ultra11y 5.43.0 → 5.43.1

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page WCAG 2.2 AA / RGAA reports in Claude Code.",
-      "version": "5.43.0",
+      "version": "5.43.1",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/SocialGouv/ultra11y",
       "repository": "https://github.com/SocialGouv/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.43.0",
+  "version": "5.43.1",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/SocialGouv/ultra11y",
   "repository": "https://github.com/SocialGouv/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): automatic review before commit, push and pull request, plus detailed evidenced Markdown, HTML and per-page conformance reports in interactive agent sessions.",
-  "version": "5.43.0",
+  "version": "5.43.1",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/SocialGouv/ultra11y",
   "repository": "https://github.com/SocialGouv/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.43.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.43.1";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -577,7 +577,7 @@ pnpm run build:icons     # re-generate the browser extension's icons from their
 ```
 
 Releases are cut automatically by **semantic-release** on push to `main` (GitHub release +
-npm publish via OIDC trusted publishing, plus the moving `v2` major tag). The version bump is
+npm publish via OIDC trusted publishing, plus the moving `v5` major tag). The version bump is
 decided by **Conventional Commits**: a commit whose subject carries no `feat:`/`fix:` prefix
 is analysed as *no release*, so a change that must ship needs at least one conventional commit
 in the range — otherwise the major alias and npm keep serving the previous version while `main`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.43.0",
+  "version": "5.43.1",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join52, relative as relative6, resolve as resolve17, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.43.0";
+var VERSION = "5.43.1";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2298,7 +2298,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-10-13 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-10-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -62733,7 +62733,7 @@ import { existsSync as existsSync21, readFileSync as readFileSync18 } from "fs";
 import { resolve as resolve10 } from "path";
 var WINDOW = 10;
 var norm2 = (s) => s.normalize("NFKC").replace(/[‘’]/g, "'").replace(/[“”]/g, '"').replace(/\s+/g, " ").replace(/>\s+/g, ">").replace(/\s+</g, "<").trim();
-var isUnresolvable = (file) => !file || file === "-" || file === "<stdin>" || file === "stdin";
+var isUnresolvable = (file) => !file || file === "-" || file === "<stdin>" || file === "stdin" || /^[a-z][a-z0-9+.-]*:\/\//.test(file);
 var SEMANTIC_SELECTORS = /* @__PURE__ */ new Set(["handler"]);
 function selectorProbes(selector) {
   if (SEMANTIC_SELECTORS.has(selector.trim().toLowerCase())) return [];

package/scripts/vendor/wcag-2.2-fr.json

@@ -1,6 +1,6 @@
 {
   "source": "https://www.w3.org/Translations/WCAG22-fr/",
-  "fetchedAt": "2026-10-13",
+  "fetchedAt": "2026-10-19",
   "principles": {
     "1": "Perceptible",
     "2": "Utilisable",

package/scripts/vendor/wcag-2.2-sc-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-10-13 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-10-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "principles": [
     {
       "number": 1,

package/scripts/vendor/wcag-2.2-techniques.json

@@ -2,7 +2,7 @@
   "source": "https://github.com/w3c/wcag",
   "understanding": "https://www.w3.org/WAI/WCAG22/Understanding/",
   "license": "W3C Document License (code samples: W3C Software License)",
-  "fetchedAt": "2026-10-13",
+  "fetchedAt": "2026-10-19",
   "criteria": {
     "1.1.1": {
       "slug": "non-text-content",

package/scripts/vendor/wcag-2.2-text.json

@@ -1,7 +1,7 @@
 {
   "source": "https://github.com/w3c/wcag",
   "license": "W3C Document License",
-  "fetchedAt": "2026-10-13",
+  "fetchedAt": "2026-10-19",
   "criteria": {
