ultra11y 4.5.0 → 4.5.2

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "4.5.0",
+      "version": "4.5.2",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "4.5.0",
+  "version": "4.5.2",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "4.5.0",
+  "version": "4.5.2",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "4.5.0";
+const ULTRA11Y_PLUGIN_VERSION = "4.5.2";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "4.5.0",
+  "version": "4.5.2",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join50, relative as relative5, resolve as resolve15, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "4.5.0";
+var VERSION = "4.5.2";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -58352,6 +58352,20 @@ var LIVE_REGION_DETAIL = {
 function clicksAllowed(storageState, interactClicks) {
   return interactClicks === true || !storageState;
 }
+function landedOnRequestedPage(requested, landed) {
+  if (!landed || requested === landed) return true;
+  const path = (u) => {
+    try {
+      return new URL(u, "http://x.invalid").pathname.replace(/\/+$/, "");
+    } catch {
+      return void 0;
+    }
+  };
+  const a = path(requested);
+  const b = path(landed);
+  if (a === void 0 || b === void 0) return true;
+  return a === b;
+}
 async function probeLiveRegion(page, lang, allowClicks) {
   const detail = LIVE_REGION_DETAIL[lang] ?? LIVE_REGION_DETAIL.en;
   return await page.evaluate(liveRegionExpr(detail, allowClicks)).catch(() => []);
@@ -58520,6 +58534,7 @@ async function runSampleScanLocal(pages, opts) {
   const browser = await launchChromium(chromium);
   const findings = [];
   const snapshots = [];
+  const redirected = [];
   try {
     for (const page of pages) {
       const storageState = page.storageState ?? opts.storageState;
@@ -58531,6 +58546,10 @@ async function runSampleScanLocal(pages, opts) {
         lang,
         snapshot: Boolean(opts.snapshotRoot)
       });
+      if (!landedOnRequestedPage(page.url, out2.url)) {
+        redirected.push({ id: page.id, name: page.name, requested: page.url, landed: out2.url });
+        continue;
+      }
       findings.push(...tagSampleFindings(toDynamicResult(out2, page.url, lang, LOCAL_ENGINE).findings, page));
       const id = opts.snapshotRoot ? writeRunnerSnapshot(opts.snapshotRoot, out2, page.url, page) : void 0;
       if (id) snapshots.push(id);
@@ -58546,7 +58565,8 @@ async function runSampleScanLocal(pages, opts) {
     findings,
     sample: sampleScope({ pages }),
     testedScs: localTestedScs(interact),
-    ...snapshots.length ? { snapshots } : {}
+    ...snapshots.length ? { snapshots } : {},
+    ...redirected.length ? { redirected } : {}
   };
 }
 async function runCrawlScanLocal(opts) {
@@ -66615,8 +66635,9 @@ async function cmdScan(p) {
     }
     sampleConfig = v.sample;
     if (!useLocal && sampleConfig.pages.some((pg) => pg.storageState)) {
+      const forced = typeof p.flags.runtime === "string" && p.flags.runtime === "docker";
       console.error(
-        lang === "fr" ? "ultra11y scan : l'\xE9chantillon comporte des pages authentifi\xE9es (storageState), non prises en charge par le runtime Docker. Utilisez --runtime local --cwd <projet>." : "ultra11y scan: the sample has authenticated pages (storageState), unsupported by the Docker runtime. Use --runtime local --cwd <project>."
+        lang === "fr" ? `ultra11y scan : l'\xE9chantillon comporte des pages authentifi\xE9es (storageState), non prises en charge par le runtime Docker.${forced ? " Retirez --runtime docker." : " Le runtime local n'a pas pu \xEAtre r\xE9solu : installez @playwright/test et @axe-core/playwright dans le projet audit\xE9 (ou pointez --cwd dessus). Via l'Action, ce sont des d\xE9pendances du d\xE9p\xF4t."}` : `ultra11y scan: the sample has authenticated pages (storageState), unsupported by the Docker runtime.${forced ? " Drop --runtime docker." : " The local runtime could not be resolved: install @playwright/test and @axe-core/playwright in the audited project (or point --cwd at it). Through the Action, those are dependencies of the repository."}`
       );
       return 2;
     }
@@ -66645,6 +66666,13 @@ async function cmdScan(p) {
     console.error(`ultra11y scan: ${e instanceof Error ? e.message : String(e)}`);
     return 1;
   }
+  if (dynamic.redirected?.length) {
+    for (const r of dynamic.redirected) {
+      console.error(
+        lang === "fr" ? `\u26A0\uFE0F ultra11y scan : \xAB ${r.name} \xBB (${r.id}) non enregistr\xE9e \u2014 ${r.requested} a redirig\xE9 vers ${r.landed}. L'enregistrer aurait d\xE9crit cet \xE9cran sous le nom du premier.` : `\u26A0\uFE0F ultra11y scan: "${r.name}" (${r.id}) not recorded \u2014 ${r.requested} redirected to ${r.landed}. Recording it would have described that screen under the first one's name.`
+      );
+    }
+  }
   if (useSample && sampleConfig) {
     const lintKey = typeof p.flags.standard === "string" && p.flags.standard ? p.flags.standard : "rgaa";
     try {

