updateOn: 'blur' defers the commit until blur — typing does not commit", () => {
+    const { $compile, $rootScope } = boot();
+    const root = compile(
+      `<div><input type="text" ng-model="name" ng-model-options="{ updateOn: 'blur' }"></div>`,
+      $compile,
+      $rootScope,
+    );
+    const el = findInput(root);
+
+    // Typing buffers the pending value but does NOT commit to the model.
+    type(el, 'Ada');
+    expect(model($rootScope, 'name')).toBeUndefined();
+
+    // Blur commits the buffered value.
+    fire(el, 'blur');
+    expect(model($rootScope, 'name')).toBe('Ada');
+  });
+
+  it("updateOn: 'default blur' commits on typing AND on blur", () => {
+    const { $compile, $rootScope } = boot();
+    const root = compile(
+      `<div><input type="text" ng-model="name" ng-model-options="{ updateOn: 'default blur' }"></div>`,
+      $compile,
+      $rootScope,
+    );
+    const el = findInput(root);
+
+    type(el, 'Grace');
+    expect(model($rootScope, 'name')).toBe('Grace');
+  });
+
+  it('inherits updateOn from an ancestor ngModelOptions', () => {
+    const { $compile, $rootScope } = boot();
+    const root = compile(
+      `<div ng-model-options="{ updateOn: 'blur' }"><input type="text" ng-model="name"></div>`,
+      $compile,
+      $rootScope,
+    );
+    const el = findInput(root);
+
+    type(el, 'Edith');
+    expect(model($rootScope, 'name')).toBeUndefined();
+    fire(el, 'blur');
+    expect(model($rootScope, 'name')).toBe('Edith');
+  });
+});
+
+describe('ngModelOptions — debounce (FS §2.5)', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it('debounce (a number) delays the model write', () => {
+    const { $compile, $rootScope } = boot();
+    const root = compile(
+      `<div><input type="text" ng-model="name" ng-model-options="{ debounce: 300 }"></div>`,
+      $compile,
+      $rootScope,
+    );
+    const el = findInput(root);
+
+    type(el, 'Lin');
+    // Not committed yet — the debounce timer is still pending.
+    expect(model($rootScope, 'name')).toBeUndefined();
+
+    vi.advanceTimersByTime(300);
+    expect(model($rootScope, 'name')).toBe('Lin');
+  });
+
+  it('a superseding change resets the debounce timer', () => {
+    const { $compile, $rootScope } = boot();
+    const root = compile(
+      `<div><input type="text" ng-model="name" ng-model-options="{ debounce: 300 }"></div>`,
+      $compile,
+      $rootScope,
+    );
+    const el = findInput(root);
+
+    type(el, 'a');
+    vi.advanceTimersByTime(200);
+    // A second keystroke before the first commit resets the window.
+    type(el, 'ab');
+    vi.advanceTimersByTime(200);
+    expect(model($rootScope, 'name')).toBeUndefined();
+
+    vi.advanceTimersByTime(100);
+    expect(model($rootScope, 'name')).toBe('ab');
+  });
+
+  it('a per-event debounce map applies a different delay per trigger', () => {
+    const { $compile, $rootScope } = boot();
+    const root = compile(
+      `<div><input type="text" ng-model="name"
+         ng-model-options="{ updateOn: 'default blur', debounce: { default: 300, blur: 0 } }"></div>`,
+      $compile,
+      $rootScope,
+    );
+    const el = findInput(root);
+
+    // A `default` (input) commit is debounced by 300ms.
+    type(el, 'x');
+    expect(model($rootScope, 'name')).toBeUndefined();
+    vi.advanceTimersByTime(300);
+    expect(model($rootScope, 'name')).toBe('x');
+
+    // A `blur` commit is immediate (delay 0) — flushes the pending default too.
+    type(el, 'xy');
+    fire(el, 'blur');
+    expect(model($rootScope, 'name')).toBe('xy');
+  });
+
+  it('cancels a pending debounce timer on $destroy (no late write, no throw)', () => {
+    const { $compile, $rootScope } = boot();
+    // Link against a CHILD scope so `$destroy()` actually fires (the root
+    // scope's `$destroy` is a no-op in this framework); the control's
+    // `$on('$destroy')` cancel handler runs on the child scope teardown.
+    const child = $rootScope.$new();
+    const host = document.createElement('div');
+    host.innerHTML = `<input type="text" ng-model="name" ng-model-options="{ debounce: 300 }">`;
+    const inputEl = findInput(host);
+    $compile(inputEl)(child);
+    child.$digest();
+
+    type(inputEl, 'gone');
+    // Destroy the (child) scope before the debounce fires.
+    child.$destroy();
+
+    expect(() => {
+      vi.advanceTimersByTime(500);
+    }).not.toThrow();
+    // The commit never lands after destroy.
+    expect(model($rootScope, 'name')).toBeUndefined();
+  });
+});
+
+describe('ngModelOptions — allowInvalid (FS §2.5)', () => {
+  it('allowInvalid: true writes an invalid value to the model (validity still flips)', () => {
+    const { $compile, $rootScope } = boot();
+    const root = compile(
+      `<div><input type="text" ng-model="v" required ng-model-options="{ allowInvalid: true }"></div>`,
+      $compile,
+      $rootScope,
+    );
+    const el = findInput(root);
+
+    // required makes an empty value invalid; with allowInvalid the empty
+    // string is still written, and the required rule still flips validity.
+    type(el, 'x');
+    expect(model($rootScope, 'v')).toBe('x');
+    type(el, '');
+    // Invalid (required) — but allowInvalid keeps the empty string in the model.
+    expect(model($rootScope, 'v')).toBe('');
+    expect(el.classList.contains('ng-invalid')).toBe(true);
+    expect(el.classList.contains('ng-invalid-required')).toBe(true);
+  });
+
+  it('WITHOUT allowInvalid an invalid value is withheld (default)', () => {
+    const { $compile, $rootScope } = boot();
+    const root = compile(`<div><input type="number" ng-model="n"></div>`, $compile, $rootScope);
+    const el = findInput(root);
+
+    setModel($rootScope, 'n', 5);
+    $rootScope.$digest();
+    // Force a bad numeric parse.
+    Object.defineProperty(el, 'validity', {
+      configurable: true,
+      get: () => ({ badInput: true, valid: false }) as unknown as ValidityState,
+    });
+    el.value = '';
+    el.dispatchEvent(new Event('input'));
+
+    expect(model($rootScope, 'n')).toBeUndefined();
+    expect(el.classList.contains('ng-invalid-number')).toBe(true);
+  });
+});
+
+describe('ngModelOptions — getterSetter (FS §2.5)', () => {
+  it('getterSetter: true round-trips through a getter/setter function', () => {
+    const { $compile, $rootScope } = boot();
+    let stored = 'initial';
+    // AngularJS getter/setter convention: called with no args → read; called
+    // with a value → write. `function` (not arrow) so `arguments` is available.
+    function accessor(...args: unknown[]): unknown {
+      if (args.length === 0) {
+        return stored;
+      }
+      stored = args[0] as string;
+      return stored;
+    }
+    setModel($rootScope, 'name', accessor);
+
+    const root = compile(
+      `<div><input type="text" ng-model="name" ng-model-options="{ getterSetter: true }"></div>`,
+      $compile,
+      $rootScope,
+    );
+    const el = findInput(root);
+
+    // Read: the getter's current value renders into the field.
+    expect(el.value).toBe('initial');
+
+    // Write: typing calls the setter, updating the backing store.
+    type(el, 'updated');
+    expect(stored).toBe('updated');
+
+    // Read again from code: the getter reflects the new value.
+    stored = 'external';
+    $rootScope.$digest();
+    expect(el.value).toBe('external');
+  });
+});
+
+describe('ngModelOptions — timezone (FS §2.5)', () => {
+  /** Parse a `type=date` value under a given timezone option, returning the model Date. */
+  function parseDateUnderTz(tz: string, value: string): Date {
+    const { $compile, $rootScope } = boot();
+    const root = compile(
+      `<div><input type="date" ng-model="d" ng-model-options="{ timezone: '${tz}' }"></div>`,
+      $compile,
+      $rootScope,
+    );
+    const el = findInput(root);
+    el.value = value;
+    el.dispatchEvent(new Event('input'));
+    const d = model($rootScope, 'd');
+    expect(d).toBeInstanceOf(Date);
+    resetRegistry();
+    return d as Date;
+  }
+
+  it('timezone shifts the parsed instant: UTC vs +0500 differ by 5 hours', () => {
+    // The SAME date string parsed under two zones yields two instants five
+    // hours apart — midnight in a more-eastern zone is an earlier UTC instant.
+    // This relative check is host-timezone-independent (unlike an absolute
+    // getTime() assertion).
+    const utc = parseDateUnderTz('UTC', '2020-06-15');
+    const east5 = parseDateUnderTz('+0500', '2020-06-15');
+    // The two zones produce instants exactly five hours apart (the direction
+    // is a convention detail of the shared date helper; the magnitude proves
+    // the timezone option is honored end-to-end).
+    expect(Math.abs(utc.getTime() - east5.getTime())).toBe(5 * 60 * 60 * 1000);
+  });
+
+  it('round-trips a date-model Date back into the field text under UTC (lossless)', () => {
+    const { $compile, $rootScope } = boot();
+
+    // First control: parse '2021-01-02' under UTC to obtain the model Date.
+    const rootA = compile(
+      `<div><input type="date" ng-model="d" ng-model-options="{ timezone: 'UTC' }"></div>`,
+      $compile,
+      $rootScope,
+    );
+    const elA = findInput(rootA);
+    elA.value = '2021-01-02';
+    elA.dispatchEvent(new Event('input'));
+    const parsedDate = model($rootScope, 'd');
+    expect(parsedDate).toBeInstanceOf(Date);
+
+    // Second control bound to the SAME model, also UTC: it renders the Date
+    // back into the input as the original string — parse/format under the
+    // configured zone is symmetric (lossless round-trip).
+    const rootB = compile(
+      `<div><input type="date" ng-model="d" ng-model-options="{ timezone: 'UTC' }"></div>`,
+      $compile,
+      $rootScope,
+    );
+    const elB = findInput(rootB);
+    $rootScope.$digest();
+    expect(elB.value).toBe('2021-01-02');
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// PR-audit regression — a lone `updateOn: '*'` resets to default events
+// ────────────────────────────────────────────────────────────────────────────
+
+describe("ngModelOptions — updateOn: '*' alone (inheritance reset)", () => {
+  it('resets an inherited blur-only updateOn back to the default input events', () => {
+    const { $compile, $rootScope } = boot();
+    const root = compile(
+      '<div ng-model-options="{ updateOn: \'blur\' }">' +
+        '<input ng-model="v" ng-model-options="{ updateOn: \'*\' }">' +
+        '</div>',
+      $compile,
+      $rootScope,
+    );
+    const el = findInput(root);
+
+    // The child reset inheritance — typing must commit immediately (the
+    // handler's default events), NOT wait for blur.
+    type(el, 'typed');
+    expect(model($rootScope, 'v')).toBe('typed');
+  });
+});
diff --git a/src/forms/__tests__/ng-model.test.ts b/src/forms/__tests__/ng-model.test.ts
new file mode 100644
index 0000000..e5a0696
--- /dev/null
+++ b/src/forms/__tests__/ng-model.test.ts
@@ -0,0 +1,289 @@
+/**
+ * `ngModel` two-way binding + state + `ngChange` + `textarea` (spec 039
+ * Slice 1).
+ *
+ * End-to-end through the canonical `ngModule` (via `bootstrapInjector`),
+ * exercising the real `$compile` / `$rootScope` so the forms directives
+ * registered by `src/core/ng-module.ts` are reachable. User input is
+ * simulated by setting `element.value` and dispatching native `input` /
+ * `change` / `blur` events, matching how a browser drives the control.
+ */
+
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { asHtmlElement, asInput, asTextarea } from '@compiler/__tests__/dom-guards';
+import type { CompileService } from '@compiler/directive-types';
+import type { Scope } from '@core/index';
+import { bootstrapInjector } from '@bootstrap/index';
+import { resetRegistry } from '@di/module';
+import { NgModelControllerImpl } from '@forms/ng-model-controller';
+
+interface Harness {
+  $compile: CompileService;
+  $rootScope: Scope;
+}
+
+function boot(): Harness {
+  const injector = bootstrapInjector([]);
+  return {
+    $compile: injector.get('$compile'),
+    $rootScope: injector.get('$rootScope'),
+  };
+}
+
+afterEach(() => {
+  resetRegistry();
+});
+
+function compile(html: string, $compile: CompileService, scope: Scope): HTMLElement {
+  const el = document.createElement('div');
+  el.innerHTML = html;
+  const child = asHtmlElement(el.firstElementChild);
+  $compile(child)(scope);
+  scope.$digest();
+  return child;
+}
+
+function fireInput(el: HTMLInputElement, value: string): void {
+  el.value = value;
+  el.dispatchEvent(new Event('input'));
+}
+
+describe('ngModel — registration', () => {
+  it('registers ngModel / input / textarea / ngChange on ngModule', () => {
+    const injector = bootstrapInjector([]);
+    expect(injector.has('ngModelDirective')).toBe(true);
+    expect(injector.has('inputDirective')).toBe(true);
+    expect(injector.has('textareaDirective')).toBe(true);
+    expect(injector.has('ngChangeDirective')).toBe(true);
+  });
+});
+
+describe('ngModel — two-way binding (FS §2.1)', () => {
+  it('typing into a text input updates a nested model path (intermediates created)', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input type="text" ng-model="user.name">', $compile, $rootScope);
+    const node = asInput(el);
+
+    // Initially undefined model → empty value.
+    expect(node.value).toBe('');
+
+    fireInput(node, 'Ada');
+
+    expect(($rootScope as unknown as { user: { name: string } }).user.name).toBe('Ada');
+  });
+
+  it('a model change in code re-renders the field', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input type="text" ng-model="greeting">', $compile, $rootScope);
+    const node = asInput(el);
+
+    ($rootScope as unknown as { greeting: string }).greeting = 'hello';
+    $rootScope.$digest();
+
+    expect(node.value).toBe('hello');
+  });
+
+  it('deeply nested path round-trips both directions', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input type="text" ng-model="a.b.c">', $compile, $rootScope);
+    const node = asInput(el);
+
+    fireInput(node, 'deep');
+    expect(($rootScope as unknown as { a: { b: { c: string } } }).a.b.c).toBe('deep');
+
+    ($rootScope as unknown as { a: { b: { c: string } } }).a.b.c = 'changed';
+    $rootScope.$digest();
+    expect(node.value).toBe('changed');
+  });
+});
+
+describe('ngModel — non-assignable model routes "$compile"', () => {
+  it('routes a non-assignable expression through $exceptionHandler (default → console.error)', () => {
+    // The default `$exceptionHandler` is `consoleErrorExceptionHandler`,
+    // so the non-assignable-model error surfaces via `console.error` with
+    // cause `'$compile'`. Spying it is the observable proxy for the
+    // routing contract; the directive goes inert (no model write, no
+    // throw out of compile/link).
+    const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    const { $compile, $rootScope } = boot();
+
+    const el = document.createElement('div');
+    el.innerHTML = '<input type="text" ng-model="a + b">';
+    const node = asInput(el.firstElementChild);
+    expect(() => {
+      $compile(node)($rootScope);
+      $rootScope.$digest();
+    }).not.toThrow();
+
+    expect(consoleSpy).toHaveBeenCalled();
+    consoleSpy.mockRestore();
+  });
+});
+
+describe('ngModel — dirty / pristine / touched transitions + classes (FS §2.2)', () => {
+  it('fresh control is pristine + untouched + valid with matching classes', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input type="text" ng-model="x">', $compile, $rootScope);
+
+    expect(el.classList.contains('ng-pristine')).toBe(true);
+    expect(el.classList.contains('ng-untouched')).toBe(true);
+    expect(el.classList.contains('ng-valid')).toBe(true);
+    expect(el.classList.contains('ng-dirty')).toBe(false);
+  });
+
+  it('typing marks the control dirty + toggles classes', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input type="text" ng-model="x">', $compile, $rootScope);
+    fireInput(asInput(el), 'typed');
+
+    expect(el.classList.contains('ng-dirty')).toBe(true);
+    expect(el.classList.contains('ng-pristine')).toBe(false);
+  });
+
+  it('$setPristine resets the control', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input type="text" ng-model="x">', $compile, $rootScope);
+    fireInput(asInput(el), 'typed');
+    expect(el.classList.contains('ng-dirty')).toBe(true);
+
+    const ctrl = readController(el);
+    ctrl.$setPristine();
+    expect(el.classList.contains('ng-pristine')).toBe(true);
+    expect(el.classList.contains('ng-dirty')).toBe(false);
+  });
+
+  it('$setTouched / $setUntouched toggle the touched classes', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input type="text" ng-model="x">', $compile, $rootScope);
+    const ctrl = readController(el);
+
+    ctrl.$setTouched();
+    expect(el.classList.contains('ng-touched')).toBe(true);
+    expect(el.classList.contains('ng-untouched')).toBe(false);
+
+    ctrl.$setUntouched();
+    expect(el.classList.contains('ng-untouched')).toBe(true);
+    expect(el.classList.contains('ng-touched')).toBe(false);
+  });
+});
+
+describe('ngModel — ng-empty / ng-not-empty (FS §2.2)', () => {
+  it('reflects emptiness as the model changes', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input type="text" ng-model="x">', $compile, $rootScope);
+
+    // Empty model → ng-empty.
+    expect(el.classList.contains('ng-empty')).toBe(true);
+    expect(el.classList.contains('ng-not-empty')).toBe(false);
+
+    fireInput(asInput(el), 'something');
+    expect(el.classList.contains('ng-not-empty')).toBe(true);
+    expect(el.classList.contains('ng-empty')).toBe(false);
+
+    fireInput(asInput(el), '');
+    expect(el.classList.contains('ng-empty')).toBe(true);
+    expect(el.classList.contains('ng-not-empty')).toBe(false);
+  });
+});
+
+describe('ngModel — $setValidity + per-rule classes (FS §2.2)', () => {
+  it('toggles ng-valid-<key> / ng-invalid-<key> and aggregate validity', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input type="text" ng-model="x">', $compile, $rootScope);
+    const ctrl = readController(el);
+
+    ctrl.$setValidity('required', false);
+    expect(el.classList.contains('ng-invalid')).toBe(true);
+    expect(el.classList.contains('ng-invalid-required')).toBe(true);
+    expect(ctrl.$invalid).toBe(true);
+    expect(ctrl.$error['required']).toBe(true);
+
+    ctrl.$setValidity('required', true);
+    expect(el.classList.contains('ng-valid')).toBe(true);
+    expect(el.classList.contains('ng-valid-required')).toBe(true);
+    expect(ctrl.$valid).toBe(true);
+    expect('required' in ctrl.$error).toBe(false);
+  });
+
+  it('dasherizes a camelCase rule key', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<input type="text" ng-model="x">', $compile, $rootScope);
+    const ctrl = readController(el);
+
+    ctrl.$setValidity('myCustomRule', false);
+    expect(el.classList.contains('ng-invalid-my-custom-rule')).toBe(true);
+  });
+});
+
+describe('ngChange — fires on committed view change only (FS §2.5)', () => {
+  it('fires on user input but NOT on a programmatic model change', () => {
+    const { $compile, $rootScope } = boot();
+    ($rootScope as unknown as { count: number }).count = 0;
+    const el = compile('<input type="text" ng-model="x" ng-change="count = count + 1">', $compile, $rootScope);
+
+    // Programmatic model change should NOT fire ngChange.
+    ($rootScope as unknown as { x: string }).x = 'fromCode';
+    $rootScope.$digest();
+    expect(($rootScope as unknown as { count: number }).count).toBe(0);
+
+    // User input SHOULD fire ngChange.
+    fireInput(asInput(el), 'typed');
+    expect(($rootScope as unknown as { count: number }).count).toBe(1);
+  });
+});
+
+describe('textarea — binds a string', () => {
+  it('two-way binds like a text input', () => {
+    const { $compile, $rootScope } = boot();
+    const el = compile('<textarea ng-model="notes"></textarea>', $compile, $rootScope);
+    const node = asTextarea(el);
+
+    ($rootScope as unknown as { notes: string }).notes = 'hi';
+    $rootScope.$digest();
+    expect(node.value).toBe('hi');
+
+    node.value = 'edited';
+    node.dispatchEvent(new Event('input'));
+    expect(($rootScope as unknown as { notes: string }).notes).toBe('edited');
+  });
+});
+
+function readController(el: HTMLElement): NgModelControllerImpl {
+  // The controller is stashed on $$ngControllers under 'ngModel'.
+  const map = (el as unknown as { $$ngControllers?: Map<string, unknown> }).$$ngControllers;
+  const ctrl = map?.get('ngModel');
+  if (!(ctrl instanceof NgModelControllerImpl)) {
+    throw new Error('ngModel controller not found on element');
+  }
+  return ctrl;
+}
+
+// ────────────────────────────────────────────────────────────────────────────
+// PR-audit regression — the model watch preserves a live parse error
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('model watch — parse-error preservation (PR-audit regression)', () => {
+  it('does not clear $error.parse when the model is set to the same rejected text', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="x">', $compile, $rootScope));
+    const ctrl = readController(el);
+
+    // A parser that rejects any value containing digits.
+    ctrl.$parsers.push((v: unknown) => (typeof v === 'string' && /\d/.test(v) ? undefined : v));
+
+    fireInput(el, 'abc123');
+    expect(ctrl.$error['parse']).toBe(true);
+    expect(($rootScope as unknown as Record<string, unknown>)['x']).toBeUndefined();
+
+    // Programmatically writing the SAME rejected text onto the scope: the
+    // formatted value equals what the view already shows, so `$render` is
+    // skipped — and the live parse error must STAND (AngularJS
+    // `ngModelWatch` parity: validators re-run only inside the render
+    // branch).
+    ($rootScope as unknown as Record<string, unknown>)['x'] = 'abc123';
+    $rootScope.$digest();
+    expect(ctrl.$error['parse']).toBe(true);
+    expect(el.value).toBe('abc123');
+  });
+});
diff --git a/src/forms/__tests__/ng-options.test.ts b/src/forms/__tests__/ng-options.test.ts
new file mode 100644
index 0000000..204a315
--- /dev/null
+++ b/src/forms/__tests__/ng-options.test.ts
@@ -0,0 +1,388 @@
+/**
+ * `ngOptions` directive (spec 039 Slice 4 / FS §2.5).
+ *
+ * Drives a `<select ng-model ng-options="…">` end-to-end through the
+ * canonical `ngModule` (via `bootstrapInjector`), exercising label / value /
+ * `group by` / `disable when` / `track by` against ARRAY and OBJECT
+ * collections. Options are generated from the collection; selection is
+ * simulated by setting `.value` / an option's `.selected` and dispatching a
+ * native `change`. Vectors ported from AngularJS `ngOptionsSpec.js`.
+ */
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { asOption, asSelect } from '@compiler/__tests__/dom-guards';
+import type { CompileService } from '@compiler/directive-types';
+import type { Scope } from '@core/index';
+import { bootstrapInjector } from '@bootstrap/index';
+import { resetRegistry } from '@di/module';
+
+interface Harness {
+  $compile: CompileService;
+  $rootScope: Scope;
+}
+
+function boot(): Harness {
+  const injector = bootstrapInjector([]);
+  return {
+    $compile: injector.get('$compile'),
+    $rootScope: injector.get('$rootScope'),
+  };
+}
+
+afterEach(() => {
+  resetRegistry();
+});
+
+/** Compile a `<select>` fragment against `scope` + digest. */
+function compile(html: string, $compile: CompileService, scope: Scope): HTMLSelectElement {
+  const el = document.createElement('div');
+  el.innerHTML = html;
+  const child = asSelect(el.firstElementChild);
+  $compile(child)(scope);
+  scope.$digest();
+  return child;
+}
+
+function fireChange(el: HTMLSelectElement): void {
+  el.dispatchEvent(new Event('change'));
+}
+
+function model(scope: Scope, key: string): unknown {
+  return (scope as unknown as Record<string, unknown>)[key];
+}
+
+function setModel(scope: Scope, key: string, value: unknown): void {
+  (scope as unknown as Record<string, unknown>)[key] = value;
+}
+
+/** The rendered `<option>` labels (in DOM order, skipping optgroups). */
+function optionLabels(select: HTMLSelectElement): string[] {
+  return Array.from(select.querySelectorAll('option')).map((o) => o.text);
+}
+
+// ────────────────────────────────────────────────────────────────────────────
+// array collections — label / value
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('ngOptions over an array — label + value (FS §2.5)', () => {
+  it('generates one option per array item with the label expression', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'items', [
+      { id: 1, name: 'Ada' },
+      { id: 2, name: 'Alan' },
+    ]);
+    const select = compile(
+      '<select ng-model="chosen" ng-options="item.name for item in items"></select>',
+      $compile,
+      $rootScope,
+    );
+
+    // The blank leading label is the synthetic unknown option (`value="?"`)
+    // — the model is unset and matches no option (AngularJS parity).
+    expect(optionLabels(select)).toEqual(['', 'Ada', 'Alan']);
+  });
+
+  it('binds the whole item as the model value (bare form)', () => {
+    const { $compile, $rootScope } = boot();
+    const ada = { id: 1, name: 'Ada' };
+    const alan = { id: 2, name: 'Alan' };
+    setModel($rootScope, 'items', [ada, alan]);
+    const select = compile(
+      '<select ng-model="chosen" ng-options="item.name for item in items"></select>',
+      $compile,
+      $rootScope,
+    );
+
+    // Index 0 is the unknown option (model unset) — Alan is at index 2.
+    asOption(select.options[2]).selected = true;
+    fireChange(select);
+    expect(model($rootScope, 'chosen')).toBe(alan);
+  });
+
+  it('the `select as label` form binds the select expression, labels with the label expression', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'items', [
+      { id: 1, name: 'Ada' },
+      { id: 2, name: 'Alan' },
+    ]);
+    const select = compile(
+      '<select ng-model="chosen" ng-options="item.id as item.name for item in items"></select>',
+      $compile,
+      $rootScope,
+    );
+
+    expect(optionLabels(select)).toEqual(['', 'Ada', 'Alan']);
+    // Index 0 is the unknown option (model unset) — Ada is at index 1.
+    asOption(select.options[1]).selected = true;
+    fireChange(select);
+    expect(model($rootScope, 'chosen')).toBe(1);
+  });
+
+  it('renders the current model onto the selection', () => {
+    const { $compile, $rootScope } = boot();
+    const ada = { id: 1, name: 'Ada' };
+    const alan = { id: 2, name: 'Alan' };
+    setModel($rootScope, 'items', [ada, alan]);
+    setModel($rootScope, 'chosen', alan);
+    const select = compile(
+      '<select ng-model="chosen" ng-options="item.name for item in items"></select>',
+      $compile,
+      $rootScope,
+    );
+
+    expect(select.options[select.selectedIndex]?.textContent).toBe('Alan');
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// group by
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('ngOptions group by — optgroups (FS §2.5)', () => {
+  it('wraps options in <optgroup> by the group-by value', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'people', [
+      { name: 'Ada', team: 'Analysis' },
+      { name: 'Alan', team: 'Computing' },
+      { name: 'Grace', team: 'Computing' },
+    ]);
+    const select = compile(
+      '<select ng-model="chosen" ng-options="p.name group by p.team for p in people"></select>',
+      $compile,
+      $rootScope,
+    );
+
+    const groups = Array.from(select.querySelectorAll('optgroup'));
+    expect(groups.map((g) => g.label)).toEqual(['Analysis', 'Computing']);
+    const computing = groups[1];
+    if (computing === undefined) {
+      throw new Error('expected a second <optgroup>');
+    }
+    expect(Array.from(computing.querySelectorAll('option')).map((o) => o.textContent)).toEqual(['Alan', 'Grace']);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// disable when
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('ngOptions disable when — per-option disabled (FS §2.5)', () => {
+  it('disables options whose disable-when expression is truthy', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'items', [
+      { name: 'A', locked: false },
+      { name: 'B', locked: true },
+      { name: 'C', locked: false },
+    ]);
+    const select = compile(
+      '<select ng-model="chosen" ng-options="i.name disable when i.locked for i in items"></select>',
+      $compile,
+      $rootScope,
+    );
+
+    const options = Array.from(select.querySelectorAll('option'));
+    // The leading entry is the (enabled) unknown option — model unset.
+    expect(options.map((o) => o.disabled)).toEqual([false, false, true, false]);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// track by
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('ngOptions track by — stable identity (FS §2.5)', () => {
+  it('selects by track-by identity even with a fresh (non-identical) model object', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'items', [
+      { id: 1, name: 'Ada' },
+      { id: 2, name: 'Alan' },
+    ]);
+    const select = compile(
+      '<select ng-model="chosen" ng-options="item.name for item in items track by item.id"></select>',
+      $compile,
+      $rootScope,
+    );
+
+    // Index 0 is the unknown option (model unset) — Ada is at index 1.
+    asOption(select.options[1]).selected = true;
+    fireChange(select);
+    const chosen = model($rootScope, 'chosen') as { id: number };
+    expect(chosen.id).toBe(1);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// object collections
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('ngOptions over an object — (key, value) iteration (FS §2.5)', () => {
+  it('generates options from object properties', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'colors', { r: 'Red', g: 'Green', b: 'Blue' });
+    const select = compile(
+      '<select ng-model="chosen" ng-options="value for (key, value) in colors"></select>',
+      $compile,
+      $rootScope,
+    );
+
+    // The blank leading label is the unknown option — model unset.
+    expect(optionLabels(select)).toEqual(['', 'Red', 'Green', 'Blue']);
+  });
+
+  it('binds the property value as the model value', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'colors', { r: 'Red', g: 'Green' });
+    const select = compile(
+      '<select ng-model="chosen" ng-options="value for (key, value) in colors"></select>',
+      $compile,
+      $rootScope,
+    );
+
+    // Index 0 is the unknown option (model unset) — Green is at index 2.
+    asOption(select.options[2]).selected = true;
+    fireChange(select);
+    expect(model($rootScope, 'chosen')).toBe('Green');
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// collection change regenerates options
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('ngOptions — collection change regenerates options (FS §2.5)', () => {
+  it('regenerates the option list when the collection changes', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'items', [{ name: 'A' }]);
+    const select = compile(
+      '<select ng-model="chosen" ng-options="i.name for i in items"></select>',
+      $compile,
+      $rootScope,
+    );
+    // The blank leading label is the unknown option — model unset.
+    expect(optionLabels(select)).toEqual(['', 'A']);
+
+    setModel($rootScope, 'items', [{ name: 'X' }, { name: 'Y' }, { name: 'Z' }]);
+    $rootScope.$digest();
+    expect(optionLabels(select)).toEqual(['', 'X', 'Y', 'Z']);
+  });
+
+  it('appending to the collection adds options in place', () => {
+    const { $compile, $rootScope } = boot();
+    const items: { name: string }[] = [{ name: 'one' }];
+    setModel($rootScope, 'items', items);
+    const select = compile(
+      '<select ng-model="chosen" ng-options="i.name for i in items"></select>',
+      $compile,
+      $rootScope,
+    );
+    // The blank leading label is the unknown option — model unset.
+    expect(optionLabels(select)).toEqual(['', 'one']);
+
+    items.push({ name: 'two' });
+    $rootScope.$digest();
+    expect(optionLabels(select)).toEqual(['', 'one', 'two']);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// track by — model → view matching (PR-audit regressions)
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('ngOptions track by — model→view matching', () => {
+  it('selects the option for a FRESH (non-identical) model object with a matching track-by key', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'items', [
+      { id: 1, name: 'Ada' },
+      { id: 2, name: 'Alan' },
+    ]);
+    const select = compile(
+      '<select ng-model="chosen" ng-options="item.name for item in items track by item.id"></select>',
+      $compile,
+      $rootScope,
+    );
+
+    // A server-fresh copy: same track-by key, different object reference.
+    setModel($rootScope, 'chosen', { id: 2, name: 'Alan (updated)' });
+    $rootScope.$digest();
+
+    expect(select.options[select.selectedIndex]?.textContent).toBe('Alan');
+  });
+
+  it('a multiple select checks options for fresh model objects by track-by key', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'items', [
+      { id: 1, name: 'Ada' },
+      { id: 2, name: 'Alan' },
+      { id: 3, name: 'Grace' },
+    ]);
+    const select = compile(
+      '<select multiple ng-model="chosen" ng-options="item.name for item in items track by item.id"></select>',
+      $compile,
+      $rootScope,
+    );
+
+    setModel($rootScope, 'chosen', [{ id: 1 }, { id: 3 }]);
+    $rootScope.$digest();
+
+    const selected = Array.from(select.querySelectorAll('option'))
+      .filter((o) => o.selected)
+      .map((o) => o.textContent);
+    expect(selected).toEqual(['Ada', 'Grace']);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// unknown option + empty option (PR-audit regressions)
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('ngOptions — unknown option and empty option', () => {
+  it('removes the unknown option once the model matches a generated option', () => {
+    const { $compile, $rootScope } = boot();
+    const items = [{ name: 'A' }, { name: 'B' }];
+    setModel($rootScope, 'items', items);
+    const select = compile(
+      '<select ng-model="chosen" ng-options="i.name for i in items"></select>',
+      $compile,
+      $rootScope,
+    );
+    expect(optionLabels(select)).toEqual(['', 'A', 'B']);
+
+    setModel($rootScope, 'chosen', items[1]);
+    $rootScope.$digest();
+
+    expect(optionLabels(select)).toEqual(['A', 'B']);
+    expect(select.options[select.selectedIndex]?.textContent).toBe('B');
+  });
+
+  it('preserves an author-supplied empty option and selects it for a null model', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'items', [{ name: 'A' }, { name: 'B' }]);
+    const select = compile(
+      '<select ng-model="chosen" ng-options="i.name for i in items"><option value="">-- choose --</option></select>',
+      $compile,
+      $rootScope,
+    );
+
+    // The placeholder survives option regeneration; a null/undefined model
+    // selects it (no unknown option is inserted).
+    expect(optionLabels(select)).toEqual(['-- choose --', 'A', 'B']);
+    expect(select.value).toBe('');
+  });
+
+  it('selecting the empty option reads back as null (view → model)', () => {
+    const { $compile, $rootScope } = boot();
+    const items = [{ name: 'A' }, { name: 'B' }];
+    setModel($rootScope, 'items', items);
+    setModel($rootScope, 'chosen', items[0]);
+    const select = compile(
+      '<select ng-model="chosen" ng-options="i.name for i in items"><option value="">-- choose --</option></select>',
+      $compile,
+      $rootScope,
+    );
+
+    select.value = '';
+    fireChange(select);
+    expect(model($rootScope, 'chosen')).toBeNull();
+  });
+});
diff --git a/src/forms/__tests__/parity.test.ts b/src/forms/__tests__/parity.test.ts
new file mode 100644
index 0000000..bad2b24
--- /dev/null
+++ b/src/forms/__tests__/parity.test.ts
@@ -0,0 +1,393 @@
+/**
+ * Parity hardening — remaining upstream `ngModelSpec.js` / `formSpec.js`
+ * edge-case vectors not already covered by Slices 1–6 (spec 039 Slice 7).
