ultra11y 5.35.0 → 5.35.2

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join53, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.35.0";
+var VERSION = "5.35.2";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -44713,10 +44713,18 @@ var PRESENTATIONAL_MARKUP_ATTRS = /* @__PURE__ */ new Set([
 ]);
 var DOWNLOAD_HREF = /\.(pdf|docx?|xlsx?)(?:[?#]|$)/i;
 var STATUS_CLASS = /(error|status|message|alert|notif|toast|feedback|live)/i;
+var TEMPORAL_MEDIA_VALUE = /(?:^|[/.?=&_-])(?:audio|video|player|podcast|mp[34]|webm|ogg|ogv|wav|m4a|mov|avi|mpeg)(?:$|[/.?=&_-])/i;
 var ROUTER_IMPORT = /['"](?:react-router(?:-dom)?|next\/(?:router|navigation)|vue-router|@remix-run\/[\w-]+|@tanstack\/[\w-]*router|@sveltejs\/kit|\$app\/(?:navigation|stores))['"]/;
 var FOREIGN_LEXICON = /\b(?:the|and|with|your|about|please|download|settings|welcome|dashboard|overview|read more|learn more|sign in|sign up|log in|get started|coming soon|powered by)\b/i;
 var CONTROL_TAGS = ["input", "select", "textarea"];
 var INTERACTIVE_TAGS = ["a", "button", "input", "select", "textarea", "summary", "details", "label"];
+function embeddedMediaKind(el) {
+  const type = (attr(el, "type") ?? "").toLowerCase();
+  const resource = `${attr(el, "src") ?? ""} ${attr(el, "data") ?? ""}`.toLowerCase();
+  if (/^(?:audio|video)\//.test(type) || TEMPORAL_MEDIA_VALUE.test(`${type} ${resource}`)) return "temporal";
+  if (/^image\//.test(type) || /\.(?:svg|png|jpe?g|webp|avif)(?:[?#]|$)/i.test(resource)) return "non-temporal";
+  return "unknown";
+}
 function labelFor(doc, el) {
   const id = attr(el, "id");
   const lbl = id ? elementsByTag(doc, "label").find((l) => attr(l, "for") === id) : void 0;
@@ -45099,6 +45107,66 @@ var SUBJECTS = {
       (e) => h(d, e, `<${e.tag} autoplay=${attr(e, "autoplay") !== void 0} controls=${attr(e, "controls") !== void 0}>`, `media|${e.tag}`)
     )
   ]),
+  // RGAA 4.11 — temporal players and the code that controls their consultation. This must
+  // not inherit WCAG 2.1.1/2.1.2's page-wide union of pointer handlers and focusables: an
+  // unrelated clickable card says nothing about whether an <audio> can be paused.
+  temporalMediaControls: (docs) => docs.flatMap((d) => [
+    ...d.elements.filter((e) => e.tag === "audio" || e.tag === "video" || ["object", "embed"].includes(e.tag) && embeddedMediaKind(e) !== "non-temporal").map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> temporal media \u2014 controls=${attr(e, "controls") !== void 0}, autoplay=${attr(e, "autoplay") !== void 0}; can play/pause/stop and sound be operated by keyboard and pointer?`,
+        `temporal-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? ""}|controls=${attr(e, "controls") !== void 0}`
+      )
+    ),
+    ...linesOf(d, /\.(?:play|pause)\s*\(|\b(?:currentTime|muted|volume|playbackRate)\s*=|\bHTMLMediaElement\b/).map(
+      (l) => hAt(d, l.line, "media-control", `custom temporal-media control: ${l.text}`, `temporal-control|${l.text}`)
+    )
+  ]),
+  // RGAA 4.12 — non-temporal plug-in/SVG/canvas media. Static instances are included too:
+  // the adjudicator must first establish whether they expose consultation controls before it
+  // can legitimately answer NA. Temporal players and generic event handlers stay out.
+  nonTemporalMediaControls: (docs) => docs.flatMap((d) => [
+    ...d.elements.filter((e) => e.tag === "svg" || e.tag === "canvas" || ["object", "embed"].includes(e.tag) && embeddedMediaKind(e) !== "temporal").map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> non-temporal media \u2014 inspect any pan/zoom/navigation/control function for keyboard and pointer operation`,
+        `non-temporal-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? attr(e, "id") ?? ""}`
+      )
+    ),
+    ...linesOf(d, /\b(?:svgPanZoom|panzoom|zoomIn|zoomOut|getContext)\b/i).map(
+      (l) => hAt(d, l.line, "media-control", `non-temporal media/control code: ${l.text}`, `non-temporal-control|${l.text}`)
+    )
+  ]),
+  // WCAG 2.3.1 / RGAA 13.7 — only things capable of a luminance flash. The old `motion`
+  // subject mixed autoplay audio and <marquee> into this criterion while omitting ordinary
+  // images, canvas, scripts and stylesheet animation rules. That gave the adjudicator lots of
+  // evidence and none of the evidence the three-flash test actually asks for.
+  flashes: (docs) => docs.flatMap((d) => [
+    ...d.elements.filter((e) => ["video", "img", "svg", "canvas", "embed", "object", "blink"].includes(e.tag)).map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> visual/animated content \u2014 does it flash, and if so is it at most 3 flashes/s or below the area threshold?`,
+        `flash-media|${e.tag}|${attr(e, "src") ?? attr(e, "data") ?? attr(e, "id") ?? ""}`
+      )
+    ),
+    ...elementsByTag(d, "script").map(
