ultra11y 5.16.0 → 5.18.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.16.0",
+      "version": "5.18.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.16.0",
+  "version": "5.18.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.16.0",
+  "version": "5.18.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.16.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.18.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -442,7 +442,7 @@ node scripts/ultra11y.mjs scan http://localhost:3000 --runtime local --cwd . --m
 node scripts/ultra11y.mjs report --in audits/audit-latest.json --out audits
 ```
 
-Only the Docker runtime needs Docker. `--runtime local` needs a Chromium binary (`npx playwright install chromium`) and nothing else: `@playwright/test` and `@axe-core/playwright` are dependencies of the package, and the audited project's own copies take precedence when it has them. The engine bundle itself stays dependency-free. The Docker runner + Dockerfile are embedded in the engine and mirrored under `docker/` (with a `docker-compose.yml`). See `skills/ultra11y/references/dynamic.md`.
+Only the Docker runtime needs Docker. `--runtime local` needs a Chromium binary (`npx playwright install chromium`) plus `@playwright/test` and `@axe-core/playwright` — which **come with the npm package**, since they are its own dependencies; the audited project's own copies take precedence when it has them. Running the engine as a **standalone skill bundle** is the exception: an installed skill has no `node_modules` beside it, so there the two packages must be in the audited project, reachable from `--cwd`. The engine bundle itself stays dependency-free either way. The Docker runner + Dockerfile are embedded in the engine and mirrored under `docker/` (with a `docker-compose.yml`). See `skills/ultra11y/references/dynamic.md`.
 
 Typical audit flow:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.16.0",
+  "version": "5.18.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.16.0";
+var VERSION = "5.18.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -54623,6 +54623,17 @@ function renderRedirected(redirected, lang = "en") {
   }
   return out2;
 }
+function gridRate(rows, status, pageId) {
+  let c2 = 0;
+  let nc = 0;
+  for (const row of rows) {
+    const st = status.get(row.id)?.get(pageId);
+    if (st === "C") c2++;
+    else if (st === "NC") nc++;
+  }
+  const decided = c2 + nc;
+  return [decided === 0 ? null : Math.round(c2 / decided * 100), decided, rows.length];
+}
 function renderPageGrid(result, pages, standard = CORE2, lang = "en") {
   const s = L3[lang];
   const out2 = [];
@@ -54636,9 +54647,9 @@ function renderPageGrid(result, pages, standard = CORE2, lang = "en") {
   if (derived.some((p) => p.basis === "attributed")) out2.push(`> \u26A0\uFE0F ${s.basisNote}`, "");
   const head = [isCore(standard) ? s.criterion : s.criterion, ...derived.map((p) => `${p.name}${p.auth ? " \u{1F512}" : ""}`)];
   out2.push(`| ${head.join(" | ")} |`, `| ${head.map(() => "---").join(" | ")} |`);
-  out2.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(p.conformancePct, p.decided, p.total)}**`).join(" | ")} |`);
-  out2.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
   const { rows, status } = pageGridModel(result, derived, standard, lang);
+  out2.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(...gridRate(rows, status, p.id))}**`).join(" | ")} |`);
+  out2.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
   let group = "";
   for (const row of rows) {
     if (row.group !== group) {
@@ -59669,11 +59680,13 @@ function mergeSnapshotAudit(base, snap) {
   if (snap.packFindings?.length) merged.packFindings = [...merged.packFindings ?? [], ...snap.packFindings];
   for (const c2 of merged.criteria) {
     if (!c2.inapplicable) continue;
-    if (snapById.get(c2.id)?.status === "C") {
-      c2.status = "C";
-      delete c2.inapplicable;
-      delete c2.justification;
-    }