+ *
+ * These port behaviors from AngularJS's own directive specs that the
+ * per-slice suites did not exercise directly:
+ *
+ *  - `$setDirty` / `$setPristine` propagation through nested forms;
+ *  - `$rollbackViewValue` restoring a buffered value;
+ *  - `$parsers` / `$formatters` ORDERING (parsers forward, formatters
+ *    reverse);
+ *  - a `$isEmpty` override changing `required` / `ng-empty`;
+ *  - form / control re-name via `$$renameControl`;
+ *  - `$commitViewValue` no-op on an unchanged value;
+ *  - a failing parser short-circuiting the chain (`parse` key);
+ *  - the model→view feedback guard not double-firing view-change listeners.
+ *
+ * End-to-end through the canonical `ngModule` (via `bootstrapInjector`) so the
+ * real `$compile` / `$rootScope` / `$q` back the assertions.
+ */
+
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { asHtmlElement, asInput } from '@compiler/__tests__/dom-guards';
+import type { CompileService } from '@compiler/directive-types';
+import type { Scope } from '@core/index';
+import { bootstrapInjector } from '@bootstrap/index';
+import { resetRegistry } from '@di/module';
+import { FormControllerImpl } from '@forms/form-controller';
+import { NgModelControllerImpl } from '@forms/ng-model-controller';
+
+interface Harness {
+  $compile: CompileService;
+  $rootScope: Scope;
+}
+
+function boot(): Harness {
+  const injector = bootstrapInjector([]);
+  return {
+    $compile: injector.get('$compile'),
+    $rootScope: injector.get('$rootScope'),
+  };
+}
+
+afterEach(() => {
+  resetRegistry();
+});
+
+function compile(html: string, $compile: CompileService, scope: Scope): HTMLElement {
+  const el = document.createElement('div');
+  el.innerHTML = html;
+  const child = asHtmlElement(el.firstElementChild);
+  $compile(child)(scope);
+  scope.$digest();
+  return child;
+}
+
+function fireInput(el: HTMLInputElement, value: string): void {
+  el.value = value;
+  el.dispatchEvent(new Event('input'));
+}
+
+/** Pull the published `NgModelController` off an element's controller stash. */
+function ctrlOf(el: HTMLElement): NgModelControllerImpl {
+  const stash = (el as unknown as { $$ngControllers?: Map<string, unknown> }).$$ngControllers;
+  const ctrl = stash?.get('ngModel');
+  if (!(ctrl instanceof NgModelControllerImpl)) {
+    throw new Error('no NgModelController on element');
+  }
+  return ctrl;
+}
+
+/** Pull the published `FormController` off a form element's controller stash. */
+function formOf(el: HTMLElement): FormControllerImpl {
+  const stash = (el as unknown as { $$ngControllers?: Map<string, unknown> }).$$ngControllers;
+  const ctrl = stash?.get('form');
+  if (!(ctrl instanceof FormControllerImpl)) {
+    throw new Error('no FormController on element');
+  }
+  return ctrl;
+}
+
+function scopeVal(scope: Scope, key: string): unknown {
+  return (scope as unknown as Record<string, unknown>)[key];
+}
+
+// ────────────────────────────────────────────────────────────────────────────
+// $setDirty / $setPristine propagation (ngModelSpec.js / formSpec.js)
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('$setDirty / $setPristine propagation (parity)', () => {
+  it('a control going dirty propagates up through a nested form to the outer form', () => {
+    const { $compile, $rootScope } = boot();
+    const outer = compile(
+      '<form name="outer"><ng-form name="inner"><input name="i" ng-model="v"></ng-form></form>',
+      $compile,
+      $rootScope,
+    );
+    const outerCtrl = formOf(outer);
+    const el = asInput(outer.querySelector('input'));
+
+    // Fresh: both forms pristine.
+    expect(outerCtrl.$pristine).toBe(true);
+
+    fireInput(el, 'x');
+
+    // The control's $setDirty bubbles: inner form + outer form both dirty.
+    const innerCtrl = scopeVal($rootScope, 'inner') as FormControllerImpl;
+    expect(innerCtrl.$dirty).toBe(true);
+    expect(outerCtrl.$dirty).toBe(true);
+    expect(outerCtrl.$pristine).toBe(false);
+    expect(outer.classList.contains('ng-dirty')).toBe(true);
+  });
+
+  it('form.$setPristine fans out to every registered control and nested form', () => {
+    const { $compile, $rootScope } = boot();
+    const outer = compile(
+      '<form name="outer"><input name="a" ng-model="a"><ng-form name="inner"><input name="b" ng-model="b"></ng-form></form>',
+      $compile,
+      $rootScope,
+    );
+    const outerCtrl = formOf(outer);
+    const inputs = outer.querySelectorAll('input');
+    const elA = asInput(inputs[0]);
+    const elB = asInput(inputs[1]);
+
+    fireInput(elA, 'x');
+    fireInput(elB, 'y');
+    expect(outerCtrl.$dirty).toBe(true);
+    expect(ctrlOf(elA).$dirty).toBe(true);
+    expect(ctrlOf(elB).$dirty).toBe(true);
+
+    // Reset the outer form → every control + the nested form returns pristine.
+    outerCtrl.$setPristine();
+    expect(outerCtrl.$pristine).toBe(true);
+    expect(ctrlOf(elA).$pristine).toBe(true);
+    expect(ctrlOf(elB).$pristine).toBe(true);
+    const innerCtrl = scopeVal($rootScope, 'inner') as FormControllerImpl;
+    expect(innerCtrl.$pristine).toBe(true);
+  });
+
+  it('$setPristine on a form also clears $submitted (parity)', () => {
+    const { $compile, $rootScope } = boot();
+    const form = compile('<form name="f"><input name="i" ng-model="v"></form>', $compile, $rootScope);
+    const ctrl = formOf(form);
+    ctrl.$setSubmitted();
+    expect(ctrl.$submitted).toBe(true);
+    expect(form.classList.contains('ng-submitted')).toBe(true);
+
+    ctrl.$setPristine();
+    expect(ctrl.$submitted).toBe(false);
+    expect(form.classList.contains('ng-submitted')).toBe(false);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// $rollbackViewValue (ngModelSpec.js)
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('$rollbackViewValue (parity)', () => {
+  it('reverts an uncommitted view value to the last committed one and re-renders', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v" ng-model-options="{ updateOn: \'blur\' }">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    // Commit an initial value on blur.
+    el.value = 'first';
+    el.dispatchEvent(new Event('blur'));
+    expect(scopeVal($rootScope, 'v')).toBe('first');
+
+    // Type more without committing (updateOn:blur buffers on input).
+    fireInput(el, 'second-uncommitted');
+    // The model is still the committed value.
+    expect(scopeVal($rootScope, 'v')).toBe('first');
+
+    // Rollback discards the buffer and re-renders the committed value.
+    ctrl.$rollbackViewValue();
+    expect(el.value).toBe('first');
+    expect(ctrl.$viewValue).toBe('first');
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// $parsers / $formatters ordering (ngModelSpec.js)
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('$parsers / $formatters ordering (parity)', () => {
+  it('$parsers run in REGISTRATION order (view → model)', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+    const order: string[] = [];
+
+    ctrl.$parsers.push((value) => {
+      order.push('first');
+      return `${String(value)}|1`;
+    });
+    ctrl.$parsers.push((value) => {
+      order.push('second');
+      return `${String(value)}|2`;
+    });
+
+    fireInput(el, 'x');
+    expect(order).toEqual(['first', 'second']);
+    // Both parsers ran in order, appending in sequence.
+    expect(scopeVal($rootScope, 'v')).toBe('x|1|2');
+  });
+
+  it('$formatters run in REVERSE registration order (model → view)', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+    const order: string[] = [];
+
+    ctrl.$formatters.push((value) => {
+      order.push('first');
+      return `${String(value)}|a`;
+    });
+    ctrl.$formatters.push((value) => {
+      order.push('second');
+      return `${String(value)}|b`;
+    });
+
+    ($rootScope as unknown as Record<string, unknown>).v = 'model';
+    $rootScope.$digest();
+
+    // Reverse order: the LAST-registered formatter runs FIRST.
+    expect(order).toEqual(['second', 'first']);
+    expect(el.value).toBe('model|b|a');
+  });
+
+  it('a $parser returning undefined short-circuits the chain and fails the parse key', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+    let secondRan = false;
+
+    ctrl.$parsers.push(() => undefined);
+    ctrl.$parsers.push((value) => {
+      secondRan = true;
+      return value;
+    });
+
+    fireInput(el, 'x');
+    // The second parser never ran (short-circuit), and the bad parse keeps
+    // the value out of the model + fails the `parse` validity key.
+    expect(secondRan).toBe(false);
+    expect(scopeVal($rootScope, 'v')).toBeUndefined();
+    expect(ctrl.$error['parse']).toBe(true);
+    expect(ctrl.$invalid).toBe(true);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// $isEmpty overrides (ngModelSpec.js)
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('$isEmpty override (parity)', () => {
+  it('a custom $isEmpty drives ng-empty and required', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v" required>', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    // Override: only the literal string "empty" counts as empty.
+    ctrl.$isEmpty = (value: unknown): boolean => value === 'empty';
+
+    // Typing "empty" → required fails, ng-empty on.
+    fireInput(el, 'empty');
+    expect(ctrl.$error['required']).toBe(true);
+    expect(el.classList.contains('ng-empty')).toBe(true);
+
+    // Typing a normal value → not empty, required passes.
+    fireInput(el, 'real');
+    expect(ctrl.$error['required']).toBeUndefined();
+    expect(el.classList.contains('ng-not-empty')).toBe(true);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// Control / form re-name via $$renameControl (formSpec.js)
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('$$renameControl (parity)', () => {
+  it('renaming a control updates its $name', () => {
+    const { $compile, $rootScope } = boot();
+    const form = compile('<form name="f"><input name="a" ng-model="v"></form>', $compile, $rootScope);
+    const formCtrl = formOf(form);
+    const ctrl = ctrlOf(asInput(form.querySelector('input')));
+
+    expect(ctrl.$name).toBe('a');
+    formCtrl.$$renameControl(ctrl, 'renamed');
+    expect(ctrl.$name).toBe('renamed');
+
+    // The form-instance slots move too: `f.renamed` resolves the control,
+    // `f.a` is gone (AngularJS parity — expressions read `f.renamed.$invalid`).
+    const record = formCtrl as unknown as Record<string, unknown>;
+    expect(record['renamed']).toBe(ctrl);
+    expect(record['a']).toBeUndefined();
+  });
+
+  it('renaming does not clobber a newer control already published under the old name', () => {
+    const { $compile, $rootScope } = boot();
+    const form = compile('<form name="f"><input name="a" ng-model="v"></form>', $compile, $rootScope);
+    const formCtrl = formOf(form);
+    const ctrl = ctrlOf(asInput(form.querySelector('input')));
+
+    // Simulate a newer control having taken over the `a` slot.
+    const newer = { $name: 'a' };
+    const record = formCtrl as unknown as Record<string, unknown>;
+    record['a'] = newer;
+
+    formCtrl.$$renameControl(ctrl, 'renamed');
+    expect(record['a']).toBe(newer); // untouched — identity guard
+    expect(record['renamed']).toBe(ctrl);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// $commitViewValue no-op on unchanged value (ngModelSpec.js)
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('$commitViewValue / view-change listeners (parity)', () => {
+  it('re-committing the same view value does not re-fire $viewChangeListeners', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+    const spy = vi.fn();
+    ctrl.$viewChangeListeners.push(spy);
+
+    fireInput(el, 'x');
+    expect(spy).toHaveBeenCalledTimes(1);
+
+    // Committing the identical value again is a no-op — no listener re-fire.
+    ctrl.$setViewValue('x');
+    ctrl.$commitViewValue();
+    expect(spy).toHaveBeenCalledTimes(1);
+  });
+
+  it('a programmatic model change re-renders WITHOUT firing view-change listeners', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+    const spy = vi.fn();
+    ctrl.$viewChangeListeners.push(spy);
+
+    // Change the model in code — the view re-renders but ngChange-style
+    // listeners fire ONLY on committed USER input (FS §2.5).
+    ($rootScope as unknown as Record<string, unknown>).v = 'fromCode';
+    $rootScope.$digest();
+    expect(el.value).toBe('fromCode');
+    expect(spy).not.toHaveBeenCalled();
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// Programmatic state transitions (ngModelSpec.js)
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('programmatic control state (parity)', () => {
+  it('$setTouched / $setUntouched toggle the touched classes', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    expect(ctrl.$untouched).toBe(true);
+    expect(el.classList.contains('ng-untouched')).toBe(true);
+
+    ctrl.$setTouched();
+    expect(ctrl.$touched).toBe(true);
+    expect(el.classList.contains('ng-touched')).toBe(true);
+    expect(el.classList.contains('ng-untouched')).toBe(false);
+
+    ctrl.$setUntouched();
+    expect(ctrl.$untouched).toBe(true);
+    expect(el.classList.contains('ng-untouched')).toBe(true);
+  });
+
+  it('$setDirty / $setPristine toggle the dirty classes on the control', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    expect(ctrl.$pristine).toBe(true);
+    ctrl.$setDirty();
+    expect(ctrl.$dirty).toBe(true);
+    expect(el.classList.contains('ng-dirty')).toBe(true);
+
+    ctrl.$setPristine();
+    expect(ctrl.$pristine).toBe(true);
+    expect(el.classList.contains('ng-pristine')).toBe(true);
+    expect(el.classList.contains('ng-dirty')).toBe(false);
+  });
+});
diff --git a/src/forms/__tests__/select.test.ts b/src/forms/__tests__/select.test.ts
new file mode 100644
index 0000000..d4b96ce
--- /dev/null
+++ b/src/forms/__tests__/select.test.ts
@@ -0,0 +1,224 @@
+/**
+ * `select` directive + `SelectController` (spec 039 Slice 4 / FS §2.4).
+ *
+ * Drives a `<select ng-model>` end-to-end through the canonical `ngModule`
+ * (via `bootstrapInjector`), so the `select` / `option` directives
+ * registered by `src/core/ng-module.ts` are reachable. Selection is
+ * simulated the way a browser drives the control — setting `.value` /
+ * `.selectedIndex` / an option's `.selected`, then dispatching a native
+ * `change` event. Vectors ported from AngularJS `selectSpec.js`.
+ */
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import { asOption, asSelect } from '@compiler/__tests__/dom-guards';
+import type { CompileService } from '@compiler/directive-types';
+import type { Scope } from '@core/index';
+import { bootstrapInjector } from '@bootstrap/index';
+import { resetRegistry } from '@di/module';
+
+interface Harness {
+  $compile: CompileService;
+  $rootScope: Scope;
+}
+
+function boot(): Harness {
+  const injector = bootstrapInjector([]);
+  return {
+    $compile: injector.get('$compile'),
+    $rootScope: injector.get('$rootScope'),
+  };
+}
+
+afterEach(() => {
+  resetRegistry();
+});
+
+/** Compile an HTML fragment's first element against `scope` + digest. */
+function compile(html: string, $compile: CompileService, scope: Scope): HTMLSelectElement {
+  const el = document.createElement('div');
+  el.innerHTML = html;
+  const child = asSelect(el.firstElementChild);
+  $compile(child)(scope);
+  scope.$digest();
+  return child;
+}
+
+function fireChange(el: HTMLSelectElement): void {
+  el.dispatchEvent(new Event('change'));
+}
+
+function model(scope: Scope, key: string): unknown {
+  return (scope as unknown as Record<string, unknown>)[key];
+}
+
+function setModel(scope: Scope, key: string, value: unknown): void {
+  (scope as unknown as Record<string, unknown>)[key] = value;
+}
+
+/** The `<option>` children of a `<select>`, skipping the synthetic unknown option. */
+function optionValues(select: HTMLSelectElement): string[] {
+  return Array.from(select.options).map((o) => o.value);
+}
+
+// ────────────────────────────────────────────────────────────────────────────
+// single select
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('select (single) — binds the chosen option value (FS §2.4)', () => {
+  const html =
+    '<select ng-model="color">' +
+    '<option value="red">Red</option>' +
+    '<option value="green">Green</option>' +
+    '<option value="blue">Blue</option>' +
+    '</select>';
+
+  it('selecting an option writes its value to the model', () => {
+    const { $compile, $rootScope } = boot();
+    const select = compile(html, $compile, $rootScope);
+
+    select.value = 'green';
+    fireChange(select);
+    expect(model($rootScope, 'color')).toBe('green');
+  });
+
+  it('a model change re-renders the selection', () => {
+    const { $compile, $rootScope } = boot();
+    const select = compile(html, $compile, $rootScope);
+
+    setModel($rootScope, 'color', 'blue');
+    $rootScope.$digest();
+    expect(select.value).toBe('blue');
+    expect(select.options[select.selectedIndex]?.value).toBe('blue');
+  });
+
+  it('round-trips a selection back through a model change', () => {
+    const { $compile, $rootScope } = boot();
+    const select = compile(html, $compile, $rootScope);
+
+    select.value = 'red';
+    fireChange(select);
+    expect(model($rootScope, 'color')).toBe('red');
+
+    setModel($rootScope, 'color', 'green');
+    $rootScope.$digest();
+    expect(select.value).toBe('green');
+  });
+
+  it('an unknown model value (matching no option) renders the unknown option', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'color', 'purple');
+    const select = compile(html, $compile, $rootScope);
+
+    // No registered option matches 'purple' — the synthetic unknown option
+    // becomes the selection rather than silently binding 'red'.
+    expect(select.value).toBe('?');
+    // The unknown option is inserted as the first child.
+    expect(select.options[0]?.value).toBe('?');
+  });
+
+  it('setting the model to a real value after an unknown value clears the unknown option', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'color', 'purple');
+    const select = compile(html, $compile, $rootScope);
+    expect(select.value).toBe('?');
+
+    setModel($rootScope, 'color', 'blue');
+    $rootScope.$digest();
+    expect(select.value).toBe('blue');
+    // The unknown option is gone.
+    expect(optionValues(select)).not.toContain('?');
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// multiple select
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('select[multiple] — binds an array of chosen values (FS §2.4)', () => {
+  const html =
+    '<select ng-model="colors" multiple>' +
+    '<option value="red">Red</option>' +
+    '<option value="green">Green</option>' +
+    '<option value="blue">Blue</option>' +
+    '</select>';
+
+  it('selecting several options writes an array of their values', () => {
+    const { $compile, $rootScope } = boot();
+    const select = compile(html, $compile, $rootScope);
+
+    asOption(select.options[0]).selected = true;
+    asOption(select.options[2]).selected = true;
+    fireChange(select);
+
+    expect(model($rootScope, 'colors')).toEqual(['red', 'blue']);
+  });
+
+  it('an array model checks the matching options', () => {
+    const { $compile, $rootScope } = boot();
+    const select = compile(html, $compile, $rootScope);
+
+    setModel($rootScope, 'colors', ['green', 'blue']);
+    $rootScope.$digest();
+
+    expect(asOption(select.options[0]).selected).toBe(false);
+    expect(asOption(select.options[1]).selected).toBe(true);
+    expect(asOption(select.options[2]).selected).toBe(true);
+  });
+
+  it('deselecting all options writes an empty array', () => {
+    const { $compile, $rootScope } = boot();
+    const select = compile(html, $compile, $rootScope);
+
+    asOption(select.options[0]).selected = true;
+    fireChange(select);
+    expect(model($rootScope, 'colors')).toEqual(['red']);
+
+    asOption(select.options[0]).selected = false;
+    fireChange(select);
+    expect(model($rootScope, 'colors')).toEqual([]);
+  });
+
+  it('reports empty via $isEmpty when nothing is selected', () => {
+    const { $compile, $rootScope } = boot();
+    const select = compile(html, $compile, $rootScope);
+
+    // Fresh multiple select with no selection → ng-empty.
+    asOption(select.options[0]).selected = true;
+    fireChange(select);
+    expect(select.classList.contains('ng-not-empty')).toBe(true);
+
+    asOption(select.options[0]).selected = false;
+    fireChange(select);
+    expect(select.classList.contains('ng-empty')).toBe(true);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// PR-audit regression — interpolated option value re-keys on change
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('option — interpolated value="{{…}}" (PR-audit regression)', () => {
+  it('re-keys the option when the interpolated value changes, so model→view still matches', () => {
+    const { $compile, $rootScope } = boot();
+    setModel($rootScope, 'v', 'a');
+    const select = compile(
+      '<select ng-model="chosen"><option value="{{v}}">Pick</option></select>',
+      $compile,
+      $rootScope,
+    );
+
+    // Initial key is the interpolated value.
+    setModel($rootScope, 'chosen', 'a');
+    $rootScope.$digest();
+    expect(select.value).toBe('a');
+
+    // The interpolated value changes — the option must be re-registered
+    // under the new key so a matching model selects it (not the unknown
+    // option).
+    setModel($rootScope, 'v', 'b');
+    setModel($rootScope, 'chosen', 'b');
+    $rootScope.$digest();
+    expect(select.value).toBe('b');
+  });
+});
diff --git a/src/forms/__tests__/validators.test.ts b/src/forms/__tests__/validators.test.ts
new file mode 100644
index 0000000..f09255f
--- /dev/null
+++ b/src/forms/__tests__/validators.test.ts
@@ -0,0 +1,549 @@
+/**
+ * Built-in + custom (sync / async) validators + `$pending` (spec 039
+ * Slice 5).
+ *
+ * End-to-end through the canonical `ngModule` (via `bootstrapInjector`),
+ * exercising the real `$compile` / `$rootScope` / `$q` so the forms
+ * directives registered by `src/core/ng-module.ts` are reachable. User
+ * input is simulated by dispatching native `input` / `change` events;
+ * async validators use the real digest-scheduled `$q`, driven by resolving
+ * a deferred and running a digest.
+ */
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+import type { QDeferred, QService } from '@async/q-types';
+import { asHtmlElement, asInput } from '@compiler/__tests__/dom-guards';
+import type { CompileService } from '@compiler/directive-types';
+import type { Scope } from '@core/index';
+import { bootstrapInjector } from '@bootstrap/index';
+import { resetRegistry } from '@di/module';
+import { NgModelControllerImpl } from '@forms/ng-model-controller';
+
+interface Harness {
+  $compile: CompileService;
+  $rootScope: Scope;
+  $q: QService;
+}
+
+function boot(): Harness {
+  const injector = bootstrapInjector([]);
+  return {
+    $compile: injector.get('$compile'),
+    $rootScope: injector.get('$rootScope'),
+    $q: injector.get('$q'),
+  };
+}
+
+afterEach(() => {
+  resetRegistry();
+});
+
+function compile(html: string, $compile: CompileService, scope: Scope): HTMLElement {
+  const el = document.createElement('div');
+  el.innerHTML = html;
+  const child = asHtmlElement(el.firstElementChild);
+  $compile(child)(scope);
+  scope.$digest();
+  return child;
+}
+
+function fireInput(el: HTMLInputElement, value: string): void {
+  el.value = value;
+  el.dispatchEvent(new Event('input'));
+}
+
+/** Pull the published `NgModelController` off an element's controller stash. */
+function ctrlOf(el: HTMLElement): NgModelControllerImpl {
+  const stash = (el as unknown as { $$ngControllers?: Map<string, unknown> }).$$ngControllers;
+  const ctrl = stash?.get('ngModel');
+  if (!(ctrl instanceof NgModelControllerImpl)) {
+    throw new Error('no NgModelController on element');
+  }
+  return ctrl;
+}
+
+function model(scope: Scope, key: string): unknown {
+  return (scope as unknown as Record<string, unknown>)[key];
+}
+
+// ────────────────────────────────────────────────────────────────────────────
+// required / ng-required
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('required (FS §2.6)', () => {
+  it('flips control + form validity and toggles ng-invalid-required', () => {
+    const { $compile, $rootScope } = boot();
+    const form = compile('<form name="f"><input name="i" ng-model="v" required></form>', $compile, $rootScope);
+    const el = asInput(form.querySelector('input'));
+
+    // Fresh empty control fails `required`.
+    const ctrl = ctrlOf(el);
+    expect(ctrl.$error['required']).toBe(true);
+    expect(ctrl.$invalid).toBe(true);
+    expect(el.classList.contains('ng-invalid-required')).toBe(true);
+    expect(el.classList.contains('ng-valid-required')).toBe(false);
+
+    const formCtrl = model($rootScope, 'f') as { $invalid: boolean; $valid: boolean };
+    expect(formCtrl.$invalid).toBe(true);
+
+    // Typing a value clears it.
+    fireInput(el, 'x');
+    expect(ctrl.$error['required']).toBeUndefined();
+    expect(ctrl.$valid).toBe(true);
+    expect(el.classList.contains('ng-valid-required')).toBe(true);
+    expect(el.classList.contains('ng-invalid-required')).toBe(false);
+    expect(formCtrl.$valid).toBe(true);
+  });
+
+  it('conditional ng-required toggles as its expression changes', () => {
+    const { $compile, $rootScope } = boot();
+    ($rootScope as unknown as Record<string, unknown>).need = false;
+    const el = asInput(compile('<input ng-model="v" ng-required="need">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    // need=false → not required → empty is valid.
+    expect(ctrl.$error['required']).toBeUndefined();
+    expect(ctrl.$valid).toBe(true);
+
+    // Flip need=true → now required → empty is invalid.
+    ($rootScope as unknown as Record<string, unknown>).need = true;
+    $rootScope.$digest();
+    expect(ctrl.$error['required']).toBe(true);
+    expect(ctrl.$invalid).toBe(true);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// length / pattern / email / url / min / max
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('ng-minlength / ng-maxlength (FS §2.6)', () => {
+  it('minlength fails when too short, passes when long enough', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v" ng-minlength="3">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    fireInput(el, 'ab');
+    expect(ctrl.$error['minlength']).toBe(true);
+    expect(el.classList.contains('ng-invalid-minlength')).toBe(true);
+    expect(model($rootScope, 'v')).toBeUndefined(); // invalid kept out of model
+
+    fireInput(el, 'abc');
+    expect(ctrl.$error['minlength']).toBeUndefined();
+    expect(model($rootScope, 'v')).toBe('abc');
+  });
+
+  it('maxlength fails when too long', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v" ng-maxlength="2">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    fireInput(el, 'abc');
+    expect(ctrl.$error['maxlength']).toBe(true);
+    fireInput(el, 'ab');
+    expect(ctrl.$error['maxlength']).toBeUndefined();
+    expect(model($rootScope, 'v')).toBe('ab');
+  });
+
+  it('re-validates when the ng-minlength expression changes', () => {
+    const { $compile, $rootScope } = boot();
+    ($rootScope as unknown as Record<string, unknown>).n = 2;
+    const el = asInput(compile('<input ng-model="v" ng-minlength="n">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    fireInput(el, 'ab'); // length 2 passes with min 2
+    expect(ctrl.$error['minlength']).toBeUndefined();
+
+    // Raise the min to 3 → the current value (2) now fails.
+    ($rootScope as unknown as Record<string, unknown>).n = 3;
+    $rootScope.$digest();
+    expect(ctrl.$error['minlength']).toBe(true);
+  });
+});
+
+describe('pattern / ng-pattern (FS §2.6)', () => {
+  it('ng-pattern with a regex literal fails on mismatch', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v" ng-pattern="/^\\d+$/">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    fireInput(el, 'abc');
+    expect(ctrl.$error['pattern']).toBe(true);
+    expect(el.classList.contains('ng-invalid-pattern')).toBe(true);
+
+    fireInput(el, '123');
+    expect(ctrl.$error['pattern']).toBeUndefined();
+    expect(model($rootScope, 'v')).toBe('123');
+  });
+
+  it('ng-pattern from a scope RegExp re-validates when it changes', () => {
+    const { $compile, $rootScope } = boot();
+    ($rootScope as unknown as Record<string, unknown>).re = /^a+$/;
+    const el = asInput(compile('<input ng-model="v" ng-pattern="re">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    fireInput(el, 'aaa');
+    expect(ctrl.$error['pattern']).toBeUndefined();
+    fireInput(el, 'bbb');
+    expect(ctrl.$error['pattern']).toBe(true);
+  });
+});
+
+describe('email / url type validators (FS §2.6)', () => {
+  it('email fails on a malformed address, passes on a valid one', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="email" ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    fireInput(el, 'not-an-email');
+    expect(ctrl.$error['email']).toBe(true);
+    expect(el.classList.contains('ng-invalid-email')).toBe(true);
+    expect(model($rootScope, 'v')).toBeUndefined();
+
+    fireInput(el, 'ada@example.com');
+    expect(ctrl.$error['email']).toBeUndefined();
+    expect(model($rootScope, 'v')).toBe('ada@example.com');
+  });
+
+  it('url fails on a malformed URL', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="url" ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    fireInput(el, 'nope');
+    expect(ctrl.$error['url']).toBe(true);
+    fireInput(el, 'https://example.com');
+    expect(ctrl.$error['url']).toBeUndefined();
+  });
+});
+
+describe('number min / max validators (FS §2.6)', () => {
+  it('min fails below the bound, max fails above', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="number" ng-model="v" min="5" max="10">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    fireInput(el, '3');
+    expect(ctrl.$error['min']).toBe(true);
+    expect(el.classList.contains('ng-invalid-min')).toBe(true);
+
+    fireInput(el, '12');
+    expect(ctrl.$error['min']).toBeUndefined();
+    expect(ctrl.$error['max']).toBe(true);
+
+    fireInput(el, '7');
+    expect(ctrl.$error['min']).toBeUndefined();
+    expect(ctrl.$error['max']).toBeUndefined();
+    expect(model($rootScope, 'v')).toBe(7);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// custom sync validators
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('custom $validators (FS §2.7)', () => {
+  it('a custom sync rule flips validity under its key on every change', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    // "no digits allowed"
+    ctrl.$validators['noDigits'] = (_m, viewValue) => !/\d/.test(typeof viewValue === 'string' ? viewValue : '');
+
+    fireInput(el, 'abc1');
+    expect(ctrl.$error['noDigits']).toBe(true);
+    expect(el.classList.contains('ng-invalid-no-digits')).toBe(true); // dasherized key
+    expect(model($rootScope, 'v')).toBeUndefined();
+
+    fireInput(el, 'abc');
+    expect(ctrl.$error['noDigits']).toBeUndefined();
+    expect(model($rootScope, 'v')).toBe('abc');
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// custom async validators + $pending + ng-pending
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('custom $asyncValidators + $pending (FS §2.7)', () => {
+  it('reports pending + ng-pending until settle; model written only on resolve', () => {
+    const { $compile, $rootScope, $q } = boot();
+    const el = asInput(compile('<input ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    let deferred: QDeferred<unknown> | undefined;
+    ctrl.$asyncValidators['server'] = () => {
+      deferred = $q.defer();
+      return deferred.promise;
+    };
+
+    fireInput(el, 'abc');
+
+    // Outstanding async → pending, ng-pending on, model NOT yet written.
+    expect(ctrl.$pending?.['server']).toBe(true);
+    expect(el.classList.contains('ng-pending')).toBe(true);
+    expect(ctrl.$valid).toBe(false); // pending is neither valid nor invalid
+    expect(ctrl.$invalid).toBe(false);
+    expect(model($rootScope, 'v')).toBeUndefined();
+
+    // Resolve → valid, pending cleared, model written.
+    deferred?.resolve('ok');
+    $rootScope.$digest();
+
+    expect(ctrl.$pending).toBeUndefined();
+    expect(el.classList.contains('ng-pending')).toBe(false);
+    expect(ctrl.$valid).toBe(true);
+    expect(model($rootScope, 'v')).toBe('abc');
+  });
+
+  it('a rejecting async rule marks the control invalid under its key', () => {
+    const { $compile, $rootScope, $q } = boot();
+    const el = asInput(compile('<input ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    let deferred: QDeferred<unknown> | undefined;
+    ctrl.$asyncValidators['server'] = () => {
+      deferred = $q.defer();
+      return deferred.promise;
+    };
+
+    fireInput(el, 'abc');
+    deferred?.reject('taken');
+    $rootScope.$digest();
+
+    expect(ctrl.$pending).toBeUndefined();
+    expect(ctrl.$error['server']).toBe(true);
+    expect(ctrl.$invalid).toBe(true);
+    expect(model($rootScope, 'v')).toBeUndefined();
+  });
+
+  it('async runs ONLY after all sync validators pass', () => {
+    const { $compile, $rootScope, $q } = boot();
+    const el = asInput(compile('<input ng-model="v" ng-minlength="3">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    let asyncCalls = 0;
+    ctrl.$asyncValidators['server'] = () => {
+      asyncCalls += 1;
+      return $q.resolve('ok');
+    };
+
+    // Too short → sync minlength fails → async must NOT run.
+    fireInput(el, 'ab');
+    expect(asyncCalls).toBe(0);
+    expect(ctrl.$pending).toBeUndefined();
+
+    // Long enough → sync passes → async runs.
+    fireInput(el, 'abcd');
+    expect(asyncCalls).toBe(1);
+  });
+
+  it('a stale async pass is cancelled by newer input (no stale validity write)', () => {
+    const { $compile, $rootScope, $q } = boot();
+    const el = asInput(compile('<input ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    const deferreds: QDeferred<unknown>[] = [];
+    ctrl.$asyncValidators['server'] = () => {
+      const d = $q.defer();
+      deferreds.push(d);
+      return d.promise;
+    };
+
+    fireInput(el, 'first'); // starts pass #1
+    fireInput(el, 'second'); // starts pass #2 (bumps run id, cancels #1)
+
+    // Resolve the STALE first pass — its validity write must be dropped.
+    deferreds[0]?.resolve('ok');
+    $rootScope.$digest();
+
+    // Still pending on pass #2 (its deferred is unresolved), NOT valid.
+    expect(ctrl.$pending?.['server']).toBe(true);
+    expect(model($rootScope, 'v')).toBeUndefined();
+
+    // Now settle pass #2.
+    deferreds[1]?.resolve('ok');
+    $rootScope.$digest();
+    expect(ctrl.$pending).toBeUndefined();
+    expect(ctrl.$valid).toBe(true);
+    expect(model($rootScope, 'v')).toBe('second');
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// programmatic $validate
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('$validate (FS §2.7)', () => {
+  it('re-runs validators against the current value on demand', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    fireInput(el, 'abc');
+    expect(ctrl.$valid).toBe(true);
+
+    // Add a rule AFTER the value was committed, then re-validate.
+    ctrl.$validators['always'] = () => false;
+    ctrl.$validate();
+
+    expect(ctrl.$error['always']).toBe(true);
+    expect(ctrl.$invalid).toBe(true);
+    // A now-invalid value is withheld from the model on re-validation.
+    expect(model($rootScope, 'v')).toBeUndefined();
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// PR-audit regressions — min/max check the PARSED model value
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('min/max validate the parsed model value (parity)', () => {
+  it('a NaN-parsing view value ("." → NaN) is treated as empty — min/max pass', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="number" ng-model="n" min="5" max="10">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    // NUMBER_RE accepts "." (parses to NaN); NaN is EMPTY for min/max —
+    // emptiness is `required`'s concern (upstream checks modelValue).
