ultra11y 5.3.3 → 5.4.0

package/src/audit.ts

@@ -12,6 +12,7 @@ import { attachSignals, isSnapshotDom, snapshotPageId } from "./snapshot.js";
 import { attr, elementsByTag, type Doc, type CaptureProvenance } from "./parse/html.js";
 import { CAPTURES_DIR, computeCaptureCoverage, enrichCaptureOrigins, isUnderDir, readCaptureDir, capturesForSources } from "./capture.js";
 import { isFullDocument } from "./rules/rule.js";
+import { renderedTestedScs } from "./rules/rendered.js";
 import { runRules } from "./rules/registry.js";
 import { runCrossRules } from "./rules/cross-registry.js";
 import { listPacks } from "./standards/registry.js";
@@ -64,12 +65,141 @@ const APPLICABLE: Record<string, (d: Doc) => boolean> = {
   "3.1.1": (d) => isFullDocument(d), // Language of Page — html-lang-missing / lang-invalid
 };
 
-function residualReason(automatability: string): string {
+// ---- SUBJECT MATTER: what makes a NON-static criterion applicable at all -----------------
+//
+// A judgment or rendering criterion used to have exactly two outcomes: `NC` when a rule fired,
+// `manual` otherwise. So a repository containing no audio and no video still reported all five
+// time-based-media criteria as « to assess » — and under RGAA, whose theme 4 projects from
+// them, that is 13 criteria a reader has to work through to discover there was never anything
+// to look at. Measured on a real 300-file audit: 96 of 106 criteria « to assess », whole themes
+// among them applicable to nothing in scope.
+//
+// « Not applicable » is a real, normative verdict, and the engine can prove it for a criterion
+// whose SUBJECT MATTER is a thing you can look for in the source. So: no media element in the
+// whole scope ⇒ the media criteria are NA, with a justification naming the observation.
+//
+// Three rules keep this honest, because a wrong NA is far worse than an honest « to assess » —
+// it is a non-conformity hidden inside a report someone signs:
+//
+//   1. OVER-INCLUSION IS THE SAFE DIRECTION. A predicate answers "could this criterion
+//      possibly apply here?", so it must say YES on anything ambiguous. `<object>`/`<embed>`/
+//      `<iframe>` are usually not media, and they are all listed anyway: their presence merely
+//      keeps a criterion open, which costs nothing but a line in the worklist.
+//   2. APPLICABILITY IS OR-FOLDED ACROSS THE WHOLE SCOPE (see `foldDoc`). One document with a
+//      `<video>` keeps the media criteria open for the entire audit. NA means "nothing,
+//      anywhere in what was audited" — never "nothing in this file".
+//   3. THE VERDICT IS SCOPE-BOUND AND SAYS SO. The justification states what was searched and
+//      not found, so it is falsifiable by a reader. A scope that cannot see rendered output
+//      (an opaque component library) is already flagged on the audit itself, and `check`'s
+//      unjustified-NA gate still applies.
+const SUBJECT_MATTER: Record<string, (d: Doc) => boolean> = {
+  // ---- Time-based media (WCAG 1.2.x → RGAA theme 4) ----
+  // Captions, transcripts, audio description and sign language all presuppose a media element.
+  // `track` counts on its own: a stray <track> means media is being assembled somewhere.
+  "1.2.1": hasMedia,
+  "1.2.2": hasMedia,
+  "1.2.3": hasMedia,
+  "1.2.4": hasMedia,
+  "1.2.5": hasMedia,
+  // ---- Motion actuation (WCAG 2.5.4) ----
+  // Applicable only where device motion drives the interface, which is a source-visible API.
+  "2.5.4": hasMotionApi,
+  // ---- Forms (WCAG 3.3.x) ----
+  // Error identification, labels and instructions, error suggestion, error prevention,
+  // redundant entry and accessible authentication all presuppose user input. 3.3.4 and 3.3.8
+  // are narrower still (legal/financial transactions, authentication), so "any form control"
+  // is the deliberately over-inclusive predicate for them.
+  "3.3.1": hasFormControl,
+  "3.3.2": hasFormControl,
+  "3.3.3": hasFormControl,
+  "3.3.4": hasFormControl,
+  "3.3.7": hasFormControl,
+  "3.3.8": hasFormControl,
+  // Identify Input Purpose — about autocomplete on fields collecting user data.
