gina 0.6.19 → 0.6.20

package/CHANGELOG.md

@@ -6,6 +6,18 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.20 - 2026-08-30
+
+> **Pickup: restart your bundles AND rebuild them** (`gina bundle:build`). The browser bundle changed —
+> `gina.min.js` differs from `0.6.19` (`gina.min.css` and `gina.onload.min.js` are unchanged), owed to the
+> two `merge()` fixes below; `lib/merge` ships in the client bundle. The security fix is server-side and a
+> restart alone picks it up. `0.6.20` is a patch — the `shortVersion` stays `0.6`, so there is no settings reset.
+### Fixed
+* `merge()` no longer throws `TypeError: Cannot create property 'id' on string` when a target array that repeats a primitive (`['v2', 'v2']`) is merged with an array of objects. The object-fill branch tested for a free index on the DEDUPED copy of the target and then wrote into the real one, whose index still held the string (or `null`), so a configuration overlay hitting that shape killed the boot instead of merging. An occupied index is now left alone — as it already was for an object landing on one — and the merge completes (#B437).
+* `merge()` no longer duplicates a number the target already holds at a different index (`merge([9, 1], [1])` gave `[9, 1, 1]`; `{ ports: [8080, 8124] }` merged with `{ ports: [8124] }` gave `[8080, 8124, 8124]`), and a nested array is merged once per level instead of twice, so `[1, 2]` + `[3, 4]` one level down is `[1, 2, 3, 4]` rather than `[1, 2, 3, 4, 3, 4]` and merging the same source a second time is a no-op. The rule that lets a source repeat a number (`[25]` + `[25, 25]` still gives `[25, 25]`) now compares counts instead of positions. An array shared by both sides below the top level is also left untouched, closing a residual of the 0.6.19 source-mutation fix (#B436).
+### Security
+* #B440 — concurrent calls to a JS-defined, emit-style entity method are now paired to the call each completion came from, on both call forms (`await entity.method()` and `util.promisify(entity.method)`). One call that never signalled completion — it neither emitted its `<shortName>#<method>` trigger nor returned a Promise that settled, typically because something threw inside an asynchronous callback before the `emit` (swallowed as an unhandled rejection) — used to leave its pending slot at the head of that method's arrival-order queue forever: from then on every caller received the NEXT caller's record and the last one hung, every later caller hung when calls did not overlap, and each further lost completion made it one caller worse. Where the method reads a user-scoped or ownership-bearing record, a check performed on the returned row could pass for the wrong principal — a confidentiality and authorization concern, not only a correctness one, and the same shape as the 0.6.19 Couchbase fix. The trigger is data-dependent (an unexpected record shape), not load-dependent: invisible in a load test, present in any long-lived process. Every call now runs inside its own async context; a completion is matched to that context whatever the completion order (which also closes the documented out-of-order residual of the 0.6.11 fix), a completion for a call that already settled is dropped rather than handed to the next caller, and a completion that reaches the entity outside every call's context (a native driver calling back from a loop started at boot) still pairs in arrival order and now logs `DISPATCH:NO_CONTEXT` at debug level. The promisify form also chains on a Promise returned by the method — it used to discard it, so a Promise-returning method was only safe on the entity-context form. New opt-in `settings.json > model.emitTimeout` (ms) bounds a call that never completes: it rejects with an Error naming the trigger and a warn line is logged; absent or 0 keeps the previous behaviour, where that call — and now only that call — stays pending. Server-side only — pickup is a bundle restart, no re-bake.
+
 ## 0.6.19 - 2026-08-28
 ### Fixed
 * #B431 — a failed couchbase query no longer settles its caller twice. Each dispatch chained `.catch(onError).then(onResult)` sequentially; a `.catch()` handler that returns normally RESOLVES the promise it produces, so the trailing `.then()` ran on every error with no result payload and delivered a second, bogus empty success. Measured: one failed query invoked an explicit trailing callback twice — first with the real error, then with `(false, null, {})` — so the canonical `if (err) { return next(err); } render(data);` shape ran BOTH branches, erroring the request and then rendering an empty result. On the `await` / `.onComplete()` path the second settlement was swallowed because a promise settles once, which is why this went unnoticed; it was still the reason a failed query emitted its trigger three times instead of once. `bulkInsert` shared the root cause with a different symptom: its result handler dereferenced the absent payload, so every failed bulk insert logged a spurious `TypeError: Cannot read properties of undefined (reading 'rows')`. All three dispatch sites now use the two-argument `.then(onResult, onError)` form, making the handlers mutually exclusive branches, and `bulkInsert` guards its payload the way the query path already did. Server-side only — pickup is a bundle restart, no re-bake.

