ultra11y 5.25.0 → 5.27.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.25.0",
+      "version": "5.27.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.25.0",
+  "version": "5.27.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.25.0",
+  "version": "5.27.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.25.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.27.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/dist/playwright.mjs

@@ -720,7 +720,7 @@ var test = (() => {
       const base = load(from).test;
       if (!base?.extend) continue;
       return base.extend({
-        // biome-ignore lint/suspicious/noExplicitAny: same
+        // `any` for the same reason.
         ultra11y: async ({ page }, use) => {
           await use((opts) => checkA11y(page, opts));
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.25.0",
+  "version": "5.27.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.25.0";
+var VERSION = "5.27.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -36908,7 +36908,7 @@ function makeFilter(opts = {}) {
     const rel2 = toPosix(file);
     if (include && !include(rel2)) return false;
     if (exclude?.(rel2)) return false;
-    if (!opts.noDefaultExcludes && isTestArtifact(rel2) && !(include && include(rel2))) return false;
+    if (!opts.noDefaultExcludes && isTestArtifact(rel2) && !include?.(rel2)) return false;
     return true;
   };
 }
@@ -36974,7 +36974,7 @@ function expandInputs(inputs, opts = {}) {
     const before = list.length;
     list = list.filter((f) => {
       const rel2 = toPosix(f);
-      return !isTestArtifact(rel2) || explicit.has(f) || include != null && include(rel2);
+      return !isTestArtifact(rel2) || explicit.has(f) || include?.(rel2);
     });
     const dropped = before - list.length;
     if (dropped) opts.onWarn?.(`ultra11y: skipped ${dropped} test/spec/story file(s) \u2014 pass --no-default-excludes to audit them.`);
@@ -45061,14 +45061,42 @@ var SUBJECTS = {
       (e) => h(d, e, `<${e.tag} autoplay=${attr(e, "autoplay") !== void 0} controls=${attr(e, "controls") !== void 0}>`, `media|${e.tag}`)
     )
   ]),
-  // A change of context triggered by focus or by changing a value.
-  // RGAA 7.4 / WCAG 3.2.1-3.2.2. The handlers are half the subject; the OTHER half is what a
-  // script does once it runs, and that is where a context change actually happens: submitting a
-  // form, navigating, opening a window. Looking only for onFocus/onBlur/onChange left the
-  // criterion with an empty harvest on any codebase that binds its handlers in JavaScript
-  // rather than in markup — which is most of them — and an empty harvest is a criterion the
-  // adjudicator can only guess at.
+  // A change of context initiated by a script. RGAA 7.4 / WCAG 3.2.1-3.2.2.
+  //
+  // THE SUBJECT IS THE SCRIPT, and getting that wrong cost a release. This used to be a list of
+  // CONSEQUENCES — onFocus/onBlur/onChange, `.submit(`, `location`, `router.push`,
+  // `window.open` — on the theory that a context change is one of them. It is, but the list can
+  // only ever be the ways we have already seen a script change context, and a criterion whose
+  // subject is « each script » cannot be answered from a catalogue of endings.
+  //
+  // Measured on tests/fixtures/realworld, which ships LoginForm.tsx whose form carries
+  // `onSubmit={(e) => { e.preventDefault(); … }}`: 7.4 reached the adjudicator with population
+  // ZERO. A script was right there, doing the thing the criterion asks about, and the harvest
+  // walked past it because `onSubmit` was not on the list. The adjudicator was told « no
+  // evidence » and billed to guess between NA and manual — on a page it should have been handed
+  // twenty lines of React to read.
+  //
+  // So it collects the script FIRST: any `<script>`, any `on*` binding whatever the event, and
+  // then the consequences it always looked for, which stay because they are what an adjudicator
+  // most needs pointed out. Two things follow. A page with a script always arrives with it, so
+  // the verdict is made on the code rather than on its absence. And a page with no script at all
+  // harvests nothing — which is now a FACT about the code, not a gap in a pattern list, so 7.4
+  // and 3.2.1/3.2.2 close as « not applicable » with no model in the loop (EXISTENCE_SUBJECTS).
   contextChange: (docs) => docs.flatMap((d) => [
+    // The script itself — the subject, before anything it goes on to do.
+    ...elementsByTag(d, "script").map(
+      (e) => h(
+        d,
+        e,
+        `<script${attr(e, "src") ? ` src="${attr(e, "src")}"` : ""}> \u2014 does anything it runs change context, and is the user warned or in control?`,
+        `script|${attr(e, "src") ?? "inline"}`
+      )
+    ),
+    // Any handler binding, whatever the event: `onSubmit` and `onClick` change context as
+    // readily as `onChange`, and a criterion about scripts has no business enumerating events.
+    ...linesOf(d, /\bon[A-Z][A-Za-z]*\s*=|\son[a-z]+\s*=\s*["']/).map(
+      (l) => hAt(d, l.line, "handler", `handler \u2014 does it change context (navigate, submit, open a window, move focus)? ${l.text}`, `handler|${l.text}`)
+    ),
     ...linesOf(d, /\bon(?:Focus|Blur)\s*=/).map(
       (l) => hAt(d, l.line, "handler", `focus handler \u2014 does it change context (navigate, submit, move focus)? ${l.text}`, `onfocus|${l.text}`)
     ),
@@ -45436,9 +45464,12 @@ var EXISTENCE_SUBJECTS = /* @__PURE__ */ new Set([
   "autocomplete",
   "errors",
   "frames",
-  "downloadDocs"
+  "downloadDocs",
+  "newWindow",
+  "contextChange"
 ]);
 var subjectsForSc = (sc) => SC_SUBJECTS[sc] ?? [];
+var ownPackSubjects = (standard, id) => PACK_SUBJECTS[standard]?.[id];
 function subjectsForPackCriterion(standard, id, scs) {
   const own = PACK_SUBJECTS[standard]?.[id];
   if (own) return own;
@@ -46968,7 +46999,7 @@ var tableEmptyDataCell = {
     return out2;
   }
 };
-function ownerTable(el, doc) {
+function ownerTable(el) {
   return ancestors(el).find((a) => a.tag === "table");
 }
 var headersAttrDangling = {
@@ -46981,7 +47012,7 @@ var headersAttrDangling = {
       if (el.tag !== "td" && el.tag !== "th") continue;
       const raw = (attr(el, "headers") ?? "").trim();
       if (!raw || raw.includes("{")) continue;
-      const table = ownerTable(el, doc);
+      const table = ownerTable(el);
       if (!table) continue;
       const inTable = new Map(
