gina 0.6.4 → 0.6.5

package/framework/{v0.6.4 → v0.6.5}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -4787,7 +4787,12 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             }
 
 
-            var isValid = ( typeof(this.value) != 'undefined' && this.value != null && this.value != '' && !/^\s+/.test(this.value) ) ? true : false;
+            // was: var isValid = ( typeof(this.value) != 'undefined' && this.value != null && this.value != '' && !/^\s+/.test(this.value) ) ? true : false;
+            // #B245 - the leading anchor alone made ANY leading-whitespace-padded value
+            // read as empty ("  x" was rejected while "x  " passed, and a paired `trim`
+            // healed the data AFTER the error was recorded); emptiness means
+            // whitespace-ONLY, so anchor both ends. All-whitespace still fails.
+            var isValid = ( typeof(this.value) != 'undefined' && this.value != null && this.value != '' && !/^\s+$/.test(this.value) ) ? true : false;
             var errors  = self[this['name']]['errors'] || {};
 
 
@@ -5131,7 +5136,10 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         self[el]['trim'] = function(isApplicable) {
             if ( typeof(isApplicable) == 'boolean' && isApplicable ) {
                 //if ( typeof(this.value) == 'string' ) {
-                    this.value = this.value.replace(/^\s+|\s+$/, '');
+                    // was: this.value = this.value.replace(/^\s+|\s+$/, '');
+                    // #B245 - without the global flag, replace() rewrote only the FIRST
+                    // match: "  x  " came back "x  " (leading stripped, trailing kept).
+                    this.value = this.value.replace(/^\s+|\s+$/g, '');
                     local.data[this.name] = local.data[this.name] = this.value;
                 //}
                 return self[this.name]
@@ -7499,6 +7507,47 @@ function setupXhr(options) {
     return xhr;
 }
 
+/**
+ * getFilenameFromContentDisposition
+ *
+ * Extracts the `filename` parameter from a response `Content-Disposition`
+ * header for the XHR blob-download path. Both RFC 6266 value forms are
+ * accepted: a bare token (`filename=report.pdf`, read up to the next `;`)
+ * and a quoted-string (`filename="monthly report.pdf"`, delimiters stripped,
+ * `\"` and `\\` unescaped). Returns an empty string when the header is
+ * missing or carries no `filename` parameter (e.g. a bare `attachment`), so
+ * the caller can hand the browser an empty `download` attribute and let it
+ * derive a name instead of throwing mid-handler. The extended RFC 5987
+ * parameter (`filename` followed by a star) is never matched — the star
+ * breaks the `filename=` adjacency — so a header carrying both parameters
+ * yields the plain one instead of folding the two values together.
+ *
+ * @function getFilenameFromContentDisposition
+ * @param {string|null} contentDisposition - raw header value, e.g. from `xhr.getResponseHeader('Content-Disposition')`
+ * @returns {string} filename - the decoded filename, or `''` when none is present
+ *
+ * @example
+ *  getFilenameFromContentDisposition('attachment; filename="monthly report.pdf"');
+ *  // -> 'monthly report.pdf'
+ * @example
+ *  getFilenameFromContentDisposition('attachment');
+ *  // -> ''
+ */
+function getFilenameFromContentDisposition(contentDisposition) {
+    if (!contentDisposition) {
+        return '';
+    }
+    var found = contentDisposition.match(/filename\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([^;]+))/i);
+    if (!found) {
+        return '';
+    }
+    if ( typeof(found[1]) != 'undefined' ) {
+        // quoted-string: delimiters are not part of the name; unescape quoted pairs
+        return found[1].replace(/\\(.)/g, '$1');
+    }
+    return found[2].replace(/^\s+|\s+$/g, '');
+}
+
 /**
  * handleXhr
  *
@@ -7650,7 +7699,7 @@ function handleXhr(xhr, $el, options, require) {
                         var url = window.URL.createObjectURL(blob);
                         a.href = url;
                         var contentDisposition = xhr.getResponseHeader('Content-Disposition');
-                        a.download = contentDisposition.match('\=(.*)')[0].substring(1);
+                        a.download = getFilenameFromContentDisposition(contentDisposition);
                         //programatically click the link to trigger the download
                         a.click();
                         //release the reference to the file by revoking the Object URL
@@ -8991,12 +9040,29 @@ define('gina', [ 'require', 'lib/merge', 'lib/uuid', 'lib/routing', 'utils/event
 
         /**
          * setOptions
-         * Override default config options or add new options properties
+         * Overrides default config options or adds new option properties on the
+         * exposed `gina.config` — the object every plugin and library reads.
+         * Applied in place with override semantics: a top-level scalar from
+         * `options` replaces the existing value, a top-level object is merged one
+         * level deep, and keys absent from `options` are never removed.
+         *
+         * N.B.: the framework boot passes the exposed config itself through this
+         * function; that call is a no-op by design. In a child frame inheriting a
+         * parent frame's instance, the inherited handler configures the parent.
