gina 0.6.34-alpha.1 → 0.7.1-alpha.1

package/CHANGELOG.md

@@ -6,6 +6,37 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.7.0 - 2026-09-27
+### Added
+* A Swig bundle that leaves `settings.swig.autoescape` unset now gets a warning at boot, once, naming 0.8.0: in 0.8.0 the default becomes `true`, which HTML-escapes every `{{ x }}` a template does not mark `| safe`. Set the key explicitly to keep your bundle's behaviour and silence the warning: `true` to escape (then mark a variable that carries HTML on purpose with `| safe`, for example `{{ gina.csrfInput | safe }}`), or `false` to keep output unescaped. A bundle whose own pages render only through Nunjucks is not warned. New bundles created with `gina bundle:add` now set `"swig": { "autoescape": true }` in their `settings.json`. Rendered output does not change in 0.7.0. Pick it up with a bundle restart. (#B359)
+* A bundle now warns once at boot, in one line, about the routing `requirements` regexes that are not anchored at both ends, such as `"/[0-9]+/"`. A requirement is tested as a partial match when a request is matched, so that one accepts `123abc`: anchor it (`"/^[0-9]+$/"`) to constrain the whole value, or write an intended partial match in full (`"/^pk_.*$/"`). A pattern with the `m` flag counts as not anchored, and each alternative of a `|` must be anchored. Requirements are never changed, and they are not applied when a URL is built: `lib.routing.getRoute()`, its `toUrl()` and the `getUrl` template filter put parameter values into the path as given. Pick it up with a bundle restart. (#B360)
+### Changed
+* Route matching no longer evaluates every rule of a bundle for a request the warm route cache has not seen. Once per routing table, the engine indexes which rules could match a URL: segment count, static segments, parameters (a `:` anywhere in a segment, so inline parameters included), each variant of a comma-separated URL, and each rule's raw `url`. The declaration-order scan then skips every other rule, so the first matching rule still wins and every per-rule check (scope, method, requirements) runs as before, and a request no rule can match gets its 404 without a scan. Measured on the routing step alone, over a 380-rule table: matching a late rule went from about 440 µs to about 14 µs, and a 404 from about 510 µs to about 12 µs. Some requests and rules are still scanned in full: the root path, a path with a trailing or doubled slash, a path holding `?` (the express engine keeps the query in the path), and a rule declaring two or more `requirements` that are not bound to a whole `:key` segment of its `url`. A rule the index skips no longer runs its requirement checks for that request. A `validator::` requirement on such a rule is no longer evaluated, so a malformed one no longer answers 500 for other URLs, and a `validator::{ query: ... }` no longer sends its backend request. On a 404 or a 405, `req.params` also no longer carries values that a skipped rule used to capture. Pickup: bundle restart, no re-bake (#P46)
+* The warm route cache, the per-process record of which rule matched each `METHOD:path` pair (up to 5,000 of them), is now one `Map`. A lookup and an eviction cost the same at any size: with the cache full, a lookup went from 18-74 µs to about 1.5 µs, and an insert that evicts the oldest entry from 26-80 µs to about 1 µs (two runs on a loaded host). The rules are unchanged: the first write to a key wins, the oldest key is evicted first, and a hit does not move an entry. A cache entry now keeps only the rule's name and object. It used to also keep the route parameters and the data of the request that first matched it (for a POST, its body, a login form's included) for as long as the entry lived, which is the life of the process unless 5,000 other paths pushed it out. The unused radix trie is removed: `lib/routing/src/radix.js` and the routing library's internal `buildTrie()` and `lookupTrie()`, which no running code called (the route candidate index replaces them). Pickup: bundle restart, and a re-bake to carry the rebuilt browser bundle (#P46)
+* Over HTTP/2, `self.query()` no longer adds `status: 200` to an upstream JSON body that carries no `status`, and no longer logs `Response status code is undefined: switching to 200` on every such call. The caller receives the body as the upstream sent it, as it always did over HTTP/1.1, and so does the end client of a `control: "forward"` route, which relayed the added key. Success is decided as before: a body without `status` is a success on both transports, and a body that carries one, numeric or not, is delivered unchanged. A JSON string body such as `"[]"` is now a success over HTTP/2 too; the added key threw on it and the call answered 500. Code that read `status` on such a result now reads `undefined` and should treat an absent `status` as success, as the framework does; code that deleted the added key no longer needs to. Pickup: bundle restart, no re-bake (#P47)
+### Fixed
+* `gina project:rename @<old> @<new>` refused every free name as already taken and renamed only onto a project that was already registered, and that rename damaged the port records: another project whose name began with the old one had its `ports.reverse.json` entries renamed too, and the renamed project kept its old name in `ports.json` beside stray entries. It now renames to a free name, refuses a registered name or an existing directory with exit `1` before anything moves, and renames port entries only where the project name matches exactly. (#B651)
+* `gina env:add <env> @<project>` registered the environment on the project but never gave its bundles ports for it or wrote their `env.json` blocks, so the new environment could not start; it also printed nothing, and it hung wherever the CLI was started by its own path. It now gives every bundle of the project its own ports for the environment, writes the `env.json` blocks, prints `environment [ <env> ] created` and exits; a failure rolls its changes back. (#B643)
+* A failed file copy through the path helper (`_().cp()`, `PathObject.mv()`, which CLI copy, build and rename paths use) could leave its temporary `*.tmp` file beside the destination: the temporary file was removed only if it existed when the failure was reported, and its creation could finish just after. It is now removed once its stream has closed, before the callback runs. (#B649)
+* On Bun, a failed file copy through the path helper reported an Error with no `stack`, so callers that print `err.stack` printed `undefined`. The error now always carries a stack, and keeps its code and message. (#B654)
+* Six more commands never ended the process after doing their work, so they hung wherever the CLI was started by its own path (as CI and scripts run it): `gina port:reset` with no registered project, `env:unset`, `env:set` with no key, `port:list --format=json` (with or without `--filename`) and `--format=conf` without `--filename`, `connector:list` without `@<project>`, and a cancelled `protocol:set` prompt. They now exit; the listings exit only once their output has been written. (#B653)
+* `gina project:add` and `project:import` read `--path`, `--scope` and `--env` whole. A value holding `=` was cut at its second `=`: on a fresh registry a `--path` holding `=` failed with `ENOENT`, `project:import` refused such a path as one that "no longer exists", and `--scope=a=b` or `--env=a=b` registered `a` instead of refusing the name. A `--path` value containing `--scope=` or `--env=` is no longer read as that flag, and a failed removal of the project's `node_modules/gina` link now reports its own error instead of a `ReferenceError`. `--scope` and `--env` register a missing scope or environment; they do not change the project's defaults, which `scope:use` and `env:use` set, as the CLI reference now says. (#B644)
+* The `connectors.json` a new bundle is scaffolded with showed the Couchbase keep-alive interval as `ping`, a key the connector ignores. Its example now names `pingInterval`, the key the connector reads (default `2m`, used while `keepAlive` is on, as it is by default). (#D51)
+* A first `npm install -g gina` no longer fails when your home directory, or the npm prefix, has a space in its path. The install scripts ran `chown` on `~/.gina` (a no-op, now removed) and created and sourced `~/.profile` through command lines with the path unquoted, and aborted; the sourcing never reached your shell either, so it is removed and a new shell reads the profile. The install's npm probes and `framework:set` calls also reach such paths whole now, where before they failed without a word. `gina port:reset` reads the project's bundles itself instead of running `gina bundle:list` through a shell, so it no longer crashes when `gina` is not on your `PATH` or sits under a path with a space, and it no longer consults whichever `gina` comes first on `PATH`. `gina bundle:restart` runs `bundle:stop` and `bundle:start` without a shell, so it works from an install under a path with a space and passes each flag through unchanged. (#B663)
+* On the Express engine, a URL carrying a query string never matched a route or a static file, on Express 4 and 5 alike: `GET /items?page=2` answered 404 while `GET /items` answered 200, and a static requested with a cache-buster (`/css/app.css?v=3`) was not found. The engine kept the query string in `request.url`, so the path handed to route matching, to the statics handler and to the requirement matcher still carried `?…` on its last segment; the built-in isaac engine strips it before dispatch. The Express path now does the same, after the framework's own `/_gina/*` handlers (which read a `?key=` off the full URL) and before the webroot filter, the statics and the routing loop, with the engine's query materialised on `request.query` first. `request.originalUrl` keeps the full URL. A consequence to know: the warm route cache is keyed by method and path, so on Express the query variants of one path now share one entry exactly as on isaac — the match verdict is re-evaluated on every hit. Pickup: bundle restart (#B668)
+* A `405 Method Not Allowed` now carries the `Allow` header that RFC 9110 requires, listing the methods of the routes whose URL matched, with `HEAD` wherever `GET` is listed; a wrong method on a URL whose routes each declare a single method still answers 404, as documented. A `HEAD` request is now served by every route that serves `GET`: it used to answer 404 on a parameterised URL (a `GET` route on `/items/:id`) and 405 on a route declaring several methods (`"GET,POST"`), and only a single-method `GET` route on a static URL served it. On the isaac engine the `access-control-allow-methods` header of a `HEAD` response now reads `HEAD` rather than `GET`, as it already did on the Express engine. Pickup: bundle restart (#B659, #B667)
+* A `HEAD` request served by a route that serves `GET` now gives the action the same `req.get` a `GET` would, so a `GET` action that reads `req.get` no longer answers 500 on `HEAD`. gina runs the `GET` action for a `HEAD`, so that the response carries the headers a `GET` would, but it kept the request's URL and query parameters only in `req.head` and left `req.get` undefined, and an action reading `req.get.<param>` threw. `req.get` is now the same object as `req.head`; `req.head`, `req.getParam()` and `req.getParams()` are unchanged, and `req.method` stays `HEAD`, so the response still has no body. Affected: 0.3.0 to 0.6.33, on routes with a static URL (a `HEAD` on a parameterised or multi-method route answered 404 or 405 there). Pickup: bundle restart (#B675)
+* The first gina commands after moving to a new minor version (for example 0.6 → 0.7) no longer fail. On that first run, gina copies each per-version default it keeps in `~/.gina/main.json` (culture, timezone, log level, protocols, scopes and the rest) from the previous minor version to the new one. The copy ran only while the new version was not yet registered in that file, and `gina bundle:start`, `bundle:restart`, `project:start` and `project:restart` register it before the copy runs, as does every `gina-container` boot. When one of those came first, the copy never ran and every later gina command exited 1 with `Cannot read properties of undefined (reading 'split')` until the file was repaired by hand. The copy now fills whatever the new version is missing, whether or not the version is registered, and keeps any entry already there. Separately, even when the copy ran, the first command exited 1 once with `(reading 'indexOf')`, because the later steps of that same command still read the file as it was before the copy; they now read the updated file. Exposed: installs that skip npm's install scripts (Bun, `gina-container` images, a git checkout); an npm install ran the copy first. CLI only: nothing to restart. (#B680, #B681)
+* With `settings.swig.autoescape: true`, a Swig page now keeps its CSS and JavaScript. Gina injects the bundle's stylesheet and script tags into the layout through the `{{ page.view.stylesheets }}` and `{{ page.view.scripts }}` placeholders, and auto-escaping rendered every injected `<link>` and `<script>` tag as visible text, so the page lost all its styles and scripts. The placeholders are now injected with `| safe`, and a layout that already holds either one, bare or with `| safe`, is not given a second copy. With autoescape on, the `nl2br` filter also escapes the text it receives and keeps its line breaks as markup; before, the `<br/>` it added showed as text. With autoescape off (the default until 0.8.0) rendered output is unchanged. A layout that places `{{ page.view.stylesheets }}` or `{{ page.view.scripts }}` itself writes `| safe` when autoescape is on, as with Nunjucks. Pick it up with a bundle restart. (#B690, #B359)
+### Security
+* On the Express engine with Express 5, one request could stop the bundle: a DELETE, or a POST, PUT or PATCH sent without a body, on any URL, before routing and with no authentication. The Express 5 support added in 0.6.9 shadowed Express's `req.query` getter with a plain writable property so the framework's own assignments would work, but that left `request.query` undefined until the GET and HEAD branches assigned it; the DELETE branch and the empty-body fallback of the body-carrying branches counted it as it was, and the resulting TypeError inside the request's end handler took the uncaught-exception path and exited the process. The property is now an accessor: on the first read it materialises Express's own parse — honouring the app's `query parser` setting at read time — as a plain, writable object of the request (a plain copy, because the default `simple` parser returns a null-prototype object that the framework's `count()` helper cannot iterate), and assignments still store. Express 4, where the query middleware assigns the property on every request, and the default isaac engine were never affected. No layer is registered and no router is created at engine construction, so an `app.set(...)` made in `onInitialize` keeps its effect. Affected: `>= 0.6.9 <= 0.6.33` with `engine: "express"` and Express 5 installed. Pickup: bundle restart (#B666)
+* A plain `GET` no longer runs an action whose route is declared `"method": "DELETE"`. So that the popin and link plugins could send their anchors as a `GET`, the router served any `GET` to such a URL as a `DELETE`, for any client. A cross-site navigation carrying the visitor's session cookie could therefore run a `DELETE` action: on the Express engine even with the Csrf plugin adopted as documented, because the plugin runs before routing and treats a `GET` as safe (the default isaac engine refused it), and on either engine when the plugin is not used, since the Session plugin's default `SameSite=Lax` cookie is sent on a top-level cross-site navigation. The override is now granted only to an XHR (`X-Requested-With: XMLHttpRequest`) that is not a browser cross-origin request: a `Sec-Fetch-Site` of `same-origin` or `none` passes, `same-site` and `cross-site` are refused, and an `Origin` that differs from the host is refused. Any other `GET` answers 404 on a URL whose only route is `DELETE`, and 405 on a route whose method list includes `DELETE`. The override now sets the request method to `DELETE`; on a route declaring several methods it used to hand the action the whole list (`req.method === "POST,DELETE"`). Client code that sends a `GET` to a DELETE-only route from outside the bundle's own pages, or without the header, must send a real `DELETE`. Affected: every version up to 0.6.33, on both engines. Pickup: bundle restart (#B662, #B660)
+* A controller's `self.throwError()` no longer sends a stack trace passed as the message to clients outside the local scope. A call such as `self.throwError(res, 500, err.stack)` or `self.throwError(500, err.stack)`, or an error object whose `message`, `error` or `title` holds a stack, put the file paths and frames in the JSON body and on the built-in HTML error page in every scope, because only the `stack` field was stripped. Outside the local scope such a value now keeps its first line in the JSON body, on the fallback page and in the data a custom error page receives, and the full text goes to the server log line that carries the incident ref. On the HTML path that line now logs the error's own text rather than the `throwError` call site, and a `self.throwError(res, code, { ... })` call now writes one at all (it logged no line for its ref before). Local scope is unchanged. The engine-level error responder has done the same since 0.5.21. Affected: every version up to 0.6.33. Pickup: bundle restart (#B670)
+* The browser bundle ships no dynamic-code call any more. A custom form validator (`forms/validators/<name>/main.js`) is compiled by the browser as an inline script carrying the page's own CSP nonce instead of through eval: same scope contract (`this.getValidationContext()`), same name in DevTools, one compile per validator per page, and no 'unsafe-eval' needed. The two unreachable calls the bundled RequireJS (`require.exec`, the transpiler-plugin path) and engine.io-client (its global-object shim) carried are rewritten at build time by exact match, so a dependency bump that moves them fails the build instead of shipping them. On the server, where custom validators are not wired, a function registered on the gina context is attached as it is. Supply-chain scanners flagged the eval on some published versions and not others, which swung the package score between two values on identical bytes (#M21d)
+* The start command that `gina tail --follow` re-runs when a bundle crashes is now saved under the framework home (`<GINA_HOMEDIR>/run/<bundle>@<project>.argv`, `~/.gina/run/` by default, written with mode 0600) instead of the system tmp directory, and on POSIX systems it is re-run only when that file is a regular file owned by the current user that group and other cannot write; any other file is refused with a warning. Where the tmp directory is shared between local users (`/tmp` on Linux by default), another user could create the file first: the owner's own `gina bundle:start` then failed to overwrite it, and the next crash restart ran that user's program under the owner's account. Affected: every version up to 0.6.33. Pickup: restart `gina tail`, then start each bundle once so its file is written in the new place; until then a crashed bundle is not restarted automatically (#B676)
+* The framework log listener (the MQ listener on port 8125, loopback by default) no longer stops the framework daemon when a connecting client sends a log frame whose `request` field names an inherited object member (such as `__proto__` or `constructor`) or the listener object's own `name` field: such a value reached an array method on a non-array, or a call on a non-function, and threw out of the socket handler, ending the daemon process that also serves the command socket on 8124. The listener now accepts only a short identifier as a request name and dispatches only to its own methods, refusing any other frame with a warning and keeping the connection and the process. The listener binds loopback by default, so this was reachable only by a process on the same host. Affected: every version up to 0.6.33. Pickup: framework restart (#B678)
+* On the default (isaac) engine, a request carrying a very long `X-Forwarded-Prefix` header no longer ties up the bundle: the mount-path length and character-set check now runs before the trailing-slash trim, so an over-length value is discarded before any regular expression sees it. The trim used a pattern that backtracks quadratically on a long run of slashes, and it ran on the raw header on every request, so one request with a 15 KB header cost roughly 100 to 170 ms of CPU (about 8 seconds at the 64 KB an HTTP/2 header list admits) — enough for a few such requests a second to saturate a single-threaded bundle. A legitimate mount path (at most 255 characters) is unaffected; anything longer is ignored as before. Affected: every version from 0.3.10 to 0.6.33 on the isaac engine. Pickup: bundle restart (#B679)
+
 ## 0.6.33 - 2026-09-25
 ### Added
 * `server.query.http2SessionPool` (settings.json; an integer from 1 to 50, default 1): how many HTTP/2 client sessions `self.query()` keeps per upstream authority. The default keeps one multiplexed session per `hostname:port`, as before. A pool of N opens N sessions, filled round-robin call by call, so a per-connection (L4) balancer — a Kubernetes Service with no HTTP-aware ingress — spreads the calls over N upstream connections instead of pinning every call to the one pod behind the first connection. Any other value refuses the boot; the value is resolved once at engine start, so a change needs a bundle restart. Pickup: bundle restart, no re-bake (#P43)