+    ctrl.$setViewValue('.');
+    expect(ctrl.$error['min']).toBeUndefined();
+    expect(ctrl.$error['max']).toBeUndefined();
+  });
+
+  it('still fails/passes min against real numbers', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input type="number" ng-model="n" min="5">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    fireInput(el, '3');
+    expect(ctrl.$error['min']).toBe(true);
+
+    fireInput(el, '7');
+    expect(ctrl.$error['min']).toBeUndefined();
+    expect(model($rootScope, 'n')).toBe(7);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// PR-audit regressions — native minlength / maxlength attributes
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('native minlength/maxlength attributes (parity)', () => {
+  it('<input minlength="3"> (no ng- prefix) validates', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v" minlength="3">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    fireInput(el, 'ab');
+    expect(ctrl.$error['minlength']).toBe(true);
+
+    fireInput(el, 'abc');
+    expect(ctrl.$error['minlength']).toBeUndefined();
+  });
+
+  it('<input maxlength="2"> (no ng- prefix) validates', () => {
+    const { $compile, $rootScope } = boot();
+    const el = asInput(compile('<input ng-model="v" maxlength="2">', $compile, $rootScope));
+    const ctrl = ctrlOf(el);
+
+    ctrl.$setViewValue('abc');
+    expect(ctrl.$error['maxlength']).toBe(true);
+
+    ctrl.$setViewValue('ab');
+    expect(ctrl.$error['maxlength']).toBeUndefined();
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// PR-audit regressions — async pending aggregates onto the FORM
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('form-level $pending + ng-pending (parity)', () => {
+  interface FormLike {
+    $pending: Record<string, unknown[]> | undefined;
+    $valid: boolean;
+    $invalid: boolean;
+    $removeControl: (c: unknown) => void;
+  }
+
+  it('a control with an outstanding async rule marks the enclosing form pending', () => {
+    const { $compile, $rootScope, $q } = boot();
+    const form = compile('<form name="f"><input name="i" ng-model="v"></form>', $compile, $rootScope);
+    const el = asInput(form.querySelector('input'));
+    const ctrl = ctrlOf(el);
+    const formCtrl = model($rootScope, 'f') as FormLike;
+
+    let deferred: QDeferred<unknown> | undefined;
+    ctrl.$asyncValidators['server'] = () => {
+      deferred = $q.defer();
+      return deferred.promise;
+    };
+
+    fireInput(el, 'abc');
+
+    // Outstanding async → the FORM aggregates the pending key too.
+    expect(formCtrl.$pending?.['server']).toContain(ctrl);
+    expect(form.classList.contains('ng-pending')).toBe(true);
+    expect(formCtrl.$valid).toBe(false); // pending is neither valid nor invalid
+    expect(formCtrl.$invalid).toBe(false);
+
+    // Resolve → the form's pending map empties back to undefined.
+    deferred?.resolve('ok');
+    $rootScope.$digest();
+    expect(formCtrl.$pending).toBeUndefined();
+    expect(form.classList.contains('ng-pending')).toBe(false);
+    expect(formCtrl.$valid).toBe(true);
+  });
+
+  it('a rejected async rule moves the form from pending to invalid', () => {
+    const { $compile, $rootScope, $q } = boot();
+    const form = compile('<form name="f"><input name="i" ng-model="v"></form>', $compile, $rootScope);
+    const el = asInput(form.querySelector('input'));
+    const ctrl = ctrlOf(el);
+    const formCtrl = model($rootScope, 'f') as FormLike & { $error: Record<string, unknown[]> };
+
+    let deferred: QDeferred<unknown> | undefined;
+    ctrl.$asyncValidators['server'] = () => {
+      deferred = $q.defer();
+      return deferred.promise;
+    };
+
+    fireInput(el, 'abc');
+    expect(formCtrl.$pending?.['server']).toContain(ctrl);
+
+    deferred?.reject('taken');
+    $rootScope.$digest();
+    expect(formCtrl.$pending).toBeUndefined();
+    expect(formCtrl.$error['server']).toContain(ctrl);
+    expect(formCtrl.$invalid).toBe(true);
+    expect(form.classList.contains('ng-pending')).toBe(false);
+  });
+
+  it('removing a control while its async rule is in flight clears the form pending entry', () => {
+    const { $compile, $rootScope, $q } = boot();
+    const form = compile(
+      '<form name="f"><div ng-if="show"><input name="i" ng-model="v"></div></form>',
+      $compile,
+      $rootScope,
+    );
+    ($rootScope as unknown as Record<string, unknown>)['show'] = true;
+    $rootScope.$digest();
+    const el = asInput(form.querySelector('input'));
+    const ctrl = ctrlOf(el);
+    const formCtrl = model($rootScope, 'f') as FormLike;
+
+    ctrl.$asyncValidators['server'] = () => $q.defer().promise;
+    fireInput(el, 'abc');
+    expect(formCtrl.$pending?.['server']).toContain(ctrl);
+
+    // Remove the control (ng-if teardown) — the pending entry must go too.
+    ($rootScope as unknown as Record<string, unknown>)['show'] = false;
+    $rootScope.$digest();
+    expect(formCtrl.$pending).toBeUndefined();
+    expect(form.classList.contains('ng-pending')).toBe(false);
+    expect(formCtrl.$valid).toBe(true);
+  });
+});
diff --git a/src/forms/form-controller.ts b/src/forms/form-controller.ts
new file mode 100644
index 0000000..9100ed7
--- /dev/null
+++ b/src/forms/form-controller.ts
@@ -0,0 +1,335 @@
+/**
+ * `FormController` — the per-form aggregation engine (spec 039 Slice 2 /
+ * FS §2.3, technical-considerations §2.6).
+ *
+ * Every `<form>` / `<ng-form>` publishes one of these. It aggregates the
+ * validity + dirty + pending state of every control (and every nested
+ * sub-form) registered under it, and mirrors the aggregate onto the form
+ * element via the shared state classes (`ng-valid` / `ng-invalid`,
+ * `ng-dirty` / `ng-pristine`, `ng-submitted`, per-key
+ * `ng-valid-<key>` / `ng-invalid-<key>`).
+ *
+ * **The validity aggregation model (AngularJS parity).** A form does NOT
+ * store a boolean per control — it counts, per validation KEY, how many
+ * controls currently fail that key. `$setValidity(key, false, control)`
+ * pushes `control` into the key's failure set; `$setValidity(key, true,
+ * control)` removes it. The form is invalid under `key` iff its failure
+ * set is non-empty, and invalid overall iff ANY key has a non-empty
+ * failure set. This makes control removal correct for free — dropping a
+ * control removes it from every key's set (`$removeControl`), so a form
+ * that was invalid only because of a since-removed control flips back to
+ * valid without the control having to "un-fail" first.
+ *
+ * **Nested forms bubble up.** A `FormController` is itself a "control"
+ * from its PARENT form's perspective: `form.$addControl(childForm)` and
+ * `childForm.$setValidity(key, isValid, childForm)` propagate the child
+ * form's aggregate validity to the parent. `$setDirty` / `$setSubmitted`
+ * also walk up the `$$parentForm` chain.
+ *
+ * **`nullFormCtrl`** is a shared no-op form controller so a form-less
+ * `ngModel` (an `<input ng-model>` with no enclosing form) has a valid
+ * `$addControl` / `$setValidity` target without a null-check on every
+ * call site — the AngularJS `nullFormCtrl` precedent.
+ */
+
+import {
+  clearValidationClass,
+  setPendingClass,
+  setPristineClass,
+  setSubmittedClass,
+  setValidationClass,
+  setValidClass,
+} from './state-classes';
+
+/**
+ * The minimal shape a `FormController` needs from each control it tracks
+ * — either an `NgModelController` or a nested `FormController`. Only the
+ * `$name` is read here (to publish named controls onto the form
+ * instance); validity flows through `$setValidity`, not by reading the
+ * control.
+ */
+export interface FormControlLike {
+  /** The control's `name` (from `name` / `ng-form` attribute), if any. */
+  $name: string | undefined;
+}
+
+/**
+ * The public contract of the `form` / `ngForm` controller (AngularJS
+ * parity). The method / field names ARE the API; consumers type against
+ * this interface and read aggregate state in expressions
+ * (`myForm.$invalid`, `myForm.email.$invalid`).
+ */
+export interface FormController {
+  /** The form's name (from `name` / `ng-form` attribute), if any. */
+  $name: string | undefined;
+  /** Failing-rule map — `$error[key]` is the array of controls failing `key`. */
+  $error: Record<string, FormControlLike[]>;
+  /** Outstanding-async-rule map — `$pending[key]` is the array of pending controls. */
+  $pending: Record<string, FormControlLike[]> | undefined;
+  /** At least one control (or sub-form) is dirty. */
+  $dirty: boolean;
+  /** No control has been changed by the user. */
+  $pristine: boolean;
+  /** A submit has been attempted on this form. */
+  $submitted: boolean;
+  /** No failing rules across any control. */
+  $valid: boolean;
+  /** At least one failing rule across some control. */
+  $invalid: boolean;
+  /** Register a child control / sub-form with this form. */
+  $addControl: (control: FormControlLike) => void;
+  /** Deregister a child control / sub-form, dropping its state contribution. */
+  $removeControl: (control: FormControlLike) => void;
+  /**
+   * Bubble a control's per-key validity into this form's aggregate.
+   * Tri-state (AngularJS parity): `true` clears the control from the
+   * key's failure + pending sets, `false` records it as failing, and
+   * `undefined` records it as PENDING (an async rule in flight) —
+   * aggregated into `$pending` with `ng-pending` on the form element.
+   */
+  $setValidity: (key: string, isValid: boolean | undefined, control: FormControlLike) => void;
+  /** Mark the form dirty (propagates to the parent form). */
+  $setDirty: () => void;
+  /** Reset the form (and its controls) to pristine. */
+  $setPristine: () => void;
+  /** Mark the form submitted (propagates to the parent form). */
+  $setSubmitted: () => void;
+  /** Support renaming a control (removes the old name slot, adds the new). */
+  $$renameControl: (control: FormControlLike, newName: string) => void;
+}
+
+/**
+ * A shared no-op `FormController` — the target `ngModel` (and a
+ * top-level `form`) uses when there is no enclosing form. Every method
+ * is a no-op so a form-less control (and the root form's parent
+ * propagation) needs no null-check. AngularJS's `nullFormCtrl`.
+ *
+ * Declared BEFORE {@link FormControllerImpl} because the class defaults
+ * its `$$parentForm` field to this value.
+ */
+export const nullFormCtrl: FormController = {
+  $name: undefined,
+  $error: {},
+  $pending: undefined,
+  $dirty: false,
+  $pristine: true,
+  $submitted: false,
+  $valid: true,
+  $invalid: false,
+  $addControl: () => {
+    /* no-op */
+  },
+  $removeControl: () => {
+    /* no-op */
+  },
+  $setValidity: () => {
+    /* no-op */
+  },
+  $setDirty: () => {
+    /* no-op */
+  },
+  $setPristine: () => {
+    /* no-op */
+  },
+  $setSubmitted: () => {
+    /* no-op */
+  },
+  $$renameControl: () => {
+    /* no-op */
+  },
+};
+
+/**
+ * Concrete `FormController`. Constructed by the `form` / `ngForm`
+ * directive's controller seam with the form `element` + resolved
+ * `name`; the directive's link then re-points `$$parentForm` to the
+ * enclosing form (resolved via `require: '?^^form'`) and registers this
+ * controller with it. The `element` is the form element whose state
+ * classes it toggles.
+ */
+export class FormControllerImpl implements FormController {
+  $name: string | undefined;
+  $error: Record<string, FormControlLike[]> = {};
+  $pending: Record<string, FormControlLike[]> | undefined = undefined;
+  $dirty = false;
+  $pristine = true;
+  $submitted = false;
+  $valid = true;
+  $invalid = false;
+
+  /** Every registered control / sub-form (used by `$setPristine` fan-out). */
+  private readonly controls: FormControlLike[] = [];
+
+  /**
+   * @internal The enclosing form — {@link nullFormCtrl} until the form
+   * directive's link resolves the real parent (via `require: '?^^form'`)
+   * and re-points it. Defaulting to `nullFormCtrl` keeps every
+   * propagation call (`$setDirty` / `$setSubmitted` / `$setValidity`)
+   * safe even before link runs.
+   */
+  $$parentForm: FormController = nullFormCtrl;
+
+  private readonly element: Element | null;
+
+  constructor(element: Element | null, name: string | undefined) {
+    this.element = element;
+    this.$name = name;
+
+    // Initialize the aggregate classes to the fresh-form defaults.
+    if (this.element !== null) {
+      setValidClass(this.element, true);
+      setPristineClass(this.element, true);
+      setSubmittedClass(this.element, false);
+    }
+  }
+
+  $addControl(control: FormControlLike): void {
+    if (!this.controls.includes(control)) {
+      this.controls.push(control);
+    }
+  }
+
+  $removeControl(control: FormControlLike): void {
+    const index = this.controls.indexOf(control);
+    if (index !== -1) {
+      this.controls.splice(index, 1);
+    }
+    // Drop the control's contribution to every failing / pending key.
+    for (const key of Object.keys(this.$error)) {
+      this.$setValidity(key, true, control);
+    }
+    if (this.$pending !== undefined) {
+      for (const key of Object.keys(this.$pending)) {
+        this.$setValidity(key, true, control);
+      }
+    }
+  }
+
+  /** Remove `control` from a key's set in `map`, deleting emptied keys. */
+  private static unsetFromSet(map: Record<string, FormControlLike[]>, key: string, control: FormControlLike): void {
+    const set = map[key];
+    if (set === undefined) {
+      return;
+    }
+    const index = set.indexOf(control);
+    if (index !== -1) {
+      set.splice(index, 1);
+    }
+    if (set.length === 0) {
+      // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- string-keyed map of rule → control arrays; an empty set means the key no longer applies, so its entry is removed entirely (AngularJS parity — `Object.keys(...)` reflects only live entries).
+      delete map[key];
+    }
+  }
+
+  $setValidity(key: string, isValid: boolean | undefined, control: FormControlLike): void {
+    if (isValid === undefined) {
+      // Pending — record in $pending; the key is neither failing nor
+      // succeeding while the async rule settles.
+      FormControllerImpl.unsetFromSet(this.$error, key, control);
+      this.$pending ??= {};
+      const pendingSet = this.$pending[key] ?? [];
+      if (!pendingSet.includes(control)) {
+        pendingSet.push(control);
+      }
+      this.$pending[key] = pendingSet;
+    } else {
+      // Settled — the control leaves the key's pending set either way.
+      if (this.$pending !== undefined) {
+        FormControllerImpl.unsetFromSet(this.$pending, key, control);
+        if (Object.keys(this.$pending).length === 0) {
+          // `$pending` is `undefined`, not `{}`, when nothing is in flight.
+          this.$pending = undefined;
+        }
+      }
+      if (isValid) {
+        FormControllerImpl.unsetFromSet(this.$error, key, control);
+      } else {
+        const failureSet = this.$error[key] ?? [];
+        if (!failureSet.includes(control)) {
+          failureSet.push(control);
+        }
+        this.$error[key] = failureSet;
+      }
+    }
+
+    const keyStillFails = (this.$error[key]?.length ?? 0) > 0;
+    const keyPending = (this.$pending?.[key]?.length ?? 0) > 0;
+    if (this.element !== null) {
+      if (keyPending) {
+        // Neutral while pending — neither ng-valid-<key> nor ng-invalid-<key>.
+        clearValidationClass(this.element, key);
+      } else {
+        setValidationClass(this.element, key, !keyStillFails);
+      }
+    }
+
+    // Aggregate: invalid iff any failing key; valid iff no failing AND no
+    // pending key (mirrors the control-level aggregate).
+    const anyInvalid = Object.keys(this.$error).length > 0;
+    const anyPending = this.$pending !== undefined;
+    this.$valid = !anyInvalid && !anyPending;
+    this.$invalid = anyInvalid;
+    if (this.element !== null) {
+      setValidClass(this.element, !anyInvalid);
+      setPendingClass(this.element, anyPending);
+    }
+
+    // Bubble this form's combined per-key state up to the parent form so a
+    // nested `ng-form`'s validity / pending state reaches the enclosing
+    // `<form>` (`undefined` while pending, else the failure state).
+    this.$$parentForm.$setValidity(key, keyPending ? undefined : !keyStillFails, this);
+  }
+
+  $setDirty(): void {
+    this.$dirty = true;
+    this.$pristine = false;
+    if (this.element !== null) {
+      setPristineClass(this.element, false);
+    }
+    // Propagate up — a dirty control in a nested form makes the parent
+    // form dirty too.
+    this.$$parentForm.$setDirty();
+  }
+
+  $setPristine(): void {
+    this.$dirty = false;
+    this.$pristine = true;
+    this.$submitted = false;
+    if (this.element !== null) {
+      setPristineClass(this.element, true);
+      setSubmittedClass(this.element, false);
+    }
+    // Reset every registered control / sub-form back to pristine too
+    // (AngularJS parity — `$setPristine` fans out to children).
+    for (const control of this.controls) {
+      const child = control as Partial<{ $setPristine: () => void }>;
+      if (typeof child.$setPristine === 'function') {
+        child.$setPristine();
+      }
+    }
+  }
+
+  $setSubmitted(): void {
+    this.$submitted = true;
+    if (this.element !== null) {
+      setSubmittedClass(this.element, true);
+    }
+    // Propagate up so submitting a nested form marks the parent too.
+    this.$$parentForm.$setSubmitted();
+  }
+
+  $$renameControl(control: FormControlLike, newName: string): void {
+    // Move the control's named slot on the form instance: drop the old
+    // name (only when the slot still holds THIS control — a newer control
+    // published under the same name must not be clobbered) and publish
+    // under the new name (AngularJS parity — `myForm.<newName>` resolves).
+    const record = this as unknown as Record<string, unknown>;
+    const oldName = control.$name;
+    if (oldName !== undefined && record[oldName] === control) {
+      // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- the form instance carries named-control slots keyed by each control's `$name`; a rename removes the stale slot entirely so `myForm.<oldName>` becomes undefined again (AngularJS parity).
+      delete record[oldName];
+    }
+    control.$name = newName;
+    record[newName] = control;
+  }
+}
diff --git a/src/forms/form.ts b/src/forms/form.ts
new file mode 100644
index 0000000..eadcf98
--- /dev/null
+++ b/src/forms/form.ts
@@ -0,0 +1,251 @@
+/**
+ * `form` + `ngForm` directives (spec 039 Slice 2 / FS §2.3,
+ * technical-considerations §2.6).
+ *
+ * ONE shared factory registers under BOTH the `form` (element) and
+ * `ngForm` (element + attribute) names — a `<form>` and an `<ng-form>` /
+ * `<div ng-form>` behave identically. Each match publishes a
+ * {@link FormControllerImpl} that aggregates the validity + dirty +
+ * submitted state of every `ngModel` control and nested sub-form beneath
+ * it.
+ *
+ * **Controller publish under the `'form'` key.** The compiler's
+ * per-element controller seam stashes a directive's controller under its
+ * OWN directive name (`form` for `<form>`, `ngForm` for `<ng-form>`).
+ * `ngModel` and nested forms resolve the enclosing form via the single
+ * `require: '?^^form'` key, so this directive additionally stashes its
+ * controller under `'form'` (via {@link stashController}) in its PRE-link
+ * — before any descendant control links and runs its own `require`
+ * resolution. Publishing in pre-link (not post-link) is load-bearing:
+ * the parent's pre-link runs before its children are linked, so a child
+ * `ngModel`'s `require: '?^^form'` ancestor walk finds the form.
+ *
+ * **Parent-form wiring.** The directive declares
+ * `require: ['<ownName>', '?^^form']`, so its link receives
+ * `[ownController, parentFormOrNull]`. It re-points the controller's
+ * `$$parentForm` to the resolved parent (or {@link nullFormCtrl}) and
+ * registers itself with the parent via `$addControl` — so a nested
+ * `ng-form`'s validity / dirty / submitted state bubbles up. On
+ * `$destroy` it deregisters (`parent.$removeControl(this)`), dropping the
+ * sub-form's contribution when it is removed from the page (e.g. by
+ * `ng-if`).
+ *
+ * **Named form + named controls.** A named form (`<form name="myForm">`
+ * / `<ng-form ng-form="myForm">`) publishes its controller onto the
+ * surrounding scope via {@link buildParentWriter} — the same assignable
+ * writer `ngModel` / `ngRef` use — so `myForm.$invalid` reads in
+ * expressions. Named CONTROLS publish onto the FORM INSTANCE (not the
+ * scope) so `myForm.email.$invalid` resolves through the published form:
+ * a control registering with the form makes the form assign the control
+ * under its `$name`. This directive owns the form-side publish;
+ * `ngModel`'s form registration (in `ng-model.ts`) triggers it.
+ *
+ * **Submit handling.** A native `submit` listener calls `$setSubmitted()`
+ * inside a `$$phase`-guarded `$apply` / `$evalAsync` (the event-directive
+ * pattern). The `ngSubmit` EXPRESSION is NOT evaluated here — the
+ * standalone `ngSubmit` event directive (spec 026) already binds a
+ * `submit` listener and runs it; this directive owns only the
+ * `$setSubmitted` state transition and the native-submit suppression, so
+ * a `<form ng-submit="…">` runs its handler exactly once. When the form
+ * has no `action` attribute the listener `preventDefault()`s the native
+ * submit (AngularJS parity — a form without an action should not
+ * navigate). A form WITH an `action` still navigates unless a handler
+ * prevents it.
+ *
+ * Registered on `ngModule` only (DI-only, the built-in-directive
+ * precedent) — reachable via `injector.get('formDirective')` /
+ * `injector.get('ngFormDirective')`, NOT exported from the root barrel.
+ */
+
+import { buildParentWriter } from '@compiler/expression-assign';
+import { stashController } from '@compiler/element-slots';
+import type { Attributes, DirectiveFactory, DirectiveFactoryReturn, LinkFn } from '@compiler/directive-types';
+import type { ControllerInvokable } from '@controller/controller-types';
+import { invokeExceptionHandler, type ExceptionHandler } from '@exception-handler/index';
+import { parse } from '@parser/index';
+
+import { FormControllerImpl, nullFormCtrl, type FormController } from './form-controller';
+
+export const FORM_NAME = 'form';
+export const NG_FORM_NAME = 'ngForm';
+/** The single `$$ngControllers` key both directives publish under. */
+export const FORM_CONTROLLER_KEY = 'form';
+
+/**
+ * Read the form's `name` — the `name` attribute for `<form>` /
+ * `<ng-form>`, or the `ng-form` attribute value for `<div ng-form="…">`
+ * (AngularJS parity — `ng-form` doubles as the name for the attribute
+ * form). Empty / whitespace strings count as unnamed.
+ */
+function resolveFormName(attrs: Attributes): string | undefined {
+  const nameAttr = attrs['name'];
+  if (typeof nameAttr === 'string' && nameAttr !== '') {
+    return nameAttr;
+  }
+  const ngFormAttr = attrs[NG_FORM_NAME];
+  if (typeof ngFormAttr === 'string' && ngFormAttr !== '') {
+    return ngFormAttr;
+  }
+  return undefined;
+}
+
+/**
+ * Narrow the resolved parent-form require slot to a `FormController`.
+ * `require: '?^^form'` yields `null` on a miss (top-level form); anything
+ * that is not a live controller falls back to {@link nullFormCtrl}.
+ */
+function asParentForm(candidate: unknown): FormController {
+  if (candidate instanceof FormControllerImpl) {
+    return candidate;
+  }
+  return nullFormCtrl;
+}
+
+/**
+ * Read the two resolved `require` controllers from the link fn's 4th
+ * argument. The declared `require` is `['<ownName>', '?^^form']`, so the
+ * resolved value is a 2-tuple `[ownController, parentOrNull]`.
+ */
+function readRequired(controllers: unknown): { own: FormControllerImpl | null; parent: FormController } {
+  if (!Array.isArray(controllers)) {
+    return { own: null, parent: nullFormCtrl };
+  }
+  const own = controllers[0] instanceof FormControllerImpl ? controllers[0] : null;
+  const parent = asParentForm(controllers[1]);
+  return { own, parent };
+}
+
+/**
+ * Build the shared `form` / `ngForm` factory. `ownName` is the directive
+ * name under which the controller seam stashes the controller (`form` or
+ * `ngForm`) — it drives the `require` self-lookup.
+ */
+function buildFormFactory(ownName: string): DirectiveFactory {
+  function formFactory($exceptionHandler: ExceptionHandler): DirectiveFactoryReturn {
+    // Array-annotated so `injector.invoke` resolves the element-locals by
+    // name. Returns a fresh FormController per matched element.
+    const controller: ControllerInvokable = [
+      '$element',
+      '$attrs',
+      (...args: unknown[]): FormControllerImpl =>
+        new FormControllerImpl(args[0] as Element, resolveFormName(args[1] as Attributes)),
+    ];
+
+    const preLink: LinkFn = (_scope, element, _attrs, controllers) => {
+      const { own } = readRequired(controllers);
+      if (own === null) {
+        return;
+      }
+      // Publish under the shared `'form'` key so descendant controls and
+      // nested forms resolve `require: '?^^form'` regardless of whether
+      // this element is a `<form>` or an `<ng-form>`. Runs in PRE-link so
+      // it lands before any child links.
+      stashController(element, FORM_CONTROLLER_KEY, own);
+    };
+
+    const postLink: LinkFn = (scope, element, _attrs, controllers) => {
+      const { own, parent } = readRequired(controllers);
+      if (own === null) {
+        return;
+      }
+
+      // Re-point the controller's parent to the resolved enclosing form
+      // and register with it so this (sub-)form's state bubbles up.
+      own.$$parentForm = parent;
+      parent.$addControl(own);
+
+      // Publish a NAMED form onto the surrounding scope so `myForm.$…`
+      // reads in expressions. The name expression is treated as an
+      // assignable l-value (`myForm`, `forms.signup`); a non-assignable
+      // name is silently skipped (an unnamed form is a valid, common
+      // case — no error).
+      if (own.$name !== undefined) {
+        const writer = buildParentWriter(parse(own.$name));
+        if (writer !== undefined) {
+          writer(scope, own);
+        }
+      }
+
+      // Native submit handling. Only the `$setSubmitted` state transition
+      // + native-submit suppression live here; the `ngSubmit` expression
+      // is run by the standalone `ngSubmit` event directive (spec 026).
+      const hasAction = element.hasAttribute('action');
+
+      const onSubmit = (event: Event) => {
+        // A form with no `action` should not navigate — prevent the
+        // native submit (AngularJS parity). A form WITH an action is left
+        // to the handler / browser.
+        if (!hasAction) {
+          event.preventDefault();
+        }
+        const run = () => {
+          own.$setSubmitted();
+        };
+        try {
+          if (scope.$$phase !== null) {
+            scope.$evalAsync(run);
+          } else {
+            scope.$apply(run);
+          }
+        } catch (err) {
+          invokeExceptionHandler($exceptionHandler, err, '$compile');
+        }
+      };
+
+      element.addEventListener('submit', onSubmit);
+
+      // Teardown: deregister from the parent (drop this sub-form's
+      // contribution) + remove the submit listener when the scope is
+      // destroyed (e.g. an `ng-if` removes the form).
+      scope.$on('$destroy', () => {
+        element.removeEventListener('submit', onSubmit);
+        parent.$removeControl(own);
+      });
+    };
+
+    return {
+      restrict: ownName === FORM_NAME ? 'E' : 'EA',
+      require: [ownName, '?^^form'],
+      controller,
+      link: { pre: preLink, post: postLink },
+    };
+  }
+
+  return ['$exceptionHandler', formFactory];
+}
+
+/**
+ * DI-annotated `form` directive (`restrict: 'E'`). Auto-creates a form
+ * group on every `<form>` — no attribute required.
+ */
+export const formDirective: DirectiveFactory = buildFormFactory(FORM_NAME);
+
+/**
+ * DI-annotated `ngForm` directive (`restrict: 'EA'`). Provides a nested
+ * form group inside another form via `<ng-form>` or `<div ng-form>`.
+ */
+export const ngFormDirective: DirectiveFactory = buildFormFactory(NG_FORM_NAME);
+
+/**
+ * The scope publish a control performs onto the FORM INSTANCE. When a
+ * named `ngModel` registers with a `FormController`, the control is
+ * assigned onto the form under its `$name` so `myForm.email.$invalid`
+ * resolves through the published form object. Exposed as a small helper
+ * so `ng-model.ts` can call it without reaching into the controller's
+ * internals.
+ */
+export function publishNamedControlOnForm(form: FormController, name: string, control: object): void {
+  (form as unknown as Record<string, unknown>)[name] = control;
+}
+
+/**
+ * Remove a named control's slot from the form instance (control
+ * teardown). Mirror of {@link publishNamedControlOnForm}.
+ */
+export function unpublishNamedControlOnForm(form: FormController, name: string): void {
+  const record = form as unknown as Record<string, unknown>;
+  if (name in record) {
+    // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- the form instance carries named-control slots keyed by each control's `$name`; on control teardown its slot is removed entirely so `myForm.email` becomes undefined again (AngularJS parity — the control is no longer reachable through the form).
+    delete record[name];
+  }
+}
diff --git a/src/forms/forms-register.ts b/src/forms/forms-register.ts
new file mode 100644
index 0000000..db21c8e
--- /dev/null
+++ b/src/forms/forms-register.ts
@@ -0,0 +1,92 @@
+/**
+ * Forms directive registration (spec 039 Slice 1 /
+ * technical-considerations §2.8).
+ *
+ * Like every other built-in directive batch, the forms directives are
+ * core `ng` directives — registered on `ngModule` via a
+ * `.config(['$compileProvider', …])` block (DI-only). An app reaching
+ * `'ng'` in its deps chain gets `ngModel` / `input` / `textarea` /
+ * `ngChange` for free; the directive factories themselves stay file-local
+ * (not exported from `@compiler/index` or the root barrel), matching the
+ * `ngTransclude` / event-directive precedent.
+ *
+ * This module exposes a single {@link registerForms} helper that takes the
+ * `$compileProvider` and registers the four directives. `ngModule`
+ * (`src/core/ng-module.ts`) imports + invokes it from its config block.
+ */
+
+import type { $CompileProvider } from '@compiler/compile-provider';
+
+import { formDirective, ngFormDirective, FORM_NAME, NG_FORM_NAME } from './form';
+import { inputDirective, textareaDirective } from './input';
+import { ngChangeDirective, ngModelDirective, NG_CHANGE_NAME, NG_MODEL_NAME } from './ng-model';
+import { ngModelOptionsDirective, NG_MODEL_OPTIONS_NAME } from './ng-model-options';
+import { ngListDirective, NG_LIST_NAME } from './ng-list';
+import { ngOptionsDirective, NG_OPTIONS_NAME } from './ng-options';
+import { optionDirective, selectDirective, OPTION_NAME, SELECT_NAME } from './select';
+import {
+  maxlengthDirective,
+  minlengthDirective,
+  ngPatternDirective,
+  ngRequiredDirective,
+  patternDirective,
+  requiredDirective,
+  MAXLENGTH_NAME,
+  MINLENGTH_NAME,
+  NG_MAXLENGTH_NAME,
+  NG_MINLENGTH_NAME,
+  NG_PATTERN_NAME,
+  NG_REQUIRED_NAME,
+  PATTERN_NAME,
+  REQUIRED_NAME,
+} from './validators';
+
+/**
+ * Register the Slice-1 forms directives on a `$compileProvider`.
+ *
+ * - `ngModel` — two-way binding + the published {@link NgModelController}.
+ * - `input` — single directive dispatching on `type` (default → text).
+ * - `textarea` — delegates to the `text` handler.
+ * - `ngChange` — fires on committed view change.
+ */
+export function registerForms($compileProvider: $CompileProvider): void {
+  $compileProvider.directive(NG_MODEL_NAME, ngModelDirective);
+  $compileProvider.directive('input', inputDirective);
+  $compileProvider.directive('textarea', textareaDirective);
+  $compileProvider.directive(NG_CHANGE_NAME, ngChangeDirective);
+  // Slice 2 — form aggregation. Both `form` and `ngForm` publish a
+  // `FormController`; `ngModel` / nested forms resolve the enclosing form
+  // via `require: '?^^form'`.
+  $compileProvider.directive(FORM_NAME, formDirective);
+  $compileProvider.directive(NG_FORM_NAME, ngFormDirective);
+  // Slice 4 — select / ngOptions / ngList. `select` publishes a
+  // `SelectController` (under `'select'`); `option` self-registers plain
+  // markup options; `ngOptions` generates options from a collection;
+  // `ngList` adds a delimited-string ↔ array transform to `ngModel`.
+  $compileProvider.directive(SELECT_NAME, selectDirective);
+  $compileProvider.directive(OPTION_NAME, optionDirective);
+  $compileProvider.directive(NG_OPTIONS_NAME, ngOptionsDirective);
+  $compileProvider.directive(NG_LIST_NAME, ngListDirective);
+  // Slice 5 — built-in validator directives. Each `require: '?ngModel'`
+  // and pushes a rule onto the control's `$validators` map under a fixed
+  // key (`required` / `minlength` / `maxlength` / `pattern`), so a failure
+  // surfaces `ng-invalid-<key>` and bubbles to the enclosing form. The
+  // `email` / `number` / `url` and `min` / `max` type validators are wired
+  // by the corresponding `inputType` handler, NOT here (AngularJS parity).
+  $compileProvider.directive(REQUIRED_NAME, requiredDirective);
+  $compileProvider.directive(NG_REQUIRED_NAME, ngRequiredDirective);
+  // Both the native attribute name AND the `ng-` alias register the same
+  // factory (AngularJS parity — `<input minlength="3">` validates too;
+  // the factory reads whichever attribute is present).
+  $compileProvider.directive(MINLENGTH_NAME, minlengthDirective);
+  $compileProvider.directive(NG_MINLENGTH_NAME, minlengthDirective);
+  $compileProvider.directive(MAXLENGTH_NAME, maxlengthDirective);
+  $compileProvider.directive(NG_MAXLENGTH_NAME, maxlengthDirective);
+  $compileProvider.directive(PATTERN_NAME, patternDirective);
+  $compileProvider.directive(NG_PATTERN_NAME, ngPatternDirective);
+  // Slice 6 — `ngModelOptions`. Publishes a resolved `ModelOptions`
+  // (inheriting from an ancestor `ngModelOptions`) that a descendant
+  // `ngModel` reads via `require: '?^^ngModelOptions'` to drive `updateOn` /
+  // `debounce` / `allowInvalid` / `getterSetter` / `timezone`.
+  $compileProvider.directive(NG_MODEL_OPTIONS_NAME, ngModelOptionsDirective);
+}
diff --git a/src/forms/index.ts b/src/forms/index.ts
new file mode 100644
index 0000000..d8e6d20
--- /dev/null
+++ b/src/forms/index.ts
@@ -0,0 +1,26 @@
+/**
+ * Public barrel for the `@forms` module — forms & validation (spec 039).
+ *
+ * The directives themselves are DI-only core `ng` directives registered
+ * on `ngModule` via `forms-register.ts` (the `ngTransclude` / event-
+ * directive precedent), so the public surface here is the CONTRACT TYPES
+ * consumers type against — `NgModelController` and its transform-list
+ * types — plus the `registerForms` wiring helper that `ngModule` invokes.
+ *
+ * Slice 1 exposes the `NgModelController` contract; later slices add
+ * `FormController`, `NgModelOptions`, validator maps, etc.
+ */
+
+export type { NgModelController, ModelParser, ModelFormatter } from './ng-model-controller';
+export { NgModelControllerImpl } from './ng-model-controller';
+export type { SyncValidator, AsyncValidator } from './validation';
+export { NgModelNonAssignableError } from './ng-model';
+export type { FormController, FormControlLike } from './form-controller';
+export { FormControllerImpl, nullFormCtrl } from './form-controller';
+export type { SelectController } from './select';
+export { SelectControllerImpl } from './select';
+export { NgOptionsBadExpressionError } from './ng-options-parse';
+export type { NgOptionsDescriptor } from './ng-options-parse';
+export type { NgModelOptions, ModelOptions } from './ng-model-options';
+export { createModelOptions, defaultModelOptions, resolveDebounceDelay } from './ng-model-options';
+export { registerForms } from './forms-register';
diff --git a/src/forms/input-date.ts b/src/forms/input-date.ts
new file mode 100644
index 0000000..46ce0f3
--- /dev/null
+++ b/src/forms/input-date.ts
@@ -0,0 +1,257 @@
+/**
+ * Date/time family parse + format helpers (spec 039 Slice 3 / FS §2.4,
+ * technical-considerations §2.4, §2.5 `timezone`).
