gina 0.6.32 → 0.6.33

package/CHANGELOG.md

@@ -6,6 +6,54 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.33 - 2026-09-25
+### Added
+* `server.query.http2SessionPool` (settings.json; an integer from 1 to 50, default 1): how many HTTP/2 client sessions `self.query()` keeps per upstream authority. The default keeps one multiplexed session per `hostname:port`, as before. A pool of N opens N sessions, filled round-robin call by call, so a per-connection (L4) balancer — a Kubernetes Service with no HTTP-aware ingress — spreads the calls over N upstream connections instead of pinning every call to the one pod behind the first connection. Any other value refuses the boot; the value is resolved once at engine start, so a change needs a bundle restart. Pickup: bundle restart, no re-bake (#P43)
+### Changed
+* The Isaac HTTP/2 rapid-reset guard (CVE-2023-44487) now counts the streams a CLIENT cuts short — a `RST_STREAM` of any code, or the peer destroying the stream, before the response completed — per session per rolling second, instead of counting new streams. Counting new streams made a sibling bundle's own multiplexed `self.query()` calls trip it: above 200 calls per second on one cached session the target sent `GOAWAY(ENHANCE_YOUR_CALM)` and every in-flight call failed with a 500 (17% of calls at 50 concurrent callers with default settings). A well-behaved multiplexing caller never resets a stream, so it never trips the re-scoped guard; new streams stay bounded by `maxConcurrentStreams`. The setting is renamed to say what it counts: `http2Options.maxStreamResetsPerSecond` (default 200). The old key `maxStreamsPerSecond` is no longer read — a bundle still setting it gets one boot warning and the default — because a raised value left over from the workaround must not quietly widen the reset limit. Two new pass-through keys, `http2Options.streamResetBurst` and `streamResetRate` (both required together), tune the runtime's own frame-level reset limit, which stays the primary guard: nghttp2 closes a session with `GOAWAY(INTERNAL_ERROR)` after a 1,000-reset burst (then 33/s), silently on the server side; gina's guard is the observable, configurable, tighter-burst layer on top. Not a vulnerability fix — the protection was in place; its scope changes so it no longer fires on the framework's own traffic. Engine-side aborts (a server-side destroy, the teardown a GOAWAY causes) are told apart and never counted. On Bun the runtime has no reset limit of its own and ignores both pass-through keys (one boot warning says so), so gina's guard is the only rapid-reset layer there; it reads Bun's own stream state to recognise a client reset, every reset code included. Pickup: bundle restart, no re-bake (#B611)
+* `gina scope:add` now checks the whole scope name and refuses one it cannot use: a name is made of letters, digits, `_`, `.` and `-`, starts with a lowercase letter, a digit, `_` or `.`, and is neither `.`, `..` nor the name of a property every object inherits, such as `constructor`. It used to check the first character only. The `<bundle>/<scope>` form the command help documented as adding a scope to one bundle is retired: it never limited a scope to a bundle, it registered a project scope literally named `<bundle>/<scope>`. That form is now refused with a pointer to the per-bundle mechanism, the `scopes` allow-list on a bundle entry in `manifest.json`. A name that failed the old first-character check, such as `Staging`, used to be dropped without a message; it is now refused. Scopes already registered are unchanged, `scope:remove` still removes them, and the Couchbase connector still accepts a `/` in a scope, so a scope registered under the old form keeps booting. (#B626)
+* `gina env:add` now checks the whole environment name and refuses one it cannot use, as `scope:add` now does for scopes: a name is made of letters, digits, `_`, `.` and `-`, starts with a lowercase letter, a digit, `_` or `.`, and is none of `.`, `..` and `global`, which already names the configuration overlay that applies to every environment. It used to check the first character only. The `<bundle>/<env>` form the command help documented as adding an environment to one bundle is retired: it never limited an environment to a bundle, it registered a project environment literally named `<bundle>/<env>`. A name that failed the old check, such as `Staging`, used to be dropped without a message; it is now refused. Both `env:add` and `scope:add` also refuse the name of a property every object inherits, such as `constructor` or `__proto__`: the project files are indexed by these names, and such a name would reach the shared prototype instead of an entry of its own. Environments and scopes already registered are unchanged. (#B639)
+### Fixed
+* The published package no longer carries Playwright `test-results/` artifacts. The directory is gitignored but `.npmignore` never listed it, so two `error-context.md` snapshots from a local end-to-end run shipped inside `gina@0.6.32` and `gina@0.6.33-alpha.1` — test fixtures only, with no credentials and no local paths (measured before this entry was written). `test-results/` and `playwright-report/` are now excluded from the tarball (#B581)
+* With the Couchbase session store, logging in no longer answers 500 when the visitor's pre-login session was never saved (for example with `saveUninitialized: false`). Logging in rotates the session, which first deletes the old one, and the store reported deleting a session that is not in the bucket as an error, so the login failed through `req.login()` and through Passport 0.6 or later. Deleting an absent session is now a successful delete, as it already was on every other session store gina ships; any other error, such as a timeout, still fails (#B577)
+* A `${secret:...}` reference whose key breaks the placeholder grammar `^[A-Z_][A-Z0-9_]*$` — lowercase or dotted (`${secret:db_password}`), empty, or a valid token padded with surrounding whitespace — is now REFUSED at config load, exactly like a missing key: the error names the config path and the grammar, never the offending text (the internal logger names it at debug level only). Previously such a value was passed through unchanged, so the literal placeholder text reached its consumer as a credential and the only symptom was that consumer's own failure much later, such as a database driver reporting an authentication error. Genuine mixed content (`https://${secret:HOST}/v1`) still passes through. `gina secrets:check` reports each malformed reference with its file, path and text and exits non-zero; `gina secrets:scan` lists them under "Malformed references"; `connector:test`, `connector:infer` and `connector:models` name the path instead of `<unknown>`. `lib.secrets` gains `getMalformedReferences(config)` beside `getRequiredKeys` and exports `MALFORMED_RE` beside `SECRET_RE`. A bundle that boots today with such a literal will refuse to start after upgrading — run `secrets:check` before the restart; it names every offending entry (#B583)
+* A synchronous throw from a bundle's `onInitialize` callback — or the rejection of a promise an `async` callback returns — before it has emitted `'complete'` now aborts the boot with `[ FRAMEWORK ] onInitialize threw before emitting 'complete' — aborting boot: <reason>` on stderr and exit code 1, the same way a model-load failure does, so `gina bundle:start` reports the failure straight away and a container exits 1 with the reason in its log. Previously the throw was only logged: the boot stopped with nothing listening and no failure reported — `gina bundle:start` waited out its startup timeout and printed only "Check your logs", and under `gina-container` the process could even exit with code 0. A throw after `'complete'` still lets the bundle keep starting, and is now logged as such (#B576)
+* A GET or HEAD query value whose text holds a percent-escape (`%0A`, `%22`, `%5C`, `%25`) is no longer decoded a second time: it used to turn the serialized query document into invalid JSON, so `req.get` came back EMPTY for the whole request (and a `validator::` requirement copying that data 404ed the route), while `100%2525` silently became `100%`. The data helper never percent-decodes a `{`-leading document any more; the isaac query parser decodes query KEYS once, like values (an HTML-form GET `user%5Bname%5D` still nests, and a `+` in a key is now a space, as express's query parsers, `qs` and `querystring`, already treat it). The same document path serves the browser validator, so a form value holding `%22`/`%0A` no longer empties the validated data set and a pasted `a%20b` is sent as typed; and it serves every route declaring a DTO, whose validated payload went through the same decode — an `application/json` body value holding `%20` reached the action as a space, and one holding `%22` left the action with no payload at all (`req.post` undefined); both now arrive as sent. Pickup: restart AND re-bake. (#B589)
+* The published TypeScript declarations of two data-helper globals now match what the runtime does. `nestBracketNotationKey` takes the bracket path as an ARRAY (`['item', '0', 'id']`), which is what it has always required — a string nested character by character — so a TypeScript caller passing a string now gets a compile error instead of a silently wrong object; and `formatDataFromString` returns `object | undefined`, since a `{`- or `[`-leading input that does not parse as JSON yields `undefined`. (#B588)
+* An `is` comparison between values that contain no ASCII letter or digit (`!!!`, `é€`) is now evaluated: it always failed, so a confirmation made only of symbols or non-ASCII letters could never pass. Pickup: restart AND re-bake. (#B602)
+* A value containing a double quote, a backslash or a line break in a field that an `is` condition references (`$password === $passwordConfirm`) no longer stops the validation pass: the rule set was built by pasting the value in unescaped, so in the browser the form could not be submitted and on the server the validation threw. Such values are now compared exactly as typed, and `$&`, `$'` or `$$` in them are no longer rewritten (`ab$$cd` matched `ab$cd`). A referenced field with a number rule is compared as a number when its value is one and as text otherwise; a string literal written in a condition follows JSON escaping (one that is not valid JSON is read as written, as before); and a `$fieldName` value sent by a `query` rule reaches the endpoint as typed. Pickup: restart AND re-bake. (#B600)
+* An `is` comparison no longer ignores parentheses and the word `return` inside the compared values: two values differing only by those characters (`ab(cd` and `ab)cd`, `myreturnpass` and `mypass`) compared as equal, in the browser, on the server and in route `validator::` requirements. Parentheses written around a condition's operands are still accepted. Pickup: restart AND re-bake. (#B601)
+* A referenced value that itself contains a `$` followed by another field's name (`abc$email` in a password whose confirmation is checked with `$password === $passwordConfirm`) is no longer substituted a second time: the rule set was resolved one field at a time, re-reading the whole text after each splice, and the two-argument `is` form re-read the resolved condition once more — so such a value could never be confirmed, and, worse, two different values could compare equal (`abc$zeta x` confirmed `abcZ x` when a sibling field `zeta` held `Z`). Every `$` token is now resolved in one pass and the value is compared exactly as typed. Pickup: restart AND re-bake. (#B603)
