gina 0.6.17 → 0.6.18

package/CHANGELOG.md

@@ -6,6 +6,11 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.18 - 2026-08-27
+### Fixed
+* A field validated by a `query` (live-check) rule no longer gets the wrong verdict when its value contains a `+` — the common case being an email plus-address such as `alias+tag@example.com`. The live-check body is JSON, but the request was labelled `application/x-www-form-urlencoded`, so the server correctly url-decoded it before parsing and turned every `+` into a space; the mangled body was still valid JSON, so nothing errored and the endpoint answered 200 with an answer computed from a corrupted value. Because a `query` rule also gates the submit trigger, an affected visitor could not submit the form at all — a hard lockout on sign-in and password-recovery forms rather than a warning. The request now sends `application/json` when the body is JSON, matching what the form-submit and file-removal paths already did. An explicit per-rule `headers` override still wins, so a rule that already declares its own `Content-Type` is unchanged. Note that live-check bodies are no longer URL-decoded at all, so `%XX` sequences reach your action verbatim; field values are sent raw, so this only affects a bundle that relied on the decode.
+* The controller no longer walks and rewrites the shared forms catalog on every request. The dotted-path data setter behind every render (`page.view.*`, `page.environment.*`, `page.forms`, …) used to build the path as a JSON string, parse it, and deep-merge the result into the render data — and that merge recursed into every object value it grafted, re-merging each array inside it with itself and writing the copies back into the caller's object. For a bundle with a real forms catalog that was 0.4–1.5 ms of CPU per request AND a silent mutation of the per-process catalog (its arrays were swapped for equal copies on every render). A first write is now stored by reference without being walked, missing intermediates are created directly, and only a genuine collision goes through the merge — so the value semantics are unchanged (first write wins, an object written onto an object leaf still deep-fills), the catalog is never touched, and the 59 primitive writes of a render cost about a fifth of what they did (66.6 → 14.8 µs). One deliberate difference: writing an array onto an existing array leaf now merges the two once instead of twice (the old path produced duplicate elements); no framework route writes an array-bearing path twice. Server-side only — pickup is a bundle restart, no rebuild.
+
 ## 0.6.17 - 2026-08-26
 ### Fixed
 * #B422 — a route whose URL structurally matches but whose `requirements` REJECT the request no longer drops the connection once the route cache is warm. The route cache is keyed `method:pathname` and (on the isaac engine) the query string is stripped before dispatch, so every query variant of one pathname shares one cache entry; the warm path re-evaluated `requirements` on each hit but discarded the verdict, force-matching the rejected request and dispatching it with no routing description — an unhandled promise rejection at the dispatch target deref, the connection dropped with no HTTP response at all. The warm path now honors the verdict: a rejecting (or throwing) requirement evaluation is treated as a cache miss and falls through to the routing scan, which answers correctly — 404 when nothing matches, the sibling rule when one does, or a 500 naming the rule when a `validator::` requirement throws (previously also a dropped connection). The cache entry is kept — variants the requirements accept stay warm. Defence in depth: the router now answers a named 500 instead of throwing when dispatched without a resolved `param.control`. Server-side only — pickup is a bundle restart, no re-bake.

package/README.md

@@ -62,30 +62,30 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.17
+## What's in 0.6.18
 
 > **Restart your bundles AND rebuild them.** This release changes the browser
-> bundle: `gina.min.js` differs from `0.6.16` (`gina.min.css` and
+> bundle: `gina.min.js` differs from `0.6.17` (`gina.min.css` and
 > `gina.onload.min.js` are unchanged). A restart alone updates the server half
 > only — each bundle bakes its own copy of the client assets, so the validator
 > fix below would not reach a browser at all.
 
