gina 0.6.25 → 0.6.26

package/CHANGELOG.md

@@ -6,6 +6,13 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.26 - 2026-09-04
+### Fixed
+* Error responses no longer crash when the rendered payload carries a non-numeric top-level status (#B466). A page whose own vocabulary includes a field named status - say {status: "draft"} rendered alongside an error - had that value stamped straight into the HTTP response, which threw ERR_HTTP_INVALID_STATUS_CODE and replaced the intended error page with an unhandled 500. The failure was invisible on every successful render and fired only on the error path, i.e. exactly when the error page was needed. Every status the error path resolves is now validated against node's own rule (an integer from 100 to 999) and degrades to a 500 error page when it does not qualify; a numeric status still sets the HTTP status exactly as documented. This also closes the same hole for an explicitly passed three-digit-but-invalid code such as "099", which previously threw as well.
+* Error responses now carry the content-type they are meant to declare (#B467). Two branches of the error path - the Internet Explorer override, and the branch taken when a request arrives with no user-agent header at all, which is the common shape for machine callers - passed the header NAME as node's status-message argument instead of passing a headers object. Node therefore read the MIME string character by character: over HTTP/1.1 the response came back with roughly ten to thirty junk headers named 0, 1, 2 and so on, a status line whose reason phrase read content-type, and no content-type header at all; over HTTP/2 the headers were dropped entirely and a status-message warning was emitted. Nothing threw, so the malformed error response was completely silent. Both branches now pass a headers object, matching the two sibling branches beside them, and the plain-text branch declares the bundle encoding as its charset because the error body is JSON written as UTF-8 - a charset-less text/plain invited clients to guess a single-byte encoding and corrupt any non-ASCII text in the error message.
+* Staged multipart upload parts stranded by a previous process are now reclaimed at boot (#B469). The `upload.autoTmpCleanupTimeout` deletion timer is per-upload and in-process, so a restart stranded every staged part it was holding, and a part that never reached `self.store()` - a request failing after the multipart parse, or an application consuming the staged file some other way - then had no reclaim path at all: on deployments that restart often, server-generated `.part` files accumulated indefinitely in the configured landing directories. When the timer is armed, server init now sweeps each configured landing directory (the global default plus every group `path`, deduplicated) for staged-shaped `.part` files older than the configured timeout, floored at one hour so an in-flight upload from a sibling live process on a shared staging directory is never touched. The sweep is deliberately conservative: exact server-generated name shape only (a client-named orphan predating the opaque staging names is indistinguishable from an application file and is left alone), regular files only, symlinks never followed, non-recursive. A disabled timer - the shipped default - still arms no sweep: removing staged files then remains the operator's own job, exactly as documented. Applications may also remove `req.files[].path` themselves; the publish path has always tolerated a vanished source, and that tolerance is now a documented contract.
+* Job records stranded by a process death are now reclaimed (#B471). The deferred function of an async job lives only in its creating process - a closure cannot be serialised - so a record left `running` (or `pending` past its scheduled retry) by a crash or an unclean restart could never settle: on a durable store its `expiresAt` stayed null forever, the TTL sweep's own guard excluded it, listings reported phantom running work, and the documented polling pattern never terminated. The sweep is now preceded by an orphan-reclaim pass on durable stores: a non-terminal record whose last transition - or whose scheduled retry - is older than `jobs.orphanTimeout` (seconds, default 86400, `0` or `false` disables, floored at 60) is marked `failed` with error name `JobOrphanedError`, after which normal `ttl` retention removes it on schedule. The built-in memory store is exempt, since an in-process store cannot hold another process's orphans; a record reclaimed while its origin was merely slow self-corrects on the origin's next write; and no completion webhook fires for a reclaim - concurrent reclaimers and a self-healing job would otherwise produce contradictory notifications, and the record itself carries the truth.
+
 ## 0.6.25 - 2026-09-03
 ### Added
 * Exact-money primitive (#FIN5): lib.money server-side and gina.money in the browser bundle — ISO 4217 minor-unit integer arithmetic on BigInt, with an in-lib exponent table (JPY 0, BHD 3, CLF 4, default 2). Strict wire-string parse() rejects float inputs and excess fractional precision (rounding stays the application's decision); add/subtract/compare/multiply throw on currency mismatch and integer-factor violations; format() renders the canonical wire string with exactly the currency's fraction digits; toMinor()/fromMinor() round-trip JSON-safe minor-unit counts. Amounts stay exact beyond Number.MAX_SAFE_INTEGER minor units. Display formatting deliberately stays with the i18n layer (Intl.NumberFormat). The module is dependency-free and dual-published; changes to it ride the browser bundle (pickup: restart and re-bake).

package/README.md

@@ -66,29 +66,26 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.25
+## What's in 0.6.26
 
-> **Restart AND rebuild your bundles.** This release changes the browser bundle:
-> the exact-money primitive (`gina.money`), the `isIban`/`isBic` validation
-> rules and the routing-helper diagnostic all ride `gina.min.js`. Run
-> `gina bundle:build` after upgrading, then `gina bundle:restart`.
+> **Restart your bundles — no rebuild needed.** Every fix in this release is
+> server-side; the browser bundle is byte-identical to `0.6.25`
+> (`gina.min.js` and `gina.min.css` both unchanged), so `gina bundle:restart`
+> is the whole pickup.
 
