gina 0.6.11-alpha.2 → 0.6.11

package/CHANGELOG.md

@@ -6,6 +6,16 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.11 - 2026-08-19
+### Fixed
+* The Inspector's View tab could show two badges instead of three, dropping the page-weight badge until the Inspector was refreshed, and its Flow tab could be missing the template-compile, execute, response-write and total bars (#B386). Both came from one cause: the dev statusbar hands the page payload to the Inspector before the render delegates append their late-bind patch script above `</body>`, and that patch only mutated the in-memory object. Every channel the Inspector can read therefore kept the emit-time payload for the life of the page, with the page weight left null (it is unknown at emit, since the response body length is not final until the render completes) and the late timeline entries absent. The asymmetry is what made it look intermittent rather than broken: the server-side processing time IS known at emit, so the load badge always rendered while the weight badge silently did not. Both of the Inspector's data channels are now refreshed at the end of that patch, after the values are written: the localStorage fallback mirror, and the per-tab broadcast channel a statusbar-launched Inspector actually binds to. The broadcast channel is keyed from per-tab session storage rather than the shared cross-tab advert, so one tab can never publish onto another tab's channel. The nunjucks delegate additionally now injects its patch through a function replacer rather than a string one, so a timeline entry containing a dollar-sequence can no longer corrupt the emitted script. Development-mode only; no configuration change is required.
+* FormValidator: on Safari, fast typing into a live-checked `autocomplete="off"` text input no longer scrambles the text (gh issue #63). The keydown interception restored the caret only two timer hops after each programmatic value rebuild — and a value assignment parks the caret at the end of the field — so a quick second keystroke read a stale position and characters landed at the end instead of at the caret. Every rebuild now commits the caret synchronously and records the intended position on the element; while a deferred restore is still in flight the interception trusts that recorded position, and the restore re-asserts the latest committed position instead of a stale per-keystroke capture. The transient-readonly autofill suppression is mechanism-unchanged. Browser-bundled: rebuild your bundles to pick it up.
+* FormValidator: three position-0 edge defects in the same Safari `autocomplete="off"` keydown interception now match native field behavior — Backspace at the start of the field deleted the first character (native is a no-op), Delete with a selection starting at position 0 removed one character more than the selection, and ArrowLeft at position 0 teleported the caret to the end of the field (`setSelectionRange(-1)` wraps to the unsigned maximum). Browser-bundled: rebuild your bundles to pick it up.
+* FormValidator: on a form with an async `query` rule and a committed error, a refused submit's answer could render, take focus, and then be hidden again milliseconds later when the click landed while a previous validation round was still settling — the late completion's display refresh read the answered field as "being typed in" (it was the active element) and re-hid the very message the answer had just rendered. The error message and its field focus now stay put: the framework records that the focus was placed by the answer rather than by the user, both display-refresh paths honour that record however late they run, and the first genuine user interaction (typing, clicking, tabbing away) releases it so the deliberate hide-while-typing behaviour is unchanged (#B387). Browser-bundled: rebuild your bundles to pick it up.
+* FormValidator: on a form whose async `query` rule rides a field that is not declared last, the display-only validation pass answering a refused submit click could silently never complete — its result matched no completion route — so the stale not-ready marker on the submit trigger was never re-synced and a fully valid form kept refusing every click until reload. The reveal pass now carries its own completion identity and always completes: the refused click renders the current validation state, the trigger state re-syncs from the fresh result, and the next click on a valid form goes through. Field declaration order no longer decides whether a stale marker can heal (#B348). Browser-bundled: rebuild your bundles to pick it up.
+* `Collection.replace()` no longer silently discards the write when the stored entry carries an internal `_uuid` and the caller's `set` object does not (#B393, gh issue #64). The comparison key was resolved by inspecting the stored entry alone, so in that one combination neither the `id` fallback nor the "no comparison key" refusal applied and the comparison became `<storedUuid> == undefined` — never true. Nothing matched, nothing was replaced, no error was raised, and the call returned a result that looked successful: a silent, lossy write. A stored `_uuid` is present exactly when the caller re-loaded an array a previous chained call had returned, which is why the failure looked intermittent rather than constant. The key is now resolved from BOTH sides — the stored entry and the `set` — falling back to `id` when both carry one, and the call now refuses loudly when the two sides share no usable key at all, so the one unmatchable combination is no longer the only one that stays quiet. An explicitly named comparison key is still honoured exactly as given, and the resolved key is scoped per entry rather than shared, so a fallback taken for one entry can no longer apply to the entries examined after it. Every previously-working call is unaffected. Browser-bundled: rebuild your bundles to pick it up.
+* Concurrent `util.promisify(entity.method)` calls on the same entity method no longer cross-deliver results or leave a caller hanging (#B394). The promisify fast-path kept a single scalar callback slot: a second in-flight call overwrote the first, so the first result to arrive was delivered to the last caller to register (one caller receiving another's record), and the displaced caller's promise never settled at all — a request left hanging with nothing logged, and a read-modify-write variant that could persist one key's document under another. The entity-context path already used a FIFO queue with a single persistent dispatch listener; the fast-path now uses the same shape, so every concurrent caller settles and, when the underlying operations complete in the order they were called, each caller receives its own result. When operations can complete out of call order, results are still paired by arrival order — give such a method true per-call identity by returning a Promise instead of emitting its trigger (see the Models guide's concurrency note). Server-side only; pick it up with a bundle restart.
+
 ## 0.6.10 - 2026-08-16
 
 ### Added

package/README.md

@@ -61,28 +61,32 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.10
+## What's in 0.6.11
 
-> **Restart your bundles — no re-bake.** The browser bundle is byte-identical to
-> `0.6.9` (verified), so `gina bundle:restart` is enough; this release is
-> server-side only.
+> **Restart your bundles AND rebuild them.** The browser bundle changed in this
+> release (`Collection.replace()` and the four FormValidator fixes are bundled),
+> so a restart alone keeps serving the old client code — run `gina bundle:build`
+> for each bundle as well as `gina bundle:restart`.
 
