gina 0.5.20 → 0.5.21

package/CHANGELOG.md

@@ -6,6 +6,20 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.5.21 - 2026-07-20
+### Added
+* Popin eager preload — a trigger can opt into warming its AJAX content off the critical path with data-gina-dialog-preload="eager" (case-insensitive): after window load, at browser idle, the popin plugin fetches the content one trigger at a time through the same gate as the hover/focus warm (the "false" opt-out, the disabled skip, and the cache dedup all apply — whichever warm runs second is a no-op), so a later open injects instantly with no second GET. The pass is skipped when the browser signals Save-Data. Default behavior is unchanged: hover/focus warm stays the default and "false" still disables warming entirely. Browser-bundled — rebuild your bundles to pick it up.
+### Fixed
+* Fixed CSP useNonce nonces diverging between the Content-Security-Policy header and the framework-injected inline bootstrap script on cache-enabled routes: the bootstrap nonce was frozen at first compile inside the per-view compiled-template cache (and the persisted layout cache) while the header rotated per request, so every cache-path response failed nonce validation under an enforcing policy. The bootstrap nonce is now injected as a render-time template conditional (re-evaluated per response), stale pre-fix layout-cache files are healed in place on the next compile, and cache HITS re-mint: the serve path rewrites the stored CSP header and body with a fresh per-response nonce on both engines, so header and markup nonces match and rotate on misses and hits alike.
+* A bundle whose config/routing.json is missing or unreadable at boot now refuses to start with an error naming the bundle and environment (previously it booted silently with only the framework-synthetic routes, so every app route 404'd and cross-bundle route lookups threw hours later with no boot-time signal); an external supervisor restart (an orchestrator liveness/restart or a container restart policy) then retries until the release tree settles, which self-heals mid-deploy races — the gina daemon itself does not retry a startup crash (it reports it once and stops; restart manually) — a deployment that relied on the silent half-boot must fix its release artifact. The route-lookup not-found error now also names the bundle and its rule count, so a degraded or near-empty routing table is tellable from a plain mistyped rule at the call site
+* FormValidator: on live-check fields with autocomplete="off", the Safari-autocomplete keydown interception no longer swallows modifier chords — Cmd/Ctrl+A/C/V/X/Z and Cmd+Arrow run their native defaults instead of typing the chord letter into the field (Cmd+A appended "a") or routing keyboard paste through document.execCommand("paste"), which is inert in unprivileged web content, so keyboard paste on intercepted fields works again (#B134)
+* The framework env template no longer declares a hardcoded accept-language RESPONSE header — Accept-Language is a request header, and the runtime-merged template default made every response (error responses included) emit it. A project or bundle env.json that declares its own response headers keeps working, including re-declaring accept-language, which is still emitted verbatim and still honored by the controller's locale fallback; deployments whose generated env.json copied the old template value should remove that line themselves
+* FormValidator: the Safari-autocomplete keydown interception (fields with autocomplete="off" on a live-check form) now gates on REAL Safari only — every Chromium UA (Chrome/Edge/Brave/Opera) carries the Safari/537.36 token, so the bare /safari/i test ran the WebKit workaround on Chromium where it was never intended; Chromium users get native typing/autofill behavior back, while WebKit-on-iOS browsers (CriOS/FxiOS) stay covered by design (#B135)
+* FormValidator live-check: when the whole-form validation pass turns valid (e.g. a checkbox interaction raises a field another field's comparison rule reads), the pass now clears every previously-errored field's rendered error message along with re-enabling the submit trigger — pre-fix the stale blocking-error paragraph stayed visible next to an enabled submit until the field's next keystroke; applied to both global-pass copies (input/checkbox/radio path and select path), and the pass still never renders new errors on untouched fields (#B136)
+* Merged-process projects (several bundles sharing one port, served by one process): the first cross-bundle getUrl no longer permanently replaces the target bundle's routing table with the starting app's — previously every cross-bundle link to that bundle rendered the literal 404:[<METHOD>]<rule>@<bundle> marker instead of a URL, and merged-mode inbound statics dispatch could match requests against the wrong bundle's table. Each bundle now keeps its own routing table (the hostname share is preserved); projects with distinct per-bundle ports were never affected.
+### Security
+* Server-side error responses no longer serialize stack traces to HTTP clients outside local scope: the engine-level error responder logs the full stack server-side and sends the message line only (JSON/XHR bodies, the inline HTML fallback, and custom-error-page data), the JSON render delegate's HTTP/1.1 reason-phrase fallback ships the error message instead of a stack, and the cached-file stream error path ships message-only — local scope keeps the stack on the wire for the development toolbar
+
 ## 0.5.20 - 2026-07-19
 ### Changed
 * Multipart parsing now uses `@rhinostone/busboy` installed from npm instead of a patched copy vendored inside the framework. The fork is a strict superset of upstream busboy 1.6.0 whose only addition exposes each part's parsed Content-Disposition parameters, which is what lets the upload layer read the `group="..."` tag — previously a local patch that had to be re-applied by hand on every upstream upgrade. Upload behaviour and the multipart wire format are unchanged: files still arrive with their group, an unconfigured group is still rejected, and a file with no group still falls back to `untagged`. Pickup is the version plus a bundle restart; no client rebuild is needed.