-> **No settings reset.** `0.6.17` is a patch — the `shortVersion` stays `0.6`, so
+> **No settings reset.** `0.6.18` is a patch — the `shortVersion` stays `0.6`, so
 > your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**A dropped-connection routing defect, and three validator rules that could not
-run on the server.** The headline is an availability fix: once a route cache was
-warm, a request rejected by a route's `requirements` was dispatched anyway and the
-connection was dropped with no HTTP response at all — no status, no body. Alongside
-it, three documented validator rules threw on every server-side call, and a
-redirect-route log flood that could account for most of a bundle's warning volume
-is gone. **No action is required for any of the three** — each is a strict
-improvement over behaviour that previously failed; details in the
+**A form-validation lockout, and a per-request cost paid by every render.** The
+headline is a correctness fix with an availability consequence: a field validated
+by a `query` (live-check) rule got the wrong verdict whenever its value contained
+a `+` — an email plus-address being the common case — and because a `query` rule
+also gates the submit trigger, an affected visitor could not submit the form at
+all. Alongside it, the dotted-path data setter behind every render no longer
+deep-merges its way through the render tree, which also ends a silent mutation of
+the per-process forms catalog. **One behaviour change needs your attention** if a
+bundle relied on live-check bodies being URL-decoded — details in the
 [migration guide](https://gina.io/docs/migration).
 
-- **Fixed — a rejected route no longer drops the connection once the cache is warm (#B422).** The route cache is keyed `method:pathname`, and on the isaac engine the query string is stripped before dispatch, so every query variant of one pathname shares a single cache entry. The warm path re-evaluated the route's `requirements` on each hit and then discarded the verdict, force-matching a request the requirements had just rejected and dispatching it with no routing description — an unhandled promise rejection at the dispatch target deref, and the connection closed with no HTTP response at all. The warm path now honours the verdict: a rejecting or throwing requirement evaluation is treated as a cache miss and falls through to the routing scan, which answers correctly — `404` when nothing matches, the sibling rule when one does, or a `500` naming the rule when a `validator::` requirement throws (previously also a dropped connection). The cache entry is kept, so variants the requirements accept stay warm. Defence in depth: the router now answers a named `500` instead of throwing when dispatched without a resolved `param.control`.
-- **Fixed — the `toFloat`, `set` and `format` validator rules are context-safe (#B398).** All three are documented rules that threw on every server-side call. `toFloat` opened by reading the live DOM element unguarded, so server-side rule sets could not coerce a float at all; it now reads the live value only when one is reachable and otherwise uses the submitted value — which on the server *is* the raw value — so it works in both contexts (a missing comma in the same statement, which leaked `isFloatingWithCommas` as an implicit global into every page, is fixed with it). `set` assigns the field value in both contexts and reflects it onto the DOM element only in the browser, where an element exists. `format` — which already worked in both contexts when chained after `isDate`, as its documentation shows — now reports a non-`Date` value as a named rule-authoring error pointing at the missing `isDate`, instead of the opaque `val.format is not a function`. The guide's [middleware page](https://gina.io/docs/guides/middleware) also gained a section on reading configuration efficiently.
-- **Fixed — a redirect route no longer floods the log with `source[host] is undefined` warnings (#B423).** Redirect rules are deliberately excluded from the per-rule host/hostname defaulting, so those keys are absent on them — but the per-request routing copy assigned them unconditionally, creating properties holding `undefined` on the cached routing clone. Because that clone lives for the process lifetime, every later no-arg `getConfig()` emitted one `host` and one `hostname` warning per redirect rule, indefinitely; measured by a consumer at roughly three quarters of that log line's total volume, drowning the genuine warnings it exists to surface. The copy is now existence-guarded: an absent key stays absent, and rules that do carry a host or hostname are copied exactly as before. This removes log noise rather than a functional defect — the clone had been substituting `null`, which every reader already treated the same as absent. Reached only from template and view routes, so API-only bundles were never affected.
+- **Fixed — a `query` rule no longer mis-validates a value containing `+` (#B425).** The live-check body is JSON, but the request was labelled `application/x-www-form-urlencoded`, so the server correctly url-decoded it before parsing and turned every `+` into a space. The mangled body was still valid JSON, so nothing errored — the endpoint answered `200` with a verdict computed from a corrupted value. Because a `query` rule also gates the submit trigger, the common case of an email plus-address such as `alias+tag@example.com` was a hard lockout on sign-in and password-recovery forms rather than a warning. The request now sends `application/json` when the body is JSON, matching what the form-submit and file-removal paths already did. An explicit per-rule `headers` override still wins, so a rule that already declares its own `Content-Type` is unchanged. **Action required only if you relied on the decode:** live-check bodies are no longer URL-decoded at all, so `%XX` sequences reach your action verbatim, and field values are sent raw.
+- **Fixed — the render data setter no longer walks and rewrites the shared forms catalog on every request (#P39).** The dotted-path setter behind every render (`page.view.*`, `page.environment.*`, `page.forms`, …) used to build the path as a JSON string, parse it, and deep-merge the result into the render data — and that merge recursed into every object value it grafted, re-merging each array inside it with itself and writing the copies back into the caller's object. For a bundle with a real forms catalog that was roughly 0.4 to 1.5 ms of CPU per request *and* a silent mutation of the per-process catalog, whose arrays were swapped for equal copies on every render. A first write is now stored by reference without being walked, missing intermediates are created directly, and only a genuine collision goes through the merge — so the value semantics are unchanged (first write wins; an object written onto an object leaf still deep-fills), the catalog is never touched, and the 59 primitive writes of a render cost about a fifth of what they did (66.6 → 14.8 µs). One deliberate difference: writing an array onto an existing array leaf now merges the two once instead of twice, where the old path produced duplicate elements; no framework route writes an array-bearing path twice.
 