package/CONVENTIONS.md

@@ -587,7 +587,7 @@ Two flag names are reserved by the framework's global CLI parser and must **not*
 | Implicit globals injected by `gna.js` | Everywhere | Not statically analysable | #M8 |
 | `typeof(x)` with parentheses | Everywhere | Style inconsistency | — |
 | `"use strict"` absent from ~60% of files | Everywhere | Sloppy mode bugs | #M9 |
-| `eval()` in install script | `script/pre_install.js:222` | Low-risk but code smell | — |
+| `eval()` in release scripts | `script/prepare_version.js`, `script/post_publish.js` (not published to npm) | Low-risk but code smell | — |
 | Circular dep `utils/helper ↔ lib/logger` | `lib/index.js:32` | Import order fragility | — |
 | Commented-out code preserved in large blocks | `context.js`, `controller.render-json.js` | Dead code maintenance burden | — |
 | Incomplete `reps` dict in `getCoreEnv` | `lib/cmd/helper.js` | whisper silently leaves `${placeholder}` unresolved | — |

package/README.md

@@ -2,7 +2,7 @@
 
 [![npm version](https://img.shields.io/npm/v/gina)](https://www.npmjs.com/package/gina) [![npm downloads](https://img.shields.io/npm/dm/gina)](https://www.npmjs.com/package/gina) [![GitHub stars](https://img.shields.io/github/stars/gina-io/gina)](https://github.com/gina-io/gina/stargazers) [![Tests](https://github.com/gina-io/gina/actions/workflows/test.yml/badge.svg)](https://github.com/gina-io/gina/actions/workflows/test.yml) [![Socket](https://img.shields.io/badge/Socket-view%20analysis-blue)](https://socket.dev/npm/package/gina) [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D%2022-brightgreen)](https://nodejs.org) [![Bun >= 1.2](https://img.shields.io/badge/Bun-%3E%3D%201.2-brightgreen)](https://bun.sh) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
-> **Documentation:** [gina.io/docs](https://gina.io/docs/) · **Issues:** [GitHub](https://github.com/gina-io/gina/issues) · **Changelog:** [CHANGELOG.md](./CHANGELOG.md)
+> **Documentation:** [gina.io/docs](https://gina.io/docs/) · **Issues:** [GitHub](https://github.com/gina-io/gina/issues) · **Changelog:** [CHANGELOG.md](./CHANGELOG.md) · **Security:** [SECURITY.md](./SECURITY.md)
 
 MVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency.
 
@@ -18,7 +18,7 @@ MVC framework for Node.js and Bun with built-in HTTP/2, multi-bundle architectur
 | HTTP/2 server | Built-in `isaac` engine — TLS, h2c, ALPN, HTTP/1.1 fallback, 103 Early Hints, RFC 9218 request priorities, CVE-hardened |
 | Multi-bundle | One project, N independent bundles with shared config and project layer |
 | Scope isolation | `local` / `beta` / `production` — per-request and per-record |
-| MVC routing | `routing.json` — declare routes in config, not code; O(m) radix trie lookup |
+| MVC routing | `routing.json` — declare routes in config, not code; an index built once per routing table narrows each cold match to the rules the URL could reach, and a hot path is served from the route cache |
 | Async/await | Controller actions can be `async`; rejections routed to `throwError` automatically |
 | WebSockets | WS routes in `routing.json` (`"method": "ws"` + channel handlers, `:param` paths); WebSocket-over-HTTP/2 (RFC 8441) |
 | ORM / entities | EventEmitter-based entity system; SQL files auto-wired to entity methods |
@@ -67,86 +67,68 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.33
+## What's in 0.7.0
 
-> **Restart your bundles *and* rebuild them.** Eight of this release's commits
-> are browser-bundled — the request-parsing security fixes, the validator's
-> referenced-value and token fixes, the in-memory Collection and the routing
-> fix — so `gina.min.js` changed and `gina bundle:restart` alone leaves the old
+> **Restart your bundles *and* rebuild them.** Two changes are browser-bundled —
+> custom form validators now compile without `eval`, and the warm route cache is
+> one map — so `gina.min.js` changed and `gina bundle:restart` alone leaves the old
 > client running. Rebuild each consuming bundle, then restart.
 
