ultra11y 5.41.1 → 5.42.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page WCAG 2.2 AA / RGAA reports in Claude Code.",
-      "version": "5.41.1",
+      "version": "5.42.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.41.1",
+  "version": "5.42.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.41.1",
+  "version": "5.42.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.41.1";
+const ULTRA11Y_PLUGIN_VERSION = "5.42.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -331,12 +331,16 @@ tests**:
   41 receive candidate evidence, with overlap. One additional criterion receives only an
   advisory signal. A candidate is forwarded to adjudication and never changes a verdict by
   itself.
-- Only **8.3, 8.5 and 10.1** may earn `C` from a complete silent measurement. For the other
+- Only **8.3 and 8.5** may earn `C` from a complete silent measurement. For the other
   mechanically detectable tests, silence can mean “no subject found” or “an alternative or
-  exception still needs judging”, so it cannot prove conformity.
+  exception still needs judging”, so it cannot prove conformity. 10.1 was on that list and
+  left it: its rule tolerates `<u>`, tolerates `width`/`height` on nine tags where the
+  glossary names five, and covers “presentation built out of spaces” with two heuristics —
+  every one of them a deliberate under-report, which is the safe direction for a finding and
+  the wrong one for a conformity.
 - The remaining **228 `judgment` tests across 92 criteria** all enter the AI worklist,
   including an apparently absent subject whose `NA` still needs confirmation. Overall,
-  **103 of 106 criteria require adjudication to earn `C`**.
+  **104 of 106 criteria require adjudication to earn `C`**.
 
 The number can grow, but the useful target is **more observed, exact failures**, not a larger
 marketing count. The best next candidates are complete rendered probes for zoom/reflow and

package/dist/cypress-plugin.d.ts

@@ -1,4 +1,4 @@
-import { S as SnapshotPayload, F as FindingLike } from './payload-DvcIA6VQ.js';
+import { S as SnapshotPayload, F as FindingLike } from './payload-Bb1uQH1q.js';
 
 type On = (event: string, handler: any) => void;
 interface TaskPayload extends SnapshotPayload {

package/dist/cypress.d.ts

@@ -1,5 +1,5 @@
-import { C as CheckOptions } from './payload-DvcIA6VQ.js';
-export { s as slugify } from './payload-DvcIA6VQ.js';
+import { C as CheckOptions } from './payload-Bb1uQH1q.js';
+export { s as slugify } from './payload-Bb1uQH1q.js';
 
 interface CypressCheckOptions extends CheckOptions {
     /** Capture a viewport screenshot so the pixel tier can run. On by default — the plugin

package/dist/{payload-DvcIA6VQ.d.ts → payload-Bb1uQH1q.d.ts}

@@ -69,6 +69,21 @@ interface CheckOptions {
      *  YOUR pages, and a screen with 400 focusables should be able to say so rather than being
      *  quietly cut off at 120. */
     probes?: boolean | string[] | ProbeTuning;
+    /** Also measure 4.1.3 STATUS MESSAGES — content updated by an interaction and announced to
+     *  nobody.
+     *
+     *  Separate from `probes` because it is a different promise. The probes above stress the page
+     *  and put it back; this one FILLS its fields and toggles its controls to see what the update
+     *  lands in, and a framework that reacted to that has reacted. Restored, but observed.
+     *
+     *  Off by default here and ON in a sweep, the same asymmetry `probes` carries: a sweep exists
+     *  for nothing but recording the sample and asserts nothing afterwards. `{ clicks: true }`
+     *  additionally presses `button[type=button]` (destructive-sounding names skipped, navigation
+     *  aborts the pass) — never the default on an authenticated session, where a server mutation
+     *  is invisible to any check this side of the network. */
+    liveRegion?: boolean | {
+        clicks?: boolean;
+    };
     /** Run AXE-CORE on the page before recording it.
      *
      *  `scan` has always driven axe; your suite never did — and your suite is the only tier that

package/dist/playwright.d.ts

@@ -1,4 +1,4 @@
-import { C as CheckOptions, A as AuditLike } from './payload-DvcIA6VQ.js';
+import { C as CheckOptions, A as AuditLike } from './payload-Bb1uQH1q.js';
 
 interface PlaywrightPage {
     evaluate(script: string): Promise<unknown>;