-> **No settings reset.** `0.6.25` is a patch — the `shortVersion` stays `0.6`,
+> **No settings reset.** `0.6.26` is a patch — the `shortVersion` stays `0.6`,
 > so your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**The financial-messaging foundations release** — five additive building blocks
-for ISO 20022-class and payments-grade applications, plus one hardening fix and
-two bug fixes. Full detail in [CHANGELOG.md](./CHANGELOG.md).
-
-- **Added — verbatim XML request bodies (#FIN1).** A POST, PUT or PATCH whose `Content-Type` is `application/xml`, `text/xml` or any `application/*+xml` type reaches your action verbatim: `req.body` is the exact document as a string, and you parse it with the library of your choice — gina never parses XML itself. Previously such a body was silently destroyed by the form-encoded decode path.
-- **Added — `self.renderXML(xmlContent, contentType)` (#FIN2).** First-class XML responses: send a pre-serialised document and the delegate owns the wire concerns — `application/xml` by default with your bundle's charset (RFC 7303), an optional `+xml`-suffix content type (`application/soap+xml`, `atom+xml`, vendor trees), HEAD suppression with byte-accurate `content-length`, the HTTP/2 pseudo-header status, opt-in trailers.
-- **Added — message-schema validation seam (#FIN3).** Declare `"messageValidator": "<name>"` in a route's `param` block and ship a factory at `message-validators/<name>.js` — boot-compiled (a broken module refuses the boot instead of silently skipping validation), sync or async, fed the verbatim body string. Refusals are fail-closed: 422 with your `errors` array, 400 for an unparseable document, 503 + `Retry-After` when your checker is down. Gina ships no schema engine — the validator is yours; the hook, the ordering and the refusal shape are the framework's.
-- **Added — `isIban` / `isBic` FormValidator rules (#FIN4).** IBAN per ISO 13616 — shape, official per-country length for 87 registered countries, and the ISO 7064 MOD 97-10 checksum — with a tolerant read (case and separators normalized for validation only; the stored value is never mutated), plus BIC per ISO 9362. Client + server, like every built-in rule.
-- **Added — exact-money primitive (#FIN5).** `lib.money` server-side and `gina.money` in the browser bundle: ISO 4217 minor-unit integer arithmetic on BigInt, strict wire-string `parse()` that rejects float inputs, `add`/`subtract`/`multiply`/`compare` with same-currency guards, canonical `format()`. Display formatting stays with `Intl.NumberFormat`.
-- **Added — idempotency keys (#FIN6).** Opt-in `Idempotency-Key` request deduplication at the router band, per the IETF draft: the recorded first response replays with `Idempotency-Replayed: true`, a duplicate in flight gets 409 + `Retry-After`, key reuse with a different payload gets 422. Principal-scoped, over a kv namespace you declare; dormant unless enabled.
-- **Security — Inspector inline-script data can no longer be read as template source.** The shared inline-script helper now escapes `{` and `}` inside JSON string literals as well as `<`, so a stored value like `{{ 7*7 }}` renders literally instead of executing with the page's locals in scope. Values parse back identical; only pages emitting the Inspector block were reachable.
-- **Fixed — the `query()` basic-auth option is honoured on HTTP/2 and can no longer leak (#B465).** `options.auth` is minted into `Authorization: Basic` before dispatch on BOTH transports and the option is deleted pre-dispatch. Previously node consumed it on HTTP/1.x only, while the HTTP/2 path forwarded it as a literal `auth:` header with authentication silently unperformed. A caller-supplied authorization header always wins.
-- **Fixed — the client-side routing helper no longer swallows its own diagnostic (#B462).** A route missing from the running table now surfaces as a `console.warn` on the first sighting (the `gina.notFound` registry still dedups repeats), and the alternate-route arm records its registry entry so repeat counts accumulate.
+**The error-path and orphan-reclaim release** — four fixes: two on the error
+response itself, where failures were invisible precisely because they only fire
+when something has already gone wrong, and two reclaiming artifacts that a
+process death used to strand forever. Full detail in
+[CHANGELOG.md](./CHANGELOG.md).
+
+- **Fixed — an error response no longer crashes on a non-numeric `status` (#B466).** A page whose own vocabulary includes a field named `status` — say `{status: "draft"}` rendered alongside an error — had that value stamped straight into the HTTP response, which threw `ERR_HTTP_INVALID_STATUS_CODE` and replaced the intended error page with an unhandled 500. Every status the error path resolves is now validated against node's own rule (an integer from 100 to 999) and degrades to a 500 error page when it does not qualify. A numeric status still sets the HTTP status exactly as documented. This also closes the same hole for an explicitly passed three-digit-but-invalid code such as `"099"`.
+- **Fixed — error responses carry the content-type they declare (#B467).** Two branches of the error path — the Internet Explorer override, and the branch taken when a request arrives with no `user-agent` header at all, the common shape for machine callers — passed the header *name* as node's status-message argument instead of a headers object. Node read the MIME string character by character: over HTTP/1.1 the response came back with roughly ten to thirty junk headers named `0`, `1`, `2`…, a reason phrase reading `content-type`, and no content-type at all; over HTTP/2 the headers were dropped entirely. Nothing threw, so the malformed response was completely silent. Both branches now pass a headers object, and the plain-text branch declares the bundle encoding as its charset. That half is user-visible wherever error copy is not plain ASCII: the error body is JSON written as UTF-8, and a charset-less `text/plain` invites the client to guess a single-byte encoding, so accented characters and non-Latin scripts in a message shown to a visitor render as mojibake.
+- **Fixed — staged upload parts stranded by a restart are reclaimed at boot (#B469).** The `upload.autoTmpCleanupTimeout` deletion timer is per-upload and in-process, so a restart stranded every staged part it was holding, and a part that never reached `self.store()` had no reclaim path at all — on deployments that restart often, server-generated `.part` files accumulated indefinitely. When the timer is armed, server init now sweeps each configured landing directory for staged-shaped `.part` files older than the configured timeout, floored at one hour so an in-flight upload from a sibling process on a shared staging directory is never touched. Deliberately conservative: exact server-generated name shape only, regular files only, symlinks never followed, non-recursive. A disabled timer — the shipped default — still arms no sweep.
+- **Fixed — job records stranded by a process death are reclaimed (#B471).** The deferred function of an async job lives only in its creating process, so a record left `running` by a crash or an unclean restart could never settle: on a durable store its `expiresAt` stayed null forever, the TTL sweep's own guard excluded it, listings reported phantom running work, and the documented polling pattern never terminated. The sweep is now preceded by an orphan-reclaim pass on durable stores: a non-terminal record older than `jobs.orphanTimeout` (seconds, default 86400, `0` or `false` disables, floored at 60) is marked `failed` with error name `JobOrphanedError`, after which normal `ttl` retention removes it on schedule. The built-in memory store is exempt, and no completion webhook fires for a reclaim — the record itself carries the truth.
 
