gina 0.6.31 → 0.6.32

package/CHANGELOG.md

@@ -6,6 +6,47 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.32 - 2026-09-22
+### Added
+* Added a commit-msg git hook that keeps local-tool configuration paths and AI-attribution mentions out of commit messages. The existing pre-commit hook scans staged content, but no hook ever received the message itself, so the message was the one unguarded surface; 13 messages on the public branches had picked up such a mention since 2026-05. It shares the pre-commit leak and exception patterns byte-for-byte, pinned by a test so the pair cannot drift, and adds a message-only pattern for the prose forms the content scan does not need to match. Vendor identifiers the AI connector depends on - protocol schemes, SDK package names, canonical env-var names, and the provider key itself - remain allowed. Fails open, and git commit --no-verify still bypasses it. Contributor clones pick the hook up through the core.hooksPath that post_install already installs.
+* The maintenance status payload (`GET`/`POST /_gina/maintenance`, both engines) now carries `pid` and `hostname` — the process that answered, and under Kubernetes the pod name. The runtime override was always per process: it lives in the memory of the process that received the `POST` and — unless the replica sync below (`server.maintenance.store`) is configured — is neither written nor broadcast, and a replica that restarts returns to its configured state. That contract is now stated on the guide, the schema and `llms.txt`, and the two fields let an operator fanning a `POST` out over replicas read back which ones applied it; `enabled: true` in configuration remains the durable, deployment-wide form
+* Maintenance mode can now be turned on from the environment: a bundle started with `GINA_MAINTENANCE=1` (or `true`) boots with its maintenance gate closed, exactly as if `settings.json > server.maintenance.enabled` were `true` — for replacement pods created during a window, or any process that must come up closed without a configuration edit. The variable can only close a bundle, never open one: `0`, `false` or an unset value leave the configured state in place, and any other value is ignored with a boot warning naming the accepted values. The runtime toggle keeps its meaning — `POST /_gina/maintenance {"enable":false}` still reopens the process — and `GET /_gina/maintenance` reports `source: "env"` for a closure that came from the variable. Honoured under both launchers (`gina bundle:start` and `gina-container`); under the daemon the variable must be present in the environment of the process that started the daemon (a pod init script), because a warm daemon passes only its launch-time environment to the bundles it spawns.
+* Maintenance mode can now stay coherent across the replicas of one deployment. Point `server.maintenance.store` at a declared kv namespace (redis-backed for replicas on different hosts, sqlite-backed for processes on one host) and every `POST /_gina/maintenance` writes its runtime override there, while each process polls it (`pollInterval`, default 2000 ms, an unref-ed timer) — so one POST anywhere closes or reopens every replica within one interval, and a replica joining mid-window follows the shared state within one store round-trip. The gate itself keeps reading local memory synchronously. A store outage freezes each replica in its last-known state and never reopens a closed site; a `ttlSeconds` window expires deployment-wide through the record TTL; an `enable:false` is written, not deleted, so it wins over a configured `enabled: true` on every replica exactly as it does locally. A namespace the kv primitive cannot hand out, or one running `failMode: "open"`, refuses the boot with a message naming the fix; a memory-backed namespace runs with a boot warning that replicas will not follow each other. `GET /_gina/maintenance` gains a `sync` field (`store`, `key`, `lastSyncAt`, `lastError`) and a `POST` reply carries `store: {written, error}` — a write that fails still applies locally and answers 200 with `written: false`. Without `store` nothing changes.
+* A form can swap its `text/html` XHR answer into any element of the page, htmx-style, with three attributes on the `<form>`: `data-gina-form-target` (the `hx-target` grammar - `this`, `closest <selector>`, `find <selector>`, or a CSS selector; `next`/`previous` reserved), `data-gina-form-swap` (`innerHTML` by default, `outerHTML`, `textContent`, `beforebegin`, `afterbegin`, `beforeend`, `afterend`, `delete`, `none`) and `data-gina-form-select` (a CSS selector picking the part of the answer to swap, every match). The target is resolved at submit, from the form, and a target or strategy that cannot be honoured refuses the submit before anything is sent (`error` callback with `{ status: 422, reason: 'targetError' }`). The success payload keeps `contentType`/`content`/`status` and adds `data`/`view` (the action's data when the answer carries the dev-mode hidden inputs, `null` otherwise), `target`, `swap` and `swapped`. Two events on the form for the main swap: `beforeswap` (cancelable with `preventDefault()`; `detail.content` may be rewritten) and `afterswap` (after the region is bound; declarative hook `data-gina-form-event-on-swap`). The swapped region is bound through the shared `bindRegion()` policy: src scripts the document does not have are re-created once, forms that opt in are bound, `data-gina-link` anchors too; a swap that replaces the submitting form binds its replacement after the `success` callback. A declared target wins over the popin the form is in; absent, a form inside a popin keeps loading its answer into that popin (https://github.com/gina-io/gina/issues/76)
+* `lib.duration.parse()` — the framework's one parser for unit-suffixed duration strings (`"500ms"`, `"30s"`, `"15m"`, `"3h"`, `"15d"`; the unit is required, a bare number is refused with `NaN`, `"0s"` is legal). It is the parser `lib/storage` already used for its interval keys, promoted to a registry entry so every configuration key that names a span of time shares one dialect; storage delegates to it and its behaviour is unchanged.
+* Per-bundle login session cookie lifetimes, declared in a bundle's `security.json`. `session.expires` sets the cookie lifetime applied at `req.login()` for an ordinary login and `session.remember` the lifetime for a login that asked to be remembered — both unit-suffixed duration strings (`"15m"`, `"3h"`, `"15d"`; the unit is required). A login counts as remembered when the caller passes `{ remember: true }` to `req.login()`, or when the login request carries a truthy `remember` field (`on`, `1`, `true`, `yes`); an explicit option always wins over the request field. Both keys are optional and a bundle that declares neither behaves exactly as before. These two keys were documented but interpreted by nothing until now, so a value already sitting in one may not be a duration string: such a value is reported at boot naming the bundle, environment and key, and then ignored — the bundle keeps the cookie lifetime it already had and the boot is never refused. Everything that governed a session before still does: an application setting `req.session.cookie.maxAge` in its own login callback still wins, an absolute session timeout still caps the total lifetime, and a session store's `ttl` still governs the server-side record independently of the cookie. Declared in the published `security.json` schema.
