ultra11y 5.27.0 → 5.28.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.27.0",
+      "version": "5.28.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.27.0",
+  "version": "5.28.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.27.0",
+  "version": "5.28.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.27.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.28.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -371,7 +371,7 @@ a test). See [`CONTRIBUTING.md`](CONTRIBUTING.md) and `skills/ultra11y/reference
   fills an input or resizes the viewport — otherwise the snapshot would record our own
   instrumentation instead of the site.
 - **Page by page** — RGAA is a per-page norm; the engine's verdict is scope-wide. `pages`
-  bridges the two: one row per criterion, one column per page, embedded in `report` and
+  bridges the two: one row per criterion, one column per page URL, embedded in `report` and
   rebuilt from a committed `audit.json` alone. The per-page status is not recomputed — a
   per-page *view* of the audit runs through the very same projection the report uses, so grid
   and report agree by construction. Two rules hold the line: a finding is attributed to a page

package/dist/playwright.mjs

@@ -287,14 +287,17 @@ async function probeFocusVisible(page, scope = "", limits = PROBE_DEFAULTS, dead
   if (!count) return [];
   const hits = [];
   const seen = /* @__PURE__ */ new Set();
-  const limit = Math.min(count + 2, limits.maxFocusables + 10);
+  const limit = tabPressBudget(count, limits);
+  let prevKey = null;
   for (let i = 0; i < limit; i++) {
     if (deadline?.out()) break;
     await page.keyboard.press("Tab");
     const r = await page.evaluate(FOCUS_CHECK_PROBE);
     if (!r) continue;
+    if (r.key === prevKey) continue;
     if (seen.has(r.key)) break;
     seen.add(r.key);
+    prevKey = r.key;
     if (!r.changed) {
       hits.push({
         selector: r.selector,
@@ -306,11 +309,23 @@ async function probeFocusVisible(page, scope = "", limits = PROBE_DEFAULTS, dead
   }
   return hits;
 }
+var NATIVE_SEGMENT_STOPS = {
+  date: 5,
+  time: 5,
+  "datetime-local": 8,
+  month: 4,
+  week: 4
+};
+function tabPressBudget(count, limits) {
+  return Math.min(count * 2 + 20, limits.maxFocusables * 2 + 20);
+}
 var FOCUS_WHERE_PROBE = `(() => { ${PRELUDE}
   const e = document.activeElement;
   if (!e || e === document.body || e === document.documentElement) return null;
   const key = e.getAttribute && e.getAttribute('data-u11y-f');
-  return { key: key || __sel(e), tagged: !!key, selector: __sel(e), html: __html(e) };
+  const stops = ${JSON.stringify(NATIVE_SEGMENT_STOPS)};
+  const type = e.tagName === 'INPUT' ? (e.getAttribute('type') || 'text').toLowerCase() : '';
+  return { key: key || __sel(e), tagged: !!key, selector: __sel(e), html: __html(e), segments: stops[type] || 1 };
 })()`;
 async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
   const count = await page.evaluate(focusSetupExpr("", limits.maxFocusables));
@@ -318,7 +333,7 @@ async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
   const hits = [];
   const seen = /* @__PURE__ */ new Set();
   const confirmPresses = 2;
-  const limit = Math.min(count + 2, limits.maxFocusables + 10);
+  const limit = tabPressBudget(count, limits);
   let prev = null;
   for (let i = 0; i < limit; i++) {
     if (deadline?.out()) break;
@@ -326,8 +341,9 @@ async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
     const now = await page.evaluate(FOCUS_WHERE_PROBE);
     if (!now) break;
     if (prev?.tagged && now.tagged && now.key === prev.key) {
+      const budget = Math.max(confirmPresses, (now.segments ?? 1) - 1);
       let stuck = true;
-      for (let k = 0; k < confirmPresses && stuck; k++) {
+      for (let k = 0; k < budget && stuck; k++) {
         if (deadline?.out()) break;
         await page.keyboard.press("Tab");
         const again = await page.evaluate(FOCUS_WHERE_PROBE);
@@ -337,13 +353,15 @@ async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