+         *
+         * @param {object} options - e.g. `{ loadingAttribute: 'data-loading' }`
          *
-         * @param {object} options
+         * @example
+         *  gina.setOptions({ loadingAttribute: 'data-loading' });
+         *  // gina.config.loadingAttribute is now 'data-loading'
          * */
         var setOptions = function(options) {
-            proto.config = merge(proto.config, options, true)
+            if ( !options || typeof(options) != 'object' || options === $instance.config ) {
+                // nothing to merge: no options given, or the boot passing the
+                // exposed config back to itself
+                return
+            }
+            $instance.config = merge($instance.config, options, true)
         }
 
         // instance proto
@@ -9316,16 +9382,15 @@ if ( _isNode ) {
  * ## Configuring the attribute name
  *
  * The name is read from `gina.config.loadingAttribute`, lazily, at every call —
- * `gina.config` is populated after the bundle loads (via `setOptions`), so a value
+ * `gina.config` is populated by the loader after the bundle loads, so a value
  * captured at module-definition time would be stale. A project already built on
  * `data-loading` opts in with:
  *
- * ```html
- * <script src="/js/vendor/gina/gina.min.js"
- *         data-gina-config="{ loadingAttribute: 'data-loading' }"></script>
+ * ```js
+ * gina.setOptions({ loadingAttribute: 'data-loading' });
  * ```
  *
- * or `gina.setOptions({ loadingAttribute: 'data-loading' })`. There is no
+ * There is no
  * auto-detection: a DOM probe reads nothing at rest (the attribute only exists
  * while something is loading) and a stylesheet probe races late-loaded sheets and
  * throws on cross-origin ones. Configuration is explicit by design.
@@ -9767,10 +9832,88 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
 
 
 
+        /**
+         * A click the user asked the BROWSER to handle specially — cmd/ctrl for a new
+         * tab, shift for a new window, alt for a download in some browsers. Binding it
+         * swallows that intent, exactly as the `download` / `target` / `#` shapes did
+         * before the bind-time guard in `bindLinks`.
+         *
+         * Mirrors the nav plugin's equivalent test, with two deliberate differences:
+         *   - nav also bails on `event.defaultPrevented`. That cannot be reused here:
+         *     this plugin's own per-anchor listener suppresses the default before the
+         *     document proxy runs, so the flag is always set by the time the proxy is
+         *     reached and the bail would fire on every single click.
+         *   - nav also bails on a non-left `event.button`. Measured unnecessary here:
+         *     a middle click fires `auxclick`, not `click`, so it never arrives.
+         *
+         * Must be consulted at every site that still holds the NATIVE event — the
+         * per-anchor listener, the document proxy and this child proxy. The custom
+         * event dispatched onward carries no modifier data at all (`triggerEvent`
+         * copies native properties only when handed a `proxiedEvent`, which no call
+         * site here does), so a check placed after that hop could never fire.
+         *
+         * @inner
+         * @private
+         * @param {object} e - the native click event
+         * @returns {boolean} true when a modifier key was held
+         *
+         * @example
+         * if ( isModifiedClick(e) ) return; // let the browser open its new tab
+         */
+        var isModifiedClick = function(e) {
+            return !!( e && (e.ctrlKey || e.metaKey || e.shiftKey || e.altKey) );
+        }
+
+        /**
+         * isLinkDisabled
+         *
+         * Tells whether a bound link is currently marked disabled — #B310's
+         * click-time gate. The predicate is the popin trigger gate's (#B296),
+         * itself mirroring the validator's (#B293), so all three subsystems
+         * agree on what "disabled" means for a trigger: the aria-disabled
+         * marker always counts; the native attribute counts only where
+         * `disabled` is not a real IDL property (on an anchor it never is, so
+         * both arms are live here), because a genuine form control's
+         * browser-enforced disable never lets the click reach JS at all.
+         *
+         * Consulted at the TWO dispatch sites that turn a click into a
+         * request — the document proxy and the child-node proxy — AFTER their
+         * cancelEvent: a registered link keeps suppressing its default, gated
+         * or not, so a disabled link goes nowhere rather than falling back to
+         * navigation. Deliberately NOT consulted in linkRequest (the public
+         * API + the redirect funnel — a programmatic call is not operating
+         * the control, the same scope reasoning as the validator's gesture
+         * gate) nor in the per-anchor CSP suppression listener (a gated link
+         * still suppresses its default).
+         *
+         * @inner
+         * @private
+         * @param {object} $el - the bound anchor
+         * @returns {boolean} true when the link is marked disabled
+         *
+         * @example
+         * if ( isLinkDisabled($el) ) return; // swallow the click, send nothing
+         */
+        var isLinkDisabled = function($el) {
+            return !!(
+                $el
+                && (
+                    !('disabled' in $el)
+                    && $el.getAttribute('disabled') != null && $el.getAttribute('disabled') != 'false'
+                    || $el.getAttribute('aria-disabled') == 'true'
+                )
+            );
+        }
+
         var proxyClick = function($childNode, $el, evt) {
 
             addListener(gina, $childNode, 'click', function(e) {
+                if ( isModifiedClick(e) ) return;
+
                 cancelEvent(e);
+                // #B310 — the disabled gate, AFTER cancelEvent: a registered
+                // link keeps suppressing its default, gated or not.
+                if ( isLinkDisabled($el) ) return;
 
                 triggerEvent(gina, $el, evt);
             });
@@ -10089,8 +10232,34 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
         /**
          * bindLinks
          *
+         * Binds every `<a data-gina-link>` under `$target` so its clicks issue an XHR
+         * instead of navigating. An anchor spelling `data-gina-link="false"` opts out.
+         *
+         * Three shapes are skipped at bind time (#B288) because they ask the BROWSER for
+         * something an XHR cannot deliver — a `download` save, a `target` window, or a
+         * pure `#` in-page fragment move. A skipped anchor is left completely untouched
+         * (no generated id, no click listeners) and therefore behaves exactly like
+         * un-marked markup. The test is made against the RESOLVED url, so the documented
+         * `<a href="#" data-gina-link-url="/real/target">` placeholder idiom still binds.