 ## Documentation
 

package/ROADMAP.md

@@ -77,6 +77,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.23` ✅ | **Security**: hardened inline-script escaping — the previous guard matched only the literal `</script>` and `<!--`, but the HTML5 script-data end tag also accepts a tab, newline, form feed, space or `/` after the tag name, so `</script >` closed the block and the remainder of a stored value parsed as HTML; serialised values now neutralise `<` itself at every site, with U+2028/U+2029 escaped too, and escaped output parses back to an identical value. **Added**: the framework itself now emits seven security headers by default on both engines (`server.securityHeaders`; four more opt-in — `xFrameOptions` / `coop` / `corp` / `hsts`), first-writer-wins so mounted plugins, `env.json` headers and proxies keep winning, with `/_gina/*` exempt from the cross-origin-isolating pair; `server.hidePoweredBy` now defaults to `true`. **Added**: `server.maxBodySize` (default 64MB, 413 + stream destroyed) bounds non-multipart request bodies, with warn-only `server.maxBodySizeWarn` (2MB) and a configurable `server.timeout` that stays `0` on purpose (SSE/WebSocket). **Added**: opt-in Subresource Integrity — `templates.json > "sriEnabled": true` adds `integrity` + `crossorigin` to same-origin script and stylesheet tags that resolve on disk; fail-open, hashes stat-validated per render. **Fixed**: a JSON body whose nested object shadows `constructor` with a primitive, null, array or plain object no longer crashes the merge on the PUT path. Restart **and** rebuild your bundles (the browser bundle changed — the merge fix ships in `gina.min.js`). |
 | **Q4 2026** | `0.6.25` ✅ | **Added**: the financial-messaging foundations — verbatim XML request bodies on POST/PUT/PATCH (`req.body` keeps the exact document the client sent; the form-encoded decode path previously destroyed it silently) with `self.renderXML()` as the outbound counterpart (`application/xml` by default per RFC 7303, an optional `+xml`-suffix content type, HEAD suppression with byte-accurate `content-length`, HTTP/2 pseudo-header status, opt-in trailers — gina parses no XML and builds none); a pluggable message-schema validation seam (declare `param.messageValidator: "<name>"` on a route and ship a factory at `message-validators/<name>.js` — boot-compiled, fail-closed refusals: 422 with your `errors` array, 400 unparseable, 503 + `Retry-After` when the checker is down — ordered after auth/rate-limit/idempotency and before DTO field validation); `isIban` / `isBic` FormValidator rules (ISO 13616 shape + official per-country length for 87 countries + ISO 7064 MOD 97-10, and ISO 9362 — tolerant read, the stored value is never mutated; client + server like every built-in rule); an exact-money primitive (`lib.money` server-side and `gina.money` in the browser bundle — ISO 4217 minor-unit integer arithmetic on BigInt with strict wire-string `parse()`, same-currency guards and canonical `format()`; display stays with `Intl.NumberFormat`); and opt-in `Idempotency-Key` request deduplication at the router band per the IETF draft (the recorded first response replays with `Idempotency-Replayed: true`; 409 + `Retry-After` while the original is in flight; 422 on key reuse with a different payload; principal-scoped over a declared kv namespace). **Security**: server data serialised into the Inspector's inline script blocks can no longer be read as template source — the shared inline-script helper now escapes `{` and `}` inside JSON string literals as well as `<`, so a stored `{{ 7*7 }}` renders literally instead of executing with the page's locals in scope (values parse back identical; only pages emitting the Inspector block were reachable). **Fixed**: the query() basic-auth option is honoured on HTTP/2 and can no longer leak — `options.auth` is minted into `Authorization: Basic` before dispatch on BOTH transports and the option is deleted pre-dispatch (previously node consumed it on HTTP/1.x only, while the HTTP/2 path forwarded it as a literal `auth:` header with authentication silently unperformed; a caller-supplied authorization header always wins); and the client-side routing helper no longer swallows its "route not found inside your view" diagnostic — `console.warn` on the first sighting of each missing route, with repeats counted on `gina.notFound`. Restart **and** rebuild your bundles — the browser bundle changed (the money primitive, the IBAN/BIC rules and the routing-helper diagnostic ride `gina.min.js`). |
 | **Q4 2026** | `0.6.24` ✅ | **Fixed**: Couchbase `bulkInsert` no longer returns `undefined` when its own prologue throws — the outer `try` wraps the method body, so a synchronous failure (an unresolvable connection, or either `rec` validation) was caught, logged and swallowed, and the method fell off the end: the `await` form resolved with `undefined`, so a caller treating "did not throw" as success recorded an insert that never happened, and `.onComplete(cb)` threw a `TypeError` at the call site. The promise, its one-shot resolver and the `.onComplete` shim are now built before the `try`, so the outer catch settles the call. A fire-and-forget call now surfaces an `unhandledRejection` where it previously failed silently, and the fix moves what `bulkInsert` RETURNS, not what its promise RESOLVES WITH — a rows-less success still resolves `null`. **Fixed**: a Couchbase entity that fails to register now names itself, its source file, the method being attached and the underlying cause, instead of emitting a bare stack that left a partially-built entity and a missing method surfacing arbitrarily far from the cause; registration stays non-fatal. **Fixed**: the reconnect classifier no longer throws under every supported SDK — `err instanceof couchbase.Error` raised a `TypeError` because no supported couchnode exports a bare `Error` class, and since that operand is evaluated first the message arm was unreachable too, so the classifier could not classify by any route; each `instanceof` is now guarded on the class existing (deliberately a guard, not an activation — on the default `isaac` engine the listener is never dispatched at all). Restart your bundles — the browser bundle is unchanged, so no rebuild is needed. |
+| **Q4 2026** | `0.6.26` ✅ | **Fixed**: the error-path and orphan-reclaim release. An error response no longer crashes when the rendered payload carries a non-numeric top-level `status` — a page whose own vocabulary includes a field named `status` (say `{status: "draft"}` rendered alongside an error) had that value stamped straight into the HTTP response, which threw `ERR_HTTP_INVALID_STATUS_CODE` and replaced the intended error page with an unhandled 500, i.e. it fired only on the error path, exactly when the error page was needed; every status the error path resolves is now validated against node's own rule (an integer from 100 to 999) and degrades to a 500 error page when it does not qualify, while a numeric status still sets the HTTP status exactly as documented. **Fixed**: error responses now carry the content-type they declare — two branches of the error path, the Internet Explorer override and the branch taken when a request arrives with no `user-agent` header at all (the common shape for machine callers), passed the header NAME as node's status-message argument instead of a headers object, so node read the MIME string character by character: over HTTP/1.1 the response came back with roughly ten to thirty junk headers named `0`, `1`, `2`…, a reason phrase reading `content-type`, and no content-type at all, and over HTTP/2 the headers were dropped entirely — nothing threw, so the malformed response was completely silent. Both branches now pass a headers object, and the plain-text branch declares the bundle encoding as its charset, which is user-visible wherever error copy is not plain ASCII: the body is JSON written as UTF-8, and a charset-less `text/plain` invites the client to guess a single-byte encoding, rendering accented characters and non-Latin scripts as mojibake. **Fixed**: staged multipart upload parts stranded by a previous process are now reclaimed at boot — the `upload.autoTmpCleanupTimeout` deletion timer is per-upload and in-process, so a restart stranded every staged part it was holding and a part that never reached `self.store()` had no reclaim path at all; when the timer is armed, server init now sweeps each configured landing directory for staged-shaped `.part` files older than the configured timeout, floored at one hour so an in-flight upload from a sibling live process on a shared staging directory is never touched, and the sweep is deliberately conservative (exact server-generated name shape only, regular files only, symlinks never followed, non-recursive). A disabled timer — the shipped default — still arms no sweep. **Fixed**: job records stranded by a process death are now reclaimed — the deferred function of an async job lives only in its creating process, so a record left `running` by a crash or an unclean restart could never settle: its `expiresAt` stayed null forever, the TTL sweep's own guard excluded it, listings reported phantom running work and the documented polling pattern never terminated; the sweep is now preceded by an orphan-reclaim pass on durable stores marking a non-terminal record older than `jobs.orphanTimeout` (seconds, default 86400, `0` or `false` disables, floored at 60) as `failed` with error name `JobOrphanedError`, after which normal `ttl` retention removes it on schedule — the built-in memory store is exempt and no completion webhook fires for a reclaim. Restart your bundles — the browser bundle is unchanged, so no rebuild is needed. |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys |

package/framework/v0.6.26/VERSION

@@ -0,0 +1 @@
+0.6.26

package/framework/{v0.6.25 → v0.6.26}/core/controller/controller.js

@@ -123,6 +123,31 @@ const { type }      = require('node:os');
 var SwigFilters     = lib.SwigFilters;
 var statusCodes     = requireJSON( _( getPath('gina').core + '/status.codes') );
 
+/**
+ * #B466 — is `v` a status code node's `writeHead()` will accept ?
+ *
+ * Encodes node's own rule (integer 100-999) rather than membership of
+ * `statusCodes`: that table carries a `_comment` key, so a bare
+ * `typeof(statusCodes[v]) != 'undefined'` test accepts the status
+ * `"_comment"`, and it would also coerce a valid-but-unlisted code.
+ * `/^\d{3}$/` is not sufficient either — it accepts `"099"`, which node
+ * rejects. The `statusCodes` lookup remains in place as the DIAGNOSTIC
+ * (the `[ ApiValidator ]` warn); this predicate is the CORRECTNESS gate.
+ *
+ * @param {*} v - candidate status
+ * @returns {boolean} true when node would accept `v` as an HTTP status
+ *
+ * @example
+ *      _isValidHttpStatus(404)      // true
+ *      _isValidHttpStatus('404')    // true  (node accepts numeric strings)
+ *      _isValidHttpStatus('draft')  // false
+ *      _isValidHttpStatus('099')    // false (node rejects it)
+ */
+var _isValidHttpStatus = function (v) {
+    var n = Number(v);
+    return Number.isInteger(n) && n >= 100 && n <= 999;
+};
+
 // cached at module load — these env vars never change at runtime (#P19)
 var _isDev          = process.env.NODE_ENV_IS_DEV && process.env.NODE_ENV_IS_DEV.toLowerCase() === 'true';
 var _isLocalScope   = process.env.NODE_SCOPE_IS_LOCAL && process.env.NODE_SCOPE_IS_LOCAL.toLowerCase() === 'true';
@@ -7906,8 +7931,13 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
         ) {
 
             msg    = ( !/^\d+$/.test(code) && typeof(msg) == 'undefined' ) ?  code : msg;
-            // Preserve an explicitly passed 3-digit HTTP status code; fall back to res.status or 500
-            code    = ( /^\d{3}$/.test(String(code)) ) ? code : ( res && typeof(res.status) != 'undefined' ) ? res.status : 500;
+            // Preserve an explicitly passed HTTP status code; fall back to res.status or 500.
+            // #B466 — both candidates are validated: an unvalidated res.status
+            // reached writeHead() verbatim and threw ERR_HTTP_INVALID_STATUS_CODE
+            // on any non-numeric value, i.e. the error page failed exactly when
+            // it was needed. Guarding the explicit arm too closes the same hole
+            // for a 3-digit-but-invalid code such as "099".
+            code    = _isValidHttpStatus(code) ? code : ( res && _isValidHttpStatus(res.status) ) ? res.status : 500;
             // #CE1 — a transient datastore failure resolving to 500 upgrades
             // to 503 when the bundle opted in (explicit non-500 preserved above)
             code    = _maybeUpgradeTransient503(code);
@@ -7984,7 +8014,14 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
 
         } else if (arguments.length < 3) {
             msg           = code || null;
-            code          = res || 500;
+            // #B466 — `res` holds the code in this shape, and an invalid SCALAR
+            // would reach writeHead() verbatim. An OBJECT is deliberately passed
+            // through untouched: the errorObj shape is unpacked at the site-2
+            // resolution below (which applies the same guard), and collapsing it
+            // here would break the #CE1 transient-503 upgrade that depends on it.
+            code          = ( res !== null && typeof(res) == 'object' ) ? res
+                          : _isValidHttpStatus(res) ? res
+                          : 500;
             res           = local.res;
         }
 