+* In a route `validator::` requirement or a fluent `is()` call, a `$field` token followed by a parenthesis or an operator — `($password) === ($passwordConfirm)`, `$a===$b` — now resolves; it used to resolve only when whitespace or the end of the condition followed it, so the condition was refused and the field read invalid. A field name holding a bracket or another RegExp character (`$pw[0]`, `$a+b`) resolves too. The rule is now the same on every path: the longest field name wins, a token ends at the first character outside `A-Z a-z 0-9 _ -`, and a `$` naming no field stays literal. (#B604)
+* A `$fieldName` token in a `query` rule's `data` now names the right field whatever its spelling: `$passwordConfirm` was resolved as `$password` followed by `Confirm` (another field's value reached the endpoint), `$Email` was left as is, `$password` and `$password-confirm` in one body resolved by their order, a space after a token swallowed the text that followed it, and a `$` naming no field was sent as the string `null` — and threw while live-checking. Such a `$` now stays as typed. (#B606)
+* Every request no longer re-reads the framework's environment template from disk. `Config` is constructed three times per request (route resolution, view detection and bundle-configuration lookup) and each construction parsed `core/template/conf/env.json` twice through `requireJSON`, which has no cache — six synchronous file reads and parses per request in every bundle, measured at 27% of a trivial JSON route's CPU (twelve per bundle-to-bundle call). The template is now parsed once per process, on the first construction, and shared read-only by every instance; nothing observable changes except the cost. Pickup is a bundle restart (#B610)
+* The `/_gina/info` HTTP/2 `rstCount` metric had read 0 since it shipped: the server listened for a `rstCode` event on every stream, and `rstCode` is a stream property, not an event. It now counts the streams the client cut short before the response completed — the signal the rapid-reset guard counts (#B614)
+* `self.query()` over HTTP/2: the client sent an `RST_STREAM(NO_ERROR)` after EVERY completed response — the settled-stream release ran `req.close()` while the stream was not yet marked closed — and the target's nghttp2 counted those frames against its CVE-2023-44487 reset rate limit, closing the cached session with `GOAWAY(INTERNAL_ERROR)` after about 1,000 calls (the `Session closed with error code 2` failures on long-lived bundle-to-bundle sessions). The release no longer closes the stream: a settled stream closes itself within milliseconds, and the listener drop alone releases it (#B613). An in-flight safe-method call cut by a server GOAWAY — `ERR_HTTP2_SESSION_ERROR` — is now retried on a fresh session under the same safe-method / `retryUnsafe` rule as a stream error; a non-safe method is still never replayed. A session gone between the cache read and the send made `client.request()` throw synchronously (`ERR_HTTP2_INVALID_SESSION`), unguarded; it is now caught and retried on a fresh session for any method, since nothing was sent, and exhausts into a typed 503 (#B612). Pickup: bundle restart, no re-bake
+* The in-memory Collection's `find()` and nested-path filters now compare string values with the `==`, `>` and `<` operators instead of throwing, and no longer break when a value or the filter contains a double quote or a backslash. Previously a single row whose string value held a double quote threw and failed the whole query; `==`, `>` and `<` were not recognised on strings (only `>=`, `<=`, `===` and `!==` were); and a space after the operator (such as `>= b`) was kept inside the operand and skewed the comparison. Both operands are now encoded before comparison; numeric and datetime comparisons are unchanged (#B609)
+* The Isaac server never closed an idle HTTP/2 session: its 120 s idle timer closed only when `session.activeStreams` read 0, and that property does not exist, so the timer re-armed forever and idle sessions were left to the client or the network. An idle session is now closed gracefully after `http2Options.sessionIdleTimeout` (`"120s"`, `120000`; default 120 s, the value the timer always had): open streams finish, no new stream is accepted on that connection, and a client's next request opens a fresh one — gina's own client evicts the closed session and reconnects. `0` disables the close; a value that is negative, not a timeout, or above 2147483647 ms logs one warning and uses the default. A quiet open stream (an SSE stream between events) does not keep the session alive — the stream itself finishes — while a stream still sending data does. Node.js only: on Bun the key is ignored with one boot warning and idle sessions are not closed by the server (Bun 1.2 / 1.3 time out busy sessions, and a client's next request hangs after the close). Pickup: bundle restart, no re-bake (#B619)
+* `self.query()` over HTTP/2: every eviction of a cached client session deleted the cache entry by KEY, so a dead session's late `close`, `error` or `goaway` — or an earlier attempt's retry branch — evicted the LIVE replacement a retry had just cached under the same key. The replacement kept running, keepalive ticking, in no cache: 148 + 160 upstream connections were still open 186 s after a load run (the bundle-to-bundle audit, 2026-09-24), and the next call opened yet another. Every eviction is now identity-checked — it removes only the session it belongs to — and the cache owns the "lost its slot" teardown: an entry that is replaced, LRU-evicted, capped out or deleted stops its keepalive and closes its session gracefully (in-flight calls finish, nothing new is sent on it) instead of leaking it. The per-process session cap now drains the oldest session the same way instead of destroying it under an in-flight call. Pickup: bundle restart, no re-bake (#B625)
+* `self.query()` over HTTP/2: the pre-flight PING stormed. A cached session counted as stale 3 s after its last PONG while the keepalive pinged only every 5 s, so about 40% of the time every concurrent caller sent its own pre-flight PING; node cancels every ping past its outstanding limit of 10 with `ERR_HTTP2_PING_CANCEL`, and that cancel was read as a dead session — 22 healthy sessions evicted and reconnected per 10 s run at 50 concurrent callers (the bundle-to-bundle audit). Now one pre-flight PING per session serves every caller waiting on it, every response re-stamps the session as fresh (a busy session never pre-flights), and a cancelled PING is inconclusive: the call goes out on the same session and the keepalive skips that tick. Pickup: bundle restart, no re-bake (#B627)
+* The boot warmup of HTTP/2 sessions (`server.warmup`) never kept a session on Node.js: its initial PING was sent while the session was still connecting, node cancels such a ping at once, and the warmup read the cancel as a dead session and tore it down within a tick — so the first real `self.query()` still met a cold connection. The PING is now sent once the session is connected, the warmed session is stamped fresh after its PONG (the first call does not pre-flight it), and it is cached with the same identity-checked eviction and graceful cleanup as a session `self.query()` opens itself. Pickup: bundle restart, no re-bake (#B629)
+* `self.query()` over HTTP/2: a request refused before the upstream processed it is now retried for any method. The runtime refuses a request queued onto a session that has just started closing — the upstream's GOAWAY landed between the pre-flight PING and the send — with `REFUSED_STREAM` (RFC 9113 §8.7: closed prior to any processing) or, on node 24 / 26 and Bun 1.4, with an asynchronous `ERR_HTTP2_GOAWAY_SESSION`; a server at its stream limit refuses the same way. Both went through the stream-error path, where only a safe method is replayed, so a POST failed with a 503 although nothing had been processed. The request is now re-sent within the retry budget — on a fresh session, or on the same healthy one when the upstream merely refused a stream. Pickup: bundle restart, no re-bake (#B630, #B631)
+* A model-loading failure on an asynchronous connector now aborts the boot with exit code 1 and the reason on stderr, as it already did on a synchronous one. An entity file the class-name check rejects (a name starting with a digit or an underscore), or an entity constructor that throws, on a connector such as DuckDB or Couchbase did not stop the boot: depending on the connector, the failure was logged as an unhandled promise rejection, reported as a failure to connect and retried, or swallowed, and the bundle never listened. Under `gina-container` a DuckDB bundle exited with code 0, a success status. It now ends with `[ FRAMEWORK ] Model loading failed — aborting boot: <cause>` (#B617)
+* After a Couchbase reconnect rebuilds the models, each connector now receives the scope declared on its `connectors.json` entry, as it does at boot. The rebuild used to omit it, so a connector whose entry declares a scope other than `NODE_SCOPE` switched to `NODE_SCOPE` for the documents it stamps and the queries it filters. (#B624)
+* A Couchbase entity `bulkInsert` now writes the bucket name into its statement as an escaped identifier, so it works on a bucket whose name needs escaping in N1QL, such as `beer-sample`. The name used to go into `INSERT INTO` and `RETURNING` bare, and a dash, which Couchbase allows in a bucket name, made the statement fail to parse. The statement text changes for every bucket (the name is now backtick-quoted); the query means the same. (#B616)
+* Bundle-to-bundle `self.query()` calls over HTTP/1.1 now reuse their connections. Each call used to build its own connection pool and throw it away, so every call opened a new TCP connection (500 sequential calls to one bundle opened 500); calls to the same upstream now share one keep-alive pool, kept for the life of the bundle (the same 500 calls use one connection). Each upstream gets its own pool, so a `bundle@project` call still reaches its own upstream, and two upstreams, or one host reached with two CAs, never share one. `maxSockets` (default 100) now limits the concurrent connections to one upstream, which it never did before: a call beyond the limit waits for a free connection, and its `requestTimeout` starts once it has one. At most 50 pools are kept per process; the least recently used one is retired without cutting a call in flight. HTTP/2 calls are unchanged. Pickup: bundle restart, no re-bake (#P44)
+* An https `self.query()` no longer reads its CA file from disk on every call. Each call re-read the file named by `server.credentials.ca` (or the call's `ca` option), about 25 µs per call, and on HTTP/2 even when the call reused a cached session and never needed it. The file is now read once and kept for the life of the bundle; each call checks it with one `stat`, and a file that changed on disk (a Kubernetes Secret volume update replaces it) is read again and used by the very next call, as before. A missing or unreadable CA file fails the call with the same error as before. Pickup: bundle restart, no re-bake (#B633)
+* `gina project:add` could lose a scope or an environment it had just registered. With `--scope` or `--env` naming one that did not exist yet, the command started linking gina into the new project and, while that step was still running, registered the new names with `scope:add` and `env:add`. Each of these commands rewrites the registry files in `~/.gina`, so on some runs the new name was missing afterwards from `main.json` or from the project entry in `projects.json`, and the state store logged `database is locked`. The link step now starts only once the rest of the command has finished. (#B647)
