gina 0.6.2 → 0.6.3

package/framework/{v0.6.2 → v0.6.3}/core/plugins/lib/validator/src/main.js

@@ -268,13 +268,205 @@ function ValidatorPlugin(rules, data, formId, culture) {
         'setCustomRules': setCustomRules
     };
 
+    /**
+     * backendIsPlainObject — plain-data-object test for the #B241 alias walk.
+     * Arrays, Date instances and null are LEAF VALUES on the server form-body
+     * path (a rule addresses the array/date itself), never containers to
+     * descend into.
+     *
+     * @inner
+     * @private
+     * @param {*} value
+     * @returns {boolean} true for a non-null, non-array, non-Date object
+     */
+    var backendIsPlainObject = function (value) {
+        return (
+            value !== null
+            && typeof(value) == 'object'
+            && !Array.isArray(value)
+            && !(value instanceof Date)
+        )
+    };
 
     /**
-     * Backend init
+     * backendAliasAugment — #B241: synthesize dotted-canon field entries
+     * ALONGSIDE the raw posted keys so the per-field rule lookup can join.
      *
-     * @param {object} rules
-     * @param {object} [customRule]
-     * */
+     * `parseRules` canonicalizes every rule key to a dotted path (a bracket
+     * key `a[b]` becomes `a.b`, a nested rule tree flattens to its dotted
+     * leaves) while the fields map keeps the RAW posted keys — so a rule
+     * authored on a bracket key, or as a nested tree, never joined on this
+     * path and the field was skipped with no warn (fail-open, check AND
+     * drop directives alike). Both production wire shapes were affected:
+     * flat bracket keys (the client posts the engine's name-keyed data as
+     * JSON, which the server parses verbatim) and nested objects (the
+     * multipart and urlencoded parsers expand bracket names).
+     *
+     * The originals are deliberately KEPT in the map: dollar-token
+     * substitution reads the raw keys, so cross-field references to
+     * bracket-named peers keep resolving exactly as before, and an all-flat
+     * payload synthesizes nothing (identity). An alias is only added when
+     * its key is still free, so a caller that already posts the dotted form
+     * keeps its own entry untouched.
+     *
+     * @inner
+     * @private
+     * @param {object} fields - the fields map to augment IN PLACE
+     * @param {object} data - the raw posted payload (never mutated)
+     * @returns {object} aliases - { count: number, map: { alias: meta } }
+     *   where meta is { kind: 'bracket', original } or
+     *   { kind: 'nested', rootKey, path }
+     */
+    var backendAliasAugment = function (fields, data) {
+        var aliases = { count: 0, map: {} };
+        var addNestedLeafAliases = function (rootKey, base, obj, pathSoFar) {
+            for (var subKey in obj) {
+                var aliasPath = pathSoFar.concat(subKey);
+                var subAlias = base + '.' + subKey;
+                if ( backendIsPlainObject(obj[subKey]) ) {
+                    addNestedLeafAliases(rootKey, subAlias, obj[subKey], aliasPath);
+                } else if ( typeof(fields[subAlias]) == 'undefined' ) {
+                    fields[subAlias] = obj[subKey];
+                    aliases.map[subAlias] = { kind: 'nested', rootKey: rootKey, path: aliasPath };
+                    ++aliases.count;
+                }
+            }
+        };
+        var key = null, alias = null;
+        for (key in data) {
+            if ( /\[/.test(key) ) {
+                alias = key.replace(/\[/g, '.').replace(/\]/g, '');
+                if ( typeof(fields[alias]) == 'undefined' ) {
+                    fields[alias] = data[key];
+                    aliases.map[alias] = { kind: 'bracket', original: key };
+                    ++aliases.count;
+                }
+            } else if ( backendIsPlainObject(data[key]) ) {
+                addNestedLeafAliases(key, key, data[key], [key]);
+            }
+        }
+        return aliases;
+    };
+
+    /**
+     * backendAliasToBracketName — rebuild the client's DOM-name addressing
+     * from a nested alias path (['account','username'] -> account[username]),
+     * so restored error keys match what the browser side renders against.
+     *
+     * @inner
+     * @private
+     * @param {string} rootKey
+     * @param {array} pathArr - path segments, rootKey first
+     * @returns {string} the bracket-notation field name
+     */
+    var backendAliasToBracketName = function (rootKey, pathArr) {
+        var out = rootKey;
+        for (var i = 1, len = pathArr.length; i < len; ++i) {
+            out += '[' + pathArr[i] + ']';
+        }
+        return out;
+    };
+
+    /**
+     * backendRestoreAliases — #B241 egress: fold every alias outcome back
+     * onto the original addressing, so the summary keeps today's contract.