package/README.md

@@ -42,12 +42,15 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.5.20
-
-- **Fixed — region locale data: one file per language, with localized country names.** The region-locale generator used to append each requested language's rows to the previous language's output, so `dist/region/fr.json` carried every country twice (the English copy first) and `getLocales().getCountries()` always resolved the English row. Each language now ships as a standalone file, and non-English builds localize `countryName` — a bundle resolving a `fr` culture now renders `Allemagne`, `États-Unis`, `Royaume-Uni` where it previously showed `Germany`, `US`, `UK`, through the same `getLocales().getCountries()` path with no application changes. Rows with no ISO 3166 alpha-2 code are dropped (they could only ever render blank). The region files are read once at boot, so restart your bundles after upgrading to pick up the regenerated data. (#50)
-- **Fixed — `getCountries(code)` honors its projection argument.** The optional `code` argument (e.g. `capital`, `continent`, `tld`) was computed and never applied; it now adds that field to every returned row while the four historical fields (`isoShort`, `isoLong`, `countryName`, `officialStateName`) stay untouched, so calls without an argument return exactly what they did before. An unknown or non-string field logs a warning and is ignored, and a bundle with no locale set gets an empty list instead of throwing. (#50)
-- **Fixed — FormValidator: numbered `is` rules now enforce, injected forms activate live checking, and boolean `_case_` conditions match live.** Numbered `is` aliases (`is1`, `is2`, …) were silently skipped and now install and run on both the client and the server — **a form that submitted clean because its `is2` condition was ignored may begin failing validation (or returning 422), so sweep your rule files for numbered `is` keys before upgrading.** Each alias now records its error under its own key on both sides, and server-side validation of rules carrying `$` cross-field references no longer crashes. Separately, dynamically injected (popin) forms now resolve `data-gina-form-rule` so live checking activates, and `_case_` conditions written as the strings `"true"` / `"false"` now match during live checking. These are browser-bundled changes — rebuild your bundles after upgrading. (#B127/#B128/#B129)
-- **Changed — busboy is now an npm dependency, not a vendored copy.** Multipart form parsing uses [`@rhinostone/busboy`](https://github.com/gina-io/busboy) — a strict superset of upstream busboy 1.6.0 whose only addition exposes each part's parsed Content-Disposition parameters, which is what lets the upload layer read the `group="…"` tag — installed from npm instead of a patched copy carried inside the framework tree. Upload behaviour and the multipart wire format are unchanged: files still arrive with their group, an unconfigured group is still rejected, and a file with no group still falls back to `untagged`. No application changes and no client rebuild — pickup is the version plus a bundle restart.
+## What's in 0.5.21
+
+- **Security — 500 bodies no longer carry stack traces outside local scope.** Uncaught controller and middleware errors route through the server-side error responder, which used to serialize the full stack — absolute server paths and frames — into the JSON `error` field, the inline HTML fallback, and custom-error-page data on every scope. Outside local scope the wire now carries only the error's message line (the JSON render delegate's HTTP/1.1 reason-phrase fallback and the cached-file stream error path included); the full stack goes to the server log. Local scope is unchanged — the development toolbar keeps its stack.
+- **Changed — a missing bundle `routing.json` now fails the boot (deliberate).** A bundle whose `config/routing.json` was missing at boot used to start silently with only the framework-synthetic routes — every app route 404'd, and cross-bundle lookups threw hours later. The boot now refuses to start with an error naming the bundle and environment, exactly like a malformed `routing.json` always has; under an external supervisor (Kubernetes, a container restart policy, an init system) the restart retries until the release tree settles, while a bare `gina bundle:start` reports the crash once and stays down until restarted manually. The route-lookup not-found error also names the bundle and its rule count, so a degraded table is tellable from a mistyped rule — that half is browser-bundled, so rebuild your bundles.
+- **Fixed — FormValidator: keyboard shortcuts on `autocomplete="off"` fields, the Safari-only gate, and stale error clearing.** The Safari-autocomplete keydown interception no longer swallows modifier chords (Cmd/Ctrl+A/C/V/X/Z run their native defaults instead of typing the chord letter into the field) and now runs on real Safari only — every Chromium UA carries the `Safari/537.36` token, so Chrome/Edge/Brave were wrongly intercepted. And when a live-check whole-form pass turns valid, every previously-errored field's message is now cleared along with re-enabling the submit trigger, instead of leaving a stale blocking error on screen. Browser-bundled — rebuild your bundles. (#B134/#B135/#B136)
+- **Fixed — cross-bundle links in merged-process projects.** In a project whose bundles share one port (served by one process), the first cross-bundle `getUrl` permanently replaced the target bundle's routing table with the starting app's — every cross-bundle link to that bundle rendered a literal `404:[…]` marker instead of a URL. Each bundle now keeps its own routing table. Server-side only; projects with distinct per-bundle ports were never affected. (#B137)
+- **Fixed — CSP `useNonce` on cache-enabled routes.** The framework-injected inline bootstrap's nonce was frozen at first compile inside the compiled-template and layout caches while the `Content-Security-Policy` header rotated per request, so every cache-path response failed nonce validation under an enforcing policy. The nonce is now injected per response, stale pre-fix layout-cache files heal in place, and cache hits re-mint both the stored header and body with a fresh nonce on both engines.
+- **Fixed — the hardcoded `accept-language` response header is gone.** Accept-Language is a request header, but the framework env template declared it as a response default, so every response — error responses included — emitted it. An env.json that declares its own response headers keeps working verbatim; deployments whose generated env.json copied the old template line should remove it.
+- **Added — popin eager preload.** Mark a trigger with `data-gina-dialog-preload="eager"` and the popin plugin fetches its AJAX content after window load, at browser idle — one trigger at a time, off the critical path — so a later open injects instantly with no second GET. Same safety gates as the hover/focus warm (the `"false"` opt-out, the disabled skip, cache dedup), and the pass is skipped under Save-Data. Default behavior is unchanged. Browser-bundled — rebuild your bundles.
 
