ultra11y 5.40.0 → 5.40.2

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page WCAG 2.2 AA / RGAA reports in Claude Code.",
-      "version": "5.40.0",
+      "version": "5.40.2",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.40.0",
+  "version": "5.40.2",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.40.0",
+  "version": "5.40.2",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.40.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.40.2";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.40.0",
+  "version": "5.40.2",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join53, relative as relative6, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.40.0";
+var VERSION = "5.40.2";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2300,7 +2300,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-28 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-31 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -5473,8 +5473,8 @@ function allIds(doc) {
 }
 function snippet(doc, el, max = 120) {
   const lineStart = doc.lineStarts[el.line - 1] ?? 0;
-  let end = doc.source.indexOf("\n", lineStart);
-  if (end === -1) end = doc.source.length;
+  const nextLineStart = doc.lineStarts[el.line];
+  const end = nextLineStart === void 0 ? doc.source.length : Math.max(lineStart, nextLineStart - 1);
   const from = Math.min(Math.max(el.start, lineStart), end);
   const tagEnd = doc.source.indexOf(">", from);
   const to = Math.min(from + max, Math.max(Math.min(end, from + max), tagEnd === -1 ? end : tagEnd + 1));
@@ -56992,7 +56992,7 @@ function judgmentGuard(r, pc) {
   return { ...r, status: "manual", judgment: true };
 }
 function measuredRescue(r, pc, cov, ran, pageId) {
-  if (r.status !== "manual" || pc.judgment || r.outOfScope || pc.automation?.completeBySilence !== true) return r;
+  if (r.status !== "manual" || pc.judgment || r.outOfScope || pc.automation && pc.automation.completeBySilence !== true) return r;
   if (!criterionMeasuredOn(pc.appliesTo?.ruleIds, pc.wcag, cov, ran)) return r;
   const { scopedOut: _scopedOut, judgment: _judgment, ...rest } = r;
   return { ...rest, status: "C", decidedBy: "scan", justification: measuredReason(pc, pageId) };
@@ -63277,6 +63277,7 @@ var VERDICT_KINDS = `Rule it (the apply gate is FAIL-CLOSED \u2014 a verdict mis
    - \`NC\` (non-conforming) \u2014 REQUIRES \`findings\`: at least one groundable \`{ file, line, selector?, message, snippet?, severity?, normativeRef }\` pointing at REAL source. The fold re-grounds every finding; an invented file:line is rejected, and so is a finding with no \`file\` at all. \`normativeRef\` MUST cite the precise failed test \u2014 under a country standard, one of the criterion's OWN numbered tests, listed in its brief under \xAB tests to rule on \xBB. A WCAG id looks alike, denotes an unrelated test, and is rejected.
    - \`NA\` (not applicable) \u2014 REQUIRES \`justification\`, AND \`citations[]\` whenever evidence WAS presented, to say which of those items fall outside the criterion's scope.
    - \`manual\` (still undecidable) \u2014 REQUIRES \`reason\`: \`needs-rendered-dom\` (only a rendered DOM can decide it, and no capture in this run carries its subject) or \`undecidable\` (the evidence cannot settle it either way).`;
+var WORKLIST_RULE = `THE WORKLIST IS THE RESIDUAL. Return exactly one verdict for EVERY criterion presented \u2014 never omit an item because the engine already reported a run-wide \`NC\`. The strict page gate deliberately puts such a criterion back on the worklist when page-level cells remain open. It is not surplus and it is not already resolved for this task: inspect the complete evidence and rule it. If the evidence cannot settle it, return \`manual\` with a reason; never leave its verdict blank.`;
 var ABSENCE_RULE = `AN NC SHAPED LIKE AN ABSENCE IS STILL ANCHORED. \xAB No second navigation system \xBB, \xAB no search engine \xBB, \xAB no error message suggests the expected format \xBB \u2014 an absence is OBSERVED somewhere: cite the element and the page you observed it on. And when the criterion's subject exists nowhere in the audited scope, the verdict is \`NA\` with its justification, never \`NC\`.
 
