gina 0.5.21 → 0.5.22

package/framework/{v0.5.21 → v0.5.22}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -3136,6 +3136,15 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
     };
 
     var compileError = function(error, data) {
+        // #B87: tolerate a non-string `error` from a future call site — the only
+        // current caller is string-gated at the query result site, but nothing in
+        // this function's own contract enforces it and `error.match()` throws on
+        // anything else. A non-string carries no `{{placeholder}}` to compile, so
+        // it is returned as-is; if it then lands in `replace()` as a label, the
+        // #B86 fail-soft degrades it to the English default with a warn.
+        if ( typeof(error) != 'string' ) {
+            return error;
+        }
         var varArr = error.match(/\{\{([^{{}}]+)\}\}/g );
         // `String.match` with a /g regex yields `null` — not [] — when nothing matches, so a
         // backend field error carrying no `{{placeholder}}` (the common shape, e.g. "Already
@@ -3392,9 +3401,11 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             }
         }
 
-        var onResult = function(result) {
+        var processQueryResult = function(result) {
 
-            _this.value      = local['data'][_this.name] = (_this.value) ? _this.value.toLowerCase() : _this.value;
+            // #B87: a boolean checkbox routed through a `query` rule carries a real
+            // boolean — `.toLowerCase()` only applies to string values
+            _this.value      = local['data'][_this.name] = (_this.value && typeof(_this.value) == 'string') ? _this.value.toLowerCase() : _this.value;
 
             var isValid     = result.isValid || false;
             if (validIf != isValid) {
@@ -3504,22 +3515,67 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             console.debug('prematurely completed event `'+ 'asyncCompleted.' + id +'`');
 
             return triggerEvent(gina, _this.target, 'asyncCompleted.' + id, self[_this['name']]);
-        } // EO onResult
+        } // EO processQueryResult
+
+        /**
+         * #B87 blanket guard: the XHR result lands asynchronously, so by the
+         * time it is processed the form may have been unbound or the field
+         * detached (e.g. a popin closed mid-flight) — a throw inside the
+         * processing used to leave `asyncCompleted.<id>` unfired, hanging the
+         * submit path's async waiter for the whole pass. Warn and release the
+         * waiter with the field state as-is: the query verdict is unknown,
+         * and the server re-validates on submit either way.
+         *
+         * @inner
+         * @param {object} err - Error thrown while handling the query result
+         *
+         * @returns {undefined}
+         */
+        var releaseQueryWaiter = function(err) {
+            console.warn('[ FormValidator ] `query` result handling failed for field `'+ (_this && _this.name) +'`: '+ ( err && err.message || err ));
+            try {
+                var _releaseId = _this.target && (_this.target.id || _this.target.getAttribute('id'));
+                if (_releaseId) {
+                    triggerEvent(gina, _this.target, 'asyncCompleted.' + _releaseId, self[_this['name']]);
+                }
+            } catch (ignore) {}
+        }
+
+        /**
+         * Guarded entry point for the XHR handlers below — delegates to
+         * `processQueryResult` and routes any throw to `releaseQueryWaiter`
+         * so the async waiter can never be left hanging (#B87).
+         *
+         * @inner
+         * @param {object} result - Parsed backend response
+         *
+         * @returns {undefined}
+         */
+        var onResult = function(result) {
+            try {
+                return processQueryResult(result);
+            } catch (err) {
+                return releaseQueryWaiter(err);
+            }
+        }
 
 
         if (xhr) {
 
             xhr.onerror = function(event, err) {
+                // #B87: blanket-guarded like `xhr.onload` — a throw while shaping
+                // the error result (e.g. bad JSON under a JSON content-type) must
+                // release the async waiter, not hang it
+                try {
+                    var error = 'Transaction error: might be due to the server CORS settings.\nPlease, check the console for more details.';
+                    var result = {
+                        'status':  xhr.status, //500,
+                        'error' : error
+                    };
 
