gina 0.6.20 → 0.6.21

package/CHANGELOG.md

@@ -6,6 +6,12 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.21 - 2026-08-30
+### Fixed
+* #B442 - `route.request()` now settles its callback exactly once on every outcome, and an outbound request that fails can no longer take the bundle down. The `ClientRequest` returned by `http(s).get` was discarded, so nothing could attach an `error` listener to it: a dial failure whose code is carved out of the process-level handler left the caller waiting forever with nothing logged, while a code that is not carved out (`ETIMEDOUT`, `EHOSTUNREACH`, `ENETUNREACH`) escalated to an uncaughtException and terminated the bundle. A response stream that died mid-body behaved the same way for a different reason: the error was assigned to a local and delivery waited on an `end` event that never arrives. All four exit paths now run through a single-settle latch, so the callback receives an ordinary error argument - the shape consuming code already handles - and can never be invoked twice. `options.timeout` is honoured for the first time: it reached `http(s).get` and Node emitted `timeout` without destroying the socket, and the request object was unreachable, so the option silently did nothing; on expiry the request is now destroyed and the callback settles with an Error carrying `code` set to `ETIMEDOUT`. A request sent without a callback logs a warning on a dial failure instead of throwing. The browser bundle carries `lib/routing`, so pickup is a bundle restart AND a re-bake.
+* #B443 - merge() no longer throws when an id-keyed array carries a null element. typeof null is object, so a null element passed every typeof test and the next property access dereferenced it: seven shapes threw a TypeError across five distinct sites in the array merger - both collection entry guards null-checked only the source operand (a null FIRST target element threw inside the guard itself), both id-roster loops dereferenced every element (a null at any LATER index threw after the guard had passed), the override walk dereferenced both operands per step, and the per-element collection tests null-checked only the target side. Because every configuration overlay and collection merge travels through this lib, any such shape was a whole-merge kill. A null element now behaves like an element with no key: it matches nothing, blocks nothing and contributes nothing, and every previously-working shape is pinned byte-identical by the regression suite. This closes the read-side residual of the 0.6.20 fix, which had guarded the write side only. The browser bundle carries the array merger, so pickup is a bundle restart AND a re-bake.
+* #B444 - on Safari, modifier chords work again in validated fields carrying a suppressed autocomplete: paste (Cmd+V), select-all, copy, cut and undo were ALL dead on any live-checked field with autocomplete set to off or false, and the failure was silent in every direction - nothing was inserted, no paste or beforeinput event was dispatched anywhere on the page, and typing kept working, so the page author had no signal pointing at the framework. The cause was one layer above the Safari typing interception: the form-level keydown proxy cancelled the NATIVE keydown unconditionally before re-dispatching its namespaced synthetic event, and preventDefault on a native keydown suppresses the browser editing command itself - so the interception handler deliberately letting chords through changed nothing. The proxy now dispatches first and cancels the native keydown only when the handler prevented the synthetic event, which the interception already does on the paths it re-implements and already does not on chords - typing interception, caret integrity and autofill suppression are unchanged, verified on a real WebKit engine alongside the restored chords. `triggerEvent` now returns the event it dispatched so a proxy can read that decision; existing callers ignore the return value. Chromium-family browsers were never affected (the interception is gated to real-Safari user agents). The browser bundle carries both changed files, so pickup is a bundle restart AND a re-bake.
+
 ## 0.6.20 - 2026-08-30
 
 > **Pickup: restart your bundles AND rebuild them** (`gina bundle:build`). The browser bundle changed —

package/README.md

@@ -62,31 +62,29 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.20
+## What's in 0.6.21
 
 > **Restart your bundles AND rebuild them.** This release changes the browser
-> bundle: `gina.min.js` differs from `0.6.19` (`gina.min.css` and
-> `gina.onload.min.js` are unchanged). A restart alone updates the server half
-> only — each bundle bakes its own copy of the client assets, so the `merge()`
-> fixes below would not reach a browser at all. The security fix is server-side
-> and a restart is enough for it; the rebuild is owed to `lib/merge`.
+> bundle: all three fixes below ship in `gina.min.js`. A restart alone updates
+> the server half only — each bundle bakes its own copy of the client assets,
+> so a restart without `gina bundle:build` leaves the browser running the old
+> code.
 