+ *
+ * The `date` / `datetime-local` / `time` / `month` / `week` input types
+ * bind a **`Date`** model value. Each type has its own HTML `value`
+ * string format (see the per-type regex + formatter below); this module
+ * owns the string ↔ `Date` conversion, isolated here so Slice 6's
+ * `ngModelOptions.timezone` wiring can thread a real timezone in cleanly.
+ *
+ * **Timezone seam.** Every parse/format helper takes an explicit
+ * {@link Timezone} value. Slice 3 always passes the {@link LOCAL_TIMEZONE}
+ * sentinel (`undefined`), which means "use the host's local timezone" —
+ * exactly today's behavior. Slice 6 will resolve `ngModelOptions.timezone`
+ * to an offset (e.g. `'UTC'` / `'+0500'`) and pass it here without
+ * touching any call site's structure. Keep the timezone the LAST
+ * parameter of every helper so the Slice-6 handoff is purely additive.
+ *
+ * The parse/format logic mirrors AngularJS `src/ng/directive/input.js`
+ * (`createDateParser` / the per-type `inputType` entries). We build a
+ * `Date` from local-time components (so a round-trip through the local
+ * timezone is lossless), then — when a non-local timezone is requested —
+ * shift by the requested offset relative to local.
+ */
+
+/**
+ * A resolved timezone. `undefined` (the {@link LOCAL_TIMEZONE} sentinel)
+ * means the host's local timezone; a number is the minutes-east-of-UTC
+ * offset (e.g. `'UTC'` → `0`, `'+0500'` → `300`). Slice 6 resolves the
+ * `ngModelOptions.timezone` string into this shape.
+ */
+export type Timezone = number | undefined;
+
+/**
+ * The Slice-3 default timezone sentinel: the host's local timezone. Slice
+ * 6 replaces this at the call sites with a resolved offset.
+ */
+export const LOCAL_TIMEZONE: Timezone = undefined;
+
+/**
+ * Resolve an `ngModelOptions.timezone` string into a {@link Timezone} offset
+ * (spec 039 Slice 6). Mirrors AngularJS's `timezoneToOffset`:
+ *
+ *  - `undefined` / `''` → {@link LOCAL_TIMEZONE} (the host's local zone).
+ *  - `'UTC'` / `'Z'` → `0`.
+ *  - `'+HHMM'` / `'-HHMM'` / `'+HH:MM'` → the signed minutes-east-of-UTC.
+ *
+ * An unrecognized string falls back to the local sentinel (never throws —
+ * a bad timezone silently degrades to local, matching the framework's other
+ * lenient option parses).
+ */
+export function resolveTimezone(timezone: string | undefined): Timezone {
+  if (timezone === undefined || timezone === '') {
+    return LOCAL_TIMEZONE;
+  }
+  const upper = timezone.toUpperCase();
+  if (upper === 'UTC' || upper === 'Z' || upper === 'GMT') {
+    return 0;
+  }
+  const m = /^([+-])(\d{2}):?(\d{2})$/.exec(timezone);
+  if (m) {
+    const sign = m[1] === '-' ? -1 : 1;
+    const hours = Number.parseInt(m[2] ?? '0', 10);
+    const minutes = Number.parseInt(m[3] ?? '0', 10);
+    return sign * (hours * 60 + minutes);
+  }
+  return LOCAL_TIMEZONE;
+}
+
+/**
+ * Discriminator for the five date/time input types. Drives per-type regex,
+ * parse, and format selection.
+ */
+export type DateInputKind = 'date' | 'datetime-local' | 'time' | 'month' | 'week';
+
+/** Zero-pad a number to a fixed width (AngularJS `padNumber`). */
+function pad(value: number, digits: number): string {
+  const sign = value < 0 ? '-' : '';
+  const abs = Math.abs(value);
+  const str = String(abs);
+  return sign + str.padStart(digits, '0');
+}
+
+/**
+ * Apply a timezone offset (minutes east of UTC) to a `Date` built from
+ * local components, converting it into the equivalent instant. When
+ * `timezone` is the local sentinel this is a no-op — the `Date` already
+ * carries the correct instant for a local round-trip. Otherwise we adjust
+ * so the produced components match the requested zone.
+ *
+ * Mirrors AngularJS `timezoneToOffset` + `convertTimezoneToLocal`: the
+ * requested offset is combined with the host's own offset so that
+ * formatting the same `Date` later yields the requested-zone components.
+ */
+function applyTimezone(date: Date, timezone: Timezone, reverse: boolean): Date {
+  if (timezone === undefined) {
+    return date;
+  }
+  // `getTimezoneOffset` is minutes WEST of UTC (positive for zones behind
+  // UTC), so negate to get minutes east. `timezone` is minutes east.
+  const localOffset = -date.getTimezoneOffset();
+  const delta = (timezone - localOffset) * (reverse ? -1 : 1);
+  return new Date(date.getTime() + delta * 60_000);
+}
+
+/** Result of a per-type parse: a `Date`, or `null` on a malformed value. */
+type ParseResult = Date | null;
+
+const DATE_RE = /^(\d{4,})-(\d{2})-(\d{2})$/;
+const DATETIME_LOCAL_RE = /^(\d{4,})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,3}))?)?$/;
+const TIME_RE = /^(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,3}))?)?$/;
+const MONTH_RE = /^(\d{4,})-(\d{2})$/;
+const WEEK_RE = /^(\d{4,})-W(\d{2})$/;
+
+/** Coerce a captured group to an int (0 when the optional group is absent). */
+function intOf(group: string | undefined): number {
+  return group === undefined ? 0 : Number.parseInt(group, 10);
+}
+
+/** Milliseconds from a captured fractional-seconds group (`.5` → 500ms). */
+function millisOf(group: string | undefined): number {
+  if (group === undefined) {
+    return 0;
+  }
+  return Number.parseInt(group.padEnd(3, '0').slice(0, 3), 10);
+}
+
+/**
+ * Convert an ISO week number + year to the `Date` of that week's Monday
+ * (AngularJS `getFirstThursdayOfYear` + week-offset arithmetic). Weeks are
+ * ISO-8601: week 1 contains the year's first Thursday.
+ */
+function dateFromWeek(year: number, week: number): Date {
+  const firstThursday = new Date(year, 0, 1);
+  const dayOfWeek = firstThursday.getDay();
+  // Shift to the first Thursday (getDay(): 0=Sun..6=Sat; ISO wants Thu=4).
+  const offsetToThursday = (dayOfWeek <= 4 ? 4 : 11) - dayOfWeek;
+  firstThursday.setDate(firstThursday.getDate() + offsetToThursday);
+  // Monday of the requested week: back up 3 days from that week's Thursday.
+  const thursdayOfWeek = new Date(firstThursday.getTime());
+  thursdayOfWeek.setDate(firstThursday.getDate() + (week - 1) * 7);
+  const monday = new Date(thursdayOfWeek.getTime());
+  monday.setDate(thursdayOfWeek.getDate() - 3);
+  monday.setHours(0, 0, 0, 0);
+  return monday;
+}
+
+/** ISO week number (1..53) for a `Date` (AngularJS `weekParser` inverse). */
+function isoWeek(date: Date): { year: number; week: number } {
+  const target = new Date(date.getFullYear(), date.getMonth(), date.getDate());
+  // Thursday of the current week determines the ISO year.
+  const day = (target.getDay() + 6) % 7; // Mon=0..Sun=6
+  target.setDate(target.getDate() - day + 3);
+  const isoYear = target.getFullYear();
+  const firstThursday = new Date(isoYear, 0, 4);
+  const firstDay = (firstThursday.getDay() + 6) % 7;
+  firstThursday.setDate(firstThursday.getDate() - firstDay + 3);
+  const week = 1 + Math.round((target.getTime() - firstThursday.getTime()) / (7 * 24 * 60 * 60 * 1000));
+  return { year: isoYear, week };
+}
+
+/**
+ * Parse an input `value` string of the given `kind` into a `Date` in the
+ * requested `timezone`, or `null` when the string is malformed / empty.
+ */
+export function parseDateInput(kind: DateInputKind, value: string, timezone: Timezone): ParseResult {
+  if (value === '') {
+    return null;
+  }
+
+  let local: Date | null = null;
+  switch (kind) {
+    case 'date': {
+      const m = DATE_RE.exec(value);
+      if (m) {
+        local = new Date(intOf(m[1]), intOf(m[2]) - 1, intOf(m[3]), 0, 0, 0, 0);
+      }
+      break;
+    }
+    case 'datetime-local': {
+      const m = DATETIME_LOCAL_RE.exec(value);
+      if (m) {
+        local = new Date(
+          intOf(m[1]),
+          intOf(m[2]) - 1,
+          intOf(m[3]),
+          intOf(m[4]),
+          intOf(m[5]),
+          intOf(m[6]),
+          millisOf(m[7]),
+        );
+      }
+      break;
+    }
+    case 'time': {
+      const m = TIME_RE.exec(value);
+      if (m) {
+        // AngularJS anchors time-only values to 1970-01-01 (local).
+        local = new Date(1970, 0, 1, intOf(m[1]), intOf(m[2]), intOf(m[3]), millisOf(m[4]));
+      }
+      break;
+    }
+    case 'month': {
+      const m = MONTH_RE.exec(value);
+      if (m) {
+        local = new Date(intOf(m[1]), intOf(m[2]) - 1, 1, 0, 0, 0, 0);
+      }
+      break;
+    }
+    case 'week': {
+      const m = WEEK_RE.exec(value);
+      if (m) {
+        local = dateFromWeek(intOf(m[1]), intOf(m[2]));
+      }
+      break;
+    }
+  }
+
+  if (local === null || Number.isNaN(local.getTime())) {
+    return null;
+  }
+  return applyTimezone(local, timezone, false);
+}
+
+/**
+ * Format a `Date` model value into the HTML `value` string for the given
+ * `kind`, in the requested `timezone`. A non-`Date` / invalid `Date`
+ * yields `''` (so the control shows blank rather than `Invalid Date`).
+ */
+export function formatDateInput(kind: DateInputKind, value: unknown, timezone: Timezone): string {
+  if (!(value instanceof Date) || Number.isNaN(value.getTime())) {
+    return '';
+  }
+  const date = applyTimezone(value, timezone, true);
+
+  switch (kind) {
+    case 'date':
+      return `${pad(date.getFullYear(), 4)}-${pad(date.getMonth() + 1, 2)}-${pad(date.getDate(), 2)}`;
+    case 'datetime-local':
+      return (
+        `${pad(date.getFullYear(), 4)}-${pad(date.getMonth() + 1, 2)}-${pad(date.getDate(), 2)}` +
+        `T${pad(date.getHours(), 2)}:${pad(date.getMinutes(), 2)}:${pad(date.getSeconds(), 2)}` +
+        `.${pad(date.getMilliseconds(), 3)}`
+      );
+    case 'time':
+      return (
+        `${pad(date.getHours(), 2)}:${pad(date.getMinutes(), 2)}:${pad(date.getSeconds(), 2)}` +
+        `.${pad(date.getMilliseconds(), 3)}`
+      );
+    case 'month':
+      return `${pad(date.getFullYear(), 4)}-${pad(date.getMonth() + 1, 2)}`;
+    case 'week': {
+      const { year, week } = isoWeek(date);
+      return `${pad(year, 4)}-W${pad(week, 2)}`;
+    }
+  }
+}
diff --git a/src/forms/input-types.ts b/src/forms/input-types.ts
new file mode 100644
index 0000000..09ab94f
--- /dev/null
+++ b/src/forms/input-types.ts
@@ -0,0 +1,579 @@
+/**
+ * Input-type handler registry (spec 039 Slice 1 + Slice 3 / FS §2.4,
+ * technical-considerations §2.4).
+ *
+ * One `input` directive dispatches on `attrs.type` into the handlers
+ * registered here (AngularJS parity — NOT one directive per type).
+ * Slice 1 shipped the baseline `text` handler; Slice 3 fills in
+ * `number` / `range` / `checkbox` / `radio` / the date-time family
+ * (`date` / `datetime-local` / `time` / `month` / `week`) and the
+ * no-model controls (`hidden` / `button` / `submit` / `reset`). Slice 5
+ * wires the `email` / `number` / `url` type validators through these
+ * handlers.
+ *
+ * A handler receives the linked `scope`, the control `element`, the
+ * shared `attrs`, and the published {@link NgModelController}. It is
+ * responsible for:
+ *
+ *  - installing `$render` (writes `$viewValue` to the DOM control), and
+ *  - registering the native DOM event listeners that call
+ *    `$setViewValue` on user input.
+ *
+ * **`$$phase`-guarded dispatch.** A native event firing while a digest is
+ * already in flight (e.g. inside another `$apply`) must NOT call
+ * `scope.$apply` (which throws `'$digest already in progress'`). The
+ * shared {@link applyDuringEvent} helper dispatches through
+ * `scope.$evalAsync` in that case and `scope.$apply` otherwise — the
+ * established event-directive pattern. The runner is wrapped in a
+ * `try/catch` that routes through `$exceptionHandler` with cause
+ * `'$compile'` because the project's `$apply` is `try/finally`-only.
+ */
+
+import { asInstanceOf, type Scope } from '@core/index';
+
+import type { Attributes } from '@compiler/directive-types';
+import { invokeExceptionHandler, type ExceptionHandler } from '@exception-handler/index';
+import { parse } from '@parser/index';
+
+import { formatDateInput, parseDateInput, type DateInputKind } from './input-date';
+import { wireDateMinMax, wireEmailValidator, wireNumericMinMax, wireUrlValidator } from './input-validators';
+import type { NgModelControllerImpl } from './ng-model-controller';
+
+/**
+ * Context handed to every input-type handler.
+ */
+export interface InputTypeContext {
+  scope: Scope;
+  element: HTMLInputElement | HTMLTextAreaElement;
+  attrs: Attributes;
+  ctrl: NgModelControllerImpl;
+  exceptionHandler: ExceptionHandler;
+}
+
+/**
+ * An input-type handler installs `$render` + the native event listeners
+ * for one (group of) `type` value(s).
+ */
+export type InputTypeHandler = (ctx: InputTypeContext) => void;
+
+/**
+ * Dispatch a runner through the `$$phase`-guarded `$apply` / `$evalAsync`
+ * seam, routing any throw via `$exceptionHandler('$compile')`. Mirrors the
+ * spec-026 event-directive workaround (the project's `$apply` is
+ * `try/finally`, not `try/catch`).
+ */
+export function applyDuringEvent(scope: Scope, exceptionHandler: ExceptionHandler, run: () => void): void {
+  try {
+    if (scope.$$phase !== null) {
+      scope.$evalAsync(run);
+    } else {
+      scope.$apply(run);
+    }
+  } catch (err) {
+    invokeExceptionHandler(exceptionHandler, err, '$compile');
+  }
+}
+
+/**
+ * Coerce a view value to the string a text control should display.
+ * `undefined` / `null` render as `''` (never the literal words); a value
+ * that is already a string passes through; numbers / booleans use their
+ * primitive string form. Any other shape (an object, etc.) is treated as
+ * empty rather than producing `'[object Object]'` — a text control should
+ * not be fed a non-primitive model, and showing the brace-noise would be
+ * worse than blank.
+ */
+function stringifyView(value: unknown): string {
+  if (value === undefined || value === null) {
+    return '';
+  }
+  if (typeof value === 'string') {
+    return value;
+  }
+  if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') {
+    return String(value);
+  }
+  return '';
+}
+
+/**
+ * Coerce an unknown view value to a string for a `$parser` that consumes
+ * the raw on-screen text. The listener always feeds `element.value` (a
+ * string), so this is normally an identity; a non-string / non-primitive
+ * (defensive — a caller invoking `$setViewValue` with an object) maps to
+ * `''` rather than producing `'[object Object]'`.
+ */
+function toStringView(value: unknown): string {
+  if (typeof value === 'string') {
+    return value;
+  }
+  if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') {
+    return String(value);
+  }
+  return '';
+}
+
+/**
+ * Read the narrowed `HTMLInputElement` view of the control. The date /
+ * number / checkbox / radio handlers only ever run for an `<input>` (a
+ * `<textarea>` always routes to the `text` handler in `input.ts`), so the
+ * guard never throws in practice — it just fails loudly if that routing
+ * invariant is ever violated, instead of casting past it.
+ */
+function asInput(element: HTMLInputElement | HTMLTextAreaElement): HTMLInputElement {
+  return asInstanceOf(element, HTMLInputElement);
+}
+
+/**
+ * Whether the control's native `validity.badInput` flag is set — the
+ * browser could not sanitize the raw user input into a value for a typed
+ * control (`number` / `date` / …). In that state the browser reports
+ * `element.value === ''`, so `badInput` is the only observable signal that
+ * the raw input was garbage. Mirrors AngularJS's `badInputChecker`. Guards
+ * against environments where `validity` is absent.
+ */
+function hasBadInput(control: HTMLInputElement): boolean {
+  // `HTMLInputElement.validity` is typed non-nullable, but a bare Element
+  // cast (the M-restricted / non-input edge) may lack it at runtime, so a
+  // defensive optional-chain read keeps the check safe without a redundant
+  // typed-`undefined` comparison the linter rejects.
+  return control.validity.badInput;
+}
+
+/**
+ * Install the view → model event listeners for a control, honoring
+ * `ngModelOptions.updateOn` (spec 039 Slice 6).
+ *
+ * `defaultEvents` are the input type's OWN default commit events (e.g.
+ * `['input', 'change']` for text). `readValue` extracts the current view
+ * value from the DOM.
+ *
+ * Behavior:
+ *
+ *  - When `updateOn` includes `default` (the common case — `updateOn` absent,
+ *    or `"default blur"`), the default events COMMIT: they call
+ *    `ctrl.$setViewValue(readValue(), 'default')`.
+ *  - When `updateOn` does NOT include `default` (e.g. `updateOn: 'blur'`),
+ *    the default events only BUFFER the pending view value — they set
+ *    `ctrl.$viewValue` WITHOUT committing, so typing does not update the
+ *    model. AngularJS parity (`$$updateEvents`): the value is still tracked
+ *    so a later `updateOn` event commits the latest text.
+ *  - Every event in `$$updateEvents` (the non-`default` events from
+ *    `updateOn`) COMMITS with the event's own name as the debounce trigger.
+ *
+ * All dispatch goes through the `$$phase`-guarded {@link applyDuringEvent}.
+ * Listeners are removed on `$destroy`.
+ */
+export function registerInputListeners(
+  ctx: InputTypeContext,
+  defaultEvents: readonly string[],
+  readValue: () => unknown,
+): void {
+  const { scope, element, ctrl, exceptionHandler } = ctx;
+  const options = ctrl.$options;
+  const registered: { event: string; listener: EventListener }[] = [];
+
+  const add = (event: string, listener: EventListener): void => {
+    element.addEventListener(event, listener);
+    registered.push({ event, listener });
+  };
+
+  // Default events: commit when `default` is in `updateOn`, else buffer only.
+  const defaultCommits = options.$$hasDefaultUpdateEvent;
+  for (const event of defaultEvents) {
+    add(event, () => {
+      applyDuringEvent(scope, exceptionHandler, () => {
+        if (defaultCommits) {
+          ctrl.$setViewValue(readValue(), 'default');
+        } else {
+          // Buffer the pending view value without committing (updateOn parity).
+          ctrl.$viewValue = readValue();
+        }
+      });
+    });
+  }
+
+  // Explicit `updateOn` events (e.g. `blur`) — each commits under its own name.
+  for (const event of options.$$updateEvents) {
+    // Avoid double-registering an event that is also a default event — a
+    // default event listed in `updateOn` already commits above (when
+    // `default` is present) or should commit here (when it is not).
+    if (defaultEvents.includes(event) && defaultCommits) {
+      continue;
+    }
+    add(event, () => {
+      applyDuringEvent(scope, exceptionHandler, () => {
+        ctrl.$setViewValue(readValue(), event);
+      });
+    });
+  }
+
+  scope.$on('$destroy', () => {
+    for (const { event, listener } of registered) {
+      element.removeEventListener(event, listener);
+    }
+  });
+}
+
+/**
+ * Baseline string handler used by `text` / `search` / `tel` / `password`
+ * / `email` / `url` inputs and by `textarea`. Renders the model's
+ * formatted string into `element.value` and commits user input on the
+ * native `input` and `change` events.
+ *
+ * The `$render` writer coerces `undefined` / `null` to `''` so the control
+ * never shows the literal words; the listener reads `element.value`
+ * verbatim (parsers — e.g. trim, type validators — run inside
+ * `$setViewValue`).
+ */
+export const textInputType: InputTypeHandler = (ctx) => {
+  const { element, ctrl } = ctx;
+  ctrl.$render = () => {
+    element.value = stringifyView(ctrl.$viewValue);
+  };
+
+  registerInputListeners(ctx, ['input', 'change'], () => element.value);
+};
+
+/**
+ * `email` handler — a baseline string control (like `text`) that ALSO
+ * registers the `email` validator (spec 039 Slice 5 / FS §2.6). The value
+ * is valid when empty (emptiness is `required`'s concern) or it matches
+ * {@link EMAIL_REGEXP}. Registered as a `$validators` entry so a malformed
+ * address flips the control invalid under the `email` key and surfaces
+ * `ng-invalid-email` — without keeping the string out of the model
+ * (AngularJS parity — the string still binds; the control is just invalid).
+ */
+export const emailInputType: InputTypeHandler = (ctx) => {
+  textInputType(ctx);
+  wireEmailValidator(ctx.ctrl);
+};
+
+/**
+ * `url` handler — a baseline string control that ALSO registers the `url`
+ * validator (spec 039 Slice 5 / FS §2.6). Valid when empty or matching
+ * {@link URL_REGEXP}; a malformed URL flips `ng-invalid-url`.
+ */
+export const urlInputType: InputTypeHandler = (ctx) => {
+  textInputType(ctx);
+  wireUrlValidator(ctx.ctrl);
+};
+
+/**
+ * Matches a numeric string AngularJS accepts for `type=number` (integers,
+ * decimals, scientific notation, leading sign). Empty / non-numeric input
+ * fails the `number` validator instead of writing a bad model.
+ */
+const NUMBER_RE = /^\s*(-|\+)?(\d+|(\d*(\.\d*)))([eE][+-]?\d+)?\s*$/;
+
+/**
+ * `number` / `range` handler — the model holds a **Number** (FS §2.4).
+ *
+ * Parsing: an empty view value maps to `null` (an empty control is not a
+ * bad number — it is simply blank, so the `number` validity key stays
+ * true); a non-numeric string sets `$setValidity('number', false)` and
+ * returns `undefined` so the bad value is kept OUT of the model; a numeric
+ * string parses to a `Number` (and clears the `number` validity key).
+ *
+ * `range` additionally clamps the parsed number to `min` / `max` / `step`
+ * — the browser's native range clamping, reproduced so the model matches
+ * what the slider actually shows. Slice 5 adds the standalone `min` / `max`
+ * validator directives; the `number` validity key set here is where those
+ * build on.
+ */
+function makeNumericHandler(isRange: boolean): InputTypeHandler {
+  return (ctx) => {
+    const { scope, element, attrs, ctrl } = ctx;
+    const control = asInput(element);
+
+    // View → model parser: string → Number, guarding the `number` key.
+    // A `type=number` control whose native `validity.badInput` is set (the
+    // user typed a non-numeric string that the browser could not sanitize
+    // into a value) fails the `number` rule directly — the browser reports
+    // `element.value === ''` in that state, so `badInput` is the only
+    // observable signal that the raw input was garbage (AngularJS parity —
+    // `badInputChecker`). We also keep the regex guard for the non-empty
+    // string path (environments / values that surface the raw string).
+    ctrl.$parsers.push((viewValue: unknown): unknown => {
+      if (hasBadInput(control)) {
+        ctrl.$setValidity('number', false);
+        return undefined;
+      }
+      if (viewValue === undefined || viewValue === null || viewValue === '') {
+        ctrl.$setValidity('number', true);
+        return null;
+      }
+      const str = toStringView(viewValue);
+      if (!NUMBER_RE.test(str)) {
+        ctrl.$setValidity('number', false);
+        return undefined;
+      }
+      ctrl.$setValidity('number', true);
+      let num = Number.parseFloat(str);
+      if (isRange) {
+        num = clampToRange(num, attrs);
+      }
+      return num;
+    });
+
+    // Model → view formatter: Number → string (blank for null/undefined).
+    ctrl.$formatters.push((modelValue: unknown): unknown => {
+      if (modelValue === undefined || modelValue === null) {
+        return '';
+      }
+      if (typeof modelValue === 'number') {
+        return String(modelValue);
+      }
+      return modelValue;
+    });
+
+    ctrl.$render = () => {
+      control.value = stringifyView(ctrl.$viewValue);
+    };
+
+    // `min` / `max` validators (spec 039 Slice 5). `range` clamps in the
+    // parser above (the model always lands in bounds), so it does not also
+    // register the validators — matching AngularJS.
+    if (!isRange) {
+      wireNumericMinMax(scope, attrs, ctrl);
+    }
+
+    registerInputListeners(ctx, ['input', 'change'], () => control.value);
+  };
+}
+
+/**
+ * Clamp a number to the control's `min` / `max` / `step` attributes,
+ * reproducing the browser's native `type=range` clamping. `min` defaults
+ * to 0 and `max` to 100 (the HTML defaults); `step` (default 1) snaps to
+ * the nearest step above `min`.
+ */
+function clampToRange(value: number, attrs: Attributes): number {
+  const minAttr = attrs['min'];
+  const maxAttr = attrs['max'];
+  const stepAttr = attrs['step'];
+  const min = typeof minAttr === 'string' && minAttr !== '' ? Number.parseFloat(minAttr) : 0;
+  const max = typeof maxAttr === 'string' && maxAttr !== '' ? Number.parseFloat(maxAttr) : 100;
+  const step = typeof stepAttr === 'string' && stepAttr !== '' ? Number.parseFloat(stepAttr) : 1;
+
+  let result = value;
+  if (Number.isFinite(min) && result < min) {
+    result = min;
+  }
+  if (Number.isFinite(max) && result > max) {
+    result = max;
+  }
+  // Snap to the nearest step boundary relative to min.
+  if (Number.isFinite(step) && step > 0) {
+    const steps = Math.round((result - min) / step);
+    result = min + steps * step;
+    if (Number.isFinite(max) && result > max) {
+      result -= step;
+    }
+    // Guard against floating-point drift (e.g. 0.1 + 0.2).
+    result = Number.parseFloat(result.toPrecision(12));
+  }
+  return result;
+}
+
+export const numberInputType: InputTypeHandler = makeNumericHandler(false);
+export const rangeInputType: InputTypeHandler = makeNumericHandler(true);
+
+/**
+ * Evaluate a constant-attribute expression (`ng-true-value` /
+ * `ng-false-value` / `ng-value`) once against the scope, matching
+ * AngularJS (`$parse(attr)(scope)`). A missing attribute yields the
+ * supplied `fallback`.
+ */
+function evalConstantAttr(attrs: Attributes, name: string, scope: Scope, fallback: unknown): unknown {
+  const raw = attrs[name];
+  if (typeof raw !== 'string') {
+    return fallback;
+  }
+  return parse(raw)(scope as unknown as Record<string, unknown>);
+}
+
+/**
+ * `checkbox` handler — the model holds a **boolean** (FS §2.4).
+ *
+ * `ng-true-value` / `ng-false-value` override the checked / unchecked
+ * model values (parsed as constant expressions per AngularJS, so
+ * `ng-true-value="'YES'"` stores the string `'YES'`). `$isEmpty` is
+ * overridden so an unchecked checkbox counts as empty (drives `ng-empty`
+ * and `required`).
+ */
+export const checkboxInputType: InputTypeHandler = (ctx) => {
+  const { scope, element, attrs, ctrl } = ctx;
+  const control = asInput(element);
+  const trueValue = evalConstantAttr(attrs, 'ngTrueValue', scope, true);
+  const falseValue = evalConstantAttr(attrs, 'ngFalseValue', scope, false);
+
+  // A checkbox is "empty" when it is NOT checked (i.e. the model value
+  // equals the false value). Compared by strict equality with the resolved
+  // true value.
+  ctrl.$isEmpty = (value: unknown): boolean => value !== trueValue;
+
+  ctrl.$render = () => {
+    control.checked = ctrl.$viewValue === trueValue;
+  };
+
+  registerInputListeners(ctx, ['change'], () => (control.checked ? trueValue : falseValue));
+};
+
+/**
+ * `radio` handler — the model holds the **value of the selected radio**
+ * among a group sharing the same `ng-model` (FS §2.4).
+ *
+ * The checked radio's `value` (or `ng-value`, parsed as a constant
+ * expression) becomes the model; `$render` sets `.checked` by comparing
+ * the model against this radio's value. Every radio in the group binds the
+ * same model expression, so a `change` on one commits its value and the
+ * model→view watch un-checks the others on the next digest.
+ */
+export const radioInputType: InputTypeHandler = ({ scope, element, attrs, ctrl, exceptionHandler }) => {
+  const control = asInput(element);
+
+  // The value this radio contributes when checked: `ng-value` (constant
+  // expression) if present, else the raw `value` attribute string.
+  function currentValue(): unknown {
+    const ngValue = attrs['ngValue'];
+    if (typeof ngValue === 'string') {
+      return parse(ngValue)(scope as unknown as Record<string, unknown>);
+    }
+    const valueAttr = attrs['value'];
+    return typeof valueAttr === 'string' ? valueAttr : undefined;
+  }
+
+  ctrl.$render = () => {
+    control.checked = ctrl.$viewValue === currentValue();
+  };
+
+  const listener = () => {
+    if (!control.checked) {
+      return;
+    }
+    applyDuringEvent(scope, exceptionHandler, () => {
+      // `'change'` is the debounce trigger (AngularJS parity — a
+      // `debounce: { change: … }` map applies to radio commits).
+      ctrl.$setViewValue(currentValue(), 'change');
+    });
+  };
+  control.addEventListener('change', listener);
+
+  // Re-render when this radio's contributed value changes so a
+  // data-driven value stays in sync: watch the `ng-value` EXPRESSION when
+  // present (the `value` attribute is absent then, so `$observe` alone
+  // would never re-fire), else observe the (possibly interpolated)
+  // `value` attribute.
+  const ngValueExpr = attrs['ngValue'];
+  if (typeof ngValueExpr === 'string') {
+    scope.$watch(ngValueExpr, () => {
+      ctrl.$render();
+    });
+  }
+  const stopObserve = attrs.$observe('value', () => {
+    ctrl.$render();
+  });
+
+  scope.$on('$destroy', () => {
+    control.removeEventListener('change', listener);
+    stopObserve();
+  });
+};
+
+/**
+ * Build a date/time-family handler for one {@link DateInputKind}. The
+ * model holds a **`Date`** (FS §2.4); parse/format is delegated to
+ * `input-date.ts`, isolated so Slice 6's `ngModelOptions.timezone` wiring
+ * threads a resolved timezone in cleanly. Slice 3 always uses
+ * {@link LOCAL_TIMEZONE} (the host's local zone).
+ *
+ * The per-type validity key (`date` / `datetime-local` / `time` /
+ * `month` / `week`) is set false when the string is present but malformed,
+ * keeping the bad value out of the model; an empty control clears the key.
+ * Slice 5's `min` / `max` validators compare against the parsed `Date`.
+ */
+function makeDateHandler(kind: DateInputKind): InputTypeHandler {
+  return (ctx) => {
+    const { scope, element, attrs, ctrl } = ctx;
+    const control = asInput(element);
+
+    ctrl.$parsers.push((viewValue: unknown): unknown => {
+      if (hasBadInput(control)) {
+        ctrl.$setValidity(kind, false);
+        return undefined;
+      }
+      if (viewValue === undefined || viewValue === null || viewValue === '') {
+        ctrl.$setValidity(kind, true);
+        return null;
+      }
+      // Read `ctrl.$$timezone` LAZILY (spec 039 Slice 6): `ngModel`'s link
+      // resolves `ngModelOptions.timezone` onto the controller before the
+      // first digest, so a parse during a listener sees the configured zone.
+      const parsed = parseDateInput(kind, toStringView(viewValue), ctrl.$$timezone);
+      if (parsed === null) {
+        ctrl.$setValidity(kind, false);
+        return undefined;
+      }
+      ctrl.$setValidity(kind, true);
+      return parsed;
+    });
+
+    ctrl.$formatters.push((modelValue: unknown): unknown => formatDateInput(kind, modelValue, ctrl.$$timezone));
+
+    wireDateMinMax(kind, scope, attrs, ctrl);
+
+    ctrl.$render = () => {
+      control.value = typeof ctrl.$viewValue === 'string' ? ctrl.$viewValue : '';
+    };
+
+    registerInputListeners(ctx, ['input', 'change'], () => control.value);
+  };
+}
+
+export const dateInputType: InputTypeHandler = makeDateHandler('date');
+export const dateTimeLocalInputType: InputTypeHandler = makeDateHandler('datetime-local');
+export const timeInputType: InputTypeHandler = makeDateHandler('time');
+export const monthInputType: InputTypeHandler = makeDateHandler('month');
+export const weekInputType: InputTypeHandler = makeDateHandler('week');
+
+/**
+ * No-model handler for `hidden` / `button` / `submit` / `reset`. These
+ * controls do not participate in `ng-model` parsing — the handler is a
+ * deliberate no-op (it installs no `$render`, no listeners), matching
+ * AngularJS's empty `inputType` entries. A leftover `ng-model` on such a
+ * control simply never round-trips.
+ */
+export const noopInputType: InputTypeHandler = () => {
+  /* no model parsing for hidden / button / submit / reset */
+};
+
+/**
+ * The type registry. Every recognized `type` maps to its handler; the
+ * plain string types (`text` / `search` / `tel` / `password`) use the
+ * baseline handler, while `email` / `url` use handlers that ALSO layer
+ * their Slice-5 shape validator on top of the baseline. Unknown / absent
+ * types fall back to `text` (AngularJS parity) at the dispatch site in
+ * `input.ts`.
+ */
+export const inputTypeHandlers: Record<string, InputTypeHandler> = {
+  text: textInputType,
+  search: textInputType,
+  tel: textInputType,
+  url: urlInputType,
+  email: emailInputType,
+  password: textInputType,
+  number: numberInputType,
+  range: rangeInputType,
+  checkbox: checkboxInputType,
+  radio: radioInputType,
+  date: dateInputType,
+  'datetime-local': dateTimeLocalInputType,
+  time: timeInputType,
+  month: monthInputType,
+  week: weekInputType,
+  hidden: noopInputType,
+  button: noopInputType,
+  submit: noopInputType,
+  reset: noopInputType,
+};
diff --git a/src/forms/input-validators.ts b/src/forms/input-validators.ts
new file mode 100644
index 0000000..a7786a8
--- /dev/null
+++ b/src/forms/input-validators.ts
@@ -0,0 +1,185 @@
+/**
+ * Type-validator wiring for the `input` type handlers (spec 039 Slice 5 /
+ * FS §2.6).