-                var error = 'Transaction error: might be due to the server CORS settings.\nPlease, check the console for more details.';
-                var result = {
-                    'status':  xhr.status, //500,
-                    'error' : error
-                };
-
-                console.debug('query error [2] detected !! ', err, error);
-                isOnException = true;
-                result = this.responseText;
+                    console.debug('query error [2] detected !! ', err, error);
+                    isOnException = true;
+                    result = this.responseText;
                     var contentType     = this.getResponseHeader("Content-Type");
                     if ( /\/json/.test( contentType ) ) {
                         result = JSON.parse(this.responseText);
@@ -3540,7 +3596,9 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                         }
                         return onResult(result);
                     }
-
+                } catch (e) {
+                    return releaseQueryWaiter(e);
+                }
             }// Eo xhr.onerror
 
             // catching ready state cb
@@ -3608,7 +3666,9 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                         return onResult(result);
                     }
                 } catch (err) {
-                    throw err;
+                    // #B87: a malformed response (e.g. bad JSON under a JSON
+                    // content-type) must release the async waiter, not hang it
+                    return releaseQueryWaiter(err);
                 }
             }// xhr.onload = function () {
 
@@ -7254,10 +7314,9 @@ function handleXhr(xhr, $el, options, require) {
         id      = $target.getAttribute('id');
     }
 
-    // forward callback to HTML data event attribute through `hform` status
+    // forward callback to HTML data event attribute through `hlink` status
+    // (registration happens in link/main.js `linkRequest` before handleXhr runs)
     var hLinkIsRequired = ( $link && $el.getAttribute('data-gina-link-event-on-success') || $link && $el.getAttribute('data-gina-link-event-on-error') ) ? true : false;
-    // if (hLinkIsRequired && $link)
-    //     listenToXhrEvents($link, 'link');
 
     // forward callback to HTML data event attribute through `hform` status
     var hFormIsRequired = ( $form && $target.getAttribute('data-gina-form-event-on-submit-success') || $form && $target.getAttribute('data-gina-form-event-on-submit-error') ) ? true : false;
@@ -7310,7 +7369,7 @@ function handleXhr(xhr, $el, options, require) {
             triggerEvent(gina, $target, 'error.' + id + '.hform', result);
 
         if (hLinkIsRequired)
-            triggerEvent(gina, $target, 'error.' + id + '.hlink', result);
+            triggerEvent(gina, $link.target, 'error.' + $link.id + '.hlink', result);
     }
 
     // catching ready state cb
@@ -7463,7 +7522,7 @@ function handleXhr(xhr, $el, options, require) {
                         triggerEvent(gina, $target, 'success.' + id + '.hform', result);
 
                     if (hLinkIsRequired)
-                        triggerEvent(gina, $target, 'success.' + id + '.hlink', result);
+                        triggerEvent(gina, $link.target, 'success.' + $link.id + '.hlink', result);
 
                 } catch (err) {
 
@@ -7497,7 +7556,7 @@ function handleXhr(xhr, $el, options, require) {
                         triggerEvent(gina, $target, 'error.' + id + '.hform', result);
 
                     if (hLinkIsRequired)
-                        triggerEvent(gina, $target, 'error.' + id + '.hlink', result);
+                        triggerEvent(gina, $link.target, 'error.' + $link.id + '.hlink', result);
                 }
 
                 // handle redirect
@@ -7588,7 +7647,7 @@ function handleXhr(xhr, $el, options, require) {
                                 triggerEvent(gina, $target, 'error.' + id + '.hform', result);
 
                             if (hLinkIsRequired)
-                                triggerEvent(gina, $target, 'error.' + id + '.hlink', result);
+                                triggerEvent(gina, $link.target, 'error.' + $link.id + '.hlink', result);
                         }
                         return;
 
