gina 0.6.3 → 0.6.4

package/framework/{v0.6.3 → v0.6.4}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -9274,10 +9274,378 @@ if ( _isNode ) {
     });
 }
 ;
-define('gina/link', [ 'require', 'lib/domain', 'lib/merge', 'lib/uuid', 'utils/events' ], function (require) {
+
+/**
+ * This file is part of the gina package.
+ * Copyright (c) 2009-2026 Rhinostone <contact@gina.io>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+/**
+ * @module lib/loading-state
+ * @description Framework-owned loading state for submit-like triggers. Works in
+ * Node.js (CommonJS) and browser (AMD / GFF) contexts.
+ *
+ * A submit-like trigger — `<button type="submit">`, `<input type="submit">` or an
+ * `<a data-gina-form-submit>` — carries `data-gina-loading="true"` for exactly as
+ * long as the action it started is running, and `"false"` once that action
+ * completes OR is interrupted. Consumers style the running state with CSS.
+ *
+ * The module owns three things and no more: resolving the configured attribute
+ * NAME, writing the two values, and walking a click target up to the trigger that
+ * actually owns it. It holds NO state — the caller decides which element is armed
+ * and where to remember it, so the validator, popin and link plugins can share one
+ * implementation without sharing a registry.
+ *
+ * ## The `"false"` value is deliberate, and it constrains readers
+ *
+ * `disarm()` writes the STRING `"false"`; it does not remove the attribute. That
+ * diverges on purpose from the form-scoped `data-gina-form-loading`, which #B175
+ * changed from `setAttribute(..., false)` to `removeAttribute()` precisely because
+ * `"false"` is attribute-PRESENT and therefore truthy for a presence check.
+ *
+ * The consequence is a hard rule for every reader, in the framework and in
+ * consumer CSS alike: **match on the VALUE, never on presence**. Use
+ * `[data-gina-loading="true"]`, never a bare `[data-gina-loading]`, and in JS use
+ * {@link module:lib/loading-state~isArmed} rather than reading the attribute
+ * directly. A bare presence selector matches a disarmed trigger and pins the
+ * loading style on forever.
+ *
+ * ## Configuring the attribute name
+ *
+ * The name is read from `gina.config.loadingAttribute`, lazily, at every call —
+ * `gina.config` is populated after the bundle loads (via `setOptions`), so a value
+ * captured at module-definition time would be stale. A project already built on
+ * `data-loading` opts in with:
+ *
+ * ```html
+ * <script src="/js/vendor/gina/gina.min.js"
+ *         data-gina-config="{ loadingAttribute: 'data-loading' }"></script>
+ * ```
+ *
+ * or `gina.setOptions({ loadingAttribute: 'data-loading' })`. There is no
+ * auto-detection: a DOM probe reads nothing at rest (the attribute only exists
+ * while something is loading) and a stylesheet probe races late-loaded sheets and
+ * throws on cross-origin ones. Configuration is explicit by design.
+ *
+ * @example
+ * var loadingState = require('lib/loading-state');
+ *
+ * var $trigger = loadingState.resolveTrigger(event.target, $form);
+ * loadingState.arm($trigger);      // data-gina-loading="true"
+ * // ... the action runs, then settles, errors, times out or is rejected ...
+ * loadingState.disarm($trigger);   // data-gina-loading="false"
+ */
+
+/**
+ * Loading-state factory — returns the stateless API object.
+ * Exported as the module itself via `module.exports = LoadingState()`.
+ *
+ * @function LoadingState
+ * @returns {object} The `{ arm, disarm, isArmed, getAttributeName, resolveTrigger, DEFAULT_ATTRIBUTE }` API
+ *
+ * @memberof module:lib
+ * @author  Rhinostone <contact@gina.io>
+ * @api     Public
+ */
+function LoadingState() {
+
+    /**
+     * The attribute written when no `gina.config.loadingAttribute` override is set.
+     *
+     * @constant {string}
+     * @inner
+     */
+    var DEFAULT_ATTRIBUTE = 'data-gina-loading';
+
+    /**
+     * The value written by `arm()`.
+     *
+     * @constant {string}
+     * @inner
+     */
+    var ARMED = 'true';
+
+    /**
+     * The value written by `disarm()`. NOT `removeAttribute` — see the module
+     * description for why, and for the presence-check rule it imposes on readers.
+     *
+     * @constant {string}
+     * @inner
+     */
+    var DISARMED = 'false';
+
+    /**
+     * How many ancestors `resolveTrigger()` will climb before giving up. A submit
+     * trigger is a direct child of its form in every realistic markup, so this is a
+     * runaway guard rather than a real limit — a detached or cyclic node can not
+     * spin the loop.
+     *
+     * @constant {number}
+     * @inner
+     */
+    var MAX_DEPTH = 10;
+
+    /**
+     * isNode
+     *
+     * True when `$el` can carry attributes. Guards every public entry point so a
+     * `null`, a text node, a `window` or a plain object is a silent no-op rather
+     * than a thrown TypeError inside an event handler.
+     *
+     * @param {object} $el - candidate element
+     *
+     * @returns {boolean} true when `$el` exposes the attribute API
+     *
+     * @example
+     * isNode(document.querySelector('button')); // true
+     * isNode(null);                             // false
+     *
+     * @inner
+     */
+    var isNode = function($el) {
+        return !!(
+            $el
+            && typeof($el.setAttribute) == 'function'
+            && typeof($el.getAttribute) == 'function'
+        );
+    };
+
+    /**
+     * isSubmitTrigger
+     *
+     * True when `$el` is an element a user submits a form WITH. Mirrors the shapes
+     * the validator's click proxy already recognises: a `button`/`input` whose type
+     * is `submit`, or an anchor carrying `data-gina-form-submit`.
+     *
+     * @param {object} $el - candidate element
+     *
+     * @returns {boolean} true when `$el` is a submit-like trigger
+     *
+     * @example
+     * isSubmitTrigger($button); // true for <button type="submit">
+     * isSubmitTrigger($span);   // false
+     *
+     * @inner
+     */
+    var isSubmitTrigger = function($el) {
+        if ( !isNode($el) || !$el.tagName ) {
+            return false;
+        }
+        if ( /^(button|input)$/i.test($el.tagName) && /^submit$/i.test($el.type || '') ) {
+            return true;
+        }
+        if ( /^a$/i.test($el.tagName) && $el.getAttribute('data-gina-form-submit') != null ) {
+            return true;
+        }
+        return false;
+    };
+
+    /**
+     * getAttributeName
+     *
+     * Resolves the attribute name to write. Reads `gina.config.loadingAttribute`
+     * LAZILY on every call: `gina.config` is populated after the bundle loads, so a
+     * value captured once at definition time would always be the default. Falls
+     * back to `data-gina-loading` when unset, empty or not a string.
+     *
+     * @returns {string} the configured attribute name, or `data-gina-loading`
+     *
+     * @example
+     * getAttributeName();                                  // 'data-gina-loading'
+     * gina.setOptions({ loadingAttribute: 'data-loading' });
+     * getAttributeName();                                  // 'data-loading'
+     *
+     * @api Public
+     */
+    var getAttributeName = function() {
+        if (
+            typeof(gina) != 'undefined' && gina && gina.config
+            && typeof(gina.config.loadingAttribute) == 'string'
+            && gina.config.loadingAttribute !== ''
+        ) {
+            return gina.config.loadingAttribute;
+        }
+        return DEFAULT_ATTRIBUTE;
+    };
+
+    /**
+     * arm
+     *
+     * Marks `$el` as running by writing `<attribute>="true"`. Idempotent — arming an
+     * already-armed trigger rewrites the same value. A non-element is a no-op.
+     *
+     * @param {object} $el - the trigger to mark (see `resolveTrigger`)
+     *
+     * @returns {boolean} true when the attribute was written
+     *
+     * @example
+     * arm($button); // $button now carries data-gina-loading="true"
+     *
+     * @api Public
+     */
+    var arm = function($el) {
+        if ( !isNode($el) ) {
+            return false;
+        }
+        $el.setAttribute(getAttributeName(), ARMED);
+        return true;
+    };
+
+    /**
+     * disarm
+     *
+     * Releases `$el` by writing `<attribute>="false"`. Called on EVERY terminal
+     * outcome — settled, errored, timed out, aborted, rate-limited and
+     * validation-rejected — so a trigger can not stay visually loading after its
+     * action stopped. Idempotent; a non-element is a no-op.
+     *
+     * Writes `"false"` rather than removing the attribute; see the module
+     * description for the reasoning and the presence-check rule it imposes.
+     *
+     * @param {object} $el - the trigger to release
+     *
+     * @returns {boolean} true when the attribute was written
+     *
+     * @example
+     * disarm($button); // $button now carries data-gina-loading="false"
+     *
+     * @api Public
+     */
+    var disarm = function($el) {
+        if ( !isNode($el) ) {
+            return false;
+        }
+        $el.setAttribute(getAttributeName(), DISARMED);
+        return true;
+    };
+
+    /**
+     * isArmed
+     *
+     * True only when `$el` is currently marked as running. Compares the VALUE
+     * against `"true"` — never tests presence, because a disarmed trigger still
+     * carries the attribute with `"false"`. Use this instead of reading the
+     * attribute directly.
+     *
+     * @param {object} $el - the trigger to inspect
+     *
+     * @returns {boolean} true when `$el` carries `<attribute>="true"`
+     *
+     * @example
+     * arm($button);    isArmed($button); // true
+     * disarm($button); isArmed($button); // false — attribute present, value "false"
+     *
+     * @api Public
+     */
+    var isArmed = function($el) {
+        if ( !isNode($el) ) {
+            return false;
+        }
+        return $el.getAttribute(getAttributeName()) === ARMED;
+    };
+
+    /**
+     * resolveTrigger
+     *
+     * Walks `$el` up to the submit trigger that owns it, so the state lands on the
+     * control the user perceives as the button rather than on whatever inner node
+     * happened to receive the click. `<button type="submit"><span>Save</span></button>`
+     * clicked on the label yields the `button`, not the `span`.
+     *
+     * Returns `$el` itself when no submit-like ancestor is found, so a caller that
+     * already knows it is handling a submit still gets a usable element. Stops at
+     * the boundary element (typically the form), at `form`/`body`/`html`, or after
+     * `MAX_DEPTH` hops.
+     *
+     * ## Recognising a non-submit trigger (`isTrigger`)
+     *
+     * The default predicate recognises submit-like controls only — a `button` or
+     * `input` of type `submit`, or an `a[data-gina-form-submit]`. That is what the
+     * validator needs and nothing else. Other plugins arm elements this module has
+     * no business knowing about: link arms `a[data-gina-link]`, popin arms
+     * `a[data-gina-dialog]`. Pass `isTrigger` to say what counts as YOUR trigger.
+     *
+     * Without it the climb finds no match, breaks at `form`/`body`/`html`, and
+     * returns the ORIGINAL `$el` — so a click on the `<span>` inside
+     * `<a data-gina-link><span>Go</span></a>` would arm the span and leave the
+     * anchor unstyled.
+     *
+     * The predicate lives with the caller deliberately rather than being folded
+     * into the default: this module owns the WALK, each plugin owns its own notion
+     * of a trigger. Folding plugin attribute names in here would also couple the
+     * module to the popin deprecation/alias work, which changes which attributes
+     * are honoured over time.
+     *
+     * @param {object} $el - the clicked element (`event.target`)
+     * @param {object} [$boundary] - element to stop at, usually the `<form>`
+     * @param {function} [isTrigger] - `($node) => boolean`; defaults to the
+     *   submit-like predicate. Ignored when not a function. A predicate that
+     *   THROWS is deliberately not caught: every caller is framework code, so
+     *   swallowing would hide a framework bug behind a silently unarmed trigger.
+     *
+     * @returns {object} the owning trigger, or `$el`, or `null` when `$el` is not an element
+     *
+     * @example
+     * // <button type="submit"><span>Save</span></button>
+     * resolveTrigger(event.target, $form); // the <button>, even when the <span> was clicked
+     *
+     * @example
+     * // <a data-gina-link><span>Go</span></a> — the span was clicked
+     * resolveTrigger(event.target, null, function($n) {
+     *     return /^a$/i.test($n.tagName) && $n.getAttribute('data-gina-link') != null;
+     * }); // the <a>, not the <span>
+     *
+     * @api Public
+     */
+    var resolveTrigger = function($el, $boundary, isTrigger) {
+        if ( !isNode($el) ) {
+            return null;
+        }
+        var matches = ( typeof(isTrigger) == 'function' ) ? isTrigger : isSubmitTrigger;
+        var $node = $el;
+        var depth = 0;
+        while ( isNode($node) && depth < MAX_DEPTH ) {
+            if ( matches($node) ) {
+                return $node;
+            }
+            if ( $boundary && $node === $boundary ) {
+                break;
+            }
+            if ( $node.tagName && /^(form|body|html)$/i.test($node.tagName) ) {
+                break;
+            }
+            $node = $node.parentNode;
+            ++depth;
+        }
+        return $el;
+    };
+
+    return {
+        'DEFAULT_ATTRIBUTE' : DEFAULT_ATTRIBUTE,
+        'getAttributeName'  : getAttributeName,
+        'arm'               : arm,
+        'disarm'            : disarm,
+        'isArmed'           : isArmed,
+        'resolveTrigger'    : resolveTrigger
+    };
+}
+
+if ( ( typeof(module) !== 'undefined' ) && module.exports ) {
+    // Publish as node.js module
+    module.exports = LoadingState()
+} else if ( typeof(define) === 'function' && define.amd) {
+    // Publish as AMD module
+    define('lib/loading-state', [],function() { return LoadingState() })
+}
+;
+define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge', 'lib/uuid', 'utils/events' ], function (require) {
 