+    const measured = snapById.get(c2.id);
+    if (!measured || measured.status !== "C" || measured.inapplicable) continue;
+    c2.status = "C";
+    delete c2.inapplicable;
+    if (measured.justification) c2.justification = measured.justification;
+    else delete c2.justification;
+    if (measured.decidedBy) c2.decidedBy = measured.decidedBy;
   }
   const nowNc = new Set(snap.findings.filter((f) => !f.advisory).map((f) => f.criteriaId));
   merged.residualRisks = merged.residualRisks.filter((r) => !nowNc.has(r.criteriaId));
@@ -61016,7 +61029,7 @@ jobs:
   ultra11y:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # the diff gate needs the base ref
       - uses: maxgfr/ultra11y@v${VERSION}
@@ -62975,12 +62988,16 @@ function scoreboardBlocks(result, standard, lang, sheetHref) {
   const scope = pagesOf(result);
   if (!scope.length) return [];
   const derived = derivePages(result, scope);
-  const rows = derived.map((p) => [
-    { text: `${p.name}${p.auth ? " \u{1F512}" : ""}`, ...sheetHref ? { href: sheetHref(p.id) } : {} },
-    { text: p.url, mono: true },
-    { text: basisLabel(p.basis, lang) },
-    { text: formatRate(p.conformancePct, p.decided, p.total), align: "end" }
-  ]);
+  const rows = derived.map((p) => {
+    const criteria = pageCriterionRows(result, p, standard, lang);
+    const cov = pageCoverage(criteria);
+    return [
+      { text: `${p.name}${p.auth ? " \u{1F512}" : ""}`, ...sheetHref ? { href: sheetHref(p.id) } : {} },
+      { text: p.url, mono: true },
+      { text: basisLabel(p.basis, lang) },
+      { text: formatRate(pageRatePct(criteria), cov.decided, cov.total), align: "end" }
+    ];
+  });
   const out2 = [
     { kind: "heading", level: 2, text: t3.perPage, id: "pages" },
     {
@@ -67062,6 +67079,9 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
 ]);
 var KNOWN_FLAGS = /* @__PURE__ */ new Set([...VALUE_FLAGS2, ...BOOLEAN_FLAGS]);
 var LIST_FLAGS = /* @__PURE__ */ new Set(["include", "exclude", "ext"]);
+function looksLikeFlag(token) {
+  return token?.startsWith("--") ?? false;
+}
 function parseArgs(argv) {
   const [command, ...rest] = argv;
   const valueFlags = valueFlagsFor(command ?? "");
@@ -67076,7 +67096,7 @@ function parseArgs(argv) {
       const inlineVal = eq === -1 ? void 0 : a.slice(eq + 1);
       let val;
       if (inlineVal !== void 0) val = inlineVal;
-      else if (valueFlags.has(key)) val = rest[++i2] ?? "";
+      else if (valueFlags.has(key) && !looksLikeFlag(rest[i2 + 1])) val = rest[++i2] ?? "";
       else val = true;
       const prev = flags2[key];
       if (LIST_FLAGS.has(key) && typeof prev === "string" && typeof val === "string") {

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.16.0
+  version: 5.18.0
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.16.0";
+var VERSION = "5.18.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -54623,6 +54623,17 @@ function renderRedirected(redirected, lang = "en") {
   }
   return out2;
 }
+function gridRate(rows, status, pageId) {
+  let c2 = 0;
+  let nc = 0;
+  for (const row of rows) {
+    const st = status.get(row.id)?.get(pageId);
+    if (st === "C") c2++;
+    else if (st === "NC") nc++;
+  }
+  const decided = c2 + nc;
+  return [decided === 0 ? null : Math.round(c2 / decided * 100), decided, rows.length];
+}
 function renderPageGrid(result, pages, standard = CORE2, lang = "en") {
   const s = L3[lang];
   const out2 = [];
@@ -54636,9 +54647,9 @@ function renderPageGrid(result, pages, standard = CORE2, lang = "en") {
   if (derived.some((p) => p.basis === "attributed")) out2.push(`> \u26A0\uFE0F ${s.basisNote}`, "");
   const head = [isCore(standard) ? s.criterion : s.criterion, ...derived.map((p) => `${p.name}${p.auth ? " \u{1F512}" : ""}`)];
   out2.push(`| ${head.join(" | ")} |`, `| ${head.map(() => "---").join(" | ")} |`);
-  out2.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(p.conformancePct, p.decided, p.total)}**`).join(" | ")} |`);
-  out2.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