@@ -7648,7 +7707,7 @@ function handleXhr(xhr, $el, options, require) {
                         triggerEvent(gina, $target, 'error.' + id + '.hform', result);
 
                     if (hLinkIsRequired)
-                        triggerEvent(gina, $target, 'error.' + id + '.hlink', result);
+                        triggerEvent(gina, $link.target, 'error.' + $link.id + '.hlink', result);
                 }
 
                 return;
@@ -7697,7 +7756,7 @@ function handleXhr(xhr, $el, options, require) {
             triggerEvent(gina, $target, 'error.' + id + '.hform', result);
 
         if (hLinkIsRequired)
-            triggerEvent(gina, $target, 'error.' + id + '.hlink', result);
+            triggerEvent(gina, $link.target, 'error.' + $link.id + '.hlink', result);
 
         return;
     };
@@ -7844,33 +7903,45 @@ function on(event, cb) {
         return this
     }
 
-    // Nothing can be added after on()
-
-
-    var listenToXhrEvents = function($el, type) {
+}
 
+/**
+ * listenToXhrEvents
+ *
+ * Registers the `data-gina-<type>-event-on-success` / `data-gina-<type>-event-on-error`
+ * HTML callbacks of a plugin element on its `success.h<type>` / `error.h<type>` XHR
+ * event channels. The attribute value must be a bare identifier resolving on `window`
+ * (function-call shapes are refused with a console warning — #M21a).
+ * Consumed by `link/main.js` `linkRequest` (type `'link'`) and by `handleXhr`'s form
+ * branch (type `'form'`); must stay top-level — both callers resolve it as a global.
+ *
+ * @function listenToXhrEvents
+ * @param {object} $el - plugin element object (a `$link`/`$form` carrying `.target` and `.on`)
+ * @param {string} type - attribute/channel type: `'link'` or `'form'`
+ * @returns {void}
+ */
+function listenToXhrEvents($el, type) {
 
-        //data-gina-{type}-event-on-success
-        var htmlSuccesEventCallback =  $el.target.getAttribute('data-gina-'+ type +'-event-on-success') || null;
-        if (htmlSuccesEventCallback != null) {
+    //data-gina-{type}-event-on-success
+    var htmlSuccesEventCallback =  $el.target.getAttribute('data-gina-'+ type +'-event-on-success') || null;
+    if (htmlSuccesEventCallback != null) {
 
-            if ( /\((.*)\)/.test(htmlSuccesEventCallback) ) {
-                // #M21a — function-call shape unsupported; register a bare handler on window instead
-                try { console.warn('[gina-event] function-call shape no longer supported on data-gina-'+ type +'-event-on-success — use a bare identifier and register the handler on window: '+ htmlSuccesEventCallback); } catch (e) {}
-            } else {
-                $el.on('success.h'+ type,  window[htmlSuccesEventCallback])
-            }
+        if ( /\((.*)\)/.test(htmlSuccesEventCallback) ) {
+            // #M21a — function-call shape unsupported; register a bare handler on window instead
+            try { console.warn('[gina-event] function-call shape no longer supported on data-gina-'+ type +'-event-on-success — use a bare identifier and register the handler on window: '+ htmlSuccesEventCallback); } catch (e) {}
+        } else {
+            $el.on('success.h'+ type,  window[htmlSuccesEventCallback])
         }
+    }
 
-        //data-gina-{type}-event-on-error
-        var htmlErrorEventCallback =  $el.target.getAttribute('data-gina-'+ type +'-event-on-error') || null;
-        if (htmlErrorEventCallback != null) {
-            if ( /\((.*)\)/.test(htmlErrorEventCallback) ) {
-                // #M21a — function-call shape unsupported; register a bare handler on window instead
-                try { console.warn('[gina-event] function-call shape no longer supported on data-gina-'+ type +'-event-on-error — use a bare identifier and register the handler on window: '+ htmlErrorEventCallback); } catch (e) {}
-            } else {
-                $el.on('error.h'+ type, window[htmlErrorEventCallback])
-            }
+    //data-gina-{type}-event-on-error
+    var htmlErrorEventCallback =  $el.target.getAttribute('data-gina-'+ type +'-event-on-error') || null;
+    if (htmlErrorEventCallback != null) {
+        if ( /\((.*)\)/.test(htmlErrorEventCallback) ) {
+            // #M21a — function-call shape unsupported; register a bare handler on window instead
+            try { console.warn('[gina-event] function-call shape no longer supported on data-gina-'+ type +'-event-on-error — use a bare identifier and register the handler on window: '+ htmlErrorEventCallback); } catch (e) {}
+        } else {
+            $el.on('error.h'+ type, window[htmlErrorEventCallback])
         }
     }
 };
@@ -9097,12 +9168,12 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/merge', 'lib/uuid', 'utils/e
             var $el         = document.getElementById(id) || null;
 