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 4.5.0
+  version: 4.5.2
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join50, relative as relative5, resolve as resolve15, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "4.5.0";
+var VERSION = "4.5.2";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -58352,6 +58352,20 @@ var LIVE_REGION_DETAIL = {
 function clicksAllowed(storageState, interactClicks) {
   return interactClicks === true || !storageState;
 }
+function landedOnRequestedPage(requested, landed) {
+  if (!landed || requested === landed) return true;
+  const path = (u) => {
+    try {
+      return new URL(u, "http://x.invalid").pathname.replace(/\/+$/, "");
+    } catch {
+      return void 0;
+    }
+  };
+  const a = path(requested);
+  const b = path(landed);
+  if (a === void 0 || b === void 0) return true;
+  return a === b;
+}
 async function probeLiveRegion(page, lang, allowClicks) {
   const detail = LIVE_REGION_DETAIL[lang] ?? LIVE_REGION_DETAIL.en;
   return await page.evaluate(liveRegionExpr(detail, allowClicks)).catch(() => []);
@@ -58520,6 +58534,7 @@ async function runSampleScanLocal(pages, opts) {
   const browser = await launchChromium(chromium);
   const findings = [];
   const snapshots = [];
+  const redirected = [];
   try {
     for (const page of pages) {
       const storageState = page.storageState ?? opts.storageState;
@@ -58531,6 +58546,10 @@ async function runSampleScanLocal(pages, opts) {
         lang,
         snapshot: Boolean(opts.snapshotRoot)
       });
+      if (!landedOnRequestedPage(page.url, out2.url)) {
+        redirected.push({ id: page.id, name: page.name, requested: page.url, landed: out2.url });
+        continue;
+      }
       findings.push(...tagSampleFindings(toDynamicResult(out2, page.url, lang, LOCAL_ENGINE).findings, page));
       const id = opts.snapshotRoot ? writeRunnerSnapshot(opts.snapshotRoot, out2, page.url, page) : void 0;
       if (id) snapshots.push(id);
@@ -58546,7 +58565,8 @@ async function runSampleScanLocal(pages, opts) {
     findings,
     sample: sampleScope({ pages }),
     testedScs: localTestedScs(interact),
-    ...snapshots.length ? { snapshots } : {}
+    ...snapshots.length ? { snapshots } : {},
+    ...redirected.length ? { redirected } : {}
   };
 }
 async function runCrawlScanLocal(opts) {
@@ -66615,8 +66635,9 @@ async function cmdScan(p) {
     }
     sampleConfig = v.sample;
     if (!useLocal && sampleConfig.pages.some((pg) => pg.storageState)) {
+      const forced = typeof p.flags.runtime === "string" && p.flags.runtime === "docker";
       console.error(
-        lang === "fr" ? "ultra11y scan : l'\xE9chantillon comporte des pages authentifi\xE9es (storageState), non prises en charge par le runtime Docker. Utilisez --runtime local --cwd <projet>." : "ultra11y scan: the sample has authenticated pages (storageState), unsupported by the Docker runtime. Use --runtime local --cwd <project>."
+        lang === "fr" ? `ultra11y scan : l'\xE9chantillon comporte des pages authentifi\xE9es (storageState), non prises en charge par le runtime Docker.${forced ? " Retirez --runtime docker." : " Le runtime local n'a pas pu \xEAtre r\xE9solu : installez @playwright/test et @axe-core/playwright dans le projet audit\xE9 (ou pointez --cwd dessus). Via l'Action, ce sont des d\xE9pendances du d\xE9p\xF4t."}` : `ultra11y scan: the sample has authenticated pages (storageState), unsupported by the Docker runtime.${forced ? " Drop --runtime docker." : " The local runtime could not be resolved: install @playwright/test and @axe-core/playwright in the audited project (or point --cwd at it). Through the Action, those are dependencies of the repository."}`
       );
       return 2;
     }
@@ -66645,6 +66666,13 @@ async function cmdScan(p) {
     console.error(`ultra11y scan: ${e instanceof Error ? e.message : String(e)}`);
     return 1;
   }
+  if (dynamic.redirected?.length) {
+    for (const r of dynamic.redirected) {
+      console.error(
+        lang === "fr" ? `\u26A0\uFE0F ultra11y scan : \xAB ${r.name} \xBB (${r.id}) non enregistr\xE9e \u2014 ${r.requested} a redirig\xE9 vers ${r.landed}. L'enregistrer aurait d\xE9crit cet \xE9cran sous le nom du premier.` : `\u26A0\uFE0F ultra11y scan: "${r.name}" (${r.id}) not recorded \u2014 ${r.requested} redirected to ${r.landed}. Recording it would have described that screen under the first one's name.`
+      );
+    }
+  }
   if (useSample && sampleConfig) {
     const lintKey = typeof p.flags.standard === "string" && p.flags.standard ? p.flags.standard : "rgaa";
     try {

