ultra11y 5.15.1 → 5.17.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.15.1",
+      "version": "5.17.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.15.1",
+  "version": "5.17.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.15.1",
+  "version": "5.17.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.15.1";
+const ULTRA11Y_PLUGIN_VERSION = "5.17.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -442,7 +442,7 @@ node scripts/ultra11y.mjs scan http://localhost:3000 --runtime local --cwd . --m
 node scripts/ultra11y.mjs report --in audits/audit-latest.json --out audits
 ```
 
-Only the Docker runtime needs Docker; `--runtime local` needs a project with `@playwright/test` + `@axe-core/playwright`. The rest of the skill is zero-dependency. The Docker runner + Dockerfile are embedded in the engine and mirrored under `docker/` (with a `docker-compose.yml`). See `skills/ultra11y/references/dynamic.md`.
+Only the Docker runtime needs Docker. `--runtime local` needs a Chromium binary (`npx playwright install chromium`) plus `@playwright/test` and `@axe-core/playwright` — which **come with the npm package**, since they are its own dependencies; the audited project's own copies take precedence when it has them. Running the engine as a **standalone skill bundle** is the exception: an installed skill has no `node_modules` beside it, so there the two packages must be in the audited project, reachable from `--cwd`. The engine bundle itself stays dependency-free either way. The Docker runner + Dockerfile are embedded in the engine and mirrored under `docker/` (with a `docker-compose.yml`). See `skills/ultra11y/references/dynamic.md`.
 
 Typical audit flow:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.15.1",
+  "version": "5.17.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",
@@ -77,14 +77,14 @@
     "url": "https://github.com/maxgfr/ultra11y"
   },
   "dependencies": {
+    "@axe-core/playwright": "^4.13.0",
     "@babel/parser": "^8.0.0",
+    "@playwright/test": "^1.62.1",
     "domhandler": "^6.0.1",
     "htmlparser2": "^12.0.0"
   },
   "devDependencies": {
-    "@axe-core/playwright": "^4.13.0",
     "@biomejs/biome": "^2.5.1",
-    "@playwright/test": "^1.62.1",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^10.0.1",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.15.1";
+var VERSION = "5.17.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2290,7 +2290,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-20 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -54623,6 +54623,17 @@ function renderRedirected(redirected, lang = "en") {
   }
   return out2;
 }
+function gridRate(rows, status, pageId) {
+  let c2 = 0;
+  let nc = 0;
+  for (const row of rows) {
+    const st = status.get(row.id)?.get(pageId);
+    if (st === "C") c2++;
+    else if (st === "NC") nc++;
+  }
+  const decided = c2 + nc;
+  return [decided === 0 ? null : Math.round(c2 / decided * 100), decided, rows.length];
+}
 function renderPageGrid(result, pages, standard = CORE2, lang = "en") {
   const s = L3[lang];
   const out2 = [];
@@ -54636,9 +54647,9 @@ function renderPageGrid(result, pages, standard = CORE2, lang = "en") {
   if (derived.some((p) => p.basis === "attributed")) out2.push(`> \u26A0\uFE0F ${s.basisNote}`, "");
   const head = [isCore(standard) ? s.criterion : s.criterion, ...derived.map((p) => `${p.name}${p.auth ? " \u{1F512}" : ""}`)];
   out2.push(`| ${head.join(" | ")} |`, `| ${head.map(() => "---").join(" | ")} |`);
-  out2.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(p.conformancePct, p.decided, p.total)}**`).join(" | ")} |`);
-  out2.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
   const { rows, status } = pageGridModel(result, derived, standard, lang);
+  out2.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(...gridRate(rows, status, p.id))}**`).join(" | ")} |`);
+  out2.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
   let group = "";
   for (const row of rows) {
     if (row.group !== group) {
@@ -59669,11 +59680,13 @@ function mergeSnapshotAudit(base, snap) {
   if (snap.packFindings?.length) merged.packFindings = [...merged.packFindings ?? [], ...snap.packFindings];
   for (const c2 of merged.criteria) {
     if (!c2.inapplicable) continue;
-    if (snapById.get(c2.id)?.status === "C") {
-      c2.status = "C";
-      delete c2.inapplicable;
-      delete c2.justification;
-    }
+    const measured = snapById.get(c2.id);
+    if (!measured || measured.status !== "C" || measured.inapplicable) continue;
+    c2.status = "C";
+    delete c2.inapplicable;
+    if (measured.justification) c2.justification = measured.justification;
+    else delete c2.justification;
+    if (measured.decidedBy) c2.decidedBy = measured.decidedBy;
   }
   const nowNc = new Set(snap.findings.filter((f) => !f.advisory).map((f) => f.criteriaId));
   merged.residualRisks = merged.residualRisks.filter((r) => !nowNc.has(r.criteriaId));
@@ -59894,17 +59907,38 @@ function localTestedScs(interact) {
 }
 var PW_SPEC = "@playwright/test";
 var AXE_SPEC = "@axe-core/playwright";
-function localTierStatus(cwd) {
-  const req = createRequire(resolve12(cwd, "package.json"));
-  for (const spec of [PW_SPEC, AXE_SPEC]) {
+function resolveAnchors(cwd) {
+  return [resolve12(cwd, "package.json"), import.meta.url];
+}
+function requireRuntime(cwd, spec) {
+  let last;
+  for (const from of resolveAnchors(cwd)) {
     try {
-      req.resolve(spec);
+      return createRequire(from)(spec);
+    } catch (e) {
+      last = e;
+    }
+  }
+  throw last instanceof Error ? last : new Error(String(last));
+}
+function resolvesRuntime(cwd, spec) {
+  return resolveAnchors(cwd).some((from) => {
+    try {
+      createRequire(from).resolve(spec);
+      return true;
     } catch {
-      return { ok: false, reason: `${spec} does not resolve from ${cwd}` };
+      return false;
+    }
+  });
+}
+function localTierStatus(cwd) {
+  for (const spec of [PW_SPEC, AXE_SPEC]) {
+    if (!resolvesRuntime(cwd, spec)) {
+      return { ok: false, reason: `${spec} resolves neither from ${cwd} nor from ultra11y itself` };
     }
   }
   try {
-    const pw = req(PW_SPEC);
+    const pw = requireRuntime(cwd, PW_SPEC);
     const bin = pw.chromium?.executablePath?.();
     if (typeof bin === "string" && bin.length > 0 && !existsSync24(bin)) {
       return { ok: false, reason: `no browser binary at ${bin} \u2014 run \`npx playwright install chromium\`` };
@@ -59921,15 +59955,14 @@ function resolveLocalDeps(cwd) {
   let chromium;
   let AxeBuilder;
   try {
-    const req = createRequire(resolve12(cwd, "package.json"));
-    const pw = req(PW_SPEC);
-    const axeMod = req(AXE_SPEC);
+    const pw = requireRuntime(cwd, PW_SPEC);
+    const axeMod = requireRuntime(cwd, AXE_SPEC);
     chromium = pw.chromium;
     AxeBuilder = axeMod.default ?? axeMod;
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
     throw new Error(