   const { rows, status } = pageGridModel(result, derived, standard, lang);
+  out2.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(...gridRate(rows, status, p.id))}**`).join(" | ")} |`);
+  out2.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
   let group = "";
   for (const row of rows) {
     if (row.group !== group) {
@@ -59669,11 +59680,13 @@ function mergeSnapshotAudit(base, snap) {
   if (snap.packFindings?.length) merged.packFindings = [...merged.packFindings ?? [], ...snap.packFindings];
   for (const c2 of merged.criteria) {
     if (!c2.inapplicable) continue;
-    if (snapById.get(c2.id)?.status === "C") {
-      c2.status = "C";
-      delete c2.inapplicable;
-      delete c2.justification;
-    }
+    const measured = snapById.get(c2.id);
+    if (!measured || measured.status !== "C" || measured.inapplicable) continue;
+    c2.status = "C";
+    delete c2.inapplicable;
+    if (measured.justification) c2.justification = measured.justification;
+    else delete c2.justification;
+    if (measured.decidedBy) c2.decidedBy = measured.decidedBy;
   }
   const nowNc = new Set(snap.findings.filter((f) => !f.advisory).map((f) => f.criteriaId));
   merged.residualRisks = merged.residualRisks.filter((r) => !nowNc.has(r.criteriaId));
@@ -61016,7 +61029,7 @@ jobs:
   ultra11y:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # the diff gate needs the base ref
       - uses: maxgfr/ultra11y@v${VERSION}
@@ -62975,12 +62988,16 @@ function scoreboardBlocks(result, standard, lang, sheetHref) {
   const scope = pagesOf(result);
   if (!scope.length) return [];
   const derived = derivePages(result, scope);
-  const rows = derived.map((p) => [
-    { text: `${p.name}${p.auth ? " \u{1F512}" : ""}`, ...sheetHref ? { href: sheetHref(p.id) } : {} },
-    { text: p.url, mono: true },
-    { text: basisLabel(p.basis, lang) },
-    { text: formatRate(p.conformancePct, p.decided, p.total), align: "end" }
-  ]);
+  const rows = derived.map((p) => {
+    const criteria = pageCriterionRows(result, p, standard, lang);
+    const cov = pageCoverage(criteria);
+    return [
+      { text: `${p.name}${p.auth ? " \u{1F512}" : ""}`, ...sheetHref ? { href: sheetHref(p.id) } : {} },
+      { text: p.url, mono: true },
+      { text: basisLabel(p.basis, lang) },
+      { text: formatRate(pageRatePct(criteria), cov.decided, cov.total), align: "end" }
+    ];
+  });
   const out2 = [
     { kind: "heading", level: 2, text: t3.perPage, id: "pages" },
     {
@@ -67062,6 +67079,9 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
 ]);
 var KNOWN_FLAGS = /* @__PURE__ */ new Set([...VALUE_FLAGS2, ...BOOLEAN_FLAGS]);
 var LIST_FLAGS = /* @__PURE__ */ new Set(["include", "exclude", "ext"]);
+function looksLikeFlag(token) {
+  return token?.startsWith("--") ?? false;
+}
 function parseArgs(argv) {
   const [command, ...rest] = argv;
   const valueFlags = valueFlagsFor(command ?? "");
@@ -67076,7 +67096,7 @@ function parseArgs(argv) {
       const inlineVal = eq === -1 ? void 0 : a.slice(eq + 1);
       let val;
       if (inlineVal !== void 0) val = inlineVal;
-      else if (valueFlags.has(key)) val = rest[++i2] ?? "";
+      else if (valueFlags.has(key) && !looksLikeFlag(rest[i2 + 1])) val = rest[++i2] ?? "";
       else val = true;
       const prev = flags2[key];
       if (LIST_FLAGS.has(key) && typeof prev === "string" && typeof val === "string") {

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 5.16.0
+  version: 5.18.0
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup
@@ -314,7 +314,7 @@ node scripts/ultra11y.mjs pack check ./packs/section508.json                  #
 ```
 Add `--standard rgaa` to `report`/`prd`/`criteria`/`check`/`verify` for a country standard,
 `--pack ./pack.json` to load one at runtime, and `--json` anywhere for machine output.
-`--lang` follows the conversation (pass it explicitly — Core rule 5).
+`--lang` follows the conversation (pass it explicitly — Core rule 7).
 
