ultra11y 5.38.3 → 5.38.5

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.38.3",
+      "version": "5.38.5",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.38.3",
+  "version": "5.38.5",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.38.3",
+  "version": "5.38.5",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.38.3";
+const ULTRA11Y_PLUGIN_VERSION = "5.38.5";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.38.3",
+  "version": "5.38.5",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join53, relative as relative6, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.38.3";
+var VERSION = "5.38.5";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2300,7 +2300,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-27 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-28 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -47196,6 +47196,36 @@ var SUBJECTS = {
     ),
     ...linesOf(d, /\b(?:flash|flashing|strobe|setInterval|requestAnimationFrame|classList\.(?:add|remove|replace|toggle))\b|animation(?:-name)?\s*:/i).filter((l) => !/^\s*(?:<!--|\/\/|\/\*)/.test(l.text)).map((l) => hAt(d, l.line, "flash-code", `possible scripted/CSS flash mechanism: ${l.text}`, `flash-code|${l.text}`))
   ]),
+  // RGAA 7.2 — the script AND the alternative whose relevance must be judged. Inheriting
+  // WCAG 4.1.2 used to hand this criterion every ARIA-bearing element in the repository while
+  // omitting inline handlers entirely. On the realworld fixture that meant 33 unrelated
+  // anchors and none of its three scripts; Haiku correctly refused to invent an association.
+  // Keep the population narrow: scripts/handlers establish applicability, while noscript and
+  // non-text fallbacks are the concrete alternatives covered by tests 7.2.1 and 7.2.2.
+  scriptAlternatives: (docs) => docs.flatMap((d) => [
+    ...elementsByTag(d, "script").map(
+      (e) => h(
+        d,
+        e,
+        `<script${attr(e, "src") ? ` src="${attr(e, "src")}"` : ""}> \u2014 identify its alternative and compare the information or function`,
+        `script|${attr(e, "src") ?? t(e, 100)}`
+      )
+    ),
+    ...linesOf(d, /\bon[A-Z][A-Za-z]*\s*=|\son[a-z]+\s*=\s*["']/).map(
+      (l) => hAt(d, l.line, "handler", `script handler \u2014 identify any alternative offering the same information or function: ${l.text}`, `handler|${l.text}`)
+    ),
+    ...elementsByTag(d, "noscript").map(
+      (e) => h(d, e, `<noscript> alternative \u2014 does it provide content and functions similar to the associated script?`, `noscript|${t(e, 120)}`)
+    ),
+    ...d.elements.filter((e) => ["canvas", "object", "embed"].includes(e.tag) && (t(e, 120) !== "" || e.children.some((child) => child.type === "element"))).map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> fallback \u2014 if a script updates this non-text element, is its alternative updated and relevant?`,
+        `script-fallback|${e.tag}|${t(e, 120)}`
+      )
+    )
+  ]),
   // A change of context initiated by a script. RGAA 7.4 / WCAG 3.2.1-3.2.2.
   //
   // THE SUBJECT IS THE SCRIPT, and getting that wrong cost a release. This used to be a list of
@@ -47559,6 +47589,7 @@ var PACK_SUBJECTS = {
     // Theme 7 — scripts. "Is each script operable by keyboard AND pointer?" is about the
     // handlers and the focusable surface, never about the page's headings and lists.
     "7.1": ["aria", "pointerHandlers"],
+    "7.2": ["scriptAlternatives"],
     "7.3": ["pointerHandlers", "focusables"],
     "7.4": ["contextChange"],
     "7.5": ["liveRegions"],
@@ -47607,6 +47638,7 @@ var EXISTENCE_SUBJECTS = /* @__PURE__ */ new Set([
   "downloadDocs",
   "newWindow",
   "contextChange",
+  "scriptAlternatives",
   // A page that declares no default language has no language code for 8.4 to be about. The
   // `<html>` element is always there; the attribute is what this subject looks for.
   "declaredLang"

