ultra11y 5.41.2 → 5.42.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page WCAG 2.2 AA / RGAA reports in Claude Code.",
-      "version": "5.41.2",
+      "version": "5.42.1",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.41.2",
+  "version": "5.42.1",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.41.2",
+  "version": "5.42.1",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.41.2";
+const ULTRA11Y_PLUGIN_VERSION = "5.42.1";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -331,12 +331,16 @@ tests**:
   41 receive candidate evidence, with overlap. One additional criterion receives only an
   advisory signal. A candidate is forwarded to adjudication and never changes a verdict by
   itself.
-- Only **8.3, 8.5 and 10.1** may earn `C` from a complete silent measurement. For the other
+- Only **8.3 and 8.5** may earn `C` from a complete silent measurement. For the other
   mechanically detectable tests, silence can mean “no subject found” or “an alternative or
-  exception still needs judging”, so it cannot prove conformity.
+  exception still needs judging”, so it cannot prove conformity. 10.1 was on that list and
+  left it: its rule tolerates `<u>`, tolerates `width`/`height` on nine tags where the
+  glossary names five, and covers “presentation built out of spaces” with two heuristics —
+  every one of them a deliberate under-report, which is the safe direction for a finding and
+  the wrong one for a conformity.
 - The remaining **228 `judgment` tests across 92 criteria** all enter the AI worklist,
   including an apparently absent subject whose `NA` still needs confirmation. Overall,
-  **103 of 106 criteria require adjudication to earn `C`**.
+  **104 of 106 criteria require adjudication to earn `C`**.
 
 The number can grow, but the useful target is **more observed, exact failures**, not a larger
 marketing count. The best next candidates are complete rendered probes for zoom/reflow and

package/dist/cypress-plugin.d.ts

@@ -1,4 +1,4 @@
-import { S as SnapshotPayload, F as FindingLike } from './payload-DvcIA6VQ.js';
+import { S as SnapshotPayload, F as FindingLike } from './payload-BMFQTm5s.js';
 
 type On = (event: string, handler: any) => void;
 interface TaskPayload extends SnapshotPayload {

package/dist/cypress.d.ts

@@ -1,5 +1,5 @@
-import { C as CheckOptions } from './payload-DvcIA6VQ.js';
-export { s as slugify } from './payload-DvcIA6VQ.js';
+import { C as CheckOptions } from './payload-BMFQTm5s.js';
+export { s as slugify } from './payload-BMFQTm5s.js';
 
 interface CypressCheckOptions extends CheckOptions {
     /** Capture a viewport screenshot so the pixel tier can run. On by default — the plugin

package/dist/{payload-DvcIA6VQ.d.ts → payload-BMFQTm5s.d.ts}

@@ -69,6 +69,24 @@ interface CheckOptions {
      *  YOUR pages, and a screen with 400 focusables should be able to say so rather than being
      *  quietly cut off at 120. */
     probes?: boolean | string[] | ProbeTuning;
+    /** Also measure 4.1.3 STATUS MESSAGES — content updated by an interaction and announced to
+     *  nobody.
+     *
+     *  Separate from `probes` because it is a different promise. The probes above stress the page
+     *  and put it back; this one FILLS its fields and toggles its controls to see what the update
+     *  lands in, and a framework that reacted to that has reacted. Restored, but observed.
+     *
+     *  Off by default here and ON in a sweep, the same asymmetry `probes` carries: a sweep exists
+     *  for nothing but recording the sample and asserts nothing afterwards. `{ clicks: true }`
+     *  additionally presses `button[type=button]` (destructive-sounding names skipped, navigation
+     *  aborts the pass) — never the default on an authenticated session, where a server mutation
+     *  is invisible to any check this side of the network.
+     *
+     *  PLAYWRIGHT ONLY, like `probes` beside it: the Cypress integration records a page and runs
+     *  no live probe at all, so both are inert there. Stated rather than left to be discovered. */
+    liveRegion?: boolean | {
+        clicks?: boolean;
+    };
     /** Run AXE-CORE on the page before recording it.
      *
      *  `scan` has always driven axe; your suite never did — and your suite is the only tier that

package/dist/playwright.d.ts

@@ -1,4 +1,4 @@
-import { C as CheckOptions, A as AuditLike } from './payload-DvcIA6VQ.js';
+import { C as CheckOptions, A as AuditLike } from './payload-BMFQTm5s.js';
 
 interface PlaywrightPage {
     evaluate(script: string): Promise<unknown>;

package/dist/playwright.mjs

@@ -133,6 +133,7 @@ var COLLECT_SNAPSHOT = `(() => {
 })()`;
 