-      `Playwright not resolvable from "${cwd}". Pass --cwd <dir> at a project with @playwright/test + @axe-core/playwright installed (e.g. --cwd packages/app), or use --runtime docker. (${msg})`
+      `Playwright resolves neither from "${cwd}" nor from ultra11y itself. Both are dependencies of this package, so the usual cause is the standalone engine bundle running with no node_modules beside it: pass --cwd <dir> at a project that has @playwright/test + @axe-core/playwright (e.g. --cwd packages/app), or use --runtime docker. (${msg})`
     );
   }
   if (!chromium || typeof AxeBuilder !== "function") {
@@ -60996,7 +61029,7 @@ jobs:
   ultra11y:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # the diff gate needs the base ref
       - uses: maxgfr/ultra11y@v${VERSION}
@@ -62955,12 +62988,16 @@ function scoreboardBlocks(result, standard, lang, sheetHref) {
   const scope = pagesOf(result);
   if (!scope.length) return [];
   const derived = derivePages(result, scope);
-  const rows = derived.map((p) => [
-    { text: `${p.name}${p.auth ? " \u{1F512}" : ""}`, ...sheetHref ? { href: sheetHref(p.id) } : {} },
-    { text: p.url, mono: true },
-    { text: basisLabel(p.basis, lang) },
-    { text: formatRate(p.conformancePct, p.decided, p.total), align: "end" }
-  ]);
+  const rows = derived.map((p) => {
+    const criteria = pageCriterionRows(result, p, standard, lang);
+    const cov = pageCoverage(criteria);
+    return [
+      { text: `${p.name}${p.auth ? " \u{1F512}" : ""}`, ...sheetHref ? { href: sheetHref(p.id) } : {} },
+      { text: p.url, mono: true },
+      { text: basisLabel(p.basis, lang) },
+      { text: formatRate(pageRatePct(criteria), cov.decided, cov.total), align: "end" }
+    ];
+  });
   const out2 = [
     { kind: "heading", level: 2, text: t3.perPage, id: "pages" },
     {
@@ -67042,6 +67079,9 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
 ]);
 var KNOWN_FLAGS = /* @__PURE__ */ new Set([...VALUE_FLAGS2, ...BOOLEAN_FLAGS]);
 var LIST_FLAGS = /* @__PURE__ */ new Set(["include", "exclude", "ext"]);
+function looksLikeFlag(token) {
+  return token?.startsWith("--") ?? false;
+}
 function parseArgs(argv) {
   const [command, ...rest] = argv;
   const valueFlags = valueFlagsFor(command ?? "");
@@ -67056,7 +67096,7 @@ function parseArgs(argv) {
       const inlineVal = eq === -1 ? void 0 : a.slice(eq + 1);
       let val;
       if (inlineVal !== void 0) val = inlineVal;
-      else if (valueFlags.has(key)) val = rest[++i2] ?? "";
+      else if (valueFlags.has(key) && !looksLikeFlag(rest[i2 + 1])) val = rest[++i2] ?? "";
       else val = true;
       const prev = flags2[key];
       if (LIST_FLAGS.has(key) && typeof prev === "string" && typeof val === "string") {

package/scripts/vendor/wcag-2.2-fr.json

@@ -1,6 +1,6 @@
 {
   "source": "https://www.w3.org/Translations/WCAG22-fr/",
-  "fetchedAt": "2026-08-19",
+  "fetchedAt": "2026-08-20",
   "principles": {
     "1": "Perceptible",
     "2": "Utilisable",

package/scripts/vendor/wcag-2.2-sc-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-20 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "principles": [
     {
       "number": 1,

package/scripts/vendor/wcag-2.2-techniques.json

@@ -2,7 +2,7 @@
   "source": "https://github.com/w3c/wcag",
   "understanding": "https://www.w3.org/WAI/WCAG22/Understanding/",
   "license": "W3C Document License (code samples: W3C Software License)",
-  "fetchedAt": "2026-08-19",
+  "fetchedAt": "2026-08-20",
   "criteria": {
     "1.1.1": {
       "slug": "non-text-content",

package/scripts/vendor/wcag-2.2-text.json

@@ -1,7 +1,7 @@
 {
   "source": "https://github.com/w3c/wcag",
   "license": "W3C Document License",
-  "fetchedAt": "2026-08-19",
+  "fetchedAt": "2026-08-20",
   "criteria": {
     "1.1.1": "All non-text content that is presented to the user has a text alternative that serves the equivalent purpose, except for the situations listed below.\nControls, Input:\nIf non-text content is a control or accepts user input, then it has a name that describes its purpose. (Refer to Success Criterion 4.1.2 Name, Role, Value for additional requirements for controls and content that accepts user input.)\nTime-Based Media:\nIf non-text content is time-based media, then text alternatives at least provide descriptive identification of the non-text content. (Refer to Guideline 1.2 for additional requirements for media.)\nTest:\nIf non-text content is a test or exercise that would be invalid if presented in text, then text alternatives at least provide descriptive identification of the non-text content.\nSensory:\nIf non-text content is primarily intended to create a specific sensory experience, then text alternatives at least provide descriptive identification of the non-text content.\nCAPTCHA:\nIf the purpose of non-text content is to confirm that content is being accessed by a person rather than a computer, then text alternatives that identify and describe the purpose of the non-text content are provided, and alternative forms of CAPTCHA using output modes for different types of sensory perception are provided to accommodate different disabilities.\nDecoration, Formatting, Invisible:\nIf non-text content is pure decoration, is used only for visual formatting, or is not presented to users, then it is implemented in a way that it can be ignored by assistive technology.",
     "1.2.1": "For prerecorded audio-only and prerecorded video-only media, the following are true, except when the audio or video is a media alternative for text and is clearly labeled as such:\nPrerecorded Audio-only:\nAn alternative for time-based media is provided that presents equivalent information for prerecorded audio-only content.\nPrerecorded Video-only:\nEither an alternative for time-based media or an audio track is provided that presents equivalent information for prerecorded video-only content.",

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.15.1
+  version: 5.17.0
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.15.1";
+var VERSION = "5.17.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2290,7 +2290,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-20 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -54623,6 +54623,17 @@ function renderRedirected(redirected, lang = "en") {
   }
   return out2;
 }
+function gridRate(rows, status, pageId) {
+  let c2 = 0;
+  let nc = 0;
+  for (const row of rows) {
+    const st = status.get(row.id)?.get(pageId);
+    if (st === "C") c2++;
+    else if (st === "NC") nc++;
+  }
+  const decided = c2 + nc;
+  return [decided === 0 ? null : Math.round(c2 / decided * 100), decided, rows.length];
+}
 function renderPageGrid(result, pages, standard = CORE2, lang = "en") {
   const s = L3[lang];
   const out2 = [];
@@ -54636,9 +54647,9 @@ function renderPageGrid(result, pages, standard = CORE2, lang = "en") {
   if (derived.some((p) => p.basis === "attributed")) out2.push(`> \u26A0\uFE0F ${s.basisNote}`, "");
