v1.2.9

Fixed

• MCP access notices now describe their actual keyless behavior: no compile, URL fetch, audit or usage read. Hosted gating and read-only/closed-world annotations remain intact.
• Upgrade guidance offers the matching free local command for compile, audit and local telemetry, with hosted/local usage scope made explicit.
• Enabled compile/audit descriptions document reduced-motion defaults and warnings, nullable CSS, scoring v2 and Markdown text output accurately.

Security

• Dev toolchain only: brace-expansion 5.0.9 → 5.0.12 (pulled in by eslint → minimatch) fixes three denial-of-service advisories on crafted brace patterns (GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr). Not part of the published package; npm audit --omit=dev was already clean.

Documentation

• examples/a11y/: three reproducible motion-accessibility examples — an endless loop with the WCAG 2.2.2 pause control, interaction-triggered motion with reduced-motion behaviour (2.3.3), and a static audit page whose five cases, runtime-library disclosure and withheld badge are explained. test/examples-a11y.test.js pins every stated output.
• README test count updated to 360, including the accessibility examples and MCP access-contract regression tests.
• README package size refreshed from the 1.2.9 pack preview; the SBOM description now reflects this repository's generated-and-checked CI policy.