         descendants(table).filter((d) => d.tag === "th" || d.tag === "td").map((d) => [attr(d, "id") ?? "", d])
@@ -48784,7 +48815,7 @@ function matchNode(el, node, depth) {
   if (node.has || node.lacks) {
     const desc = descendants(el);
     if (node.has && !node.has.every((sub) => desc.some((d) => matchNode(d, sub, depth + 1)))) return false;
-    if (node.lacks && node.lacks.some((sub) => desc.some((d) => matchNode(d, sub, depth + 1)))) return false;
+    if (node.lacks?.some((sub) => desc.some((d) => matchNode(d, sub, depth + 1)))) return false;
   }
   return true;
 }
@@ -49000,7 +49031,7 @@ function extractGraphNode(ast, doc, file, opts = {}) {
   if (ast) {
     for (const stmt of asNodes((asNode(ast.program) ?? ast).body)) {
       const vd = stmt.type === "VariableDeclaration" ? stmt : stmt.type === "ExportNamedDeclaration" ? asNode(stmt.declaration) : void 0;
-      if (!vd || vd.type !== "VariableDeclaration") continue;
+      if (vd?.type !== "VariableDeclaration") continue;
       for (const d of asNodes(vd.declarations)) {
         const idn = asNode(d.id);
         const init2 = asNode(d.init);
@@ -49353,7 +49384,7 @@ function hasMedia(d) {
   return d.elements.some((el) => {
     if (el.tag === "object" || el.tag === "embed") {
       const type = (el.attribs.type ?? "").toLowerCase();
-      return !type || type.startsWith("audio/") || type.startsWith("video/") || type.startsWith("application/") ? true : false;
+      return !type || type.startsWith("audio/") || type.startsWith("video/") || type.startsWith("application/");
     }
     if (el.tag !== "iframe") return false;
     const hay = `${el.attribs.src ?? ""} ${el.attribs.title ?? ""} ${el.attribs.allow ?? ""}`;
@@ -54407,6 +54438,13 @@ function derivePackResults(audit2, packKey, pageId) {
   const overrides = pack.overrides;
   const seen = audit2.scope.subjectsSeen;
   const subjectAbsent = (pc) => seen !== void 0 && subjectsAbsent(subjectsForPackCriterion(packKey, pc.id, pc.wcag), new Set(seen));
+  const ownSubjectSeen = (pc) => {
+    if (seen === void 0) return false;
+    const own = ownPackSubjects(packKey, pc.id);
+    if (!own?.length) return false;
+    const present = new Set(seen);
+    return own.some((id) => present.has(id));
+  };
   const ownRuleIds = new Set((pack.rules ?? []).map((r) => `pack:${packKey}:${r.id}`));
   const deriveBase = (pc) => {
     const outOfScope = pc.wcag.every((sc) => {
@@ -54443,6 +54481,9 @@ function derivePackResults(audit2, packKey, pageId) {
       return { id: pc.id, theme: pc.theme, status: INAPPLICABLE_STATUS, findings, scs: pc.wcag, inapplicable: true };
     }
     const inapplicable = status === INAPPLICABLE_STATUS && (scResults.length === 0 || scResults.every((r) => r.inapplicable));
+    if (inapplicable && ownSubjectSeen(pc)) {
+      return { id: pc.id, theme: pc.theme, status: "manual", findings, scs: pc.wcag };
+    }
     return { id: pc.id, theme: pc.theme, status, findings, scs: pc.wcag, ...inapplicable ? { inapplicable: true } : {} };
   };
   const enabledSecondary = (pack.secondaryMappings ?? []).filter((m) => m.enabled === true);
@@ -59219,7 +59260,7 @@ function applyAdjudication(audit2, adj, opts = {}) {
     if (v === null) {
       blame(it.criteriaId, `criterion ${it.criteriaId}: unadjudicated (verdict is null)`);
     } else if (v === "C" || v === "NA") {
-      if (!it.justification || !it.justification.trim()) blame(it.criteriaId, `criterion ${it.criteriaId}: a ${v} verdict requires a justification`);
+      if (!it.justification?.trim()) blame(it.criteriaId, `criterion ${it.criteriaId}: a ${v} verdict requires a justification`);
       const cites = (it.citations ?? []).map(readCitation).filter((c2) => c2 !== null);
       if (v === "C" && it.evidenceComplete === false) {
         blame(
@@ -59272,7 +59313,7 @@ function applyAdjudication(audit2, adj, opts = {}) {
           );
           continue;
         }
-        if (!f.normativeRef || !f.normativeRef.trim()) {
+        if (!f.normativeRef?.trim()) {
           blame(it.criteriaId, `criterion ${it.criteriaId}: an NC finding requires a normativeRef citing the failed test of the active standard`);
         } else if (!normativeRefResolves(f.normativeRef, adj.standard, isCore(adj.standard) ? void 0 : it.criteriaId)) {
           blame(
@@ -60873,7 +60914,7 @@ function mergeSnapshotAudit(base, snap) {
   for (const c2 of merged.criteria) {
     if (!c2.inapplicable) continue;
     const measured = snapById.get(c2.id);
-    if (!measured || measured.status !== "C" || measured.inapplicable) continue;
+    if (measured?.status !== "C" || measured.inapplicable) continue;
     c2.status = "C";
     delete c2.inapplicable;
     if (measured.justification) c2.justification = measured.justification;
@@ -64916,7 +64957,7 @@ function foldRecordedAdjudication(root, fresh) {
   for (const c2 of prior.criteria) {
     if (c2.decidedBy !== "agent") continue;
     const target = byId2.get(c2.id);
-    if (!target || target.status !== "manual") continue;
+    if (target?.status !== "manual") continue;
     target.status = c2.status;
     target.decidedBy = "agent";
     if (c2.justification) target.justification = c2.justification;
@@ -65541,7 +65582,7 @@ For EACH entry:
 Then fold: \`ultra11y verify --apply ${join47(runAbs, "VERIFY.todo.json")} --report <the report .md>\`. Without a shell, leave the fold to whoever gave you the file.
 `;
 }
-function agentContracts(runAbs, engineAbs, opts = {}) {
+function agentContracts(runAbs, opts = {}) {
   const footer = ONE_WRITER_FOOTER.replaceAll("<RUN>", runAbs);
   if (opts.eco) return { adjudicator: ecoAdjudicatorContract(runAbs), refuter: ecoRefuterContract(runAbs) };
   return {
@@ -65724,7 +65765,7 @@ function orchestrateRun(runDir, engineAbs, opts = {}) {
   mkdirSync17(agentsDir, { recursive: true });
   const written = [];
   const notices = [];
-  for (const [name2, content] of Object.entries(agentContracts(run2, engineAbs, { eco: opts.eco === true }))) {
+  for (const [name2, content] of Object.entries(agentContracts(run2, { eco: opts.eco === true }))) {
     const p = join48(agentsDir, `${name2}.md`);
     writeFileSync19(p, content);
     written.push(p);
@@ -66230,7 +66271,7 @@ function bool(v) {
 }
 function strArray2(v) {
   const a = Array.isArray(v) && v.every((x) => typeof x === "string") ? v : void 0;
-  return a && a.length ? a : void 0;
+  return a?.length ? a : void 0;
 }
 function positive(v, key) {
   const n = num2(v);