 See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
 

package/ROADMAP.md

@@ -45,6 +45,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q3 2026** | `0.5.18` ✅ | **Added**: a redis-backed L2 render cache — rendered output is cached in a shared store, so several replicas serve the same rendered page and a freshly-started replica serves what a peer already rendered (cross-replica cold-start), degrading to per-replica caching if redis is down · pluggable cache backends (`server.cache.type`: `memory` / `fs` / `redis`) with bundle-wide `sliding` / `maxAge` fallbacks a route inherits · type-safe DTOs and a default-on validation pipe (`gina.dto` — one shape projected to runtime validation, response shaping, JSON Schema and TypeScript; `param.dto` validates the payload before the action with a localised 422, `param.responseDto` shapes the wire, `gina bundle:types` emits declarations, and `bundle:openapi` / `bundle:mcp` emit real request/response schemas) · `releaseWatch` — an opt-in stale built-release watch for local production rehearsals (source-tree fingerprint against the manifest release stamp, `GET /_gina/release/status` + an SSE stream, idle-gated rebuild-and-restart honouring in-flight requests and busy probes, a live shadow-DOM banner, and `restartMode: supervisor` for daemonless container launches) · `POST /_gina/cache/clear` + a `gina cache:clear` CLI (flush the rendered-output cache, or evict by event across bundles) · two-tier cache observability (an RFC 9211 `Cache-Status` `detail` naming the serving tier, plus an `l2` redis-health block on `/_gina/cache/stats`) · **Changed**: render-cache keys are release-namespaced, so an upgrade auto-invalidates (`GINA_CACHE_NAMESPACE`, else the framework version) · the `Cache-Status` miss form is now the RFC 9211 `gina-cache; fwd=uri-miss`, and Express bundles get their first cache-miss signal · **Fixed**: event-driven cache invalidation works — `self.cache.invalidateByEvent()` now exists, and a key carrying a querystring no longer throws a 500 that discarded an already-rendered page · the `fs` cache survives a restart (disk read-back via a `.meta` sidecar, original absolute expiry preserved, no TTL extension) · a checkbox's `value` attribute no longer decides its `checked` state (#49) · the published TypeScript declarations describe the runtime · errors surface instead of crashing, masking, or coming back as `0` (detached-context `throwError`, partial-boot `getLib()` / `getConfig()`, a bitwise-or at nine sites, and `$` in log messages) |
 | **Q3 2026** | `0.5.19` ✅ | **Added**: route authorization — a `routing.json` rule gates access before the action runs via `param.requireAuth` (a 401 for XHR, a non-cacheable login redirect for a browser navigation, the original request snapshotted for `resumeRequest()`), `param.roles` (ANY-of, implies `requireAuth`), and `param.policy` (a per-bundle function for the ownership/record checks roles can't express, AND-composed after roles); denials stay generic — required roles and the policy name never reach the wire — author mistakes refuse to boot, and `self.hasRole()` authorizes mid-logic · an audit trail — opt-in `self.audit(action, data)` writes a user-attributed append-only JSONL record (its own store, never the logger sinks; an actor snapshot, `X-Forwarded-For` never trusted), route-authorization denials recorded automatically, and an always-on request id correlating audit records to JSON logs · an OCI image/container CLI on the `image:build` host — `image:list` / `image:rm` / `image:run` (podman; publishes the EXPOSEd port, `--env-var` / `--env-file` keep secrets out of argv) and a `container:` group (`container:ps` / `container:stop`, reporting the rung a container came down on) · **Changed**: `redirect()` carries request data through the session by default (a one-shot flash, gone on refresh), the clear-text `?inheritedData=` URL form and its 2000-char cap now session-less-only — removing a plaintext-secret-in-URL disclosure when a session-ful bundle halts a credential-bearing POST · **Fixed**: Prometheus metrics no longer double-count under the isaac engine (#OBS1) · the relative `self.redirect('/path')` form resolves again and an unresolvable target 404s instead of crashing (`redirect()` is now async), and `getRoute()` no longer 500s on a requirements-less GET route with extra params (#B120/#B121) · `image:build` for gina-dependent projects no longer fails at gina-init and the pinned framework wins `require('gina')` (#B118/#B119) · `gina.emit` is an inert stub (#B109) and the checkbox migration warning now covers the un-tick direction (#49) |
 | **Q3 2026** | `0.5.20` ✅ | **Fixed**: region locale data — the generator now emits one standalone file per language with localized country names (a `fr` culture renders `Allemagne` / `États-Unis` / `Royaume-Uni` through the same `getLocales().getCountries()` path, no app changes; rows without an ISO 3166 alpha-2 code are dropped; read once at boot, so restart to pick up), and `getCountries(code)` honors its projection argument — adding the requested field while the four historical fields stay untouched, an empty locale set degrading to an empty list instead of throwing (#50) · **Fixed**: FormValidator — numbered `is` rules (`is1`, `is2`, …) now install and enforce on client and server (previously silently skipped; **sweep rule JSONs before upgrading — forms may begin 422ing**), each alias keying its error distinctly and server-side `$`-cross-field rules no longer crashing; injected/popin forms resolve `data-gina-form-rule` so live checking activates; boolean `_case_` conditions match live (#B127/#B128/#B129) · **Changed**: multipart parsing uses `@rhinostone/busboy` installed from npm instead of a patched vendored copy — a strict superset of upstream busboy 1.6.0, upload behaviour and the wire format unchanged, pickup is the version plus a bundle restart |
