gina 0.6.4 → 0.6.5

package/CHANGELOG.md

@@ -6,6 +6,35 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.5 - 2026-08-08
+### Changed
+* The not-ready submit-trigger state is now expressed with the framework-owned `data-gina-form-submit-gated="true"` attribute plus the existing `gina-form-submit-disabled` class, instead of `aria-disabled` (#B312): the trigger is genuinely operable — a click is answered with the validation reveal — so it no longer carries an ARIA claim its behaviour contradicts. `aria-disabled` now has exactly two writers, both honest: your own authored marks, which the click gates enforce and the framework never auto-clears (clear yours when you enable the control — previously a valid form stripped it for you), and the anchor in-flight lock for the request window. A default look ships for the gated state (`cursor: not-allowed` + a modest dim, single-attribute specificity, trivially overridden). If your CSS targeted `[aria-disabled="true"]` on submit triggers, key it on `.gina-form-submit-disabled` (written since 0.5.12) or the new attribute; automation note — a gated trigger no longer fails driver actionability checks, so plain clicks deliver.
+### Fixed
+* Fixed the `npm test` script, which pointed at a glob (`test*.test.js`) matching no files: it reported 0 tests and exited 0, a silent green that could pass for a healthy run. It now runs the full suite — the same set CI gates on — and package.json is the single source of truth for that file list, with the Tests workflow and CONTRIBUTING.md both deferring to it instead of carrying their own divergent copies. Also added `npm run test:coverage` (node:test built-in coverage) and a `pretest:e2e` step that installs the matching Chromium build, so `npm run test:e2e` works from a clean checkout instead of failing every scenario with a missing-browser error.
+* A `data-gina-link` anchor no longer swallows clicks the browser itself should handle. Four cases are now left alone. Three are properties of the anchor: one carrying `download` saves natively instead of being buffered in memory by the request layer, one carrying `target` opens its window or tab again, and one pointing at a bare `#` fragment moves within the page instead of issuing a request for the literal fragment text. The fourth is a property of the click — holding ctrl, cmd, shift or alt now opens the new tab or window the browser would normally open, instead of being turned into a background request that never opens anything. Previously all four were intercepted, so the click either did nothing visible or produced the wrong result. The anchor tests are made against the resolved target, so the documented placeholder form — an empty or `#` href paired with `data-gina-link-url` — keeps working, and the modifier test covers clicks landing on an element nested inside the anchor as well as on the anchor itself. Cross-origin links are unaffected and still go through the request layer.
+* A form's submit trigger no longer stops responding to clicks when your own code sets the native `disabled` attribute on it during the click — the shape used by the common double-submit guard, where a click handler disables the button to block a second submit. Since 0.6.4 the trigger's disabled check accepted that attribute, so the click was cancelled before anything was sent; because the page then cleared the attribute again, the button looked perfectly normal and every further click was swallowed just as silently. The native attribute is now honoured only on elements where the browser does not already enforce it (anchors, custom elements) — on a real form control the browser suppresses the click itself, so the check was never what protected you there. Forms gated by gina's own aria-disabled marker are unaffected and still cannot be submitted while invalid.
+* A form whose last rule is an async `query` — the uniqueness check a registration form typically carries — no longer stays marked invalid after that check comes back clean. The async completion path decided the form's validity from a single field's result, and its update step only ran when that field FAILED, so a form that had just become valid was never re-examined: the submit trigger kept its `aria-disabled` marker and `gina.validator.$forms[id].errors` kept listing the field. Until 0.6.4 that was invisible, because nothing read the marker; since the submit gate began reading it, the first click after the query settled was silently swallowed and only a second click got through. The verdict now comes from a fresh whole-form pass, the same one already used when the async field is not the last to validate, which also clears the stale error message. A form with another field still invalid stays correctly blocked.
+* A form's submit button keeps working after the page replaces its DOM node — the shape an AJAX update or a popin re-render produces when it swaps in fresh markup. Previously such a button went permanently and silently dead: clicking it produced no request, no navigation and no error, and the button looked entirely normal, while submitting the same form by pressing Enter or by calling submit() from your own code still worked. The cause was that the click handling is delegated to the form and so survived the swap, but the step that actually runs the submit was attached to the original button; the replacement inherited every attribute except that binding, and nothing re-established it. Gina now recognises a replaced trigger the first time it is clicked and re-binds it, so the swap is invisible to your code. Validation is unaffected — a replaced trigger on an invalid form still refuses to submit.
+* A popin or dialog trigger keeps working when your own click handler disables it — the near-universal double-submit guard that sets the disabled attribute on the control it just handled. Previously that guard ran first, inside the very click being handled, and gina then read the attribute and silently refused to open: no popin, no error, and because your handler clears the attribute again, a control that looked completely normal. Gina now trusts the native disabled attribute only on elements where the browser does not enforce it itself. On a real form control the browser already suppresses the click entirely, so the check protected nothing there and could only ever fire on a mid-click write; on a link or a custom element it is still honoured, so markup relying on <a disabled> is unchanged. The same fix covers the legacy popin dispatch path and in-popin close buttons, where a capture-phase guard could leave a popin stuck open. Gina's own behaviour of disabling a trigger while its popin loads is unaffected.
+* A popin holding more than one form now tears every form down when it closes. Previously the teardown walked its list of forms while removing entries from that same list, so it skipped every other one: those forms were never released, and their stale records were left pointing at markup the popin had already discarded. On the next open the validator handed back the stale record instead of binding the fresh markup, so the form — its submit control included — came up silently inert, with no error and nothing to see in the page. Only popins given a validator explicitly are affected; the ones gina wires up for you never reached this path. Teardown is also no longer all-or-nothing: if releasing one form fails it is reported and the remaining forms are still torn down, where before the first failure quietly abandoned every form after it.
+* A popin's close button now closes the popin whatever id you give it, and wherever inside it you click. Two shapes were silently inert before. Giving the button your own id — for styling, a test hook or an aria reference — stopped it working, because gina recognised its close buttons by an id it had assigned itself and yours replaced it. More commonly, putting an icon inside the button broke it too: a click landing on the inner icon rather than the button's own edge was not recognised, so the ordinary markup of a close affordance with an svg or a span inside it did nothing. Neither case reported an error, and because gina suppresses the button's default action either way, nothing at all happened on click. A close button that also acts as a trigger for another popin is unaffected and still behaves as before.
+* A link marked with data-gina-link no longer does nothing when you give it your own id. Previously gina kept the id you wrote but dispatched only the links whose id it had generated itself, so markup like <a id="my-link" data-gina-link>Open</a> registered normally and was then silently ignored on every click — and because gina had already suppressed the default action, the click did nothing at all: no request, no navigation, no error. Links left without an id were unaffected, as were links wrapping an element such as a span or an image, whose clicks reach the plugin by a different internal route — which is why this could sit unnoticed. The id you set is preserved rather than overwritten, so anything targeting it from CSS or your own scripts keeps working.
+* A popin trigger that gina has disabled while its popin loads can no longer be clicked a second time to start a second load. An anchor using the older data-gina-popin-name markup was marked aria-disabled for the duration of the load, but the code that dispatched its clicks tested only the plain disabled attribute, which an anchor never carries here — so a second click during a slow load issued a second request. In practice this reached triggers that opt out of preloading with data-gina-dialog-preload="false", which is the setting used for links whose request has side effects on the server, so the duplicate request could cost more than bandwidth. Clicks landing on an icon or other markup nested inside the trigger are covered too. Buttons and other real form controls were never affected, because the browser suppresses those clicks itself.