 // src/probes.ts
+var PROBES_VERSION = 2;
 var PRELUDE = `
 const __sel = (e) => {
   if (!e || !e.tagName) return '\u2014';
@@ -235,7 +236,23 @@ var TEXT_SPACING_PROBE = `(() => { ${PRELUDE}
 function focusSetupExpr(scope = "", maxFocusables = PROBE_DEFAULTS.maxFocusables) {
   const rootExpr = scope ? `document.querySelectorAll(${JSON.stringify(scope)})` : `[document.documentElement]`;
   return `(() => { ${PRELUDE}
-  const sel = 'a[href],button:not([disabled]),input:not([type=hidden]):not([disabled]),select:not([disabled]),textarea:not([disabled]),[tabindex]:not([tabindex="-1"]),[role=button]:not([disabled])';
+  // FOCUSABLE MEANS FOCUSABLE, NOT "the six tags we thought of". This list decides which
+  // elements get tagged, and since the walk may now license a conformity, an element missing
+  // from it is not merely unmeasured -- it is silently cleared. A page whose only control is a
+  // <summary> tagged nothing at all, so the count was zero, so the ring was "vacuously whole",
+  // so 2.4.7 and 2.4.11 closed without a single Tab press.
+  //
+  // AND NOT iframe / audio[controls] / video[controls], which were here for one release and
+  // had to come back out. They are genuinely focusable, but their focus lives in another
+  // document: everything below reads the PARENT'S activeElement, which stays the host element
+  // press after press while the user tabs through the controls inside. The trap walk reads
+  // exactly that as a cage, so an ordinary page with a video player, a payment frame, a map or
+  // a support widget was reported as a bloquant 2.1.2 -- a blocker manufactured out of our own
+  // blindness, able to fail somebody else's gate. The measurement we cannot make is not a
+  // finding; Tab still crosses them, the walk still records that it crossed something it never
+  // measured, and the page is not cleared either.
+  // (No backticks in this comment: it lives inside a template literal.)
+  const sel = 'a[href],area[href],button:not([disabled]),input:not([type=hidden]):not([disabled]),select:not([disabled]),textarea:not([disabled]),summary,[contenteditable]:not([contenteditable="false"]),[tabindex]:not([tabindex="-1"]),[role=button]:not([disabled])';
   // A BOX THAT IS ANIMATING CANNOT BE COMPARED ACROSS TIME, so it contributes a constant.
   //
   // The snapshot is taken before Tab and re-read after it, and the properties compared include
@@ -268,6 +285,7 @@ function focusSetupExpr(scope = "", maxFocusables = PROBE_DEFAULTS.maxFocusables
   for (const el of Array.from(document.querySelectorAll('[data-u11y-f],[data-u11y-fp]'))) { el.removeAttribute('data-u11y-f'); el.removeAttribute('data-u11y-fp'); }
   const roots = ${rootExpr};
   const focusables = [];
+  let total = 0;
   for (const root of Array.from(roots)) {
     if (root.matches && root.matches(sel)) focusables.push(root);
     for (const e of Array.from(root.querySelectorAll(sel))) focusables.push(e);
@@ -278,20 +296,27 @@ function focusSetupExpr(scope = "", maxFocusables = PROBE_DEFAULTS.maxFocusables
     const proxy = proxyFor(e);
     if (!proxy) continue;
     const key = 'k' + n;
+    total++;
+    if (n >= ${maxFocusables}) continue; // tagged the cap; keep COUNTING so the caller knows it was cut
     e.setAttribute('data-u11y-f', key);
     proxy.setAttribute('data-u11y-fp', key);
     window.__u11yF[key] = { rest: snap(proxy), sel: __sel(proxy), html: __html(proxy) };
     n++;
-    if (n >= ${maxFocusables}) break;
   }
-  return n;
+  return { n: n, total: total };
 })()`;
 }
 var FOCUS_CHECK_PROBE = `(() => {
   const e = document.activeElement;
+  // FOCUS LEFT THE DOCUMENT \u2014 the normal end of a tab ring, and nothing to measure.