     var Domain          = require('lib/domain');
     var domainInstance  = null;
+    var loadingState    = require('lib/loading-state');
     var merge           = require('lib/merge');
     var uuid            = require('lib/uuid');
 
@@ -9333,8 +9701,52 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/merge', 'lib/uuid', 'utils/e
 
 
 
-        // XML Request
-        var xhr = null;
+        // XML Request — the request currently in flight, plus a monotonic sequence.
+        //
+        // These replace a single module-scope `xhr` that every link click reused.
+        // That is the #B175 class popin already fixed and nav deliberately avoids:
+        // calling `open()` on an object that is still carrying a request implicitly
+        // ABORTS it, and an aborted request reaches readyState 4 with status 0 —
+        // which `handleXhr` has no branch for. So the first click's completion never
+        // arrived at all, and anything waiting on it waited forever.
+        //
+        // The sequence exists because aborting is not enough on its own: the
+        // superseded request may already have reached readyState 4 and queued its
+        // handler. `_linkSeq` lets that stale response be dropped rather than acted
+        // upon, so a slow first response can never overwrite a newer one.
+        var _linkXhr = null;
+        var _linkSeq = 0;
+
+        /**
+         * Build a fresh transport for a single request.
+         *
+         * Was inlined in the `init` handler, which created ONE object for the whole
+         * page lifetime. Per-request construction is what makes concurrent link
+         * clicks independent.
+         *
+         * @returns {object} a new XHR-like object, or `null` when the browser has none
+         *
+         * @example
+         * var xhr = createXhr(); // fresh per request — never shared
+         *
+         * @inner
+         */
+        var createXhr = function() {
+            if (window.XMLHttpRequest) { // Mozilla, Safari, ...
+                return new XMLHttpRequest();
+            }
+            if (window.ActiveXObject) { // IE
+                try {
+                    return new ActiveXObject("Msxml2.XMLHTTP");
+                } catch (e) {
+                    try {
+                        return new ActiveXObject("Microsoft.XMLHTTP");
+                    }
+                    catch (e) {}
+                }
+            }
+            return null;
+        };
 
         /**
          * XML Request options
@@ -9386,11 +9798,42 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/merge', 'lib/uuid', 'utils/e
         /**
          * linkRequest
          *
-         * @param {string} url
-         * @param {object} [options]
+         * Builds and sends the request for a bound link. Every entry point funnels
+         * through here — the direct click, the `proxyClick` child delegation and the
+         * public `gina.link.request()` — which is why the loading state is armed here
+         * rather than in the click handlers: `$el` is already the anchor at this point,
+         * so no click target ever has to be walked back up to it.
+         *
+         * Side effects: supersedes any request still in flight, arms `data-gina-loading`
+         * on the anchor for the duration of this one, and releases it from a `loadend`
+         * listener. An indefinite hang is the single outcome that never releases, because
+         * no `xhr.timeout` is set.
+         *
+         * @param {string} url - URL to request
+         * @param {object} [options] - XHR options, merged over the link's own
+         *
+         * @returns {void}
+         *
+         * @example
+         * gina.link.request('/some/route'); // arms the bound anchor, releases on loadend
+         *
+         * @inner
          * */
         function linkRequest(url, options) {
 
+            // One transport per request, and a sequence taken BEFORE the abort so a
+            // supersede-abort is stale by construction — its handler sees
+            // `seq !== _linkSeq` and drops out, which is what keeps the abort from
+            // being mistaken for a real network failure.
+            var seq = ++_linkSeq;
+            if ( _linkXhr && _linkXhr.readyState !== 4 ) {
+                try {
+                    _linkXhr.abort();
+                } catch (abortErr) { /* already dead — nothing to unwind */ }
+            }
+            var xhr = createXhr();
+            _linkXhr = xhr;
+
             // link object
             var $link      = getLinkByUrl(url);
             var id         = $link.id;
@@ -9489,10 +9932,83 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/merge', 'lib/uuid', 'utils/e
 
 
             options.$link = $link;
+            // The CORS branches above can swap the transport (XDomainRequest) or drop
+            // it entirely, so re-point the in-flight tracker at whatever will actually run.
+            _linkXhr = xhr;
             //xhr = handleXhr(xhr, $el, options);
             handleXhr(xhr, $el, options, require);
+
+            // Sequence guard, applied by WRAPPING the handler `handleXhr` just installed
+            // rather than by teaching `handleXhr` about link's sequence. `handleXhr` is
+            // shared and the sequence belongs to the plugin that owns the clicks, so the
+            // guard lives here and `utils/events.js` stays untouched.
+            //
+            // Only `onreadystatechange` needs wrapping: an aborted request fires
+            // `onabort` (which `handleXhr` does not install), never `onerror`, so a
+            // superseded request has exactly one way back into the completion path.
+            var onSettled = xhr.onreadystatechange;
+            xhr.onreadystatechange = function(event) {
+                if ( seq !== _linkSeq ) {
+                    return; // superseded by a newer click — drop the stale response
+                }
+                if ( typeof(onSettled) == 'function' ) {
+                    onSettled.call(this, event);
+                }
+            };
+
+            // #B247 — loading state for the link the user actually clicked.
+            //
+            // Armed HERE rather than in the click handlers because `$el` is already the
+            // anchor at this point (`getElementById($link.id)` above), and because this
+            // is the one funnel every entry reaches: the direct click, the `proxyClick`
+            // child delegation — which dispatches its custom event ON the anchor, so the
+            // handler's `e.target` is never the inner node — and the public
+            // `gina.link.request()`. Arming below the `!xhr` throw also means a transport
+            // that never materialises can not leave a trigger lit.
+            //
+            // Released on `loadend`, the same fail-safe the validator uses: a LISTENER
+            // emits no events of its own, so it covers success, error, abort AND the
+            // readyState-4/status-0 network failure `handleXhr` has no branch for —
+            // without any of the consumer-visible surface that adding such a branch
+            // would carry (#B282). One listener per transport, and transports are built
+            // per request, so nothing accumulates.
+            //
+            // Never arm what can not be released: the CORS branch above can swap in a
+            // legacy `XDomainRequest`, which has no `addEventListener` and so no
+            // `loadend` to release on. An armed trigger with no release is exactly the
+            // permanent strand this feature exists to prevent.
+            //
+            // Deliberately NOT sequence-guarded, unlike the response wrapper above. The
+            // sequence drops a stale RESPONSE; a superseded request must still RELEASE
+            // its trigger. It releases before the newer click arms, because `abort()`
+            // fires `loadend` synchronously — inside the abort at the top of this
+            // function, which runs before this line. Guarding here would strand the
+            // trigger it was meant to protect.
+            //
+            // Residual: a request that never terminates never fires `loadend`, so an
+            // indefinite hang still strands the trigger. That is #B283 (no `xhr.timeout`
+            // is set, which is also why the `ontimeout` handleXhr installs is dead code)
+            // — a separate, consumer-visible behaviour change, NOT covered here.
+            if ( typeof(xhr.addEventListener) == 'function' ) {
+                loadingState.arm($el);
+                xhr.addEventListener('loadend', function onLinkSettled() {
+                    loadingState.disarm($el);
+                });
+            }
+
             // sending
-            xhr.send();
+            try {
+                xhr.send();
+            } catch (sendErr) {
+                // A synchronous throw out of `send()` (a cross-origin synchronous
+                // request, a transport already in an invalid state) means no request ran,
+                // so no `loadend` is ever coming. Release, then let the error out
+                // unchanged — the caller's contract is untouched.
+                if ( loadingState.isArmed($el) ) {
+                    loadingState.disarm($el);
+                }
+                throw sendErr;
+            }
         }
 
         function registerLink($link, options) {
@@ -9661,19 +10177,10 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/merge', 'lib/uuid', 'utils/e
             setupInstanceProto();
             instance.on('init', function(event) {
 
-                // setting up AJAX
-                if (window.XMLHttpRequest) { // Mozilla, Safari, ...
-                    xhr = new XMLHttpRequest();
-                } else if (window.ActiveXObject) { // IE
-                    try {
-                        xhr = new ActiveXObject("Msxml2.XMLHTTP");
-                    } catch (e) {
-                        try {
-                            xhr = new ActiveXObject("Microsoft.XMLHTTP");
-                        }
-                        catch (e) {}
-                    }
-                }
+                // AJAX setup used to happen HERE, building one transport for the whole
+                // page lifetime. It moved to `createXhr()`, called per request from
+                // `linkRequest`, so two link clicks no longer share one object — see the
+                // `_linkXhr` / `_linkSeq` comment at the top of this closure.
 