+      (e) => h(d, e, `<script> \u2014 inspect for luminance/colour states toggled rapidly`, `flash-script|${attr(e, "src") ?? t(e, 80)}`)
+    ),
+    ...d.elements.filter((e) => /animation|transition/i.test(attr(e, "style") ?? "")).map((e) => h(d, e, `inline visual animation: ${(attr(e, "style") ?? "").slice(0, 100)}`, `flash-inline|${attr(e, "style") ?? ""}`)),
+    ...(d.signals?.css?.rules ?? []).filter((r) => r.decls.animation !== void 0 || r.decls.animationName !== void 0).map(
+      (r) => hAt(
+        d,
+        1,
+        `css:${r.selector}`,
+        `stylesheet animation: ${r.selector.slice(0, 60)} { ${declsText(r.decls)} } \u2014 inspect keyframes for rapid opposing luminance changes`,
+        `flash-css|${r.selector}|${declsText(r.decls)}`
+      )
+    ),
+    ...linesOf(d, /\b(?:flash|flashing|strobe|setInterval|requestAnimationFrame|classList\.(?:add|remove|replace|toggle))\b|animation(?:-name)?\s*:/i).filter((l) => !/^\s*(?:<!--|\/\/|\/\*)/.test(l.text)).map((l) => hAt(d, l.line, "flash-code", `possible scripted/CSS flash mechanism: ${l.text}`, `flash-code|${l.text}`))
+  ]),
   // A change of context initiated by a script. RGAA 7.4 / WCAG 3.2.1-3.2.2.
   //
   // THE SUBJECT IS THE SCRIPT, and getting that wrong cost a release. This used to be a list of
@@ -45358,7 +45426,7 @@ var SC_SUBJECTS = {
   "2.1.4": ["shortcuts"],
   "2.2.1": ["timers"],
   "2.2.2": ["motion", "timers"],
-  "2.3.1": ["motion"],
+  "2.3.1": ["flashes"],
   "2.4.1": ["landmarks"],
   "2.4.3": ["focusOrder"],
   "2.4.4": ["links"],
@@ -45451,6 +45519,10 @@ var PACK_SUBJECTS = {
     // WCAG 1.4.2, which is `static` and therefore has no subject of its own — but the pack
     // flags 4.10 `judgment`, so judgmentGuard reopens it and it would arrive with nothing.
     "4.10": ["motion"],
+    // 4.11/4.12 map to the same keyboard SCs but ask about disjoint media populations.
+    // Inheriting the union handed both criteria every pointer handler and focusable in scope.
+    "4.11": ["temporalMediaControls"],
+    "4.12": ["nonTemporalMediaControls"],
     // Theme 3 — colour. The question is about what colour alone conveys, not the outline.
     "3.1": ["colourPairs", "links"],
     "3.2": ["colourPairs"],
@@ -45487,7 +45559,7 @@ var PACK_SUBJECTS = {
     "13.2": ["newWindow"],
     "13.3": ["downloadDocs"],
     "13.4": ["downloadDocs"],
-    "13.7": ["motion"],
+    "13.7": ["flashes"],
     "13.8": ["motion", "timers"],
     "13.9": ["readingOrder"],
     "13.10": ["pointerHandlers"],
@@ -49414,7 +49486,7 @@ var SUBJECT_MATTER = {
   "2.1.4": hasCharShortcut,
   "2.2.1": hasTimeLimit,
   "2.2.2": hasMovingContent,
-  "2.3.1": hasMovingContent,
+  "2.3.1": hasFlashCandidate,
   "2.5.1": hasGesture,
   "2.5.2": hasDownEventAction,
   "2.5.7": hasDrag
@@ -49459,6 +49531,14 @@ function hasMovingContent(d) {
   if ((d.signals?.css?.rules ?? []).some((r) => r.decls.animation !== void 0 || r.decls.animationName !== void 0)) return true;
   return /\b(?:carousel|autoplay|requestAnimationFrame|animation-iteration-count|\.gif["']|\bswiper\b)/i.test(d.source);
 }
+function hasFlashCandidate(d) {
+  if (has(d, "video", "img", "svg", "canvas", "embed", "object", "blink", "script")) return true;
+  if (d.elements.some((e) => /animation|transition/i.test(e.attribs.style ?? ""))) return true;
+  if ((d.signals?.css?.rules ?? []).some((r) => r.decls.animation !== void 0 || r.decls.animationName !== void 0)) return true;
+  return /\b(?:flash|flashing|strobe|blink|setInterval|requestAnimationFrame|classList\.(?:add|remove|replace|toggle))\b|animation(?:-name)?\s*:/i.test(
+    d.source
+  );
+}
 function hasFormControl(d) {
   if (has(d, "input", "select", "textarea", "form", "fieldset", "output", "datalist")) return true;
   return d.elements.some((e) => {
@@ -54611,8 +54691,24 @@ function derivePackResults(audit2, packKey, pageId) {
 }
 function findingsForStandard(audit2, standard) {
   if (standard === CORE_KEY) return audit2.findings;
-  const mine = (audit2.packFindings ?? []).filter((f) => f.ruleId.startsWith(`pack:${standard}:`));
-  return mine.length ? [...audit2.findings, ...mine] : audit2.findings;
+  const eligible = new Set(
+    [
+      ...audit2.findings,
+      ...(audit2.packFindings ?? []).filter((finding) => finding.ruleId.startsWith(`pack:${standard}:`)),
+      ...audit2.packAdjudication?.standard === standard ? audit2.packAdjudication.criteria.flatMap((criterion) => criterion.findings) : []
+    ].map(findingId)
+  );
+  const seen = /* @__PURE__ */ new Set();
+  const out2 = [];
+  for (const criterion of derivePackResults(audit2, standard)) {
+    for (const finding of criterion.findings) {
+      const id = findingId(finding);
+      if (!eligible.has(id) || seen.has(id)) continue;
+      seen.add(id);
+      out2.push(finding);
+    }
+  }
+  return out2;
 }
 