package/dist/playwright.mjs

@@ -235,8 +235,29 @@ var TEXT_SPACING_PROBE = `(() => { ${PRELUDE}
 function focusSetupExpr(scope = "", maxFocusables = PROBE_DEFAULTS.maxFocusables) {
   const rootExpr = scope ? `document.querySelectorAll(${JSON.stringify(scope)})` : `[document.documentElement]`;
   return `(() => { ${PRELUDE}
-  const sel = 'a[href],button:not([disabled]),input:not([type=hidden]):not([disabled]),select:not([disabled]),textarea:not([disabled]),[tabindex]:not([tabindex="-1"]),[role=button]:not([disabled])';
-  const __style = (e, pseudo) => { const s = getComputedStyle(e, pseudo); return [s.outlineStyle, s.outlineWidth, s.outlineColor, s.boxShadow, s.borderColor, s.borderTopWidth, s.borderBottomWidth, s.backgroundColor, s.color, s.textDecorationLine].join('|'); };
+  // FOCUSABLE MEANS FOCUSABLE, NOT "the six tags we thought of". This list decides which
+  // elements get tagged, and since the walk may now license a conformity, an element missing
+  // from it is not merely unmeasured -- it is silently cleared. A page whose only control is a
+  // <summary> tagged nothing at all, so the count was zero, so the ring was "vacuously whole",
+  // so 2.4.7 and 2.4.11 closed without a single Tab press.
+  // (No backticks in this comment: it lives inside a template literal.)
+  const sel = 'a[href],area[href],button:not([disabled]),input:not([type=hidden]):not([disabled]),select:not([disabled]),textarea:not([disabled]),summary,iframe,audio[controls],video[controls],[contenteditable]:not([contenteditable="false"]),[tabindex]:not([tabindex="-1"]),[role=button]:not([disabled])';
+  // A BOX THAT IS ANIMATING CANNOT BE COMPARED ACROSS TIME, so it contributes a constant.
+  //
+  // The snapshot is taken before Tab and re-read after it, and the properties compared include
+  // background-color and colour \u2014 so a pseudo-element pulsing on a keyframe animation differs
+  // between the two reads for a reason that has nothing to do with focus. That reads as \xAB the
+  // focus is visible \xBB on a control that has no indicator at all: a MISSED non-conformity,
+  // strictly worse than the false positive the pseudo-element read was added to remove.
+  //
+  // A transition is not affected and must not be excluded: it only moves on a state change,
+  // so its at-rest value is stable and a focus transition is exactly what we want to see.
+  //
+  // When every part of an element is animated, both sides collapse to the same constant and
+  // the probe reports \xAB no visible change \xBB \u2014 a finding rather than a silent pass. That is the
+  // safe direction: this tool would rather name something a human can dismiss than clear
+  // something nobody will look at again.
+  const __style = (e, pseudo) => { const s = getComputedStyle(e, pseudo); if (s.animationName && s.animationName !== 'none') return 'animated'; return [s.outlineStyle, s.outlineWidth, s.outlineColor, s.boxShadow, s.borderColor, s.borderTopWidth, s.borderBottomWidth, s.backgroundColor, s.color, s.textDecorationLine].join('|'); };
   const snap = (e) => [__style(e, null), __style(e, '::before'), __style(e, '::after')].join('#');
   // Visually-hidden radio/checkbox \u2192 measure its visible label/proxy, not the input.
   const proxyFor = (e) => {
@@ -253,6 +274,7 @@ function focusSetupExpr(scope = "", maxFocusables = PROBE_DEFAULTS.maxFocusables
   for (const el of Array.from(document.querySelectorAll('[data-u11y-f],[data-u11y-fp]'))) { el.removeAttribute('data-u11y-f'); el.removeAttribute('data-u11y-fp'); }
   const roots = ${rootExpr};
   const focusables = [];
+  let total = 0;
   for (const root of Array.from(roots)) {
     if (root.matches && root.matches(sel)) focusables.push(root);
     for (const e of Array.from(root.querySelectorAll(sel))) focusables.push(e);
@@ -263,27 +285,36 @@ function focusSetupExpr(scope = "", maxFocusables = PROBE_DEFAULTS.maxFocusables
     const proxy = proxyFor(e);
     if (!proxy) continue;
     const key = 'k' + n;
+    total++;
+    if (n >= ${maxFocusables}) continue; // tagged the cap; keep COUNTING so the caller knows it was cut
     e.setAttribute('data-u11y-f', key);
     proxy.setAttribute('data-u11y-fp', key);
     window.__u11yF[key] = { rest: snap(proxy), sel: __sel(proxy), html: __html(proxy) };
     n++;
-    if (n >= ${maxFocusables}) break;
   }
-  return n;
+  return { n: n, total: total };
 })()`;
 }
 var FOCUS_CHECK_PROBE = `(() => {
   const e = document.activeElement;
+  // FOCUS LEFT THE DOCUMENT \u2014 the normal end of a tab ring, and nothing to measure.