         hits.push({
           selector: now.selector,
           html: now.html,
-          detail: `Le focus reste sur cet \xE9l\xE9ment apr\xE8s ${1 + confirmPresses} appuis sur Tab, alors que la page compte ${count} \xE9l\xE9ments focalisables \u2014 pi\xE8ge au clavier (2.1.2).`
+          detail: `Le focus reste sur cet \xE9l\xE9ment apr\xE8s ${1 + budget} appuis sur Tab, alors que la page compte ${count} \xE9l\xE9ments focalisables \u2014 pi\xE8ge au clavier (2.1.2).`
         });
         break;
       }
     }
-    if (seen.has(now.key)) break;
-    seen.add(now.key);
+    if (now.key !== prev?.key) {
+      if (seen.has(now.key)) break;
+      seen.add(now.key);
+    }
     prev = now;
   }
   return hits;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.27.0",
+  "version": "5.28.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/build-pack-rgaa.mjs

@@ -251,9 +251,16 @@ const RULE_TO_CRITERIA = {
   "error-not-associated": ["11.10"], "aria-invalid-no-description": ["11.10"],
   "axe:label": ["11.1"], "axe:form-field-multiple-labels": ["11.1"], "axe:select-name": ["11.1"], "axe:label-title-only": ["11.1"],
   "axe:autocomplete-valid": ["11.13"], "axe:fieldset": ["11.6"], "axe:input-button-name": ["11.9"], "axe:button-name": ["11.9"],
-  // Theme 12 — navigation (12.7 skip link, 12.8 tab order)
+  // Theme 12 — navigation (12.7 skip link, 12.8 tab order, 12.9 keyboard trap)
   "skip-link-target-missing": ["12.7"], "axe:skip-link": ["12.7"], "axe:bypass": ["12.7"],
   "positive-tabindex": ["12.8"], "axe:tabindex": ["12.8"],
+  // 12.9 « la navigation ne doit pas contenir de piège au clavier ». The probe that answers it
+  // has existed since `probeKeyboardTrap` landed, and it was mapped to WCAG 2.1.2 alone — so a
+  // trap the browser had just walked into raised a blocking WCAG non-conformity and left RGAA
+  // 12.9 « à évaluer », to be bought from a paid adjudicator on every run. The evidence was
+  // measured and then never delivered to the criterion it answers. No axe rule joins it: axe
+  // has none for keyboard traps, which is why the probe was written in the first place.
+  "dyn-keyboard-trap": ["12.9"],
   // Theme 13 — consultation (13.1 time limits, 13.8 moving/blinking)
   "meta-refresh-redirect": ["13.1"], "blink-marquee": ["13.8"], "autoplay-media": ["4.10", "13.8"],
   "axe:no-autoplay-audio": ["4.10"], "axe:blink": ["13.8"], "axe:marquee": ["13.8"],

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join51, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.27.0";
+var VERSION = "5.28.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -43052,7 +43052,7 @@ var rgaa_default = {
       techniques: ["G21", "H91", "F10"],
       wcag: ["2.1.1", "2.1.2"],
       appliesTo: {
-        ruleIds: []
+        ruleIds: ["dyn-keyboard-trap"]
       }
     },
     {
@@ -44949,6 +44949,32 @@ var SUBJECTS = {
     )
   ]),
   // The document's own language declaration.
+  // THE LANGUAGE CODE THAT IS ACTUALLY THERE — RGAA 8.4's own subject, and NOT `docLang`.
+  //
+  // 8.3 and 8.4 read the same element and ask opposite questions. 8.3 (« la page a-t-elle une
+  // langue par défaut ? ») is about the `<html>` element, and its subject must be present even
+  // when the attribute is missing — that absence IS its non-conformity. 8.4 (« POUR CHAQUE PAGE
+  // AYANT UNE LANGUE PAR DÉFAUT, le code est-il pertinent ? ») is about the code, and on a page
+  // that declares none the criterion has, in the referential's own words, nothing to be about.
+  //
+  // Sharing `docLang` made 8.4 unclosable exactly there: the subject was seen (the `<html>`
+  // element is always seen), so absence could never be concluded, and 8.4 is `judgment: true`
+  // so silence never earned it a `C` either. Measured on tests/fixtures/realworld: one page
+  // declares no language — that is its seeded 8.3 defect — and 8.4 stayed « à évaluer » on it
+  // for ever, on every run, with nothing any adjudicator could read.