 AND CITE FROM THIS CRITERION'S OWN ANCHORS, NOT THE THING YOU ARE RULING OUT. An absence pulls you toward the element you are arguing ABOUT \u2014 the search form that is not a site search engine, the menu that is not a second navigation system \u2014 and that element is, precisely because it is off-topic, absent from what this criterion was harvested. A citation on one of the criterion's own anchors is vouched for by the harvest; one outside it has its snippet verified LITERALLY, character for character, and a retyping then fails. Cite the region you inspected \u2014 the \`header\`, the \`nav\`, the \`footer\` the brief listed \u2014 and say in the justification what you did not find in it.`;
@@ -63284,7 +63285,7 @@ var CAPTURE_RULE = `THE RENDERED PAGE MAY BE ON DISK. When a criterion's evidenc
 var NEVER_GUESS_RULE = `Never guess. A criterion you cannot decide from real evidence stays \`manual\` with its reason \u2014 that is a valid, honest verdict, and it is worth more than a verdict the gate throws away.`;
 var SCOPE_RULE = `Rule ONLY on the criteria presented. Never introduce another \u2014 a verdict for a criterion nobody asked about is dropped, and under the fold it would otherwise overwrite what the deterministic engine already decided.`;
 var CONFORMITY_RULE = `A \`C\` WILL BE ATTACKED, exactly as an \`NC\` is. Every conformity you record goes into an adversarial worklist where a second reader opens your citations and asks whether they ESTABLISH the criterion or merely show that its subject exists \u2014 a present \`alt\` is not a relevant \`alt\`, a present \`<title>\` is not a title that describes the page. Cite the evidence that answers the criterion's own question, and when the evidence only proves presence, the honest verdict is \`manual\`.`;
-var TAIL = [ABSENCE_RULE, CAPTURE_RULE, NEVER_GUESS_RULE, SCOPE_RULE, CONFORMITY_RULE];
+var TAIL = [WORKLIST_RULE, ABSENCE_RULE, CAPTURE_RULE, NEVER_GUESS_RULE, SCOPE_RULE, CONFORMITY_RULE];
 function verdictRulesMd(startAt) {
   const lines = [`${startAt}. ${VERDICT_KINDS}`];
   TAIL.forEach((rule, i2) => lines.push(`${startAt + 1 + i2}. ${rule}`));
@@ -63328,6 +63329,12 @@ function apiKeyFromEnv() {
 function modelFromEnv() {
   return process.env.ULTRA11Y_LLM_MODEL?.trim() || DEFAULT_MODEL;
 }
+var BudgetExceededError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BudgetExceededError";
+  }
+};
 function isProviderUnavailableError(error) {
   const message = error instanceof Error ? error.message : String(error);
   return /(?:api status|http)\s*(?:429|5\d\d)|\b429\b.*rate.?limit|rate.?limit|overload|service unavailable/i.test(message);
@@ -63480,6 +63487,7 @@ async function judgeAll(batches, opts) {
   const verdicts = [];
   const failures = [];
   let done = 0;
+  let total = batches.length;
   const queue = [...batches];
   const backend = opts.backend ?? judgeBatch;
   const lanes = Math.max(1, opts.concurrency ?? CONCURRENCY);
@@ -63497,10 +63505,18 @@ async function judgeAll(batches, opts) {
           verdicts.push(...checked.accepted);
           if (checked.accepted.length) opts.onVerdicts?.(checked.accepted);
         } catch (e) {
+          if (e instanceof BudgetExceededError && b.items.length > 1 && opts.render) {
+            const half = Math.ceil(b.items.length / 2);
+            const parts2 = [b.items.slice(0, half), b.items.slice(half)];
+            queue.unshift(...parts2.map((items) => ({ items, prompt: opts.render(items) })));
+            total += parts2.length - 1;
+            opts.onProgress?.(done, total);
+            continue;
+          }
           failures.push(e instanceof Error ? e.message : String(e));
           if (opts.abortOnError?.(e)) aborted = true;
         }
-        opts.onProgress?.(++done, batches.length);
+        opts.onProgress?.(++done, total);
       }
     })
   );
@@ -63572,7 +63588,9 @@ function claudeBin() {
 }
 function batchSchema(items) {
   const schema = structuredClone(VERDICT_TOOL.input_schema);
-  const id = schema.properties.verdicts.items.properties.criteriaId;
+  const verdicts = schema.properties.verdicts;
+  verdicts.description = `Exactly one verdict for each of these ${items.length} worklist criteria. Do not omit criteria already reported non-conforming run-wide: page-level cells may still be open.`;
+  const id = verdicts.items.properties.criteriaId;
   id.enum = items.map((i2) => i2.criteriaId);
   id.description = `The criterion id EXACTLY as given \u2014 the bare id (e.g. "1.2.1"), never the heading or the title beside it.`;
   return schema;
@@ -63704,6 +63722,14 @@ async function runCli2(argv, prompt, opts, extract) {
     }
     if (env.is_error || env.subtype !== "success") {
       lastError = `the CLI reported an error (${env.subtype ?? "unknown"}${env.api_error_status ? `, api status ${env.api_error_status}` : ""}).`;
+      if (env.subtype === "error_max_budget_usd") {
+        try {
+          const salvaged = extract(env);
+          if (Array.isArray(salvaged) ? salvaged.length > 0 : salvaged !== void 0) return salvaged;
+        } catch {
+        }
+        throw new BudgetExceededError(`ultra11y judge: ${lastError}`);
+      }
       if (env.api_error_status && (env.api_error_status === 429 || env.api_error_status >= 500)) continue;
       break;
     }
@@ -74907,6 +74933,9 @@ async function cmdJudge(p) {
     // runner with room.
     concurrency: runner === "claude" || runner === "codex" ? cliConcurrency : void 0,
     abortOnError: isProviderUnavailableError,
+    // The seam that lets a budget abort be halved rather than lost: the same renderer
+    // `batchWorklist` used, so a re-queued half is prompted exactly like a first-class batch.
+    render: render2,
     maxBudgetUsd: Number.isFinite(maxBudgetUsd) ? maxBudgetUsd : void 0,
     effort,
     timeoutMs: Number.isFinite(timeoutMs) ? timeoutMs : void 0,

package/scripts/vendor/wcag-2.2-fr.json

@@ -1,6 +1,6 @@
 {
   "source": "https://www.w3.org/Translations/WCAG22-fr/",
-  "fetchedAt": "2026-08-28",
+  "fetchedAt": "2026-08-31",
   "principles": {
     "1": "Perceptible",
     "2": "Utilisable",

package/scripts/vendor/wcag-2.2-sc-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-28 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-31 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "principles": [
     {
       "number": 1,

package/scripts/vendor/wcag-2.2-techniques.json

@@ -2,7 +2,7 @@
   "source": "https://github.com/w3c/wcag",
   "understanding": "https://www.w3.org/WAI/WCAG22/Understanding/",
   "license": "W3C Document License (code samples: W3C Software License)",
-  "fetchedAt": "2026-08-28",
+  "fetchedAt": "2026-08-31",
   "criteria": {
     "1.1.1": {
       "slug": "non-text-content",

package/scripts/vendor/wcag-2.2-text.json

@@ -1,7 +1,7 @@
 {
   "source": "https://github.com/w3c/wcag",
   "license": "W3C Document License",
-  "fetchedAt": "2026-08-28",
+  "fetchedAt": "2026-08-31",
   "criteria": {
     "1.1.1": "All non-text content that is presented to the user has a text alternative that serves the equivalent purpose, except for the situations listed below.\nControls, Input:\nIf non-text content is a control or accepts user input, then it has a name that describes its purpose. (Refer to Success Criterion 4.1.2 Name, Role, Value for additional requirements for controls and content that accepts user input.)\nTime-Based Media:\nIf non-text content is time-based media, then text alternatives at least provide descriptive identification of the non-text content. (Refer to Guideline 1.2 for additional requirements for media.)\nTest:\nIf non-text content is a test or exercise that would be invalid if presented in text, then text alternatives at least provide descriptive identification of the non-text content.\nSensory:\nIf non-text content is primarily intended to create a specific sensory experience, then text alternatives at least provide descriptive identification of the non-text content.\nCAPTCHA:\nIf the purpose of non-text content is to confirm that content is being accessed by a person rather than a computer, then text alternatives that identify and describe the purpose of the non-text content are provided, and alternative forms of CAPTCHA using output modes for different types of sensory perception are provided to accommodate different disabilities.\nDecoration, Formatting, Invisible:\nIf non-text content is pure decoration, is used only for visual formatting, or is not presented to users, then it is implemented in a way that it can be ignored by assistive technology.",
     "1.2.1": "For prerecorded audio-only and prerecorded video-only media, the following are true, except when the audio or video is a media alternative for text and is clearly labeled as such:\nPrerecorded Audio-only:\nAn alternative for time-based media is provided that presents equivalent information for prerecorded audio-only content.\nPrerecorded Video-only:\nEither an alternative for time-based media or an audio track is provided that presents equivalent information for prerecorded video-only content.",