   if (!e || e === document.body || e === document.documentElement) return null;
   const key = e.getAttribute && e.getAttribute('data-u11y-f');
-  if (!key || !window.__u11yF || !window.__u11yF[key]) return null;
+  // FOCUS IS ON SOMETHING THE SETUP NEVER TAGGED, which is a different fact entirely and used
+  // to be reported as the same one. A skip link revealed only on focus, a widget that moves
+  // focus into a node the selector does not match -- Tab crossed it, nothing measured it, and
+  // the walk went on to call itself whole. The caller needs to know the ring contained an
+  // element it cannot speak for. (No backticks here: this lives inside a template literal.)
+  if (!key || !window.__u11yF || !window.__u11yF[key]) return { untagged: true, key: '', changed: true, selector: '', html: '' };
   const rec = window.__u11yF[key];
   const proxy = document.querySelector('[data-u11y-fp="' + key + '"]') || e;
   // THE SAME THREE BOXES pass 1 snapshotted, in the same order. A design system that paints
   // its control in label::before -- DSFR, GOV.UK, USWDS, Bootstrap -- puts the focus ring
   // there too, and reading only the element would report every one of them as unfocusable.
   // (No backticks in this comment: it lives inside a template literal.)
-  const st = (pseudo) => { const s = getComputedStyle(proxy, pseudo); return [s.outlineStyle, s.outlineWidth, s.outlineColor, s.boxShadow, s.borderColor, s.borderTopWidth, s.borderBottomWidth, s.backgroundColor, s.color, s.textDecorationLine].join('|'); };
+  // Same three boxes, same animation exclusion as pass 1 -- an animating box contributes a
+  // constant on both sides, so it can never fabricate a difference (nor hide a real one).
+  const st = (pseudo) => { const s = getComputedStyle(proxy, pseudo); if (s.animationName && s.animationName !== 'none') return 'animated'; return [s.outlineStyle, s.outlineWidth, s.outlineColor, s.boxShadow, s.borderColor, s.borderTopWidth, s.borderBottomWidth, s.backgroundColor, s.color, s.textDecorationLine].join('|'); };
   const now = [st(null), st('::before'), st('::after')].join('#');
   return { key: key, changed: now !== rec.rest, selector: rec.sel, html: rec.html };
 })()`;
@@ -329,41 +360,70 @@ var FOCUS_OBSCURED_PROBE = `(() => { ${PRELUDE}
 var HOVER_SETUP_PROBE = `(() => { ${PRELUDE}
   const out = [];
   let n = 0;
+  let total = 0;
   for (const e of Array.from(document.querySelectorAll('[aria-describedby]'))) {
     const id = (e.getAttribute('aria-describedby') || '').split(/\\s+/)[0];
     if (!id) continue;
     const t = document.getElementById(id);
     if (!t) continue;
+    // THE TRIGGER ITSELF HAS TO BE THERE. 1.4.13 is about content revealed on hover or focus,
+    // and an element that is not rendered reveals nothing to anybody -- hovering it was always
+    // futile, and once an unreachable trigger started withholding the criterion, that futility
+    // would have turned into a page nobody could ever clear.
+    if (!__vis(e)) continue;
     const s = getComputedStyle(t);
     const hidden = s.display === 'none' || s.visibility === 'hidden' || t.getBoundingClientRect().height === 0;
     if (!hidden) continue;
+    total++;
+    if (n >= 10) continue; // tagged ten; keep COUNTING so the caller knows what it did not see
     const key = 'h' + n;
     e.setAttribute('data-u11y-h', key);
     out.push({ key: key, target: id, selector: __sel(e) });
     n++;
-    if (n >= 10) break;
   }
+  for (const o of out) o.total = total;
   return out;
 })()`;
 function hoverVisibleExpr(id, wantHidden = false) {
   const j = JSON.stringify(id);
   return `(() => { const t = document.getElementById(${j}); if (!t) return ${wantHidden ? "true" : "false"}; const s = getComputedStyle(t); const shown = s.display !== 'none' && s.visibility !== 'hidden' && t.getBoundingClientRect().height > 0; return ${wantHidden ? "!shown" : "shown"}; })()`;
 }
+function readSetup(raw, limits) {
+  if (typeof raw === "number") return { count: raw, capped: raw >= limits.maxFocusables };
+  const o = raw ?? {};
+  const count = o.n ?? 0;
+  return { count, capped: (o.total ?? count) > count };
+}
+function cappedRing(capped, limits) {
+  return capped ? `the setup pass stopped tagging at ${limits.maxFocusables} focusable elements (probes.maxFocusables), so everything past that was never focused and never measured` : void 0;
+}
 async function probeFocusRing(page, scope = "", limits = PROBE_DEFAULTS, deadline) {