+* A form's `text/html` answer can update elements anywhere in the page, independently of where the answer itself goes: any element of the answer carrying `data-gina-swap-oob` is swapped into the page element with the same `id` (htmx's `hx-swap-oob`). `true` or an empty value replaces that element (`outerHTML`); a strategy name (`innerHTML`, `textContent`, `beforebegin`, `afterbegin`, `beforeend`, `afterend`, `delete`, `none`) applies the out-of-band element's CONTENT, the wrapper being dropped; `<strategy>:<selector>` is reserved. Out-of-band elements are always removed from the answer, whether or not they swapped, so the main fragment stays clean, and they run BEFORE `data-gina-form-select` narrows it, so an element outside the selection still lands; where both address the same element, the main swap wins. They are processed on all three answer paths - a declared `data-gina-form-target`, a form rendered inside a popin, and a form with neither - so an answer carrying nothing else still updates the page. A missing `id`, no matching page element, a reserved or unknown value: the element is dropped and reported with a `reason`, never thrown, and named in a dev-mode console notice. The success payload gains `oob` (one entry per element: `id`, `strategy`, `swapped`, and `reason` when it did not swap) and `remainder` (the answer without them - what a handler should insert, since `content` stays the raw answer and would land them twice); both are absent when the answer carried no out-of-band element. Two events per element: `oobbeforeswap` (cancelable with `preventDefault()`; `detail.content` may be rewritten) and `oobafterswap`, each carrying `oob: true` and `oobId`. A form inside a popin updates the page behind it this way, and when nothing but out-of-band elements was addressed the dialog keeps its own content rather than being blanked. An out-of-band swap that replaces the submitting form rebinds it after the `success` callback, as a main swap does. An element wrapped in a `<template>` is honoured, and a wrapper emptied of them is dropped with them. An answer with no `data-gina-swap-oob` anywhere takes exactly the path it did before (https://github.com/gina-io/gina/issues/76)
+* A server can now have the last word on where a form's `text/html` answer goes and how: three response headers, read at settle once the answer is known to be HTML and before `beforeswap`, override the form's declared `data-gina-form-target` / `-swap` / `-select` — `X-Gina-Retarget` (the target grammar: `this`, `closest <selector>`, `find <selector>`, a CSS selector; it creates a target where none was declared, replaces a declared one, and wins over the popin a form sits in), `X-Gina-Reswap` (one of the nine strategies) and `X-Gina-Reselect` (a selector applied to the answer) — htmx's `HX-Retarget`, `HX-Reswap` and `HX-Reselect`. The invalid-value rule is asymmetric: a Retarget that cannot be resolved means no swap at all, not into the declared target and not into the popin, and the success callback still runs with `swapped: false` and `reason: 'retargetError'` (never an error callback: the request succeeded); an invalid Reswap or Reselect is ignored and the declared value kept, as is either one without any target. Every refused or ignored value is named in a dev-mode console notice, and the success payload gains an `overrides` key — present only when the answer carried at least one of the headers — with one `{ value, applied, reason }` entry per header; `beforeswap` receives the same object in its detail and keeps the last word. A JSON answer never reaches the read. The three headers are honoured only from a response whose origin is the page's own - the transport's `responseURL`, the URL after redirects, against `location.origin` - so a responder elsewhere may neither choose the element its answer lands in nor reshape or trim the swap the form declared: a cross-origin Retarget is refused exactly as an unresolvable one (no swap, `reason: 'crossOrigin'`), a cross-origin Reswap or Reselect is ignored and the declared value kept, and a transport that cannot say where the answer came from (no `responseURL`, or an opaque origin on either side) reads as not-same-origin. `Access-Control-Expose-Headers` therefore changes nothing for these three. htmx needs no such read because `selfRequestsOnly` refuses the cross-origin request itself; a form here posts to its raw `action`, so the gate lives at the read (https://github.com/gina-io/gina/issues/76)
+### Changed
+* The popin context a request and its answer carry is decided by containment - the popin the submitting form is inside - instead of by whichever popin is open: (1) the `X-Gina-Popin-Id` / `X-Gina-Popin-Name` request headers, and therefore `self.isPopinContext()`, `Setup.isPopinContext` and a popin-style XHR redirect from `self.redirect()`, are now produced only for a form rendered inside a popin, not for a page form submitted while a popin happened to be open; (2) a plain `location` XHR redirect answering a page form navigates the page instead of being loaded into an open popin, and a name-less `location` redirect arriving after its popin was closed no longer reopens it; (3) `getActivePopin()` no longer returns a registered popin that is not open, so a no-argument `gina.popin.close()`, `destroy()` or `unbind()` during a popin's own click-time load window is a no-op, and with two popins open the most recently opened one is the active one rather than the first registered; (4) a name-less `popin: { close: true }` answer with nothing open to close is a no-op rather than a `422`. A page that deliberately fed a non-modal popin from a page form's answer sees the dev-mode notice and keeps that behaviour explicitly with `data-gina-form-target` pointing at the dialog, or by rendering the form inside the popin (https://github.com/gina-io/gina/issues/76)
+* Fragment navigation (`gina/nav`) binds the swapped region through the same policy the validator now uses for form-answer swaps, the shared `bindRegion()` helper (utils/dom): the fragment's src-bearing scripts the document does not already have are re-created once, `data-gina-link` anchors are bound through the live link plugin, and forms are bound ONLY when they opt in (#B549: a `data-gina-form-*` attribute, an id naming a registered rule, or a `gina-upload-*` id). A bare id-bearing form inside a navigated fragment was bound regardless, and its submit silently became an XHR - the pre-#B549 bind-everything shape re-entering through swapped content (measured on the real bundle: bound and posted over XHR after a swap, left alone on the initial page). Such a form now keeps its native submit; add `data-gina-form-rule` or any `data-gina-form-*` attribute to opt it in. The validator publishes the gate as `gina.validator.bindRegion($root)` (https://github.com/gina-io/gina/issues/76)
+* Two forms whose answers land in the same region no longer race. A form already declares, at submit time, where its answer goes and what it does when it gets there, and that is the whole of what the decision needs: when `data-gina-form-swap` REPLACES the region the form targets - `innerHTML` (the default), `outerHTML`, `textContent` or `delete` - a newer submit into the same target SUPERSEDES the request still in flight, whose answer was about to be overwritten anyway; when the swap ADDS to the region (`beforebegin`, `afterbegin`, `beforeend`, `afterend`) or writes nothing (`none`), there is no conflict to resolve and both land, exactly as before. Nothing is declared for any of this. The key is the RESOLVED swap target, which is what makes two DIFFERENT forms coordinate at all - a form-keyed guard never sees them - and a form declaring no `data-gina-form-target` is untouched, the module-wide `withRateLimit` rule still governing it and its own re-submits. BEHAVIOUR CHANGE, in exactly one shape: two or more forms targeting one element with a replacing swap, where both answers used to arrive and the older one is now aborted. Declare `data-gina-form-sync="queue"` on the later form to serialise them instead, or an insertion swap if what was wanted was both. `data-gina-form-sync` on the form overrides the derived decision where it is wrong - `replace`, `drop` or `queue` (one submit waits per region, the most recent) - and when declared it owns that form's decision, the module-wide `withRateLimit` option yielding to it so `replace` and `queue` are reachable without changing a global. Three htmx `hx-sync` spellings are REFUSED rather than parsed, each with a message naming the reason and the alternative: `abort` (its disposable-GET idiom, where a form submit is a validated POST with side effects - use `replace` or `drop`), the `queue first|last|all` modifiers (htmx has them because its trigger spec has `queue:` modifiers of its own; there is no trigger spec here, and one submit waiting per region is the only thing that region can act on), and `<selector>:<strategy>` (it names the element to coordinate on, which is already known - the resolved swap target). A superseded request releases everything it held - its trigger, its loading state, its a11y state - and then stops: it fires a new `abort` event on the form, `{ status: 0, reason: 'superseded', sync, derived }`, and never reaches the `error` channel, so the 408 an aborted transport would otherwise look like is not raised and `data-gina-form-event-on-submit-error` never sees it. Superseding cancels the client's WAIT, not the server's WORK: a superseded request was already in flight, so it may have reached the server, and if it did its writes stand - a page must never read `abort` / `superseded` as 'not saved' and resubmit, which would be a duplicate write. `derived` says whether the rule was read from the swap strategy or declared on the form, because the default needs no attribute and a page seeing the event may find nothing in its own markup that asked for it. The loading state follows the same logic: a submit turned away by `drop` releases the `data-gina-loading` its own click armed, since it will never reach a settle that could; a queued submit keeps it, being pending rather than abandoned. `data-gina-form-disabled-elt` holds elements disabled for the life of a request: a comma-separated list in the `data-gina-form-target` grammar, resolved before the request is opened and released at the one settle that covers success, error, abort and timeout alike. Each element is refcounted, so two overlapping requests naming the same element release it once, and marked `data-gina-disabled-by` with the form id; an element the page had already disabled is left alone and never cleared by us. An unreadable `sync` value or a part of `disabled-elt` that resolves to nothing refuses the submit before anything is sent - the same pre-send refusal a bad `data-gina-form-target` gets, `{ status: 422, reason: 'targetError' }` with `attribute` naming which one - deliberately louder than htmx, which skips an unmatched `hx-disabled-elt` silently (https://github.com/gina-io/gina/issues/76)
+### Fixed
+* The client validator boot scan now binds only the forms a page opted in - a data-gina-form-* attribute, an id naming a registered rule, or a virtual gina-upload-* id - and leaves any other form untouched, as the forms guide states. Before, declaring a single rule file made every form on every page an always-XHR submit, plain login and signup forms included, which expected a native POST (#B549). Behaviour change: a form that was bound implicitly now submits natively unless it carries a data-gina-form-* attribute or matches a rule; explicit validateFormById() and getFormById() calls are unchanged.
+* Two connectors in one bundle no longer fight over an entity class name. The framework registers each entity's singleton in a process-wide table that was keyed on the bare class name, which is only unique within one model - so when two connectors of a bundle produced a class of the same name (guaranteed when they share a `database`, and equally possible across two databases that each carry a `user.js`), the one whose connection became ready SECOND was handed the first one's instance and never attached its own entities. Its `getModel()` returned a bare `{ _connection, getConnection }`, and because the bundle still started and served, every call on the missing entity failed later at request time. Which connector lost depended on connection timing, so it differed between replicas of the same release, and a dev boot could not reproduce it at all. The table is now keyed per bundle, model and class name. As a safety net, a bundle whose declared entity did not reach its model now names the class and refuses to start instead of serving a half-built model layer (#B555).