package/skills/review-a11y/SKILL.md

@@ -3,7 +3,7 @@ name: review-a11y
 description: "Use to REVIEW changed frontend code for accessibility: staged files, a working diff, branch, or PR; prompts such as 'review a11y', 'is this accessible?', or 'anything to fix before merge?'; and hook or CI findings on a change. Run the bundled install-free engine with cross-file JSX/TSX analysis, then adjudicate candidates and return a severity-ranked WCAG 2.2 AA review with file:line fixes, residual rendering risks, and a verdict. Use `ultra11y` instead for whole-repo audits, dated conformance reports, country standards, PRD backlogs, or authoring accessible markup."
 license: MIT
 metadata:
-  version: 5.40.0
+  version: 5.40.2
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join53, relative as relative6, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.40.0";
+var VERSION = "5.40.2";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2300,7 +2300,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-28 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-31 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -5473,8 +5473,8 @@ function allIds(doc) {
 }
 function snippet(doc, el, max = 120) {
   const lineStart = doc.lineStarts[el.line - 1] ?? 0;
-  let end = doc.source.indexOf("\n", lineStart);
-  if (end === -1) end = doc.source.length;
+  const nextLineStart = doc.lineStarts[el.line];
+  const end = nextLineStart === void 0 ? doc.source.length : Math.max(lineStart, nextLineStart - 1);
   const from = Math.min(Math.max(el.start, lineStart), end);
   const tagEnd = doc.source.indexOf(">", from);
   const to = Math.min(from + max, Math.max(Math.min(end, from + max), tagEnd === -1 ? end : tagEnd + 1));
@@ -56992,7 +56992,7 @@ function judgmentGuard(r, pc) {
   return { ...r, status: "manual", judgment: true };
 }
 function measuredRescue(r, pc, cov, ran, pageId) {
-  if (r.status !== "manual" || pc.judgment || r.outOfScope || pc.automation?.completeBySilence !== true) return r;
+  if (r.status !== "manual" || pc.judgment || r.outOfScope || pc.automation && pc.automation.completeBySilence !== true) return r;
   if (!criterionMeasuredOn(pc.appliesTo?.ruleIds, pc.wcag, cov, ran)) return r;
   const { scopedOut: _scopedOut, judgment: _judgment, ...rest } = r;
   return { ...rest, status: "C", decidedBy: "scan", justification: measuredReason(pc, pageId) };
@@ -63277,6 +63277,7 @@ var VERDICT_KINDS = `Rule it (the apply gate is FAIL-CLOSED \u2014 a verdict mis
    - \`NC\` (non-conforming) \u2014 REQUIRES \`findings\`: at least one groundable \`{ file, line, selector?, message, snippet?, severity?, normativeRef }\` pointing at REAL source. The fold re-grounds every finding; an invented file:line is rejected, and so is a finding with no \`file\` at all. \`normativeRef\` MUST cite the precise failed test \u2014 under a country standard, one of the criterion's OWN numbered tests, listed in its brief under \xAB tests to rule on \xBB. A WCAG id looks alike, denotes an unrelated test, and is rejected.
    - \`NA\` (not applicable) \u2014 REQUIRES \`justification\`, AND \`citations[]\` whenever evidence WAS presented, to say which of those items fall outside the criterion's scope.
    - \`manual\` (still undecidable) \u2014 REQUIRES \`reason\`: \`needs-rendered-dom\` (only a rendered DOM can decide it, and no capture in this run carries its subject) or \`undecidable\` (the evidence cannot settle it either way).`;
+var WORKLIST_RULE = `THE WORKLIST IS THE RESIDUAL. Return exactly one verdict for EVERY criterion presented \u2014 never omit an item because the engine already reported a run-wide \`NC\`. The strict page gate deliberately puts such a criterion back on the worklist when page-level cells remain open. It is not surplus and it is not already resolved for this task: inspect the complete evidence and rule it. If the evidence cannot settle it, return \`manual\` with a reason; never leave its verdict blank.`;
 var ABSENCE_RULE = `AN NC SHAPED LIKE AN ABSENCE IS STILL ANCHORED. \xAB No second navigation system \xBB, \xAB no search engine \xBB, \xAB no error message suggests the expected format \xBB \u2014 an absence is OBSERVED somewhere: cite the element and the page you observed it on. And when the criterion's subject exists nowhere in the audited scope, the verdict is \`NA\` with its justification, never \`NC\`.
 