+* Fixed `gina.setOptions()`, which merged its options into an orphan object nothing ever read and was therefore silently ignored for every key since it shipped — the documented `loadingAttribute` rename (`gina.setOptions({ loadingAttribute: 'data-loading' })`) could not work. It now merges options into the exposed `gina.config` — the object every plugin and library reads — in place, with override semantics (a top-level scalar replaces, a top-level object merges one level deep, keys absent from the options are never removed). An identity guard keeps the framework boot's own call a no-op, so page-load behaviour is unchanged. Note that anything a project was already passing to `setOptions()` and silently having ignored will now take effect. The `data-gina-config` script-tag attribute, which was documented alongside the rename but is parsed by nothing, is no longer documented.
+* Fixed the client-side blob-download filename parse (both the shared XHR handler and the validator's copy): a `Content-Disposition` without a `filename` parameter no longer throws mid-download — the browser derives a name instead — and an RFC 6266 quoted-string filename is unquoted and unescaped rather than saved with its surrounding quotes; a trailing extended parameter is no longer folded into the name.
+* Fixed the `Content-Disposition` emission for downloads: both server emitters (`downloadFromURL`'s attachment upgrade and `downloadFromLocal`) now emit the filename as an RFC 6266 quoted-string with `"` and `\` escaped, so filenames containing spaces, `;` or `,` produce a conformant header instead of a bare token an intermediary may truncate or split.
+* Fixed the dev Inspector's footer source-mode badge, which never appeared when the Inspector ran as a standalone window opened from a `?target=` URL. That badge names where the window's data comes from (`bound`, `agent`, or a warn-tinted `global`), but it was only ever painted from the data-poll timer — which standalone mode deliberately never starts, since its data is pushed over the stream rather than polled — so the badge kept the hidden state it ships with and the window reported no mode at all. The same `agent` mode did show up when the window was reached through the "No source" connect form instead, which meant the badge's presence depended on how the Inspector had been opened rather than on the mode it was in — the opposite of what the badge exists for. Standalone windows now report their source mode on both entry paths and for both agent transports (WebSocket and the SSE fallback). Polling is still not started in that mode, deliberately: it would repaint the active tab on every tick and disturb scrolling, expanded nodes and text selection, and the refresh button does not need it.
+* Fixed popin triggers showing no busy state when their open adopts a still-in-flight hover/focus preload (the common path when warm-on-intent preloading is on): the trigger is now armed for the adopted wait exactly like a cold click-time load — aria-disabled on links, native disabled on other controls, plus the shared data-gina-loading marker — and released when the preload settles, success or failure alike. An instant open from an already-cached preload never flashes a busy state, and a second click during the wait is refused by the existing trigger gates.
+* Fixed the form submit proxy enforcing its disabled gate on a DOMParser copy of the form that only saw native `disabled` — a gated (`aria-disabled`) submit trigger still ran the full validation cycle and sent from trusted gestures (a wrapped-label click, or Enter on a form whose trigger is not a native submit button), while a native `disabled` written mid-dispatch by a double-submit guard could kill the submit outright. User gestures now hit the live registered trigger with the same predicate and answer as the click path (cancel + reveal errors + focus the first invalid field); programmatic `$forms[id].submit()` deliberately keeps the fresh-validate path.
+* Fixed the send-settle releases clobbering the live-check gate on `<a data-gina-form-submit>` triggers — the gate and the in-flight lock share `aria-disabled` with opposite lifecycles, and both releases removed the attribute unconditionally, so a form invalidated mid-flight (an edited-empty field plus an impatient second click, whose refusal re-derives validity) settled with the gate class present but the attribute gone: marked to the framework, operable to assistive tech and the trigger gates. The releases now replay the gate verdict stamped at its last evaluation; button triggers are untouched (their lock is native `disabled`), and the stray second arguments to two unary `removeAttribute` calls are gone in passing.
+* Fixed `data-gina-link` anchors having no disabled gate at all — an anchor marked `aria-disabled="true"` (or carrying the native attribute, which an anchor never enforces) still fired its XHR on click, from both the direct-click and the child-element dispatch paths. Both sites now refuse the click with the same trigger-disabled predicate the popin and validator gates use, while still suppressing the default navigation; programmatic `gina.link.request()` deliberately stays ungated.
+* A second click on an anchor submit trigger while its request was in flight ran the validation reveal, whose valid-form heal erased the in-flight lock's `aria-disabled` mid-request — announcing the control operable again while the send was still running, and re-running validation (including async `query` rules) per extra click (#B313). With the not-ready marker moved to its own channel, the lock owns `aria-disabled` exclusively and survives mid-flight clicks; the settle releases are plain unconditional removals again (the conditional verdict replay they carried is retired as no longer needed).
+* FormValidator's `trim` strips leading AND trailing whitespace when both are present: the replacement previously rewrote only the first match, so a both-sides-padded value kept its trailing run (#B245).
+* FormValidator's `isRequired` no longer rejects a leading-whitespace-padded non-empty value: emptiness now means undefined, null, the empty string, or whitespace-only. The documented `isRequired` + `trim` pairing therefore cleans a stray leading space off the stored value instead of recording "Cannot be left empty" against a value the same pass had just trimmed (#B245).
+* The SQLite and DuckDB connector JSDoc and the connectors.json schema no longer describe the default database-file location as version-segmented (~/.gina/{version}/{database}.sqlite or .duckdb): the framework resolves the gina home without a version segment, so the documented default now matches the real path — ~/.gina/{database}.sqlite and ~/.gina/{database}.duckdb (#B317).
+* A gina process no longer hangs for the OS connect timeout (~75 seconds on macOS) when the configured MQ log host is unreachable — a powered-off peer, a firewalled segment, or a stale `host_v4` left behind by a DHCP reassignment. The speaker's socket was already unref'd, but an unref'd socket only releases the event loop once the dial settles: a connect that is still PENDING is a live request that holds the process open on its own, so `require()`ing framework code stalled for the full window wherever the host answered nothing at all (a REFUSED connection was always fine — the peer's reset closes the handle). The dial now carries its own unref'd deadline and gives up after a bounded wait, flowing through the same error path as a refused connection: the logging transport can be degraded, never load-bearing (#B318).
+* Fixed a refused submit hiding its own error message (#B319): both refused-submit answers — the disabled/gated-trigger reveal and an enabled trigger's failed validation — render the first invalid field's message and then focus that field, and that focus re-entered the live-check suppression that hides a message while its field is being edited, leaving the answer readable only by a screen reader the instant it appeared. The framework's own answer focus is now exempt (one-shot): the message stays visible with the hard `form-item-error` styling, and the first later keystroke re-engages the mid-typing suppression unchanged. Pre-existing in 0.6.4.
+
 ## 0.6.4 - 2026-08-05
 ### Added
 * Submit-like triggers now carry a framework-owned loading state. Clicking a `<button type="submit">`, an `<input type="submit">` or an `<a data-gina-form-submit>` sets `data-gina-loading="true"` on that trigger, and the attribute flips to `"false"` as soon as the action completes or is interrupted — settled, errored, timed out, aborted, rate-limited, or rejected by validation. That last case is the one that stranded loading state on forever (#B247): a submit refused before it starts sends no request at all, so nothing in the XHR lifecycle could ever release it, and only the framework knows the submit was refused. Enter-key and programmatic submits arm the form's registered trigger, and a click on a wrapped label such as `<button type="submit"><span>Save</span></button>` arms the button rather than the span. A project already built on `data-loading` renames the attribute with `gina.setOptions({ loadingAttribute: 'data-loading' })`; there is no auto-detection, so nothing changes for anyone who does not opt in. Style the running state with `[data-gina-loading="true"]` and never with a bare `[data-gina-loading]` — the attribute stays present when released, carrying `"false"`, so a presence selector would pin the loading style on permanently.