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.25.0
+  version: 5.27.0
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.25.0";
+var VERSION = "5.27.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -36908,7 +36908,7 @@ function makeFilter(opts = {}) {
     const rel2 = toPosix(file);
     if (include && !include(rel2)) return false;
     if (exclude?.(rel2)) return false;
-    if (!opts.noDefaultExcludes && isTestArtifact(rel2) && !(include && include(rel2))) return false;
+    if (!opts.noDefaultExcludes && isTestArtifact(rel2) && !include?.(rel2)) return false;
     return true;
   };
 }
@@ -36974,7 +36974,7 @@ function expandInputs(inputs, opts = {}) {
     const before = list.length;
     list = list.filter((f) => {
       const rel2 = toPosix(f);
-      return !isTestArtifact(rel2) || explicit.has(f) || include != null && include(rel2);
+      return !isTestArtifact(rel2) || explicit.has(f) || include?.(rel2);
     });
     const dropped = before - list.length;
     if (dropped) opts.onWarn?.(`ultra11y: skipped ${dropped} test/spec/story file(s) \u2014 pass --no-default-excludes to audit them.`);
@@ -45061,14 +45061,42 @@ var SUBJECTS = {
       (e) => h(d, e, `<${e.tag} autoplay=${attr(e, "autoplay") !== void 0} controls=${attr(e, "controls") !== void 0}>`, `media|${e.tag}`)
     )
   ]),
-  // A change of context triggered by focus or by changing a value.
-  // RGAA 7.4 / WCAG 3.2.1-3.2.2. The handlers are half the subject; the OTHER half is what a
-  // script does once it runs, and that is where a context change actually happens: submitting a
-  // form, navigating, opening a window. Looking only for onFocus/onBlur/onChange left the
-  // criterion with an empty harvest on any codebase that binds its handlers in JavaScript
-  // rather than in markup — which is most of them — and an empty harvest is a criterion the
-  // adjudicator can only guess at.
+  // A change of context initiated by a script. RGAA 7.4 / WCAG 3.2.1-3.2.2.
+  //
+  // THE SUBJECT IS THE SCRIPT, and getting that wrong cost a release. This used to be a list of
+  // CONSEQUENCES — onFocus/onBlur/onChange, `.submit(`, `location`, `router.push`,
+  // `window.open` — on the theory that a context change is one of them. It is, but the list can
+  // only ever be the ways we have already seen a script change context, and a criterion whose
+  // subject is « each script » cannot be answered from a catalogue of endings.
+  //
+  // Measured on tests/fixtures/realworld, which ships LoginForm.tsx whose form carries
+  // `onSubmit={(e) => { e.preventDefault(); … }}`: 7.4 reached the adjudicator with population
+  // ZERO. A script was right there, doing the thing the criterion asks about, and the harvest
+  // walked past it because `onSubmit` was not on the list. The adjudicator was told « no
+  // evidence » and billed to guess between NA and manual — on a page it should have been handed
+  // twenty lines of React to read.
+  //
+  // So it collects the script FIRST: any `<script>`, any `on*` binding whatever the event, and
+  // then the consequences it always looked for, which stay because they are what an adjudicator
+  // most needs pointed out. Two things follow. A page with a script always arrives with it, so
+  // the verdict is made on the code rather than on its absence. And a page with no script at all
+  // harvests nothing — which is now a FACT about the code, not a gap in a pattern list, so 7.4
+  // and 3.2.1/3.2.2 close as « not applicable » with no model in the loop (EXISTENCE_SUBJECTS).
   contextChange: (docs) => docs.flatMap((d) => [
+    // The script itself — the subject, before anything it goes on to do.
+    ...elementsByTag(d, "script").map(
+      (e) => h(
+        d,
+        e,
+        `<script${attr(e, "src") ? ` src="${attr(e, "src")}"` : ""}> \u2014 does anything it runs change context, and is the user warned or in control?`,
+        `script|${attr(e, "src") ?? "inline"}`
+      )
+    ),
+    // Any handler binding, whatever the event: `onSubmit` and `onClick` change context as
+    // readily as `onChange`, and a criterion about scripts has no business enumerating events.
+    ...linesOf(d, /\bon[A-Z][A-Za-z]*\s*=|\son[a-z]+\s*=\s*["']/).map(
+      (l) => hAt(d, l.line, "handler", `handler \u2014 does it change context (navigate, submit, open a window, move focus)? ${l.text}`, `handler|${l.text}`)
+    ),
     ...linesOf(d, /\bon(?:Focus|Blur)\s*=/).map(
       (l) => hAt(d, l.line, "handler", `focus handler \u2014 does it change context (navigate, submit, move focus)? ${l.text}`, `onfocus|${l.text}`)
     ),
@@ -45436,9 +45464,12 @@ var EXISTENCE_SUBJECTS = /* @__PURE__ */ new Set([
   "autocomplete",
   "errors",
   "frames",
-  "downloadDocs"
+  "downloadDocs",
+  "newWindow",
+  "contextChange"
 ]);
 var subjectsForSc = (sc) => SC_SUBJECTS[sc] ?? [];
+var ownPackSubjects = (standard, id) => PACK_SUBJECTS[standard]?.[id];
 function subjectsForPackCriterion(standard, id, scs) {
   const own = PACK_SUBJECTS[standard]?.[id];
   if (own) return own;
@@ -46968,7 +46999,7 @@ var tableEmptyDataCell = {
     return out2;
   }
 };
-function ownerTable(el, doc) {
+function ownerTable(el) {
   return ancestors(el).find((a) => a.tag === "table");
 }
 var headersAttrDangling = {
@@ -46981,7 +47012,7 @@ var headersAttrDangling = {
       if (el.tag !== "td" && el.tag !== "th") continue;
       const raw = (attr(el, "headers") ?? "").trim();
       if (!raw || raw.includes("{")) continue;
-      const table = ownerTable(el, doc);
+      const table = ownerTable(el);
       if (!table) continue;
       const inTable = new Map(
         descendants(table).filter((d) => d.tag === "th" || d.tag === "td").map((d) => [attr(d, "id") ?? "", d])
@@ -48784,7 +48815,7 @@ function matchNode(el, node, depth) {
   if (node.has || node.lacks) {
     const desc = descendants(el);
     if (node.has && !node.has.every((sub) => desc.some((d) => matchNode(d, sub, depth + 1)))) return false;
-    if (node.lacks && node.lacks.some((sub) => desc.some((d) => matchNode(d, sub, depth + 1)))) return false;
+    if (node.lacks?.some((sub) => desc.some((d) => matchNode(d, sub, depth + 1)))) return false;
   }
   return true;
 }
@@ -49000,7 +49031,7 @@ function extractGraphNode(ast, doc, file, opts = {}) {
   if (ast) {
     for (const stmt of asNodes((asNode(ast.program) ?? ast).body)) {
       const vd = stmt.type === "VariableDeclaration" ? stmt : stmt.type === "ExportNamedDeclaration" ? asNode(stmt.declaration) : void 0;
-      if (!vd || vd.type !== "VariableDeclaration") continue;
+      if (vd?.type !== "VariableDeclaration") continue;
       for (const d of asNodes(vd.declarations)) {
         const idn = asNode(d.id);
         const init2 = asNode(d.init);
@@ -49353,7 +49384,7 @@ function hasMedia(d) {
   return d.elements.some((el) => {
     if (el.tag === "object" || el.tag === "embed") {
       const type = (el.attribs.type ?? "").toLowerCase();
-      return !type || type.startsWith("audio/") || type.startsWith("video/") || type.startsWith("application/") ? true : false;
+      return !type || type.startsWith("audio/") || type.startsWith("video/") || type.startsWith("application/");
     }
     if (el.tag !== "iframe") return false;
     const hay = `${el.attribs.src ?? ""} ${el.attribs.title ?? ""} ${el.attribs.allow ?? ""}`;
@@ -54407,6 +54438,13 @@ function derivePackResults(audit2, packKey, pageId) {
   const overrides = pack.overrides;
   const seen = audit2.scope.subjectsSeen;
   const subjectAbsent = (pc) => seen !== void 0 && subjectsAbsent(subjectsForPackCriterion(packKey, pc.id, pc.wcag), new Set(seen));
+  const ownSubjectSeen = (pc) => {
+    if (seen === void 0) return false;
+    const own = ownPackSubjects(packKey, pc.id);
+    if (!own?.length) return false;
+    const present = new Set(seen);
+    return own.some((id) => present.has(id));
+  };
   const ownRuleIds = new Set((pack.rules ?? []).map((r) => `pack:${packKey}:${r.id}`));
   const deriveBase = (pc) => {
     const outOfScope = pc.wcag.every((sc) => {
@@ -54443,6 +54481,9 @@ function derivePackResults(audit2, packKey, pageId) {
       return { id: pc.id, theme: pc.theme, status: INAPPLICABLE_STATUS, findings, scs: pc.wcag, inapplicable: true };
     }
     const inapplicable = status === INAPPLICABLE_STATUS && (scResults.length === 0 || scResults.every((r) => r.inapplicable));
+    if (inapplicable && ownSubjectSeen(pc)) {
+      return { id: pc.id, theme: pc.theme, status: "manual", findings, scs: pc.wcag };
+    }
     return { id: pc.id, theme: pc.theme, status, findings, scs: pc.wcag, ...inapplicable ? { inapplicable: true } : {} };
   };
   const enabledSecondary = (pack.secondaryMappings ?? []).filter((m) => m.enabled === true);
@@ -59219,7 +59260,7 @@ function applyAdjudication(audit2, adj, opts = {}) {
     if (v === null) {
       blame(it.criteriaId, `criterion ${it.criteriaId}: unadjudicated (verdict is null)`);
     } else if (v === "C" || v === "NA") {
-      if (!it.justification || !it.justification.trim()) blame(it.criteriaId, `criterion ${it.criteriaId}: a ${v} verdict requires a justification`);
+      if (!it.justification?.trim()) blame(it.criteriaId, `criterion ${it.criteriaId}: a ${v} verdict requires a justification`);
       const cites = (it.citations ?? []).map(readCitation).filter((c2) => c2 !== null);
       if (v === "C" && it.evidenceComplete === false) {
         blame(
@@ -59272,7 +59313,7 @@ function applyAdjudication(audit2, adj, opts = {}) {
           );
           continue;
         }
-        if (!f.normativeRef || !f.normativeRef.trim()) {
+        if (!f.normativeRef?.trim()) {
           blame(it.criteriaId, `criterion ${it.criteriaId}: an NC finding requires a normativeRef citing the failed test of the active standard`);
         } else if (!normativeRefResolves(f.normativeRef, adj.standard, isCore(adj.standard) ? void 0 : it.criteriaId)) {
           blame(
@@ -60873,7 +60914,7 @@ function mergeSnapshotAudit(base, snap) {
   for (const c2 of merged.criteria) {
     if (!c2.inapplicable) continue;
     const measured = snapById.get(c2.id);
-    if (!measured || measured.status !== "C" || measured.inapplicable) continue;
+    if (measured?.status !== "C" || measured.inapplicable) continue;
     c2.status = "C";
     delete c2.inapplicable;
     if (measured.justification) c2.justification = measured.justification;
@@ -64916,7 +64957,7 @@ function foldRecordedAdjudication(root, fresh) {
   for (const c2 of prior.criteria) {
     if (c2.decidedBy !== "agent") continue;
     const target = byId2.get(c2.id);
-    if (!target || target.status !== "manual") continue;
+    if (target?.status !== "manual") continue;
     target.status = c2.status;
     target.decidedBy = "agent";
     if (c2.justification) target.justification = c2.justification;
@@ -65541,7 +65582,7 @@ For EACH entry:
 Then fold: \`ultra11y verify --apply ${join47(runAbs, "VERIFY.todo.json")} --report <the report .md>\`. Without a shell, leave the fold to whoever gave you the file.
 `;
 }
-function agentContracts(runAbs, engineAbs, opts = {}) {
+function agentContracts(runAbs, opts = {}) {
   const footer = ONE_WRITER_FOOTER.replaceAll("<RUN>", runAbs);
   if (opts.eco) return { adjudicator: ecoAdjudicatorContract(runAbs), refuter: ecoRefuterContract(runAbs) };
   return {
@@ -65724,7 +65765,7 @@ function orchestrateRun(runDir, engineAbs, opts = {}) {
   mkdirSync17(agentsDir, { recursive: true });
   const written = [];
   const notices = [];
-  for (const [name2, content] of Object.entries(agentContracts(run2, engineAbs, { eco: opts.eco === true }))) {
+  for (const [name2, content] of Object.entries(agentContracts(run2, { eco: opts.eco === true }))) {
     const p = join48(agentsDir, `${name2}.md`);
     writeFileSync19(p, content);
     written.push(p);
@@ -66230,7 +66271,7 @@ function bool(v) {
 }
 function strArray2(v) {
   const a = Array.isArray(v) && v.every((x) => typeof x === "string") ? v : void 0;
-  return a && a.length ? a : void 0;
+  return a?.length ? a : void 0;
 }
 function positive(v, key) {
   const n = num2(v);

