gina 0.6.31 → 0.6.32

package/framework/{v0.6.31 → v0.6.32}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -5579,7 +5579,38 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                     ) {
                         date = new Date(NaN);
                     }
-                    this.value = local.data[this.name] = date;
+                    // #B558 (2026-09-18) — the FIELD keeps the Date, the PAYLOAD
+                    // takes a date-only string. A Date is the one normalised type
+                    // that does not round-trip through JSON: JSON.stringify calls
+                    // toISOString(), which yields a UTC INSTANT whose date part is
+                    // a day EARLIER for every positive UTC offset, so a client east
+                    // of UTC submitted the previous day (driven: Europe/Paris
+                    // '2026-09-18' -> '2026-09-17T22:00:00.000Z'). Silent, because
+                    // the instant is well-formed — only a reader that slices the
+                    // string sees it.
+                    //
+                    // The Date stays on this.value so `format()` and the #B48
+                    // chaining contract still work; only local.data (the submitted
+                    // payload) changes. The components are read back with the
+                    // Date's LOCAL getters, which the round-trip check above has
+                    // already proven equal to the parsed input, so no timezone
+                    // enters the written value at all.
+                    //
+                    // The shape is always `yyyy-mm-dd` regardless of the input
+                    // mask: gina's own introspection already publishes an isDate
+                    // field as {type:'string', format:'date'} (RFC 3339 full-date,
+                    // NOT date-time), and the mask governs INPUT parsing, not the
+                    // wire. An invalid date is left exactly as it was, so the
+                    // error path below still sees an Invalid Date object.
+                    // was: this.value = local.data[this.name] = date;
+                    this.value = date;
+                    if ( isNaN(date.getTime()) ) {
+                        local.data[this.name] = date;
+                    } else {
+                        local.data[this.name] = date.getFullYear()
+                            + '-' + ('0' + (date.getMonth() + 1)).slice(-2)
+                            + '-' + ('0' + date.getDate()).slice(-2);
+                    }
                 }
 
                 if ( /Invalid Date/i.test(date) || date instanceof Date === false ) {
@@ -8811,28 +8842,35 @@ function handleXhr(xhr, $el, options, require) {
                         // if hasPopinHandler & popinIsBinded
                         if ( typeof(gina.popin) != 'undefined' && gina.hasPopinHandler ) {
 
-                            // select popin by id
-                            var $popin = gina.popin.getActivePopin();
+                            // #gh76 — the popin the clicked ANCHOR lives in ($el — never
+                            // $target, which is the link plugin's container on this path),
+                            // and only while it is open; a page link's HTML answer stays
+                            // with its own handler instead of being loaded into whichever
+                            // popin happened to be open.
+                            var $popin = ( typeof(gina.popin.getPopinContaining) == 'function' )
+                                ? gina.popin.getPopinContaining($el)
+                                : null;
+                            if ( $popin && !$popin.isOpen ) {
+                                $popin = null;
+                            }
 
                             if ($popin) {
 
-                                XHRData = {};
+                                // #B575 — ONE tolerant parse: the hidden inputs are a dev-mode
+                                // transport, absent outside dev mode; dereferencing them raised a
+                                // false 422 and the popin was never loaded
+                                var _parsed = parseXhrHtmlAnswer(result.content);
+                                XHRData = _parsed.data;
+                                XHRView = _parsed.view;
                                 // update toolbar
-
                                 try {
-                                    XHRData = new DOMParser().parseFromString(result.content, 'text/html').getElementById('gina-without-layout-xhr-data');
-                                    XHRData = JSON.parse(decodeURIComponent(XHRData.value));
-
-                                    XHRView = new DOMParser().parseFromString(result.content, 'text/html').getElementById('gina-without-layout-xhr-view');
-                                    XHRView = JSON.parse(decodeURIComponent(XHRView.value));
-
                                     // update data tab
-                                    if ( gina && typeof(window.ginaToolbar) != 'undefined' && window.ginaToolbar && typeof(XHRData) != 'undefined' ) {
+                                    if ( gina && typeof(window.ginaToolbar) != 'undefined' && window.ginaToolbar && XHRData ) {
                                         window.ginaToolbar.update('data-xhr', XHRData);
                                     }
 
                                     // update view tab
-                                    if ( gina && typeof(window.ginaToolbar) != 'undefined' && window.ginaToolbar && typeof(XHRView) != 'undefined' ) {
+                                    if ( gina && typeof(window.ginaToolbar) != 'undefined' && window.ginaToolbar && XHRView ) {
                                         window.ginaToolbar.update('view-xhr', XHRView);
                                     }
 
@@ -8842,8 +8880,19 @@ function handleXhr(xhr, $el, options, require) {
 
                                 $popin.loadContent(result.content);
 
-                                result = XHRData;
+                                // the parsed xhr-data in dev mode, delivered VERBATIM, or an
+                                // object carrying the status outside dev mode where the transport
+                                // inputs are absent (the handler contract is "an object", never
+                                // null). The parsed data is never mutated.
+                                result = XHRData || { status: xhr.status };
                                 triggerEvent(gina, $target, 'success.' + id, result);
+                                // #B571 — this branch returned before the tail that emits the
+                                // declared-callback companion, so a link's
+                                // `data-gina-link-event-on-success` never ran when its HTML
+                                // answer was loaded into a popin. `.hlink` only: the `.hform`
+                                // half of this handler is dead (no caller passes `$form`).
+                                if (hLinkIsRequired)
+                                    triggerEvent(gina, $link.target, 'success.' + $link.id + '.hlink', result);
 
                                 return;
                             }
@@ -9231,7 +9280,14 @@ function on(event, cb) {
             addListener(gina, $target, event, function(e) {
 
                 //if ( typeof(e.defaultPrevented) != 'undefined' && e.defaultPrevented)
-                cancelEvent(e);
+                // #gh76 slice 2 — `beforeswap.<id>` is CANCELABLE by design: the listener
+                // decides with `preventDefault()` whether the swap happens, so the blanket
+                // cancel below must not pre-empt it (it would read as "every listener
+                // cancels"). Name-scoped, so no other event sees a difference. Slice 3
+                // adds `oobbeforeswap.<id>`, the per-element out-of-band twin.
+                if ( !/^(oob)?beforeswap\./.test(e.type) ) {
+                    cancelEvent(e);
+                }
 
                 var data = null;
 
@@ -9261,6 +9317,273 @@ function on(event, cb) {
 
 }
 
+/**
+ * parseXhrHtmlAnswer
+ *
+ * Parses a `text/html` XHR answer ONCE and reads the two hidden inputs a
+ * `renderWithoutLayout()` action splices in — `gina-without-layout-xhr-data` (the page data)
+ * and `gina-without-layout-xhr-view` — when they are present. They are a DEV-MODE transport:
+ * the server splices them only under `NODE_ENV_IS_DEV`, so outside dev mode both read `null`
+ * (#B575: the popin branches used to dereference the absent input and raise a false `422`).
+ * The inputs are removed from the parsed document so a swap never carries them into the page
+ * (inside a form they would be submitted; repeated swaps would duplicate their ids); the
+ * caller's raw `content` string is untouched.
+ *
+ * @function parseXhrHtmlAnswer
+ * @param {string} content - the answer body
+ * @returns {{doc: Document, data: (object|null), view: (object|null)}}
+ *
+ * @example
+ * var parsed = parseXhrHtmlAnswer(xhr.responseText);
+ * parsed.data;                // the action's data in dev mode, null otherwise
+ * parsed.doc.body.innerHTML;  // the fragment, hidden inputs stripped
+ */
+function parseXhrHtmlAnswer(content) {
+    var raw = ( typeof(content) == 'string' ) ? content : '';
+    // #B578 — an answer is a FRAGMENT, not a document. Parsed as a document, the HTML
+    // parser foster-parents table-context elements (`<tr>`, `<td>`, `<tbody>`…) out of
+    // existence, so a row answer came out as its cell text and a `select` on `tr` found
+    // nothing. Parse through a `<template>` — whose contents accept any element; htmx's
+    // `makeFragment` idiom — and MOVE the fragment into `doc.body`: a DOM move never
+    // re-parses, so the row survives and every reader of `doc` (`getElementById`,
+    // `querySelectorAll`, `body.innerHTML`) is unchanged. A full-page answer (a layout
+    // render by mistake) drops its `<head>` first, as htmx does, or its `<title>` would
+    // land in the swap. An author-supplied `<template>` inside the answer is content and
+    // is kept as-is.
+    raw = raw.replace(/<head(\s[^>]*)?>[\s\S]*?<\/head>/i, '');
+    var doc  = new DOMParser().parseFromString('<body><template>' + raw + '</template></body>', 'text/html');
+    var $tpl = ( doc.body ) ? doc.body.querySelector('template') : null;
+    if ( $tpl ) {
+        var frag = $tpl.content;
+        $tpl.parentNode.removeChild($tpl);
+        doc.body.appendChild(( typeof(doc.adoptNode) == 'function' ) ? doc.adoptNode(frag) : frag);
+    }
+    var read = function(idName) {
+        var $input = doc.getElementById(idName), value = null;
+        if ( !$input ) {
+            return null;
+        }
+        value = $input.value;
+        try { $input.parentNode.removeChild($input); } catch (rmErr) {}
+        if ( typeof(value) != 'string' || value === '' ) {
+            return null;
+        }
+        try {
+            return JSON.parse(decodeURIComponent(value));
+        } catch (parseErr) {
+            return null;
+        }
+    };
+    return {
+        doc  : doc,
+        data : read('gina-without-layout-xhr-data'),
+        view : read('gina-without-layout-xhr-view')
+    };
+}
+
+/**
+ * applyOobSwaps
+ *
+ * #gh76 slice 3 — out-of-band swaps (the `hx-swap-oob` contract). Every element of the
+ * parsed answer carrying `data-gina-swap-oob` is swapped into the PAGE element with the
+ * same `id`, independently of where the main answer goes, and is REMOVED from the answer
+ * whether or not it swapped — the main fragment is always clean. Runs BEFORE any
+ * `data-gina-form-select` pick and before the main swap (htmx's order, so an oob element
+ * outside the selection still lands; on overlap the main swap wins).
+ *
+ * Value grammar: `true` / empty ⇒ `outerHTML` (the page element is replaced by the oob
+ * element, attribute stripped); a strategy name ⇒ applied with the oob element's CONTENT
+ * (the wrapper is stripped — `innerHTML` would otherwise nest a duplicate id);
+ * `<strategy>:<selector>` is RESERVED; anything else is unknown. A missing `id`, no page
+ * match, a reserved or unknown value: the element is still removed and reported with a
+ * `reason`, never thrown. An oob element inside ANOTHER oob element is not processed on
+ * its own — it travels with its ancestor and its attribute is stripped there. Elements
+ * inside an author-supplied `<template>` are processed too.
+ *
+ * Per element: `oobbeforeswap.<formId>` (cancelable: `preventDefault()` skips it;
+ * `detail.content` may be rewritten) → the write → the region bound through the shared
+ * `bindRegion()` policy → `oobafterswap.<formId>`, whose `.hform` companion fires when the
+ * declared-callback channel is armed — `oobbeforeswap` has none, mirroring `beforeswap`:
+ * a cancel is a decision, and the declared-callback channel carries notifications. An
+ * author-supplied `<template>` emptied of its out-of-band elements is removed with them,
+ * so an out-of-band-only answer leaves NOTHING behind whether or not it was wrapped. A
+ * swap that replaces or removes the SUBMITTING form
+ * defers its re-binding (`deferFormId`) and is reported through `rebindSelf`, so the
+ * caller's shared tail binds the same-id replacement after the `success` events.
+ *
+ * @param {Document} doc - the parsed answer (`parseXhrHtmlAnswer().doc`), MUTATED: every oob element is removed
+ * @param {object} ctx
+ * @param {HTMLFormElement} ctx.$target - the submitting form element
+ * @param {string} ctx.id - the form id (event channel)
+ * @param {boolean} ctx.hFormIsRequired - whether the `.hform` companions are armed
+ * @param {object} ctx.gina - the framework global (event bus)
+ *
+ * @returns {{ list: Array<{ id: (string|null), strategy: string, swapped: boolean, reason: (string|undefined) }>, rebindSelf: boolean }}
+ *
+ * @example
+ * var run = applyOobSwaps(parsed.doc, { $target: $form, id: 'f', hFormIsRequired: true, gina: gina });
+ * // => { list: [{ id: 'totals', strategy: 'outerHTML', swapped: true }], rebindSelf: false }
+ */
+function applyOobSwaps(doc, ctx) {
+    var OOB_ATTR   = 'data-gina-swap-oob';
+    var STRATEGIES = ['innerHTML', 'outerHTML', 'textContent', 'beforebegin', 'afterbegin', 'beforeend', 'afterend', 'delete', 'none'];
+    var $target    = ctx.$target
+        , id       = ctx.id
+        , armed    = !!ctx.hFormIsRequired
+        , gina     = ctx.gina
+        , out      = { list: [], rebindSelf: false }
+        , list     = []
+        , work     = []
+        , i        = 0
+    ;
+    if ( !doc || typeof(doc.querySelectorAll) != 'function' ) {
+        return out;
+    }
+    var collect = function(root) {
+        var found = root.querySelectorAll('[' + OOB_ATTR + ']');
+        for (var f = 0; f < found.length; ++f) list.push(found[f]);
+    };
+    collect(doc);
+    var tpls = doc.querySelectorAll('template'), harvested = [];
+    for (i = 0; i < tpls.length; ++i) {
+        if ( !tpls[i].content ) continue;
+        var before = list.length;
+        collect(tpls[i].content);
+        if ( list.length > before ) harvested.push(tpls[i]);
+    }
+    // pre-pass while the tree is intact: an oob element under another oob element travels
+    // with its ancestor — strip its attribute now, so it never fires and never re-arms
+    for (i = 0; i < list.length; ++i) {
+        var $anc = list[i].parentNode, nested = false;
+        while ( $anc && $anc.nodeType === 1 ) {
+            if ( $anc.hasAttribute(OOB_ATTR) ) { nested = true; break; }
+            $anc = $anc.parentNode;
+        }
+        if (nested) {
+            list[i].removeAttribute(OOB_ATTR);
+        } else {
+            work.push(list[i]);
+        }
+    }
+    for (i = 0; i < work.length; ++i) {
+        var $oob     = work[i]
+            , oobId  = $oob.getAttribute('id') || null
+            , value  = ( $oob.getAttribute(OOB_ATTR) || '' ).trim()
+            , strategy = null
+            , reason = null
+            , $page  = null
+            , content = null
+            , evt    = null
+            , $scope = null
+            , detaches = false
+            , entry  = null
+        ;
+        if ( value === '' || /^true$/i.test(value) ) {
+            strategy = 'outerHTML';
+        } else if ( value.indexOf(':') > -1 ) {
+            strategy = value; reason = 'reserved';
+        } else if ( STRATEGIES.indexOf(value) < 0 ) {
+            strategy = value; reason = 'unknownStrategy';
+        } else {
+            strategy = value;
+        }
+        // consumed transport: never lands in the page, never stays in the answer
+        $oob.removeAttribute(OOB_ATTR);
+        if ( $oob.parentNode ) $oob.parentNode.removeChild($oob);
+
+        if ( !reason && !oobId ) reason = 'noId';
+        if ( !reason ) {
+            $page = document.getElementById(oobId);
+            if ( !$page ) reason = 'noTarget';
+        }
+        entry = { id: oobId, strategy: strategy, swapped: false };
+        if ( reason ) {
+            entry.reason = reason;
+            out.list.push(entry);
+            continue;
+        }
+
+        content = ( strategy === 'outerHTML' )
+            ? $oob.outerHTML
+            : ( strategy === 'textContent' ) ? $oob.textContent : $oob.innerHTML;
+
+        if ( strategy !== 'none' ) {
+            // no `.hform` companion, exactly as `beforeswap`: this is a DECISION point and the
+            // declared-callback channel carries notifications — `oobafterswap` has the twin
+            evt = triggerEvent(gina, $target, 'oobbeforeswap.' + id, { target: $page, content: content, strategy: strategy, oob: true, oobId: oobId });
+            if ( evt && evt.defaultPrevented ) {
+                entry.reason = 'cancelled';
+                out.list.push(entry);
+                continue;
+            }
+            if ( evt && evt.detail && typeof(evt.detail.content) == 'string' ) {
+                content = evt.detail.content;
+            }
+        }
+
+        detaches = ( strategy === 'outerHTML' || strategy === 'delete' ) && ( $page === $target || $page.contains($target) );
+
+        switch (strategy) {
+            case 'innerHTML':
+                $page.innerHTML = content;
+                $scope = $page;
+                break;
+            case 'outerHTML':
+                $scope = $page.parentNode;
+                $page.outerHTML = content;
+                break;
+            case 'textContent':
+                $page.textContent = content;
+                break;
+            case 'beforebegin':
+                $scope = $page.parentNode;
+                $page.insertAdjacentHTML('beforebegin', content);
+                break;
+            case 'afterbegin':
+                $page.insertAdjacentHTML('afterbegin', content);
+                $scope = $page;
+                break;
+            case 'beforeend':
+                $page.insertAdjacentHTML('beforeend', content);
+                $scope = $page;
+                break;
+            case 'afterend':
+                $scope = $page.parentNode;
+                $page.insertAdjacentHTML('afterend', content);
+                break;
+            case 'delete':
+                if ( $page.parentNode ) $page.parentNode.removeChild($page);
+                break;
+            case 'none':
+                break;
+        }
+        entry.swapped = ( strategy !== 'none' );
+        if ( detaches ) out.rebindSelf = true;
+
+        if ( $scope && typeof($scope.getElementsByTagName) == 'function' ) {
+            bindRegion($scope, { deferFormId: ( detaches ) ? id : null });
+        }
+        if ( strategy !== 'none' ) {
+            triggerEvent(gina, $target, 'oobafterswap.' + id, { target: $page, strategy: strategy, swapped: entry.swapped, oob: true, oobId: oobId });
+            if ( armed )
+                triggerEvent(gina, $target, 'oobafterswap.' + id + '.hform', { target: $page, strategy: strategy, swapped: entry.swapped, oob: true, oobId: oobId });
+        }
+        out.list.push(entry);
+    }
+    // an author-supplied wrapper that held nothing but out-of-band elements is consumed
+    // transport too: left in place it would defeat the empty-remainder rule downstream
+    // (a popin would be asked to load `<template></template>` and blank itself)
+    for (i = 0; i < harvested.length; ++i) {
+        if ( harvested[i].content.childElementCount === 0
+            && !/\S/.test(harvested[i].content.textContent || '')
+            && harvested[i].parentNode
+        ) {
+            harvested[i].parentNode.removeChild(harvested[i]);
+        }
+    }
+    return out;
+}
+
 /**
  * listenToXhrEvents
  *
@@ -11701,6 +12024,110 @@ function getElementsByAttribute(attribute) {
 		}
 	};
 }(DOMParser));
+/**
+ * bindRegion
+ *
+ * Binds a freshly injected HTML region — ONE policy, shared by fragment navigation
+ * (`gina/nav`) and by the validator's form-answer swaps (#gh76 slice 2), so a third
+ * copy of "what happens to injected content" never has to be written:
+ *  - `<script src>` elements the document does not already have OUTSIDE the region are
+ *    re-created in `<head>` (a `<script>` inserted through innerHTML never runs); a src the
+ *    document already carries elsewhere — the page's own bundles, a copy an earlier swap or a
+ *    popin injected — is not re-created, so a fragment may safely re-declare the page's
+ *    scripts. Inline scripts are never executed: innerHTML semantics, the contract popin
+ *    and nav content have always had;
+ *  - `<link rel="stylesheet">` elements are left alone — inserted through innerHTML they are
+ *    already live;
+ *  - forms that opt in (#B549: a `data-gina-form-*` attribute, an id naming a registered rule,
+ *    or a `gina-upload-*` id) are bound through the live validator's own `bindRegion`; a bare
+ *    form keeps its native submit, exactly as on the initial page;
+ *  - `<a data-gina-link>` anchors are bound through the live link plugin when one is active;
+ *  - declarative `data-gina-dialog` triggers are document-delegated (nothing to bind); legacy
+ *    `data-gina-popin-*` triggers are inert in injected content; custom elements upgrade
+ *    natively.
+ *
+ * @param {HTMLElement} $root - the injected region: the swapped element, or the parent of
+ *      nodes inserted beside it
+ * @param {object} [options]
+ * @param {string} [options.deferFormId] - a form id to SKIP: the submitting form of a swap
+ *      that replaced it keeps its listeners until the swap's own events are delivered, so
+ *      its replacement is bound by the caller afterwards
+ * @param {boolean} [options.forms=true] - bind opted-in forms
+ * @param {boolean} [options.links=true] - bind `data-gina-link` anchors
+ *
+ * @returns {{scripts: number, forms: number, links: number}} what was bound
+ *
+ * @example
+ * $region.innerHTML = fragment;
+ * bindRegion($region); // => { scripts: 1, forms: 2, links: 0 }
+ */
+function bindRegion($root, options) {
+    var out = { scripts: 0, forms: 0, links: 0 };
+    if ( !$root || typeof($root.getElementsByTagName) != 'function' ) {
+        return out;
+    }
+    options = options || {};
+    var _gina = ( typeof(window) != 'undefined' && window.gina ) ? window.gina : null;
+
+    // scripts — dedup against every src the DOCUMENT carries outside the region: the
+    // fragment's own copies are inert (innerHTML) and must not count as "already loaded"
+    var known       = []
+        , docScripts = document.getElementsByTagName('script')
+        , scripts   = $root.getElementsByTagName('script')
+        , src       = null
+        , $s        = null
+        , i         = 0
+        , len       = docScripts.length
+    ;
+    for (; i < len; ++i) {
+        if ( docScripts[i].src && !$root.contains(docScripts[i]) ) {
+            known.push(docScripts[i].src);
+        }
+    }
+    for (i = 0, len = scripts.length; i < len; ++i) {
+        src = scripts[i].src; // the resolved absolute URL
+        if ( !src || known.indexOf(src) > -1 ) continue;
+        $s     = document.createElement('script');
+        $s.src = src;
+        document.head.appendChild($s);
+        known.push(src);
+        out.scripts++;
+    }
+
+    // forms — the validator owns the opt-in gate (#B549)
+    if (
+        options.forms !== false
+        && _gina && _gina.hasValidator && _gina.validator
+        && typeof(_gina.validator.bindRegion) == 'function'
+    ) {
+        try {
+            out.forms = _gina.validator.bindRegion($root, { deferFormId: options.deferFormId || null });
+        } catch (formsErr) {
+            if ( typeof(console) != 'undefined' && console.warn ) {
+                console.warn('[gina][bindRegion] form binding failed: ' + (formsErr.message || formsErr));
+            }
+        }
+    }
+
+    // links — the link plugin binds the anchors that opt in
+    if (
+        options.links !== false
+        && _gina && _gina.hasLinkHandler && _gina.link
+        && typeof(_gina.link.bindLinks) == 'function'
+    ) {
+        try {
+            _gina.link.bindLinks($root);
+            out.links = $root.querySelectorAll('a[data-gina-link]:not([data-gina-link="false"])').length;
+        } catch (linksErr) {
+            if ( typeof(console) != 'undefined' && console.warn ) {
+                console.warn('[gina][bindRegion] link binding failed: ' + (linksErr.message || linksErr));
+            }
+        }
+    }
+
+    return out;
+}
+;
 define("utils/dom", function(){});
 