                 // proxies
                 // click on main document
@@ -10321,6 +10828,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
     var FormValidator   = (isGFFCtx) ? require('lib/form-validator') : require('./form-validator');
     //var Collection      = (isGFFCtx) ? require('lib/collection') : require('../../../../../lib/collection');
     var routing         = (isGFFCtx) ? require('lib/routing') : require('../../../../../lib/routing');
+    var loadingState    = (isGFFCtx) ? require('lib/loading-state') : require('../../../../../lib/loading-state');
 
 
     /** definitions */
@@ -11005,9 +11513,14 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 if (isErrorMessageHidden) {
                     // hide error messages
                     $children[c].className = $children[c].className +' hidden';
+                    // #A11Y5 — this hide fires when the field regains focus, and it does not
+                    // touch aria-invalid: a committed error stays asserted while its message
+                    // would otherwise leave the a11y tree. Clip it instead.
+                    clipErrorMessage($children[c]);
                 } else {
                     // display error messages
                     $children[c].className = $children[c].className.replace(/(\s+hidden|hidden)/, '');
+                    revealErrorMessage($children[c]);
                 }
                 break
             }
@@ -11015,17 +11528,38 @@ function ValidatorPlugin(rules, data, formId, culture) {
     }
 
     /**
-     * #A11Y1 (slice 4) — lazily create one visually-hidden aria-live="polite" status region per
-     * form and announce a blur-time committed error through it. A CSS :user-invalid display toggle
-     * is not reliably announced by screen readers, and on blur the field has lost focus so its own
-     * aria-invalid / aria-errormessage are not re-read; the polite region decouples the announcement
-     * from visual display. Submit-time errors use focus (see onValidate), not this region.
+     * #A11Y2 — create (or recover) a form's visually-hidden polite status region WITHOUT
+     * writing to it. Split out of announceA11yError so the region can exist LONG before the
+     * first error: a region that is inserted and populated in the same tick reaches assistive
+     * tech as a single mutation batch, which is commonly never spoken, so the very first
+     * announcement per form — the one that matters most — was the one most likely lost.
+     * bindForm calls this at bind time, which is what makes that first error audible.
+     *
+     * The region is a CHILD OF THE FORM deliberately. A popin renders its form inside a native
+     * `<dialog>` opened with showModal(), which leaves everything outside the top layer inert;
+     * a body-level region would sit in that inert subtree and go unspoken for exactly the forms
+     * that live in popins. Keeping it inside the form keeps it inside the dialog. The price is
+     * that a subtree replacement (a popin re-render's `innerHTML =`, or a nav fragment swap)
+     * destroys it — hence create-OR-RECOVER, and hence the deferred first write in
+     * announceA11yError, which is what stops a recovery from silently repeating the defect.
+     *
+     * The bookkeeping flag lives on the element rather than in a module-scope map so it dies
+     * WITH the region: a destroyed region leaves no stale entry behind, and no form id keeps
+     * an unbounded map alive. Browser-only, like readCsrfCookie — this engine is shared with
+     * the server form-body path, which has no document.
+     *
+     * @inner
      * @param {object} $form - the HTMLFormElement the region belongs to
-     * @param {string} text - the error text to announce
-     * @returns {object|null} the live-region element, or null when nothing was announced
+     * @returns {object|null} the live-region element, or null outside a browser document
+     * @example
+     * // at bind time: the region is in the a11y tree before any error can occur
+     * ensureA11yLiveRegion($form.target);
      */
-    var announceA11yError = function($form, text) {
-        if ( !$form || !text ) return null;
+    var ensureA11yLiveRegion = function($form) {
+        if ( !$form ) return null;
+        if ( typeof(document) === 'undefined' || !document || typeof(document.getElementById) !== 'function' ) {
+            return null;
+        }
         var _fid    = ( typeof($form.id) != 'undefined' && $form.id ) ? $form.id : ( $form.getAttribute('id') || 'form' );
         var _liveId = 'gina-aria-live-' + _fid;
         var _live   = document.getElementById(_liveId);
@@ -11037,33 +11571,253 @@ function ValidatorPlugin(rules, data, formId, culture) {
             _live.setAttribute('aria-atomic', 'true');
             _live.className = 'gina-visually-hidden';
             _live.style.cssText = 'position:absolute;width:1px;height:1px;margin:-1px;padding:0;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap;border:0;';
+            _live.ginaA11yFresh = true;
+            $form.appendChild(_live);
+        } else if ( _live.parentNode !== $form ) {
+            // Same id, different form node — a re-render replaced the form, or two forms share
+            // an id. Re-home it so the region always sits inside the form that announces, which
+            // is the property the inert reasoning above depends on; a move is a fresh insertion.
+            _live.ginaA11yFresh = true;
             $form.appendChild(_live);
         }
-        _live.textContent = text;
-        return _live;
+        return _live;
+    };
+
+    /**
+     * #A11Y1 (slice 4) — announce a blur-time committed error through the region created at
+     * bind time. A CSS :user-invalid display toggle is not reliably announced by screen
+     * readers, and on blur the field has lost focus so its own aria-invalid /
+     * aria-errormessage are not re-read; the polite region decouples the announcement
+     * from visual display. Submit-time errors use focus (see onValidate), not this region.
+     *
+     * #A11Y2 — when the region had to be created (or re-homed) HERE rather than at bind time,
+     * the insertion and this write would land in the same tick and likely never be spoken, so
+     * that first write is deferred by one macrotask. Only the fresh case defers; an already
+     * bound region writes synchronously, exactly as before. While a deferred write is pending
+     * a later call replaces the pending text, so the LATEST error wins and a stale first
+     * message can never land on top of it. The timer re-enters this function, which then takes
+     * the synchronous branch — keeping exactly ONE textContent write site.
+     *
+     * @param {object} $form - the HTMLFormElement the region belongs to
+     * @param {string} text - the error text to announce
+     * @returns {object|null} the live-region element, or null when nothing was announced
+     * @example
+     * announceA11yError($form, 'This field is required');
+     */
+    var announceA11yError = function($form, text) {
+        if ( !$form || !text ) return null;
+        var _live = ensureA11yLiveRegion($form);
+        if ( !_live ) return null;
+        if ( _live.ginaA11yFresh ) {
+            _live.ginaA11yPending = text;
+            if ( !_live.ginaA11yTimer ) {
+                _live.ginaA11yTimer = setTimeout(function() {
+                    _live.ginaA11yTimer = null;
+                    _live.ginaA11yFresh = false;
+                    announceA11yError($form, _live.ginaA11yPending);
+                }, 0);
+            }
+            return _live;
+        }
+        text = a11yDistinctText(_live, text);
+        _live.textContent = text;
+        return _live;
+    };
+
+    /**
+     * #B178 — announcement text for a field's error container.
+     * The container renders one `<p>` per rule message; visually they stack as
+     * blocks, but `textContent` concatenates them with NO separator, so an
+     * aria-live announcement read multiple messages as one run-on string.
+     * Joins the per-message texts with '. ' instead; falls back to the raw
+     * `textContent` when the container has no `<p>` children.
+     * @inner
+     * @param {object} $err - the error-message container element
+     * @returns {string} announcement text
+     */
+    var getA11yAnnounceText = function($err) {
+        var $msgs = $err.getElementsByTagName('p');
+        if ( !$msgs.length ) {
+            return $err.textContent;
+        }
+        var parts = [];
+        for (var m = 0, mLen = $msgs.length; m < mLen; ++m) {
+            parts.push($msgs[m].textContent);
+        }
+        return parts.join('. ');
+    };
+
+    /**
+     * A11Y_LABELS — English defaults for gina's own accessibility status strings.
+     *
+     * Deliberately separate from `setErrorLabels`, which owns per-culture overrides
+     * for *rule* error labels and is keyed by rule name. These are framework-authored
+     * announcements about what gina is doing, so they need a home of their own.
+     *
+     * `%s` in a value is replaced with a runtime detail (currently the file name);
+     * it follows the same placeholder convention the rule error labels already use,
+     * so a translation keeps control of where the detail lands in the sentence.
+     *
+     * @constant {object}
+     * @inner
+     */
+    var A11Y_LABELS = {
+        submitting      : 'Submitting…',
+        // #A11Y7/U2 — staged uploads announce only their TRANSITIONS (start and
+        // success), never per-tick progress: `aria-live="polite"` coalesces but does
+        // not throttle, and one announcement per onprogress event would bury every
+        // other message on the page. There is deliberately NO `uploadError` key —
+        // the error path announces the server's own message instead (#A11Y7/U3), and
+        // a generic second write in the same beat would clobber it (see the rationale
+        // on `releaseSubmitA11y`).
+        uploadStarted   : 'Upload started',
+        uploadComplete  : 'Upload complete',
+        // #A11Y7/U5 — spoken when a staged file's reset/delete control removes it.
+        fileRemoved     : '%s removed'
+    };
+
+    /**
+     * a11yLabel — resolve one accessibility status string.
+     *
+     * Follows the same philosophy `setErrorLabels` documents: an English default
+     * ships inline and fills anything the project does not translate. A project
+     * overrides by assigning `gina.config.a11y`, typically once at boot keyed off
+     * the negotiated culture.
+     *
+     * @param   {string} key - Label key, e.g. `submitting`.
+     * @returns {string} the project's override when it supplies a non-empty string,
+     *                   otherwise the English default (empty string for unknown keys).
+     *
+     * @example
+     * // project side, once at boot:
+     * gina.config.a11y = { submitting: 'Envoi…' };
+     *
+     * @inner
+     */
+    var a11yLabel = function(key) {
+        var _over = ( typeof(gina) != 'undefined' && gina && gina.config && gina.config.a11y )
+            ? gina.config.a11y
+            : null;
+        if ( _over && typeof(_over[key]) == 'string' && _over[key] ) {
+            return _over[key];
+        }
+        return A11Y_LABELS[key] || '';
+    };
+
+    /**
+     * announceA11yStatus — announce a non-error status through the form's region.
+     *
+     * The region #A11Y2 stands up at bind time is `role="status" aria-live="polite"`,
+     * i.e. already a status channel rather than an error-only one — so submit progress
+     * rides that same element instead of a second region competing with it. Kept as a
+     * named delegate purely so call sites read as status, not as errors.
+     *
+     * @param   {object} $form - form target (HTMLFormElement), not the form instance.
+     * @param   {string} text  - resolved, human-readable status text.
+     * @returns {object|null} the live region, or null when it could not be resolved.
+     *
+     * @example
+     * announceA11yStatus($myForm, 'Envoi…');
+     *
+     * @inner
+     */
+    var announceA11yStatus = function($form, text) {
+        return announceA11yError($form, text);
+    };
+
+    /**
+     * a11yDistinctText — make a repeated announcement observably new.
+     *
+     * An `aria-live="polite"` region is announced when its content CHANGES, so re-writing
+     * byte-identical text is commonly not spoken at all. That is the normal case for a
+     * validation message: blurring a field that still fails the same rule produces exactly
+     * the same string, and the user heard nothing the second time. Appending a no-break
+     * space makes the node's content differ while leaving what is read out unchanged, and
+     * it self-cancels — the next identical announcement compares against the suffixed text,
+     * differs, and writes the clean string again.
+     *
+     * Lives outside `announceA11yError` deliberately: that function sits inside a fixed
+     * character window asserted by a source pin, and the rationale above does not fit in it.
+     *
+     * ⚠️ Unverified: that a screen reader actually re-announces as a result. The string
+     * demonstrably changes; no assistive-technology pass has been run to confirm the effect.
+     *
+     * @param   {object} $live - the live region node.
+     * @param   {string} text  - the announcement about to be written.
+     * @returns {string} `text`, suffixed only when it would otherwise be a no-op write.
+     *
+     * @example
+     * var next = a11yDistinctText($region, 'This field is required');
+     *
+     * @inner
+     */
+    var a11yDistinctText = function($live, text) {
+        if ( !$live || typeof(text) != 'string' ) {
+            return text;
+        }
+        return ( $live.textContent === text ) ? text + ' ' : text;
+    };
+
+    /**
+     * ERR_MSG_CLIP — inline declarations that hide an element from VIEW while leaving it
+     * in the accessibility tree.
+     *
+     * `display` carries `!important` because gina's own `.hidden` helper is
+     * `display: none !important`, and an inline `!important` is what outranks it (measured:
+     * a plain inline `display:block` loses to it). The class is deliberately left in place
+     * so consumer CSS keyed on `.hidden` keeps matching.
+     *
+     * @constant {string}
+     * @inner
+     */
+    var ERR_MSG_CLIP = 'display:block !important;position:absolute;width:1px;height:1px;'
+        + 'margin:-1px;padding:0;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap;border:0;';
+
+    /**
+     * clipErrorMessage — hide a validation message visually, but keep it reachable.
+     *
+     * `.hidden` is `display: none !important`, which removes the node from the
+     * accessibility tree outright. That is the wrong tool wherever `aria-invalid="true"`
+     * stays asserted on the field, because the `aria-errormessage` association then points
+     * assistive tech at a target it cannot resolve — the field is announced invalid with no
+     * retrievable reason. Both hide paths that can coexist with an asserted `aria-invalid`
+     * (the focus-driven hide in `refreshWarning`, and the refresh re-create) clip instead.
+     *
+     * gina creates and owns this element, so replacing `style.cssText` wholesale is safe.
+     *
+     * @param   {object} $err - the `form-item-error-message` element.
+     * @returns {boolean} true when the clip was applied.
+     *
+     * @example
+     * clipErrorMessage($someMessageDiv);
+     *
+     * @inner
+     */
+    var clipErrorMessage = function($err) {
+        if ( !$err || typeof($err.style) == 'undefined' || !$err.style ) {
+            return false;
+        }
+        $err.style.cssText = ERR_MSG_CLIP;
+        return true;
     };
 