-  const count = await page.evaluate(focusSetupExpr(scope, limits.maxFocusables));
-  if (!count) return { visible: [], obscured: [] };
+  const { count, capped } = readSetup(await page.evaluate(focusSetupExpr(scope, limits.maxFocusables)), limits);
+  if (!count) return { visible: [], obscured: [], complete: true };
   const hits = [];
   const obscured = [];
   const seen = /* @__PURE__ */ new Set();
   const limit = tabPressBudget(count, limits);
   let prevKey = null;
+  let cutShort = `the walk spent its ${limit} Tab presses without the ring ever closing, so the tail of it was never reached`;
+  let untagged = 0;
   for (let i = 0; i < limit; i++) {
-    if (deadline?.out()) break;
+    if (deadline?.out()) {
+      cutShort = `the probe budget of ${limits.budgetMs}ms ran out after ${seen.size} of the ${count} focusable elements \u2014 the rest of the ring was never focused`;
+      break;
+    }
     await page.keyboard.press("Tab");
     const r = await page.evaluate(FOCUS_CHECK_PROBE);
     if (!r) continue;
+    if (r.untagged) {
+      untagged++;
+      continue;
+    }
     if (r.key === prevKey) continue;
-    if (seen.has(r.key)) break;
+    if (seen.has(r.key)) {
+      cutShort = void 0;
+      break;
+    }
     seen.add(r.key);
     prevKey = r.key;
     if (!r.changed) {
@@ -383,9 +443,14 @@ async function probeFocusRing(page, scope = "", limits = PROBE_DEFAULTS, deadlin
         });
       }
     }
-    if (hits.length >= 20 && obscured.length >= 20) break;
+    if (hits.length >= 20 && obscured.length >= 20) {
+      cutShort = `both recording caps filled at ${seen.size} of the ${count} focusable elements \u2014 enough was found to fail the page, not enough to clear the rest of it`;
+      break;
+    }
   }
-  return { visible: hits, obscured };
+  if (cutShort && seen.size >= count) cutShort = void 0;
+  const why = cappedRing(capped, limits) ?? cutShort ?? (untagged > 0 ? `Tab crossed ${untagged} element(s) the tagging pass never matched \u2014 a control focusable in the browser but not by this selector (a skip link revealed on focus, a widget moving focus into an untagged node). They were never compared, so this page is not cleared` : void 0);
+  return { visible: hits, obscured, complete: !why, ...why ? { why } : {} };
 }
 var NATIVE_SEGMENT_STOPS = {
   date: 5,
@@ -405,53 +470,85 @@ var FOCUS_WHERE_PROBE = `(() => { ${PRELUDE}
   const type = e.tagName === 'INPUT' ? (e.getAttribute('type') || 'text').toLowerCase() : '';
   return { key: key || __sel(e), tagged: !!key, selector: __sel(e), html: __html(e), segments: stops[type] || 1 };
 })()`;
-async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
-  const count = await page.evaluate(focusSetupExpr("", limits.maxFocusables));
-  if (!count || count < 2) return [];
+async function probeKeyboardTrapRing(page, limits = PROBE_DEFAULTS, deadline) {
+  const { count, capped } = readSetup(await page.evaluate(focusSetupExpr("", limits.maxFocusables)), limits);
+  if (!count || count < 2) return { hits: [], complete: true };
   const hits = [];
   const seen = /* @__PURE__ */ new Set();
   const confirmPresses = 2;
   const limit = tabPressBudget(count, limits);
   let prev = null;
+  let cutShort = `the walk spent its ${limit} Tab presses without the ring ever closing, so the tail of it was never reached`;
   for (let i = 0; i < limit; i++) {
-    if (deadline?.out()) break;
+    if (deadline?.out()) {
+      cutShort = `the probe budget of ${limits.budgetMs}ms ran out after ${seen.size} of the ${count} focusable elements \u2014 the rest of the ring was never walked`;
+      break;
+    }
     await page.keyboard.press("Tab");
     const now = await page.evaluate(FOCUS_WHERE_PROBE);
-    if (!now) break;
+    if (!now) {
+      cutShort = void 0;
+      break;
+    }
     if (prev?.tagged && now.tagged && now.key === prev.key) {
       const budget = Math.max(confirmPresses, (now.segments ?? 1) - 1);
       let stuck = true;
+      let confirmed = true;
       for (let k = 0; k < budget && stuck; k++) {
-        if (deadline?.out()) break;
+        if (deadline?.out()) {
+          confirmed = false;
+          break;
+        }
         await page.keyboard.press("Tab");
         const again = await page.evaluate(FOCUS_WHERE_PROBE);
         stuck = again !== null && again.tagged === true && again.key === now.key;
       }
+      if (!confirmed) {
+        cutShort = `the probe budget of ${limits.budgetMs}ms ran out while confirming whether focus could leave ${now.selector} \u2014 an unconfirmed suspicion is not a non-conformity`;