+  //
+  // Same correction as 13.2 and 7.4 further down: the refusal was right about the rule and
+  // wrong about the SUBJECT.
+  declaredLang: (docs) => docs.flatMap(
+    (d) => elementsByTag(d, "html").filter((e) => (attr(e, "lang") ?? attr(e, "xml:lang") ?? "").trim() !== "").map(
+      (e) => h(
+        d,
+        e,
+        `<html lang="${attr(e, "lang") ?? attr(e, "xml:lang")}"> \u2014 is this code the language the content is actually written in?`,
+        `declaredlang|${attr(e, "lang") ?? attr(e, "xml:lang")}`
+      )
+    )
+  ),
   docLang: (docs) => docs.flatMap(
     (d) => elementsByTag(d, "html").map(
       (e) => h(d, e, `<html lang="${attr(e, "lang") ?? ""}"> \u2014 is it present, valid, and the language of the content?`, `doclang|${attr(e, "lang") ?? ""}`)
@@ -45370,7 +45396,8 @@ var PACK_SUBJECTS = {
     // is the ONLY place its subject can be named.
     "8.1": ["doctype"],
     "8.3": ["docLang"],
-    "8.4": ["docLang"],
+    // 8.4 asks about the CODE, 8.3 about the element — see `declaredLang`.
+    "8.4": ["declaredLang"],
     "8.5": ["docTitle"],
     "8.6": ["docTitle"],
     "8.7": ["langParts"],
@@ -45466,7 +45493,10 @@ var EXISTENCE_SUBJECTS = /* @__PURE__ */ new Set([
   "frames",
   "downloadDocs",
   "newWindow",
-  "contextChange"
+  "contextChange",
+  // A page that declares no default language has no language code for 8.4 to be about. The
+  // `<html>` element is always there; the attribute is what this subject looks for.
+  "declaredLang"
 ]);
 var subjectsForSc = (sc) => SC_SUBJECTS[sc] ?? [];
 var ownPackSubjects = (standard, id) => PACK_SUBJECTS[standard]?.[id];
@@ -49513,7 +49543,8 @@ function newAccum() {
     renderedRan: /* @__PURE__ */ new Map(),
     probedScs: /* @__PURE__ */ new Map(),
     axeRan: /* @__PURE__ */ new Set(),
-    subjectsSeen: /* @__PURE__ */ new Set()
+    subjectsSeen: /* @__PURE__ */ new Set(),
+    pageSubjects: /* @__PURE__ */ new Map()
   };
 }
 function primarySubtag(lang) {
@@ -49554,6 +49585,9 @@ function foldDoc(acc, doc, graph) {
   const pageId = snapshotPageId(doc.file);
   if (pageId) {
     acc.pageIds.add(pageId);
+    const own = acc.pageSubjects.get(pageId) ?? /* @__PURE__ */ new Set();
+    for (const id of subjectsPresentIn(doc, own)) own.add(id);
+    acc.pageSubjects.set(pageId, own);
     for (const ruleId of renderedRulesRan(doc.signals)) {
       const seen = acc.renderedRan.get(ruleId) ?? /* @__PURE__ */ new Set();
       seen.add(pageId);
@@ -49817,6 +49851,9 @@ function finalize(acc, inputs, extra = {}) {
       // nothing, `undefined` says this audit predates the fold. A pack derivation must be
       // able to tell those apart before concluding NA from silence.
       ...acc.fileCount > 0 ? { subjectsSeen: [...acc.subjectsSeen].sort() } : {},
+      // Per page, and omitted when no page was read — same rule as above: absent means "this
+      // audit predates the fold", never "nothing was found".
+      ...acc.pageSubjects.size ? { pageSubjects: Object.fromEntries([...acc.pageSubjects].map(([id, set]) => [id, [...set].sort()])) } : {},
       // The pages this run genuinely read. Written UNCONDITIONALLY — `[]` is the whole point,
       // because "this audit read no page" is exactly the claim a source-only run needs to make,
       // and an omit-when-empty field would say nothing precisely then. See scope.pagesAudited.