+| **Q3 2026** | `0.5.21` ✅ | **Security**: server-side error responses no longer serialize stack traces to HTTP clients outside local scope — the responder logs the full stack server-side and ships the message line only (JSON bodies, the inline HTML fallback, custom-error-page data; local scope keeps the development-toolbar stack) · **Changed**: a bundle whose `config/routing.json` is missing at boot now refuses to start with an error naming the bundle and environment (previously a silent half-boot with only the framework-synthetic routes; an external supervisor's restart retries until the release tree settles — the daemon itself is fail-stop), and the route-lookup not-found error names the bundle and its rule count · **Fixed**: FormValidator — modifier chords (Cmd/Ctrl+A/C/V/X/Z) run their native defaults again on `autocomplete="off"` live-check fields, the Safari-autocomplete interception gates on real Safari only (Chromium UAs no longer intercepted), and a whole-form live-check pass that turns valid clears every previously-errored field's message (#B134/#B135/#B136) · **Fixed**: merged-process (same-port multi-bundle) projects — the first cross-bundle getUrl no longer permanently replaces the target bundle's routing table with the starting app's, which rendered every cross-bundle link as a literal `404:[…]` marker; distinct-port projects were never affected (#B137) · **Fixed**: CSP `useNonce` on cache-enabled routes — the header and inline-bootstrap nonces now match and rotate per response, on cache hits and misses alike · **Fixed**: the env template's hardcoded `accept-language` response header is gone (a request header, wrongly emitted on every response) · **Added**: popin eager preload — `data-gina-dialog-preload="eager"` warms a popin's AJAX content at browser idle after window load, same safety gates as the hover/focus warm, skipped under Save-Data |
 | **Q4 2026** | `0.6.0` | Security & compliance controls (technical safeguards mapping to PCI-DSS / SOC2 / HIPAA) |
 | **Q1 2027** | `0.5.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |
@@ -65,6 +66,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | ✅ | **HEAD method** — `req.head` populated with query-string and URI params. Full controller action runs so all response headers are set correctly; body is suppressed before writing to the wire. Both `render()` and `renderJSON()` honour HEAD. Routes declared as `GET` automatically accept HEAD — no extra routing rule needed. | `0.3.0` | 2026-03-31 |
 | ✅ | **Client-side components (Web Components)** — Standards-based conventions for stateful client widgets: custom elements v1, zero dependency, no build tooling. Server-rendered light-DOM authoring keeps HTML (designer) and JS (developer) separated — the behavior-only class binds its own server-rendered subtree and holds no markup strings (repeatable markup clones from a server-rendered `<template>`). Components upgrade automatically in popin/XHR-injected content with no rebinding; SEO/GEO-first (meaningful content ships in the initial server-rendered HTML). `gina view:add` scaffolds a reference component (engine partial + behavior-only class); e2e coverage locks popin auto-upgrade, strict-CSP compatibility (real nonce'd header, no `unsafe-inline`), SSR hydration from attributes + a JSON `data-*` payload, and no-JS crawler equivalence. The `gina-*` tag prefix is reserved for framework components. Form-associated custom elements participate in FormValidator — a named component exposing a `.value` getter is collected, validated, serialized into the AJAX payload, and error-rendered like a native control (client-side live-check on its composed bubbling `change`, dirty-tracking, and auto-id), so long as it declares `static formAssociated = true`, carries a `name`, and fires a composed `change` on commit. Live-data components ride the same lifecycle — open the connection in `connectedCallback`, close it in `disconnectedCallback` (popin close then tears it down automatically) — paired with `method:"ws"` routes or SSE via `renderStream()`, with per-animation-frame batching guidance for high-frequency streams; the lifecycle contract is executed against a live HTTP/2 extended-CONNECT loopback in the test suite. Dev-mode Inspector observability: the View tab carries a component census with a red undefined-components indicator (a typo'd tag or a missing definition script is no longer a silent failure), and the Events tab surfaces client-side `<tag>:<verb>` component events — metadata always, `detail` values only behind the existing `inspector.events.captureArgs` opt-in. | `0.5.15` | 2026-07-11 |
 | ✅ | **Stale built-release watch** — For LOCAL production rehearsals. A bundle serving a built release under `local` scope + a non-dev env has no hot-reload, so after you edit source it silently keeps serving the stale build. Opt in via `server.releaseWatch` in `settings.json`: the bundle watches its SOURCE tree, compares fingerprints against the manifest release stamp, and surfaces staleness on `GET /_gina/release/status` and a live `GET /_gina/release/events` SSE stream (notify mode, the default) — or auto-rebuilds on change (opt-in `auto` mode). `POST /_gina/release/rebuild` rebuilds with an **idle-gated restart** that waits on in-flight HTTP requests and `gina.registerBusyProbe` application probes, so a restart never interrupts in-flight work. Hard-gated on `local` scope + a non-dev env — never active on a real cluster. | `0.5.18-alpha` | 2026-07-16 |
+| ✅ | **Popin eager preload** — Opt-in idle warming for AJAX popin content. Mark a trigger with `data-gina-dialog-preload="eager"` (case-insensitive) and the popin plugin fetches its content after `window` load, at browser idle — one trigger at a time, off the critical path — so opening feels instant with no second GET. Same safety gates as the hover/focus warm: the `"false"` opt-out and the disabled skip apply identically, and an eager warm and a hover warm coalesce into a single GET (whichever runs second is a no-op). The pass is skipped when the browser signals Save-Data. Default behavior is unchanged — hover/focus warm remains the default. | `0.5.21-alpha` | 2026-07-19 |
 