   const head = [isCore(standard) ? s.criterion : s.criterion, ...derived.map((p) => `${p.name}${p.auth ? " \u{1F512}" : ""}`)];
   out2.push(`| ${head.join(" | ")} |`, `| ${head.map(() => "---").join(" | ")} |`);
-  out2.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(p.conformancePct, p.decided, p.total)}**`).join(" | ")} |`);
-  out2.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
   const { rows, status } = pageGridModel(result, derived, standard, lang);
+  out2.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(...gridRate(rows, status, p.id))}**`).join(" | ")} |`);
+  out2.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
   let group = "";
   for (const row of rows) {
     if (row.group !== group) {
@@ -59669,11 +59680,13 @@ function mergeSnapshotAudit(base, snap) {
   if (snap.packFindings?.length) merged.packFindings = [...merged.packFindings ?? [], ...snap.packFindings];
   for (const c2 of merged.criteria) {
     if (!c2.inapplicable) continue;
-    if (snapById.get(c2.id)?.status === "C") {
-      c2.status = "C";
-      delete c2.inapplicable;
-      delete c2.justification;
-    }
+    const measured = snapById.get(c2.id);
+    if (!measured || measured.status !== "C" || measured.inapplicable) continue;
+    c2.status = "C";
+    delete c2.inapplicable;
+    if (measured.justification) c2.justification = measured.justification;
+    else delete c2.justification;
+    if (measured.decidedBy) c2.decidedBy = measured.decidedBy;
   }
   const nowNc = new Set(snap.findings.filter((f) => !f.advisory).map((f) => f.criteriaId));
   merged.residualRisks = merged.residualRisks.filter((r) => !nowNc.has(r.criteriaId));
@@ -59894,17 +59907,38 @@ function localTestedScs(interact) {
 }
 var PW_SPEC = "@playwright/test";
 var AXE_SPEC = "@axe-core/playwright";
-function localTierStatus(cwd) {
-  const req = createRequire(resolve12(cwd, "package.json"));
-  for (const spec of [PW_SPEC, AXE_SPEC]) {
+function resolveAnchors(cwd) {
+  return [resolve12(cwd, "package.json"), import.meta.url];
+}
+function requireRuntime(cwd, spec) {
+  let last;
+  for (const from of resolveAnchors(cwd)) {
     try {
-      req.resolve(spec);
+      return createRequire(from)(spec);
+    } catch (e) {
+      last = e;
+    }
+  }
+  throw last instanceof Error ? last : new Error(String(last));
+}
+function resolvesRuntime(cwd, spec) {
+  return resolveAnchors(cwd).some((from) => {
+    try {
+      createRequire(from).resolve(spec);
+      return true;
     } catch {
-      return { ok: false, reason: `${spec} does not resolve from ${cwd}` };
+      return false;
+    }
+  });
+}
+function localTierStatus(cwd) {
+  for (const spec of [PW_SPEC, AXE_SPEC]) {
+    if (!resolvesRuntime(cwd, spec)) {
+      return { ok: false, reason: `${spec} resolves neither from ${cwd} nor from ultra11y itself` };
     }
   }
   try {
-    const pw = req(PW_SPEC);
+    const pw = requireRuntime(cwd, PW_SPEC);
     const bin = pw.chromium?.executablePath?.();
     if (typeof bin === "string" && bin.length > 0 && !existsSync24(bin)) {
       return { ok: false, reason: `no browser binary at ${bin} \u2014 run \`npx playwright install chromium\`` };
@@ -59921,15 +59955,14 @@ function resolveLocalDeps(cwd) {
   let chromium;
   let AxeBuilder;
   try {
-    const req = createRequire(resolve12(cwd, "package.json"));
-    const pw = req(PW_SPEC);
-    const axeMod = req(AXE_SPEC);
+    const pw = requireRuntime(cwd, PW_SPEC);
+    const axeMod = requireRuntime(cwd, AXE_SPEC);
     chromium = pw.chromium;
     AxeBuilder = axeMod.default ?? axeMod;
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
     throw new Error(
-      `Playwright not resolvable from "${cwd}". Pass --cwd <dir> at a project with @playwright/test + @axe-core/playwright installed (e.g. --cwd packages/app), or use --runtime docker. (${msg})`
+      `Playwright resolves neither from "${cwd}" nor from ultra11y itself. Both are dependencies of this package, so the usual cause is the standalone engine bundle running with no node_modules beside it: pass --cwd <dir> at a project that has @playwright/test + @axe-core/playwright (e.g. --cwd packages/app), or use --runtime docker. (${msg})`
     );
   }
   if (!chromium || typeof AxeBuilder !== "function") {
@@ -60996,7 +61029,7 @@ jobs:
   ultra11y:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # the diff gate needs the base ref
       - uses: maxgfr/ultra11y@v${VERSION}
@@ -62955,12 +62988,16 @@ function scoreboardBlocks(result, standard, lang, sheetHref) {
   const scope = pagesOf(result);
   if (!scope.length) return [];
   const derived = derivePages(result, scope);
-  const rows = derived.map((p) => [
-    { text: `${p.name}${p.auth ? " \u{1F512}" : ""}`, ...sheetHref ? { href: sheetHref(p.id) } : {} },
-    { text: p.url, mono: true },
-    { text: basisLabel(p.basis, lang) },
-    { text: formatRate(p.conformancePct, p.decided, p.total), align: "end" }
-  ]);
+  const rows = derived.map((p) => {
+    const criteria = pageCriterionRows(result, p, standard, lang);
+    const cov = pageCoverage(criteria);
+    return [
+      { text: `${p.name}${p.auth ? " \u{1F512}" : ""}`, ...sheetHref ? { href: sheetHref(p.id) } : {} },
+      { text: p.url, mono: true },
+      { text: basisLabel(p.basis, lang) },
+      { text: formatRate(pageRatePct(criteria), cov.decided, cov.total), align: "end" }
+    ];
+  });
   const out2 = [
     { kind: "heading", level: 2, text: t3.perPage, id: "pages" },
     {
@@ -67042,6 +67079,9 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
 ]);
 var KNOWN_FLAGS = /* @__PURE__ */ new Set([...VALUE_FLAGS2, ...BOOLEAN_FLAGS]);
 var LIST_FLAGS = /* @__PURE__ */ new Set(["include", "exclude", "ext"]);
+function looksLikeFlag(token) {
+  return token?.startsWith("--") ?? false;
+}
 function parseArgs(argv) {
   const [command, ...rest] = argv;
   const valueFlags = valueFlagsFor(command ?? "");
@@ -67056,7 +67096,7 @@ function parseArgs(argv) {
       const inlineVal = eq === -1 ? void 0 : a.slice(eq + 1);
       let val;
       if (inlineVal !== void 0) val = inlineVal;
-      else if (valueFlags.has(key)) val = rest[++i2] ?? "";
+      else if (valueFlags.has(key) && !looksLikeFlag(rest[i2 + 1])) val = rest[++i2] ?? "";
       else val = true;
       const prev = flags2[key];
       if (LIST_FLAGS.has(key) && typeof prev === "string" && typeof val === "string") {

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 5.15.1
+  version: 5.17.0
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup
@@ -314,7 +314,7 @@ node scripts/ultra11y.mjs pack check ./packs/section508.json                  #
 ```
 Add `--standard rgaa` to `report`/`prd`/`criteria`/`check`/`verify` for a country standard,
 `--pack ./pack.json` to load one at runtime, and `--json` anywhere for machine output.
-`--lang` follows the conversation (pass it explicitly — Core rule 5).
+`--lang` follows the conversation (pass it explicitly — Core rule 7).
 