 ## Documentation
 

package/ROADMAP.md

@@ -69,6 +69,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.15` ✅ | **Fixed**: client-side handler release now awaits the routing table — the table arrives only by async fetch (the page deliberately whispers an empty stub rather than inlining it) yet `gina.ready` handlers and the auto-boot validator released at `DOMContentLoaded`, so anything calling `getRoute()`/`toUrl()` during handler or form-bind initialisation ran against an empty table; loopback wins that race by single-digit milliseconds, which is why development and the local suites never see it, while a real deployment loses it by 150ms or more on every load, deterministically — a validator form rule naming a route then threw inside the init listener, the event dispatch swallowed the throw, and the instance's `ready` never fired, silently. All three release paths now gate on the dependency settling (the ready-list scheduler, the validator auto-boot poll, and the late-registration path that previously bypassed the scheduler entirely and fired immediately), settled deliberately meaning loaded **or** failed so a broken endpoint still releases handlers rather than hanging the page, with a parse-time 5-second fallback force-settling in degenerate shapes where no fetch is ever issued (ACTION REQUIRED only in the sense of timing: on deployed tiers handlers now fire 150ms–1.3s later than before, when routing is actually available). Alongside it, client `getRoute()` no longer crashes with a context-free TypeError when a bundle's routing table is absent — the client `getRouting()` returns null by design, and the bare dereference of that null sat one line above the very diagnostic built for the degraded-table case, so the case it existed for was exactly the one it could never report — and a failed routing fetch now leaves console evidence instead of booting the framework permanently degraded in silence. The couchbase connector no longer hangs a request when a `@return {number}` COUNT query does not match its alias parser: the branch dereferenced an unguarded regex match, so `SELECT COUNT(DISTINCT a.b) AS n` and an unaliased `SELECT COUNT(*)` both threw inside the connector's own result callback — no 5xx was ever produced, a promisified caller never settled, and the request hung until the client or proxy timed out, a stall then retried behind an HTTP/2 inter-bundle client; it was dev-invisible too, since the dev path strips only the first comment block, so a commented-out parsable COUNT elsewhere in the file kept the regex satisfied locally while production threw on the identical file. The branch now derives the count from the first projected column with no regex at all, guarded against empty result sets, empty rows and null payloads, exactly as mysql, postgresql, scylladb and sqlite already did (ACTION REQUIRED if a multi-column projection puts its COUNT anywhere but first: the returned value is now the first column rather than the aliased one, consistent with every other connector). The same connector now trims and lowercases the types it reads from `@return` and `@param`, and bounds both captures to the first brace pair — the extracted types feed exact-match comparisons whose arms are all lowercase, so `{Number}` or `{ number }` matched nothing and was silently skipped, handing back the raw row array instead of the declared shape and leaving the parameter uncast, while a second brace pair on the same line bled into the greedy capture (ACTION REQUIRED: annotations that previously fell through silently now reach their branch, so a query declaring `@return {Number}` begins returning the declared shape; `@options` deliberately keeps its greedy capture, holding a nestable object literal rather than a single type token). Two client plugins stop leaking behaviour onto pages that never asked for it: the public link API throws a named error identifying the url and the likely cause instead of a bare TypeError, and detects the miss before the supersede step so a mistyped url no longer aborts a legitimate request still in flight; and the popin stylesheet's `::backdrop` rule is scoped to gina's own popin dialogs rather than every `<dialog>` on the page (ACTION REQUIRED if a page relied on the unscoped rule to style its own dialogs, or supplies a popin dialog element from its own markup — that element needs the `gina-popin-container` class to keep gina's backdrop). **Changed**: a changelog fragment whose filename names a tracker id must now cite that id in its body, since only the body renders into `CHANGELOG.md` and the published tarball — an id carried by filename and commit message alone ships an unnumbered entry and anyone triaging by id gets a false zero (roughly 60 of 937 historical fragments shipped that way); recognised id families are an explicit allowlist rather than a generic pattern, because the generic form false-positives on real filenames and a false positive would block a commit. Pickup: restart **and** rebuild your bundles (the browser bundle changed — both `gina.min.js` and `gina.min.css` differ from `0.6.14`). |