 // src/standards/vocabulary.ts
@@ -59499,6 +59595,12 @@ function applyAdjudication(audit2, adj, opts = {}) {
   };
   const uncovered = (criteriaId) => notFolded.add(criteriaId);
   canonicalizeAdjudication(adj);
+  const itemCounts = /* @__PURE__ */ new Map();
+  for (const item of adj.items) itemCounts.set(item.criteriaId, (itemCounts.get(item.criteriaId) ?? 0) + 1);
+  for (const [criteriaId, count] of itemCounts) {
+    if (count > 1)
+      blame(criteriaId, `criterion ${criteriaId}: duplicate criterion id appears ${count} times in the adjudication \u2014 no implicit winner is accepted`);
+  }
   const byId2 = new Map(adj.items.map((it) => [it.criteriaId, it]));
   const packMode = !isCore(adj.standard);
   const open = /* @__PURE__ */ new Set();
@@ -60415,6 +60517,20 @@ var BATCH_SIZE = 8;
 var CONCURRENCY = 4;
 var MAX_ATTEMPTS = 4;
 var MAX_TOKENS = 16e3;
+function batchWorklist(items, render2, size = BATCH_SIZE) {
+  if (!Number.isInteger(size) || size < 1) throw new Error(`batch size must be a positive integer (got ${size})`);
+  const ids = items.map((item) => item.criteriaId);
+  if (new Set(ids).size !== ids.length) {
+    const duplicate = [...new Set(ids.filter((id, index) => ids.indexOf(id) !== index))];
+    throw new Error(`worklist contains duplicate criterion id(s): ${duplicate.join(", ")}`);
+  }
+  const batches = [];
+  for (let i2 = 0; i2 < items.length; i2 += size) {
+    const slice = items.slice(i2, i2 + size);
+    batches.push({ items: slice, prompt: render2(slice) });
+  }
+  return batches;
+}
 function apiKeyFromEnv() {
   const k = process.env.ANTHROPIC_API_KEY?.trim();
   return k || void 0;
@@ -60536,7 +60652,7 @@ function verdictsOf(res) {
   if (!Array.isArray(input?.verdicts)) throw new Error("ultra11y judge: the model's tool call carried no verdicts array.");
   return input.verdicts;
 }
-async function judgeBatch(items, prompt, opts) {
+async function judgeBatch(_items, prompt, opts) {
   if (!opts.apiKey) throw new Error("ultra11y judge: the Messages backend needs an API key (ANTHROPIC_API_KEY or --api-key).");
   const res = await callOnce(
     {
@@ -60549,8 +60665,22 @@ async function judgeBatch(items, prompt, opts) {
     },
     opts
   );
-  const known = new Set(items.map((i2) => i2.criteriaId));
-  return verdictsOf(res).filter((v) => known.has(v.criteriaId));
+  return verdictsOf(res);
+}
+function validateBatchVerdicts(items, landed) {
+  const expected = new Set(items.map((item) => item.criteriaId));
+  const counts = /* @__PURE__ */ new Map();
+  for (const verdict of landed) counts.set(verdict.criteriaId, (counts.get(verdict.criteriaId) ?? 0) + 1);
+  const duplicate = new Set([...counts].filter(([, count]) => count > 1).map(([id]) => id));
+  const unknown = [...new Set(landed.map((v) => v.criteriaId).filter((id) => !expected.has(id)))];
+  const accepted = landed.filter((verdict) => expected.has(verdict.criteriaId) && !duplicate.has(verdict.criteriaId));
+  const acceptedIds = new Set(accepted.map((verdict) => verdict.criteriaId));
+  const missing = [...expected].filter((id) => !acceptedIds.has(id) && !duplicate.has(id));
+  const failures = [];
+  if (duplicate.size) failures.push(`duplicate criterion id(s) in batch response: ${[...duplicate].join(", ")}`);
+  if (unknown.length) failures.push(`unknown criterion id(s) in batch response: ${unknown.join(", ")}`);
+  if (missing.length) failures.push(`missing criterion id(s) in batch response: ${missing.join(", ")}`);
+  return { accepted, failures };
 }
 async function judgeAll(batches, opts) {
   const verdicts = [];
@@ -60564,8 +60694,10 @@ async function judgeAll(batches, opts) {
       for (let b = queue.shift(); b !== void 0; b = queue.shift()) {
         try {
           const landed = await backend(b.items, b.prompt, opts);
-          verdicts.push(...landed);
-          if (landed.length) opts.onVerdicts?.(landed);
+          const checked = validateBatchVerdicts(b.items, landed);
+          failures.push(...checked.failures);
+          verdicts.push(...checked.accepted);
+          if (checked.accepted.length) opts.onVerdicts?.(checked.accepted);
         } catch (e) {
           failures.push(e instanceof Error ? e.message : String(e));
         }