+  "1.3.5": hasFormControl,
+};
+
+/** Media, and everything that could be carrying media. Over-inclusive on purpose (rule 1). */
+function hasMedia(d: Doc): boolean {
+  return has(d, "audio", "video", "track", "source", "object", "embed", "iframe", "marquee", "canvas");
+}
+
+/** Device-motion input: the only thing WCAG 2.5.4 is about. */
+function hasMotionApi(d: Doc): boolean {
+  return /\b(?:devicemotion|deviceorientation|DeviceMotionEvent|DeviceOrientationEvent|Accelerometer|Gyroscope|requestPermission)\b/i.test(d.source);
+}
+
+/** Any control that takes user input, native or delegated. Over-inclusive on purpose. */
+function hasFormControl(d: Doc): boolean {
+  if (has(d, "input", "select", "textarea", "form", "fieldset", "output", "datalist")) return true;
+  // A custom widget standing in for a field, and a submit control that implies one.
+  return d.elements.some((e) => {
+    const role = (e.attribs.role ?? "").toLowerCase();
+    if (role && /^(textbox|combobox|listbox|checkbox|radio|radiogroup|slider|spinbutton|searchbox|switch|form)$/.test(role)) return true;
+    return e.attribs.contenteditable !== undefined;
+  });
+}
+
+// ---- WHY a criterion is still to assess, and WHERE its evidence would come from -----------
+//
+// One generic sentence per tier used to answer for all 52 undecided criteria: "needs a rendered
+// DOM (contrast, focus visibility, zoom/reflow, target size)" was printed against 1.4.5 (images
+// of text) as readily as against 1.4.3 (contrast), naming four measurements of which at most
+// one was the criterion's. A reader could not tell what was missing, and neither could the next
+// run — so « to assess » read as a shrug rather than as an instruction.
+//
+// Each entry names the measurement that decides the criterion and the command that produces it.
+// Absent ⇒ the tier default below, which is still true, just unspecific.
+const RESIDUAL_TRAIL: Record<string, string> = {
+  // Rendering criteria the SNAPSHOT tier decides offline, from computed styles + stylesheets.
+  "1.3.4":
+    "Decided on a page's own stylesheets (an orientation media query that rotates the document) — record a snapshot with `scan --sample` (or an E2E capture), then re-audit.",
+  "1.4.1": "Decided on computed colours (a link distinguished by colour alone) — record a snapshot with `scan --sample`, then re-audit.",
+  "1.4.3":
+    "Decided on computed text/background colours, with a screenshot fallback where the backdrop is an image — record a snapshot with `scan --sample`, then re-audit.",
+  "1.4.11": "Decided on computed colours of UI components and graphics — record a snapshot with `scan --sample`, then re-audit.",
+  "2.4.7":
+    "Decided on the page's own stylesheets (a `:focus` rule that removes the indicator without restoring one), or by the live focus probe — record a snapshot with `scan --sample`, then re-audit.",
+  // Rendering criteria that need a LIVE browser: they are measured by acting on the page.
+  "1.4.4": "Needs a live browser: the page is re-measured at 200% zoom — `scan <url> --runtime local --merge <audit.json>`.",
+  "1.4.10": "Needs a live browser: the page is re-measured in a 320px viewport (reflow) — `scan <url> --merge <audit.json>`.",
+  "1.4.12": "Needs a live browser: text spacing overrides are injected and the layout re-measured — `scan <url> --runtime local --merge <audit.json>`.",
+  "1.4.13":
+    "Needs a live browser: hover/focus-triggered content is opened and probed for dismiss/hover/persist — `scan <url> --runtime local --merge <audit.json>`.",
+  // axe's own `target-size` rule can FAIL this on a live page, but no tier certifies it, so a
+  // clean scan leaves it open rather than conforming. Say both halves.
+  "2.5.8":
+    "A live scan can fail this (axe `target-size`) but never certify it — `scan <url> --runtime local --merge <audit.json>`, then adjudicate what is left.",
+  "4.1.3":
+    "Needs a live browser WITH interaction: a status message is triggered and the live region observed — `scan <url> --runtime local --merge <audit.json>` (interactions are on by default).",
+  // Rendering criteria no automated tier measures — say so, rather than pointing at `scan` and
+  // letting the reader discover it changes nothing.
+  "1.4.5":
+    "No automated tier decides this: whether text is presented as an image is a reading of each image's content. Adjudicate it (`verify --manual`) against the images the audit lists.",
+  "2.1.2": "No automated tier decides this: escaping a keyboard trap has to be attempted by hand, on each focusable region.",
+  "2.3.1": "No automated tier decides this: flashing has to be observed over time on the rendered page.",
+  "2.4.11": "No automated tier decides this: whether a focused element stays unobscured depends on the sticky headers and overlays in play on each screen.",
+};
+
+function residualReason(automatability: string, sc?: string): string {
+  const trail = sc ? RESIDUAL_TRAIL[sc] : undefined;
+  if (trail) return trail;
   return automatability === "needs-rendering"
     ? "Needs a rendered DOM (contrast, focus visibility, zoom/reflow, target size) — decide via `scan`."