-> **No settings reset.** `0.6.10` is a patch — the `shortVersion` stays `0.6`, so
+> **No settings reset.** `0.6.11` is a patch — the `shortVersion` stays `0.6`, so
 > your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**This release adds maintenance mode and closes a cross-site request forgery hole
-in the admin endpoints.** It also makes boot-time bundle mounts safe when several
-processes share one project tree — replicas over a POSIX network filesystem, or
-containers bind-mounting a single checkout. **Two behaviour changes to check
-before you upgrade** — a real directory sitting at a bundle's mount path is now
-refused loudly instead of being silently deleted, and cross-origin writes to the
-`/_gina/*` control endpoints are now refused. Both are covered in the
-[migration guide](https://gina.io/docs/migration).
-
-- **Added — maintenance mode.** A bundle can now be closed to the public without being stopped, via `settings.json > server.maintenance`. While a window is open every request except the framework's own `/_gina/*` endpoints is answered `503` with a `Retry-After` header and `Cache-Control: no-store`, carrying a self-contained page for a browser navigation and the standard JSON body for XHR, SPA-fragment and JSON callers. The gate runs on **both engines**, placed ahead of static assets, both output-cache serve points and routing — so unlike a route middleware, which only runs once a route has matched, it also covers static files and URLs that match no route at all. The liveness endpoint deliberately keeps answering `200`, so an orchestrator does not restart healthy instances over a declared window, and the toggle itself stays reachable so you are never stranded outside your own off switch. Chosen visitors can still browse: a shared bypass key works as a header, or once in the address bar — which then sets a short-lived cookie and redirects without the secret — under any deployment; the supplementary IP allowlist applies only to requests that did not arrive through a reverse proxy, since behind one every address is the proxy's. Maintenance can also be flipped at runtime through an admin-gated endpoint with an optional expiry; a runtime flip is not persisted, and a lapsed expiry reverts to your *configuration* rather than to "off", so a forgotten timer cannot re-open a site that configuration says is closed.
-- **Security — cross-origin writes to admin `/_gina/*` endpoints are refused (#B384).** Present in every release up to and including `0.6.9`. These endpoints authorise callers by IP allowlist alone (`app.json` `admin.allowFrom`, loopback by default), and a browser attaches that ambient credential automatically — so an operator browsing from an allowlisted machine could be lured to a page that silently issued writes to `/_gina/storage/gc`, `/_gina/cache/clear`, `/_gina/release/rebuild` or `/_gina/maintenance`. The first three read their entire input from the query string and never read a body, so the attack needed no JavaScript and no CORS involvement at all: a plain auto-submitting form was enough. Such a write is now refused with `403` on both engines, using `Sec-Fetch-Site` where the browser sends it and comparing `Origin` against the connected authority otherwise — never against a forwarded header. **Two things are deliberately unaffected:** requests carrying no browser origin signal (`curl`, the gina CLI, deploy scripts) still work, so operator tooling is unchanged; and safe methods are untouched, so cross-origin `GET`/SSE channels keep working. No configuration change is required.
-- **Fixed — boot-time bundle mounts are idempotent, atomic and concurrency-safe.** Every boot re-created every declared bundle's mount symlink in two non-atomic steps — unlink, then create — with no mutual exclusion anywhere in the framework, and the config loader did it for *every* declared bundle on *every* load. With a single process that is invisible. With several processes booting one shared project tree it is a race on the same directory entries: the mount name genuinely disappears between the two steps, so a boot could fail outright on a contended create, and because the configuration load is shared, one contended link could abort it for every bundle in the project. Mounting is now idempotent and atomic. A link that already resolves to its intended source is left completely alone — the steady-state boot writes nothing at all, which is what removes the contention rather than merely surviving it. A wrong or missing link is published atomically through a temporary sibling and a rename, so the name is never absent and two processes cannot collide. And a process that loses the race to another one publishing the *identical* link now treats that as success instead of refusing to boot. Genuine failures are still loud: a release whose source has vanished, or a real directory occupying the mount path, refuse by name. The same class of race is closed on the directory creation that accompanies a mount. **Contract note:** a real directory at a bundle's mount path used to be deleted and replaced with the link during config load, and now refuses the boot instead — if you hit that, remove or relocate the directory.
-- **Docs — the guidance on addressing an out-of-request push is corrected.** `0.6.9` introduced `gina.pushToSession()` and warned against sourcing its recipient from the browser. That warning was written broadly enough to read as forbidding a **server-minted, integrity-protected token** that names the recipient — which is in fact the sanctioned shape, and the one the authenticated-hop pattern already relied on. The prohibition is now scoped to what it always meant: a *bare* recipient id in a client-writable field. The sanctioned shape is documented with the conditions that make it safe — verify the token and derive the recipient only from its verified claims, fail closed when it is absent or unverifiable, and keep it short-lived, since targeting integrity is not replay immunity.
+**This is a fixes-only release: seven fixes, two of them reported through GitHub
+issues (#63, #64).** It closes a silent lossy write in `Collection.replace()`, a
+cross-delivery / hang defect for concurrent `util.promisify(entity.method)`
+calls, four FormValidator defects (Safari caret scrambling plus three caret edge
+cases, and two submit-time display races on async-`query` forms), and a
+development-mode Inspector data-channel staleness. **One behaviour change to
+check before you upgrade** — `Collection.replace()` now throws where it
+previously failed silently, when neither side of the comparison carries a usable
+key. Details are in the [migration guide](https://gina.io/docs/migration).
+
+- **Fixed — `Collection.replace()` no longer silently discards the write (#B393, issue #64).** When the stored entry carried an internal `_uuid` and the caller's `set` object did not, the comparison key was resolved from the stored entry alone, so the comparison became `<storedUuid> == undefined` — never true: nothing matched, nothing was replaced, no error was raised, and the call returned a result that looked successful. A stored `_uuid` is present exactly when you re-load an array a previous chained call returned, which is why the failure looked intermittent. The key is now resolved from **both** sides — the stored entry and the `set` — falling back to `id` when both carry one, and the call now **throws `No comparison key defined !`** when the two sides share no usable key, so the one unmatchable combination is no longer the only one that stays quiet. An explicitly supplied key argument is honoured exactly as before, and the resolved key is scoped per entry, so a fallback taken for one entry can no longer apply to the entries examined after it. Every previously-working call is unaffected. Browser-bundled.
+- **Fixed — concurrent `util.promisify(entity.method)` calls no longer cross-deliver results or leave a caller hanging (#B394).** The promisify fast-path kept a single scalar callback slot: a second in-flight call on the same method overwrote the first, so the first result to arrive was delivered to the last caller to register (one caller receiving another's record), and the displaced caller's promise never settled — a request left hanging with nothing logged, and a read-modify-write variant that could persist one key's document under another. The fast-path now uses the same FIFO queue and single persistent dispatcher as the entity-context path: every concurrent caller settles, and when the underlying operations complete in the order they were called, each caller receives its own result. When operations can complete out of call order, results are still paired by arrival order — give such a method true per-call identity by returning a Promise instead of emitting its trigger (see the [Models guide](https://gina.io/docs/guides/models)). Server-side.
+- **Fixed — FormValidator: fast typing into a Safari `autocomplete="off"` field no longer scrambles the text (#B389, issue #63), plus three position-0 edge cases in the same interception (#B390, #B391, #B392).** The keydown interception restored the caret two timer hops after each programmatic value rebuild — and a value assignment parks the caret at the end of the field — so a quick second keystroke read a stale position and characters landed at the end instead of at the caret. Every rebuild now commits the caret synchronously and records the intended position; while a deferred restore is in flight the interception trusts that record, and the restore re-asserts the latest committed position instead of a stale capture. In the same switch, Backspace at position 0 no longer deletes the first character (native is a no-op), Delete with a selection starting at position 0 no longer removes one character more than the selection, and ArrowLeft at position 0 no longer teleports the caret to the end of the field. Browser-bundled.
+- **Fixed — FormValidator: a refused submit's answer stays visible and focused on async-`query` forms (#B387).** On a form with an async `query` rule and a committed error, a refused submit's answer could render, take focus, and then be hidden again milliseconds later when the click landed while a previous validation round was still settling — the late completion's display refresh read the answered field as "being typed in" (it was the active element, because the answer had just focused it) and re-hid the very message the answer had rendered. The framework now records that the focus was placed by the answer rather than by the user, both display-refresh paths honour that record however late they run, and the first genuine user interaction (typing, clicking, tabbing away) releases it — so the deliberate hide-while-typing behaviour is unchanged. Browser-bundled.
+- **Fixed — FormValidator: a stale not-ready submit marker can no longer refuse every click until reload (#B348).** On a form whose async `query` rule rides a field that is not declared last, the display-only validation pass answering a refused submit click could silently never complete — its result matched no completion route — so the stale not-ready marker on the submit trigger was never re-synced and a fully valid form kept refusing every click. That pass now carries its own completion identity and always completes: the refused click renders the current validation state, the trigger state re-syncs from the fresh result, and the next click on a valid form goes through. Field declaration order no longer decides whether a stale marker can heal. Browser-bundled.
+- **Fixed — Inspector (development mode): the View tab's page-weight badge and the Flow tab's late timeline bars no longer go missing until the Inspector is refreshed (#B386).** The dev statusbar hands the page payload to the Inspector before the render delegates append their late-bind patch script above `</body>`, and that patch only mutated the in-memory object — so every channel the Inspector can read kept the emit-time payload for the life of the page, with the page weight left null (it is unknown at emit) and the template-compile, execute, response-write and total bars absent. Both of the Inspector's data channels — the localStorage fallback mirror and the per-tab broadcast channel a statusbar-launched Inspector actually binds to — are now refreshed at the end of that patch, after the values are written; the broadcast channel is keyed from per-tab session storage rather than the shared cross-tab advert, so one tab can never publish onto another tab's channel. The nunjucks delegate additionally injects its patch through a function replacer rather than a string one, so a timeline entry containing a dollar sequence can no longer corrupt the emitted script. Server-side; development mode only; no configuration change is required.
 