package/scripts/vendor/wcag-2.2-fr.json

@@ -1,6 +1,6 @@
 {
   "source": "https://www.w3.org/Translations/WCAG22-fr/",
-  "fetchedAt": "2026-08-27",
+  "fetchedAt": "2026-08-28",
   "principles": {
     "1": "Perceptible",
     "2": "Utilisable",

package/scripts/vendor/wcag-2.2-sc-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-27 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-28 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "principles": [
     {
       "number": 1,

package/scripts/vendor/wcag-2.2-techniques.json

@@ -2,7 +2,7 @@
   "source": "https://github.com/w3c/wcag",
   "understanding": "https://www.w3.org/WAI/WCAG22/Understanding/",
   "license": "W3C Document License (code samples: W3C Software License)",
-  "fetchedAt": "2026-08-27",
+  "fetchedAt": "2026-08-28",
   "criteria": {
     "1.1.1": {
       "slug": "non-text-content",

package/scripts/vendor/wcag-2.2-text.json

@@ -1,7 +1,7 @@
 {
   "source": "https://github.com/w3c/wcag",
   "license": "W3C Document License",
-  "fetchedAt": "2026-08-27",
+  "fetchedAt": "2026-08-28",
   "criteria": {
     "1.1.1": "All non-text content that is presented to the user has a text alternative that serves the equivalent purpose, except for the situations listed below.\nControls, Input:\nIf non-text content is a control or accepts user input, then it has a name that describes its purpose. (Refer to Success Criterion 4.1.2 Name, Role, Value for additional requirements for controls and content that accepts user input.)\nTime-Based Media:\nIf non-text content is time-based media, then text alternatives at least provide descriptive identification of the non-text content. (Refer to Guideline 1.2 for additional requirements for media.)\nTest:\nIf non-text content is a test or exercise that would be invalid if presented in text, then text alternatives at least provide descriptive identification of the non-text content.\nSensory:\nIf non-text content is primarily intended to create a specific sensory experience, then text alternatives at least provide descriptive identification of the non-text content.\nCAPTCHA:\nIf the purpose of non-text content is to confirm that content is being accessed by a person rather than a computer, then text alternatives that identify and describe the purpose of the non-text content are provided, and alternative forms of CAPTCHA using output modes for different types of sensory perception are provided to accommodate different disabilities.\nDecoration, Formatting, Invisible:\nIf non-text content is pure decoration, is used only for visual formatting, or is not presented to users, then it is implemented in a way that it can be ignored by assistive technology.",
     "1.2.1": "For prerecorded audio-only and prerecorded video-only media, the following are true, except when the audio or video is a media alternative for text and is clearly labeled as such:\nPrerecorded Audio-only:\nAn alternative for time-based media is provided that presents equivalent information for prerecorded audio-only content.\nPrerecorded Video-only:\nEither an alternative for time-based media or an audio track is provided that presents equivalent information for prerecorded video-only content.",