     : "Judgement criterion — adjudicated by the agent from source/context (`verify --manual`, gated).";
 }
 
+/** Why a non-static criterion is NA — the observation, so a reader can falsify it. Scope-bound
+ *  by construction (`n` files audited), which is exactly the claim being made. */
+function subjectMatterReason(sc: string, files: number): string {
+  const scope = `nothing in the ${files} file(s) audited is concerned`;
+  if (sc.startsWith("1.2."))
+    return `No time-based media in scope: ${scope} — no <audio>, <video>, <track>, <object>, <embed>, <iframe> or <canvas> element was found.`;
+  if (sc === "2.5.4") return `No motion actuation in scope: ${scope} — no device-motion or device-orientation API is used.`;
+  if (sc === "1.3.5" || sc.startsWith("3.3.")) return `No user input in scope: ${scope} — no form control (native, ARIA or contenteditable) was found.`;
+  return `No element in scope is concerned by this success criterion (${scope}).`;
+}
+
 // Streaming accumulator: parse → run rules → fold → DISCARD each Doc, so the
 // engine never holds a whole repo in memory. The only cross-document state is
 // (a) the flat findings list (bounded by finding count, not source size) and
@@ -87,6 +217,10 @@ interface Accum {
   sfcExts: Set<string>; // which SFC extensions were seen
   captures: { file: string; provenance: CaptureProvenance }[]; // rendered capture files audited
   langCounts: Map<string, number>; // <html lang> primary subtags seen, for repo-language detection
+  // Success criteria the RENDERED tier measured, from the snapshots ingested in this run
+  // (src/rules/rendered.ts renderedTestedScs). Stamped onto scope.scan.testedScs so the
+  // partial-audit banner names what is genuinely missing instead of every rendering criterion.
+  renderedScs: Set<string>;
 }
 
 // Precompute the static success criteria + their applicability predicates once.
@@ -94,6 +228,13 @@ const STATIC_PREDS: ReadonlyArray<readonly [string, (d: Doc) => boolean]> = allS
   .filter((c) => c.automatability === "static")
   .map((c) => [c.sc, APPLICABLE[c.sc] ?? isFullDocument] as const);
 
+// The same fold, for the non-static criteria whose subject matter is source-visible. Kept as a
+// separate list so the `static` contract above ("clean ⇒ C") is untouched: a criterion here can
+// only ever gain `NA`, never `C`.
+const SUBJECT_PREDS: ReadonlyArray<readonly [string, (d: Doc) => boolean]> = allSC()
+  .filter((c) => c.automatability !== "static" && SUBJECT_MATTER[c.sc] !== undefined)
+  .map((c) => [c.sc, SUBJECT_MATTER[c.sc]!] as const);
+
 function newAccum(): Accum {
   return {
     byCriterion: new Map(),
@@ -107,6 +248,7 @@ function newAccum(): Accum {
     sfcExts: new Set(),
     captures: [],
     langCounts: new Map(),
+    renderedScs: new Set(),
   };
 }
 
@@ -166,6 +308,14 @@ export function foldDoc(acc: Accum, doc: Doc, graph?: DepGraph): void {
   for (const [id, pred] of STATIC_PREDS) {
     if (!acc.applicable.get(id) && pred(doc)) acc.applicable.set(id, true);
   }
+  // OR-folded across the whole scope: one document carrying the subject matter keeps the
+  // criterion open for the entire audit (see SUBJECT_MATTER, rule 2).
+  for (const [id, pred] of SUBJECT_PREDS) {
+    if (!acc.applicable.get(id) && pred(doc)) acc.applicable.set(id, true);
+  }
+  // A page snapshot just let the rendered tier MEASURE some criteria, offline and with no
+  // browser. Record which, so the report stops claiming they were never tested.
+  if (doc.signals) for (const sc of renderedTestedScs(doc.signals)) acc.renderedScs.add(sc);
   if (doc.opaqueComponents?.length) {
     for (const lib of doc.opaqueComponents) acc.opaqueLibs.add(lib);
     acc.opaqueFiles++;
@@ -215,11 +365,17 @@ function finalize(acc: Accum, inputs: string[], extra: FinalizeExtra = {}): Audi
     } else if (normativeFs.length > 0) {
       // a rule on a needs-rendering / judgment SC raised a DEFINITE failure
       status = "NC";
+    } else if (SUBJECT_MATTER[c.sc] !== undefined && !(acc.applicable.get(c.sc) ?? false)) {
+      // The criterion's SUBJECT MATTER is absent from the entire scope, so there is nothing to
+      // judge and nothing to render — « not applicable » is the accurate verdict, not « to
+      // assess ». Never a `C`: this says the criterion does not apply, never that it is met.