 AND CITE FROM THIS CRITERION'S OWN ANCHORS, NOT THE THING YOU ARE RULING OUT. An absence pulls you toward the element you are arguing ABOUT \u2014 the search form that is not a site search engine, the menu that is not a second navigation system \u2014 and that element is, precisely because it is off-topic, absent from what this criterion was harvested. A citation on one of the criterion's own anchors is vouched for by the harvest; one outside it has its snippet verified LITERALLY, character for character, and a retyping then fails. Cite the region you inspected \u2014 the \`header\`, the \`nav\`, the \`footer\` the brief listed \u2014 and say in the justification what you did not find in it.`;
@@ -63284,7 +63285,7 @@ var CAPTURE_RULE = `THE RENDERED PAGE MAY BE ON DISK. When a criterion's evidenc
 var NEVER_GUESS_RULE = `Never guess. A criterion you cannot decide from real evidence stays \`manual\` with its reason \u2014 that is a valid, honest verdict, and it is worth more than a verdict the gate throws away.`;
 var SCOPE_RULE = `Rule ONLY on the criteria presented. Never introduce another \u2014 a verdict for a criterion nobody asked about is dropped, and under the fold it would otherwise overwrite what the deterministic engine already decided.`;
 var CONFORMITY_RULE = `A \`C\` WILL BE ATTACKED, exactly as an \`NC\` is. Every conformity you record goes into an adversarial worklist where a second reader opens your citations and asks whether they ESTABLISH the criterion or merely show that its subject exists \u2014 a present \`alt\` is not a relevant \`alt\`, a present \`<title>\` is not a title that describes the page. Cite the evidence that answers the criterion's own question, and when the evidence only proves presence, the honest verdict is \`manual\`.`;
-var TAIL = [ABSENCE_RULE, CAPTURE_RULE, NEVER_GUESS_RULE, SCOPE_RULE, CONFORMITY_RULE];
+var TAIL = [WORKLIST_RULE, ABSENCE_RULE, CAPTURE_RULE, NEVER_GUESS_RULE, SCOPE_RULE, CONFORMITY_RULE];
 function verdictRulesMd(startAt) {
   const lines = [`${startAt}. ${VERDICT_KINDS}`];
   TAIL.forEach((rule, i2) => lines.push(`${startAt + 1 + i2}. ${rule}`));
@@ -63328,6 +63329,12 @@ function apiKeyFromEnv() {
 function modelFromEnv() {
   return process.env.ULTRA11Y_LLM_MODEL?.trim() || DEFAULT_MODEL;
 }
+var BudgetExceededError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BudgetExceededError";
+  }
+};
 function isProviderUnavailableError(error) {
   const message = error instanceof Error ? error.message : String(error);
   return /(?:api status|http)\s*(?:429|5\d\d)|\b429\b.*rate.?limit|rate.?limit|overload|service unavailable/i.test(message);
@@ -63480,6 +63487,7 @@ async function judgeAll(batches, opts) {
   const verdicts = [];
   const failures = [];
   let done = 0;
+  let total = batches.length;
   const queue = [...batches];
   const backend = opts.backend ?? judgeBatch;
   const lanes = Math.max(1, opts.concurrency ?? CONCURRENCY);
@@ -63497,10 +63505,18 @@ async function judgeAll(batches, opts) {
           verdicts.push(...checked.accepted);
           if (checked.accepted.length) opts.onVerdicts?.(checked.accepted);
         } catch (e) {
+          if (e instanceof BudgetExceededError && b.items.length > 1 && opts.render) {
+            const half = Math.ceil(b.items.length / 2);
+            const parts2 = [b.items.slice(0, half), b.items.slice(half)];
+            queue.unshift(...parts2.map((items) => ({ items, prompt: opts.render(items) })));
+            total += parts2.length - 1;
+            opts.onProgress?.(done, total);
+            continue;
+          }
           failures.push(e instanceof Error ? e.message : String(e));
           if (opts.abortOnError?.(e)) aborted = true;
         }
-        opts.onProgress?.(++done, batches.length);
+        opts.onProgress?.(++done, total);
       }
     })
   );
@@ -63572,7 +63588,9 @@ function claudeBin() {
 }
 function batchSchema(items) {
   const schema = structuredClone(VERDICT_TOOL.input_schema);
-  const id = schema.properties.verdicts.items.properties.criteriaId;
+  const verdicts = schema.properties.verdicts;
+  verdicts.description = `Exactly one verdict for each of these ${items.length} worklist criteria. Do not omit criteria already reported non-conforming run-wide: page-level cells may still be open.`;
+  const id = verdicts.items.properties.criteriaId;
   id.enum = items.map((i2) => i2.criteriaId);
   id.description = `The criterion id EXACTLY as given \u2014 the bare id (e.g. "1.2.1"), never the heading or the title beside it.`;
   return schema;
@@ -63704,6 +63722,14 @@ async function runCli2(argv, prompt, opts, extract) {
     }
     if (env.is_error || env.subtype !== "success") {
       lastError = `the CLI reported an error (${env.subtype ?? "unknown"}${env.api_error_status ? `, api status ${env.api_error_status}` : ""}).`;
+      if (env.subtype === "error_max_budget_usd") {
+        try {
+          const salvaged = extract(env);
+          if (Array.isArray(salvaged) ? salvaged.length > 0 : salvaged !== void 0) return salvaged;
+        } catch {
+        }
+        throw new BudgetExceededError(`ultra11y judge: ${lastError}`);
+      }
       if (env.api_error_status && (env.api_error_status === 429 || env.api_error_status >= 500)) continue;
       break;
     }
@@ -74907,6 +74933,9 @@ async function cmdJudge(p) {
     // runner with room.
     concurrency: runner === "claude" || runner === "codex" ? cliConcurrency : void 0,
     abortOnError: isProviderUnavailableError,
+    // The seam that lets a budget abort be halved rather than lost: the same renderer
+    // `batchWorklist` used, so a re-queued half is prompted exactly like a first-class batch.
+    render: render2,
     maxBudgetUsd: Number.isFinite(maxBudgetUsd) ? maxBudgetUsd : void 0,
     effort,
     timeoutMs: Number.isFinite(timeoutMs) ? timeoutMs : void 0,

package/skills/ultra11y/SKILL.md

@@ -3,7 +3,7 @@ name: ultra11y
 description: "Use to AUDIT a repository, site, or page against WCAG 2.2 AA or a country standard such as RGAA; produce a dated conformance report, criterion grid, PRD backlog, or tickets; AUTHOR accessible markup; fix accessibility; or wire a repo gate and rendered-DOM capture pipeline. The bundled install-free engine runs 93 static checks tied to success criteria, while the agent adjudicates judgment criteria and routes rendering criteria to browser scans; check/verify reject invented non-conformities. Use `review-a11y` instead for a review scoped only to a diff, branch, or PR."
 license: MIT
 metadata:
-  version: 5.40.0
+  version: 5.40.2
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup
@@ -72,6 +72,10 @@ adjudicates. So the engine's clean run is a starting point, never a verdict —
 >    grid to the same bar: a criterion failing on one route is settled for the run and may still
 >    be nobody's verdict on the routes it never fired on, which is what a per-page deliverable is
 >    actually judged on.
+>    **The emitted worklist is authoritative.** It may deliberately contain a criterion whose
+>    run-wide status is already `NC`, because that failure did not decide the criterion on the
+>    other pages. Such an item is not redundant: return one grounded verdict for it (or an
+>    explicit `manual` reason), never leave it blank because the global tally looks decided.
 > 5. **Look the criterion up; never recall it.** `criteria [--standard <pack>] <id>` — or
 >    `ultra11y_criteria` over MCP — returns the criterion's own wording, its **numbered
 >    tests**, and the glossary definitions those tests cite. RGAA 8.3 is not "the page needs a

package/skills/ultra11y/references/runbook.md

@@ -22,6 +22,9 @@ for pass in 1 2 3; do
     --model haiku --max-budget-usd <n> --concurrency 4 --ledger
 done
 