 ## The loop: audit → render → judge → fix → re-audit
 
@@ -347,7 +347,7 @@ drive the judgment and content stages:
    per NC criterion) and `prd` (the same blocks as an actionable backlog; `tickets`
    filing one GitHub issue per criterion with that identical block) are two views of the
    ONE building block, in the language of this conversation (pass `--lang` explicitly —
-   Core rule 5).
+   Core rule 7).
 
 6. **Hand the change over to `review-a11y`, in a subagent.** Once the deliverable is out,
    the code you just fixed still has to be reviewed as a *change*, and that is the other

package/skills/ultra11y/references/dynamic.md

@@ -7,21 +7,26 @@ content on hover (1.4.13), target size (2.5.8). The dynamic tier decides them by
 
 - **`--runtime local`** (recommended): resolves Playwright + `@axe-core/playwright`
   **at runtime**, from `--cwd` first and from ultra11y's own install second (no Docker, no
-  global install). Both are dependencies of this package, so a project that installed ultra11y
-  alone still gets the tier; a project that pins its own Playwright keeps it, because `--cwd`
-  is tried first. Adds the residual-criteria **probes** (below).
+  global install). A project that pins its own Playwright keeps it, because `--cwd` is tried
+  first. Adds the residual-criteria **probes** (below).
 - **`--runtime docker`**: runs axe-core in a Docker image auto-built on first use (runner +
   Dockerfile embedded in the bundle). No host deps beyond Docker. Axe + 320px reflow only.
 - **`--runtime auto`** (default): local if Playwright resolves **and** a browser binary is on
-  disk, else Docker, else an actionable error. Since the packages ship with ultra11y, what
-  decides `auto` in practice is the browser, not the modules.
+  disk, else Docker, else an actionable error.
 
 ## Prerequisites
 
-- **local**: a Chromium browser — `npx playwright install chromium`. The two npm packages
-  (`@playwright/test`, `@axe-core/playwright`) come with ultra11y and need no separate install;
-  installing them in the audited project is still supported and takes precedence, which is what
-  a repository with its own pinned Playwright wants.
+- **local**: a Chromium browser (`npx playwright install chromium`), plus the two npm packages
+  — and **where they have to live depends on how you run the engine**:
+
+  | Channel | `@playwright/test` + `@axe-core/playwright` |
+  |---|---|
+  | ultra11y as an npm dependency (`ultra11y/playwright`, `pnpm exec ultra11y`) | **come with it** — they are its own `dependencies`. Nothing to install. |
+  | the standalone skill bundle (`node scripts/ultra11y.mjs` from an installed skill) | **must be in the audited project**, reachable from `--cwd`. An installed skill is a directory of files with no `node_modules` beside it, so the second anchor finds nothing there. |
+
+  Either way, a project that installs them itself wins: `--cwd` is tried first, which is what a
+  repository with its own pinned Playwright wants. When neither anchor resolves, `auto` degrades
+  to Docker and says which package it could not find.
 - **docker**: Docker running.
 
 The rest of the skill (static audit) needs neither.