             var hLinkIsRequired = null;
-            // forward callback to HTML data event attribute through `hform` status
+            // forward callback to HTML data event attribute through `hlink` status
             hLinkIsRequired = ( $el.getAttribute('data-gina-link-event-on-success') || $el.getAttribute('data-gina-link-event-on-error') ) ? true : false;
-            // success -> data-gina-form-event-on-submit-success
-            // error -> data-gina-form-event-on-submit-error
+            // success -> data-gina-link-event-on-success
+            // error -> data-gina-link-event-on-error
             if (hLinkIsRequired)
-                listenToXhrEvents($link);
+                listenToXhrEvents($link, 'link');
 
             // if ( $el == null ) {
 
@@ -9192,33 +9263,6 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/merge', 'lib/uuid', 'utils/e
             xhr.send();
         }
 
-        // var listenToXhrEvents = function($link) {
-
-        //     //data-gina-link-event-on-success
-        //     var htmlSuccesEventCallback =  $link.target.getAttribute('data-gina-link-event-on-success') || null;
-        //     if (htmlSuccesEventCallback != null) {
-
-        //         if ( /\((.*)\)/.test(htmlSuccesEventCallback) ) {
-        //             eval(htmlSuccesEventCallback)
-        //         } else {
-        //             $link.on('success.hlink',  window[htmlSuccesEventCallback])
-        //         }
-        //     }
-
-        //     //data-gina-link-event-on-error
-        //     var htmlErrorEventCallback =  $link.target.getAttribute('data-gina-link-event-on-error') || null;
-        //     if (htmlErrorEventCallback != null) {
-        //         if ( /\((.*)\)/.test(htmlErrorEventCallback) ) {
-        //             eval(htmlErrorEventCallback)
-        //         } else {
-        //             $link.on('error.hlink', window[htmlErrorEventCallback])
-        //         }
-        //     }
-        // }
-
-
-
-
         function registerLink($link, options) {
 
             if ( typeof(options) != 'object' ) {
@@ -14721,6 +14765,27 @@ function ValidatorPlugin(rules, data, formId, culture) {
     var isCheckboxValueAsState = function($form) {
         return /^true$/i.test($form.target.dataset.ginaFormCheckboxValueAsState) ? true : false;
     }
+
+    /**
+     * #B125: tells whether the form EXPLICITLY declares the checkbox state
+     * model via `data-gina-form-checkbox-value-as-state` — any value counts:
+     * "true" is the legacy opt-in, anything else (canonically "false")
+     * declares the spec model. The #49 migration warns only fire when the
+     * attribute is entirely absent: an author who declares the model has
+     * already read it, so the migration aid has nothing left to teach — and
+     * the payload-only shape (`value="true"` with no `checked`, intended
+     * unticked) is legitimate post-#49 markup that is byte-identical to
+     * pre-#49 markup at the attribute level, so the declaration is the only
+     * intent signal available.
+     *
+     * @inner
+     * @param {object} $form - Form object (`instance.$forms[id]` shape)
+     *
+     * @returns {boolean} isCheckboxStateModelDeclared
+     */
+    var isCheckboxStateModelDeclared = function($form) {
+        return ( typeof($form.target.dataset.ginaFormCheckboxValueAsState) != 'undefined' ) ? true : false;
+    }
     // one warn per field id per page load (migration aid, #49)
     var checkboxValueStateWarned = {};
 