     /**
-     * #B178 — announcement text for a field's error container.
-     * The container renders one `<p>` per rule message; visually they stack as
-     * blocks, but `textContent` concatenates them with NO separator, so an
-     * aria-live announcement read multiple messages as one run-on string.
-     * Joins the per-message texts with '. ' instead; falls back to the raw
-     * `textContent` when the container has no `<p>` children.
+     * revealErrorMessage — undo `clipErrorMessage`, restoring normal visual flow.
+     *
+     * @param   {object} $err - the `form-item-error-message` element.
+     * @returns {boolean} true when the clip was cleared.
+     *
+     * @example
+     * revealErrorMessage($someMessageDiv);
+     *
      * @inner
-     * @param {object} $err - the error-message container element
-     * @returns {string} announcement text
      */
-    var getA11yAnnounceText = function($err) {
-        var $msgs = $err.getElementsByTagName('p');
-        if ( !$msgs.length ) {
-            return $err.textContent;
-        }
-        var parts = [];
-        for (var m = 0, mLen = $msgs.length; m < mLen; ++m) {
-            parts.push($msgs[m].textContent);
+    var revealErrorMessage = function($err) {
+        if ( !$err || typeof($err.style) == 'undefined' || !$err.style ) {
+            return false;
         }
-        return parts.join('. ');
+        $err.style.cssText = '';
+        return true;
     };
 
     /**
@@ -11361,6 +12115,14 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         // global pass, so without this focus guard it re-shows the message mid-typing.
                         // On blur (field no longer active) the message is created shown (focusout commits).
                         $err.setAttribute('class', ( document.activeElement && document.activeElement.name == name ) ? 'form-item-error-message hidden' : 'form-item-error-message');
+                        // #A11Y5 — the branch below re-asserts aria-invalid="true" on this same
+                        // field, so when the message is hidden it must stay resolvable: clip it
+                        // out of view rather than out of the accessibility tree. Reads the class
+                        // just written instead of re-deriving the condition, so the ternary above
+                        // stays exactly as pinned.
+                        if ( /hidden/.test($err.className) ) {
+                            clipErrorMessage($err);
+                        }
 
                         // #A11Y1 (slice 2) — preserve the aria-errormessage wire we own across refresh.
                         if ( _ginaOwnsErrMsg && _ariaErrId ) {
@@ -11690,6 +12452,231 @@ function ValidatorPlugin(rules, data, formId, culture) {
     }
 