 ---
 

package/framework/v0.5.21/VERSION

@@ -0,0 +1 @@
+0.5.21

package/framework/{v0.5.20 → v0.5.21}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -6295,7 +6295,10 @@ function Routing() {
 
 
         if ( typeof(routing[rule]) == 'undefined' ) {
-            throw new Error('[ RoutingHelper::getRouting(rule, params) ] : `' +rule + '` not found !')
+            // #B132 — name the bundle + its table size so a degraded/near-empty
+            // table (e.g. a bundle whose routing config never loaded) is
+            // tellable from a plain mistyped rule at the call site.
+            throw new Error('[ RoutingHelper::getRouting(rule, params) ] : `' +rule + '` not found ! (bundle `'+ bundle +'` holds '+ Object.keys(routing).length +' rules)')
         }
 
         var route   = JSON.clone(routing[rule]);
@@ -13799,6 +13802,24 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                             handleErrorsDisplay($gForm, gResult.error, gResult.data, _touchedField);
                                         }
                                     }
+                                    // #B136 — the fresh global pass is VALID but the store still
+                                    // holds errors from an earlier pass (e.g. a cross-field
+                                    // comparison fixed by ANOTHER control's change: a checkbox
+                                    // handler raising the compared field). Every stored error is
+                                    // stale — clear each previously-errored field's display, not
+                                    // just the touched field's, so the re-enabled submit trigger
+                                    // never sits beside a stale blocking-error message.
+                                    // handleErrorsDisplay's empty-errors path also prunes the
+                                    // per-field bookkeeping; new errors are never rendered here
+                                    // (untouched-field display still waits for interaction or
+                                    // submit).
+                                    else if ( isFormValid && instance.$forms[formId].errors && instance.$forms[formId].errors.count() > 0 ) {
+                                        var staleErrors = instance.$forms[formId].errors;
+                                        instance.$forms[formId].errors = {};
+                                        for (var staleField in staleErrors) {
+                                            handleErrorsDisplay($gForm, {}, null, staleField);
+                                        }
+                                    }
                                     // Fixed on 2025-03-16
                                     // Eg.: input select change impacting another element: solve `no more errors`
                                     else if ( instance.$forms[formId].errors && !instance.$forms[formId].errors.count() ) {
@@ -14011,7 +14032,19 @@ function ValidatorPlugin(rules, data, formId, culture) {
      * handleAutoComplete
      * This is a temporary fix to handle safari autocomplete/autosuggest
      * Will be removed when Safari honores autocomplete="off"
+     *
+     * Intercepts keydown on the field (preventDefault + a programmatic value
+     * rebuild behind a transient readonly) so the browser never sees typing
+     * and offers no autofill/autosuggest. Modifier chords (metaKey/ctrlKey)
+     * are deliberately NOT intercepted (#B134): they return before
+     * preventDefault so the native select-all/copy/paste/cut/undo defaults
+     * run — the rebuild cannot reproduce them.
+     *
+     * Gated to REAL Safari at the registerForLiveChecking call site (#B135):
+     * Chromium UAs carry the Safari token but were never this workaround's
+     * target — they get native behavior.
      * @param {object} $el HTMLElement
+     * @param {number} [liveCheckTimer] - live-check debounce handle, cleared per intercepted keystroke
      */
     var handleAutoComplete = function($el, liveCheckTimer) {
 
@@ -14032,6 +14065,17 @@ function ValidatorPlugin(rules, data, formId, culture) {
             // add once
             if ( typeof(gina.events[evtName]) == 'undefined' ) {
                 addListener(gina, event.currentTarget, evtName, function(e) {
+                    // #B134 — modifier chords are NOT intercepted: return before
+                    // preventDefault so the native select-all/copy/paste/cut/undo
+                    // defaults run. The rebuild below cannot reproduce them — the
+                    // printable branch typed the chord letter into the field
+                    // (Cmd+A appended "a") and execCommand("paste") is inert in
+                    // unprivileged web content. The field is not readonly here
+                    // (focusin removed it), so the native edit lands and the
+                    // live-check picks it up on the keyup that follows.
+                    if ( e.metaKey || e.ctrlKey ) {
+                        return;
+                    }
                     e.preventDefault();
                     clearTimeout(liveCheckTimer);
 