 | **Q4 2026** | `0.6.16` ✅ | **Security**: concurrent uploads of the same filename no longer corrupt one another — the multipart parser wrote every incoming file to `<upload dir>/<the filename the client sent>` with nothing in the path distinguishing one part or one request from another, so two uploads sharing a filename opened two write streams on a single path and interleaved their bytes into one hybrid matching neither upload, while the framework reported success to both callers; measured on a live bundle before the fix, twelve concurrent uploads of one filename left ONE corrupted file where twelve intact ones were sent, and a single request carrying two same-named parts produced one file mixing both. The parse runs before routing and before any middleware, so reaching it needed neither authentication nor a valid route — a POST to an unknown url answers 404 to the client and still writes the file to disk — and no application configuration could avoid it; uploads now stage under a server-generated random name, 32 hex characters plus a `.part` suffix, as multer and formidable have always done, which also keeps client-controlled bytes off the filesystem and cannot overflow the operating system filename limit (ACTION REQUIRED only where your own code derives a display name or a public URL from the basename of `req.files[].path`: read `req.files[].originalFilename` instead, which is unchanged and is still the name `self.store()` publishes the file under). **Fixed**: the documented fluent `store(target).onComplete(cb)` form works again — `store()` was accidentally declared `async`, so the deliberate `{ onComplete }` facade came back wrapped in a Promise carrying no `onComplete`, leaving the upload guide's first worked example dead code on every stable from `0.6.0` through `0.6.15`; the body contains no `await` and nothing anywhere awaits the call, so dropping the keyword changed no behaviour, the facade returns synchronously as documented, the three-argument callback form is byte-unchanged, and the TypeScript declaration now describes the fluent return shape instead of `Promise<void>`. The page whisper no longer exports the forms mocks group — the RFC5987-encoded `page.environment.forms` export shipped the entire bundle forms catalog into every page in every environment, mocks included, while the routing exports one line above it were deliberately stubbed to `{}` for page weight; mocks are now excluded in every environment rather than outside development only, deliberately, since an env-divergent `gina.forms` shape is the works-in-dev-fails-in-prod class, and rules, custom validators and every server-side surface keep the complete catalog (ACTION REQUIRED only for client code that read `gina.forms.mocks`, which the framework's own client bundle never consumed). And the link API names its error when the anchor has left the DOM: there is no deregistration path, so a registration outlives its element and a page that re-renders its anchors after binding dereferenced the null lookup and threw a bare TypeError — it now throws a named error identifying the link id, the url and the cause, detected beside the unregistered-url guard before the supersede step so it no longer aborts a request already in flight nor invalidates that request's response handling. Pickup: restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.15`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q4 2026** | `0.6.17` ✅ | **Fixed**: a route whose URL structurally matches but whose `requirements` reject the request no longer drops the connection once the route cache is warm — the cache is keyed on method and pathname with the query string stripped before dispatch, so every query variant of one pathname shares a single entry, and the warm path re-evaluated the requirements on each hit and then discarded the verdict, force-matching a request that had just been rejected and dispatching it with no routing description, which closed the connection with no HTTP response at all — no status and no body; the warm path now honours the verdict, treating a rejecting or throwing evaluation as a cache miss that falls through to the routing scan and answers correctly (404 when nothing matches, the sibling rule when one does, or a 500 naming the rule when a `validator::` requirement throws, which was previously also a dropped connection), while the cache entry is kept so the variants the requirements accept stay warm. **Fixed**: the `toFloat`, `set` and `format` validator rules are context-safe — all three are documented rules that threw on every server-side call, with `toFloat` opening by reading the live DOM element unguarded so server-side rule sets could not coerce a float at all (it now reads the live value only when one is reachable and otherwise uses the submitted value, which on the server is the raw value, and a missing comma in the same statement that leaked `isFloatingWithCommas` as an implicit global into every page is fixed with it), `set` now assigning the field value in both contexts while reflecting it onto the DOM element only in the browser where an element exists, and `format` — which already worked in both contexts when chained after `isDate`, as its documentation shows — now reporting a non-`Date` value as a named rule-authoring error pointing at the missing `isDate` instead of the opaque `val.format is not a function`. **Fixed**: a bundle declaring a redirect route no longer floods its log with `source[host] is undefined` warnings — redirect rules are deliberately excluded from the per-rule host and hostname defaulting so those keys are