 /**
@@ -12162,8 +12589,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
         'registered',
         'success',
         'error',
+        'beforeswap', // #gh76 slice 2 — cancelable, before a form answer is swapped into its target
+        'afterswap', // #gh76 slice 2 — after the swap and the region binding
+        'oobbeforeswap', // #gh76 slice 3 — per out-of-band element, cancelable
+        'oobafterswap', // #gh76 slice 3 — per out-of-band element, after its region binding
         'progress',
         'uploadProgress', // #R8 — upload (client-to-server) wire progress for staged uploads
+        'abort', // #gh76 slice 4 — a request superseded by `data-gina-form-sync`
         'submit',
         'reset',
         'change',
@@ -12745,15 +13177,1053 @@ function ValidatorPlugin(rules, data, formId, culture) {
         if ( gina.hasPopinHandler && gina.popinIsBinded ) {
             $activePopin = gina.popin.getActivePopin();
         }
-
-        if ( $activePopin && $activePopin.isOpen ) {
-            isPopinInUse = true;
+
+        if ( $activePopin && $activePopin.isOpen ) {
+            isPopinInUse = true;
+        }
+
+        return isPopinInUse;
+    }
+
+    /**
+     * popinStillContaining
+     *
+     * #gh76 — the settle-time half of the containment rule: the popin captured at
+     * submit, if it is still open and its element still contains the form (a close +
+     * reopen in flight wipes and refetches the content, so the captured form is detached
+     * and the answer must not land in content the user has since navigated to).
+     *
+     * @param {object|null} $captured - the popin captured at submit (`sendCtx.popin`)
+     * @param {HTMLElement} $formEl - the form element
+     *
+     * @returns {object|null} $popin
+     *
+     * @example
+     * var $popin = popinStillContaining(sendCtx.popin, $target); // null => legacy payload
+     */
+    var popinStillContaining = function($captured, $formEl) {
+        var $dialog = null;
+        if ( !$captured || !$captured.isOpen ) {
+            return null;
+        }
+        $dialog = ( $captured.id ) ? document.getElementById($captured.id) : null;
+        return ( $dialog && $dialog.contains($formEl) ) ? $captured : null;
+    }
+
+    /**
+     * warnIfOldRuleRouted
+     *
+     * #gh76 — dev-only notice when the retired "active popin" rule would have routed a
+     * PAGE form's answer or redirect into a popin the form is not inside. The one
+     * conceivable reliance on that routing is a non-modal popin deliberately updated by a
+     * page form; the notice is how such a page finds out. Two messages: the popin was
+     * open (its content would have been replaced) vs loading, not open (a false 422
+     * would have been raised).
+     *
+     * @param {object|null} $captured - the popin captured at submit
+     * @param {object|null} $routed - the popin the answer is actually routed to
+     * @param {HTMLElement} $formEl - the form element
+     * @param {string} what - `answer` or `redirect`, for the message
+     *
+     * @returns {undefined}
+     *
+     * @example
+     * warnIfOldRuleRouted(sendCtx.popin, $popin, $target, 'answer');
+     */
+    var warnIfOldRuleRouted = function($captured, $routed, $formEl, what) {
+        var $old = null, $popins = null, activeId = null;
+        if ( !envIsDev || $routed || $captured || typeof(gina.popin) == 'undefined' || !gina.popin ) {
+            return;
+        }
+        // what getActivePopin() resolved before #gh76: the first open popin, else the
+        // popin `activePopinId` names in ANY state
+        $old = gina.popin.getActivePopin();
+        if ( !$old ) {
+            $popins  = gina.popin.$popins || {};
+            activeId = gina.popin.activePopinId;
+            $old     = ( activeId && $popins[activeId] ) ? $popins[activeId] : null;
+        }
+        if ( !$old ) {
+            return;
+        }
+        try {
+            console.warn('[FormValidator][popin] the HTML '+ what +' of form `#'+ $formEl.id +'` is delivered to its own handler: the form is not inside popin `'+ $old.name +'`, which is '+ ( $old.isOpen ? 'open (the former routing rule would have replaced its content)' : 'loading, not open (the former routing rule would have raised a false 422 error)' ) +'.');
+        } catch (e) {}
+    }
+
+
+    /**
+     * warnIfOldRulePlacedUpload
+     *
+     * #B572 — dev-only notice, the staged-upload twin of `warnIfOldRuleRouted`: the
+     * retired "active popin" rule placed a PAGE form's virtual upload form — and with it
+     * the preview lookups and the staging request's popin headers — inside whichever popin
+     * happened to be open, where the staged metadata never reached the form. Containment
+     * now decides the placement; this is how a page that relied on the old placement
+     * finds out. Only an OPEN popin is named: the retired gate required `isOpen`.
+     *
+     * @param {object|null} $owner - the popin containing the real form (null for a page form)
+     * @param {HTMLElement} $formEl - the real form the file input belongs to
+     * @param {HTMLElement} $inputEl - the file input
+     *
+     * @returns {undefined}
+     *
+     * @example
+     * warnIfOldRulePlacedUpload($ownerPopin, $el.form, $el);
+     */
+    var warnIfOldRulePlacedUpload = function($owner, $formEl, $inputEl) {
+        var $old = null;
+        if ( !envIsDev || $owner || typeof(gina.popin) == 'undefined' || !gina.popin ) {
+            return;
+        }
+        // what isPopinContext() resolved before #B572: the first OPEN popin
+        $old = ( typeof(gina.popin.getActivePopin) == 'function' ) ? gina.popin.getActivePopin() : null;
+        if ( !$old || !$old.isOpen ) {
+            return;
+        }
+        try {
+            console.warn('[FormValidator][popin] the staged upload of `#'+ ( ( $inputEl && $inputEl.id ) ? $inputEl.id : '' ) +'` (form `#'+ ( ( $formEl && $formEl.id ) ? $formEl.id : '' ) +'`) is placed with its own form: the form is not inside popin `'+ $old.name +'`, which is open (the former rule would have placed the upload inside it and its metadata would never have reached the form).');
+        } catch (e) {}
+    }
+
+    /**
+     * The swap strategies `data-gina-form-swap` accepts (#gh76 slice 2) — htmx's `hx-swap`
+     * values, applied with the matching DOM operation.
+     * @constant {string[]}
+     */
+    var SWAP_STRATEGIES = ['innerHTML', 'outerHTML', 'textContent', 'beforebegin', 'afterbegin', 'beforeend', 'afterend', 'delete', 'none'];
+
+    /**
+     * resolveSwapTarget
+     *
+     * #gh76 slice 2 — resolves a form's `data-gina-form-target` value to an element, at
+     * SUBMIT time, with htmx's `hx-target` grammar: `this` (the form itself),
+     * `closest <selector>` (the closest ancestor OR the form), `find <selector>` (the first
+     * descendant), or a CSS selector (the first match in the document). `next` and
+     * `previous` are reserved: refused with a message naming them, so a later addition is
+     * purely additive.
+     *
+     * @param {HTMLFormElement} $formEl - the submitting form
+     * @param {string} value - the attribute value
+     *
+     * @returns {{target: (HTMLElement|undefined), error: (string|undefined)}}
+     *
+     * @example
+     * resolveSwapTarget($form, 'closest li'); // => { target: <li> }
+     * resolveSwapTarget($form, '#nowhere');   // => { error: 'no element matches `#nowhere`' }
+     */
+    var resolveSwapTarget = function($formEl, value) {
+        var v = ( typeof(value) == 'string' ) ? value.trim() : '';
+        var m = null, keyword = null, selector = null, $el = null;
+        if ( v === '' ) {
+            return { error: 'empty value' };
+        }
+        if ( v === 'this' ) {
+            return { target: $formEl };
+        }
+        try {
+            m = v.match(/^(closest|find|next|previous)(?:\s+(.+))?$/i);
+            if (m) {
+                keyword  = m[1].toLowerCase();
+                selector = ( m[2] || '' ).trim();
+                if ( keyword === 'next' || keyword === 'previous' ) {
+                    return { error: '`'+ keyword +'` targeting is reserved and not supported yet' };
+                }
+                if ( selector === '' ) {
+                    return { error: '`'+ keyword +'` needs a selector' };
+                }
+                $el = ( keyword === 'closest' ) ? $formEl.closest(selector) : $formEl.querySelector(selector);
+            } else {
+                $el = document.querySelector(v);
+            }
+        } catch (selectorErr) {
+            return { error: 'invalid selector `'+ v +'`: '+ (selectorErr.message || selectorErr) };
+        }
+        return ( $el ) ? { target: $el } : { error: 'no element matches `'+ v +'`' };
+    }
+
+    /**
+     * refuseSend
+     *
+     * #gh76 slice 2 — refuses a submit BEFORE any request leaves (a declared target or swap
+     * strategy that cannot be honoured): releases what the submit armed and delivers the
+     * refusal to the form's error channels as `{ status: 422, reason: 'targetError', … }`.
+     * Runs before the request is opened, so no `disabled`/`data-gina-form-loading` lock
+     * exists yet; the #B247 trigger arm does, and is released.
+     *
+     * @param {object} $form - the form's registry entry
+     * @param {HTMLFormElement} $target - the form element
+     * @param {string} id - the form id
+     * @param {boolean} hFormIsRequired - whether the declared-callback channel is armed
+     * @param {string} attribute - the offending attribute name
+     * @param {string} value - its value
+     * @param {string} why - the reason
+     * @param {boolean} [ownedByEarlierSend] - a PREVIOUS request was already in flight when
+     *      this attempt reached `send()` (read before it claimed `isSending`). When true the
+     *      refusal delivers its error but touches neither `isSending`/`sent` nor the loading
+     *      state: both belong to the request still running, whose own settle releases them.
+     *      `armSubmitLoading` is first-wins, so this refused attempt armed nothing of its own
+     *      — the same ownership rule the validation-rejected path applies (#B247).
+     *
+     * @returns {undefined}
+     *
+     * @example
+     * refuseSend($form, $target, id, hFormIsRequired, 'data-gina-form-target', '#nowhere', 'no element matches `#nowhere`', false);
+     */
+    var refuseSend = function($form, $target, id, hFormIsRequired, attribute, value, why, ownedByEarlierSend) {
+        var result = {
+            status          : 422,
+            error           : attribute +': '+ why,
+            reason          : 'targetError',
+            attribute       : attribute,
+            value           : value,
+            transportError  : false
+        };
+        if ( !ownedByEarlierSend ) {
+            $form.isSending = false;
+            $form.sent      = false;
+            if ( instance.$forms[id] ) {
+                instance.$forms[id].isSending = false;
+                instance.$forms[id].sent      = false;
+            }
+            disarmSubmitLoading($form);
+        }
+        $form.eventData.error = result;
+        if (envIsDev) {
+            try { console.error('[FormValidator][swap] submit of form `#'+ id +'` refused — '+ result.error); } catch (e) {}
+        }
+        triggerEvent(gina, $target, 'error.' + id, result);
+        if (hFormIsRequired)
+            triggerEvent(gina, $target, 'error.' + id + '.hform', result);
+    }
+
+    /**
+     * #gh76 slice 4 — the three things a submit can do when the region its answer is bound
+     * for is already owned by a request in flight. `data-gina-form-sync` names one of them;
+     * most forms never need to, because the default is DERIVED from the swap strategy they
+     * already declared (see `deriveSync`).
+     * @constant {string[]}
+     */
+    var SYNC_STRATEGIES = ['drop', 'replace', 'queue'];
+
+    /**
+     * #gh76 slice 4 — the swap strategies that REPLACE what a region holds, as opposed to
+     * adding to it. They are what makes the default derivable: an answer about to overwrite
+     * the region makes the answer still on the wire moot, so the newer submit wins. The five
+     * that remain — the four insertion points and `none` — have no conflict to resolve, so
+     * two such answers both land, exactly as they always have.
+     * @constant {string[]}
+     */
+    var REPLACING_SWAPS = ['innerHTML', 'outerHTML', 'textContent', 'delete'];
+
+    /**
+     * #gh76 slice 4 — per-KEY coordination state, keyed on the element a form's answer is
+     * bound for: its resolved swap target, or the form itself when it declares none. A
+     * WeakMap because a swapped-away target is a NEW element — the old entry is collected
+     * with it, and a different element is legitimately a different key.
+     *
+     * There is no sequence counter: `#B175` gives every send its own XHR, so the XHR object
+     * IS the identity a late settle is checked against, exactly and without a counter to
+     * keep in step.
+     *
+     * @type {WeakMap<Element, {xhr: (XMLHttpRequest|null), ctx: (object|null), queue: Array<Function>}>}
+     */
+    var syncRegistry = new WeakMap();
+
+    /**
+     * #gh76 slice 4 — how many in-flight requests currently hold each element disabled
+     * through `data-gina-form-disabled-elt`. Overlapping requests naming the same element
+     * release it once, at the last settle. Only elements WE disabled are ever counted, so an
+     * authored `disabled` can never be cleared by us.
+     *
+     * @type {WeakMap<Element, number>}
+     */
+    var disabledRefs = new WeakMap();
+
+    /**
+     * syncNotice
+     *
+     * #gh76 slice 4 — dev-mode console notice for a coordination decision that silently
+     * changes what a submit did (dropped, queued, superseded). Production stays quiet: these
+     * are the declared outcomes, not errors.
+     *
+     * @param {string} id - the form id
+     * @param {string} msg - what happened
+     *
+     * @returns {undefined}
+     *
+     * @example
+     * syncNotice('add-row', 'submit dropped — a request already owns this target');
+     *
+     * @inner
+     */
+    var syncNotice = function(id, msg) {
+        if (envIsDev) {
+            try { console.warn('[FormValidator][sync] form `#'+ id +'`: '+ msg); } catch (e) {}
+        }
+    }
+
+    /**
+     * parseSync
+     *
+     * #gh76 slice 4 — parses an explicit `data-gina-form-sync` value into `{ strategy }`.
+     *
+     * Three htmx spellings are deliberately REFUSED rather than implemented, each with a
+     * message naming the reason and what to write instead — gina refuses what it will not
+     * honour rather than parsing it into silence:
+     *  - `abort` means "anything that comes next may cancel me", htmx's idiom for a
+     *    disposable GET. A gina submit is a validated POST with side effects, never
+     *    disposable; `replace` and `drop` cover both halves of what it was reaching for.
+     *  - the `queue` modifiers exist in htmx because its trigger spec has `queue:` modifiers
+     *    too. Gina has no trigger spec, and one submit waiting per region is the only
+     *    behaviour the region can act on.
+     *  - `<selector>:<strategy>` names the element to coordinate on. Gina already knows it:
+     *    it is the resolved swap target.
+     *
+     * @param {string} value - the attribute value
+     *
+     * @returns {{strategy: (string|undefined), error: (string|undefined)}}
+     *
+     * @example
+     * parseSync('replace');    // => { strategy: 'replace' }
+     * parseSync('queue');      // => { strategy: 'queue' }
+     * parseSync('abort');      // => { error: '`abort` is not supported: … Use `replace` …' }
+     *
+     * @inner
+     */
+    var parseSync = function(value) {
+        var v = ( typeof(value) == 'string' ) ? value.trim().toLowerCase() : '';
+        var m = null;
+        if ( v === '' ) {
+            return { error: 'empty value' };
+        }
+        if ( v.indexOf(':') > -1 ) {
+            return { error: '`<selector>:<strategy>` keying is not supported — the key is the resolved `data-gina-form-target`, so there is nothing to name; write the strategy alone' };
+        }
+        if ( /^abort\b/.test(v) ) {
+            return { error: '`abort` is not supported — it means `anything may cancel me`, which fits a disposable GET, not a submit with rules and side effects; use `replace` to let the newer submit take over, or `drop` to yield to the one running' };
+        }
+        m = v.match(/^(drop|replace|queue)(?:\s+(\S+))?$/);
+        if ( !m ) {
+            return { error: 'unknown strategy `'+ v +'` (one of '+ SYNC_STRATEGIES.join(', ') +')' };
+        }
+        if ( m[2] ) {
+            return { error: '`'+ m[1] +'` takes no modifier (found `'+ m[2] +'`) — the key is the resolved swap target, and one submit waits per region, the most recent one' };
+        }
+        return { strategy: m[1] };
+    }
+
+    /**
+     * deriveSync
+     *
+     * #gh76 slice 4 — the DEFAULT, for a form that declares no `data-gina-form-sync`: read
+     * from the swap strategy the form already declared, so the common case coordinates with
+     * nothing written in the markup.
+     *
+     * A form whose answer REPLACES a region coordinates on that region — an answer still on
+     * the wire is about to be overwritten, so it is moot and the newer submit supersedes it.
+     * A form whose answer is INSERTED, or writes nothing, has no conflict to resolve: both
+     * land, exactly as they always have. A form declaring no target coordinates on nothing —
+     * the module-wide one-at-a-time rule is the only thing that governs it, unchanged.
+     *
+     * This is the decision neither htmx nor Turbo can make for you: htmx knows nothing about
+     * the answer until it arrives, and Turbo treats every submit as a navigation, so newest
+     * wins for everything. Gina knows, at submit time, what the answer is going to do.
+     *
+     * The target must RESOLVE here. An unresolvable one is refused by the pre-flight a few
+     * lines below, and a submit already on its way to a refusal must never abort a running
+     * request on the way.
+     *
+     * @param {HTMLFormElement} $formEl - the submitting form
+     *
+     * @returns {?{strategy: string, derived: boolean, key: HTMLElement, swap: string}}
+     *
+     * @example
+     * // <form data-gina-form-target="#rows">
+     * deriveSync($form); // => { strategy: 'replace', derived: true, key: <ul id="rows">, swap: 'innerHTML' }
+     * // <form data-gina-form-target="#rows" data-gina-form-swap="beforeend">
+     * deriveSync($form); // => null — an insertion has nothing to resolve
+     *
+     * @inner
+     */
+    var deriveSync = function($formEl) {
+        var targetAttr = $formEl.getAttribute('data-gina-form-target');
+        var swapAttr   = null, strategy = '', resolved = null;
+        if ( targetAttr === null ) {
+            return null;
+        }
+        swapAttr = $formEl.getAttribute('data-gina-form-swap');
+        // read exactly as the pre-flight reads it, case included: a value it would refuse
+        // must not coordinate here either
+        strategy = ( swapAttr === null ) ? 'innerHTML' : swapAttr.trim();
+        if ( REPLACING_SWAPS.indexOf(strategy) < 0 ) {
+            return null;
+        }
+        resolved = resolveSwapTarget($formEl, targetAttr);
+        if ( resolved.error || !resolved.target ) {
+            return null;
+        }
+        return { strategy: 'replace', derived: true, key: resolved.target, swap: strategy };
+    }
+
+    /**
+     * decideSync
+     *
+     * #gh76 slice 4 — the pure overlap decision: what this submit does when the key it
+     * coordinates on is, or is not, already owned by a request in flight.
+     *
+     * A key nobody owns is never a decision: every strategy proceeds. When one IS owned,
+     * `drop` yields, `replace` takes the slot, and `queue` defers until it is free. There is
+     * no state carried on the entry for this — the strategy of the submit ARRIVING decides,
+     * because it is the one whose answer is about to land.
+     *
+     * @param {object} parsed - a parseSync() or deriveSync() result
+     * @param {object} [entry] - the key's registry entry, when it has one
+     *
+     * @returns {{action: string, abortPrevious: (boolean|undefined)}}
+     *
+     * @example
+     * decideSync({ strategy: 'drop' }, { xhr: {} });     // => { action: 'drop' }
+     * decideSync({ strategy: 'replace' }, { xhr: {} });  // => { action: 'proceed', abortPrevious: true }
+     * decideSync({ strategy: 'queue' }, null);           // => { action: 'proceed', abortPrevious: false }
+     *
+     * @inner
+     */
+    var decideSync = function(parsed, entry) {
+        var busy = !!( entry && entry.xhr );
+        if ( !busy ) {
+            return { action: 'proceed', abortPrevious: false };
+        }
+        switch ( parsed.strategy ) {
+            case 'drop':
+                return { action: 'drop' };
+            case 'replace':
+                return { action: 'proceed', abortPrevious: true };
+            case 'queue':
+                return { action: 'queue' };
+        }
+        return { action: 'proceed', abortPrevious: false };
+    }
+
+    /**
+     * queueSyncSend
+     *
+     * #gh76 slice 4 — holds a deferred submit until its key's slot is free. Exactly ONE waits
+     * per key: a submit arriving while another already waits replaces it, because what the
+     * user asked for last is what they meant. Drained by the settle chokepoint.
+     *
+     * @param {object} entry - the key's registry entry
+     * @param {Function} replay - re-enters send() with the caller's original arguments
+     *
+     * @returns {undefined}
+     *
+     * @example
+     * queueSyncSend(entry, function () { send.call(receiver, data, options); });
+     *
+     * @inner
+     */
+    var queueSyncSend = function(entry, replay) {
+        entry.queue = [ replay ];
+    }
+
+    /**
+     * shiftSyncQueue
+     *
+     * #gh76 slice 4 — runs the next deferred submit for a key, once that key's slot is free.
+     * Guarded on the slot ACTUALLY being free: a settle that was superseded by a `replace`
+     * never shifts, because the request that replaced it claims the slot immediately
+     * afterwards and would race the one this shift started.
+     *
+     * @param {object} [entry] - the key's registry entry
+     *
+     * @returns {undefined}
+     *
+     * @example
+     * shiftSyncQueue(syncRegistry.get($list));
+     *
+     * @inner
+     */
+    var shiftSyncQueue = function(entry) {
+        var next = null;
+        if ( !entry || entry.xhr || !entry.queue || !entry.queue.length ) {
+            return;
+        }
+        next = entry.queue.shift();
+        try {
+            next();
+        } catch (queueErr) {
+            if (envIsDev) {
+                try { console.error('[FormValidator][sync] a queued submit failed: '+ ( queueErr.message || queueErr )); } catch (e) {}
+            }
+        }
+    }
+
+    /**
+     * resolveSyncKey
+     *
+     * #gh76 slice 4 — the element a form coordinates on: its resolved swap target, or the
+     * form itself when it declares none. Keying on the TARGET is what closes the reorder the
+     * issue describes — two forms answering into one `#list` are invisible to a form-keyed
+     * guard. A declared target that does not resolve falls back to the form, and that submit
+     * is refused a few lines further down anyway, so the key it briefly used is moot.
+     *
+     * @param {HTMLFormElement} $formEl - the submitting form
+     *
+     * @returns {HTMLElement}
+     *
+     * @example
+     * resolveSyncKey($form); // => <ul id="list">
+     *
+     * @inner
+     */
+    var resolveSyncKey = function($formEl) {
+        var attr = $formEl.getAttribute('data-gina-form-target');
+        var resolved = null;
+        if ( attr === null ) {
+            return $formEl;
+        }
+        resolved = resolveSwapTarget($formEl, attr);
+        return ( resolved.target ) ? resolved.target : $formEl;
+    }
+
+    /**
+     * resolveDisabledElts
+     *
+     * #gh76 slice 4 — resolves a `data-gina-form-disabled-elt` value: a comma-separated list,
+     * each part carrying the `data-gina-form-target` grammar (`this`, `closest …`, `find …`,
+     * a CSS selector; `next`/`previous` reserved). A part that resolves to nothing is an
+     * ERROR, not a silent skip: the attribute exists so a user cannot act twice, and a typo
+     * that quietly disables nothing is the very failure it was added to prevent.
+     *
+     * @param {HTMLFormElement} $formEl - the submitting form
+     * @param {string} value - the attribute value
+     *
+     * @returns {{elements: (Array<HTMLElement>|undefined), error: (string|undefined)}}
+     *
+     * @example
+     * resolveDisabledElts($form, 'closest fieldset, #save'); // => { elements: [<fieldset>, <button>] }
+     * resolveDisabledElts($form, '#nope');                   // => { error: '`#nope`: no element matches `#nope`' }
+     *
+     * @inner
+     */
+    var resolveDisabledElts = function($formEl, value) {
+        var raw   = ( typeof(value) == 'string' ) ? value : '';
+        var parts = raw.split(',');
+        var out = [], i = 0, part = null, resolved = null;
+        if ( raw.trim() === '' ) {
+            return { error: 'empty value' };
+        }
+        for (; i < parts.length; ++i) {
+            part = parts[i].trim();
+            if ( part === '' ) {
+                return { error: 'empty part at position '+ ( i + 1 ) };
+            }
+            resolved = resolveSwapTarget($formEl, part);
+            if ( resolved.error ) {
+                return { error: '`'+ part +'`: '+ resolved.error };
+            }
+            if ( out.indexOf(resolved.target) < 0 ) {
+                out.push(resolved.target);
+            }
+        }
+        return { elements: out };
+    }
+
+    /**
+     * disableForRequest
+     *
+     * #gh76 slice 4 — holds one element disabled for the life of a request, refcounted so
+     * overlapping requests naming the same element release it once. An element ALREADY
+     * disabled without our marker was disabled by the page: it is left untouched and not
+     * counted, so the release can never clear a state we did not set.
+     *
+     * @param {HTMLElement} $el - the element to hold disabled
+     * @param {string} formId - written to `data-gina-disabled-by` as provenance
+     *
+     * @returns {boolean} whether this request now holds the element
+     *
+     * @example
+     * disableForRequest($fieldset, 'add-row'); // => true
+     *
+     * @inner
+     */
+    var disableForRequest = function($el, formId) {
+        var n = disabledRefs.get($el) || 0;
+        if ( n === 0 ) {
+            if ( $el.hasAttribute('disabled') ) {
+                return false;
+            }
+            $el.setAttribute('disabled', '');
+            $el.setAttribute('data-gina-disabled-by', formId);
+        }
+        disabledRefs.set($el, n + 1);
+        return true;
+    }
+
+    /**
+     * releaseDisabledElts
+     *
+     * #gh76 slice 4 — releases the elements one request held, at its settle. Decrements each
+     * refcount and clears `disabled` only at zero, and only on an element still carrying our
+     * own `data-gina-disabled-by` marker.
+     *
+     * @param {Array<HTMLElement>} [elements] - what this request held
+     *
+     * @returns {undefined}
+     *
+     * @example
+     * releaseDisabledElts(sendCtx.disabledElts);
+     *
+     * @inner
+     */
+    var releaseDisabledElts = function(elements) {
+        var i = 0, $el = null, n = 0;
+        if ( !elements || !elements.length ) {
+            return;
+        }
+        for (; i < elements.length; ++i) {
+            $el = elements[i];
+            n   = disabledRefs.get($el) || 0;
+            if ( n > 1 ) {
+                disabledRefs.set($el, n - 1);
+                continue;
+            }
+            disabledRefs['delete']($el);
+            if ( $el.getAttribute('data-gina-disabled-by') !== null ) {
+                $el.removeAttribute('disabled');
+                $el.removeAttribute('data-gina-disabled-by');
+            }
+        }
+    }
+
+    /**
+     * warnOobRefusals
+     *
+     * #gh76 slice 3 — dev-mode notice for every out-of-band element that did not swap for a
+     * REASON (no id, no page match, reserved or unknown value, cancelled). `swap="none"`
+     * writes nothing by design and carries no reason, so it is not reported.
+     *
+     * @param {string} id - the form id
+     * @param {Array<{id: (string|null), strategy: string, swapped: boolean, reason: (string|undefined)}>} list - `applyOobSwaps().list`
+     *
+     * @returns {undefined}
+     *
+     * @example
+     * warnOobRefusals(id, run.list);
+     */
+    var warnOobRefusals = function(id, list) {
+        if ( !envIsDev || !list ) return;
+        for (var i = 0; i < list.length; ++i) {
+            if ( !list[i].swapped && list[i].reason ) {
+                try { console.warn('[FormValidator][swap] form `#'+ id +'`: out-of-band element `'+ (list[i].id || '(no id)') +'` not swapped — '+ list[i].reason); } catch (e) {}
+            }
+        }
+    }
+
+    /**
+     * applyResponseOverrides
+     *
+     * #gh76 §6 — the server's last word on where a `text/html` answer goes and how: three
+     * response headers, read at settle AFTER the answer is known to be HTML and BEFORE the
+     * swap-target fork and `beforeswap` (htmx's order, so a listener keeps the final say):
+     *   `X-Gina-Retarget` — the `data-gina-form-target` grammar (`this`, `closest`, `find`,
+     *     a selector; `next`/`previous` refused), resolved from the submitting form through
+     *     resolveSwapTarget. On success it BECOMES the target and `sendCtx.targetAttr` names
+     *     the header: a declaration made by the server, so it wins over the popin exactly as
+     *     a declared attribute does, and it creates a target where none was declared.
+     *   `X-Gina-Reswap` — one of SWAP_STRATEGIES, replacing the declared strategy.
+     *   `X-Gina-Reselect` — a selector applied to the answer, replacing `data-gina-form-select`.
+     * The invalid-value rule is ASYMMETRIC, each half consistent with a rule that already
+     * exists. A Retarget that cannot be resolved means NO swap (`applied: false` + the
+     * reason, and the target is dropped): slice 2's settle-time refusal for a target that
+     * left the document — inserting into the declared target could land the answer in the
+     * wrong DOM when the server plainly meant somewhere else. A Reswap or Reselect that
+     * fails validation is IGNORED and the declared value kept: a modifier on a known target,
+     * and htmx degrades an invalid `HX-Reswap` the same way. Either without a target —
+     * declared or retargeted — is ignored too (`reason: 'noTarget'`). Never a 422: a
+     * misconfiguration surfacing as an error after a successful write is the false-422
+     * shape slice 1 removed. Dev-mode console notices name every refused or ignored value.
+     * SAME-ORIGIN ONLY. All three are honoured only from a response whose origin is the
+     * page's own (`xhr.responseURL` — the URL after redirects — against
+     * `window.location.origin`): a responder elsewhere may not choose the element its
+     * answer lands in, nor reshape or trim the swap the author declared. A cross-origin
+     * Retarget is refused exactly as an unresolvable one (no swap, `reason: 'crossOrigin'`);
+     * a cross-origin Reswap/Reselect is ignored and the declared value kept. Fail-closed: a
+     * missing or unparseable `responseURL`, or an opaque origin on either side, reads as
+     * not-same-origin. htmx has no such read because `selfRequestsOnly` refuses the
+     * cross-origin REQUEST; a form here posts to its raw `action`, so the gate is at the read.
+     *
+     * Returns the report — `null` when the answer carried none of the three — and stores it
+     * on `sendCtx.overrides`, from where `beforeswap` and the success payload carry it.
+     *
+     * @param {XMLHttpRequest} xhr - the settled transport (its `getResponseHeader` and `responseURL`)
+     * @param {object} sendCtx - the per-send capture (`target`/`targetAttr`/`swap`/`select` mutated)
+     * @param {HTMLFormElement} $target - the submitting form (the `this`/`closest`/`find` base)
+     * @param {string} id - the form id (notices)
+     *
+     * @returns {(null|{retarget: (object|undefined), reswap: (object|undefined), reselect: (object|undefined)})}
+     *   each entry `{ value, applied, reason }` (`reason` only when not applied)
+     *
+     * @example
+     * applyResponseOverrides(xhr, sendCtx, $target, id); // => { retarget: { value: '#totals', applied: true } }
+     */
+    var applyResponseOverrides = function(xhr, sendCtx, $target, id) {
+        var read = function(name) {
+            var v = null;
+            try { v = xhr.getResponseHeader(name); } catch (headerErr) { v = null; }
+            return ( typeof(v) == 'string' ) ? v.trim() : null;
+        };
+        var retarget    = read('X-Gina-Retarget')
+            , reswap    = read('X-Gina-Reswap')
+            , reselect  = read('X-Gina-Reselect')
+            , report    = null
+            , resolved  = null
+            , hasTarget = false
+            , notice    = function(msg) {
+                if (envIsDev) {
+                    try { console.warn('[FormValidator][swap] form `#'+ id +'`: '+ msg); } catch (e) {}
+                }
+            }
+        ;
+        if ( retarget === null && reswap === null && reselect === null ) {
+            return null;
+        }
+        // #gh76 §6 — same-origin only. The headers are honoured from a response whose
+        // origin is the page's own: a responder elsewhere may not choose the element its
+        // answer lands in, nor reshape or trim the swap the author declared. htmx never
+        // needs this read (`selfRequestsOnly` refuses the cross-origin REQUEST); a form
+        // here posts to its raw `action`, so the gate belongs at the read. Fail-closed: no
+        // `responseURL` (a transport that cannot say where the answer came from), an
+        // unparseable one, or an opaque origin on either side (`'null'` — two opaque
+        // origins are never the same origin, whatever the string says) all read as
+        // not-same-origin. `responseURL` is the URL AFTER redirects, so a same-origin
+        // action that was redirected elsewhere is refused too.
+        var sameOrigin  = false
+            , resOrigin = 'an unknown origin'
+        ;
+        try {
+            var docOrigin = window.location.origin
+                , resURL  = xhr.responseURL
+            ;
+            if ( typeof(docOrigin) == 'string' && docOrigin !== '' && docOrigin !== 'null'
+                && typeof(resURL) == 'string' && resURL !== '' ) {
+                resOrigin  = new URL(resURL, window.location.href).origin;
+                sameOrigin = ( resOrigin === docOrigin );
+            }
+        } catch (originErr) {
+            sameOrigin = false;
+        }
+        if ( !sameOrigin ) {
+            report = {};
+            if ( retarget !== null ) {
+                report.retarget    = { value: retarget, applied: false, reason: 'crossOrigin' };
+                sendCtx.targetAttr = 'X-Gina-Retarget';
+                sendCtx.target     = null;
+                notice('`X-Gina-Retarget: '+ retarget +'` refused — the answer came from '+ resOrigin +', not from this page\'s origin; nothing swapped');
+            }
+            if ( reswap !== null ) {
+                report.reswap = { value: reswap, applied: false, reason: 'crossOrigin' };
+                notice('`X-Gina-Reswap: '+ reswap +'` ignored — the answer came from '+ resOrigin +', not from this page\'s origin; `'+ sendCtx.swap +'` kept');
+            }
+            if ( reselect !== null ) {
+                report.reselect = { value: reselect, applied: false, reason: 'crossOrigin' };
+                notice('`X-Gina-Reselect: '+ reselect +'` ignored — the answer came from '+ resOrigin +', not from this page\'s origin; `'+ ( sendCtx.select || 'the whole answer' ) +'` kept');
+            }
+            sendCtx.overrides = report;
+            return report;
+        }
+        report = {};
+        if ( retarget !== null ) {
+            resolved = resolveSwapTarget($target, retarget);
+            sendCtx.targetAttr = 'X-Gina-Retarget';
+            if ( resolved.error ) {
+                report.retarget = { value: retarget, applied: false, reason: resolved.error };
+                sendCtx.target  = null;
+                notice('`X-Gina-Retarget: '+ retarget +'` cannot be honoured ('+ resolved.error +') — nothing swapped');
+            } else {
+                report.retarget = { value: retarget, applied: true };
+                sendCtx.target  = resolved.target;
+            }
+        }
+        hasTarget = !!sendCtx.target;
+        if ( reswap !== null ) {
+            if ( !hasTarget ) {
+                report.reswap = { value: reswap, applied: false, reason: 'noTarget' };
+                notice('`X-Gina-Reswap: '+ reswap +'` ignored — the answer has no swap target');
+            } else if ( SWAP_STRATEGIES.indexOf(reswap) < 0 ) {
+                report.reswap = { value: reswap, applied: false, reason: 'unknown swap strategy `'+ reswap +'` (one of '+ SWAP_STRATEGIES.join(', ') +')' };
+                notice('`X-Gina-Reswap: '+ reswap +'` ignored — unknown strategy, `'+ sendCtx.swap +'` kept');
+            } else {
+                report.reswap = { value: reswap, applied: true };
+                sendCtx.swap  = reswap;
+            }
+        }
+        if ( reselect !== null ) {
+            var selectorOk = ( reselect !== '' );
+            if ( selectorOk ) {
+                try { document.createDocumentFragment().querySelector(reselect); } catch (selectorErr) { selectorOk = false; }
+            }
+            if ( !hasTarget ) {
+                report.reselect = { value: reselect, applied: false, reason: 'noTarget' };
+                notice('`X-Gina-Reselect: '+ reselect +'` ignored — the answer has no swap target');
+            } else if ( !selectorOk ) {
+                report.reselect = { value: reselect, applied: false, reason: 'invalid selector `'+ reselect +'`' };
+                notice('`X-Gina-Reselect: '+ reselect +'` ignored — invalid selector, `'+ ( sendCtx.select || 'the whole answer' ) +'` kept');
+            } else {
+                report.reselect = { value: reselect, applied: true };
+                sendCtx.select  = reselect;
+            }
+        }
+        sendCtx.overrides = report;
+        return report;
+    }
+
+    /**
+     * applySwap
+     *
+     * #gh76 slice 2 — swaps a `text/html` answer into the target captured at submit. ONE
+     * parse (`parseXhrHtmlAnswer`, the hidden inputs stripped), the optional
+     * `data-gina-form-select` pick (every match, document order), the attached check, the
+     * cancelable `beforeswap.<id>` event (a listener's `preventDefault()` skips the swap;
+     * `detail.content` is re-read after dispatch, so a listener may rewrite it), the DOM
+     * write by strategy, the region binding through the shared `bindRegion()` policy, then
+     * `afterswap.<id>` (+ `.hform`). Returns the success payload; the caller's shared tail
+     * emits `success`. Fail-soft on a swap that cannot happen (no `select` match, a target
+     * that left the document): `swapped: false`, a dev notice, the payload still delivered
+     * — the data is already saved.
+     *
+     * A swap that replaces or removes the submitting form (`outerHTML`/`delete` on a target
+     * containing it) defers the form's own re-binding: its listeners deliver the events
+     * first, then `finalizeSelfReplacement` binds the same-id replacement.
+     *
+     * @param {object} sendCtx - the per-send capture
+     * @param {object} $form - the form's registry entry
+     * @param {HTMLFormElement} $target - the form element
+     * @param {string} id - the form id
+     * @param {boolean} hFormIsRequired - whether the declared-callback channel is armed
+     * @param {{contentType: string, content: string, status: number}} result - the legacy payload
+     *
+     * @returns {{contentType: string, content: string, status: number, data: (object|null), view: (object|null), target: HTMLElement, swap: string, swapped: boolean}}
+     *
+     * @example
+     * result = applySwap(sendCtx, $form, $target, id, hFormIsRequired, result); // => { …, swapped: true }
+     */
+    var applySwap = function(sendCtx, $form, $target, id, hFormIsRequired, result) {
+        var strategy    = sendCtx.swap || 'innerHTML'
+            , $el       = sendCtx.target
+            , parsed    = parseXhrHtmlAnswer(result.content)
+            , content   = null
+            , $nodes    = null
+            , evt       = null
+            , $scope    = null
+            , attached  = false
+            , detachesForm = false
+            , payload   = {
+                contentType : result.contentType,
+                content     : result.content,
+                status      : result.status,
+                data        : parsed.data,
+                view        : parsed.view,
+                target      : $el,
+                swap        : strategy,
+                swapped     : false
+            }
+        ;
+        // #gh76 §6 — present only when the answer carried an override header
+        if ( sendCtx.overrides ) {
+            payload.overrides = sendCtx.overrides;
+        }
+        var warn = function(msg) {
+            if (envIsDev) {
+                try { console.warn('[FormValidator][swap] form `#'+ id +'`: '+ msg); } catch (e) {}
+            }
+        };
+        // dev toolbar
+        try {
+            if ( gina && envIsDev && typeof(window.ginaToolbar) != 'undefined' && window.ginaToolbar ) {
+                if (parsed.data) window.ginaToolbar.update('data-xhr', parsed.data);
+                if (parsed.view) window.ginaToolbar.update('view-xhr', parsed.view);
+            }
+        } catch (toolbarErr) {}
+
+        // #gh76 slice 3 — out-of-band elements first (htmx order: before `select`, before
+        // the main swap), gated on the attribute appearing in the answer so an oob-free
+        // answer pays nothing and stays byte-identical. `content` keeps the RAW answer;
+        // `remainder` is what is left once the oob elements are out.
+        if ( typeof(result.content) == 'string' && result.content.indexOf('data-gina-swap-oob') > -1 ) {
+            var oobRun = applyOobSwaps(parsed.doc, { $target: $target, id: id, hFormIsRequired: hFormIsRequired, gina: gina });
+            warnOobRefusals(id, oobRun.list);
+            payload.oob       = oobRun.list;
+            payload.remainder = parsed.doc.body.innerHTML;
+            if ( oobRun.rebindSelf ) sendCtx.rebindSelf = true;
+        }
+
+        if ( strategy === 'textContent' ) {
+            // htmx: the raw answer, not parsed as HTML — but never the out-of-band elements,
+            // which are consumed transport (#gh76 slice 3): once the gate fired, `remainder`
+            // IS the answer without them. Below the gate this is the raw answer, unchanged.
+            content = ( typeof(payload.remainder) == 'string' ) ? payload.remainder : result.content;
+        } else if ( sendCtx.select ) {
+            try {
+                $nodes = parsed.doc.querySelectorAll(sendCtx.select);
+            } catch (selErr) {
+                $nodes = [];
+            }
+            if ( !$nodes.length ) {
+                warn('`data-gina-form-select` matched nothing in the answer (`'+ sendCtx.select +'`) — nothing swapped');
+                return payload;
+            }
+            content = '';
+            for (var n = 0, nLen = $nodes.length; n < nLen; ++n) {
+                content += $nodes[n].outerHTML;
+            }
+        } else {
+            content = parsed.doc.body.innerHTML;
+        }
+
+        attached = ( typeof($el.isConnected) == 'boolean' ) ? $el.isConnected : document.contains($el);
+        if ( !attached ) {
+            warn('the target captured at submit (`'+ sendCtx.targetAttr +'`) is no longer in the document — nothing swapped');
+            return payload;
+        }
+
+        if ( strategy !== 'none' ) {
+            var beforeDetail = { target: $el, content: content, strategy: strategy, select: sendCtx.select };
+            if ( sendCtx.overrides ) {
+                beforeDetail.overrides = sendCtx.overrides;
+            }
+            evt = triggerEvent(gina, $target, 'beforeswap.' + id, beforeDetail);
+            if ( evt && evt.defaultPrevented ) {
+                warn('the swap was cancelled by a `beforeswap` listener');
+                return payload;
+            }
+            if ( evt && evt.detail && typeof(evt.detail.content) == 'string' ) {
+                content = evt.detail.content;
+            }
+        }
+
+        detachesForm = ( strategy === 'outerHTML' || strategy === 'delete' ) && ( $el === $target || $el.contains($target) );
+
+        switch (strategy) {
+            case 'innerHTML':
+                $el.innerHTML = content;
+                $scope = $el;
+                break;
+            case 'outerHTML':
+                $scope = $el.parentNode;
+                $el.outerHTML = content;
+                break;
+            case 'textContent':
+                $el.textContent = content;
+                break;
+            case 'beforebegin':
+                $scope = $el.parentNode;
+                $el.insertAdjacentHTML('beforebegin', content);
+                break;
+            case 'afterbegin':
+                $el.insertAdjacentHTML('afterbegin', content);
+                $scope = $el;
+                break;
+            case 'beforeend':
+                $el.insertAdjacentHTML('beforeend', content);
+                $scope = $el;
+                break;
+            case 'afterend':
+                $scope = $el.parentNode;
+                $el.insertAdjacentHTML('afterend', content);
+                break;
+            case 'delete':
+                if ( $el.parentNode ) $el.parentNode.removeChild($el);
+                break;
+            case 'none':
+                break;
+        }
+        payload.swapped = ( strategy !== 'none' );
+
+        if ( $scope && typeof($scope.getElementsByTagName) == 'function' ) {
+            bindRegion($scope, { deferFormId: ( detachesForm ) ? id : null });
+        }
+        sendCtx.rebindSelf = sendCtx.rebindSelf || detachesForm;
+
+        if ( strategy !== 'none' ) {
+            triggerEvent(gina, $target, 'afterswap.' + id, { target: $el, strategy: strategy, swapped: payload.swapped });
+            if (hFormIsRequired)
+                triggerEvent(gina, $target, 'afterswap.' + id + '.hform', { target: $el, strategy: strategy, swapped: payload.swapped });
+        }
+        return payload;
+    }
+
+    /**
+     * finalizeSelfReplacement
+     *
+     * #gh76 slice 2 — after a swap that replaced or removed the submitting form and after
+     * its events were delivered: retire the stale registry entry (its element left the
+     * document) and bind the same-id replacement when the answer carried one and it opts
+     * in (#B549).
+     *
+     * @param {HTMLFormElement} $oldForm - the submitting form element
+     * @param {string} id - its id
+     *
+     * @returns {undefined}
+     *
+     * @example
+     * finalizeSelfReplacement($target, id);
+     */
+    var finalizeSelfReplacement = function($oldForm, id) {
+        var $new = document.getElementById(id);
+        var oldAttached = ( typeof($oldForm.isConnected) == 'boolean' ) ? $oldForm.isConnected : document.contains($oldForm);
+        if ( !oldAttached ) {
+            try {
+                destroy(id);
+            } catch (destroyErr) {
+                delete instance.$forms[id];
+            }
+        }
+        if ( $new && $new !== $oldForm && /^FORM$/i.test($new.tagName) && isFormOptedIn($new, local.rules) ) {
+            validateFormById.call(instance, id);
+        }
+    }
+
+    /**
+     * #B549 — does the page opt this form into the validator?
+     *
+     * The boot scan binds a `<form>` ONLY when the markup asks for it: a
+     * `data-gina-form-*` attribute (`data-gina-form-rule`, the submit event
+     * handlers, submit-method/action overrides, upload staging…), an EXISTING id
+     * naming a registered rule (`-` read as `.`), or a virtual `gina-upload-*` id.
+     * Anything else is left untouched — no minted id, no `$forms` entry, no submit
+     * proxy — so a plain form on a rules-bearing page keeps its native submit, as
+     * the guide states. Explicit `validateFormById()` / `getFormById()` calls are
+     * not gated: the call is the opt-in.
+     *
+     * @private
+     * @param {HTMLFormElement} $form
+     * @param {object} rules - the registered rule sets, keyed by dotted name
+     * @returns {boolean}
+     * @example
+     * isFormOptedIn(document.querySelector('form[data-gina-form-rule]'), gina.forms.rules); // true
+     * isFormOptedIn(document.querySelector('form[action="/login"]'), gina.forms.rules);     // false — bare
+     */
+    function isFormOptedIn($form, rules) {
+        if ( !$form || typeof($form.getAttribute) != 'function' ) {
+            return false;
+        }
+        var existingId = $form.getAttribute('id');
+        if ( existingId && /^gina\-upload/i.test(existingId) ) {
+            return true;
+        }
+        if ( existingId && rules && typeof(rules[existingId.replace(/\-/g, '.')]) != 'undefined' ) {
+            return true;
+        }
+        var attrs = $form.attributes;
+        for (var a = 0, aLen = (attrs) ? attrs.length : 0; a < aLen; ++a) {
+            if ( /^data-gina-form-/i.test(attrs[a].name) ) {
+                return true;
+            }
         }
-
-        return isPopinInUse;
+        return false;
     }
 