@@ -15047,12 +15112,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     if (
                         /^(checkbox)$/i.test($inputs[f].type)
                         && !isCheckboxValueAsState($form)
+                        && !isCheckboxStateModelDeclared($form)
                         && !$inputs[f].hasAttribute('checked')
                         && /^(true|on)$/i.test($inputs[f].getAttribute('value'))
                         && !checkboxValueStateWarned[elId]
                     ) {
                         checkboxValueStateWarned[elId] = true;
-                        console.warn('[ FormValidator ] checkbox `'+ elId +'`: `value` no longer implies the checked state; add the `checked` attribute if it must render ticked, or set `data-gina-form-checkbox-value-as-state="true"` on the form to restore the legacy behavior');
+                        console.warn('[ FormValidator ] checkbox `'+ elId +'`: `value` no longer implies the checked state; add the `checked` attribute if it must render ticked, or set `data-gina-form-checkbox-value-as-state="true"` on the form to restore the legacy behavior. If the unticked rendering is intended, remove the `value` attribute (a boolean checkbox posts its live checked state either way), or set `data-gina-form-checkbox-value-as-state="false"` on the form to declare the current model and silence migration warnings');
                     }
 
                     // Migration aid (#49) — the mirror direction: this markup used to be
@@ -15066,12 +15132,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     if (
                         /^(checkbox)$/i.test($inputs[f].type)
                         && !isCheckboxValueAsState($form)
+                        && !isCheckboxStateModelDeclared($form)
                         && $inputs[f].hasAttribute('checked')
                         && ( legacyUntickValue === '' || /^false$/i.test(legacyUntickValue) )
                         && !checkboxValueStateWarned[elId]
                     ) {
                         checkboxValueStateWarned[elId] = true;
-                        console.warn('[ FormValidator ] checkbox `'+ elId +'`: `value` no longer un-ticks a checked box; remove the `checked` attribute if it must render unticked, or set `data-gina-form-checkbox-value-as-state="true"` on the form to restore the legacy behavior');
+                        console.warn('[ FormValidator ] checkbox `'+ elId +'`: `value` no longer un-ticks a checked box; remove the `checked` attribute if it must render unticked, or set `data-gina-form-checkbox-value-as-state="true"` on the form to restore the legacy behavior. If the ticked rendering is intended, set `data-gina-form-checkbox-value-as-state="false"` on the form to declare the current model and silence migration warnings');
                     }
                 }
             }
@@ -17362,9 +17429,32 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 if ( /^is\d+$/.test(rule) && typeof(d[field][rule]) == 'undefined' ) { // is aliases
                     d[field][rule] = function(){};
                     d[field][rule] = inherits(d[field][rule], d[field][ rule.replace(/\d+/, '') ]);
-                    d[field][rule].setAlias = (function(alias) {
-                        this._currentValidatorAlias = alias
-                    }(rule));
+                    // #B138 — arm the alias handshake PER INVOCATION, not per install.
+                    // The old install-time IIFE armed the shared `_currentValidatorAlias`
+                    // slot ONCE (this install branch is gated once-per-instance), while
+                    // form-validator's is() CONSUMES the slot with a delete on every
+                    // call — so on any re-application against the same instance (a
+                    // `conditions`/_case_ re-evaluation, forEachField recursion) the
+                    // slot was empty: every numbered rule collapsed onto the shared key
+                    // 'is', the last-declared rule overwrote its siblings there, and its
+                    // message rendered TWICE (its own key + the collapsed 'is' key — the
+                    // error-display loop has no message dedup). The wrapper re-arms the
+                    // slot immediately before every delegation, so is<N> keys stay
+                    // distinct on every application. Root resolution mirrors
+                    // form-validator's _aliasRoot (browser window / server global).
+                    // was:
+                    // d[field][rule].setAlias = (function(alias) {
+                    //     this._currentValidatorAlias = alias
+                    // }(rule));
+                    d[field][rule] = (function (aliasName, composed) {
+                        return function () {
+                            var _aliasRoot = ( typeof(window) != 'undefined' ) ? window : ( ( typeof(global) != 'undefined' ) ? global : null );
+                            if (_aliasRoot) {
+                                _aliasRoot._currentValidatorAlias = aliasName;
+                            }
+                            return composed.apply(this, arguments);
+                        };
+                    }(rule, d[field][rule]));
                 }
                 // skip when not processing rule function
                 if ( typeof(d[field][rule]) != 'function' ) {
@@ -18328,6 +18418,14 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
      * Shared across popin instances so a warm entry survives the subsequent
      * click. A reserved-but-not-yet-loaded entry is `null` (in-flight).
      *
+     * #B139 — an entry never outlives the open it warmed: popinUnbind clears
+     * the consumed URL's slot at close (clearContentPreload), so a reopen's own
+     * hover/focus warm fetches CURRENT content instead of dedup-ing against a
+     * previous open's leftover. Pre-fix the leftover (the around-open re-warm,
+     * or the #B54 in-flight adoption's repopulated body) blocked the fresh warm
+     * and every open rendered the PREVIOUS open's fetch — a one-generation-
+     * lagging cache paying ~1 GET per open for content it never showed.
+     *
      * @inner
      * @type {object}
      */
@@ -18997,6 +19095,10 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                     if ( body == null ) {
                         if ( typeof(onMiss) == 'function' ) { onMiss(); }
                     } else {
+                        // #B139 — record the content's source URL so close can
+                        // clear the (repopulated) slot: the completion writes the
+                        // cache back even after this adoption consumed the body.
+                        $popin._contentUrl = url;
                         handleLoadedBody(body, $popin, ensurePopinDialog($popin));
                     }
                 });
@@ -19004,11 +19106,76 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
             }
             var body = slot;
             delete preloadCache[url];
+            // #B139 — record the content's source URL so close can clear any
+            // around-open re-warm parked at the same key (the leftover that made
+            // the NEXT open render this open's generation).
+            $popin._contentUrl = url;
             var $el = ensurePopinDialog($popin);
             handleLoadedBody(body, $popin, $el);
             return true;
         }
 