     "1.1.1": "All non-text content that is presented to the user has a text alternative that serves the equivalent purpose, except for the situations listed below.\nControls, Input:\nIf non-text content is a control or accepts user input, then it has a name that describes its purpose. (Refer to Success Criterion 4.1.2 Name, Role, Value for additional requirements for controls and content that accepts user input.)\nTime-Based Media:\nIf non-text content is time-based media, then text alternatives at least provide descriptive identification of the non-text content. (Refer to Guideline 1.2 for additional requirements for media.)\nTest:\nIf non-text content is a test or exercise that would be invalid if presented in text, then text alternatives at least provide descriptive identification of the non-text content.\nSensory:\nIf non-text content is primarily intended to create a specific sensory experience, then text alternatives at least provide descriptive identification of the non-text content.\nCAPTCHA:\nIf the purpose of non-text content is to confirm that content is being accessed by a person rather than a computer, then text alternatives that identify and describe the purpose of the non-text content are provided, and alternative forms of CAPTCHA using output modes for different types of sensory perception are provided to accommodate different disabilities.\nDecoration, Formatting, Invisible:\nIf non-text content is pure decoration, is used only for visual formatting, or is not presented to users, then it is implemented in a way that it can be ignored by assistive technology.",
     "1.2.1": "For prerecorded audio-only and prerecorded video-only media, the following are true, except when the audio or video is a media alternative for text and is clearly labeled as such:\nPrerecorded Audio-only:\nAn alternative for time-based media is provided that presents equivalent information for prerecorded audio-only content.\nPrerecorded Video-only:\nEither an alternative for time-based media or an audio track is provided that presents equivalent information for prerecorded video-only content.",

package/skills/review-a11y/SKILL.md

@@ -3,7 +3,7 @@ name: review-a11y
 description: "Use to REVIEW changed frontend code for accessibility: staged files, a working diff, branch, or PR; prompts such as 'review a11y', 'is this accessible?', or 'anything to fix before merge?'; and hook or CI findings on a change. Run the bundled install-free engine with cross-file JSX/TSX analysis, then adjudicate candidates and return a severity-ranked WCAG 2.2 AA review with file:line fixes, residual rendering risks, and a verdict. Use `ultra11y` instead for whole-repo audits, dated conformance reports, country standards, PRD backlogs, or authoring accessible markup."
 license: MIT
 metadata:
-  version: 5.43.0
+  version: 5.43.1
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join52, relative as relative6, resolve as resolve17, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.43.0";
+var VERSION = "5.43.1";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2298,7 +2298,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-10-13 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-10-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -62733,7 +62733,7 @@ import { existsSync as existsSync21, readFileSync as readFileSync18 } from "fs";
 import { resolve as resolve10 } from "path";
 var WINDOW = 10;
 var norm2 = (s) => s.normalize("NFKC").replace(/[‘’]/g, "'").replace(/[“”]/g, '"').replace(/\s+/g, " ").replace(/>\s+/g, ">").replace(/\s+</g, "<").trim();
-var isUnresolvable = (file) => !file || file === "-" || file === "<stdin>" || file === "stdin";
+var isUnresolvable = (file) => !file || file === "-" || file === "<stdin>" || file === "stdin" || /^[a-z][a-z0-9+.-]*:\/\//.test(file);
 var SEMANTIC_SELECTORS = /* @__PURE__ */ new Set(["handler"]);
 function selectorProbes(selector) {
   if (SEMANTIC_SELECTORS.has(selector.trim().toLowerCase())) return [];

package/skills/ultra11y/SKILL.md

@@ -3,7 +3,7 @@ name: ultra11y
 description: "Use to AUDIT a repository, site, or page against WCAG 2.2 AA or a country standard such as RGAA; produce a dated conformance report, criterion grid, PRD backlog, or tickets; AUTHOR accessible markup; fix accessibility; or wire a repo gate and rendered-DOM capture pipeline. The bundled install-free engine runs 93 static checks tied to success criteria, while the agent adjudicates judgment criteria and routes rendering criteria to browser scans; check/verify reject invented non-conformities. Use `review-a11y` instead for a review scoped only to a diff, branch, or PR."
 license: MIT
 metadata:
-  version: 5.43.0
+  version: 5.43.1
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/references/orchestrators.md

@@ -15,16 +15,21 @@ Pin the version. `npx` resolves `latest` otherwise, so what runs can change with
 anywhere.
 