+* `gina scope:link-local`, `scope:link-production` and `env:link-dev` crashed with "Gina has some troubles with this command" and a stack trace when no project could be determined, such as when run outside a project directory without `@<project>`, or when `@<project>` named a project that is not registered: they looked the scope or environment up in the project before checking it. They now print "Project name is required: @<project_name>" or "[ <name> ] is not a valid project name." and exit 1. Their message for a missing argument also named `scope:use` or `env:use` instead of the command that was run. (#B641)
+* `gina scope:link-local`, `scope:link-production` and `env:link-dev` could hang after a successful change: they updated `projects.json` but never exited, and when the CLI was started by its own path (`node <gina>/bin/cli …`, as CI and scripts do) its open log listener kept the process alive. The same commands typed through the installed `gina` launcher were not affected. They now exit once the change is written. (#B648)
+### Security
+* A request-parsing failure no longer writes the unparsed body or query to the log. The data helper's three parse-failure lines printed the whole document, segment or value verbatim at error level (the body of a malformed `{`-leading request that is not labelled `application/json`, or every parameter of a GET whose serialized query document failed to parse, a password or a token included), and the same lines ship in the browser bundle, so they reached the console too; the isaac query parser warned with a query value the same way. The remaining sites now log metadata only — the helper's document line the input's length, its first character and the error's name, the isaac warn the parameter's name, the value's length and the error's name — never the value, and never the parse error's message, which can quote the input; the two segment-level lines are gone, because a urlencoded value that is not JSON is now kept as text instead of reported (#B588). (#B590)
+* A bracket-notation field name whose non-last segment is numeric while its container is not an array (`0[a]=1`, or `a[0][b]=2` after `a[x]=1`) no longer throws inside the nesting helper. The throw was a TypeError on a null slot the helper had just seeded for itself, and from the GET/HEAD `inheritedData` call site it had no try/catch: one unauthenticated `GET /any-url?inheritedData=0%5Ba%5D%3D1` exited the bundle process (measured: exit 143, the next request refused). A urlencoded POST/PUT/PATCH with the same field name answered 500, and the validator's client-side twin threw inside the browser, breaking the whole submission. Such a segment now creates a plain object slot (`0[a]=1` nests as the key `0` holding `a`); every previously non-throwing shape is unchanged. (#B591)
+* An `application/x-www-form-urlencoded` POST, PUT or PATCH body is no longer percent-decoded as a whole before it is split, so an encoded `&` or `=` inside a field value or a field NAME can no longer act as a separator and add or override other fields of the request (`role=user&bio=hi%26role%3Dadmin` arrived as `role=admin`, and so did `role=user&a%26role%3Dadmin=x`). The body now follows the standard form algorithm: split on `&`, then at the first `=`, each name and value decoded exactly once, so `field=a%26b` is `a&b`, `field=a%3Db` is `a=b`, a raw `=` inside a value is kept (`token=YWJj==` keeps its padding) and a typed `100%25` (sent `100%2525`) stays `100%25` instead of collapsing to `100%`. A quoted token in a value keeps its quotes (`%22true%22` is six characters, and so is a raw `"true"` in a hand-built body); a value that is a JSON document is parsed as JSON and keeps its own types, so a quoted `"true"` inside it stays a string (a text pass over the whole body used to turn it into a boolean), and under a bracket name it nests (`items[0]={…}` now gives `items` an element instead of a field literally named `items[0]`); a value that merely starts with `{` or `[` is kept verbatim instead of dropped; and a value-less `{`-leading segment no longer replaces the whole body. Bare `true`/`false`/`on`/`null` stay strings on this path, as they always did. Pickup: restart AND re-bake — the helper ships in the browser bundle. (#B588)
+* A request field named `__proto__`, `constructor` or `prototype` at the top level of a urlencoded body or a query document is now dropped (and so is a top-level `prototype` key in the JSON payload of a route declaring a DTO, which the same helper re-parses; a plain `application/json` body is parsed as-is and keeps it): assigned flat, a JSON-valued `__proto__` pair swapped the PROTOTYPE of the parsed request object, so `req.post.polluted` read an attacker-chosen value that `Object.keys` and `hasOwnProperty` could not see (the process-wide pollution was already closed by #B446; this is the per-request object). (#B592)
+* The Couchbase connector no longer writes caller or configuration values into N1QL statement text unvalidated. A `$N` inside `SEARCH()` was spliced into the statement as a double-quoted string literal with no escaping — a search term containing a `"` made the statement malformed, and the substitution rewrote every placeholder up to the statement's last `)` — and is now bound as a query parameter, which Couchbase documents for `SEARCH()`'s query argument on every server version that has the function. A `$N` written as a field-path segment (`doc.flags.$1`) cannot be bound, so its argument is still written after the dot, but only when it is a string of identifiers separated by dots (`identifier(.identifier)*`); anything else is refused before dispatch with a `TypeError` (code `GINA_COUCHBASE_INVALID_FIELD_PATH`), delivered to the query callback when there is one and thrown otherwise. The scope written for `$scope` and stamped as `_scope` on inserted documents is now resolved once when the connector loads and must match `^[A-Za-z0-9_./-]+$` (letters, digits, `_`, `.`, `-` and `/` — the `/` so that a scope registered under the retired `scope:add <bundle>/<scope>` form keeps booting); otherwise the bundle refuses to boot (code `GINA_COUCHBASE_INVALID_SCOPE`, exit code 1). Behaviour changes inside `SEARCH()`: a non-string search term is no longer turned into a string, a value parameter following the call keeps its real type, and a statement compiles one prepared plan instead of one per search term. (#B608)
+* `gina project:add` no longer passes `--scope` or `--env` through a shell. When either value named a scope or an environment that was not registered yet, the command registered it by running `scope:add` or `env:add` through a shell command line with the value spliced in unquoted, so shell syntax in the value ran as a command, as the user running `project:add`. Who was exposed: automation that builds these flags from data it does not control, such as a branch or ticket name, and runs `project:add` with them; the second shell parse defeated that automation's own quoting. Typing the command yourself crossed no boundary, and `project:import` was never exposed: it refuses a project that is not registered, and for a registered one the CLI already refused any value that project does not list, before any child could run. `project:add` now checks both values with the scope and environment name rules before anything is written, so an invalid one is refused with exit 1 and no longer leaves the project half-added, and the child commands are started from an argument vector. `project:import` skips that check, so a name registered by an older release, which the rules may now reject, keeps importing. (#B640)
+* The Couchbase connector no longer has a REST query transport. With `useRestApi: true` on a couchbase entry of `connectors.json`, every N1QL query was sent over plain HTTP to the query service with the cluster credentials in an `Authorization: Basic` header, even when the entry used `couchbases://`, so the credentials travelled unencrypted where the connection was meant to be TLS. Who was exposed: a couchbase connector configured with both `useRestApi: true` and `couchbases://`; the option is off by default and was not documented. The same transport rewrote every single quote in the statement into a double quote and inserted parameter values without escaping, so a value holding `"` or `\` produced a malformed or different query. The option is now ignored, with one warning when the connector connects, and those queries go through the Couchbase SDK like every other query. (#B634, #B623)
+* On a bundle whose `server.protocol` is `http/2.0`, a request that arrives over HTTP/1.1 is now held to each route's declared `method`. Such a bundle also serves HTTP/1.1 through the HTTP/2 server's `allowHTTP1` fallback: a client that does not negotiate HTTP/2, or a reverse proxy that talks HTTP/1.1 to the bundle (nginx's `proxy_pass` does). The router read the request method from the HTTP/2 `:method` pseudo-header whenever the bundle was configured for HTTP/2, and an HTTP/1.1 request carries none, so every method passed the method checks. Any method then ran a single-method route whose URL has no `:param` segment, and any method ran a multi-method route, parameters or not: a GET reached a POST-only action (and a GET is never asked for a CSRF token), a DELETE ran a `GET, POST` route, and a POST on a URL declared for both GET and POST ran whichever route was declared first. The route cache is keyed by method and path, so one such request also left the wrong action as the cached answer for every later client using that method on that path, HTTP/2 clients included, until a restart or until the entry was evicted — and a client could evict it with enough requests to any route that takes a parameter. Single-method routes with a `:param` segment were not affected, nor were bundles on the default `http/1.1` protocol. An HTTP/1.1 CORS preflight on such a bundle is now answered 204, as an HTTP/2 one is; it used to be routed, and the route's action ran for the OPTIONS request. Pickup: restart. (#B645)
+* A query key named like a member every object inherits — `toString`, `valueOf`, `toLocaleString`, `isPrototypeOf` — no longer counts as a route requirement. For a GET or DELETE request on a route that declares `requirements`, the router treats each request key that names a requirement the URL does not bind as a whole `:key` segment as an extra URL variable, and it looked the name up with a plain property read, which also finds those inherited members. Each such key, with a value shaped like that member's source text, replaced one leading segment of the compared URL — the first the always-empty leading position, the second the bundle webroot, the next ones the path — so a request reached a route whose path differs from its own, including a path outside the bundle's webroot, and the action received `req.params.toString` as a string. A path-based control applied outside the route, such as a reverse-proxy location rule, could be bypassed this way; the reached route's own middleware and authorization still ran. Only requirements a route declares itself now count. Every release since 0.1.0 is affected, on Node.js and on Bun. Pickup: restart and re-bake. (#B650)
+
 ## 0.6.32 - 2026-09-22
 ### Added
 * Added a commit-msg git hook that keeps local-tool configuration paths and AI-attribution mentions out of commit messages. The existing pre-commit hook scans staged content, but no hook ever received the message itself, so the message was the one unguarded surface; 13 messages on the public branches had picked up such a mention since 2026-05. It shares the pre-commit leak and exception patterns byte-for-byte, pinned by a test so the pair cannot drift, and adds a message-only pattern for the prose forms the content scan does not need to match. Vendor identifiers the AI connector depends on - protocol schemes, SDK package names, canonical env-var names, and the provider key itself - remain allowed. Fails open, and git commit --no-verify still bypasses it. Contributor clones pick the hook up through the core.hooksPath that post_install already installs.