+     *
+     * Error keys move to the DOM-name bracket form (the addressing the
+     * client's error rendering looks up). On `.data` — which the engine has
+     * already materialized (bracket originals arrive nested) — the alias
+     * flat keys are stripped and their outcomes applied at the original
+     * spot: an alias the engine dropped (an `exclude` directive) drops the
+     * original leaf too, an alias a transform rewrote wins over the raw
+     * value. Parents emptied BY AN EXCLUSION are pruned along that alias's
+     * path only — an empty object the caller posted is not this function's
+     * to remove.
+     *
+     * @inner
+     * @private
+     * @param {object} result - the { isValid, error, data } summary (mutated)
+     * @param {object} aliases - backendAliasAugment's return value
+     * @returns {object} result
+     */
+    var backendRestoreAliases = function (result, aliases) {
+        var alias = null, meta = null;
+        var errors = {};
+        for (alias in (result.error || {})) {
+            meta = aliases.map[alias];
+            if ( !meta ) {
+                errors[alias] = result.error[alias];
+            } else if ( meta.kind == 'bracket' ) {
+                errors[meta.original] = result.error[alias];
+            } else {
+                errors[backendAliasToBracketName(meta.rootKey, meta.path)] = result.error[alias];
+            }
+        }
+        result.error = errors;
+
+        var data = result.data;
+        if ( !data || typeof(data) != 'object' ) {
+            return result;
+        }
+        for (alias in aliases.map) {
+            meta = aliases.map[alias];
+            var aliasKept = Object.prototype.hasOwnProperty.call(data, alias);
+            var aliasValue = aliasKept ? data[alias] : undefined;
+            delete data[alias];
+
+            var segments = ( meta.kind == 'bracket' )
+                ? meta.original.replace(/\]/g, '').split(/\[/g)
+                : meta.path;
+            var sLen = segments.length - 1;
+            var parent = data, s = 0;
+            for (; s < sLen && parent; ++s) {
+                parent = parent[ segments[s] ];
+            }
+            if ( !parent || typeof(parent) != 'object' ) {
+                continue;
+            }
+            if ( !aliasKept ) {
+                delete parent[ segments[sLen] ];
+                // walk back up THIS path only, dropping parents the exclusion emptied
+                for (var back = sLen - 1; back >= 0; --back) {
+                    var holder = data, b = 0;
+                    for (; b < back && holder; ++b) {
+                        holder = holder[ segments[b] ];
+                    }
+                    if (
+                        holder
+                        && backendIsPlainObject(holder[ segments[back] ])
+                        && Object.keys(holder[ segments[back] ]).length === 0
+                    ) {
+                        delete holder[ segments[back] ];
+                    } else {
+                        break;
+                    }
+                }
+            } else {
+                parent[ segments[sLen] ] = aliasValue;
+            }
+        }
+        return result;
+    };
+
+    /**
+     * Backend init — the server half of form-body validation.
+     *
+     * Builds the fields map from the posted payload, parses the rule set
+     * into the dotted canon, and runs the engine. #B241: bracket-notation
+     * and nested-authored rule keys join through synthesized dotted aliases
+     * (see backendAliasAugment above); verdict keys and the data egress are
+     * restored to the original addressing before returning. The no-rules
+     * branch is untouched and keeps returning the payload verbatim.
+     *
+     * @inner
+     * @private
+     * @param {object} rules - the form's rule set (authored keys)
+     * @param {object} data - the posted payload
+     * @param {string} [formId]
+     * @param {string} [culture]
+     * @returns {object} the { isValid, error, data } summary, or a bare
+     *   FormValidator instance on the no-rules branch
+     */
     var backendInit = function (rules, data, formId, culture) {
 
         var $form = ( typeof(formId) != 'undefined' ) ? { 'id': formId } : null;
@@ -288,6 +480,9 @@ function ValidatorPlugin(rules, data, formId, culture) {
         // parsing rules
         if ( typeof(rules) != 'undefined' && rules.count() > 0 ) {
 
+            // #B241 — join bracket/nested rule keys through dotted aliases
+            var backendAliases = backendAliasAugment(fields, data);
+
             try {
                 parseRules(rules, '');
                 rules = checkForRulesImports(rules);
@@ -297,7 +492,16 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
             backendProto.rules = instance.rules;
 