 ## The loop: audit → render → judge → fix → re-audit
 
@@ -347,7 +347,7 @@ drive the judgment and content stages:
    per NC criterion) and `prd` (the same blocks as an actionable backlog; `tickets`
    filing one GitHub issue per criterion with that identical block) are two views of the
    ONE building block, in the language of this conversation (pass `--lang` explicitly —
-   Core rule 5).
+   Core rule 7).
 
 6. **Hand the change over to `review-a11y`, in a subagent.** Once the deliverable is out,
    the code you just fixed still has to be reviewed as a *change*, and that is the other

package/skills/ultra11y/references/dynamic.md

@@ -5,18 +5,28 @@ contrast (1.4.3), focus visible (2.4.7), reflow/zoom (1.4.4/1.4.10), text spacin
 content on hover (1.4.13), target size (2.5.8). The dynamic tier decides them by running
 **axe-core in a real headless browser** (Playwright). Two runtimes, same finding shape:
 
-- **`--runtime local`** (recommended): resolves a host/target Playwright + `@axe-core/playwright`
-  **at runtime** from `--cwd` (no Docker, no global install). Most projects with Playwright
-  e2e tests already have both deps. Adds the residual-criteria **probes** (below).
+- **`--runtime local`** (recommended): resolves Playwright + `@axe-core/playwright`
+  **at runtime**, from `--cwd` first and from ultra11y's own install second (no Docker, no
+  global install). A project that pins its own Playwright keeps it, because `--cwd` is tried
+  first. Adds the residual-criteria **probes** (below).
 - **`--runtime docker`**: runs axe-core in a Docker image auto-built on first use (runner +
   Dockerfile embedded in the bundle). No host deps beyond Docker. Axe + 320px reflow only.
-- **`--runtime auto`** (default): local if Playwright resolves from `--cwd`, else Docker, else
-  an actionable error.
+- **`--runtime auto`** (default): local if Playwright resolves **and** a browser binary is on
+  disk, else Docker, else an actionable error.
 
 ## Prerequisites
 
-- **local**: a project reachable from `--cwd` with `@playwright/test` + `@axe-core/playwright`
-  installed, and a Chromium browser (`npx playwright install chromium`).
+- **local**: a Chromium browser (`npx playwright install chromium`), plus the two npm packages
+  — and **where they have to live depends on how you run the engine**:
+
+  | Channel | `@playwright/test` + `@axe-core/playwright` |
+  |---|---|
+  | ultra11y as an npm dependency (`ultra11y/playwright`, `pnpm exec ultra11y`) | **come with it** — they are its own `dependencies`. Nothing to install. |
+  | the standalone skill bundle (`node scripts/ultra11y.mjs` from an installed skill) | **must be in the audited project**, reachable from `--cwd`. An installed skill is a directory of files with no `node_modules` beside it, so the second anchor finds nothing there. |
+
+  Either way, a project that installs them itself wins: `--cwd` is tried first, which is what a
+  repository with its own pinned Playwright wants. When neither anchor resolves, `auto` degrades
+  to Docker and says which package it could not find.
 - **docker**: Docker running.
 
 The rest of the skill (static audit) needs neither.