+# The worklist is authoritative. A run-wide NC may be present because other page cells remain
+# open: every emitted item gets one grounded verdict, or an explicit manual reason.
+
 # 4. A second reader puts those claims on trial, and the outcome is APPLIED.
 ultra11y report --in audits/audit-latest.json --standard rgaa --out audits
 ultra11y verify --report audits/<report>.md --in audits/audit-latest.json --out audits --max-verify 0

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join53, relative as relative6, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.40.0";
+var VERSION = "5.40.2";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2300,7 +2300,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-28 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-31 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -5473,8 +5473,8 @@ function allIds(doc) {
 }
 function snippet(doc, el, max = 120) {
   const lineStart = doc.lineStarts[el.line - 1] ?? 0;
-  let end = doc.source.indexOf("\n", lineStart);
-  if (end === -1) end = doc.source.length;
+  const nextLineStart = doc.lineStarts[el.line];
+  const end = nextLineStart === void 0 ? doc.source.length : Math.max(lineStart, nextLineStart - 1);
   const from = Math.min(Math.max(el.start, lineStart), end);
   const tagEnd = doc.source.indexOf(">", from);
   const to = Math.min(from + max, Math.max(Math.min(end, from + max), tagEnd === -1 ? end : tagEnd + 1));
@@ -56992,7 +56992,7 @@ function judgmentGuard(r, pc) {
   return { ...r, status: "manual", judgment: true };
 }
 function measuredRescue(r, pc, cov, ran, pageId) {
-  if (r.status !== "manual" || pc.judgment || r.outOfScope || pc.automation?.completeBySilence !== true) return r;
+  if (r.status !== "manual" || pc.judgment || r.outOfScope || pc.automation && pc.automation.completeBySilence !== true) return r;
   if (!criterionMeasuredOn(pc.appliesTo?.ruleIds, pc.wcag, cov, ran)) return r;
   const { scopedOut: _scopedOut, judgment: _judgment, ...rest } = r;
   return { ...rest, status: "C", decidedBy: "scan", justification: measuredReason(pc, pageId) };
@@ -63277,6 +63277,7 @@ var VERDICT_KINDS = `Rule it (the apply gate is FAIL-CLOSED \u2014 a verdict mis
    - \`NC\` (non-conforming) \u2014 REQUIRES \`findings\`: at least one groundable \`{ file, line, selector?, message, snippet?, severity?, normativeRef }\` pointing at REAL source. The fold re-grounds every finding; an invented file:line is rejected, and so is a finding with no \`file\` at all. \`normativeRef\` MUST cite the precise failed test \u2014 under a country standard, one of the criterion's OWN numbered tests, listed in its brief under \xAB tests to rule on \xBB. A WCAG id looks alike, denotes an unrelated test, and is rejected.
    - \`NA\` (not applicable) \u2014 REQUIRES \`justification\`, AND \`citations[]\` whenever evidence WAS presented, to say which of those items fall outside the criterion's scope.
    - \`manual\` (still undecidable) \u2014 REQUIRES \`reason\`: \`needs-rendered-dom\` (only a rendered DOM can decide it, and no capture in this run carries its subject) or \`undecidable\` (the evidence cannot settle it either way).`;
+var WORKLIST_RULE = `THE WORKLIST IS THE RESIDUAL. Return exactly one verdict for EVERY criterion presented \u2014 never omit an item because the engine already reported a run-wide \`NC\`. The strict page gate deliberately puts such a criterion back on the worklist when page-level cells remain open. It is not surplus and it is not already resolved for this task: inspect the complete evidence and rule it. If the evidence cannot settle it, return \`manual\` with a reason; never leave its verdict blank.`;
 var ABSENCE_RULE = `AN NC SHAPED LIKE AN ABSENCE IS STILL ANCHORED. \xAB No second navigation system \xBB, \xAB no search engine \xBB, \xAB no error message suggests the expected format \xBB \u2014 an absence is OBSERVED somewhere: cite the element and the page you observed it on. And when the criterion's subject exists nowhere in the audited scope, the verdict is \`NA\` with its justification, never \`NC\`.
 