package/README.md

@@ -67,69 +67,86 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.32
+## What's in 0.6.33
 
-> **Restart your bundles *and* rebuild them.** Seventeen of this release's
-> commits are browser-bundled — the whole form-answer arc, the popin fixes and
-> the validator changes — so `gina.min.js` changed and `gina bundle:restart`
-> alone leaves the old client running. Rebuild each consuming bundle, then
-> restart.
+> **Restart your bundles *and* rebuild them.** Eight of this release's commits
+> are browser-bundled — the request-parsing security fixes, the validator's
+> referenced-value and token fixes, the in-memory Collection and the routing
+> fix — so `gina.min.js` changed and `gina bundle:restart` alone leaves the old
+> client running. Rebuild each consuming bundle, then restart.
 
-> **No settings reset.** `0.6.32` is a patch — the `shortVersion` stays `0.6`,
+> **No settings reset.** `0.6.33` is a patch — the `shortVersion` stays `0.6`,
 > so your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**The form-answer release.** A form's HTML answer can now land anywhere in the
-page — htmx-style `data-gina-form-target` / `-swap` / `-select`, out-of-band
-elements, three server-side override headers — and two forms answering into one
-region no longer race. Where a popin is involved, the answer is routed by the
-popin the form is *inside*, never by whichever popin happens to be open, which
-closes the routing defect behind
-[gh#76](https://github.com/gina-io/gina/issues/76) and a run of popin edge cases
-with it. Four security fixes lead the rest: credentials no longer ride a
-redirect, the built-in error pages escape what they render, a request parameter
-can no longer force an error or hang a request, and an HTTP/2 static no longer
-carries another request's headers. Alongside: the HTTP/2 render path now runs a
-session middleware's hooks, maintenance mode can be armed from the environment
-and kept coherent across replicas, an environment config overlay wins over its
-base file, and per-bundle login session lifetimes are read from `security.json`.
-Full detail in [CHANGELOG.md](./CHANGELOG.md).
-
-- **Security — credentials no longer ride a redirect (#B551).** `self.redirect()` carried the request's parameters to the target — the parsed body verbatim for a `POST`, so a login form's plaintext password was written to the session store, or placed in the redirect URL on a session-less bundle. Fields matching the framework's redaction list (`password`, `secret`, `token`, `apikey`, `authorization`, `credentials` and their case and separator variants) are now dropped from what is carried; everything else travels exactly as before.
-- **Security — the built-in error pages escape every value they render (#B554).** A crafted link to any route whose action redirects — `?error=<script>…` — made the fallback error page reflect the value as markup and execute it in your application's origin, on every released version; a newly scaffolded bundle, which configures no `errorFiles`, hit exactly that page. The engine-level error page and the three nunjucks fallbacks are escaped the same way.
-- **Security — a request parameter can no longer decide whether a redirect happens (#B559).** A key named `error` in the query string or body was read as an instruction to raise an error, so any unauthenticated request to any redirecting route could force a 500 — and an empty value left the request unanswered for as long as the client held the connection. The key is now an ordinary parameter and rides the redirect in `inheritedData`.
-- **Security — an HTTP/2 static file no longer carries another request's response headers (#B566).** The first static request after boot registered a byte-serving listener that kept its response object for the life of the process and folded that response's headers — its `Set-Cookie` included — onto every later client's stream, served unseen HTML as raw binary, and answered a directory's index URL with a destroyed stream for the rest of the process's life. The listener and its server-push branch are removed; every HTTP/2 static is served on the request's own response, with the `ETag` / `304` support that path never emitted.
-- **Added — a form can swap its HTML answer into any element of the page (gh#76).** Three attributes on the `<form>`: `data-gina-form-target` (the `hx-target` grammar), `data-gina-form-swap` (nine strategies, `innerHTML` by default) and `data-gina-form-select`; a target or strategy that cannot be honoured refuses the submit before anything is sent, and `beforeswap` / `afterswap` bracket the main swap. A declared target wins over the popin the form is in.
-- **Added — an answer can update elements anywhere in the page, out of band (gh#76).** Any element of the answer carrying `data-gina-swap-oob` is swapped into the page element with the same `id` (htmx's `hx-swap-oob`), on all three answer paths; the success payload gains `oob` and `remainder`, and an answer without the attribute takes exactly the path it did before.
-- **Added — a server can retarget, reswap or reselect a form's HTML answer (gh#76).** `X-Gina-Retarget`, `X-Gina-Reswap` and `X-Gina-Reselect` override the form's declared attributes at settle, and are honoured only from a response whose origin is the page's own; a Retarget that cannot be resolved means no swap at all, reported to the success callback with `swapped: false`, never an error.
-- **Added — `GINA_MAINTENANCE` boots a bundle with maintenance mode on.** `GINA_MAINTENANCE=1` closes the gate at boot exactly as `server.maintenance.enabled: true` would — for replacement pods created during a window — and can only close a bundle, never open one; `GET /_gina/maintenance` reports `source: "env"` for such a closure.
-- **Added — maintenance mode stays coherent across replicas through a shared kv namespace.** Point `server.maintenance.store` at a declared kv namespace and every `POST /_gina/maintenance` is written there and polled by each process (`pollInterval`, default 2000 ms); a store outage freezes each replica in its last-known state and never reopens a closed site.
-- **Added — the maintenance status payload carries `pid` and `hostname`.** The runtime override was always per process; the two fields let an operator fanning a `POST` out over replicas read back which ones applied it, and that per-process contract is now stated on the guide, the schema and `llms.txt`.
-- **Added — per-bundle login session lifetimes from `security.json`.** `session.expires` and `session.remember` — unit-suffixed duration strings — set the cookie lifetime `req.login()` applies for an ordinary and a remembered login. Both keys were documented but interpreted by nothing until now, so a value already there that is not a duration string is reported at boot and ignored, never fatal.
-- **Added — `lib.duration.parse()`, one parser for unit-suffixed durations.** The parser `lib/storage` already used for its interval keys, promoted to a registry entry so every configuration key naming a span of time shares one dialect (`"500ms"`, `"30s"`, `"15m"`, `"3h"`, `"15d"`; the unit is required and a bare number is refused).
-- **Added — a `commit-msg` git hook for contributor clones.** It keeps local-tool configuration paths and attribution mentions out of commit messages — the one surface no hook had scanned — and reaches a clone through the `core.hooksPath` that `post_install` already installs. Not part of the published package.
-- **Changed — the popin context a request carries is decided by containment, not by "the active popin" (gh#76).** The `X-Gina-Popin-Id` / `-Name` headers, `self.isPopinContext()` and a popin-style XHR redirect are produced only for a form rendered inside a popin; a page form's `location` redirect navigates the page; `getActivePopin()` returns open popins only, the most recently opened first; a name-less `popin: { close: true }` with nothing open is a no-op.
-- **Changed — two form answers replacing the same region no longer race (gh#76).** When a form's swap replaces its target, a newer submit into the same target supersedes the request still in flight (a new `abort` event with `reason: 'superseded'`, never the `error` channel); insertion swaps still both land. `data-gina-form-sync` (`replace`, `drop`, `queue`) overrides the derived decision and `data-gina-form-disabled-elt` holds elements disabled for the life of a request. Superseding cancels the client's wait, not the server's work — never read it as "not saved" and resubmit.
-- **Changed — a navigated fragment's forms are bound only when they opt in (gh#76).** Fragment navigation binds the swapped region through the shared `bindRegion()` policy, so a bare id-bearing form inside a navigated fragment keeps its native submit unless it carries a `data-gina-form-*` attribute or an id naming a rule.
-- **Fixed — a form's HTML answer is routed by the popin the submitting form is in (gh#76).** A page form's answer arriving while a popin was open replaced that popin's content; arriving while a popin was still loading it raised a false `422` after a successful server write; with two popins open it landed in whichever had been registered first. Containment at submit decides now, and `popinLoadContent` loads into the popin it is called on.
-- **Fixed — a form or link answering into a popin runs its declared success callback (#B571).** The popin branch returned after the bare `success.<id>` event, so `data-gina-form-event-on-submit-success` and `data-gina-link-event-on-success` never ran there.
-- **Fixed — a pre-opened popin's loading shell is a state you can close, load into, or lose to a failed load (gh#76).** `isLoading` covers the round trip between the shell showing and the content landing: `loadContent()` no longer throws, `close()` and `destroy()` cancel the load and tear the shell down, an Escape during the load takes that same path instead of a dialog that reopens when its content arrives, and a failed load closes the shell unless an `error` listener loaded content into it.
-- **Fixed — a pre-opened popin opened modeless reaches its open state (#B574).** `popinOpen` guarded its open call with `getAttribute('open')`, which reads the shell's empty-string attribute as absent, so `show()` threw `InvalidStateError` and the popin stayed visibly open while the framework recorded it closed.
-- **Fixed — a popin answer outside dev mode no longer reports a false 422 (#B575).** The two hidden inputs the popin branch parsed are spliced only when `NODE_ENV_IS_DEV` is true; both branches now go through one tolerant parse.
-- **Fixed — an HTML answer whose top-level elements are table rows or cells keeps them (#B578).** The answer is parsed as a fragment rather than a whole document, so a top-level `<tr>` or `<td>` survives and a swap into a `<tbody>` writes the row, not the cell text.
-- **Fixed — reloading an open popin no longer blanks it (#B579).** The declarative trigger's `loaded` listener applied the event detail — the popin object — as if it were the body, wiping the content just written; present since `0.4.6`.
-- **Fixed — a malformed `data-gina-dialog-target` falls back instead of throwing (#B580).** A selector such as `#slot >` takes the documented full-replace fallback rather than an uncaught `SyntaxError`, and both silent fallbacks are now announced in dev mode.