@@ -8056,7 +8093,8 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                 // allowing this.throwError(err)
                 if ( typeof(code) == 'object' && !msg && typeof(code.status) != 'undefined' && typeof(code.error) != 'undefined' ) {
                     msg     = code.error || code.message;
-                    code    = code.status || 500;
+                    // #B466 — same guard as the resolution arms above.
+                    code    = _isValidHttpStatus(code.status) ? code.status : 500;
                     // #CE1 — second upgrade site: the 2-arg errorObj shape
                     // resolves its status only here, after the early header
                     // point above — so this site sets its own header too
@@ -8082,7 +8120,12 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                 // TODO - test with internet explorer then remove this if working
                 if ( typeof(req.headers['user-agent']) != 'undefined' ) {
                     if ( /msie/i.test(req.headers['user-agent']) ) {
-                        res.writeHead(code, "content-type", "text/plain");
+                        // #B467 - Node's signature is writeHead(status[, statusMessage][, headers]):
+                        // the 3-arg form used here put the mime STRING in the headers slot, so Node
+                        // index-keyed it into junk headers ("0","1",...) and emitted NO content-type.
+                        // The charset is declared because the body below is JSON.stringify(...) written
+                        // via res.end(), i.e. UTF-8 - same form the text-render path already builds.
+                        res.writeHead(code, { 'content-type': 'text/plain; charset='+ bundleConf.encoding } );
                     } else {
                         var contentType = ( responseHeaders && responseHeaders['content-type'])
                                          ? responseHeaders['content-type']
@@ -8093,7 +8136,9 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                 } else if ( typeof(responseHeaders['content-type']) != 'undefined' ) {
                     res.writeHead(code, { 'content-type': responseHeaders['content-type']} )
                 } else {
-                    res.writeHead(code, "content-type", bundleConf.server.coreConfiguration.mime['json']+ '; charset='+ bundleConf.encoding);
+                    // #B467 - same 3-arg misuse as the MSIE branch above; the mime expression is
+                    // unchanged, only the argument shape is corrected.
+                    res.writeHead(code, { 'content-type': bundleConf.server.coreConfiguration.mime['json']+ '; charset='+ bundleConf.encoding } );
                 }
 
 

package/framework/{v0.6.25 → v0.6.26}/core/gna.js

@@ -1536,6 +1536,7 @@ isBundleMounted(projects, bundlesPath, getContext('bundle'), function onBundleMo
                                         sweepInterval:  _jobsConf.sweepInterval,
                                         idSize:         _jobsConf.idSize,
                                         retryBackoffMs: _jobsConf.retryBackoffMs,
+                                        orphanTimeout:  _jobsConf.orphanTimeout,
                                         webhookMaxAttempts: _jobsConf.webhookMaxAttempts,
                                         webhookBackoffMs:   _jobsConf.webhookBackoffMs,
                                         webhookTimeoutMs:   _jobsConf.webhookTimeoutMs,

package/framework/{v0.6.25 → v0.6.26}/core/server.js

@@ -162,6 +162,91 @@ var parseByteSize = function(value) {
     }
 };
 
+/**
+ * #B469 — reclaim staged multipart parts a PREVIOUS process stranded.
+ *
+ * A staged upload part has exactly two reclaim paths: the `movefiles()` unlink
+ * when `self.store()` publishes it, and the per-upload `autoTmpCleanupTimeout`
+ * timer — which is in-process, so every part it was holding outlives a restart.
+ * This sweep runs the same policy across process lifetimes: at boot, remove
+ * from each configured staging directory the parts old enough that an armed
+ * timer would already have taken them, had its process survived.
+ *
+ * Deliberately conservative:
+ * - name-gated on the exact staged shape (32 lowercase hex + `.part`, the
+ *   server-generated name) — a client-named orphan predating that naming is
+ *   indistinguishable from an application file and is left alone;
+ * - regular files only (`lstat`, never follows a symlink), non-recursive;
+ * - age-gated on mtime, so a part a SIBLING live process is still streaming
+ *   into a shared staging dir (fresh mtime while chunks land) is never touched;
+ * - every step tolerates a concurrent removal (`ENOENT` is not an error — a
+ *   sibling bundle sweeping the same dir, or the app unlinking its own part).
+ *
+ * @private
+ * @function sweepStagedUploadOrphans
+ * @param {array} dirs - Absolute staging directories (already resolved, deduped by the caller)
+ * @param {number} olderThanMs - Only parts whose mtime is older than this many ms are removed; a non-positive/NaN value makes the sweep a no-op
+ * @param {function} done - Completion callback
+ * @param {object} done.report - `{ scanned, removed, errors }` counters (`scanned` = name-matching entries considered)
+ * @returns {void}
+ * @example
+ *   sweepStagedUploadOrphans([ '/var/data/uploads' ], 3600000, function(report) {
+ *       console.debug('removed ' + report.removed + ' orphaned staged part(s)');
+ *   });
+ */
+var sweepStagedUploadOrphans = function(dirs, olderThanMs, done) {
+    var report = { scanned: 0, removed: 0, errors: 0 };
+    if ( !(olderThanMs > 0) ) { // NaN/0/negative — refuse to sweep on a broken threshold
+        return done(report);
+    }
+    var d = 0;
+    var nextDir = function() {
+        if (d >= dirs.length) {
+            return done(report);
+        }
+        var dir = dirs[d]; d++;
+        fs.readdir(dir, function(readdirErr, names) {
+            if (readdirErr) {
+                // a staging dir that does not exist yet has nothing to reclaim
+                if (readdirErr.code != 'ENOENT') report.errors++;
+                return nextDir();
+            }
+            var cutoff = Date.now() - olderThanMs;
+            var n = 0;
+            var nextName = function() {
+                if (n >= names.length) {
+                    return nextDir();
+                }
+                var name = names[n]; n++;
+                if ( !/^[0-9a-f]{32}\.part$/.test(name) ) {
+                    return nextName();
+                }
+                report.scanned++;
+                var full = dir + '/' + name;
+                fs.lstat(full, function(lstatErr, stats) {
+                    if (lstatErr) {
+                        if (lstatErr.code != 'ENOENT') report.errors++;
+                        return nextName();
+                    }
+                    if ( !stats.isFile() || stats.mtimeMs > cutoff ) {
+                        return nextName();
+                    }
+                    fs.unlink(full, function(unlinkErr) {
+                        if (unlinkErr) {
+                            if (unlinkErr.code != 'ENOENT') report.errors++;
+                        } else {
+                            report.removed++;
+                        }
+                        nextName();
+                    });
+                });
+            };
+            nextName();
+        });
+    };
+    nextDir();
+};
+
 var _isDebugLog = function() {
     return process.env.LOG_LEVEL === 'debug' || process.env.LOG_LEVEL === 'trace';
 };
@@ -1838,6 +1923,57 @@ function Server(options) {
                 }
             }
 