+         *
+         * Cross-origin anchors are deliberately NOT skipped — `linkRequest` supports them
+         * (it drops credentials and relies on the target's CORS headers). Non-left-button
+         * clicks need no guard: a middle click fires `auxclick`, not `click`.
+         *
          * @param {object} $target - DOM element
          * @param {object} [options]
+         *
+         * @example
+         * // bound — same-origin GET over XHR
+         * // <a href="/reports/42" data-gina-link>Open</a>
+         *
+         * // bound — placeholder href, real target in the data attribute
+         * // <a href="#" data-gina-link data-gina-link-url="/reports/42">Open</a>
+         *
+         * // NOT bound — the browser saves, moves in-page, or opens a window itself
+         * // <a href="/report.pdf" data-gina-link download>Save</a>
+         * // <a href="/reports/42" data-gina-link target="_blank">New tab</a>
+         * // <a href="#section-3" data-gina-link>Jump</a>
          * */
         var bindLinks = function($target, options) {
 
@@ -10134,8 +10303,35 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
                     props.url = $el.getAttribute('href')
                 }
 
-
-
+                // #B288 — leave the browser's own affordances alone. Three anchor shapes
+                // ask the BROWSER to do something an XHR cannot do, and binding them
+                // silently swallowed the user's intent (all three measured in a real
+                // browser against the shipped bundle):
+                //   `download` — the user asked for a saved file; the native save streams
+                //                and names it, where the XHR path buffers the whole body
+                //                in memory first.
+                //   `target`   — asks for another window/tab; an XHR opens neither, so the
+                //                click did nothing observable at all.
+                //   a pure `#` — an in-page fragment move; there is no resource to request,
+                //                and the plugin issued a GET for the literal "#name".
+                // Skipped at BIND time, so a skipped anchor gets neither the id nor either
+                // click listener and behaves exactly as un-marked markup — gating only the
+                // request would leave the default still suppressed and produce a dead link
+                // (the #B141 failure this plugin already shipped once).
+                // Keyed on the RESOLVED url, never on `href`: `data-gina-link-url` wins
+                // (see just above), so the documented placeholder idiom
+                // `<a href="#" data-gina-link data-gina-link-url="/real/target">` still binds.
+                // Deliberately NOT guarded here: cross-origin (a supported link feature —
+                // see the CORS branch in `linkRequest`) and non-left-button clicks (a middle
+                // click fires `auxclick`, not `click`, so it never reaches this plugin —
+                // measured: the browser opens the tab and no request is made).
+                if (
+                       $el.getAttribute('download') != null
+                    || $el.getAttribute('target') != null
+                    || /^#/.test( props.url || '' )
+                ) {
+                    continue;
+                }
 
                 elId = $el.getAttribute('id');
                 if ( typeof(elId) == 'undefined' || elId == null || elId == '' || /popin\.link/.test(elId) ) {
@@ -10157,7 +10353,10 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
                 // script-src-attr under nonce-based policies. preventDefault (NOT cancelEvent —
                 // its stopPropagation would block the document-level delegation that fires the
                 // AJAX request) covers direct AND child clicks while leaving the delegation intact.
-                addListener(gina, $el, 'click', function(e) { e.preventDefault(); });
+                // The modifier bail runs FIRST: suppressing here would kill the browser's new
+                // tab/window no matter what the document proxy later decides, because this
+                // listener is reached before it.
+                addListener(gina, $el, 'click', function(e) { if ( isModifiedClick(e) ) return; e.preventDefault(); });
 
                 $newLink = null;
 
@@ -10188,6 +10387,10 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
                 // for proxies, use linkInstance.id as target is always `document`
                 addListener(gina, instance.target, evt, function(event) {
 
+                    // A modified click belongs to the browser. Bail before the id backfill
+                    // below, so deferring leaves no trace on the element either.
+                    if ( isModifiedClick(event) ) return;
+
                     if ( typeof(event.target.id) == 'undefined' ) {
                         event.target.setAttribute('id', evt +'.'+ uuid() );
                         event.target.id = event.target.getAttribute('id')
@@ -10195,13 +10398,29 @@ define('gina/link', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge',
 
 
 
-                    if ( /^link\.click\./.test(event.target.id) ) {
+                    // #B302 — dispatch on REGISTRATION, never on the id's SHAPE. `bindLinks`
+                    // KEEPS an author-supplied `id` (only an empty/missing/`popin.link` id gets
+                    // the generated `link.click.gina-link-<instance>-<uuid>` form), so gating
+                    // here on that shape made `<a id="my-link" data-gina-link>text</a>` a DEAD
+                    // link: it registered its `$links` entry and its custom-event listener
+                    // normally, this proxy then refused to trigger it, and the per-anchor
+                    // listener above had already suppressed the default — so the click did
+                    // nothing at all. `instance.$links` is the very lookup `getLinkById` is,
+                    // and it is PER-INSTANCE, so it answers "is this one of MY links?"
+                    // directly — subsuming the old second, instance-scoping regex — and it
+                    // holds for BOTH id shapes. Note the child proxy (`proxyClick`) has always
+                    // been shape-agnostic (it takes the id as a parameter), which is why a
+                    // nested-element click on such an anchor already worked; this makes the
+                    // direct-click path agree with it rather than adding a new mechanism.