@@ -14115,53 +14159,61 @@ function ValidatorPlugin(rules, data, formId, culture) {
                             }
                             break;
                         // Shortcuts
-                        case 17: // CTRL
-                        case 91: // CMD
-                            console.debug("CMD, CTRL hit");
-                            e.preventDefault();
-                            break;
-                        case 67: // to handle CMD+C (copy)
-                            if (
-                                keyboardMapping[67] && keyboardMapping[91] // mac osx
-                                ||
-                                keyboardMapping[67] && keyboardMapping[17] // windows
-                            ) {
-                                $_el.setSelectionRange(posStart, posEnd);
-                                document.execCommand("copy");
-                                break;
-                            }
-                        case 86: // to handle CMD+V (paste)
-                            if (
-                                keyboardMapping[86] && keyboardMapping[91] // mac osx
-                                ||
-                                keyboardMapping[86] && keyboardMapping[17] // windows
-                            ) {
-                                if (posStart != posEnd) {
-                                    $_el.value = $_el.value.replace(str.substring(posStart, posEnd), '');
-                                }
-                                setCaretToPos($_el, posStart);
-                                document.execCommand("paste");
-                                break;
-                            }
-                        case 88: // to handle CMD+X (cut)
-                            if (
-                                keyboardMapping[88] && keyboardMapping[91] // mac osx
-                                ||
-                                keyboardMapping[88] && keyboardMapping[17] // windows
-                            ) {
-                                $_el.setSelectionRange(posStart, posEnd);
-                                document.execCommand("cut");
-                                break;
-                            }
-                        case 90: // to handle CMD+Z (undo)
-                            if (
-                                keyboardMapping[90] && keyboardMapping[91] // mac osx
-                                ||
-                                keyboardMapping[90] && keyboardMapping[17] // windows
-                            ) {
-                                $_el.value = $_el.defaultValue;
-                                break;
-                            }
+                        // #B134 — the modifier-chord cases below are unreachable
+                        // since the e.metaKey/e.ctrlKey bail at the top of this
+                        // handler: chords now run natively, and the native
+                        // copy/cut/paste/select-all/undo defaults are correct
+                        // where these re-implementations were not (the paste
+                        // re-implementation was inert in unprivileged web
+                        // content, and undo-to-defaultValue wiped user input).
+                        // Kept commented for the record.
+                        // case 17: // CTRL
+                        // case 91: // CMD
+                        //     console.debug("CMD, CTRL hit");
+                        //     e.preventDefault();
+                        //     break;
+                        // case 67: // to handle CMD+C (copy)
+                        //     if (
+                        //         keyboardMapping[67] && keyboardMapping[91] // mac osx
+                        //         ||
+                        //         keyboardMapping[67] && keyboardMapping[17] // windows
+                        //     ) {
+                        //         $_el.setSelectionRange(posStart, posEnd);
+                        //         document.execCommand("copy");
+                        //         break;
+                        //     }
+                        // case 86: // to handle CMD+V (paste)
+                        //     if (
+                        //         keyboardMapping[86] && keyboardMapping[91] // mac osx
+                        //         ||
+                        //         keyboardMapping[86] && keyboardMapping[17] // windows
+                        //     ) {
+                        //         if (posStart != posEnd) {
+                        //             $_el.value = $_el.value.replace(str.substring(posStart, posEnd), '');
+                        //         }
+                        //         setCaretToPos($_el, posStart);
+                        //         document.execCommand("paste");
+                        //         break;
+                        //     }
+                        // case 88: // to handle CMD+X (cut)
+                        //     if (
+                        //         keyboardMapping[88] && keyboardMapping[91] // mac osx
+                        //         ||
+                        //         keyboardMapping[88] && keyboardMapping[17] // windows
+                        //     ) {
+                        //         $_el.setSelectionRange(posStart, posEnd);
+                        //         document.execCommand("cut");
+                        //         break;
+                        //     }
+                        // case 90: // to handle CMD+Z (undo)
+                        //     if (
+                        //         keyboardMapping[90] && keyboardMapping[91] // mac osx
+                        //         ||
+                        //         keyboardMapping[90] && keyboardMapping[17] // windows
+                        //     ) {
+                        //         $_el.value = $_el.defaultValue;
+                        //         break;
+                        //     }
                         default:
                             // Replace selection
                             if (e.key.length > 1) {
@@ -14230,9 +14282,17 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 addLiveForInput($form, $el, liveCheckTimer, isCustomEl);
                 if ( !isCustomEl ) {
                     // Bypass Safari autocomplete (native inputs only)
+                    // #B135 — REAL Safari only: every Chromium UA (Chrome/Edge/
+                    // Brave/Opera...) also carries the "Safari/537.36" token, so
+                    // the bare /safari/i test matched them all and ran this
+                    // WebKit workaround where it was never intended (see the
+                    // handleAutoComplete header). WebKit-on-iOS third-party
+                    // browsers (CriOS/FxiOS/EdgiOS — no "Chrome"/"Chromium"
+                    // token) stay matched on purpose: they run Safari's engine.
                     var isAutoCompleteField = $el.getAttribute('autocomplete');
                     if (
                         /safari/i.test(navigator.userAgent)
+                        && !/chrom(e|ium)/i.test(navigator.userAgent)
                         && isAutoCompleteField
                         && /^(off|false)/i.test(isAutoCompleteField)
                     ) {
@@ -15544,6 +15604,17 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                 handleErrorsDisplay($gForm, gResult.error, gResult.data, _touchedField);
                             }
                         }
+                        // #B136 — same stale-clear as processEvent's global pass (keep the
+                        // two copies in sync): the fresh pass is valid but the store still
+                        // holds earlier errors — clear each previously-errored field's
+                        // display, not just the touched field's.
+                        else if ( isFormValid && instance.$forms[formId].errors && instance.$forms[formId].errors.count() > 0 ) {
+                            var staleErrors = instance.$forms[formId].errors;
+                            instance.$forms[formId].errors = {};
+                            for (var staleField in staleErrors) {
+                                handleErrorsDisplay($gForm, {}, null, staleField);
+                            }
+                        }
 