-
     /**
      * validateFormById
      *
@@ -14251,14 +15721,43 @@ function ValidatorPlugin(rules, data, formId, culture) {
         var XHRData = null;
         var isAttachment = null; // handle download
         var hFormIsRequired = null;
+        // #gh76 — per-send capture of the popin the SUBMITTING form lives in (or null),
+        // read at the settle below. `$form.eventData` is per form and a second send would
+        // overwrite it; this closure is per send (#B175 made the XHR per send).
+        /** @type {{ popin: (object|null), target: (HTMLElement|null), swap: string, select: (string|null), targetAttr: (string|null), rebindSelf: boolean, overrides: (object|undefined), sync: (string|undefined), syncDerived: (boolean|undefined), syncKey: (HTMLElement|undefined), superseded: (boolean|undefined), disabledElts: (Array<HTMLElement>|null|undefined) }} */
+        var sendCtx = { popin: null, target: null, swap: 'innerHTML', select: null, targetAttr: null, rebindSelf: false };
+        // #gh76 slice 4 — the receiver and the caller's ORIGINAL options, captured BEFORE the
+        // merge below stamps headers into them: a `data-gina-form-sync="queue"` submit is
+        // replayed by re-entering send() from the settle chokepoint, and it must re-enter with
+        // what the caller passed, never with this send's merged copy.
+        var syncReceiver = this, syncRawOptions = options, syncEntry = null, syncParsed = null;
 