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 4.5.0
+  version: 4.5.2
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/references/pages.md

@@ -220,7 +220,17 @@ Sheets are named `page-<id>.md`: a page whose id is `index` — the ordinary id
 gates that mean something here — above all **no invented criterion** — instead of demanding
 the §1–5 structure of a conformance document.
 
-### Three honesty rules
+### Four honesty rules
+
+**0. A page is recorded only if the browser stayed on it.** A sample page's declared `id` and
+`name` are the identity the report speaks, and they are applied to whatever was on screen. So a
+route that redirects — an expired session bouncing to sign-in, a wizard step the application
+state does not open — would be filed under the requested page's name while showing something
+else: a sheet, a screenshot and a rate that describe a different screen, with nothing about the
+document looking wrong. `scan --sample` compares the landed **path** against the requested one
+(a query string or fragment the app appends is the same page) and **drops** a page that moved,
+naming it and where it went. A page reported missing is a bug in the sample or in the state you
+seeded, and both are fixable; a page reported under the wrong name is a false conformance claim.
 
 **1. A finding is attributed to a page only when something says so.** In order: the snapshot
 path it was raised on (`.ultra11y/pages/<id>/dom.html` — the id is *in the path*, which is what

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join50, relative as relative5, resolve as resolve15, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "4.5.0";
+var VERSION = "4.5.2";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -58352,6 +58352,20 @@ var LIVE_REGION_DETAIL = {
 function clicksAllowed(storageState, interactClicks) {
   return interactClicks === true || !storageState;
 }
+function landedOnRequestedPage(requested, landed) {
+  if (!landed || requested === landed) return true;
+  const path = (u) => {
+    try {
+      return new URL(u, "http://x.invalid").pathname.replace(/\/+$/, "");
+    } catch {
+      return void 0;
+    }
+  };
+  const a = path(requested);
+  const b = path(landed);
+  if (a === void 0 || b === void 0) return true;
+  return a === b;
+}
 async function probeLiveRegion(page, lang, allowClicks) {
   const detail = LIVE_REGION_DETAIL[lang] ?? LIVE_REGION_DETAIL.en;
   return await page.evaluate(liveRegionExpr(detail, allowClicks)).catch(() => []);
@@ -58520,6 +58534,7 @@ async function runSampleScanLocal(pages, opts) {
   const browser = await launchChromium(chromium);
   const findings = [];
   const snapshots = [];
+  const redirected = [];
   try {
     for (const page of pages) {
       const storageState = page.storageState ?? opts.storageState;
@@ -58531,6 +58546,10 @@ async function runSampleScanLocal(pages, opts) {
         lang,
         snapshot: Boolean(opts.snapshotRoot)
       });
+      if (!landedOnRequestedPage(page.url, out2.url)) {