 AND CITE FROM THIS CRITERION'S OWN ANCHORS, NOT THE THING YOU ARE RULING OUT. An absence pulls you toward the element you are arguing ABOUT \u2014 the search form that is not a site search engine, the menu that is not a second navigation system \u2014 and that element is, precisely because it is off-topic, absent from what this criterion was harvested. A citation on one of the criterion's own anchors is vouched for by the harvest; one outside it has its snippet verified LITERALLY, character for character, and a retyping then fails. Cite the region you inspected \u2014 the \`header\`, the \`nav\`, the \`footer\` the brief listed \u2014 and say in the justification what you did not find in it.`;
@@ -63284,7 +63285,7 @@ var CAPTURE_RULE = `THE RENDERED PAGE MAY BE ON DISK. When a criterion's evidenc
 var NEVER_GUESS_RULE = `Never guess. A criterion you cannot decide from real evidence stays \`manual\` with its reason \u2014 that is a valid, honest verdict, and it is worth more than a verdict the gate throws away.`;
 var SCOPE_RULE = `Rule ONLY on the criteria presented. Never introduce another \u2014 a verdict for a criterion nobody asked about is dropped, and under the fold it would otherwise overwrite what the deterministic engine already decided.`;
 var CONFORMITY_RULE = `A \`C\` WILL BE ATTACKED, exactly as an \`NC\` is. Every conformity you record goes into an adversarial worklist where a second reader opens your citations and asks whether they ESTABLISH the criterion or merely show that its subject exists \u2014 a present \`alt\` is not a relevant \`alt\`, a present \`<title>\` is not a title that describes the page. Cite the evidence that answers the criterion's own question, and when the evidence only proves presence, the honest verdict is \`manual\`.`;
-var TAIL = [ABSENCE_RULE, CAPTURE_RULE, NEVER_GUESS_RULE, SCOPE_RULE, CONFORMITY_RULE];
+var TAIL = [WORKLIST_RULE, ABSENCE_RULE, CAPTURE_RULE, NEVER_GUESS_RULE, SCOPE_RULE, CONFORMITY_RULE];
 function verdictRulesMd(startAt) {
   const lines = [`${startAt}. ${VERDICT_KINDS}`];
   TAIL.forEach((rule, i2) => lines.push(`${startAt + 1 + i2}. ${rule}`));
@@ -63328,6 +63329,12 @@ function apiKeyFromEnv() {
 function modelFromEnv() {
   return process.env.ULTRA11Y_LLM_MODEL?.trim() || DEFAULT_MODEL;
 }
+var BudgetExceededError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BudgetExceededError";
+  }
+};
 function isProviderUnavailableError(error) {
   const message = error instanceof Error ? error.message : String(error);
   return /(?:api status|http)\s*(?:429|5\d\d)|\b429\b.*rate.?limit|rate.?limit|overload|service unavailable/i.test(message);
@@ -63480,6 +63487,7 @@ async function judgeAll(batches, opts) {
   const verdicts = [];
   const failures = [];
   let done = 0;
+  let total = batches.length;
   const queue = [...batches];
   const backend = opts.backend ?? judgeBatch;
   const lanes = Math.max(1, opts.concurrency ?? CONCURRENCY);
@@ -63497,10 +63505,18 @@ async function judgeAll(batches, opts) {
           verdicts.push(...checked.accepted);
           if (checked.accepted.length) opts.onVerdicts?.(checked.accepted);
         } catch (e) {
+          if (e instanceof BudgetExceededError && b.items.length > 1 && opts.render) {
+            const half = Math.ceil(b.items.length / 2);
+            const parts2 = [b.items.slice(0, half), b.items.slice(half)];
+            queue.unshift(...parts2.map((items) => ({ items, prompt: opts.render(items) })));
+            total += parts2.length - 1;
+            opts.onProgress?.(done, total);
+            continue;
+          }
           failures.push(e instanceof Error ? e.message : String(e));
           if (opts.abortOnError?.(e)) aborted = true;
         }
-        opts.onProgress?.(++done, batches.length);
+        opts.onProgress?.(++done, total);
       }
     })
   );
@@ -63572,7 +63588,9 @@ function claudeBin() {
 }
 function batchSchema(items) {
   const schema = structuredClone(VERDICT_TOOL.input_schema);
-  const id = schema.properties.verdicts.items.properties.criteriaId;
+  const verdicts = schema.properties.verdicts;
+  verdicts.description = `Exactly one verdict for each of these ${items.length} worklist criteria. Do not omit criteria already reported non-conforming run-wide: page-level cells may still be open.`;
+  const id = verdicts.items.properties.criteriaId;
   id.enum = items.map((i2) => i2.criteriaId);
   id.description = `The criterion id EXACTLY as given \u2014 the bare id (e.g. "1.2.1"), never the heading or the title beside it.`;
   return schema;
@@ -63704,6 +63722,14 @@ async function runCli2(argv, prompt, opts, extract) {
     }
     if (env.is_error || env.subtype !== "success") {
       lastError = `the CLI reported an error (${env.subtype ?? "unknown"}${env.api_error_status ? `, api status ${env.api_error_status}` : ""}).`;
+      if (env.subtype === "error_max_budget_usd") {
+        try {
+          const salvaged = extract(env);
+          if (Array.isArray(salvaged) ? salvaged.length > 0 : salvaged !== void 0) return salvaged;
+        } catch {
+        }
+        throw new BudgetExceededError(`ultra11y judge: ${lastError}`);
+      }
       if (env.api_error_status && (env.api_error_status === 429 || env.api_error_status >= 500)) continue;
       break;
     }
@@ -74907,6 +74933,9 @@ async function cmdJudge(p) {
     // runner with room.
     concurrency: runner === "claude" || runner === "codex" ? cliConcurrency : void 0,
     abortOnError: isProviderUnavailableError,
+    // The seam that lets a budget abort be halved rather than lost: the same renderer
+    // `batchWorklist` used, so a re-queued half is prompted exactly like a first-class batch.
+    render: render2,
     maxBudgetUsd: Number.isFinite(maxBudgetUsd) ? maxBudgetUsd : void 0,
     effort,
     timeoutMs: Number.isFinite(timeoutMs) ? timeoutMs : void 0,

package/skills/ultra11y/templates/gitlab-ci.yml

@@ -27,7 +27,7 @@ variables:
   ULTRA11Y_LANG: en
   # Exact by default: a CI report must say which engine produced it. The release script keeps
   # this pin aligned with the package version; override only for a deliberate upgrade test.
-  ULTRA11Y_VERSION: '5.40.0'
+  ULTRA11Y_VERSION: '5.40.2'
   # Batches of 8 amortise the prompt; each accepted verdict is checkpointed before the next
   # batch, and later passes receive only the residue.
   ULTRA11Y_GRAIN: batch