         options = (typeof (options) != 'undefined') ? merge(options, xhrOptions) : xhrOptions;
 
+        // forward callback to HTML data event attribute through `hform` status
+        // success -> data-gina-form-event-on-submit-success
+        // error -> data-gina-form-event-on-submit-error
+        // afterswap -> data-gina-form-event-on-swap (#gh76 slice 2)
+        // #gh76 slice 4 — read here, above the gate, so the coordination decision below can
+        // refuse a submit into the declared error channel. The binding itself still happens
+        // at its own site further down.
+        hFormIsRequired = ( $target.getAttribute('data-gina-form-event-on-submit-success') || $target.getAttribute('data-gina-form-event-on-submit-error') || $target.getAttribute('data-gina-form-event-on-swap') ) ? true : false;
+
+        // #gh76 slice 4 — `data-gina-form-sync` declares what this submit does when another
+        // request already owns the same key. Read before the gate below, because a form that
+        // declares it OWNS its own overlap decision: the gate is `setOptions`-wide with no
+        // per-form form, so `replace` and `queue` could not be reached otherwise.
+        var syncAttr = $target.getAttribute('data-gina-form-sync');
+
         // Rate Limit to one request at the time
         // Attention: this should be an option
         // the request needs to be completed before another can be made
         // TODO - Check same url
+        // #gh76 slice 4 — yields to `data-gina-form-sync` when that attribute is declared.
+        // Absent ⇒ byte-identical behaviour to before.
         if (
+            syncAttr === null
+            && (
             /^true$/i.test(options.withRateLimit)
             && typeof($form.isSending) != 'undefined'
             && /^true$/i.test($form.isSending)
@@ -14266,6 +15765,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
             /^true$/i.test(options.withRateLimit)
             && typeof($form.sent) != 'undefined'
             && /^true$/i.test($form.sent)
+            )
         ) {
             // #B247 — deliberately NO loading-state release here. This return means a
             // request for this form is already in flight, so the trigger that owns it is
@@ -14275,6 +15775,83 @@ function ValidatorPlugin(rules, data, formId, culture) {
             return;
         }
 