   if (!e || e === document.body || e === document.documentElement) return null;
   const key = e.getAttribute && e.getAttribute('data-u11y-f');
-  if (!key || !window.__u11yF || !window.__u11yF[key]) return null;
+  // FOCUS IS ON SOMETHING THE SETUP NEVER TAGGED, which is a different fact entirely and used
+  // to be reported as the same one. A skip link revealed only on focus, a widget that moves
+  // focus into a node the selector does not match -- Tab crossed it, nothing measured it, and
+  // the walk went on to call itself whole. The caller needs to know the ring contained an
+  // element it cannot speak for. (No backticks here: this lives inside a template literal.)
+  if (!key || !window.__u11yF || !window.__u11yF[key]) return { untagged: true, key: '', changed: true, selector: '', html: '' };
   const rec = window.__u11yF[key];
   const proxy = document.querySelector('[data-u11y-fp="' + key + '"]') || e;
   // THE SAME THREE BOXES pass 1 snapshotted, in the same order. A design system that paints
@@ -346,41 +371,70 @@ var FOCUS_OBSCURED_PROBE = `(() => { ${PRELUDE}
 var HOVER_SETUP_PROBE = `(() => { ${PRELUDE}
   const out = [];
   let n = 0;
+  let total = 0;
   for (const e of Array.from(document.querySelectorAll('[aria-describedby]'))) {
     const id = (e.getAttribute('aria-describedby') || '').split(/\\s+/)[0];
     if (!id) continue;
     const t = document.getElementById(id);
     if (!t) continue;
+    // THE TRIGGER ITSELF HAS TO BE THERE. 1.4.13 is about content revealed on hover or focus,
+    // and an element that is not rendered reveals nothing to anybody -- hovering it was always
+    // futile, and once an unreachable trigger started withholding the criterion, that futility
+    // would have turned into a page nobody could ever clear.
+    if (!__vis(e)) continue;
     const s = getComputedStyle(t);
     const hidden = s.display === 'none' || s.visibility === 'hidden' || t.getBoundingClientRect().height === 0;
     if (!hidden) continue;
+    total++;
+    if (n >= 10) continue; // tagged ten; keep COUNTING so the caller knows what it did not see
     const key = 'h' + n;
     e.setAttribute('data-u11y-h', key);
     out.push({ key: key, target: id, selector: __sel(e) });
     n++;
-    if (n >= 10) break;
   }
+  for (const o of out) o.total = total;
   return out;
 })()`;
 function hoverVisibleExpr(id, wantHidden = false) {
   const j = JSON.stringify(id);
   return `(() => { const t = document.getElementById(${j}); if (!t) return ${wantHidden ? "true" : "false"}; const s = getComputedStyle(t); const shown = s.display !== 'none' && s.visibility !== 'hidden' && t.getBoundingClientRect().height > 0; return ${wantHidden ? "!shown" : "shown"}; })()`;
 }
+function readSetup(raw, limits) {
+  if (typeof raw === "number") return { count: raw, capped: raw >= limits.maxFocusables };
+  const o = raw ?? {};
+  const count = o.n ?? 0;
+  return { count, capped: (o.total ?? count) > count };
+}
+function cappedRing(capped, limits) {
+  return capped ? `the setup pass stopped tagging at ${limits.maxFocusables} focusable elements (probes.maxFocusables), so everything past that was never focused and never measured` : void 0;
+}
 async function probeFocusRing(page, scope = "", limits = PROBE_DEFAULTS, deadline) {
-  const count = await page.evaluate(focusSetupExpr(scope, limits.maxFocusables));
-  if (!count) return { visible: [], obscured: [] };
+  const { count, capped } = readSetup(await page.evaluate(focusSetupExpr(scope, limits.maxFocusables)), limits);
+  if (!count) return { visible: [], obscured: [], complete: true };
   const hits = [];
   const obscured = [];
   const seen = /* @__PURE__ */ new Set();
   const limit = tabPressBudget(count, limits);