+        break;
+      }
       if (stuck) {
         hits.push({
           selector: now.selector,
           html: now.html,
           detail: `Le focus reste sur cet \xE9l\xE9ment apr\xE8s ${1 + budget} appuis sur Tab, alors que la page compte ${count} \xE9l\xE9ments focalisables \u2014 pi\xE8ge au clavier (2.1.2).`
         });
+        cutShort = void 0;
         break;
       }
     }
     if (now.key !== prev?.key) {
-      if (seen.has(now.key)) break;
+      if (seen.has(now.key)) {
+        cutShort = void 0;
+        break;
+      }
       seen.add(now.key);
     }
     prev = now;
   }
-  return hits;
+  if (cutShort && seen.size >= count) cutShort = void 0;
+  const why = cappedRing(capped, limits) ?? cutShort;
+  return { hits, complete: !why, ...why ? { why } : {} };
 }
-async function probeHover(page, limits = PROBE_DEFAULTS, deadline) {
-  const triggers = await page.evaluate(HOVER_SETUP_PROBE);
+async function probeHoverWalk(page, limits = PROBE_DEFAULTS, deadline) {
+  const setup = await page.evaluate(HOVER_SETUP_PROBE);
+  const triggers = setup;
   const hits = [];
-  for (const tr of triggers.slice(0, Math.max(1, limits.maxTriggers))) {
-    if (deadline?.out()) break;
+  let cutShort;
+  let unreachable = 0;
+  const tried = triggers.slice(0, Math.max(1, limits.maxTriggers));
+  if (tried.length < triggers.length) {
+    cutShort = `only ${tried.length} of the ${triggers.length} hover triggers on this page were opened (probes.maxTriggers) \u2014 the rest were never asked whether Escape dismisses them`;
+  }
+  for (const tr of tried) {
+    if (deadline?.out()) {
+      cutShort = `the probe budget of ${limits.budgetMs}ms ran out with triggers left unopened`;
+      break;
+    }
     try {
       await page.hover(`[data-u11y-h="${tr.key}"]`, { timeout: actionTimeout(limits, deadline) });
     } catch {
+      unreachable++;
       continue;
     }
     await page.waitForTimeout(150);
@@ -469,9 +566,14 @@ async function probeHover(page, limits = PROBE_DEFAULTS, deadline) {
         detail: `Le contenu r\xE9v\xE9l\xE9 au survol (aria-describedby #${tr.target}) ne se masque pas avec \xC9chap \u2014 Contenu au survol ou au focus (1.4.13).`
       });
     }
-    if (hits.length >= Math.min(limits.maxHits, 8)) break;
+    if (hits.length >= Math.min(limits.maxHits, 8)) {
+      cutShort = "the recording cap filled with triggers left unopened \u2014 enough was found to fail the page, not enough to clear the rest of it";
+      break;
+    }
   }
-  return hits;
+  const capped = setup[0]?.total;
+  const why = cutShort ?? (typeof capped === "number" && capped > triggers.length ? `only ${triggers.length} of the ${capped} hover triggers on this page were tagged \u2014 the rest were never opened` : void 0) ?? (unreachable > 0 ? `${unreachable} hover trigger(s) never became actionable, so their content was never opened or dismissed` : void 0);
+  return { hits, complete: !why, ...why ? { why } : {} };
 }
 async function runLiveProbes(page, opts = {}) {
   const limits = { ...PROBE_DEFAULTS, ...opts.limits };
@@ -569,26 +671,184 @@ async function runLiveProbes(page, opts = {}) {
     if (r) {
       out.focusVisible = r.visible;
       out.focusObscured = r.obscured;
-      if (want("2.4.7")) out.probed.push("2.4.7");
-      if (want("2.4.11")) out.probed.push("2.4.11");
+      for (const sc of ["2.4.7", "2.4.11"]) {
+        if (!want(sc)) continue;
+        if (r.complete) out.probed.push(sc);
+        else skip(sc, r.why ?? "the walk of the tab ring did not cross the whole of it");
+      }
     }
   }
   if (want("2.1.2") && canType) {
-    const r = await bounded("2.1.2", () => probeKeyboardTrap(page, limits, deadline));
+    const r = await bounded("2.1.2", () => probeKeyboardTrapRing(page, limits, deadline));
     if (r) {
-      out.keyboardTrap = r;
-      out.probed.push("2.1.2");
+      out.keyboardTrap = r.hits;
+      if (r.complete) out.probed.push("2.1.2");
+      else skip("2.1.2", r.why ?? "the walk of the tab ring did not cross the whole of it");
     }
   }
   if (want("1.4.13") && canHover && canType) {
-    const r = await bounded("1.4.13", () => probeHover(page, limits, deadline));
+    const r = await bounded("1.4.13", () => probeHoverWalk(page, limits, deadline));
     if (r) {
-      out.hover = r;
-      out.probed.push("1.4.13");
+      out.hover = r.hits;
+      if (r.complete) out.probed.push("1.4.13");
+      else skip("1.4.13", r.why ?? "the hover pass did not open every trigger on the page");