@@ -60576,7 +60708,9 @@ async function judgeAll(batches, opts) {
   return { verdicts, failures };
 }
 function applyRawVerdicts(items, verdicts) {
-  const byId2 = new Map(verdicts.map((v) => [v.criteriaId, v]));
+  const counts = /* @__PURE__ */ new Map();
+  for (const verdict of verdicts) counts.set(verdict.criteriaId, (counts.get(verdict.criteriaId) ?? 0) + 1);
+  const byId2 = new Map(verdicts.filter((v) => counts.get(v.criteriaId) === 1).map((v) => [v.criteriaId, v]));
   let filled = 0;
   for (const item of items) {
     const v = byId2.get(item.criteriaId);
@@ -64249,7 +64383,9 @@ var S = {
   fr: {
     title: "Audit d'accessibilit\xE9 ultra11y",
     files: "fichiers",
-    rate: "r\xE9ussite automatique",
+    coverage: (decided, total) => `${decided}/${total} crit\xE8res tranch\xE9s dans ce run`,
+    remaining: (n) => `${n} \xE0 compl\xE9ter par scan ou adjudication`,
+    provenance: { engine: "moteur", scan: "scan", agent: "agent" },
     none: "\u2705 Aucune non-conformit\xE9 d\xE9tect\xE9e par le moteur statique.",
     findings: "Non-conformit\xE9s",
     severity: "S\xE9v\xE9rit\xE9",
@@ -64317,7 +64453,9 @@ var S = {
   en: {
     title: "ultra11y accessibility audit",
     files: "files",
-    rate: "automatic pass rate",
+    coverage: (decided, total) => `${decided}/${total} criteria decided in this run`,
+    remaining: (n) => `${n} still to complete by scan or adjudication`,
+    provenance: { engine: "engine", scan: "scan", agent: "agent" },
     none: "\u2705 No non-conformity detected by the static engine.",
     findings: "Non-conformities",
     severity: "Severity",
@@ -64439,11 +64577,24 @@ function groupByCriterion(groups) {
   }
   return [...byCriterion.values()].map(({ pageSet, ...c2 }) => ({ ...c2, pages: pageSet.size })).sort((a, b) => SEV_ORDER4.indexOf(a.severity) - SEV_ORDER4.indexOf(b.severity) || b.occurrences - a.occurrences || a.criterion.localeCompare(b.criterion));
 }
-function runRate(result, standard, lang) {
+function runCoverage(result, standard, lang) {
   const groups = isCore(standard) ? reportGroups(result, lang) : packReportGroups(result, loadPack(standard), lang);
   const { decided, total } = reportCoverage(groups);
+  const decidedRows = groups.flatMap((g) => g.rows).filter((r) => r.status === "C" || r.status === "NC");
+  const by = {
+    engine: decidedRows.filter((r) => !r.decidedBy || r.decidedBy === "engine").length,
+    scan: decidedRows.filter((r) => r.decidedBy === "scan").length,
+    agent: decidedRows.filter((r) => r.decidedBy === "agent").length
+  };
+  const s = S[lang];
+  const provenance = ["engine", "scan", "agent"].filter((key2) => by[key2] > 0).map((key2) => `${by[key2]} ${s.provenance[key2]}`);
+  const remaining = Math.max(0, total - decided);
   const agentRuled = groups.some((g) => g.rows.some((r) => r.decidedBy === "agent" && r.status === "C"));
-  return { text: `${formatRate(decided === 0 ? null : result.conformancePct, decided, total)}${agentRuled ? "*" : ""}`, agentRuled };
+  return {
+    text: s.coverage(decided, total),
+    detail: [...provenance, ...remaining ? [s.remaining(remaining)] : []].join(" \xB7 "),
+    agentRuled
+  };
 }
 var cell = (v) => v.replace(/\|/g, "\\|");
 function criterionTableHead(s) {
@@ -64482,11 +64633,11 @@ function stepSummary(result, opts = {}) {
   const lang = opts.lang ?? "en";
   const s = S[lang];
   const stdLabel = isCore(standard) ? "WCAG 2.2 AA" : loadPack(standard).name;
-  const rate = runRate(result, standard, lang);
+  const coverage = runCoverage(result, standard, lang);
   const out2 = [];
   out2.push(`## ${s.title} \u2014 ${stdLabel}`, "");
-  out2.push(`\`${result.date}\` \xB7 ${result.scope.files} ${s.files} \xB7 **${rate.text}** ${s.rate}`, "");
-  if (rate.agentRuled) out2.push(`> ${agentMarkNote(lang)}`, "");
+  out2.push(`\`${result.date}\` \xB7 ${result.scope.files} ${s.files} \xB7 **${coverage.text}**${coverage.detail ? ` \xB7 ${coverage.detail}` : ""}`, "");
+  if (coverage.agentRuled) out2.push(`> ${agentMarkNote(lang)}`, "");
   const baseDir = opts.baseDir ?? process.cwd();
   const all = findingsForStandard(result, standard);
   if (!all.length) {
@@ -64537,15 +64688,15 @@ function prComment(result, opts = {}) {