 ```sh
-npm_config_update_notifier=false npx -y ultra11y@2.31.2 --version   # → 2.31.2, exit 0
+npm_config_update_notifier=false npx -y ultra11y@5.43.0 --version   # → 5.43.0, exit 0
 ```
 
 - **`npm_config_update_notifier=false` is not optional.** Without it npm prints its
   "New major version available" notice into the output a step is about to parse.
 - **`ULTRA11Y_BIN`** points at an engine you already have (a vendored `ultra11y.mjs`, a
-  container layer). The engine is one self-contained file with no runtime dependencies, so
-  vendoring is a supported path — that is exactly what the skills and the Action do.
+  container layer). For every command but `scan` the engine is one self-contained file with
+  no runtime dependencies, so vendoring is a supported path — that is exactly what the skills
+  and the Action do. `scan` resolves `@playwright/test` and `@axe-core/playwright` from
+  `--cwd` first, then from the engine's own install, so a vendored file alone cannot scan.
 - **Node ≥ 22.18.** No other system dependency, no API key. (`judge` takes a key; nothing
   else does. `scan` needs a browser tier — see `references/dynamic.md`.)
+- **Pin the file, not only the version.** An orchestrator that resolves the engine itself
+  should check the entry file's sha256 before running it: `--version` is a banner any file
+  can print.
 - **Verify what you resolved, and fail if it is not what you asked for.** A step that lets a
   missing engine fall through reports zero findings, which reads exactly like a clean audit.
   This is the one failure mode worth being loud about.
@@ -34,7 +39,7 @@ npm_config_update_notifier=false npx -y ultra11y@2.31.2 --version   # → 2.31.2
 Six steps. Four are deterministic; only step 3 involves a model.
 
 ```sh
-ENGINE="npx -y ultra11y@2.31.2"        # or "node $ULTRA11Y_BIN"
+ENGINE="npx -y ultra11y@5.43.0"        # or "node $ULTRA11Y_BIN"
 RUN=/tmp/a11y-run                          # out-of-tree: see "Where output lands"
 
 # 1. FIND — the static engine. No model. This is the finding set.
@@ -42,15 +47,21 @@ $ENGINE audit "<globs>" --graph --out "$RUN" --json --lang en > /dev/null
 #    …or, on a pull request, exactly what the branch introduced:
 $ENGINE audit --since "$BASE_REF" --graph --out "$RUN" --json --lang en > /dev/null
 
-# 2. WORKLIST — a draft report, then the criteria a static pass cannot decide.
-$ENGINE report --in "$RUN/audit-latest.json" --out "$RUN" --lang en > /dev/null
-$ENGINE verify --report "$RUN"/wcag-*.md --in "$RUN/audit-latest.json" --manual --out "$RUN" --json
+# 2. WORKLIST — the criteria a static pass cannot decide, one brief per criterion.
+$ENGINE verify --manual --in "$RUN/audit-latest.json" --out "$RUN" --json
+#    → { count, todoPath, verdictsPath, itemsDir, mdPath, items }. ADJUDICATE.todo.json carries
+#    the evidence (it can reach hundreds of KB); ADJUDICATE.verdicts.json is the same worklist
+#    without it — hand the agent that slim file plus the briefs in <itemsDir>/<criterion>.md.
 
-# 3. ADJUDICATE — hand $RUN/ADJUDICATE.todo.json to the agent; it fills every `verdict`.
-#    The file carries its own `contract` (see below) — the agent needs nothing else.
+# 3. ADJUDICATE — the agent fills every `verdict` (C/NC/NA/manual) in the verdicts file.
+#    The file carries its own `contract` (see below) — the agent needs nothing else. The fold
+#    re-hydrates the evidence from the audit, so a verdicts-only file is accepted.
 