+                    // A click on non-link markup yields an id absent from `$links` — no-op.
+                    if ( typeof(instance.$links[event.target.id]) != 'undefined' ) {
                         cancelEvent(event);
-                        var _evt = event.target.id;
-
-                        if ( new RegExp( '^link.click.gina-link-' + instance.id).test(_evt) )
-                            triggerEvent(gina, event.target, _evt, event.detail);
-
+                        // #B310 — the disabled gate, AFTER cancelEvent (same
+                        // reasoning as proxyClick's): suppressed, not sent.
+                        if ( isLinkDisabled(event.target) ) {
+                            return;
+                        }
+                        triggerEvent(gina, event.target, event.target.id, event.detail);
                     }
                 });
 
@@ -11478,6 +11697,23 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
     }
 
+    /**
+     * #B319 — one-shot exemption raised while the framework moves focus to the
+     * first invalid field to DELIVER a refused submit's answer (the #B246/#B308
+     * display-only reveal, and the `validate.<id>` failure branch). `.focus()`
+     * dispatches `focusin` synchronously, so without this flag that dispatch
+     * re-enters the live-check listener whose `refreshWarning` call sees the
+     * field is by then the active element and hides the very message the answer
+     * just rendered (#B312: the message IS the answer). The focusin arm skips
+     * the downgrade while the flag is up; both focus sites clear it on every
+     * exit, so the user's next interaction — typing, refocusing — re-engages
+     * the deliberate mid-typing suppression untouched.
+     *
+     * @private
+     * @type {boolean}
+     */
+    var isAnswerFocusInProgress = false;
+
     var refreshWarning = function($el) {
         var formId = $el.form.id || $el.form.getAttribute('id');
         var elName = $el.name || $el.form.getAttribute('name');
@@ -12865,6 +13101,15 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     if ($submitTrigger) {
                         // For A tag: aria-disabled=true
                         if ( /^A$/i.test($submitTrigger.tagName) ) {
+                            // #B312 — unconditional again: the live-check gate now marks
+                            // `data-gina-form-submit-gated` (its own channel, untouched
+                            // here), so the in-flight lock is aria-disabled's only
+                            // framework writer on this trigger and the #B309 verdict
+                            // replay — a conditional re-mark read from the form's
+                            // `_gateMarked` shadow (commit cf366c34a) — had nothing left
+                            // to replay and is retired. An authored aria mark set
+                            // mid-flight is still released here; that was equally true
+                            // of the replay.
                             $submitTrigger.removeAttribute('aria-disabled');
                         } else {
                             $submitTrigger.removeAttribute('disabled');
@@ -12943,9 +13188,17 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     if ($submitTrigger) {
                         // For A tag: aria-disabled=true
                         if ( /^A$/i.test($submitTrigger.tagName) ) {
-                            $submitTrigger.removeAttribute('aria-disabled', true);
+                            // #B312 — unconditional again, in step with the loadend
+                            // release above (the #B309 verdict replay is retired with
+                            // the shared attribute — the gate marks its own channel
+                            // now), and the stray 2nd argument fixed by #B309 stays
+                            // gone.
+                            // was:
+                            // $submitTrigger.removeAttribute('aria-disabled', true);
+                            $submitTrigger.removeAttribute('aria-disabled');
                         } else {
-                            $submitTrigger.removeAttribute('disabled', true);
+                            // was: $submitTrigger.removeAttribute('disabled', true);
+                            $submitTrigger.removeAttribute('disabled');
                         }
                     }
                     $form.target.removeAttribute('data-gina-form-loading');
@@ -12980,7 +13233,7 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                 var url = window.URL.createObjectURL(blob);
                                 a.href = url;
                                 var contentDisposition = xhr.getResponseHeader("Content-Disposition");
-                                a.download = contentDisposition.match('\=(.*)')[0].substring(1);
+                                a.download = getFilenameFromContentDisposition(contentDisposition);
                                 //programatically click the link to trigger the download
                                 a.click();
 
@@ -16076,7 +16329,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         }
                         // other inputs & textareas
                         else if ( /^focusin\./i.test(event.type) ) {
-                            if ( /\-error/.test($el.parentNode.className) ) {
+                            // #B319 — not on the answer focus: when a refused submit
+                            // moves focus to the first invalid field, the message it
+                            // just rendered must survive its own delivery.
+                            if (
+                                /\-error/.test($el.parentNode.className)
+                                && !isAnswerFocusInProgress
+                            ) {
                                 console.debug('#1 you just focusin ....'+$el.id, $el.value, instance.$forms[ $el.form.getAttribute('id') ].isValidating);
                                 refreshWarning($el);
                             }
@@ -18718,20 +18977,18 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         _evt = 'reset.'+_evt
                     }
 
-                    // #B246 — a disabled submit trigger must not run the submit cycle.
-                    // `updateSubmitTriggerState()` marks an invalid form's trigger with
-                    // `aria-disabled="true"` and never with native `disabled`, precisely so
-                    // the click still reaches us. Nothing READ that marker, so the trigger
-                    // stayed fully operable: a click ran the collect -> validate ->
-                    // `validate.<id>` chain and only the `isValid()` gate stopped the send.
-                    // The trigger was inert in appearance ONLY, and that also contradicted
-                    // the `aria-disabled` contract it advertises to assistive tech (which
-                    // requires the author to suppress the action).