   const all = findingsForStandard(result, standard);
   const normative = all.filter((f) => !f.advisory);
   const blocking = normative.filter((f) => f.severity === "bloquant").length;
-  const rate = runRate(result, standard, lang);
+  const coverage = runCoverage(result, standard, lang);
   const grouped = groupFindings(all, standard, lang, baseDir);
   const criteria = groupByCriterion(grouped);
-  const orphans = unattributedFindings(result).filter((f) => !f.advisory).length;
+  const orphans = all.filter((f) => !f.advisory && !f.page).length;
   const head = [];
   head.push(`### ${s.title} \u2014 ${stdLabel}`, "");
   head.push(blocking ? s.verdictFail(blocking) : normative.length ? s.verdictWarn : s.verdictPass, "");
-  head.push(`\`${result.date}\` \xB7 ${result.scope.files} ${s.files} \xB7 **${rate.text}** ${s.rate}`, "");
-  if (rate.agentRuled) head.push(`> ${agentMarkNote(lang)}`, "");
+  head.push(`\`${result.date}\` \xB7 ${result.scope.files} ${s.files} \xB7 **${coverage.text}**${coverage.detail ? ` \xB7 ${coverage.detail}` : ""}`, "");
+  if (coverage.agentRuled) head.push(`> ${agentMarkNote(lang)}`, "");
   if (orphans) head.push(`> ${s.unattributed(orphans)}`, "");
   const tail = [];
   if (opts.artifactName) tail.push(s.artifact(opts.artifactName), "");
@@ -64581,7 +64732,7 @@ function perPageTable(result, standard = CORE2, lang = "en") {
     "",
     ...scoreboardTable(result, derived, standard, s, lang),
     "",
-    ...basisCaveats(result, derived, s, lang),
+    ...basisCaveats(result, derived, standard, s, lang),
     ...fullGridBlock(result, derived, standard, s, lang),
     "",
     ...derived.flatMap((pg) => [...namedCriteriaBlock(result, pg, standard, s, lang), ""])
@@ -64613,7 +64764,8 @@ function scoreboardTable(result, derived, standard, s, lang) {
     "| --- | --- | ---: | ---: | ---: | ---: | ---: |"
   ];
   for (const pg of derived) {
-    const n = (sev) => severityCount(pg, sev);
+    const pageFindings = findingsForStandard(pageView(result, pg), standard).filter((f) => !f.advisory);
+    const n = (sev) => pageFindings.filter((f) => f.severity === sev).length;
     const t3 = pageTally(pageCriterionRows(result, pg, standard, lang));
     out2.push(
       `| ${pg.name}${pg.auth ? " \u{1F512}" : ""} \u2014 \`${pg.url}\` | ${basisLabel(pg.basis, lang)} | ${t3.c} | ${t3.nc} | ${n("bloquant")} | ${n("majeur")} | ${n("mineur")} |`
@@ -64637,12 +64789,10 @@ function undecidedBlock(result, derived, standard, s, lang) {
   out2.push("");
   return out2;
 }
-function severityCount(pg, sev) {
-  return pg.findings.filter((f) => !f.advisory && f.severity === sev).length;
-}
-function basisCaveats(result, derived, s, lang) {
+function basisCaveats(result, derived, standard, s, lang) {
   const out2 = [`> ${s.scoreboardNote}`, ""];
-  const orphans = unattributedFindings(result).filter((f) => !f.advisory).length;
+  const projected = new Set(findingsForStandard(result, standard));
+  const orphans = unattributedFindings(result).filter((f) => projected.has(f) && !f.advisory).length;
   if (orphans) out2.push(`> ${s.unattributed(orphans)}`, "");
   if (derived.some((p) => p.basis === "attributed")) out2.push(`> ${s.sourceBasis}`, "");
   const notAudited = pageBasisWarning("not-audited", lang);
@@ -64654,9 +64804,11 @@ function pageBlock(result, page, standard, lang, baseDir) {
   const s = S[lang];
   const rows = pageCriterionRows(result, page, standard, lang);
   const nc = rows.filter((r) => r.status === "NC");
-  const occurrences = page.findings.filter((f) => !f.advisory).length;
+  const pageFindings = findingsForStandard(pageView(result, page), standard).filter((f) => !f.advisory);
+  const occurrences = pageFindings.length;
   if (!nc.length && !occurrences) return void 0;
-  const counts = `\u{1F534} ${severityCount(page, "bloquant")} \xB7 \u{1F7E0} ${severityCount(page, "majeur")} \xB7 \u{1F7E1} ${severityCount(page, "mineur")}`;
+  const count = (severity) => pageFindings.filter((f) => f.severity === severity).length;
+  const counts = `\u{1F534} ${count("bloquant")} \xB7 \u{1F7E0} ${count("majeur")} \xB7 \u{1F7E1} ${count("mineur")}`;
   const withTests = nc.some((r) => r.tests.length);
   const out2 = [
     "<details>",