-> **No settings reset.** `0.6.33` is a patch — the `shortVersion` stays `0.6`,
-> so your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
-
-> **Read before upgrading — some changes can stop a bundle or change an
-> answer.** A malformed `${secret:…}` reference now refuses the bundle (run
-> `gina secrets:check` first); a throw from `onInitialize` and a model that fails
-> to load on an asynchronous connector now abort the boot; a Couchbase `$scope`
-> outside `^[A-Za-z0-9_./-]+$` refuses the boot; `http2Options.maxStreamsPerSecond`
-> is no longer read (rename it `maxStreamResetsPerSecond`); `useRestApi` on a
-> Couchbase connector is ignored; `scope:add` and `env:add` refuse names they
-> used to drop silently; and on an `http/2.0` bundle an HTTP/1.1 client using a
-> method a route does not declare now gets 404 (405 on a multi-method route).
-> The [migration notes](https://gina.io/docs/migration) list every behaviour
-> change.
-
-**The request-parsing and inter-bundle release.** Nine security fixes lead it.
-One unauthenticated GET could stop a bundle process, an encoded `&` or `=` in a
-form field could add or override other fields, a parse failure wrote the raw
-body or query to the log, and a top-level `__proto__` field swapped the parsed
-request object's prototype. On an `http/2.0` bundle an HTTP/1.1 request skipped
-every route's method check, and a query key named like an inherited object
-member could reach another route. The Couchbase connector no longer writes
-values into statement text unvalidated and its plaintext REST transport is
-retired, and `project:add` no longer runs `--scope` / `--env` through a shell.
-The inter-bundle throughput arc makes `self.query()` hold up under sustained
-traffic: the framework's env template is parsed once per process instead of six
-times per request, the HTTP/2 rapid-reset guard counts client resets instead of
-new streams, client sessions no longer reset every stream, leak or storm
-pre-flight PINGs, a request refused before processing is retried for any method,
-HTTP/1.1 calls reuse their connections, and `server.query.http2SessionPool`
-spreads calls over several sessions. The `is` validation rule now compares
-referenced values exactly as typed, with one `$field` token grammar everywhere
-([gh#77](https://github.com/gina-io/gina/issues/77)). Full detail in
-[CHANGELOG.md](./CHANGELOG.md).
-
-- **Security — one GET request could stop the bundle (#B591).** A bracket-notation field name whose non-last segment is numeric while its container is not an array (`0[a]=1`) threw inside the nesting helper, and on the `inheritedData` query path nothing caught it: one unauthenticated `GET /any-url?inheritedData=0%5Ba%5D%3D1` exited the bundle process. A urlencoded body with the same name answered 500, and the validator's browser twin broke the submission. Such a segment now creates a plain object slot.
-- **Security — an encoded `&` or `=` in a form field can no longer add or override other fields (#B588).** A urlencoded POST, PUT or PATCH body was percent-decoded as a whole before it was split, so `bio=hi%26role%3Dadmin` arrived as a second `role` field. The body now follows the standard form algorithm — split on `&`, then at the first `=`, each name and value decoded exactly once — which also keeps a raw `=` inside a value and a typed `100%25` as typed.
-- **Security — a parse failure no longer writes the request body or query to the log (#B590).** The data helper's parse-failure lines printed the whole document at error level — a password or a token included, and in the browser console too — and the isaac query parser warned with the value. They now log the input's length, its first character and the error's name, never the value or the parse message.
-- **Security — a top-level field named `__proto__`, `constructor` or `prototype` is dropped (#B592).** Assigned flat, a JSON-valued `__proto__` pair swapped the prototype of the parsed request object, so `req.post.<key>` could read an attacker-chosen value that `Object.keys` and `hasOwnProperty` could not see. The process-wide pollution was already closed by #B446; this is the per-request object.
-- **Security — the Couchbase connector no longer writes caller or configuration values into statement text unvalidated (#B608).** A `$N` inside `SEARCH()` is now bound as a query parameter instead of being spliced in as an unescaped string literal; a `$N` used as a field-path segment must be a dotted identifier path or the query is refused (`GINA_COUCHBASE_INVALID_FIELD_PATH`); and the `$scope` / `_scope` value is resolved once at load and must match `^[A-Za-z0-9_./-]+$`, or the bundle refuses to boot.
-- **Security — the Couchbase connector's REST query transport is retired (#B634, #B623).** `useRestApi: true` sent every N1QL query over plain HTTP with the cluster credentials in an `Authorization: Basic` header — even on a `couchbases://` entry — and rewrote quotes and inserted parameters unescaped. The option is now ignored with one warning, and those queries go through the Couchbase SDK.
-- **Security — `project:add` no longer runs `--scope` / `--env` through a shell (#B640).** An unregistered name was registered through a shell command line with the value spliced in unquoted, so shell syntax in it ran as the user running `project:add` — an exposure for automation that builds those flags from data it does not control. Both values are now checked against the name rules before anything is written, and the child commands start from an argument vector.
-- **Security — on an `http/2.0` bundle, an HTTP/1.1 request is held to each route's method (#B645).** Such a bundle also answers HTTP/1.1 — a client that does not negotiate HTTP/2, or a reverse proxy such as nginx's `proxy_pass` — and the router read the method from the HTTP/2 `:method` pseudo-header, which an HTTP/1.1 request does not carry, so every method passed: a GET reached a POST-only action, and the wrong action could be left in the route cache for later HTTP/2 clients. A wrong method now gets 404 (405 on a multi-method route), and an HTTP/1.1 CORS preflight is answered 204.
-- **Security — a query key named like an inherited object member can no longer reach another route (#B650).** For a GET or DELETE on a route that declares `requirements`, a key such as `toString` or `valueOf` was found by a plain property read and counted as a requirement; each such key replaced a leading segment of the compared URL, so a request could reach a route whose path differs from its own — bypassing a path-based control applied outside the route, such as a reverse-proxy location rule. Only requirements a route declares itself count now. Every release since `0.1.0` was affected.
-- **Added — `server.query.http2SessionPool` (#P43).** How many HTTP/2 client sessions `self.query()` keeps per upstream (1 to 50, default 1, as before). A pool of N is filled round-robin, so a per-connection load balancer — a Kubernetes Service with no HTTP-aware ingress — spreads the calls over N connections instead of pinning them all to one pod.
-- **Changed — the HTTP/2 rapid-reset guard counts client resets; `maxStreamsPerSecond` becomes `maxStreamResetsPerSecond` (#B611).** The Isaac guard (CVE-2023-44487) counted new streams per session, so above 200 calls per second a sibling bundle's own multiplexed `self.query()` calls tripped it and every in-flight call failed with a 500. It now counts the streams a client cuts short. The old key is no longer read — a bundle still setting it gets one boot warning and the default — and `streamResetBurst` / `streamResetRate` pass through to the runtime's own reset limit. Not a vulnerability fix: the protection stays; it no longer fires on the framework's own traffic.
-- **Changed — `scope:add` checks the whole name; the `<bundle>/<scope>` form is retired (#B626).** A name is made of letters, digits, `_`, `.` and `-`, starts with a lowercase letter, a digit, `_` or `.`, and is not `.`, `..` or the name of an inherited object member such as `constructor`; a name that fails used to be dropped without a message and is now refused. The `<bundle>/<scope>` form never limited a scope to one bundle — it registered a scope literally named `<bundle>/<scope>` — and is refused with a pointer to the `scopes` allow-list in `manifest.json`. Registered scopes are unchanged.
-- **Changed — `env:add` checks the whole name; the `<bundle>/<env>` form is retired (#B639).** The same rules as `scope:add`, and `global` — which already names the overlay that applies to every environment — is refused as well. Registered environments are unchanged.
-- **Fixed — a throw from `onInitialize` aborts the boot loudly (#B576).** A synchronous throw, or the rejection of an `async` callback's promise, before `'complete'` now exits 1 with the reason on stderr. It used to leave a bundle listening on nothing: `bundle:start` waited out its timeout, and a `gina-container` process could exit 0.
-- **Fixed — a model that fails to load on an asynchronous connector aborts the boot (#B617).** A rejected entity file or a throwing entity constructor on DuckDB or Couchbase was logged as a rejection, retried as a connection failure, or swallowed — and a DuckDB bundle under `gina-container` exited 0. It now ends the boot with exit code 1, as a synchronous connector already did.
-- **Fixed — a malformed `${secret:…}` reference refuses the bundle at config load (#B583).** A key breaking `^[A-Z_][A-Z0-9_]*$` — lowercase, dotted, empty or padded — used to pass through, so the literal placeholder reached its consumer as a credential. It is now refused like a missing key; `gina secrets:check` names every offending entry, so run it before restarting on this release.
-- **Fixed — logging in with the Couchbase session store no longer fails when the pre-login session was never saved (#B577).** Rotating the session deleted an absent document and the store reported that as an error, failing `req.login()` and Passport 0.6 or later; deleting an absent session is now a success, as on every other session store gina ships.
-- **Fixed — a query value holding a percent-escape no longer empties the whole query (#B589).** A GET or HEAD value holding `%0A`, `%22`, `%5C` or `%25` was decoded twice, turning the serialized query document into invalid JSON — `req.get` came back empty — and `100%2525` became `100%`. The same path serves the browser validator and every route declaring a DTO, where a JSON body value holding `%22` could leave the action with no payload.
-- **Fixed — two data-helper type declarations match the runtime (#B588).** `nestBracketNotationKey` takes the bracket path as an array, and `formatDataFromString` returns `object | undefined`. Type-check only.
-- **Fixed — a referenced value is compared exactly as typed (#B600, #B601, #B602).** In an `is` condition such as `$password === $passwordConfirm`, a double quote, a backslash or a line break in a value stopped the validation pass (the browser form could not submit, the server threw); parentheses and the word `return` inside a value were ignored (`ab(cd` matched `ab)cd`); and a value with no ASCII letter or digit (`!!!`) never matched.
-- **Fixed — every `$field` token follows one grammar (#B603, #B604, #B606).** In an `is` condition, a route `validator::` requirement, a fluent `is()` call and a `query` rule's `data`: one pass, the longest field name wins, a token ends at the first character outside `A-Z a-z 0-9 _ -`, and a `$` naming no field stays literal — so `abc$email` is no longer substituted a second time, `($password) === ($passwordConfirm)` resolves, and `$passwordConfirm` in `query` data is no longer read as `$password` followed by `Confirm`.
-- **Fixed — the in-memory Collection compares strings with `==`, `>` and `<`, and a quote no longer breaks a query (#B609).** A row whose string value held a `"` threw and failed the whole `find()`; `==`, `>` and `<` were not recognised on strings; and a space after the operator skewed the comparison. Both operands are now encoded before they are compared; numeric and datetime comparisons are unchanged.
-- **Fixed — every request re-read the framework's env template from disk (#B610).** Six synchronous reads and parses per request in every bundle — measured at 27% of a trivial JSON route's CPU — are now one parse per process.
-- **Fixed — bundle-to-bundle HTTP/2 calls no longer die after about 1,000 calls, and a call cut by a GOAWAY is retried (#B612, #B613).** The client reset every completed stream, which the target's runtime counted against its reset limit until it closed the session with `GOAWAY(INTERNAL_ERROR)`. A safe-method call cut by a GOAWAY is now retried on a fresh session, and a session gone before the send is retried for any method.
-- **Fixed — the `/_gina/info` `rstCount` metric was always 0 (#B614).** It now counts the streams a client cuts short.