 
+    /**
+     * armSubmitLoading
+     *
+     * Marks `$trigger` as running (`data-gina-loading="true"`, or whatever
+     * `gina.config.loadingAttribute` names) and remembers it on the form instance so
+     * every terminal path can release it — including the ones that never reach an
+     * XHR and therefore have no `$submitTrigger` of their own in scope.
+     *
+     * The element is stashed rather than re-derived because the two are NOT always
+     * the same: `send()` resolves `$submitTrigger` once from `$form.submitTrigger`
+     * (an id) at its own entry, which a rejected submit never reaches, and which a
+     * second click on a different button would have overwritten by then. The stash
+     * is a single reference per form, replaced on each arm and nulled on disarm, so
+     * it can not retain a detached node past the submit that created it.
+     *
+     * @param {object} $formInstance - the form instance (`instance.$forms[id]`)
+     * @param {object} $trigger - the element the user operated
+     *
+     * @returns {boolean} true when the trigger was marked
+     *
+     * FIRST ARM WINS until the state is released. A form runs one submit at a time — that
+     * is what `withRateLimit` enforces — so a second attempt arriving mid-flight is about
+     * to be refused, and must not take ownership: on a form with several submit buttons it
+     * would move the stash to the refused trigger, leaving the trigger that actually owns
+     * the request armed with nothing left to release it.
+     *
+     * @example
+     * armSubmitLoading(instance.$forms[$form.id], loadingState.resolveTrigger($el, $target));
+     *
+     * @inner
+     */
+    var armSubmitLoading = function($formInstance, $trigger) {
+        if ( !$formInstance || !$trigger ) {
+            return false;
+        }
+        if ($formInstance.loadingTrigger) {
+            return false;
+        }
+        $formInstance.loadingTrigger = $trigger;
+        return loadingState.arm($trigger);
+    };
+
+    /**
+     * disarmSubmitLoading
+     *
+     * Releases whatever `armSubmitLoading` marked for this form
+     * (`data-gina-loading="false"`) and drops the stash. Idempotent and safe to call
+     * on a form that was never armed — every terminal path calls it unconditionally
+     * rather than trying to work out whether arming happened.
+     *
+     * #B247: the validation-rejected path is the one that stranded consumer loading
+     * state, because a rejected submit sends nothing and so never reaches any XHR
+     * settle. `send()`'s rate-limit early return is the same shape and is covered
+     * too; `loadend` covers success, error, timeout and abort alike.
+     *
+     * @param {object} $formInstance - the form instance (`instance.$forms[id]`)
+     *
+     * @returns {boolean} true when a marked trigger was released
+     *
+     * @example
+     * disarmSubmitLoading(instance.$forms[_id]); // on reject, settle, timeout or abort
+     *
+     * @inner
+     */
+    var disarmSubmitLoading = function($formInstance) {
+        if ( !$formInstance || !$formInstance.loadingTrigger ) {
+            return false;
+        }
+        var released = loadingState.disarm($formInstance.loadingTrigger);
+        $formInstance.loadingTrigger = null;
+        return released;
+    };
+
+    /**
+     * holdTriggerFocus — remember the submit trigger gina is about to blur.
+     *
+     * A natively `disabled` control cannot hold focus: the instant gina disables an
+     * in-flight submit trigger the browser moves focus to `<body>`, and re-enabling
+     * does not bring it back (both measured). Every keyboard submit therefore loses
+     * the user's place. Only the native-`disabled` branch is recorded — an `<a>`
+     * receives `aria-disabled`, which does not blur (measured), so it needs no restore.
+     *
+     * @param   {object} $form    - the form instance, which carries the stash.
+     * @param   {object} $trigger - resolved submit trigger; may be null.
+     * @returns {boolean} true when focus was captured for a later restore.
+     *
+     * @example
+     * holdTriggerFocus($myFormInstance, $mySaveButton);
+     *
+     * @inner
+     */
+    var holdTriggerFocus = function($form, $trigger) {
+        if ( !$form || !$trigger ) {
+            return false;
+        }
+        if ( typeof(document) === 'undefined' || !document ) {
+            return false;
+        }
+        if ( document.activeElement !== $trigger ) {
+            return false;
+        }
+        $form.ginaA11yFocusReturn = $trigger;
+        return true;
+    };
+
+    /**
+     * releaseTriggerFocus — put focus back on the trigger gina blurred.
+     *
+     * Deliberately conservative: it restores ONLY when focus is still exactly where
+     * the disable dropped it (`<body>`) and the trigger is still in the document. If
+     * anything else claimed focus while the request was in flight — a popin opened, a
+     * redirect ran, the failed-submit branch moved focus to the first invalid field —
+     * that decision wins and gina undoes nothing. gina restores what gina took, never
+     * more.
+     *
+     * @param   {object} $form - the form instance holding the stash.
+     * @returns {boolean} true when focus was actually restored.
+     *
+     * @example
+     * releaseTriggerFocus($myFormInstance);
+     *
+     * @inner
+     */
+    var releaseTriggerFocus = function($form) {
+        if ( !$form || !$form.ginaA11yFocusReturn ) {
+            return false;
+        }
+        var $trigger = $form.ginaA11yFocusReturn;
+        $form.ginaA11yFocusReturn = null;
+        if ( typeof(document) === 'undefined' || !document ) {
+            return false;
+        }
+        // Nothing else may have claimed focus in the meantime.
+        if ( document.activeElement && document.activeElement !== document.body ) {
+            return false;
+        }
+        var _stillThere = ( typeof($trigger.isConnected) == 'boolean' )
+            ? $trigger.isConnected
+            : ( document.body && document.body.contains($trigger) );
+        if ( !_stillThere || typeof($trigger.focus) != 'function' ) {
+            return false;
+        }
+        $trigger.focus();
+        return true;
+    };
+
+    /**
+     * armSubmitA11y — expose an in-flight submit to assistive technology.
+     *
+     * Three things at once, all scoped to the request window: capture the trigger's
+     * focus before the caller's native disable blurs it, mark the trigger busy, and
+     * announce the start once through the form's polite region.
+     *
+     * Two placement decisions worth keeping:
+     * - `aria-busy` goes on the TRIGGER, never the form. The live region lives inside
+     *   the form, and an ancestor marked busy MAY be treated as "defer announcements in
+     *   this subtree", which would silence the very region used to announce. ARIA 1.2
+     *   defines no normative behaviour here, so this is a cheap hedge, not a spec
+     *   requirement — and it is explicitly NOT a claim about what implementations do:
+     *   measured 2026-08-05 on VoiceOver/Chrome, an announcement from inside an
+     *   `aria-busy="true"` ancestor WAS spoken, so at least that pairing does not defer.
+     *   The placement costs nothing and still guards ATs that might; do not restate it
+     *   as "assistive tech commonly defers" — that wording was wrong and was corrected.
+     * - This window is only ever reached once a request is genuinely in flight, so a
+     *   validation-rejected submit never arms and never announces. That is what keeps
+     *   the arm-before-validate loading state from producing a busy/not-busy flap.
+     *
+     * @param   {object} $form    - the form instance.
+     * @param   {object} $trigger - resolved submit trigger; may be null.
+     * @returns {boolean} true when this call produced the announcement.
+     *
+     * @example
+     * armSubmitA11y($myFormInstance, $mySaveButton);
+     *
+     * @inner
+     */
+    var armSubmitA11y = function($form, $trigger) {
+        if ( !$form ) {
+            return false;
+        }
+        if ($trigger) {
+            if ( !/^A$/i.test($trigger.tagName) ) {
+                holdTriggerFocus($form, $trigger);
+            }
+            $trigger.setAttribute('aria-busy', 'true');
+        }
+        // readyState 1 and 3 both reach here; announce once per request.
+        if ( $form.ginaA11yBusy ) {
+            return false;
+        }
+        $form.ginaA11yBusy = true;
+        if ( $form.target ) {
+            announceA11yStatus($form.target, a11yLabel('submitting'));
+        }
+        return true;
+    };
+
+    /**
+     * releaseSubmitA11y — clear the in-flight submit exposure.
+     *
+     * Idempotent, because both the readyState-4 release and the `loadend` fail-safe
+     * run it. Deliberately announces nothing on completion: an errored response is
+     * already announced field-by-field by `handleErrorsDisplay`, and writing a second
+     * status over a polite region in the same beat can cut that announcement off.
+     *
+     * @param   {object} $form    - the form instance.
+     * @param   {object} $trigger - resolved submit trigger; may be null.
+     * @returns {boolean} true when focus was restored to the trigger.
+     *
+     * @example
+     * releaseSubmitA11y($myFormInstance, $mySaveButton);
+     *
+     * @inner
+     */
+    var releaseSubmitA11y = function($form, $trigger) {
+        if ( !$form ) {
+            return false;
+        }
+        if ($trigger) {
+            $trigger.removeAttribute('aria-busy');
+        }
+        $form.ginaA11yBusy = false;
+        return releaseTriggerFocus($form);
+    };
+
     /**
      * send
      * N.B.: no validation here; if you want to validate against rules, use `.submit()` or `.validateFormById(formId)` before
@@ -11724,6 +12711,11 @@ function ValidatorPlugin(rules, data, formId, culture) {
             && typeof($form.sent) != 'undefined'
             && /^true$/i.test($form.sent)
         ) {
+            // #B247 — deliberately NO loading-state release here. This return means a
+            // request for this form is already in flight, so the trigger that owns it is
+            // still legitimately loading and its own settle will release it. Releasing
+            // here would clear the state mid-request; and because `armSubmitLoading` is
+            // first-wins, the refused attempt never armed anything of its own to clear.
             return;
         }
 
@@ -11879,12 +12871,20 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         }
                     }
                     $form.target.removeAttribute('data-gina-form-loading');
+                    // #B247 — the trigger-scoped release rides the same fail-safe:
+                    // `loadend` is the one hook that covers abort and error too.
+                    disarmSubmitLoading($form);
+                    // #A11Y4 — last, so focus lands on a trigger that is fully settled:
+                    // re-enabled above and no longer flagged loading.
+                    releaseSubmitA11y($form, $submitTrigger);
                 });
             }
             // catching ready state cb
             // Data loading ...
             if ( /^(1|3)$/.test(xhr.readyState) ) {
                 $form.target.setAttribute('data-gina-form-loading', true);
+                // #A11Y4 — must run BEFORE the native disable below, which blurs the trigger.
+                armSubmitA11y($form, $submitTrigger);
                 if ($submitTrigger) {
                     // For A tag: aria-disabled=true
                     if ( /^A$/i.test($submitTrigger.tagName) ) {
@@ -11913,6 +12913,8 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 // Data loading ...
                 if ( /^(1|3)$/.test(xhr.readyState) ) {
                     $form.target.setAttribute('data-gina-form-loading', true);
+                    // #A11Y4 — must run BEFORE the native disable below, which blurs the trigger.
+                    armSubmitA11y($form, $submitTrigger);
                     if ($submitTrigger) {
                         // For A tag: aria-disabled=true
                         if ( /^A$/i.test($submitTrigger.tagName) ) {
@@ -11947,6 +12949,11 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         }
                     }
                     $form.target.removeAttribute('data-gina-form-loading');
+                    // #B247 — idempotent with the `loadend` release above
+                    disarmSubmitLoading($form);
+                    // #A11Y4 — last, so focus lands on a fully settled trigger; idempotent
+                    // with the `loadend` release, which may already have restored it.
+                    releaseSubmitA11y($form, $submitTrigger);
 
                     var $popin          = null;
                     var blob            = null;
@@ -12725,7 +13732,16 @@ function ValidatorPlugin(rules, data, formId, culture) {
      *   computable) so the browser renders its native indeterminate animation;
      *   `error` empties the bar (value 0 — NOT indeterminate, whose animation
      *   would read as still working)
-     * - any other element: `textContent` shows the integer percentage (`42%`)
+     * - any other element: `textContent` shows the integer percentage (`42%`), and
+     *   `role="progressbar"` + `aria-valuemin="0"` / `aria-valuemax="100"` /
+     *   `aria-valuenow="<percent>"` give it the semantics a native `<progress>` gets
+     *   for free (#A11Y7/U2 — without them the indicator is unlabelled text to
+     *   assistive tech). `aria-valuenow` tracks `data-gina-upload-progress` exactly:
+     *   both are ABSENT while indeterminate and on `error`, because an absent
+     *   `aria-valuenow` is how a progressbar signals "unknown" — a stale or zero
+     *   value would read as real, stalled progress. A native `<progress>` is left
+     *   untouched: it already exposes all of this, and a redundant explicit role
+     *   risks overriding the implicit one.
      *
      * Every target also carries two data attributes as styling hooks:
      * `data-gina-upload-progress` (integer percent, absent while indeterminate)
@@ -12761,10 +13777,28 @@ function ValidatorPlugin(rules, data, formId, culture) {
             }
             $indicator.removeAttribute('data-gina-upload-progress');
             $indicator.removeAttribute('data-gina-upload-progress-state');
+            // #A11Y7/U2 — `reset` strips everything this layer ever set, and the ARIA
+            // below is part of "everything": leaving a stale `role="progressbar"` on a
+            // cleared element would expose a permanently 0%-looking bar to assistive tech.
+            if (!isNativeProgress) {
+                $indicator.removeAttribute('role');
+                $indicator.removeAttribute('aria-valuemin');
+                $indicator.removeAttribute('aria-valuemax');
+                $indicator.removeAttribute('aria-valuenow');
+            }
             return;
         }
 
         $indicator.setAttribute('data-gina-upload-progress-state', state);
+        // #A11Y7/U2 — a native <progress> already carries implicit progressbar
+        // semantics (and its own value/max), so it is deliberately left alone; every
+        // other element is text with no role at all until we give it one. The bounds
+        // are constant because `data-gina-upload-progress` is already a percentage.
+        if (!isNativeProgress) {
+            $indicator.setAttribute('role', 'progressbar');
+            $indicator.setAttribute('aria-valuemin', '0');
+            $indicator.setAttribute('aria-valuemax', '100');
+        }
 
         if (state == 'processing') {
             // #R8 — byte-complete, server still post-processing. Advance the STATE only:
@@ -12786,6 +13820,9 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 $indicator.textContent = '100%';
             }
             $indicator.setAttribute('data-gina-upload-progress', 100);
+            if (!isNativeProgress) {
+                $indicator.setAttribute('aria-valuenow', '100');
+            }
             return;
         }
 
@@ -12799,6 +13836,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 $indicator.textContent = '';
             }
             $indicator.removeAttribute('data-gina-upload-progress');
+            // #A11Y7/U2 — an errored bar is EMPTY, not indeterminate (the native branch
+            // above says the same about `value`): drop `aria-valuenow` so assistive tech
+            // reports an unknown state rather than a confident 0% that reads as "no
+            // progress yet, still working".
+            if (!isNativeProgress) {
+                $indicator.removeAttribute('aria-valuenow');
+            }
             return;
         }
 