+* A date field no longer submits the previous day for users east of UTC. `isDate` normalised the payload the way every validator does, but it wrote a `Date` OBJECT into it — and a `Date` is the one normalised type that does not round-trip through JSON: `JSON.stringify` renders it via `toISOString()`, which yields a UTC instant. Local midnight in any positive UTC offset is the previous day in UTC, so a user in Paris who picked `2026-09-18` submitted `2026-09-17T22:00:00.000Z`, and anything reading the date part of that string stored the 17th. It was silent because the instant was well-formed, and invisible to servers and CI running in UTC. The field now keeps the parsed `Date` — so `field.isDate(mask).format(...)` chaining is unchanged — while the submitted payload takes a plain `yyyy-mm-dd` string, always, whatever the input mask: the mask governs how input is PARSED, and gina already published these fields as `{type: "string", format: "date"}` in both its routing introspection and its DTO type emission, so the payload now matches the schema it was already advertising. BREAKING for anything that consumed the old shape: `req.body.<field>` is a string rather than a `Date`, and `new Date(payload)` on a date-only string resolves to UTC midnight rather than local midnight (#B558).
+* `self.throwError()` now answers the request when it is called with a falsy value. The one-argument form passes the caller's own payload in the slot that the two- and three-argument forms use for the response, and the guard that protects it from running against an already-released response tested only that slot for truthiness. So `self.throwError(err)` where `err` was an empty string, `null`, `undefined`, `0` or `false` was mistaken for a call arriving after the response had gone: nothing was written, the request was never answered, and the only trace was a warning stating that the response had been released - which it had not - followed by no error text at all, because that message reads the status and message arguments and never the payload. Such a call now renders a 500 like any other. Genuine late calls, and calls made with no arguments, still bail exactly as before (#B560).
+* An XHR redirect over HTTP/2 now delivers the session cookie it just rotated (#B550). `redirect()`'s XHR and popin exits answered through the raw HTTP/2 stream, which calls neither `res.writeHead` nor `res.end` — so a session middleware that sets its cookie from an `on-headers` hook and persists from an `end` proxy emitted neither, and a user signed in immediately before the redirect arrived unauthenticated, still presenting the session id that had just been replaced. Both exits now terminate through the compat response, as the sibling 303 exit always did. The router's one-shot `inheritedData` consume likewise persists itself instead of relying on that same save-on-end proxy, so a redirect that carried a credential-bearing body no longer leaves it in the stored session record for the rest of the session. HTTP/1.1 was never affected on either engine. The ordinary render path — a `rolling` cookie that did not roll, and session mutations dropped during a render — is addressed by #B562 in this same release.
+* On HTTP/2, a `rolling` session cookie now rolls on an ordinary rendered response, and a session mutation made while rendering is persisted (#B562). The render delegates answer on the raw HTTP/2 stream, which calls neither `res.writeHead` nor `res.end`, so middleware that installs itself by wrapping those two methods — a session's `on-headers` cookie hook and its save-on-end proxy among them — was inert on every render: the cookie was never emitted, so a rolling expiry never rolled, and a mutation made during the render was silently dropped. A base `writeHead`/`write`/`end` is now installed on the response before the bundle middleware chain runs, so such middleware wraps it, and the six buffering render delegates hand their HTTP/2 send to that base `end` — which a session middleware invokes only once its store write has completed, so a response can no longer reach the client ahead of the record it depends on. The shim is transparent: a response that no delegate has claimed keeps its original methods, leaving redirects, statics and the built-in endpoints byte-identical. The framework-level error responder defers the same way, so an error answered over HTTP/2 now carries the session cookie it rotated and persists a mutation made while handling it. A base `_implicitHeader` is forced alongside the shim: an express plugin written against HTTP/1 calls it and `Http2ServerResponse` does not implement it, and while the router already forced it on the routed path, the middleware chain also terminates in the statics handler, so a statics-terminated request could otherwise reach a middleware-wrapped `end()` without it. The statics send sites stay on the raw stream deliberately: a static response runs no application code, so it has no session mutation to persist, and the one remaining difference is that a rolling session cookie does not have its idle timer refreshed by a static served over HTTP/2, where HTTP/1.1 does refresh it. `renderStream()` is deliberately unchanged — it writes chunk by chunk from an async iterable, and buffering it would alter SSE and Range responses. HTTP/1.1 was never affected on either engine.
+* Fixed the storage metadata store running an application callback from inside its own try/catch. Seven methods - set, remove, acquireRef, releaseRef, listZeroRefs, removeIfZero and listKeys - invoked the callback inside the try that guards their SQLite statement, so an error thrown by the application was swallowed by the store, and the catch then invoked that same callback a second time with the application error presented as a store error. A caller that latches on first settle, as the content-addressed driver verify() does, treated the re-entry as a no-op and never completed, so the operation hung indefinitely instead of reporting. Callbacks now run after the try on every path, a genuine store error still arrives as fn(err), and get() already had the correct shape and is unchanged. (#B565)
+* An HTML file served from a bundle's public directory over a dev boot no longer answers 500 when that bundle has no templates configuration (#B567). In dev the static handler injects the gina loader into an HTML static and read the bundle's `content.templates._common` block to do so; a bundle that never ran `view:add` — any API-only bundle — has no such block, so the read threw and the request answered 500 with a `TypeError`. The loader is now injected only when the bundle carries one; otherwise the page is served exactly as it is on disk, which is also what production always did. Pickup: a bundle restart; no rebuild.
+* A JSON config carrying a `/**` docblock and, in a string value, a `/*` with no `*/` after it — a glob or certificate path such as `"…/ssl/*.example.pem"` — no longer hangs the bundle boot. The block-comment strip in `requireJSON` was a regular expression that backtracked about 2× per line (4× per CRLF line) following such a value, so a config with a glob path a few dozen lines from its bottom hung until the CLI start-wait killed the process, with nothing logged. The strip is now a linear, string-aware scan; a `/*` inside a quoted value is data and survives intact, where the regex also removed `/**/` out of glob values such as `"./lib/**/*"`. Everything else is unchanged: block comments are still stripped only when the file carries a docblock (#B568)
+* A `preOpen: true` popin opened through the declarative `data-gina-dialog` trigger with the default (modeless) modal resolution now reaches `isOpen = true`. The loading shell is born modal, which sets the dialog element's `open` attribute to the empty string; `popinOpen` guarded its own open call with `getAttribute('open')`, which reads that empty string as absent, so on the modeless path it called `show()` on an already-modal dialog, the engine threw `InvalidStateError`, and the popin stayed visibly open while the framework recorded it closed - `close()` returned early, `getActivePopin()` ignored it, and a form inside it was routed as outside any popin. The guard now uses `hasAttribute('open')`, so both open calls are skipped for a shell-opened dialog; a modeless-declared popin that was pre-opened keeps the shell's modal presentation, as it did before (#B574)
+* A form or link whose `text/html` answer is loaded into a popin now gets its DECLARED callback: `data-gina-form-event-on-submit-success` and `data-gina-link-event-on-success` are bound to the `.hform` / `.hlink` companion channels, and the popin branch of both XHR handlers returned after the bare `success.<id>` event, so a form inside a popin never saw its declared success callback run (only a programmatic `success.<id>` listener did). The companion now fires there too, with the parsed xhr-data as its payload, and `$form.eventData.success` is set as on every other path (#B571)
+* A form's `text/html` XHR answer is now routed by the popin the SUBMITTING form is rendered in, resolved by containment at submit, never by "the active popin". A page form whose answer arrived while a popin was open had that popin's content replaced by the answer; arriving while a popin was still loading (reachable through a trigger opted out of preload, a programmatic load, or a click before the hover warm - not through a hovered default trigger) it raised a false `422` error callback, `Popin x is not open !`, after a successful server write; and with two popins open the answer landed in whichever open one had been registered first. The answer of a form that is not inside a popin is delivered to its own handler unchanged; a form inside a popin still loads its answer into that popin, and `popinLoadContent` now loads into the popin it is called on. `getActivePopin()` returns open popins only. In dev mode a console notice names the popin the former rule would have targeted (https://github.com/gina-io/gina/issues/76)
+* A form or link whose `text/html` answer is loaded into a popin no longer raises a false `422` outside dev mode. The two hidden inputs the popin branch parsed (`gina-without-layout-xhr-data` / `-view`) are spliced by the server only when `NODE_ENV_IS_DEV` is true, so on any other boot the branch dereferenced an absent element, the error callback ran with a `TypeError` message after a successful server write, and the popin was never loaded. Both branches now go through one tolerant parse: the popin loads, the callback receives the parsed data in dev mode and an object carrying `status` otherwise (#B575)
+* An `<name>.<env>.json` configuration overlay now wins on every key it declares. It was previously folded in before its base file and lost to it on any key both declared, so an environment-only key was added but an actual override was silently dropped — the opposite of what the reference pages have always described. Two consequences are observable and worth checking before upgrading: an overlay array now REPLACES the base array instead of being unioned into it, and a `null` in the overlay overrides the base value. Bundles with no overlay file are unaffected. This is the per-bundle configuration loader only; the `settings.*` template path is a separate mechanism and is unchanged.