-- **Fixed — bundle-to-bundle HTTP/2 sessions no longer leak, and the pre-flight PING no longer storms (#B625, #B627).** Evictions are identity-checked, so a dead session's late event no longer evicts its live replacement (which leaked, keepalive ticking); a replaced or evicted session is closed gracefully; one pre-flight PING serves every waiting caller; and a cancelled PING no longer counts as a dead session.
-- **Fixed — the boot warmup (`server.warmup`) keeps its HTTP/2 sessions on Node.js (#B629).** Its PING went out while the session was still connecting and the cancel tore the session down; it is now sent once the session is connected.
-- **Fixed — a request refused before the upstream processed it is retried for any method (#B630, #B631).** `REFUSED_STREAM` and an asynchronous `ERR_HTTP2_GOAWAY_SESSION` are re-sent within the retry budget, so a POST no longer fails with a 503 when nothing was processed.
-- **Fixed — the Isaac server closes idle HTTP/2 sessions (#B619).** Its 120 s idle timer tested a property that does not exist and re-armed forever. An idle session now closes gracefully after `http2Options.sessionIdleTimeout` (default 120 s; `0` disables it). Node.js only.
-- **Fixed — bundle-to-bundle HTTP/1.1 calls reuse their connections (#P44).** Each call built its own connection pool and threw it away, so 500 calls opened 500 connections; calls to one upstream now share one keep-alive pool, and `maxSockets` (default 100) now limits the concurrent connections to one upstream.
-- **Fixed — an https bundle-to-bundle call no longer reads its CA file on every call (#B633).** The file is read once and read again only when it changes on disk, so a Kubernetes Secret update is still picked up by the next call.
-- **Fixed — a Couchbase reconnect keeps each connector's declared `scope` (#B624).** The model rebuild omitted it, switching the connector to `NODE_SCOPE` for the documents it stamps and the queries it filters.
-- **Fixed — `bulkInsert` escapes the bucket name (#B616).** A bucket such as `beer-sample` made the statement fail to parse; the name is now backtick-quoted.
-- **Fixed — `project:add` no longer loses a scope or environment it has just registered (#B647).** Its link step raced the `scope:add` / `env:add` children over the registry files; it now starts once the rest of the command has finished.
-- **Fixed — `scope:link-local`, `scope:link-production` and `env:link-dev` no longer crash without a registered project (#B641).** They print the missing or unknown project name and exit 1 instead of a stack trace.
-- **Fixed — the same three commands exit after a successful change (#B648).** Started by the CLI's own path (`node <gina>/bin/cli …`, as CI jobs and scripts run it), they wrote the change and then hung on the CLI's open log listener; the installed `gina` launcher was not affected.
-- **Fixed — the published package no longer carries end-to-end test artifacts (#B581).** Two Playwright `error-context.md` snapshots shipped in `0.6.32` and `0.6.33-alpha.1` — test fixtures only, no credentials and no local paths; `test-results/` and `playwright-report/` are now excluded from the tarball.
+> **A new minor version — check what carries over to `~/.gina/0.7`.** On an npm
+> install, the install writes `~/.gina/0.7/settings.json` from its template, so
+> `port`, `debug_port`, `mq_port`, `host_v4`, `bind_host`, `hostname`, `rundir`,
+> `logdir`, `tmpdir` and the log level start from their defaults: re-apply them
+> with `gina framework:set`. With Bun, a `gina-container` image or a git checkout,
+> those nine carry over from `~/.gina/0.6/settings.json` and only the log level
+> resets. Culture, timezone, default environment and scope carry over on every
+> path. A `^0.6.x` dependency range does not resolve `0.7.0` — widen it to
+> `^0.7.0`.
+
+> **Read before upgrading — some changes can change an answer.** A plain `GET`
+> no longer runs an action whose route is `DELETE`: the popin and link plugins'
+> same-origin XHR anchors keep working, but any other client must send a real
+> `DELETE`. `project:rename` refuses a registered name, `project:add` and
+> `project:import` read `--path`, `--scope` and `--env` whole, a `405` now
+> carries `Allow`, and a `HEAD` is served by every `GET` route. The scaffolded
+> Couchbase keep-alive key is `pingInterval`, not `ping` — check your
+> `connectors.json`. And plan for `0.8.0`: Swig's `autoescape` default becomes
+> `true`; a bundle that leaves it unset now says so at boot. The
+> [migration notes](https://gina.io/docs/migration) list every behaviour change.
+
+**The hardening and throughput release.** Seven security fixes lead it: a `GET`
+could run a route's `DELETE` action for another site; on Express 5 one body-less
+request could stop a bundle; a stack passed as an error message reached the
+client; `gina tail --follow` could re-run another local user's program; a long
+`X-Forwarded-Prefix` header could tie up an isaac bundle; a malformed frame could
+stop the framework daemon; and the browser bundle no longer carries any
+dynamic-code call. The inter-bundle throughput arc closes with a route candidate
+index and a one-map warm route cache, and `0.7.0` prepares Swig's move to escaped
+output by default in `0.8.0`. Full detail in [CHANGELOG.md](./CHANGELOG.md).
+
+- **Security — a `GET` no longer runs a `DELETE` action for another site (#B662).** So that the popin and link plugins could send their anchors as a `GET`, the router served any `GET` to a `DELETE` route as a `DELETE`, for any client: a cross-site navigation carrying the visitor's session cookie could run it — on the Express engine even with the Csrf plugin adopted, and on either engine without it, since the Session plugin's default `SameSite=Lax` cookie is sent on a top-level navigation. The override is now granted only to a same-origin XHR (`X-Requested-With: XMLHttpRequest`, `Sec-Fetch-Site` of `same-origin` or `none`, no foreign `Origin`); any other `GET` answers 404, or 405 on a route whose methods include `DELETE`.
+- **Security — on Express 5, one body-less request no longer stops the bundle (#B666).** A `DELETE`, or a `POST`, `PUT` or `PATCH` without a body, on any URL and with no authentication, found `request.query` undefined, and the resulting TypeError exited the process. `request.query` is now an accessor that materialises Express's own parse on first read. Express 4 and the default isaac engine were never affected; `0.6.9` to `0.6.33` were.
+- **Security — a stack passed as an error message no longer reaches the client (#B670).** `self.throwError(res, 500, err.stack)`, or an error whose `message`, `error` or `title` holds a stack, put file paths and frames in the JSON body and on the built-in error page in every scope. Outside the local scope such a value now keeps only its first line in the response, and the full text goes to the server log line that carries the incident ref.
+- **Security — `gina tail --follow` no longer re-runs a start command from the shared tmp directory (#B676).** The command a crash restart re-runs is now saved as `~/.gina/run/<bundle>@<project>.argv` (mode 0600) and re-run only from a regular file owned by the current user that group and other cannot write; where `/tmp` is shared, another local user could create the old file first. Restart `gina tail`, then start each bundle once so its file is written in the new place.
+- **Security — a long `X-Forwarded-Prefix` header no longer ties up an isaac bundle (#B679).** The trailing-slash trim backtracked quadratically on a long run of slashes and ran before the 255-character cap, so one request with a 15 KB header cost about 100–170 ms of CPU. The cap now runs first. `0.3.10` to `0.6.33` were affected.
+- **Security — a malformed frame on the log listener no longer stops the framework daemon (#B678).** A frame on port 8125 whose `request` names an inherited object member, such as `__proto__`, threw out of the socket handler and ended the daemon, which also serves the command socket on 8124; the listener now dispatches only short identifiers to its own methods. It binds loopback by default, so only a local process could reach it. Pickup: a framework restart.
+- **Security — the browser bundle carries no dynamic-code call (#M21d).** A custom form validator is compiled by the browser as an inline script carrying the page's CSP nonce instead of through `eval` — the same `this.getValidationContext()` contract, and no `'unsafe-eval'` needed — and the two unreachable calls in the bundled RequireJS and engine.io-client are rewritten at build time. Nothing changes for a validator file that follows the reference.
+- **Added — a boot warning when Swig `autoescape` is not set; `true` becomes the default in `0.8.0` (#B359).** Rendered output does not change in `0.7.0`. Set `settings.swig.autoescape` explicitly to silence it: `false` keeps today's output; with `true`, mark HTML you trust with `| safe` — `{{ gina.csrfInput | safe }}` first, or every form POST fails CSRF. New bundles are scaffolded with `"autoescape": true`.
+- **Added — a boot warning for routing `requirements` regexes that are not anchored (#B360).** A requirement is tested as a partial match, so `"/[0-9]+/"` accepts `123abc`. Anchor each listed pattern (`"/^[0-9]+$/"`); nothing is rewritten for you, and requirements are not applied when a URL is built.
+- **Changed — routing tests only the routes whose URL could match (#P46).** A per-table candidate index skips the rules a request's URL cannot match — a late rule on a 380-rule table went from about 440 µs to about 14 µs — so a skipped rule's `validator::` requirement is no longer evaluated for that request.
+- **Changed — the warm route cache is one map and keeps only the matched rule (#P46).** A lookup and an eviction cost the same at any size, and an entry no longer keeps the first request's parameters and data — a login form's body included — for the life of the process.
+- **Changed — `self.query()` over HTTP/2 no longer adds `status: 200` (#P47).** An upstream JSON body without a `status` arrives as sent, as it always did over HTTP/1.1, with no warning per call; treat an absent `status` as success.
+- **Fixed — the first gina commands after a minor-version upgrade no longer fail (#B680, #B681).** When `bundle:start`, `bundle:restart`, `project:start`, `project:restart` or a `gina-container` boot ran first, every later command exited `1` (`reading 'split'`) until `main.json` was repaired by hand, and the first command after any minor upgrade failed once (`reading 'indexOf'`). Installs that skip npm's install scripts were exposed. CLI only.
+- **Fixed — with `autoescape: true`, Swig pages keep their CSS and JavaScript (#B690).** gina's injected `<link>` and `<script>` tags rendered as visible text; they are now injected with `| safe`, and `nl2br` keeps its line breaks. Output with escaping off is unchanged.
+- **Fixed — a `405` carries `Allow`, and a `HEAD` works on every `GET` route (#B659, #B667).** The `Allow` header lists the methods of the routes whose URL matched; a `HEAD` on a parameterised URL used to answer 404, and on a route declaring several methods 405.
+- **Fixed — a `HEAD` gives the action `req.get` (#B675).** A `GET` action reading `req.get.<param>` answered 500 on `HEAD`; `req.get` is now the same object as `req.head`.
+- **Fixed — on the Express engine, a URL carrying a query string resolves (#B668).** `GET /items?page=2` and a cache-busted static such as `/css/app.css?v=3` answered 404 on Express 4 and 5; the query is now stripped before routing and statics, as on isaac.
+- **Fixed — `env:add <env> @<project>` makes the environment ready to start (#B643).** It registered the environment but gave no bundle ports for it; it now allocates them, writes the `env.json` blocks, prints a confirmation and exits.
+- **Fixed — `project:add` and `project:import` read `--path`, `--scope` and `--env` whole (#B644).** A value holding `=` was cut at its second `=`.
+- **Fixed — `project:rename` renames to a free name and refuses a taken one (#B651).** It refused every free name, and renamed port records of any project whose name began with the old one.
+- **Fixed — six more commands exit after their work (#B653).** Started by the CLI's own path, as CI and scripts run it, `port:reset` with no project, `env:unset`, `env:set` with no key, `port:list --format=json|conf`, `connector:list` without a project and a cancelled `protocol:set` prompt never ended.
+- **Fixed — a path with a space no longer breaks the install, `port:reset` or `bundle:restart` (#B663).** The install scripts, `port:reset` and `bundle:restart` no longer run their commands through a shell, so a home directory or npm prefix with a space works, and `port:reset` no longer needs `gina` on your `PATH`.
+- **Fixed — a failed copy no longer leaves a temporary file behind, and reports a stack on Bun (#B649, #B654).**
+- **Fixed — the scaffolded Couchbase keep-alive interval is `pingInterval` (#D51).** The example named `ping`, a key the connector ignores — check your `connectors.json`.
 