   let prevKey = null;
+  let cutShort = `the walk spent its ${limit} Tab presses without the ring ever closing, so the tail of it was never reached`;
+  let untagged = 0;
   for (let i = 0; i < limit; i++) {
-    if (deadline?.out()) break;
+    if (deadline?.out()) {
+      cutShort = `the probe budget of ${limits.budgetMs}ms ran out after ${seen.size} of the ${count} focusable elements \u2014 the rest of the ring was never focused`;
+      break;
+    }
     await page.keyboard.press("Tab");
     const r = await page.evaluate(FOCUS_CHECK_PROBE);
     if (!r) continue;
+    if (r.untagged) {
+      untagged++;
+      continue;
+    }
     if (r.key === prevKey) continue;
-    if (seen.has(r.key)) break;
+    if (seen.has(r.key)) {
+      cutShort = void 0;
+      break;
+    }
     seen.add(r.key);
     prevKey = r.key;
     if (!r.changed) {
@@ -400,9 +454,14 @@ async function probeFocusRing(page, scope = "", limits = PROBE_DEFAULTS, deadlin
         });
       }
     }
-    if (hits.length >= 20 && obscured.length >= 20) break;
+    if (hits.length >= 20 && obscured.length >= 20) {
+      cutShort = `both recording caps filled at ${seen.size} of the ${count} focusable elements \u2014 enough was found to fail the page, not enough to clear the rest of it`;
+      break;
+    }
   }
-  return { visible: hits, obscured };
+  if (cutShort && seen.size >= count) cutShort = void 0;
+  const why = cappedRing(capped, limits) ?? cutShort ?? (untagged > 0 ? `Tab crossed ${untagged} element(s) the tagging pass never matched \u2014 a control focusable in the browser but not by this selector (a skip link revealed on focus, a widget moving focus into an untagged node). They were never compared, so this page is not cleared` : void 0);
+  return { visible: hits, obscured, complete: !why, ...why ? { why } : {} };
 }
 var NATIVE_SEGMENT_STOPS = {
   date: 5,
@@ -422,53 +481,85 @@ var FOCUS_WHERE_PROBE = `(() => { ${PRELUDE}
   const type = e.tagName === 'INPUT' ? (e.getAttribute('type') || 'text').toLowerCase() : '';
   return { key: key || __sel(e), tagged: !!key, selector: __sel(e), html: __html(e), segments: stops[type] || 1 };
 })()`;
-async function probeKeyboardTrap(page, limits = PROBE_DEFAULTS, deadline) {
-  const count = await page.evaluate(focusSetupExpr("", limits.maxFocusables));
-  if (!count || count < 2) return [];
+async function probeKeyboardTrapRing(page, limits = PROBE_DEFAULTS, deadline) {
+  const { count, capped } = readSetup(await page.evaluate(focusSetupExpr("", limits.maxFocusables)), limits);
+  if (!count || count < 2) return { hits: [], complete: true };
   const hits = [];
   const seen = /* @__PURE__ */ new Set();
   const confirmPresses = 2;
   const limit = tabPressBudget(count, limits);
   let prev = null;
+  let cutShort = `the walk spent its ${limit} Tab presses without the ring ever closing, so the tail of it was never reached`;
   for (let i = 0; i < limit; i++) {
-    if (deadline?.out()) break;
+    if (deadline?.out()) {
+      cutShort = `the probe budget of ${limits.budgetMs}ms ran out after ${seen.size} of the ${count} focusable elements \u2014 the rest of the ring was never walked`;
+      break;
+    }
     await page.keyboard.press("Tab");
     const now = await page.evaluate(FOCUS_WHERE_PROBE);
-    if (!now) break;
+    if (!now) {
+      cutShort = void 0;
+      break;
+    }
     if (prev?.tagged && now.tagged && now.key === prev.key) {
       const budget = Math.max(confirmPresses, (now.segments ?? 1) - 1);
       let stuck = true;
+      let confirmed = true;
       for (let k = 0; k < budget && stuck; k++) {
-        if (deadline?.out()) break;
+        if (deadline?.out()) {
+          confirmed = false;