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.16.0";
+var VERSION = "5.18.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -54623,6 +54623,17 @@ function renderRedirected(redirected, lang = "en") {
   }
   return out2;
 }
+function gridRate(rows, status, pageId) {
+  let c2 = 0;
+  let nc = 0;
+  for (const row of rows) {
+    const st = status.get(row.id)?.get(pageId);
+    if (st === "C") c2++;
+    else if (st === "NC") nc++;
+  }
+  const decided = c2 + nc;
+  return [decided === 0 ? null : Math.round(c2 / decided * 100), decided, rows.length];
+}
 function renderPageGrid(result, pages, standard = CORE2, lang = "en") {
   const s = L3[lang];
   const out2 = [];
@@ -54636,9 +54647,9 @@ function renderPageGrid(result, pages, standard = CORE2, lang = "en") {
   if (derived.some((p) => p.basis === "attributed")) out2.push(`> \u26A0\uFE0F ${s.basisNote}`, "");
   const head = [isCore(standard) ? s.criterion : s.criterion, ...derived.map((p) => `${p.name}${p.auth ? " \u{1F512}" : ""}`)];
   out2.push(`| ${head.join(" | ")} |`, `| ${head.map(() => "---").join(" | ")} |`);
-  out2.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(p.conformancePct, p.decided, p.total)}**`).join(" | ")} |`);
-  out2.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
   const { rows, status } = pageGridModel(result, derived, standard, lang);
+  out2.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(...gridRate(rows, status, p.id))}**`).join(" | ")} |`);
+  out2.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
   let group = "";
   for (const row of rows) {
     if (row.group !== group) {
@@ -59669,11 +59680,13 @@ function mergeSnapshotAudit(base, snap) {
   if (snap.packFindings?.length) merged.packFindings = [...merged.packFindings ?? [], ...snap.packFindings];
   for (const c2 of merged.criteria) {
     if (!c2.inapplicable) continue;
-    if (snapById.get(c2.id)?.status === "C") {
-      c2.status = "C";
-      delete c2.inapplicable;
-      delete c2.justification;
-    }
+    const measured = snapById.get(c2.id);
+    if (!measured || measured.status !== "C" || measured.inapplicable) continue;
+    c2.status = "C";
+    delete c2.inapplicable;
+    if (measured.justification) c2.justification = measured.justification;
+    else delete c2.justification;
+    if (measured.decidedBy) c2.decidedBy = measured.decidedBy;
   }
   const nowNc = new Set(snap.findings.filter((f) => !f.advisory).map((f) => f.criteriaId));
   merged.residualRisks = merged.residualRisks.filter((r) => !nowNc.has(r.criteriaId));
@@ -61016,7 +61029,7 @@ jobs:
   ultra11y:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # the diff gate needs the base ref
       - uses: maxgfr/ultra11y@v${VERSION}
@@ -62975,12 +62988,16 @@ function scoreboardBlocks(result, standard, lang, sheetHref) {
   const scope = pagesOf(result);
   if (!scope.length) return [];
   const derived = derivePages(result, scope);
-  const rows = derived.map((p) => [
-    { text: `${p.name}${p.auth ? " \u{1F512}" : ""}`, ...sheetHref ? { href: sheetHref(p.id) } : {} },
-    { text: p.url, mono: true },
-    { text: basisLabel(p.basis, lang) },
-    { text: formatRate(p.conformancePct, p.decided, p.total), align: "end" }
-  ]);
+  const rows = derived.map((p) => {
+    const criteria = pageCriterionRows(result, p, standard, lang);
+    const cov = pageCoverage(criteria);
+    return [
+      { text: `${p.name}${p.auth ? " \u{1F512}" : ""}`, ...sheetHref ? { href: sheetHref(p.id) } : {} },
+      { text: p.url, mono: true },
+      { text: basisLabel(p.basis, lang) },
+      { text: formatRate(pageRatePct(criteria), cov.decided, cov.total), align: "end" }
+    ];
+  });
   const out2 = [
     { kind: "heading", level: 2, text: t3.perPage, id: "pages" },
     {
@@ -67062,6 +67079,9 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
 ]);
 var KNOWN_FLAGS = /* @__PURE__ */ new Set([...VALUE_FLAGS2, ...BOOLEAN_FLAGS]);
 var LIST_FLAGS = /* @__PURE__ */ new Set(["include", "exclude", "ext"]);
+function looksLikeFlag(token) {
+  return token?.startsWith("--") ?? false;
+}
 function parseArgs(argv) {
   const [command, ...rest] = argv;
   const valueFlags = valueFlagsFor(command ?? "");
@@ -67076,7 +67096,7 @@ function parseArgs(argv) {
       const inlineVal = eq === -1 ? void 0 : a.slice(eq + 1);
       let val;
       if (inlineVal !== void 0) val = inlineVal;
-      else if (valueFlags.has(key)) val = rest[++i2] ?? "";
+      else if (valueFlags.has(key) && !looksLikeFlag(rest[i2 + 1])) val = rest[++i2] ?? "";
       else val = true;
       const prev = flags2[key];
       if (LIST_FLAGS.has(key) && typeof prev === "string" && typeof val === "string") {