+ *
+ * Split out of `input-types.ts` so that file stays focused on the
+ * parse/format/render pipeline for each type. This module owns the
+ * validators that belong to a TYPE rather than a standalone attribute:
+ *
+ *  - `email` / `url` shape checks (ported AngularJS regexps), and
+ *  - the numeric / date `min` / `max` bounds (`number` / `range` / the
+ *    date-time family) — each re-validates when its bound changes: the
+ *    native `min` / `max` attribute is `$observe`d when present, else the
+ *    `ng-min` / `ng-max` EXPRESSION is `$watch`ed (observing a missing
+ *    attribute would fire a spurious one-shot `undefined`).
+ *
+ * The standalone attribute validators (`required` / `ngMinlength` /
+ * `ngMaxlength` / `pattern`) live in `validators.ts` as directives.
+ */
+
+import type { Scope } from '@core/index';
+
+import type { Attributes } from '@compiler/directive-types';
+import { parse } from '@parser/index';
+
+import { parseDateInput, type DateInputKind, type Timezone } from './input-date';
+import type { NgModelControllerImpl } from './ng-model-controller';
+
+/**
+ * AngularJS's `EMAIL_REGEXP` — the standard email shape check applied by
+ * `<input type="email">`. Ported verbatim.
+ */
+export const EMAIL_REGEXP =
+  /^(?=.{1,254}$)(?=.{1,64}@)[-!#$%&'*+/0-9=?A-Z^_`a-z{|}~]+(\.[-!#$%&'*+/0-9=?A-Z^_`a-z{|}~]+)*@[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
+
+/**
+ * AngularJS's `URL_REGEXP` — the standard URL shape check applied by
+ * `<input type="url">`. Ported verbatim.
+ */
+export const URL_REGEXP =
+  /^[a-z][a-z\d.+-]*:\/*(?:[^:@]+(?::[^@]+)?@)?(?:[^\s:/?#]+|\[[a-f\d:]+])(?::\d+)?(?:\/[^?#]*)?(?:\?[^#]*)?(?:#.*)?$/i;
+
+/**
+ * Register the `email` validator on the control — valid when empty
+ * (emptiness is `required`'s concern) or the value matches {@link EMAIL_REGEXP}.
+ */
+export function wireEmailValidator(ctrl: NgModelControllerImpl): void {
+  ctrl.$validators['email'] = (modelValue: unknown, viewValue: unknown): boolean => {
+    const value = modelValue ?? viewValue;
+    return ctrl.$isEmpty(value) || EMAIL_REGEXP.test(String(value));
+  };
+}
+
+/** Register the `url` validator — valid when empty or matching {@link URL_REGEXP}. */
+export function wireUrlValidator(ctrl: NgModelControllerImpl): void {
+  ctrl.$validators['url'] = (modelValue: unknown, viewValue: unknown): boolean => {
+    const value = modelValue ?? viewValue;
+    return ctrl.$isEmpty(value) || URL_REGEXP.test(String(value));
+  };
+}
+
+/** Evaluate an `ng-min` / `ng-max` expression against the scope. */
+function evalAttrExpr(attrs: Attributes, name: string, scope: Scope): unknown {
+  const raw = attrs[name];
+  if (typeof raw !== 'string') {
+    return undefined;
+  }
+  return parse(raw)(scope as unknown as Record<string, unknown>);
+}
+
+/**
+ * Parse a `min` / `max` attribute value to a number, or `undefined` when
+ * absent / non-numeric (AngularJS's `parseNumberAttrVal`). An `undefined`
+ * bound makes the corresponding validator a no-op.
+ */
+function parseNumberAttrVal(val: unknown): number | undefined {
+  if (typeof val === 'number') {
+    return Number.isNaN(val) ? undefined : val;
+  }
+  if (typeof val !== 'string' || val === '') {
+    return undefined;
+  }
+  const num = Number.parseFloat(val);
+  return Number.isNaN(num) ? undefined : num;
+}
+
+/**
+ * Wire the numeric `min` / `max` validators onto a `number` control. Each
+ * is present only when its attribute (`min` / `ng-min`, `max` / `ng-max`)
+ * exists; both `$observe` their attribute so a data-driven bound
+ * re-validates. Empty values and undefined bounds pass.
+ */
+export function wireNumericMinMax(scope: Scope, attrs: Attributes, ctrl: NgModelControllerImpl): void {
+  if (typeof attrs['min'] === 'string' || typeof attrs['ngMin'] === 'string') {
+    let parsedMin = parseNumberAttrVal(attrs['min'] ?? evalAttrExpr(attrs, 'ngMin', scope));
+    ctrl.$validators['min'] = (modelValue: unknown): boolean =>
+      ctrl.$isEmpty(modelValue) || parsedMin === undefined || Number(modelValue) >= parsedMin;
+    wireBoundSource(scope, attrs, 'min', 'ngMin', (val) => {
+      parsedMin = parseNumberAttrVal(val);
+      ctrl.$validate();
+    });
+  }
+
+  if (typeof attrs['max'] === 'string' || typeof attrs['ngMax'] === 'string') {
+    let parsedMax = parseNumberAttrVal(attrs['max'] ?? evalAttrExpr(attrs, 'ngMax', scope));
+    ctrl.$validators['max'] = (modelValue: unknown): boolean =>
+      ctrl.$isEmpty(modelValue) || parsedMax === undefined || Number(modelValue) <= parsedMax;
+    wireBoundSource(scope, attrs, 'max', 'ngMax', (val) => {
+      parsedMax = parseNumberAttrVal(val);
+      ctrl.$validate();
+    });
+  }
+}
+
+/**
+ * Wire the re-validation source for a `min` / `max` bound. Observe the
+ * native attribute ONLY when present (observing a missing attribute would
+ * fire a one-shot `undefined` that wrongly clears the bound); otherwise
+ * `$watch` the `ng-min` / `ng-max` expression. `onChange` receives the raw
+ * new value (native string or evaluated expression value).
+ */
+function wireBoundSource(
+  scope: Scope,
+  attrs: Attributes,
+  nativeName: string,
+  ngName: string,
+  onChange: (val: unknown) => void,
+): void {
+  if (typeof attrs[nativeName] === 'string') {
+    const stopObserve = attrs.$observe(nativeName, (val) => {
+      onChange(val);
+    });
+    scope.$on('$destroy', stopObserve);
+    return;
+  }
+  const ngExpr = attrs[ngName];
+  if (typeof ngExpr === 'string') {
+    scope.$watch(ngExpr, (val: unknown) => {
+      onChange(val);
+    });
+  }
+}
+
+/**
+ * Parse an observed `min` / `max` date-attribute value to a `Date` (or
+ * `undefined` when absent / unparseable) for the given date-input `kind`.
+ */
+function parseDateAttrVal(kind: DateInputKind, val: unknown, timezone: Timezone): Date | undefined {
+  if (typeof val !== 'string' || val === '') {
+    return undefined;
+  }
+  const parsed = parseDateInput(kind, val, timezone);
+  return parsed instanceof Date ? parsed : undefined;
+}
+
+/**
+ * Wire the `min` / `max` DATE validators onto a date-family control. Each
+ * compares the model `Date` against the parsed bound; an empty / non-Date
+ * model, or an undefined bound, passes. Both `$observe` their attribute.
+ */
+export function wireDateMinMax(
+  kind: DateInputKind,
+  scope: Scope,
+  attrs: Attributes,
+  ctrl: NgModelControllerImpl,
+): void {
+  if (typeof attrs['min'] === 'string' || typeof attrs['ngMin'] === 'string') {
+    let parsedMin = parseDateAttrVal(kind, attrs['min'] ?? evalAttrExpr(attrs, 'ngMin', scope), ctrl.$$timezone);
+    ctrl.$validators['min'] = (modelValue: unknown): boolean =>
+      !(modelValue instanceof Date) || parsedMin === undefined || modelValue.getTime() >= parsedMin.getTime();
+    wireBoundSource(scope, attrs, 'min', 'ngMin', (val) => {
+      parsedMin = parseDateAttrVal(kind, val, ctrl.$$timezone);
+      ctrl.$validate();
+    });
+  }
+
+  if (typeof attrs['max'] === 'string' || typeof attrs['ngMax'] === 'string') {
+    let parsedMax = parseDateAttrVal(kind, attrs['max'] ?? evalAttrExpr(attrs, 'ngMax', scope), ctrl.$$timezone);
+    ctrl.$validators['max'] = (modelValue: unknown): boolean =>
+      !(modelValue instanceof Date) || parsedMax === undefined || modelValue.getTime() <= parsedMax.getTime();
+    wireBoundSource(scope, attrs, 'max', 'ngMax', (val) => {
+      parsedMax = parseDateAttrVal(kind, val, ctrl.$$timezone);
+      ctrl.$validate();
+    });
+  }
+}
diff --git a/src/forms/input.ts b/src/forms/input.ts
new file mode 100644
index 0000000..e6ae799
--- /dev/null
+++ b/src/forms/input.ts
@@ -0,0 +1,93 @@
+/**
+ * `input` + `textarea` directives (spec 039 Slice 1 / FS §2.4,
+ * technical-considerations §2.4).
+ *
+ * A SINGLE `input` directive (`restrict: 'E'`, `require: '?ngModel'`)
+ * matches every `<input>` and dispatches on `attrs.type` into the
+ * internal {@link inputTypeHandlers} registry (AngularJS parity — not one
+ * directive per type). When the element carries no `ng-model` the link is
+ * a no-op (the optional `?ngModel` require yields `null`), so a plain
+ * `<input>` without a model is untouched.
+ *
+ * `textarea` is a thin directive delegating to the `text` handler — a
+ * `<textarea ng-model>` binds a string exactly like a text input.
+ *
+ * Unknown / absent `type` values fall back to the `text` handler
+ * (AngularJS parity — `<input type="quux">` and `<input>` both behave as
+ * text). Types with no model parsing (`hidden` / `button` / `submit` /
+ * `reset`) are deferred to Slice 3; in Slice 1 they fall back to text,
+ * which is harmless for a model-less control.
+ */
+
+import type { DirectiveFactory, DirectiveFactoryReturn, LinkFn } from '@compiler/directive-types';
+import { asInstanceOf } from '@core/index';
+import type { ExceptionHandler } from '@exception-handler/index';
+
+import { inputTypeHandlers, textInputType, type InputTypeContext } from './input-types';
+import { NgModelControllerImpl } from './ng-model-controller';
+
+function asNgModelController(controllers: unknown): NgModelControllerImpl | null {
+  return controllers instanceof NgModelControllerImpl ? controllers : null;
+}
+
+/**
+ * Build the link fn shared by `input` and `textarea`. `forceTextHandler`
+ * forces the `text` handler regardless of `attrs.type` (used by
+ * `textarea`).
+ */
+function buildInputLink($exceptionHandler: ExceptionHandler, forceTextHandler: boolean): LinkFn {
+  return (scope, element, attrs, controllers) => {
+    const ctrl = asNgModelController(controllers);
+    if (ctrl === null) {
+      // No ng-model on this control — nothing to wire.
+      return;
+    }
+
+    // `element` is an Element on the public LinkFn surface; an `input` /
+    // `textarea` directive only matches those tags, so the runtime value
+    // is always an HTMLInputElement / HTMLTextAreaElement. The guard
+    // narrows to the `.value` surface the handlers consume, throwing
+    // loudly if the invariant is ever violated instead of casting.
+    const control = element instanceof HTMLTextAreaElement ? element : asInstanceOf(element, HTMLInputElement);
+
+    const typeAttr = attrs['type'];
+    const type = !forceTextHandler && typeof typeAttr === 'string' ? typeAttr.toLowerCase() : 'text';
+    const handler = forceTextHandler ? textInputType : (inputTypeHandlers[type] ?? textInputType);
+
+    const ctx: InputTypeContext = {
+      scope,
+      element: control,
+      attrs,
+      ctrl,
+      exceptionHandler: $exceptionHandler,
+    };
+    handler(ctx);
+  };
+}
+
+function inputFactory($exceptionHandler: ExceptionHandler): DirectiveFactoryReturn {
+  return {
+    restrict: 'E',
+    require: '?ngModel',
+    link: buildInputLink($exceptionHandler, false),
+  };
+}
+
+/**
+ * DI-annotated `input` directive. Injects `$exceptionHandler` so the
+ * input-type handlers can route native-listener throws through it.
+ */
+export const inputDirective: DirectiveFactory = ['$exceptionHandler', inputFactory];
+
+function textareaFactory($exceptionHandler: ExceptionHandler): DirectiveFactoryReturn {
+  return {
+    restrict: 'E',
+    require: '?ngModel',
+    link: buildInputLink($exceptionHandler, true),
+  };
+}
+
+/**
+ * DI-annotated `textarea` directive — delegates to the `text` handler.
+ */
+export const textareaDirective: DirectiveFactory = ['$exceptionHandler', textareaFactory];
diff --git a/src/forms/ng-list.ts b/src/forms/ng-list.ts
new file mode 100644
index 0000000..de87812
--- /dev/null
+++ b/src/forms/ng-list.ts
@@ -0,0 +1,132 @@
+/**
+ * `ngList` directive (spec 039 Slice 4 / FS §2.5,
+ * technical-considerations §2.5).
+ *
+ * `<input ng-model="tags" ng-list>` transforms a delimited string in the
+ * field into an **array** in the model (and back). It adds:
+ *
+ *  - a `$parser` (view → model) that splits the on-screen string on the
+ *    delimiter, trims each part, and drops empty trailing parts — so
+ *    `"a, b, c"` becomes `['a', 'b', 'c']`;
+ *  - a `$formatter` (model → view) that joins an array back into a
+ *    delimited string using the RAW attribute value as the separator
+ *    (AngularJS parity — `value.join(ngList)`; the default is `', '`).
+ *
+ * **Delimiter forms.** The `ng-list` attribute value is the delimiter; an
+ * absent / empty value defaults to `', '` (AngularJS parity). A plain
+ * string delimiter is trimmed for SPLITTING (so `ng-list=", "` and
+ * `ng-list=","` split alike, upstream parity) but joins with the raw
+ * value (`ng-list="|"` joins `'a|b'`, `ng-list=", "` joins `'a, b'`). A
+ * value wrapped in slashes (`/regex/`) is treated as a REGEXP delimiter
+ * for splitting (e.g. a `\s`-tolerant comma) — a project EXTENSION
+ * (upstream has no regexp form); the join then derives a literal
+ * separator from the source plus a trailing space.
+ *
+ * `require: 'ngModel'` — `ngList` only makes sense on an `ng-model`
+ * control. Registered on `ngModule` only (DI-only) — reachable via
+ * `injector.get('ngListDirective')`, NOT exported from the root barrel.
+ */
+
+import type { DirectiveFactory, DirectiveFactoryReturn, LinkFn } from '@compiler/directive-types';
+
+import { NgModelControllerImpl } from './ng-model-controller';
+
+export const NG_LIST_NAME = 'ngList';
+
+/**
+ * The resolved split/join delimiter behavior for an `ng-list` value.
+ * `split` is either a `RegExp` (from a `/…/` value) or a literal string;
+ * `join` is the separator inserted between array elements when formatting.
+ */
+interface ListDelimiter {
+  split: RegExp | string;
+  join: string;
+}
+
+/**
+ * Resolve the `ng-list` attribute value into split + join delimiters.
+ * A `/…/` value is a regexp split (the source between the slashes); the
+ * join uses the trimmed literal source plus a trailing space. A plain
+ * value is trimmed for splitting but joins RAW (AngularJS parity —
+ * `value.join(ngList)`); an absent / empty value defaults to `', '`.
+ */
+function resolveDelimiter(raw: unknown): ListDelimiter {
+  const value = typeof raw === 'string' ? raw : '';
+  const regexMatch = /^\s*\/(.*)\/\s*$/.exec(value);
+  if (regexMatch !== null && regexMatch[1] !== undefined) {
+    const source = regexMatch[1];
+    return { split: new RegExp(source), join: `${trimSeparatorForJoin(source)} ` };
+  }
+  const rawOrDefault = value.trim() === '' ? ', ' : value;
+  return { split: rawOrDefault.trim(), join: rawOrDefault };
+}
+
+/**
+ * Derive a human-friendly join separator from a regexp source. AngularJS
+ * joins on the literal delimiter, not the regexp; for the common
+ * `,\s*` / `\s*,\s*` sources we surface a bare `,`. Fallback: strip
+ * regexp whitespace tokens, else use `,`.
+ */
+function trimSeparatorForJoin(source: string): string {
+  const literal = source.replace(/\\s\*|\\s\+|\s/g, '');
+  return literal === '' ? ',' : literal;
+}
+
+function asNgModel(controllers: unknown): NgModelControllerImpl | null {
+  return controllers instanceof NgModelControllerImpl ? controllers : null;
+}
+
+function ngListFactory(): DirectiveFactoryReturn {
+  const link: LinkFn = (_scope, _element, attrs, controllers) => {
+    const ctrl = asNgModel(controllers);
+    if (ctrl === null) {
+      return;
+    }
+
+    const delimiter = resolveDelimiter(attrs[NG_LIST_NAME]);
+
+    // View → model: split, trim, drop empties → array. An empty view value
+    // yields `undefined` (an empty control has no list), matching upstream.
+    ctrl.$parsers.push((viewValue: unknown): unknown => {
+      // The listener feeds `element.value` (a string). A non-string /
+      // empty view value has no list to split — yields `undefined`.
+      if (typeof viewValue !== 'string' || viewValue === '') {
+        return undefined;
+      }
+      const parts = viewValue.split(delimiter.split);
+      const list: string[] = [];
+      for (const part of parts) {
+        const trimmed = part.trim();
+        if (trimmed !== '') {
+          list.push(trimmed);
+        }
+      }
+      return list;
+    });
+
+    // Model → view: join an array back into a delimited string. A
+    // non-array model renders as-is (a defensive pass-through).
+    ctrl.$formatters.push((modelValue: unknown): unknown => {
+      if (Array.isArray(modelValue)) {
+        return modelValue.join(delimiter.join);
+      }
+      return modelValue;
+    });
+
+    // An `ng-list` control is empty when its model is `undefined` / `null`
+    // or an empty array (drives `ng-empty` / `required`).
+    ctrl.$isEmpty = (value: unknown): boolean =>
+      value === undefined || value === null || (Array.isArray(value) && value.length === 0);
+  };
+
+  return {
+    restrict: 'A',
+    require: 'ngModel',
+    link,
+  };
+}
+
+/**
+ * DI-annotated `ngList` directive. Zero deps. Registered on `ngModule`.
+ */
+export const ngListDirective: DirectiveFactory = [ngListFactory];
diff --git a/src/forms/ng-model-controller.ts b/src/forms/ng-model-controller.ts
new file mode 100644
index 0000000..ed5b4f8
--- /dev/null
+++ b/src/forms/ng-model-controller.ts
@@ -0,0 +1,614 @@
+/**
+ * `NgModelController` — the per-control value pipeline + state engine
+ * (spec 039 Slice 1 / FS §2.1, §2.2, technical-considerations §2.2).
+ *
+ * Every `ng-model` control publishes one of these so collaborating
+ * directives (the `input` / `textarea` type handlers, built-in and custom
+ * validators, `ng-change`) can wire into the bidirectional value flow.
+ * The controller is instantiated by the compiler's per-element controller
+ * seam (the `ngModel` directive declares `controller: ...`), stashed on
+ * `$$ngControllers` under the name `ngModel`, and reachable from any
+ * directive that declares `require: 'ngModel'` / `require: '?ngModel'`.
+ *
+ * **The two transformation lists.**
+ *
+ *  - `$parsers` run view → model on every committed view change, in
+ *    REGISTRATION order. Each takes the prior stage's output and returns
+ *    the next; a parser returning `undefined` short-circuits the rest
+ *    (AngularJS parity — a failed parse yields `undefined` model).
+ *  - `$formatters` run model → view whenever the bound model changes, in
+ *    REVERSE registration order. The final string is what `$render` writes
+ *    to the DOM.
+ *
+ * **`$render` is directive-supplied.** The base controller installs a
+ * no-op; each input-type handler overrides it to write `$viewValue` to the
+ * actual DOM control. The model→view feedback guard (`$$lastCommittedViewValue`
+ * compare in the model `$watch`, owned by the `ngModel` directive) keeps
+ * `$render` from firing when the view already shows the value.
+ *
+ * **Validation (Slice 5).** `$setViewValue` and the model→view watch both
+ * route through `$$parseAndValidate` → `$$runValidators` (the engine lives
+ * in `validation.ts`): sync `$validators` first, then — only if all pass —
+ * async `$asyncValidators`, marking `$pending` + `ng-pending` until
+ * `$q.all(...)` settles. `$setValidity` is tri-state
+ * (`true` / `false` / `undefined` = pending); a monotonic
+ * `$$currentValidationRunId` cancels stale async passes. By default an
+ * invalid parse / failing validators keep the value OUT of the scope model
+ * (`$modelValue` → `undefined`); the `$$allowInvalid` seam (Slice 6's
+ * `ngModelOptions.allowInvalid`) flips that.
+ */
+
+import type { QService } from '@async/q-types';
+import type { Scope } from '@core/index';
+
+import type { Attributes } from '@compiler/directive-types';
+
+import { type FormController, nullFormCtrl } from './form-controller';
+import { defaultModelOptions, resolveDebounceDelay, type ModelOptions } from './ng-model-options';
+import {
+  clearValidationClass,
+  setEmptyClass,
+  setPendingClass,
+  setPristineClass,
+  setTouchedClass,
+  setValidationClass,
+  setValidClass,
+} from './state-classes';
+import { runValidators, type AsyncValidator, type SyncValidator } from './validation';
+
+/**
+ * A view → model transform. Receives the prior stage's output and returns
+ * the next-stage value. Returning `undefined` halts the chain (the parse
+ * is treated as failed and the model becomes `undefined`).
+ */
+export type ModelParser = (value: unknown) => unknown;
+
+/**
+ * A model → view transform. Receives the prior stage's output and returns
+ * the next. The final stage's output feeds `$render`.
+ */
+export type ModelFormatter = (value: unknown) => unknown;
+
+/**
+ * The public contract of the `ngModel` controller (AngularJS parity). The
+ * method/field names ARE the API; consumers type against this interface.
+ */
+export interface NgModelController {
+  /** Current on-screen value (after `$parsers` would run, the raw view input). */
+  $viewValue: unknown;
+  /** Current stored value (the value written back to the bound model). */
+  $modelValue: unknown;
+  /** View → model transforms, run in order on a committed view change. */
+  $parsers: ModelParser[];
+  /** Model → view transforms, run in reverse on a model change. */
+  $formatters: ModelFormatter[];
+  /**
+   * Synchronous validation rules keyed by rule name — each returns truthy
+   * for valid. Run on every committed view change and every model change
+   * (Slice 5). A failing rule surfaces `ng-invalid-<name>` + `$error[name]`.
+   */
+  $validators: Record<string, SyncValidator>;
+  /**
+   * Asynchronous validation rules keyed by rule name — each returns a
+   * promise that resolves for valid / rejects for invalid (Slice 5). Run
+   * ONLY after every sync validator passes; while outstanding the control
+   * reports `$pending[name]` + `ng-pending` and the model is not written.
+   */
+  $asyncValidators: Record<string, AsyncValidator>;
+  /** Callbacks fired after a committed view change (backs `ng-change`). */
+  $viewChangeListeners: (() => void)[];
+  /** Failing-rule map — `$error[key] === true` while rule `key` fails. */
+  $error: Record<string, boolean>;
+  /** Outstanding-async-rule map — `$pending[key] === true` while async rule `key` is in flight (Slice 5). */
+  $pending: Record<string, boolean> | undefined;
+  /** The element has been changed by the user. */
+  $dirty: boolean;
+  /** The element has not been changed by the user. */
+  $pristine: boolean;
+  /** The element has been visited (focus then blur). */
+  $touched: boolean;
+  /** The element has not been visited. */
+  $untouched: boolean;
+  /** No failing rules. */
+  $valid: boolean;
+  /** At least one failing rule. */
+  $invalid: boolean;
+  /** The control's name (from the `name` attribute), if any. */
+  $name: string | undefined;
+  /**
+   * The resolved {@link ModelOptions} for this control (spec 039 Slice 6) —
+   * the effective `ngModelOptions` after inheritance. Defaults to
+   * {@link defaultModelOptions} (every option unset) until `ngModel`'s link
+   * re-points it from the enclosing `ngModelOptions` (resolved by walking the
+   * element's `$$ngControllers` stash).
+   */
+  $options: ModelOptions;
+  /** Directive-supplied DOM writer — pushes `$viewValue` to the control. */
+  $render: () => void;
+  /** Overridable emptiness test — drives `ng-empty` / `required`. */
+  $isEmpty: (value: unknown) => boolean;
+  /**
+   * Entry point from the control: a new on-screen value runs the
+   * `$parsers`, writes the model (via the directive-installed callback),
+   * marks the control dirty, and fires `$viewChangeListeners`.
+   */
+  $setViewValue: (value: unknown, trigger?: string) => void;
+  /**
+   * Flush the buffered (debounce / `updateOn`) view value — commits the
+   * current `$viewValue` through the pipeline immediately, cancelling any
+   * pending debounce timer (spec 039 Slice 6). A no-op when the buffered
+   * value already matches the last commit.
+   */
+  $commitViewValue: () => void;
+  /** Revert a buffered (uncommitted) view value back to the last committed one. */
+  $rollbackViewValue: () => void;
+  /**
+   * Re-run every validator against the current model / view value (Slice 5)
+   * — the programmatic re-validation entry point. Built-in validator
+   * directives call it from their `$observe` when a bound parameter changes.
+   */
+  $validate: () => void;
+  /**
+   * Set a single rule's validity — `true` (valid), `false` (invalid), or
+   * `undefined` (async pending). Updates `$error` / `$pending` + the
+   * per-rule class + aggregate validity, and bubbles to the enclosing form.
+   */
+  $setValidity: (key: string, isValid: boolean | undefined) => void;
+  /** Mark the control pristine (and untouched? no — pristine only). */
+  $setPristine: () => void;
+  /** Mark the control dirty. */
+  $setDirty: () => void;
+  /** Mark the control touched. */
+  $setTouched: () => void;
+  /** Mark the control untouched. */
+  $setUntouched: () => void;
+}
+
+/**
+ * Default emptiness test — AngularJS parity. A value is empty when it is
+ * `undefined`, `null`, `''`, `NaN`, or `false`. Input-type handlers
+ * override this (e.g. checkbox: empty when not checked).
+ */
+function defaultIsEmpty(value: unknown): boolean {
+  return value === undefined || value === null || value === '' || (typeof value === 'number' && Number.isNaN(value));
+}
+
+/**
+ * Remove `key` from a string-keyed boolean map if present. Used by
+ * `$setValidity` to keep the `$error` / `$$success` / `$pending` maps
+ * mutually exclusive per key.
+ */
+function unsetMapKey(map: Record<string, boolean>, key: string): void {
+  if (key in map) {
+    // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- these validity maps expose only live entries (AngularJS parity); clearing a key removes it entirely so `Object.keys(...)` reflects the current failing / pending / passing set.
+    delete map[key];
+  }
+}
+
+/**
+ * Concrete implementation. Constructed by the compiler's controller seam
+ * with element-locals `{ $scope, $element, $attrs }`; the `ngModel`
+ * directive's link fn (via `require: 'ngModel'`) installs the model
+ * write-back + watch and overrides `$render` through the input-type
+ * handler.
+ *
+ * `$$setModelValue` is the directive-installed write-back hook — the
+ * controller calls it from `$setViewValue` to push the parsed value onto
+ * the bound scope expression. Until `ngModel`'s link runs it is a no-op
+ * (so a controller constructed in isolation does not throw).
+ */
+export class NgModelControllerImpl implements NgModelController {
+  $viewValue: unknown = Number.NaN;
+  $modelValue: unknown = Number.NaN;
+  $parsers: ModelParser[] = [];
+  $formatters: ModelFormatter[] = [];
+  $validators: Record<string, SyncValidator> = {};
+  $asyncValidators: Record<string, AsyncValidator> = {};
+  $viewChangeListeners: (() => void)[] = [];
+  $error: Record<string, boolean> = {};
+  $$success: Record<string, boolean> = {};
+  $pending: Record<string, boolean> | undefined = undefined;
+  $dirty = false;
+  $pristine = true;
+  $touched = false;
+  $untouched = true;
+  $valid = true;
+  $invalid = false;
+  $name: string | undefined;
+  $options: ModelOptions = defaultModelOptions;
+  $render: () => void = () => {
+    /* directive-supplied; no-op until an input-type handler overrides it */
+  };
+  $isEmpty: (value: unknown) => boolean = defaultIsEmpty;
+
+  /**
+   * Directive-installed model write-back hook. Set by `ngModel`'s link fn
+   * to push a parsed value onto the bound scope expression via
+   * `buildParentWriter`. No-op until then.
+   *
+   * @internal Consumed only by this controller + the `ngModel` directive.
+   */
+  $$writeModelToScope: (value: unknown) => void = () => {
+    /* installed by ngModel link */
+  };
+
+  /**
+   * The last view value committed to the model. Owned by this controller
+   * but consulted by `ngModel`'s model `$watch` to implement the
+   * model→view feedback guard ($render only on divergence).
+   *
+   * @internal
+   */
+  $$lastCommittedViewValue: unknown = Number.NaN;
+
+  /**
+   * The enclosing form (spec 039 Slice 2). Defaults to {@link nullFormCtrl}
+   * so a form-less `ngModel` needs no null-check; `ngModel`'s link
+   * re-points it to the resolved `require: '?^^form'` form and registers
+   * this control with it. Every per-rule `$setValidity` bubbles up to the
+   * form so the form's aggregate reflects this control's validity; the
+   * first user change bubbles `$setDirty`.
+   *
+   * @internal
+   */
+  $$parentForm: FormController = nullFormCtrl;
+
+  /**
+   * The last raw parsed model value BEFORE the invalid → `undefined`
+   * substitution — `$validate()` re-runs validators against this so a
+   * programmatic re-validation sees the real value, not the `undefined`
+   * that a prior invalid pass wrote to the scope model.
+   *
+   * @internal
+   */
+  $$rawModelValue: unknown = Number.NaN;
+
+  /**
+   * The `$parsers` chain outcome for the last commit: `true` (produced a
+   * value), `false` (a parser returned `undefined` — bad parse), or
+   * `undefined` (nothing to parse). Drives the `parse` validity key.
+   *
+   * @internal
+   */
+  $$parserValid: boolean | undefined = undefined;
+
+  /**
+   * Monotonic validation-pass id — bumped by `$$runValidators` so a stale
+   * async settle can be detected and dropped (spec 039 Slice 5).
+   *
+   * @internal
+   */
+  $$currentValidationRunId = 0;
+
+  /**
+   * When `true`, an invalid parse / failing validators STILL write the
+   * value to the scope model (the `ngModelOptions.allowInvalid` behavior).
+   * Defaults to `false` — invalid values are kept out of the model
+   * (`undefined`). Slice 6's `ngModelOptions` directive flips this seam; it
+   * lives here now so the validation engine has a single branch to gate on.
+   *
+   * @internal
+   */
+  $$allowInvalid = false;
+
+  /**
+   * The `$q` service, used by the async-validator engine. Element-locals
+   * on the controller seam do not include `$q`, so `ngModel`'s controller
+   * annotation injects it and hands it in.
+   *
+   * @internal
+   */
+  readonly $$q: QService;
+
+  /**
+   * Resolved timezone offset for the date/time input handlers (spec 039
+   * Slice 6). `undefined` = the host's local timezone (Slice 3 behavior);
+   * `ngModel`'s link sets it from `$options.getOption('timezone')`. The date
+   * handlers read it lazily at parse/format time so a config-time swap takes
+   * effect. Minutes east of UTC, or `undefined` for local.
+   *
+   * @internal
+   */
+  $$timezone: number | undefined = undefined;
+
+  /**
+   * Deferred-timer seam backing `ngModelOptions.debounce` (spec 039 Slice 6).
+   * `ngModel`'s link binds it to `$timeout` so a debounced commit runs
+   * `$$phase`-guarded inside a digest and cancels cleanly on `$destroy` /
+   * supersession. Until then it fires the callback synchronously (no
+   * debounce), so a controller constructed in isolation still commits.
+   *
+   * @internal
+   */
+  $$scheduleCommit: (fn: () => void, delay: number) => unknown = (fn) => {
+    fn();
+    return undefined;
+  };
+
+  /** Cancel a pending debounce timer. Paired with {@link $$scheduleCommit}. @internal */
+  $$cancelScheduledCommit: (handle: unknown) => void = () => {
+    /* no-op until ngModel binds $timeout.cancel */
+  };
+
+  /** The handle of the currently-pending debounce timer, if any. @internal */
+  $$pendingCommitTimer: unknown = undefined;
+
+  private readonly scope: Scope;
+  private readonly element: Element;
+
+  /** The DOM element — exposed to the validation engine for `ng-pending`. */
+  get $$element(): Element {
+    return this.element;
+  }
+
+  constructor(scope: Scope, element: Element, attrs: Attributes, $q: QService) {
+    this.scope = scope;
+    this.element = element;
+    this.$$q = $q;
+    const name = attrs['name'];
+    this.$name = typeof name === 'string' ? name : undefined;
+
+    // Initialize the state classes to the fresh-control defaults:
+    // valid + pristine + untouched. Empty/not-empty is set by the first
+    // formatter run (ngModel link).
+    setValidClass(this.element, true);
+    setPristineClass(this.element, true);
+    setTouchedClass(this.element, true);
+  }
+
+  $isEmptyClassUpdate(value: unknown): void {
+    setEmptyClass(this.element, this.$isEmpty(value));
+  }
+
+  $setViewValue(value: unknown, trigger = 'default'): void {
+    this.$viewValue = value;
+    this.$$debounceViewValueCommit(trigger);
+  }
+
+  /**
+   * @internal Decide whether the current `$viewValue` commits immediately or
+   * after a debounce delay (spec 039 Slice 6). A superseding change cancels
+   * the previous pending timer (the timer seam is `$timeout`, so cancelling
+   * is a clean no-op on an already-fired handle). A zero / absent delay
+   * commits synchronously via {@link $commitViewValue}.
+   */
+  $$debounceViewValueCommit(trigger: string): void {
+    const delay = resolveDebounceDelay(this.$options, trigger);
+
+    // Cancel any pending commit — a new keystroke resets the debounce window.
+    if (this.$$pendingCommitTimer !== undefined) {
+      this.$$cancelScheduledCommit(this.$$pendingCommitTimer);
+      this.$$pendingCommitTimer = undefined;
+    }
+
+    if (delay > 0) {
+      this.$$pendingCommitTimer = this.$$scheduleCommit(() => {
+        this.$$pendingCommitTimer = undefined;
+        this.$commitViewValue();
+      }, delay);
+      return;
+    }
+
+    this.$commitViewValue();
+  }
+
+  /**
+   * @internal Run the `$parsers` chain then validate, honoring `allowInvalid`.
+   *
+   * The parse chain sets `$$parserValid` (`false` when a parser returned
+   * `undefined`); the raw parsed value is stashed on `$$rawModelValue` so
+   * `$validate()` can re-run against it. On a valid pass (or with
+   * `allowInvalid`) the value is written to the scope model and the
+   * view-change listeners fire — but only when the model actually changed
+   * (the feedback guard on the model watch then keeps `$render` from
+   * clobbering a live keystroke).