+    }
+  }
+  if (want("4.1.3") && opts.liveRegion) {
+    const clicks = typeof opts.liveRegion === "object" && opts.liveRegion.clicks === true;
+    const r = await bounded("4.1.3", () => probeLiveRegion(page, opts.lang ?? "fr", clicks));
+    if (r) {
+      out.liveRegion = r.hits;
+      if (r.complete) out.probed.push("4.1.3");
+      else skip("4.1.3", r.why ?? "the live-region pass did not exercise the whole page");
     }
   }
   return out;
 }
+var DESTRUCTIVE_NAME_RE = "\\b(supprim|retir|effac|envoy|valid|confirm|pay|achet|command|delete|remove|eras|clear|send|submit|buy|order)";
+function liveRegionExpr(detail, allowClicks) {
+  const d = JSON.stringify(detail);
+  const clickLoop = allowClicks ? `
+  // click button[type=button] only (never a submit/link), skipping destructive names
+  const dangerous = new RegExp(${JSON.stringify(DESTRUCTIVE_NAME_RE)}, 'i');
+  const nameOf = (b) => {
+    let n = (b.getAttribute('aria-label') || '') + ' ' + (b.textContent || '') + ' ' + (b.getAttribute('title') || '');
+    // ALL aria-labelledby ids (attribute trimmed): a destructive verb may sit in ANY
+    // referenced id, and the value may carry stray leading/trailing whitespace.
+    for (const id of (b.getAttribute('aria-labelledby') || '').trim().split(/\\s+/)) {
+      if (!id) continue;
+      const t = document.getElementById(id);
+      if (t) n += ' ' + (t.textContent || '');
+    }
+    // Icon-only buttons: the name lives in img[alt] (an attribute \u2014 invisible to
+    // textContent) or an svg <title> (belt-and-braces; textContent usually includes it).
+    for (const im of Array.from(b.querySelectorAll('img[alt]'))) n += ' ' + (im.getAttribute('alt') || '');
+    for (const ti of Array.from(b.querySelectorAll('svg title'))) n += ' ' + (ti.textContent || '');
+    return n;
+  };
+  for (const b of Array.from(document.querySelectorAll('button[type="button"]'))) {
+    if (count >= 20 || hits.length >= 10) { untried += 1; continue; }
+    if (b.disabled || !__vis(b)) continue;
+    if (dangerous.test(nameOf(b))) { untried += 1; continue; } // defense-in-depth: never click a destructive-named button
+    const before = location.href;
+    try { b.click(); } catch (_) {}
+    await settle();
+    if (location.href !== before) { obs.disconnect(); return { hits: hits, untried: untried, navigated: true }; }
+    drain();
+    count++;
+  }` : `
+  // CLICKS DISABLED, and the buttons are counted rather than ignored. A status message very
+  // often appears after a button press and nothing else, so a pass that never pressed one has
+  // not measured 4.1.3 on this page -- it has measured the fields. Reporting how many it
+  // declined is what lets the caller withhold the credit instead of publishing silence.
+  for (const b of Array.from(document.querySelectorAll('button[type="button"]'))) {
+    if (!b.disabled && __vis(b)) untried += 1;
+  }`;
+  return `(async () => { ${PRELUDE}
+  const isLive = (node) => {
+    let el = node && node.nodeType === 1 ? node : (node ? node.parentElement : null);
+    while (el && el !== document.documentElement) {
+      const live = (el.getAttribute && el.getAttribute('aria-live')) || '';
+      const role = (el.getAttribute && el.getAttribute('role')) || '';
+      if (live === 'polite' || live === 'assertive') return true;
+      if (role === 'status' || role === 'alert' || role === 'log') return true;
+      el = el.parentElement;
+    }
+    return false;
+  };
+  const hits = [];
+  const seen = new Set();
+  const records = [];
+  const obs = new MutationObserver((muts) => { for (const m of muts) records.push(m); });
+  obs.observe(document.body, { subtree: true, childList: true, characterData: true });
+  const settle = () => new Promise((r) => setTimeout(r, 40));
+  const drain = () => {
+    for (const m of records.splice(0)) {
+      const targets = m.type === 'characterData' ? [m.target] : Array.from(m.addedNodes);
+      for (const t of targets) {
+        if (!t || (t.textContent || '').trim().length === 0) continue;
+        if (isLive(t)) continue;
+        const host = t.nodeType === 1 ? t : t.parentElement;
+        if (!host || !__vis(host)) continue;
+        const key = __sel(host);
+        if (seen.has(key)) continue;
+        seen.add(key);
+        hits.push({ selector: key, html: __html(host), detail: ${d} });
+      }
+    }
+  };
+  let count = 0;
+  // How many candidate interactions this pass did NOT perform -- caps, a destructive-sounding