 ## Documentation
 

package/ROADMAP.md

@@ -60,8 +60,9 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.6` ✅ | **Fixed**: the logging-transport release. A slow boot no longer silences a bundle's logging for the life of the process — a two-second connect deadline added in `0.6.5` read a socket flag Node clears one event-loop phase later, so any boot that blocked the loop past it destroyed a connection the kernel had already established (every container start and network-filesystem mount was exposed, and the transport never redialled). The MQ and file log transports also stopped dialling `host_v4`, which on a `~/.gina` shared across hosts silently shipped every log line off-host while all connection lines read healthy. Plus: the popin `success` event fires again instead of raising a 422 carrying the successful response body; a link request belongs to the anchor you clicked rather than the first anchor sharing its url; and constructing the link handler twice no longer corrupts the first instance · **Added**: the log transport reconnects — exponential backoff to a 30-second ceiling, one report per outage, frames dropped rather than queued while down so an outage cannot grow memory |
 | **Q4 2026** | `0.6.7` ✅ | **Added**: the object-storage release — a `storage` block declares named drivers (an adapter crossed with a strategy) reachable as `gina.storage()`, publishing objects atomically under opaque keys with their metadata written through a pluggable store seam; a content-addressed `cas` strategy deduplicates identical bytes behind a reference count, reclaiming them only after a grace-gated sweep; size tiering keeps sub-`64KB` objects inline in the metadata store, measurably faster than per-file writes; `storage:stats` / `storage:gc` / `storage:verify` operate a bundle's drivers whether it is running or stopped, through always-on admin-gated endpoints; and an upload group can route its `self.store()` step straight into a driver · **Security**: bound query parameter values no longer reach dev consoles or the Inspector query log — count and type markers replace them, with `inspector.queries.captureValues` to opt back in · **Fixed**: the `is` rule compiles regex literals as authored instead of stripping their parentheses (stricter — review patterns containing parens), forms with an async `query` rule complete correctly across a cluster of interacting defects (a submit leaving before the verdict landed, a completion carrying only the query field's slice, a re-click clearing later fields' errors, a clean form whose query field was not declared last never submitting at all, replayed submits from stale listeners, and an id-less trigger bound twice), `getConfig().settings` resolves path placeholders, `req.files[].group` reports the resolved group instead of `undefined`, and the Inspector's Data and Forms tabs stop putting framework-internal keys and the bundle catalog above your own data · **Changed**: framework default looks ship inside a `@layer gina` cascade layer, so any un-layered project rule overrides them without `!important` |
 | **Q4 2026** | `0.6.8` ✅ | **Security**: `self.push()` decides its recipient server-side instead of reading it from the request, where a supplied session id aimed the push at any session and an absent one broadcast to every connected client (ACTION REQUIRED — a bare worker push over an HTTP hop that carried the recipient IN THE REQUEST stops delivering; where the hop is authenticated the controller can pass `{ sessionID }` explicitly and keep working, and a worker with no request context at all polls `GET /_gina/jobs/:id`) · forwarded headers (`X-Forwarded-Host`, `-Proto`, `-Prefix` and the request's own `Host`) are validated where they are read, closing a reflected-XSS path that spliced them unescaped into the client bootstrap script emitted on every rendered page · **Added**: storage metadata can live on Couchbase, which is what makes a driver root shareable across bundles and replicas; a `stream` strategy for large sequential media brings resumable, out-of-order, restart-surviving uploads whose finalise verifies coverage as an interval union and refuses to publish a gap; HTTP Range serving through `self.serveFromStorage()` on both engines, with conditional GET and a fail-closed content-type downgrade; the `s3` adapter completes the pluggable object-storage layer, storeless by design and able to offload GET/HEAD to a presigned URL; `getRange()` on every local strategy; machine-readable `err.code` on storage read verbs; and the Couchbase soak probes ship in the package · **Changed**: `renderStream()` is byte-serving-capable — `Buffer` chunks pass through verbatim on non-SSE content types (binary payloads previously arrived corrupted), HEAD answers headers-only without consuming the iterable, and caller-set headers are no longer clobbered · **Fixed**: `renderStream()` honours a caller-set status on both engines and stops throwing a swallowed error at the end of every streamed response, a redirect treats `HEAD` as the safe method it is and keeps the caller's query string under `keep-params: true`, and a local storage driver reclaims the temp files left behind by a crashed or refused `put()` |
-| **Q4 2026** | `0.6.10` ✅ | **Added**: maintenance mode — a bundle can be closed to the public without being stopped. When it is active every request except the framework's own built-in endpoints is answered `503` with a `Retry-After` header and a self-contained maintenance page, and the response is marked never to be stored so a cached copy cannot outlive the window. The gate runs on both engines ahead of static assets, the output cache and routing, so it also covers files and URLs that a route middleware never sees. The liveness endpoint deliberately keeps answering normally, so an orchestrator does not restart healthy instances over a declared window. Chosen visitors can still browse: a shared bypass key presented as a header or once in the address bar (which then sets a short-lived cookie and redirects without the secret) works under any deployment, while the supplementary IP allowlist applies only to requests that did not arrive through a reverse proxy — behind one, every address is the proxy's, so an unconditioned list would let either everybody or nobody through. Maintenance can be flipped at runtime through an administrator-gated endpoint with an optional expiry; a runtime flip is not persisted, and an expiry reverts to the configured state rather than to off, so a forgotten timer cannot re-open a site that configuration says is closed. **Fixed**: boot-time bundle mounts are idempotent, atomic and concurrency-safe — a mount symlink that already resolves to its source is left untouched (so the steady-state boot writes nothing), a wrong or missing one is published atomically through a temp sibling and a rename, and a process that loses the race to another publishing the identical link treats that as success instead of refusing to boot. Previously every boot re-created every declared bundle's link in two non-atomic steps with no mutual exclusion, so several processes sharing one project tree raced the same directory entries and a contended link could fail a boot or abort the shared configuration load for every bundle in the project. The same race is closed on the directory creation that accompanies a mount. Behaviour change: a real directory occupying a mount path is now refused by name instead of silently deleted. **Security**: cross-origin writes to the administrator-gated built-in endpoints are refused. Those endpoints authorise callers by network address alone — a credential a browser attaches automatically — so an operator browsing from an allowed machine could be lured to a page that silently issued writes to them; and because several of them read their whole input from the address rather than from a request body, the attack needed no scripting and no cross-origin negotiation at all. Such a write is now refused on both engines, using the browser's own request-context signal where it is sent, and otherwise comparing the stated origin against the address the client actually connected to — never against a forwarded header, which an attacker controls. Clients that send no browser origin signal, such as command-line tooling and deployment scripts, are deliberately unaffected, as are safe methods, so existing cross-origin read channels keep working. | `0.6.10` | 2026-08-16 |