+                    // #B246 — a gated or disabled submit trigger must not run the submit
+                    // cycle. `updateSubmitTriggerState()` marks an invalid form's trigger
+                    // with `data-gina-form-submit-gated` + a class (#B312 — the
+                    // framework's own channel, no ARIA claim, precisely so the click
+                    // still reaches us and the vocabulary stays honest), and
+                    // `isTriggerDisabled` ALSO honours an AUTHORED aria/native disabled
+                    // mark and the anchor in-flight lock.
                     //
                     // Intercept HERE — before the `submit.<id>` dispatch below — so
                     // `bindSubmitEl`'s handler never runs, `isSubmitting` is never latched
                     // and no send path is reachable. The click is still answered with a
-                    // display-only reveal, so the user learns WHY the trigger is disabled
+                    // display-only reveal, so the user learns WHY the trigger is refused
                     // (which is what the operable-trigger design was bought for).
                     // Checked on the CLICKED element, not `$formInstance.submitTrigger`:
                     // a form may carry several submit buttons and only one registers.
@@ -18757,6 +19014,24 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     }
 
                     if (gina.events[_evt]) {
+                        // #B294 — submit binding is TWO-STAGE and only the first stage is
+                        // delegated. The native click proxy lives on the FORM (:8090) and
+                        // survives any re-render; the listener that does the work is
+                        // attached to the trigger NODE by `bindSubmitEl` (:8231). Because
+                        // `gina.events` is a name -> id-STRING registry, the `submit.<id>`
+                        // key outlives the node, so after an AJAX/popin re-render replaces
+                        // the trigger this gate still passes: `cancelEvent` below suppresses
+                        // the native submit and `triggerEvent` fires at a node that has no
+                        // listener. The form does not even fall back to a normal submit, and
+                        // nothing self-heals — `bindForm` latches `binded` (:8580) and is
+                        // never re-entered on DOM replacement — so the trigger was
+                        // permanently and silently dead.
+                        // Re-bind the live node when its marker is absent. A clone cannot
+                        // inherit the expando, so this fires exactly once per replacement
+                        // and is a no-op on the normal path.
+                        if ( $el && $el.__ginaSubmitBoundFor !== _evt ) {
+                            bindSubmitEl(_evt, $el);
+                        }
                         cancelEvent(event);
 
                         triggerEvent(gina, $el, _evt, event.detail);
@@ -18913,25 +19188,33 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     var _a11yErrs = result['fields'] || result['error'];
                     if ( _a11yErrs ) {
                         var $a11yForm = event['target'];
-                        for (var _ai = 0, _aLen = $a11yForm.length; _ai < _aLen; ++_ai) {
-                            var _aField = $a11yForm[_ai];
-                            var _aName  = _aField.getAttribute('name');
-                            if (
-                                _aName
-                                && typeof(_a11yErrs[_aName]) != 'undefined'
-                                && ( typeof(_a11yErrs[_aName].count) != 'function' || _a11yErrs[_aName].count() > 0 )
-                                && _aField.type != 'hidden'
-                                && typeof(_aField.focus) == 'function'
-                            ) {
-                                _aField.focus();
-                                // #A11Y5 (V8) — kept in step with focusFirstInvalidField:
-                                // only stop once focus actually moved, since focus() is a
-                                // no-op on an unfocusable host that still passes the
-                                // typeof-function gate above.
-                                if ( typeof(document) === 'undefined' || !document || document.activeElement === _aField ) {
-                                    break;
+                        // #B319 — same one-shot answer-focus exemption as
+                        // focusFirstInvalidField: this focus delivers the
+                        // answer, it is not the user editing the field.
+                        isAnswerFocusInProgress = true;
+                        try {
+                            for (var _ai = 0, _aLen = $a11yForm.length; _ai < _aLen; ++_ai) {
+                                var _aField = $a11yForm[_ai];
+                                var _aName  = _aField.getAttribute('name');
+                                if (
+                                    _aName
+                                    && typeof(_a11yErrs[_aName]) != 'undefined'
+                                    && ( typeof(_a11yErrs[_aName].count) != 'function' || _a11yErrs[_aName].count() > 0 )
+                                    && _aField.type != 'hidden'
+                                    && typeof(_aField.focus) == 'function'
+                                ) {
+                                    _aField.focus();
+                                    // #A11Y5 (V8) — kept in step with focusFirstInvalidField:
+                                    // only stop once focus actually moved, since focus() is a
+                                    // no-op on an unfocusable host that still passes the
+                                    // typeof-function gate above.
+                                    if ( typeof(document) === 'undefined' || !document || document.activeElement === _aField ) {
+                                        break;
+                                    }
                                 }
                             }
+                        } finally {
+                            isAnswerFocusInProgress = false;
                         }
                     }
                 }
@@ -18950,6 +19233,16 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 evt = 'submit.'+ evt;
             }
             //console.debug('attaching submit event: `'+  evt +'` on `'+ $submit.id + '` element for form `'+ $submit.form.id +'`');
+            // #B294 — mark the node this listener is ACTUALLY attached to. Deliberately
+            // a JS expando and NOT a `data-*` attribute: `cloneNode(true)` copies
+            // attributes but not expandos (measured), so a re-rendered trigger arrives
+            // carrying every attribute yet WITHOUT this marker. That asymmetry is what
+            // makes it a reliable "is this the bound node?" test — and it is why the
+            // inherited `dataset.ginaFormSubmitTriggerFor` cannot serve the same purpose.