package/CONTRIBUTING.md

@@ -90,13 +90,33 @@ cd "$(npm config get prefix)/bin" && ln -s ../lib/node_modules/gina/bin/gina* .
 The test suite uses Node's built-in `node:test` runner — no additional test dependencies needed.
 
 ```bash
-# Run all tests
-node --test test/**/*.test.js framework/v*/test/unit/*.test.js
+# Run all tests — the same set CI gates on
+npm test
+
+# Run all tests with a coverage report
+npm run test:coverage
 
 # Run a single file
 node --test test/core/controller.test.js
+
+# Pass extra node:test flags — via the env var, NOT `npm test -- --flag`
+GINA_TEST_FLAGS=--test-concurrency=2 npm test
 ```
 
+`npm test` is the single source of truth for which files make up the suite:
+CI runs exactly this script, so a green local run and a green CI run cover the
+same set.
+
+**Extra runner flags must go through `GINA_TEST_FLAGS`.** `node --test` stops
+parsing options at the first positional argument, so a flag placed after the
+file list is neither honoured nor rejected — it is silently ignored and the run
+still exits 0. That makes `npm test -- --test-concurrency=2` a no-op that looks
+like it worked. The `test` script interpolates `$GINA_TEST_FLAGS` *before* the
+file list, which is why `npm run test:coverage` is defined as
+`GINA_TEST_FLAGS=--experimental-test-coverage npm test`. Measured over 199
+files: `--test-concurrency=1` before the list takes 47s, after the list 15s,
+and with no flag at all 17s.
+
 Some tests resolve the framework the way a consuming project does — via
 `require('gina')`. For that to resolve from inside the clone, the repository
 must be reachable as its own `gina` module. Create a one-time self-symlink (it
@@ -221,7 +241,7 @@ Pick the kind (`Added`, `Changed`, `Fixed`, `Removed`, `Security`) and write the
 
 Before opening a PR against `develop`:
 
-- [ ] Tests pass — `node --test test/**/*.test.js framework/v*/test/unit/*.test.js`
+- [ ] Tests pass — `npm test`
 - [ ] New behaviour is covered by a test (or an explanation is provided for why it cannot be)
 - [ ] A `changie new` entry exists for any user-facing change
 - [ ] Commit messages follow the style above

package/README.md

@@ -60,45 +60,47 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.4
+## What's in 0.6.5
 
 > **Re-bake your bundles, not just restart them.** The browser bundle changed in
-> this release. The new loading state, the form and staged-upload accessibility
-> work, and the link-transport fix ship *only* in the bundle, so a restart alone
-> will not deliver them. Rebuild each bundle (`gina bundle:build`) as well as
-> restarting.
+> this release. Nearly every fix below lives in the bundle — the form validator,
+> the popin plugin and the link plugin — so a restart alone will not deliver
+> them. Rebuild each bundle (`gina bundle:build`) as well as restarting.
 