+      status = "NA";
+      justification = subjectMatterReason(c.sc, acc.fileCount);
     } else {
       // engine can't decide — leave it for the agent to adjudicate (`verify --manual`,
       // gated) or the `scan` tier (rendering criteria); never a silent conforming.
       status = "manual";
-      residualRisks.push({ criteriaId: c.sc, reason: residualReason(c.automatability), automatability: c.automatability });
+      residualRisks.push({ criteriaId: c.sc, reason: residualReason(c.automatability, c.sc), automatability: c.automatability });
     }
     criteria.push({ id: c.sc, guideline: c.guideline, status, findings: fs, ...(justification ? { justification } : {}) });
   }
@@ -262,6 +418,11 @@ function finalize(acc: Accum, inputs: string[], extra: FinalizeExtra = {}): Audi
           }
         : {}),
       ...(acc.langCounts.size ? { langs: [...acc.langCounts.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).map(([lang]) => lang) } : {}),
+      // Coverage the RENDERED tier earned from the snapshots this run ingested. Same field the
+      // live-browser merge stamps (`mergeDynamic`), because it is the same claim: these criteria
+      // were measured. Omitted when no snapshot carried usable signals, so a source-only audit
+      // is byte-for-byte unchanged and still says the rendering criteria are untested.
+      ...(acc.renderedScs.size ? { scan: { testedScs: [...acc.renderedScs].sort() } } : {}),
       // The pages this run genuinely read. Written UNCONDITIONALLY — `[]` is the whole point,
       // because "this audit read no page" is exactly the claim a source-only run needs to make,
       // and an omit-when-empty field would say nothing precisely then. See scope.pagesAudited.

package/src/cli.ts

@@ -42,7 +42,15 @@ import { runCriteria, renderCriteriaReference } from "./criteria.js";
 import { checkReport, checkSemantic } from "./check.js";
 import { buildWorklist, writeWorklist, applyVerdicts, VERIFY_MAX, type VerifyItem } from "./verify.js";
 import { groundItems } from "./grounding.js";
-import { buildAdjudicationWorklist, formatAdjudication, writeAdjudication, applyAdjudication, type AdjudicationFile } from "./adjudicate.js";
+import {
+  buildAdjudicationWorklist,
+  formatAdjudication,
+  writeAdjudication,
+  applyAdjudication,
+  hydrateAdjudication,
+  type AdjudicationFile,
+} from "./adjudicate.js";
+import { entriesFrom, isLedger, ledgerPath, mergeLedger, readLedger, replayLedger, type VerdictLedger, writeLedger } from "./ledger.js";
 import { BATCH_SIZE, apiKeyFromEnv, applyRawVerdicts, judgeAll, modelFromEnv } from "./llm.js";
 import { runScan, runScanMany, runCrawlScan, runSampleScan, mergeDynamic, mergeSnapshotAudit, cleanDynamic, dockerAvailable } from "./scan.js";
 import { runScanLocal, runScanManyLocal, runCrawlScanLocal, runSampleScanLocal, localAvailable } from "./scan-local.js";
@@ -368,6 +376,13 @@ Options:
   --generate         criteria: emit the bundled references/criteria.md (WCAG 2.2 AA)
   --apply <file>     verify: reduce a filled verdicts file to a pass/fail gate
                      (requires --report — coverage is re-derived from the report, uncapped)
+                     Also accepts an ADJUDICATION (--in <audit.json>), or a VERDICT LEDGER,
+                     which it REPLAYS onto the audit with no model in the loop
+  --ledger <file>    verify --apply / judge --apply: record the verdicts the fold ACCEPTED,
+                     so a later run replays them for free (default:
+                     .ultra11y/verdicts/<standard>.json). Replay re-derives the evidence
+                     and re-runs the same gate; a verdict whose evidence changed is
+                     dropped as stale and its criterion says so
   --max-verify <n>   verify: cap the worklist size; 0 = no cap           (default: 40)
   --verdicts <file>  check --semantic: the adjudicated verdicts artifact
                      (default: VERIFY.todo.json next to the report)
@@ -430,6 +445,10 @@ Options:
   --apply            judge: fold the verdicts straight into the audit, through the SAME
                      fail-closed gate an agent's verdicts pass (no unjustified C/NA, no
                      ungroundable NC, no unadjudicated criterion)
+  --strict           verify --apply / judge --apply: all-or-nothing fold — one refused
+                     verdict discards the whole adjudication. The default folds PER
+                     VERDICT: a refusal costs its own criterion, which stays to assess
+                     carrying the refusal, and every verdict that proved itself lands
   --semantic         verify: fold the support-check into one pass
                      check: engage the semantic gate — requires an adjudicated verdicts
                      artifact (fails closed when absent) and re-grounds every passing
@@ -508,6 +527,10 @@ const VALUE_FLAGS = new Set([
   "dedup",
   "only",
   "standard",
+  // `verify --apply` / `judge --apply`: where to RECORD the verdicts the fold accepted, so a
+  // later run can replay them without a model (src/ledger.ts). A path; empty falls back to the
+  // standard's default location under .ultra11y/verdicts/.