+        /**
+         * clearContentPreload — #B139: the preload cache must not outlive the
+         * open it warmed. Called from popinUnbind at the same lifecycle moment
+         * the AJAX body is wiped from the DOM: deletes the popin's content-URL
+         * slot so the NEXT open's own hover/focus warm (or click-time load)
+         * fetches current content instead of dedup-ing against this open's
+         * leftover. An in-flight slot gets a discard waiter instead — the
+         * fetch completion writes the cache BEFORE firing waiters, so the
+         * waiter deletes the just-written entry (and the failure path's own
+         * delete makes the double-delete a no-op).
+         *
+         * Never-opened warms are untouched (no close ever ran for them): the
+         * eager pass keeps its documented no-TTL page-lifetime semantics.
+         *
+         * @inner
+         * @param {object} $popin
+         */
+        function clearContentPreload($popin) {
+            var url = $popin._contentUrl;
+            if ( !url ) {
+                return;
+            }
+            $popin._contentUrl = null;
+            clearPreloadSlot(url);
+        }
+
+        /**
+         * clearPreloadSlot — #B139 slot-clearing core: deletes a ready slot;
+         * an in-flight slot gets a discard waiter (the fetch completion writes
+         * the cache BEFORE firing waiters, so the waiter deletes the
+         * just-written entry — and the failure path's own delete makes the
+         * double-delete a no-op). Split out of clearContentPreload so the
+         * close path can re-sweep the URL after the teardown task (see
+         * popinUnbind): the a11y focus-return and the pointer's re-hover after
+         * overlay removal fire TRUSTED synthetic intent events DURING teardown
+         * (measured: focusin → GET within 1ms of the close), re-warming the
+         * just-cleared URL with close-era content. A raced sweep is benign by
+         * construction — an adopted in-flight body still reaches its open via
+         * the waiter chain; only the cached copy dies, costing at most one
+         * extra fetch, never staleness.
+         *
+         * @inner
+         * @param {string} url
+         */
+        function clearPreloadSlot(url) {
+            var slot = preloadCache[url];
+            if ( typeof(slot) == 'undefined' ) {
+                return;
+            }
+            if ( slot === null ) {
+                if ( typeof(preloadWaiters[url]) == 'undefined' ) {
+                    preloadWaiters[url] = [];
+                }
+                preloadWaiters[url].push(function () {
+                    delete preloadCache[url];
+                });
+                return;
+            }
+            delete preloadCache[url];
+        }
+
         /**
          * installPreload — one-time delegated `mouseover` + `focusin` listeners that warm
          * preloadCache for AJAX triggers (`data-gina-dialog-src` / legacy
@@ -19267,7 +19434,12 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                 // Consume a warmed OR in-flight preload; else fall through to a click-time XHR.
                 var loadOptions = merge({ isSynchrone: false, withCredentials: false }, existing.options);
                 var onMiss = function () { popinLoad(name, descriptor.src, loadOptions); };
-                if ( consumePreload(descriptor.src, existing, onMiss) ) {
+                // #B139 companion — `preload="false"` is the always-refetch spelling:
+                // such a trigger must NEVER serve cached content (not even a same-URL
+                // sibling trigger's warm), so skip the consume entirely — its GET
+                // always happens at open time.
+                var _noPreload = /^false$/i.test($trigger.getAttribute('data-gina-dialog-preload'));
+                if ( !_noPreload && consumePreload(descriptor.src, existing, onMiss) ) {
                     return;
                 }
                 onMiss();
@@ -19417,7 +19589,11 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                             // #B54 — reuse a hover/focus preload (warmed OR in-flight) for the
                             // same URL instead of firing a second identical GET. Mirrors the
                             // new data-gina-dialog path (openFromTrigger).
-                            if ( consumePreload(url, $popin, doLoad) ) {
+                            // #B139 companion — `preload="false"` triggers skip the consume:
+                            // always-refetch means the GET happens at open time, never from
+                            // the cache (see the openFromTrigger twin).
+                            var _noPreload = /^false$/i.test(this.getAttribute('data-gina-dialog-preload'));
+                            if ( !_noPreload && consumePreload(url, $popin, doLoad) ) {
                                 return;
                             }
                             doLoad();
@@ -20085,6 +20261,12 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
             var id              = $popin.id;
             var $popinTrigger   = document.getElementById($popin.openTrigger) || null;
 