-> **No settings reset.** `0.6.4` is a patch — the `shortVersion` stays `0.6`, so
+> **No settings reset.** `0.6.5` is a patch — the `shortVersion` stays `0.6`, so
 > your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-> **One visual change arrives with no opt-in.** Gina now ships a default look for
-> the loading state it writes, so a submit trigger picks up a `progress` cursor
-> and a gentle opacity pulse while its request runs. Overriding takes one rule of
-> your own — the selector is a single attribute, so any class beats it — and the
-> pulse is already gated on `prefers-reduced-motion`.
-
-- **Added — a framework-owned loading state for busy controls.** Clicking a `<button type="submit">`, an `<input type="submit">`, an `<a data-gina-form-submit>`, a `data-gina-link` anchor or a popin trigger sets `data-gina-loading="true"` on that control, and the attribute flips to `"false"` as soon as the work completes or is interrupted — settled, errored, timed out, aborted, rate-limited, or rejected by validation. That last case is the one that stranded loading state on forever: a submit refused before it starts sends no request at all, so nothing in the XHR lifecycle could ever release it (#B247). One stylesheet now covers every busy control on a page whichever plugin started the work. Enter-key and programmatic submits arm the form's registered trigger; a click on a wrapped label such as `<button type="submit"><span>Save</span></button>` arms the button rather than the span; and the state lands on the anchor itself even when the click hits a nested element. A project already built on `data-loading` renames the attribute with `gina.setOptions({ loadingAttribute: 'data-loading' })`. **Style the running state with `[data-gina-loading="true"]` and never with a bare `[data-gina-loading]`** — the attribute stays present when released, carrying `"false"`, so a presence selector would pin the loading style on permanently. Two limits are deliberate and tracked: a link request that hangs never settles and so never releases, and a popin opened from a still-in-flight hover/focus preload does not yet arm its trigger (it cannot leave anything stuck — nothing is armed). Browser-bundled — **re-bake**.
-- **Added — a default look for that loading state, so the feature is visible without writing any CSS.** Deliberately minimal, with two omissions on purpose: no injected spinner, because one would stack with a spinner you already ship and would force a positioning change on a trigger gina does not own; and no `pointer-events: none`, because a link deliberately accepts a second click while its request runs and supersedes the first. Anyone who has asked for reduced motion gets a static dimmed state rather than no signal at all. `animation: none` drops just the motion, and renaming the attribute opts out of the default styling entirely, since it is keyed on the default name.
-- **Added — `gina.config.a11y` translates what gina says on its own behalf.** For example `gina.config.a11y = { submitting: 'Envoi…' }`. English defaults ship for anything a project does not translate, mirroring how `setErrorLabels` already handles built-in rule labels. These are distinct from rule error labels: `setErrorLabels` is keyed by rule name, while these describe what the framework itself is doing.
-- **Added — `${secret:KEY}` can resolve from `.env`-style files as well as the environment.** Declare `secrets.file` in the bundle `settings.json` — one path or an array — using the usual config tokens, e.g. `["${homedir}/secrets.env", "${homedir}/${scope}/secrets.env"]`. **Files are layered UNDER the environment**, which inverts the usual `.env` intuition on purpose: a non-empty environment variable always wins, so a Kubernetes secret, a `sops exec-env` invocation or a CI-exported value can never be shadowed by a stale file left on disk. A variable that is set but *empty* counts as absent and the file fills it — which keeps the common `environment: ["X=${X}"]` passthrough working — and that fall-through warns, naming the key. Within the array, later entries win, so a shared base file and a per-scope file combine. A declared file that does not exist contributes nothing rather than failing, resolution stays fail-closed when a key is in neither source, and a config that does not declare `secrets.file` behaves exactly as before. `lib.secrets` gains `parseEnv` / `parseEnvFile`, which `secrets:check --env-file` shares, so the CI gate and the runtime can never disagree about how a file is read. **This is a convenience for plaintext and pre-decrypted deployments, not a secrets-management integration:** for SOPS, Vault or a KMS, keep decrypting at the container entrypoint so values land in the environment.
-- **Security — secret files are ignored by glob, not by exact name.** The previous single `.env` entry matched only that exact name. Dot-prefixed variants such as `.env.production` were already covered by the pre-existing `.*` catch-all, but a secret file whose name does not begin with a dot — `secrets.env`, `db.env`, `production.env` — matched nothing and was committable and publishable by default. `.env`, `.env.*` and `*.env` are now all covered in both the repository ignore list and the published-package ignore list.
-- **Fixed — a submit trigger disabled by live validation is no longer operable.** A trigger marked disabled (`aria-disabled="true"` plus the `gina-form-submit-disabled` class) could still be clicked, and that click ran the entire submit cycle — field collection, validation, the submit latch and the send gate. The control was inert in appearance only, so one announced as disabled to assistive technology stayed fully operable. The click is now intercepted before the submit dispatch, and answered by a display-only validation pass that renders every invalid field and moves focus to the first, so the reason it is disabled stays discoverable; that pass also re-syncs the trigger, so a stale disabled marker on a form that has since become valid heals itself. The check reads the clicked element rather than the form's registered trigger, so forms carrying several submit buttons behave correctly. (#B246)
-- **Fixed — a form's first validation error is now reliably announced.** The polite live region was created, inserted and given its text in a single synchronous step, which reaches a screen reader as one change on an element it has never seen and is commonly not spoken at all — so the first error on any form, the one most likely to matter, was the one least likely to be heard, while every later announcement worked. The region is now stood up when the form is bound. A region that still has to be created at announcement time defers its first write by a tick, which matters because the region lives inside the form and a subtree replacement destroys it: a popin re-render or fragment swap otherwise reproduced the original problem silently. The region deliberately stays a child of the form rather than moving to document level — a popin renders its form inside a native dialog opened with `showModal()`, which leaves everything outside the top layer inert, so a document-level region would go unspoken for exactly those forms. Browser-bundled — **re-bake**.
-- **Fixed — submitting a form no longer loses the keyboard user's place.** Gina disables the submit trigger for the duration of the request, which makes the browser drop focus to the document body; focus is now returned to that trigger once the request settles, and only when nothing else claimed it meanwhile. The trigger also carries `aria-busy` while the request is in flight, and the form's polite live region announces the start once. Completion announces nothing, so an errored response still announces its field errors uninterrupted, and a submit rejected by validation announces nothing at all.
-- **Fixed — validation messages stay reachable while they are hidden from view.** Gina hides a committed error's message when its field regains focus, but kept `aria-invalid="true"` asserted — so the `aria-errormessage` association pointed at an element `display: none` had removed from the accessibility tree, announcing a field as invalid with no retrievable reason. Both hide paths now clip the message out of view instead of out of the tree, and the `.hidden` class is still applied so consumer CSS keyed on it keeps matching. Re-announcing the same error works now too (a polite region ignores a byte-identical rewrite), and moving focus to the first invalid field no longer stops on a control that cannot take focus — every element has a `focus` method, including a custom element whose `focus()` does nothing, so the search confirms focus actually moved and continues otherwise.
-- **Fixed — staged uploads are announced and operable.** A progress indicator that is not a native `<progress>` carries `role="progressbar"` with `aria-valuemin`/`aria-valuemax`/`aria-valuenow`; the value is **dropped rather than zeroed** while an upload is indeterminate or errored, so a screen reader reports an unknown state instead of stalled progress. A native `<progress>` is left untouched. Upload start and successful completion are announced through the polite live region gina already owns — per-tick progress deliberately is not, as one announcement per progress event would bury everything else on the page — and an upload error announces the server's own message there rather than only writing it into a container that is hidden when the text lands. The auto-generated reset control is now announced as a button, activates with Space as well as Enter, and names the file it acts on; focus moves to the file input before the control is removed. Preview images finally carry an `alt` taken from the user's own filename, where assistive technology previously read the temporary upload URI aloud once per staged file. The three new strings — `uploadStarted`, `uploadComplete` and `fileRemoved` (which takes a `%s` for the file name) — are overridable through `gina.config.a11y`. Browser-bundled — **re-bake**.