 | **Q4 2026** | `0.6.9` ✅ | **Security**: an engine.io socket's session identity is derived server-side from the upgrade request's own cookie instead of a field the browser asserts on every message — any client could previously claim another user's session and receive the pushes addressed to it, which took strictly less than stealing the cookie, since a rendered page carries the bare session id while the cookie carries the signed form; the binding replays the bundle's own session middleware (same secret, store and cookie name, no new configuration) and fails closed, so an id-less socket receives only deliberate broadcasts · **Added**: `gina.pushToSession()` gives code with no request context — a job handler, a cron tick, a boot hook — a sanctioned route to a user's socket, with a required recipient, no reachable broadcast, and delivery reported rather than assumed; and a bundle can declare which scopes it is deployed in through a `scopes` allow-list on its manifest entry, so one still under development stays out of every other scope · **Fixed**: `engine: "express"` bundles boot and serve on Express 5, with the supported range declared for the first time (`>= 4 < 6`, both majors verified live) · `project:add`/`project:import` no longer empty a project's `bundles` block on a declared-count mismatch, no longer adopt a bundle's invalid `server.protocol`/`server.scheme` into the project's registry lists, and no longer resolve one project's bundles against another project's path · `project:add` writes the `.gitignore` the shipped template's underscore prefix has always implied · the path helper's copier stages to a temp sibling and publishes with an atomic rename, so a failed copy can no longer destroy the destination it was replacing · the secrets resolver reads its two environment tiers independently, so a swept boolean no longer lets a plaintext file shadow `process.env`, and three malformed `settings.secrets.file` shapes that used to pass in silence are caught (ACTION REQUIRED — two of them now refuse to boot) · a bundle whose release tree cannot be linked refuses by name instead of dying as an opaque TypeError · `self.push()` refuses by name when the server instance has no engine.io channel |
+| **Q4 2026** | `0.6.10` ✅ | **Added**: maintenance mode — a bundle can be closed to the public without being stopped. When it is active every request except the framework's own built-in endpoints is answered `503` with a `Retry-After` header and a self-contained maintenance page, and the response is marked never to be stored so a cached copy cannot outlive the window. The gate runs on both engines ahead of static assets, the output cache and routing, so it also covers files and URLs that a route middleware never sees. The liveness endpoint deliberately keeps answering normally, so an orchestrator does not restart healthy instances over a declared window. Chosen visitors can still browse: a shared bypass key presented as a header or once in the address bar (which then sets a short-lived cookie and redirects without the secret) works under any deployment, while the supplementary IP allowlist applies only to requests that did not arrive through a reverse proxy — behind one, every address is the proxy's, so an unconditioned list would let either everybody or nobody through. Maintenance can be flipped at runtime through an administrator-gated endpoint with an optional expiry; a runtime flip is not persisted, and an expiry reverts to the configured state rather than to off, so a forgotten timer cannot re-open a site that configuration says is closed. **Fixed**: boot-time bundle mounts are idempotent, atomic and concurrency-safe — a mount symlink that already resolves to its source is left untouched (so the steady-state boot writes nothing), a wrong or missing one is published atomically through a temp sibling and a rename, and a process that loses the race to another publishing the identical link treats that as success instead of refusing to boot. Previously every boot re-created every declared bundle's link in two non-atomic steps with no mutual exclusion, so several processes sharing one project tree raced the same directory entries and a contended link could fail a boot or abort the shared configuration load for every bundle in the project. The same race is closed on the directory creation that accompanies a mount. Behaviour change: a real directory occupying a mount path is now refused by name instead of silently deleted. **Security**: cross-origin writes to the administrator-gated built-in endpoints are refused. Those endpoints authorise callers by network address alone — a credential a browser attaches automatically — so an operator browsing from an allowed machine could be lured to a page that silently issued writes to them; and because several of them read their whole input from the address rather than from a request body, the attack needed no scripting and no cross-origin negotiation at all. Such a write is now refused on both engines, using the browser's own request-context signal where it is sent, and otherwise comparing the stated origin against the address the client actually connected to — never against a forwarded header, which an attacker controls. Clients that send no browser origin signal, such as command-line tooling and deployment scripts, are deliberately unaffected, as are safe methods, so existing cross-origin read channels keep working. | `0.6.10` | 2026-08-16 |
+| **Q4 2026** | `0.6.11` ✅ | **Fixed**: `Collection.replace()` no longer silently discards the write when the stored entry carries an internal `_uuid` and the caller's `set` does not — the comparison key is now resolved from both sides (falling back to `id` when both carry one) and the call throws instead of returning quietly when the two sides share no usable key; an explicitly supplied key is honoured exactly as before (issue #64). Concurrent `util.promisify(entity.method)` calls on the same method no longer cross-deliver results or leave a caller hanging — the promisify fast-path now uses the same FIFO queue and single persistent dispatcher as the entity-context path, so every caller settles and in-order completion gives each its own result; out-of-order completion still pairs by arrival order, for which the per-call-identity path is a Promise-returning method. FormValidator: fast typing into a Safari `autocomplete="off"` field no longer scrambles the text (the caret is committed synchronously on every rebuild and the deferred restore re-asserts the latest committed position; issue #63), with three position-0 edge cases in the same interception corrected to native behaviour (Backspace, Delete with a selection, ArrowLeft); a refused submit's answer on an async-`query` form stays visible and focused instead of being re-hidden by a late completion (answer-placed focus is told from user-placed focus until the first genuine interaction); and a stale not-ready submit marker can no longer refuse every click until reload on a form whose async `query` field is not declared last (the reveal pass now carries its own completion identity and always completes). Inspector (development mode): the View tab's page-weight badge and the Flow tab's late timeline bars no longer go missing until a refresh — both data channels are refreshed at the end of the late-bind patch, keyed per tab. Pickup: restart **and** rebuild your bundles (the browser bundle changed). |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |
@@ -442,7 +443,7 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | ✅ | **V8 pointer compression support** | `0.2.0` | Q2 2026 | Node.js built with `--experimental-enable-pointer-compression` (e.g. [node-caged](https://github.com/platformatic/node-caged) or a custom build) delivers ~50% heap memory reduction across all pointer-heavy structures. Gina is pure JS — compatible out of the box. Adds: startup detection + `GINA_V8_POINTER_COMPRESSED` env var, Dockerfile guide with custom build recipe (full-icu + pointer compression), 4 GB ceiling documentation, N-API-only connector policy. |
 | ✅ | **Runtime CPU profiling baseline** | `0.6.2` | 2026-07-31 | Shipped — a three-arm baseline (HTTP/2 render, concurrent multipart upload, WebSocket echo) profiled a production-built bundle under load. Outcome: the multipart-scan, WebSocket-unmask, and render/log-cleanup candidates below all measured small under their own arms and moved to measure-gated deferral, while the dominant cost found is per-request deep-clone traffic — half of render-arm CPU — plus per-item random-id minting (~1 ms per render), now planned as its own row below. "No further acceleration needed" was an accepted verdict shape, and for the byte-loop candidates it is the verdict. |
 | ⏸ | **Multipart boundary-scan fast path** | — | on demand | **Deferred — acquitted by the profiling baseline (2026-07):** the boundary scan measured 7.2% of upload-arm CPU (0.73 ms per MB, ~47 µs per 64 KB chunk) with the event loop far from saturated — the loop-relief win does not materialize at these magnitudes. Re-armed by a profiled workload where the scan is a leading loop consumer. Original scope, unchanged when re-armed: the multipart parser's boundary search is the one unbounded byte-by-byte JS loop on a request path; delegating the in-chunk needle search to the runtime's native `Buffer.indexOf` (JS keeps only the chunk-boundary carry) relieves the event loop under large concurrent uploads; wire and event contract unchanged; validated by differential tests against the current matcher. |
-| ⏸ | **WebSocket unmask fast path** | — | on demand | **Deferred — acquitted by the profiling baseline (2026-07):** the built-in codec measured 8% of an echo arm deliberately isolated to maximize its visibility (~3.4 µs per 4 KB frame); real in-bundle traffic would only shrink that share. Re-armed by a WebSocket-heavy profile showing the codec as a leading consumer. Original scope, unchanged when re-armed: every inbound client frame must be unmasked, and that XOR currently runs byte-by-byte in JS; word-at-a-time unmasking in the built-in RFC 6455 codec, with the `ws` engine path picking up `bufferutil` acceleration where it is installed — optional only; the pure-JS behaviour remains the permanent fallback. |
+| ⏸ | **WebSocket unmask fast path** | — | on demand | **Deferred — acquitted by the profiling baseline (2026-07), re-verified in-bundle (2026-08):** the built-in codec measured 8% of an echo arm deliberately isolated to maximize its visibility (~3.4 µs per 4 KB frame), and the same echo load driven through a real bundle's declarative WebSocket route confirmed the acquittal — ~10% of an idle-dominated in-bundle profile (~22% of non-idle CPU, ~3.2 µs per 4 KB frame), outranked two-to-one by the runtime's own native buffer/UTF-8 internals, with all other framework work under 2% combined. Re-armed by a WebSocket-heavy or binary-streaming profile showing the codec as a leading consumer. Original scope, unchanged when re-armed: every inbound client frame must be unmasked, and that XOR currently runs byte-by-byte in JS; word-at-a-time unmasking in the built-in RFC 6455 codec, with the `ws` engine path picking up `bufferutil` acceleration where it is installed — optional only; the pure-JS behaviour remains the permanent fallback. |
 | ⏸ | **Render & logging hot-path cleanups** | — | on demand | **Deferred — acquitted by the profiling baseline (2026-07):** the asset-scan, logger-regex, and render-splice candidates each measured at or under about 1% of render CPU under the arm built for them (the broken asset-scan memo guard remains real, but as a correctness fix that can ride any future work on that surface). Re-armed if any of them turns leading in a future profile. Original scope, unchanged when re-armed: repair the per-render asset-scan memoization (the cache guard can never hit as written, so the full document is re-scanned every HTTP/2 render), precompile the logger's per-line token regexes, and consolidate whole-document render passes where a profile convicts them. |
 | ⏸ | **SIMD boundary scanner (Rust → WebAssembly)** | — | on demand | **Deferred — measure-gated, doubly dormant since the 2026-07 baseline.** Built only if a profile still convicts the multipart scan after the JS fast path lands — and the JS fast path is itself deferred-acquitted, so this trigger cannot fire today. WebAssembly first: sandboxed, a single artifact for every platform including Bun, no process crash surface. Native N-API prebuilds — published as separate per-platform packages so the framework tarball never carries a compiled binary — only if WASM leaves measured headroom. No install scripts ever; the JS implementation remains the permanent fallback. *Interim:* the JS fast path above. |
 | ✅ | **Render-path deep-clone & id-mint reduction** | `0.6.2` | 2026-08-01 | **Convicted by the profiling baseline, shipped ahead of schedule:** half of render-arm CPU was per-request deep-clone traffic, concentrated in three framework call sites (the template-filter configuration was re-cloned on every render; the render delegate cloned its envelope; the options collection deep-cloned its content and minted a random id per collected item — about 1 ms per render of entropy alone), with GC time consistent with the clone garbage. Shipped JS-side only: the filter configuration is now passed and stashed by reference (its write surface was measured empty before the change), the per-request locale lookups are memoized with the per-request copy materialized lazily on first read, and the id generator right-sizes its entropy batch to the requested length. Measured on the profiling harness with fresh runs on both sides: **4.4× render throughput** on the baseline workload (10.7 → 2.4 ms per render), deep-clone share 50.31% → 1.81%, GC down ~18×, and entropy out of the top profile frames on both arms. The remaining clone sites on this surface stay measure-gated for a future profile. Porting the object-graph work to native code remains an anti-candidate. |