package/README.md

@@ -62,35 +62,31 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.19
+## What's in 0.6.20
 
 > **Restart your bundles AND rebuild them.** This release changes the browser
-> bundle: `gina.min.js` differs from `0.6.18` (`gina.min.css` and
+> bundle: `gina.min.js` differs from `0.6.19` (`gina.min.css` and
 > `gina.onload.min.js` are unchanged). A restart alone updates the server half
 > only — each bundle bakes its own copy of the client assets, so the `merge()`
-> fix below would not reach a browser at all.
+> fixes below would not reach a browser at all. The security fix is server-side
+> and a restart is enough for it; the rebuild is owed to `lib/merge`.
 
-> **No settings reset.** `0.6.19` is a patch — the `shortVersion` stays `0.6`, so
+> **No settings reset.** `0.6.20` is a patch — the `shortVersion` stays `0.6`, so
 > your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**Two security fixes, and a family of connector callback defects closed.** Log
-redaction is now built in and on by default, so a credential carried in a request
-URL no longer reaches stdout in plaintext; and concurrent calls to the same
-Couchbase entity method no longer cross-deliver each other's results. Around
-them, every connector's callback delivery was audited: a callback that throws is
-no longer invoked a second time, a failed Couchbase query no longer settles its
-caller twice, a logged `Error` keeps its message and stack, and `merge()` no
-longer rewrites the object it was given. **Two changes may require action** —
-log redaction for every project, the Couchbase change only if you use that
-connector — details in the [migration guide](https://gina.io/docs/migration).
-
-- **Security — credentials in a request URL no longer reach the logs (#B433).** The HTTP access line — and 45 sibling sites across both engines, every render delegate and the CSRF filter — logged the URL as received, so a password-reset token, a signed download link or a one-time invite was written to stdout verbatim with no seam to redact it. Every log message is now redacted before it is rendered and dispatched, at the logger's single pre-render point, so stdout, `gina tail`, the file transport and the Inspector all receive the same masked line. Configured per bundle in `settings.json > log.redact` and **on by default**: a built-in set masks JSON Web Tokens, URL userinfo passwords, `Bearer`/`Basic` credentials, named credential query keys (`token`, `access_token`, `api_key`, `secret`, `password`, `signature`, `otp`, …, keeping the key and masking the value) and api-key style headers; every value the secrets resolver substituted for a `${secret:KEY}` placeholder is masked verbatim; and `patterns` takes your own rules. A bare long-hex path segment is deliberately not a default — add `(?<![0-9a-f])[0-9a-f]{64}(?![0-9a-f])` yourself when your credentials take that shape. **Behaviour change:** masked values now appear in logs where the raw value used to; set `log.redact.enabled` to `false` to opt out. Also new: `console.setRedaction(block, options)` and `lib.secrets.getResolvedValues(conf)`.
-- **Security — concurrent Couchbase entity reads no longer cross-deliver results (#B429).** The completion trigger carried no call identity and was emitted on a process-wide singleton, so the first query to finish woke every in-flight caller of that method with its own payload: two concurrent reads with different arguments could each receive the other's rows, a third caller could receive an error belonging to a different call, and a single response could blend rows from two callers — a confidentiality and authorization concern where the method reads a user-scoped record, not only a correctness one. Every call now settles from its own identity. **Action required only if you use the Couchbase connector** — see the migration guide.
-- **Fixed — a Couchbase callback that throws is no longer invoked twice (#B430).** The delivery path wrapped the callback in a `try` whose `catch` called the same callback again with identical arguments. The throw is now reported with the query trigger for context and the callback is never re-entered.
-- **Fixed — a failed Couchbase query no longer settles its caller twice (#B431).** Each dispatch chained `.catch(onError).then(onResult)` sequentially, so every error was followed by a bogus empty success — the canonical `if (err) { return next(err); } render(data);` shape ran both branches. Failed `bulkInsert` calls also logged a spurious `TypeError`; that is gone.
-- **Fixed — an entity query callback is no longer invoked twice when the callback itself throws (#B432).** The sqlite, mongodb and scylladb connectors delivered results inside a `try` or a `.then()` whose error path called the same callback a second time with the caller's own exception dressed up as a database failure. A throwing callback is now logged once, as `[ <label> ] callback exception:`, and never re-entered.