+            // Assigned after the `submit.` prefix is normalised above, so it holds the
+            // same string `clickProxyHandler` compares against. Read at the :8037
+            // dispatch gate.
+            $submit.__ginaSubmitBoundFor = evt;
             addListener(gina, $submit, evt, function(event) {
                 // start validation
                 cancelEvent(event);
@@ -19137,13 +19430,39 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 , isBinded          = $form.binded
             ;
 
-            // check submit trigger status
-            var submitTrigger = new DOMParser()
-                .parseFromString($target.innerHTML, 'text/html')
-                .getElementById($formInstance.submitTrigger);
-            // prevent submit if disabled
-            if ( submitTrigger && submitTrigger.disabled) {
-                cancelEvent(e);
+            // #B308 — the disabled gate for USER GESTURES, with #B246's own predicate
+            // read from the LIVE registered trigger, and #B246's own answer (cancel +
+            // reveal). `e.isTrusted` scopes it: Enter-key submission and a wrapped-label
+            // click (`<button type="submit"><span>`, whose click target has no `.type`
+            // and so surfaces here instead of at the click proxy) arrive as trusted
+            // submits; gina's own `triggerEvent` (`$forms[id].submit()`) dispatches an
+            // untrusted CustomEvent and stays on the fresh-validate path below — a
+            // programmatic submit is not operating the control, and the fresh pass is
+            // the honest gate there. The reveal re-derives validity from live values,
+            // so a stale marker heals and the NEXT gesture goes through.
+            // Replaces the DOMParser innerHTML-copy guard below: the copy was blind to
+            // the gate's marker (then `aria-disabled`, written by
+            // updateSubmitTriggerState — since #B312 the gate marks its own
+            // `data-gina-form-submit-gated` channel) while SIGHTED on a native `disabled` written
+            // mid-dispatch by a double-submit guard — the exact attribute #B293 ruled
+            // must not count on a real form control — so a wrapped-label trigger plus
+            // a double-submit guard was a dead submit.
+            // was:
+            // // check submit trigger status
+            // var submitTrigger = new DOMParser()
+            //     .parseFromString($target.innerHTML, 'text/html')
+            //     .getElementById($formInstance.submitTrigger);
+            // // prevent submit if disabled
+            // if ( submitTrigger && submitTrigger.disabled) {
+            //     cancelEvent(e);
+            // }
+            if ($formInstance && e.isTrusted) {
+                var $registeredTrigger = document.getElementById($formInstance.submitTrigger) || null;
+                if ( isTriggerDisabled($registeredTrigger) ) {
+                    cancelEvent(e);
+                    revealValidationState($formInstance);
+                    return false;
+                }
             }
 
             // prevent event to be triggered twice
@@ -19159,12 +19478,10 @@ function ValidatorPlugin(rules, data, formId, culture) {
             // the event surfaces here instead. There is no clicked element on this path,
             // so the registered trigger is the best and only referent. Placed after the
             // disabled + defaultPrevented guards above, which both return first.
-            // NB. the disabled check at the top of this handler reads a DOMParser copy of
-            // the form's innerHTML, so it sees neither a live `disabled` set by JS nor the
-            // `aria-disabled` marker `updateSubmitTriggerState` uses. Re-check the live
-            // node with #B246's predicate: without it, every Enter-key submit on an
-            // invalid live-check form would flash the trigger armed for the length of the
-            // validation pass before the rejected branch released it.
+            // NB. the #B308 gesture gate above already cancelled any TRUSTED submit on
+            // a marked trigger, so this skip now guards the UNTRUSTED path: a
+            // programmatic submit on a marked form runs the fresh validate pass below
+            // and must not flash the trigger armed for the length of that pass.
             if ($formInstance) {
                 var $loadingTrigger = document.getElementById($formInstance.submitTrigger);
                 if ( !isTriggerDisabled($loadingTrigger) ) {
@@ -19341,6 +19658,33 @@ function ValidatorPlugin(rules, data, formId, culture) {
 
     } // EO bindForm()
 
+    /**
+     * updateSubmitTriggerState
+     *
+     * Syncs a form's registered submit trigger with the live-check verdict:
+     * while the form is invalid and live checking is on, the trigger is marked
+     * `data-gina-form-submit-gated="true"` plus a styling class (#B312); both
+     * marks are removed the moment the form validates. The marker is the
+     * framework's OWN channel — the trigger carries no ARIA disabled claim,
+     * because it stays genuinely operable: a click on a gated trigger is
+     * answered by the display-only reveal (#B246), and `isValid()` remains the
+     * real send gate.
+     *
+     * `aria-disabled` is deliberately neither written nor cleared here: an
+     * authored mark belongs to the author (the gates enforce it, and nothing
+     * here strips it), and the anchor in-flight lock's mark belongs to the
+     * settle releases in `send()`.