+* A `text/html` form answer whose top-level elements are table rows or cells no longer loses them. The answer was parsed as a whole document, so the HTML parser moved a top-level `<tr>` or `<td>` out of existence and a swap into a `<tbody>` wrote the cell text instead of the row, while a `data-gina-form-select` on `tr` matched nothing. The answer is now parsed as a fragment, so any element survives at the top level; a full-page answer drops its `<head>` rather than placing its `<title>` in the swap. Behaviour is byte-identical for answers that were already parsed correctly (#B578)
+* A popin constructed with `preOpen: true` now treats the time between its loading shell showing and its content landing as an explicit state, `isLoading`, instead of a half-state nothing could name. Five things went wrong in that window: `loadContent()` on the popin threw `is not open !` for the whole round trip; `close()` returned without closing, so the shell could not be dismissed programmatically; a load that failed fired `error` and left the skeleton showing with nothing to dismiss it; a native Escape closed the dialog behind the plugin's back, and the content landing afterwards ran the real open and re-opened the dialog the user had just dismissed (measured on the published bundle); and the close-time teardown keyed on a class a dialog shell never carries. Now `loadContent()` on a loading popin injects into the dialog and completes the open, so `open` fires once, from that completion, and content still in flight lands afterwards as any later `loadContent()` would; `close()` and `destroy()` on a loading popin cancel the load (a transport still in flight is aborted, and a cancelled load fires no `error`), tear the shell down, release the trigger and fire `close`, so a dismissed dialog never comes back when its content arrives; the native `close` listener is bound when the shell shows, so an Escape during the load takes that same path; and a load that fails fires `error` first, so a listener that calls `loadContent()` keeps the dialog with its own content, then closes the shell if nothing handled it. A popin without `preOpen` shows nothing while it loads and never enters the state. Three visible changes: `loadContent()` no longer throws while the popin is loading, a loading popin closes, and a failed load closes its shell unless an `error` listener loaded content into it. `getActivePopin()` still returns open popins only, so a loading popin is not the active one (https://github.com/gina-io/gina/issues/76)
+* Loading new content into a popin that is already open — `gina.popin.load(name, url)` on an open `data-gina-dialog` popin — no longer leaves the dialog empty. The landing wrote the new body and then fired the popin's `loaded` event with the popin object as its detail, the form of that event the legacy trigger's listener only binds on; the declarative trigger's listener applied the detail as if it were the body, and a body that is not a string is applied as nothing, so the content just written was wiped a moment later, with no error anywhere. That listener now applies nothing for a non-string detail, and the body written by the reload stays. Legacy `data-gina-popin-*` triggers were never affected. Present in every published version since 0.4.6, which introduced the declarative AJAX path (#B579)
+* A malformed `data-gina-dialog-target` value no longer throws: `applyContent` guards the one read the selector engine can refuse, so a selector such as `#slot >` takes the documented fallback (a full replace of the dialog) instead of an uncaught `SyntaxError` inside the loaded-content and preload-consume handlers, which left the popin without its content and the open never fired (#B580). The partial swap's two silent fallbacks are now announced in dev mode, one `console.warn` per event naming the popin, the selector and which fallback ran: a selector matching nothing in the OPEN DIALOG falls back to a full replace (as documented), and a selector matching nothing in the ANSWER writes the whole answer body into the slot - the second fallback existed before but was undocumented. Production output is unchanged: the notices are gated on `gina.config.envIsDev`, and every fallback keeps the behaviour it had. The attribute keeps its plain-selector grammar on purpose: one selector runs on BOTH sides of the swap - it locates the slot in the dialog and the region in the answer - which makes it the dialog-scoped sibling of `data-gina-form-select`, not of `data-gina-form-target`; there is nothing to resolve relative to an element, so the `this` / `closest` / `find` grammar does not apply to it, and the four keywords are valid CSS that would silently match nothing anyway. Restart and re-bake (the browser bundle changed).
+* A page form's staged upload is now placed with its own form. Which popin, if any, a chosen file belongs to is decided by containment - the popin the real form is inside, captured once at selection - never by "some popin is open" (#B572). Before, a file input in a page form whose file was chosen while an unrelated popin was open - through the file-picker race (a popin opening while the OS picker is already up) or a script assigning `input.files` - had its virtual `gina-upload-*` form appended inside that popin: the staging POST succeeded, none of the generated hidden metadata fields reached the form, the form then saved without the file, and the staging request carried that popin's `X-Gina-Popin-Id`. Nothing reported it. A form rendered inside a popin keeps the popin placement it always had. In dev mode the console now names the popin the former rule would have used. Restart and re-bake (the browser bundle changed).
+### Security
+* The built-in error pages now HTML-escape every value they render. A crafted link to any route whose action redirects - carrying a query string such as `?error=<script>...` - made the fallback error page reflect that value as markup and execute it in your application's origin, in every scope and on every released version; a newly scaffolded bundle, which configures no `errorFiles`, hit exactly that page. The same escaping is applied to the engine-level error page (whose text is built from the request path by its 404, 403 and 500 callers) and to the three nunjucks error-document fallbacks. Behaviour change: an application that deliberately passed HTML in an error title or message now sees it escaped - that reflection was the vulnerability. The scope gate on stack traces is unchanged (#B554).
+* `self.redirect()` no longer lets a request parameter decide whether the redirect happens. A key named `error` in the incoming query string or request body was read as an instruction to raise an error, so any unauthenticated request to any route whose action redirects could force a 500 by adding `?error=` - on both engines, with no route opt-in, and in every released version. An EMPTY value was worse: the empty string is falsy, so the late-call guard inside `throwError()` mistook it for a call on an already-released response, logged "ignoring late error:" with nothing after the colon and returned without writing anything, leaving the request unanswered for as long as the client held the connection - and nothing reaps that, because `server.timeout` defaults to 0 so that SSE and WebSocket responses are not cut off. The key is now an ordinary parameter: it rides the redirect in `inheritedData` like every other one, which is what the documented "carrying request data across the redirect" example always described - that example could not work as written while the gate stood (#B559).
+* Credentials no longer ride a redirect. `self.redirect()` carries the request's parameters to the redirect target - on the session as `inheritedData`, or in the target URL when the bundle has no session - and for a `POST` that container is the parsed body verbatim, so a login form's plaintext password was carried with it. On the session that meant the password was written to the session store, where on an authenticated flow it survived the redirect target's own request; where the bundle has no session it meant the password appeared in the redirect URL, and so in access logs, proxy logs, browser history and any `Referer` the target sends onward. A rejected login attempt was carried the same way. Fields whose names match the framework's existing redaction list - the same maintained, tokenising matcher the Inspector uses to mask these values in its own pane, covering `password`, `secret`, `token`, `apikey`, `authorization`, `credentials` and their case and separator variants - are now dropped from what is carried, while everything else travels exactly as before; keys describing rules or configuration, such as `passwordRules`, are deliberately still carried. Behaviour change: an application that deliberately carried a field with one of those names across a redirect no longer receives it at the target and should pass it by another route (#B551).
+* Over HTTP/2, a static file served by the built-in engine no longer carries another request's response headers (#B566). The first static request after boot registered a byte-serving listener on the server that kept that request's response object for the life of the process and served every later static through it, folding the captured response's headers — its `Set-Cookie`, its request id and its CORS headers among them — onto every other client's stream. Any middleware that sets a per-request header eagerly (the framework's own CSRF plugin does) turned that into a cross-user cookie delivery. The same listener served an HTML static it had not seen before as a raw binary, and once a directory URL had been requested it answered that directory's index URL with a destroyed stream for the rest of the process's life. The listener and its server-push branch are removed: every HTTP/2 static is now served by the static handler on the request's own response, so it carries that request's headers, the dev `cache-control: no-store` set and the production `ETag`/`Last-Modified` with `304` support that the listener path never emitted. HTTP/2 server push, which browsers no longer support and which only a push-capable client could reach, is no longer implemented. Every published version is affected. HTTP/1.1 was never affected. Pickup: a bundle restart; no rebuild.