-# 4. FOLD — fail-closed. Exit 1 with per-criterion reasons if a verdict is unsupported.
-$ENGINE verify --apply "$RUN/adjudication.json" --in "$RUN/audit-latest.json" --out "$RUN" --json
+# 4. FOLD — partial by default: every verdict the gate accepts lands, every refusal is named
+#    in `rejectedCriteria[]` / `issues[]`, and a criterion absent from the file is refused as a
+#    coverage gap. Exit 1 only when nothing landed. `--strict` makes it all-or-nothing (exit 1
+#    on any refusal, audit left untouched).
+$ENGINE verify --apply "$RUN/ADJUDICATE.verdicts.json" --in "$RUN/audit-latest.json" --out "$RUN" --json
 
 # 5. REPORT — deterministic rendering of the adjudicated audit.
 $ENGINE report --in "$RUN/audit-latest.json" --out audits --standard rgaa --lang fr
@@ -153,15 +164,16 @@ repo it does not own — write the run's intermediates out-of-tree and let only
 dated report land in the project, if at all.
 
 `.ultra11y/pages/` is written only by the page-snapshot commands (`scan`, `snapshot`,
-`dev`); `--root` relocates it. `audit`, `report`, `prd`, `tickets`, `verify` and `check`
-never touch it.
+`dev`). `snapshot`, `dev` and `pages discover` take `--root` to relocate it; `scan` does not —
+it writes under the current working directory, so run it from the directory that should
+hold the snapshots. `audit`, `report`, `prd`, `tickets`, `verify` and `check` never touch it.
 
 ## Exit codes
 
 | | 0 | 1 | 2 |
 |---|---|---|---|
 | `audit` | reported (no `--fail-on`), or clean | findings ≥ `--fail-on` | usage / bad input |
-| `verify --apply` | folded | the adjudication was refused (see `issues[]`) | usage / bad input |
+| `verify --apply` | at least one verdict landed (refusals, if any, in `rejectedCriteria[]` / `issues[]`) | nothing landed, or `--strict` and a refusal | usage / bad input |
 | `check` | report is sound | integrity failure | report not found / bad input |
 | `prd` | written | — (it writes markdown and files nothing) | usage / bad input |
 | `tickets` | filed, skipped, or nothing to file | a creation failed, the provider is unusable, or no page in scope | usage / bad input / past `--max-tickets` |
@@ -174,8 +186,24 @@ Read exit codes from the process, **not** from a pipeline — `cmd --json | head
 - `audit --json` → the `AuditResult` (also at `<out>/audit-latest.json`): `findings[]` with
   stable `findingId`, `criteriaId`, `severity`, `file`, `line`; `residualRisks[]`;
   `conformancePct` — the **automatic static pass rate**, not a conformance rate.
-- `verify --apply --json` → `{ ok, auditPath, applied, stillManual, conformancePct, findings, grounding }`
-  on success; `{ ok: false, issues[], audit }` when refused.
+- `verify --apply --json` → `{ ok, auditPath, applied, stillManual, rejected, rejectedCriteria[], issues[],
+  conformancePct, findings, grounding }`; `ok: false` when nothing landed. Count on
+  `applied + stillManual + rejected`, never on the exit code alone.
+- With `--prune`, **`ok: false` does not mean "nothing was applied"**. The CLI computes the
+  coverage and grounding verdicts first, but `applyPrune` writes the pruned
+  `audit-latest.json` and repairs the `--ledger` file BEFORE `ok` is derived — so a trial that
+  fails on grounding still applied every refutation it decided. Read `pruned` in the JSON
+  (or the audit document itself) to know what the audit now says; never report `ok: false` as
+  "trial not applied".
+- `grounding` re-opens every cited file of a retained verdict. A `file` that is a served URL
+  (`^[a-z][a-z0-9+.-]*://` — a rendered finding whose page has no `.ultra11y/pages` capture
+  mapped back to source) has no on-disk source to re-open and is skipped like `stdin`, not
+  counted as `failed`.
+- Under a pack standard (`--standard rgaa`), `audit-latest.json` is a `pack-audit` document:
+  its root `conformancePct` is the automatic pass rate for that standard, `core` is the WCAG
+  audit, and `report --json` and `verify --apply --json` echo the **core** rate. The
+  standard's own conformance rate (validated ÷ validated + NC + à évaluer, NA excluded) is
+  printed by the report; derive it from `criteria[]` if a number is needed in a pipeline.
 - `check --json` → `{ ok, issues[] }`.
 