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.15.1";
+var VERSION = "5.17.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2290,7 +2290,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-20 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -54623,6 +54623,17 @@ function renderRedirected(redirected, lang = "en") {
   }
   return out2;
 }
+function gridRate(rows, status, pageId) {
+  let c2 = 0;
+  let nc = 0;
+  for (const row of rows) {
+    const st = status.get(row.id)?.get(pageId);
+    if (st === "C") c2++;
+    else if (st === "NC") nc++;
+  }
+  const decided = c2 + nc;
+  return [decided === 0 ? null : Math.round(c2 / decided * 100), decided, rows.length];
+}
 function renderPageGrid(result, pages, standard = CORE2, lang = "en") {
   const s = L3[lang];
   const out2 = [];
@@ -54636,9 +54647,9 @@ function renderPageGrid(result, pages, standard = CORE2, lang = "en") {
   if (derived.some((p) => p.basis === "attributed")) out2.push(`> \u26A0\uFE0F ${s.basisNote}`, "");
   const head = [isCore(standard) ? s.criterion : s.criterion, ...derived.map((p) => `${p.name}${p.auth ? " \u{1F512}" : ""}`)];
   out2.push(`| ${head.join(" | ")} |`, `| ${head.map(() => "---").join(" | ")} |`);
-  out2.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(p.conformancePct, p.decided, p.total)}**`).join(" | ")} |`);
-  out2.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
   const { rows, status } = pageGridModel(result, derived, standard, lang);
+  out2.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(...gridRate(rows, status, p.id))}**`).join(" | ")} |`);
+  out2.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
   let group = "";
   for (const row of rows) {
     if (row.group !== group) {
@@ -59669,11 +59680,13 @@ function mergeSnapshotAudit(base, snap) {
   if (snap.packFindings?.length) merged.packFindings = [...merged.packFindings ?? [], ...snap.packFindings];
   for (const c2 of merged.criteria) {
     if (!c2.inapplicable) continue;
-    if (snapById.get(c2.id)?.status === "C") {
-      c2.status = "C";
-      delete c2.inapplicable;
-      delete c2.justification;
-    }
+    const measured = snapById.get(c2.id);
+    if (!measured || measured.status !== "C" || measured.inapplicable) continue;
+    c2.status = "C";
+    delete c2.inapplicable;
+    if (measured.justification) c2.justification = measured.justification;
+    else delete c2.justification;
+    if (measured.decidedBy) c2.decidedBy = measured.decidedBy;
   }
   const nowNc = new Set(snap.findings.filter((f) => !f.advisory).map((f) => f.criteriaId));
   merged.residualRisks = merged.residualRisks.filter((r) => !nowNc.has(r.criteriaId));
@@ -59894,17 +59907,38 @@ function localTestedScs(interact) {
 }
 var PW_SPEC = "@playwright/test";
 var AXE_SPEC = "@axe-core/playwright";
-function localTierStatus(cwd) {
-  const req = createRequire(resolve12(cwd, "package.json"));
-  for (const spec of [PW_SPEC, AXE_SPEC]) {
+function resolveAnchors(cwd) {
+  return [resolve12(cwd, "package.json"), import.meta.url];
+}
+function requireRuntime(cwd, spec) {
+  let last;
+  for (const from of resolveAnchors(cwd)) {
     try {
-      req.resolve(spec);
+      return createRequire(from)(spec);
+    } catch (e) {
+      last = e;
+    }
+  }
+  throw last instanceof Error ? last : new Error(String(last));
+}
+function resolvesRuntime(cwd, spec) {
+  return resolveAnchors(cwd).some((from) => {
+    try {
+      createRequire(from).resolve(spec);
+      return true;
     } catch {
-      return { ok: false, reason: `${spec} does not resolve from ${cwd}` };
+      return false;
+    }
+  });
+}
+function localTierStatus(cwd) {
+  for (const spec of [PW_SPEC, AXE_SPEC]) {
+    if (!resolvesRuntime(cwd, spec)) {
+      return { ok: false, reason: `${spec} resolves neither from ${cwd} nor from ultra11y itself` };
     }
   }
   try {
-    const pw = req(PW_SPEC);
+    const pw = requireRuntime(cwd, PW_SPEC);
     const bin = pw.chromium?.executablePath?.();
     if (typeof bin === "string" && bin.length > 0 && !existsSync24(bin)) {
       return { ok: false, reason: `no browser binary at ${bin} \u2014 run \`npx playwright install chromium\`` };
@@ -59921,15 +59955,14 @@ function resolveLocalDeps(cwd) {
   let chromium;
   let AxeBuilder;
   try {
-    const req = createRequire(resolve12(cwd, "package.json"));
-    const pw = req(PW_SPEC);
-    const axeMod = req(AXE_SPEC);
+    const pw = requireRuntime(cwd, PW_SPEC);
+    const axeMod = requireRuntime(cwd, AXE_SPEC);
     chromium = pw.chromium;
     AxeBuilder = axeMod.default ?? axeMod;
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
     throw new Error(
-      `Playwright not resolvable from "${cwd}". Pass --cwd <dir> at a project with @playwright/test + @axe-core/playwright installed (e.g. --cwd packages/app), or use --runtime docker. (${msg})`
+      `Playwright resolves neither from "${cwd}" nor from ultra11y itself. Both are dependencies of this package, so the usual cause is the standalone engine bundle running with no node_modules beside it: pass --cwd <dir> at a project that has @playwright/test + @axe-core/playwright (e.g. --cwd packages/app), or use --runtime docker. (${msg})`
     );
   }
   if (!chromium || typeof AxeBuilder !== "function") {
@@ -60996,7 +61029,7 @@ jobs:
   ultra11y:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # the diff gate needs the base ref
       - uses: maxgfr/ultra11y@v${VERSION}
@@ -62955,12 +62988,16 @@ function scoreboardBlocks(result, standard, lang, sheetHref) {
   const scope = pagesOf(result);
   if (!scope.length) return [];
   const derived = derivePages(result, scope);
-  const rows = derived.map((p) => [
-    { text: `${p.name}${p.auth ? " \u{1F512}" : ""}`, ...sheetHref ? { href: sheetHref(p.id) } : {} },
-    { text: p.url, mono: true },
-    { text: basisLabel(p.basis, lang) },
-    { text: formatRate(p.conformancePct, p.decided, p.total), align: "end" }
-  ]);
+  const rows = derived.map((p) => {
+    const criteria = pageCriterionRows(result, p, standard, lang);
+    const cov = pageCoverage(criteria);
+    return [
+      { text: `${p.name}${p.auth ? " \u{1F512}" : ""}`, ...sheetHref ? { href: sheetHref(p.id) } : {} },
+      { text: p.url, mono: true },
+      { text: basisLabel(p.basis, lang) },
+      { text: formatRate(pageRatePct(criteria), cov.decided, cov.total), align: "end" }
+    ];
+  });
   const out2 = [
     { kind: "heading", level: 2, text: t3.perPage, id: "pages" },
     {
@@ -67042,6 +67079,9 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
 ]);
 var KNOWN_FLAGS = /* @__PURE__ */ new Set([...VALUE_FLAGS2, ...BOOLEAN_FLAGS]);
 var LIST_FLAGS = /* @__PURE__ */ new Set(["include", "exclude", "ext"]);
+function looksLikeFlag(token) {
+  return token?.startsWith("--") ?? false;
+}
 function parseArgs(argv) {
   const [command, ...rest] = argv;
   const valueFlags = valueFlagsFor(command ?? "");
@@ -67056,7 +67096,7 @@ function parseArgs(argv) {
       const inlineVal = eq === -1 ? void 0 : a.slice(eq + 1);
       let val;
       if (inlineVal !== void 0) val = inlineVal;
-      else if (valueFlags.has(key)) val = rest[++i2] ?? "";
+      else if (valueFlags.has(key) && !looksLikeFlag(rest[i2 + 1])) val = rest[++i2] ?? "";
       else val = true;
       const prev = flags2[key];
       if (LIST_FLAGS.has(key) && typeof prev === "string" && typeof val === "string") {