-> **No settings reset.** `0.6.20` is a patch — the `shortVersion` stays `0.6`, so
+> **No settings reset.** `0.6.21` is a patch — the `shortVersion` stays `0.6`, so
 > your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**One security fix, and two `merge()` defects closed.** Concurrent calls to an
-emit-style entity method are now paired to the call each completion came from, so
-a single call that never signals completion can no longer desynchronise every
-caller that follows it — the same confidentiality shape as the `0.6.19` Couchbase
-fix, reached by a different route. Alongside it, `merge()` stops duplicating
-values a target already holds and stops throwing on a mixed array shape that
-could kill a boot. **One change may require action** — the new
-`model.emitTimeout` is opt-in and off by default, so nothing changes unless you
-set it; details in the [migration guide](https://gina.io/docs/migration).
-
-- **Security — concurrent entity calls no longer receive each other's records (#B440).** Both call forms (`await entity.method()` and `util.promisify(entity.method)`) paired completions to callers by arrival order, with no call identity. One call that never signalled completion — it neither emitted its `<shortName>#<method>` trigger nor returned a Promise that settled, typically because something threw inside an asynchronous callback before the `emit` and was swallowed as an unhandled rejection — left its pending slot at the head of that method's queue forever: from then on every caller received the *next* caller's record and the last one hung, every later caller hung outright when calls did not overlap, and each further lost completion made it one caller worse. Where the method reads a user-scoped or ownership-bearing record, a check performed on the returned row could pass for the wrong principal — a confidentiality and authorization concern, not only a correctness one. The trigger is **data-dependent** (an unexpected record shape), not load-dependent: invisible in a load test, present in any long-lived process. Every call now runs inside its own async context and a completion is matched to that context whatever the completion order — which also closes the documented out-of-order residual of the `0.6.11` fix. A completion for a call that already settled is dropped rather than handed to the next caller, and a completion reaching the entity outside every call's context (a native driver calling back from a loop started at boot) still pairs in arrival order and now logs `DISPATCH:NO_CONTEXT` at debug level. The `promisify` form also chains on a Promise returned by the method — it used to discard it, so a Promise-returning method was only safe on the entity-context form. **New opt-in** `settings.json > model.emitTimeout` (ms) bounds a call that never completes: it rejects with an Error naming the trigger and logs a warning; absent or `0` keeps the previous behaviour, where that call — and now only that call — stays pending. Server-side only.
-- **Fixed — `merge()` no longer duplicates a number the target already holds (#B436).** `merge([9, 1], [1])` gave `[9, 1, 1]`, and `{ ports: [8080, 8124] }` merged with `{ ports: [8124] }` gave `[8080, 8124, 8124]`. A nested array is also merged once per level instead of twice, so `[1, 2]` + `[3, 4]` one level down is `[1, 2, 3, 4]` rather than `[1, 2, 3, 4, 3, 4]`, and merging the same source a second time is now a no-op. The rule that lets a source legitimately repeat a number (`[25]` + `[25, 25]` still gives `[25, 25]`) now compares counts instead of positions. An array shared by both sides below the top level is left untouched, closing a residual of the `0.6.19` source-mutation fix.
-- **Fixed — `merge()` no longer throws on a mixed array shape (#B437).** Merging a target array that repeats a primitive (`['v2', 'v2']`) with an array of objects raised `TypeError: Cannot create property 'id' on string`: the object-fill branch tested for a free index on the *deduped* copy of the target and then wrote into the real one, whose index still held the string (or `null`). A configuration overlay hitting that shape killed the boot instead of merging. An occupied index is now left alone — as it already was for an object landing on one — and the merge completes.