 ## Honesty rules an orchestrator has to carry

package/skills/ultra11y/references/verify.md

@@ -23,6 +23,9 @@ node scripts/ultra11y.mjs check --report audits/wcag-YYYY-MM-DD.md --semantic [-
 Fails **closed** if there is no adjudicated verdicts artifact (never green-but-inactive),
 re-runs the **uncapped** coverage check, and re-grounds every passing verdict against the cited
 source. `--verdicts` points at the artifact (default `VERIFY.todo.json` next to the report).
+A `file` that is a served URL (a rendered finding whose page has no `.ultra11y/pages` capture
+mapped back to source) is not a path to re-open: it is skipped like `stdin`, never reported as
+« cited file not found ».
 
 ### Applicability gate — `check --report … --standard rgaa --in audit.json`
 

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join52, relative as relative6, resolve as resolve17, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.43.0";
+var VERSION = "5.43.1";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2298,7 +2298,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-10-13 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-10-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -62733,7 +62733,7 @@ import { existsSync as existsSync21, readFileSync as readFileSync18 } from "fs";
 import { resolve as resolve10 } from "path";
 var WINDOW = 10;
 var norm2 = (s) => s.normalize("NFKC").replace(/[‘’]/g, "'").replace(/[“”]/g, '"').replace(/\s+/g, " ").replace(/>\s+/g, ">").replace(/\s+</g, "<").trim();
-var isUnresolvable = (file) => !file || file === "-" || file === "<stdin>" || file === "stdin";
+var isUnresolvable = (file) => !file || file === "-" || file === "<stdin>" || file === "stdin" || /^[a-z][a-z0-9+.-]*:\/\//.test(file);
 var SEMANTIC_SELECTORS = /* @__PURE__ */ new Set(["handler"]);
 function selectorProbes(selector) {
   if (SEMANTIC_SELECTORS.has(selector.trim().toLowerCase())) return [];

package/skills/ultra11y/templates/gitlab-ci.yml

@@ -27,7 +27,7 @@ variables:
   ULTRA11Y_LANG: en
   # Exact by default: a CI report must say which engine produced it. The release script keeps
   # this pin aligned with the package version; override only for a deliberate upgrade test.
-  ULTRA11Y_VERSION: '5.43.0'
+  ULTRA11Y_VERSION: '5.43.1'
   # Batches of 8 amortise the prompt; each accepted verdict is checkpointed before the next
   # batch, and later passes receive only the residue.
   ULTRA11Y_GRAIN: batch

package/src/data/wcag-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-10-13 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-10-19 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "criteria": [
     {
       "id": "1.1.1",

package/src/grounding.ts

@@ -39,8 +39,11 @@ const WINDOW = 10;
 const norm = (s: string) =>
   s.normalize("NFKC").replace(/[‘’]/g, "'").replace(/[“”]/g, '"').replace(/\s+/g, " ").replace(/>\s+/g, ">").replace(/\s+</g, "<").trim();
 
-/** Streams/aggregates have no on-disk source to re-open. */
-const isUnresolvable = (file: string) => !file || file === "-" || file === "<stdin>" || file === "stdin";
+/** Streams/aggregates have no on-disk source to re-open. Neither has a served URL: a rendered
+ *  finding whose page has no `.ultra11y/pages` capture keeps the page URL as its `file`, and
+ *  resolving that against the cwd can only report it missing. The `://` keeps a Windows drive
+ *  letter (`C:\…`) out — only a scheme + authority is a URL. */
+const isUnresolvable = (file: string) => !file || file === "-" || file === "<stdin>" || file === "stdin" || /^[a-z][a-z0-9+.-]*:\/\//.test(file);
 
 /** A markup token a selector implies. `ci` = case-INSENSITIVE (HTML tag & attribute
  *  names, which the HTML spec treats case-insensitively — `<IMG>` ≡ `<img>`); `cs` =

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.43.0";
+export const VERSION = "5.43.1";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,