+        // #gh76 slice 4 — the coordination decision. It runs BEFORE `isSending` is claimed
+        // below because `replace` aborts the in-flight request, and an XHR abort settles its
+        // handler SYNCHRONOUSLY: claiming first would let that settle clear the very flag this
+        // send had just taken (the #B332 class). The same ordering is why `ownedByEarlierSend`
+        // is read after this block — after an abort, nothing is owned by an earlier send.
+        // The strategy is the form's own `data-gina-form-sync` when it declares one, and is
+        // otherwise DERIVED from the swap strategy it already declared — so the case this
+        // slice exists for, two forms replacing one region, is coordinated with nothing
+        // written in the markup. The attribute is the override, not the switch.
+        if ( syncAttr !== null ) {
+            syncParsed = parseSync(syncAttr);
+        } else {
+            syncParsed = deriveSync($target);
+        }
+        // An UNREADABLE value coordinates nothing, so there is nothing to decide here — and the
+        // refusal it owes cannot be delivered from this far up, where the declared callbacks are
+        // not bound yet. It is carried to the pre-flight below, beside its `-target`/`-swap`
+        // siblings, and the gate above has already yielded because the attribute is present, so
+        // the submit is guaranteed to reach it.
+        if ( syncParsed && !syncParsed.error ) {
+            var syncKey      = syncParsed.key || resolveSyncKey($target);
+            var syncDecision = decideSync(syncParsed, syncRegistry.get(syncKey));
+            if ( syncDecision.action === 'drop' ) {
+                // #B247's ownership rule, re-derived for a TARGET key: a submit that stops here
+                // never reaches an XHR, so no settle will release the loading state its own click
+                // armed. The module-wide gate could return without releasing because it only ever
+                // fires on the form that already owns the request — its settle does the release.
+                // A target key coordinates DIFFERENT forms, so the one turned away here is usually
+                // not the one running, and nothing else would ever release it. It releases only
+                // what it owns: when this form IS the one in flight, the state belongs to that
+                // request and its settle still owns it.
+                if ( !( /^true$/i.test(instance.$forms[id].isSending) || /^true$/i.test($form.isSending) ) ) {
+                    disarmSubmitLoading($form);
+                }
+                syncNotice(id, 'submit dropped (`drop`) — a request already owns this target');
+                return;
+            }
+            if ( syncDecision.action === 'queue' ) {
+                syncEntry = syncRegistry.get(syncKey);
+                // a QUEUED submit keeps its loading state: it is genuinely pending, and the
+                // replay re-enters send() with `armSubmitLoading` first-arm-wins, so the state
+                // carries straight through to the real request's settle. Only a submit turned
+                // AWAY releases.
+                queueSyncSend(syncEntry, function replaySyncSend() { send.call(syncReceiver, data, syncRawOptions); });
+                syncNotice(id, 'submit queued (`queue`) — a request already owns this target');
+                return;
+            }
+            if ( syncDecision.abortPrevious ) {
+                syncEntry = syncRegistry.get(syncKey);
+                if ( syncEntry && syncEntry.xhr ) {
+                    if ( syncEntry.ctx ) {
+                        syncEntry.ctx.superseded = true;
+                    }
+                    try { syncEntry.xhr.abort(); } catch (abortErr) {}
+                    syncNotice(id, ( syncParsed.derived )
+                        ? 'the request that owned this target was superseded — a `'+ syncParsed.swap +'` answer replaces the region, so the one still on the wire is moot (declare `data-gina-form-sync` to choose otherwise)'
+                        : 'the request that owned this target was superseded (`replace`)');
+                    // That settle released the loading state on its way out (`loadend` covers
+                    // abort). This send is the one now running, so it takes the state over:
+                    // `armSubmitLoading` is first-arm-wins and the stash was just cleared, so
+                    // on a same-form replace this is the arm that sticks; on two different
+                    // forms the replacing one is already armed and this is a no-op.
+                    armSubmitLoading(instance.$forms[id], $submitTrigger);
+                }
+            }
+            sendCtx.sync        = syncParsed.strategy;
+            sendCtx.syncDerived = !!syncParsed.derived;
+            sendCtx.syncKey     = syncKey;
+        }
+
+        // #gh76 slice 2 — whether a PREVIOUS request still owns `isSending` and the armed
+        // loading state, read BEFORE this attempt claims them. Only reachable with
+        // `withRateLimit: false` (the gate above returns otherwise), and only consulted by
+        // a pre-send refusal below — which must not clear state it does not own.
+        var ownedByEarlierSend = /^true$/i.test(instance.$forms[id].isSending)
+            || /^true$/i.test($form.isSending);
+
         instance.$forms[id].isSending = true;
 
 
@@ -14297,26 +15874,62 @@ function ValidatorPlugin(rules, data, formId, culture) {
             options.headers['X-Gina-Form-Rule'] = $form.target.dataset.ginaFormRule +'@'+ gina.config.bundle;
         }
 
-        if (isPopinContext()) {
-            // select popin current active popin
-            $activePopin = gina.popin.getActivePopin();
-            if ( $activePopin.isOpen ) {
-                if ( typeof($activePopin.id) != 'undefined' )
-                    options.headers['X-Gina-Popin-Id'] = $activePopin.id;
+        // #gh76 — the popin context a request carries is the popin the SUBMITTING form is
+        // rendered in, resolved by containment, never "some popin is open" (the former
+        // isPopinContext() gate): a page form submitted while a non-modal popin was open
+        // told the server it came from that popin — `self.isPopinContext()` read true and
+        // the redirect came back as a popin redirect — the request-side half of the same
+        // defect. Gated on the popin handler existing, as the settle site always was.
+        sendCtx.popin = (
+            typeof(gina.popin) != 'undefined'
+            && gina.popin
+            && typeof(gina.popin.getPopinContaining) == 'function'
+        ) ? gina.popin.getPopinContaining($target) : null;
+        if ( sendCtx.popin && sendCtx.popin.isOpen ) {
+            if ( typeof(sendCtx.popin.id) != 'undefined' )
+                options.headers['X-Gina-Popin-Id'] = sendCtx.popin.id;
 
-                if ( typeof($activePopin.name) != 'undefined' )
-                    options.headers['X-Gina-Popin-Name'] = $activePopin.name;
-            }
+            if ( typeof(sendCtx.popin.name) != 'undefined' )
+                options.headers['X-Gina-Popin-Name'] = sendCtx.popin.name;
         }
 
 
-        // forward callback to HTML data event attribute through `hform` status
-        hFormIsRequired = ( $target.getAttribute('data-gina-form-event-on-submit-success') || $target.getAttribute('data-gina-form-event-on-submit-error') ) ? true : false;
-        // success -> data-gina-form-event-on-submit-success
-        // error -> data-gina-form-event-on-submit-error
+        // #gh76 slice 4 — `hFormIsRequired` itself is now decided at the top of send(): the
+        // coordination decision up there can refuse a submit, and a refusal must reach the
+        // declared error channel. Only the listener binding stays here, where it always was.
         if (hFormIsRequired)
             listenToXhrEvents($form);
 
+        // #gh76 slice 2 — a DECLARED swap target is resolved NOW, from the submitting form,
+        // and carried to the settle in this closure (the htmx contract: the target is a
+        // property of the issuing element, resolved before the request is sent). A target
+        // or strategy that cannot be honoured refuses the submit before anything leaves —
+        // fail-LOUD, deliberately the opposite of `data-gina-dialog-target`'s silent
+        // full-replace fallback.
+        var targetAttr = $target.getAttribute('data-gina-form-target');
+        var swapAttr   = $target.getAttribute('data-gina-form-swap');
+        var selectAttr = $target.getAttribute('data-gina-form-select');
+        if ( targetAttr !== null ) {
+            var resolvedTarget = resolveSwapTarget($target, targetAttr);
+            if ( resolvedTarget.error ) {
+                refuseSend($form, $target, id, hFormIsRequired, 'data-gina-form-target', targetAttr, resolvedTarget.error, ownedByEarlierSend);
+                return;
+            }
+            sendCtx.target     = resolvedTarget.target;
+            sendCtx.targetAttr = targetAttr;
+        }
+        if ( swapAttr !== null ) {
+            var strategy = swapAttr.trim();
+            if ( SWAP_STRATEGIES.indexOf(strategy) < 0 ) {
+                refuseSend($form, $target, id, hFormIsRequired, 'data-gina-form-swap', swapAttr, 'unknown swap strategy `'+ strategy +'` (one of '+ SWAP_STRATEGIES.join(', ') +')', ownedByEarlierSend);
+                return;
+            }
+            sendCtx.swap = strategy;
+        }
+        if ( selectAttr !== null && selectAttr.trim() !== '' ) {
+            sendCtx.select = selectAttr.trim();
+        }
+
         // #R8 — staged-upload send? (virtual `gina-upload-*` form) The upload-progress
         // channel below only activates for these sends.
         var isUploadXhr = /^gina\-upload/i.test(id);
@@ -14325,6 +15938,35 @@ function ValidatorPlugin(rules, data, formId, culture) {
         // handler); no default: absent attribute = no `.hform` progress channel
         var uploadProgressHFormIsRequired = ( $target.getAttribute('data-gina-form-event-on-upload-progress') ) ? true : false;
 
+        // #gh76 slice 4 — `data-gina-form-disabled-elt`: elements held disabled for the life
+        // of this request, so a user cannot act on what the answer is about to change. Placed
+        // AFTER every pre-send refusal and after the coordination decision, and BEFORE the XHR
+        // is opened, so a refused submit can never strand a disabled control; released at the
+        // `loadend` fail-safe below — the one chokepoint that covers error, abort and timeout
+        // as well as success.
+        // #gh76 slice 4 — the refusal deferred from the coordination decision above: delivered
+        // HERE, where `listenToXhrEvents` has bound the declared error callback, and outside the
+        // `-target`/`-swap` window so that window's shape is untouched.
+        if ( syncParsed && syncParsed.error ) {
+            refuseSend($form, $target, id, hFormIsRequired, 'data-gina-form-sync', syncAttr, syncParsed.error, ownedByEarlierSend);
+            return;
+        }
+
+        var disabledAttr = $target.getAttribute('data-gina-form-disabled-elt');
+        if ( disabledAttr !== null ) {
+            var resolvedDisabled = resolveDisabledElts($target, disabledAttr);
+            if ( resolvedDisabled.error ) {
+                refuseSend($form, $target, id, hFormIsRequired, 'data-gina-form-disabled-elt', disabledAttr, resolvedDisabled.error, ownedByEarlierSend);
+                return;
+            }
+            sendCtx.disabledElts = [];
+            for (var dIdx = 0; dIdx < resolvedDisabled.elements.length; ++dIdx) {
+                if ( disableForRequest(resolvedDisabled.elements[dIdx], id) ) {
+                    sendCtx.disabledElts.push(resolvedDisabled.elements[dIdx]);
+                }
+            }
+        }
+
         var url         = $target.getAttribute('action') || options.url;
         var method      = $target.getAttribute('method') || options.method;
         method          = method.toUpperCase();
@@ -14442,8 +16084,43 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     // #A11Y4 — last, so focus lands on a trigger that is fully settled:
                     // re-enabled above and no longer flagged loading.
                     releaseSubmitA11y($form, $submitTrigger);
+                    // #gh76 slice 4 — the same one chokepoint releases what this request held
+                    // disabled, frees its coordination slot and starts the next deferred
+                    // submit. A slot is freed only by the request that owns it (a late settle
+                    // must never evict a newer one — the XHR object is that identity), and a
+                    // SUPERSEDED settle does not shift: the request that replaced it claims
+                    // the slot on the very next statement of the aborting send().
+                    releaseDisabledElts(sendCtx.disabledElts);
+                    sendCtx.disabledElts = null;
+                    if ( sendCtx.syncKey ) {
+                        var settledEntry = syncRegistry.get(sendCtx.syncKey);
+                        if ( settledEntry && settledEntry.xhr === xhr ) {
+                            settledEntry.xhr = null;
+                            settledEntry.ctx = null;
+                            if ( !sendCtx.superseded ) {
+                                shiftSyncQueue(settledEntry);
+                            }
+                        }
+                    }
                 });
             }
+            // #gh76 slice 4 — claiming the coordination slot is deliberately deferred to the
+            // line AFTER `xhr.send()` at each of its three sites: claiming here would leave a
+            // key wedged "busy" forever on the one path that opens an XHR and never sends it
+            // (a `processFiles` failure on the binary branch), because `loadend` — the only
+            // release — never fires for a request that never left.
+            var claimSyncSlot = function() {
+                if ( !sendCtx.syncKey ) {
+                    return;
+                }
+                var claimed = syncRegistry.get(sendCtx.syncKey);
+                if ( !claimed ) {
+                    claimed = { xhr: null, ctx: null, queue: [] };
+                    syncRegistry.set(sendCtx.syncKey, claimed);
+                }
+                claimed.xhr = xhr;
+                claimed.ctx = sendCtx;
+            };
             // catching ready state cb
             // Data loading ...
             if ( /^(1|3)$/.test(xhr.readyState) ) {
@@ -14461,7 +16138,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
             }
             //handleXhrResponse(xhr, $target, id, $form, hFormIsRequired);
             xhr.onreadystatechange = function onValidationCallback(event) {
-                $form.isSubmitting = false;
+                // #gh76 slice 4 — a request superseded by `data-gina-form-sync="replace"`
+                // settles SYNCHRONOUSLY inside the aborting send()'s own decision, before that
+                // send has claimed this latch: clearing it unconditionally here would clear the
+                // NEW cycle's flag and strand it (the #B332 class).
+                if ( !sendCtx.superseded ) {
+                    $form.isSubmitting = false;
+                }
                 // #B175: `isSending` is no longer cleared here — this handler
                 // first fires at readyState 1 (synchronously at open()), so an
                 // early clear made the flag false for almost the whole request
@@ -14528,6 +16211,26 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     // with the `loadend` release, which may already have restored it.
                     releaseSubmitA11y($form, $submitTrigger);
 
+                    // #gh76 slice 4 — this request was superseded by a later submit on the same
+                    // `data-gina-form-sync` key. Its RELEASE arms above have run, and must: the
+                    // trigger, the loading state and the a11y state may never outlive their
+                    // request. Its DISPATCH arms must not run at all — an aborted XHR settles at
+                    // readyState 4 with status 0, which the transport arm below reads as a 408
+                    // the server never sent (#B447). A deliberate abort is not an error: it
+                    // reaches its own `abort.<id>` channel and stops there, so neither `error`
+                    // nor `data-gina-form-event-on-submit-error` ever sees it.
+                    if ( sendCtx.superseded ) {
+                        triggerEvent(gina, $target, 'abort.' + id, {
+                            status  : 0,
+                            reason  : 'superseded',
+                            sync    : sendCtx.sync || null,
+                            // the default needs no attribute, so a page seeing this event may
+                            // find nothing in its own markup that asked for it: say which it was
+                            derived : !!sendCtx.syncDerived
+                        });
+                        return;
+                    }
+
                     var $popin          = null;
                     var blob            = null;
                     var contentType     = xhr.getResponseHeader("Content-Type");
@@ -14603,31 +16306,70 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                 if ( typeof(result.status) == 'undefined' )
                                     result.status = xhr.status;
 
+                                // #gh76 §6 — the server's last word (X-Gina-Retarget / -Reswap /
+                                // -Reselect): read once the answer is known to be HTML, before
+                                // the target fork and before `beforeswap`, so a listener still
+                                // has the final say. A JSON answer never reaches this read.
+                                applyResponseOverrides(xhr, sendCtx, $target, id);
+
+                                // #gh76 §6 — a Retarget that cannot be honoured: no swap, nowhere
+                                // (the popin included) — the server plainly meant somewhere else,
+                                // or the answer came from another origin, which may not choose.
+                                // The handler still receives the answer, and out-of-band elements
+                                // still land below: they are addressed by id, not by the target.
+                                if ( sendCtx.overrides && sendCtx.overrides.retarget && !sendCtx.overrides.retarget.applied ) {
+                                    var parsedRefused = parseXhrHtmlAnswer(result.content);
+                                    result = {
+                                        contentType : result.contentType,
+                                        content     : result.content,
+                                        status      : result.status,
+                                        data        : parsedRefused.data,
+                                        view        : parsedRefused.view,
+                                        target      : null,
+                                        swap        : sendCtx.swap,
+                                        swapped     : false,
+                                        reason      : 'retargetError',
+                                        overrides   : sendCtx.overrides
+                                    };
+                                }
+                                // #gh76 slice 2 — a DECLARED target wins over containment: the
+                                // answer is swapped into the element captured at submit (inside
+                                // or outside a popin), bound, and delivered with the richer
+                                // payload; the shared tail below emits `success`.
+                                else if ( sendCtx.target ) {
+                                    result = applySwap(sendCtx, $form, $target, id, hFormIsRequired, result);
+                                }
                                 // if hasPopinHandler & popinIsBinded
-                                if ( typeof(gina.popin) != 'undefined' && gina.hasPopinHandler ) {
-                                    // select popin current active popin
-                                    $popin = gina.popin.getActivePopin();
+                                else if ( typeof(gina.popin) != 'undefined' && gina.hasPopinHandler ) {
+                                    // #gh76 — the answer goes to the popin the form was captured
+                                    // in at submit, while it is still open and still contains the
+                                    // form; anything else is the legacy handler-only payload.
+                                    // Never "the active popin": that routed a PAGE form's answer
+                                    // into an open popin (content replaced) or a loading one (a
+                                    // false 422, `Popin x is not open !`), and with two popins
+                                    // open picked the first registered one.
+                                    $popin = popinStillContaining(sendCtx.popin, $target);
+                                    warnIfOldRuleRouted(sendCtx.popin, $popin, $target, 'answer');
 