package/src/cli.ts

@@ -691,6 +691,23 @@ export interface ParsedArgs {
   unknown: string[];
 }
 
+/** Is this token the NEXT FLAG rather than the previous flag's value?
+ *
+ *  Several value flags take an OPTIONAL value — `--ledger` bare means the standard's default
+ *  path, `--require-decided` bare means the run's grid — and the bare form is almost always
+ *  followed by another flag. Consumed blindly, the next flag became the value:
+ *  `verify --apply … --ledger --lang fr` wrote a 33 KB verdict ledger to a file literally
+ *  named `--lang`, never wrote `.ultra11y/verdicts/rgaa.json`, and — `--lang` having been
+ *  eaten — printed the run in the wrong language. Nothing failed and nothing warned; the next
+ *  run simply paid for the whole adjudication again, which is the cost the ledger exists to
+ *  remove.
+ *
+ *  Only `--` counts. A single dash is the stdin positional, and a value may legitimately be
+ *  negative or start with one. */
+function looksLikeFlag(token: string | undefined): boolean {
+  return token?.startsWith("--") ?? false;
+}
+
 export function parseArgs(argv: string[]): ParsedArgs {
   const [command, ...rest] = argv;
   const valueFlags = valueFlagsFor(command ?? "");
@@ -708,7 +725,7 @@ export function parseArgs(argv: string[]): ParsedArgs {
       const inlineVal = eq === -1 ? undefined : a.slice(eq + 1);
       let val: string | boolean;
       if (inlineVal !== undefined) val = inlineVal;
-      else if (valueFlags.has(key)) val = rest[++i] ?? "";
+      else if (valueFlags.has(key) && !looksLikeFlag(rest[i + 1])) val = rest[++i] ?? "";
       else val = true;
       const prev = flags[key];
       if (LIST_FLAGS.has(key) && typeof prev === "string" && typeof val === "string") {

package/src/html-report.ts

@@ -301,12 +301,19 @@ export function scoreboardBlocks(result: AuditResult, standard: StandardId, lang
   const scope = pagesOf(result);
   if (!scope.length) return [];
   const derived = derivePages(result, scope);
-  const rows = derived.map((p) => [
-    { text: `${p.name}${p.auth ? " 🔒" : ""}`, ...(sheetHref ? { href: sheetHref(p.id) } : {}) },
-    { text: p.url, mono: true },
-    { text: basisLabel(p.basis, lang) },
-    { text: formatRate(p.conformancePct, p.decided, p.total), align: "end" as const },
-  ]);
+  // Through the standard-aware helpers, exactly like `renderPageRates` in src/report.ts:
+  // `PageResult.conformancePct` is the WCAG core projection, so under a pack this cell used to
+  // quote a rate out of 55 beside a document counting 106.
+  const rows = derived.map((p) => {
+    const criteria = pageCriterionRows(result, p, standard, lang);
+    const cov = pageCoverage(criteria);
+    return [
+      { text: `${p.name}${p.auth ? " 🔒" : ""}`, ...(sheetHref ? { href: sheetHref(p.id) } : {}) },
+      { text: p.url, mono: true },
+      { text: basisLabel(p.basis, lang) },
+      { text: formatRate(pageRatePct(criteria), cov.decided, cov.total), align: "end" as const },
+    ];
+  });
   const out: Block[] = [
     { kind: "heading", level: 2, text: t.perPage, id: "pages" },
     {

package/src/init.ts

@@ -129,7 +129,7 @@ jobs:
   ultra11y:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # the diff gate needs the base ref
       - uses: maxgfr/ultra11y@v${VERSION}

package/src/pages.ts

@@ -489,6 +489,25 @@ export function renderRedirected(redirected: ScanRedirect[], lang: Lang = "en"):
   return out;
 }
 
+/** One page's standing over the rows of the grid it is printed on — same C ÷ (C + NC) basis
+ *  as everywhere else, and the same NULL for "nothing decided". Taking it from the grid model
+ *  rather than from `PageResult` is what makes the header a summary of the body under a pack
+ *  as well as under the core: `PageResult` only ever carries the WCAG projection.
+ *
+ *  Returned as the argument tuple `formatRate` takes, so no caller can pair a rate with
+ *  somebody else's denominator. */
+export function gridRate(rows: { id: string }[], status: Map<string, Map<string, Status>>, pageId: string): [number | null, number, number] {
+  let c = 0;
+  let nc = 0;
+  for (const row of rows) {
+    const st = status.get(row.id)?.get(pageId);
+    if (st === "C") c++;
+    else if (st === "NC") nc++;
+  }
+  const decided = c + nc;
+  return [decided === 0 ? null : Math.round((c / decided) * 100), decided, rows.length];
+}
+
 /** The Markdown grid: one row per criterion, one column per page. */
 export function renderPageGrid(result: AuditResult, pages: PageScope[], standard: StandardId = CORE, lang: Lang = "en"): string {
   const s = L[lang];
@@ -504,10 +523,17 @@ export function renderPageGrid(result: AuditResult, pages: PageScope[], standard
 