-            return validate($form, fields, null, instance.rules, null, culture)
+            var backendResult = validate($form, fields, null, instance.rules, null, culture);
+            if (
+                backendAliases.count > 0
+                && backendResult
+                && typeof(backendResult.isValid) == 'function'
+                && typeof(backendResult.error) != 'undefined'
+            ) {
+                backendRestoreAliases(backendResult, backendAliases);
+            }
+            return backendResult;
 
         } else {
             // without rules - by hand
@@ -4238,6 +4442,25 @@ function ValidatorPlugin(rules, data, formId, culture) {
         Object.defineProperty($el, 'value', descriptor);
     }
 
+    /**
+     * addLiveForInput
+     * Wires one form control for live checking: registers the gina event
+     * name(s) the control's validation handler consumes, plus the handler
+     * itself (field pass + whole-form silent pass -> updateSubmitTriggerState).
+     * Text-like controls register change./keyup./focusin./focusout.<id>;
+     * radios and checkboxes register changed.<id> (dispatched by their
+     * update relays); a radio ALSO registers change.<id> (#B228) because the
+     * form-level change proxy is the only dispatcher that fires on a user
+     * pick and it only dispatches names that are registered.
+     *
+     * @inner
+     * @param {object} $form - form instance record (`instance.$forms[id]` shape: `.rules`, `.target`)
+     * @param {object} $el - control to wire (DOMObject)
+     * @param {number} liveCheckTimer - shared debounce timer handle
+     * @param {boolean} [isOtherTagAllowed=false] - admit non-input/textarea tags (selects, FACEs)
+     *
+     * @returns {undefined}
+     * */
     var addLiveForInput = function($form, $el, liveCheckTimer, isOtherTagAllowed) {
 
         if (typeof(isOtherTagAllowed) == 'undefined' ) {
@@ -4310,6 +4533,23 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         eventsList[_e] = _evt;
                         ++_e;
                     }
+                    // #B228 -- a RADIO also listens on the proxy-dispatched name: the
+                    // form-level change proxy dispatches `change.<id>` only when that
+                    // exact name is registered, and nothing else fires on a user pick
+                    // (the click proxy short-circuits into updateRadio, which never
+                    // dispatches; the bare-id relay has no live trigger) -- so the
+                    // `changed.<id>` registration above was consume-only dead wiring
+                    // on the pick path and the submit trigger kept its bind-time
+                    // state forever. The handler's radio arm has accepted
+                    // `change.`-typed events all along; checkboxes stay on their
+                    // working relay (change proxy -> updateCheckBox -> `changed.<id>`).
+                    if ( /^radio$/i.test($el.type) ) {
+                        _evt = 'change.'+$el.id;
+                        if ( typeof(gina.events[_evt]) == 'undefined' ) {
+                            eventsList[_e] = _evt;
+                            ++_e;
+                        }
+                    }
                 }
 
                 if (eventsList.length > 0) {
@@ -7210,6 +7450,20 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         $form.send(result['data']);
                     }
                 } else {
+                    // #B192 — release the submit latch. A rejected submit sends nothing, so it
+                    // never reaches the XHR settle (`xhr.onreadystatechange`), which was the only
+                    // other site clearing `isSubmitting`. Left latched, the live-check field
+                    // listener hard-returns on every subsequent keystroke, `updateSubmitTriggerState`
+                    // never runs again and the submit trigger keeps `aria-disabled="true"` +
+                    // `gina-form-submit-disabled` until the page is reloaded — and because the flag
+                    // lives on the `$forms[id]` object rather than a listener closure, it survives a
+                    // full unbind/rebind too. This branch IS the terminal no-send outcome; the valid
+                    // branch above deliberately keeps the latch until send() settles, which is what
+                    // keeps live-check quiet during a real in-flight submit.
+                    if ( instance.$forms[_id] ) {
+                        instance.$forms[_id].isSubmitting = false;
+                    }
+
                     // #A11Y1 (slice 3) — failed submit: move focus to the first invalid field so
                     // assistive tech announces it (accessible name + aria-invalid + the
                     // aria-errormessage text). DOM order; hidden / unfocusable fields are skipped.
@@ -7499,6 +7753,18 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     && !/^(true|false)$/.test($target[i].value)
                     ) {
                         fields[name] = false;
+                    } else if ( // #B221: same collection arm as getFormValidationInfos --
+                        // an unchecked non-boolean radio group with a truthy isRequired
+                        // is collected as an empty value so the submit-path validation
+                        // can adjudicate it (see the twin arm there for the rationale).
+                        $target[i].type == 'radio'
+                        && rules
+                        && typeof(rules[name]) != 'undefined'
+                        && /^true$/i.test(rules[name].isRequired)
+                        && typeof(rules[name].isBoolean) == 'undefined'
+                        && typeof(fields[name]) == 'undefined'
+                    ) {
+                        fields[name] = '';
                     }
 