package/skills/review-a11y/SKILL.md

@@ -3,7 +3,7 @@ name: review-a11y
 description: "Use to REVIEW changed frontend code for accessibility: staged files, a working diff, branch, or PR; prompts such as 'review a11y', 'is this accessible?', or 'anything to fix before merge?'; and hook or CI findings on a change. Run the bundled install-free engine with cross-file JSX/TSX analysis, then adjudicate candidates and return a severity-ranked WCAG 2.2 AA review with file:line fixes, residual rendering risks, and a verdict. Use `ultra11y` instead for whole-repo audits, dated conformance reports, country standards, PRD backlogs, or authoring accessible markup."
 license: MIT
 metadata:
-  version: 5.38.3
+  version: 5.38.5
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join53, relative as relative6, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.38.3";
+var VERSION = "5.38.5";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2300,7 +2300,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-27 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-28 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -47196,6 +47196,36 @@ var SUBJECTS = {
     ),
     ...linesOf(d, /\b(?:flash|flashing|strobe|setInterval|requestAnimationFrame|classList\.(?:add|remove|replace|toggle))\b|animation(?:-name)?\s*:/i).filter((l) => !/^\s*(?:<!--|\/\/|\/\*)/.test(l.text)).map((l) => hAt(d, l.line, "flash-code", `possible scripted/CSS flash mechanism: ${l.text}`, `flash-code|${l.text}`))
   ]),
+  // RGAA 7.2 — the script AND the alternative whose relevance must be judged. Inheriting
+  // WCAG 4.1.2 used to hand this criterion every ARIA-bearing element in the repository while
+  // omitting inline handlers entirely. On the realworld fixture that meant 33 unrelated
+  // anchors and none of its three scripts; Haiku correctly refused to invent an association.
+  // Keep the population narrow: scripts/handlers establish applicability, while noscript and
+  // non-text fallbacks are the concrete alternatives covered by tests 7.2.1 and 7.2.2.
+  scriptAlternatives: (docs) => docs.flatMap((d) => [
+    ...elementsByTag(d, "script").map(
+      (e) => h(
+        d,
+        e,
+        `<script${attr(e, "src") ? ` src="${attr(e, "src")}"` : ""}> \u2014 identify its alternative and compare the information or function`,
+        `script|${attr(e, "src") ?? t(e, 100)}`
+      )
+    ),
+    ...linesOf(d, /\bon[A-Z][A-Za-z]*\s*=|\son[a-z]+\s*=\s*["']/).map(
+      (l) => hAt(d, l.line, "handler", `script handler \u2014 identify any alternative offering the same information or function: ${l.text}`, `handler|${l.text}`)
+    ),
+    ...elementsByTag(d, "noscript").map(
+      (e) => h(d, e, `<noscript> alternative \u2014 does it provide content and functions similar to the associated script?`, `noscript|${t(e, 120)}`)
+    ),
+    ...d.elements.filter((e) => ["canvas", "object", "embed"].includes(e.tag) && (t(e, 120) !== "" || e.children.some((child) => child.type === "element"))).map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> fallback \u2014 if a script updates this non-text element, is its alternative updated and relevant?`,
+        `script-fallback|${e.tag}|${t(e, 120)}`
+      )
+    )
+  ]),
   // A change of context initiated by a script. RGAA 7.4 / WCAG 3.2.1-3.2.2.
   //
   // THE SUBJECT IS THE SCRIPT, and getting that wrong cost a release. This used to be a list of
@@ -47559,6 +47589,7 @@ var PACK_SUBJECTS = {
     // Theme 7 — scripts. "Is each script operable by keyboard AND pointer?" is about the
     // handlers and the focusable surface, never about the page's headings and lists.
     "7.1": ["aria", "pointerHandlers"],
+    "7.2": ["scriptAlternatives"],
     "7.3": ["pointerHandlers", "focusables"],
     "7.4": ["contextChange"],
     "7.5": ["liveRegions"],
@@ -47607,6 +47638,7 @@ var EXISTENCE_SUBJECTS = /* @__PURE__ */ new Set([
   "downloadDocs",
   "newWindow",
   "contextChange",
+  "scriptAlternatives",
   // A page that declares no default language has no language code for 8.4 to be about. The
   // `<html>` element is always there; the attribute is what this subject looks for.
   "declaredLang"