+  "ledger",
   "baseline",
   "fail-on",
   "split",
@@ -592,6 +615,9 @@ const BOOLEAN_FLAGS = new Set([
   "generate",
   "semantic",
   "manual",
+  // `verify --apply` / `judge --apply`: restore the all-or-nothing fold, where one refused
+  // verdict discards the whole adjudication. The default is per-verdict.
+  "strict",
   "no-technical",
   "override",
   "local",
@@ -2486,10 +2512,14 @@ function cmdVerify(p: ParsedArgs): number {
       return 2;
     }
     // Dispatch on shape: an OBJECT with kind:"adjudication" is a manual-criteria adjudication
-    // (src/adjudicate.ts); a plain ARRAY is the classic NC-verdicts worklist.
+    // (src/adjudicate.ts); kind:"verdict-ledger" is a stored one being REPLAYED (src/ledger.ts,
+    // no model in the loop); a plain ARRAY is the classic NC-verdicts worklist.
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed) && (parsed as { kind?: string }).kind === "adjudication") {
       return applyAdjudicationFile(p, parsed as AdjudicationFile, lang);
     }
+    if (isLedger(parsed)) {
+      return replayLedgerFile(p, parsed, lang);
+    }
     if (!Array.isArray(parsed)) {
       console.error("ultra11y verify: --apply must be a JSON array of verdicts, or an adjudication object.");
       return 2;
@@ -2617,6 +2647,109 @@ function cmdVerify(p: ParsedArgs): number {
   return 0;
 }
 
+/** Where to record the verdicts a fold accepted. `--ledger <path>` names a file; `--ledger`
+ *  bare takes the standard's default location. Absent ⇒ nothing is recorded, so a caller who
+ *  never asked for a ledger never gets a surprise file in their tree. */
+function ledgerTarget(p: ParsedArgs, standard: StandardId): string | undefined {
+  const flag = p.flags.ledger;
+  if (flag === undefined || flag === false) return undefined;
+  return typeof flag === "string" && flag ? flag : ledgerPath(standard);
+}
+
+/** `verify --apply <ledger.json> --in <audit.json> --out <dir>` — REPLAY stored verdicts onto
+ *  a fresh audit, with no model in the loop.
+ *
+ *  This is the parity mechanism: the same `applyAdjudication` gate runs, on evidence re-derived
+ *  from the audit in front of it, so a stored verdict has to prove itself again exactly as it
+ *  did the day it was recorded. A verdict whose evidence has since changed is dropped as stale
+ *  and its criterion returns to « to assess », saying so. */
+function replayLedgerFile(p: ParsedArgs, ledger: VerdictLedger, lang: Lang): number {
+  const inFlag = p.flags.in;
+  if (typeof inFlag !== "string" || !inFlag) {
+    console.error(
+      lang === "fr"
+        ? "ultra11y verify : --apply <registre> exige --in <audit.json> (l'audit à mettre à jour)."