+**Three availability and correctness fixes, two of them reported from the
+field.** An outbound request that failed could hang its caller forever or take
+the bundle down; `merge()` threw on a null array element; and on Safari, every
+modifier chord — paste, select-all, copy, cut, undo — was dead in validated
+fields that suppress autocomplete. **One change may require action** —
+`options.timeout` on an outbound request was accepted but inert, and now
+actually aborts the request; details in the
+[migration guide](https://gina.io/docs/migration).
+
+- **Fixed — an outbound `route.request()` now settles its callback on every outcome (#B442).** The request object returned by `http(s).get` was discarded, so nothing could attach an `error` listener to it, and a failed outbound call took one of two paths — neither reaching your callback. When the failure code was one the process-level handler tolerates (`ECONNREFUSED`, `ECONNRESET`, `EPIPE`) the process survived and the callback was simply never invoked: no error, no log line, and in anything serialized (a worker at concurrency 1, a queue processor) a permanent stall with nothing to diagnose it by. When the code was not one of those (`ETIMEDOUT`, `EHOSTUNREACH`, `ENETUNREACH` — a peer that stops answering, a route that goes away) the unhandled `error` became an `uncaughtException` and the bundle was terminated. A response stream dying mid-body behaved like the first case for a different reason: the error was recorded and delivery waited on an `end` event a broken stream never emits. All exit paths now run through a single-settle latch, so the callback is invoked **exactly once** on every outcome and can never be invoked twice. **Action if you already set `options.timeout`:** it previously did nothing — it reached `http(s).get`, but Node only *emits* a `timeout` event and never destroys the socket, and the request object was unreachable. It is now honoured: on expiry the request is destroyed and the callback settles with an `Error` carrying `code === 'ETIMEDOUT'`. Re-check the value against your slowest legitimate response before upgrading, or remove the option to keep the previous unbounded behaviour. A request sent without a callback now warns on a dial failure instead of throwing.
+- **Fixed — `merge()` no longer throws on a null array element (#B443).** An id-keyed array carrying a `null` raised `TypeError: Cannot read properties of null` from deep inside the merge — on either operand, at any index. `typeof null` is `'object'`, so a null element passed every type test and the next property access dereferenced it; seven distinct shapes threw, across the collection entry guards, the id-roster loops, the override walk and the per-element tests. Since every configuration overlay travels through this code, any such shape was a whole-merge kill. A null element is now treated as an element with no key: it matches nothing, blocks nothing and contributes nothing. Shapes that previously worked are unchanged — the regression suite pins them byte-identical. This closes the read side of the family whose write side shipped in `0.6.20`.
+- **Fixed — Safari: modifier chords work again in validated fields with a suppressed autocomplete (#B444).** On Safari, a live-checked field carrying `autocomplete="off"` (or `"false"`) could not be pasted into — and select-all, copy, cut and undo were equally dead. Nothing was inserted, **no `paste` or `beforeinput` event was dispatched anywhere on the page**, and typing kept working, so nothing pointed at the framework. The form-level keydown proxy was cancelling the native keydown before the Safari typing interception could decide anything, and `preventDefault` on a native keydown suppresses the browser's editing command itself. The proxy now defers that decision to the interception, which deliberately lets modifier chords run natively. Typing interception, caret integrity and autofill suppression on those fields are unchanged; Chromium-family browsers were never affected.
 
