The ARIA spec says aria-controls is required on combobox.

The APG Roles, States and Properties section of the combobox pattern says:

The combobox element has aria-controls set to a value that refers to the element that serves as the popup. Note that aria-controls only needs to be set when the popup is visible. However, it is valid to reference an element that is not visible.

The 2nd sentence is problematic. It seems to be implying that aria-controls is not always required, i.e. authors can leave it off when the popup is not visible.

This may lead to confusion, with authors thinking, "Well, is it required or not?".
It also complicates processing for validator tools, making it less likely that tooling will catch incorrectly marked up comboboxes.

Consider rewriting the above point in the APG to say:

The combobox element has aria-controls set to a value that refers to the element that serves as the popup. Note that it is valid for aria-controls to reference an element that is not visible.