+          break;
+        }
         await page.keyboard.press("Tab");
         const again = await page.evaluate(FOCUS_WHERE_PROBE);
         stuck = again !== null && again.tagged === true && again.key === now.key;
       }
+      if (!confirmed) {
+        cutShort = `the probe budget of ${limits.budgetMs}ms ran out while confirming whether focus could leave ${now.selector} \u2014 an unconfirmed suspicion is not a non-conformity`;
+        break;
+      }
       if (stuck) {
         hits.push({
           selector: now.selector,
           html: now.html,
           detail: `Le focus reste sur cet \xE9l\xE9ment apr\xE8s ${1 + budget} appuis sur Tab, alors que la page compte ${count} \xE9l\xE9ments focalisables \u2014 pi\xE8ge au clavier (2.1.2).`
         });
+        cutShort = void 0;
         break;
       }
     }
     if (now.key !== prev?.key) {
-      if (seen.has(now.key)) break;
+      if (seen.has(now.key)) {
+        cutShort = void 0;
+        break;
+      }
       seen.add(now.key);
     }
     prev = now;
   }
-  return hits;
+  if (cutShort && seen.size >= count) cutShort = void 0;
+  const why = cappedRing(capped, limits) ?? cutShort;
+  return { hits, complete: !why, ...why ? { why } : {} };
 }
-async function probeHover(page, limits = PROBE_DEFAULTS, deadline) {
-  const triggers = await page.evaluate(HOVER_SETUP_PROBE);
+async function probeHoverWalk(page, limits = PROBE_DEFAULTS, deadline) {
+  const setup = await page.evaluate(HOVER_SETUP_PROBE);
+  const triggers = setup;
   const hits = [];
-  for (const tr of triggers.slice(0, Math.max(1, limits.maxTriggers))) {
-    if (deadline?.out()) break;
+  let cutShort;
+  let unreachable = 0;
+  const tried = triggers.slice(0, Math.max(1, limits.maxTriggers));
+  if (tried.length < triggers.length) {
+    cutShort = `only ${tried.length} of the ${triggers.length} hover triggers on this page were opened (probes.maxTriggers) \u2014 the rest were never asked whether Escape dismisses them`;
+  }
+  for (const tr of tried) {
+    if (deadline?.out()) {
+      cutShort = `the probe budget of ${limits.budgetMs}ms ran out with triggers left unopened`;
+      break;
+    }
     try {
       await page.hover(`[data-u11y-h="${tr.key}"]`, { timeout: actionTimeout(limits, deadline) });
     } catch {
+      unreachable++;
       continue;
     }
     await page.waitForTimeout(150);
@@ -486,9 +577,14 @@ async function probeHover(page, limits = PROBE_DEFAULTS, deadline) {
         detail: `Le contenu r\xE9v\xE9l\xE9 au survol (aria-describedby #${tr.target}) ne se masque pas avec \xC9chap \u2014 Contenu au survol ou au focus (1.4.13).`
       });
     }
-    if (hits.length >= Math.min(limits.maxHits, 8)) break;
+    if (hits.length >= Math.min(limits.maxHits, 8)) {
+      cutShort = "the recording cap filled with triggers left unopened \u2014 enough was found to fail the page, not enough to clear the rest of it";
+      break;
+    }
   }
-  return hits;
+  const capped = setup[0]?.total;
+  const why = cutShort ?? (typeof capped === "number" && capped > triggers.length ? `only ${triggers.length} of the ${capped} hover triggers on this page were tagged \u2014 the rest were never opened` : void 0) ?? (unreachable > 0 ? `${unreachable} hover trigger(s) never became actionable, so their content was never opened or dismissed` : void 0);
+  return { hits, complete: !why, ...why ? { why } : {} };
 }
 async function runLiveProbes(page, opts = {}) {
   const limits = { ...PROBE_DEFAULTS, ...opts.limits };
@@ -502,6 +598,7 @@ async function runLiveProbes(page, opts = {}) {
   const size = canResize ? page.viewportSize() ?? null : null;
   const restore = size ?? { width: 1280, height: 900 };
   const out = {