-- **Fixed — a page form's staged upload is placed with its own form (#B572).** Which popin a chosen file belongs to is decided by containment, captured once at selection, never by "some popin is open" — before, a file chosen while an unrelated popin was open had its virtual upload form appended inside that popin and the form then saved without the file.
-- **Fixed — the client validator binds only the forms a page opted in (#B549).** Declaring a single rule file used to make every form on every page an always-XHR submit, plain login and signup forms included. Behaviour change: an implicitly bound form now submits natively unless it carries a `data-gina-form-*` attribute or matches a rule.
-- **Fixed — a date field no longer submits the previous day east of UTC (#B558).** `isDate` wrote a `Date` object into the payload, which `JSON.stringify` renders as a UTC instant — the previous day in any positive offset. The payload now takes a plain `yyyy-mm-dd` string, matching the schema the framework already published; breaking for anything that read `req.body.<field>` as a `Date`.
-- **Fixed — an XHR redirect over HTTP/2 delivers the session cookie it rotated (#B550).** `redirect()`'s XHR and popin exits answered on the raw HTTP/2 stream, so a session middleware's `on-headers` cookie and save-on-end never fired and a user signed in immediately before the redirect arrived unauthenticated. Both exits terminate through the compat response, and the router's `inheritedData` consume persists itself.
-- **Fixed — a session survives an ordinary HTTP/2 render (#B562).** A transparent base `writeHead` / `write` / `end` is installed before the middleware chain and the six buffering render delegates hand their send to it, so a `rolling` cookie rolls and a mutation made while rendering is persisted; statics stay on the raw stream deliberately and `renderStream()` is unchanged.
-- **Fixed — an HTML file in `public/` no longer answers 500 on a bundle without templates (#B567).** The dev-mode loader injection read a `content.templates._common` block that an API-only bundle never has.
-- **Fixed — an environment config overlay now overrides its base file.** A `<name>.<env>.json` overlay was folded in before its base and lost to it on every shared key — the opposite of what the reference pages described. It now wins; an overlay array replaces the base array and a `null` overrides. Read your overlays before upgrading.
-- **Fixed — two connectors in one bundle no longer fight over an entity class name (#B555).** The process-wide entity table was keyed on the bare class name, so the connector whose connection became ready second was handed the first one's instance. It is keyed per bundle, model and class now, and a bundle whose declared entity did not reach its model refuses to start instead of serving a half-built model layer.
-- **Fixed — a JSON config with a docblock and an unterminated `/*` in a string value no longer hangs the boot (#B568).** `requireJSON`'s block-comment strip backtracked about twice per line after a glob or certificate path such as `"…/ssl/*.example.pem"`, hanging the boot until the start-wait killed it with nothing logged; the strip is now a linear, string-aware scan.
-- **Fixed — `self.throwError()` answers the request when called with a falsy value (#B560).** The late-call guard tested the one-argument form's payload for truthiness, so `self.throwError(err)` with `''`, `null`, `undefined`, `0` or `false` was mistaken for a call on a released response and the request was never answered; it now renders a 500 like any other.
-- **Fixed — the storage metadata store no longer runs an application callback inside its own try/catch (#B565).** Seven methods swallowed an error thrown by the callback and then invoked it a second time with the application error presented as a store error, so a first-settle latch such as the content-addressed driver's `verify()` hung; callbacks now run after the try on every path.
-
+> **Read before upgrading — some changes can stop a bundle or change an
+> answer.** A malformed `${secret:…}` reference now refuses the bundle (run
+> `gina secrets:check` first); a throw from `onInitialize` and a model that fails
+> to load on an asynchronous connector now abort the boot; a Couchbase `$scope`
+> outside `^[A-Za-z0-9_./-]+$` refuses the boot; `http2Options.maxStreamsPerSecond`
+> is no longer read (rename it `maxStreamResetsPerSecond`); `useRestApi` on a
+> Couchbase connector is ignored; `scope:add` and `env:add` refuse names they
+> used to drop silently; and on an `http/2.0` bundle an HTTP/1.1 client using a
+> method a route does not declare now gets 404 (405 on a multi-method route).
+> The [migration notes](https://gina.io/docs/migration) list every behaviour
+> change.
+
+**The request-parsing and inter-bundle release.** Nine security fixes lead it.
+One unauthenticated GET could stop a bundle process, an encoded `&` or `=` in a
+form field could add or override other fields, a parse failure wrote the raw
+body or query to the log, and a top-level `__proto__` field swapped the parsed
+request object's prototype. On an `http/2.0` bundle an HTTP/1.1 request skipped
+every route's method check, and a query key named like an inherited object
+member could reach another route. The Couchbase connector no longer writes
+values into statement text unvalidated and its plaintext REST transport is
+retired, and `project:add` no longer runs `--scope` / `--env` through a shell.
+The inter-bundle throughput arc makes `self.query()` hold up under sustained
+traffic: the framework's env template is parsed once per process instead of six
+times per request, the HTTP/2 rapid-reset guard counts client resets instead of
+new streams, client sessions no longer reset every stream, leak or storm
+pre-flight PINGs, a request refused before processing is retried for any method,
+HTTP/1.1 calls reuse their connections, and `server.query.http2SessionPool`
+spreads calls over several sessions. The `is` validation rule now compares
+referenced values exactly as typed, with one `$field` token grammar everywhere
+([gh#77](https://github.com/gina-io/gina/issues/77)). Full detail in
+[CHANGELOG.md](./CHANGELOG.md).
+
+- **Security — one GET request could stop the bundle (#B591).** A bracket-notation field name whose non-last segment is numeric while its container is not an array (`0[a]=1`) threw inside the nesting helper, and on the `inheritedData` query path nothing caught it: one unauthenticated `GET /any-url?inheritedData=0%5Ba%5D%3D1` exited the bundle process. A urlencoded body with the same name answered 500, and the validator's browser twin broke the submission. Such a segment now creates a plain object slot.
+- **Security — an encoded `&` or `=` in a form field can no longer add or override other fields (#B588).** A urlencoded POST, PUT or PATCH body was percent-decoded as a whole before it was split, so `bio=hi%26role%3Dadmin` arrived as a second `role` field. The body now follows the standard form algorithm — split on `&`, then at the first `=`, each name and value decoded exactly once — which also keeps a raw `=` inside a value and a typed `100%25` as typed.
+- **Security — a parse failure no longer writes the request body or query to the log (#B590).** The data helper's parse-failure lines printed the whole document at error level — a password or a token included, and in the browser console too — and the isaac query parser warned with the value. They now log the input's length, its first character and the error's name, never the value or the parse message.
+- **Security — a top-level field named `__proto__`, `constructor` or `prototype` is dropped (#B592).** Assigned flat, a JSON-valued `__proto__` pair swapped the prototype of the parsed request object, so `req.post.<key>` could read an attacker-chosen value that `Object.keys` and `hasOwnProperty` could not see. The process-wide pollution was already closed by #B446; this is the per-request object.
+- **Security — the Couchbase connector no longer writes caller or configuration values into statement text unvalidated (#B608).** A `$N` inside `SEARCH()` is now bound as a query parameter instead of being spliced in as an unescaped string literal; a `$N` used as a field-path segment must be a dotted identifier path or the query is refused (`GINA_COUCHBASE_INVALID_FIELD_PATH`); and the `$scope` / `_scope` value is resolved once at load and must match `^[A-Za-z0-9_./-]+$`, or the bundle refuses to boot.
+- **Security — the Couchbase connector's REST query transport is retired (#B634, #B623).** `useRestApi: true` sent every N1QL query over plain HTTP with the cluster credentials in an `Authorization: Basic` header — even on a `couchbases://` entry — and rewrote quotes and inserted parameters unescaped. The option is now ignored with one warning, and those queries go through the Couchbase SDK.
+- **Security — `project:add` no longer runs `--scope` / `--env` through a shell (#B640).** An unregistered name was registered through a shell command line with the value spliced in unquoted, so shell syntax in it ran as the user running `project:add` — an exposure for automation that builds those flags from data it does not control. Both values are now checked against the name rules before anything is written, and the child commands start from an argument vector.
+- **Security — on an `http/2.0` bundle, an HTTP/1.1 request is held to each route's method (#B645).** Such a bundle also answers HTTP/1.1 — a client that does not negotiate HTTP/2, or a reverse proxy such as nginx's `proxy_pass` — and the router read the method from the HTTP/2 `:method` pseudo-header, which an HTTP/1.1 request does not carry, so every method passed: a GET reached a POST-only action, and the wrong action could be left in the route cache for later HTTP/2 clients. A wrong method now gets 404 (405 on a multi-method route), and an HTTP/1.1 CORS preflight is answered 204.
+- **Security — a query key named like an inherited object member can no longer reach another route (#B650).** For a GET or DELETE on a route that declares `requirements`, a key such as `toString` or `valueOf` was found by a plain property read and counted as a requirement; each such key replaced a leading segment of the compared URL, so a request could reach a route whose path differs from its own — bypassing a path-based control applied outside the route, such as a reverse-proxy location rule. Only requirements a route declares itself count now. Every release since `0.1.0` was affected.
+- **Added — `server.query.http2SessionPool` (#P43).** How many HTTP/2 client sessions `self.query()` keeps per upstream (1 to 50, default 1, as before). A pool of N is filled round-robin, so a per-connection load balancer — a Kubernetes Service with no HTTP-aware ingress — spreads the calls over N connections instead of pinning them all to one pod.
+- **Changed — the HTTP/2 rapid-reset guard counts client resets; `maxStreamsPerSecond` becomes `maxStreamResetsPerSecond` (#B611).** The Isaac guard (CVE-2023-44487) counted new streams per session, so above 200 calls per second a sibling bundle's own multiplexed `self.query()` calls tripped it and every in-flight call failed with a 500. It now counts the streams a client cuts short. The old key is no longer read — a bundle still setting it gets one boot warning and the default — and `streamResetBurst` / `streamResetRate` pass through to the runtime's own reset limit. Not a vulnerability fix: the protection stays; it no longer fires on the framework's own traffic.