+            // ── #B469 — staged-upload orphan sweep (boot-time) ──
+            // The `autoTmpCleanupTimeout` deletion timer is per-upload and
+            // in-process: a restart strands every part it was holding, and a
+            // part that never reaches `self.store()` (the request failed after
+            // the multipart parse, or the app consumed the staged file some
+            // other way) has NO other reclaim path. So when the operator HAS
+            // armed the timer, honour that same policy across process
+            // lifetimes: sweep the configured staging dirs at boot for staged
+            // parts old enough that a surviving timer would already have taken
+            // them. The threshold is floored at 1h: an in-flight upload from a
+            // sibling live process on a SHARED staging dir keeps a fresh mtime
+            // while its chunks land, and the floor keeps even a stalled one
+            // safe. A disabled timer (the shipped default) arms NO sweep — the
+            // docs say tmp cleanup is then the operator's own job, and this
+            // keeps that contract intact. Runs in every scope (production is
+            // where restarts strand parts); duplicate sweeps of a dir shared
+            // across merged-process bundles are harmless (idempotent,
+            // ENOENT-tolerant).
+            if ( _uploadSettings && _uploadSettings.groups && typeof(_uploadSettings.groups) == 'object' ) {
+                // mirrors the request path's arming gate for the timer itself
+                var _hasSweepTimeout = (
+                    typeof(_uploadSettings.autoTmpCleanupTimeout) != 'undefined'
+                    &&  _uploadSettings.autoTmpCleanupTimeout != ''
+                    &&  _uploadSettings.autoTmpCleanupTimeout != 0
+                    &&  !/false/i.test(_uploadSettings.autoTmpCleanupTimeout)
+                ) ? true : false;
+                var _sweepTimeoutMs = (!_hasSweepTimeout) ? null : parseTimeout(_uploadSettings.autoTmpCleanupTimeout);
+                if (_sweepTimeoutMs) {
+                    // staging-dir set = the resolved global landing dir + every
+                    // group override — the same resolution the write site uses
+                    var _sweepDirs = [ ( _uploadSettings.uploadDir || _uploadSettings.tmpPath || os.tmpdir() ) ];
+                    var _sweepGroupNames = Object.keys(_uploadSettings.groups);
+                    for (var _sg = 0; _sg < _sweepGroupNames.length; _sg++) {
+                        var _sgPath = _uploadSettings.groups[_sweepGroupNames[_sg]] && _uploadSettings.groups[_sweepGroupNames[_sg]].path;
+                        if ( _sgPath && _sweepDirs.indexOf(_sgPath) < 0 ) {
+                            _sweepDirs.push(_sgPath);
+                        }
+                    }
+                    var _sweepAppName = self.appName;
+                    setImmediate(function() {
+                        sweepStagedUploadOrphans(_sweepDirs, Math.max(_sweepTimeoutMs, 3600000), function(report) {
+                            if (report.removed || report.errors) {
+                                console.info('[ BUNDLE ][ '+ _sweepAppName +' ][ server ][ init ] upload orphan sweep: removed '+ report.removed +' staged part(s)'+ ( report.errors ? ' ('+ report.errors +' error(s))' : '' ) +' across '+ _sweepDirs.length +' staging dir(s)');
+                            } else {
+                                console.debug('[ BUNDLE ][ '+ _sweepAppName +' ][ server ][ init ] upload orphan sweep: no orphaned staged parts ('+ _sweepDirs.length +' staging dir(s))');
+                            }
+                        });
+                    });
+                }
+            }
+
             // ── #B152 — opt-in deterministic proxied-request classification ──
             // server.proxy.requireForwardedHeaders === true -> a request is
             // classified proxied ONLY on an explicit X-Forwarded-Host; the

package/framework/{v0.6.25 → v0.6.26}/lib/job/src/main.js

@@ -46,7 +46,12 @@
  *     session-store cleanup pattern) — NOT `lib/cron`, which is dormant (not
  *     registered in `lib/index.js`, not instantiated at boot). A bundle may
  *     drive an extra sweep from its own cron, but the internal timer
- *     guarantees baseline retention regardless.
+ *     guarantees baseline retention regardless. Since #B471 the sweep is
+ *     preceded by an orphan-reclaim pass on DURABLE stores: a non-terminal
+ *     record stranded by a dead process (its deferred fn died with it) is
+ *     terminalized as `failed`/`JobOrphanedError` once older than
+ *     `orphanTimeout` (default 24h, `0` disables), so retention and the
+ *     polling surface stay truthful across process lifetimes.
  *
  * The primitive is always-on. Optional tuning via `app.json` (an absent block
  * means sane defaults):
@@ -167,6 +172,16 @@ var DEFAULT_WEBHOOK_TIMEOUT_MS = 5000;
  */
 var DEFAULT_RETRY_BACKOFF_MS = 1000;
 