+  // name, clicks turned off. A probe that skipped half a page has not measured it, and the
+  // caller may not read its silence as conformity.
+  let untried = 0;${clickLoop}
+  // toggle checkbox/radio, then restore
+  for (const t of Array.from(document.querySelectorAll('input[type="checkbox"], input[type="radio"]'))) {
+    if (count >= 40 || hits.length >= 10) { untried += 1; continue; }
+    if (t.disabled || !__vis(t)) continue;
+    const before = location.href;
+    const prev = t.checked;
+    // A RADIO IS NOT A CHECKBOX: clicking one UNCHECKS its pair, and restoring only the one we
+    // clicked left the group with nothing selected -- a form the caller's next assertion, or
+    // the user, finds broken. Remember which member of the group was checked and put THAT back.
+    let group = null;
+    if (t.type === 'radio' && t.name) {
+      try {
+        const form = t.form || document;
+        for (const r of Array.from(form.querySelectorAll('input[type="radio"]'))) { if (r.name === t.name && r.checked) { group = r; break; } }
+      } catch (_) {}
+    }
+    try { t.click(); } catch (_) {}
+    await settle();
+    if (location.href !== before) { obs.disconnect(); return { hits: hits, untried: untried, navigated: true }; }
+    drain();
+    try {
+      if (group) { if (!group.checked) { group.checked = true; group.dispatchEvent(new Event('change', { bubbles: true })); } }
+      else if (t.checked !== prev) { t.checked = prev; t.dispatchEvent(new Event('change', { bubbles: true })); }
+    } catch (_) {}
+    count++;
+  }
+  // fill text inputs, then restore
+  for (const inp of Array.from(document.querySelectorAll('input[type="text"], input[type="email"], input[type="search"], textarea'))) {
+    if (count >= 60 || hits.length >= 10) { untried += 1; continue; }
+    if (inp.disabled || inp.readOnly || !__vis(inp)) continue;
+    const before = location.href;
+    const prev = inp.value == null ? '' : String(inp.value);
+    try { inp.value = 'test 123'; inp.dispatchEvent(new Event('input', { bubbles: true })); inp.dispatchEvent(new Event('change', { bubbles: true })); } catch (_) {}
+    await settle();
+    if (location.href !== before) { obs.disconnect(); return { hits: hits, untried: untried, navigated: true }; }
+    drain();
+    try { inp.value = prev; inp.dispatchEvent(new Event('input', { bubbles: true })); } catch (_) {}
+    count++;
+  }
+  obs.disconnect();
+  return { hits: hits.slice(0, 10), untried: untried, navigated: false };
+})()`;
+}
+var LIVE_REGION_DETAIL = {
+  fr: "Mise \xE0 jour de contenu d\xE9clench\xE9e par une interaction hors d'une r\xE9gion live (aria-live / role=status|alert|log) \u2014 probablement non restitu\xE9e aux technologies d'assistance.",
+  en: "Content update triggered by an interaction outside any live region (aria-live / role=status|alert|log) \u2014 likely not announced to assistive technology."
+};
+async function probeLiveRegion(page, lang, allowClicks) {
+  const detail = LIVE_REGION_DETAIL[lang] ?? LIVE_REGION_DETAIL.en;
+  const r = await page.evaluate(liveRegionExpr(detail, allowClicks));
+  const hits = r?.hits ?? [];
+  if (r?.navigated) {
+    return {
+      hits,
+      complete: false,
+      why: "an interaction navigated away mid-pass \u2014 everything after it happened on another page, and this one was not finished"
+    };
+  }
+  if (r?.untried > 0) {
+    return {
+      hits,
+      complete: false,
+      why: `${r.untried} interactive element(s) were never exercised (clicks disabled, a destructive-sounding name, or a cap) \u2014 a status message that only appears after one of them would not have been seen`
+    };
+  }
+  return { hits, complete: true };
+}
 var REMOVE_TEXT_SPACING_STEP = `(() => {
   const sheets = Array.from(document.querySelectorAll('style'));
   for (const s of sheets) {
@@ -797,7 +1057,7 @@ async function checkA11y(page, opts = {}) {
   let probes;
   if (opts.probes) {
     try {
-      probes = await runLiveProbes(page, probeOptions(opts.probes));
+      probes = await runLiveProbes(page, { ...probeOptions(opts.probes), ...opts.liveRegion ? { liveRegion: opts.liveRegion } : {} });
     } catch (e) {
       console.warn(
         `ultra11y: the live probes failed on this page \u2014 ${e instanceof Error ? e.message : String(e)}. The snapshot was still recorded; the criteria they decide stay to assess.`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.41.1",
+  "version": "5.42.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/build-pack-rgaa.mjs