                                     if ($popin) {
 
-                                        XHRData = {};
+                                        // #B575 — ONE tolerant parse: the hidden inputs are a dev-mode
+                                        // transport (spliced only under NODE_ENV_IS_DEV), so outside
+                                        // dev mode they are absent — dereferencing them threw inside
+                                        // this try and surfaced as a false 422 error callback, and the
+                                        // popin was never loaded
+                                        var parsedAnswer = parseXhrHtmlAnswer(result.content);
+                                        XHRData = parsedAnswer.data;
+                                        XHRView = parsedAnswer.view;
                                         // update toolbar
-
                                         try {
-                                            XHRData = new DOMParser().parseFromString(result.content, 'text/html').getElementById('gina-without-layout-xhr-data');
-                                            XHRData = JSON.parse(decodeURIComponent(XHRData.value));
-
-                                            XHRView = new DOMParser().parseFromString(result.content, 'text/html').getElementById('gina-without-layout-xhr-view');
-                                            XHRView = JSON.parse(decodeURIComponent(XHRView.value));
-
                                             // update data tab
-                                            if ( gina && envIsDev && typeof(window.ginaToolbar) && typeof(XHRData) != 'undefined' ) {
+                                            if ( gina && envIsDev && typeof(window.ginaToolbar) && XHRData ) {
                                                 window.ginaToolbar.update("data-xhr", XHRData);
                                             }
 
                                             // update view tab
-
-                                            if ( gina && envIsDev && typeof(window.ginaToolbar) && typeof(XHRView) != 'undefined' ) {
+                                            if ( gina && envIsDev && typeof(window.ginaToolbar) && XHRView ) {
                                                 window.ginaToolbar.update("view-xhr", XHRView);
                                             }
 
@@ -14635,15 +16377,69 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                             throw err
                                         }
 
+                                        // #gh76 slice 3 — out-of-band elements are swapped into the PAGE
+                                        // before the popin receives what is left; an EMPTY remainder means
+                                        // nothing was addressed to the popin, so it is left as it is
+                                        // (loading '' would blank the open dialog and unbind its form —
+                                        // measured). The popin payload below is untouched: the oob
+                                        // results reach the consumer through the events.
+                                        var popinContent = result.content, oobRunPopin = null;
+                                        if ( typeof(result.content) == 'string' && result.content.indexOf('data-gina-swap-oob') > -1 ) {
+                                            oobRunPopin = applyOobSwaps(parsedAnswer.doc, { $target: $target, id: id, hFormIsRequired: hFormIsRequired, gina: gina });
+                                            warnOobRefusals(id, oobRunPopin.list);
+                                            popinContent = parsedAnswer.doc.body.innerHTML;
+                                            if ( oobRunPopin.rebindSelf ) sendCtx.rebindSelf = true;
+                                        }
+                                        if ( oobRunPopin === null || popinContent.trim() !== '' ) {
+                                            $popin.loadContent(popinContent);
+                                        }
 
-                                        $popin.loadContent(result.content);
-
-                                        result = XHRData;
+                                        // the parsed xhr-data in dev mode, delivered VERBATIM, or
+                                        // an object carrying the status outside dev mode where the
+                                        // transport inputs are absent (the handler contract is "an
+                                        // object", never null). The parsed data is never mutated:
+                                        // injecting a `status` key into the action's own data would
+                                        // change the payload every contained form already receives.
+                                        result = XHRData || { status: xhr.status };
+                                        // #B571 — this branch returned after the bare event, so the
+                                        // DECLARED success callback (bound to the `.hform` channel by
+                                        // listenToXhrEvents) never ran for a form answering into a
+                                        // popin; mirror the shared tail below, eventData included.
+                                        $form.eventData.success = result;
                                         triggerEvent(gina, $target, 'success.' + id, result);
 
+                                        if (hFormIsRequired)
+                                            triggerEvent(gina, $target, 'success.' + id + '.hform', result);
+
+                                        // #gh76 slice 3 — an oob swap that replaced the submitting form
+                                        // (the popin left as it was) binds the same-id replacement now,
+                                        // exactly as the shared tail below does
+                                        if ( sendCtx.rebindSelf ) {
+                                            finalizeSelfReplacement($target, id);
+                                        }
                                         return;
                                     }
                                 }
+
+                                // #gh76 slice 3 — the legacy path (no declared target, not inside a
+                                // popin): the raw answer still goes to the handler, inserted nowhere,
+                                // but its out-of-band elements are swapped into the page first (htmx:
+                                // "out of band items will still be processed"). `content` stays raw;
+                                // `remainder` is what to insert, `oob` what was handled.
+                                if ( !sendCtx.target && typeof(result.content) == 'string' && result.content.indexOf('data-gina-swap-oob') > -1 ) {
+                                    var parsedLegacy = parseXhrHtmlAnswer(result.content);
+                                    var oobRunLegacy = applyOobSwaps(parsedLegacy.doc, { $target: $target, id: id, hFormIsRequired: hFormIsRequired, gina: gina });
+                                    warnOobRefusals(id, oobRunLegacy.list);
+                                    result.oob       = oobRunLegacy.list;
+                                    result.remainder = parsedLegacy.doc.body.innerHTML;
+                                    if ( oobRunLegacy.rebindSelf ) sendCtx.rebindSelf = true;
+                                }
+                                // #gh76 §6 — an override the server sent to a target-less form
+                                // (ignored, `reason: 'noTarget'`) is still reported to the handler;
+                                // the popin path's parsed data is delivered verbatim and carries none
+                                if ( !sendCtx.target && sendCtx.overrides && typeof(result.overrides) == 'undefined' ) {
+                                    result.overrides = sendCtx.overrides;
+                                }
                             }
 
                             $form.eventData.success = result;
@@ -14684,14 +16480,34 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                 && typeof(result.location) != 'undefined'
                                 && isXhrRedirect
                             ) {
-                                $popin = gina.popin.getActivePopin();
+                                // #gh76 — route by the SUBMITTING form's popin, never by "the
+                                // active popin". A name-less `result.popin` directive (`close`,
+                                // `url`) is the one case where the server addresses "the open
+                                // popin" explicitly — only a route the app declared as popin
+                                // context produces it — so it keeps the open-only fallback; a
+                                // plain `location` redirect was chosen by the server BECAUSE it
+                                // saw no popin context, so from a page form it falls through to
+                                // the page redirect below instead of loading into a popin the
+                                // form is not inside.
+                                $popin = sendCtx.popin
+                                      || ( ( typeof(result.popin) != 'undefined' ) ? gina.popin.getActivePopin() : null );
+                                if ( !$popin && typeof(result.popin) == 'undefined' ) {
+                                    warnIfOldRuleRouted(sendCtx.popin, $popin, $target, 'redirect');
+                                }
                                 if ( !$popin && typeof(result.popin) != 'undefined' ) {
-                                    if ( typeof(result.popin) != 'undefined' && typeof(result.popin.name) == 'undefined' ) {
-                                        throw new Error('To get a `$popin` instance, you need at list a `popin.name`.');
-                                    }
-                                    $popin = gina.popin.getPopinByName(result.popin.name);
-                                    if ( !$popin ) {
-                                        throw new Error('Popin with name: `'+ result.popin.name +'` not found.')
+                                    if ( typeof(result.popin.name) == 'undefined' ) {
+                                        // a name-less `close` with nothing open to close is a no-op,
+                                        // not an error: getActivePopin() no longer resolves a not-open
+                                        // popin for that close() to no-op on (#gh76 §8(a)); only an
+                                        // actual resolve still throws
+                                        if ( typeof(result.popin.close) == 'undefined' ) {
+                                            throw new Error('To get a `$popin` instance, you need at list a `popin.name`.');
+                                        }
+                                    } else {
+                                        $popin = gina.popin.getPopinByName(result.popin.name);
+                                        if ( !$popin ) {
+                                            throw new Error('Popin with name: `'+ result.popin.name +'` not found.')
+                                        }
                                     }
                                 }
 
@@ -14699,8 +16515,11 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                     typeof(result.popin) != 'undefined'
                                     && typeof(result.popin.close) != 'undefined'
                                 ) {
-                                    $popin.isRedirecting = false;
-                                    $popin.close();
+                                    // #gh76 — `$popin` is null when nothing is open to close
+                                    if ($popin) {
+                                        $popin.isRedirecting = false;
+                                        $popin.close();
+                                    }
                                     var _reload = (result.popin.reload) ? result.popin.reload : false;
                                     if ( !result.popin.location && !result.popin.url) {
                                        delete result.popin;
@@ -14786,6 +16605,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
                             if (hFormIsRequired)
                                 triggerEvent(gina, $target, 'success.' + id + '.hform', result);
 
+                            // #gh76 slice 2 — a swap that replaced or removed the SUBMITTING form
+                            // kept its listeners until the events above were delivered; its
+                            // replacement (same id) is bound only now
+                            if ( sendCtx.rebindSelf ) {
+                                finalizeSelfReplacement($target, id);
+                            }
+
                         } catch (err) {
 
                             result = {
@@ -15234,6 +17060,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                     if ( /^gina\-upload/i.test(id) )
                                         onUpload(gina, $target, 'error', id, err);
 
+                                    // #gh76 slice 4 — this send never reaches the wire, so its
+                                    // `loadend` never fires: release what it held disabled here.
+                                    // The coordination slot needs nothing — it is claimed after
+                                    // `xhr.send()`, which this branch never reaches.
+                                    releaseDisabledElts(sendCtx.disabledElts);
+                                    sendCtx.disabledElts = null;
+
                                     triggerEvent(gina, $target, 'error.' + id, err);
 
                                     if (hFormIsRequired)
@@ -15243,6 +17076,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                     if (done) {
                                         xhr.setRequestHeader('Content-Type', 'multipart/form-data; boundary=' + boundary);
                                         xhr.send(data);
+                                        claimSyncSlot(); // #gh76 slice 4 — after send(): a throw leaves no wedged key
 
                                         $form.sent = true;
                                         if ( envIsDev && isGFFCtx && typeof(window.ginaToolbar) != 'undefined' && window.ginaToolbar ) {
@@ -15298,6 +17132,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         xhr.setRequestHeader('Content-Type', sendContentType);
                     }
                     xhr.send(data)
+                    claimSyncSlot(); // #gh76 slice 4
                 }
 
             } else {
@@ -15306,6 +17141,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     xhr.setRequestHeader('Content-Type', enctype);
                 }
                 xhr.send()
+                claimSyncSlot(); // #gh76 slice 4
             }
 
             $form.sent = true;
@@ -16497,6 +18333,16 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 $form.on('success.hform',  window[htmlSuccesEventCallback])
             }
         }
+        //data-gina-form-event-on-swap (#gh76 slice 2) -> afterswap.<id>.hform
+        var htmlSwapEventCallback =  $form.target.getAttribute('data-gina-form-event-on-swap') || null;
+        if (htmlSwapEventCallback != null) {
+            if ( /\((.*)\)/.test(htmlSwapEventCallback) ) {
+                // #M21a — function-call shape unsupported; register a bare handler on window instead
+                try { console.warn('[gina-form-event] function-call shape not supported on data-gina-form-event-on-swap — use a bare identifier and register the handler on window: '+ htmlSwapEventCallback); } catch (e) {}
+            } else {
+                $form.on('afterswap.hform', window[htmlSwapEventCallback])
+            }
+        }
         //data-gina-form-event-on-submit-error
         var htmlErrorEventCallback =  $form.target.getAttribute('data-gina-form-event-on-submit-error') || null;
         if (htmlErrorEventCallback != null) {
@@ -16751,6 +18597,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 $validator.unbind               = unbindForm;
                 $validator.bind                 = bindForm;
                 $validator.reBind               = reBindForm;
+                $validator.bindRegion           = bindFormsInRegion;
                 $validator.destroy              = destroy;
 
                 var id          = null
@@ -16763,6 +18610,10 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 // form has rule ?
                 for (var f=0, len = $allForms.length; f<len; ++f) {
                     // preparing prototype (need at least an ID for this)
+                    // #B549 — bind only what the page opted in; a bare <form> is left
+                    // untouched (no minted id, no $forms entry, no submit proxy), as the
+                    // guide states. Explicit validateFormById()/getFormById() stay ungated.
+                    if ( !isFormOptedIn($allForms[f], local.rules) ) { continue; }
 
                     if ($allForms[f].getAttribute) {
                         id = $allForms[f].getAttribute('id') || 'form.' + uuid();
@@ -18410,6 +20261,88 @@ function ValidatorPlugin(rules, data, formId, culture) {
         return $form;
     }
 
+    /**
+     * bindFormsInRegion
+     *
+     * #gh76 slice 2 — binds the forms of a freshly injected region through the SAME gate
+     * the boot scan applies (#B549): a form is bound only when the markup opts it in (a
+     * `data-gina-form-*` attribute, an id naming a registered rule, or a `gina-upload-*`
+     * id); a bare form keeps its native submit, exactly as on the initial page. Called by
+     * the shared `bindRegion()` DOM helper for fragment navigation and form-answer swaps,
+     * so swapped content follows the contract the guide states instead of re-entering
+     * the pre-#B549 bind-everything shape.
+     *
+     * An id-less opted-in form is minted an id, as at boot. A registry entry whose
+     * element is no longer the one in the region (a same-id replacement) is destroyed
+     * first, so `validateFormById` binds the NEW element instead of returning the stale
+     * entry. A form already bound to this very element is left alone.
+     *
+     * @param {HTMLElement} $root - the injected region
+     * @param {object} [options]
+     * @param {string|null} [options.deferFormId] - a form id to skip: the submitting form
+     *      of a swap that replaced it keeps its listeners until the swap's own events are
+     *      delivered, and is (re)bound by the caller afterwards
+     *
+     * @returns {number} the number of forms bound
+     *
+     * @example
+     * $region.innerHTML = fragment;
+     * gina.validator.bindRegion($region); // => 1
+     */
+    // NOTE: deliberately NOT named `bindRegion`. `var` hoists over the whole module,
+    // so a local of that name shadows utils/dom's shared `bindRegion()` policy for
+    // every line of this file — which is how a swapped region's `<script src>` came
+    // to be silently dropped (#gh76 slice 2): `applySwap` called the bare name and
+    // got THIS forms-only binder. The PUBLISHED name stays `gina.validator.bindRegion`.
+    var bindFormsInRegion = function($root, options) {
+        var bound   = 0
+            , $v    = ( this && typeof(this.$forms) != 'undefined' ) ? this : instance
+            , $forms = null
+            , $f    = null
+            , _id   = null
+            , existing = null
+            , deferId = ( options && options.deferFormId ) ? options.deferFormId : null
+        ;
+        if ( !$root || typeof($root.getElementsByTagName) != 'function' ) {
+            return bound;
+        }
+        // a static copy: binding mutates nothing structural, but a live collection is
+        // the wrong thing to iterate while ids are minted
+        $forms = Array.prototype.slice.call($root.getElementsByTagName('form'));
+        for (var f = 0, fLen = $forms.length; f < fLen; ++f) {
+            $f = $forms[f];
+            if ( !isFormOptedIn($f, local.rules) ) continue;
+
+            _id = $f.getAttribute('id') || 'form.' + uuid();
+            if ( _id !== $f.getAttribute('id') ) {
+                $f.setAttribute('id', _id);
+            }
+            if ( deferId && _id === deferId ) continue;
+
+            existing = instance.$forms[_id];
+            if ( existing && existing.target === $f ) continue; // already bound to this element
+
+            if ( existing && existing.target && existing.target !== $f ) {
+                // the region replaced a same-id form: retire the stale entry so the new
+                // element binds (validateFormById returns an existing entry untouched)
+                try {
+                    destroy(_id);
+                } catch (staleErr) {
+                    // one stale entry must never abort the binding of the others — a form
+                    // holding a detached virtual upload input throws inside unbindForm
+                    if ( typeof(console) != 'undefined' && console.warn ) {
+                        console.warn('[gina][validator] bindRegion: could not retire stale form `' + _id + '`: ' + (staleErr.message || staleErr));
+                    }
+                    delete instance.$forms[_id];
+                }
+            }
+
+            validateFormById.call($v, _id);
+            bound++;
+        }
+        return bound;
+    }
+
     var unbindForm = function($target) {
         var $form   = null
             , _id   = null
@@ -18448,6 +20381,9 @@ function ValidatorPlugin(rules, data, formId, culture) {
         if ($form.target.getAttribute('data-gina-form-event-on-submit-error'))
             removeListener(gina, $form, 'error.' + _id + '.hform');
 
+        if ($form.target.getAttribute('data-gina-form-event-on-swap'))
+            removeListener(gina, $form, 'afterswap.' + _id + '.hform');
+
         removeListener(gina, $form, 'validate.' + _id);
         removeListener(gina, $form, 'validated.' + _id);
         removeListener(gina, $form, 'submit.' + _id);
@@ -19266,19 +21202,33 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     var eventOnError    = $el.getAttribute('data-gina-form-upload-on-error');
                     var eventOnProgress = $el.getAttribute('data-gina-form-upload-on-progress'); // #R8
                     var errorField    = null;
+                    // #B572 — which popin, if any, this upload belongs to is decided by
+                    // CONTAINMENT (the popin the real form is inside), captured ONCE per
+                    // selection and read by every site below — never by "some popin is open"
+                    // (`isPopinContext()`), which placed a PAGE form's virtual upload form, its
+                    // preview lookups and its staging request inside whatever popin happened
+                    // to be open, where the staged metadata never reached the form. The same
+                    // capture the submit path makes into `sendCtx.popin`; `$el.form` is the
+                    // consumer's real form (the file input is never moved into the virtual one).
+                    var $ownerPopin = (
+                        typeof(gina.popin) != 'undefined'
+                        && gina.popin
+                        && typeof(gina.popin.getPopinContaining) == 'function'
+                    ) ? gina.popin.getPopinContaining($el.form || $el) : null;
+                    warnIfOldRulePlacedUpload($ownerPopin, $el.form, $el);
 
                     if (files.length > 0) {
 
                         // create form if not exists
-                        var $uploadForm = null, $activePopin = null;
-                        if ( isPopinContext() ) {
-                            // getting active popin
-                            $activePopin = gina.popin.getActivePopin();
-                            $activePopin.$target = new DOMParser().parseFromString($activePopin.target.outerHTML, 'text/html');
+                        var $uploadForm = null;
+                        if ( $ownerPopin ) {
+                            // the popin CONTAINING the real form (#B572) — its element is where
+                            // the virtual form lives and is torn down with it
+                            $ownerPopin.$target = new DOMParser().parseFromString($ownerPopin.target.outerHTML, 'text/html');
                             // binding to DOM
-                            $activePopin.$target.getElementById($activePopin.id).innerHTML = document.getElementById($activePopin.id).innerHTML;
+                            $ownerPopin.$target.getElementById($ownerPopin.id).innerHTML = document.getElementById($ownerPopin.id).innerHTML;
 