-- **Fixed — a superseded popin no longer stays reachable behind the one on screen.** Non-modal is the framework default for the `data-gina-dialog` API and opening a popin never closes the one it supersedes, so both stay in the page — but a non-modal `<dialog>` gets none of the background `inert` that native `showModal()` provides, and gina restores it by hand. That restoration skipped the shared popin container wholesale, and every popin lives inside it, so a superseded dialog kept its links, buttons and fields in the tab order: a keyboard or screen-reader user could tab straight out of the popin they were looking at and into a stale one. The container is now descended into and sibling open dialogs are inerted individually. Closed ones are deliberately left alone — a `<dialog>` without `open` is already `display: none` per the user-agent stylesheet. Teardown still restores everything it marked, including an `inert` a project set itself, which gina never claims.
-- **Fixed — built-in HTML error pages are conforming documents.** The fallback page served when a project has no custom error template emitted no doctype (so browsers rendered it in quirks mode), no head, no title and no `lang` — and on HTTP/1.1 it closed the body with an *opening* `<html>` tag, so the document never terminated. Both engine branches now ship a doctype, an `<html lang>`, a `<title>` and a `<main>` landmark. This is the default path: a scaffolded project ships no `templates/html/errors/` directory, so it is what an unhandled 500 actually serves. Separately, the `lang` value gina emits is normalised to BCP-47 wherever it appears — `en_CM` becomes `en-CM`, and an `accept-language` q-value such as `fr;q=0.9` reduces to `fr` — falling back to `en` rather than emitting a tag assistive technology cannot parse.
-- **Fixed — clicking a second `data-gina-link` no longer kills the first click's response.** The link plugin built one `XMLHttpRequest` at initialisation and reused it for every click, and re-opening a request that is still running aborts it — an aborted request arrives with status `0`, which the completion path has no branch for, so the first click ended in total silence: no success callback, no error callback, nothing. Each link request now gets its own transport and carries a sequence number, so a superseded response is discarded rather than acted upon and a slow first response can never overwrite a newer one. Two related gaps stay unchanged for now because both would alter what your handlers receive: a link request that fails at the network level is still silent, and one that hangs still has no deadline. Browser-bundled — **re-bake**.
-- **Fixed — `gina secrets:check` looks in the same two places a bundle would, in the same order.** It previously cross-referenced the environment only, so once a bundle declared `settings.secrets.file` the command reported `UNSET` — and exited non-zero — for a key that bundle would have started with perfectly well, turning a pre-deploy gate into a false alarm. It now resolves the declared file chain beneath the environment, reusing the runtime's own token substitution and the shared parser. An explicit `--env-file` still wins, because it stands in for the environment tier. The report gained a per-bundle chain listing marking each path `loaded` or `ABSENT`, and each key names the tier it was satisfied from, so a value coming from a plaintext file on the local disk is never mistaken for one the deployment will inject. `${projectVersion}`/`${projectVersionMajor}` are seeded from the project manifest and `${scope}` falls back to the project's default scope, so version- and scope-templated chains resolve; a path whose tokens still cannot be resolved is reported and skipped rather than opened blindly — which can only make the gate stricter than the runtime, never laxer. A bundle declaring no `secrets.file` reports exactly as before. (#B263, #B266)
-- **Fixed — a declared secrets file that exists but cannot be read now refuses the boot.** Wrong permissions or ownership, or a path that is actually a directory, were all mistaken for a layer that is simply absent — so a chain whose per-scope file lost read permission silently fell back to the shared base file and **the bundle booted healthily on the wrong credential**, with only a debug line, itself mislabelled `ABSENT`, to say so at a level suppressed by default. Boot now refuses and names the path and the error code, and `secrets:check` reports the same distinction. A genuinely missing file is unchanged: it contributes nothing and is not an error, so shipping a base file and adding the per-scope one only on some targets keeps working. (#B267)
-- **Fixed — an environment variable that is set but empty warns as it falls through to the file.** The fall-through itself is deliberate and unchanged — an empty value counts as absent, which is what keeps the `environment: ["X=${X}"]` passthrough working when the outer variable is unset. But the same shape appears when a container entrypoint runs `export X="$(fetch …)"` and the fetch *fails*, and there a file quietly supplying a stale value is exactly the shadowing that the environment-wins ordering exists to prevent. Since the two are indistinguishable from inside the process, the file tier now emits a warning naming the key — never the value — at a level that survives the default log hierarchy. (#B268)
-- **Fixed — a trailing `#` comment in a secrets file is no longer read as part of the secret.** `DB_PASSWORD=s3cret # rotated May` resolved to the literal `s3cret # rotated May`, and a quoted value followed by a comment kept its quote characters too. The parser now strips a trailing comment the way a POSIX shell does when sourcing the same file — which is what the documented container-entrypoint pattern (`set -a; . secrets.env; set +a`) already did, so the same file no longer means two different things depending on which route delivered it. Two cases deliberately keep their hash, because stripping them would corrupt a legitimate password: a `#` with no whitespace before it (`abc#def`), and any `#` inside quotes (`"abc # def"`) — which makes quoting a complete escape hatch. **One consequence to check before upgrading:** `KEY= # comment` is now an empty value rather than the string `# comment`, and an empty value counts as unset — so a key written that way fails closed at bundle start and `secrets:check` reports it `UNSET` instead of `SET`. That reversal is the point: the shell always delivered it empty, and the previous `SET` was a false green.
-- **Fixed — requiring gina outside a bundle context fails cleanly instead of hanging the process.** The bootstrap has always thrown when it cannot find the bundle context the CLI provides, but the logger — a load-time singleton — had already opened its MQ socket by then, and that socket kept the event loop alive: catching the error did not let the process exit, so a plain node process (a test runner, a one-off script, a codegen pass) stalled with no output wherever an MQ listener happened to be running. The speaker now unrefs its connection, so a logging transport can never be the reason a process stays alive. The error also names the boundary it hit and points at `SuperController.createTestInstance()` for exercising controller code without booting a bundle, instead of reporting an internal path-registry failure. (#B276, #B277)
-- **Fixed — a bundle starting in an environment its `env.json` does not declare reliably prints why.** The refusal was written with `console.error` and the boot then ended through a callback, so on a loaded or short-lived pipe — a container start, CI — the explanation could be truncated away and the operator was left with an exit code and no reason. The message is now flushed synchronously before the boot unwinds, matching the other boot-refusal sites in the same file. (#B278)
-- **Fixed — a gina command no longer dies when an MQ speaker disconnects abruptly.** Every CLI invocation starts the MQ listener on the shared log port, so commands running side by side connect to one another as speakers. When one ended or was killed, the listener still held its connection socket and the next write raised `EPIPE` or `ECONNRESET` on a socket that had no error listener — so Node threw the event and took the whole command down mid-run. The failure was silent and looked like the command had simply not done its work: a `bundle:add` killed this way exited non-zero after registering its ports but before writing the rest of its state, leaving a half-created bundle. Connection sockets now handle their own errors, dropping the departed speaker's session and carrying on. The listener-wide error handler was never a substitute — in Node every accepted connection is its own emitter, so it never saw these. (#B279)
-
-See the full [Changelog](./CHANGELOG.md) and [Roadmap](./ROADMAP.md).
+> **If you are on 0.6.4, upgrade.** `0.6.4` shipped a regression that could stop a
+> submit button responding to clicks entirely (#B293, first below). This release
+> fixes it, together with a family of long-standing defects that produced the same
+> signature — a control that looks completely normal and does nothing at all.
+
+**Four items may need action before you upgrade:** the submit-trigger marker
+vocabulary change, `gina.setOptions()` starting to take effect, the new disabled
+gate on links, and `isRequired` accepting padded input. Each is called out below
+and detailed in the [migration guide](https://gina.io/docs/migration).
+
+- **Changed — the not-ready submit-trigger marker is `data-gina-form-submit-gated`, not `aria-disabled`.** While live validation reports a form invalid, its submit control is marked with the framework-owned attribute plus the existing `gina-form-submit-disabled` class. It no longer carries `aria-disabled`, which announces a control as not operable while gina deliberately answers the click — revealing every invalid field and moving focus to the first. Announcing one thing and doing another was the contradiction; the behaviour is unchanged and the vocabulary now matches it. `aria-disabled` keeps exactly two writers, both honest: marks you author yourself, which the click gates now enforce and gina never auto-clears, and the anchor in-flight lock for the request window. A modest default look ships for the gated state (`cursor: not-allowed` plus a dim, single-attribute specificity, trivially overridden). **Action:** if your CSS targets `[aria-disabled="true"]` on submit triggers, key it on the new attribute or on the class. A gated trigger also no longer fails browser-driver actionability checks, so plain clicks deliver in tests. (#B312)