+/**
+ * Default orphan-reclaim ceiling, SECONDS (24h). A non-terminal record whose
+ * last transition is older than this is presumed stranded by a dead process
+ * and reclaimed as `failed` (`JobOrphanedError`) by {@link sweep}'s reclaim
+ * pass — durable stores only; see {@link reclaimOrphans}. `0` disables.
+ * @constant
+ * @type {number}
+ */
+var DEFAULT_ORPHAN_TIMEOUT = 86400;
+
 /**
  * The active record store (memory store by default). `null` until the first
  * {@link create} or {@link start}.
@@ -176,6 +191,26 @@ var DEFAULT_RETRY_BACKOFF_MS = 1000;
  */
 var _store = null;
 
+/**
+ * `true` when {@link _store} is the BUILT-IN memory store (defaulted, not
+ * app-supplied). The orphan-reclaim pass skips it: an in-process store cannot
+ * hold another process's orphans (process death wipes it), so reclaim there
+ * could only ever produce false positives on long-running live jobs.
+ *
+ * @inner
+ * @type {boolean}
+ */
+var _storeIsBuiltinMemory = false;
+
+/**
+ * Orphan-reclaim ceiling, SECONDS. `0` = disabled. Floored at 60 when armed
+ * (a smaller value would reclaim jobs still legitimately mid-flight).
+ *
+ * @inner
+ * @type {number}
+ */
+var _orphanTimeout = DEFAULT_ORPHAN_TIMEOUT;
+
 /**
  * In-flight worker count. Bounded by {@link _maxConcurrency}.
  *
@@ -248,7 +283,7 @@ function noop() {}
  * @property {number}      updatedAt   - Epoch ms of the last transition.
  * @property {?number}     startedAt   - Epoch ms the worker began; `null` while pending.
  * @property {?number}     finishedAt  - Epoch ms of the terminal transition; `null` until then.
- * @property {?number}     expiresAt   - Epoch ms after which a terminal record is sweepable; `null` until terminal — deliberately including while a retry is pending, so the sweep can never purge a retryable job.
+ * @property {?number}     expiresAt   - Epoch ms after which a terminal record is sweepable; `null` until terminal — deliberately including while a retry is pending, so the TTL sweep can never purge a retryable job. On a durable store that protection is bounded by the orphan-reclaim pass: a record left non-terminal past `orphanTimeout` is marked `failed` first, which stamps `expiresAt` and hands it to ordinary retention (see {@link reclaimOrphans}). The built-in memory store is exempt, so the guarantee is unbounded there.
  * @property {?number}     nextRetryAt - Epoch ms of the next scheduled attempt while a failed attempt awaits its retry; `null` once terminal (absent if the job never settled).
  * @property {?number}     webhookDeliveredAt - Epoch ms a completion webhook succeeded; absent until delivered.
  * @property {?boolean}    webhookFailed      - `true` once webhook delivery exhausts its retries; absent otherwise.
@@ -354,6 +389,7 @@ function serializeError(err) {
 function ensureStarted() {
     if (!_store) {
         _store = createMemoryStore();
+        _storeIsBuiltinMemory = true;
     }
     ensureSweepTimer();
 }
@@ -757,8 +793,106 @@ function remove(id, cb) {
 }
 
 /**
- * Purge terminal records whose TTL has elapsed. Invoked automatically by the
- * internal timer; also callable directly (e.g. from a bundle cron, or a test).
+ * #B471 — reclaim non-terminal records stranded by a DEAD process. The
+ * deferred function lives only in its creating process (a closure cannot be
+ * serialised), so a record left `running` — or `pending` past its scheduled
+ * retry — by a process death can never settle: `expiresAt` stays `null`, the
+ * TTL sweep's own `expires_at IS NOT NULL` guard excludes it forever, and a
+ * consumer polling it polls forever. This pass terminalizes such records as
+ * `failed` with error name `JobOrphanedError`, after which normal retention
+ * applies and the ordinary sweep deletes them on schedule.
+ *
+ * Age gates (both on ceilings, so a LIVE process's work always survives):
+ * - `running`:  last transition (`updatedAt`) older than the ceiling.
+ * - `pending` with a scheduled retry: `now` past `nextRetryAt` + ceiling —
+ *   a live origin retries at ~`nextRetryAt`, so the ceiling past it is
+ *   unambiguous, and a record merely WAITING on backoff is never touched.
+ * - plain `pending` (never ran): the `updatedAt` gate, like `running`.
+ *
+ * A record reclaimed while its origin was merely SLOW self-corrects: every
+ * origin write (`update()`, the worker's running transition, a retry
+ * re-enqueue) is unguarded last-write-wins, so the real outcome overwrites
+ * the synthetic failure. The transient `failed` reading is the disclosed
+ * cost. Reclaim fires NO completion webhook — under multi-process stores two
+ * processes may reclaim concurrently (no cross-process claim verb exists),
+ * and a self-healing job would otherwise emit contradictory notifications;
+ * the record itself carries the truth.
+ *
+ * Skipped entirely when disabled (`orphanTimeout: 0`/`false`), when the
+ * store is the BUILT-IN memory store (an in-process store cannot hold
+ * another process's orphans), or when the store lacks `list` (a minimal
+ * third-party store). Never throws; a list/update error is logged and the
+ * pass moves on — a reclaim that broke the sweep would be a worse failure
+ * than the strand it repairs.
+ *
+ * @inner
+ * @param   {number}   now - Epoch ms.
+ * @param   {function} cb  - `cb(reclaimedCount)`; never receives an error.
+ * @returns {void}
+ */
+function reclaimOrphans(now, cb) {
+    if (!_orphanTimeout || _storeIsBuiltinMemory || !_store || typeof _store.list !== 'function') {
+        cb(0); return;
+    }
+    var ceilingMs = _orphanTimeout * 1000;
+    var reclaimed = 0;
+    var states    = [STATES.RUNNING, STATES.PENDING];
+    var si        = 0;
+
+    var nextState = function() {
+        if (si >= states.length) {
+            if (reclaimed > 0) {
+                console.info('[lib.job] orphan reclaim: marked ' + reclaimed + ' stranded record(s) `failed` (JobOrphanedError, ceiling ' + _orphanTimeout + 's)');
+            }
+            cb(reclaimed); return;
+        }
+        var state = states[si]; si++;
+        _store.list({ state: state }, function(listErr, recs) {
+            if (listErr || !Array.isArray(recs)) {
+                if (listErr) console.warn('[lib.job] orphan reclaim: list(' + state + ') failed — skipping this pass: ' + (listErr.message || listErr));
+                return nextState();
+            }
+            var ri = 0;
+            var nextRec = function() {
+                if (ri >= recs.length) return nextState();
+                var rec = recs[ri]; ri++;
+                var stranded = false;
+                if (state === STATES.RUNNING) {
+                    stranded = (now - (rec.updatedAt || rec.startedAt || rec.createdAt || now)) > ceilingMs;
+                } else if (rec.nextRetryAt) {
+                    stranded = now > (rec.nextRetryAt + ceilingMs);
+                } else {
+                    stranded = (now - (rec.updatedAt || rec.createdAt || now)) > ceilingMs;
+                }
+                if (!stranded) return nextRec();
+                update(rec.id, {
+                    state:       STATES.FAILED,
+                    error:       { name: 'JobOrphanedError', message: 'reclaimed: `' + state + '` past jobs.orphanTimeout (' + _orphanTimeout + 's) — the owning process likely exited before settling this job', stack: null },
+                    nextRetryAt: null,
+                    finishedAt:  now,
+                    expiresAt:   now + _ttl * 1000
+                }, function(uErr, updated) {
+                    if (uErr) {
+                        console.warn('[lib.job] orphan reclaim: update failed for job `' + rec.id + '`: ' + (uErr.message || uErr));
+                    } else if (updated) {
+                        reclaimed++;
+                    }
+                    nextRec();
+                });
+            };
+            nextRec();
+        });
+    };
+    nextState();
+}
+
+/**
+ * Purge terminal records whose TTL has elapsed — preceded by the #B471
+ * orphan-reclaim pass (see {@link reclaimOrphans}), so records a dead
+ * process stranded become terminal and then age out through this same
+ * purge. Invoked automatically by the internal timer; also callable
+ * directly (e.g. from a bundle cron, or a test). The callback contract is
+ * unchanged: `removedCount` counts DELETIONS only, never reclaims.
  *
  * @memberof module:gina/lib/job
  * @param   {function} [cb] - `cb(err, removedCount)`.
@@ -770,7 +904,10 @@ function remove(id, cb) {
 function sweep(cb) {
     if (typeof cb !== 'function') cb = noop;
     if (!_store) { cb(null, 0); return; }
-    _store.sweep(Date.now(), cb);
+    var now = Date.now();
+    reclaimOrphans(now, function() {
+        _store.sweep(now, cb);
+    });
 }
 