 ## Documentation
 

package/ROADMAP.md

@@ -85,9 +85,10 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.31` ✅ | **Security**: the availability release — a request carrying a top-level field named `count` no longer terminates the bundle process (unauthenticated, one request, on any URL including one matching no route; every published version was affected), and a queued async job runs inside a detached copy of the request context that created it instead of whichever request's job freed the worker slot. **Added**: RFC 9218 request priorities — `req.priority` on both engines, propagation through `self.query()` / `self.forward()`, `self.setPriority()`, and urgency-ordered async jobs. **Fixed**: a Couchbase connector that cannot reach its cluster at boot reports the failure instead of hanging until the CLI kills the bundle; one bundle without a release `config/` no longer moves every other bundle's configuration root, and the config-directory refusals name the bundle; two dead external references refreshed. Restart your bundles **and rebuild them** — the `count` fix touches the validator's shared rule engine, which is browser-bundled. |
 | **Q4 2026** | `0.6.32` ✅ | **Security**: the form-answer release's four fixes — credentials no longer ride a redirect (the request's `password` / `secret` / `token`-class fields are dropped from what `self.redirect()` carries); the built-in error pages HTML-escape every value they render (a reflected XSS through `?error=` on any redirecting route, every released version); a request parameter named `error` can no longer force a 500 or leave the request unanswered; an HTTP/2 static file no longer carries another request's response headers. **Added**: htmx-style form answers — `data-gina-form-target` / `-swap` / `-select`, out-of-band `data-gina-swap-oob` elements, and the `X-Gina-Retarget` / `-Reswap` / `-Reselect` response headers (same-origin only); the `GINA_MAINTENANCE` boot variable and replica-coherent maintenance mode through a shared kv namespace, with `pid` and `hostname` on the status payload; per-bundle login session lifetimes from `security.json` on top of the new `lib.duration.parse()`; a contributor `commit-msg` hook. **Changed**: popin context by containment rather than by the active popin; two form answers replacing one region no longer race (the newer submit supersedes); a navigated fragment's forms bind only when they opt in. **Fixed**: the gh#76 routing defect and its popin family (declared callbacks on the popin branch, the pre-open loading state, the modeless guard, the false 422 outside dev, table-row answers, reload blanking, malformed dialog targets, staged uploads placed by containment); the validator binds only opted-in forms; a date field no longer submits the previous day east of UTC; an XHR redirect and an ordinary render over HTTP/2 run the session middleware's hooks; an HTML static on a template-less bundle; an environment config overlay now overrides its base; two connectors sharing an entity class name; a glob path in a docblock-bearing JSON config no longer hangs the boot; `throwError()` with a falsy payload; the storage metadata store's callback isolation. 35 fragments; restart **and rebuild** — 17 commits touch the browser bundle. |
 | **Q4 2026** | `0.6.33` ✅ | **Security**: nine fixes — one unauthenticated GET could stop a bundle process (a bracket field name with a numeric segment); an encoded `&` or `=` in a urlencoded body could add or override other fields; a parse failure wrote the raw body or query to the log; a top-level `__proto__` field swapped the parsed request object's prototype; on an `http/2.0` bundle an HTTP/1.1 request skipped every route's method check; a query key named like an inherited object member could reach another route; the Couchbase connector binds `SEARCH()` terms and validates field paths and the scope instead of splicing them into statement text, and its plaintext REST query transport is retired; `project:add` no longer runs `--scope` / `--env` through a shell. **Added**: `server.query.http2SessionPool`. **Changed**: the HTTP/2 rapid-reset guard counts client resets (`maxStreamResetsPerSecond`); `scope:add` and `env:add` check the whole name and retire the `<bundle>/<name>` forms. **Fixed**: the inter-bundle throughput arc (the env template parsed once per process; HTTP/2 client sessions no longer reset every stream, leak, storm pre-flight PINGs or lose their warmup sessions; a request refused before processing is retried for any method; the server closes idle sessions; HTTP/1.1 calls reuse their connections; the CA file is read once); the `is` rule compares referenced values as typed, with one `$field` token grammar (gh#77); a throw from `onInitialize` and an asynchronous model-load failure abort the boot; a malformed `${secret:…}` reference refuses the bundle; the Couchbase session store's login rotation, a reconnect's scope and `bulkInsert`'s bucket name; a percent-escape no longer empties a query; the in-memory Collection's string operators; the `rstCount` metric; `project:add`'s scope and environment race and the link-slot commands' crash and hang; two type declarations; the tarball's test artifacts. 42 fragments; restart **and rebuild** — 8 commits touch the browser bundle. |
-| **Q1 2027** | `0.6.x` | HTTP/2 priorities ✅ shipped early in `0.6.31` (the `Priority` header half — read, propagated, emitted, job urgency; response ordering stays blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
-| **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`; the per-request configuration view — `getConfig()` without the deep clone — landed for the next `0.6.x` cut) |
-| **2027** | `0.8.0` | ⚠️ **Delivered early — this content shipped in `0.6.25` (2026-09-03)**: XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys. No committed content remains against this milestone; re-scope before planning around it. |
+| **Q1 2027** | `0.6.x` | HTTP/2 priorities ✅ shipped early in `0.6.31` (the `Priority` header half — read, propagated, emitted, job urgency; response ordering stays blocked on Node scheduler hooks) · the `0.6` line closed at `0.6.33`: the Beemaster admin + visual translation editor moved to `0.7.x` |
+| **Q4 2026** | `0.7.0` ✅ | **Performance**: the inter-bundle throughput arc closes — a candidate index narrows the cold route match to the rules whose URL could match, the warm route cache becomes one constant-time map, an HTTP/2 `self.query()` answer without a `status` field no longer gets `status: 200` added nor a warning logged per call, and the arc's exit benchmark is published (its first five slices shipped in `0.6.33`). **Security**: seven fixes — a `GET` could run a route's `DELETE` action for any client, including from another site; on Express 5 one body-less request could stop the bundle; a stack passed as an error message reached the client; `gina tail --follow` re-ran a start command from the shared tmp directory; a long `X-Forwarded-Prefix` header could tie up an isaac bundle; a malformed frame on the loopback log listener stopped the framework daemon; and the browser bundle no longer carries any dynamic-code call, so custom validators compile without `eval`. **Added**: a boot warning for a Swig bundle that leaves `settings.swig.autoescape` unset (the default becomes `true` in `0.8.0`), and one for routing `requirements` regexes that are not anchored. **Fixed**: the first gina commands after a minor-version upgrade; a `405` lists the allowed methods, and a `HEAD` works on every `GET` route and gives the action `req.get`; on Express, a URL carrying a query string resolves; with `autoescape: true`, Swig pages keep their CSS and JavaScript; `env:add <env> @<project>`, `project:rename`, the values of `project:add`'s flags, six CLI commands that did not exit, and a path with a space in the install, `port:reset` and `bundle:restart`; the path helper's failed copies; the scaffolded Couchbase `pingInterval`. **ISO 27001 supplier evidence**: a published OpenSSF Scorecard and the controller-side error-message sanitizer. **New minor version**: settings move to `~/.gina/0.7/` — an npm install resets the networking and directory settings and the log level to their defaults, while Bun, a `gina-container` image or a git checkout carries them over and resets only the log level; culture, timezone, default environment and scope carry over on every path — and a `^0.6.x` dependency range does not resolve `0.7.0`. 25 fragments; restart **and rebuild** — the browser bundle changed. |
+| **2027** | `0.7.x` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`; the per-request configuration view — `getConfig()` without the deep clone — shipped in `0.6.30`) · ISO 27001 supplier evidence — an SBOM attached to every release, once releases are cut by the CI release workflow · Beemaster admin + visual translation editor (moved from `0.6.x`) |
+| **2027** | `0.8.0` | **Swig output auto-escaping on by default** — `settings.swig.autoescape` becomes `true` when a bundle leaves it unset (prepared in `0.7.0`: a boot warning, the scaffold, the asset-tag fix). ⚠️ The financial-messaging content first planned here was **delivered early in `0.6.25` (2026-09-03)**: XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys. |
 | **2027** | `0.9.0` | Financial-integration heavyweights — entity-layer datastore transaction seam · message-queue connector family (AMQP / Kafka / IBM MQ) |
 | **Q3 2027** | `1.0.0` | First stable release — Windows alpha compatibility is a hard gate |
 
@@ -147,7 +148,7 @@ Stub commands confirmed in source — handler files exist but are empty or comme
 | ✅ | **`protocol:remove`** — Revert a bundle to the project's default protocol/scheme by removing its `settings.json` override (no shared `ports*.json` mutation), with `--dry-run` / `--force`. | `0.4.1-alpha.2` | 2026-05-31 |
 | ✅ | **`minion:list`** — List the running bundle child-processes ("minions") of a project, or of every project, grouped by project. `--format=json` supported. | `0.4.1-alpha.2` | 2026-05-31 |
 | ✅ | **`minion:kill`** — Reap a project's running bundle child-processes ("minions") — both pidfile-tracked and `ps`-discovered orphans — with a graceful SIGTERM/SIGKILL escalation and a `--dry-run` preview. | `0.4.1-alpha.2` | 2026-05-31 |
-| 📋 | **`gina --status` / `-t`** — Top-level health check: print whether the framework daemon is running, its version, and active bundle count. Requires adding `--status`/`-t` entries to `aliases.json` and implementing `framework/status.js`. | `0.6.x` | Q4 2026 |
+| 📋 | **`gina --status` / `-t`** — Top-level health check: print whether the framework daemon is running, its version, and active bundle count. Requires adding `--status`/`-t` entries to `aliases.json` and implementing `framework/status.js`. | `0.7.x` | Q4 2026 |
 | ✅ | **`bundle:copy` / `bundle:cp`** — Duplicate a bundle (source files + config) under a new name within the same project, with a word-boundary name rewrite, a fresh full protocol/scheme/env port matrix, and `--dry-run` / `--force`. | `0.4.1-alpha.2` | 2026-05-31 |
 | ✅ | **`project:status`** — Show the running/stopped state of each bundle in a project with PID and port info. | `0.4.1-alpha.2` | 2026-05-30 |
 