+- **Fixed — a double-submit guard no longer kills the submit.** Since `0.6.4`, a submit trigger stopped responding to clicks when your own handler set the native `disabled` attribute during the click — the shape the near-universal double-submit guard uses. The click was cancelled before anything was sent, and because your handler cleared the attribute again the button looked perfectly normal while every further click was swallowed. The native attribute is now honoured only where the browser does not already enforce it (anchors, custom elements); on a real form control the browser suppresses the click itself, so the check never protected you there. The same shape is fixed for popin and dialog triggers, the legacy popin dispatch path, and in-popin close buttons, where a capture-phase guard could leave a popin stuck open. (#B293, #B296)
+- **Fixed — a submit button keeps working after its DOM node is replaced.** The shape an AJAX update or a popin re-render produces when it swaps in fresh markup: the replacement went permanently and silently dead — no request, no navigation, no error — while Enter and `submit()` still worked. Click handling is delegated to the form and survived the swap, but the step that runs the submit was bound to the original node. Gina now recognises a replaced trigger on its first click and re-binds it. (#B294)
+- **Fixed — an async `query` rule no longer leaves a valid form blocked.** A form whose last rule is an async uniqueness check stayed marked invalid after the check came back clean, because the completion path decided validity from one field's result and only ran its update when that field failed. Invisible until `0.6.4`, when the submit gate began reading the marker — after which the first click following a settled query was silently swallowed. (#B295)
+- **Fixed — Enter and wrapped-label clicks respect the submit gate.** The submit proxy enforced its gate against a `DOMParser` copy of the form that could only see native `disabled`, so a gated trigger still ran the full cycle and **sent** from a click on markup nested inside the button, or from Enter on a form whose trigger is not a native submit button. Trusted gestures now hit the live registered trigger with the same answer as the click path. Programmatic `$forms[id].submit()` deliberately keeps the fresh-validate path. (#B308)
+- **Fixed — an anchor submit trigger's in-flight lock survives a second click.** On an `<a data-gina-form-submit>` the validity gate and the in-flight lock both wrote `aria-disabled` with opposite lifecycles and could erase each other, leaving a form marked to the framework but operable to assistive technology, or announcing a control operable while its request was still running. With the not-ready state on its own attribute, the lock owns `aria-disabled` exclusively. Button triggers were never affected. (#B309, #B313)
+- **Fixed — required fields accept padded input, and `trim` strips both sides.** `isRequired` treated any value *starting* with whitespace as empty, so `" john"` was rejected as *Cannot be left empty* — and when the rule set also declared `trim`, the same pass then trimmed the value after recording the error. Emptiness now means `undefined`, `null`, the empty string, or whitespace-only. `trim` also rewrote only the first whitespace run it found, so a value padded on both sides kept its trailing run. **Action:** if anything relied on leading whitespace being rejected, enforce it explicitly. (#B245)
+- **Fixed — a popin holding several forms tears all of them down.** The teardown walked its list of forms while removing entries from it, releasing only every other one; the skipped forms kept stale records pointing at discarded markup, so the next open handed back the stale record and the form came up silently inert. Only popins given a validator explicitly are affected. Teardown is also no longer all-or-nothing. (#B265)
+- **Fixed — a popin trigger shows its busy state when it adopts a preload.** The common path when warm-on-intent preloading is on: an open adopting a still-in-flight hover/focus preload left the trigger with no affordance. It is now armed for the adopted wait exactly like a cold load and released when the preload settles either way. An instant open from cache never flashes a busy state. (#B285)
+- **Fixed — a legacy popin trigger cannot start a second load.** An anchor using the older `data-gina-popin-name` markup was marked `aria-disabled` while loading, but its dispatch path tested only the plain `disabled` attribute, which an anchor never carries — so a second click during a slow load issued a second request. In practice this reached triggers that opt out of preloading, i.e. links whose request has side effects on the server. (#B298)
+- **Fixed — a popin close button works with your own id and with nested markup.** Giving the button your own id stopped it working, because gina recognised its close buttons by an id it had assigned itself. More commonly, an icon inside the button broke it too — a click landing on the inner `svg` or `span` was not recognised. Neither reported an error, and gina suppresses the default action either way, so nothing happened at all. (#B299, #B301)
+- **Fixed — `data-gina-link` leaves native affordances to the browser.** Four cases are no longer intercepted: an anchor carrying `download` saves natively instead of being buffered in memory, one carrying `target` opens its window or tab again, one pointing at a bare `#` fragment moves within the page, and a ctrl/cmd/shift/alt click opens the tab or window the browser would. The tests run against the resolved target, so the documented placeholder form keeps working. Cross-origin links are unaffected. (#B288)
+- **Fixed — a `data-gina-link` with your own id dispatches again.** Gina kept the id you wrote but dispatched only links whose id it had generated itself, so `<a id="my-link" data-gina-link>` registered normally and was then silently ignored on every click — with the default action already suppressed, nothing happened at all. Links with no id, and links wrapping a `span` or image, were unaffected, which is why this could sit unnoticed. (#B302)
+- **Fixed — disabled links are refused.** `data-gina-link` anchors had no disabled gate at all: one marked `aria-disabled="true"` still fired its XHR from both dispatch paths. Both now refuse the click with the same predicate the popin and validator gates use, while still suppressing the default navigation. Programmatic `gina.link.request()` deliberately stays ungated. **Action:** this is an enforcement tightening — remove the attribute from any link you still expect to fire. (#B310)
+- **Fixed — download filenames parse and serialize correctly.** Client-side, a `Content-Disposition` carrying no `filename` no longer throws mid-download (the browser derives a name), a quoted-string filename is unquoted and unescaped rather than saved with its quotes, and a trailing extended parameter is no longer folded into the name. Server-side, both emitters now write the filename as an RFC 6266 quoted-string with `"` and `\` escaped, so a name containing spaces, `;` or `,` produces a conformant header instead of a bare token an intermediary may truncate. (#B290, #B297)
+- **Fixed — `gina.setOptions()` writes the config the framework actually reads.** It merged into an orphan object nothing ever read, and was therefore silently ignored for every key since it shipped — the documented `loadingAttribute` rename could not work. It now merges into the exposed `gina.config` in place, with override semantics. **Action:** anything your project was already passing and silently having ignored **will now take effect** — review those calls. The `data-gina-config` script-tag attribute, documented alongside the rename but parsed by nothing, is no longer documented. (#B305)
+- **Fixed — the dev Inspector's standalone window reports its source mode.** The footer badge naming where the window's data comes from never appeared for a window opened from a `?target=` URL, because it was painted only from the data-poll timer that standalone mode deliberately never starts. The same mode did show when the window was reached through the connect form, so the badge's presence depended on how the Inspector had been opened rather than on the mode it was in. Polling is still not started there, deliberately. (#B306)
+- **Fixed — the documented SQLite and DuckDB default database path.** The connector JSDoc and the `connectors.json` schema described the default as version-segmented; the framework resolves the gina home without a version segment, so the documented default now matches the real path. Documentation only — behaviour is unchanged. (#B317)
+- **Fixed — `npm test` runs the suite.** The script pointed at a glob matching no files: 0 tests, exit 0 — a silent green that could pass for a healthy run. It now runs the full suite CI gates on, with `package.json` as the single source of truth for that file list. Adds `npm run test:coverage`, and a `pretest:e2e` step that installs the matching Chromium build so `npm run test:e2e` works from a clean checkout.
+- **Fixed — an unreachable log host no longer stalls gina processes.** With the default `mq` log flow configured and the host unreachable — a powered-off peer, a firewalled segment, a stale `host_v4` after a DHCP reassignment — any fresh gina process, a bare `require()` of framework code included, hung for the OS connect timeout (~75 seconds on macOS) before doing anything. A *refused* connection was always fine; it was the host that answers nothing at all that held the process open, because a still-pending dial is a live request even on an unref'd socket. The dial now carries its own bounded deadline and degrades through the same error path as a refusal — logging stays best-effort, never load-bearing. This fix is server-side: a restart delivers it, no re-bake needed. (#B318)
+- **Fixed — a refused submit keeps its error message visible.** Both refused-submit answers — the gated-trigger reveal and an enabled trigger's failed validation — render the first invalid field's message and then focus that field, and that focus re-engaged the live-check suppression that hides a message while its field is being edited: the answer was clipped to a screen-reader-only state the instant it appeared, so a refused submit looked like a dead click to sighted users. The framework's own answer focus is now exempt, one-shot; the first later keystroke re-engages the mid-typing suppression unchanged, as does clicking into an errored field yourself. Pre-existing — reproduced back to `0.6.4`. (#B319)
 
