We say in 3.3.5: "If the axis name is omitted from an axis step, the default axis is child, with two exceptions: if the axis step contains an AttributeTest or SchemaAttributeTest then the default axis is attribute; if the axis step contains namespace-node() then the default axis is namespace."

The word "contains" here is too broad. The axis step contains a predicate list, and we are not interested in what the predicate list contains. We should say "if the NodeTest is an AttributeTest..." etc.

(There is another problem with this section in that rule 3 concerns the semantics of "//" which is not an abbreviated axis step; the rule is misplaced.)