-- **Fixed — a logged `Error` object keeps its message, stack, own properties and `cause` chain (#B434).** Both log writers walked enumerable properties only, so `console.error(err)` rendered `{}` (or just `{"code": …}`). Errors now render the way Node's own console does — directly, among other arguments, nested inside a logged object, and on `console.log` alike — and the rendered message still goes through redaction. Passing `err.stack` as a string keeps working unchanged.
-- **Fixed — `merge()` no longer rewrites the object it was given (#B428).** A source subtree merged into an existing target level that lacked its key was referenced and then walked again as if merged into itself: every array inside the caller's object was replaced by a copy at every depth, and an array of primitives silently lost its duplicates. A subtree that is the same object on both sides is now skipped, so a grafted source keeps its arrays and duplicates and the result references it. Merging two different values is unchanged. `lib/merge` is part of the browser bundle — hence the rebuild.
+**One security fix, and two `merge()` defects closed.** Concurrent calls to an
+emit-style entity method are now paired to the call each completion came from, so
+a single call that never signals completion can no longer desynchronise every
+caller that follows it — the same confidentiality shape as the `0.6.19` Couchbase
+fix, reached by a different route. Alongside it, `merge()` stops duplicating
+values a target already holds and stops throwing on a mixed array shape that
+could kill a boot. **One change may require action** — the new
+`model.emitTimeout` is opt-in and off by default, so nothing changes unless you
+set it; details in the [migration guide](https://gina.io/docs/migration).
+
+- **Security — concurrent entity calls no longer receive each other's records (#B440).** Both call forms (`await entity.method()` and `util.promisify(entity.method)`) paired completions to callers by arrival order, with no call identity. One call that never signalled completion — it neither emitted its `<shortName>#<method>` trigger nor returned a Promise that settled, typically because something threw inside an asynchronous callback before the `emit` and was swallowed as an unhandled rejection — left its pending slot at the head of that method's queue forever: from then on every caller received the *next* caller's record and the last one hung, every later caller hung outright when calls did not overlap, and each further lost completion made it one caller worse. Where the method reads a user-scoped or ownership-bearing record, a check performed on the returned row could pass for the wrong principal — a confidentiality and authorization concern, not only a correctness one. The trigger is **data-dependent** (an unexpected record shape), not load-dependent: invisible in a load test, present in any long-lived process. Every call now runs inside its own async context and a completion is matched to that context whatever the completion order — which also closes the documented out-of-order residual of the `0.6.11` fix. A completion for a call that already settled is dropped rather than handed to the next caller, and a completion reaching the entity outside every call's context (a native driver calling back from a loop started at boot) still pairs in arrival order and now logs `DISPATCH:NO_CONTEXT` at debug level. The `promisify` form also chains on a Promise returned by the method — it used to discard it, so a Promise-returning method was only safe on the entity-context form. **New opt-in** `settings.json > model.emitTimeout` (ms) bounds a call that never completes: it rejects with an Error naming the trigger and logs a warning; absent or `0` keeps the previous behaviour, where that call — and now only that call — stays pending. Server-side only.
+- **Fixed — `merge()` no longer duplicates a number the target already holds (#B436).** `merge([9, 1], [1])` gave `[9, 1, 1]`, and `{ ports: [8080, 8124] }` merged with `{ ports: [8124] }` gave `[8080, 8124, 8124]`. A nested array is also merged once per level instead of twice, so `[1, 2]` + `[3, 4]` one level down is `[1, 2, 3, 4]` rather than `[1, 2, 3, 4, 3, 4]`, and merging the same source a second time is now a no-op. The rule that lets a source legitimately repeat a number (`[25]` + `[25, 25]` still gives `[25, 25]`) now compares counts instead of positions. An array shared by both sides below the top level is left untouched, closing a residual of the `0.6.19` source-mutation fix.
+- **Fixed — `merge()` no longer throws on a mixed array shape (#B437).** Merging a target array that repeats a primitive (`['v2', 'v2']`) with an array of objects raised `TypeError: Cannot create property 'id' on string`: the object-fill branch tested for a free index on the *deduped* copy of the target and then wrote into the real one, whose index still held the string (or `null`). A configuration overlay hitting that shape killed the boot instead of merging. An occupied index is now left alone — as it already was for an object landing on one — and the merge completes.
 