@@ -64675,12 +64827,7 @@ function pageBlock(result, page, standard, lang, baseDir) {
   for (const r of nc) {
     out2.push(withTests ? `| ${cell(r.label)} | ${r.tests.map((t3) => `\`${t3}\``).join(" ")} |` : `| ${cell(r.label)} |`);
   }
-  const defects = groupFindings(
-    page.findings.filter((f) => !f.advisory),
-    standard,
-    lang,
-    baseDir
-  );
+  const defects = groupFindings(pageFindings, standard, lang, baseDir);
   const blocking = groupByCriterion(defects.filter((g) => g.severity === "bloquant"));
   const rest = groupByCriterion(defects.filter((g) => g.severity !== "bloquant"));
   const shownBlocking = Math.min(blocking.length, PAGE_CRITERIA_SHOWN);
@@ -64717,7 +64864,8 @@ function fullGridBlock(result, derived, standard, s, lang) {
   return out2;
 }
 function orphansBlock(result, standard, s, lang, baseDir) {
-  const orphans = unattributedFindings(result).filter((f) => !f.advisory);
+  const projected = new Set(findingsForStandard(result, standard));
+  const orphans = unattributedFindings(result).filter((f) => projected.has(f) && !f.advisory);
   if (!orphans.length) return [];
   const criteria = groupByCriterion(groupFindings(orphans, standard, lang, baseDir));
   const counts = SEV_ORDER4.map((sev) => `${ICON5[sev]} ${orphans.filter((f) => f.severity === sev).length}`).join(" \xB7 ");
@@ -64774,17 +64922,18 @@ function pagesComment(result, opts = {}) {
   const derived = derivePages(result, scope);
   const normative = findingsForStandard(result, standard).filter((f) => !f.advisory);
   const blocking = normative.filter((f) => f.severity === "bloquant").length;
-  const rate = runRate(result, standard, lang);
+  const coverage = runCoverage(result, standard, lang);
   head.push(blocking ? s.verdictFail(blocking) : normative.length ? s.verdictWarn : s.verdictPass, "");
-  head.push(`\`${result.date}\` \xB7 ${s.pagesCount(derived.length)} \xB7 **${rate.text}** ${s.rate}`, "");
-  if (rate.agentRuled) head.push(`> ${agentMarkNote(lang)}`, "");
+  head.push(`\`${result.date}\` \xB7 ${s.pagesCount(derived.length)} \xB7 **${coverage.text}**${coverage.detail ? ` \xB7 ${coverage.detail}` : ""}`, "");
+  if (coverage.agentRuled) head.push(`> ${agentMarkNote(lang)}`, "");
+  const severity = (page, level) => findingsForStandard(pageView(result, page), standard).filter((f) => !f.advisory && f.severity === level).length;
   const blocks = [...derived].sort(
-    (a, b) => severityCount(b, "bloquant") - severityCount(a, "bloquant") || severityCount(b, "majeur") - severityCount(a, "majeur") || severityCount(b, "mineur") - severityCount(a, "mineur")
+    (a, b) => severity(b, "bloquant") - severity(a, "bloquant") || severity(b, "majeur") - severity(a, "majeur") || severity(b, "mineur") - severity(a, "mineur")
   ).map((p) => pageBlock(result, p, standard, lang, baseDir)).filter((b) => b !== void 0);
   const assemble = (nBlocks2, nRows2, withGrid = true) => {
     const body3 = [...scoreboardTable(result, derived.slice(0, nRows2), standard, s, lang), ""];
     if (nRows2 < derived.length) body3.push(s.scoreboardClamped(derived.length - nRows2), "");
-    body3.push(...basisCaveats(result, derived, s, lang));
+    body3.push(...basisCaveats(result, derived, standard, s, lang));
     body3.push(...undecidedBlock(result, derived, standard, s, lang));
     if (redirected.length) body3.push(...renderRedirected(redirected, lang), "");
     body3.push(...orphansBlock(result, standard, s, lang, baseDir), "");
@@ -71741,11 +71890,7 @@ async function cmdJudge(p) {
   if (truncated) items = items.slice(0, max);
   const size = grain === "criterion" ? 1 : BATCH_SIZE;
   const render2 = (slice) => formatAdjudication(slice, lang, standard, { preamble: false, contract: false });
-  const batches = [];
-  for (let i2 = 0; i2 < items.length; i2 += size) {
-    const slice = items.slice(i2, i2 + size);
-    batches.push({ items: slice, prompt: render2(slice) });
-  }
+  const batches = batchWorklist(items, render2, size);
   const explicitModel = typeof p.flags.model === "string" && p.flags.model ? p.flags.model : void 0;
   const model = explicitModel ?? (runner === "claude" ? DEFAULT_CLI_MODEL : runner === "api" ? modelFromEnv() : void 0);
   const modelLabel = model ?? "Codex account default";