 ## Documentation
 

package/ROADMAP.md

@@ -72,6 +72,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.18` ✅ | **Fixed**: a field validated by a `query` (live-check) rule no longer gets the wrong verdict when its value contains a `+` — the live-check body is JSON but the request was labelled `application/x-www-form-urlencoded`, so the server url-decoded it before parsing and turned every `+` into a space; the mangled body was still valid JSON, so the endpoint answered 200 with a verdict computed from a corrupted value, and because a `query` rule also gates the submit trigger the common case of an email plus-address was a hard lockout on sign-in and password-recovery forms rather than a warning. Live-check bodies are no longer URL-decoded at all, so `%XX` sequences reach your action verbatim. **Fixed**: the dotted-path render data setter no longer walks and rewrites the shared forms catalog on every request — a first write is now stored by reference instead of being deep-merged through the render tree, ending both a per-request CPU cost and a silent mutation of the per-process catalog. Restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.17`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q4 2026** | `0.6.19` ✅ | **Security**: credentials carried in a request URL no longer reach the logs — every log message is redacted at the logger's single pre-render point before any sink renders it; configured per bundle in `settings.json > log.redact`, on by default with a built-in credential set, your own `patterns`, and every `${secret:KEY}` value masked verbatim. **Security**: concurrent calls to the same Couchbase entity method no longer cross-deliver results — the completion trigger carried no call identity, so the first query to finish woke every in-flight caller with its own payload. **Fixed**: a connector callback that throws is no longer invoked a second time, and a failed Couchbase query no longer settles its caller twice. **Fixed**: a logged `Error` keeps its message, stack, own properties and `cause` chain. **Fixed**: `merge()` no longer rewrites the object it was given. Restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.18`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
 | **Q4 2026** | `0.6.20` ✅ | **Security**: concurrent calls to an emit-style entity method are now paired to the call each completion came from. Both call forms (`await entity.method()` and `util.promisify(entity.method)`) paired by arrival order with no call identity, so one call that never signalled completion — it neither emitted its trigger nor returned a Promise that settled, typically because something threw inside an asynchronous callback and was swallowed as an unhandled rejection — left its slot at the head of that method's queue forever: every caller after it received the *next* caller's record, the last one hung, and each further lost completion made it one caller worse. Where the method reads a user-scoped or ownership-bearing record, a check performed on the returned row could pass for the wrong principal. The trigger is data-dependent, not load-dependent — invisible in a load test, present in any long-lived process. Every call now runs inside its own async context, a completion for an already-settled call is dropped rather than handed to the next caller, one reaching the entity outside every call's context still pairs in arrival order and logs `DISPATCH:NO_CONTEXT` at debug level, and the `promisify` form chains on a Promise the method returns instead of discarding it. New opt-in `settings.json > model.emitTimeout` (ms) bounds a call that never completes. **Fixed**: `merge()` no longer duplicates a number the target already holds at a different index, and merges a nested array once per level instead of twice. **Fixed**: `merge()` no longer throws `TypeError: Cannot create property 'id' on string` when a target array that repeats a primitive is merged with an array of objects — a configuration overlay hitting that shape killed the boot. Restart **and** rebuild your bundles (the browser bundle changed — `gina.min.js` differs from `0.6.19`; `gina.min.css` and `gina.onload.min.js` are unchanged). |
+| **Q4 2026** | `0.6.21` ✅ | **Fixed**: an outbound `route.request()` now settles its callback on every outcome — the request object was discarded, so nothing could attach an `error` listener, and a dial failure either never invoked the callback at all (a permanent stall for anything serialized, with nothing logged) or reached `uncaughtException` and terminated the bundle; a response stream dying mid-body waited on an `end` event it would never emit. `options.timeout` was accepted but inert — Node only emits a `timeout` event and never destroys the socket — and is now honoured, so a value set in the belief that it capped the call will begin aborting requests at that budget. **Fixed**: `merge()` no longer throws `TypeError: Cannot read properties of null` on an id-keyed array carrying a `null` element, on either operand at any index — the read-side counterpart of the write-side fix that shipped in `0.6.20`. **Fixed**: on Safari, modifier chords (paste, select-all, copy, cut, undo) work again in live-checked fields carrying `autocomplete="off"` — the form-level keydown proxy cancelled the native keydown before the typing interception could decide anything, and `preventDefault` on a native keydown suppresses the browser's editing command itself, so no `paste` event was dispatched anywhere; Chromium-family browsers were never affected. Restart **and** rebuild your bundles (the browser bundle changed — all three fixes ship in `gina.min.js`). |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |

package/framework/v0.6.21/VERSION

@@ -0,0 +1 @@
+0.6.21

package/framework/{v0.6.20 → v0.6.21}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -2475,11 +2475,16 @@ function Merge() {
                 && options[0] != null
                 && typeof(options[0][keyComparison]) != 'undefined'
                 && typeof(target[0]) == 'object'
+                // #B443 - typeof passes for a null first element; mirror the
+                // options-side check two lines above or the next line dereferences it
+                && target[0] != null
                 && typeof(target[0][keyComparison]) != 'undefined'
             ) {
 
                 newTarget =  (Array.isArray(target)) ? Array.from(target) : JSON.clone(target);
                 for (var nt = 0, ntLen = newTarget.length; nt < ntLen; ++nt) {
+                    // #B443 - a null (or hole) at a later index has no key to contribute
+                    if (newTarget[nt] == null) { continue; }
                     newTargetIds.push(newTarget[nt][keyComparison]);
                 }
 
@@ -2489,6 +2494,10 @@ function Merge() {
                 aLen = _options.length;
                 for (var n = next || 0, nLen = target.length; n < nLen; ++n) {
 
+                    // #B443 - a null target element has no key: it can match nothing,
+                    // so it neither blocks nor contributes; skip the comparison slot
+                    if (target[n] == null) { continue; }
+
                     // if (newTargetIds.indexOf(target[n][keyComparison]) == -1) {
                     //     newTargetIds.push(target[n][keyComparison]);
 
@@ -2499,6 +2508,10 @@ function Merge() {
                     label:
                     for (a = a || 0; a < aLen; ++a) {
 
+                        // #B443 - same disposition for a null source element: no key,
+                        // nothing to push, advance the cursor past it
+                        if (_options[a] == null) { continue; }
+
                         if (_options[a][keyComparison] === target[n][keyComparison] ) {
 