@@ -210,7 +211,7 @@ Stub commands confirmed in source — handler files exist but are empty or comme
 | ✅ | **Explicit exports for global helpers** — `getContext`, `setContext`, `_`, `requireJSON` etc. available as explicit `require('gina/gna').getContext` imports alongside the existing global injection. Enables IDE navigation and static analysis. | `0.3.3-alpha.3` | 2026-04-09 |
 | ✅ | **TypeScript declaration files** — `.d.ts` declarations for the public surface: `SuperController`, `EntitySuper`, connector config shapes, `routing.json` schema, `PathObject`, `uuid`, all config file interfaces, `GinaRequest`/`GinaResponse`. No TS migration of internals — just declarations for consumer projects. `package.json` wired with `"types"` and `"typesVersions"`. | `0.3.3-alpha.3` | 2026-04-09 |
 | ✅ | **Auto-generated `types/gna.d.ts` from JSDoc** (#M9) — `script/generate_gna_types.js` reads the `GLOBAL_EXPORTS` inventory from the gna-exports unit test plus the JSDoc on `framework/v*/core/gna.js` and emits `types/gna.d.ts` with one entry per global export. Two npm scripts: `npm run types:gen` regenerates, `npm run types:check` exits non-zero if drifted. A `gna-types-drift.test.js` unit test re-runs the generator in memory on every test pass — the JSDoc on `core/gna.js` is the single source of truth. Closes the #M8 → #M9 loop and removes the hand-written declaration. | `0.3.7-alpha.2` | 2026-04-18 |
-| 📋 | **`gina connector:audit [@project]`** — reads `connectors.json`, maps each declared connector to its npm peer package (`mysql2`, `pg`, `ioredis`, `couchbase`, `openai`, `@anthropic-ai/sdk`, etc.), and runs `npm audit --json` scoped to those packages in the project's `node_modules`. Reports CVEs with severity and fix availability. If `socket` is installed in the project, delegates to it for supply-chain analysis (malware, typosquatting, protestware) instead of `npm audit`. Exit code 1 on any high/critical finding — CI-friendly. Only audits packages actually declared in `connectors.json`, not the full dependency tree. | `0.6.x` | Q4 2026 |
+| 📋 | **`gina connector:audit [@project]`** — reads `connectors.json`, maps each declared connector to its npm peer package (`mysql2`, `pg`, `ioredis`, `couchbase`, `openai`, `@anthropic-ai/sdk`, etc.), and runs `npm audit --json` scoped to those packages in the project's `node_modules`. Reports CVEs with severity and fix availability. If `socket` is installed in the project, delegates to it for supply-chain analysis (malware, typosquatting, protestware) instead of `npm audit`. Exit code 1 on any high/critical finding — CI-friendly. Only audits packages actually declared in `connectors.json`, not the full dependency tree. | `0.7.x` | Q4 2026 |
 
 ### Phase 5 — Future
 
@@ -283,13 +284,14 @@ HTTP security response headers as opt-in `gina.plugins.*` middlewares, mirroring
 
 ## OWASP Top 10 Response
 
-Direct response to an OWASP Top 10:2025 review of the framework (September 2026): close the weak areas at the framework layer rather than leaving them as consumer homework. Three items shipped together in `0.6.23`; the remaining review findings stay tracked as candidates and get rows here only if promoted.
+Direct response to an OWASP Top 10:2025 review of the framework (September 2026): close the weak areas at the framework layer rather than leaving them as consumer homework. Three items shipped together in `0.6.23`; the remaining review findings stay tracked as candidates and get rows here only if promoted. The Swig auto-escaping default (A05) came from a separate report and is tracked here as the same class of fix.
 
 | Status | Feature | Version | Target |
 | --- | --- | --- | --- |
 | ✅ | **Framework-side security headers + `X-Powered-By` off by default (A02)** — Security headers are now emitted by the framework itself, on both engines, via `settings.json > server.securityHeaders` — closing the gap that made the `#HDR` plugins unreachable for most projects: they are Express middleware, and the default `isaac` engine never runs the Express middleware chain for HTTP responses, so mounting the `SecurityHeaders()` orchestrator emitted nothing there. Seven headers on by default — `x-content-type-options`, `x-download-options`, `x-permitted-cross-domain-policies`, `x-xss-protection`, `referrer-policy`, `x-dns-prefetch-control`, `origin-agent-cluster` — chosen because none can break a working application. Four opt-in behind one key each, each with a named breakage: `xFrameOptions` (cross-origin embedding), `coop` (severs `window.opener` — OAuth/payment popups), `corp` (cross-origin asset loading, incl. gina's own deliberately cross-origin `/_gina/*` endpoints), `hsts` (a 180-day HTTPS commitment). Precedence is first-writer-wins: a mounted plugin, an `env.json` header override or an upstream proxy always beats the framework default. `coop`/`corp` are never applied to `/_gina/*`. `server.hidePoweredBy` now defaults to `true` — a version banner is free reconnaissance and buys the operator nothing. `server.securityHeaders.enabled: false` restores the previous behaviour. | `0.6.23` | 2026-09-02 |
 | ✅ | **Request-body size cap + configurable server timeout (A10)** — `settings.json > server.maxBodySize` (default `64MB`, enforced: 413 + stream destroyed) bounds non-multipart request bodies, which previously accumulated with no ceiling at all. A companion `server.maxBodySizeWarn` (default `2MB`) only logs, so the real payload distribution can be measured before choosing a stricter ceiling. Raw wire bytes are counted, not decoded string length. Both accept B/KB/MB/GB (a bare number means MB); `0` disables either. Multipart uploads remain governed by the `upload.*` caps. `server.timeout` is exposed and stays `0` (unlimited) by default on purpose — a finite whole-request clock would kill Server-Sent Events and WebSocket connections, and the slow-body case is already closed by the body cap. | `0.6.23` | 2026-09-02 |
 | ✅ | **Opt-in Subresource Integrity for emitted asset tags (A08)** — `templates.json > "_common" > "sriEnabled": true` adds `integrity="sha384-..."` plus `crossorigin="anonymous"` to every same-origin `<script>` and `<link rel="stylesheet">` whose file resolves on disk, so a tampered or truncated asset is refused by the browser instead of executed. Fail-open by design: external URLs, unresolvable paths and unreadable files get no attribute — a wrong hash would hard-block the asset, so nothing is ever guessed. Hashes are stat-validated per render (mtime + size), so a rebuilt asset re-hashes with no restart; pages already stored by the render/output cache keep the hash they were rendered with (flush that cache after rebuilding assets). The HTTP/2 preload hint is suppressed for integrity-checked assets, since a hint carries no integrity metadata and a mismatched preload would be a wasted double fetch. sha384 is fixed deliberately: its padding-free base64 output keeps integrity values inert to the framework's own asset-catalog URL scan. | `0.6.23` | 2026-09-02 |
+| 📋 | **Swig output auto-escaping on by default (A05)** — `settings.swig.autoescape` becomes `true` when a bundle leaves it unset, matching Nunjucks, so `{{ x }}` is HTML-escaped unless marked `\| safe`. Prepared without any output change: a boot warning names the flip for every Swig bundle that leaves the key unset, `gina bundle:add` scaffolds `"autoescape": true`, and gina's own injected asset tags render correctly with escaping on. Before upgrading, set the key explicitly (`false` keeps today's output) or add `\| safe` where a template prints trusted HTML — `{{ gina.csrfInput \| safe }}` first, or every form POST fails CSRF. | `0.8.x` | 2027 |
 
 ---
 
@@ -316,7 +318,7 @@ Secrets handling for bundle JSON configs without baking plaintext values into so
 
 ## Security & Compliance Controls
 
-Technical-safeguard primitives that map to the **PCI-DSS**, **SOC2**, and **HIPAA** technical requirements. Gina supplies the controls; certification itself is an organizational, infrastructure, and process matter (a QSA assessment, a SOC2 auditor, HIPAA BAAs + a risk analysis) — a framework cannot be "certified." These are the building blocks an application deployed on Gina uses to satisfy the technical safeguards.
+Technical-safeguard primitives that map to the **PCI-DSS**, **SOC2**, **HIPAA** and **ISO/IEC 27001** (Annex A) technical requirements. Gina supplies the controls; certification itself is an organizational, infrastructure, and process matter (a QSA assessment, a SOC2 auditor, HIPAA BAAs + a risk analysis, an ISMS audit) — a framework cannot be "certified." These are the building blocks an application deployed on Gina uses to satisfy the technical safeguards.
 