 ## Documentation
 

package/ROADMAP.md

@@ -71,6 +71,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.17` ✅ | **Fixed**: a route whose URL structurally matches but whose `requirements` reject the request no longer drops the connection once the route cache is warm — the cache is keyed on method and pathname with the query string stripped before dispatch, so every query variant of one pathname shares a single entry, and the warm path re-evaluated the requirements on each hit and then discarded the verdict, force-matching a request that had just been rejected and dispatching it with no routing description, which closed the connection with no HTTP response at all — no status and no body; the warm path now honours the verdict, treating a rejecting or throwing evaluation as a cache miss that falls through to the routing scan and answers correctly (404 when nothing matches, the sibling rule when one does, or a 500 naming the rule when a `validator::` requirement throws, which was previously also a dropped connection), while the cache entry is kept so the variants the requirements accept stay warm. **Fixed**: the `toFloat`, `set` and `format` validator rules are context-safe — all three are documented rules that threw on every server-side call, with `toFloat` opening by reading the live DOM element unguarded so server-side rule sets could not coerce a float at all (it now reads the live value only when one is reachable and otherwise uses the submitted value, which on the server is the raw value, and a missing comma in the same statement that leaked `isFloatingWithCommas` as an implicit global into every page is fixed with it), `set` now assigning the field value in both contexts while reflecting it onto the DOM element only in the browser where an element exists, and `format` — which already worked in both contexts when chained after `isDate`, as its documentation shows — now reporting a non-`Date` value as a named rule-authoring error pointing at the missing `isDate` instead of the opaque `val.format is not a function`. **Fixed**: a bundle declaring a redirect route no longer floods its log with `source[host] is undefined` warnings — redirect rules are deliberately excluded from the per-rule host and hostname defaulting so those keys are absent on them, but the per-request routing copy assigned them unconditionally, creating properties holding `undefined` on a clone kept for the lifetime of the process, so every later no-arg `getConfig()` emitted one `host` and one `hostname` warning per redirect rule indefinitely, measured by a consumer at roughly three quarters of that log line's total volume and drowning the genuine warnings it exists to surface; the copy is now existence-guarded, so an absent key stays absent and rules that do carry a host are copied exactly as before, which removes log noise rather than a functional defect, and only template and view routes reach it so API-only bundles were never affected. Pickup: restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.16`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q4 2026** | `0.6.18` ✅ | **Fixed**: a field validated by a `query` (live-check) rule no longer gets the wrong verdict when its value contains a `+` — the live-check body is JSON but the request was labelled `application/x-www-form-urlencoded`, so the server url-decoded it before parsing and turned every `+` into a space; the mangled body was still valid JSON, so the endpoint answered 200 with a verdict computed from a corrupted value, and because a `query` rule also gates the submit trigger the common case of an email plus-address was a hard lockout on sign-in and password-recovery forms rather than a warning. Live-check bodies are no longer URL-decoded at all, so `%XX` sequences reach your action verbatim. **Fixed**: the dotted-path render data setter no longer walks and rewrites the shared forms catalog on every request — a first write is now stored by reference instead of being deep-merged through the render tree, ending both a per-request CPU cost and a silent mutation of the per-process catalog. Restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.17`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q4 2026** | `0.6.19` ✅ | **Security**: credentials carried in a request URL no longer reach the logs — every log message is redacted at the logger's single pre-render point before any sink renders it; configured per bundle in `settings.json > log.redact`, on by default with a built-in credential set, your own `patterns`, and every `${secret:KEY}` value masked verbatim. **Security**: concurrent calls to the same Couchbase entity method no longer cross-deliver results — the completion trigger carried no call identity, so the first query to finish woke every in-flight caller with its own payload. **Fixed**: a connector callback that throws is no longer invoked a second time, and a failed Couchbase query no longer settles its caller twice. **Fixed**: a logged `Error` keeps its message, stack, own properties and `cause` chain. **Fixed**: `merge()` no longer rewrites the object it was given. Restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.18`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
+| **Q4 2026** | `0.6.20` ✅ | **Security**: concurrent calls to an emit-style entity method are now paired to the call each completion came from. Both call forms (`await entity.method()` and `util.promisify(entity.method)`) paired by arrival order with no call identity, so one call that never signalled completion — it neither emitted its trigger nor returned a Promise that settled, typically because something threw inside an asynchronous callback and was swallowed as an unhandled rejection — left its slot at the head of that method's queue forever: every caller after it received the *next* caller's record, the last one hung, and each further lost completion made it one caller worse. Where the method reads a user-scoped or ownership-bearing record, a check performed on the returned row could pass for the wrong principal. The trigger is data-dependent, not load-dependent — invisible in a load test, present in any long-lived process. Every call now runs inside its own async context, a completion for an already-settled call is dropped rather than handed to the next caller, one reaching the entity outside every call's context still pairs in arrival order and logs `DISPATCH:NO_CONTEXT` at debug level, and the `promisify` form chains on a Promise the method returns instead of discarding it. New opt-in `settings.json > model.emitTimeout` (ms) bounds a call that never completes. **Fixed**: `merge()` no longer duplicates a number the target already holds at a different index, and merges a nested array once per level instead of twice. **Fixed**: `merge()` no longer throws `TypeError: Cannot create property 'id' on string` when a target array that repeats a primitive is merged with an array of objects — a configuration overlay hitting that shape killed the boot. Restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.19`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |

package/framework/v0.6.20/VERSION

@@ -0,0 +1 @@
+0.6.20

package/framework/{v0.6.19 → v0.6.20}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -2157,6 +2157,12 @@ define("requireLib", function(){});
  * - Missing keys are always filled from `source`; on a CONFLICTING key the
  *   `target` value is preserved by default.
  * - Pass `true` as the last argument (`override`) to make `source` win instead.
+ * - Arrays of primitives merge as an ordered union: the target's elements first,
+ *   then every source element the result lacks. A number the source repeats more
+ *   often than the result is topped up to the source's count (`[25]` + `[25,25]`
+ *   gives `[25,25]`), a value already present is never pushed again, and merging
+ *   the same source a second time is a no-op (#B436). A nested array is merged
+ *   once per level.
  *
  * @example
  * var merge = require('lib/merge');
@@ -2199,6 +2205,7 @@ function Merge() {
      * merge([1, 2],   [3, 4])            // [1, 2, 3, 4]
      * merge([1, 2],   [3, 4], true)      // [3, 4]
      * merge({ a: [null, 'x'] }, { a: [null, 'x'] })  // { a: [null, 'x'] } — null elements are preserved (#B226)
+     * merge({ ports: [8080, 8124] }, { ports: [8124] })  // { ports: [8080, 8124] } — a value already present is not pushed again (#B436)
      */
     var browse = function (_target, _source) {
 