                             if (newTargetIds.indexOf(_options[a][keyComparison]) > -1) {
@@ -2582,6 +2595,9 @@ function Merge() {
                 && options[0] != null
                 && typeof(options[0][keyComparison]) != 'undefined'
                 && typeof(target[0]) == 'object'
+                // #B443 - typeof passes for a null first element; mirror the
+                // options-side check two lines above or the next line dereferences it
+                && target[0] != null
                 && typeof(target[0][keyComparison]) != 'undefined'
             ) {
 
@@ -2592,11 +2608,17 @@ function Merge() {
                 i = 0;
                 a = 0; aLen = newTarget.length;
                 for (; a < aLen; ++a) {
+                    // #B443 - a null (or hole) at a later index has no key to contribute
+                    if (newTarget[a] == null) { continue; }
                     newTargetIds.push(newTarget[a][keyComparison]);
                 }
                 a = 0;
                 for (; a < aLen; ++a) {
 
+                    // #B443 - a null slot on the rebuilt target has no key; both arms
+                    // of the comparison below dereference it
+                    if (newTarget[a] == null) { continue; }
+
                     end:
                         for (var n = next || 0, nLen = _options.length; n < nLen; ++n) {
 
@@ -2710,6 +2732,7 @@ function Merge() {
                             && !/null/i.test(target[a])
                             && typeof (target[a][keyComparison]) != 'undefined'
                             && typeof (options[a]) != 'undefined'
+                            && options[a] != null
                             && typeof (options[a][keyComparison]) != 'undefined'
                             && target[a][keyComparison] == options[a][keyComparison]
                         ) {
@@ -2730,6 +2753,7 @@ function Merge() {
                             && !/null/i.test(target[a])
                             && typeof (target[a][localKeyComparison]) != 'undefined'
                             && typeof (options[a]) != 'undefined'
+                            && options[a] != null
                             && typeof (options[a][localKeyComparison]) != 'undefined'
                             && target[a][localKeyComparison] == options[a][localKeyComparison]
                         ) {
@@ -6982,13 +7006,27 @@ function Routing() {
          * request current url
          * Attention: You should first try without an authentification middleware
          *
+         * The callback is settled EXACTLY ONCE, on every outcome: a successful response,
+         * a dial failure (ECONNREFUSED / EHOSTUNREACH / ENETUNREACH ...), a response stream
+         * that dies mid-body, or a timeout. Without a callback the request is fire-and-forget
+         * and a dial failure is reported with `console.warn` instead of being thrown.
          *
          * @param {boolean} [ignoreWebRoot]
          * @param {object} [options] - see: https://nodejs.org/api/https.html#https_new_agent_options
+         *      @param {number} [options.timeout] - milliseconds; on expiry the request is destroyed
+         *              and the callback settles with an Error carrying `code === 'ETIMEDOUT'`
          * @param {object} [_this] - current context: only used when `promisify`is used
          *
-         * @callback {callback} [cb] - see: https://nodejs.org/api/https.html#https_new_agent_options
-         *      @param {object} res
+         * @callback {callback} [cb]
+         *      @param {Error|string|boolean} err - an Error for transport failures, a string for a
+         *              broken response stream, `false` on success
+         *      @param {object|string} [data] - the response body, parsed when it is JSON
+         *
+         * @example
+         *      route.request(false, { timeout: 5000 }, function (err, data) {
+         *          if (err) { return handle(err); }
+         *          use(data);
+         *      });
          */
         route.request = function(ignoreWebRoot, options) {
 
@@ -7023,6 +7061,17 @@ function Routing() {
                 options.agent = false;
             }
             var agent = require(''+scheme);
+            // #B442: every exit path settles the caller exactly once. Before this guard the
+            // ClientRequest was discarded, so a dial failure had NO 'error' listener: a carved-out
+            // code (e.g. ECONNREFUSED, see lib/proc.js) left the caller waiting forever with
+            // nothing logged, and an uncarved one (ETIMEDOUT / EHOSTUNREACH / ENETUNREACH)
+            // escalated to uncaughtException and took the bundle down via dismiss(pid,'SIGTERM').
+            var settled = false;
+            var settle = function (err, data) {
+                if (settled) { return; }
+                settled = true;
+                cb(err, data);
+            };
             var onAgentResponse = function(res) {
 