 | Status | Feature | Version | Target |
 | --- | --- | --- | --- |
@@ -325,12 +327,15 @@ Technical-safeguard primitives that map to the **PCI-DSS**, **SOC2**, and **HIPA
 | ✅ | **Authentication hardening** — `lib.authn` supplies the primitives that are dangerous to hand-roll, without becoming an identity provider: Gina still owns no user record, credential store, or login route, and the module ends where `req.login()` begins. `hashPassword` mints scrypt hashes encoded as self-describing PHC strings, so the cost parameters travel with the hash and can be raised later without a flag day — `needsRehash` reports which stored hashes are below policy and the next successful login upgrades them transparently, the one moment the plaintext is in hand. `verifyPassword` compares in constant time and also verifies existing argon2 and bcrypt hashes through your own project's package, so a bundle arriving with credentials already hashed keeps working; `dummyVerify` spends matching work on the account-not-found branch to close the user-enumeration oracle; `validatePasswordPolicy` checks length first per NIST SP 800-63B, with composition rules and a deny-list available. `createLockout()` adds the credential-stuffing brake — PCI-DSS §8.3.4 defaults of 10 consecutive failures and a 30-minute lock, a caller-chosen key with optional normalisation, per-key serialization so failures arriving concurrently cannot lose the count, a pluggable shared store for multi-replica correctness, and one `auth.lockout` audit record on the transition into locked; it is per-account credential lockout, not per-client request-rate limiting, which remains a separate roadmap item. RFC 6238 TOTP completes the set: secret generation, the `otpauth://` enrolment URI every standard authenticator scans, and constant-time verification returning the matched step as an absolute `counter` so your application can enforce replay defence. Maps to PCI-DSS req 8 (8.3.2 authentication-factor storage, 8.3.4 lockout, 8.4 MFA), HIPAA §164.312(d). | `0.6.0` | shipped |
 | ✅ | **Session lifecycle hardening** — `req.login(user, done)` now works without Passport and rotates the session id BEFORE binding the user (the session-fixation defense): the pre-login record is destroyed, the principal lands at `req.session.user`, and the absolute-timeout anchor is stamped — with a graceful bind-and-warn when the session provider exposes no `regenerate()`, and Passport bundles untouched. The Session plugin gained an opt-in absolute session cap: `session({ absoluteTimeout: <ms> })` or `settings.json > session.absoluteTimeout` (bundle code wins, `false` disables) destroys an authenticated session older than the cap on its next request — regardless of activity — and the request proceeds anonymously, exactly like a naturally-expired record; fail-closed when the record cannot be destroyed, anonymous sessions never touched so `saveUninitialized: false` keeps its meaning. Composes with the existing idle expiry (cookie `maxAge` + store-record TTL, both rolling with activity). Declared in the published settings.json schema. Maps to PCI-DSS req 8.2. | `0.6.0` | shipped |
 | ⏸ | **PII/PHI protection** — Production log-field redaction, data classification, and retention helpers (today's redaction is a dev-only inspector tool). **Deferred — built on request.** *Interim:* keep credentials and identifiers out of query strings, since the always-on access log records full request URLs. Maps to HIPAA and SOC2 Privacy. | — | on demand |
-| ✅ | **Application-level rate limiting** — Opt-in identified-caller quotas at the router (#MS6): fixed-window counters over the key-value primitive (per-process in-memory, or replica-shared via redis/sqlite), keyed on the session user (operator-named field) or the machine caller, enforced after route authorization and before DTO validation (401 → 429 → 422). 429 carries `Retry-After` plus the draft `RateLimit` / `RateLimit-Policy` fields; per-route `rateLimit` overrides/exemptions in routing.json; store outages follow the namespace's `failMode` (open admits, closed answers 503). Anonymous flood control stays at the edge proxy and the HTTP/2 rapid-reset guard by design. Distinct from `lib.authn` account lockout, which brakes credential failures per account, not requests per client. Maps to PCI-DSS anti-automation and SOC2 availability. | `0.6.x` | 2026-08-22 |
+| ✅ | **Application-level rate limiting** — Opt-in identified-caller quotas at the router (#MS6): fixed-window counters over the key-value primitive (per-process in-memory, shared across one host's processes via sqlite, or across every replica via redis), keyed on the session user (operator-named field) or the machine caller, enforced after route authorization and before DTO validation (401 → 429 → 422). 429 carries `Retry-After` plus the draft `RateLimit` / `RateLimit-Policy` fields; per-route `rateLimit` overrides/exemptions in routing.json; store outages follow the namespace's `failMode` (open admits, closed answers 503). Anonymous flood control stays at the edge proxy and the HTTP/2 rapid-reset guard by design. Distinct from `lib.authn` account lockout, which brakes credential failures per account, not requests per client. Maps to PCI-DSS anti-automation and SOC2 availability. | `0.6.x` | 2026-08-22 |
 | ⏸ | **Data-at-rest / field-level encryption helpers** — Field-level encryption + key-management utilities. **Deferred — built on request.** *Interim:* encrypt at the application layer with your platform's KMS SDK; `${secret:KEY}` delivers the key material. Maps to PCI-DSS req 3 and HIPAA §164.312(a)(2)(iv). | — | on demand |
-| ✅ | **Compliance control-mapping guide** — [Compliance control mapping](https://gina.io/docs/guides/compliance) maps every control Gina ships to the PCI-DSS v4.0.1, SOC 2 (2017 TSC), and HIPAA §164.312 requirement it supports, and states plainly where a framework's responsibility ends. Controls still on the roadmap are listed separately as unavailable, each with the interim pattern to use until it ships, so a planned control can never be mistaken for one you have. An explicit "what Gina does not — and cannot — cover" section names what no framework provides: the certification itself, legal instruments, network and physical security, personnel and process, operations, key-management infrastructure, and vendor risk. A living reference — rows move from planned to available as controls ship. | `0.5.26-alpha.2` | shipped |
+| ✅ | **Compliance control-mapping guide** — [Compliance control mapping](https://gina.io/docs/guides/compliance) maps every control Gina ships to the PCI-DSS v4.0.1, SOC 2 (2017 TSC), HIPAA §164.312 and ISO/IEC 27001:2022 Annex A requirement it supports, and states plainly where a framework's responsibility ends. Controls still on the roadmap are listed separately as unavailable, each with the interim pattern to use until it ships, so a planned control can never be mistaken for one you have. An explicit "what Gina does not — and cannot — cover" section names what no framework provides: the certification itself, legal instruments, network and physical security, personnel and process, operations, key-management infrastructure, and vendor risk. A living reference — rows move from planned to available as controls ship. | `0.5.26-alpha.2` | shipped |
 | ✅ | **Transport-security posture** — A bundle resolving a cleartext scheme outside the local scope warns once at boot, naming the bundle, scheme, and scope alongside both remediations. `server.requireHttps: true` refuses the boot instead — the throw lands pre-listen, so the cleartext port is never reachable at all. `server.allowInsecure: true` is the "TLS terminates upstream" acknowledgment for the mesh / ingress / reverse-proxy topology, turning the warning into a single info line; declaring both is a boot-refused contradiction. Both are strict booleans resolved exactly like `scheme` itself — the bundle's settings win and `env.json`'s `server` block fills — and a non-boolean value refuses the boot in every scope. Terminating mTLS stays a mesh/ingress concern by design. Maps to the "encrypt everywhere / no implicit network trust" principle of NIST SP 800-207 (Zero Trust). | `0.5.26-alpha.2` | shipped |
 | ✅ | **Deny-by-default authorization mode** — `settings.json > auth.requireAuthByDefault: true` inverts a bundle's posture: a route declaring no authorization key is gated rather than open, and opts back out with `param.public: true`. The mode is keyed per bundle, so one bundle's posture can never un-gate a sibling's in a merged process. The existing `requireAuth` / `roles` / `policy` keys are unaffected — only the un-annotated route changes — and `public` is evaluated inside the un-annotated branch, so a route carrying it alongside an explicit gate key stays gated even in a hand-edited config. The boot refuses the three shapes the mode makes dangerous: `public` beside an explicit gate key, a login route the mode would gate (an infinite self-bounce), and a mode-gated route that also declares `cache` (the render cache is read before authorization and its key carries no identity). The five framework-injected routes ship exempt, so enabling the mode cannot take the site root or the error renderer offline. Complements the shipped Authorization / RBAC control. Maps to NIST SP 800-207 least-privilege / deny-by-default. | `0.5.26-alpha.2` | shipped |
 | ✅ | **Zero-Trust deployment guide** — [Running Gina zero-trust](https://gina.io/docs/guides/zero-trust) walks the NIST SP 800-207 tenets against the controls Gina actually ships: deny-by-default authorization, the transport-posture knobs, terminating mTLS at the mesh or ingress, network default-deny between services, keeping the framework control sockets on loopback, and shipping the built-in audit / metrics / request-correlation telemetry to a SOC. An honest-boundary companion to the compliance control-mapping guide — the framework supplies the enforcement point, identity, and telemetry; the deployment supplies transport identity and segmentation. | `0.5.26-alpha.2` | shipped |
+| 📋 | **ISO 27001 supplier evidence — a published Scorecard and an error-message sanitizer** — two of the artifacts a certified customer's supplier review (ISO/IEC 27001:2022 A.5.19–A.5.22, A.8.8) asks of Gina itself: a published OpenSSF Scorecard (its prerequisites — read-only default token permissions and SHA-pinned actions in every workflow, and CodeQL analysis — are in place since 2026-09-25) and a controller-side error-message sanitizer, so a stack trace passed as an error message never reaches the JSON wire outside the local scope (the server-side twin has sanitized since `0.5.21`). The evidence Gina already offers — private vulnerability reporting with published, CVSS-scored advisories; Dependabot, OSV and Socket scans; staged npm publishing approved with 2FA — is listed on the [compliance control mapping](https://gina.io/docs/guides/compliance) guide. | `0.7.x` | Q4 2026 |
+| ⏸ | **ISO 27001 Annex A — the deferred technological controls** — the ISO view of two rows above, not new work: data masking and PII protection (A.8.11, A.5.34) are the deferred **PII/PHI protection** row; encryption of data at rest (A.8.24) is the deferred **field-level encryption** row. Both stay built-on-request; their interim patterns are unchanged. Everything else Gina can supply under Annex A's technological theme is shipped, and the organizational, people and physical themes are never a framework's. | — | on demand |
+| 📋 | **ISO 27001 supplier evidence — an SBOM per release** — a software bill of materials attached to every GitHub Release, generated by the CI release workflow once releases are cut there; build provenance for npm releases rides the same workflow. GitHub already exports a bill of materials for the repository on demand; what is missing is the per-release artifact. | `0.7.x` | 2027 |
 
 ---
 
@@ -384,8 +389,8 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 
 | Status | Feature | Version | Target |
 | --- | --- | --- | --- |
-| ✅ | **Credential exposure in process list (`restQuery`)** — The `useRestApi: true` path built a shell command containing `-u username:password` passed to `exec()`. Plaintext credentials were visible in `ps aux` for the duration of the call. Fixed: replaced `exec()` with `execFile()` — credentials passed as positional arguments, never in the shell string. | `0.2.0` | 2026-03-27 |
-| ✅ | **Shell command injection in `restQuery`** — The same `exec()` path joined the N1QL statement and query parameters into a single shell string. Metacharacters (`$`, `;`, `&`, `|`, backtick) in parameters were not neutralised. Fixed: same change as above — `execFile()` eliminates the shell entirely. | `0.2.0` | 2026-03-27 |
+| ✅ | **Credential exposure in process list (`restQuery`)** — The `useRestApi: true` path built a shell command containing `-u username:password` passed to `exec()`. Plaintext credentials were visible in `ps aux` for the duration of the call. Fixed: replaced `exec()` with `http.request()` — credentials travel in an `Authorization` header, and no shell or child process is involved. | `0.2.0` | 2026-03-27 |
+| ✅ | **Shell command injection in `restQuery`** — The same `exec()` path joined the N1QL statement and query parameters into a single shell string. Metacharacters (`$`, `;`, `&`, `|`, backtick) in parameters were not neutralised. Fixed: same change as above — `http.request()` involves no shell at all. | `0.2.0` | 2026-03-27 |
 