+    v: PROBES_VERSION,
     focusVisible: [],
     hover: [],
     keyboardTrap: [],
@@ -586,26 +683,190 @@ async function runLiveProbes(page, opts = {}) {
     if (r) {
       out.focusVisible = r.visible;
       out.focusObscured = r.obscured;
-      if (want("2.4.7")) out.probed.push("2.4.7");
-      if (want("2.4.11")) out.probed.push("2.4.11");
+      for (const sc of ["2.4.7", "2.4.11"]) {
+        if (!want(sc)) continue;
+        if (r.complete) out.probed.push(sc);
+        else skip(sc, r.why ?? "the walk of the tab ring did not cross the whole of it");
+      }
     }
   }
   if (want("2.1.2") && canType) {
-    const r = await bounded("2.1.2", () => probeKeyboardTrap(page, limits, deadline));
+    const r = await bounded("2.1.2", () => probeKeyboardTrapRing(page, limits, deadline));
     if (r) {
-      out.keyboardTrap = r;
-      out.probed.push("2.1.2");
+      out.keyboardTrap = r.hits;
+      if (r.complete) out.probed.push("2.1.2");
+      else skip("2.1.2", r.why ?? "the walk of the tab ring did not cross the whole of it");
     }
   }
   if (want("1.4.13") && canHover && canType) {
-    const r = await bounded("1.4.13", () => probeHover(page, limits, deadline));
+    const r = await bounded("1.4.13", () => probeHoverWalk(page, limits, deadline));
     if (r) {
-      out.hover = r;
-      out.probed.push("1.4.13");
+      out.hover = r.hits;
+      if (r.complete) out.probed.push("1.4.13");
+      else skip("1.4.13", r.why ?? "the hover pass did not open every trigger on the page");
+    }
+  }
+  if (want("4.1.3") && opts.liveRegion) {
+    const clicks = typeof opts.liveRegion === "object" && opts.liveRegion.clicks === true;
+    const r = await bounded("4.1.3", () => probeLiveRegion(page, opts.lang ?? "fr", clicks));
+    if (r) {
+      out.liveRegion = r.hits;
+      if (r.complete) out.probed.push("4.1.3");
+      else skip("4.1.3", r.why ?? "the live-region pass did not exercise the whole page");
+    }
+  }
+  for (const [bucket, sc] of UNREADABLE_BY_OLDER) {
+    if (out[bucket]?.length) {
+      const at = out.probed.indexOf(sc);
+      if (at >= 0) out.probed.splice(at, 1);
     }
   }
   return out;
 }
+var DESTRUCTIVE_NAME_RE = "\\b(supprim|retir|effac|envoy|valid|confirm|pay|achet|command|delete|remove|eras|clear|send|submit|buy|order)";
+function liveRegionExpr(detail, allowClicks) {
+  const d = JSON.stringify(detail);
+  const clickLoop = allowClicks ? `
+  // click button[type=button] only (never a submit/link), skipping destructive names
+  const dangerous = new RegExp(${JSON.stringify(DESTRUCTIVE_NAME_RE)}, 'i');
+  const nameOf = (b) => {
+    let n = (b.getAttribute('aria-label') || '') + ' ' + (b.textContent || '') + ' ' + (b.getAttribute('title') || '');
+    // ALL aria-labelledby ids (attribute trimmed): a destructive verb may sit in ANY
+    // referenced id, and the value may carry stray leading/trailing whitespace.
+    for (const id of (b.getAttribute('aria-labelledby') || '').trim().split(/\\s+/)) {
+      if (!id) continue;
+      const t = document.getElementById(id);
+      if (t) n += ' ' + (t.textContent || '');
+    }
+    // Icon-only buttons: the name lives in img[alt] (an attribute \u2014 invisible to
+    // textContent) or an svg <title> (belt-and-braces; textContent usually includes it).
+    for (const im of Array.from(b.querySelectorAll('img[alt]'))) n += ' ' + (im.getAttribute('alt') || '');
+    for (const ti of Array.from(b.querySelectorAll('svg title'))) n += ' ' + (ti.textContent || '');
+    return n;
+  };
+  for (const b of Array.from(document.querySelectorAll('button[type="button"]'))) {
+    if (count >= 20 || hits.length >= 10) { untried += 1; continue; }
+    if (b.disabled || !__vis(b)) continue;