                 var data = '', err = false;
@@ -7031,12 +7080,15 @@ function Routing() {
                     data += chunk;
                 });
                 res.on('error', function (error) {
-                    err = 'Failed to get mail content';
+                    // #B442: a response that dies mid-body never emits 'end', so assigning here
+                    // and waiting for 'end' to deliver meant the caller was never settled at all.
+                    err = 'route.request: response stream failed for ' + url;
                     if (error && typeof(error.stack) != 'undefined' ) {
-                        err += error.stack;
+                        err += '\n' + error.stack;
                     } else if ( typeof(error) == 'string' ) {
                         err += '\n' + error;
                     }
+                    settle(err);
                 });
                 res.on('end', function () {
                     if (/^\{/.test(data) ) {
@@ -7051,19 +7103,39 @@ function Routing() {
                         }
                     }
                     if (err) {
-                        cb(err);
+                        settle(err);
                         return;
                     }
 
-                    cb(false, data);
+                    settle(false, data);
                     return;
                 });
             }
+            var req = null;
             if (cb) {
-                agent.get(url, options, onAgentResponse);
+                req = agent.get(url, options, onAgentResponse);
+                // #B442: the dial-failure path. Without this the 'error' event has no listener.
+                req.on('error', function (error) {
+                    settle(error);
+                });
+                // #B442: `options.timeout` reaches http(s).get and Node EMITS 'timeout' without
+                // destroying the socket — and the request object used to be unreachable, so the
+                // option looked like a workaround and did nothing. Honour it here.
+                if ( options && typeof(options.timeout) != 'undefined' && options.timeout ) {
+                    req.on('timeout', function () {
+                        var e = new Error('route.request: timed out after ' + options.timeout + 'ms requesting ' + url);
+                        e.code = 'ETIMEDOUT';
+                        req.destroy(e);
+                    });
+                }
             } else {
                 // just throw the request without waiting/handling response
-                agent.get(url, options);
+                req = agent.get(url, options);
+                // #B442: nobody is waiting, but an unhandled 'error' here is still an
+                // uncaughtException — which is how a fire-and-forget call could kill the bundle.
+                req.on('error', function (error) {
+                    console.warn('[ ROUTING ] route.request: fire-and-forget request to ' + url + ' failed: ' + ( (error && error.message) ? error.message : error ));
+                });
             }
             return;
 
@@ -7616,6 +7688,10 @@ function addListener(target, element, name, callback) {
  * @param {string} name - event ID
  * @param {object|array|string} args - details
  * @param {object} [proxiedEvent]
+ * @returns {object|undefined} the dispatched event when a DOM element received
+ *      one - so a proxy can read the handler's decision (defaultPrevented) and
+ *      mirror it onto the native event it is proxying; undefined on the
+ *      customEvent (element-less) path
  */
 function triggerEvent (target, element, name, args, proxiedEvent) {
     if (typeof(element) != 'undefined' && element != null) {
@@ -7656,6 +7732,7 @@ function triggerEvent (target, element, name, args, proxiedEvent) {
                 //console.log('dispatching ['+name+'] to ', element.id, isAttachedToDOM, evt.detail);
                 element.dispatchEvent(evt)
             }
+            return evt;
 
         } else if (document.createEventObject) { // non standard
 
@@ -7670,6 +7747,7 @@ function triggerEvent (target, element, name, args, proxiedEvent) {
             }
 
             element.fireEvent('on' + name, evt);
+            return evt;
         }
 
     } else {
@@ -19289,8 +19367,21 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 _evt = 'keydown.'+$el.id
             }
             if (gina.events[_evt]) {
-                cancelEvent(event);
-                triggerEvent(gina, $el, _evt, event.detail, event);
+                // #B444 - dispatch FIRST and let the namespaced handler decide:
+                // the native keydown is cancelled only when that handler asked
+                // for it (it prevents the synthetic event on the paths it
+                // re-implements, and deliberately does not on modifier chords,
+                // per the interception's own contract). Cancelling BEFORE the
+                // dispatch suppressed the browser's own editing commands for
+                // every chord - on a real-Safari UA that made paste, select-all,
+                // copy, cut and undo all dead on any live-checked
+                // autocomplete-suppressed field, with no event observable
+                // anywhere (gh issue #67).
+                // was: cancelEvent(event); triggerEvent(gina, $el, _evt, event.detail, event);
+                var _syntheticEvt = triggerEvent(gina, $el, _evt, event.detail, event);
+                if ( _syntheticEvt && _syntheticEvt.defaultPrevented ) {
+                    cancelEvent(event);
+                }
             }
         };
         var keyupProxyHandler = function(event) {