                 } else {
@@ -7655,8 +7921,17 @@ function ValidatorPlugin(rules, data, formId, culture) {
     /**
      * getFormValidationInfos
      *
+     * Collects a form's named, non-disabled controls into a name->value map
+     * (`fields`) plus a name->DOM-handle map (`$fields`). Radio groups: a
+     * checked member's value is collected by the boolean/legacy arms; an
+     * unchecked non-boolean group whose rule declares a truthy `isRequired`
+     * is collected as an empty string (#B221) so the rule engine can
+     * adjudicate it; any other unchecked group stays absent (native parity;
+     * boolean-declared groups are owned by the force-false arm).
+     *
      * @param {object} $form - form target (DOMObject), not the instance
      * @param {object} [rules]
+     * @param {boolean} [isOnResetMode=false] - resets hidden/text values to their defaults while walking
      *
      * @returns {object} { .fields, .$fields, .rules }
      */
@@ -7812,6 +8087,28 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
                 ) {
                     fields[name] = false;
+                } else if ( // #B221: an unchecked non-boolean radio group with a
+                    // declared truthy isRequired never entered `fields`, so no
+                    // rule (isRequired above all) could adjudicate it -- and a
+                    // radio-group-only form short-circuited the whole pass
+                    // (fields count == 0 reads as nothing-to-validate). Collect
+                    // it as an empty value so the engine's generic emptiness
+                    // test fires. A checked member is always collected by the
+                    // arms above; the already-collected guard keeps this arm
+                    // from resetting it when an unchecked member iterates after
+                    // the checked one. Groups with no rule, isRequired:false,
+                    // or an isBoolean declaration keep the legacy
+                    // absent-when-unchecked shape (boolean groups are owned by
+                    // the force-false arm above; optional groups bypass on
+                    // empty anyway, so their wire shape stays byte-identical).
+                    $form[i].type == 'radio'
+                    && rules
+                    && typeof(rules[name]) != 'undefined'
+                    && /^true$/i.test(rules[name].isRequired)
+                    && typeof(rules[name].isBoolean) == 'undefined'
+                    && typeof(fields[name]) == 'undefined'
+                ) {
+                    fields[name] = '';
                 }
 
             } else {
@@ -7835,6 +8132,26 @@ function ValidatorPlugin(rules, data, formId, culture) {
         }
     }
 
+    /**
+     * getCastedValue
+     * Returns the value to use for `fieldName` — raw for the engine to
+     * adjudicate, or cast/quoted for dynamised-rules substitution.
+     *
+     * Plain mode (`formatFields`): numeric-rule comma normalisation only;
+     * real booleans pass through as-is and every other value stays RAW — the
+     * engine's own rules cast on acceptance (#B236).
+     * Dynamised mode (`getDynamisedRules`): values are spliced into a
+     * stringified condition, so a boolean-ruled field casts to an unquoted
+     * boolean operand, an empty value becomes a quoted empty string, and
+     * other strings are quoted.
+     *
+     * @inner
+     * @param {object} ruleObj - parsed rules (quoted booleans unquoted)
+     * @param {object} fields - collected field values (MUTATED: comma normalisation)
+     * @param {string} fieldName
+     * @param {boolean|string} [isOnDynamisedRulesMode] - truthy/`'true'` in dynamised mode
+     * @returns {*} the raw, cast, or quoted value
+     */
     var getCastedValue = function(ruleObj, fields, fieldName, isOnDynamisedRulesMode) {
 
         var isOnDynamisedRules = (
@@ -7879,7 +8196,16 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
         if ( typeof(fields[fieldName]) == 'boolean') {
             return fields[fieldName]
-        } else if (ruleObj[fieldName].isBoolean) {
+        // #B236 — the boolean pre-cast survives ONLY in dynamised-rules mode, where a
+        // referenced isBoolean field must splice into a stringified condition as an
+        // unquoted boolean operand (`$flag === true`). On the PLAIN pass it funneled
+        // every value not matching the case-insensitive literal `true` to `false`
+        // BEFORE the engine ran, so junk (and the HTML checkbox default `on`, and
+        // the number 1) validated clean and persisted as `false` on the server auto
+        // path. The engine is the single adjudicator now — the same contract the
+        // routing requirements surface always enforced.
+        // was: `} else if (ruleObj[fieldName].isBoolean) {`
+        } else if (isOnDynamisedRules && ruleObj[fieldName].isBoolean) {
             return (/^true$/i.test(fields[fieldName])) ? true : false;
         }
 