                         updateSubmitTriggerState( $gForm, isFormValid);
                         once = false;
@@ -18252,9 +18323,10 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
 
     /**
      * Module-level preload cache, keyed by URL. Warmed by the delegated
-     * mouseover/focusin listeners (installPreload) and consumed once at open time
-     * (consumePreload). Shared across popin instances so a hover-preload survives the
-     * subsequent click. A reserved-but-not-yet-loaded entry is `null` (in-flight).
+     * mouseover/focusin listeners (installPreload) and by the opt-in idle eager
+     * pass (installEagerPreload); consumed once at open time (consumePreload).
+     * Shared across popin instances so a warm entry survives the subsequent
+     * click. A reserved-but-not-yet-loaded entry is `null` (in-flight).
      *
      * @inner
      * @type {object}
@@ -18312,6 +18384,8 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
     var _ginaDialogDelegated = false;
     /** @inner @type {boolean} module guard — the preload listeners are installed once */
     var _ginaPreloadInstalled = false;
+    /** @inner @type {boolean} module guard — the idle eager-preload pass is installed once */
+    var _ginaEagerInstalled = false;
 
     /**
      * Gina Popin Handler
@@ -18797,13 +18871,21 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
          * Cross-origin URLs are left for the click-time XHR/CORS path.
          *
          * @inner
+         * @param {string} url - same-origin popin content URL
+         * @param {function} [onDone] - completion callback, fired on EVERY exit path
+         *   (cross-origin bail, cache, or decline) so a serialized caller — the
+         *   eager warm queue — always advances. The hover path passes none.
          */
-        function preloadFetch(url) {
+        function preloadFetch(url, onDone) {
+            var _preloadDone = function () {
+                if ( typeof(onDone) == 'function' ) { onDone(); }
+            };
             if (
                 /^(http|https):/.test(url)
                 && !new RegExp('^' + window.location.protocol + '//' + window.location.host).test(url)
             ) {
                 delete preloadCache[url];
+                _preloadDone();
                 return;
             }
             var xhrPreload = new XMLHttpRequest();
@@ -18829,6 +18911,7 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                         delete preloadCache[url];
                         for ( var _wf = 0; _wf < _waiters.length; ++_wf ) { _waiters[_wf](null); }
                     }
+                    _preloadDone();
                 }
             };
             xhrPreload.send();
@@ -18929,10 +19012,10 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
         /**
          * installPreload — one-time delegated `mouseover` + `focusin` listeners that warm
          * preloadCache for AJAX triggers (`data-gina-dialog-src` / legacy
-         * `data-gina-popin-url`). GET + same-origin only; disabled triggers skipped;
-         * repeated hover over descendants is a no-op (URL-cache dedup). A trigger whose
-         * GET is not safe to fire on hover/focus (server-side effects) opts out with
-         * `data-gina-dialog-preload="false"` — honored on legacy triggers too (#B91).
+         * `data-gina-popin-url`). Per-trigger gating (disabled skip, the #B91
+         * `data-gina-dialog-preload="false"` opt-out, URL-cache dedup) lives in
+         * warmTrigger, shared with the idle eager pass (installEagerPreload) so the
+         * two warm paths can never drift.
          *
          * @inner
          */
@@ -18949,30 +19032,119 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                 if ( !$trigger ) {
                     return;
                 }
-                if (
-                    $trigger.getAttribute('disabled') != null && $trigger.getAttribute('disabled') != 'false'
-                    || $trigger.getAttribute('aria-disabled') == 'true'
-                ) {
-                    return;
-                }
-                // #B91 — per-trigger preload opt-out: a trigger whose GET has server-side
-                // effects declares itself. Case-insensitive on purpose (a templated "False"
-                // must not silently fail open and fire the GET anyway); its click still
-                // loads normally, at click time (consumePreload -> false).
-                if ( /^false$/i.test($trigger.getAttribute('data-gina-dialog-preload')) ) {
-                    return;
-                }
-                var url = $trigger.getAttribute('data-gina-dialog-src') || $trigger.getAttribute('data-gina-popin-url');
-                if ( !url || typeof(preloadCache[url]) != 'undefined' ) {
-                    return; // already cached or in-flight — dedup
-                }
-                preloadCache[url] = null; // reserve in-flight slot (dedup concurrent intents)
-                preloadFetch(url);
+                warmTrigger($trigger);
             };
             document.addEventListener('mouseover', onIntent);
             document.addEventListener('focusin', onIntent);
         }
 