 /**
@@ -786,6 +923,7 @@ function sweep(cb) {
  * @param   {number}   [opts.sweepInterval=300]  - Sweep interval (seconds); `0` disables the internal timer.
  * @param   {number}   [opts.idSize=21]          - jobId length (characters).
  * @param   {number}   [opts.retryBackoffMs=1000]    - Base delay (ms) between attempts of a failed job with retries remaining; doubles each attempt.
+ * @param   {number|boolean} [opts.orphanTimeout=86400] - Orphan-reclaim ceiling (SECONDS): a non-terminal record whose last transition is older than this is reclaimed as `failed` (`JobOrphanedError`) by the sweep pass — durable stores only, the built-in memory store is exempt. `0`/`false` disables; positive values are floored at 60.
  * @param   {number}   [opts.webhookMaxAttempts=3]   - Completion-webhook retry ceiling.
  * @param   {number}   [opts.webhookBackoffMs=500]   - Webhook backoff base (ms); doubles each retry.
  * @param   {number}   [opts.webhookTimeoutMs=5000]  - Per-attempt webhook request timeout (ms).
@@ -814,6 +952,13 @@ function start(opts) {
     if (typeof opts.retryBackoffMs === 'number' && opts.retryBackoffMs >= 0) {
         _retryBackoffMs = Math.floor(opts.retryBackoffMs);
     }
+    // 0 / false disables the orphan-reclaim pass; a positive value is floored
+    // at 60s so a mistyped tiny ceiling cannot reclaim jobs mid-flight.
+    if (opts.orphanTimeout === 0 || opts.orphanTimeout === false) {
+        _orphanTimeout = 0;
+    } else if (typeof opts.orphanTimeout === 'number' && opts.orphanTimeout > 0) {
+        _orphanTimeout = Math.max(60, Math.floor(opts.orphanTimeout));
+    }
     if (typeof opts.webhookMaxAttempts === 'number' && opts.webhookMaxAttempts > 0) {
         _webhookMaxAttempts = Math.floor(opts.webhookMaxAttempts);
     }
@@ -827,7 +972,13 @@ function start(opts) {
         _webhookSecret = opts.webhookSecret;
     }
     if (!_store) {
-        _store = (opts.store && typeof opts.store === 'object') ? opts.store : createMemoryStore();
+        if (opts.store && typeof opts.store === 'object') {
+            _store = opts.store;
+            _storeIsBuiltinMemory = false;
+        } else {
+            _store = createMemoryStore();
+            _storeIsBuiltinMemory = true;
+        }
     } else if (opts.store && typeof opts.store === 'object' && opts.store !== _store) {
         // Store adoption is once-only: a store arriving after one is installed
         // (e.g. a create() already ran ensureStarted() and defaulted to the
@@ -900,6 +1051,8 @@ function reset() {
     _webhookTimeoutMs   = DEFAULT_WEBHOOK_TIMEOUT_MS;
     _webhookSecret      = null;
     _retryBackoffMs     = DEFAULT_RETRY_BACKOFF_MS;
+    _orphanTimeout      = DEFAULT_ORPHAN_TIMEOUT;
+    _storeIsBuiltinMemory = false;
 }
 
 module.exports = {

package/framework/{v0.6.25 → v0.6.26}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina-framework",
-  "version": "0.6.25",
+  "version": "0.6.26",
   "dependencies": {
     "@rhinostone/busboy": "^1.6.1",
     "@rhinostone/swig": "^2.7.2",