package/skills/ultra11y/SKILL.md

@@ -3,7 +3,7 @@ name: ultra11y
 description: "Use to AUDIT a repository, site, or page against WCAG 2.2 AA or a country standard such as RGAA; produce a dated conformance report, criterion grid, PRD backlog, or tickets; AUTHOR accessible markup; fix accessibility; or wire a repo gate and rendered-DOM capture pipeline. The bundled install-free engine runs 81 static checks tied to success criteria, while the agent adjudicates judgment criteria and routes rendering criteria to browser scans; check/verify reject invented non-conformities. Use `review-a11y` instead for a review scoped only to a diff, branch, or PR."
 license: MIT
 metadata:
-  version: 5.35.0
+  version: 5.35.2
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup
@@ -20,6 +20,14 @@ criteria (computed contrast, visible focus, zoom/reflow, content-on-hover) fall
 tier (axe-core in a real browser); a human is at most optional oversight. Gates stop any
 hallucinated non-conformity from surviving, and nothing is ever silently "conforming".
 
+**Do not confuse rules with criteria.** The bundle ships 81 static checks, WCAG AA has 55
+success criteria, and RGAA has 106 criteria. Several rules may evidence one criterion, one
+rule may contribute to several pack criteria, and most criteria remain open until a scan or
+an adjudication. The only honest run-level coverage is the grid's live provenance tally
+(`moteur + scan + agent`, plus any named undecidable residue), never a fixed promise such as
+“48 agent criteria”. GitHub summaries therefore show `decided/total`, not a percentage over
+the small decided subset.
+
 **WCAG 2.2 Level AA is the worldwide core.** Country standards — France's **RGAA**, the
 US **Section 508**, the EU **EN 301 549** — are pluggable *standards packs* that map their
 criteria onto WCAG. Add `--standard rgaa` to re-key **every command and every output** —

package/skills/ultra11y/references/ci.md

@@ -339,18 +339,27 @@ plan renders inline on the diff, and appends a Markdown job summary to
 been scanned and merged). With no `$GITHUB_STEP_SUMMARY` set, the summary goes to stderr so a
 local run still shows it.
 