package/src/cli.ts

@@ -691,6 +691,23 @@ export interface ParsedArgs {
   unknown: string[];
 }
 
+/** Is this token the NEXT FLAG rather than the previous flag's value?
+ *
+ *  Several value flags take an OPTIONAL value — `--ledger` bare means the standard's default
+ *  path, `--require-decided` bare means the run's grid — and the bare form is almost always
+ *  followed by another flag. Consumed blindly, the next flag became the value:
+ *  `verify --apply … --ledger --lang fr` wrote a 33 KB verdict ledger to a file literally
+ *  named `--lang`, never wrote `.ultra11y/verdicts/rgaa.json`, and — `--lang` having been
+ *  eaten — printed the run in the wrong language. Nothing failed and nothing warned; the next
+ *  run simply paid for the whole adjudication again, which is the cost the ledger exists to
+ *  remove.
+ *
+ *  Only `--` counts. A single dash is the stdin positional, and a value may legitimately be
+ *  negative or start with one. */
+function looksLikeFlag(token: string | undefined): boolean {
+  return token?.startsWith("--") ?? false;
+}
+
 export function parseArgs(argv: string[]): ParsedArgs {
   const [command, ...rest] = argv;
   const valueFlags = valueFlagsFor(command ?? "");
@@ -708,7 +725,7 @@ export function parseArgs(argv: string[]): ParsedArgs {
       const inlineVal = eq === -1 ? undefined : a.slice(eq + 1);
       let val: string | boolean;
       if (inlineVal !== undefined) val = inlineVal;
-      else if (valueFlags.has(key)) val = rest[++i] ?? "";
+      else if (valueFlags.has(key) && !looksLikeFlag(rest[i + 1])) val = rest[++i] ?? "";
       else val = true;
       const prev = flags[key];
       if (LIST_FLAGS.has(key) && typeof prev === "string" && typeof val === "string") {

package/src/data/wcag-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-20 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "criteria": [
     {
       "id": "1.1.1",

package/src/html-report.ts

@@ -301,12 +301,19 @@ export function scoreboardBlocks(result: AuditResult, standard: StandardId, lang
   const scope = pagesOf(result);
   if (!scope.length) return [];
   const derived = derivePages(result, scope);
-  const rows = derived.map((p) => [
-    { text: `${p.name}${p.auth ? " 🔒" : ""}`, ...(sheetHref ? { href: sheetHref(p.id) } : {}) },
-    { text: p.url, mono: true },
-    { text: basisLabel(p.basis, lang) },
-    { text: formatRate(p.conformancePct, p.decided, p.total), align: "end" as const },
-  ]);
+  // Through the standard-aware helpers, exactly like `renderPageRates` in src/report.ts:
+  // `PageResult.conformancePct` is the WCAG core projection, so under a pack this cell used to
+  // quote a rate out of 55 beside a document counting 106.
+  const rows = derived.map((p) => {
+    const criteria = pageCriterionRows(result, p, standard, lang);
+    const cov = pageCoverage(criteria);
+    return [
+      { text: `${p.name}${p.auth ? " 🔒" : ""}`, ...(sheetHref ? { href: sheetHref(p.id) } : {}) },
+      { text: p.url, mono: true },
+      { text: basisLabel(p.basis, lang) },
+      { text: formatRate(pageRatePct(criteria), cov.decided, cov.total), align: "end" as const },
+    ];
+  });
   const out: Block[] = [
     { kind: "heading", level: 2, text: t.perPage, id: "pages" },
     {

package/src/init.ts

@@ -129,7 +129,7 @@ jobs:
   ultra11y:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # the diff gate needs the base ref
       - uses: maxgfr/ultra11y@v${VERSION}

package/src/pages.ts

@@ -489,6 +489,25 @@ export function renderRedirected(redirected: ScanRedirect[], lang: Lang = "en"):
   return out;
 }
 
+/** One page's standing over the rows of the grid it is printed on — same C ÷ (C + NC) basis
+ *  as everywhere else, and the same NULL for "nothing decided". Taking it from the grid model
+ *  rather than from `PageResult` is what makes the header a summary of the body under a pack
+ *  as well as under the core: `PageResult` only ever carries the WCAG projection.
+ *
+ *  Returned as the argument tuple `formatRate` takes, so no caller can pair a rate with
+ *  somebody else's denominator. */
+export function gridRate(rows: { id: string }[], status: Map<string, Map<string, Status>>, pageId: string): [number | null, number, number] {
+  let c = 0;
+  let nc = 0;
+  for (const row of rows) {
+    const st = status.get(row.id)?.get(pageId);
+    if (st === "C") c++;
+    else if (st === "NC") nc++;
+  }
+  const decided = c + nc;
+  return [decided === 0 ? null : Math.round((c / decided) * 100), decided, rows.length];
+}
+
 /** The Markdown grid: one row per criterion, one column per page. */
 export function renderPageGrid(result: AuditResult, pages: PageScope[], standard: StandardId = CORE, lang: Lang = "en"): string {
   const s = L[lang];
@@ -504,10 +523,17 @@ export function renderPageGrid(result: AuditResult, pages: PageScope[], standard
 
   const head = [isCore(standard) ? s.criterion : s.criterion, ...derived.map((p) => `${p.name}${p.auth ? " 🔒" : ""}`)];
   out.push(`| ${head.join(" | ")} |`, `| ${head.map(() => "---").join(" | ")} |`);
-  out.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(p.conformancePct, p.decided, p.total)}**`).join(" | ")} |`);
+  // THE MODEL FIRST, because the rate is a summary OF THIS GRID and has to be computed from
+  // the rows it is printed above. It was read off `PageResult` instead — which is always the
+  // WCAG core projection — so under a pack the header and the body answered different
+  // questions: measured on a two-page RGAA run, the grid listed all 106 criteria and then
+  // announced « 89 % (9/55) », while the same page's own dossier said 47/106. Same command,
+  // same page, two denominators; and this grid is what `comment-kind: pages` pastes onto a
+  // pull request, so the wrong one was the one people read.
+  const { rows, status } = pageGridModel(result, derived, standard, lang);
+  out.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(...gridRate(rows, status, p.id))}**`).join(" | ")} |`);
   out.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
 