+
 ## 0.6.31 - 2026-09-14
 ### Added
 * RFC 9218 request priorities (#H12): `req.priority` is parsed on both engines from the `Priority` header — urgency 0–7 (default 3) and the incremental flag, with out-of-range, wrong-type or malformed values ignored exactly as the RFC requires — `self.query()` and `self.forward()` propagate a present inbound priority to the target bundle (a caller-set `headers.priority` wins, `priority: false` suppresses, an explicit `priority` option is sent normalized), `self.setPriority()` emits the response header, and `self.startJob(fn, { urgency })` orders the async-job queue: the worker always starts the lowest-urgency queued job first, FIFO within a class, a retried attempt keeps its urgency, and the value is never inherited from the request — an action passes it explicitly. The header is advisory and client-supplied: the framework carries the signal, it never reorders response writes.

package/README.md

@@ -25,9 +25,9 @@ MVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architectur
 | Connectors | Couchbase, MongoDB, ScyllaDB / Cassandra, MySQL, PostgreSQL, Redis, SQLite, AI (LLM) — loaded from project `node_modules` |
 | AI connector | Any LLM provider via named protocol (`anthropic://`, `openai://`, `ollama://`, …) — unified `.infer()`, token streaming via `.stream()`, inference-as-a-job via `self.inferAsync()` |
 | Template engine | [`@rhinostone/swig`](https://github.com/gina-io/swig) — maintained fork with CVE-2023-25345 patched; streaming SSE/chunked via `renderStream()`. Nunjucks supported as opt-in via `render.engine = "nunjucks"` or per-section `"ext": ".njk"` |
-| Forms & validation | One rule engine for client and server — live checks, cross-field rules, ARIA states, localised messages; the server enforces the same rules on submit |
+| Forms & validation | One rule engine for client and server — live checks, cross-field rules, ARIA states, localised messages; the server enforces the same rules on submit. A form can swap its HTML answer into any element of the page, htmx-style (`data-gina-form-target` / `-swap` / `-select`), and update elements elsewhere out of band (`data-gina-swap-oob`); the server can retarget, reswap or reselect that answer with `X-Gina-Retarget` / `-Reswap` / `-Reselect` response headers. Two answers replacing the same region coordinate on their own — derived from the swap strategy, with no attribute to write — and `data-gina-form-sync` overrides that where it is wrong, while `data-gina-form-disabled-elt` holds controls disabled for the life of a request |
 | DTOs | `gina.dto` schema builder — request validation with localised 422s (`param.dto`), response shaping (`param.responseDto`), JSON Schema export |
-| Sessions | Hardened session plugin (SameSite / HttpOnly / Secure defaults) — Redis, SQLite, MongoDB, Couchbase, and ScyllaDB stores; session-id rotation on login, opt-in absolute timeout, record destroyed on logout |
+| Sessions | Hardened session plugin (SameSite / HttpOnly / Secure defaults) — Redis, SQLite, MongoDB, Couchbase, and ScyllaDB stores; session-id rotation on login, per-bundle login and remember-me cookie lifetimes from `security.json`, opt-in absolute timeout, record destroyed on logout |
 | File uploads | Multipart via the maintained [`@rhinostone/busboy`](https://github.com/gina-io/busboy) fork — named upload groups with per-group extension allow-lists, size / count limits, and target dirs |
 | Object storage | `gina.storage()` — named drivers pairing an adapter (`local` filesystem, or `s3` for any S3-compatible provider with its SDK as a project-side dependency) with a key strategy behind opaque keys: `sharded` (dated), `cas` (content-addressed, deduplicating, refcounted, GC-swept) and `stream` (large media, resumable out-of-order segment uploads); size tiering, HTTP Range serving (`serveFromStorage()` — 206/416/304, strong key ETags), presigned-URL offload (307) on `s3`, embedded SQLite or Couchbase metadata store, `storage:stats` / `gc` / `verify` CLI |
 | Async jobs | `self.startJob()` background jobs — durable SQLite / MongoDB / Redis stores, retries with backoff, HMAC-signed completion webhooks, `/_gina/jobs/:id` status endpoint |
@@ -35,6 +35,7 @@ MVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architectur
 | Authentication | `lib.authn` primitives — scrypt password hashing as self-describing PHC strings (argon2 / bcrypt verify-only for migration), NIST SP 800-63B policy, enumeration-safe `dummyVerify`, PCI-DSS account lockout, RFC 6238 TOTP |
 | Route authorization | `requireAuth` / `roles` / `policy` per route or deny-by-default, login bounce with `resumeRequest()`, `self.hasRole()` |
 | Rate limiting | Opt-in identified-caller quotas at the router (#MS6) — fixed-window counters over the KV primitive (per-process, or replica-shared via redis/sqlite), per-route overrides/exemptions, 429 + `Retry-After` + draft `RateLimit` header fields; anonymous flood control stays at your edge by design |
+| Maintenance mode | Opt-in `server.maintenance` (#MAINT1) — every request answered 503 + `Retry-After` before statics, cache and routing while `/_gina/*` stays reachable; topology-neutral bypass (`x-gina-maintenance-key` header, or a one-shot query grant minted into a signed cookie) plus a non-proxied IP allowlist; runtime toggle `POST /_gina/maintenance` with a dead-man `ttlSeconds`, `GINA_MAINTENANCE` to boot closed, and replica coherence through a shared KV namespace (`store`) |
 | Audit trail | Opt-in append-only JSONL audit log (`self.audit()`), authorization denials auto-recorded, always-on request ids; opt-in HMAC hash chain verified offline by `gina audit:verify` |
 | CSRF protection | Signed double-submit token middleware + Origin/Referer pre-filter + hardened session cookie |
 | Security headers | CSP with per-response nonces, HSTS, COOP / COEP / CORP, Referrer-Policy and the X-* family — per-header plugins or one `SecurityHeaders` wrapper |
@@ -52,7 +53,7 @@ MVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architectur
 | K8s ready | `gina-container`, `gina-init`, SIGTERM drain, JSON stdout logging |
 | Container tooling | `image:build` synthesizes an OCI image (buildah), `image:run` / `container:ps` / `container:stop` (podman) — local or over SSH |
 | Dependency injection | Mockable connectors and config for unit testing |
-| Runtime | Node.js 22–26, or **Bun** (`bun add -g gina`) — install + boot validated end-to-end by a CI Bun smoke |
+| Runtime | Node.js 22–26, or **Bun** (`bun add -g gina`) — install + boot validated end-to-end by a CI Bun smoke, and the unit suite runs under `bun test` in CI behind an expected-failures gate |
 
 ## Quick start
 
@@ -66,32 +67,68 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.31
+## What's in 0.6.32
 
-> **Restart your bundles *and* rebuild them.** The validator's shared rule
-> engine ships in the browser bundle and one of this release's security fixes
-> touches it, so `gina.min.js` changed and `gina bundle:restart` alone leaves
-> the old client running. Rebuild each consuming bundle, then restart.
+> **Restart your bundles *and* rebuild them.** Seventeen of this release's
+> commits are browser-bundled — the whole form-answer arc, the popin fixes and
+> the validator changes — so `gina.min.js` changed and `gina bundle:restart`
+> alone leaves the old client running. Rebuild each consuming bundle, then
+> restart.
 
-> **No settings reset.** `0.6.31` is a patch — the `shortVersion` stays `0.6`,
+> **No settings reset.** `0.6.32` is a patch — the `shortVersion` stays `0.6`,
 > so your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**The availability release.** Two security fixes lead: a request carrying a
-top-level field named `count` could terminate the bundle process —
-unauthenticated, one request, on any URL, in every published version — and a
-queued async job could run inside another request's context. Alongside them,
-RFC 9218 request priorities arrive on both engines, a Couchbase connector that
-cannot reach its cluster at boot now says so instead of hanging until the CLI
-kills the bundle, and one bundle without a release `config/` no longer moves
-every other bundle's configuration root. Full detail in
-[CHANGELOG.md](./CHANGELOG.md).
-
-- **Security — a request field named `count` no longer terminates the bundle (#B546).** gina installs a `count()` helper on `Object.prototype`, and the framework reached it as `<container>.count()` on containers whose keys the client chooses — the parsed body, the query bag, route params, uploaded files. An own property of that name shadowed the helper, so the framework called a string: a 500 on the body branches, an `uncaughtException` that exited the process on the query branches, and a request left hanging open on a route param. Every published version was affected. The framework now reaches the helper through a form no own property can shadow; application code calling `x.count()` is untouched.