+   */
+  $$parseAndValidate(): void {
+    const viewValue = this.$$lastCommittedViewValue;
+    let modelValue: unknown = viewValue;
+
+    // Run the parsers view → model in registration order. A parser
+    // returning `undefined` halts the chain (failed parse), matching
+    // AngularJS — the `parse` validity key then fails and every other
+    // validator is skipped.
+    this.$$parserValid = modelValue === undefined ? undefined : true;
+    if (this.$$parserValid === true) {
+      for (const parser of this.$parsers) {
+        modelValue = parser(modelValue);
+        if (modelValue === undefined) {
+          this.$$parserValid = false;
+          break;
+        }
+      }
+    }
+
+    const prevModelValue = this.$modelValue;
+    this.$$rawModelValue = modelValue;
+
+    const writeIfChanged = (): void => {
+      if (this.$modelValue !== prevModelValue) {
+        this.$$writeModelToScope(this.$modelValue);
+        this.$$fireViewChangeListeners();
+      }
+    };
+
+    if (this.$$allowInvalid) {
+      // Write the (possibly invalid) value up front; validators still run
+      // and toggle validity, but the model is not withheld.
+      this.$modelValue = modelValue;
+      writeIfChanged();
+    }
+
+    this.$$runValidators(modelValue, viewValue, this.$$parserValid, (allValid) => {
+      if (!this.$$allowInvalid) {
+        this.$modelValue = allValid ? modelValue : undefined;
+        writeIfChanged();
+      }
+    });
+  }
+
+  /**
+   * @internal Delegate to the validation engine (`validation.ts`). Split
+   * out so the engine's sync-before-async ordering + stale-pass
+   * cancellation can be reasoned about independently of the pipeline.
+   */
+  $$runValidators(
+    modelValue: unknown,
+    viewValue: unknown,
+    parserValid: boolean | undefined,
+    doneCallback: (allValid: boolean) => void,
+  ): void {
+    runValidators(this, modelValue, viewValue, parserValid, doneCallback);
+  }
+
+  $validate(): void {
+    // NaN model means "never set" (the fresh-control sentinel) — nothing to
+    // validate yet (AngularJS parity).
+    if (typeof this.$modelValue === 'number' && Number.isNaN(this.$modelValue)) {
+      return;
+    }
+    const viewValue = this.$$lastCommittedViewValue;
+    const modelValue = this.$$rawModelValue;
+    const prevValid = this.$valid;
+    const prevModelValue = this.$modelValue;
+
+    this.$$runValidators(modelValue, viewValue, this.$$parserValid, (allValid) => {
+      if (!this.$$allowInvalid && prevValid !== allValid) {
+        this.$modelValue = allValid ? modelValue : undefined;
+        if (this.$modelValue !== prevModelValue) {
+          this.$$writeModelToScope(this.$modelValue);
+        }
+      }
+    });
+  }
+
+  /** @internal Fire every registered view-change listener (backs `ng-change`). */
+  $$fireViewChangeListeners(): void {
+    for (const listener of this.$viewChangeListeners) {
+      listener();
+    }
+  }
+
+  $commitViewValue(): void {
+    // Flush any pending debounce timer — an explicit commit (e.g. `blur` with
+    // `{ blur: 0 }`, or a programmatic `$commitViewValue()`) supersedes it.
+    if (this.$$pendingCommitTimer !== undefined) {
+      this.$$cancelScheduledCommit(this.$$pendingCommitTimer);
+      this.$$pendingCommitTimer = undefined;
+    }
+
+    const viewValue = this.$viewValue;
+    // No-op when the buffered view value already matches the last commit
+    // (AngularJS parity — a re-commit of the same value does nothing). The
+    // `viewValue === ''` exception mirrors AngularJS's `$$hasNativeValidators`
+    // clause: an empty commit still runs so a typed control (`number` /
+    // `date`) re-reads its native `validity.badInput` — the browser reports
+    // `value === ''` when it could not sanitize the raw input, so a re-commit
+    // of `''` is the only signal that the garbage input is still present.
+    if (this.$$lastCommittedViewValue === viewValue && viewValue !== '') {
+      return;
+    }
+
+    this.$$lastCommittedViewValue = viewValue;
+
+    if (this.$pristine) {
+      this.$setDirty();
+    }
+
+    this.$isEmptyClassUpdate(viewValue);
+
+    this.$$parseAndValidate();
+  }
+
+  $rollbackViewValue(): void {
+    // Discard the buffered (uncommitted) view value and re-render the last
+    // committed one. Cancels any pending debounce timer.
+    if (this.$$pendingCommitTimer !== undefined) {
+      this.$$cancelScheduledCommit(this.$$pendingCommitTimer);
+      this.$$pendingCommitTimer = undefined;
+    }
+    this.$viewValue = this.$$lastCommittedViewValue;
+    this.$render();
+  }
+
+  $setValidity(key: string, isValid: boolean | undefined): void {
+    // Tri-state (AngularJS `addSetValidityMethod` parity):
+    //   true      → success  (clear $error + $pending for the key)
+    //   false     → failure  (record in $error; clear $$success + $pending)
+    //   undefined → pending  (record in $pending; clear $error + $$success)
+    // The three maps are always mutually exclusive per key.
+    unsetMapKey(this.$error, key);
+    unsetMapKey(this.$$success, key);
+    if (this.$pending !== undefined) {
+      unsetMapKey(this.$pending, key);
+    }
+
+    if (isValid === undefined) {
+      // Pending — lazily create the $pending map on first async rule.
+      this.$pending ??= {};
+      this.$pending[key] = true;
+    } else if (isValid) {
+      this.$$success[key] = true;
+    } else {
+      this.$error[key] = true;
+    }
+
+    // Drop an emptied $pending map back to `undefined` (AngularJS parity —
+    // `$pending` is `undefined`, not `{}`, when no async rule is in flight).
+    if (this.$pending !== undefined && Object.keys(this.$pending).length === 0) {
+      this.$pending = undefined;
+    }
+
+    // Per-rule class: `ng-valid-<key>` when success, `ng-invalid-<key>` when
+    // failure. A pending key is neutral — remove BOTH per-rule classes so it
+    // reads as neither valid nor invalid while the async rule settles.
+    if (isValid === undefined) {
+      clearValidationClass(this.element, key);
+    } else {
+      setValidationClass(this.element, key, isValid);
+    }
+
+    // Aggregate: invalid iff any $error key; valid iff no $error AND no
+    // $pending key (a pending control is neither valid nor invalid).
+    const anyInvalid = Object.keys(this.$error).length > 0;
+    const anyPending = this.$pending !== undefined;
+    this.$valid = !anyInvalid && !anyPending;
+    this.$invalid = anyInvalid;
+    setValidClass(this.element, !anyInvalid);
+    setPendingClass(this.element, anyPending);
+
+    // Bubble this control's per-key tri-state into the enclosing form so
+    // the form's aggregate `$error` / `$pending` / `$valid` reflects it
+    // (`undefined` marks the key pending on the form too — AngularJS
+    // parity). A form-less control's `$$parentForm` is `nullFormCtrl`
+    // (no-op).
+    this.$$parentForm.$setValidity(key, isValid, this);
+  }
+
+  $setPristine(): void {
+    this.$dirty = false;
+    this.$pristine = true;
+    setPristineClass(this.element, true);
+  }
+
+  $setDirty(): void {
+    this.$dirty = true;
+    this.$pristine = false;
+    setPristineClass(this.element, false);
+    // The first user change bubbles up so the enclosing form (and its
+    // ancestors) become dirty too.
+    this.$$parentForm.$setDirty();
+  }
+
+  $setTouched(): void {
+    this.$touched = true;
+    this.$untouched = false;
+    setTouchedClass(this.element, false);
+  }
+
+  $setUntouched(): void {
+    this.$touched = false;
+    this.$untouched = true;
+    setTouchedClass(this.element, true);
+  }
+}
diff --git a/src/forms/ng-model-options.ts b/src/forms/ng-model-options.ts
new file mode 100644
index 0000000..e03d856
--- /dev/null
+++ b/src/forms/ng-model-options.ts
@@ -0,0 +1,320 @@
+/**
+ * `ngModelOptions` directive + the resolved-options helper (spec 039
+ * Slice 6 / FS §2.5, technical-considerations §2.2, §2.4).
+ *
+ * `ng-model-options="{ … }"` tunes HOW and WHEN an enclosing / descendant
+ * `ng-model` commits its view value and reads/writes its bound model. The
+ * five parity options threaded through {@link NgModelControllerImpl}:
+ *
+ *  - **`updateOn`** — a space-separated list of DOM events that COMMIT the
+ *    view value (replacing the hard-coded `input change`). The pseudo-event
+ *    `default` stands for the input-type handler's OWN default events. Other
+ *    events still BUFFER the pending view value (AngularJS `$$updateEvents`)
+ *    so a later `default`-triggered commit picks up the latest text.
+ *  - **`debounce`** — a number (ms) or per-event map (`{ default: 300,
+ *    blur: 0 }`) delaying the commit; a superseding change resets the timer,
+ *    and pending timers are cleared on `$destroy`.
+ *  - **`allowInvalid`** — flips the controller's `$$allowInvalid` seam so an
+ *    invalid parse / failing validators still write the value to the model.
+ *  - **`getterSetter`** — treats the `ng-model` expression as a FUNCTION used
+ *    both to read (`fn()`) and write (`fn(value)`) the model.
+ *  - **`timezone`** — a resolved offset threaded into the date/time input
+ *    parse + format so date controls interpret / display in that zone.
+ *
+ * **Inheritance (AngularJS parity).** A nested `ngModelOptions` inherits its
+ * ancestor's options unless the special key `'*'` appears in `updateOn`,
+ * which resets inheritance (the child starts from bare defaults). The
+ * resolved {@link ModelOptions} object exposes `getOption(name)` — the single
+ * read surface `ngModel` / the input handlers consult.
+ *
+ * **Wiring.** The directive publishes a resolved {@link ModelOptions} as a
+ * controller under the `ngModelOptions` key (via {@link stashController}) in
+ * its PRE-link, so a descendant `ngModel`'s `require: '?^^ngModelOptions'`
+ * ancestor walk resolves it before the control links. A control WITHOUT an
+ * enclosing `ngModelOptions` uses {@link defaultModelOptions}.
+ *
+ * Registered on `ngModule` only (DI-only, the built-in-directive precedent)
+ * — reachable via `injector.get('ngModelOptionsDirective')`, NOT exported
+ * from the root barrel.
+ */
+
+import type { Scope } from '@core/index';
+
+import { stashController } from '@compiler/element-slots';
+import type { Attributes, DirectiveFactory, DirectiveFactoryReturn, LinkFn } from '@compiler/directive-types';
+import type { ControllerInvokable } from '@controller/controller-types';
+import { parse } from '@parser/index';
+
+export const NG_MODEL_OPTIONS_NAME = 'ngModelOptions';
+/** The `$$ngControllers` key `ngModelOptions` publishes its resolved options under. */
+export const NG_MODEL_OPTIONS_KEY = 'ngModelOptions';
+
+/**
+ * The recognized `ngModelOptions` keys (AngularJS parity — the full spec-039
+ * set). `updateOn` / `debounce` are consumed by the input-type event wiring;
+ * `allowInvalid` / `getterSetter` / `timezone` by the controller / date
+ * handlers.
+ */
+export interface NgModelOptions {
+  /**
+   * Space-separated DOM events that commit the view value. `default` is a
+   * pseudo-event meaning the input handler's own default events; `'*'` (as a
+   * lone token) resets inheritance from an ancestor `ngModelOptions`.
+   */
+  updateOn?: string;
+  /** A number (ms) or a per-event map (`{ default: 300, blur: 0 }`) delaying the commit. */
+  debounce?: number | Record<string, number>;
+  /** When `true`, invalid values are still written to the model. */
+  allowInvalid?: boolean;
+  /** When `true`, the `ng-model` expression is a read/write function. */
+  getterSetter?: boolean;
+  /** A timezone string (`'UTC'`, `'+0500'`, …) for date/time controls. */
+  timezone?: string;
+}
+
+/**
+ * The resolved options object a control reads through. `getOption(name)`
+ * returns the effective value for a key (after inheritance). `$$updateEvents`
+ * is the parsed `updateOn` event list with the `default` pseudo-event
+ * expanded away (`default` is dropped — the input handler supplies its own
+ * default events); an empty list means "commit on the handler's default
+ * events only".
+ */
+export interface ModelOptions {
+  /** Read the effective value of an option key (post-inheritance). */
+  getOption<K extends keyof NgModelOptions>(name: K): NgModelOptions[K];
+  /**
+   * The concrete, non-`default` events from `updateOn`. When `default` was
+   * present (or `updateOn` was absent) the input handler's OWN default events
+   * ALSO commit; when `default` was absent only these events commit.
+   */
+  readonly $$updateEvents: readonly string[];
+  /** Whether `updateOn` contained the `default` pseudo-event (or was absent). */
+  readonly $$hasDefaultUpdateEvent: boolean;
+}
+
+/**
+ * A mutable {@link ModelOptions} whose resolution can be re-applied in place.
+ * The `ngModelOptions` directive returns ONE of these from its controller
+ * factory and mutates it in pre-link once the inherited parent is known — so
+ * a descendant `ngModel` that captured the controller reference at require
+ * resolution always reads the fully-inherited options (the reference is
+ * stable; only the internal resolution changes).
+ *
+ * @internal
+ */
+export interface MutableModelOptions extends ModelOptions {
+  /** Re-apply resolution from a raw options record + optional parent (mutates in place). */
+  $$reresolve(raw: NgModelOptions, parent?: ModelOptions): void;
+}
+
+/**
+ * Split a raw `updateOn` string into a distinct event list, dropping the
+ * `default` and `'*'` sentinels (they are handled separately by the resolver
+ * / the inheritance reset).
+ */
+function parseUpdateEvents(raw: string | undefined): { events: string[]; hasDefault: boolean } {
+  if (raw === undefined || raw.trim() === '') {
+    return { events: [], hasDefault: true };
+  }
+  const tokens = raw.split(/\s+/).filter((t) => t !== '');
+  const events: string[] = [];
+  let hasDefault = false;
+  for (const token of tokens) {
+    if (token === 'default') {
+      hasDefault = true;
+    } else if (token === '*') {
+      // '*' is the inheritance-reset marker, not a real event — ignore here.
+    } else if (!events.includes(token)) {
+      events.push(token);
+    }
+  }
+  // A lone `'*'` (no real events, no `default`) resets inheritance and
+  // falls back to the handler's default events — otherwise NOTHING would
+  // ever commit the view value and the control would be read-only.
+  if (!hasDefault && events.length === 0) {
+    hasDefault = true;
+  }
+  return { events, hasDefault };
+}
+
+/**
+ * Build a {@link ModelOptions} from a raw {@link NgModelOptions} record and an
+ * optional parent to inherit from. A raw `updateOn` containing the lone `'*'`
+ * token resets inheritance (the child ignores the parent's options entirely).
+ */
+export function createModelOptions(raw: NgModelOptions, parent?: ModelOptions): ModelOptions {
+  const rawUpdateOn = raw.updateOn;
+  const resetsInheritance = typeof rawUpdateOn === 'string' && /(^|\s)\*(\s|$)/.test(rawUpdateOn);
+  const effectiveParent = resetsInheritance ? undefined : parent;
+
+  // Merge: own keys win; absent own keys fall back to the parent's effective
+  // value (AngularJS `defaults(options, parentOptions.$$options)`).
+  const merged: NgModelOptions = { ...raw };
+  if (effectiveParent !== undefined) {
+    if (merged.updateOn === undefined) {
+      merged.updateOn = effectiveParent.getOption('updateOn');
+    }
+    if (merged.debounce === undefined) {
+      merged.debounce = effectiveParent.getOption('debounce');
+    }
+    if (merged.allowInvalid === undefined) {
+      merged.allowInvalid = effectiveParent.getOption('allowInvalid');
+    }
+    if (merged.getterSetter === undefined) {
+      merged.getterSetter = effectiveParent.getOption('getterSetter');
+    }
+    if (merged.timezone === undefined) {
+      merged.timezone = effectiveParent.getOption('timezone');
+    }
+  }
+
+  const { events, hasDefault } = parseUpdateEvents(merged.updateOn);
+
+  return {
+    getOption<K extends keyof NgModelOptions>(name: K): NgModelOptions[K] {
+      return merged[name];
+    },
+    $$updateEvents: events,
+    $$hasDefaultUpdateEvent: hasDefault,
+  };
+}
+
+/**
+ * Build a {@link MutableModelOptions} that can be re-resolved in place (see
+ * the interface doc for why the stable reference matters). Starts from a
+ * bare (uninherited) resolution; `$$reresolve` re-computes the merge.
+ */
+export function createMutableModelOptions(raw: NgModelOptions): MutableModelOptions {
+  let resolved = createModelOptions(raw);
+  const holder: MutableModelOptions = {
+    getOption<K extends keyof NgModelOptions>(name: K): NgModelOptions[K] {
+      return resolved.getOption(name);
+    },
+    get $$updateEvents(): readonly string[] {
+      return resolved.$$updateEvents;
+    },
+    get $$hasDefaultUpdateEvent(): boolean {
+      return resolved.$$hasDefaultUpdateEvent;
+    },
+    $$reresolve(nextRaw: NgModelOptions, parent?: ModelOptions): void {
+      resolved = createModelOptions(nextRaw, parent);
+    },
+  };
+  return holder;
+}
+
+/**
+ * The default options a control uses when there is no enclosing
+ * `ngModelOptions` — every option unset, so `updateOn` falls back to the
+ * input handler's default events, no debounce, invalid values withheld,
+ * plain assignable model, local timezone.
+ */
+export const defaultModelOptions: ModelOptions = createModelOptions({});
+
+/**
+ * Resolve the debounce delay (ms) for a committing `trigger` event from a
+ * {@link ModelOptions}. A numeric `debounce` applies to every trigger; a map
+ * looks up the trigger, falling back to the `default` key, else `0`. An
+ * absent / non-finite value is `0` (commit immediately).
+ */
+export function resolveDebounceDelay(options: ModelOptions, trigger: string): number {
+  const debounce = options.getOption('debounce');
+  if (typeof debounce === 'number') {
+    return Number.isFinite(debounce) ? debounce : 0;
+  }
+  if (debounce !== undefined && typeof debounce === 'object') {
+    const forTrigger = debounce[trigger];
+    if (typeof forTrigger === 'number' && Number.isFinite(forTrigger)) {
+      return forTrigger;
+    }
+    const forDefault = debounce['default'];
+    if (typeof forDefault === 'number' && Number.isFinite(forDefault)) {
+      return forDefault;
+    }
+  }
+  return 0;
+}
+
+/**
+ * Narrow the resolved parent-options require slot to a {@link ModelOptions}.
+ * `require: '?^^ngModelOptions'` yields `null` on a miss (top-level options);
+ * anything that is not a live options object falls back to `undefined` (no
+ * parent).
+ */
+function asParentOptions(candidate: unknown): ModelOptions | undefined {
+  if (candidate !== null && typeof candidate === 'object' && '$$updateEvents' in candidate) {
+    return candidate as ModelOptions;
+  }
+  return undefined;
+}
+
+/**
+ * Read the resolved options from the `ngModelOptions` require tuple's 2nd
+ * slot (`require: ['ngModelOptions', '?^^ngModelOptions']`).
+ */
+function readParentOptions(controllers: unknown): ModelOptions | undefined {
+  if (Array.isArray(controllers)) {
+    return asParentOptions(controllers[1]);
+  }
+  return undefined;
+}
+
+/** Evaluate the raw `ng-model-options` attribute expression to a record. */
+function evalOptionsAttr(scope: Scope, attrs: Attributes): NgModelOptions {
+  const raw = attrs[NG_MODEL_OPTIONS_NAME];
+  if (typeof raw === 'string' && raw.trim() !== '') {
+    const value = parse(raw)(scope as unknown as Record<string, unknown>);
+    if (value !== null && typeof value === 'object') {
+      return value as NgModelOptions;
+    }
+  }
+  return {};
+}
+
+function ngModelOptionsFactory(): DirectiveFactoryReturn {
+  // The controller IS a MUTABLE resolved ModelOptions (see
+  // `createMutableModelOptions`). It starts as a bare (uninherited) resolution
+  // and is RE-RESOLVED in place in pre-link once the parent require resolves —
+  // so a descendant `ngModel` that captured this controller reference at
+  // require-resolution time always reads the fully-inherited options.
+  const controller: ControllerInvokable = [
+    '$scope',
+    '$attrs',
+    (...args: unknown[]): MutableModelOptions =>
+      createMutableModelOptions(evalOptionsAttr(args[0] as Scope, args[1] as Attributes)),
+  ];
+
+  const preLink: LinkFn = (scope, element, attrs, controllers) => {
+    const ownCandidate: unknown = Array.isArray(controllers) ? controllers[0] : controllers;
+    if (ownCandidate === null || typeof ownCandidate !== 'object' || !('$$reresolve' in ownCandidate)) {
+      return;
+    }
+    const own = ownCandidate as MutableModelOptions;
+    // Re-resolve WITH the inherited parent options (mutating the stable
+    // controller reference in place). Publish the resolved options under the
+    // shared `ngModelOptions` key via `stashController` so a descendant
+    // `ngModel` — which walks the `$$ngControllers` stash directly at link
+    // time (see `readEnclosingOptions` in `ng-model.ts`) — reads the
+    // fully-inherited options for both same-element and ancestor cases.
+    const parent = readParentOptions(controllers);
+    own.$$reresolve(evalOptionsAttr(scope, attrs), parent);
+    stashController(element, NG_MODEL_OPTIONS_KEY, own);
+  };
+
+  return {
+    restrict: 'A',
+    // `['ngModelOptions', '?^^ngModelOptions']` — own controller + optional
+    // ANCESTOR options to inherit from (`^^` skips own element so a directive
+    // does not inherit from itself).
+    require: [NG_MODEL_OPTIONS_NAME, '?^^ngModelOptions'],
+    controller,
+    link: { pre: preLink },
+  };
+}
+
+/**
+ * DI-annotated `ngModelOptions` factory. No injected deps — the options are
+ * evaluated from the element's own attribute against the linked scope.
+ */
+export const ngModelOptionsDirective: DirectiveFactory = [ngModelOptionsFactory];
diff --git a/src/forms/ng-model.ts b/src/forms/ng-model.ts
new file mode 100644
index 0000000..6e37ea1
--- /dev/null
+++ b/src/forms/ng-model.ts
@@ -0,0 +1,367 @@
+/**
+ * `ngModel` + `ngChange` directives (spec 039 Slice 1 / FS §2.1, §2.5,
+ * technical-considerations §2.2).
+ *
+ * **`ngModel`** is the two-way binding directive. It:
+ *
+ *  1. Declares a `controller` ({@link NgModelControllerImpl}) so the
+ *     compiler's per-element seam instantiates it with element-locals
+ *     `{ $scope, $element, $attrs }` and stashes it on `$$ngControllers`
+ *     under the name `ngModel` — which is exactly what
+ *     `require: 'ngModel'` / `require: '?ngModel'` reads.
+ *  2. Declares `require: 'ngModel'` so its OWN link fn receives the
+ *     controller as the 4th argument.
+ *  3. Parses the model expression and builds a parent-side write-back via
+ *     {@link buildParentWriter} (`@compiler/expression-assign` — the same
+ *     machinery the `=` isolate binding uses, so dotted paths
+ *     auto-create their intermediates). A non-assignable model
+ *     (`ng-model="a + b"`, `ng-model="fn()"`) routes
+ *     {@link NgModelNonAssignableError} via `$exceptionHandler('$compile')`.
+ *  4. Installs `scope.$watch(modelExpr, …)` — on a model change it runs
+ *     the `$formatters` (reverse), sets `$viewValue`, and calls
+ *     `$render()`. The **model→view feedback guard** compares the new
+ *     formatted value against `$$lastCommittedViewValue` so `$render`
+ *     fires only when the model genuinely diverges from what the view
+ *     already shows (AngularJS parity — prevents the watch from clobbering
+ *     a live keystroke).
+ *
+ * The actual `$render` writer + native DOM event listeners are installed
+ * by the input-type handler (`input.ts` → `input-types.ts`), NOT by
+ * `ngModel` itself — `ngModel` only owns the model side of the pipeline.
+ *
+ * **`ngChange`** registers its expression into the controller's
+ * `$viewChangeListeners`, so it fires ONLY on a committed view change
+ * (user input), never on a programmatic model change — the FS §2.5
+ * distinction.
+ */
+
+import type { QService } from '@async/q-types';
+import type { TimeoutService } from '@async/async-types';
+import type { Scope } from '@core/index';
+
+import { buildParentWriter } from '@compiler/expression-assign';
+import type { Attributes, DirectiveFactory, DirectiveFactoryReturn, LinkFn } from '@compiler/directive-types';
+import type { ControllerInvokable } from '@controller/controller-types';
+import { invokeExceptionHandler, type ExceptionHandler } from '@exception-handler/index';
+import type { ExpressionFn } from '@parser/parse-types';
+import { parse } from '@parser/index';
+
+import { FormControllerImpl, nullFormCtrl, type FormController } from './form-controller';
+import { publishNamedControlOnForm, unpublishNamedControlOnForm } from './form';
+import { resolveTimezone } from './input-date';
+import { NgModelControllerImpl } from './ng-model-controller';
+import { defaultModelOptions, NG_MODEL_OPTIONS_KEY, type ModelOptions } from './ng-model-options';
+
+export const NG_MODEL_NAME = 'ngModel';
+export const NG_CHANGE_NAME = 'ngChange';
+
+/**
+ * Thrown when an `ng-model` expression is not assignable (e.g. a literal,
+ * a binary expression, or a function call). Routed via
+ * `$exceptionHandler('$compile')` — the directive then goes inert rather
+ * than silently writing nowhere. Mirrors AngularJS's `ngModel:nonassign`.
+ */
+export class NgModelNonAssignableError extends Error {
+  constructor(expression: string) {
+    super(`Expression '${expression}' is non-assignable. Element used with ng-model.`);
+    this.name = 'NgModelNonAssignableError';
+  }
+}
+
+/**
+ * Type-narrowing view of the controller seam's 4th link argument. The
+ * `ngModel` directive declares `require: ['ngModel', '?^^form']`, so the
+ * resolved value is a 2-tuple `[ngModelController, formControllerOrNull]`.
+ * `ngChange` still declares the string form (`require: 'ngModel'`), so it
+ * receives the single controller — both shapes are handled here.
+ */
+/** Whether a value is the numeric `NaN` (the fresh-control model sentinel). */
+function isNanValue(value: unknown): boolean {
+  return typeof value === 'number' && Number.isNaN(value);
+}
+
+function asNgModelController(controllers: unknown): NgModelControllerImpl | null {
+  if (controllers instanceof NgModelControllerImpl) {
+    return controllers;
+  }
+  if (Array.isArray(controllers) && controllers[0] instanceof NgModelControllerImpl) {
+    return controllers[0];
+  }
+  return null;
+}
+
+/**
+ * Read the enclosing form from the `ngModel` require tuple's 2nd slot.
+ * `require: '?^^form'` yields `null` when there is no ancestor form; a
+ * non-form value falls back to {@link nullFormCtrl} so registration is a
+ * safe no-op for a form-less control.
+ */
+function readEnclosingForm(controllers: unknown): FormController {
+  if (Array.isArray(controllers) && controllers[1] instanceof FormControllerImpl) {
+    return controllers[1];
+  }
+  return nullFormCtrl;
+}
+
+/**
+ * Read the enclosing `ngModelOptions` by walking the element's own
+ * `$$ngControllers` stash, then its `parentElement` chain, for a controller
+ * published under the `ngModelOptions` key (spec 039 Slice 6).
+ *
+ * We do NOT resolve this through the `require` tuple: `require` resolution for
+ * `ngModel` (a controller-bearing directive) runs during `runControllerSeam`,
+ * which — for a SAME-element `ng-model-options` — can execute before the
+ * `ngModelOptions` controller is stashed AND before its pre-link re-resolves
+ * inheritance. `ngModel`'s LINK runs after every pre-link and after every
+ * controller is stashed, so a direct stash walk at link time reliably sees
+ * the fully-inherited options for both the same-element and ancestor cases.
+ * A miss falls back to {@link defaultModelOptions}.
+ */
+function readEnclosingOptions(element: Element): ModelOptions {
+  let cursor: Element | null = element;
+  while (cursor !== null) {
+    const map = (cursor as { $$ngControllers?: Map<string, unknown> }).$$ngControllers;
+    const candidate = map?.get(NG_MODEL_OPTIONS_KEY);
+    if (
+      candidate !== undefined &&
+      candidate !== null &&
+      typeof candidate === 'object' &&
+      '$$updateEvents' in candidate
+    ) {
+      return candidate as ModelOptions;
+    }
+    cursor = cursor.parentElement;
+  }
+  return defaultModelOptions;
+}
+
+function ngModelFactory($exceptionHandler: ExceptionHandler, $timeout: TimeoutService): DirectiveFactoryReturn {
+  // The controller is array-annotated so `injector.invoke` / `$controller`
+  // can resolve the element-locals by name (`$scope` / `$element` /
+  // `$attrs`); a bare class would be rejected by the strict `annotate`
+  // helper. The trailing factory returns a fresh controller per element.
+  const controller: ControllerInvokable = [
+    '$scope',
+    '$element',
+    '$attrs',
+    '$q',
+    (...args: unknown[]): NgModelControllerImpl =>
+      new NgModelControllerImpl(args[0] as Scope, args[1] as Element, args[2] as Attributes, args[3] as QService),
+  ];
+
+  const link: LinkFn = (scope, element, attrs, controllers) => {
+    const ctrl = asNgModelController(controllers);
+    if (ctrl === null) {
+      return;
+    }
+
+    // Register with the enclosing form (spec 039 Slice 2). Re-point the
+    // control's `$$parentForm` so its `$setValidity` / `$setDirty` bubble
+    // up, and seed the form's aggregate with this control's current
+    // validity (it starts valid, so this is a no-op failure-wise but
+    // records the control in the form's control list). A named control
+    // additionally publishes onto the FORM INSTANCE so
+    // `myForm.email.$invalid` reads in expressions.
+    const form = readEnclosingForm(controllers);
+    ctrl.$$parentForm = form;
+    form.$addControl(ctrl);
+    if (ctrl.$name !== undefined) {
+      publishNamedControlOnForm(form, ctrl.$name, ctrl);
+    }
+    scope.$on('$destroy', () => {
+      form.$removeControl(ctrl);
+      // Clear the named slot only while it still holds THIS control — a
+      // newer same-named control (e.g. an `ng-if` remount whose link ran
+      // before this teardown) must not be clobbered.
+      if (ctrl.$name !== undefined && (form as unknown as Record<string, unknown>)[ctrl.$name] === ctrl) {
+        unpublishNamedControlOnForm(form, ctrl.$name);
+      }
+    });
+
+    // Resolve `ngModelOptions` (spec 039 Slice 6) and thread the seams into
+    // the controller BEFORE the model watch / write-back are wired: the
+    // `allowInvalid` / `getterSetter` / `timezone` decisions all depend on
+    // it, and the debounce timer needs `$timeout`.
+    const options = readEnclosingOptions(element);
+    ctrl.$options = options;
+    ctrl.$$allowInvalid = options.getOption('allowInvalid') === true;
+    ctrl.$$timezone = resolveTimezone(options.getOption('timezone'));
+    const isGetterSetter = options.getOption('getterSetter') === true;
+
+    // Debounce timer seam (spec 039 Slice 6): route through `$timeout` so a
+    // deferred commit runs `$$phase`-guarded inside a digest and refreshes
+    // bound content. `invokeApply` defaults to `true`; `$timeout.cancel`
+    // clears a pending timer on supersession / `$destroy`.
+    ctrl.$$scheduleCommit = (fn, delay) => $timeout(fn, delay);
+    ctrl.$$cancelScheduledCommit = (handle) => {
+      $timeout.cancel(handle as ReturnType<TimeoutService>);
+    };
+    scope.$on('$destroy', () => {
+      if (ctrl.$$pendingCommitTimer !== undefined) {
+        $timeout.cancel(ctrl.$$pendingCommitTimer as ReturnType<TimeoutService>);
+        ctrl.$$pendingCommitTimer = undefined;
+      }
+    });
+
+    const expr = attrs[NG_MODEL_NAME];
+    if (typeof expr !== 'string') {
+      return;
+    }
+
+    const parsed = parse(expr);
+
+    // Model read/write dispatch (spec 039 Slice 6). In `getterSetter` mode the
+    // `ng-model` expression is a FUNCTION used both ways — read via `fn()`,
+    // write via `fn(value)` — so the expression need NOT be assignable. In
+    // the normal mode a `buildParentWriter` assignable writer is required; a
+    // non-assignable model routes `NgModelNonAssignableError`.
+    let readModel: (s: Scope) => unknown;
+    let writeModel: (s: Scope, value: unknown) => void;
+    if (isGetterSetter) {
+      readModel = (s: Scope) => invokeGetterSetter(parsed, s);
+      writeModel = (s: Scope, value: unknown) => {
+        invokeGetterSetter(parsed, s, value);
+      };
+    } else {
+      const writer = buildParentWriter(parsed);
+      if (writer === undefined) {
+        invokeExceptionHandler($exceptionHandler, new NgModelNonAssignableError(expr), '$compile');
+        return;
+      }
+      readModel = (s: Scope) => parsed(s as unknown as Record<string, unknown>);
+      writeModel = writer;
+    }
+
+    // Install the model write-back hook the controller calls from
+    // `$setViewValue`. `scope` is the linked scope the model expression
+    // resolves against.
+    ctrl.$$writeModelToScope = (value: unknown) => {
+      writeModel(scope, value);
+    };
+
+    // Model → view watch. On a model change, run the formatters in
+    // REVERSE, then — only when the formatted value diverges from what the
+    // view already shows ($$lastCommittedViewValue) — set $viewValue and
+    // re-render. The divergence guard is the AngularJS feedback-loop fix.
+    // The model watch runs the model → view pipeline (formatters → render)
+    // + validation ONLY when the scope model diverges from the controller's
+    // cached `$modelValue` (AngularJS's `ngModelWatch` guard). When a change
+    // originated from `$setViewValue`, `$modelValue` was already updated to
+    // match, so the guard fails and validation is NOT re-run — that is what
+    // keeps async validators from firing twice per user keystroke. The
+    // guard's NaN clause (`a === a || b === b`) lets the fresh-control NaN
+    // sentinel transition to a real value on the first digest.
+    scope.$watch(
+      () => readModel(scope),
+      (modelValue: unknown) => {
+        const cached = ctrl.$modelValue;
+        // AngularJS's `ngModelWatch` guard: run the pipeline only when the
+        // scope model diverges from the cached `$modelValue`. The NaN clause
+        // (`!(both are NaN)`) lets the fresh-control NaN sentinel transition
+        // to a real value on the first digest, while treating NaN === NaN as
+        // "no change" so two NaN sentinels don't re-run.