-  const { rows, status } = pageGridModel(result, derived, standard, lang);
   let group = "";
   for (const row of rows) {
     if (row.group !== group) {

package/src/scan-local.ts

@@ -1,6 +1,7 @@
-// `scan --runtime local` — the dynamic tier WITHOUT Docker. Resolves a host/target
-// Playwright + @axe-core/playwright AT RUNTIME (createRequire, a node: builtin) from
-// `--cwd`, so the zero-dep static engine bundle never gains a static browser import.
+// `scan --runtime local` — the dynamic tier WITHOUT Docker. Resolves Playwright +
+// @axe-core/playwright AT RUNTIME (createRequire, a node: builtin) from `--cwd` first and
+// from this package second, so the zero-dep static engine bundle never gains a static
+// browser import while a project that installed ultra11y alone still gets the tier.
 // It runs the SAME axe-core pass as the Docker RUNNER, then the residual-criteria
 // probes axe cannot decide (focus visibility, 200% zoom, text spacing, content on
 // hover, target size). The Docker RUNNER / docker/* files are untouched (docker-sync).
@@ -59,6 +60,46 @@ interface LocalDeps {
 const PW_SPEC = "@playwright/test";
 const AXE_SPEC = "@axe-core/playwright";
 
+/** Where a runtime dependency may live, in the order that must be tried.
+ *
+ *  THE TARGET PROJECT FIRST, then this package — the same order `src/integrations/playwright.ts`
+ *  uses, and for the same two reasons. A repository that pins its own Playwright must keep it:
+ *  two copies in one process hand out `Page` objects the other one's fixtures do not recognise.
+ *  And a repository that has none must still get the tier, now that `@playwright/test` and
+ *  `@axe-core/playwright` are dependencies of ultra11y instead of something every caller had to
+ *  duplicate into its own manifest. Anchoring on `cwd` ALONE was the older contract, and it made
+ *  `--runtime local` unavailable to exactly the projects that had not read the prerequisites. */
+function resolveAnchors(cwd: string): string[] {
+  return [resolve(cwd, "package.json"), import.meta.url];
+}
+
+/** Load `spec` from the target project, else from this package. Rethrows the LAST failure, so
+ *  the message names the spec the caller asked for rather than the first anchor that missed. */
+function requireRuntime(cwd: string, spec: string): Any {
+  let last: unknown;
+  for (const from of resolveAnchors(cwd)) {
+    try {
+      return createRequire(from)(spec);
+    } catch (e) {
+      last = e;
+    }
+  }
+  throw last instanceof Error ? last : new Error(String(last));
+}
+
+/** Can `spec` be resolved from either anchor? Resolution only — never loads the module, so
+ *  probing the tier stays as cheap as it was when it only looked at `cwd`. */
+function resolvesRuntime(cwd: string, spec: string): boolean {
+  return resolveAnchors(cwd).some((from) => {
+    try {
+      createRequire(from).resolve(spec);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+}
+
 /** Why the LOCAL tier is (un)usable from `cwd` — the one line a reader of a
  *  `runtime: auto` log gets before the Docker fallback takes over. A silent degrade is
  *  indistinguishable from a working fallback, so the reason must NAME what to install. */
@@ -68,16 +109,13 @@ export type LocalTierStatus = { ok: true } | { ok: false; reason: string };
  *  boolean. Drives the `runtime: auto` decision AND the message printed when it degrades
  *  to Docker. */
 export function localTierStatus(cwd: string): LocalTierStatus {
-  const req = createRequire(resolve(cwd, "package.json"));
   for (const spec of [PW_SPEC, AXE_SPEC]) {
-    try {
-      req.resolve(spec);
-    } catch {
-      return { ok: false, reason: `${spec} does not resolve from ${cwd}` };
+    if (!resolvesRuntime(cwd, spec)) {
+      return { ok: false, reason: `${spec} resolves neither from ${cwd} nor from ultra11y itself` };
     }
   }
   try {
-    const pw = req(PW_SPEC) as { chromium?: { executablePath?: () => string } };
+    const pw = requireRuntime(cwd, PW_SPEC) as { chromium?: { executablePath?: () => string } };
     const bin = pw.chromium?.executablePath?.();
     // No path at all ⇒ a Playwright that cannot tell us; treat as available and let the
     // launch report its own failure, rather than refusing a tier that might work.
@@ -112,15 +150,14 @@ export function resolveLocalDeps(cwd: string): LocalDeps {
   let chromium: Any;
   let AxeBuilder: Any;
   try {
-    const req = createRequire(resolve(cwd, "package.json"));
-    const pw = req(PW_SPEC);
-    const axeMod = req(AXE_SPEC);
+    const pw = requireRuntime(cwd, PW_SPEC);
+    const axeMod = requireRuntime(cwd, AXE_SPEC);
     chromium = pw.chromium;
     AxeBuilder = axeMod.default ?? axeMod;
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
     throw new Error(
-      `Playwright not resolvable from "${cwd}". Pass --cwd <dir> at a project with @playwright/test + @axe-core/playwright installed (e.g. --cwd packages/app), or use --runtime docker. (${msg})`,
+      `Playwright resolves neither from "${cwd}" nor from ultra11y itself. Both are dependencies of this package, so the usual cause is the standalone engine bundle running with no node_modules beside it: pass --cwd <dir> at a project that has @playwright/test + @axe-core/playwright (e.g. --cwd packages/app), or use --runtime docker. (${msg})`,
     );
   }
   if (!chromium || typeof AxeBuilder !== "function") {

package/src/scan.ts

@@ -741,15 +741,33 @@ export function mergeSnapshotAudit(base: AuditResult, snap: AuditResult): AuditR
   if (snap.packFindings?.length) merged.packFindings = [...(merged.packFindings ?? []), ...snap.packFindings];
 