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 5.25.0
+  version: 5.27.0
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.25.0";
+var VERSION = "5.27.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -36908,7 +36908,7 @@ function makeFilter(opts = {}) {
     const rel2 = toPosix(file);
     if (include && !include(rel2)) return false;
     if (exclude?.(rel2)) return false;
-    if (!opts.noDefaultExcludes && isTestArtifact(rel2) && !(include && include(rel2))) return false;
+    if (!opts.noDefaultExcludes && isTestArtifact(rel2) && !include?.(rel2)) return false;
     return true;
   };
 }
@@ -36974,7 +36974,7 @@ function expandInputs(inputs, opts = {}) {
     const before = list.length;
     list = list.filter((f) => {
       const rel2 = toPosix(f);
-      return !isTestArtifact(rel2) || explicit.has(f) || include != null && include(rel2);
+      return !isTestArtifact(rel2) || explicit.has(f) || include?.(rel2);
     });
     const dropped = before - list.length;
     if (dropped) opts.onWarn?.(`ultra11y: skipped ${dropped} test/spec/story file(s) \u2014 pass --no-default-excludes to audit them.`);
@@ -45061,14 +45061,42 @@ var SUBJECTS = {
       (e) => h(d, e, `<${e.tag} autoplay=${attr(e, "autoplay") !== void 0} controls=${attr(e, "controls") !== void 0}>`, `media|${e.tag}`)
     )
   ]),
-  // A change of context triggered by focus or by changing a value.
-  // RGAA 7.4 / WCAG 3.2.1-3.2.2. The handlers are half the subject; the OTHER half is what a
-  // script does once it runs, and that is where a context change actually happens: submitting a
-  // form, navigating, opening a window. Looking only for onFocus/onBlur/onChange left the
-  // criterion with an empty harvest on any codebase that binds its handlers in JavaScript
-  // rather than in markup — which is most of them — and an empty harvest is a criterion the
-  // adjudicator can only guess at.
+  // A change of context initiated by a script. RGAA 7.4 / WCAG 3.2.1-3.2.2.
+  //
+  // THE SUBJECT IS THE SCRIPT, and getting that wrong cost a release. This used to be a list of
+  // CONSEQUENCES — onFocus/onBlur/onChange, `.submit(`, `location`, `router.push`,
+  // `window.open` — on the theory that a context change is one of them. It is, but the list can
+  // only ever be the ways we have already seen a script change context, and a criterion whose
+  // subject is « each script » cannot be answered from a catalogue of endings.
+  //
+  // Measured on tests/fixtures/realworld, which ships LoginForm.tsx whose form carries
+  // `onSubmit={(e) => { e.preventDefault(); … }}`: 7.4 reached the adjudicator with population
+  // ZERO. A script was right there, doing the thing the criterion asks about, and the harvest
+  // walked past it because `onSubmit` was not on the list. The adjudicator was told « no
+  // evidence » and billed to guess between NA and manual — on a page it should have been handed
+  // twenty lines of React to read.
+  //
+  // So it collects the script FIRST: any `<script>`, any `on*` binding whatever the event, and
+  // then the consequences it always looked for, which stay because they are what an adjudicator
+  // most needs pointed out. Two things follow. A page with a script always arrives with it, so
+  // the verdict is made on the code rather than on its absence. And a page with no script at all
+  // harvests nothing — which is now a FACT about the code, not a gap in a pattern list, so 7.4
+  // and 3.2.1/3.2.2 close as « not applicable » with no model in the loop (EXISTENCE_SUBJECTS).
   contextChange: (docs) => docs.flatMap((d) => [
+    // The script itself — the subject, before anything it goes on to do.
+    ...elementsByTag(d, "script").map(
+      (e) => h(
+        d,
+        e,
+        `<script${attr(e, "src") ? ` src="${attr(e, "src")}"` : ""}> \u2014 does anything it runs change context, and is the user warned or in control?`,
+        `script|${attr(e, "src") ?? "inline"}`
+      )
+    ),
+    // Any handler binding, whatever the event: `onSubmit` and `onClick` change context as
+    // readily as `onChange`, and a criterion about scripts has no business enumerating events.
+    ...linesOf(d, /\bon[A-Z][A-Za-z]*\s*=|\son[a-z]+\s*=\s*["']/).map(
+      (l) => hAt(d, l.line, "handler", `handler \u2014 does it change context (navigate, submit, open a window, move focus)? ${l.text}`, `handler|${l.text}`)
+    ),
     ...linesOf(d, /\bon(?:Focus|Blur)\s*=/).map(
       (l) => hAt(d, l.line, "handler", `focus handler \u2014 does it change context (navigate, submit, move focus)? ${l.text}`, `onfocus|${l.text}`)
     ),
@@ -45436,9 +45464,12 @@ var EXISTENCE_SUBJECTS = /* @__PURE__ */ new Set([
   "autocomplete",
   "errors",
   "frames",
-  "downloadDocs"
+  "downloadDocs",
+  "newWindow",
+  "contextChange"
 ]);
 var subjectsForSc = (sc) => SC_SUBJECTS[sc] ?? [];
+var ownPackSubjects = (standard, id) => PACK_SUBJECTS[standard]?.[id];
 function subjectsForPackCriterion(standard, id, scs) {
   const own = PACK_SUBJECTS[standard]?.[id];
   if (own) return own;
@@ -46968,7 +46999,7 @@ var tableEmptyDataCell = {
     return out2;
   }
 };
-function ownerTable(el, doc) {
+function ownerTable(el) {
   return ancestors(el).find((a) => a.tag === "table");
 }
 var headersAttrDangling = {
@@ -46981,7 +47012,7 @@ var headersAttrDangling = {
       if (el.tag !== "td" && el.tag !== "th") continue;
       const raw = (attr(el, "headers") ?? "").trim();
       if (!raw || raw.includes("{")) continue;
-      const table = ownerTable(el, doc);
+      const table = ownerTable(el);
       if (!table) continue;
       const inTable = new Map(
         descendants(table).filter((d) => d.tag === "th" || d.tag === "td").map((d) => [attr(d, "id") ?? "", d])
@@ -48784,7 +48815,7 @@ function matchNode(el, node, depth) {
   if (node.has || node.lacks) {
     const desc = descendants(el);
     if (node.has && !node.has.every((sub) => desc.some((d) => matchNode(d, sub, depth + 1)))) return false;
-    if (node.lacks && node.lacks.some((sub) => desc.some((d) => matchNode(d, sub, depth + 1)))) return false;