 ### High — Bugs
 
@@ -481,7 +486,7 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | Status | Feature | Version | Target | Notes |
 | --- | --- | --- | --- | --- |
 | ✅ | **`NODE_COMPILE_CACHE` — V8 bytecode startup cache** | `0.2.0` | Q2 2026 | Node.js 22.8+ caches compiled V8 bytecode to disk. Set once at startup — 30–60% faster cold start on subsequent runs with zero code changes to user bundles. No-op on Node < 22.8, so safe to ship unconditionally. |
-| 🔄 | **Route radix trie — compile `routing.json` at startup** | `0.3.0-alpha.1` | 2026-04-01 | **Built, not wired (measured 2026-09-24):** the trie is built by a function the boot never calls, so every request still matches by a linear scan — it has not run in any release. Wiring it, with a runtime check, is the routing slice of the inter-bundle throughput arc below. Original note: `lib/routing/src/radix.js` builds a segment-level trie once at startup. O(m) candidate lookup per request (m = segment count). `Set.has()` check skips non-candidates in the `for…in` loop. Internal change — no user-facing API change. |
+| ⏸ | **Route radix trie — compile `routing.json` at startup** | `0.3.0-alpha.1` | 2026-04-01 | **Superseded and removed (2026-09-25).** The trie was built by a function the boot never called, so it never ran in any release. It was not wired: its lookup could drop or fail on routes the linear scan matches. The routing slice of the inter-bundle throughput arc below narrows the scan with a candidate index instead, and removes the trie (both for `0.7.0`). Original note: `lib/routing/src/radix.js` builds a segment-level trie once at startup. O(m) candidate lookup per request (m = segment count). `Set.has()` check skips non-candidates in the `for…in` loop. Internal change — no user-facing API change. |
 | ✅ | **Bun runtime support** | `0.5.5` | 2026-06-21 | Gina runs on the [Bun](https://bun.sh) runtime (Bun `>= 1.2`) as a supported, CI-gated target — `bun add -g gina` installs and boots end-to-end, validated by a blocking CI Bun smoke. Both investigated blockers cleared: dev-mode `require.cache` hot-reload and `node:http2` work under Bun (on Bun `< 1.4` one upstream gap remains: RFC 8441 extended-CONNECT advertisement, affecting only opt-in WebSocket-over-HTTP/2 — Bun 1.4 advertises it). Gina self-bootstraps on first run; Node `>= 22 < 27` remains fully supported. |
 | ✅ | **V8 pointer compression support** | `0.2.0` | Q2 2026 | Node.js built with `--experimental-enable-pointer-compression` (e.g. [node-caged](https://github.com/platformatic/node-caged) or a custom build) delivers ~50% heap memory reduction across all pointer-heavy structures. Gina is pure JS — compatible out of the box. Adds: startup detection + `GINA_V8_POINTER_COMPRESSED` env var, Dockerfile guide with custom build recipe (full-icu + pointer compression), 4 GB ceiling documentation, N-API-only connector policy. |
 | ✅ | **Runtime CPU profiling baseline** | `0.6.2` | 2026-07-31 | Shipped — a three-arm baseline (HTTP/2 render, concurrent multipart upload, WebSocket echo) profiled a production-built bundle under load. Outcome: the multipart-scan, WebSocket-unmask, and render/log-cleanup candidates below all measured small under their own arms and moved to measure-gated deferral, while the dominant cost found is per-request deep-clone traffic — half of render-arm CPU — plus per-item random-id minting (~1 ms per render), now planned as its own row below. "No further acceleration needed" was an accepted verdict shape, and for the byte-loop candidates it is the verdict. |
@@ -494,9 +499,9 @@ A cold audit of the Couchbase connector identified two critical security vulnera
 | ✅ | **HTTP/2 hop self-DoS — rapid-reset guard re-scoped to client resets; a call cut by a GOAWAY retried** | `0.6.33` | 2026-09-24 | **Arc slice 2, shipped.** The Isaac rapid-reset guard counted *new streams* per session per second, so a sibling bundle multiplexing its `self.query()` calls on one session was closed by its own target above 200 calls/s (17% of calls answered 500 at 50 concurrent callers with default settings). It now counts the streams a client cuts short before the response completed (`maxStreamResetsPerSecond`, default 200; `maxStreamsPerSecond` is no longer read — one boot warning), and the runtime's own reset limit stays the primary guard, exposed as `streamResetBurst`/`streamResetRate`. The HTTP/2 client no longer resets a completed stream — those frames tripped the target's runtime limit after ~1,000 calls (`GOAWAY(INTERNAL_ERROR)`, the audit's F4) — an in-flight safe-method call cut by a GOAWAY is retried on a fresh session, and a session gone before the send is retried for any method. The `/_gina/info` `rstCount` metric, always 0 until now, counts client resets. Restart, no re-bake. |
 | ✅ | **HTTP/2 client session lifecycle — identity-checked eviction, coalesced pre-flight PING, no eviction on a cancelled ping, graceful close of a session that loses its slot, per-authority pool size** | `0.6.33` | 2026-09-24 | **Arc slice 3, shipped.** Every eviction of a cached HTTP/2 client session is identity-checked and a session that loses its cache slot is closed gracefully, so a dead session's late events no longer orphan the live replacement (148 + 160 upstream connections were still open 186 s after a load run); one pre-flight PING per session serves every waiting caller, a response counts as proof of life and a cancelled PING is inconclusive (22 healthy sessions were evicted per 10 s at 50 concurrent callers); the boot warmup keeps its sessions on Node.js; a request refused before processing (`REFUSED_STREAM`, `ERR_HTTP2_GOAWAY_SESSION`) is retried for any method; and `server.query.http2SessionPool` (default 1, up to 50) spreads a caller over N connections behind a per-connection Kubernetes `Service` (measured 40 / 0 → 20 / 20 through a round-robin proxy). Beside it, the Isaac server now closes idle sessions after `http2Options.sessionIdleTimeout` (120 s; Node.js only — the old timer never closed anything). Scene at 50 concurrent callers: pre-flight evictions 66 → 0 per run, failed calls 60–97 → 0, connections to each upstream 34 → 67 and growing → exactly 1. Restart, no re-bake. |
 | ✅ | **HTTP/1.1 hop connection reuse — one keep-alive agent per upstream instead of one per call** | `0.6.33` | 2026-09-25 | **Arc slice 4, shipped.** Every `self.query()` over HTTP/1.1 opened a new TCP connection (500 calls → 500 connections), costing ~190 µs of callee CPU per call on loopback and a full network round-trip (plus TLS) per call between pods. Calls to the same upstream now share one keep-alive pool kept for the life of the bundle: 500 sequential calls use one connection, 50 concurrent callers settle at 10, and the benchmark's median latency fell from 46 to 14 ms. One pool per upstream, never one shared: a single shared pool sent every `bundle@project` call to the wrong host. `maxSockets` (default 100) now caps the connections to one upstream. Pickup: bundle restart. |
-| 📋 | **Server-side `GOAWAY(INTERNAL_ERROR)` on long-lived HTTP/2 sessions — diagnose and fix** | `0.6.x` | Q4 2026 | **Arc slice 5.** Observed on long-lived inter-bundle sessions under load (4 events → 24 failed calls) with nothing in the target's log; to be reproduced with HTTP/2 debug tracing and fixed. |
-| 📋 | **Routing — wire the radix trie and trim the warm path; measure against rule count** | `0.6.x` | Q4 2026 | **Arc slice 6.** The radix trie shipped in 0.3.0 is built by a function the boot never calls, so every cold match is still a linear scan and even a cached match re-runs the full comparison. Wire the trie with a runtime check, remove the per-request work a cache hit does not need, and measure cold and warm matching at 3 / 60 / 380 rules. |
-| 📋 | **Hop hygiene — per-call warning and `status` injection on the HTTP/2 hop, guide corrections, arc exit benchmark** | `0.6.x` | Q4 2026 | **Arc slice 7.** Every HTTP/2 answer without a `status` field logs a warning and gets `status: 200` injected into the caller's data; the multi-bundle guide describes the call as travelling over HTTP/2 when the scaffold default is HTTP/1.1. Closes with a re-run of the bundle-to-bundle benchmark on the shipped tree: zero failures at 50 concurrent callers with default settings, no connection growth after load, and a measured reduction of the hop's cost. |
+| ✅ | **Server-side `GOAWAY(INTERNAL_ERROR)` on long-lived HTTP/2 sessions — diagnose and fix** | `0.6.33` | 2026-09-25 | **Arc slice 5 — cause found in slice 2, fix re-checked.** After every completed response the calling bundle also sent a stream reset; the target's HTTP/2 library counts those against its reset rate limit and closed the session with `GOAWAY(INTERNAL_ERROR)` after about a thousand calls, without logging anything. The caller stopped sending them in `0.6.33`. Re-checked on the current tree: three runs of 20,000 calls (8 and 50 concurrent callers), each on one long-lived session — no GOAWAY, no failed call, no retry; the same scene with the reset put back closed the session four times in 5,000 calls. |
+| ✅ | **Routing — a candidate index for the cold match, a constant-time route cache; measured against rule count** | `0.7.0` | 2026-09-25 | **Arc slice 6 — landed (2026-09-25, for `0.7.0`).** Instead of wiring the 0.3.0 trie, a server-side index built once per routing table narrows a request the route cache has not seen to the routes whose URL could match; declaration order and every per-route check are unchanged, so the same route answers. Measured on the routing step, 380 routes: a late match 441 → 14 µs, a `404` 509 → 12 µs. The route cache is now one map: with it full, a lookup costs about 1.5 µs instead of 18–74 µs, and an entry keeps only the matched route — no longer the request's parameters and data. The unused trie is removed. |
+| ✅ | **Hop hygiene — per-call warning and `status` injection on the HTTP/2 hop, guide corrections, arc exit benchmark** | `0.7.0` | 2026-09-25 | **Arc slice 7 — landed (2026-09-25, for `0.7.0`).** An HTTP/2 `self.query()` answer without a `status` field no longer gets `status: 200` added or logs a warning, so both transports return the same result. The guides now say which protocol a bundle serves (HTTP/1.1 unless configured), what the HTTP/2 client retries, and when a route answers 405. The arc closed with the bundle-to-bundle benchmark re-run on the shipped tree, side by side with the arc's starting point: with default settings, no failed call at 50 concurrent callers (3,916 before, over three 10-second runs), one connection per HTTP/2 upstream and none left open after idle, and the hop's CPU cost per call down 52% over HTTP/1.1 and 58% over HTTP/2. |
 
 ---
 
@@ -567,7 +572,7 @@ Gina's built-in per-bundle inspector. Phases 1–2 ship as an embedded SPA at `/
 
 | Status | Feature | Version | Target |
 | --- | --- | --- | --- |
-| 📋 | **Official website redesign + docs integration** — Refactor gina.io as a proper project homepage (landing page, feature highlights, showcase) with the documentation fully integrated. Single coherent web presence. Prerequisite: tutorials complete. | `0.6.x` | Q4 2026 |
+| 📋 | **Official website redesign + docs integration** — Refactor gina.io as a proper project homepage (landing page, feature highlights, showcase) with the documentation fully integrated. Single coherent web presence. Prerequisite: tutorials complete. | `0.7.x` | Q4 2026 |
 | ✅ | **Docs offline ZIP** — One-click download of the complete gina.io documentation as a static HTML ZIP archive. Generated at deploy time by the Docusaurus build pipeline — no server-side logic required. Targeted at users in regions with limited or expensive internet access (offline-first for the African market). | `0.4.0` | 2026-05-22 |
 | ✅ | **Security & CVE compliance page** — Dedicated docs page listing the HTTP/2 CVEs addressed by Gina and the Node.js version required for each mitigation. Covers CVE-2023-44487 (Rapid Reset), CVE-2024-27316 / CVE-2024-27983 (CONTINUATION flood), CVE-2019-9514 (RST flood), HPACK bomb, and server push abuse. Docs only — no code changes. | `0.3.0-alpha.1` | 2026-04-01 |