-                            $uploadForm = $activePopin.$target.getElementById(uploadFormId);
+                            $uploadForm = $ownerPopin.$target.getElementById(uploadFormId);
                         } else {
                             $uploadForm = document.getElementById(uploadFormId);
                         }
@@ -19291,8 +21241,8 @@ function ValidatorPlugin(rules, data, formId, culture) {
                             }
 
                             if (!$uploadForm) {
-                                $uploadForm = (isPopinContext())
-                                            ? $activePopin.$target.createElement('form')
+                                $uploadForm = ($ownerPopin)
+                                            ? $ownerPopin.$target.createElement('form')
                                             : document.createElement('form');
                             }
 
@@ -19323,8 +21273,8 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                 // no default id (see bindUploadDropzone)
                                 var dropzoneContainer   = $el.getAttribute('data-gina-form-upload-dropzone') || null;
                                 var previewContainer    = $el.getAttribute('data-gina-form-upload-preview') || fieldId + '-preview';
-                                previewContainer        = (isPopinContext())
-                                                        ? $activePopin.$target.getElementById(previewContainer)
+                                previewContainer        = ($ownerPopin)
+                                                        ? $ownerPopin.$target.getElementById(previewContainer)
                                                         : document.getElementById(previewContainer);
 
                                 // #B147 — previewContainer is a getElementById RESULT
@@ -19477,7 +21427,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                     mandatoryFields     : mandatoryFields,
                                     uploadFields        : hiddenFields,
                                     hasPreviewContainer : hasPreviewContainer,
-                                    isPopinContext      : isPopinContext()
+                                    isPopinContext      : !!$ownerPopin // #B572 — true iff the file's form is inside a popin; nothing reads it, the key is kept for shape
                                 };
                                 if (hasPreviewContainer) {
                                     $uploadForm.uploadProperties.previewContainer = previewContainer;
@@ -19504,9 +21454,9 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
 
                             // adding for to current document
-                            if (isPopinContext()) {
-                                //$activePopin.$target.appendChild($uploadForm)
-                                document.getElementById($activePopin.id).appendChild($uploadForm)
+                            if ($ownerPopin) {
+                                //$ownerPopin.$target.appendChild($uploadForm)
+                                document.getElementById($ownerPopin.id).appendChild($uploadForm)
                             } else {
                                 document.body.appendChild($uploadForm)
                             }
@@ -23520,6 +25470,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
         instance.setOptions             = setOptions;
         instance.getFormById            = getFormById;
         instance.validateFormById       = validateFormById;
+        instance.bindRegion             = bindFormsInRegion;
         instance.resetErrorsDisplay     = resetErrorsDisplay;
         instance.resetFields            = resetFields;
         instance.handleErrorsDisplay    = handleErrorsDisplay;
@@ -23706,6 +25657,7 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
             '$popins'       : _sharedPopins, // #B90 — module-shared registry (one object for all instances)
             activePopinId   : null,
             getActivePopin  : null, // returns the active $popin
+            getPopinContaining : null, // the popin whose element contains a given element (#gh76)
             target          : document, // by default
             isReady         : false,
             initialized     : false
@@ -23723,6 +25675,15 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
             'loadContent'       : null,
             'open'              : null,
             'isOpen'            : false,
+            // #gh76 §8 — true from the moment a `preOpen` popin shows its loading shell
+            // until its real open (or its close / failed load); a default popin shows
+            // nothing while it loads, so it never enters this state
+            'isLoading'         : false,
+            // #gh76 §8 — this popin's load sequence and the transport of the load in
+            // flight: a close during the load bumps the sequence, so the landing result
+            // is dropped instead of re-opening a dismissed dialog
+            '_loadSeq'          : 0,
+            '_loadXhr'          : null,
             'isRedirecting'     : false,
             'close'             : null,
             '$forms'            : [],
@@ -23833,21 +25794,78 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
             return $popin;
         }
 
+        /**
+         * getActivePopin
+         *
+         * The popin the framework considers active: the one `activePopinId` names WHEN IT
+         * IS OPEN, else the first open popin in registration order, else `null`.
+         *
+         * #gh76 §8(a) — a registered-but-not-open popin is never returned. The former
+         * any-registered fallback on `activePopinId` returned a popin during its own
+         * click-time load window (`popinLoad` sets the id before the content lands), which
+         * routed a page form's HTML answer into a popin the framework itself considered
+         * closed, and `popinLoadContent` then threw on it. With two popins open the id —
+         * the most recently opened one — now wins over registration order.
+         *
+         * @returns {object|null} $popin
+         *
+         * @example
+         * var $popin = gina.popin.getActivePopin();
+         * if ($popin) { $popin.close(); }
+         */
         function getActivePopin() {
-            var $popin = null;
+            var $popins = gina.popin.$popins, activeId = gina.popin.activePopinId;
 
-            for (var p in gina.popin.$popins) {
-                if ( typeof(gina.popin.$popins[p].isOpen) != 'undefined' && gina.popin.$popins[p].isOpen ) {
-                    $popin = gina.popin.$popins[p];
-                    break;
+            if ( activeId && $popins[activeId] && $popins[activeId].isOpen ) {
+                return $popins[activeId];
+            }
+            for (var p in $popins) {
+                if ( typeof($popins[p].isOpen) != 'undefined' && $popins[p].isOpen ) {
+                    return $popins[p];
                 }
             }
+            return null;
+        }
 
-            if (!$popin && gina.popin.activePopinId) {
-                $popin = gina.popin.$popins[gina.popin.activePopinId]
-            }
+        /**
+         * getPopinContaining
+         *
+         * The registered popin whose dialog element contains `$el`, or `null` when `$el`
+         * is not inside any popin. Innermost wins when popins nest (an in-page dialog
+         * registered from inside another popin's loaded content).
+         *
+         * #gh76 — the routing test for a form's or a link's HTML answer: the answer goes
+         * to the popin the SUBMITTING element lives in, never to "the active popin". The
+         * element id is the popin id on every flavour (dialog, div, in-page), so the walk
+         * is one `getElementById` + `contains` per registered popin — measured at 0.2 µs
+         * worst case per submit.
+         *
+         * @param {HTMLElement} $el - the form, anchor or any element to locate
+         *
+         * @returns {object|null} $popin
+         *
+         * @example
+         * var $popin = gina.popin.getPopinContaining(document.getElementById('my-form'));
+         * // -> the popin the form is rendered in, or null for a page form
+         */
+        function getPopinContaining($el) {
+            var $popins = gina.popin.$popins, $found = null, $foundEl = null, $dialog = null;
 
-            return $popin;
+            if ( !$el || typeof($el.nodeType) == 'undefined' ) {
+                return null;
+            }
+            for (var p in $popins) {
+                $dialog = ( $popins[p].id ) ? document.getElementById($popins[p].id) : null;
+                if ( !$dialog || !$dialog.contains($el) ) {
+                    continue;
+                }
+                // innermost wins: take the candidate the previous one contains
+                if ( !$found || $foundEl.contains($dialog) ) {
+                    $found   = $popins[p];
+                    $foundEl = $dialog;
+                }
+            }
+            return $found;
         }
 
 
@@ -24101,29 +26119,95 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
             }
         }
 
+        /**
+         * warnPartialTarget
+         *
+         * Dev-mode notice for the partial-swap fallbacks (#B580). Gated on
+         * `gina.config.envIsDev` like the CORS trace below, so production stays
+         * silent exactly as the guide promises; plain `console.warn`, the shape
+         * warnDeprecatedOnce uses. One line per event, naming the popin, the
+         * selector and which fallback ran — the three silent decisions this file
+         * used to make with no trace at all.
+         *
+         * @inner
+         * @param {object|null} $popin - the popin (its `name` goes in the message)
+         * @param {string} partialTarget - the declared `data-gina-dialog-target`
+         * @param {string} what - `invalid` | `noSlot` | `noRegion`
+         * @param {Error} [err] - the engine's error, for `invalid`
+         *
+         * @returns {undefined}
+         */
+        function warnPartialTarget($popin, partialTarget, what, err) {
+            var isDev = ( typeof(gina) != 'undefined' && gina && gina.config && gina.config.envIsDev ) ? true : false;
+            if ( !isDev || typeof(console) == 'undefined' || typeof(console.warn) != 'function' ) {
+                return;
+            }
+            var name = ( $popin && $popin.name ) ? $popin.name : '(unknown)';
+            var why  = ( what === 'invalid' )
+                ? 'is not a valid selector ('+ ( err && err.message ? err.message : String(err) ) +') — the whole dialog was replaced instead'
+                : ( what === 'noSlot' )
+                    ? 'matched nothing in the open dialog — the whole dialog was replaced instead'
+                    : 'matched nothing in the answer — the whole answer went into the slot';
+            try {
+                console.warn('[gina/popin] popin `'+ name +'`: `data-gina-dialog-target="'+ partialTarget +'"` '+ why +'.');
+            } catch (e) {}
+        }
+
         /**
          * applyContent
          *
-         * Full (default): replace the whole element — byte-identical to the legacy
-         * `$el.innerHTML = html.trim()`, so legacy popins are unaffected.
-         * Partial (`partialTarget` set): parse the fetched HTML with DOMParser and swap
-         * only the `partialTarget` region, so chrome (close button, header/footer) and
-         * its bindings survive. Falls back to full-replace if the slot is absent.
+         * Writes a loaded HTML body into the dialog element.
+         *
+         * Full (`partialTarget` absent): `$el.innerHTML = html.trim()`.
+         *
+         * Partial (`partialTarget` set): ONE plain CSS selector, applied on BOTH
+         * sides — it locates the slot in the OPEN DIALOG and the region in the
+         * parsed answer — and only the slot's CONTENTS are swapped, so chrome
+         * (close button, header/footer) and its bindings survive. That makes the
+         * attribute the dialog-scoped sibling of `data-gina-form-select`, not of
+         * `data-gina-form-target`: there is nothing here to resolve relative to an
+         * element, so the `this` / `closest` / `find` grammar does not apply.
+         *
+         * Three fallbacks, all deliberate (a popin open is a read the user can
+         * retry, so working-but-wrong beats refusing) and each now announced in
+         * dev mode (#B580 — before, the first THREW uncaught and the other two were
+         * silent):
+         *  - a selector the engine refuses         → full replace;
+         *  - a selector matching nothing in the dialog → full replace;
+         *  - a selector matching nothing in the answer → the whole answer body into the slot.
          *
          * @inner
+         * @param {HTMLElement} $el - the dialog element
+         * @param {string} html - the loaded body
+         * @param {object|null} $popin - the popin (for the notice)
+         * @param {string|null} partialTarget - the declared selector, or null
+         *
+         * @returns {undefined}
          */
         function applyContent($el, html, $popin, partialTarget) {
             if ( !partialTarget ) {
                 $el.innerHTML = ( typeof(html) == 'string' ) ? html.trim() : '';
                 return;
             }
-            var $slot = $el.querySelector(partialTarget);
+            var $slot = null, parsed = null, $incoming = null;
+            try {
+                $slot = $el.querySelector(partialTarget);
+            } catch (badSelector) {
+                warnPartialTarget($popin, partialTarget, 'invalid', badSelector);
+                $el.innerHTML = ( typeof(html) == 'string' ) ? html.trim() : '';
+                return;
+            }
             if ( !$slot ) {
+                warnPartialTarget($popin, partialTarget, 'noSlot');
                 $el.innerHTML = ( typeof(html) == 'string' ) ? html.trim() : '';
                 return;
             }
-            var parsed = new DOMParser().parseFromString(html, 'text/html');
-            var $incoming = parsed.querySelector(partialTarget) || parsed.body;
+            parsed    = new DOMParser().parseFromString(html, 'text/html');
+            $incoming = parsed.querySelector(partialTarget);
+            if ( !$incoming ) {
+                warnPartialTarget($popin, partialTarget, 'noRegion');
+                $incoming = parsed.body;
+            }
             $slot.innerHTML = $incoming.innerHTML;
         }
 
@@ -24289,6 +26373,9 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                 // A preOpen popin still gets its instant born-modal skeleton now; the
                 // adopted preload swaps in the real content on arrival — matching the
                 // popinLoad preOpen flow this consume path bypasses (#B54).
+                // #gh76 §8 — this adoption's sequence, on the same counter popinLoad uses:
+                // a close during the wait bumps it and the body is dropped on arrival
+                var seq = ( $popin ) ? ( $popin._loadSeq = ( $popin._loadSeq || 0 ) + 1 ) : null;
                 if ( $popin && $popin.options && $popin.options.preOpen ) {
                     showLoadingShell($popin, ensurePopinDialog($popin));
                 }
@@ -24299,6 +26386,10 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                     // #B285 — the adopted wait is over (body or failure): settle FIRST,
                     // matching the cold path's release-before-apply order.
                     _settle();
+                    // #gh76 §8 — cancelled while it waited: released above, body dropped
+                    if ( seq !== null && seq !== $popin._loadSeq ) {
+                        return;
+                    }
                     if ( body == null ) {
                         if ( typeof(onMiss) == 'function' ) { onMiss(); }
                     } else {
@@ -24650,6 +26741,13 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                 if ( typeof(gina.events[loadedEvt]) == 'undefined' ) {
                     addListener(gina, existing.target, loadedEvt, function (loadedEvent) {
                         loadedEvent.preventDefault();
+                        // #B579 — popinLoadContent's redirect emit fires this same event with the
+                        // POPIN OBJECT as detail (the legacy listener only binds + opens on it): a
+                        // load landing on an already-open popin routes through it, and applying a
+                        // non-string would blank the dialog whose content that call just wrote
+                        if ( typeof(loadedEvent.detail) != 'string' ) {
+                            return;
+                        }
                         handleLoadedBody(loadedEvent.detail, existing, ensurePopinDialog(existing));
                     });
                 }
@@ -24984,7 +27082,7 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
 
                                 if (!fired) {
                                     fired = true;
-                                    popinLoadContent(e.detail);
+                                    popinLoadContent.call($popin, e.detail);
                                 }
                             });
                         }
@@ -25564,6 +27662,106 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                     $overlay.classList.add('gina-popin-is-active');
                 }
             }
+
+            // #gh76 §8 — the shell is showing and the load is in flight: an explicit state.
+            // `isOpen` stays false, so the two `!isOpen ⇒ popinOpen` consumers still run the
+            // real open when the content lands. A dialog shell gets the native `close` sync
+            // NOW, not only at popinOpen: an Escape during the load must route through
+            // popinClose, or the landing content would re-open a dismissed dialog.
+            $popin.isLoading = true;
+            bindNativeCloseSync($popin, $el);
+        }
+
+        /**
+         * bindNativeCloseSync
+         *
+         * #gh76 §8 — one native `close` listener per dialog element, bound at the loading
+         * shell AND at popinOpen, whichever comes first (`_ginaCloseSyncBound` keeps it to
+         * one across element reuse). Listens to `close`, not `cancel`: `close` fires for
+         * BOTH Escape and method="dialog". De-dup with the plugin's own close: popinClose
+         * (and closeLoadingShell) set isOpen / isLoading false SYNCHRONOUSLY before the
+         * queued `close` event fires, so the guard sees neither and no-ops; a `$el.close()`
+         * on an already-closed dialog is a spec no-op, so there is no recursion. Native
+         * addEventListener — NOT gina's addListener (the custom event bus). Gated on
+         * useDialogMode: a <div> has no `close` event.
+         *
+         * @param {object} $popin - the registered popin
+         * @param {HTMLElement} $el - its dialog element
+         *
+         * @returns {undefined}
+         *
+         * @example
+         * bindNativeCloseSync($popin, $el);
+         */
+        function bindNativeCloseSync($popin, $el) {
+            if ( self.options.useDialogMode && $el && !$el._ginaCloseSyncBound ) {
+                $el._ginaCloseSyncBound = true;
+                $el.addEventListener('close', function () {
+                    if ( $popin.isOpen || $popin.isLoading ) {
+                        popinClose($popin.name);
+                    }
+                });
+            }
+        }
+
+        /**
+         * closeLoadingShell
+         *
+         * #gh76 §8 — closes a popin whose loading shell is showing but whose real open never
+         * happened (`isLoading` true, `isOpen` false). The load itself is CANCELLED: the
+         * sequence is bumped so the landing result — or an adopted preload's body — is
+         * dropped instead of re-opening a dismissed dialog, and a transport still in flight
+         * is aborted (its own readyState-4 handler sees the bumped sequence and returns
+         * right after its release block, so no `error` fires for a cancel). Tears down what
+         * the shell built BY THE SHELL'S OWN STATE — not by the `gina-popin-is-active` class
+         * popinClose's teardown keys on, which a dialog shell never carries — releases the
+         * trigger, and fires `close.<id>`: the honest "this dialog went away" signal, even
+         * though `open.<id>` never fired.
+         *
+         * @param {object} $popin - the loading popin
+         *
+         * @returns {undefined}
+         *
+         * @example
+         * if ( $popin.isLoading && !$popin.isOpen ) closeLoadingShell($popin);
+         */
+        function closeLoadingShell($popin) {
+            var $el           = document.getElementById($popin.id) || null;
+            var $popinTrigger = document.getElementById($popin.openTrigger) || null;
+            // cancel the load: the landing result is dropped by the sequence check
+            $popin._loadSeq = ( $popin._loadSeq || 0 ) + 1;
+            if ( $popin._loadXhr && $popin._loadXhr.readyState !== 4 ) {
+                try { $popin._loadXhr.abort(); } catch (abortErr) { /* already dead */ }
+            }
+            $popin._loadXhr  = null;
+            // BEFORE the native close below: its queued `close` event must find no state
+            $popin.isLoading = false;
+            if ( $el ) {
+                if ( $el.tagName === 'DIALOG' ) {
+                    if ( typeof($el.close) === 'function' && $el.hasAttribute('open') ) {
+                        try { $el.close(); } catch (closeErr) { $el.removeAttribute('open'); }
+                    } else {
+                        $el.removeAttribute('open');
+                    }
+                } else {
+                    $el.classList.remove('gina-popin-is-active');
+                    var $overlay = $el.parentElement;
+                    if ( $overlay ) { $overlay.classList.remove('gina-popin-is-active'); }
+                }
+                $el.innerHTML = '';
+                $el.removeAttribute('data-gina-popin-loading');
+            }
+            if ( $popin.target && typeof($popin.target.removeAttribute) == 'function' ) {
+                $popin.target.removeAttribute('data-gina-popin-loading');
+            }
+            releasePopinTrigger($popinTrigger);
+            // operands reversed on purpose: popin-registry.test.js counts the raw WRITE
+            // shape of the active id (assignment to the instance field) at exactly one
+            // site, and a `===` read written the other way round carries that prefix
+            if ( $popin.id === instance.activePopinId ) {
+                setActivePopinId(null);
+            }
+            triggerEvent(gina, $popin.target, 'close.'+ $popin.id, $popin);
         }
 
