The opening of 9.2 Parameters does not list it as allowed for xsl:package or xsl:transform.

We seem to have two conflicting statements with regards to the tunnel attribute. In 9.2 Parameters, we say:

A)  As a child of xsl:stylesheet, to define a parameter to the transformation. 
    In this case all attributes except tunnel are permitted. Stylesheet 
    parameters are set by the calling application: see 2.3.2 Priming a 
    Stylesheet.

And at the bottom of that same chapter (just before 9.2.1):

B)  The optional tunnel attribute may be used to indicate that a parameter is 
    a tunnel parameter. The default is no; the value yes may be specified only 
    for template parameters. Tunnel parameters are described in 10.1.3 Tunnel 
    Parameters

And in 9.10 we say (2nd last para):

C)  The optional tunnel attribute may be used to indicate that a parameter is
    a tunnel parameter. The default is no. Tunnel parameters are described in 
    10.1.3 Tunnel Parameters. They are used only when passing parameters to 
    templates: for an xsl:with-param element that is a child of xsl:evaluate 
    or xsl:next-iteration the tunnel attribute must either be omitted or take 
    the value no.

So, in (A) we say it is _not permitted_, in (B) we say it is permitted but takes a value of no outside xsl:template, in (C) we say for xsl:with-param that it may take a value of no only for xsl:evaluate and xsl:next-iteration.

I propose to align these statements and keep it simple, similar to the select attribute in xsl:function, just disallow it except inside xsl:template.

Since xsl:param has so many different guises, this is what we came up with:


xsl:param in           tunnel       static       select       required
---------------------- ------------ ------------ ------------ -------------
xsl:stylesheet etc     disallowed   allowed      allowed      allowed
xsl:package            disallowed   allowed      allowed      allowed
xsl:template           allowed      disallowed   allowed      allowed
xsl:function           disallowed   disallowed   disallowed   disallowed
xsl:iterate            disallowed   disallowed   mandatory    disallowed


xsl:with-param in
---------------------- ------------
xsl:apply-templates    allowed
xsl:call-template      allowed
xsl:next-iteration     disallowed*
xsl:evaluate           disallowed*

* currently allowed only with the value no, I propose to disallow it similar 
  to the rules of xsl:param, to avoid confusion

Error summary:
XTSE0010 If a name is missing, or under xsl:iterate, if select is missing
XTSE0020 If any of the values are wrong
XTSE0090 If an attribute that is disallowed in the table above is used