package/framework/v0.6.11/VERSION

@@ -0,0 +1 @@
+0.6.11

package/framework/{v0.6.11-alpha.2 → v0.6.11}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -11841,6 +11841,69 @@ function ValidatorPlugin(rules, data, formId, culture) {
      */
     var isAnswerFocusInProgress = false;
 
+    /**
+     * #B387 — the asynchronous continuation of the #B319 exemption above.
+     *
+     * The answer's own focus move makes the answered field the active element,
+     * and BOTH display refreshers read "active element" as "the user is editing
+     * this field" and soften/hide the committed message:
+     *   - `refreshWarning`'s error->warning downgrade appends `hidden`;
+     *   - `handleErrorsDisplay`'s refresh branch re-creates the message born-hidden.
+     * The one-shot flag above only covers the SYNCHRONOUS focusin dispatched
+     * inside `.focus()`; a validation completion firing LATER in the same
+     * cascade (a live-check waiter woken by the reveal pass's deferred release,
+     * or the trailing silent global re-validation) runs after the `finally`
+     * cleared it — and re-hid the very message the answer had just rendered.
+     *
+     * This slot records WHICH field currently holds an answer-placed focus, so
+     * the two hide sites can tell answer-placed focus from user-placed focus,
+     * for ANY caller, however late. A single slot is exact: only one active
+     * element exists. Released on the first genuine user interaction (any
+     * trusted native event reaching a form proxy while the one-shot flag is
+     * down), so the deliberate mid-typing suppression re-engages the moment
+     * the user actually edits.
+     *
+     * @private
+     * @type {object|null} `{ formId, elName }` while an answer-placed focus is live, else `null`
+     */
+    var answerFocusHold = null;
+
+    /**
+     * #B387 — does `answerFocusHold` name this exact field?
+     *
+     * @private
+     * @param {string} formId - owning form id
+     * @param {string} elName - field name
+     * @returns {boolean} true while the answer-placed focus is live on this field
+     */
+    var isAnswerFocusHeldFor = function(formId, elName) {
+        return ( answerFocusHold
+            && answerFocusHold.formId === formId
+            && answerFocusHold.elName === elName ) ? true : false;
+    };
+
+    /**
+     * #B387 — release the hold on the first genuine user interaction.
+     *
+     * Trusted-only: framework-internal `triggerEvent` dispatches are untrusted
+     * CustomEvents and must not release it. The `isAnswerFocusInProgress`
+     * guard keeps the answer's OWN synchronous focusin (trusted — the UA
+     * generates it inside `.focus()`) from releasing the hold it is part of
+     * delivering.
+     *
+     * @private
+     * @param {object} event - the native event reaching a form proxy handler
+     * @returns {void}
+     */
+    var releaseAnswerFocusHold = function(event) {
+        if ( !answerFocusHold ) {
+            return;
+        }
+        if ( event && event.isTrusted && !isAnswerFocusInProgress ) {
+            answerFocusHold = null;
+        }
+    };
+
     var refreshWarning = function($el) {
         var formId = $el.form.id || $el.form.getAttribute('id');
         var elName = $el.name || $el.form.getAttribute('name');
@@ -11857,7 +11920,19 @@ function ValidatorPlugin(rules, data, formId, culture) {
         if ( /form\-item\-warning/.test($parent.className) && currentElName != elName ) {
             $parent.className = $parent.className.replace(/form\-item\-warning/, 'form-item-error');
 