@@ -12807,6 +13851,12 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 $indicator.removeAttribute('value'); // native indeterminate animation
             }
             $indicator.removeAttribute('data-gina-upload-progress');
+            // #A11Y7/U2 — mirrors the `value` removal above: an absent `aria-valuenow`
+            // on a progressbar IS the indeterminate signal, so this must track the
+            // percent attribute exactly rather than reporting a stale last-known value.
+            if (!isNativeProgress) {
+                $indicator.removeAttribute('aria-valuenow');
+            }
             return;
         }
 
@@ -12816,6 +13866,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
             $indicator.value    = result.loaded;
         } else {
             $indicator.textContent = result.progress + '%';
+            $indicator.setAttribute('aria-valuenow', result.progress);
         }
         $indicator.setAttribute('data-gina-upload-progress', result.progress);
     };
@@ -13030,9 +14081,27 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
             $error.innerHTML = '<p>'+ errMsg +'</p>';
             fadeIn($error);
+            // #A11Y7/U3 — the container is `display:none` when the text is written and
+            // only revealed by the fadeIn above, which is exactly the case where a
+            // `role="alert"` on it is unreliable; route through the form's own polite
+            // region instead — the same channel field validation errors already use.
+            // Announce the RENDERED text, not `errMsg`: the message can carry markup
+            // (the url-action checker substitutes `<br>`), and textContent is what a
+            // user would actually read.
+            if ( $uploadTriger && $uploadTriger.form ) {
+                announceA11yError($uploadTriger.form, $error.textContent);
+            }
         } else if(!$error && status != 'success') {
             throw new Error(errMsg)
         } else {
+            // #A11Y7/U2 — success is the other end of the `uploadStarted` transition.
+            // It lives in this branch rather than at the indicator chokepoint above so
+            // it can never fire alongside the error announcement and overwrite it: a
+            // polite region is latest-wins, and a generic "complete" landing on top of
+            // a specific server message would lose the message.
+            if ( $uploadTriger && $uploadTriger.form ) {
+                announceA11yStatus($uploadTriger.form, a11yLabel('uploadComplete'));
+            }
 
             var fieldsObjectList = null
                 , $li   = null
@@ -13046,11 +14115,12 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 let resetLinkNeedToBeAdded = false;
                 let $resetLink = document.getElementById(resetLinkId);
                 let defaultClassNameArr = ['reset','js-upload-reset'];
+                let resetLabel = $uploadTriger.getAttribute('data-gina-form-upload-reset-label') || 'Reset';
                 if (!$resetLink) {
                     resetLinkNeedToBeAdded      = true;
                     $resetLink                  = document.createElement('A');
                     $resetLink.href             = '#';
-                    $resetLink.innerHTML        = $uploadTriger.getAttribute('data-gina-form-upload-reset-label') || 'Reset';
+                    $resetLink.innerHTML        = resetLabel;
                     $resetLink.className        = defaultClassNameArr.join(' ');
                     $resetLink.id               = resetLinkId;
                 } else {
@@ -13058,7 +14128,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         $resetLink.href             = '#';
                     }
                     if ( !$resetLink.innerHTML || $resetLink.innerHTML == '' ) {
-                        $resetLink.innerHTML        = $uploadTriger.getAttribute('data-gina-form-upload-reset-label') || 'Reset';
+                        $resetLink.innerHTML        = resetLabel;
                     }
                     if ( typeof($resetLink.className) == 'undefined' ) {
                         $resetLink.className = "";
@@ -13066,6 +14136,27 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     let classNameArr = merge($resetLink.className.split(/\s+/g), defaultClassNameArr);
                     $resetLink.className    = classNameArr.join(' ');
                 }
+                // #A11Y7/U5 — the control gina generates is an anchor, so assistive tech
+                // announces it as a link and Space does not activate it. Give it button
+                // semantics; the matching Space handler lives with the click binding in
+                // `bindUploadResetOrDeleteTrigger`, because a role that PROMISES button
+                // behaviour without delivering the key is worse than no role at all.
+                // Stamped only on an anchor: a consumer supplying their own <button> under
+                // this id already has the right semantics, and overriding an implicit role
+                // is a regression. Strict `/^a$/i` here, unlike the loose `/a/i` guarding
+                // `href` above (that one also matches TEXTAREA, CANVAS, LABEL…).
+                if ( /^a$/i.test($resetLink.tagName) ) {
+                    $resetLink.setAttribute('role', 'button');
+                    // The accessible name names the file it acts on: these controls stack
+                    // one per staged file and are otherwise identical, so a controls list
+                    // reads "Reset, Reset, Reset". The visible label stays the PREFIX so
+                    // the name still contains it (WCAG 2.5.3 Label in Name), and it reuses
+                    // the consumer's own `-reset-label`, so it is translated wherever that
+                    // already is.
+                    if ( files[f].originalFilename ) {
+                        $resetLink.setAttribute('aria-label', resetLabel + ' ' + files[f].originalFilename);
+                    }
+                }
                 $resetLink.style.display    = 'none';
 
                 // image preview
@@ -13076,6 +14167,12 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 ) {
                     let $img    = document.createElement('IMG');
                     $img.src    = files[f].tmpUri;
+                    // #A11Y7/U1 — the preview tells the user WHICH file is staged, so it is
+                    // informative content, not decoration; without a text alternative assistive
+                    // tech falls back to reading the temp URI aloud, once per staged file.
+                    // Empty string when the name is missing: a silently ignored image beats
+                    // announcing a placeholder.
+                    $img.alt    = files[f].originalFilename || '';
                     $img.style.display = 'none';
                     $img.setAttribute('data-upload-original-filename', files[f].originalFilename);
                     $img.setAttribute('data-upload-reset-link-id', $resetLink.id);
@@ -13171,6 +14268,12 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                 // creating IMG tag
                                 let $img = document.createElement('IMG');
                                 $img.src = files[f][key].tmpUri;
+                                // #A11Y7/U1 — name the file the user actually chose, not the
+                                // server-generated preview variant recorded just below: the
+                                // generated name is an internal artefact and means nothing to
+                                // the person listening. Same empty-string fallback as the
+                                // no-preview branch.
+                                $img.alt = files[f].originalFilename || '';
                                 $img.style.display = 'none';
                                 // retrieve img `originalFilename` (not the preview img[key] `originalFilename`)
                                 // these 2 metadatas will be used to remove files from the server
@@ -13411,6 +14514,39 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         // display upload input
                         restoreUploadAffordance($uploadTrigger, uploadHiddenClass);
 
+                        // #A11Y7/U5 — the control about to be removed is the one the user
+                        // just activated, so it holds focus; removing a focused element
+                        // drops focus to <body> and the user loses their place with no
+                        // signal. Move focus first, onto the file input that owns the
+                        // staged files — which `restoreUploadAffordance` just made visible
+                        // again. Guarded on it actually holding focus, so a programmatic
+                        // reset never yanks focus away from wherever the user really is.
+                        if ( document.activeElement === $resetLink || $resetLink.contains(document.activeElement) ) {
+                            if ( typeof($uploadTrigger.focus) == 'function' ) {
+                                $uploadTrigger.focus();
+                            }
+                            // #A11Y5's lesson, applied: `typeof focus == 'function'` is true
+                            // for EVERY HTMLElement, and focus() is a silent no-op on one
+                            // that cannot take focus (hidden, disabled, detached) — so
+                            // confirm the move instead of assuming it. Signal-only: there is
+                            // no better fallback than the document, and failing loudly here
+                            // would break a removal that otherwise succeeded.
+                            if ( document.activeElement !== $uploadTrigger ) {
+                                console.debug('[FormValidator][upload]['+ ($uploadTrigger.id || '?') +'] '+ bindingType +': could not move focus to the file input before removing the '+ bindingType +' control; focus falls back to the document.');
+                            }
+                        }
+                        // Announce the removal. `aria-live="polite"` queues rather than
+                        // interrupts, so this lands after the focus move above has been
+                        // announced instead of racing it. Function replacer, not a string:
+                        // a file name may contain `$`, and a string replacement would expand
+                        // `$&` / `$1` patterns inside it.
+                        if ( $uploadTrigger.form && childNodeFile ) {
+                            announceA11yStatus(
+                                $uploadTrigger.form,
+                                a11yLabel('fileRemoved').replace('%s', function () { return childNodeFile; })
+                            );
+                        }
+
                         // remove link & image - must be done last
                         // (the reset/delete link's own click listener dies with the node)
                         $resetLink.remove();
@@ -15420,6 +16556,19 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
                 onUploadResetOrDelete($uploadTrigger, bindingType);
             });
+            // #A11Y7/U5 — the generated control is an anchor carrying `role="button"`,
+            // and a button MUST activate on Space; an anchor natively answers Enter only,
+            // so without this the role would advertise an interaction that does not work.
+            // Anchors only: a real <button> already fires click on Space, and binding
+            // this there would run the removal twice.
+            if ( /^a$/i.test($uploadResetOrDeleteTrigger.tagName) ) {
+                addListener(gina, $uploadResetOrDeleteTrigger, 'keydown', function onUploadResetOrDeleteTriggerKeydown(e) {
+                    if ( e.key === ' ' || e.keyCode === 32 ) {
+                        e.preventDefault(); // Space would otherwise scroll the page
+                        onUploadResetOrDelete($uploadTrigger, bindingType);
+                    }
+                });
+            }
             $uploadResetOrDeleteTrigger.isBinded = true;
         } else {
             console.warn('[FormValidator::bindForm][upload]['+$uploadTrigger.id+'] : did not find `upload '+bindingType+' trigger`.\nPlease, make sure that your '+bindingType+' element ID is `'+ uploadResetOrDeleteTriggerId +'`, or add to your file input ('+ $uploadTrigger.id +') -> `data-gina-form-upload-'+bindingType+'-trigger="your-custom-id"` definition.');
@@ -15871,6 +17020,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
             throw new Error('Validator::bindForm($target, customRule) could not bind form `'+ $target +'`\n'+err.stack );
         }
 
+        // #A11Y2 — stand the polite live region up HERE, at bind time, rather than lazily on the
+        // first error. Creating and populating it in one tick reaches assistive tech as a single
+        // mutation batch that is commonly never spoken, so the first announcement per form used to
+        // be the one most likely lost. Every registration path funnels through bindForm, so this
+        // one call covers them all. Announcing stays announceA11yError's job; this only creates.
+        ensureA11yLiveRegion($target);
+
         // console.debug('binding for: '+ _id);
         var withRules = false, rule = null, evt = '', proceed = null;
 
@@ -16619,6 +17775,24 @@ function ValidatorPlugin(rules, data, formId, culture) {
                             updateUploadProgressIndicator($uploadForm.uploadProperties.progressContainer, 'preparing');
                         }
 