+    if (dangerous.test(nameOf(b))) { untried += 1; continue; } // defense-in-depth: never click a destructive-named button
+    const before = location.href;
+    try { b.click(); } catch (_) {}
+    await settle();
+    if (location.href !== before) { obs.disconnect(); return { hits: hits, untried: untried, navigated: true }; }
+    drain();
+    count++;
+  }` : `
+  // CLICKS DISABLED, and the buttons are counted rather than ignored. A status message very
+  // often appears after a button press and nothing else, so a pass that never pressed one has
+  // not measured 4.1.3 on this page -- it has measured the fields. Reporting how many it
+  // declined is what lets the caller withhold the credit instead of publishing silence.
+  for (const b of Array.from(document.querySelectorAll('button[type="button"]'))) {
+    if (!b.disabled && __vis(b)) untried += 1;
+  }`;
+  return `(async () => { ${PRELUDE}
+  const isLive = (node) => {
+    let el = node && node.nodeType === 1 ? node : (node ? node.parentElement : null);
+    while (el && el !== document.documentElement) {
+      const live = (el.getAttribute && el.getAttribute('aria-live')) || '';
+      const role = (el.getAttribute && el.getAttribute('role')) || '';
+      if (live === 'polite' || live === 'assertive') return true;
+      if (role === 'status' || role === 'alert' || role === 'log') return true;
+      el = el.parentElement;
+    }
+    return false;
+  };
+  const hits = [];
+  const seen = new Set();
+  const records = [];
+  const obs = new MutationObserver((muts) => { for (const m of muts) records.push(m); });
+  obs.observe(document.body, { subtree: true, childList: true, characterData: true });
+  const settle = () => new Promise((r) => setTimeout(r, 40));
+  const drain = () => {
+    for (const m of records.splice(0)) {
+      const targets = m.type === 'characterData' ? [m.target] : Array.from(m.addedNodes);
+      for (const t of targets) {
+        if (!t || (t.textContent || '').trim().length === 0) continue;
+        if (isLive(t)) continue;
+        const host = t.nodeType === 1 ? t : t.parentElement;
+        if (!host || !__vis(host)) continue;
+        const key = __sel(host);
+        if (seen.has(key)) continue;
+        seen.add(key);
+        hits.push({ selector: key, html: __html(host), detail: ${d} });
+      }
+    }
+  };
+  let count = 0;
+  // How many candidate interactions this pass did NOT perform -- caps, a destructive-sounding
+  // name, clicks turned off. A probe that skipped half a page has not measured it, and the
+  // caller may not read its silence as conformity.
+  let untried = 0;${clickLoop}
+  // toggle checkbox/radio, then restore
+  for (const t of Array.from(document.querySelectorAll('input[type="checkbox"], input[type="radio"]'))) {
+    if (count >= 40 || hits.length >= 10) { untried += 1; continue; }
+    if (t.disabled || !__vis(t)) continue;
+    const before = location.href;
+    const prev = t.checked;
+    // A RADIO IS NOT A CHECKBOX: clicking one UNCHECKS its pair, and restoring only the one we
+    // clicked left the group with nothing selected -- a form the caller's next assertion, or
+    // the user, finds broken. Remember which member of the group was checked and put THAT back.
+    let group = null;
+    if (t.type === 'radio' && t.name) {
+      try {
+        const form = t.form || document;
+        for (const r of Array.from(form.querySelectorAll('input[type="radio"]'))) { if (r.name === t.name && r.checked) { group = r; break; } }
+      } catch (_) {}
+    }
+    try { t.click(); } catch (_) {}
+    await settle();
+    if (location.href !== before) { obs.disconnect(); return { hits: hits, untried: untried, navigated: true }; }