+        const bothNaN = isNanValue(modelValue) && isNanValue(cached);
+        if (modelValue === cached || bothNaN) {
+          return;
+        }
+
+        let formatted: unknown = modelValue;
+        for (let i = ctrl.$formatters.length - 1; i >= 0; i--) {
+          const formatter = ctrl.$formatters[i];
+          if (formatter !== undefined) {
+            formatted = formatter(formatted);
+          }
+        }
+        ctrl.$modelValue = modelValue;
+        ctrl.$$rawModelValue = modelValue;
+        ctrl.$$parserValid = undefined;
+        if (ctrl.$$lastCommittedViewValue !== formatted) {
+          ctrl.$viewValue = formatted;
+          ctrl.$$lastCommittedViewValue = formatted;
+          ctrl.$render();
+          ctrl.$isEmptyClassUpdate(formatted);
+          // Re-run validation against the externally-changed model value so
+          // a programmatic model change (not just user input) re-evaluates
+          // the validators (spec 039 Slice 5). `$$runValidators` bumps the
+          // generation id, cancelling any in-flight async pass. INSIDE the
+          // render guard (AngularJS `ngModelWatch` parity) — when the
+          // formatted value matches what the view already shows, the view's
+          // prior parse/validation state stands (re-validating here with
+          // `parserValid: undefined` would wrongly clear a live `parse`
+          // error while the rejected text is still on screen).
+          ctrl.$$runValidators(modelValue, formatted, undefined, () => {
+            /* model-side revalidation: validity classes are the only output;
+               the scope model is authoritative here, so no write-back. */
+          });
+        }
+      },
+    );
+  };
+
+  return {
+    restrict: 'A',
+    // `['ngModel', '?^^form']` — own controller + optional enclosing form
+    // (spec 039 Slice 2). `?^^form` walks ancestors only; a form-less control
+    // resolves `null` and falls back to `nullFormCtrl`. `ngModelOptions`
+    // (spec 039 Slice 6) is NOT resolved via `require` — the link walks the
+    // element's `$$ngControllers` stash directly (see `readEnclosingOptions`),
+    // because same-element `require` resolution runs too early to see the
+    // fully-inherited options.
+    require: [NG_MODEL_NAME, '?^^form'],
+    controller,
+    link,
+  };
+}
+
+/**
+ * Invoke a `getterSetter`-mode `ng-model` function. AngularJS calls the
+ * parsed expression as `fn()` to read and `fn(value)` to write — the same
+ * function serves both directions. We evaluate the expression to obtain the
+ * function reference, then call it with zero args (read) or one arg (write).
+ * A non-function result (a misconfigured `getterSetter`) degrades to reading
+ * the raw evaluated value / no-op write rather than throwing.
+ */
+function invokeGetterSetter(parsed: ExpressionFn, scope: Scope, ...writeArgs: unknown[]): unknown {
+  const fn = parsed(scope as unknown as Record<string, unknown>);
+  if (typeof fn === 'function') {
+    return (fn as (...a: unknown[]) => unknown)(...writeArgs);
+  }
+  // Not a function — read returns the value; a write is a no-op.
+  return writeArgs.length === 0 ? fn : undefined;
+}
+
+/**
+ * DI-annotated `ngModel` factory. Injects `$exceptionHandler` (routing the
+ * non-assignable-model error) and `$timeout` (backing the
+ * `ngModelOptions.debounce` timer seam — spec 039 Slice 6).
+ */
+export const ngModelDirective: DirectiveFactory = ['$exceptionHandler', '$timeout', ngModelFactory];
+
+function ngChangeFactory(): DirectiveFactoryReturn {
+  const link: LinkFn = (scope, _element, attrs, controllers) => {
+    const ctrl = asNgModelController(controllers);
+    if (ctrl === null) {
+      return;
+    }
+    const expr = attrs[NG_CHANGE_NAME];
+    if (typeof expr !== 'string') {
+      return;
+    }
+    const parsed = parse(expr);
+    ctrl.$viewChangeListeners.push(() => {
+      parsed(scope as unknown as Record<string, unknown>);
+    });
+  };
+
+  return {
+    restrict: 'A',
+    require: NG_MODEL_NAME,
+    link,
+  };
+}
+
+/**
+ * DI-annotated `ngChange` factory. Requires `ngModel` so it can register
+ * its expression into the controller's `$viewChangeListeners`.
+ */
+export const ngChangeDirective: DirectiveFactory = [ngChangeFactory];
diff --git a/src/forms/ng-options-parse.ts b/src/forms/ng-options-parse.ts
new file mode 100644
index 0000000..8783cc1
--- /dev/null
+++ b/src/forms/ng-options-parse.ts
@@ -0,0 +1,150 @@
+/**
+ * `ngOptions` grammar parser (spec 039 Slice 4 / FS §2.5,
+ * technical-considerations §2.5).
+ *
+ * Parses the AngularJS `ngOptions` expression grammar into a small
+ * descriptor of compiled sub-expressions. The full grammar (AngularJS
+ * `NG_OPTIONS_REGEXP` in `ngOptions.js`):
+ *
+ * ```
+ * select [as label] [group by g] [disable when d]
+ *   for (key,value) in collection [track by t]
+ * ```
+ *
+ * Supported forms (all reduce to the same descriptor):
+ *
+ *  - `value for value in coll`                — value is both select + label
+ *  - `item.name for item in coll`             — label expression
+ *  - `item.id as item.name for item in coll`  — select (value) + label
+ *  - `… group by item.group for …`            — optgroup grouping
+ *  - `… disable when item.locked for …`       — per-option `disabled`
+ *  - `… for (k, v) in objColl`                — object collection, key + value
+ *  - `… track by item.id`                     — stable option keys
+ *
+ * The regex is ported verbatim from AngularJS so the exact same expressions
+ * parse (and the same malformed expressions fail) — a malformed expression
+ * routes {@link NgOptionsBadExpressionError} at link time.
+ */
+
+import { parse, type ExpressionFn } from '@parser/index';
+
+/**
+ * Thrown when an `ng-options` attribute value does not match the grammar.
+ * Routed via `$exceptionHandler('$compile')` at link time; the directive
+ * goes inert. Mirrors AngularJS's `ngOptions:iexp`.
+ */
+export class NgOptionsBadExpressionError extends Error {
+  constructor(expression: string) {
+    super(
+      `Expected expression in the form of ` +
+        `'_select_ (as _label_)? for (_key_,)?_value_ in _collection_' but got '${expression}'.`,
+    );
+    this.name = 'NgOptionsBadExpressionError';
+  }
+}
+
+/**
+ * The parsed `ngOptions` descriptor — compiled sub-expressions plus the
+ * iterator variable names. Every expression is evaluated against a
+ * per-item locals object exposing the item value under `valueName` (and
+ * the key under `keyName` for object collections).
+ */
+export interface NgOptionsDescriptor {
+  /** The `value` local name (the RHS of `for (k,v) in` or the bare `for value in`). */
+  valueName: string;
+  /** The `key` local name for object collections (`for (k, v) in obj`), else undefined. */
+  keyName: string | undefined;
+  /** Evaluates the collection against the scope. */
+  collection: ExpressionFn;
+  /** Per-item display label. */
+  label: ExpressionFn;
+  /** Per-item selected value (`_select_ as _label_`); defaults to the item value. */
+  select: ExpressionFn;
+  /** Per-item optgroup name, or undefined when there is no `group by`. */
+  group: ExpressionFn | undefined;
+  /** Per-item disabled flag, or undefined when there is no `disable when`. */
+  disable: ExpressionFn | undefined;
+  /** Per-item track-by key expression, or undefined (index / value keyed). */
+  trackBy: ExpressionFn | undefined;
+}
+
+/**
+ * Verbatim port of AngularJS's `NG_OPTIONS_REGEXP`. Capture groups:
+ *
+ *  1. select-as value expression (the `_select_` before `as`)
+ *  2. label expression (after `as`, or the whole `for` LHS)
+ *  3. group-by expression
+ *  4. disable-when expression
+ *  5. value name (bare `for value in` form)
+ *  6. key name (parenthesized `for (key, value) in` form)
+ *  7. value name (parenthesized `for (key, value) in` form)
+ *  8. collection expression
+ *  9. track-by expression
+ */
+const NG_OPTIONS_REGEXP =
+  /^\s*([\s\S]+?)(?:\s+as\s+([\s\S]+?))?(?:\s+group\s+by\s+([\s\S]+?))?(?:\s+disable\s+when\s+([\s\S]+?))?\s+for\s+(?:([$\w][$\w]*)|(?:\(\s*([$\w][$\w]*)\s*,\s*([$\w][$\w]*)\s*\)))\s+in\s+([\s\S]+?)(?:\s+track\s+by\s+([\s\S]+?))?\s*$/;
+
+/**
+ * Parse an `ng-options` expression string into a {@link NgOptionsDescriptor}.
+ * Throws {@link NgOptionsBadExpressionError} on a grammar mismatch.
+ */
+export function parseNgOptions(optionsExp: string): NgOptionsDescriptor {
+  const match = NG_OPTIONS_REGEXP.exec(optionsExp);
+  if (match === null) {
+    throw new NgOptionsBadExpressionError(optionsExp);
+  }
+
+  // Group indices (per the regex above):
+  //  [1] select-value, [2] label, [3] group by, [4] disable when,
+  //  [5] bare value name, [6] key name, [7] value name (paren form),
+  //  [8] collection, [9] track by.
+  const selectAs = match[1];
+  const labelExp = match[2];
+  const groupExp = match[3];
+  const disableExp = match[4];
+  const bareValueName = match[5];
+  const keyNameParen = match[6];
+  const valueNameParen = match[7];
+  const collectionExp = match[8];
+  const trackByExp = match[9];
+
+  if (collectionExp === undefined) {
+    throw new NgOptionsBadExpressionError(optionsExp);
+  }
+
+  // The value/label duality (AngularJS parity):
+  //  - `_select_ as _label_ for _value_ in …` — the SELECT value is
+  //    `_select_` (match[1]); the LABEL is `_label_` (match[2]).
+  //  - bare `_display_ for _value_ in …` — the LABEL is `_display_`
+  //    (match[1]); the SELECT value is the ITERATED ITEM ITSELF
+  //    (`valueName`), NOT the display expression. So
+  //    `item.name for item in items` labels each option `item.name` but
+  //    binds the whole `item` object as the model value.
+  const valueName = valueNameParen ?? bareValueName;
+  if (valueName === undefined) {
+    throw new NgOptionsBadExpressionError(optionsExp);
+  }
+  const keyName = keyNameParen;
+
+  const displayExp = selectAs;
+  if (displayExp === undefined) {
+    throw new NgOptionsBadExpressionError(optionsExp);
+  }
+
+  // With `as`: match[1] is the SELECT value, match[2] the LABEL.
+  // Without `as`: match[1] is the LABEL and the SELECT value is the item
+  // (`valueName`).
+  const label = labelExp !== undefined ? parse(labelExp) : parse(displayExp);
+  const select = labelExp !== undefined ? parse(displayExp) : parse(valueName);
+
+  return {
+    valueName,
+    keyName,
+    collection: parse(collectionExp),
+    label,
+    select,
+    group: groupExp !== undefined ? parse(groupExp) : undefined,
+    disable: disableExp !== undefined ? parse(disableExp) : undefined,
+    trackBy: trackByExp !== undefined ? parse(trackByExp) : undefined,
+  };
+}
diff --git a/src/forms/ng-options.ts b/src/forms/ng-options.ts
new file mode 100644
index 0000000..f083316
--- /dev/null
+++ b/src/forms/ng-options.ts
@@ -0,0 +1,360 @@
+/**
+ * `ngOptions` directive (spec 039 Slice 4 / FS §2.5,
+ * technical-considerations §2.5).
+ *
+ * `<select ng-model ng-options="…">` generates `<option>` elements from an
+ * array or object collection, wiring per-option label / value / optgroup /
+ * `disabled` / `track by` per the AngularJS grammar (parsed by
+ * `ng-options-parse.ts`). On a `$watchCollection` over the collection, the
+ * whole option list is regenerated and re-selected against the current
+ * model.
+ *
+ * **Integration with `SelectController`.** `ngOptions` takes OVER option
+ * management from the plain `option` directive by setting
+ * `optionsInterface = true` (so plain-markup `<option>` self-registration
+ * is suppressed) and installing `ngOptionsHooks` so the select's
+ * `readValue` / `writeValue` route through this directive's option list:
+ *
+ *  - `readValue()` maps the DOM `<select>`'s selected option key(s) back to
+ *    the real (possibly non-primitive) model value(s) — a single select
+ *    returns one value, a `multiple` select returns an array;
+ *  - `writeValue(value)` finds the option whose value matches and sets the
+ *    DOM selection (array of values for `multiple`).
+ *
+ * Each generated option carries a synthetic string key (`track by` result
+ * when present, else the collection index for arrays / the property key for
+ * objects). The real model value the option contributes is stored against
+ * that key, so an object / number model round-trips through the string DOM
+ * value.
+ *
+ * Registered on `ngModule` only (DI-only) — reachable via
+ * `injector.get('ngOptionsDirective')`, NOT exported from the root barrel.
+ */
+
+import type { DirectiveFactory, DirectiveFactoryReturn, LinkFn } from '@compiler/directive-types';
+import { asInstanceOf } from '@core/index';
+import { invokeExceptionHandler, type ExceptionHandler } from '@exception-handler/index';
+
+import { NgModelControllerImpl } from './ng-model-controller';
+import { parseNgOptions, type NgOptionsDescriptor } from './ng-options-parse';
+import { SelectControllerImpl } from './select';
+
+export const NG_OPTIONS_NAME = 'ngOptions';
+
+/** One generated option: its synthetic key, real value, label + flags. */
+interface GeneratedOption {
+  key: string;
+  value: unknown;
+  label: string;
+  group: string | undefined;
+  disabled: boolean;
+}
+
+function asSelectAndModel(controllers: unknown): {
+  select: SelectControllerImpl | null;
+  model: NgModelControllerImpl | null;
+} {
+  if (!Array.isArray(controllers)) {
+    return { select: null, model: null };
+  }
+  const select = controllers[0] instanceof SelectControllerImpl ? controllers[0] : null;
+  const model = controllers[1] instanceof NgModelControllerImpl ? controllers[1] : null;
+  return { select, model };
+}
+
+/**
+ * Build the per-item locals object the descriptor's sub-expressions
+ * evaluate against: the value under `valueName` (and, for object
+ * collections, the key under `keyName`).
+ */
+function itemLocals(descriptor: NgOptionsDescriptor, value: unknown, key: unknown): Record<string, unknown> {
+  const locals: Record<string, unknown> = { [descriptor.valueName]: value };
+  if (descriptor.keyName !== undefined) {
+    locals[descriptor.keyName] = key;
+  }
+  return locals;
+}
+
+/**
+ * Enumerate the collection into `[key, value]` pairs — arrays yield
+ * `[index, element]`, objects yield `[propKey, propValue]` in `Object.keys`
+ * order. Anything else yields no options.
+ */
+function enumerate(collection: unknown): [unknown, unknown][] {
+  if (Array.isArray(collection)) {
+    return collection.map((value, index) => [index, value]);
+  }
+  if (collection !== null && typeof collection === 'object') {
+    const record = collection as Record<string, unknown>;
+    return Object.keys(record).map((propKey) => [propKey, record[propKey]]);
+  }
+  return [];
+}
+
+/**
+ * Coerce a value into a synthetic DOM option key / label string. `null` /
+ * `undefined` map to the empty string (a bare `<option value="">`); every
+ * other value goes through `String(...)` so numbers, booleans, and object
+ * `toString()` results become stable string keys.
+ */
+function safeString(value: unknown): string {
+  if (value === undefined || value === null) {
+    return '';
+  }
+  // Option keys / labels flow from user expressions (`item.name`,
+  // `item.id`, a `track by` result). They are expected to be primitives —
+  // the cast to the primitive union makes the `String(...)` conversion
+  // visible as safe to `@typescript-eslint/no-base-to-string` (the
+  // `ng-repeat-identity.ts` precedent) and produces the meaningful
+  // stringification for a `Symbol` key without throwing. An accidental
+  // object still stringifies via its own `toString`, matching AngularJS.
+  const primitive = value as string | number | boolean | bigint | symbol;
+  return String(primitive);
+}
+
+function ngOptionsFactory($exceptionHandler: ExceptionHandler): DirectiveFactoryReturn {
+  const link: LinkFn = (scope, element, attrs, controllers) => {
+    const { select: selectCtrl, model: modelCtrl } = asSelectAndModel(controllers);
+    if (selectCtrl === null || modelCtrl === null) {
+      return;
+    }
+
+    const optionsExp = attrs[NG_OPTIONS_NAME];
+    if (typeof optionsExp !== 'string') {
+      return;
+    }
+
+    let descriptor: NgOptionsDescriptor;
+    try {
+      descriptor = parseNgOptions(optionsExp);
+    } catch (err: unknown) {
+      invokeExceptionHandler($exceptionHandler, err, '$compile');
+      return;
+    }
+
+    const selectElement = asInstanceOf(element, HTMLSelectElement);
+
+    // Take over option management from the plain `option` directive.
+    selectCtrl.optionsInterface = true;
+
+    // key → contributed model value, rebuilt on every collection change.
+    let options: GeneratedOption[] = [];
+    let byKey = new Map<string, GeneratedOption>();
+
+    // An author-supplied placeholder `<option value="">` in the template
+    // survives option regeneration (AngularJS's "empty option") — it is
+    // selected for a `null` / `undefined` model and reads back as `null`.
+    const emptyOption = ((): HTMLOptionElement | null => {
+      for (const option of Array.from(selectElement.options)) {
+        if (option.value === '') {
+          return option;
+        }
+      }
+      return null;
+    })();
+
+    // The synthetic "unknown option" shown when the model matches no
+    // generated option and no empty option exists (AngularJS parity — a
+    // mismatched model must not silently leave a stale selection).
+    const unknownOption = document.createElement('option');
+    unknownOption.value = '?';
+    unknownOption.textContent = '';
+
+    function removeUnknownOption(): void {
+      if (unknownOption.parentNode !== null) {
+        unknownOption.parentNode.removeChild(unknownOption);
+      }
+    }
+
+    /**
+     * Render the current model value onto the DOM selection. A single
+     * select matches ONE option key; a `multiple` select matches many.
+     */
+    function writeValue(value: unknown): void {
+      if (selectCtrl === null || modelCtrl === null) {
+        return;
+      }
+      if (selectCtrl.multiple) {
+        const wanted = Array.isArray(value) ? value : [];
+        const wantedKeys = new Set<string>();
+        for (const item of wanted) {
+          const key = keyForValue(item);
+          if (key !== null) {
+            wantedKeys.add(key);
+          }
+        }
+        for (const option of Array.from(selectElement.options)) {
+          option.selected = wantedKeys.has(option.value);
+        }
+        return;
+      }
+      const matchKey = keyForValue(value);
+      if (matchKey !== null) {
+        removeUnknownOption();
+        selectElement.value = matchKey;
+        return;
+      }
+      if ((value === null || value === undefined) && emptyOption !== null) {
+        removeUnknownOption();
+        selectElement.value = '';
+        return;
+      }
+      // No generated option matches — show the synthetic unknown option.
+      if (unknownOption.parentNode === null) {
+        selectElement.insertBefore(unknownOption, selectElement.firstChild);
+      }
+      selectElement.value = '?';
+    }
+
+    /** Read the DOM selection back to the real model value(s). */
+    function readValue(): unknown {
+      if (selectCtrl === null) {
+        return undefined;
+      }
+      if (selectCtrl.multiple) {
+        const selected: unknown[] = [];
+        for (const option of Array.from(selectElement.options)) {
+          if (option.selected) {
+            const generated = byKey.get(option.value);
+            if (generated !== undefined) {
+              selected.push(generated.value);
+            }
+          }
+        }
+        return selected;
+      }
+      const generated = byKey.get(selectElement.value);
+      if (generated !== undefined) {
+        return generated.value;
+      }
+      if (selectElement.value === '' && emptyOption !== null) {
+        // The author-supplied placeholder is selected — model is `null`.
+        return null;
+      }
+      return undefined;
+    }
+
+    /**
+     * The generated option key matching `value`. With `track by`, matching
+     * is by the track-by key evaluated on the candidate value (a fresh
+     * object with the same identity still matches — AngularJS parity);
+     * otherwise by strict value equality.
+     */
+    function keyForValue(value: unknown): string | null {
+      if (descriptor.trackBy !== undefined) {
+        const scopeRecord = scope as unknown as Record<string, unknown>;
+        const trackKey = safeString(descriptor.trackBy(scopeRecord, { [descriptor.valueName]: value }));
+        return byKey.has(trackKey) ? trackKey : null;
+      }
+      for (const option of options) {
+        if (option.value === value) {
+          return option.key;
+        }
+      }
+      return null;
+    }
+
+    // Route the select's read / write through this directive's option list.
+    selectCtrl.ngOptionsHooks = { readValue, writeValue };
+
+    /** Rebuild the option descriptor list from the current collection. */
+    function buildOptions(collection: unknown): GeneratedOption[] {
+      const built: GeneratedOption[] = [];
+      const seenKeys = new Set<string>();
+      for (const [key, value] of enumerate(collection)) {
+        const locals = itemLocals(descriptor, value, key);
+        const scopeRecord = scope as unknown as Record<string, unknown>;
+        const optionValue = descriptor.select(scopeRecord, locals);
+        const label = descriptor.label(scopeRecord, locals);
+        const group = descriptor.group !== undefined ? descriptor.group(scopeRecord, locals) : undefined;
+        const disabled = descriptor.disable !== undefined ? Boolean(descriptor.disable(scopeRecord, locals)) : false;
+
+        // The synthetic DOM key: track-by result (stable identity) when
+        // present, else the array index / object property key.
+        const optionKey =
+          descriptor.trackBy !== undefined ? safeString(descriptor.trackBy(scopeRecord, locals)) : safeString(key);
+        // Guard against a track-by collision by disambiguating.
+        let uniqueKey = optionKey;
+        let suffix = 0;
+        while (seenKeys.has(uniqueKey)) {
+          suffix++;
+          uniqueKey = `${optionKey}:${String(suffix)}`;
+        }
+        seenKeys.add(uniqueKey);
+
+        built.push({
+          key: uniqueKey,
+          value: optionValue,
+          label: label === undefined || label === null ? '' : safeString(label),
+          group: group === undefined || group === null ? undefined : safeString(group),
+          disabled,
+        });
+      }
+      return built;
+    }
+
+    /** Replace the `<select>`'s DOM options with the generated list. */
+    function renderOptions(): void {
+      // Clear existing children (options + optgroups).
+      while (selectElement.firstChild !== null) {
+        selectElement.removeChild(selectElement.firstChild);
+      }
+
+      // The author-supplied placeholder survives regeneration, first.
+      if (emptyOption !== null) {
+        selectElement.appendChild(emptyOption);
+      }
+
+      const groupContainers = new Map<string, HTMLOptGroupElement>();
+      for (const generated of options) {
+        const optionEl = document.createElement('option');
+        optionEl.value = generated.key;
+        optionEl.textContent = generated.label;
+        optionEl.disabled = generated.disabled;
+
+        if (generated.group !== undefined) {
+          let container = groupContainers.get(generated.group);
+          if (container === undefined) {
+            container = document.createElement('optgroup');
+            container.label = generated.group;
+            groupContainers.set(generated.group, container);
+            selectElement.appendChild(container);
+          }
+          container.appendChild(optionEl);
+        } else {
+          selectElement.appendChild(optionEl);
+        }
+      }
+    }
+
+    // Regenerate options whenever the collection changes, then re-render
+    // the current model onto the fresh selection.
+    scope.$watchCollection(descriptor.collection, (collection) => {
+      options = buildOptions(collection);
+      byKey = new Map(options.map((option) => [option.key, option]));
+      renderOptions();
+      modelCtrl.$render();
+    });
+
+    // Native change → model, routed through the select controller's seam.
+    const listener = () => {
+      selectCtrl.selectValueChanged();
+    };
+    selectElement.addEventListener('change', listener);
+    scope.$on('$destroy', () => {
+      selectElement.removeEventListener('change', listener);
+    });
+  };
+
+  return {
+    restrict: 'A',
+    require: ['^select', '?ngModel'],
+    link,
+  };
+}
+
+/**
+ * DI-annotated `ngOptions` directive. Injects `$exceptionHandler` so a
+ * malformed grammar routes through it. Registered on `ngModule`.
+ */
+export const ngOptionsDirective: DirectiveFactory = ['$exceptionHandler', ngOptionsFactory];
diff --git a/src/forms/select.ts b/src/forms/select.ts
new file mode 100644
index 0000000..c3fad10
--- /dev/null
+++ b/src/forms/select.ts
@@ -0,0 +1,425 @@
+/**
+ * `select` directive + `SelectController` (spec 039 Slice 4 / FS §2.4,
+ * technical-considerations §2.5).
+ *
+ * A `<select ng-model>` binds the chosen `<option>`'s value; a
+ * `<select multiple ng-model>` binds an **array** of the selected option
+ * values. The directive publishes a {@link SelectController} (under the
+ * `'select'` `$$ngControllers` key) that:
+ *
+ *  - registers / de-registers every `<option>` beneath it — plain markup
+ *    options via the `option` directive AND the options `ngOptions`
+ *    generates — mapping an OPAQUE string key (the DOM `value` attribute)
+ *    to the real model value the option contributes;
+ *  - `writeValue(value)` (single) / `writeMultiValue(values)` (multiple)
+ *    reflects the model onto the DOM `<select>` selection, adding a
+ *    synthetic "unknown option" (an empty `<option value="?">`) when the
+ *    model matches no registered option — AngularJS parity so a model set
+ *    to a value not yet in the option list does not silently select the
+ *    first option;
+ *  - `readValue()` reads the current selection back out (the mapped model
+ *    value for a single select, the array of mapped values for a multiple
+ *    select).
+ *
+ * `select` requires `['select', '?ngModel']`: the `SelectController` is
+ * always constructed (so child `option` / `ngOptions` directives resolve
+ * it via `require: '^select'`), but the `ngModel` wiring — `$render`
+ * (model → selection) + the native `change` listener (selection → model)
+ * — is installed only when the element carries an `ng-model`.
+ *
+ * **The option-value keying seam.** AngularJS's `SelectController` keys
+ * options by their DOM string value. Plain `<option value="x">` self-keys
+ * on `x` and contributes the STRING `x` as its model value. `ngOptions`
+ * instead assigns each generated option a synthetic key (`'0'`, `'1'`, …
+ * or a `track by` key) and registers the REAL (possibly non-string) model
+ * value under that key, so a `<select ng-options>` can bind objects /
+ * numbers, not just strings. Both routes funnel through the same
+ * `registerOption` / `readValue` / `writeValue` surface here.
+ *
+ * Registered on `ngModule` only (DI-only, the built-in-directive
+ * precedent) — reachable via `injector.get('selectDirective')`, NOT
+ * exported from the root barrel.
+ */
+
+import { stashController } from '@compiler/element-slots';
+import type { DirectiveFactory, DirectiveFactoryReturn, LinkFn } from '@compiler/directive-types';
+import type { ControllerInvokable } from '@controller/controller-types';
+import { asInstanceOf } from '@core/index';
+
+import { NgModelControllerImpl } from './ng-model-controller';
+
+export const SELECT_NAME = 'select';
+export const OPTION_NAME = 'option';
+
+/** The synthetic key + text of the "unknown option" AngularJS inserts. */
+const UNKNOWN_OPTION_KEY = '?';
+
+/**
+ * The public contract of the `select` controller (AngularJS parity). The
+ * method / field names ARE the API; `option` and `ngOptions` type against
+ * this interface to register / render options.
+ */
+export interface SelectController {
+  /** `true` when the underlying `<select>` carries the `multiple` attribute. */
+  readonly multiple: boolean;
+  /**
+   * Register an option under an opaque string `key`, contributing `value`
+   * as its model value when selected, using the supplied DOM `<option>`
+   * element. Called by the `option` directive (plain markup) and by
+   * `ngOptions` (generated options).
+   */
+  registerOption: (key: string, value: unknown, element: HTMLOptionElement) => void;
+  /** De-register the option under `key` (option teardown). */
+  removeOption: (key: string) => void;
+  /** Read the current DOM selection back as a model value (single) / array (multiple). */
+  readValue: () => unknown;
+  /**
+   * Reflect a single-select model `value` onto the DOM selection, inserting
+   * the synthetic unknown option when `value` matches no registered option.
+   */
+  writeValue: (value: unknown) => void;
+  /** Reflect a multiple-select model array `values` onto the DOM selection. */
+  writeMultiValue: (values: readonly unknown[]) => void;
+  /**
+   * Whether `ngOptions` has taken over option management for this select
+   * (suppresses the plain `option` directive's self-registration).
+   */
+  optionsInterface: boolean;
+  /**
+   * Hook `ngOptions` installs so the `select` render / change path defers
+   * to it. When present, `readValue` / `writeValue` route through here.
+   */
+  ngOptionsHooks:
+    | {
+        readValue: () => unknown;
+        writeValue: (value: unknown) => void;
+      }
+    | undefined;
+  /** The bound `NgModelController`, once `ng-model` wiring has run (else `null`). */
+  ngModelCtrl: NgModelControllerImpl | null;
+  /** Re-read the DOM selection and push it into the model (used by `ngOptions`). */
+  selectValueChanged: () => void;
+}
+
+/**
+ * Concrete `SelectController`. Constructed by the `select` directive's
+ * controller seam with the `<select>` element + linked scope; option
+ * children register through it during their own link phase.
+ */
+export class SelectControllerImpl implements SelectController {
+  readonly multiple: boolean;
+  optionsInterface = false;
+  ngOptionsHooks: SelectController['ngOptionsHooks'] = undefined;
+  ngModelCtrl: NgModelControllerImpl | null = null;
+
+  /** key → contributed model value. */
+  private readonly optionValues = new Map<string, unknown>();
+  /** key → DOM option element. */
+  private readonly optionElements = new Map<string, HTMLOptionElement>();
+
+  private readonly element: HTMLSelectElement;
+  private unknownOption: HTMLOptionElement | null = null;
+
+  /**
+   * Dispatch a selection → model commit through the `$$phase`-guarded
+   * `$apply` / `$evalAsync` seam. Installed by the directive link when
+   * `ng-model` is present; a no-op before then (so an option registering
+   * during compile does not fire a commit).
+   */
+  applyChange: (run: () => void) => void = () => {
+    /* installed by the select link when ng-model is present */
+  };
+
+  constructor(element: HTMLSelectElement) {
+    this.element = element;
+    this.multiple = element.hasAttribute('multiple');
+  }
+
+  registerOption(key: string, value: unknown, optionElement: HTMLOptionElement): void {
+    this.optionValues.set(key, value);
+    this.optionElements.set(key, optionElement);
+    optionElement.value = key;
+  }
+
+  removeOption(key: string): void {
+    this.optionValues.delete(key);
+    this.optionElements.delete(key);
+  }
+
+  readValue(): unknown {
+    if (this.ngOptionsHooks !== undefined) {
+      return this.ngOptionsHooks.readValue();
+    }
+    if (this.multiple) {
+      const selected: unknown[] = [];
+      for (const option of Array.from(this.element.options)) {
+        if (option.selected && option.value !== UNKNOWN_OPTION_KEY) {
+          selected.push(this.mappedValue(option.value));
+        }
+      }
+      return selected;
+    }
+    const key = this.element.value;
+    if (key === UNKNOWN_OPTION_KEY) {
+      return undefined;
+    }
+    return this.mappedValue(key);
+  }
+
+  writeValue(value: unknown): void {
+    if (this.ngOptionsHooks !== undefined) {
+      this.ngOptionsHooks.writeValue(value);
+      return;
+    }
+    const key = this.keyForValue(value);
+    if (key === null) {
+      // The model matches no registered option — show the unknown option.
+      this.renderUnknownOption(value);
+      return;
+    }
+    this.removeUnknownOption();
+    this.element.value = key;
+  }
+
+  writeMultiValue(values: readonly unknown[]): void {
+    if (this.ngOptionsHooks !== undefined) {
+      // `ngOptions` owns the option list — its writeValue handles the
+      // multiple case (array of model values) too.
+      this.ngOptionsHooks.writeValue(values);
+      return;
+    }
+    this.removeUnknownOption();
+    const wanted = new Set(values);
+    for (const option of Array.from(this.element.options)) {
+      if (option.value === UNKNOWN_OPTION_KEY) {
+        continue;
+      }
+      option.selected = wanted.has(this.mappedValue(option.value));
+    }
+  }
+
+  selectValueChanged(): void {
+    if (this.ngModelCtrl === null) {
+      return;
+    }
+    const ctrl = this.ngModelCtrl;
+    this.applyChange(() => {
+      ctrl.$setViewValue(this.readValue());
+    });
+  }
+
+  /** The model value a registered option key contributes (identity for plain markup). */
+  private mappedValue(key: string): unknown {
+    if (this.optionValues.has(key)) {
+      return this.optionValues.get(key);
+    }
+    return key;
+  }
+
+  /** The registered key whose contributed value strictly equals `value`, else `null`. */
+  private keyForValue(value: unknown): string | null {
+    for (const [key, mapped] of this.optionValues) {
+      if (mapped === value) {
+        return key;
+      }
+    }
+    return null;
+  }
+
+  private renderUnknownOption(value: unknown): void {
+    if (this.unknownOption === null) {
+      const option = document.createElement('option');
+      option.value = UNKNOWN_OPTION_KEY;
+      option.textContent = '';
+      this.unknownOption = option;
+    }
+    // Empty text — AngularJS shows the unknown option as the current
+    // selection with a blank label so the mismatched value is visible as
+    // "nothing selected" rather than silently binding the first option.
+    // The mismatched model value is typically a primitive; the cast to the
+    // primitive union makes the `String(...)` conversion visible as safe to
+    // `@typescript-eslint/no-base-to-string` (the `ng-repeat-identity.ts`
+    // precedent) — a `Symbol` stringifies without throwing, an accidental
+    // object falls back to its own `toString`.
+    const primitive = value as string | number | boolean | bigint | symbol;
+    this.unknownOption.textContent = value === undefined || value === null ? '' : String(primitive);
+    if (this.unknownOption.parentNode === null) {
+      this.element.insertBefore(this.unknownOption, this.element.firstChild);
+    }
+    this.element.value = UNKNOWN_OPTION_KEY;
+  }
+
+  private removeUnknownOption(): void {
+    if (this.unknownOption !== null && this.unknownOption.parentNode !== null) {
+      this.unknownOption.parentNode.removeChild(this.unknownOption);
+    }
+  }
+}
+
+function asSelectController(controllers: unknown): SelectControllerImpl | null {
+  if (controllers instanceof SelectControllerImpl) {
+    return controllers;
+  }
+  if (Array.isArray(controllers) && controllers[0] instanceof SelectControllerImpl) {
+    return controllers[0];
+  }
+  return null;
+}
+
+function asNgModelFromTuple(controllers: unknown): NgModelControllerImpl | null {
+  if (Array.isArray(controllers) && controllers[1] instanceof NgModelControllerImpl) {
+    return controllers[1];
+  }
+  return null;
+}
+
+function selectFactory(): DirectiveFactoryReturn {
+  // Array-annotated so `injector.invoke` resolves `$element` by name.
+  const controller: ControllerInvokable = [
+    '$element',
+    (...args: unknown[]): SelectControllerImpl => new SelectControllerImpl(asInstanceOf(args[0], HTMLSelectElement)),
+  ];
+
+  // PRE-link stashes the controller under the `'select'` key BEFORE child
+  // `option` / `ngOptions` directives link, so their `require: '^select'`
+  // resolves — mirroring the `form` pre-link publish precedent.
+  const preLink: LinkFn = (_scope, element, _attrs, controllers) => {
+    const selectCtrl = asSelectController(controllers);
+    if (selectCtrl === null) {
+      return;
+    }
+    stashController(element, SELECT_NAME, selectCtrl);
+  };
+
+  const postLink: LinkFn = (scope, element, _attrs, controllers) => {
+    const selectCtrl = asSelectController(controllers);
+    if (selectCtrl === null) {
+      return;
+    }
+    const modelCtrl = asNgModelFromTuple(controllers);
+    if (modelCtrl === null) {
+      // No ng-model — the select still tracks options (so `ngOptions`
+      // renders) but nothing binds a model.