+        : "ultra11y verify: --apply <ledger> requires --in <audit.json> (the audit to update).",
+    );
+    return 2;
+  }
+  let audit: AuditResult;
+  try {
+    audit = JSON.parse(readText(inFlag)) as AuditResult;
+  } catch {
+    console.error(`ultra11y verify: --in file not found or not valid JSON: ${inFlag}.`);
+    return 2;
+  }
+  const cwd = typeof p.flags.cwd === "string" ? (p.flags.cwd as string) : undefined;
+  const standard = resolveStandard(p.flags.standard) ?? ledger.standard;
+  const rp = replayLedger(audit, ledger, { cwd, standard });
+  const r = applyAdjudication(audit, rp.adj, { cwd, strict: p.flags.strict === true, residualReasons: rp.residualReasons });
+
+  if (!r.ok && (p.flags.strict === true || r.applied + r.stillManual === 0)) {
+    if (p.flags.json) console.log(JSON.stringify({ ...r, replay: rp }, null, 2));
+    else {
+      console.error(lang === "fr" ? `✗ Registre rejeté (${r.issues.length} problème(s)) :` : `✗ Ledger rejected (${r.issues.length} issue(s)):`);
+      for (const i of r.issues) console.error(`  ✗ ${i}`);
+    }
+    return 1;
+  }
+  const out = typeof p.flags.out === "string" ? (p.flags.out as string) : ".";
+  mkdirSync(out, { recursive: true });
+  const auditPath = join(out, "audit-latest.json");
+  writeFileSync(auditPath, `${JSON.stringify(r.audit, null, 2)}\n`);
+
+  if (p.flags.json)
+    console.log(
+      JSON.stringify(
+        {
+          ok: true,
+          auditPath,
+          applied: r.applied,
+          stillManual: r.stillManual,
+          rejected: r.rejected,
+          rejectedCriteria: r.rejectedCriteria,
+          replayed: rp.fresh.length,
+          stale: rp.stale,
+          obsolete: rp.obsolete,
+          missing: rp.missing,
+          issues: r.issues,
+          conformancePct: r.audit.conformancePct,
+          grounding: r.grounding,
+        },
+        null,
+        2,
+      ),
+    );
+  else {
+    console.log(
+      lang === "fr"
+        ? `✓ ${r.applied} verdict(s) rejoué(s) depuis le registre, ${r.stillManual} laissé(s) en résiduel${r.rejected ? `, ${r.rejected} refusé(s)` : ""} → ${auditPath}`
+        : `✓ ${r.applied} verdict(s) replayed from the ledger, ${r.stillManual} left residual${r.rejected ? `, ${r.rejected} refused` : ""} → ${auditPath}`,
+    );
+    // Named, never merely counted: these are exactly the criteria a refresh pass has to
+    // adjudicate, and a silent count is what let a half-covered grid read as complete.
+    if (rp.stale.length)
+      console.error(
+        lang === "fr"
+          ? `⚠ ${rp.stale.length} verdict(s) périmé(s) (l'évidence a changé) : ${rp.stale.join(", ")}`
+          : `⚠ ${rp.stale.length} stale verdict(s) (the evidence changed): ${rp.stale.join(", ")}`,
+      );
+    if (rp.missing.length)
+      console.error(
+        lang === "fr"
+          ? `⚠ ${rp.missing.length} critère(s) absent(s) du registre : ${rp.missing.join(", ")}`
+          : `⚠ ${rp.missing.length} criterion(ia) absent from the ledger: ${rp.missing.join(", ")}`,
+      );
+    if (rp.obsolete.length)
+      console.error(
+        lang === "fr"
+          ? `ℹ ${rp.obsolete.length} entrée(s) obsolète(s) (le moteur les décide désormais) : ${rp.obsolete.join(", ")}`
+          : `ℹ ${rp.obsolete.length} obsolete entry(ies) (the engine now decides them): ${rp.obsolete.join(", ")}`,
+      );
+  }
+  return 0;
+}
+
 /** `verify --apply <adjudication.json> --in <audit.json> --out <dir>` — fold an AI
  *  adjudication of the manual criteria back into the audit, fail-closed, then rewrite the
  *  audit JSON so `report`/`prd` re-render with the adjudicated statuses. */
@@ -2637,8 +2770,19 @@ function applyAdjudicationFile(p: ParsedArgs, adj: AdjudicationFile, lang: Lang)
     console.error(`ultra11y verify: --in file not found or not valid JSON: ${inFlag}.`);
     return 2;
   }
-  const r = applyAdjudication(audit, adj);
-  if (!r.ok) {
+  // A verdicts-only file (`ADJUDICATE.verdicts.json`) carries decisions without the evidence
+  // they were made against. Put it back from the audit before folding: the worklist is a pure
+  // function of the audit, so this reconstructs the very anchors the citation gate checks
+  // against — the fold below is the same fold, with the same refusals.
+  const cwd = typeof p.flags.cwd === "string" ? (p.flags.cwd as string) : undefined;
+  hydrateAdjudication(adj, audit, { cwd });
+  const strict = p.flags.strict === true;
+  const r = applyAdjudication(audit, adj, { cwd, strict });
+  // STRICT: one refusal discards the file, nothing is persisted — the historical contract.
+  // PARTIAL (default): the refusals are reported, the criteria they condemn stay to assess,
+  // and everything that proved itself is kept. Only a fold that landed NOTHING is an error;
+  // otherwise a single bad verdict would again cost the whole run.