package/src/agent-cli.ts

@@ -22,7 +22,7 @@ import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { delimiter, join } from "node:path";
 import type { AdjudicationItem } from "./adjudicate.js";
-import { VERDICT_TOOL } from "./llm.js";
+import { BudgetExceededError, VERDICT_TOOL } from "./llm.js";
 import type { LlmOptions, RawVerdict } from "./llm.js";
 import type { Lang } from "./types.js";
 import { refuteSchema, refuteSystemPrompt, type VerifyItem } from "./verify.js";
@@ -131,9 +131,21 @@ export function claudeBin(): string[] {
  *  structured output against this schema, so the wrong shape cannot come back at all. */
 export function batchSchema(items: AdjudicationItem[]): Record<string, unknown> {
   const schema = structuredClone(VERDICT_TOOL.input_schema) as {
-    properties: { verdicts: { items: { properties: { criteriaId: Record<string, unknown> } } } };
+    properties: {
+      verdicts: {
+        description?: string;
+        items: { properties: { criteriaId: Record<string, unknown> } };
+      };
+    };
   };
-  const id = schema.properties.verdicts.items.properties.criteriaId;
+  const verdicts = schema.properties.verdicts;
+  // Anthropic structured outputs support array minItems only at 0 or 1, not exact batch
+  // cardinality. Keep completeness in the shared worklist contract and repeat it beside the
+  // array the model is filling. A hard unsupported constraint could turn a useful 7/8 response
+  // into a provider error and lose all seven valid verdicts; validateBatchVerdicts deliberately
+  // preserves those seven and names the missing item for the next pass.
+  verdicts.description = `Exactly one verdict for each of these ${items.length} worklist criteria. Do not omit criteria already reported non-conforming run-wide: page-level cells may still be open.`;
+  const id = verdicts.items.properties.criteriaId;
   id.enum = items.map((i) => i.criteriaId);
   id.description = `The criterion id EXACTLY as given — the bare id (e.g. "1.2.1"), never the heading or the title beside it.`;
   return schema as unknown as Record<string, unknown>;
@@ -338,6 +350,21 @@ async function runCli<T>(argv: string[], prompt: string, opts: LlmOptions, extra
     }
     if (env.is_error || env.subtype !== "success") {
       lastError = `the CLI reported an error (${env.subtype ?? "unknown"}${env.api_error_status ? `, api status ${env.api_error_status}` : ""}).`;
+      // A BUDGET ABORT IS NOT AN EMPTY ANSWER. The ceiling can trip after the model has
+      // already produced its structured output, so LOOK before giving up — this envelope was
+      // paid for either way. `extract` is allowed to throw (usually it does: an abort with no
+      // final answer has nothing to parse), and that is the ordinary case, not an error.
+      if (env.subtype === "error_max_budget_usd") {
+        try {
+          const salvaged = extract(env);
+          if (Array.isArray(salvaged) ? salvaged.length > 0 : salvaged !== undefined) return salvaged;
+        } catch {
+          /* nothing usable in the envelope — fall through to the typed throw below */
+        }
+        // Not retried: attempt 2 is a fresh process with a fresh ceiling and the same work,
+        // so it buys the same abort at full price. Split it instead — see BudgetExceededError.
+        throw new BudgetExceededError(`ultra11y judge: ${lastError}`);
+      }
       // Only a transport fault is worth another attempt; a refusal is not.
       if (env.api_error_status && (env.api_error_status === 429 || env.api_error_status >= 500)) continue;
       break;

package/src/cli.ts

@@ -3784,6 +3784,9 @@ async function cmdJudge(p: ParsedArgs): Promise<number> {
     // runner with room.
     concurrency: runner === "claude" || runner === "codex" ? cliConcurrency : undefined,
     abortOnError: isProviderUnavailableError,
+    // The seam that lets a budget abort be halved rather than lost: the same renderer
+    // `batchWorklist` used, so a re-queued half is prompted exactly like a first-class batch.
+    render,
     maxBudgetUsd: Number.isFinite(maxBudgetUsd) ? maxBudgetUsd : undefined,
     effort,
     timeoutMs: Number.isFinite(timeoutMs) ? timeoutMs : undefined,

package/src/data/wcag-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-28 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-31 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "criteria": [
     {
       "id": "1.1.1",

package/src/llm.ts

@@ -120,6 +120,29 @@ export interface LlmOptions {
    *  without waiting out the real curve. */
   backoffMs?: (attempt: number) => number;
   onProgress?: (done: number, total: number) => void;
+  /** Re-render the prompt for an arbitrary slice of a worklist — the same function
+   *  `batchWorklist` was given. Supplying it lets `judgeAll` HALVE a batch the provider
+   *  aborted on `--max-budget-usd` and requeue both halves, because that ceiling is per
+   *  invocation: the same criteria in two calls get two ceilings. Without it a budget abort
+   *  costs the whole batch, which is the behaviour before this option existed. */
+  render?: (items: AdjudicationItem[]) => string;
+}
+
+/** The CLI stopped because `--max-budget-usd` was reached.
+ *
+ *  Typed, and not folded into the generic failure, because it is the ONE failure whose right
+ *  answer is neither "retry" nor "give up": the ceiling is per INVOCATION, so the same work
+ *  split across two invocations gets two ceilings. `judgeAll` halves the batch and requeues it,
+ *  which turns a loss of eight criteria into a loss of one.
+ *
+ *  Measured on a real run before this existed — 30 batch invocations, $38.90 spent, 12 verdicts
+ *  kept: every batch that passed the ceiling was thrown away whole, having already been paid
+ *  for. The cost is booked (`onCost` fires before this throws); only the work was lost. */
+export class BudgetExceededError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "BudgetExceededError";
+  }
 }
 
 /** Provider saturation is shared state, not a property of one criterion. Transport backends
@@ -327,6 +350,9 @@ export async function judgeAll(
   const verdicts: RawVerdict[] = [];
   const failures: string[] = [];
   let done = 0;
+  // Not `batches.length`: a budget abort splits a batch in two and requeues both, so the
+  // denominator the progress callback reports has to grow with the queue.
+  let total = batches.length;
   const queue = [...batches];
   const backend = opts.backend ?? judgeBatch;
   const lanes = Math.max(1, opts.concurrency ?? CONCURRENCY);
@@ -346,10 +372,23 @@ export async function judgeAll(
           // behind what it had already ruled on rather than nothing at all.
           if (checked.accepted.length) opts.onVerdicts?.(checked.accepted);
         } catch (e) {
+          // A BUDGET ABORT IS HALVED, NOT MOURNED. The ceiling is per invocation, so two calls
+          // get two ceilings: re-queueing the halves converts « eight criteria lost » into at
+          // worst « one criterion lost », and a batch that only just overran usually lands
+          // whole on the retry. Bounded by construction — halving 8 reaches 1 in three steps —
+          // and a single item that still overruns is a real failure, reported as one.
+          if (e instanceof BudgetExceededError && b.items.length > 1 && opts.render) {
+            const half = Math.ceil(b.items.length / 2);
+            const parts = [b.items.slice(0, half), b.items.slice(half)];
+            queue.unshift(...parts.map((items) => ({ items, prompt: opts.render!(items) })));
+            total += parts.length - 1;
+            opts.onProgress?.(done, total);
+            continue;
+          }
           failures.push(e instanceof Error ? e.message : String(e));
           if (opts.abortOnError?.(e)) aborted = true;
         }
-        opts.onProgress?.(++done, batches.length);
+        opts.onProgress?.(++done, total);
       }
     }),
   );