+    if (node.lacks?.some((sub) => desc.some((d) => matchNode(d, sub, depth + 1)))) return false;
   }
   return true;
 }
@@ -49000,7 +49031,7 @@ function extractGraphNode(ast, doc, file, opts = {}) {
   if (ast) {
     for (const stmt of asNodes((asNode(ast.program) ?? ast).body)) {
       const vd = stmt.type === "VariableDeclaration" ? stmt : stmt.type === "ExportNamedDeclaration" ? asNode(stmt.declaration) : void 0;
-      if (!vd || vd.type !== "VariableDeclaration") continue;
+      if (vd?.type !== "VariableDeclaration") continue;
       for (const d of asNodes(vd.declarations)) {
         const idn = asNode(d.id);
         const init2 = asNode(d.init);
@@ -49353,7 +49384,7 @@ function hasMedia(d) {
   return d.elements.some((el) => {
     if (el.tag === "object" || el.tag === "embed") {
       const type = (el.attribs.type ?? "").toLowerCase();
-      return !type || type.startsWith("audio/") || type.startsWith("video/") || type.startsWith("application/") ? true : false;
+      return !type || type.startsWith("audio/") || type.startsWith("video/") || type.startsWith("application/");
     }
     if (el.tag !== "iframe") return false;
     const hay = `${el.attribs.src ?? ""} ${el.attribs.title ?? ""} ${el.attribs.allow ?? ""}`;
@@ -54407,6 +54438,13 @@ function derivePackResults(audit2, packKey, pageId) {
   const overrides = pack.overrides;
   const seen = audit2.scope.subjectsSeen;
   const subjectAbsent = (pc) => seen !== void 0 && subjectsAbsent(subjectsForPackCriterion(packKey, pc.id, pc.wcag), new Set(seen));
+  const ownSubjectSeen = (pc) => {
+    if (seen === void 0) return false;
+    const own = ownPackSubjects(packKey, pc.id);
+    if (!own?.length) return false;
+    const present = new Set(seen);
+    return own.some((id) => present.has(id));
+  };
   const ownRuleIds = new Set((pack.rules ?? []).map((r) => `pack:${packKey}:${r.id}`));
   const deriveBase = (pc) => {
     const outOfScope = pc.wcag.every((sc) => {
@@ -54443,6 +54481,9 @@ function derivePackResults(audit2, packKey, pageId) {
       return { id: pc.id, theme: pc.theme, status: INAPPLICABLE_STATUS, findings, scs: pc.wcag, inapplicable: true };
     }
     const inapplicable = status === INAPPLICABLE_STATUS && (scResults.length === 0 || scResults.every((r) => r.inapplicable));
+    if (inapplicable && ownSubjectSeen(pc)) {
+      return { id: pc.id, theme: pc.theme, status: "manual", findings, scs: pc.wcag };
+    }
     return { id: pc.id, theme: pc.theme, status, findings, scs: pc.wcag, ...inapplicable ? { inapplicable: true } : {} };
   };
   const enabledSecondary = (pack.secondaryMappings ?? []).filter((m) => m.enabled === true);
@@ -59219,7 +59260,7 @@ function applyAdjudication(audit2, adj, opts = {}) {
     if (v === null) {
       blame(it.criteriaId, `criterion ${it.criteriaId}: unadjudicated (verdict is null)`);
     } else if (v === "C" || v === "NA") {
-      if (!it.justification || !it.justification.trim()) blame(it.criteriaId, `criterion ${it.criteriaId}: a ${v} verdict requires a justification`);
+      if (!it.justification?.trim()) blame(it.criteriaId, `criterion ${it.criteriaId}: a ${v} verdict requires a justification`);
       const cites = (it.citations ?? []).map(readCitation).filter((c2) => c2 !== null);
       if (v === "C" && it.evidenceComplete === false) {
         blame(
@@ -59272,7 +59313,7 @@ function applyAdjudication(audit2, adj, opts = {}) {
           );
           continue;
         }
-        if (!f.normativeRef || !f.normativeRef.trim()) {
+        if (!f.normativeRef?.trim()) {
           blame(it.criteriaId, `criterion ${it.criteriaId}: an NC finding requires a normativeRef citing the failed test of the active standard`);
         } else if (!normativeRefResolves(f.normativeRef, adj.standard, isCore(adj.standard) ? void 0 : it.criteriaId)) {
           blame(
@@ -60873,7 +60914,7 @@ function mergeSnapshotAudit(base, snap) {
   for (const c2 of merged.criteria) {
     if (!c2.inapplicable) continue;
     const measured = snapById.get(c2.id);
-    if (!measured || measured.status !== "C" || measured.inapplicable) continue;
+    if (measured?.status !== "C" || measured.inapplicable) continue;
     c2.status = "C";
     delete c2.inapplicable;
     if (measured.justification) c2.justification = measured.justification;
@@ -64916,7 +64957,7 @@ function foldRecordedAdjudication(root, fresh) {
   for (const c2 of prior.criteria) {
     if (c2.decidedBy !== "agent") continue;
     const target = byId2.get(c2.id);
-    if (!target || target.status !== "manual") continue;
+    if (target?.status !== "manual") continue;
     target.status = c2.status;
     target.decidedBy = "agent";
     if (c2.justification) target.justification = c2.justification;
@@ -65541,7 +65582,7 @@ For EACH entry:
 Then fold: \`ultra11y verify --apply ${join47(runAbs, "VERIFY.todo.json")} --report <the report .md>\`. Without a shell, leave the fold to whoever gave you the file.
 `;
 }
-function agentContracts(runAbs, engineAbs, opts = {}) {
+function agentContracts(runAbs, opts = {}) {
   const footer = ONE_WRITER_FOOTER.replaceAll("<RUN>", runAbs);
   if (opts.eco) return { adjudicator: ecoAdjudicatorContract(runAbs), refuter: ecoRefuterContract(runAbs) };
   return {
@@ -65724,7 +65765,7 @@ function orchestrateRun(runDir, engineAbs, opts = {}) {
   mkdirSync17(agentsDir, { recursive: true });
   const written = [];
   const notices = [];
-  for (const [name2, content] of Object.entries(agentContracts(run2, engineAbs, { eco: opts.eco === true }))) {
+  for (const [name2, content] of Object.entries(agentContracts(run2, { eco: opts.eco === true }))) {
     const p = join48(agentsDir, `${name2}.md`);
     writeFileSync19(p, content);
     written.push(p);
@@ -66230,7 +66271,7 @@ function bool(v) {
 }
 function strArray2(v) {
   const a = Array.isArray(v) && v.every((x) => typeof x === "string") ? v : void 0;
-  return a && a.length ? a : void 0;
+  return a?.length ? a : void 0;
 }
 function positive(v, key) {
   const n = num2(v);