 ## Documentation
 

package/ROADMAP.md

@@ -56,6 +56,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.2` ✅ | **Changed**: render and request-path CPU overhead sharply reduced — the per-render deep copies of the request options (template-filter configuration and render envelope) are passed by reference after each one's write surface was measured empty, per-request locale lookups are memoized with the request-local copy materialized lazily on first read, and the id generator right-sizes its entropy batch to the requested length; measured on the profiling harness at **4.4× render throughput** (10.7 → 2.4 ms per render), deep-clone CPU share 50.31% → 1.81%, GC time down ~18× — no API change, but the browser bundle changed so bundles pick the id-generator half up on rebuild (#P39) · **Added**: opt-in 503 + `Retry-After` rendering for transient datastore failures — with `server.transientErrors.enabled`, a connector error stamped `isTransient` that would render as HTTP 500 through `throwError` renders as 503 carrying `Retry-After`, with a configurable retry delay and user-facing message, on both engines across JSON and HTML error surfaces; off by default and byte-identical when off, and a malformed block warns at boot rather than refusing it (#CE1) · **Fixed**: an `env.json` block that omits `host` no longer leaves the `${host}` token unsubstituted inside the TLS credentials paths, which refused https and HTTP/2 boots with an ENOENT naming a literal `${host}` segment under an error pointing at the server settings — `host` was the only per-bundle value with no framework-side default, so a hand-written or partial block never received one (#B181) · **Fixed**: a bundle whose project `env.json` carries no block for the environment it starts in now refuses with the bundle, the environment, the resolved path and whether the file was found all named — covering the absent, empty and unlisted-bundles shapes — instead of an opaque `Cannot read properties of undefined` crash, exiting 1 so an external supervisor can retry (#B181) · **Fixed**: starting a bundle in an environment its `env.json` block does not cover refuses cleanly at exit 1 rather than dying at exit 143 on `Cannot set properties of undefined (setting 'bundlesPath')`, and a bundle declared only for other environments is now reported as skipped instead of taking every sibling bundle down with it (#B183) · **Fixed**: dead process records are removed from the `~/.gina/procs.json` registry under the right key — `removeRunningProc()` matched the entry by pid but deleted under the constructing bundle key, rewriting dead records back to disk and able to destroy a live one, degrading `gina stop`'s graceful-kill path (#B180) |
 | **Q4 2026** | `0.6.3` ✅ | **Security**: the client-served routing map (`/_gina/assets/routing.json`) is now built from an ALLOWLIST instead of a denylist — controller dispatch keys (`param.control`/`file`/`path`/`title`), `namespace`, `scopes`, `cache` configuration including invalidation event names, `csrfExempt`, `middlewareIgnored` and `validator::` requirement bodies all stay server-side, and structurally so does every future route key until deliberately added to the roster; client URL building is unaffected, but code reading other keys off `gina.config.routing` must move server-side · **Added**: opt-in SPA-style client-side navigation — a route declares `negotiate: true` and answers `X-Gina-Navigate: fragment` layoutlessly over the same URL, while the new `gina/nav` module swaps same-origin link targets into a `data-gina-nav` region with history, scroll, focus, title, script re-injection and validator rebinding, falling back to a full-page navigation on every uncertainty; negotiable routes advertise `Vary: X-Gina-Navigate` and opt out of the render cache (#SPA1) · a configurable RFC 9211 `Cache-Status` identifier (`server.cache.name`), with a boot warn naming the residual framework disclosure when `hidePoweredBy` is set (#B238) · a Couchbase SDK soak harness that screens a candidate SDK in a fully isolated throwaway project before a consuming project adopts it (#CN12) · **Changed**: `/_gina/assets/routing.json` now revalidates on each page boot (per-variant weak `ETag` + `no-cache`, was `max-age=86400`), so a restart's new route table reaches returning browsers immediately instead of up to 24 hours later · the dormant transitive `object-assign` dependency overridden to a maintained re-export (gina's own tree only — `overrides` are root-manifest-scoped; the consumer-reaching fix is upstream) · **Fixed**: server-side form-body validation now enforces rules authored on bracket-notation (`account[username]`) and nested keys — previously skipped silently, fail-open, for checks, `exclude` and transforms alike (#B241) · the validator's empty-value contract made uniform: five loose-equality sites let `0`, `false` and `[]` ride the empty bypass so `isEmail`/`isJsonWebToken`/`isFloat` reported them VALID outright, and `is`/`isBoolean` joined the same contract (#B233, #B235) · `isBoolean` is now the single adjudicator on every surface — server auto-validation coerced junk to `false` and persisted it — and `isInteger` digit bounds enforce on real numbers, not only strings (#B236) · a `$` token in a rule no longer crashes the validation pass on either surface (#B234, #B239) · required radio groups now gate, and the submit trigger re-enables on a pick (#B221, #B228) · a field driving its own `_case_` block is validated and keeps the value the user picked (#B229, #B230) · a rejected submit no longer kills a form's live check for the rest of the page's life · the documented `setFlash` `[null, "message"]` form works in the browser (#B226) · `pauseRequest()`/`resumeRequest()` replay the byte-exact halted URL, query string included, on both engines (#B215, #B219) · `Controller.store()` publishes each file atomically and surfaces the real filesystem error instead of a fabricated `No file to upload`, where a source-stream error previously killed the bundle process (#B223) · custom error pages answer with their real HTTP status and keep their resolved template instead of falling back to the failing route's own file (#B190) · session stores no longer write an immortal record for an already-expired session (redis wrote an expiry-less SET; couchbase and scylladb stored a never-expires zero expiry) · a Couchbase N1QL parameter the SDK cannot serialize no longer aborts the whole bundle process (#B243), and range SDK pins like `~4.5.0` resolve instead of mangling past the version floor · `lib/math` `checkSumSync` — every array collapsed to the empty-string checksum, data ending in an extension shape was misrouted to the filesystem, and real file paths were hashed as path strings (#B208, #B209, #B210) · `GINA_*` environment variables are visible to the CLI's own bootstrap, the MQ and file logger containers, the MCP bind tier and `${secret:}` resolution · the client routing map serves under every engine, and a non-2xx boot fetch is no longer installed as the client routing table (#B212, #B213) · Inspector bundle-following across a proxy-routed project, per-tab restore, advertised-channel adoption and six scope/display fixes (#B205, #B222, #B225, #B231, #B237) · `bundle:openapi`/`bundle:mcp` no longer drop three declared bound forms when un-collapsing a `validator::{}` requirement · a sub-directory in the run directory no longer aborts every gina command · the scaffolded bundle template's impossible session-store selection (`expressSession.name = 'myRedis'` silently no-ops) |
 | **Q4 2026** | `0.6.4` ✅ | **Added**: a framework-owned loading state for busy controls — clicking a submit trigger, a `data-gina-link` anchor or a popin trigger sets `data-gina-loading="true"` on that control and flips it to `"false"` when the work settles, errors, times out, aborts or is rejected by validation (the case that stranded the state on forever, since a refused submit sends no request at all), with a shipped default look gated on `prefers-reduced-motion` and an opt-in attribute rename (#B247) · `gina.config.a11y` overrides for the status strings gina announces on its own behalf · an opt-in `secrets.file` layer resolving `${secret:KEY}` from `.env`-style files **beneath** the environment, so a non-empty environment value can never be shadowed by a stale file on disk, with later array entries winning, empty-value fall-through warning, and fail-closed resolution · **Security**: secret-file ignore rules now match by glob (`.env`, `.env.*`, `*.env`) in both the repository and published-package ignore lists, where the previous exact `.env` entry left `secrets.env` or `db.env` committable and publishable by default · **Fixed**: a submit trigger disabled by live validation was inert in appearance only and still ran the whole submit cycle when clicked (#B246) · a form's first validation error was the one least likely to be heard, because the polite live region was created, inserted and written in a single synchronous step · submitting a form dropped the keyboard user's focus to the document body, and nothing told assistive technology a submit was under way · validation messages kept `aria-invalid` asserted while `display: none` removed the message from the accessibility tree, and the first-invalid focus loop could stop on a control that never actually took focus · staged uploads gained progressbar semantics with the value dropped rather than zeroed while indeterminate, spoken start/complete/error, an operable reset control, and preview `alt` text taken from the user's own filename · a popin opened over another left the superseded one reachable in the tab order behind it · built-in error pages emitted no doctype, head, title or `lang` and never terminated the document on HTTP/1.1, and the `lang` gina emits is now normalised to BCP-47 · the link plugin reused one `XMLHttpRequest` for every click, so a second click aborted the first and its response vanished in total silence · `gina secrets:check` reported `UNSET` for keys a bundle would have started with once `secrets.file` was declared, and could not resolve version- or scope-templated paths (#B263, #B266) · a declared secrets file that exists but cannot be read was mistaken for an absent one, so a bundle booted healthily on the wrong credential (#B267) · an environment variable that is set but empty now warns as it falls through to the file (#B268) · a trailing `#` comment was read as part of the secret, diverging from the POSIX shell that sources the same file · requiring gina outside a bundle context hung the process instead of failing cleanly, because the logger's MQ socket kept the event loop alive (#B276, #B277) · a bundle starting in an undeclared environment could lose its refusal message to a truncated pipe (#B278) · a gina command died mid-run when an MQ speaker disconnected abruptly, leaving a half-created bundle (#B279) |
+| **Q4 2026** | `0.6.5` ✅ | **Fixed**: the silent-dead-control release — a family of defects where a control looked completely normal and did nothing at all. A submit trigger disabled by your own double-submit guard during the click (a `0.6.4` regression), a submit button whose DOM node an AJAX update or popin re-render replaced, a form left blocked after its async uniqueness check came back clean, a popin close button given your own id or wrapping an icon, a `data-gina-link` given your own id, and a popin holding several forms releasing only every other one — all now work. Trusted gestures (Enter, wrapped-label clicks) respect the submit gate; `data-gina-link` stops swallowing `download`, `target`, `#`-fragment and modified clicks, and gains the disabled gate it never had; download filenames parse and serialize per RFC 6266; `gina.setOptions()` writes the config the framework reads, having been silently ignored since it shipped; `isRequired` accepts padded input and `trim` strips both sides · **Changed**: the not-ready submit-trigger state moves off `aria-disabled` onto the framework-owned `data-gina-form-submit-gated`, with a default look — the marker no longer claims a control is inoperable while gina deliberately answers its click |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys · sequence primitive · OAuth2 client-credentials egress |