@@ -54470,6 +54507,9 @@ function derivePackResults(audit2, packKey, pageId) {
     if (normativeFindings.length) {
       return { id: pc.id, theme: pc.theme, status: "NC", findings, scs: pc.wcag };
     }
+    if (subjectAbsent(pc)) {
+      return { id: pc.id, theme: pc.theme, status: INAPPLICABLE_STATUS, findings, scs: pc.wcag, inapplicable: true };
+    }
     if (scResults.some((r) => r.status === "NC")) {
       return { id: pc.id, theme: pc.theme, status: "manual", findings, scs: pc.wcag, scopedOut: true };
     }
@@ -55537,7 +55577,8 @@ var L3 = {
     source: "source",
     notAudited: "non audit\xE9",
     notAuditedNote: "Une page marqu\xE9e \xAB non audit\xE9 \xBB a bien un instantan\xE9, mais CET audit ne l'a pas lu (il ne portait que sur les sources). L'absence de constat n'y vaut donc PAS conformit\xE9 \u2014 relancez l'audit en incluant `.ultra11y/pages`.",
-    agentMark: "`C*` : conformit\xE9 tranch\xE9e par l'agent IA \xE0 partir des \xE9vidences cit\xE9es (gat\xE9), et non prouv\xE9e par le moteur d\xE9terministe."
+    agentMark: "`C*` : conformit\xE9 tranch\xE9e par l'agent IA \xE0 partir des \xE9vidences cit\xE9es (gat\xE9), et non prouv\xE9e par le moteur d\xE9terministe.",
+    originNote: (o) => `Les colonnes sont les URL des pages, relatives \xE0 \`${o}\`.`
   },
   en: {
     title: "Per-page grid",
@@ -55552,7 +55593,8 @@ var L3 = {
     source: "source",
     notAudited: "not audited",
     notAuditedNote: 'A page marked "not audited" does have a snapshot, but THIS audit never read it (it covered sources only). Absence of a finding there does NOT mean conforming \u2014 re-run the audit with `.ultra11y/pages` in scope.',
-    agentMark: "`C*`: conformity ruled by the AI agent from the evidence it cited (gated), not proven by the deterministic engine."
+    agentMark: "`C*`: conformity ruled by the AI agent from the evidence it cited (gated), not proven by the deterministic engine.",
+    originNote: (o) => `Columns are the pages' URLs, relative to \`${o}\`.`
   }
 };
 function formatRate(rate, decided, total) {
@@ -55572,9 +55614,37 @@ function basisLabel(basis, lang) {
 function unattributedNote(n, lang) {
   return L3[lang].unattributed(n);
 }
+function pageColumnLabel(page, origin) {
+  let label = page.url;
+  if (origin && page.url.startsWith(origin)) {
+    const rest = page.url.slice(origin.length);
+    label = rest === "" ? "/" : rest;
+  }
+  return `${label}${page.auth ? " \u{1F512}" : ""}`;
+}
+function commonOrigin(pages) {
+  if (!pages.length) return void 0;
+  let origin;
+  for (const p of pages) {
+    let o;
+    try {
+      o = new URL(p.url).origin;
+    } catch {
+      return void 0;
+    }
+    if (origin === void 0) origin = o;
+    else if (origin !== o) return void 0;
+  }
+  return origin;
+}
+function pageOriginNote(origin, lang) {
+  return origin ? L3[lang].originNote(origin) : void 0;
+}
 function pageView(result, page) {
+  const own = result.scope.pageSubjects?.[page.id];
   return {
     ...result,
+    ...own ? { scope: { ...result.scope, subjectsSeen: own } } : {},
     criteria: page.criteria,
     findings: page.findings,
     ...result.packFindings ? { packFindings: result.packFindings.filter((f) => f.page === page.id) } : {}
@@ -55606,7 +55676,7 @@ function renderRedirected(redirected, lang = "en") {
     "| --- | --- | --- | --- |"
   ];
   for (const r of redirected) {
-    const why = r.reason === "http-status" ? fr ? `HTTP ${r.status ?? "\u2265 400"} \u2014 page d'erreur rendue \xE0 la m\xEAme adresse` : `HTTP ${r.status ?? "\u2265 400"} \u2014 error page served at the same address` : fr ? "redirection" : "redirect";