package/src/adjudicate-subjects.ts

@@ -706,15 +706,43 @@ export const SUBJECTS: Record<string, Subject> = {
       ),
     ]),
 
-  // A change of context triggered by focus or by changing a value.
-  // RGAA 7.4 / WCAG 3.2.1-3.2.2. The handlers are half the subject; the OTHER half is what a
-  // script does once it runs, and that is where a context change actually happens: submitting a
-  // form, navigating, opening a window. Looking only for onFocus/onBlur/onChange left the
-  // criterion with an empty harvest on any codebase that binds its handlers in JavaScript
-  // rather than in markup — which is most of them — and an empty harvest is a criterion the
-  // adjudicator can only guess at.
+  // A change of context initiated by a script. RGAA 7.4 / WCAG 3.2.1-3.2.2.
+  //
+  // THE SUBJECT IS THE SCRIPT, and getting that wrong cost a release. This used to be a list of
+  // CONSEQUENCES — onFocus/onBlur/onChange, `.submit(`, `location`, `router.push`,
+  // `window.open` — on the theory that a context change is one of them. It is, but the list can
+  // only ever be the ways we have already seen a script change context, and a criterion whose
+  // subject is « each script » cannot be answered from a catalogue of endings.
+  //
+  // Measured on tests/fixtures/realworld, which ships LoginForm.tsx whose form carries
+  // `onSubmit={(e) => { e.preventDefault(); … }}`: 7.4 reached the adjudicator with population
+  // ZERO. A script was right there, doing the thing the criterion asks about, and the harvest
+  // walked past it because `onSubmit` was not on the list. The adjudicator was told « no
+  // evidence » and billed to guess between NA and manual — on a page it should have been handed
+  // twenty lines of React to read.
+  //
+  // So it collects the script FIRST: any `<script>`, any `on*` binding whatever the event, and
+  // then the consequences it always looked for, which stay because they are what an adjudicator
+  // most needs pointed out. Two things follow. A page with a script always arrives with it, so
+  // the verdict is made on the code rather than on its absence. And a page with no script at all
+  // harvests nothing — which is now a FACT about the code, not a gap in a pattern list, so 7.4
+  // and 3.2.1/3.2.2 close as « not applicable » with no model in the loop (EXISTENCE_SUBJECTS).
   contextChange: (docs) =>
     docs.flatMap((d) => [
+      // The script itself — the subject, before anything it goes on to do.
+      ...elementsByTag(d, "script").map((e) =>
+        h(
+          d,
+          e,
+          `<script${attr(e, "src") ? ` src="${attr(e, "src")}"` : ""}> — does anything it runs change context, and is the user warned or in control?`,
+          `script|${attr(e, "src") ?? "inline"}`,
+        ),
+      ),
+      // Any handler binding, whatever the event: `onSubmit` and `onClick` change context as
+      // readily as `onChange`, and a criterion about scripts has no business enumerating events.
+      ...linesOf(d, /\bon[A-Z][A-Za-z]*\s*=|\son[a-z]+\s*=\s*["']/).map((l) =>
+        hAt(d, l.line, "handler", `handler — does it change context (navigate, submit, open a window, move focus)? ${l.text}`, `handler|${l.text}`),
+      ),
       ...linesOf(d, /\bon(?:Focus|Blur)\s*=/).map((l) =>
         hAt(d, l.line, "handler", `focus handler — does it change context (navigate, submit, move focus)? ${l.text}`, `onfocus|${l.text}`),
       ),
@@ -1184,6 +1212,38 @@ export const PACK_SUBJECTS: Record<string, Record<string, string[]>> = {
 // about nothing when there is nothing to download. Its recall is not perfect — a document
 // served from an extensionless URL is missed — which is true of every subject here and is why
 // absence is only ever read as « nothing of that kind is in scope », never as conformance.
+//
+// `newWindow` earns its place the same way, and it is worth spelling out because the criterion
+// it closes has a single test. RGAA 13.2.1 asks one thing — « vérifier qu'à l'ouverture du
+// document, aucune nouvelle fenêtre n'est ouverte » — and a browser has exactly three ways to
+// do it: a `target` that leaves this browsing context, a `<meta http-equiv="refresh">`, and a
+// literal `window.open(`. Two are markup and the third survives minification, so a page that
+// FAILS 13.2 cannot harvest nothing. Its recall is imperfect in the same way every subject here
+// is — `open` reached through an alias is missed — which is why the absence still reads only as
+// « nothing of that kind is in scope », never as conformance.
+//
+// Measured on tests/fixtures/realworld, crawled and scanned, engine v5.25.0: 13.2 was one of
+// only two criteria still reaching the adjudicator with `evidenceComplete` and a population of
+// zero. The engine already knew the answer and was billing a model to restate it — on the run
+// this comment was written from, both were ruled NA on the first pass with no gate refusal,
+// which is the definition of a paid turn that decided nothing.
+//
+// `contextChange` is here too NOW, and it was not before — the earlier refusal was right about
+// the rule and wrong about the subject, so it is worth writing down which changed.
+//
+// It used to enumerate CONSEQUENCES: `.submit(`, `location.href`, `router.push`, a handful of
+// handler attributes. Read that way it is a heuristic, its silence is what a failing page looks
+// like, and admitting it would have bought a cheap NA at the price of a hidden non-conformity.
+// That refusal stood, and it also let a real defect stand: on tests/fixtures/realworld, 7.4
+// arrived with population ZERO from a page shipping `onSubmit={(e) => …}` — a script the harvest
+// simply did not look for.
+//
+// The subject is the SCRIPT now, not the endings: any `<script>`, any `on*` binding. RGAA 7.4
+// asks about « chaque script qui initie un changement de contexte », so a page that FAILS it runs
+// a script, and a scope with no script anywhere has nothing for the criterion to be about. That
+// is an element species, and its silence is a fact a reader can check — the same test
+// `downloadDocs` and `newWindow` pass. The heuristics stay in the harvest as POINTERS for
+// whoever reads it; they are no longer what decides whether the subject exists.
 export const EXISTENCE_SUBJECTS: ReadonlySet<string> = new Set([
   "images",
   "tables",
@@ -1194,6 +1254,8 @@ export const EXISTENCE_SUBJECTS: ReadonlySet<string> = new Set([
   "errors",
   "frames",
   "downloadDocs",
+  "newWindow",
+  "contextChange",
 ]);
 
 /** The subjects that decide a success criterion. Empty ⇒ the criterion has none declared,
@@ -1204,6 +1266,16 @@ export const subjectsForSc = (sc: string): string[] => SC_SUBJECTS[sc] ?? [];
  *  of its mapped success criteria's. The override is what stops RGAA 11.1 (are the fields
  *  labelled?) from being handed the page's heading outline because 1.3.1 happens to come
  *  first in its `wcag` list. */
+/** The subjects a pack criterion declares FOR ITSELF, as opposed to the union it inherits from
+ *  its WCAG mapping. Undefined when it declares none.
+ *
+ *  The distinction decides whether an INHERITED absence may close the criterion. RGAA 13.2 maps
+ *  onto WCAG 3.2.1, whose subject is a script; 13.2's own subject is a window opening. On a page
+ *  carrying `target="_blank"` and no script at all, 3.2.1 is legitimately « nothing of that kind
+ *  in scope » — and 13.2 inherited that closure and published a conformity over an element
+ *  nobody had looked at. Its own subject was right there in the harvest. */
+export const ownPackSubjects = (standard: string, id: string): string[] | undefined => PACK_SUBJECTS[standard]?.[id];
+
 export function subjectsForPackCriterion(standard: string, id: string, scs: string[]): string[] {
   const own = PACK_SUBJECTS[standard]?.[id];
   if (own) return own;