package/skills/ultra11y/SKILL.md

@@ -3,7 +3,7 @@ name: ultra11y
 description: "Use to AUDIT a repository, site, or page against WCAG 2.2 AA or a country standard such as RGAA; produce a dated conformance report, criterion grid, PRD backlog, or tickets; AUTHOR accessible markup; fix accessibility; or wire a repo gate and rendered-DOM capture pipeline. The bundled install-free engine runs 93 static checks tied to success criteria, while the agent adjudicates judgment criteria and routes rendering criteria to browser scans; check/verify reject invented non-conformities. Use `review-a11y` instead for a review scoped only to a diff, branch, or PR."
 license: MIT
 metadata:
-  version: 5.38.3
+  version: 5.38.5
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join53, relative as relative6, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.38.3";
+var VERSION = "5.38.5";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2300,7 +2300,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-27 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-28 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -47196,6 +47196,36 @@ var SUBJECTS = {
     ),
     ...linesOf(d, /\b(?:flash|flashing|strobe|setInterval|requestAnimationFrame|classList\.(?:add|remove|replace|toggle))\b|animation(?:-name)?\s*:/i).filter((l) => !/^\s*(?:<!--|\/\/|\/\*)/.test(l.text)).map((l) => hAt(d, l.line, "flash-code", `possible scripted/CSS flash mechanism: ${l.text}`, `flash-code|${l.text}`))
   ]),
+  // RGAA 7.2 — the script AND the alternative whose relevance must be judged. Inheriting
+  // WCAG 4.1.2 used to hand this criterion every ARIA-bearing element in the repository while
+  // omitting inline handlers entirely. On the realworld fixture that meant 33 unrelated
+  // anchors and none of its three scripts; Haiku correctly refused to invent an association.
+  // Keep the population narrow: scripts/handlers establish applicability, while noscript and
+  // non-text fallbacks are the concrete alternatives covered by tests 7.2.1 and 7.2.2.
+  scriptAlternatives: (docs) => docs.flatMap((d) => [
+    ...elementsByTag(d, "script").map(
+      (e) => h(
+        d,
+        e,
+        `<script${attr(e, "src") ? ` src="${attr(e, "src")}"` : ""}> \u2014 identify its alternative and compare the information or function`,
+        `script|${attr(e, "src") ?? t(e, 100)}`
+      )
+    ),
+    ...linesOf(d, /\bon[A-Z][A-Za-z]*\s*=|\son[a-z]+\s*=\s*["']/).map(
+      (l) => hAt(d, l.line, "handler", `script handler \u2014 identify any alternative offering the same information or function: ${l.text}`, `handler|${l.text}`)
+    ),
+    ...elementsByTag(d, "noscript").map(
+      (e) => h(d, e, `<noscript> alternative \u2014 does it provide content and functions similar to the associated script?`, `noscript|${t(e, 120)}`)
+    ),
+    ...d.elements.filter((e) => ["canvas", "object", "embed"].includes(e.tag) && (t(e, 120) !== "" || e.children.some((child) => child.type === "element"))).map(
+      (e) => h(
+        d,
+        e,
+        `<${e.tag}> fallback \u2014 if a script updates this non-text element, is its alternative updated and relevant?`,
+        `script-fallback|${e.tag}|${t(e, 120)}`
+      )
+    )
+  ]),
   // A change of context initiated by a script. RGAA 7.4 / WCAG 3.2.1-3.2.2.
   //
   // THE SUBJECT IS THE SCRIPT, and getting that wrong cost a release. This used to be a list of
@@ -47559,6 +47589,7 @@ var PACK_SUBJECTS = {
     // Theme 7 — scripts. "Is each script operable by keyboard AND pointer?" is about the
     // handlers and the focusable surface, never about the page's headings and lists.
     "7.1": ["aria", "pointerHandlers"],
+    "7.2": ["scriptAlternatives"],
     "7.3": ["pointerHandlers", "focusables"],
     "7.4": ["contextChange"],
     "7.5": ["liveRegions"],
@@ -47607,6 +47638,7 @@ var EXISTENCE_SUBJECTS = /* @__PURE__ */ new Set([
   "downloadDocs",
   "newWindow",
   "contextChange",
+  "scriptAlternatives",
   // A page that declares no default language has no language code for 8.4 to be about. The
   // `<html>` element is always there; the attribute is what this subject looks for.
   "declaredLang"