-- **Security — a queued async job runs inside a detached copy of its creator's context (#B543).** The worker pumps its queue from the settle chain of the job that just finished, so under load a job created by one request ran inside the context of whichever request's job had freed the slot: a URL it built through `getRoute().toUrl()` used the other request's host, a failure it raised through the global `getConfig()` / `getLib()` was written to the other request's response, and its JSON log lines carried the other request's id. A job now captures the creating request's identity and proxy context — never `req`, `res` or `next` — and runs its whole lifecycle inside that copy.
-- **Added — RFC 9218 request priorities (#H12).** `req.priority` is parsed on both engines from the `Priority` header (urgency 0–7, the incremental flag; malformed values ignored as the RFC requires), `self.query()` and `self.forward()` propagate it to the target bundle, `self.setPriority()` emits the response header, and `self.startJob(fn, { urgency })` starts the lowest-urgency queued job first. The header is advisory: the framework carries the signal and never reorders response writes.
-- **Fixed — a Couchbase connector that cannot reach its cluster at boot fails loudly (#B541).** Every failure path in `connect()` re-armed a retry without ever emitting `ready`, so the model layer's ready gate never closed and `bundle:start` killed the bundle after roughly 64 seconds with nothing logged. `init()` now arms its own deadline (`readyTimeout` per `connectors.json` entry, default 50000 ms) and reports the failure itself; a single failed attempt also reports once rather than twice. Both SDK v3 and v4 connectors.
-- **Fixed — a bundle without a release `config/` no longer moves every other bundle's configuration root (#B542).** The source-tree fallback wrote that bundle's own directory into the process-wide `bundles` path and reassigned the shared loop variable, so a later, healthy bundle silently loaded its source config in production, or died on a spliced path. The fallback is now scoped to the bundle it recovers, the three config-directory refusals name the bundle and the environment, and an aborted initialisation reports its retained reason instead of an opaque `TypeError`.
-- **Fixed — two dead external references refreshed.** The X-Permitted-Cross-Domain-Policies plugin and the Couchbase connector each cited a page that no longer serves the document; both now point at the live copy. Documentation only.
+**The form-answer release.** A form's HTML answer can now land anywhere in the
+page — htmx-style `data-gina-form-target` / `-swap` / `-select`, out-of-band
+elements, three server-side override headers — and two forms answering into one
+region no longer race. Where a popin is involved, the answer is routed by the
+popin the form is *inside*, never by whichever popin happens to be open, which
+closes the routing defect behind
+[gh#76](https://github.com/gina-io/gina/issues/76) and a run of popin edge cases
+with it. Four security fixes lead the rest: credentials no longer ride a
+redirect, the built-in error pages escape what they render, a request parameter
+can no longer force an error or hang a request, and an HTTP/2 static no longer
+carries another request's headers. Alongside: the HTTP/2 render path now runs a
+session middleware's hooks, maintenance mode can be armed from the environment
+and kept coherent across replicas, an environment config overlay wins over its
+base file, and per-bundle login session lifetimes are read from `security.json`.
+Full detail in [CHANGELOG.md](./CHANGELOG.md).
+
+- **Security — credentials no longer ride a redirect (#B551).** `self.redirect()` carried the request's parameters to the target — the parsed body verbatim for a `POST`, so a login form's plaintext password was written to the session store, or placed in the redirect URL on a session-less bundle. Fields matching the framework's redaction list (`password`, `secret`, `token`, `apikey`, `authorization`, `credentials` and their case and separator variants) are now dropped from what is carried; everything else travels exactly as before.
+- **Security — the built-in error pages escape every value they render (#B554).** A crafted link to any route whose action redirects — `?error=<script>…` — made the fallback error page reflect the value as markup and execute it in your application's origin, on every released version; a newly scaffolded bundle, which configures no `errorFiles`, hit exactly that page. The engine-level error page and the three nunjucks fallbacks are escaped the same way.
+- **Security — a request parameter can no longer decide whether a redirect happens (#B559).** A key named `error` in the query string or body was read as an instruction to raise an error, so any unauthenticated request to any redirecting route could force a 500 — and an empty value left the request unanswered for as long as the client held the connection. The key is now an ordinary parameter and rides the redirect in `inheritedData`.
+- **Security — an HTTP/2 static file no longer carries another request's response headers (#B566).** The first static request after boot registered a byte-serving listener that kept its response object for the life of the process and folded that response's headers — its `Set-Cookie` included — onto every later client's stream, served unseen HTML as raw binary, and answered a directory's index URL with a destroyed stream for the rest of the process's life. The listener and its server-push branch are removed; every HTTP/2 static is served on the request's own response, with the `ETag` / `304` support that path never emitted.
+- **Added — a form can swap its HTML answer into any element of the page (gh#76).** Three attributes on the `<form>`: `data-gina-form-target` (the `hx-target` grammar), `data-gina-form-swap` (nine strategies, `innerHTML` by default) and `data-gina-form-select`; a target or strategy that cannot be honoured refuses the submit before anything is sent, and `beforeswap` / `afterswap` bracket the main swap. A declared target wins over the popin the form is in.
+- **Added — an answer can update elements anywhere in the page, out of band (gh#76).** Any element of the answer carrying `data-gina-swap-oob` is swapped into the page element with the same `id` (htmx's `hx-swap-oob`), on all three answer paths; the success payload gains `oob` and `remainder`, and an answer without the attribute takes exactly the path it did before.
+- **Added — a server can retarget, reswap or reselect a form's HTML answer (gh#76).** `X-Gina-Retarget`, `X-Gina-Reswap` and `X-Gina-Reselect` override the form's declared attributes at settle, and are honoured only from a response whose origin is the page's own; a Retarget that cannot be resolved means no swap at all, reported to the success callback with `swapped: false`, never an error.
+- **Added — `GINA_MAINTENANCE` boots a bundle with maintenance mode on.** `GINA_MAINTENANCE=1` closes the gate at boot exactly as `server.maintenance.enabled: true` would — for replacement pods created during a window — and can only close a bundle, never open one; `GET /_gina/maintenance` reports `source: "env"` for such a closure.
+- **Added — maintenance mode stays coherent across replicas through a shared kv namespace.** Point `server.maintenance.store` at a declared kv namespace and every `POST /_gina/maintenance` is written there and polled by each process (`pollInterval`, default 2000 ms); a store outage freezes each replica in its last-known state and never reopens a closed site.
+- **Added — the maintenance status payload carries `pid` and `hostname`.** The runtime override was always per process; the two fields let an operator fanning a `POST` out over replicas read back which ones applied it, and that per-process contract is now stated on the guide, the schema and `llms.txt`.
+- **Added — per-bundle login session lifetimes from `security.json`.** `session.expires` and `session.remember` — unit-suffixed duration strings — set the cookie lifetime `req.login()` applies for an ordinary and a remembered login. Both keys were documented but interpreted by nothing until now, so a value already there that is not a duration string is reported at boot and ignored, never fatal.
+- **Added — `lib.duration.parse()`, one parser for unit-suffixed durations.** The parser `lib/storage` already used for its interval keys, promoted to a registry entry so every configuration key naming a span of time shares one dialect (`"500ms"`, `"30s"`, `"15m"`, `"3h"`, `"15d"`; the unit is required and a bare number is refused).
+- **Added — a `commit-msg` git hook for contributor clones.** It keeps local-tool configuration paths and attribution mentions out of commit messages — the one surface no hook had scanned — and reaches a clone through the `core.hooksPath` that `post_install` already installs. Not part of the published package.
+- **Changed — the popin context a request carries is decided by containment, not by "the active popin" (gh#76).** The `X-Gina-Popin-Id` / `-Name` headers, `self.isPopinContext()` and a popin-style XHR redirect are produced only for a form rendered inside a popin; a page form's `location` redirect navigates the page; `getActivePopin()` returns open popins only, the most recently opened first; a name-less `popin: { close: true }` with nothing open is a no-op.
+- **Changed — two form answers replacing the same region no longer race (gh#76).** When a form's swap replaces its target, a newer submit into the same target supersedes the request still in flight (a new `abort` event with `reason: 'superseded'`, never the `error` channel); insertion swaps still both land. `data-gina-form-sync` (`replace`, `drop`, `queue`) overrides the derived decision and `data-gina-form-disabled-elt` holds elements disabled for the life of a request. Superseding cancels the client's wait, not the server's work — never read it as "not saved" and resubmit.