package/src/adjudicate.ts

@@ -799,7 +799,7 @@ export function applyAdjudication(
     if (v === null) {
       blame(it.criteriaId, `criterion ${it.criteriaId}: unadjudicated (verdict is null)`);
     } else if (v === "C" || v === "NA") {
-      if (!it.justification || !it.justification.trim()) blame(it.criteriaId, `criterion ${it.criteriaId}: a ${v} verdict requires a justification`);
+      if (!it.justification?.trim()) blame(it.criteriaId, `criterion ${it.criteriaId}: a ${v} verdict requires a justification`);
       // A clearing verdict is gated exactly like an accusing one. Before this, the only
       // check was "the justification is a non-empty string", so `"x"` cleared a criterion —
       // and a model answering C to everything published a conformance nobody had assessed.
@@ -942,7 +942,7 @@ export function applyAdjudication(
         }
         // FAIL-CLOSED: every NC finding must cite a precise, resolvable test of the active
         // standard. A good practice with no normative test is a recommendation, not an NC.
-        if (!f.normativeRef || !f.normativeRef.trim()) {
+        if (!f.normativeRef?.trim()) {
           blame(it.criteriaId, `criterion ${it.criteriaId}: an NC finding requires a normativeRef citing the failed test of the active standard`);
         } else if (!normativeRefResolves(f.normativeRef, adj.standard, isCore(adj.standard) ? undefined : it.criteriaId)) {
           blame(

package/src/audit.ts

@@ -184,7 +184,7 @@ function hasMedia(d: Doc): boolean {
     if (el.tag === "object" || el.tag === "embed") {
       const type = (el.attribs.type ?? "").toLowerCase();
       // A declared non-media type rules it out; anything else is uncertain, so it counts.
-      return !type || type.startsWith("audio/") || type.startsWith("video/") || type.startsWith("application/") ? true : false;
+      return !type || type.startsWith("audio/") || type.startsWith("video/") || type.startsWith("application/");
     }
     if (el.tag !== "iframe") return false;
     const hay = `${el.attribs.src ?? ""} ${el.attribs.title ?? ""} ${el.attribs.allow ?? ""}`;

package/src/dev.ts

@@ -356,7 +356,7 @@ function foldRecordedAdjudication(root: string, fresh: AuditResult): void {
     const target = byId.get(c.id);
     // A criterion the fresh run decided by itself is authoritative: the page moved, and a
     // stale ruling must never override a live measurement.
-    if (!target || target.status !== "manual") continue;
+    if (target?.status !== "manual") continue;
     target.status = c.status;
     target.decidedBy = "agent";
     if (c.justification) target.justification = c.justification;

package/src/glob.ts

@@ -89,7 +89,7 @@ export function makeFilter(opts: ExpandOpts = {}): (file: string) => boolean {
     if (include && !include(rel)) return false;
     if (exclude?.(rel)) return false;
     // Default test-artifact exclusion (re-admitted by an explicit --include match).
-    if (!opts.noDefaultExcludes && isTestArtifact(rel) && !(include && include(rel))) return false;
+    if (!opts.noDefaultExcludes && isTestArtifact(rel) && !include?.(rel)) return false;
     return true;
   };
 }
@@ -197,7 +197,7 @@ export function expandInputs(inputs: string[], opts: ExpandOpts = {}): string[]
     const before = list.length;
     list = list.filter((f) => {
       const rel = toPosix(f);
-      return !isTestArtifact(rel) || explicit.has(f) || (include != null && include(rel));
+      return !isTestArtifact(rel) || explicit.has(f) || include?.(rel);
     });
     const dropped = before - list.length;
     if (dropped) opts.onWarn?.(`ultra11y: skipped ${dropped} test/spec/story file(s) — pass --no-default-excludes to audit them.`);

package/src/graph/imports.ts

@@ -225,7 +225,7 @@ export function extractGraphNode(ast: AstFile | null, doc: Doc, file: string, op
   if (ast) {
     for (const stmt of asNodes((asNode(ast.program) ?? ast).body)) {
       const vd = stmt.type === "VariableDeclaration" ? stmt : stmt.type === "ExportNamedDeclaration" ? asNode(stmt.declaration) : undefined;
-      if (!vd || vd.type !== "VariableDeclaration") continue;
+      if (vd?.type !== "VariableDeclaration") continue;
       for (const d of asNodes(vd.declarations)) {
         const idn = asNode(d.id);
         const init = asNode(d.init);

package/src/integrations/cypress-plugin.ts

@@ -22,7 +22,7 @@ interface ScreenshotDetails {
   path: string;
 }
 
-// biome-ignore lint/suspicious/noExplicitAny: Cypress's `on` is not a dependency of this package
+// `any`: Cypress's `on` is not a dependency of this package.
 type On = (event: string, handler: any) => void;
 
 export interface TaskPayload extends SnapshotPayload {

package/src/integrations/cypress.ts

@@ -14,10 +14,10 @@ import { type CheckOptions, buildPayload, slugify, stayedOnPage } from "./payloa
 
 // Cypress's globals are not a dependency of this package; they exist at run time only.
 declare const Cypress: {
-  // biome-ignore lint/suspicious/noExplicitAny: Cypress's own command signature
+  // `any`: Cypress's own command signature.
   Commands: { add(name: string, fn: (...args: any[]) => any): void };
 };
-// biome-ignore lint/suspicious/noExplicitAny: same
+// `any` for the same reason.
 declare const cy: any;
 
 export interface CypressCheckOptions extends CheckOptions {

package/src/integrations/playwright.ts

@@ -88,7 +88,7 @@ function fromConfig(): { only?: string[]; limits?: Omit<ProbeTuning, "only"> } {
 async function runAxe(page: PlaywrightPage, mode: boolean | "auto" | undefined): Promise<{ ran: true; violations: unknown[] } | undefined> {
   if (mode === false) return undefined;
   const demanded = mode === true;
-  // biome-ignore lint/suspicious/noExplicitAny: the builder's shape is axe's, which is not a dependency here
+  // `any`: the builder's shape is axe's, which is not a dependency here.
   let AxeBuilder: any;
   // PROJECT FIRST, then relative to this module — the same order the Playwright fixture above
   // and `scan --runtime local` use, and for the same reason: module-relative alone works for an
@@ -204,16 +204,16 @@ export async function checkA11y(page: PlaywrightPage, opts: PlaywrightCheckOptio
  *
  *  Resolution is lazy and guarded either way, so importing this in a Cypress-only repo
  *  gives `undefined` rather than a crash. */
-// biome-ignore lint/suspicious/noExplicitAny: the shape is Playwright's, which is not a dependency here
+// `any`: the shape is Playwright's, which is not a dependency here.
 export const test: any = (() => {
-  // biome-ignore lint/suspicious/noExplicitAny: same
+  // `any` for the same reason.
   const load = (from: string): any => createRequire(from)("@playwright/test");
   for (const from of [`${process.cwd()}/package.json`, import.meta.url]) {
     try {
       const base = load(from).test;
       if (!base?.extend) continue;
       return base.extend({
-        // biome-ignore lint/suspicious/noExplicitAny: same
+        // `any` for the same reason.
         ultra11y: async ({ page }: any, use: any) => {
           await use((opts: PlaywrightCheckOptions) => checkA11y(page, opts));
         },
@@ -241,7 +241,7 @@ export interface SweepOptions {
    *  `waitForLoadState`, `waitForFunction`, locators — and Playwright is not a dependency of
    *  this package, so the narrow structural shape the collector needs would reject the very
    *  function this option exists to take. Same reasoning as `test` below. */
-  // biome-ignore lint/suspicious/noExplicitAny: the shape is Playwright's, which is not a dependency here
+  // `any`: the shape is Playwright's, which is not a dependency here.
   settle?: (page: any) => Promise<void> | void;
   /** Passed to every `checkA11y`. `failOn: false` (the default here) records without
    *  asserting: the durable output of a sweep is the snapshot, not a red test. */

package/src/mcp/handlers.ts

@@ -80,7 +80,7 @@ function bool(v: unknown): boolean {
 
 function strArray(v: unknown): string[] | undefined {
   const a = Array.isArray(v) && v.every((x) => typeof x === "string") ? (v as string[]) : undefined;
-  return a && a.length ? a : undefined;
+  return a?.length ? a : undefined;
 }
 
 function positive(v: unknown, key: string): number | undefined {

package/src/orchestrate-templates.ts

@@ -260,7 +260,10 @@ Then fold: \`ultra11y verify --apply ${join(runAbs, "VERIFY.todo.json")} --repor
 `;
 }
 