package/src/parse/html.ts

@@ -290,8 +290,12 @@ export function allIds(doc: Doc): { id: string; el: El }[] {
  *  its whole subtree. */
 export function snippet(doc: Doc, el: El, max = 120): string {
   const lineStart = doc.lineStarts[el.line - 1] ?? 0;
-  let end = doc.source.indexOf("\n", lineStart);
-  if (end === -1) end = doc.source.length;
+  // `lineStarts` already indexes the next line. Searching for `\n` from this line's start for
+  // EVERY finding rescanned an entire minified one-line document each time: 8k dangling-label
+  // findings × a 650 kB line turned an otherwise-linear audit quadratic. The next recorded
+  // offset gives the same boundary in O(1); on the last/only line the document end is it.
+  const nextLineStart = doc.lineStarts[el.line];
+  const end = nextLineStart === undefined ? doc.source.length : Math.max(lineStart, nextLineStart - 1);
   const from = Math.min(Math.max(el.start, lineStart), end);
   // A JSX element usually opens on one line and carries its attributes on the next ones, so
   // stopping at the line break showed "<a" and nothing else. Read to the end of the OPENING

package/src/standards/derive.ts

@@ -225,11 +225,18 @@ function judgmentGuard(r: PackCriterionResult, pc: PackCriterion): PackCriterion
  *  `judgmentGuard` then reopened as « à évaluer ». A criterion that already carries a verdict
  *  keeps it; this only ever touches `manual`.
  *
- *  Three refusals:
+ *  Four refusals:
  *   • `judgment` criteria. « All its rules were silent » does not answer a question about
  *     PERTINENCE, which is the whole reason `judgmentGuard` exists. Read from the PACK, not
  *     from the derived flag: that flag is only set when the guard actually intercepted a `C`.
  *   • `outOfScope`: no core success criterion to project from at all, which no measurement fixes.
+ *   • a criterion whose pack DECLARES an automation contract without `completeBySilence`. That
+ *     contract is the pack saying, test by test, that silence here does not prove conformity —
+ *     and it outranks a measurement that only shows the rules ran. Written as `pc.automation &&`
+ *     rather than `pc.automation?.` DELIBERATELY, and it is the same shape as `judgmentGuard`:
+ *     a pack that declares NO contract has not refused anything, so optional chaining would
+ *     read its silence as a refusal and kill this tier for every pack but RGAA — which is
+ *     exactly what it did, without a test to notice.
  *   • an ADJUDICATED verdict never reaches here — the adjudication branch returns before this.
  *     An agent that ruled « undecidable » examined the criterion and said so; a rule that
  *     measured something narrower must not overturn it. That is what keeps RGAA 11.9 (« chaque
@@ -242,7 +249,7 @@ function measuredRescue(
   ran: PageCoverage | undefined,
   pageId: string | undefined,
 ): PackCriterionResult {
-  if (r.status !== "manual" || pc.judgment || r.outOfScope || pc.automation?.completeBySilence !== true) return r;
+  if (r.status !== "manual" || pc.judgment || r.outOfScope || (pc.automation && pc.automation.completeBySilence !== true)) return r;
   if (!criterionMeasuredOn(pc.appliesTo?.ruleIds, pc.wcag, cov, ran)) return r;
   // The stale explanations go with the stale status: `scopedOut` and `judgment` say why the
   // criterion STAYED open, and it no longer is.

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.40.0";
+export const VERSION = "5.40.2";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,

package/src/verdict-rules.ts

@@ -26,6 +26,13 @@ export const VERDICT_KINDS = `Rule it (the apply gate is FAIL-CLOSED — a verdi
    - \`NA\` (not applicable) — REQUIRES \`justification\`, AND \`citations[]\` whenever evidence WAS presented, to say which of those items fall outside the criterion's scope.
    - \`manual\` (still undecidable) — REQUIRES \`reason\`: \`needs-rendered-dom\` (only a rendered DOM can decide it, and no capture in this run carries its subject) or \`undecidable\` (the evidence cannot settle it either way).`;
 
+/** The worklist, not the run-level tally, is the source of truth for what remains to rule.
+ *
+ *  Measured on the realworld fixture: the agent left 17 items blank because their decisive
+ *  failures already made the run-wide grid NC. Those items were deliberately present because
+ *  other page cells were still open; the run finished 106/106 globally and failed every page. */
+export const WORKLIST_RULE = `THE WORKLIST IS THE RESIDUAL. Return exactly one verdict for EVERY criterion presented — never omit an item because the engine already reported a run-wide \`NC\`. The strict page gate deliberately puts such a criterion back on the worklist when page-level cells remain open. It is not surplus and it is not already resolved for this task: inspect the complete evidence and rule it. If the evidence cannot settle it, return \`manual\` with a reason; never leave its verdict blank.`;
+
 /** An absence is observed somewhere. Measured: 12.1 and 12.5 lost to this on one run. */
 export const ABSENCE_RULE = `AN NC SHAPED LIKE AN ABSENCE IS STILL ANCHORED. « No second navigation system », « no search engine », « no error message suggests the expected format » — an absence is OBSERVED somewhere: cite the element and the page you observed it on. And when the criterion's subject exists nowhere in the audited scope, the verdict is \`NA\` with its justification, never \`NC\`.
 
@@ -49,7 +56,7 @@ export const SCOPE_RULE = `Rule ONLY on the criteria presented. Never introduce
 export const CONFORMITY_RULE = `A \`C\` WILL BE ATTACKED, exactly as an \`NC\` is. Every conformity you record goes into an adversarial worklist where a second reader opens your citations and asks whether they ESTABLISH the criterion or merely show that its subject exists — a present \`alt\` is not a relevant \`alt\`, a present \`<title>\` is not a title that describes the page. Cite the evidence that answers the criterion's own question, and when the evidence only proves presence, the honest verdict is \`manual\`.`;
 
 /** The clauses in the order every surface states them, after the verdict kinds. */
-const TAIL = [ABSENCE_RULE, CAPTURE_RULE, NEVER_GUESS_RULE, SCOPE_RULE, CONFORMITY_RULE];
+const TAIL = [WORKLIST_RULE, ABSENCE_RULE, CAPTURE_RULE, NEVER_GUESS_RULE, SCOPE_RULE, CONFORMITY_RULE];
 
 /** Render the rules as a numbered Markdown list starting at `startAt`.
  *