   const head = [isCore(standard) ? s.criterion : s.criterion, ...derived.map((p) => `${p.name}${p.auth ? " 🔒" : ""}`)];
   out.push(`| ${head.join(" | ")} |`, `| ${head.map(() => "---").join(" | ")} |`);
-  out.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(p.conformancePct, p.decided, p.total)}**`).join(" | ")} |`);
+  // THE MODEL FIRST, because the rate is a summary OF THIS GRID and has to be computed from
+  // the rows it is printed above. It was read off `PageResult` instead — which is always the
+  // WCAG core projection — so under a pack the header and the body answered different
+  // questions: measured on a two-page RGAA run, the grid listed all 106 criteria and then
+  // announced « 89 % (9/55) », while the same page's own dossier said 47/106. Same command,
+  // same page, two denominators; and this grid is what `comment-kind: pages` pastes onto a
+  // pull request, so the wrong one was the one people read.
+  const { rows, status } = pageGridModel(result, derived, standard, lang);
+  out.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(...gridRate(rows, status, p.id))}**`).join(" | ")} |`);
   out.push(`| _${s.snapshot}?_ | ${derived.map((p) => `_${basisLabel(p.basis, lang)}_`).join(" | ")} |`);
 
-  const { rows, status } = pageGridModel(result, derived, standard, lang);
   let group = "";
   for (const row of rows) {
     if (row.group !== group) {

package/src/scan.ts

@@ -741,15 +741,33 @@ export function mergeSnapshotAudit(base: AuditResult, snap: AuditResult): AuditR
   if (snap.packFindings?.length) merged.packFindings = [...(merged.packFindings ?? []), ...snap.packFindings];
 
   // A criterion the static pass closed for want of a subject, which the snapshot then MEASURED.
-  // Both read `C`, so the discriminator is the flag, not the status: what has to go is the
-  // "nothing of that kind here" justification, which a rendered page has just falsified.
+  // Both read `C`, so the discriminator is the FLAG, not the status — and testing the status
+  // is exactly what this loop used to do. The snapshot pages have no time-based media either,
+  // so they closed 1.2.1 the same way the source did, `C` + `inapplicable`; reading only the
+  // status, the merge took that for a measurement and stripped the flag from every criterion
+  // both halves had closed for want of a subject.
+  //
+  // Two things then broke, both silently. The `C` lost the justification that made it
+  // falsifiable, becoming the bare uncited conformity this engine refuses everywhere else. And
+  // `pageStatus` reads `inapplicable` to hold "a conformity reached for want of a subject
+  // holds on every page" — without the flag those criteria fell through to the honesty rule
+  // that only `static` criteria earn a verdict by silence, and came back « à évaluer » on
+  // EVERY page. Measured on a two-page RGAA crawl: the run reported a complete 106/106 grid
+  // while each page carried 10 criteria nobody could ever adjudicate, because there was
+  // nothing there to adjudicate.
   for (const c of merged.criteria) {
     if (!c.inapplicable) continue;
-    if (snapById.get(c.id)?.status === "C") {
-      c.status = "C";
-      delete c.inapplicable;
-      delete c.justification; // "no relevant element in scope" no longer holds
-    }
+    const measured = snapById.get(c.id);
+    // Only a snapshot that reached `C` WITHOUT the flag has falsified "nothing of that kind
+    // here" — that one looked at the rendered page and found the subject.
+    if (!measured || measured.status !== "C" || measured.inapplicable) continue;
+    c.status = "C";
+    delete c.inapplicable;
+    // Keep the claim citable: adopt what the measuring half said, rather than leaving a `C`
+    // with nothing behind it.
+    if (measured.justification) c.justification = measured.justification;
+    else delete c.justification;
+    if (measured.decidedBy) c.decidedBy = measured.decidedBy;
   }
 
   const nowNc = new Set(snap.findings.filter((f) => !f.advisory).map((f) => f.criteriaId));