   // A criterion the static pass closed for want of a subject, which the snapshot then MEASURED.
-  // Both read `C`, so the discriminator is the flag, not the status: what has to go is the
-  // "nothing of that kind here" justification, which a rendered page has just falsified.
+  // Both read `C`, so the discriminator is the FLAG, not the status — and testing the status
+  // is exactly what this loop used to do. The snapshot pages have no time-based media either,
+  // so they closed 1.2.1 the same way the source did, `C` + `inapplicable`; reading only the
+  // status, the merge took that for a measurement and stripped the flag from every criterion
+  // both halves had closed for want of a subject.
+  //
+  // Two things then broke, both silently. The `C` lost the justification that made it
+  // falsifiable, becoming the bare uncited conformity this engine refuses everywhere else. And
+  // `pageStatus` reads `inapplicable` to hold "a conformity reached for want of a subject
+  // holds on every page" — without the flag those criteria fell through to the honesty rule
+  // that only `static` criteria earn a verdict by silence, and came back « à évaluer » on
+  // EVERY page. Measured on a two-page RGAA crawl: the run reported a complete 106/106 grid
+  // while each page carried 10 criteria nobody could ever adjudicate, because there was
+  // nothing there to adjudicate.
   for (const c of merged.criteria) {
     if (!c.inapplicable) continue;
-    if (snapById.get(c.id)?.status === "C") {
-      c.status = "C";
-      delete c.inapplicable;
-      delete c.justification; // "no relevant element in scope" no longer holds
-    }
+    const measured = snapById.get(c.id);
+    // Only a snapshot that reached `C` WITHOUT the flag has falsified "nothing of that kind
+    // here" — that one looked at the rendered page and found the subject.
+    if (!measured || measured.status !== "C" || measured.inapplicable) continue;
+    c.status = "C";
+    delete c.inapplicable;
+    // Keep the claim citable: adopt what the measuring half said, rather than leaving a `C`
+    // with nothing behind it.
+    if (measured.justification) c.justification = measured.justification;
+    else delete c.justification;
+    if (measured.decidedBy) c.decidedBy = measured.decidedBy;
   }
 
   const nowNc = new Set(snap.findings.filter((f) => !f.advisory).map((f) => f.criteriaId));

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.15.1";
+export const VERSION = "5.17.0";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,

package/dist/payload-DzQb84Kw.d.ts

@@ -1,87 +0,0 @@
-interface FindingLike {
-    ruleId: string;
-    criteriaId: string;
-    file: string;
-    line: number;
-    severity: string;
-    message: string;
-    advisory?: boolean;
-    origin?: {
-        sourceFile?: string;
-        sourceLine?: number;
-    };
-}
-interface AuditLike {
-    findings?: FindingLike[];
-}
-interface SnapshotPayload {
-    meta: Record<string, unknown>;
-    dom: string;
-    styles?: unknown;
-    boxes?: unknown;
-    css?: unknown;
-    screenshot?: string;
-    /** What the live probes measured, when the caller ran them. */
-    probes?: unknown;
-}
-/** Same slug rule as the engine (src/snapshot.ts slugifyPageId): accent-folded URL path. */
-declare function slugify(url: string): string;
-interface CheckOptions {
-    /** The page id (directory name). Defaults to the slugified URL path. */
-    as?: string;
-    /** Human page name for the report. Defaults to the document title. */
-    name?: string;
-    /** Severity at which the check fails, or `false` to record without ever failing. */
-    failOn?: "blocking" | "major" | "minor" | false;
-    /** Mark the page as sitting behind authentication. */
-    auth?: boolean;
-    /** Source files that rendered it — findings are then reported against YOUR code. */
-    sources?: string[];
-    /** Reproduction notes carried into the auditor ticket. */
-    notes?: string;
-    /** Capture a viewport screenshot for the pixel tier (Playwright: on by default). */
-    screenshot?: boolean;
-    /** The path you NAVIGATED to. Given it, the fixture refuses to record a page the browser
-     *  did not stay on — a guarded route that redirected, a session that expired — instead of
-     *  filing that other screen under this page's `as`/`name`. Nothing about such a snapshot
-     *  looks wrong, which is what makes it the worst thing an accessibility report can carry.
-     *  Compared by path (a query or fragment the app appends to its own route is the same
-     *  page); a full URL works too. `scan --sample` applies the same rule. */
-    expectPath?: string;
-    /** Run the LIVE PROBES on this page after collecting it: 200% zoom, 320px reflow, the
-     *  text-spacing override, focus visibility and content-on-hover.
-     *
-     *  These are the measurements a recorded snapshot can never settle, because they are
-     *  properties of a page being acted on rather than of a page as it stands. `scan` runs them
-     *  in its own browser, which is exactly why they were undecidable on any screen behind a
-     *  login or a state machine — the scanner arrives cold and gets a redirect. Your suite has
-     *  the page in the right state; this is how it says so.
-     *
-     *  Off by default: the probes press Tab, hover, resize the viewport and inject a stylesheet,
-     *  and a suite should opt into that. Everything is restored before it returns, and the
-     *  snapshot has already been collected, so what they measure cannot alter what was recorded.
-     *  Pass an array to run only some of them (by criterion: "1.4.4", "1.4.10", "1.4.12",
-     *  "1.4.13", "2.4.7"), or an object to also set the bounds — how wide the reflow probe
-     *  narrows to, how many focusables are worth tabbing through, how many hits are worth
-     *  recording. 320px is normative and stays the default; the other two are judgements about
-     *  YOUR pages, and a screen with 400 focusables should be able to say so rather than being
-     *  quietly cut off at 120. */
-    probes?: boolean | string[] | ProbeTuning;
-}
-/** The bounds a repository may put on the live probes. Stated once, here, because the same
- *  list is read from `.ultra11yrc.json`, accepted at the call site and handed to the engine —
- *  three copies of a field list is three chances for one of them to fall behind.
- *
- *  `budgetMs` and `actionTimeoutMs` are not tuning in the same sense as the others: they are
- *  what stops a probe from spending SOMEBODY ELSE'S test timeout. See ProbeLimits. */
-interface ProbeTuning {
-    only?: string[];
-    reflowWidth?: number;
-    maxFocusables?: number;
-    maxHits?: number;
-    maxTriggers?: number;
-    actionTimeoutMs?: number;
-    budgetMs?: number;
-}
-
-export { type AuditLike as A, type CheckOptions as C, type FindingLike as F, type SnapshotPayload as S, slugify as s };