+        /**
+         * warmTrigger — shared per-trigger warm gate + fetch, used by BOTH the
+         * hover/focus intent path (installPreload's onIntent) and the idle eager
+         * pass (installEagerPreload). Gates, in order: the disabled/aria-disabled
+         * skip, the #B91 `data-gina-dialog-preload="false"` opt-out
+         * (case-insensitive), URL resolution, the already-cached/in-flight dedup —
+         * then the in-flight slot reserve + GET. Keeping the gates in ONE place is
+         * the point: a future gate change cannot land in one warm path and miss
+         * the other.
+         *
+         * `onDone` (optional) fires on EVERY exit path — gate skip or fetch
+         * completion — so a serialized caller (the eager queue) always advances.
+         * The hover path passes none.
+         *
+         * @inner
+         * @param {object} $trigger - the matched trigger element
+         * @param {function} [onDone]
+         */
+        function warmTrigger($trigger, onDone) {
+            var _warmDone = function () {
+                if ( typeof(onDone) == 'function' ) { onDone(); }
+            };
+            if (
+                $trigger.getAttribute('disabled') != null && $trigger.getAttribute('disabled') != 'false'
+                || $trigger.getAttribute('aria-disabled') == 'true'
+            ) {
+                _warmDone();
+                return;
+            }
+            // #B91 — per-trigger preload opt-out: a trigger whose GET has server-side
+            // effects declares itself. Case-insensitive on purpose (a templated "False"
+            // must not silently fail open and fire the GET anyway); its click still
+            // loads normally, at click time (consumePreload -> false).
+            if ( /^false$/i.test($trigger.getAttribute('data-gina-dialog-preload')) ) {
+                _warmDone();
+                return;
+            }
+            var url = $trigger.getAttribute('data-gina-dialog-src') || $trigger.getAttribute('data-gina-popin-url');
+            if ( !url || typeof(preloadCache[url]) != 'undefined' ) {
+                _warmDone();
+                return; // already cached or in-flight — dedup
+            }
+            preloadCache[url] = null; // reserve in-flight slot (dedup concurrent intents)
+            preloadFetch(url, onDone);
+        }
+
+        /**
+         * installEagerPreload — one-time idle warm-all pass for triggers that opt
+         * in with `data-gina-dialog-preload="eager"` (case-insensitive). Runs off
+         * the critical path by construction: waits for `window` load, then
+         * schedules on requestIdleCallback (setTimeout fallback — load-bearing for
+         * browsers without rIC), and warms the opted-in triggers ONE AT A TIME
+         * through the same warmTrigger gate as the hover path — so the #B91
+         * `"false"` opt-out, the disabled skip, and the cache dedup (an eager warm
+         * and a hover warm coalesce into one GET) all apply identically. Skipped
+         * entirely when the browser signals Save-Data.
+         *
+         * One-shot: triggers injected after the pass are not re-scanned — the
+         * delegated hover/focus warm covers them. Content staleness matches the
+         * shipped hover-warm semantics (no TTL): the cache entry lives until
+         * consumed, declined, or page unload — a trigger opts into that window by
+         * declaring `eager`.
+         *
+         * @inner
+         */
+        function installEagerPreload() {
+            if ( _ginaEagerInstalled ) {
+                return;
+            }
+            _ginaEagerInstalled = true;
+            // Respect the user's reduced-data preference — no speculative warm at all.
+            if ( typeof(navigator) != 'undefined' && navigator.connection && navigator.connection.saveData ) {
+                return;
+            }
+            var run = function () {
+                var $candidates = document.querySelectorAll('[data-gina-dialog-src],[data-gina-popin-url]');
+                var queue = [];
+                for (var c = 0, cLen = $candidates.length; c < cLen; ++c) {
+                    if ( /^eager$/i.test($candidates[c].getAttribute('data-gina-dialog-preload')) ) {
+                        queue.push($candidates[c]);
+                    }
+                }
+                // Serialized: each warm starts only when the previous one finished
+                // (or was gate-skipped) — N eager popins never burst N parallel GETs.
+                var next = function () {
+                    var $trigger = queue.shift();
+                    if ( !$trigger ) {
+                        return;
+                    }
+                    warmTrigger($trigger, next);
+                };
+                next();
+            };
+            var schedule = function () {
+                if ( typeof(window.requestIdleCallback) == 'function' ) {
+                    window.requestIdleCallback(run);
+                } else {
+                    setTimeout(run, 1500);
+                }
+            };
+            if ( document.readyState == 'complete' ) {
+                schedule();
+            } else {
+                window.addEventListener('load', schedule, { once: true });
+            }
+        }
+
         /**
          * openInPageDialog
          *
@@ -20924,9 +21096,12 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
 
             // New `data-gina-dialog-*` entry layer — install the delegated open + preload
             // listeners once per page (module-guarded). Additive to the legacy bindOpen
-            // scan (which registerPopin still runs per popin).
+            // scan (which registerPopin still runs per popin). The eager pass warms
+            // `data-gina-dialog-preload="eager"` triggers off the critical path
+            // (post-load idle) through the same warmTrigger gate.
             bindDelegatedOpen();
             installPreload();
+            installEagerPreload();
             //instance.on('init', function(event) {
             addListener(gina, instance.target, 'init.'+instance.id, function(e) {