absent on them, but the per-request routing copy assigned them unconditionally, creating properties holding `undefined` on a clone kept for the lifetime of the process, so every later no-arg `getConfig()` emitted one `host` and one `hostname` warning per redirect rule indefinitely, measured by a consumer at roughly three quarters of that log line's total volume and drowning the genuine warnings it exists to surface; the copy is now existence-guarded, so an absent key stays absent and rules that do carry a host are copied exactly as before, which removes log noise rather than a functional defect, and only template and view routes reach it so API-only bundles were never affected. Pickup: restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.16`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
+| **Q4 2026** | `0.6.18` ✅ | **Fixed**: a field validated by a `query` (live-check) rule no longer gets the wrong verdict when its value contains a `+` — the live-check body is JSON but the request was labelled `application/x-www-form-urlencoded`, so the server url-decoded it before parsing and turned every `+` into a space; the mangled body was still valid JSON, so the endpoint answered 200 with a verdict computed from a corrupted value, and because a `query` rule also gates the submit trigger the common case of an email plus-address was a hard lockout on sign-in and password-recovery forms rather than a warning. Live-check bodies are no longer URL-decoded at all, so `%XX` sequences reach your action verbatim. **Fixed**: the dotted-path render data setter no longer walks and rewrites the shared forms catalog on every request — a first write is now stored by reference instead of being deep-merged through the render tree, ending both a per-request CPU cost and a silent mutation of the per-process catalog. Restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.17`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |
@@ -406,7 +407,7 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | ✅ | **Application-level rapid reset rate limiter** (CVE-2023-44487) — per-session stream creation counter | `0.3.13` | 2026-05-14 | The Isaac HTTP/2 session handler counts new streams in a rolling 1s window per session; over `maxStreamsPerSecond` (default 200) it sends a GOAWAY and closes the session. More targeted than `maxSessionRejectedStreams` (which counts refused streams, not created ones). Configurable via `settings.json` `http2Options.maxStreamsPerSecond`; `/_gina/info` exposes a `rapidResetBlocked` counter. |
 | ✅ | **Trailer support** — `stream.sendTrailers()` + `waitForTrailers: true` | `0.4.0` | 2026-05-22 | Opt-in HTTP/2 response trailers via `self.sendTrailers(fields)`. The render pipeline sets `waitForTrailers` and emits the trailing headers after the body (in the `wantTrailers` event), across all render delegates. Activated only when a controller calls `self.sendTrailers(fields)`; HTTP/1.1 and the no-trailers path are unchanged. For gRPC-style streaming (`grpc-status`) and content-integrity (`Digest`) use cases. |
 | ✅ | **Alt-Svc header** — advertise HTTP/3 availability | `0.4.2` | 2026-06-02 | Set `Alt-Svc: h3=":443"; ma=86400` response header to advertise HTTP/3 (QUIC) availability via a QUIC-capable reverse proxy (nginx, Caddy, Cloudflare). Gina does not need to implement QUIC — just announce it. Opt-in via `settings.server.json`. Native HTTP/3 is out of scope: Node.js has no stable QUIC API, and the standard deployment topology (Gina → proxy → client) already delivers HTTP/3 at the edge. |
-| 📋 | **RFC 9218 Extensible Priorities** — read `Priority: u=N, i` request header | `0.6.x` | Q1 2027 | Use the RFC 9218 priority header to order response writes for multiplexed API clients. Low value for typical HTML page loads; high value for parallel API requests with declared urgency. |
+| 📋 | **RFC 9218 Extensible Priorities** — read, expose and propagate the `Priority: u=N, i` header | `0.6.x` | Q1 2027 | Read the client's declared urgency, expose it on the request, propagate it on outbound HTTP/2 calls, and use it where gina schedules its own work (async jobs, load shedding). Browsers do send it over HTTP/2 — Chrome spans the full urgency range and distinguishes documents, stylesheets, scripts, images and `fetch()` — while HTTP/1.1 sends nothing. Ordering the response writes themselves is **not** included: Node exposes no `PRIORITY_UPDATE` frame and no send-scheduler hook, so that half waits on the runtime. |
 | ✅ | **WebSocket over HTTP/2** (RFC 8441 extended CONNECT) — opt-in via `http2Options.enableConnectProtocol` (default off; https and cleartext h2c HTTP/2 bundles). From `onInitialize`, `app.onWebSocket(path, handler)` registers per-path WebSocket handlers; accepted streams arrive as full sessions backed by a built-in dependency-free RFC 6455 codec (auto-pong, timed close handshake, UTF-8 + close-code validation, payload/fragment DoS caps, backpressure passthrough, graceful shutdown drain). Unknown paths are refused with 404, plain CONNECT keeps its 405, and default-off deployments are byte-identical. **Extended in `0.5.5`:** endpoints are declarable in `routing.json` (`method: "ws"` + `param.wsHandler` → `channels/<name>.js`, `:param` paths, per-route `param.wsOptions`), and handlers can call other bundles over HTTP with `session.query()`. | `0.4.7` | 2026-06-11 |
 