+     *
+     * @param {object|HTMLFormElement} $formInstanceOrTarget - form instance, or its form target
+     * @param {boolean|string} isFormValid - the fresh validity verdict
+     *
+     * @returns {void}
+     *
+     * @example
+     * updateSubmitTriggerState(instance.$forms['checkout'], true);
+     *
+     * @inner
+     */
     var updateSubmitTriggerState = function($formInstanceOrTarget, isFormValid) {
         //console.debug('submitTrigger[isFormValid='+ isFormValid +']: ', $formInstance.submitTrigger)
         var $formInstance = null; // #B176: was an implicit global (undeclared assignment)
@@ -19359,23 +19703,29 @@ function ValidatorPlugin(rules, data, formId, culture) {
         ) {
             console.warn('This might be normal, so do not worry if this form is handled by your javascript: `'+ $formInstance.id +'`\nGina could not complete `updateSubmitTriggerState()`: `submitTrigger` might not be attached to form instance `'+ $formInstance.id +'`\nTo disable this warning, You just need to disable `Form Live Checking on your form by adding to your <form>: `data-gina-form-live-check-enabled=false``')
         } else if ( document.getElementById($formInstance.submitTrigger) ) {
-            // Represent the "invalid + live-check-on" state with aria-disabled + a class
-            // INSTEAD of the native `disabled` property. A natively-disabled <button>
-            // emits no click event at all, so the click cannot be observed and the user
-            // gets no feedback about WHY the trigger is dead. aria-disabled keeps the
-            // trigger focusable and perceivable, and clickProxyHandler INTERCEPTS the
-            // click (#B246) to answer it with a display-only reveal: every invalid field
-            // is rendered and the first is focused, while the submit cycle is never
-            // entered. The trigger is therefore genuinely not operable — which is what
-            // the aria-disabled contract promises assistive tech, and what the earlier
-            // "keep it operable so the click can still validate" shape got wrong: it
-            // left the real submit path reachable from a control announced as disabled.
-            // Mirrors gina's own <a>-tag submit-trigger handling, which already uses
-            // aria-disabled in-flight. The show branch KEEPS clearing native `disabled` so a trigger
-            // rendered `disabled` in markup still enables on valid / when live-check is off.
+            // Represent the "invalid + live-check-on" state with the framework's own
+            // marker — `data-gina-form-submit-gated` + a class — INSTEAD of any
+            // disabled vocabulary (#B312). A natively-disabled <button> emits no click
+            // event at all, so the click could not be observed and the user would get
+            // no feedback about WHY nothing happens; and an ARIA disabled claim would
+            // be dishonest here — the control stays genuinely operable, keeping the
+            // trigger focusable and perceivable, and clickProxyHandler answers its
+            // clicks (#B246) with a display-only reveal: every invalid field is
+            // rendered and the first is focused, while `isValid()` remains the real
+            // send gate. `aria-disabled` is left to its two honest writers — markup or
+            // script AUTHORS (the gates enforce an authored mark, and the show branch
+            // never strips one) and the anchor in-flight lock in `send()` (armed and
+            // released at the request boundary).
+            // was (#B76, retired by #B312): the hide branch wrote an
+            // `aria-disabled="true"` claim and the show branch removed it — one
+            // attribute carrying the gate verdict, authored marks AND the in-flight
+            // lock, a sharing whose collisions produced #B309/#B311/#B313.
             // Tag-agnostic: setAttribute/classList work for both <button> and <a> submit
-            // triggers. Consumers must style the [aria-disabled="true"] /
-            // .gina-form-submit-disabled state (the framework ships no button CSS).
+            // triggers. The show branch KEEPS clearing native `disabled` so a trigger
+            // rendered `disabled` in markup still enables on valid / when live-check is off.
+            // The framework ships a default look for the gated state (see
+            // loading-state.scss); consumers may override or extend via the
+            // [data-gina-form-submit-gated="true"] / .gina-form-submit-disabled hooks.
             var $submitTrigger = document.getElementById($formInstance.submitTrigger);
             if (
                 /^true$/i.test(isFormValid)
@@ -19383,10 +19733,10 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 !/^(true)$/i.test($formInstance.target.dataset.ginaFormLiveCheckEnabled)
             ) { // show submitTrigger
                 $submitTrigger.disabled = false;
-                $submitTrigger.removeAttribute('aria-disabled');
+                $submitTrigger.removeAttribute('data-gina-form-submit-gated');
                 $submitTrigger.classList.remove('gina-form-submit-disabled');
-            } else { // hide submitTrigger (perceivable but not operable, NOT native-disabled)
-                $submitTrigger.setAttribute('aria-disabled', 'true');
+            } else { // hide submitTrigger (gated: marked not-ready, still operable)
+                $submitTrigger.setAttribute('data-gina-form-submit-gated', 'true');
                 $submitTrigger.classList.add('gina-form-submit-disabled');
             }
         }
@@ -19395,19 +19745,43 @@ function ValidatorPlugin(rules, data, formId, culture) {
     /**
      * isTriggerDisabled
      *
-     * Tells whether a submit trigger is currently marked as disabled.
-     * `updateSubmitTriggerState()` marks an invalid form's trigger with
-     * `aria-disabled="true"` rather than the native `disabled` property, so a
-     * native-only check can never see it. The predicate shape mirrors the popin
-     * plugin's own trigger gate, so both subsystems agree on what "disabled"
-     * means for a trigger.
+     * Tells whether a submit trigger must currently be refused. Three marks
+     * count, each with one honest writer (#B312): `updateSubmitTriggerState()`
+     * gates an invalid form's trigger with the framework's own
+     * `data-gina-form-submit-gated="true"` channel; an AUTHORED
+     * `aria-disabled="true"` counts and is never cleared by the framework —
+     * an author's disabled claim is enforced, not second-guessed; and the
+     * anchor in-flight lock marks `aria-disabled` for the request window. The
+     * aria/native arms keep the same shape as the popin and link plugins' own
+     * gates, so the three subsystems still agree on what an authored
+     * "disabled" means for a trigger; the gated arm is validator-only.