+        redirected.push({ id: page.id, name: page.name, requested: page.url, landed: out2.url });
+        continue;
+      }
       findings.push(...tagSampleFindings(toDynamicResult(out2, page.url, lang, LOCAL_ENGINE).findings, page));
       const id = opts.snapshotRoot ? writeRunnerSnapshot(opts.snapshotRoot, out2, page.url, page) : void 0;
       if (id) snapshots.push(id);
@@ -58546,7 +58565,8 @@ async function runSampleScanLocal(pages, opts) {
     findings,
     sample: sampleScope({ pages }),
     testedScs: localTestedScs(interact),
-    ...snapshots.length ? { snapshots } : {}
+    ...snapshots.length ? { snapshots } : {},
+    ...redirected.length ? { redirected } : {}
   };
 }
 async function runCrawlScanLocal(opts) {
@@ -66615,8 +66635,9 @@ async function cmdScan(p) {
     }
     sampleConfig = v.sample;
     if (!useLocal && sampleConfig.pages.some((pg) => pg.storageState)) {
+      const forced = typeof p.flags.runtime === "string" && p.flags.runtime === "docker";
       console.error(
-        lang === "fr" ? "ultra11y scan : l'\xE9chantillon comporte des pages authentifi\xE9es (storageState), non prises en charge par le runtime Docker. Utilisez --runtime local --cwd <projet>." : "ultra11y scan: the sample has authenticated pages (storageState), unsupported by the Docker runtime. Use --runtime local --cwd <project>."
+        lang === "fr" ? `ultra11y scan : l'\xE9chantillon comporte des pages authentifi\xE9es (storageState), non prises en charge par le runtime Docker.${forced ? " Retirez --runtime docker." : " Le runtime local n'a pas pu \xEAtre r\xE9solu : installez @playwright/test et @axe-core/playwright dans le projet audit\xE9 (ou pointez --cwd dessus). Via l'Action, ce sont des d\xE9pendances du d\xE9p\xF4t."}` : `ultra11y scan: the sample has authenticated pages (storageState), unsupported by the Docker runtime.${forced ? " Drop --runtime docker." : " The local runtime could not be resolved: install @playwright/test and @axe-core/playwright in the audited project (or point --cwd at it). Through the Action, those are dependencies of the repository."}`
       );
       return 2;
     }
@@ -66645,6 +66666,13 @@ async function cmdScan(p) {
     console.error(`ultra11y scan: ${e instanceof Error ? e.message : String(e)}`);
     return 1;
   }
+  if (dynamic.redirected?.length) {
+    for (const r of dynamic.redirected) {
+      console.error(
+        lang === "fr" ? `\u26A0\uFE0F ultra11y scan : \xAB ${r.name} \xBB (${r.id}) non enregistr\xE9e \u2014 ${r.requested} a redirig\xE9 vers ${r.landed}. L'enregistrer aurait d\xE9crit cet \xE9cran sous le nom du premier.` : `\u26A0\uFE0F ultra11y scan: "${r.name}" (${r.id}) not recorded \u2014 ${r.requested} redirected to ${r.landed}. Recording it would have described that screen under the first one's name.`
+      );
+    }
+  }
   if (useSample && sampleConfig) {
     const lintKey = typeof p.flags.standard === "string" && p.flags.standard ? p.flags.standard : "rgaa";
     try {