-export function agentContracts(runAbs: string, engineAbs: string, opts: { eco?: boolean } = {}): Record<string, string> {
+// `engineAbs` is deliberately NOT a parameter: the emitted workflow injects `ENGINE` as a
+// constant and the contract refers to it by name, so a second copy of the path here could only
+// ever disagree with the one the agent is actually handed.
+export function agentContracts(runAbs: string, opts: { eco?: boolean } = {}): Record<string, string> {
   const footer = ONE_WRITER_FOOTER.replaceAll("<RUN>", runAbs);
   if (opts.eco) return { adjudicator: ecoAdjudicatorContract(runAbs), refuter: ecoRefuterContract(runAbs) };
   return {

package/src/orchestrate.ts

@@ -165,7 +165,7 @@ export function orchestrateRun(runDir: string, engineAbs: string, opts: Orchestr
   // exists on the sequential path — least of all in CI, where the adjudicator has no shell and
   // writes a file. Emitting the fan-out text there and then telling an agent to obey it VERBATIM
   // is two contradictory sets of instructions, which is what a small model breaks on.
-  for (const [name, content] of Object.entries(agentContracts(run, engineAbs, { eco: opts.eco === true }))) {
+  for (const [name, content] of Object.entries(agentContracts(run, { eco: opts.eco === true }))) {
     const p = join(agentsDir, `${name}.md`);
     writeFileSync(p, content);
     written.push(p);

package/src/rules/images.ts

@@ -1,6 +1,6 @@
 // Theme 1 — Images.
 import type { Doc, El } from "../parse/html.js";
-import { attr, hasAttr, hasBoundAttr, boundAttr, hasDynamicSpread, visibleText, ancestors, descendants } from "../parse/html.js";
+import { attr, hasBoundAttr, boundAttr, hasDynamicSpread, visibleText, ancestors, descendants } from "../parse/html.js";
 import { accessibleName, isNameExempt } from "../name.js";
 import type { Rule, RuleFinding } from "./rule.js";
 

package/src/rules/tables.ts

@@ -181,7 +181,7 @@ const tableEmptyDataCell: Rule = {
 };
 
 /** The <table> a cell belongs to (nearest table ancestor), or undefined. */
-function ownerTable(el: El, doc: Doc): El | undefined {
+function ownerTable(el: El): El | undefined {
   return ancestors(el).find((a) => a.tag === "table");
 }
 
@@ -198,7 +198,7 @@ const headersAttrDangling: Rule = {
       if (el.tag !== "td" && el.tag !== "th") continue;
       const raw = (attr(el, "headers") ?? "").trim();
       if (!raw || raw.includes("{")) continue;
-      const table = ownerTable(el, doc);
+      const table = ownerTable(el);
       if (!table) continue;
       const inTable = new Map(
         descendants(table)

package/src/scan.ts

@@ -852,7 +852,7 @@ export function mergeSnapshotAudit(base: AuditResult, snap: AuditResult): AuditR
     const measured = snapById.get(c.id);
     // Only a snapshot that reached `C` WITHOUT the flag has falsified "nothing of that kind
     // here" — that one looked at the rendered page and found the subject.
-    if (!measured || measured.status !== "C" || measured.inapplicable) continue;
+    if (measured?.status !== "C" || measured.inapplicable) continue;
     c.status = "C";
     delete c.inapplicable;
     // Keep the claim citable: adopt what the measuring half said, rather than leaving a `C`

package/src/standards/derive.ts

@@ -2,7 +2,7 @@
 // presentation-only WCAG view (former src/standard.ts). For each pack criterion, gather
 // the results of the WCAG SCs it maps to and fold them with the same NC-dominates rule.
 // Presentation-only: the canonical, gated verdict lives on the WCAG core.
-import { subjectsAbsent, subjectsForPackCriterion } from "../adjudicate-subjects.js";
+import { ownPackSubjects, subjectsAbsent, subjectsForPackCriterion } from "../adjudicate-subjects.js";
 import { coverageFor, criterionMeasuredOn, unionCoverage } from "../coverage.js";
 import type { AuditResult, CriterionResult, PageCoverage, Status, Finding, Severity } from "../types.js";
 import { CORE_KEY, loadPack } from "./registry.js";
@@ -264,6 +264,16 @@ export function derivePackResults(audit: AuditResult, packKey: string, pageId?:
   // scope that read no file.
   const seen = audit.scope.subjectsSeen;
   const subjectAbsent = (pc: PackCriterion): boolean => seen !== undefined && subjectsAbsent(subjectsForPackCriterion(packKey, pc.id, pc.wcag), new Set(seen));
+  // Did the criterion's OWN subject turn up? Only its own counts: a criterion that declares none
+  // has nothing to defend against an inherited closure, and the union it borrows from its WCAG
+  // mapping is exactly where that closure came from.
+  const ownSubjectSeen = (pc: PackCriterion): boolean => {
+    if (seen === undefined) return false;
+    const own = ownPackSubjects(packKey, pc.id);
+    if (!own?.length) return false;
+    const present = new Set(seen);
+    return own.some((id) => present.has(id));
+  };
 
   // Rules the PACK ITSELF brings, by finding id. A criterion whose `appliesTo` names one of
   // these has an instrument regardless of what its WCAG mapping is worth — which is the whole
@@ -361,6 +371,28 @@ export function derivePackResults(audit: AuditResult, packKey: string, pageId?:
       return { id: pc.id, theme: pc.theme, status: INAPPLICABLE_STATUS as Status, findings, scs: pc.wcag, inapplicable: true };
     }
     const inapplicable = status === INAPPLICABLE_STATUS && (scResults.length === 0 || scResults.every((r) => r.inapplicable));
+    // AN INHERITED ABSENCE CANNOT CLOSE A CRITERION WHOSE OWN SUBJECT IS PRESENT.
+    //
+    // `inapplicable` here means every mapped success criterion came back « nothing of that kind
+    // is in scope ». That is a statement about THEIR subject, and a pack criterion frequently
+    // asks about a different one — which is the entire reason PACK_SUBJECTS exists. Publishing
+    // their absence as our conformity is the precise shape of « conforming because nobody
+    // looked », and it is worse than leaving the criterion open: in the deliverable it reads
+    // identically to a verified conformity.
+    //
+    // Measured on RGAA 13.2 (« l'ouverture d'une nouvelle fenêtre ne doit pas être déclenchée
+    // sans action de l'utilisateur »), which maps onto WCAG 3.2.1, whose subject is a script. On
+    // a page carrying `target="_blank"` and no script, 3.2.1 is honestly inapplicable — and 13.2
+    // inherited that and reported « conforme faute de sujet » over a link sitting in its own
+    // harvest. It surfaced the day `contextChange` became an existence subject, which is what
+    // made 3.2.1 closable at all; the flaw predates that and was merely unreachable.
+    //
+    // The answer is « undecided », never a conformity: our subject is here and nobody has ruled
+    // on it. NC is already excluded above, and a criterion declaring no subject of its own is
+    // untouched.
+    if (inapplicable && ownSubjectSeen(pc)) {
+      return { id: pc.id, theme: pc.theme, status: "manual" as Status, findings, scs: pc.wcag };
+    }
     return { id: pc.id, theme: pc.theme, status, findings, scs: pc.wcag, ...(inapplicable ? { inapplicable: true } : {}) };
   };
 

package/src/standards/pack-rules.ts

@@ -60,7 +60,7 @@ function matchNode(el: El, node: MatchNode, depth: number): boolean {
     const desc = descendants(el);
     if (node.has && !node.has.every((sub) => desc.some((d) => matchNode(d, sub, depth + 1)))) return false;
     // `lacks`: NO listed sub-condition may match ANY descendant.
-    if (node.lacks && node.lacks.some((sub) => desc.some((d) => matchNode(d, sub, depth + 1)))) return false;
+    if (node.lacks?.some((sub) => desc.some((d) => matchNode(d, sub, depth + 1)))) return false;
   }
   return true;
 }

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.25.0";
+export const VERSION = "5.27.0";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,