@@ -7951,7 +8277,18 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
             stringifiedRules = stringifiedRules.replace(re, fieldValue );
         }
-        if ( /\$(.*)/.test(stringifiedRules) ) {
+        // #B234 — this second loop is a DOM FALLBACK: it re-derives each splice
+        // value from the live element (`$fields[...].value` / `.checked`), and
+        // the server auto path (`backendInit`) passes `$fields = null`, so ANY
+        // `$` surviving loop 1 threw here — a regex end-anchor in an `is`
+        // condition, or a `$` inside a human-readable message string. Loop 1
+        // already replaces every KNOWN field's token, so what reaches loop 2 is
+        // a leftover it structurally cannot match anyway: skipping when there is
+        // no DOM matches what the client does when this re-scan no-ops, and
+        // leaves every previously-working substitution byte-identical. Same
+        // `$fields &&` guard shape as the #B127 precedent one function later.
+        // was: `if ( /\$(.*)/.test(stringifiedRules) ) {`
+        if ( $fields && /\$(.*)/.test(stringifiedRules) ) {
             for (let i = 0, len = arrFields.length; i < len; i++) {
                 _field = arrFields[i].replace(/\-|\_|\@|\#|\.|\[|\]/g, '\\$&');
                 re = new RegExp('\\$'+_field, 'g');
@@ -8016,6 +8353,24 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
 
         var re = null, flags = null, args = null;
+        /**
+         * Apply every rule declared for one field to the FormValidator instance `d`.
+         *
+         * Array-form rules (`isInList: [...]`) get their FIRST argument scanned for
+         * `$`-prefixed tokens; a token resolving to a real field (a `d` key with a
+         * defined `.value`) is substituted with that value, anything else stays
+         * LITERAL (#B239 — the blind deref crashed on unknown names and spliced
+         * "undefined" on engine-method-name collisions). Later elements are never
+         * scanned. Cross-field refs inside array rules are consumed upstream by
+         * getDynamisedRules loop 1 (quoted — #B240), so in practice only leftover
+         * non-field tokens reach the scan here.
+         *
+         * @inner
+         * @param {string} field - field name (key into `rules`, `fields` and `d`)
+         * @param {object} rules - parsed rule set for the whole form
+         * @param {object} fields - collected field values
+         * @returns {void} verdicts land on `d[field]` / `d.error`
+         */
         var checkFieldAgainstRules = function(field, rules, fields) {
             // ignore field if used as a _case_field
 
@@ -8114,7 +8469,25 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         if ( /\$[\-\w\[\]]*/.test(args[0]) ) {
                             var foundVariables = args[0].match(/\$[\-\w\[\]]*/g);
                             for (var v = 0, vLen = foundVariables.length; v < vLen; ++v) {
-                                args[0] = args[0].replace( foundVariables[v], d[foundVariables[v].replace('$', '')].value )
+                                // #B239 — the deref used to be blind, throwing
+                                // `TypeError: Cannot read properties of undefined` on
+                                // BOTH paths for any token naming no field (`d` is the
+                                // FormValidator field map on the client AND the server),
+                                // and splicing the string "undefined" for a token whose
+                                // name collides with an engine METHOD (isValid, toData —
+                                // defined keys with no `.value`). A token that does not
+                                // resolve to a real field now stays LITERAL, so strict
+                                // comparison applies. Cross-field refs inside array
+                                // rules remain owned by #B240 (upstream loop-1 quoting).
+                                // was: args[0] = args[0].replace( foundVariables[v], d[foundVariables[v].replace('$', '')].value )
+                                var _refName = foundVariables[v].replace('$', '');
+                                if (
+                                    typeof(d[_refName]) == 'undefined'
+                                    || typeof(d[_refName].value) == 'undefined'
+                                ) {
+                                    continue;
+                                }
+                                args[0] = args[0].replace( foundVariables[v], d[_refName].value );
                             }
                         }
                         d[field][rule].apply(d[field], args);
@@ -8333,6 +8706,8 @@ function ValidatorPlugin(rules, data, formId, culture) {
             var localRules = null, caseName = null;
             var localRuleObj = null, skipTest = null;
             var localFieldType  = null;
+            var caseValueBackup = null; // #B229 — see the `caseName == field` arm below
+            var baseValueBackup = null; // #B230 — see the base-rule restore below
 