+  if (!r.ok && (strict || r.applied + r.stillManual === 0)) {
     if (p.flags.json) console.log(JSON.stringify(r, null, 2));
     else {
       console.error(lang === "fr" ? `✗ Adjudication rejetée (${r.issues.length} problème(s)) :` : `✗ Adjudication rejected (${r.issues.length} issue(s)):`);
@@ -2646,11 +2790,35 @@ function applyAdjudicationFile(p: ParsedArgs, adj: AdjudicationFile, lang: Lang)
     }
     return 1;
   }
+  if (r.rejected > 0 && !p.flags.json) {
+    console.error(
+      lang === "fr"
+        ? `⚠ ${r.rejected} critère(s) refusé(s) par la porte — ils restent à évaluer, avec le motif du refus :`
+        : `⚠ ${r.rejected} criterion(ia) refused by the gate — they stay to assess, carrying the refusal:`,
+    );
+    for (const i of r.issues) console.error(`  ✗ ${i}`);
+  }
   // Persist the updated audit so report/prd re-render with the adjudicated statuses.
   const out = typeof p.flags.out === "string" ? (p.flags.out as string) : ".";
   mkdirSync(out, { recursive: true });
   const auditPath = join(out, "audit-latest.json");
   writeFileSync(auditPath, JSON.stringify(r.audit, null, 2) + "\n");
+  // Record what landed, so the next run does not have to pay a model to learn it again. Only
+  // the ACCEPTED verdicts go in: a refused one in the ledger would be laundered back on the
+  // next replay, which is the whole thing the gate exists to prevent.
+  const ledgerOut = ledgerTarget(p, adj.standard);
+  if (ledgerOut) {
+    const refused = new Set(r.rejectedCriteria);
+    const accepted = new Set(adj.items.map((it) => it.criteriaId).filter((id) => !refused.has(id)));
+    const fresh = entriesFrom(adj, accepted, r.audit.date);
+    writeLedger(ledgerOut, mergeLedger(readLedger(ledgerOut), adj.standard, fresh));
+    if (!p.flags.json)
+      console.log(
+        lang === "fr"
+          ? `✓ ${fresh.length} verdict(s) enregistré(s) au registre → ${ledgerOut}`
+          : `✓ ${fresh.length} verdict(s) recorded in the ledger → ${ledgerOut}`,
+      );
+  }
   // Carry the numbers the fold produced. The failure payload has always described its own
   // outcome (`issues`); the success one described only the mechanics, so a caller that gates
   // on the adjudicated result — a CI step, an orchestrator's tool node — had to re-read and
@@ -2663,6 +2831,9 @@ function applyAdjudicationFile(p: ParsedArgs, adj: AdjudicationFile, lang: Lang)
           auditPath,
           applied: r.applied,
           stillManual: r.stillManual,
+          rejected: r.rejected,
+          rejectedCriteria: r.rejectedCriteria,
+          issues: r.issues,
           conformancePct: r.audit.conformancePct,
           findings: r.audit.findings.length,
           grounding: r.grounding,
@@ -2674,8 +2845,8 @@ function applyAdjudicationFile(p: ParsedArgs, adj: AdjudicationFile, lang: Lang)
   else
     console.log(
       lang === "fr"
-        ? `✓ ${r.applied} critère(s) adjugé(s), ${r.stillManual} laissé(s) en résiduel → ${auditPath}`
-        : `✓ ${r.applied} criterion(ia) adjudicated, ${r.stillManual} left residual → ${auditPath}`,
+        ? `✓ ${r.applied} critère(s) adjugé(s), ${r.stillManual} laissé(s) en résiduel${r.rejected ? `, ${r.rejected} refusé(s)` : ""} → ${auditPath}`
+        : `✓ ${r.applied} criterion(ia) adjudicated, ${r.stillManual} left residual${r.rejected ? `, ${r.rejected} refused` : ""} → ${auditPath}`,
     );
   return 0;
 }
@@ -2734,16 +2905,18 @@ async function cmdJudge(p: ParsedArgs): Promise<number> {
   }
   const max = typeof p.flags.max === "string" ? Number(p.flags.max) : undefined;
   const truncated = max !== undefined && Number.isFinite(max) && max > 0 && items.length > max;
-  // `--max` bounds the spend; `--apply` folds the verdicts through a gate that REFUSES an
-  // incomplete adjudication. Together they can never succeed — so say so before spending
-  // anything, instead of billing a full run and failing on coverage at the end.
-  if (truncated && p.flags.apply === true) {
+  // `--max` bounds the spend. It used to be refused outright together with `--apply`, and
+  // rightly so: the fold was all-or-nothing, so a bounded adjudication could only ever fail on
+  // coverage — billing a full run to guarantee a failure. The fold is now per-verdict, so a
+  // bounded run lands what it covered and leaves the rest to assess, which is precisely what
+  // someone bounding spend is asking for. The pair is impossible only under `--strict`.
+  if (truncated && p.flags.apply === true && p.flags.strict === true) {
     console.error(
       lang === "fr"
-        ? `ultra11y judge : --max ${max} ne couvre que ${max} des ${items.length} critères, et --apply exige une adjudication COMPLÈTE (le gate refuse une couverture partielle).\n` +
-            "  Retirez --max pour tout adjuger, ou retirez --apply pour produire la worklist et l'appliquer plus tard."