package/src/cli.ts

@@ -3004,10 +3004,25 @@ async function cmdScan(p: ParsedArgs): Promise<number> {
     }
     sampleConfig = v.sample;
     if (!useLocal && sampleConfig.pages.some((pg) => pg.storageState)) {
+      // `--runtime local` is not always the caller's to pass: inside the GitHub Action the
+      // scan is invoked for them. On `auto` the runtime fell back to Docker because the local
+      // tier could not resolve, so naming the missing dependency is the only actionable half
+      // of this message — "use --runtime local" alone sends an Action user to a flag they
+      // cannot reach, and telling them to force a runtime that still cannot load would
+      // exchange this error for a worse one.
+      const forced = typeof p.flags.runtime === "string" && p.flags.runtime === "docker";
       console.error(
         lang === "fr"
-          ? "ultra11y scan : l'échantillon comporte des pages authentifiées (storageState), non prises en charge par le runtime Docker. Utilisez --runtime local --cwd <projet>."
-          : "ultra11y scan: the sample has authenticated pages (storageState), unsupported by the Docker runtime. Use --runtime local --cwd <project>.",
+          ? `ultra11y scan : l'échantillon comporte des pages authentifiées (storageState), non prises en charge par le runtime Docker.${
+              forced
+                ? " Retirez --runtime docker."
+                : " Le runtime local n'a pas pu être résolu : installez @playwright/test et @axe-core/playwright dans le projet audité (ou pointez --cwd dessus). Via l'Action, ce sont des dépendances du dépôt."
+            }`
+          : `ultra11y scan: the sample has authenticated pages (storageState), unsupported by the Docker runtime.${
+              forced
+                ? " Drop --runtime docker."
+                : " The local runtime could not be resolved: install @playwright/test and @axe-core/playwright in the audited project (or point --cwd at it). Through the Action, those are dependencies of the repository."
+            }`,
       );
       return 2;
     }
@@ -3044,6 +3059,18 @@ async function cmdScan(p: ParsedArgs): Promise<number> {
     console.error(`ultra11y scan: ${e instanceof Error ? e.message : String(e)}`);
     return 1;
   }
+  // Pages the scan refused to file, because the browser ended up on another route. Loud, and
+  // on stderr: a silently shorter sample is indistinguishable from a sample that passed, and
+  // the cause is always fixable — an expired session, or state the wizard step needs.
+  if (dynamic.redirected?.length) {
+    for (const r of dynamic.redirected) {
+      console.error(
+        lang === "fr"
+          ? `⚠️ ultra11y scan : « ${r.name} » (${r.id}) non enregistrée — ${r.requested} a redirigé vers ${r.landed}. L'enregistrer aurait décrit cet écran sous le nom du premier.`
+          : `⚠️ ultra11y scan: "${r.name}" (${r.id}) not recorded — ${r.requested} redirected to ${r.landed}. Recording it would have described that screen under the first one's name.`,
+      );
+    }
+  }
   // Advisory sample-methodology lint: which normative page KINDS the configured sample
   // lacks. Standard-agnostic mechanics + RGAA-specific required kinds; scan has no
   // --standard, so we lint against the config's default standard (else RGAA if registered).

package/src/scan-local.ts

@@ -11,7 +11,7 @@
 import { existsSync, statSync } from "node:fs";
 import { createRequire } from "node:module";
 import { resolve } from "node:path";
-import type { DynamicFinding, DynamicResult, Lang, SamplePage } from "./types.js";
+import type { DynamicFinding, DynamicResult, Lang, SamplePage, ScanRedirect } from "./types.js";
 import { type DiscoverOpts, discoverUrls, type ProbeHit, type RunnerOutput, tagSampleFindings, toDynamicResult, writeRunnerSnapshot } from "./scan.js";
 import { sampleScope } from "./sample.js";
 import { COLLECT_SNAPSHOT, type CollectedPage } from "./snapshot.js";
@@ -604,6 +604,36 @@ export function clicksAllowed(storageState: string | undefined, interactClicks:
   return interactClicks === true || !storageState;
 }
 