+    drain();
+    try {
+      if (group) { if (!group.checked) { group.checked = true; group.dispatchEvent(new Event('change', { bubbles: true })); } }
+      else if (t.checked !== prev) { t.checked = prev; t.dispatchEvent(new Event('change', { bubbles: true })); }
+    } catch (_) {}
+    count++;
+  }
+  // fill text inputs, then restore
+  for (const inp of Array.from(document.querySelectorAll('input[type="text"], input[type="email"], input[type="search"], textarea'))) {
+    if (count >= 60 || hits.length >= 10) { untried += 1; continue; }
+    if (inp.disabled || inp.readOnly || !__vis(inp)) continue;
+    const before = location.href;
+    const prev = inp.value == null ? '' : String(inp.value);
+    try { inp.value = 'test 123'; inp.dispatchEvent(new Event('input', { bubbles: true })); inp.dispatchEvent(new Event('change', { bubbles: true })); } catch (_) {}
+    await settle();
+    if (location.href !== before) { obs.disconnect(); return { hits: hits, untried: untried, navigated: true }; }
+    drain();
+    try { inp.value = prev; inp.dispatchEvent(new Event('input', { bubbles: true })); } catch (_) {}
+    count++;
+  }
+  obs.disconnect();
+  return { hits: hits.slice(0, 10), untried: untried, navigated: false };
+})()`;
+}
+var LIVE_REGION_DETAIL = {
+  fr: "Mise \xE0 jour de contenu d\xE9clench\xE9e par une interaction hors d'une r\xE9gion live (aria-live / role=status|alert|log) \u2014 probablement non restitu\xE9e aux technologies d'assistance.",
+  en: "Content update triggered by an interaction outside any live region (aria-live / role=status|alert|log) \u2014 likely not announced to assistive technology."
+};
+async function probeLiveRegion(page, lang, allowClicks) {
+  const detail = LIVE_REGION_DETAIL[lang] ?? LIVE_REGION_DETAIL.en;
+  const r = await page.evaluate(liveRegionExpr(detail, allowClicks));
+  const hits = r?.hits ?? [];
+  if (r?.navigated) {
+    return {
+      hits,
+      complete: false,
+      why: "an interaction navigated away mid-pass \u2014 everything after it happened on another page, and this one was not finished"
+    };
+  }
+  if (r?.untried > 0) {
+    return {
+      hits,
+      complete: false,
+      why: `${r.untried} interactive element(s) were never exercised (clicks disabled, a destructive-sounding name, or a cap) \u2014 a status message that only appears after one of them would not have been seen`
+    };
+  }
+  return { hits, complete: true };
+}
 var REMOVE_TEXT_SPACING_STEP = `(() => {
   const sheets = Array.from(document.querySelectorAll('style'));
   for (const s of sheets) {
@@ -613,6 +874,11 @@ var REMOVE_TEXT_SPACING_STEP = `(() => {
   }
   return true;
 })()`;
+var UNREADABLE_BY_OLDER = [
+  ["focusObscured", "2.4.11"],
+  ["keyboardTrap", "2.1.2"],
+  ["liveRegion", "4.1.3"]
+];
 
 // src/integrations/core.ts
 import { spawnSync } from "child_process";
@@ -812,9 +1078,13 @@ async function checkA11y(page, opts = {}) {
     );
   }
   let probes;
-  if (opts.probes) {
+  if (opts.probes || opts.liveRegion) {
     try {
-      probes = await runLiveProbes(page, probeOptions(opts.probes));
+      probes = await runLiveProbes(page, {
+        ...probeOptions(opts.probes),
+        ...opts.probes ? {} : { only: ["4.1.3"] },
+        ...opts.liveRegion ? { liveRegion: opts.liveRegion } : {}
+      });
     } catch (e) {
       console.warn(
         `ultra11y: the live probes failed on this page \u2014 ${e instanceof Error ? e.message : String(e)}. The snapshot was still recorded; the criteria they decide stay to assess.`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.41.2",
+  "version": "5.42.1",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",