@@ -2354,7 +2361,12 @@ function Merge() {
                                             } else {
                                                 clone[ prop ] = copy[ prop ] // don't override existing
                                             }
-                                        } else if ( Array.isArray(copy[ prop ]) && Array.isArray(clone[ prop ]) ) {
+                                        } else if ( createMode && Array.isArray(copy[ prop ]) && Array.isArray(clone[ prop ]) ) {
+                                            // #B436 — createMode has no recursion below, so this is its one
+                                            // pass; on an existing level the `browse(clone, copy)` recursion
+                                            // that follows merges this array itself, and merging it here too
+                                            // walked every nested array twice (and replaced an array SHARED
+                                            // by both sides with a deduped copy, past the #B428 identity guard)
                                             clone[ prop ] = mergeArray(copy[ prop ], clone[ prop ], override);
                                         }
                                     }
@@ -2426,6 +2438,19 @@ function Merge() {
      * validator rule `"setFlash": [null, "message"]` on the client-side
      * rules path.
      *
+     * An OBJECT element of `options` fills a HOLE of `target` (an index the
+     * target lacks) by copying its keys; an occupied index — an existing
+     * object, a primitive or `null` — is never written into. That guard is
+     * #B437: the hole test runs on the deduped rebuild, whose indexes shift
+     * against a target carrying duplicate primitives, so the key write used to
+     * reach a string or null and throw, killing the whole merge.
+     *
+     * Primitive elements form an ordered union — the target's first, then every
+     * source element the result lacks. A `number` the source carries more often
+     * than the result so far is pushed again, up to the source's count (#B436):
+     * the comparison is by COUNT, so a number already present at another index
+     * is never duplicated and merging the same source twice is a no-op.
+     *
      * @inner
      * @private
      * @param {Array} options  - Source array (merged INTO target)
@@ -2638,10 +2663,18 @@ function Merge() {
                         if (typeof (newTarget[a]) == 'undefined')
                             newTarget[a] = {};
 
-
-                        for (let k in options[a]) {
-                            if (!newTarget[a].hasOwnProperty(k)) {
-                                newTarget[a][k] = options[a][k]
+                        // #B437 — the hole test above ran on the DEDUPED rebuild; after
+                        // the rebind `newTarget = target` the same index can hold a
+                        // primitive or null on the real target (a target carrying
+                        // duplicate primitives is SHORTER once deduped), and writing
+                        // keys into a string / null threw a TypeError that killed the
+                        // whole merge. An occupied slot is not a hole: skip it, as the
+                        // chain below already does for an object at an occupied index.
+                        if (newTarget[a] !== null && typeof(newTarget[a]) == 'object') {
+                            for (let k in options[a]) {
+                                if (!newTarget[a].hasOwnProperty(k)) {
+                                    newTarget[a][k] = options[a][k]
+                                }
                             }
                         }
 
@@ -2655,7 +2688,17 @@ function Merge() {
                             // ok but not if @ same position
                             //&& options[a] !== newTarget[a]
                         ) {
-                            if (options[a] !== newTarget[a]) {
+                            // #B436 — top up by COUNT, never by index. The source may carry a
+                            // repeated number the target has fewer copies of (a = [25];
+                            // b = [25,25] must give [25,25]), but the old test compared POSITIONS,
+                            // so a number already present at a different index was pushed again
+                            // ([9,1] + [1] gave [9,1,1]) and the merge was not idempotent — the
+                            // second pass a nested level used to take doubled every number.
+                            // was: if (options[a] !== newTarget[a]) { newTarget.push(options[a]); continue }
+                            var _seenInSource = 0, _seenInTarget = 0, _o = 0;
+                            for (; _o <= a; ++_o) { if (options[_o] === options[a]) ++_seenInSource; }
+                            for (_o = 0; _o < newTarget.length; ++_o) { if (newTarget[_o] === options[a]) ++_seenInTarget; }
+                            if (_seenInSource > _seenInTarget) {
                                 newTarget.push(options[a]);
                                 continue
                             }