+    const why = r.reason === "http-status" ? fr ? `HTTP ${r.status ?? "\u2265 400"} \u2014 page d'erreur rendue \xE0 la m\xEAme adresse` : `HTTP ${r.status ?? "\u2265 400"} \u2014 error page served at the same address` : r.reason === "error" ? fr ? `le navigateur a \xE9chou\xE9 sur cette page${r.detail ? ` \u2014 ${r.detail}` : ""}` : `the browser failed on this page${r.detail ? ` \u2014 ${r.detail}` : ""}` : fr ? "redirection" : "redirect";
     out2.push(`| ${r.name} (\`${r.id}\`) | \`${r.requested}\` | \`${r.landed}\` | ${why} |`);
   }
   return out2;
@@ -55633,7 +55703,10 @@ function renderPageGrid(result, pages, standard = CORE2, lang = "en") {
   }
   out2.push(`> ${s.note}`, "");
   if (derived.some((p) => p.basis === "attributed")) out2.push(`> \u26A0\uFE0F ${s.basisNote}`, "");
-  const head = [isCore(standard) ? s.criterion : s.criterion, ...derived.map((p) => `${p.name}${p.auth ? " \u{1F512}" : ""}`)];
+  const origin = commonOrigin(derived);
+  const originNote = pageOriginNote(origin, lang);
+  if (originNote) out2.push(`> ${originNote}`, "");
+  const head = [s.criterion, ...derived.map((p) => pageColumnLabel(p, origin))];
   out2.push(`| ${head.join(" | ")} |`, `| ${head.map(() => "---").join(" | ")} |`);
   const { rows, status } = pageGridModel(result, derived, standard, lang);
   out2.push(`| **${s.rate}** | ${derived.map((p) => `**${formatRate(...gridRate(rows, status, p.id))}**`).join(" | ")} |`);
@@ -56202,7 +56275,7 @@ function render(r, lang, opts) {
     for (const pg of derived) {
       const nc = pg.findings.filter((f) => !f.advisory);
       const adv = pg.findings.filter((f) => f.advisory);
-      out2.push(`### ${pg.name} \u2014 \`${pg.url}\` \u2014 ${pg.auth ? s.authYes : s.authNo}`, "");
+      out2.push("<details>", `<summary>${pg.name} \u2014 <code>${pg.url}</code> \u2014 ${pg.auth ? s.authYes : s.authNo}</summary>`, "");
       out2.push(`- ${nc.length} ${s.ncCount}${adv.length ? ` \xB7 ${adv.length} ${s.advCount}` : ""}`);
       const notes = pageScope.find((x) => x.id === pg.id)?.notes;
       if (notes) out2.push(`- _${notes}_`);
@@ -56225,7 +56298,7 @@ function render(r, lang, opts) {
         out2.push(`  - [${label}] \`${f.selectorHint}\` \u2014 ${mdText(resolveMessage(f, lang))}`);
       }
       if (nc.length > PER_PAGE_MAX) out2.push(`  - _${s.perPageMore(nc.length - PER_PAGE_MAX, nc.length)}_`);
-      out2.push("");
+      out2.push("", "</details>", "");
     }
   }
   out2.push(`## ${s.cTitle}`, "");
@@ -60153,6 +60226,15 @@ function parseSitemapUrls(xml) {
   while ((m = re.exec(xml)) !== null) out2.push(m[1]);
   return out2;
 }
+var DOWNLOAD_EXT = /\.(?:pdf|docx?|pptx?|xlsx?|odt|ods|odp|rtf|csv|zip|rar|7z|gz|tar|epub|dmg|exe|pkg|mp3|mp4|m4a|m4v|avi|mov|wmv|webm|ogg|wav|png|jpe?g|gif|svg|webp|avif|ico|woff2?|ttf|otf)$/i;
+function isDownloadUrl(url) {
+  let path = url;
+  try {
+    path = new URL(url).pathname;
+  } catch {
+  }
+  return DOWNLOAD_EXT.test(path);
+}
 function extractLinks(html, baseUrl) {
   const origin = new URL(baseUrl).origin;
   const seen = /* @__PURE__ */ new Set();
@@ -60170,6 +60252,7 @@ function extractLinks(html, baseUrl) {
     }
     if (abs.protocol !== "http:" && abs.protocol !== "https:") continue;
     if (abs.origin !== origin) continue;
+    if (isDownloadUrl(abs.pathname)) continue;
     abs.hash = "";
     const url = abs.href;
     if (seen.has(url)) continue;
@@ -60519,10 +60602,11 @@ function writeRunnerSnapshot(root, out2, target, page) {
   if (!collected?.dom) return void 0;
   const url = page?.url ?? hostPageOf(out2.url ?? collected.url, target);
   const id = page?.id ?? pageIdFor(url);
+  const name2 = page?.name?.trim() || collected.title?.trim() || nameFromUrl(url);
   const meta2 = {
     v: SNAPSHOT_VERSION,