@@ -395,7 +395,31 @@ const CANDIDATE_RULE_TESTS = {
   "13.8|axe:marquee": ["1"],
 };
 
-const COMPLETE_BY_SILENCE = new Set(["8.3", "8.5", "10.1"]);
+// WHICH CRITERIA MAY BE CONCLUDED FROM A CLEAN ENGINE PASS — the shortest list in this file,
+// and the one that decides whether silence is evidence.
+//
+// 10.1 LEFT IT, and the correction goes the expensive way round: this criterion now reaches an
+// adjudicator on every run it did not reach before. It is there because the rule behind it
+// (src/rules/presentation.ts) is deliberately NARROWER than the criterion it serves, and each
+// narrowing was the right call on its own:
+//
+//   • `<u>` is excluded wholesale, because the RGAA forbids it only outside HTML5 and flagging
+//     it would manufacture a non-conformity on conforming markup;
+//   • `width`/`height` are tolerated on nine tags where the glossary names five, because
+//     `<video width>` and `<iframe width>` are conforming HTML5 and red-flagging them would
+//     fail ordinary accessible markup;
+//   • test 10.1.3 — presentation built out of spaces — is TWO heuristics (a word spelled one
+//     letter at a time, three or more non-breaking spaces), chosen because they are
+//     distinctive enough not to guess.
+//
+// Every one of those is a deliberate under-report, which is the safe direction for a FINDING
+// and the wrong one for a CONFORMITY. « This rule found nothing » and « this criterion is
+// satisfied » are not the same claim when the rule was written to look at less than the
+// criterion asks about.
+//
+// Nothing was added to this list to compensate. The budget lever is the verdict ledger
+// (src/ledger.ts), not a wider definition of what silence proves.
+const COMPLETE_BY_SILENCE = new Set(["8.3", "8.5"]);
 const renderedTier = (ruleId) =>
   ruleId.startsWith("rendered-") || ruleId.startsWith("dyn-") || ruleId.startsWith("axe:") ? "rendered" : "static";
 const mergeTestTier = (current, next) => (current === "static" || next === "static" ? "static" : next);