 ---

package/framework/v0.6.18/VERSION

@@ -0,0 +1 @@
+0.6.18

package/framework/{v0.6.17 → v0.6.18}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -3446,11 +3446,32 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         // TODO - support regexp for validIf
         var validIf = ( typeof(options.validIf) == 'undefined' ) ? true : options.validIf;
 
+        // #FORMCT (query path) — capture the rule's OWN Content-Type BEFORE the merge
+        // below: after it, a rule-declared value and the `xhrOptions` default are
+        // indistinguishable (both are just `queryOptions.headers['Content-Type']`), and the
+        // resolution at `enctype` must tell them apart so an explicit per-rule override keeps
+        // winning. `merge` is variadic and earlier sources win, so `options` already beats
+        // `xhrOptions` — this only preserves the PROVENANCE the merge erases.
+        var ruleContentType = ( options && options.headers ) ? options.headers['Content-Type'] : null;
+
         queryOptions = merge(queryOptions, options, xhrOptions);
         delete queryOptions.data;
         delete queryOptions.validIf;
 
+        // #FORMCT (query path) — the live-check body is JSON (`JSON.stringify` above).
+        // Honor an EXPLICIT rule-declared Content-Type; otherwise send application/json — NOT
+        // the urlencoded default inherited from `xhrOptions` — or the server url-decodes the
+        // JSON body ('+' -> space, decodeURIComponent) before JSON.parse and corrupts values
+        // such as email "+aliases", which parses cleanly and answers 200 with a wrong verdict.
+        // Mirrors the non-binary send path's resolution in the plugin's main.js.
         var enctype = queryOptions.headers['Content-Type'];
+        if (
+            ( !ruleContentType || ruleContentType == '' )
+            && typeof(queryData) == 'string'
+            && /^[\[{]/.test(queryData.trim())
+        ) {
+            enctype = 'application/json; charset=UTF-8';
+        }
         var result      = null
             , $target   = this.target
             //, id        = $target.getAttribute('id')