     id,
-    name: page?.name ?? collected.title ?? id,
+    name: name2,
     url,
     runner: "scan",
     ...collected.viewport ? { viewport: collected.viewport } : {},
@@ -61083,14 +61167,17 @@ async function probeFocusVisible(page, scope = "", limits = PROBE_DEFAULTS, dead
   if (!count) return [];
   const hits = [];
   const seen = /* @__PURE__ */ new Set();
-  const limit = Math.min(count + 2, limits.maxFocusables + 10);
+  const limit = tabPressBudget(count, limits);
+  let prevKey = null;
   for (let i2 = 0; i2 < limit; i2++) {
     if (deadline?.out()) break;
     await page.keyboard.press("Tab");
     const r = await page.evaluate(FOCUS_CHECK_PROBE);
     if (!r) continue;
+    if (r.key === prevKey) continue;
     if (seen.has(r.key)) break;
     seen.add(r.key);
+    prevKey = r.key;
     if (!r.changed) {
       hits.push({
         selector: r.selector,
@@ -61102,11 +61189,23 @@ async function probeFocusVisible(page, scope = "", limits = PROBE_DEFAULTS, dead
   }
   return hits;
 }
+var NATIVE_SEGMENT_STOPS = {
+  date: 5,
+  time: 5,
+  "datetime-local": 8,
+  month: 4,
+  week: 4
+};
+function tabPressBudget(count, limits) {
+  return Math.min(count * 2 + 20, limits.maxFocusables * 2 + 20);
+}
 var FOCUS_WHERE_PROBE = `(() => { ${PRELUDE}
   const e = document.activeElement;
   if (!e || e === document.body || e === document.documentElement) return null;
   const key = e.getAttribute && e.getAttribute('data-u11y-f');
-  return { key: key || __sel(e), tagged: !!key, selector: __sel(e), html: __html(e) };
+  const stops = ${JSON.stringify(NATIVE_SEGMENT_STOPS)};
+  const type = e.tagName === 'INPUT' ? (e.getAttribute('type') || 'text').toLowerCase() : '';
+  return { key: key || __sel(e), tagged: !!key, selector: __sel(e), html: __html(e), segments: stops[type] || 1 };
 })()`;
 async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
   const count = await page.evaluate(focusSetupExpr("", limits.maxFocusables));
@@ -61114,7 +61213,7 @@ async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
   const hits = [];
   const seen = /* @__PURE__ */ new Set();
   const confirmPresses = 2;
-  const limit = Math.min(count + 2, limits.maxFocusables + 10);
+  const limit = tabPressBudget(count, limits);
   let prev = null;
   for (let i2 = 0; i2 < limit; i2++) {
     if (deadline?.out()) break;
@@ -61122,8 +61221,9 @@ async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
     const now = await page.evaluate(FOCUS_WHERE_PROBE);
     if (!now) break;
     if (prev?.tagged && now.tagged && now.key === prev.key) {
+      const budget = Math.max(confirmPresses, (now.segments ?? 1) - 1);
       let stuck = true;
-      for (let k = 0; k < confirmPresses && stuck; k++) {
+      for (let k = 0; k < budget && stuck; k++) {
         if (deadline?.out()) break;
         await page.keyboard.press("Tab");
         const again = await page.evaluate(FOCUS_WHERE_PROBE);
@@ -61133,13 +61233,15 @@ async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
         hits.push({
           selector: now.selector,
           html: now.html,
-          detail: `Le focus reste sur cet \xE9l\xE9ment apr\xE8s ${1 + confirmPresses} appuis sur Tab, alors que la page compte ${count} \xE9l\xE9ments focalisables \u2014 pi\xE8ge au clavier (2.1.2).`
+          detail: `Le focus reste sur cet \xE9l\xE9ment apr\xE8s ${1 + budget} appuis sur Tab, alors que la page compte ${count} \xE9l\xE9ments focalisables \u2014 pi\xE8ge au clavier (2.1.2).`
         });
         break;
       }
     }
-    if (seen.has(now.key)) break;
-    seen.add(now.key);
+    if (now.key !== prev?.key) {
+      if (seen.has(now.key)) break;
+      seen.add(now.key);
+    }
     prev = now;
   }