+            // #B139 — record the content's source URL for the close-time cache
+            // clear (covers every click-time load path, incl. validator redirects).
+            if (url) {
+                $popin._contentUrl = url;
+            }
+
             // set as active if none is active
             if ( !gina.popin.activePopinId ) {
                 setActivePopinId(id);
@@ -20828,6 +21010,22 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                         // (the legacy default), whose body was injected at load time.
                         if ( !$popin.isInPageDialog ) {
                             $el.innerHTML                       = '';
+                            // #B139 — the content cache dies with the content: clear
+                            // this popin's URL slot so the next open warms FRESH
+                            // instead of consuming this open's leftover — then SWEEP
+                            // the same slot once the teardown task has drained: the
+                            // close-time focus-return and pointer re-hover re-warm
+                            // the URL within ~1ms (measured), refilling it with
+                            // close-era content the next open would serve stale. The
+                            // sweep's race direction is benign (at most one extra
+                            // fetch, never stale content).
+                            var _closedContentUrl = $popin._contentUrl;
+                            clearContentPreload($popin);
+                            if ( _closedContentUrl ) {
+                                setTimeout(function () {
+                                    clearPreloadSlot(_closedContentUrl);
+                                }, 120);
+                            }
                         }
                     }
                     // Fixed: clear loading state on reset — defensive cleanup for navigation