         /**
@@ -25652,6 +27850,9 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
             var $popin          = getPopinByName(name);
             var id              = $popin.id;
             var $popinTrigger   = document.getElementById($popin.openTrigger) || null;
+            // #gh76 §8 — this load's sequence: a close during the load bumps it, and the
+            // landing result below is dropped instead of re-opening a dismissed dialog
+            var seq             = $popin._loadSeq = ( $popin._loadSeq || 0 ) + 1;
 
             // #B139 — record the content's source URL for the close-time cache
             // clear (covers every click-time load path, incl. validator redirects).
@@ -25752,6 +27953,9 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                 catch (e) { try { xhr = new ActiveXObject("Microsoft.XMLHTTP"); } catch (e) {} }
             }
 
+            // #gh76 §8 — stashed so a close during the load can abort it
+            $popin._loadXhr = xhr;
+
             if ( options.withCredentials ) { // Preflighted requests
                 if ('withCredentials' in xhr) {
                     // XHR for Chrome/Firefox/Opera/Safari.
@@ -25832,6 +28036,13 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                             }
                             loadingState.disarm($popinTrigger);
                         }
+                        // #gh76 §8 — a load cancelled by a close (or superseded by a newer
+                        // load of the same popin) has released above; its result is dropped
+                        // here, so landing content cannot re-open a dismissed dialog
+                        if ( seq !== $popin._loadSeq ) {
+                            return;
+                        }
+                        $popin._loadXhr = null;
                         // 200, 201, 201' etc ...
                         var result = null;
 
@@ -25865,7 +28076,7 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                                     !isJsonContent && $popin.isOpen && isRedirecting && !$popin.partialTarget
                                 ) {
                                     // console.debug('Popin now redirecting [1]');
-                                    popinLoadContent(result, isRedirecting);
+                                    popinLoadContent.call($popin, result, isRedirecting);
                                 } else {
 
                                     if (
@@ -26025,6 +28236,13 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                                 updateToolbar(result, resultIsObject);
 
                             triggerEvent(gina, $el, 'error.' + id, result)
+                            // #gh76 §8 — a failed load never leaves the shell behind: the
+                            // `error` listener above ran FIRST (it may have loaded content,
+                            // which completes the open and keeps the dialog); if nobody did,
+                            // close the shell — a spinner on a load that will never land
+                            if ( $popin.isLoading && !$popin.isOpen ) {
+                                closeLoadingShell($popin);
+                            }
                         }
                     }
                 };
@@ -26089,21 +28307,43 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
         /**
          * popinLoadContent
          *
-         * @param {string} html - plain/text
-         * @param {boolean} [isRedirecting] - to handle link inside popin without form
+         * Replaces the popin's content with `stringContent` and re-binds it. Called as a
+         * METHOD (`$popin.loadContent(html)`, or the internal `.call($popin, …)` sites) it
+         * loads into THAT popin; called on the manager (`gina.popin.loadContent(html)`) it
+         * loads into the active popin. Throws when the resolved popin is not open.
+         *
+         * #gh76 precision 4 — the former unconditional `getActivePopin()` re-resolve landed
+         * a form's answer in whichever open popin was registered first when two were open
+         * (measured); honouring `this` is what lets the validator load into the popin it
+         * captured at submit.
+         *
+         * @this {object} [$popin] - when a registry entry, the popin to load into
+         * @param {string} stringContent - the HTML to inject (plain text)
+         * @param {boolean} [isRedirecting] - to handle a link inside a popin without a form
+         *
+         * @example
+         * gina.popin.getPopinByName('details').loadContent('<p>updated</p>');
          */
         function popinLoadContent(stringContent, isRedirecting) {
 
-            var $popin = getActivePopin();
+            var $popin = ( this && this.id && instance.$popins[this.id] === this )
+                ? this
+                : getActivePopin();
             if ( !$popin ) {
                 return;
             }
-            if (!$popin.isOpen)
+            // #gh76 §8 — a popin whose loading shell is showing accepts content: it lands
+            // in the shell and the open is completed below (a load still in flight lands
+            // afterwards as any second loadContent would — last write wins)
+            var completingOpen = ( !$popin.isOpen && $popin.isLoading );
+            if ( !$popin.isOpen && !completingOpen )
                 throw new Error('Popin `'+$popin.name+'` is not open !');
 
             $popin.isRedirecting = ( typeof(isRedirecting) != 'undefined' ) ? isRedirecting : false;
 
-            var $el = $popin.target;
+            // while loading, `target` still names the shared container (popinOpen re-points
+            // it at the dialog) — inject into the dialog element itself
+            var $el = ( completingOpen ) ? ( document.getElementById($popin.id) || $popin.target ) : $popin.target;
             // if (
             //     typeof(stringContent) != 'undefined'
             //     && typeof(stringContent.trim) == 'function'
@@ -26120,7 +28360,12 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                  refreshCSS();
             }
 
-            if ( !$popin.isRedirecting ) {
+            if ( completingOpen ) {
+                // the real open: the a11y label, isOpen, the trigger re-point, `open.<id>` —
+                // the bind above is deduped, and the shell already showed the dialog so
+                // popinOpen's own showModal() is skipped
+                popinOpen($popin.name);
+            } else if ( !$popin.isRedirecting ) {
                 triggerEvent(gina, instance.target, 'open.'+ $popin.id, $popin);
             } else {
                 // console.debug('Popin now redirecting [1-b]');
@@ -26292,7 +28537,7 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
             // Fix today's name-based aria-labelledby: associate a REAL title element.
             associateLabel($el);
 
-            if ( self.options.useDialogMode && !$el.getAttribute('open') ) {
+            if ( self.options.useDialogMode && !$el.hasAttribute('open') ) {
                 // Modal vs non-modal. The new `data-gina-dialog` API defaults to
                 // non-modal — openFromTrigger sets `$popin.modal`. Any path that did NOT
                 // set it (legacy `data-gina-popin-*` triggers, direct popinOpen() calls)
@@ -26303,8 +28548,12 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                         // showModal() promotes the dialog to the top layer with a native
                         // ::backdrop and inerts the rest of the page. Consumers that
                         // preemptively open the dialog (skeleton-loading) MUST also use
-                        // showModal() so it is born modal; the !getAttribute('open') guard
+                        // showModal() so it is born modal; the !hasAttribute('open') guard
                         // above then skips this call (re-showModal on an open dialog throws).
+                        // #B574 — it has to be hasAttribute: showModal() sets `open` to the
+                        // EMPTY string, which getAttribute() returned as a falsy value, so the
+                        // guard never skipped a shell-opened dialog and the modeless branch
+                        // below called show() on a modal dialog (InvalidStateError).
                         $el.showModal();
                     } else {
                         // Non-modal: .show() loses the native ::backdrop / Escape /
@@ -26333,16 +28582,11 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
             // there is no recursion. `_ginaCloseSyncBound` keeps it to one listener across
             // element reuse; gated on useDialogMode (non-dialog mode is a <div>, no `close`
             // event). Native addEventListener — NOT gina's addListener (the custom event bus).
-            if ( self.options.useDialogMode && $el && !$el._ginaCloseSyncBound ) {
-                $el._ginaCloseSyncBound = true;
-                $el.addEventListener('close', function () {
-                    if ( $popin.isOpen ) {
-                        popinClose($popin.name);
-                    }
-                });
-            }
+            // #gh76 §8 — shared with the loading shell, which may have bound it already
+            bindNativeCloseSync($popin, $el);
 
             $popin.isOpen = true;
+            $popin.isLoading = false;
             // so it can be forwarded to the handler who is listening
             $popin.target = $el;
 
@@ -26481,7 +28725,7 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
         function popinClose(name) {
 
             var $popin = null;
-            if ( typeof(name) == 'undefined' && /^true$/.test(this.isOpen) ) {
+            if ( typeof(name) == 'undefined' && ( /^true$/.test(this.isOpen) || /^true$/.test(this.isLoading) ) ) {
                 name    = this.name;
                 $popin  = this;
             } else {
@@ -26496,6 +28740,16 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
             if ( !$popin && typeof(name) != 'undefined' ) {
                throw new Error('Popin `'+name+'` not found !');
             }
+            // #gh76 §8 — a popin whose loading shell is showing closes too: the load is
+            // cancelled and the shell torn down. The `!isOpen` return below would otherwise
+            // leave a preOpen shell un-closeable for the whole round trip.
+            if ( !$popin.isOpen && $popin.isLoading ) {
+                if ( $popin.isRedirecting ) {
+                    return;
+                }
+                closeLoadingShell($popin);
+                return;
+            }
             if (!$popin.isOpen)
                 return;
 
@@ -26593,8 +28847,9 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
             id = $popin.id;
             name = $popin.name;
 
-            // Close first if still open (handles listener cleanup, form unbinding, header removal)
-            if ( $popin.isOpen ) {
+            // Close first if still open — or still LOADING (#gh76 §8): the loading close
+            // cancels the load and tears the shell down
+            if ( $popin.isOpen || $popin.isLoading ) {
                 $popin.isRedirecting = false;
                 popinClose(name);
             }
@@ -26760,6 +29015,7 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
             instance.load           = popinLoad;
             instance.loadContent    = popinLoadContent;
             instance.getActivePopin = getActivePopin;
+            instance.getPopinContaining = getPopinContaining;
             instance.open           = popinOpen;
             instance.close          = popinClose;
             instance.destroy        = popinDestroy;
@@ -27218,7 +29474,7 @@ if ( ( typeof(module) !== 'undefined' ) && module.exports ) {
     // Publish as AMD module
     define('gina/storage', ['helpers/dateFormat', 'helpers/prototypes'],function() { return StoragePlugin })
 };
-define('gina/nav', [ 'require', 'lib/merge', 'lib/uuid', 'utils/events' ], function (require) {
+define('gina/nav', [ 'require', 'lib/merge', 'lib/uuid', 'utils/events', 'utils/dom' ], function (require) {
 
     var merge   = require('lib/merge');
     var uuid    = require('lib/uuid');
@@ -27254,12 +29510,15 @@ define('gina/nav', [ 'require', 'lib/merge', 'lib/uuid', 'utils/events' ], funct
      *     `X-Requested-With: XMLHttpRequest` (without it the render path
      *     re-wraps a layoutless body into a full `<html>` shell);
      *  4. a genuine negotiated answer — 2xx, HTML, `Vary` advertising
-     *     `X-Gina-Navigate` — replaces the region's content, re-injects the
-     *     fragment's src-bearing scripts the document does not already have
-     *     (inline scripts are NOT executed — same contract as popin content),
-     *     rebinds id-bearing forms through the live validator, closes any open
+     *     `X-Gina-Navigate` — replaces the region's content, closes any open
      *     popin (a full navigation would have unloaded it), pushes a history
-     *     entry, restores focus/scroll, and fires `success`;
+     *     entry, restores focus/scroll, binds the new region through the shared
+     *     `bindRegion()` policy (utils/dom: the fragment's src-bearing scripts
+     *     the document does not already have are re-created — inline scripts
+     *     are NOT executed, same contract as popin content — the forms that opt
+     *     in are bound through the live validator (#B549: a bare form keeps its
+     *     native submit, as on the initial page), `data-gina-link` anchors
+     *     through the live link plugin), and fires `success`;
      *  5. ANY other answer falls back to a full-page navigation: non-2xx,
      *     timeout, network error, an un-negotiated 2xx (the `Vary` check —
      *     a client/server matching disagreement degrades to a normal page
@@ -27322,11 +29581,6 @@ define('gina/nav', [ 'require', 'lib/merge', 'lib/uuid', 'utils/events' ], funct
         // arrives from an async fetch and can land after `isFrameworkLoaded`.
         var _compiled           = null;
         var _compiledFor        = null;
-        // Scripts present at activation + scripts nav injected across swaps
-        // (the popin `parentScripts` model): a fragment's src-bearing script is
-        // injected once, never re-executed on later swaps.
-        var _parentScripts      = [];
-        var _injectedScripts    = [];
         // pathname+search last rendered — popstate events that do not change it
         // are hash-only moves and are left to the browser.
         var _currentUrl         = null;
@@ -27533,75 +29787,6 @@ define('gina/nav', [ 'require', 'lib/merge', 'lib/uuid', 'utils/events' ], funct
             return null;
         };
 
-        /**
-         * Snapshots the src of every script present in the document at
-         * activation — the popin `parentScripts` model. Scripts already loaded
-         * with the page are never re-injected from a fragment.
-         *
-         * @inner
-         * @private
-         */
-        var snapshotParentScripts = function() {
-            var scripts = document.getElementsByTagName('script');
-            for (var i = 0, len = scripts.length; i < len; ++i) {
-                if ( scripts[i].src ) {
-                    _parentScripts.push(scripts[i].src);
-                }
-            }
-        };
-
-        /**
-         * Re-injects the fragment's src-bearing scripts the document does not
-         * already have (mirrors popinOpen's external-resource loading). Inline
-         * scripts are NOT executed — innerHTML semantics, the same contract
-         * popin content has always had. Injected scripts persist across later
-         * swaps (a page never "closes"); the registry keeps them single-shot.
-         *
-         * @inner
-         * @private
-         * @param {object} $target - the swapped region
-         */
-        var injectFragmentScripts = function($target) {
-            var scripts = $target.getElementsByTagName('script');
-            for (var i = 0, len = scripts.length; i < len; ++i) {
-                var src = scripts[i].src; // resolved absolute URL
-                if ( !src ) continue;
-                if ( _parentScripts.indexOf(src) > -1 || _injectedScripts.indexOf(src) > -1 ) continue;
-                var s = document.createElement('script');
-                s.src = src;
-                document.head.appendChild(s);
-                _injectedScripts.push(src);
-            }
-        };
-
-        /**
-         * Rebinds id-bearing forms of the swapped region through the live
-         * validator (`gina.validator.validateFormById` — the popinBind model).
-         * Id-less forms are skipped: validation rules are keyed by form id, so
-         * no rule can target them. A missing/ruleless validator is a no-op.
-         *
-         * @inner
-         * @private
-         * @param {object} $target - the swapped region
-         */
-        var rebindValidator = function($target) {
-            try {
-                if ( !gina.hasValidator || !gina.validator || typeof(gina.validator.validateFormById) != 'function' ) {
-                    return;
-                }
-                var $forms = $target.getElementsByTagName('form');
-                for (var i = 0, len = $forms.length; i < len; ++i) {
-                    var _id = $forms[i].getAttribute('id');
-                    if ( !_id ) continue;
-                    try {
-                        gina.validator.validateFormById(_id);
-                    } catch (bindErr) {
-                        console.warn('[gina][nav] validator rebind skipped for `'+ _id +'`: '+ (bindErr.message || bindErr));
-                    }
-                }
-            } catch (validatorErr) {}
-        };
-
         /**
          * Closes the active popin when one is open: a full-page navigation
          * would have unloaded it, and after a fragment swap it would sit over
@@ -27639,10 +29824,11 @@ define('gina/nav', [ 'require', 'lib/merge', 'lib/uuid', 'utils/events' ], funct
         };
 
         /**
-         * Applies a fetched fragment: swaps the region content, re-injects
-         * missing src scripts, applies the optional `[data-gina-nav-title]`
-         * document title, pushes/updates history, restores scroll and focus,
-         * closes any open popin, rebinds validator forms and fires `success`.
+         * Applies a fetched fragment: swaps the region content, applies the
+         * optional `[data-gina-nav-title]` document title, pushes/updates
+         * history, restores scroll and focus, closes any open popin, binds the
+         * new region (scripts, opted-in forms, links — the shared `bindRegion()`
+         * policy) and fires `success`.
          *
          * @inner
          * @private
@@ -27655,8 +29841,6 @@ define('gina/nav', [ 'require', 'lib/merge', 'lib/uuid', 'utils/events' ], funct
             var $target = instance.target;
             $target.innerHTML = ( typeof(html) == 'string' ) ? html.trim() : '';
 
-            injectFragmentScripts($target);
-
             // Optional per-page document title: the first element of the
             // fragment carrying `data-gina-nav-title` (the fragment is
             // layoutless, so it cannot carry a <title> of its own).
@@ -27702,7 +29886,11 @@ define('gina/nav', [ 'require', 'lib/merge', 'lib/uuid', 'utils/events' ], funct
             }
 
             closeActivePopin();
-            rebindValidator($target);
+            // #gh76 — the one region-binding policy nav shares with the validator's
+            // form-answer swaps (utils/dom). Forms follow the #B549 opt-in gate here
+            // too: a bare id-bearing form in a fragment used to be bound — and its
+            // submit turned into an XHR — by a rebind that bypassed the gate.
+            bindRegion($target);
 
             instance.eventData.success = { 'url': url, 'target': $target, 'isPopState': isPopState };
             triggerEvent(gina, instance.target, 'success.' + instance.id, instance.eventData.success);
@@ -27954,7 +30142,6 @@ define('gina/nav', [ 'require', 'lib/merge', 'lib/uuid', 'utils/events' ], funct
 
                 instance.target = $marker;
                 _currentUrl     = window.location.pathname + window.location.search;
-                snapshotParentScripts();
                 try {
                     if ( window.history && 'scrollRestoration' in window.history ) {
                         window.history.scrollRestoration = 'manual';