   return hits;
@@ -61666,13 +61768,26 @@ async function runScanManyLocal(urls, opts) {
   const redirected = [];
   try {
     for (const url of urls) {
-      const out2 = await runOnPage(browser, AxeBuilder, url, false, {
-        storageState: opts.storageState,
-        interact,
-        allowClicks: clicksAllowed(opts.storageState, opts.interactClicks),
-        lang,
-        snapshot: Boolean(opts.snapshotRoot)
-      });
+      let out2;
+      try {
+        out2 = await runOnPage(browser, AxeBuilder, url, false, {
+          storageState: opts.storageState,
+          interact,
+          allowClicks: clicksAllowed(opts.storageState, opts.interactClicks),
+          lang,
+          snapshot: Boolean(opts.snapshotRoot)
+        });
+      } catch (e) {
+        redirected.push({
+          id: slugifyPageId(url),
+          name: url,
+          requested: url,
+          landed: url,
+          reason: "error",
+          detail: String(e?.message ?? e).slice(0, 200)
+        });
+        continue;
+      }
       if (out2.httpStatus !== void 0 && out2.httpStatus >= 400) {
         redirected.push({
           id: slugifyPageId(url),
@@ -61714,13 +61829,26 @@ async function runSampleScanLocal(pages, opts) {
     for (const page of pages) {
       const storageState = page.storageState ?? opts.storageState;
       const isFile = !/^https?:\/\//i.test(page.url);
-      const out2 = await runOnPage(browser, AxeBuilder, page.url, isFile, {
-        storageState,
-        interact,
-        allowClicks: clicksAllowed(storageState, opts.interactClicks),
-        lang,
-        snapshot: Boolean(opts.snapshotRoot)
-      });
+      let out2;
+      try {
+        out2 = await runOnPage(browser, AxeBuilder, page.url, isFile, {
+          storageState,
+          interact,
+          allowClicks: clicksAllowed(storageState, opts.interactClicks),
+          lang,
+          snapshot: Boolean(opts.snapshotRoot)
+        });
+      } catch (e) {
+        redirected.push({
+          id: page.id,
+          name: page.name,
+          requested: page.url,
+          landed: page.url,
+          reason: "error",
+          detail: String(e?.message ?? e).slice(0, 200)
+        });
+        continue;
+      }
       const requestedUrl = isFile ? "file://" + resolve12(page.url) : page.url;
       const landedUrl = out2.landedUrl ?? out2.url;
       if (!landedOnRequestedPage(requestedUrl, landedUrl)) {
@@ -63443,6 +63571,8 @@ function perPageTable(result, standard = CORE2, lang = "en") {
     ...scoreboardTable(result, derived, standard, s, lang),
     "",
     ...basisCaveats(result, derived, s, lang),
+    ...fullGridBlock(result, derived, standard, s, lang),
+    "",
     ...derived.flatMap((pg) => [...namedCriteriaBlock(result, pg, standard, s, lang), ""])
   ].join("\n");
 }
@@ -63568,7 +63698,9 @@ function fullGridBlock(result, derived, standard, s, lang) {
   const { rows, status } = pageGridModel(result, derived, standard, lang);
   if (!rows.length || !derived.length) return [];
   const cell = (v) => v.replace(/\|/g, "\\|");
-  const head = [s.criterion, ...derived.map((p) => `${cell(p.name)}${p.auth ? " \u{1F512}" : ""}`)];
+  const origin = commonOrigin(derived);
+  const originNote = pageOriginNote(origin, lang);
+  const head = [s.criterion, ...derived.map((p) => cell(pageColumnLabel(p, origin)))];
   const out2 = [
     "<details>",
     `<summary><b>${s.fullGrid}</b> \u2014 ${rows.length} \xD7 ${derived.length}</summary>`,
@@ -63576,6 +63708,7 @@ function fullGridBlock(result, derived, standard, s, lang) {
     "",
     `> ${s.gridLegend}`,
     "",
+    ...originNote ? [`> ${originNote}`, ""] : [],
     `| ${head.join(" | ")} |`,