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.16.0";
+export const VERSION = "5.18.0";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,

package/dist/payload-DzQb84Kw.d.ts

@@ -1,87 +0,0 @@
-interface FindingLike {
-    ruleId: string;
-    criteriaId: string;
-    file: string;
-    line: number;
-    severity: string;
-    message: string;
-    advisory?: boolean;
-    origin?: {
-        sourceFile?: string;
-        sourceLine?: number;
-    };
-}
-interface AuditLike {
-    findings?: FindingLike[];
-}
-interface SnapshotPayload {
-    meta: Record<string, unknown>;
-    dom: string;
-    styles?: unknown;
-    boxes?: unknown;
-    css?: unknown;
-    screenshot?: string;
-    /** What the live probes measured, when the caller ran them. */
-    probes?: unknown;
-}
-/** Same slug rule as the engine (src/snapshot.ts slugifyPageId): accent-folded URL path. */
-declare function slugify(url: string): string;
-interface CheckOptions {
-    /** The page id (directory name). Defaults to the slugified URL path. */
-    as?: string;
-    /** Human page name for the report. Defaults to the document title. */
-    name?: string;
-    /** Severity at which the check fails, or `false` to record without ever failing. */
-    failOn?: "blocking" | "major" | "minor" | false;
-    /** Mark the page as sitting behind authentication. */
-    auth?: boolean;
-    /** Source files that rendered it — findings are then reported against YOUR code. */
-    sources?: string[];
-    /** Reproduction notes carried into the auditor ticket. */
-    notes?: string;
-    /** Capture a viewport screenshot for the pixel tier (Playwright: on by default). */
-    screenshot?: boolean;
-    /** The path you NAVIGATED to. Given it, the fixture refuses to record a page the browser
-     *  did not stay on — a guarded route that redirected, a session that expired — instead of
-     *  filing that other screen under this page's `as`/`name`. Nothing about such a snapshot
-     *  looks wrong, which is what makes it the worst thing an accessibility report can carry.
-     *  Compared by path (a query or fragment the app appends to its own route is the same
-     *  page); a full URL works too. `scan --sample` applies the same rule. */
-    expectPath?: string;
-    /** Run the LIVE PROBES on this page after collecting it: 200% zoom, 320px reflow, the
-     *  text-spacing override, focus visibility and content-on-hover.
-     *
-     *  These are the measurements a recorded snapshot can never settle, because they are
-     *  properties of a page being acted on rather than of a page as it stands. `scan` runs them
-     *  in its own browser, which is exactly why they were undecidable on any screen behind a
-     *  login or a state machine — the scanner arrives cold and gets a redirect. Your suite has
-     *  the page in the right state; this is how it says so.
-     *
-     *  Off by default: the probes press Tab, hover, resize the viewport and inject a stylesheet,
-     *  and a suite should opt into that. Everything is restored before it returns, and the
-     *  snapshot has already been collected, so what they measure cannot alter what was recorded.
-     *  Pass an array to run only some of them (by criterion: "1.4.4", "1.4.10", "1.4.12",
-     *  "1.4.13", "2.4.7"), or an object to also set the bounds — how wide the reflow probe
-     *  narrows to, how many focusables are worth tabbing through, how many hits are worth
-     *  recording. 320px is normative and stays the default; the other two are judgements about
-     *  YOUR pages, and a screen with 400 focusables should be able to say so rather than being
-     *  quietly cut off at 120. */
-    probes?: boolean | string[] | ProbeTuning;
-}
-/** The bounds a repository may put on the live probes. Stated once, here, because the same
- *  list is read from `.ultra11yrc.json`, accepted at the call site and handed to the engine —
- *  three copies of a field list is three chances for one of them to fall behind.
- *
- *  `budgetMs` and `actionTimeoutMs` are not tuning in the same sense as the others: they are
- *  what stops a probe from spending SOMEBODY ELSE'S test timeout. See ProbeLimits. */
-interface ProbeTuning {
-    only?: string[];
-    reflowWidth?: number;
-    maxFocusables?: number;
-    maxHits?: number;
-    maxTriggers?: number;
-    actionTimeoutMs?: number;
-    budgetMs?: number;
-}
-
-export { type AuditLike as A, type CheckOptions as C, type FindingLike as F, type SnapshotPayload as S, slugify as s };