+The GitHub summary deliberately prints **coverage, never a percentage**:
+`12/106 criteria decided in this run · 12 engine · 94 still to complete by scan or
+adjudication`. A percentage over the decided subset looks like a conformance score for the
+whole grid. Coverage and provenance are derived from the selected standard's criterion rows,
+and the occurrence count is derived from the same projection; a WCAG finding that makes no
+RGAA criterion non-conformant therefore appears in neither the heading nor an empty table.
+
 URL-keyed findings are **skipped** for annotations — there is no repo line to point at — and
 counted in the summary instead, so they are never silently dropped.
 
 ## Which command to run it from
 
-`audit` is always WCAG-keyed: it takes **no** `--standard`, by design (a pack is a derived
-view, never a second source of truth). So:
+The engine remains WCAG-keyed internally, while `audit --standard <pack>` writes a pack-keyed
+document with that core under `core`. CI renderers always project from the active standard's
+grid. So:
 
 | You want | Run |
 |---|---|
 | WCAG-keyed CI output, one shot | `audit … --format sarif` |
-| **RGAA**-keyed CI output | `audit … --out audits` then `report --in audits/audit-latest.json --standard rgaa --format sarif` |
+| **RGAA**-keyed CI output, one shot | `audit … --standard rgaa --format sarif` |
+| Re-render an existing RGAA audit | `report --in audits/audit-latest.json --standard rgaa --format sarif` |
 | Only what the PR introduced | `audit --since origin/main --baseline audits/baseline.json --format sarif` |
 
 In `--baseline` gate mode the CI rendering covers **exactly the new findings** — the subject
@@ -376,7 +385,7 @@ with the action's `comment-kind` (`ULTRA11Y_PR_COMMENT_KIND`):
 | kind | what it posts |
 |---|---|
 | `digest` (default) | The verdict, the coverage, and the distinct defects — one row per (criterion, rule, selector), so 472 occurrences of one design-system defect are one row. Then a link. |
-| `pages` | The page-by-page grid: one row per page with its basis, its rate **and its denominator**, and its severities; then the FULL criterion × page grid (`C` / `NC` / `—` / `?`, collapsed), the criteria nobody has ruled on **named**, and a collapsed block per failing page listing its non-conforming criteria and where to fix them. Needs pages in scope; with none it says so rather than posting an empty scoreboard. |
+| `pages` | The page-by-page grid: one row per page with its basis, its `C`/`NC` counts and severities — no misleading decided-subset percentage; then the FULL criterion × page grid (`C` / `NC` / `—` / `?`, collapsed), the criteria nobody has ruled on **named**, and a collapsed block per failing page listing its non-conforming criteria and where to fix them. Needs pages in scope; with none it says so rather than posting an empty scoreboard. |
 | `full` | Both, in **one** comment under its own marker: everything `pages` posts, plus the run's distinct defects with their locations — the digest's actionable half. For a workflow that wants a single comment at the end with everything in it rather than two a reviewer has to reconcile. Same scope requirement as `pages`. |
 
 **The marker carries both the standard and the kind**, so a WCAG run and an RGAA run keep

package/skills/ultra11y/references/methodology.md

@@ -19,6 +19,17 @@ criteria are coarser than the engine's rules, that denominator is deliberately s
 it is **not** a full conformance rate. Full WCAG 2.2 AA conformance requires completing
 the "to assess" criteria by hand.
 
+That rate remains available in the complete artifact, beside its qualification. GitHub job
+summaries and PR comments do **not** print it: they print `decided/total`, the provenance
+breakdown (`engine`, `scan`, `agent`) and the remaining count. This prevents a static result
+such as 11 conformities and 1 non-conformity from being read as “92% RGAA” when only 12 of the
+106 RGAA criteria have actually been decided.
+
+The 81 bundled static checks are **rules, not criteria**. Their relationship is many-to-many:
+several rules can evidence one criterion, and a pack can scope one rule to several of its own
+criteria. Rule count, criterion coverage and agent worklist size must never be substituted for
+one another.
+
 ## Non-conformity priorities
 
 - 🔴 **Blocking** — prevents access to content/function (e.g. missing alt, unlabeled

package/skills/ultra11y/references/runbook.md

@@ -88,6 +88,12 @@ with Haiku, against a reference ledger adjudicated by a stronger model through t
 `11.2.1` really is a test of `11.2`. It never asks whether the reading was right, so an
 adjudicator that files « this field has no label » (which is 11.1's) under 11.2 passes cleanly.
 
+The `48` above is the intersection of two measured experiment outputs, **not** a fixed number
+of RGAA criteria assigned to the agent. On every real run, read the final provenance tally.
+For example, `26 engine + 32 scan + 46 agent + 2 named undecidable = 106` is complete; calling
+that “48 agent criteria” would hide both the actual 46 model verdicts and the two explicit
+exceptions.
+
 Three things now stand between that and a deliverable, and only the third is a model:
 
 1. **The brief names the neighbour.** A criterion states which of its theme-mates owns the