-        } else if (/form\-item\-error/.test($parent.className) && currentElName == elName ) {
+        }
+        // #B387 — `currentElName == elName` reads "the user is editing this
+        // field", but the ANSWER's own focus move (#B319) also makes the field
+        // the active element — and unlike the synchronous focusin, the async
+        // completion callers arrive after the one-shot flag is already down.
+        // While the answer-focus hold names this field the focus is
+        // answer-placed, not user-placed: keep the message the answer just
+        // rendered.
+        // was: else if (/form\-item\-error/.test($parent.className) && currentElName == elName ) {
+        else if (
+            /form\-item\-error/.test($parent.className) && currentElName == elName
+            && !isAnswerFocusHeldFor(formId, elName)
+        ) {
             $parent.className = $parent.className.replace(/form\-item\-error/, 'form-item-warning');
             isErrorMessageHidden = true;
         }
@@ -12477,7 +12552,11 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         // blur. This "refresh" re-create runs AFTER refreshWarning in the live-check
                         // global pass, so without this focus guard it re-shows the message mid-typing.
                         // On blur (field no longer active) the message is created shown (focusout commits).
-                        $err.setAttribute('class', ( document.activeElement && document.activeElement.name == name ) ? 'form-item-error-message hidden' : 'form-item-error-message');
+                        // #B387 — same provenance refinement as refreshWarning's downgrade:
+                        // an answer-placed focus (#B319) must not read as "being typed in",
+                        // or this re-create clips the very message the answer delivered.
+                        // was: ( document.activeElement && document.activeElement.name == name ) ?
+                        $err.setAttribute('class', ( document.activeElement && document.activeElement.name == name && !isAnswerFocusHeldFor(id, name) ) ? 'form-item-error-message hidden' : 'form-item-error-message');
                         // #A11Y5 — the branch below re-asserts aria-invalid="true" on this same
                         // field, so when the message is hidden it must stay resolvable: clip it
                         // out of view rather than out of the accessibility tree. Reads the class
@@ -18971,6 +19050,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
         // are guarded fallbacks that no-op on a control).
         var resetProxyHandler = function(event) {
             var $el = event.target;
+            releaseAnswerFocusHold(event); // #B387
             if (
                 typeof(event.defaultPrevented) != 'undefined'
                 && event.defaultPrevented
@@ -18989,6 +19069,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
         };
         var keydownProxyHandler = function(event) {
             var $el = event.target;
+            releaseAnswerFocusHold(event); // #B387
             if ( typeof(event.defaultPrevented) != 'undefined' && event.defaultPrevented )
             return false;
 
@@ -19007,6 +19088,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
         };
         var keyupProxyHandler = function(event) {
             var $el = event.target;
+            releaseAnswerFocusHold(event); // #B387
             if ( typeof(event.defaultPrevented) != 'undefined' && event.defaultPrevented )
             return false;
 
@@ -19026,6 +19108,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
         };
         var focusinProxyHandler = function(event) {
             var $el = event.target;
+            releaseAnswerFocusHold(event); // #B387
             if ( typeof(event.defaultPrevented) != 'undefined' && event.defaultPrevented )
             return false;
 
@@ -19060,6 +19143,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
         };
         var focusoutProxyHandler = function(event) {
             var $el = event.target;
+            releaseAnswerFocusHold(event); // #B387
             if ( typeof(event.defaultPrevented) != 'undefined' && event.defaultPrevented )
                 return false;
 
@@ -19077,6 +19161,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
         };
         var changeProxyHandler = function(event) {
             var $el = event.target;
+            releaseAnswerFocusHold(event); // #B387
             if ( typeof(event.defaultPrevented) != 'undefined' && event.defaultPrevented )
             return false;
 
@@ -19093,6 +19178,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
         };
         var clickProxyHandler = function(event) {
             var $el = event.target;
+            releaseAnswerFocusHold(event); // #B387
 
             // a click target removed from the DOM during its own dispatch
             // (e.g. an upload preview's reset/delete link) has no parent by
@@ -19464,6 +19550,8 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                     // no-op on an unfocusable host that still passes the
                                     // typeof-function gate above.
                                     if ( typeof(document) === 'undefined' || !document || document.activeElement === _aField ) {
+                                        // #B387 — same provenance record as focusFirstInvalidField.
+                                        answerFocusHold = { formId: $a11yForm.getAttribute('id'), elName: _aName };
                                         break;
                                     }
                                 }
@@ -20306,6 +20394,10 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     // so a failed submit announced nothing. Confirming it is also what makes the
                     // "skips unfocusable controls" contract above true rather than aspirational.
                     if ( typeof(document) === 'undefined' || !document || document.activeElement === $field ) {
+                        // #B387 — record the answer-placed focus so display
+                        // refreshes firing after the one-shot window (async
+                        // completion callers) can tell it from user focus.
+                        answerFocusHold = { formId: $form.getAttribute('id'), elName: name };
                         return true;
                     }
                 }
@@ -20345,12 +20437,22 @@ function ValidatorPlugin(rules, data, formId, culture) {
         var $target         = $formInstance.target;
         var validationInfo  = getFormValidationInfos($target, $formInstance.rules);
 
-        validate($target, validationInfo.fields, validationInfo.$fields, $formInstance.rules, function onDisabledTriggerReveal(result) {
+        var onDisabledTriggerReveal = function(result) {
             var errors = result['fields'] || result['error'];
             handleErrorsDisplay($target, errors, result['data']);
             focusFirstInvalidField($target, errors);
             updateSubmitTriggerState($formInstance, result.isValid());
-        });
+        };
+        // #B348 — completion identity. A reveal pass is un-latched, writes
+        // neither `isSubmitting` nor `isValidating`, and on a VALID form its
+        // verdict is clean — so with the async `query` field not declared
+        // last its waiter completion matched NO dispatch branch and this
+        // callback silently never ran: the documented self-heal + gate
+        // re-sync were dead on those forms. The marker rides the exact cb of
+        // the exact pass (the engine's own `cb._data`/`cb._errors` property
+        // idiom); the waiter's terminal-gated rescue branch consults it.
+        onDisabledTriggerReveal.isRevealCompletion = true;
+        validate($target, validationInfo.fields, validationInfo.$fields, $formInstance.rules, onDisabledTriggerReveal);
     };
 