+                        // #A11Y7/U2 — announce the transition into "uploading". Note this
+                        // is deliberately NOT gated on `progressContainer`: the indicator is
+                        // opt-in by presence, but a user who cannot see it is precisely the
+                        // one who needs to be told the upload began.
+                        // The announcement targets the file input's REAL owning form, not
+                        // `$uploadForm` (the virtual one built just above): the real form is
+                        // where `bindForm` already stood up a live region, so upload status
+                        // and validation errors share one region instead of splitting across
+                        // two. Selection always sends today — the `.send()` below is
+                        // unconditional and `data-gina-file-autosend="false"` is still a TODO
+                        // — so this is a true start; gate it if that ever lands.
+                        if ( $uploadForm.uploadProperties && $uploadForm.uploadProperties.uploadTriggerId ) {
+                            var $a11yUploadInput = document.getElementById($uploadForm.uploadProperties.uploadTriggerId);
+                            if ( $a11yUploadInput && $a11yUploadInput.form ) {
+                                announceA11yStatus($a11yUploadInput.form, a11yLabel('uploadStarted'));
+                            }
+                        }
+
                         // binding form
                         try {
                             var $uploadFormValidator = getFormById(uploadFormId);
@@ -17544,6 +18718,44 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         _evt = 'reset.'+_evt
                     }
 
+                    // #B246 — a disabled submit trigger must not run the submit cycle.
+                    // `updateSubmitTriggerState()` marks an invalid form's trigger with
+                    // `aria-disabled="true"` and never with native `disabled`, precisely so
+                    // the click still reaches us. Nothing READ that marker, so the trigger
+                    // stayed fully operable: a click ran the collect -> validate ->
+                    // `validate.<id>` chain and only the `isValid()` gate stopped the send.
+                    // The trigger was inert in appearance ONLY, and that also contradicted
+                    // the `aria-disabled` contract it advertises to assistive tech (which
+                    // requires the author to suppress the action).
+                    //
+                    // Intercept HERE — before the `submit.<id>` dispatch below — so
+                    // `bindSubmitEl`'s handler never runs, `isSubmitting` is never latched
+                    // and no send path is reachable. The click is still answered with a
+                    // display-only reveal, so the user learns WHY the trigger is disabled
+                    // (which is what the operable-trigger design was bought for).
+                    // Checked on the CLICKED element, not `$formInstance.submitTrigger`:
+                    // a form may carry several submit buttons and only one registers.
+                    if ( /^submit\./i.test(_evt) && isTriggerDisabled($el) ) {
+                        cancelEvent(event);
+                        revealValidationState( instance.$forms[$form.id] || $form );
+                        return false;
+                    }
+
+                    // #B247 — arm the loading state on the element the user actually
+                    // operated. DELIBERATELY after the #B246 gate above: a disabled
+                    // trigger returns without starting anything, so arming it there
+                    // would strand exactly the state this feature exists to release.
+                    // `resolveTrigger` climbs to the owning button/anchor, because a
+                    // click on a wrapped label (`<button><span>Save</span></button>`)
+                    // targets the inner node, and the state belongs on the control the
+                    // user perceives as the trigger.
+                    if ( /^submit\./i.test(_evt) ) {
+                        armSubmitLoading(
+                            instance.$forms[$form.id] || $form,
+                            loadingState.resolveTrigger($el, $target)
+                        );
+                    }
+
                     if (gina.events[_evt]) {
                         cancelEvent(event);
 
@@ -17679,6 +18891,22 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         instance.$forms[_id].isSubmitting = false;
                     }
 
+                    // #B247 — release the trigger-scoped loading state. THIS is the path
+                    // that stranded it: a rejected submit produces no request at all, so
+                    // none of the XHR releases can ever run, and only the framework knows
+                    // the submit was refused before it started. Left armed, the trigger
+                    // stays visually loading until the page or popin is reloaded.
+                    //
+                    // Gated on nothing being in flight: a form can be submitted again
+                    // while an earlier request is still running, and that later attempt
+                    // may well be the one that fails validation. Releasing unconditionally
+                    // would clear the state belonging to the request still in progress —
+                    // whose own settle is what must release it.
+                    var _loadingForm = instance.$forms[_id] || $form;
+                    if ( !/^true$/i.test(_loadingForm.isSending) ) {
+                        disarmSubmitLoading(_loadingForm);
+                    }
+
                     // #A11Y1 (slice 3) — failed submit: move focus to the first invalid field so
                     // assistive tech announces it (accessible name + aria-invalid + the
                     // aria-errormessage text). DOM order; hidden / unfocusable fields are skipped.
@@ -17696,7 +18924,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                 && typeof(_aField.focus) == 'function'
                             ) {
                                 _aField.focus();
-                                break;
+                                // #A11Y5 (V8) — kept in step with focusFirstInvalidField:
+                                // only stop once focus actually moved, since focus() is a
+                                // no-op on an unfocusable host that still passes the
+                                // typeof-function gate above.
+                                if ( typeof(document) === 'undefined' || !document || document.activeElement === _aField ) {
+                                    break;
+                                }
                             }
                         }
                     }
@@ -17917,6 +19151,27 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 return false;
             }
 
+            // #B247 — a submit that never went through the click proxy still gets a
+            // loading state: Enter inside a field, `form.submit()`, `$validator.submit()`,
+            // and — less obviously — a click on a wrapped label such as
+            // `<button type="submit"><span>Save</span></button>`, whose event.target is
+            // the span (no `.type`), so the click proxy's submit branch never fires and
+            // the event surfaces here instead. There is no clicked element on this path,
+            // so the registered trigger is the best and only referent. Placed after the
+            // disabled + defaultPrevented guards above, which both return first.
+            // NB. the disabled check at the top of this handler reads a DOMParser copy of
+            // the form's innerHTML, so it sees neither a live `disabled` set by JS nor the
+            // `aria-disabled` marker `updateSubmitTriggerState` uses. Re-check the live
+            // node with #B246's predicate: without it, every Enter-key submit on an
+            // invalid live-check form would flash the trigger armed for the length of the
+            // validation pass before the rejected branch released it.
+            if ($formInstance) {
+                var $loadingTrigger = document.getElementById($formInstance.submitTrigger);
+                if ( !isTriggerDisabled($loadingTrigger) ) {
+                    armSubmitLoading($formInstance, $loadingTrigger);
+                }
+            }
+
             if (withRules || isBinded) {
                 cancelEvent(e);
             }
@@ -18106,13 +19361,17 @@ function ValidatorPlugin(rules, data, formId, culture) {
         } else if ( document.getElementById($formInstance.submitTrigger) ) {
             // Represent the "invalid + live-check-on" state with aria-disabled + a class
             // INSTEAD of the native `disabled` property. A natively-disabled <button>
-            // emits no click event, so the form-level click -> validate -> show-all-errors
-            // -> focus-first guard (the `validate.<id>` listener) never fires: the button
-            // looks dead and gives zero feedback. aria-disabled keeps the trigger operable,
-            // so the click still runs validation (revealing every invalid field + focusing
-            // the first) while `isValid()` (the real gate) still blocks the send. Mirrors
-            // gina's own <a>-tag submit-trigger handling, which already uses aria-disabled
-            // in-flight. The show branch KEEPS clearing native `disabled` so a trigger
+            // emits no click event at all, so the click cannot be observed and the user
+            // gets no feedback about WHY the trigger is dead. aria-disabled keeps the
+            // trigger focusable and perceivable, and clickProxyHandler INTERCEPTS the
+            // click (#B246) to answer it with a display-only reveal: every invalid field
+            // is rendered and the first is focused, while the submit cycle is never
+            // entered. The trigger is therefore genuinely not operable — which is what
+            // the aria-disabled contract promises assistive tech, and what the earlier
+            // "keep it operable so the click can still validate" shape got wrong: it
+            // left the real submit path reachable from a control announced as disabled.
+            // Mirrors gina's own <a>-tag submit-trigger handling, which already uses
+            // aria-disabled in-flight. The show branch KEEPS clearing native `disabled` so a trigger
             // rendered `disabled` in markup still enables on valid / when live-check is off.
             // Tag-agnostic: setAttribute/classList work for both <button> and <a> submit
             // triggers. Consumers must style the [aria-disabled="true"] /
@@ -18133,6 +19392,125 @@ function ValidatorPlugin(rules, data, formId, culture) {
         }
     }
 