package/framework/v0.6.5/VERSION

@@ -0,0 +1 @@
+0.6.5

package/framework/v0.6.5/core/asset/plugin/dist/vendor/gina/css/gina.min.css

@@ -0,0 +1 @@
+@charset "UTF-8";@keyframes gina-loading-pulse{0%{opacity:1}to{opacity:.55}}@keyframes gina-popin-skeleton-shimmer{0%{background-position:200%0}to{background-position:-200%0}}[data-gina-loading=true]{cursor:progress}@media (prefers-reduced-motion:no-preference){[data-gina-loading=true]{animation:gina-loading-pulse .9s ease-in-out infinite alternate}}@media (prefers-reduced-motion:reduce){[data-gina-loading=true]{opacity:.7}}[data-gina-form-submit-gated=true]{cursor:not-allowed;opacity:.7}@font-face{font-family:"have_heart_oneregular";src:url(fonts/have_heart_one-webfont.woff2)format("woff2"),url(fonts/have_heart_one-webfont.woff)format("woff");font-weight:400;font-style:normal}.gina-popin-container{background:#fff}.gina-popins-overlay,div.gina-popin-container{visibility:hidden;opacity:0;z-index:1;transition:opacity .3s,visibility 0 .3s}.gina-popins-overlay.gina-popin-is-active,div.gina-popin-container.gina-popin-is-active{opacity:1;visibility:visible;transition-delay:0}dialog.gina-popin-container{padding:0;border:0;z-index:1}@media (prefers-reduced-motion:no-preference){dialog.gina-popin-container{opacity:0;transform:translateY(-.5rem);transition:opacity .2s ease,transform .2s ease,overlay .2s ease allow-discrete,display .2s ease allow-discrete}dialog.gina-popin-container[open]{opacity:1;transform:translateY(0)}@starting-style{dialog.gina-popin-container[open]{opacity:0;transform:translateY(-.5rem)}}dialog.gina-popin-container::backdrop{opacity:0;transition:opacity .2s ease,overlay .2s ease allow-discrete,display .2s ease allow-discrete}dialog.gina-popin-container[open]::backdrop{opacity:1}@starting-style{dialog.gina-popin-container[open]::backdrop{opacity:0}}}body[data-gina-popin-scroll-lock]{overflow:hidden}.gina-popins-overlay{position:fixed;left:0;top:0;display:grid;place-items:center;width:100%;height:100%;transition:opacity .3s,visibility .3s;overflow:auto;background:rgba(0,0,0,.75)}.gina-popins-overlay.gina-popin-is-active{backdrop-filter:blur(6px)}dialog::backdrop{background-color:rgba(0,0,0,.75);backdrop-filter:blur(6px)}.gina-popin-skeleton{padding:1.5rem;min-width:18rem;max-width:90vw}.gina-popin-skeleton .gina-popin-skeleton-line{height:.85rem;margin-bottom:.75rem;border-radius:4px;background:linear-gradient(90deg,#ededed 25%,#f7f7f7 50%,#ededed 75%);background-size:200% 100%;animation:gina-popin-skeleton-shimmer 1.4s ease-in-out infinite}.gina-popin-skeleton .gina-popin-skeleton-line:last-child{margin-bottom:0}.gina-popin-skeleton .gina-popin-skeleton-title{height:1.4rem;width:60%;margin-bottom:1.25rem}.gina-popin-skeleton .gina-popin-skeleton-line--short{width:40%}@media (prefers-reduced-motion:reduce){.gina-popin-skeleton .gina-popin-skeleton-line{animation:none}}

package/framework/{v0.6.4 → v0.6.5}/core/asset/plugin/dist/vendor/gina/inspector/inspector.js

@@ -3758,6 +3758,10 @@
      * Called from `pollData()` (every tick + every bound-channel apply) and at
      * the end of the init acquisition, so a mode transition (e.g. an adopted
      * channel handing over to the legacy fallback) surfaces within one tick.
+     * Agent mode (`?target=`) reaches neither of those — it schedules no poll
+     * timer — so init calls this directly on its branch; without that call the
+     * `agent` badge would be unreachable from a URL-entered standalone session
+     * (#B306).
      *
      * @inner
      */
@@ -5945,6 +5949,20 @@
                     }
                 }
             }
+        } else {
+            // #B306 — agent mode skips every acquisition-path badge call above
+            // AND never schedules pollData (see the polling block below), so
+            // this is the only place the badge's `agent` branch is reachable on
+            // this entry path. Without it the same mode renders when reached via
+            // the connect form (whose timer is already ticking when `source`
+            // becomes 'agent') but stays hidden under a URL `?target=` — badged
+            // or silent depending purely on how the Inspector was opened, which
+            // defeats #B231's "visible instead of silent" purpose. `tryAgent()`
+            // has already settled `source` to 'agent' by the time it returns
+            // true — including when `tryAgentWS()` claimed the channel first, on
+            // which path it short-circuits via its own `source === 'agent'`
+            // guard — so the badge reads the final mode, not an interim one.
+            updateSourceModeBadge();
         }
 
         // ── Persist window geometry on resize/move ──────────────────────────
@@ -5966,9 +5984,17 @@
         window.addEventListener('resize', debouncedSaveGeometry);
         window.addEventListener('beforeunload', saveGeometry);
 
-        // In agent mode, data arrives via SSE push — no polling needed.
-        // pollData() still runs on the timer as a no-op (source === 'agent'
-        // early-returns) so the refresh button works for manual re-renders.
+        // In agent mode, data arrives via SSE push — no polling needed, and the
+        // timer is deliberately NOT scheduled.
+        //
+        // #B306 — the comment previously here claimed the opposite ("pollData()
+        // still runs on the timer as a no-op … so the refresh button works").
+        // Both halves were wrong, so do not "reconcile" this guard to match it:
+        // pollData() is NOT a no-op under `source === 'agent'` — it re-renders
+        // the active tab from cache before returning — so a ticking timer would
+        // repaint every pollDataMs and fight scroll position, expanded folds and
+        // text selection. And the refresh button needs no timer either: it calls
+        // pollData() directly.
         if (!isAgent) {
             pollDataTimer = setInterval(pollData, pollDataMs);
             setInterval(pollLogs, POLL_LOGS_MS);