             //console.debug('parsing ', fields, $fields, rules);
             if ( typeof(rules) != 'undefined' ) {
@@ -8717,13 +9092,80 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         }
                     }
 
-                    if (isInCase || caseName == field) continue;
+                    if (isInCase) continue;
+
+                    // #B229 — a field that DRIVES a `_case_` still owns its BASE
+                    // rules. `caseName` is assigned inside the `_case_` scan loop
+                    // above, which runs in full on EVERY field iteration, so at this
+                    // point it always holds the LAST scanned `_case_` key's driver
+                    // name. The old combined tail therefore skipped the whole rest of
+                    // the iteration for that driver — base-rule check included — so a
+                    // rule shape { "group": { "isRequired": true }, "_case_group": {…} }
+                    // never adjudicated `group` on the bind pass, the live-check
+                    // global pass OR the submit pass: the form never gated and an
+                    // empty submit went out unvalidated (the #B221 silent-submit
+                    // class, resurfacing for the self-driving shape — downstream of
+                    // #B221's collection fix, which already admits the group as '').
+                    // The driver's `allFields` entry is restored around the call:
+                    // checkFieldAgainstRules ends every applied rule with
+                    // `delete fields[field]` on the object it is handed, and
+                    // `allFields[caseName]` is the case VALUE the scan block re-reads
+                    // on every later field iteration — a deleted entry re-seeds from
+                    // `$allFields[name].value`, which for a radio group is the FIRST
+                    // member's value regardless of `.checked` (#B230, pre-existing).
+                    // The direct-case block below stays skipped for the driver, so
+                    // WHICH conditions apply is unchanged (measured: that block is
+                    // never entered for a self-driving case, pre-fix or post-fix).
+                    // was:
+                    // if (isInCase || caseName == field) continue;
+                    if ( caseName == field ) {
+                        if ( typeof(rules[field]) != 'undefined' ) {
+                            caseValueBackup = allFields[field];
+                            checkFieldAgainstRules(field, rules, allFields);
+                            if (
+                                typeof(allFields[field]) == 'undefined'
+                                && typeof(caseValueBackup) != 'undefined'
+                            ) {
+                                allFields[field] = caseValueBackup;
+                            }
+                        }
+                        continue;
+                    }
 
+                    // #B230 — a `_case_` driver's entry in `allFields` IS the case
+                    // VALUE every later reader consumes: the scan block above
+                    // re-reads it on every subsequent field iteration (a missing
+                    // entry re-seeds from `$allFields[name].value` — a radio
+                    // group's FIRST member regardless of `.checked`), and the
+                    // direct-case block below reads it in THIS iteration. Site
+                    // 3/3's adjudication deletes it (checkFieldAgainstRules ends
+                    // every applied rule with `delete fields[field]` on the
+                    // object it is handed), so a non-last driver's conditions
+                    // matched a value the user never picked on later scans and
+                    // matched nothing (`undefined`) in its own direct-case pass.
+                    // Back the entry up and restore it after the check — gated
+                    // on the field driving a `_case_` in the live `rules` OR in
+                    // the pass-entry clone `allRules`: inside a direct-case
+                    // recursion `rules` is the condition's own rule set (no
+                    // `_case_` keys), so `hasCase` alone is blind there
+                    // (measured — the union is load-bearing). Non-driver fields
+                    // keep the delete untouched: the pull-in gate, the
+                    // direct-case exclude injection and the async-`query`
+                    // re-validation input all read those absences today.
+                    baseValueBackup = allFields[field];
                     // check each field against rule only if rule exists 3/3
                     if ( typeof(rules[field]) != 'undefined' ) {
                         //checkFieldAgainstRules(field, rules, fields);
                         checkFieldAgainstRules(field, rules, allFields);
                     }
+                    // #B230 restore — see the block comment above
+                    if (
+                        ( hasCase || typeof(allRules['_case_' + field]) != 'undefined' )
+                        && typeof(baseValueBackup) != 'undefined'
+                        && typeof(allFields[field]) == 'undefined'
+                    ) {
+                        allFields[field] = baseValueBackup;
+                    }
 
                     if (hasCase) {
                         ++i; // add sub level