     `| ${head.map(() => "---").join(" | ")} |`
   ];
@@ -64394,10 +64527,12 @@ function crossGridBlocks(result, derived, standard, lang) {
   if (!derived.length) return [];
   const { rows, status } = pageGridModel(result, derived, standard, lang);
   if (!rows.length) return [];
+  const origin = commonOrigin(derived);
+  const originNote = pageOriginNote(origin, lang);
   const table = {
     kind: "table",
     caption: t3.crossGridCaption,
-    columns: [{ text: t3.criterion }, ...derived.map((p) => ({ text: `${p.name}${p.auth ? " \u{1F512}" : ""}` }))],
+    columns: [{ text: t3.criterion }, ...derived.map((p) => ({ text: pageColumnLabel(p, origin) }))],
     rows: []
   };
   let group = "";
@@ -64408,7 +64543,12 @@ function crossGridBlocks(result, derived, standard, lang) {
     }
     table.rows.push([{ text: row.label }, ...derived.map((p) => ({ status: status.get(row.id)?.get(p.id) ?? "manual", text: "" }))]);
   }
-  return [{ kind: "heading", level: 2, text: t3.grid, id: "grid" }, { kind: "note", tone: "info", runs: ticks(t3.legend) }, table];
+  return [
+    { kind: "heading", level: 2, text: t3.grid, id: "grid" },
+    { kind: "note", tone: "info", runs: ticks(t3.legend) },
+    ...originNote ? [{ kind: "note", tone: "info", runs: ticks(originNote) }] : [],
+    table
+  ];
 }
 function pageGridBlocks(result, page, standard, lang) {
   const t3 = T4[lang];
@@ -68164,7 +68304,7 @@ Commands:
              SKIP_A11Y=1. Called by hooks/pre-tool-use.mjs, not by hand.
   pages      The per-page criterion grid \u2014 RGAA is a per-page norm, the engine's
              verdict is scope-wide, and this bridges the two. One row per criterion
-             (the pack's own under --standard), one column per page. Rebuilt from a
+             (the pack's own under --standard), one column per page URL. Rebuilt from a
              committed audit.json alone: no snapshots on disk, no browser.
              Two honesty rules: a finding is attributed to a page only when something
              SAYS so (the snapshot it was raised on, the scanned URL, the sample page
@@ -70602,7 +70742,12 @@ async function cmdScan(p) {
   }
   if (dynamic.redirected?.length) {
     for (const r of dynamic.redirected) {
-      const why = r.reason === "http-status" ? lang === "fr" ? `a r\xE9pondu HTTP ${r.status} \xE0 la m\xEAme adresse` : `answered HTTP ${r.status} at the same address` : lang === "fr" ? `a redirig\xE9 vers ${r.landed}` : `redirected to ${r.landed}`;
+      const why = r.reason === "http-status" ? lang === "fr" ? `a r\xE9pondu HTTP ${r.status} \xE0 la m\xEAme adresse` : `answered HTTP ${r.status} at the same address` : r.reason === "error" ? (
+        // Named rather than folded into the redirect wording: « a redirigé vers » its own
+        // address is a sentence that explains nothing, and the browser's message is the
+        // one fact that says which page to go and look at.
+        lang === "fr" ? `a fait \xE9chouer le navigateur${r.detail ? ` \u2014 ${r.detail}` : ""}` : `made the browser fail${r.detail ? ` \u2014 ${r.detail}` : ""}`
+      ) : lang === "fr" ? `a redirig\xE9 vers ${r.landed}` : `redirected to ${r.landed}`;
       console.error(
         lang === "fr" ? `\u26A0\uFE0F ultra11y scan : \xAB ${r.name} \xBB (${r.id}) non enregistr\xE9e \u2014 ${r.requested} ${why}. L'enregistrer aurait d\xE9crit cet \xE9cran sous le nom demand\xE9.` : `\u26A0\uFE0F ultra11y scan: "${r.name}" (${r.id}) not recorded \u2014 ${r.requested} ${why}. Recording it would have described that screen under the requested name.`
       );

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.27.0
+  version: 5.28.0
 ---
 
 # review-a11y — accessibility review of changed code