     /**
@@ -21156,6 +21258,29 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                     //console.debug(field +' is NOT the last element to be validated for formId: '+ formId);
                                     needsGlobalReValidation = true;
                                 }
+                                // #B348 — the reveal's rescue: a TERMINAL completion
+                                // (same condition as the errors>0 block above — the
+                                // guard is what stops a multi-query-field early wake,
+                                // where the first waiter fires at asyncCount 1)
+                                // carrying the reveal's completion identity, that
+                                // matched none of the branches above, must dispatch
+                                // its own pass or `onDisabledTriggerReveal` starves:
+                                // clean verdict + un-latched + not live-check +
+                                // query-not-last fell through EVERY branch, the gate
+                                // marker never re-synced, and a fully valid form ate
+                                // every later click. Chained LAST so every
+                                // previously-working shape (terminal errors>0, #B342
+                                // latch, last-field, live-check display-only) stays
+                                // byte-identical; an un-latched programmatic submit
+                                // (#B347) carries no marker and is deliberately
+                                // unaffected — its fix is gated on its own repro.
+                                else if (
+                                    hasParsedAllRules
+                                    && asyncCount <= 0
+                                    && cb && cb.isRevealCompletion
+                                ) {
+                                    triggerEvent(gina, $formOrElement, 'validated.' + formId, cb);
+                                }
 
                                 if (needsGlobalReValidation) {
                                     validate($currentForm, allFields, $allFields, rules, function onSilentQueryGlobalLiveValidation(gResult){
@@ -27791,8 +27916,48 @@ function Collection(content, options) {
     }
 
 
+    /**
+     * Replaces each matched entry with `set`, wholesale — unlike `.update()`,
+     * which merges. Matching is done in two stages: `filter` selects the entries
+     * (same syntax as `.find()`), then each selected entry is located in the
+     * result by comparing a single key against the same key on `set`.
+     *
+     * That comparison key is resolved per entry, from BOTH sides:
+     *
+     *  1. the internal `_uuid` when the stored entry AND `set` both carry one;
+     *  2. otherwise `id`, when both carry one;
+     *  3. otherwise the call throws — a `set` sharing no key with the stored
+     *     entry cannot be matched, and refusing is preferable to returning a
+     *     result that silently replaced nothing.
+     *
+     * Pass `key` to name the comparison key explicitly; it is then used as given,
+     * with no fallback and no refusal.
+     *
+     * N.B. a chained result carries the internal `_uuid` on every entry the call
+     * did not replace. Persist `.toRaw()` rather than the chained array if the
+     * data is going to be re-loaded into a new Collection later.
+     *
+     * @param {object|Array} filter    - Entry selector, as `.find()` — or an already-found result array
+     * @param {object}       set       - The replacement entry (replaces the match wholesale)
+     * @param {string}       [key]     - Explicit comparison key; skips the resolution above
+     * @returns {Array} the chainable result set
+     *
+     * @throws {Error} `No comparison key defined !` when neither side shares a usable key
+     *
+     * @example
+     * // matched by the internal _uuid when both sides carry it, else by id
+     * col.replace({ id: 1 }, { id: 1, name: 'Alicia' });
+     *
+     * @example
+     * // explicit comparison key
+     * col.replace({ ref: 'r1' }, { ref: 'r1', name: 'Alicia' }, 'ref');
+     */
     instance['replace'] = function() {
         var key         = '_uuid' // comparison key
+            // #B393 — whether the caller named the comparison key explicitly. An
+            // explicit key is honoured as given (no fallback, no refusal), exactly
+            // as before; only the DEFAULT `_uuid` path resolves a key below.
+            , keyExplicit = false
             , result    = null
             , filters   = null
             , set       = null
@@ -27802,6 +27967,7 @@ function Collection(content, options) {
 
         if ( typeof(arguments[arguments.length-1]) == 'string' ) {
             key = arguments[arguments.length - 1];
+            keyExplicit = true;
             delete arguments[arguments.length - 1];
             --arguments.length;
         }
@@ -27847,13 +28013,50 @@ function Collection(content, options) {
             for (var a = 0, aLen = arr.length; a < aLen; ++a) {
                 arr[a] = JSON.clone(set);
                 for (var r = 0, rLen = result.length; r < rLen; ++r) {
-                    if ( typeof(result[r][key]) == 'undefined' && key == '_uuid' && typeof(result[r]['id']) != 'undefined' ) {
-                        key = 'id';
-                    } else if (typeof(result[r][key]) == 'undefined' && key == '_uuid') {
-                        throw new Error('No comparison key defined !')
+                    // #B393 — resolve the comparison key from BOTH sides, per entry.
+                    //
+                    // Previously the key was chosen by inspecting the STORED entry
+                    // only, and was mutated in place. Two consequences, both fixed
+                    // here:
+                    //
+                    //  (a) When the stored entry carried a `_uuid` and the caller's
+                    //      `set` did not, neither the `id` fallback nor the refusal
+                    //      fired (both were gated on the STORED entry lacking the
+                    //      key), so the comparison was `<storedUuid> == undefined` —
+                    //      never true. Nothing matched, nothing was replaced, and the
+                    //      call returned a successful-looking result: a silent, lossy
+                    //      write. A stored `_uuid` is present exactly when the caller
+                    //      re-loaded an array a previous chained call had returned.
+                    //  (b) `key` was assigned rather than shadowed, so once any entry
+                    //      flipped it to `id` it stayed `id` for every later entry in
+                    //      the same call.
+                    //
+                    // `cmpKey` is derived per (a, r) pair and the outer `key` is never
+                    // written, so a fallback can no longer leak across iterations.
+                    var cmpKey = key;
+                    if ( !keyExplicit ) {
+                        if (
+                            typeof(result[r][cmpKey]) == 'undefined'
+                            || typeof(arr[a][cmpKey]) == 'undefined'
+                        ) {
+                            if (
+                                typeof(result[r]['id']) != 'undefined'
+                                && typeof(arr[a]['id']) != 'undefined'
+                            ) {
+                                cmpKey = 'id';
+                            }
+                        }
+                        // No key both sides carry: refuse loudly rather than return a
+                        // result that silently replaced nothing.
+                        if (
+                            typeof(result[r][cmpKey]) == 'undefined'
+                            || typeof(arr[a][cmpKey]) == 'undefined'
+                        ) {
+                            throw new Error('No comparison key defined !')
+                        }
                     }
 
-                    if ( result[r][key] == arr[a][key] ) {
+                    if ( result[r][cmpKey] == arr[a][cmpKey] ) {
                         result[r] = arr[a];
                         break;
                     }