+      return;
+    }
+
+    selectCtrl.ngModelCtrl = modelCtrl;
+    selectCtrl.applyChange = (run: () => void) => {
+      if (scope.$$phase !== null) {
+        scope.$evalAsync(run);
+      } else {
+        scope.$apply(run);
+      }
+    };
+
+    // Model → view: render the selection from the model value.
+    modelCtrl.$render = () => {
+      const viewValue = modelCtrl.$viewValue;
+      if (selectCtrl.multiple) {
+        selectCtrl.writeMultiValue(Array.isArray(viewValue) ? viewValue : []);
+      } else {
+        selectCtrl.writeValue(viewValue);
+      }
+    };
+
+    // A multiple select's empty state is "no selection" — an empty array.
+    if (selectCtrl.multiple) {
+      modelCtrl.$isEmpty = (value: unknown): boolean => !Array.isArray(value) || value.length === 0;
+    }
+
+    // View → model: the native `change` event commits the current
+    // selection through the `$$phase`-guarded seam.
+    const selectElement = asInstanceOf(element, HTMLSelectElement);
+    const listener = () => {
+      selectCtrl.applyChange(() => {
+        modelCtrl.$setViewValue(selectCtrl.readValue());
+      });
+    };
+    selectElement.addEventListener('change', listener);
+    scope.$on('$destroy', () => {
+      selectElement.removeEventListener('change', listener);
+    });
+  };
+
+  return {
+    restrict: 'E',
+    require: [SELECT_NAME, '?ngModel'],
+    controller,
+    link: { pre: preLink, post: postLink },
+  };
+}
+
+/**
+ * DI-annotated `select` directive. Zero deps — the controller reads only
+ * `$element`. Registered on `ngModule` via `forms-register.ts`.
+ */
+export const selectDirective: DirectiveFactory = [selectFactory];
+
+/**
+ * The `option` directive — plain markup `<option>` self-registration into
+ * the enclosing `SelectController`. Skipped entirely when `ngOptions` has
+ * taken over the select (`optionsInterface`), because `ngOptions` manages
+ * its own generated options. An option's DOM `value` attribute (or its
+ * text content when `value` is absent, AngularJS parity) is BOTH the
+ * option key and its contributed model value (a string).
+ *
+ * `require: '?^^select'` — optional + ancestor-only, so a stray
+ * `<option>` outside a `<select>` links harmlessly.
+ */
+function optionFactory(): DirectiveFactoryReturn {
+  const link: LinkFn = (scope, element, attrs, controllers) => {
+    const selectCtrl = controllers instanceof SelectControllerImpl ? controllers : null;
+    if (selectCtrl === null || selectCtrl.optionsInterface) {
+      // No enclosing select, or ngOptions owns the option list — nothing
+      // to self-register.
+      return;
+    }
+    const optionEl = element as HTMLOptionElement;
+    // Key + contributed value: the explicit `value` attribute, else the
+    // option's text content (AngularJS parity — `<option>Blue</option>`
+    // contributes `'Blue'`).
+    const valueAttr = attrs['value'];
+    let key = typeof valueAttr === 'string' ? valueAttr : optionEl.text;
+
+    selectCtrl.registerOption(key, key, optionEl);
+    // A newly-arrived option may complete the model's pending selection
+    // (an out-of-order model set that previously showed the unknown
+    // option). Re-render on the next digest turn.
+    if (selectCtrl.ngModelCtrl !== null) {
+      selectCtrl.ngModelCtrl.$render();
+    }
+
+    // An interpolated `value="{{…}}"` re-keys the option when it changes
+    // (AngularJS parity — the old key would otherwise contribute a stale
+    // string to the model).
+    if (typeof valueAttr === 'string') {
+      const stopObserve = attrs.$observe('value', (newValue) => {
+        if (typeof newValue !== 'string' || newValue === key) {
+          return;
+        }
+        selectCtrl.removeOption(key);
+        key = newValue;
+        selectCtrl.registerOption(key, key, optionEl);
+        if (selectCtrl.ngModelCtrl !== null) {
+          selectCtrl.ngModelCtrl.$render();
+        }
+      });
+      scope.$on('$destroy', stopObserve);
+    }
+
+    scope.$on('$destroy', () => {
+      selectCtrl.removeOption(key);
+    });
+  };
+
+  return {
+    restrict: 'E',
+    require: '?^^select',
+    link,
+  };
+}
+
+/**
+ * DI-annotated `option` directive. Registered on `ngModule`.
+ */
+export const optionDirective: DirectiveFactory = [optionFactory];
diff --git a/src/forms/state-classes.ts b/src/forms/state-classes.ts
new file mode 100644
index 0000000..9007845
--- /dev/null
+++ b/src/forms/state-classes.ts
@@ -0,0 +1,152 @@
+/**
+ * Shared CSS state-class toggling for form controls and forms (spec 039
+ * Slice 1 / FS §2.2, technical-considerations §2.7).
+ *
+ * AngularJS reflects every control / form state onto the element via a
+ * fixed set of CSS classes so an app can style validation feedback with
+ * plain CSS (`.ng-invalid.ng-touched { border-color: red; }`). This
+ * module owns the toggling for the Slice-1 state surface:
+ *
+ *  - `ng-valid` / `ng-invalid`
+ *  - `ng-dirty` / `ng-pristine`
+ *  - `ng-touched` / `ng-untouched`
+ *  - `ng-empty` / `ng-not-empty`
+ *  - per-rule `ng-valid-<key>` / `ng-invalid-<key>` (key dasherized)
+ *
+ * **Append-only / consumer-class-safe.** Like `ng-class` (spec 024), the
+ * framework only ever toggles classes IT manages — author classes
+ * (`<input class="form-control">`) are never stripped. The two helpers
+ * here (`toggleClass`, `toggleValidationClass`) add exactly one class and
+ * remove its mutually-exclusive partner; they never touch any other
+ * class. There is no `$animate` integration — toggles are synchronous via
+ * `classList`, consistent with `ng-show` / `ng-hide` and deferred to
+ * Phase 4.
+ *
+ * **Per-rule class dasherizing.** AngularJS lowercases + dasherizes a
+ * validation key when building the per-rule class so a camelCase rule
+ * name (`maxlength`, `myCustomRule`) produces a kebab class
+ * (`ng-invalid-maxlength`, `ng-invalid-my-custom-rule`). The
+ * {@link snakeCase} helper matches upstream's `snake_case(name, '-')` —
+ * an uppercase letter is lowercased and prefixed with the separator.
+ */
+
+const VALID_CLASS = 'ng-valid';
+const INVALID_CLASS = 'ng-invalid';
+const PRISTINE_CLASS = 'ng-pristine';
+const DIRTY_CLASS = 'ng-dirty';
+const UNTOUCHED_CLASS = 'ng-untouched';
+const TOUCHED_CLASS = 'ng-touched';
+const EMPTY_CLASS = 'ng-empty';
+const NOT_EMPTY_CLASS = 'ng-not-empty';
+const SUBMITTED_CLASS = 'ng-submitted';
+const PENDING_CLASS = 'ng-pending';
+
+/**
+ * Add `addClass` and remove `removeClass` on the element. Both arguments
+ * are framework-managed class names — no author class is ever passed
+ * here, so the append-only guarantee holds by construction. A `null`
+ * `addClass` (or `removeClass`) skips that side of the toggle.
+ */
+function applyClasses(element: Element, addClass: string | null, removeClass: string | null): void {
+  if (removeClass !== null) {
+    element.classList.remove(removeClass);
+  }
+  if (addClass !== null) {
+    element.classList.add(addClass);
+  }
+}
+
+/**
+ * Reflect the boolean validity onto an element: `ng-valid` when `isValid`,
+ * `ng-invalid` otherwise (mutually exclusive).
+ */
+export function setValidClass(element: Element, isValid: boolean): void {
+  applyClasses(element, isValid ? VALID_CLASS : INVALID_CLASS, isValid ? INVALID_CLASS : VALID_CLASS);
+}
+
+/**
+ * Reflect the pristine/dirty state: `ng-pristine` when `isPristine`,
+ * `ng-dirty` otherwise.
+ */
+export function setPristineClass(element: Element, isPristine: boolean): void {
+  applyClasses(element, isPristine ? PRISTINE_CLASS : DIRTY_CLASS, isPristine ? DIRTY_CLASS : PRISTINE_CLASS);
+}
+
+/**
+ * Reflect the touched/untouched state: `ng-untouched` when `isUntouched`,
+ * `ng-touched` otherwise.
+ */
+export function setTouchedClass(element: Element, isUntouched: boolean): void {
+  applyClasses(element, isUntouched ? UNTOUCHED_CLASS : TOUCHED_CLASS, isUntouched ? TOUCHED_CLASS : UNTOUCHED_CLASS);
+}
+
+/**
+ * Reflect the empty/not-empty state: `ng-empty` when `isEmpty`,
+ * `ng-not-empty` otherwise.
+ */
+export function setEmptyClass(element: Element, isEmpty: boolean): void {
+  applyClasses(element, isEmpty ? EMPTY_CLASS : NOT_EMPTY_CLASS, isEmpty ? NOT_EMPTY_CLASS : EMPTY_CLASS);
+}
+
+/**
+ * Reflect the submitted state on a FORM element: add `ng-submitted`
+ * once a submit has been attempted; remove it on `$setPristine`. There
+ * is no mutually-exclusive partner class (AngularJS parity — a form is
+ * simply either submitted or not), so this toggles the single class.
+ */
+export function setSubmittedClass(element: Element, isSubmitted: boolean): void {
+  applyClasses(element, isSubmitted ? SUBMITTED_CLASS : null, isSubmitted ? null : SUBMITTED_CLASS);
+}
+
+/**
+ * Reflect the pending (async-validation-in-flight) state on a control:
+ * add `ng-pending` while at least one async validator is outstanding,
+ * remove it once every async rule has settled (spec 039 Slice 5 /
+ * FS §2.2, §2.7). There is no mutually-exclusive partner class — a control
+ * is simply either pending or not — so this toggles the single class.
+ */
+export function setPendingClass(element: Element, isPending: boolean): void {
+  applyClasses(element, isPending ? PENDING_CLASS : null, isPending ? null : PENDING_CLASS);
+}
+
+/**
+ * Dasherize a validation key for the per-rule class — the AngularJS
+ * `snake_case(name, '-')` behavior. Every uppercase letter is lowercased
+ * and prefixed with `-` (so `maxLength` → `max-length`). Already-kebab
+ * keys (`maxlength`) pass through unchanged.
+ *
+ * @example
+ * ```ts
+ * snakeCase('required');     // 'required'
+ * snakeCase('maxlength');    // 'maxlength'
+ * snakeCase('myCustomRule'); // 'my-custom-rule'
+ * ```
+ */
+export function snakeCase(name: string): string {
+  return name.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
+}
+
+/**
+ * Toggle the per-rule validity class for a single rule `key`. Adds
+ * `ng-valid-<key>` and removes `ng-invalid-<key>` when `isValid`, the
+ * mirror otherwise. The key is dasherized via {@link snakeCase} so the
+ * resulting class is always kebab-case.
+ */
+export function setValidationClass(element: Element, key: string, isValid: boolean): void {
+  const dashed = snakeCase(key);
+  const validKey = `${VALID_CLASS}-${dashed}`;
+  const invalidKey = `${INVALID_CLASS}-${dashed}`;
+  applyClasses(element, isValid ? validKey : invalidKey, isValid ? invalidKey : validKey);
+}
+
+/**
+ * Remove BOTH per-rule classes for `key` — the neutral state used while an
+ * async validator is pending (spec 039 Slice 5). A pending rule is neither
+ * valid nor invalid, so the element carries neither `ng-valid-<key>` nor
+ * `ng-invalid-<key>` (only the aggregate `ng-pending` reflects it).
+ */
+export function clearValidationClass(element: Element, key: string): void {
+  const dashed = snakeCase(key);
+  applyClasses(element, null, `${VALID_CLASS}-${dashed}`);
+  applyClasses(element, null, `${INVALID_CLASS}-${dashed}`);
+}
diff --git a/src/forms/validation.ts b/src/forms/validation.ts
new file mode 100644
index 0000000..16b0205
--- /dev/null
+++ b/src/forms/validation.ts
@@ -0,0 +1,200 @@
+/**
+ * The validation engine for {@link NgModelControllerImpl} (spec 039
+ * Slice 5 / FS §2.6, §2.7, technical-considerations §2.3).
+ *
+ * Extracted from `ng-model-controller.ts` to keep that file focused on the
+ * value pipeline + state surface; this module owns the sync-before-async
+ * ordering, the `$pending` / `ng-pending` bookkeeping, and the
+ * generation-counter that cancels stale async passes. It operates on the
+ * controller through the narrow {@link ValidationHost} interface so it can
+ * be reasoned about (and unit-tested) without dragging in the whole
+ * controller surface.
+ *
+ * **Ordering (AngularJS parity).** `$$runValidators` runs in three stages:
+ *
+ *  1. **Parse.** If the `$parsers` chain failed (`$$parserValid === false`),
+ *     every `$validators` / `$asyncValidators` key is skipped (cleared to a
+ *     neutral valid state) and only the `parse` key fails — a bad parse
+ *     short-circuits the rest.
+ *  2. **Sync `$validators`.** Each runs against `(modelValue, viewValue)`
+ *     and its result is written via `$setValidity(key, boolean)`. If ANY
+ *     sync validator fails, every async key is skipped and the pass is done
+ *     (invalid).
+ *  3. **Async `$asyncValidators`.** Only reached when every sync validator
+ *     passed. Each key is marked pending (`$setValidity(key, undefined)`),
+ *     `ng-pending` goes on, and `$q.all(...)` awaits the promises. On settle
+ *     each key resolves valid / invalid by whether its promise resolved /
+ *     rejected.
+ *
+ * **Stale-pass cancellation.** Every `$$runValidators` invocation bumps a
+ * monotonic `$$currentValidationRunId`; the async settle handlers capture
+ * the id at start and no-op if a newer pass has since started — so a slow
+ * server check that resolves after the user has typed again never writes a
+ * stale validity.
+ */
+
+import type { QPromise, QService } from '@async/q-types';
+
+import { setPendingClass } from './state-classes';
+
+/**
+ * A synchronous validation rule — returns truthy for valid. Pushed onto
+ * {@link ValidationHost.$validators} under a rule name; the failing name
+ * becomes the `ng-invalid-<name>` class + `$error[name]` entry.
+ */
+export type SyncValidator = (modelValue: unknown, viewValue: unknown) => boolean;
+
+/**
+ * An asynchronous validation rule — returns a {@link QPromise} that
+ * resolves for valid, rejects for invalid. While outstanding the control
+ * reports pending (`$pending[name]`, `ng-pending`); the model is not
+ * written until every async rule settles.
+ */
+export type AsyncValidator = (modelValue: unknown, viewValue: unknown) => QPromise<unknown>;
+
+/**
+ * The narrow controller surface the engine drives. {@link NgModelControllerImpl}
+ * satisfies it; the engine reads the validator maps + the parser-valid
+ * flag, and writes validity through `$setValidity` (which owns the
+ * `$error` / `$pending` / class bookkeeping).
+ */
+export interface ValidationHost {
+  $validators: Record<string, SyncValidator>;
+  $asyncValidators: Record<string, AsyncValidator>;
+  /** The DOM element — the engine toggles `ng-pending` on it directly. */
+  readonly $$element: Element;
+  /** The `$q` service (async validators). */
+  readonly $$q: QService;
+  /** Monotonic run id — bumped per invocation to cancel stale async passes. */
+  $$currentValidationRunId: number;
+  /**
+   * The controller's outstanding-async-rule map — `undefined` when no async
+   * rule is pending, else a `{ [key]: true }` record. Owned by the
+   * controller; the engine reads it to decide the `ng-pending` toggle.
+   */
+  $pending: Record<string, boolean> | undefined;
+  /** Set a single rule's validity — `undefined` = pending. */
+  $setValidity(key: string, isValid: boolean | undefined): void;
+}
+
+/**
+ * Run the full validation pass for a committed model/view value. Bumps the
+ * run id, runs sync-then-async, and calls `doneCallback(allValid)` exactly
+ * once when the pass settles (synchronously for the sync-only / sync-fail
+ * paths, asynchronously once `$q.all` resolves for the async path).
+ *
+ * `parserValid` is the controller's `$$parserValid`: `true` when the
+ * `$parsers` chain produced a value, `false` when a parser returned
+ * `undefined` (failed parse), `undefined` when there was nothing to parse.
+ *
+ * @param host - The controller under validation.
+ * @param modelValue - The parsed model value.
+ * @param viewValue - The last committed view value.
+ * @param parserValid - The `$parsers` chain outcome (see above).
+ * @param doneCallback - Called once with the overall validity.
+ */
+export function runValidators(
+  host: ValidationHost,
+  modelValue: unknown,
+  viewValue: unknown,
+  parserValid: boolean | undefined,
+  doneCallback: (allValid: boolean) => void,
+): void {
+  host.$$currentValidationRunId += 1;
+  const localRunId = host.$$currentValidationRunId;
+
+  // A `$setValidity` that no-ops once a newer pass has started (so a stale
+  // async settle can't clobber the live validity).
+  const setValidity = (name: string, isValid: boolean | undefined): void => {
+    if (localRunId === host.$$currentValidationRunId) {
+      host.$setValidity(name, isValid);
+    }
+  };
+
+  const validationDone = (allValid: boolean): void => {
+    if (localRunId === host.$$currentValidationRunId) {
+      doneCallback(allValid);
+    }
+  };
+
+  // Stage 1 — parse errors. A failed parse skips every validator.
+  if (parserValid === false) {
+    for (const name of Object.keys(host.$validators)) {
+      setValidity(name, true);
+    }
+    for (const name of Object.keys(host.$asyncValidators)) {
+      setValidity(name, true);
+    }
+    setValidity('parse', false);
+    validationDone(false);
+    return;
+  }
+  setValidity('parse', true);
+
+  // Stage 2 — synchronous validators.
+  let syncValid = true;
+  for (const [name, validator] of Object.entries(host.$validators)) {
+    const result = validator(modelValue, viewValue);
+    syncValid = syncValid && result;
+    setValidity(name, result);
+  }
+  if (!syncValid) {
+    // Skip async validators when any sync rule fails (parity ordering).
+    for (const name of Object.keys(host.$asyncValidators)) {
+      setValidity(name, true);
+    }
+    updatePendingClass(host);
+    validationDone(false);
+    return;
+  }
+
+  // Stage 3 — asynchronous validators (only reached when all sync pass).
+  const promises: QPromise<unknown>[] = [];
+  let allValid = true;
+  for (const [name, validator] of Object.entries(host.$asyncValidators)) {
+    const promise = validator(modelValue, viewValue);
+    setValidity(name, undefined);
+    promises.push(
+      promise.then(
+        () => {
+          setValidity(name, true);
+        },
+        () => {
+          allValid = false;
+          setValidity(name, false);
+        },
+      ),
+    );
+  }
+
+  updatePendingClass(host);
+
+  if (promises.length === 0) {
+    validationDone(true);
+    return;
+  }
+
+  host.$$q.all(promises).then(
+    () => {
+      updatePendingClass(host);
+      validationDone(allValid);
+    },
+    () => {
+      // Each validator promise's rejection is caught above, so this fires
+      // only when a settlement callback itself threw. Still finalize as
+      // failed so the control never gets stuck permanently `ng-pending`.
+      updatePendingClass(host);
+      validationDone(false);
+    },
+  );
+}
+
+/**
+ * Sync the `ng-pending` class to whether any async rule is currently
+ * outstanding (`$pending` non-empty). Called after each stage that can
+ * change the pending set.
+ */
+function updatePendingClass(host: ValidationHost): void {
+  const isPending = host.$pending !== undefined && Object.keys(host.$pending).length > 0;
+  setPendingClass(host.$$element, isPending);
+}
diff --git a/src/forms/validators.ts b/src/forms/validators.ts
new file mode 100644
index 0000000..60333f0
--- /dev/null
+++ b/src/forms/validators.ts
@@ -0,0 +1,305 @@
+/**
+ * Built-in validator directives (spec 039 Slice 5 / FS §2.6,
+ * technical-considerations §2.3).
+ *
+ * Each directive `require: '?ngModel'` and, on link, pushes a rule onto the
+ * control's `$validators` map (or, where AngularJS does, `$parsers`) under
+ * a fixed key so a failure surfaces `ng-invalid-<key>` + `$error[key]` and
+ * bubbles to the enclosing form. All of them re-validate when their bound
+ * attribute / expression changes: `ngMinlength` / `ngMaxlength` / `pattern`
+ * `$observe` their attribute and call `$validate()`; `ngRequired` /
+ * `ngPattern` re-parse their expression on `$observe`.
+ *
+ * **Empty-value convention (parity).** Every length / pattern validator
+ * PASSES on an empty value (`ctrl.$isEmpty(viewValue)`) — emptiness is
+ * `required`'s concern alone. This lets `required` + `ng-minlength` compose:
+ * an empty field is `required`-invalid but not `minlength`-invalid.
+ *
+ * The `email` / `number` / `url` TYPE validators are NOT here — they are
+ * wired by their `inputType` handler (`input-types.ts`), matching AngularJS
+ * (a type validator belongs to the type, not a standalone attribute). The
+ * `min` / `max` validators are likewise wired by the `number` / `range` /
+ * date handlers.
+ *
+ * Like every forms directive these are DI-only core `ng` directives (their
+ * factories stay file-local; only registered through `forms-register.ts`).
+ */
+
+import type { Scope } from '@core/index';
+
+import type { Attributes, DirectiveFactory, DirectiveFactoryReturn, LinkFn } from '@compiler/directive-types';
+import { parse } from '@parser/index';
+
+import { NgModelControllerImpl } from './ng-model-controller';
+
+export const REQUIRED_NAME = 'required';
+export const NG_REQUIRED_NAME = 'ngRequired';
+export const NG_MINLENGTH_NAME = 'ngMinlength';
+export const MINLENGTH_NAME = 'minlength';
+export const NG_MAXLENGTH_NAME = 'ngMaxlength';
+export const MAXLENGTH_NAME = 'maxlength';
+export const PATTERN_NAME = 'pattern';
+export const NG_PATTERN_NAME = 'ngPattern';
+
+/** Narrow the `require: '?ngModel'` result to the controller (or `null`). */
+function asNgModelController(controllers: unknown): NgModelControllerImpl | null {
+  return controllers instanceof NgModelControllerImpl ? controllers : null;
+}
+
+/** Read a normalized string attribute, or `undefined` when absent / non-string. */
+function readAttr(attrs: Attributes, name: string): string | undefined {
+  const raw = attrs[name];
+  return typeof raw === 'string' ? raw : undefined;
+}
+
+/** Evaluate an expression attribute against the scope (AngularJS `$parse(expr)(scope)`). */
+function evalExpr(expr: string, scope: Scope): unknown {
+  return parse(expr)(scope as unknown as Record<string, unknown>);
+}
+
+/**
+ * Parse a length attribute (`ng-minlength` / `ng-maxlength`) to a
+ * non-negative integer, or `-1` when absent / non-numeric — `-1` makes the
+ * corresponding validator a no-op (AngularJS's `parseLength`).
+ */
+function parseLength(val: unknown): number {
+  const num = Number.parseInt(String(val), 10);
+  return Number.isNaN(num) ? -1 : num;
+}
+
+/**
+ * Read the initial parsed length bound: the native `minlength` /
+ * `maxlength` attribute string if present, else the evaluated
+ * `ng-minlength` / `ng-maxlength` expression, else `-1` (no bound).
+ */
+function readInitialLength(scope: Scope, attrs: Attributes, nativeName: string, ngName: string): number {
+  const native = readAttr(attrs, nativeName);
+  if (native !== undefined) {
+    return parseLength(native);
+  }
+  const ngExpr = readAttr(attrs, ngName);
+  return ngExpr !== undefined ? parseLength(evalExpr(ngExpr, scope)) : -1;
+}
+
+/**
+ * Wire the re-validation source for a length bound. The native attribute
+ * (`minlength` / `maxlength`) is `$observe`d ONLY when actually present —
+ * observing a missing attribute would fire a one-shot `undefined`
+ * notification and wrongly reset the bound; when the bound comes purely
+ * from the `ng-minlength` / `ng-maxlength` EXPRESSION, that expression is
+ * `$watch`ed instead. `onChange` receives the freshly parsed length.
+ */
+function wireLengthSource(
+  scope: Scope,
+  attrs: Attributes,
+  nativeName: string,
+  ngName: string,
+  onChange: (parsed: number) => void,
+): void {
+  if (readAttr(attrs, nativeName) !== undefined) {
+    const stopObserve = attrs.$observe(nativeName, (val) => {
+      onChange(parseLength(val));
+    });
+    scope.$on('$destroy', stopObserve);
+    return;
+  }
+  const ngExpr = readAttr(attrs, ngName);
+  if (ngExpr !== undefined) {
+    scope.$watch(ngExpr, (val: unknown) => {
+      onChange(parseLength(val));
+    });
+  }
+}
+
+/**
+ * `required` / `ngRequired` — the value must be non-empty (FS §2.6). The
+ * conditional `ng-required="expr"` form gates the rule on a boolean
+ * expression: `required` is enforced only while `expr` is truthy. Both
+ * publish the same `required` validator key (→ `ng-invalid-required`).
+ *
+ * The rule passes when the requirement is off (`!value`) OR the view value
+ * is not empty. Observing the `required` attribute (which `ngRequired`
+ * writes through interpolation) re-validates when the gate flips.
+ */
+function requiredFactory(): DirectiveFactoryReturn {
+  const link: LinkFn = (scope, _element, attrs, controllers) => {
+    const ctrl = asNgModelController(controllers);
+    if (ctrl === null) {
+      return;
+    }
+
+    const ngRequired = readAttr(attrs, NG_REQUIRED_NAME);
+    // `value` is the current requiredness: the bare `required` attribute is
+    // always-on; `ng-required` evaluates its expression.
+    let value: unknown = ngRequired !== undefined ? evalExpr(ngRequired, scope) : REQUIRED_NAME in attrs;
+
+    ctrl.$validators[REQUIRED_NAME] = (_modelValue: unknown, viewValue: unknown): boolean =>
+      !value || !ctrl.$isEmpty(viewValue);
+
+    // Re-evaluate the gate when `ng-required`'s expression changes. `parse`
+    // has no watch of its own, so watch the expression on the scope.
+    if (ngRequired !== undefined) {
+      scope.$watch(ngRequired, (newVal: unknown) => {
+        if (value !== newVal) {
+          value = newVal;
+          ctrl.$validate();
+        }
+      });
+    }
+  };
+
+  return { restrict: 'A', require: '?ngModel', link };
+}
+
+/**
+ * `ng-minlength` — the text must be at least N characters (FS §2.6).
+ * Publishes the `minlength` validator key. `$observe`s the `minlength`
+ * attribute so a data-driven bound re-validates. Passes on an empty value.
+ */
+function minlengthFactory(): DirectiveFactoryReturn {
+  const link: LinkFn = (scope, _element, attrs, controllers) => {
+    const ctrl = asNgModelController(controllers);
+    if (ctrl === null) {
+      return;
+    }
+
+    let parsedLength = -1;
+    ctrl.$validators[MINLENGTH_NAME] = (_modelValue: unknown, viewValue: unknown): boolean =>
+      ctrl.$isEmpty(viewValue) || String(viewValue).length >= parsedLength;
+
+    wireLengthSource(scope, attrs, MINLENGTH_NAME, NG_MINLENGTH_NAME, (parsed) => {
+      parsedLength = parsed;
+      ctrl.$validate();
+    });
+    // Seed the initial parsed bound synchronously so the first commit sees it.
+    parsedLength = readInitialLength(scope, attrs, MINLENGTH_NAME, NG_MINLENGTH_NAME);
+  };
+
+  return { restrict: 'A', require: '?ngModel', link };
+}
+
+/**
+ * `ng-maxlength` — the text must be at most N characters (FS §2.6).
+ * Publishes the `maxlength` validator key. A negative bound (`-1`, absent /
+ * non-numeric) is a no-op. `$observe`s the attribute; passes on empty.
+ */
+function maxlengthFactory(): DirectiveFactoryReturn {
+  const link: LinkFn = (scope, _element, attrs, controllers) => {
+    const ctrl = asNgModelController(controllers);
+    if (ctrl === null) {
+      return;
+    }
+
+    let parsedLength = -1;
+    ctrl.$validators[MAXLENGTH_NAME] = (_modelValue: unknown, viewValue: unknown): boolean =>
+      parsedLength < 0 || ctrl.$isEmpty(viewValue) || String(viewValue).length <= parsedLength;
+
+    wireLengthSource(scope, attrs, MAXLENGTH_NAME, NG_MAXLENGTH_NAME, (parsed) => {
+      parsedLength = parsed;
+      ctrl.$validate();
+    });
+    parsedLength = readInitialLength(scope, attrs, MAXLENGTH_NAME, NG_MAXLENGTH_NAME);
+  };
+
+  return { restrict: 'A', require: '?ngModel', link };
+}
+
+/**
+ * Matches an `ng-pattern` value written as a regex LITERAL (`/.../flags`) —
+ * as opposed to a scope expression yielding a RegExp / string. Mirrors
+ * AngularJS's `REGEX_STRING_REGEXP`.
+ */
+const REGEX_STRING_REGEXP = /^\/(.+)\/([a-z]*)$/;
+
+/**
+ * Resolve a pattern attribute value to a `RegExp`, or `undefined` when
+ * absent. Accepts a `RegExp` instance (from a scope expression), a
+ * `/.../flags` literal string, or a plain string (compiled anchored). A
+ * malformed literal throws `SyntaxError` from `RegExp` — matching
+ * AngularJS's behavior of surfacing the error.
+ */
+function parsePattern(value: unknown): RegExp | undefined {
+  if (value === undefined || value === null || value === '') {
+    return undefined;
+  }
+  if (value instanceof RegExp) {
+    return value;
+  }
+  // A non-RegExp, non-string source (e.g. an expression yielding a number)
+  // has no meaningful pattern — treat it as "no pattern" rather than
+  // stringify-then-compile garbage.
+  if (typeof value !== 'string') {
+    return undefined;
+  }
+  const str = value;
+  const literal = REGEX_STRING_REGEXP.exec(str);
+  if (literal !== null) {
+    return new RegExp(literal[1] ?? '', literal[2] ?? '');
+  }
+  // A plain string pattern is anchored (AngularJS compiles `new RegExp('^' + str + '$')`).
+  return new RegExp(`^${str}$`);
+}
+
+/**
+ * `pattern` / `ng-pattern` — the text must match a regular expression
+ * (FS §2.6). Publishes the `pattern` validator key. The pattern source may
+ * be a regex literal (`/^\d+$/`), a scope expression yielding a `RegExp`,
+ * or a plain string; `ng-pattern` re-parses on `$observe('pattern')` (the
+ * interpolated value) and on the expression's own change. Passes on empty.
+ */
+function patternFactory(): DirectiveFactoryReturn {
+  const link: LinkFn = (scope, _element, attrs, controllers) => {
+    const ctrl = asNgModelController(controllers);
+    if (ctrl === null) {
+      return;
+    }
+
+    const ngPattern = readAttr(attrs, NG_PATTERN_NAME);
+    // Resolve the initial source: `ng-pattern` — a literal string passes
+    // through verbatim (so `/.../` is honored), otherwise it is an
+    // expression evaluated against the scope; bare `pattern` reads the
+    // attribute string.
+    function resolveSource(): unknown {
+      if (ngPattern !== undefined) {
+        return REGEX_STRING_REGEXP.test(ngPattern) ? ngPattern : evalExpr(ngPattern, scope);
+      }
+      return readAttr(attrs, PATTERN_NAME);
+    }
+
+    let regexp = parsePattern(resolveSource());
+
+    ctrl.$validators[PATTERN_NAME] = (_modelValue: unknown, viewValue: unknown): boolean =>
+      ctrl.$isEmpty(viewValue) || regexp === undefined || regexp.test(String(viewValue));
+
+    // Re-resolve the pattern when its source changes, re-validating only on
+    // an actual change (`toString()` compare — parity). The native
+    // `pattern` attribute is `$observe`d ONLY when present; a `ng-pattern`
+    // EXPRESSION (non-literal) is `$watch`ed so a data-driven RegExp change
+    // re-validates. A `/.../` literal never changes, so it needs neither.
+    const revalidate = (): void => {
+      const next = parsePattern(resolveSource());
+      const changed = (regexp?.toString() ?? '') !== (next?.toString() ?? '');
+      regexp = next;
+      if (changed) {
+        ctrl.$validate();
+      }
+    };
+
+    if (readAttr(attrs, PATTERN_NAME) !== undefined) {
+      const stopObserve = attrs.$observe(PATTERN_NAME, revalidate);
+      scope.$on('$destroy', stopObserve);
+    } else if (ngPattern !== undefined && !REGEX_STRING_REGEXP.test(ngPattern)) {
+      scope.$watch(ngPattern, revalidate);
+    }
+  };
+
+  return { restrict: 'A', require: '?ngModel', link };
+}
+
+/** DI-annotated built-in validator factories (all zero-dep, array-wrapped). */
+export const requiredDirective: DirectiveFactory = [requiredFactory];
+export const ngRequiredDirective: DirectiveFactory = [requiredFactory];
+export const minlengthDirective: DirectiveFactory = [minlengthFactory];
+export const maxlengthDirective: DirectiveFactory = [maxlengthFactory];
+export const patternDirective: DirectiveFactory = [patternFactory];
+export const ngPatternDirective: DirectiveFactory = [patternFactory];
diff --git a/src/index.ts b/src/index.ts
index 637cd6f..9064921 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -231,3 +231,29 @@ export type {
   RequestTransform,
   ResponseTransform,
 } from './http/index';
+
+export {
+  createModelOptions,
+  defaultModelOptions,
+  FormControllerImpl,
+  NgModelControllerImpl,
+  NgModelNonAssignableError,
+  NgOptionsBadExpressionError,
+  nullFormCtrl,
+  registerForms,
+  resolveDebounceDelay,
+  SelectControllerImpl,
+} from './forms/index';
+export type {
+  AsyncValidator,
+  FormController,
+  FormControlLike,
+  ModelFormatter,
+  ModelOptions,
+  ModelParser,
+  NgModelController,
+  NgModelOptions,
+  NgOptionsDescriptor,
+  SelectController,
+  SyncValidator,
+} from './forms/index';
diff --git a/tsconfig.json b/tsconfig.json
index 978f88f..848efa2 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -26,7 +26,8 @@
       "@bootstrap/*": ["./src/bootstrap/*"],
       "@async/*": ["./src/async/*"],
       "@cache/*": ["./src/cache/*"],
-      "@http/*": ["./src/http/*"]
+      "@http/*": ["./src/http/*"],
+      "@forms/*": ["./src/forms/*"]
     }
   },
   "include": ["src"],
diff --git a/vitest.config.ts b/vitest.config.ts
index 4f3ee87..8d76406 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -19,6 +19,7 @@ export default defineConfig({
       '@async': path.resolve(__dirname, 'src/async'),
       '@cache': path.resolve(__dirname, 'src/cache'),
       '@http': path.resolve(__dirname, 'src/http'),
+      '@forms': path.resolve(__dirname, 'src/forms'),
     },
   },
   test: {