+- **Changed — a navigated fragment's forms are bound only when they opt in (gh#76).** Fragment navigation binds the swapped region through the shared `bindRegion()` policy, so a bare id-bearing form inside a navigated fragment keeps its native submit unless it carries a `data-gina-form-*` attribute or an id naming a rule.
+- **Fixed — a form's HTML answer is routed by the popin the submitting form is in (gh#76).** A page form's answer arriving while a popin was open replaced that popin's content; arriving while a popin was still loading it raised a false `422` after a successful server write; with two popins open it landed in whichever had been registered first. Containment at submit decides now, and `popinLoadContent` loads into the popin it is called on.
+- **Fixed — a form or link answering into a popin runs its declared success callback (#B571).** The popin branch returned after the bare `success.<id>` event, so `data-gina-form-event-on-submit-success` and `data-gina-link-event-on-success` never ran there.
+- **Fixed — a pre-opened popin's loading shell is a state you can close, load into, or lose to a failed load (gh#76).** `isLoading` covers the round trip between the shell showing and the content landing: `loadContent()` no longer throws, `close()` and `destroy()` cancel the load and tear the shell down, an Escape during the load takes that same path instead of a dialog that reopens when its content arrives, and a failed load closes the shell unless an `error` listener loaded content into it.
+- **Fixed — a pre-opened popin opened modeless reaches its open state (#B574).** `popinOpen` guarded its open call with `getAttribute('open')`, which reads the shell's empty-string attribute as absent, so `show()` threw `InvalidStateError` and the popin stayed visibly open while the framework recorded it closed.
+- **Fixed — a popin answer outside dev mode no longer reports a false 422 (#B575).** The two hidden inputs the popin branch parsed are spliced only when `NODE_ENV_IS_DEV` is true; both branches now go through one tolerant parse.
+- **Fixed — an HTML answer whose top-level elements are table rows or cells keeps them (#B578).** The answer is parsed as a fragment rather than a whole document, so a top-level `<tr>` or `<td>` survives and a swap into a `<tbody>` writes the row, not the cell text.
+- **Fixed — reloading an open popin no longer blanks it (#B579).** The declarative trigger's `loaded` listener applied the event detail — the popin object — as if it were the body, wiping the content just written; present since `0.4.6`.
+- **Fixed — a malformed `data-gina-dialog-target` falls back instead of throwing (#B580).** A selector such as `#slot >` takes the documented full-replace fallback rather than an uncaught `SyntaxError`, and both silent fallbacks are now announced in dev mode.
+- **Fixed — a page form's staged upload is placed with its own form (#B572).** Which popin a chosen file belongs to is decided by containment, captured once at selection, never by "some popin is open" — before, a file chosen while an unrelated popin was open had its virtual upload form appended inside that popin and the form then saved without the file.
+- **Fixed — the client validator binds only the forms a page opted in (#B549).** Declaring a single rule file used to make every form on every page an always-XHR submit, plain login and signup forms included. Behaviour change: an implicitly bound form now submits natively unless it carries a `data-gina-form-*` attribute or matches a rule.
+- **Fixed — a date field no longer submits the previous day east of UTC (#B558).** `isDate` wrote a `Date` object into the payload, which `JSON.stringify` renders as a UTC instant — the previous day in any positive offset. The payload now takes a plain `yyyy-mm-dd` string, matching the schema the framework already published; breaking for anything that read `req.body.<field>` as a `Date`.
+- **Fixed — an XHR redirect over HTTP/2 delivers the session cookie it rotated (#B550).** `redirect()`'s XHR and popin exits answered on the raw HTTP/2 stream, so a session middleware's `on-headers` cookie and save-on-end never fired and a user signed in immediately before the redirect arrived unauthenticated. Both exits terminate through the compat response, and the router's `inheritedData` consume persists itself.
+- **Fixed — a session survives an ordinary HTTP/2 render (#B562).** A transparent base `writeHead` / `write` / `end` is installed before the middleware chain and the six buffering render delegates hand their send to it, so a `rolling` cookie rolls and a mutation made while rendering is persisted; statics stay on the raw stream deliberately and `renderStream()` is unchanged.
+- **Fixed — an HTML file in `public/` no longer answers 500 on a bundle without templates (#B567).** The dev-mode loader injection read a `content.templates._common` block that an API-only bundle never has.
+- **Fixed — an environment config overlay now overrides its base file.** A `<name>.<env>.json` overlay was folded in before its base and lost to it on every shared key — the opposite of what the reference pages described. It now wins; an overlay array replaces the base array and a `null` overrides. Read your overlays before upgrading.
+- **Fixed — two connectors in one bundle no longer fight over an entity class name (#B555).** The process-wide entity table was keyed on the bare class name, so the connector whose connection became ready second was handed the first one's instance. It is keyed per bundle, model and class now, and a bundle whose declared entity did not reach its model refuses to start instead of serving a half-built model layer.
+- **Fixed — a JSON config with a docblock and an unterminated `/*` in a string value no longer hangs the boot (#B568).** `requireJSON`'s block-comment strip backtracked about twice per line after a glob or certificate path such as `"…/ssl/*.example.pem"`, hanging the boot until the start-wait killed it with nothing logged; the strip is now a linear, string-aware scan.
+- **Fixed — `self.throwError()` answers the request when called with a falsy value (#B560).** The late-call guard tested the one-argument form's payload for truthiness, so `self.throwError(err)` with `''`, `null`, `undefined`, `0` or `false` was mistaken for a call on a released response and the request was never answered; it now renders a 500 like any other.
+- **Fixed — the storage metadata store no longer runs an application callback inside its own try/catch (#B565).** Seven methods swallowed an error thrown by the callback and then invoked it a second time with the application error presented as a store error, so a first-settle latch such as the content-addressed driver's `verify()` hung; callbacks now run after the try on every path.
 
 
 ## Documentation

package/ROADMAP.md

@@ -83,6 +83,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.29` ✅ | **Security**: a failed Couchbase N1QL statement no longer carries its own result rows into the error it raises — the connector put the query service's whole response envelope, result documents included, on `error.stack` and `error.cause.http_body`, so a `RETURNING` statement that lost a CAS race or a SELECT that timed out part-way wrote the records it had already produced into any log that printed the error, with no interception point for a bundle; both now carry the envelope with `results` replaced by a row-count marker, while `errors`, `requestID`, `status`, `signature` and the classifier's `first_error_code`/`retry` are unchanged. **Added**: `bundle:build` and `project:build` gain an opt-in `--skip-unchanged` — a release whose source is byte-identical to what it was built from keeps its copy, signed by content rather than timestamps and recorded as `.gina-build.json`, with the manifest update, fingerprint stamp, `node_modules` link and both hooks still running and any doubt rebuilding. **Fixed**: a server-side field error reaches the visible control when a hidden twin of the same name comes first in document order; a path-form `getUrl` route containing `@` — the retina-asset idiom — no longer renders a 500 on either template engine; a staged upload no longer posts the literal `[object Object]` into a form that declares no `[preview][...]` sub-fields. Restart your bundles **and rebuild them** — two of the fixes are browser-bundled. |
 | **Q4 2026** | `0.6.30` ✅ | **Security**: the isolation release — a response rendered on the default swig path no longer carries a concurrent request's negotiated culture and webroot (50 of 50 concurrent pairs bled before the fix, 0 of 100 after); a later `util.promisify`-style caller of an entity method no longer receives an earlier call's record, which where the method reads a user-scoped row could pass an ownership check on another principal's data; and the error raised by the global `getConfig()` / `getLib()` helpers no longer writes its stack to the response, minting an incident `ref` and logging one full-detail line instead. **Changed**: `self.getConfig()` returns a per-call copy-on-write view of the configuration instead of a deep clone — reads pass through, your writes stay yours, and a route behind two middlewares reading `this.getConfig()` measured 14,719 ms → 1,884 ms per 3,000 requests. **Added**: log rotation for the logger's opt-in `file` container, and `gina tail` renders JSON when its logger's format is `json`. **Fixed**: bundle templates render through a per-bundle engine; a framework error is answered to the request that raised it rather than the most recently routed one; the server-side `query` validation rule no longer writes into the shared proxy configuration; the `file` container writes at all; and `gina-container` applies the container logging preset itself. |