+- **Changed — `scope:add` checks the whole name; the `<bundle>/<scope>` form is retired (#B626).** A name is made of letters, digits, `_`, `.` and `-`, starts with a lowercase letter, a digit, `_` or `.`, and is not `.`, `..` or the name of an inherited object member such as `constructor`; a name that fails used to be dropped without a message and is now refused. The `<bundle>/<scope>` form never limited a scope to one bundle — it registered a scope literally named `<bundle>/<scope>` — and is refused with a pointer to the `scopes` allow-list in `manifest.json`. Registered scopes are unchanged.
+- **Changed — `env:add` checks the whole name; the `<bundle>/<env>` form is retired (#B639).** The same rules as `scope:add`, and `global` — which already names the overlay that applies to every environment — is refused as well. Registered environments are unchanged.
+- **Fixed — a throw from `onInitialize` aborts the boot loudly (#B576).** A synchronous throw, or the rejection of an `async` callback's promise, before `'complete'` now exits 1 with the reason on stderr. It used to leave a bundle listening on nothing: `bundle:start` waited out its timeout, and a `gina-container` process could exit 0.
+- **Fixed — a model that fails to load on an asynchronous connector aborts the boot (#B617).** A rejected entity file or a throwing entity constructor on DuckDB or Couchbase was logged as a rejection, retried as a connection failure, or swallowed — and a DuckDB bundle under `gina-container` exited 0. It now ends the boot with exit code 1, as a synchronous connector already did.
+- **Fixed — a malformed `${secret:…}` reference refuses the bundle at config load (#B583).** A key breaking `^[A-Z_][A-Z0-9_]*$` — lowercase, dotted, empty or padded — used to pass through, so the literal placeholder reached its consumer as a credential. It is now refused like a missing key; `gina secrets:check` names every offending entry, so run it before restarting on this release.
+- **Fixed — logging in with the Couchbase session store no longer fails when the pre-login session was never saved (#B577).** Rotating the session deleted an absent document and the store reported that as an error, failing `req.login()` and Passport 0.6 or later; deleting an absent session is now a success, as on every other session store gina ships.
+- **Fixed — a query value holding a percent-escape no longer empties the whole query (#B589).** A GET or HEAD value holding `%0A`, `%22`, `%5C` or `%25` was decoded twice, turning the serialized query document into invalid JSON — `req.get` came back empty — and `100%2525` became `100%`. The same path serves the browser validator and every route declaring a DTO, where a JSON body value holding `%22` could leave the action with no payload.
+- **Fixed — two data-helper type declarations match the runtime (#B588).** `nestBracketNotationKey` takes the bracket path as an array, and `formatDataFromString` returns `object | undefined`. Type-check only.
+- **Fixed — a referenced value is compared exactly as typed (#B600, #B601, #B602).** In an `is` condition such as `$password === $passwordConfirm`, a double quote, a backslash or a line break in a value stopped the validation pass (the browser form could not submit, the server threw); parentheses and the word `return` inside a value were ignored (`ab(cd` matched `ab)cd`); and a value with no ASCII letter or digit (`!!!`) never matched.
+- **Fixed — every `$field` token follows one grammar (#B603, #B604, #B606).** In an `is` condition, a route `validator::` requirement, a fluent `is()` call and a `query` rule's `data`: one pass, the longest field name wins, a token ends at the first character outside `A-Z a-z 0-9 _ -`, and a `$` naming no field stays literal — so `abc$email` is no longer substituted a second time, `($password) === ($passwordConfirm)` resolves, and `$passwordConfirm` in `query` data is no longer read as `$password` followed by `Confirm`.
+- **Fixed — the in-memory Collection compares strings with `==`, `>` and `<`, and a quote no longer breaks a query (#B609).** A row whose string value held a `"` threw and failed the whole `find()`; `==`, `>` and `<` were not recognised on strings; and a space after the operator skewed the comparison. Both operands are now encoded before they are compared; numeric and datetime comparisons are unchanged.
+- **Fixed — every request re-read the framework's env template from disk (#B610).** Six synchronous reads and parses per request in every bundle — measured at 27% of a trivial JSON route's CPU — are now one parse per process.
+- **Fixed — bundle-to-bundle HTTP/2 calls no longer die after about 1,000 calls, and a call cut by a GOAWAY is retried (#B612, #B613).** The client reset every completed stream, which the target's runtime counted against its reset limit until it closed the session with `GOAWAY(INTERNAL_ERROR)`. A safe-method call cut by a GOAWAY is now retried on a fresh session, and a session gone before the send is retried for any method.
+- **Fixed — the `/_gina/info` `rstCount` metric was always 0 (#B614).** It now counts the streams a client cuts short.
+- **Fixed — bundle-to-bundle HTTP/2 sessions no longer leak, and the pre-flight PING no longer storms (#B625, #B627).** Evictions are identity-checked, so a dead session's late event no longer evicts its live replacement (which leaked, keepalive ticking); a replaced or evicted session is closed gracefully; one pre-flight PING serves every waiting caller; and a cancelled PING no longer counts as a dead session.
+- **Fixed — the boot warmup (`server.warmup`) keeps its HTTP/2 sessions on Node.js (#B629).** Its PING went out while the session was still connecting and the cancel tore the session down; it is now sent once the session is connected.
+- **Fixed — a request refused before the upstream processed it is retried for any method (#B630, #B631).** `REFUSED_STREAM` and an asynchronous `ERR_HTTP2_GOAWAY_SESSION` are re-sent within the retry budget, so a POST no longer fails with a 503 when nothing was processed.
+- **Fixed — the Isaac server closes idle HTTP/2 sessions (#B619).** Its 120 s idle timer tested a property that does not exist and re-armed forever. An idle session now closes gracefully after `http2Options.sessionIdleTimeout` (default 120 s; `0` disables it). Node.js only.
+- **Fixed — bundle-to-bundle HTTP/1.1 calls reuse their connections (#P44).** Each call built its own connection pool and threw it away, so 500 calls opened 500 connections; calls to one upstream now share one keep-alive pool, and `maxSockets` (default 100) now limits the concurrent connections to one upstream.
+- **Fixed — an https bundle-to-bundle call no longer reads its CA file on every call (#B633).** The file is read once and read again only when it changes on disk, so a Kubernetes Secret update is still picked up by the next call.
+- **Fixed — a Couchbase reconnect keeps each connector's declared `scope` (#B624).** The model rebuild omitted it, switching the connector to `NODE_SCOPE` for the documents it stamps and the queries it filters.
+- **Fixed — `bulkInsert` escapes the bucket name (#B616).** A bucket such as `beer-sample` made the statement fail to parse; the name is now backtick-quoted.
+- **Fixed — `project:add` no longer loses a scope or environment it has just registered (#B647).** Its link step raced the `scope:add` / `env:add` children over the registry files; it now starts once the rest of the command has finished.
+- **Fixed — `scope:link-local`, `scope:link-production` and `env:link-dev` no longer crash without a registered project (#B641).** They print the missing or unknown project name and exit 1 instead of a stack trace.
+- **Fixed — the same three commands exit after a successful change (#B648).** Started by the CLI's own path (`node <gina>/bin/cli …`, as CI jobs and scripts run it), they wrote the change and then hung on the CLI's open log listener; the installed `gina` launcher was not affected.
+- **Fixed — the published package no longer carries end-to-end test artifacts (#B581).** Two Playwright `error-context.md` snapshots shipped in `0.6.32` and `0.6.33-alpha.1` — test fixtures only, no credentials and no local paths; `test-results/` and `playwright-report/` are now excluded from the tarball.