-        : `ultra11y judge: --max ${max} covers only ${max} of ${items.length} criteria, and --apply requires a COMPLETE adjudication (the gate refuses partial coverage).\n` +
-            "  Drop --max to adjudicate everything, or drop --apply to produce the worklist and apply it later.",
+        ? `ultra11y judge : --max ${max} ne couvre que ${max} des ${items.length} critères, et --apply --strict exige une adjudication COMPLÈTE (le fold tout-ou-rien refuse une couverture partielle).\n` +
+            "  Retirez --strict pour appliquer ce qui est couvert, retirez --max pour tout adjuger, ou retirez --apply pour produire la worklist et l'appliquer plus tard."
+        : `ultra11y judge: --max ${max} covers only ${max} of ${items.length} criteria, and --apply --strict requires a COMPLETE adjudication (the all-or-nothing fold refuses partial coverage).\n` +
+            "  Drop --strict to apply what is covered, drop --max to adjudicate everything, or drop --apply to produce the worklist and apply it later.",
     );
     return 2;
   }
@@ -2799,20 +2972,45 @@ async function cmdJudge(p: ParsedArgs): Promise<number> {
   // --apply runs the SAME gate an agent's verdicts go through. A truncated run cannot pass
   // its coverage check, which is the correct outcome, not a bug.
   const adj = JSON.parse(readText(w.todoPath)) as AdjudicationFile;
-  const r = applyAdjudication(audit, adj);
-  if (!r.ok) {
+  const r = applyAdjudication(audit, adj, { strict: p.flags.strict === true });
+  // Same policy as `verify --apply`: a batch the model got wrong costs its own criteria, not
+  // the whole paid run. Only a fold that landed nothing at all is an error.
+  if (!r.ok && (p.flags.strict === true || r.applied + r.stillManual === 0)) {
     console.error(lang === "fr" ? `✗ Adjudication rejetée (${r.issues.length} problème(s)) :` : `✗ Adjudication rejected (${r.issues.length} issue(s)):`);
     for (const i of r.issues.slice(0, 40)) console.error(`  ✗ ${i}`);
     if (r.issues.length > 40) console.error(`  … +${r.issues.length - 40}`);
     return 1;
   }
+  if (r.rejected > 0) {
+    console.error(
+      lang === "fr"
+        ? `⚠ ${r.rejected} critère(s) refusé(s) par la porte — ils restent à évaluer, avec le motif du refus :`
+        : `⚠ ${r.rejected} criterion(ia) refused by the gate — they stay to assess, carrying the refusal:`,
+    );
+    for (const i of r.issues.slice(0, 40)) console.error(`  ✗ ${i}`);
+    if (r.issues.length > 40) console.error(`  … +${r.issues.length - 40}`);
+  }
   mkdirSync(out, { recursive: true });
   const auditPath = join(out, "audit-latest.json");
   writeFileSync(auditPath, `${JSON.stringify(r.audit, null, 2)}\n`);
+  // Same recording as `verify --apply`: what the model paid for, written down where the next
+  // run can replay it for free.
+  const ledgerOut = ledgerTarget(p, adj.standard);
+  if (ledgerOut) {
+    const refused = new Set(r.rejectedCriteria);
+    const accepted = new Set(adj.items.map((it) => it.criteriaId).filter((id) => !refused.has(id)));
+    const fresh = entriesFrom(adj, accepted, r.audit.date);
+    writeLedger(ledgerOut, mergeLedger(readLedger(ledgerOut), adj.standard, fresh));
+    console.log(
+      lang === "fr"
+        ? `✓ ${fresh.length} verdict(s) enregistré(s) au registre → ${ledgerOut}`
+        : `✓ ${fresh.length} verdict(s) recorded in the ledger → ${ledgerOut}`,
+    );
+  }
   console.log(
     lang === "fr"
-      ? `✓ ${r.applied} critère(s) adjugé(s), ${r.stillManual} laissé(s) en résiduel → ${auditPath}`
-      : `✓ ${r.applied} criterion(ia) adjudicated, ${r.stillManual} left residual → ${auditPath}`,
+      ? `✓ ${r.applied} critère(s) adjugé(s), ${r.stillManual} laissé(s) en résiduel${r.rejected ? `, ${r.rejected} refusé(s)` : ""} → ${auditPath}`
+      : `✓ ${r.applied} criterion(ia) adjudicated, ${r.stillManual} left residual${r.rejected ? `, ${r.rejected} refused` : ""} → ${auditPath}`,
   );
   return 0;
 }