+    /**
+     * isTriggerDisabled
+     *
+     * Tells whether a submit trigger is currently marked as disabled.
+     * `updateSubmitTriggerState()` marks an invalid form's trigger with
+     * `aria-disabled="true"` rather than the native `disabled` property, so a
+     * native-only check can never see it. The predicate shape mirrors the popin
+     * plugin's own trigger gate, so both subsystems agree on what "disabled"
+     * means for a trigger.
+     *
+     * @param {object} $el - candidate trigger (DOMObject)
+     *
+     * @returns {boolean} true when the trigger must not be operated
+     *
+     * @example
+     * isTriggerDisabled($button); // true while aria-disabled="true" is set
+     *
+     * @inner
+     */
+    var isTriggerDisabled = function($el) {
+        if ( !$el || typeof($el.getAttribute) != 'function' ) {
+            return false;
+        }
+        return (
+            $el.getAttribute('disabled') != null && $el.getAttribute('disabled') != 'false'
+            ||
+            $el.getAttribute('aria-disabled') == 'true'
+        );
+    };
+
+    /**
+     * focusFirstInvalidField
+     *
+     * Moves focus to the first field carrying an error, in DOM order, skipping
+     * hidden and unfocusable controls (#A11Y1) so assistive tech announces the
+     * accessible name + `aria-invalid` + the `aria-errormessage` text.
+     *
+     * NB. the `validate.<id>` guard keeps its own inline twin of this loop rather
+     * than calling here. That is DELIBERATE: the inline shape is locked by source
+     * pins in `test/core/validator-aria-invalid.test.js` (`_a11yErrs`, `_aField`),
+     * so collapsing the two would break pins unrelated to #B246. Keep the two in
+     * step if the focus rule ever changes.
+     *
+     * @param {object} $form - form target (DOMObject), not the instance
+     * @param {object} errors - error map keyed by field name
+     *
+     * @returns {boolean} true when a field was focused
+     *
+     * @example
+     * focusFirstInvalidField($form, result['fields'] || result['error']);
+     *
+     * @inner
+     */
+    var focusFirstInvalidField = function($form, errors) {
+        if ( !$form || !errors ) {
+            return false;
+        }
+        for (var i = 0, len = $form.length; i < len; ++i) {
+            var $field  = $form[i];
+            var name    = $field.getAttribute('name');
+            if (
+                name
+                && typeof(errors[name]) != 'undefined'
+                && ( typeof(errors[name].count) != 'function' || errors[name].count() > 0 )
+                && $field.type != 'hidden'
+                && typeof($field.focus) == 'function'
+            ) {
+                $field.focus();
+                // #A11Y5 (V8) — `typeof focus == 'function'` is true for EVERY HTMLElement,
+                // a custom element with neither `tabindex` nor `delegatesFocus` included,
+                // whose focus() is a silent no-op (measured). Without confirming the move,
+                // the loop reported success and stopped on a control that never took focus,
+                // so a failed submit announced nothing. Confirming it is also what makes the
+                // "skips unfocusable controls" contract above true rather than aspirational.
+                if ( typeof(document) === 'undefined' || !document || document.activeElement === $field ) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    };
+
+    /**
+     * revealValidationState
+     *
+     * Display-only validation pass, used when a DISABLED submit trigger is
+     * clicked (#B246). It runs the same collect + validate chain the submit path
+     * uses, but routes the result straight to the error renderer instead of
+     * dispatching `validate.<id>` — so `bindSubmitEl`'s handler never runs, the
+     * `isSubmitting` latch is never set and the `isValid()` send gate is never
+     * reached. No request can start from this path by construction.
+     *
+     * The trigger state is re-synced from the fresh result, which also self-heals
+     * a stale disabled marker on a form that has since become valid.
+     *
+     * @param {object} $formInstance - form instance (carries `.target` / `.rules`)
+     *
+     * @returns {void}
+     *
+     * @example
+     * revealValidationState(instance.$forms['myForm']);
+     *
+     * @inner
+     */
+    var revealValidationState = function($formInstance) {
+        if ( !$formInstance || !$formInstance.target ) {
+            return;
+        }
+        var $target         = $formInstance.target;
+        var validationInfo  = getFormValidationInfos($target, $formInstance.rules);
+
+        validate($target, validationInfo.fields, validationInfo.$fields, $formInstance.rules, function onDisabledTriggerReveal(result) {
+            var errors = result['fields'] || result['error'];
+            handleErrorsDisplay($target, errors, result['data']);
+            focusFirstInvalidField($target, errors);
+            updateSubmitTriggerState($formInstance, result.isValid());
+        });
+    };
+
     /**
      * getFormValidationInfos
      *
@@ -19691,13 +21069,14 @@ if ( ( typeof(module) !== 'undefined' ) && module.exports ) {
     module.exports  = ValidatorPlugin
 } else if ( typeof(define) === 'function' && define.amd) {
     // Publish as AMD module
-    define('gina/validator', ['utils/events', 'utils/dom', 'utils/effects', 'utils/data', 'lib/form-validator', 'lib/routing'], function(){ return ValidatorPlugin })
+    define('gina/validator', ['utils/events', 'utils/dom', 'utils/effects', 'utils/data', 'lib/form-validator', 'lib/routing', 'lib/loading-state'], function(){ return ValidatorPlugin })
 };
-define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], function (require) {
+define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge', 'utils/events' ], function (require) {
 
     // TODO - Integrate dialog-polyfill : https://github.com/GoogleChrome/dialog-polyfill/blob/master/dist/dialog-polyfill.js
     var Domain          = require('lib/domain');
     var domainInstance  = null;
+    var loadingState    = require('lib/loading-state');
     var merge           = require('lib/merge');
 
     require('utils/events'); // events
@@ -20163,7 +21542,19 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
          * a body scroll-lock attribute (CSS), and best-effort `inert` on background
          * siblings. Torn down by removeNonModalShims() on close.
          *
+         * "Background siblings" has to include any OTHER popin still open inside the
+         * shared container: popinOpen() never closes the popin it supersedes, so a
+         * second non-modal dialog would otherwise leave the first one fully
+         * keyboard-reachable behind it. The container itself must stay reachable — it
+         * holds $el — so it is descended into rather than skipped.
+         *
+         * Only `[open]` dialogs are inerted. A closed `<dialog>` is already
+         * `display:none` per the UA stylesheet, so it is unreachable without help.
+         *
          * @inner
+         * @param {object} $popin - popin descriptor; the Escape handler closes by $popin.name
+         * @param {HTMLElement} $el - the dialog element being shown non-modally
+         * @returns {void}
          */
         function applyNonModalShims($popin, $el) {
             if ( !$el ) {
@@ -20182,11 +21573,30 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
             $el.__ginaOnKeydown = onKeydown;
             $el.addEventListener('keydown', onKeydown);
 
-            // Best-effort background inert (skip the dialog, its container and ancestors).
+            // Best-effort background inert (skip the dialog and its ancestors; descend
+            // into the container so a superseded popin does not stay reachable).
             var siblings = document.body.children;
             var b = 0, len = siblings.length;
             for (; b < len; ++b) {
-                if ( siblings[b] === $el || siblings[b] === instance.target || siblings[b].contains($el) ) {
+                if ( siblings[b] === instance.target ) {
+                    // The container holds $el, so it cannot be inerted wholesale — but any
+                    // OTHER popin still open inside it would remain keyboard-reachable
+                    // behind this one. Closed dialogs are already display:none (UA
+                    // stylesheet), so [open] is the whole set that needs help.
+                    var $open = siblings[b].querySelectorAll('dialog[open]');
+                    var d = 0, dLen = $open.length;
+                    for (; d < dLen; ++d) {
+                        if ( $open[d] === $el || $open[d].contains($el) ) {
+                            continue;
+                        }
+                        if ( $open[d].getAttribute('inert') == null ) {
+                            $open[d].setAttribute('inert', '');
+                            $open[d].setAttribute('data-gina-popin-inert', 'true');
+                        }
+                    }
+                    continue;
+                }
+                if ( siblings[b] === $el || siblings[b].contains($el) ) {
                     continue;
                 }
                 if ( siblings[b].getAttribute('inert') == null ) {
@@ -21551,6 +22961,43 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
             }
         }
 
+        /**
+         * armPopinTrigger
+         *
+         * Makes the control that opened a popin inoperable for the duration of the load
+         * and marks it with the shared `data-gina-loading`.
+         *
+         * That attribute is NOT a duplicate of the container's `data-gina-popin-loading`:
+         * they sit on different elements and answer different questions — the container
+         * one says "this popin is filling", this one says "this control is busy". The
+         * second is the same attribute the validator and link plugins write, so a single
+         * stylesheet covers every busy control a project has, whichever plugin started
+         * the work.
+         *
+         * Scoped to the TRIGGER rather than absorbing the whole arm block, deliberately:
+         * the two arm sites must keep their own literal `showLoadingShell($popin, $el)`
+         * call, which is what `popin.test.js` pins to prove the skeleton shows at both.
+         *
+         * @inner
+         * @param {HTMLElement} [$popinTrigger] - the control that opened it, when it has an id
+         * @returns {void}
+         *
+         * @example
+         * armPopinTrigger(document.getElementById($popin.openTrigger));
+         */
+        function armPopinTrigger($popinTrigger) {
+            if ( !$popinTrigger ) {
+                return;
+            }
+            // For A tag: aria-disabled=true
+            if ( /^A$/i.test($popinTrigger.tagName) ) {
+                $popinTrigger.setAttribute('aria-disabled', true);
+            } else {
+                $popinTrigger.setAttribute('disabled', true);
+            }
+            loadingState.arm($popinTrigger);
+        }
+
         /**
          * popinLoad
          *
@@ -21728,14 +23175,7 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                 if ( /^(1|3)$/.test(xhr.readyState) ) {
                     $popin.target.setAttribute('data-gina-popin-loading', true);
                     showLoadingShell($popin, $el);
-                    if ($popinTrigger) {
-                        // For A tag: aria-disabled=true
-                        if ( /^A$/i.test($popinTrigger.tagName) ) {
-                            $popinTrigger.setAttribute('aria-disabled', true);
-                        } else {
-                            $popinTrigger.setAttribute('disabled', true);
-                        }
-                    }
+                    armPopinTrigger($popinTrigger);
                 }
 
                 // catching ready state cb
@@ -21744,18 +23184,12 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                     if ( /^(1|3)$/.test(xhr.readyState) ) {
                         $popin.target.setAttribute('data-gina-popin-loading', true);
                         showLoadingShell($popin, $el);
-                        if ($popinTrigger) {
-                            // For A tag: aria-disabled=true
-                            if ( /^A$/i.test($popinTrigger.tagName) ) {
-                                $popinTrigger.setAttribute('aria-disabled', true);
-                            } else {
-                                $popinTrigger.setAttribute('disabled', true);
-                            }
-                        }
+                        armPopinTrigger($popinTrigger);
                     }
                     if (xhr.readyState == 4) {
                         // Fixed: clear loading state on response complete — data-gina-popin-loading
                         // was set on readyState 1|3 but never removed, leaving the overlay blocked.
+                        // Covers every status including 0, since the branch is on readyState alone.
                         $popin.target.removeAttribute('data-gina-popin-loading');
                         if ($popinTrigger) {
                             if ( /^A$/i.test($popinTrigger.tagName) ) {
@@ -21763,6 +23197,7 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                             } else {
                                 $popinTrigger.removeAttribute('disabled');
                             }
+                            loadingState.disarm($popinTrigger);
                         }
                         // 200, 201, 201' etc ...
                         var result = null;
@@ -22343,6 +23778,12 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                     // Fixed: clear loading state on reset — defensive cleanup for navigation
                     // within a popin that was in loading state when reset was called.
                     $el.removeAttribute('data-gina-popin-loading');
+                    // Trigger-scoped release. This function is ALSO reached from routing
+                    // transitions that never call popinClose, so without this the control
+                    // that opened a popin torn down by a route change would stay armed.
+                    // Resolved here rather than passed in: popinUnbind only has $popin, and
+                    // `disarm` is a no-op on the null a trigger-less popin resolves to.
+                    loadingState.disarm( document.getElementById($popin.openTrigger) );
 
                     // removing from FormValidator instance
                     if ($validatorInstance) {
@@ -22455,6 +23896,7 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/merge', 'utils/events' ], f
                         } else {
                             $popinTrigger.removeAttribute('disabled', true);
                         }
+                        loadingState.disarm($popinTrigger);
                         // a11y: return focus to the trigger that opened the popin.
                         if ( typeof($popinTrigger.focus) == 'function' ) {
                             $popinTrigger.focus();
@@ -25939,7 +27381,8 @@ require([
     "lib/form-validator",
     "lib/collection",
     "lib/domain",
-    "lib/routing"
+    "lib/routing",
+    "lib/loading-state"
 ], function () {
     // Boot the popin handler at page load so the declarative `data-gina-dialog` API is
     // active WITHOUT bundle code calling `new gina.popin()`. Constructing the handler