 
 ## Documentation
 

package/ROADMAP.md

@@ -84,6 +84,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.30` ✅ | **Security**: the isolation release — a response rendered on the default swig path no longer carries a concurrent request's negotiated culture and webroot (50 of 50 concurrent pairs bled before the fix, 0 of 100 after); a later `util.promisify`-style caller of an entity method no longer receives an earlier call's record, which where the method reads a user-scoped row could pass an ownership check on another principal's data; and the error raised by the global `getConfig()` / `getLib()` helpers no longer writes its stack to the response, minting an incident `ref` and logging one full-detail line instead. **Changed**: `self.getConfig()` returns a per-call copy-on-write view of the configuration instead of a deep clone — reads pass through, your writes stay yours, and a route behind two middlewares reading `this.getConfig()` measured 14,719 ms → 1,884 ms per 3,000 requests. **Added**: log rotation for the logger's opt-in `file` container, and `gina tail` renders JSON when its logger's format is `json`. **Fixed**: bundle templates render through a per-bundle engine; a framework error is answered to the request that raised it rather than the most recently routed one; the server-side `query` validation rule no longer writes into the shared proxy configuration; the `file` container writes at all; and `gina-container` applies the container logging preset itself. |
 | **Q4 2026** | `0.6.31` ✅ | **Security**: the availability release — a request carrying a top-level field named `count` no longer terminates the bundle process (unauthenticated, one request, on any URL including one matching no route; every published version was affected), and a queued async job runs inside a detached copy of the request context that created it instead of whichever request's job freed the worker slot. **Added**: RFC 9218 request priorities — `req.priority` on both engines, propagation through `self.query()` / `self.forward()`, `self.setPriority()`, and urgency-ordered async jobs. **Fixed**: a Couchbase connector that cannot reach its cluster at boot reports the failure instead of hanging until the CLI kills the bundle; one bundle without a release `config/` no longer moves every other bundle's configuration root, and the config-directory refusals name the bundle; two dead external references refreshed. Restart your bundles **and rebuild them** — the `count` fix touches the validator's shared rule engine, which is browser-bundled. |
 | **Q4 2026** | `0.6.32` ✅ | **Security**: the form-answer release's four fixes — credentials no longer ride a redirect (the request's `password` / `secret` / `token`-class fields are dropped from what `self.redirect()` carries); the built-in error pages HTML-escape every value they render (a reflected XSS through `?error=` on any redirecting route, every released version); a request parameter named `error` can no longer force a 500 or leave the request unanswered; an HTTP/2 static file no longer carries another request's response headers. **Added**: htmx-style form answers — `data-gina-form-target` / `-swap` / `-select`, out-of-band `data-gina-swap-oob` elements, and the `X-Gina-Retarget` / `-Reswap` / `-Reselect` response headers (same-origin only); the `GINA_MAINTENANCE` boot variable and replica-coherent maintenance mode through a shared kv namespace, with `pid` and `hostname` on the status payload; per-bundle login session lifetimes from `security.json` on top of the new `lib.duration.parse()`; a contributor `commit-msg` hook. **Changed**: popin context by containment rather than by the active popin; two form answers replacing one region no longer race (the newer submit supersedes); a navigated fragment's forms bind only when they opt in. **Fixed**: the gh#76 routing defect and its popin family (declared callbacks on the popin branch, the pre-open loading state, the modeless guard, the false 422 outside dev, table-row answers, reload blanking, malformed dialog targets, staged uploads placed by containment); the validator binds only opted-in forms; a date field no longer submits the previous day east of UTC; an XHR redirect and an ordinary render over HTTP/2 run the session middleware's hooks; an HTML static on a template-less bundle; an environment config overlay now overrides its base; two connectors sharing an entity class name; a glob path in a docblock-bearing JSON config no longer hangs the boot; `throwError()` with a falsy payload; the storage metadata store's callback isolation. 35 fragments; restart **and rebuild** — 17 commits touch the browser bundle. |
+| **Q4 2026** | `0.6.33` ✅ | **Security**: nine fixes — one unauthenticated GET could stop a bundle process (a bracket field name with a numeric segment); an encoded `&` or `=` in a urlencoded body could add or override other fields; a parse failure wrote the raw body or query to the log; a top-level `__proto__` field swapped the parsed request object's prototype; on an `http/2.0` bundle an HTTP/1.1 request skipped every route's method check; a query key named like an inherited object member could reach another route; the Couchbase connector binds `SEARCH()` terms and validates field paths and the scope instead of splicing them into statement text, and its plaintext REST query transport is retired; `project:add` no longer runs `--scope` / `--env` through a shell. **Added**: `server.query.http2SessionPool`. **Changed**: the HTTP/2 rapid-reset guard counts client resets (`maxStreamResetsPerSecond`); `scope:add` and `env:add` check the whole name and retire the `<bundle>/<name>` forms. **Fixed**: the inter-bundle throughput arc (the env template parsed once per process; HTTP/2 client sessions no longer reset every stream, leak, storm pre-flight PINGs or lose their warmup sessions; a request refused before processing is retried for any method; the server closes idle sessions; HTTP/1.1 calls reuse their connections; the CA file is read once); the `is` rule compares referenced values as typed, with one `$field` token grammar (gh#77); a throw from `onInitialize` and an asynchronous model-load failure abort the boot; a malformed `${secret:…}` reference refuses the bundle; the Couchbase session store's login rotation, a reconnect's scope and `bulkInsert`'s bucket name; a percent-escape no longer empties a query; the in-memory Collection's string operators; the `rstCount` metric; `project:add`'s scope and environment race and the link-slot commands' crash and hang; two type declarations; the tarball's test artifacts. 42 fragments; restart **and rebuild** — 8 commits touch the browser bundle. |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities ✅ shipped early in `0.6.31` (the `Priority` header half — read, propagated, emitted, job urgency; response ordering stays blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`; the per-request configuration view — `getConfig()` without the deep clone — landed for the next `0.6.x` cut) |
 | **2027** | `0.8.0` | ⚠️ **Delivered early — this content shipped in `0.6.25` (2026-09-03)**: XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys. No committed content remains against this milestone; re-scope before planning around it. |
@@ -429,6 +430,8 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 
 ## HTTP/2
 
+> **Inter-bundle throughput arc (2026-09-24):** the HTTP/2 client-side fixes — the rapid-reset limiter re-scope and GOAWAY retry, the session lifecycle, and the `GOAWAY(INTERNAL_ERROR)` diagnosis — are tracked under **Performance**, not here.
+
 | Status | Feature | Version | Target | Notes |
 | --- | --- | --- | --- | --- |
 | ✅ | **Fix `/_gina/info` HTTP/2 endpoint** — `stream.end(infoStatus)` not `stream.end(infoHeaders)` | `0.2.0` | Q2 2026 | The HTTP/2 branch of the info endpoint passes the headers object instead of the JSON string. Returns `[object Object]` instead of JSON. One-line fix. |
@@ -437,7 +440,7 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | ✅ | **103 Early Hints** — send `Link` preload headers as informational response before the final response | `0.3.0-alpha.1` | 2026-03-31 | `self.setEarlyHints(links)` on SuperController. HTTP/2: `stream.additionalHeaders({ ':status': 103 })`; HTTP/1.1: `res.writeEarlyHints()` (Node.js 18.11+). Silent no-op on unsupported runtimes. |
 | ✅ | **HTTP/2 session metrics** — expose active session count, stream count, GOAWAY and RST_STREAM totals via `/_gina/info` | `0.3.0-alpha.1` | 2026-04-01 | `server._h2Metrics` counter object instrumented via session event handlers; exposed under `"http2"` key in `/_gina/info` JSON. |
 | ✅ | **Configurable `maxConcurrentStreams` and `initialWindowSize`** — move from hardcoded to `settings.json` `http2Options` | `0.3.0-alpha.1` | 2026-04-05 | All four HTTP/2 server settings configurable: `maxConcurrentStreams` (256), `initialWindowSize` (655350), `maxSessionRejectedStreams` (100), `maxSessionInvalidFrames` (1000). Security guards (`maxHeaderListSize`, `enablePush`) remain hardcoded. |
-| ✅ | **Application-level rapid reset rate limiter** (CVE-2023-44487) — per-session stream creation counter | `0.3.13` | 2026-05-14 | The Isaac HTTP/2 session handler counts new streams in a rolling 1s window per session; over `maxStreamsPerSecond` (default 200) it sends a GOAWAY and closes the session. More targeted than `maxSessionRejectedStreams` (which counts refused streams, not created ones). Configurable via `settings.json` `http2Options.maxStreamsPerSecond`; `/_gina/info` exposes a `rapidResetBlocked` counter. |
+| ✅ | **Application-level rapid reset rate limiter** (CVE-2023-44487) — per-session client-reset counter | `0.3.13` | 2026-05-14 | The Isaac HTTP/2 session handler counts the streams a client cuts short before the response completed, in a rolling 1s window per session; over `maxStreamResetsPerSecond` (default 200) it sends a GOAWAY and closes the session. Shipped in `0.3.13` as a new-stream counter (`maxStreamsPerSecond`), which a sibling bundle's own multiplexed calls tripped; re-scoped to client resets in `0.6.33`. More targeted than `maxSessionRejectedStreams` (which counts refused streams). `/_gina/info` exposes `rapidResetBlocked` and `rstCount` counters. |
 | ✅ | **Trailer support** — `stream.sendTrailers()` + `waitForTrailers: true` | `0.4.0` | 2026-05-22 | Opt-in HTTP/2 response trailers via `self.sendTrailers(fields)`. The render pipeline sets `waitForTrailers` and emits the trailing headers after the body (in the `wantTrailers` event), across all render delegates. Activated only when a controller calls `self.sendTrailers(fields)`; HTTP/1.1 and the no-trailers path are unchanged. For gRPC-style streaming (`grpc-status`) and content-integrity (`Digest`) use cases. |
 | ✅ | **Alt-Svc header** — advertise HTTP/3 availability | `0.4.2` | 2026-06-02 | Set `Alt-Svc: h3=":443"; ma=86400` response header to advertise HTTP/3 (QUIC) availability via a QUIC-capable reverse proxy (nginx, Caddy, Cloudflare). Gina does not need to implement QUIC — just announce it. Opt-in via `settings.server.json`. Native HTTP/3 is out of scope: Node.js has no stable QUIC API, and the standard deployment topology (Gina → proxy → client) already delivers HTTP/3 at the edge. |
 | ✅ | **RFC 9218 Extensible Priorities** — read, expose and propagate the `Priority: u=N, i` header | `0.6.31` | 2026-09-14 | Shipped: `req.priority` (urgency 0–7, the incremental flag, `present`) parsed on both engines, propagated on outbound `self.query()` / `self.forward()` calls (a caller-set header wins, `priority: false` suppresses), emitted with `self.setPriority()`, and consulted by the async-job worker through `startJob(fn, { urgency })` — explicit, never inherited from the request. Browsers do send it over HTTP/2 — Chrome spans the full urgency range and distinguishes documents, stylesheets, scripts, images and `fetch()` — while HTTP/1.1 sends nothing. Ordering the response writes themselves is **not** included: Node exposes no `PRIORITY_UPDATE` frame and no send-scheduler hook, so that half waits on the runtime. |