package/skills/ultra11y/templates/gitlab-ci.yml

@@ -27,7 +27,7 @@ variables:
   ULTRA11Y_LANG: en
   # Exact by default: a CI report must say which engine produced it. The release script keeps
   # this pin aligned with the package version; override only for a deliberate upgrade test.
-  ULTRA11Y_VERSION: '5.38.3'
+  ULTRA11Y_VERSION: '5.38.5'
   # Batches of 8 amortise the prompt; each accepted verdict is checkpointed before the next
   # batch, and later passes receive only the residue.
   ULTRA11Y_GRAIN: batch

package/src/adjudicate-subjects.ts

@@ -826,6 +826,40 @@ export const SUBJECTS: Record<string, Subject> = {
         .map((l) => hAt(d, l.line, "flash-code", `possible scripted/CSS flash mechanism: ${l.text}`, `flash-code|${l.text}`)),
     ]),
 
+  // RGAA 7.2 — the script AND the alternative whose relevance must be judged. Inheriting
+  // WCAG 4.1.2 used to hand this criterion every ARIA-bearing element in the repository while
+  // omitting inline handlers entirely. On the realworld fixture that meant 33 unrelated
+  // anchors and none of its three scripts; Haiku correctly refused to invent an association.
+  // Keep the population narrow: scripts/handlers establish applicability, while noscript and
+  // non-text fallbacks are the concrete alternatives covered by tests 7.2.1 and 7.2.2.
+  scriptAlternatives: (docs) =>
+    docs.flatMap((d) => [
+      ...elementsByTag(d, "script").map((e) =>
+        h(
+          d,
+          e,
+          `<script${attr(e, "src") ? ` src="${attr(e, "src")}"` : ""}> — identify its alternative and compare the information or function`,
+          `script|${attr(e, "src") ?? t(e, 100)}`,
+        ),
+      ),
+      ...linesOf(d, /\bon[A-Z][A-Za-z]*\s*=|\son[a-z]+\s*=\s*["']/).map((l) =>
+        hAt(d, l.line, "handler", `script handler — identify any alternative offering the same information or function: ${l.text}`, `handler|${l.text}`),
+      ),
+      ...elementsByTag(d, "noscript").map((e) =>
+        h(d, e, `<noscript> alternative — does it provide content and functions similar to the associated script?`, `noscript|${t(e, 120)}`),
+      ),
+      ...d.elements
+        .filter((e) => ["canvas", "object", "embed"].includes(e.tag) && (t(e, 120) !== "" || e.children.some((child) => child.type === "element")))
+        .map((e) =>
+          h(
+            d,
+            e,
+            `<${e.tag}> fallback — if a script updates this non-text element, is its alternative updated and relevant?`,
+            `script-fallback|${e.tag}|${t(e, 120)}`,
+          ),
+        ),
+    ]),
+
   // A change of context initiated by a script. RGAA 7.4 / WCAG 3.2.1-3.2.2.
   //
   // THE SUBJECT IS THE SCRIPT, and getting that wrong cost a release. This used to be a list of
@@ -1257,6 +1291,7 @@ export const PACK_SUBJECTS: Record<string, Record<string, string[]>> = {
     // Theme 7 — scripts. "Is each script operable by keyboard AND pointer?" is about the
     // handlers and the focusable surface, never about the page's headings and lists.
     "7.1": ["aria", "pointerHandlers"],
+    "7.2": ["scriptAlternatives"],
     "7.3": ["pointerHandlers", "focusables"],
     "7.4": ["contextChange"],
     "7.5": ["liveRegions"],
@@ -1381,6 +1416,7 @@ export const EXISTENCE_SUBJECTS: ReadonlySet<string> = new Set([
   "downloadDocs",
   "newWindow",
   "contextChange",
+  "scriptAlternatives",
   // A page that declares no default language has no language code for 8.4 to be about. The
   // `<html>` element is always there; the attribute is what this subject looks for.
   "declaredLang",

package/src/data/wcag-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-27 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-28 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "criteria": [
     {
       "id": "1.1.1",

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.38.3";
+export const VERSION = "5.38.5";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,