 | **Q4 2026** | `0.6.31` ✅ | **Security**: the availability release — a request carrying a top-level field named `count` no longer terminates the bundle process (unauthenticated, one request, on any URL including one matching no route; every published version was affected), and a queued async job runs inside a detached copy of the request context that created it instead of whichever request's job freed the worker slot. **Added**: RFC 9218 request priorities — `req.priority` on both engines, propagation through `self.query()` / `self.forward()`, `self.setPriority()`, and urgency-ordered async jobs. **Fixed**: a Couchbase connector that cannot reach its cluster at boot reports the failure instead of hanging until the CLI kills the bundle; one bundle without a release `config/` no longer moves every other bundle's configuration root, and the config-directory refusals name the bundle; two dead external references refreshed. Restart your bundles **and rebuild them** — the `count` fix touches the validator's shared rule engine, which is browser-bundled. |
+| **Q4 2026** | `0.6.32` ✅ | **Security**: the form-answer release's four fixes — credentials no longer ride a redirect (the request's `password` / `secret` / `token`-class fields are dropped from what `self.redirect()` carries); the built-in error pages HTML-escape every value they render (a reflected XSS through `?error=` on any redirecting route, every released version); a request parameter named `error` can no longer force a 500 or leave the request unanswered; an HTTP/2 static file no longer carries another request's response headers. **Added**: htmx-style form answers — `data-gina-form-target` / `-swap` / `-select`, out-of-band `data-gina-swap-oob` elements, and the `X-Gina-Retarget` / `-Reswap` / `-Reselect` response headers (same-origin only); the `GINA_MAINTENANCE` boot variable and replica-coherent maintenance mode through a shared kv namespace, with `pid` and `hostname` on the status payload; per-bundle login session lifetimes from `security.json` on top of the new `lib.duration.parse()`; a contributor `commit-msg` hook. **Changed**: popin context by containment rather than by the active popin; two form answers replacing one region no longer race (the newer submit supersedes); a navigated fragment's forms bind only when they opt in. **Fixed**: the gh#76 routing defect and its popin family (declared callbacks on the popin branch, the pre-open loading state, the modeless guard, the false 422 outside dev, table-row answers, reload blanking, malformed dialog targets, staged uploads placed by containment); the validator binds only opted-in forms; a date field no longer submits the previous day east of UTC; an XHR redirect and an ordinary render over HTTP/2 run the session middleware's hooks; an HTML static on a template-less bundle; an environment config overlay now overrides its base; two connectors sharing an entity class name; a glob path in a docblock-bearing JSON config no longer hangs the boot; `throwError()` with a falsy payload; the storage metadata store's callback isolation. 35 fragments; restart **and rebuild** — 17 commits touch the browser bundle. |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities ✅ shipped early in `0.6.31` (the `Priority` header half — read, propagated, emitted, job urgency; response ordering stays blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`; the per-request configuration view — `getConfig()` without the deep clone — landed for the next `0.6.x` cut) |
 | **2027** | `0.8.0` | ⚠️ **Delivered early — this content shipped in `0.6.25` (2026-09-03)**: XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys. No committed content remains against this milestone; re-scope before planning around it. |
@@ -478,7 +479,7 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | --- | --- | --- | --- | --- |
 | ✅ | **`NODE_COMPILE_CACHE` — V8 bytecode startup cache** | `0.2.0` | Q2 2026 | Node.js 22.8+ caches compiled V8 bytecode to disk. Set once at startup — 30–60% faster cold start on subsequent runs with zero code changes to user bundles. No-op on Node < 22.8, so safe to ship unconditionally. |
 | ✅ | **Route radix trie — compile `routing.json` at startup** | `0.3.0-alpha.1` | 2026-04-01 | `lib/routing/src/radix.js` builds a segment-level trie once at startup. O(m) candidate lookup per request (m = segment count). `Set.has()` check skips non-candidates in the `for…in` loop. Internal change — no user-facing API change. |
-| ✅ | **Bun runtime support** | `0.5.5` | 2026-06-21 | Gina runs on the [Bun](https://bun.sh) runtime (Bun `>= 1.2`) as a supported, CI-gated target — `bun add -g gina` installs and boots end-to-end, validated by a blocking CI Bun smoke. Both investigated blockers cleared: dev-mode `require.cache` hot-reload and `node:http2` work under Bun (one upstream gap remains: RFC 8441 extended-CONNECT advertisement, affecting only opt-in WebSocket-over-HTTP/2). Gina self-bootstraps on first run; Node `>= 22 < 27` remains fully supported. |
+| ✅ | **Bun runtime support** | `0.5.5` | 2026-06-21 | Gina runs on the [Bun](https://bun.sh) runtime (Bun `>= 1.2`) as a supported, CI-gated target — `bun add -g gina` installs and boots end-to-end, validated by a blocking CI Bun smoke. Both investigated blockers cleared: dev-mode `require.cache` hot-reload and `node:http2` work under Bun (on Bun `< 1.4` one upstream gap remains: RFC 8441 extended-CONNECT advertisement, affecting only opt-in WebSocket-over-HTTP/2 — Bun 1.4 advertises it). Gina self-bootstraps on first run; Node `>= 22 < 27` remains fully supported. |
 | ✅ | **V8 pointer compression support** | `0.2.0` | Q2 2026 | Node.js built with `--experimental-enable-pointer-compression` (e.g. [node-caged](https://github.com/platformatic/node-caged) or a custom build) delivers ~50% heap memory reduction across all pointer-heavy structures. Gina is pure JS — compatible out of the box. Adds: startup detection + `GINA_V8_POINTER_COMPRESSED` env var, Dockerfile guide with custom build recipe (full-icu + pointer compression), 4 GB ceiling documentation, N-API-only connector policy. |
 | ✅ | **Runtime CPU profiling baseline** | `0.6.2` | 2026-07-31 | Shipped — a three-arm baseline (HTTP/2 render, concurrent multipart upload, WebSocket echo) profiled a production-built bundle under load. Outcome: the multipart-scan, WebSocket-unmask, and render/log-cleanup candidates below all measured small under their own arms and moved to measure-gated deferral, while the dominant cost found is per-request deep-clone traffic — half of render-arm CPU — plus per-item random-id minting (~1 ms per render), now planned as its own row below. "No further acceleration needed" was an accepted verdict shape, and for the byte-loop candidates it is the verdict. |
 | ⏸ | **Multipart boundary-scan fast path** | — | on demand | **Deferred — acquitted by the profiling baseline (2026-07):** the boundary scan measured 7.2% of upload-arm CPU (0.73 ms per MB, ~47 µs per 64 KB chunk) with the event loop far from saturated — the loop-relief win does not materialize at these magnitudes. Re-armed by a profiled workload where the scan is a leading loop consumer. Original scope, unchanged when re-armed: the multipart parser's boundary search is the one unbounded byte-by-byte JS loop on a request path; delegating the in-chunk needle search to the runtime's native `Buffer.indexOf` (JS keeps only the chunk-boundary carry) relieves the event loop under large concurrent uploads; wire and event contract unchanged; validated by differential tests against the current matcher. |
@@ -548,6 +549,7 @@ Gina's built-in per-bundle inspector. Phases 1–2 ship as an embedded SPA at `/
 | ✅ | **Tutorial locale detection** — `LocaleSettings` React component detects the reader's locale and timezone via `navigator.language` + `Intl` APIs and pre-fills the `settings.json` scaffold example. Inserted after the scaffold step in both tutorials. Falls back to `en_US`. | — | `0.3.0` | 2026-04-06 |
 | ✅ | **Intermediate — Link Shortener** — SQLite ORM connector, async controller actions, `render()` + `renderJSON()` in same bundle, HTTP 302 redirect, route `requirements` guard. Includes downloadable project ZIP. | ~30 min | `0.3.0` | 2026-04-01 |
 | ✅ | **Advanced — Going to Production** — Full production project: authentication, per-user data isolation, deny-by-default authorization, sessions, HTTP/2, structured logging, Docker/K8s deployment with `gina-container`. Continues the intermediate tutorial's finished state (downloadable). | ~60 min | `0.6.8` | 2026-08-14 |
+| ✅ | **Advanced — Make It Interactive** — The production shortener made interactive: a rule-bound form replacing hand-rolled `fetch`, a project-defined `isUrl` validation rule (browser-only — the action re-checks), a live hit counter streamed with `self.renderStream()` into an `<x-hits>` client component, and fragment navigation with `negotiate: true` + `data-gina-nav`. Continues the advanced tutorial's finished state (downloadable). | ~45 min | `0.6.32` | 2026-09-17 |
 
 ---
 

package/framework/v0.6.32/VERSION

@@ -0,0 +1 @@
+0.6.32