@@ -478,7 +481,7 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | Status | Feature | Version | Target | Notes |
 | --- | --- | --- | --- | --- |
 | ✅ | **`NODE_COMPILE_CACHE` — V8 bytecode startup cache** | `0.2.0` | Q2 2026 | Node.js 22.8+ caches compiled V8 bytecode to disk. Set once at startup — 30–60% faster cold start on subsequent runs with zero code changes to user bundles. No-op on Node < 22.8, so safe to ship unconditionally. |
-| ✅ | **Route radix trie — compile `routing.json` at startup** | `0.3.0-alpha.1` | 2026-04-01 | `lib/routing/src/radix.js` builds a segment-level trie once at startup. O(m) candidate lookup per request (m = segment count). `Set.has()` check skips non-candidates in the `for…in` loop. Internal change — no user-facing API change. |
+| 🔄 | **Route radix trie — compile `routing.json` at startup** | `0.3.0-alpha.1` | 2026-04-01 | **Built, not wired (measured 2026-09-24):** the trie is built by a function the boot never calls, so every request still matches by a linear scan — it has not run in any release. Wiring it, with a runtime check, is the routing slice of the inter-bundle throughput arc below. Original note: `lib/routing/src/radix.js` builds a segment-level trie once at startup. O(m) candidate lookup per request (m = segment count). `Set.has()` check skips non-candidates in the `for…in` loop. Internal change — no user-facing API change. |
 | ✅ | **Bun runtime support** | `0.5.5` | 2026-06-21 | Gina runs on the [Bun](https://bun.sh) runtime (Bun `>= 1.2`) as a supported, CI-gated target — `bun add -g gina` installs and boots end-to-end, validated by a blocking CI Bun smoke. Both investigated blockers cleared: dev-mode `require.cache` hot-reload and `node:http2` work under Bun (on Bun `< 1.4` one upstream gap remains: RFC 8441 extended-CONNECT advertisement, affecting only opt-in WebSocket-over-HTTP/2 — Bun 1.4 advertises it). Gina self-bootstraps on first run; Node `>= 22 < 27` remains fully supported. |
 | ✅ | **V8 pointer compression support** | `0.2.0` | Q2 2026 | Node.js built with `--experimental-enable-pointer-compression` (e.g. [node-caged](https://github.com/platformatic/node-caged) or a custom build) delivers ~50% heap memory reduction across all pointer-heavy structures. Gina is pure JS — compatible out of the box. Adds: startup detection + `GINA_V8_POINTER_COMPRESSED` env var, Dockerfile guide with custom build recipe (full-icu + pointer compression), 4 GB ceiling documentation, N-API-only connector policy. |
 | ✅ | **Runtime CPU profiling baseline** | `0.6.2` | 2026-07-31 | Shipped — a three-arm baseline (HTTP/2 render, concurrent multipart upload, WebSocket echo) profiled a production-built bundle under load. Outcome: the multipart-scan, WebSocket-unmask, and render/log-cleanup candidates below all measured small under their own arms and moved to measure-gated deferral, while the dominant cost found is per-request deep-clone traffic — half of render-arm CPU — plus per-item random-id minting (~1 ms per render), now planned as its own row below. "No further acceleration needed" was an accepted verdict shape, and for the byte-loop candidates it is the verdict. |
@@ -487,6 +490,13 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | ⏸ | **Render & logging hot-path cleanups** | — | on demand | **Deferred — acquitted by the profiling baseline (2026-07):** the asset-scan, logger-regex, and render-splice candidates each measured at or under about 1% of render CPU under the arm built for them (the broken asset-scan memo guard remains real, but as a correctness fix that can ride any future work on that surface). Re-armed if any of them turns leading in a future profile. Original scope, unchanged when re-armed: repair the per-render asset-scan memoization (the cache guard can never hit as written, so the full document is re-scanned every HTTP/2 render), precompile the logger's per-line token regexes, and consolidate whole-document render passes where a profile convicts them. |
 | ⏸ | **SIMD boundary scanner (Rust → WebAssembly)** | — | on demand | **Deferred — measure-gated, doubly dormant since the 2026-07 baseline.** Built only if a profile still convicts the multipart scan after the JS fast path lands — and the JS fast path is itself deferred-acquitted, so this trigger cannot fire today. WebAssembly first: sandboxed, a single artifact for every platform including Bun, no process crash surface. Native N-API prebuilds — published as separate per-platform packages so the framework tarball never carries a compiled binary — only if WASM leaves measured headroom. No install scripts ever; the JS implementation remains the permanent fallback. *Interim:* the JS fast path above. |
 | ✅ | **Render-path deep-clone & id-mint reduction** | `0.6.2` | 2026-08-01 | **Convicted by the profiling baseline, shipped ahead of schedule:** half of render-arm CPU was per-request deep-clone traffic, concentrated in three framework call sites (the template-filter configuration was re-cloned on every render; the render delegate cloned its envelope; the options collection deep-cloned its content and minted a random id per collected item — about 1 ms per render of entropy alone), with GC time consistent with the clone garbage. Shipped JS-side only: the filter configuration is now passed and stashed by reference (its write surface was measured empty before the change), the per-request locale lookups are memoized with the per-request copy materialized lazily on first read, and the id generator right-sizes its entropy batch to the requested length. Measured on the profiling harness with fresh runs on both sides: **4.4× render throughput** on the baseline workload (10.7 → 2.4 ms per render), deep-clone share 50.31% → 1.81%, GC down ~18×, and entropy out of the top profile frames on both arms. The remaining clone sites on this surface stay measure-gated for a future profile. Porting the object-graph work to native code remains an anti-candidate. |
+| ✅ | **Per-request config template re-read — the framework env template parsed once per process** | `0.6.33` | 2026-09-24 | **Shipped (#B610) — the inter-bundle throughput arc, slice 1.** The configuration object is constructed three times per request and each construction re-read and re-parsed the framework's env template from disk twice: six synchronous file reads per request in every bundle, twelve per bundle-to-bundle call, 27% of a trivial JSON route's CPU. It is now parsed once per process and shared read-only; measured 6 → 0 reads per request. Pickup: bundle restart. |
+| ✅ | **HTTP/2 hop self-DoS — rapid-reset guard re-scoped to client resets; a call cut by a GOAWAY retried** | `0.6.33` | 2026-09-24 | **Arc slice 2, shipped.** The Isaac rapid-reset guard counted *new streams* per session per second, so a sibling bundle multiplexing its `self.query()` calls on one session was closed by its own target above 200 calls/s (17% of calls answered 500 at 50 concurrent callers with default settings). It now counts the streams a client cuts short before the response completed (`maxStreamResetsPerSecond`, default 200; `maxStreamsPerSecond` is no longer read — one boot warning), and the runtime's own reset limit stays the primary guard, exposed as `streamResetBurst`/`streamResetRate`. The HTTP/2 client no longer resets a completed stream — those frames tripped the target's runtime limit after ~1,000 calls (`GOAWAY(INTERNAL_ERROR)`, the audit's F4) — an in-flight safe-method call cut by a GOAWAY is retried on a fresh session, and a session gone before the send is retried for any method. The `/_gina/info` `rstCount` metric, always 0 until now, counts client resets. Restart, no re-bake. |
+| ✅ | **HTTP/2 client session lifecycle — identity-checked eviction, coalesced pre-flight PING, no eviction on a cancelled ping, graceful close of a session that loses its slot, per-authority pool size** | `0.6.33` | 2026-09-24 | **Arc slice 3, shipped.** Every eviction of a cached HTTP/2 client session is identity-checked and a session that loses its cache slot is closed gracefully, so a dead session's late events no longer orphan the live replacement (148 + 160 upstream connections were still open 186 s after a load run); one pre-flight PING per session serves every waiting caller, a response counts as proof of life and a cancelled PING is inconclusive (22 healthy sessions were evicted per 10 s at 50 concurrent callers); the boot warmup keeps its sessions on Node.js; a request refused before processing (`REFUSED_STREAM`, `ERR_HTTP2_GOAWAY_SESSION`) is retried for any method; and `server.query.http2SessionPool` (default 1, up to 50) spreads a caller over N connections behind a per-connection Kubernetes `Service` (measured 40 / 0 → 20 / 20 through a round-robin proxy). Beside it, the Isaac server now closes idle sessions after `http2Options.sessionIdleTimeout` (120 s; Node.js only — the old timer never closed anything). Scene at 50 concurrent callers: pre-flight evictions 66 → 0 per run, failed calls 60–97 → 0, connections to each upstream 34 → 67 and growing → exactly 1. Restart, no re-bake. |
+| ✅ | **HTTP/1.1 hop connection reuse — one keep-alive agent per upstream instead of one per call** | `0.6.33` | 2026-09-25 | **Arc slice 4, shipped.** Every `self.query()` over HTTP/1.1 opened a new TCP connection (500 calls → 500 connections), costing ~190 µs of callee CPU per call on loopback and a full network round-trip (plus TLS) per call between pods. Calls to the same upstream now share one keep-alive pool kept for the life of the bundle: 500 sequential calls use one connection, 50 concurrent callers settle at 10, and the benchmark's median latency fell from 46 to 14 ms. One pool per upstream, never one shared: a single shared pool sent every `bundle@project` call to the wrong host. `maxSockets` (default 100) now caps the connections to one upstream. Pickup: bundle restart. |
+| 📋 | **Server-side `GOAWAY(INTERNAL_ERROR)` on long-lived HTTP/2 sessions — diagnose and fix** | `0.6.x` | Q4 2026 | **Arc slice 5.** Observed on long-lived inter-bundle sessions under load (4 events → 24 failed calls) with nothing in the target's log; to be reproduced with HTTP/2 debug tracing and fixed. |
+| 📋 | **Routing — wire the radix trie and trim the warm path; measure against rule count** | `0.6.x` | Q4 2026 | **Arc slice 6.** The radix trie shipped in 0.3.0 is built by a function the boot never calls, so every cold match is still a linear scan and even a cached match re-runs the full comparison. Wire the trie with a runtime check, remove the per-request work a cache hit does not need, and measure cold and warm matching at 3 / 60 / 380 rules. |
+| 📋 | **Hop hygiene — per-call warning and `status` injection on the HTTP/2 hop, guide corrections, arc exit benchmark** | `0.6.x` | Q4 2026 | **Arc slice 7.** Every HTTP/2 answer without a `status` field logs a warning and gets `status: 200` injected into the caller's data; the multi-bundle guide describes the call as travelling over HTTP/2 when the scaffold default is HTTP/1.1. Closes with a re-run of the bundle-to-bundle benchmark on the shipped tree: zero failures at 50 concurrent callers with default settings, no connection growth after load, and a measured reduction of the hop's cost. |
 
 ---
 

package/framework/v0.6.33/VERSION

@@ -0,0 +1 @@
+0.6.33