+/** Did the browser end up on the page we ASKED for?
+ *
+ *  A sample page's declared id/name is the identity the report and the per-page grid speak,
+ *  and it is applied to whatever the browser had on screen. So a route that redirects — an
+ *  expired session bouncing to /login, a wizard step the application state does not open —
+ *  gets recorded under the requested page's name while showing another screen entirely.
+ *  Nothing about the resulting document looks wrong, which is what makes it the worst
+ *  failure mode an accessibility report has: a reader sees a page sheet, a screenshot and a
+ *  conformance rate, and none of it describes the page named at the top.
+ *
+ *  Only the PATH is compared. A query string or fragment the app appends to its own route is
+ *  the same page; a different path is a different page. Anything unparseable is treated as a
+ *  match — this guard exists to catch a redirect, not to invent one. Exported for the
+ *  browser-free policy test. */
+export function landedOnRequestedPage(requested: string, landed: string): boolean {
+  if (!landed || requested === landed) return true;
+  const path = (u: string): string | undefined => {
+    try {
+      // `file://` targets and relative paths never redirect; base makes them parseable.
+      return new URL(u, "http://x.invalid").pathname.replace(/\/+$/, "");
+    } catch {
+      return undefined;
+    }
+  };
+  const a = path(requested);
+  const b = path(landed);
+  if (a === undefined || b === undefined) return true;
+  return a === b;
+}
+
 async function probeLiveRegion(page: Any, lang: Lang, allowClicks: boolean): Promise<ProbeHit[]> {
   const detail = LIVE_REGION_DETAIL[lang] ?? LIVE_REGION_DETAIL.en;
   return (await page.evaluate(liveRegionExpr(detail, allowClicks)).catch(() => [])) as ProbeHit[];
@@ -880,6 +910,7 @@ export async function runSampleScanLocal(pages: SamplePage[], opts: LocalManyOpt
   const browser = await launchChromium(chromium);
   const findings: DynamicFinding[] = [];
   const snapshots: string[] = [];
+  const redirected: ScanRedirect[] = [];
   try {
     for (const page of pages) {
       const storageState = page.storageState ?? opts.storageState; // per-page override
@@ -891,6 +922,15 @@ export async function runSampleScanLocal(pages: SamplePage[], opts: LocalManyOpt
         lang,
         snapshot: Boolean(opts.snapshotRoot),
       });
+      // The declared identity is applied to whatever the browser had on screen, so a page
+      // that bounced elsewhere would be filed under the name of the page nobody looked at.
+      // Drop it instead, and say which one and where it went: a page reported missing is a
+      // bug in the sample or the seeded state, and both are fixable. A page reported under
+      // the wrong name is neither — it is a false conformance claim.
+      if (!landedOnRequestedPage(page.url, out.url)) {
+        redirected.push({ id: page.id, name: page.name, requested: page.url, landed: out.url });
+        continue;
+      }
       findings.push(...tagSampleFindings(toDynamicResult(out, page.url, lang, LOCAL_ENGINE).findings, page));
       // The sample page's declared id/name/auth/notes win over anything derived from the
       // URL: that identity is what the report and the per-page grid speak.
@@ -909,6 +949,7 @@ export async function runSampleScanLocal(pages: SamplePage[], opts: LocalManyOpt
     sample: sampleScope({ pages }),
     testedScs: localTestedScs(interact),
     ...(snapshots.length ? { snapshots } : {}),
+    ...(redirected.length ? { redirected } : {}),
   };
 }
 

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "4.5.0";
+export const VERSION = "4.5.2";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,
@@ -47,6 +47,18 @@ export interface SampleScope {
   transverse?: string[];
 }
 
+// A sample page the scan REFUSED to record, because the browser ended up somewhere else —
+// a session that had expired, a wizard step the application state does not open. Recording
+// it would have filed another screen under this page's name, which reads as a complete
+// report and is a false conformance claim. Reported so the sample or the seeded state can
+// be fixed; never silently dropped.
+export interface ScanRedirect {
+  id: string;
+  name: string;
+  requested: string;
+  landed: string;
+}
+
 // ---- WCAG 2.2 canonical core (src/data/wcag.json, produced by scripts/build-standards.mjs)
 // The engine's canonical key. Success-criterion ids/titles/levels are derived from the
 // official W3C source (https://github.com/w3c/wcag); rule coverage + automatability are
@@ -560,4 +572,7 @@ export interface DynamicResult {
   // static rules never ran against its DOM, so src/pages.ts keeps it `manual` forever).
   // Empty/absent when snapshotting was off or every collection failed. Optional/additive.
   snapshots?: string[];
+  // Sample pages dropped because the browser landed on a different path than the one asked
+  // for. Absent when every page was reached. Optional/additive — see ScanRedirect.
+  redirected?: ScanRedirect[];
 }