+     *
+     * #B293 — the native `disabled` attribute counts ONLY on an element where
+     * `disabled` is not a real IDL property. On a genuine form control the
+     * browser already suppresses the click entirely (measured: a natively
+     * disabled <button> delivers no click event to JS at all), so this gate
+     * never even runs for one — which means the only way the native arm could
+     * fire there was a listener setting the attribute DURING the dispatch. That
+     * is exactly the shape of the near-universal double-submit guard
+     * (`onclick -> this.setAttribute('disabled', …)`), which is bound to the
+     * button and therefore runs before gina's delegated proxy reaches this
+     * check. Accepting it killed the submit outright: `send()` never ran, the
+     * consumer's own handler cleared the attribute again, and every subsequent
+     * click repeated the cycle with nothing marked and a normal-looking button.
+     * On an <a> or a custom element the browser enforces nothing, so there the
+     * attribute is still the only honest signal and is still read.
      *
      * @param {object} $el - candidate trigger (DOMObject)
      *
-     * @returns {boolean} true when the trigger must not be operated
+     * @returns {boolean} true when the trigger's activation must be refused
      *
      * @example
-     * isTriggerDisabled($button); // true while aria-disabled="true" is set
+     * isTriggerDisabled($button); // true while the trigger is gated, or carries an authored aria-disabled="true"
+     *
+     * @example
+     * // <button disabled> never reaches here (the browser eats the click), and a
+     * // `disabled` set mid-click by a double-submit guard is deliberately ignored
+     * isTriggerDisabled($guardedButton); // false
      *
      * @inner
      */
@@ -19415,10 +19789,16 @@ function ValidatorPlugin(rules, data, formId, culture) {
         if ( !$el || typeof($el.getAttribute) != 'function' ) {
             return false;
         }
+        // #B293: `disabled` is only meaningful where the browser does not enforce it.
+        // was: $el.getAttribute('disabled') != null && $el.getAttribute('disabled') != 'false'
+        var nativeCounts = !('disabled' in $el);
         return (
-            $el.getAttribute('disabled') != null && $el.getAttribute('disabled') != 'false'
+            nativeCounts
+            && $el.getAttribute('disabled') != null && $el.getAttribute('disabled') != 'false'
             ||
             $el.getAttribute('aria-disabled') == 'true'
+            ||
+            $el.getAttribute('data-gina-form-submit-gated') == 'true'
         );
     };
 
@@ -19433,7 +19813,9 @@ function ValidatorPlugin(rules, data, formId, culture) {
      * than calling here. That is DELIBERATE: the inline shape is locked by source
      * pins in `test/core/validator-aria-invalid.test.js` (`_a11yErrs`, `_aField`),
      * so collapsing the two would break pins unrelated to #B246. Keep the two in
-     * step if the focus rule ever changes.
+     * step if the focus rule ever changes — as #B319 did: both sites raise the
+     * answer-focus exemption around their loop, so delivering the answer cannot
+     * be mistaken for the user editing the field.
      *
      * @param {object} $form - form target (DOMObject), not the instance
      * @param {object} errors - error map keyed by field name
@@ -19449,29 +19831,37 @@ function ValidatorPlugin(rules, data, formId, culture) {
         if ( !$form || !errors ) {
             return false;
         }
-        for (var i = 0, len = $form.length; i < len; ++i) {
-            var $field  = $form[i];
-            var name    = $field.getAttribute('name');
-            if (
-                name
-                && typeof(errors[name]) != 'undefined'
-                && ( typeof(errors[name].count) != 'function' || errors[name].count() > 0 )
-                && $field.type != 'hidden'
-                && typeof($field.focus) == 'function'
-            ) {
-                $field.focus();
-                // #A11Y5 (V8) — `typeof focus == 'function'` is true for EVERY HTMLElement,
-                // a custom element with neither `tabindex` nor `delegatesFocus` included,
-                // whose focus() is a silent no-op (measured). Without confirming the move,
-                // the loop reported success and stopped on a control that never took focus,
-                // so a failed submit announced nothing. Confirming it is also what makes the
-                // "skips unfocusable controls" contract above true rather than aspirational.
-                if ( typeof(document) === 'undefined' || !document || document.activeElement === $field ) {
-                    return true;
+        // #B319 — raise the one-shot answer-focus exemption so the synchronous
+        // `focusin` dispatched by `$field.focus()` below cannot re-enter the
+        // live-check suppression and hide the message this answer just rendered.
+        isAnswerFocusInProgress = true;
+        try {
+            for (var i = 0, len = $form.length; i < len; ++i) {
+                var $field  = $form[i];
+                var name    = $field.getAttribute('name');
+                if (
+                    name
+                    && typeof(errors[name]) != 'undefined'
+                    && ( typeof(errors[name].count) != 'function' || errors[name].count() > 0 )
+                    && $field.type != 'hidden'
+                    && typeof($field.focus) == 'function'
+                ) {
+                    $field.focus();
+                    // #A11Y5 (V8) — `typeof focus == 'function'` is true for EVERY HTMLElement,
+                    // a custom element with neither `tabindex` nor `delegatesFocus` included,
+                    // whose focus() is a silent no-op (measured). Without confirming the move,
+                    // the loop reported success and stopped on a control that never took focus,
+                    // so a failed submit announced nothing. Confirming it is also what makes the
+                    // "skips unfocusable controls" contract above true rather than aspirational.
+                    if ( typeof(document) === 'undefined' || !document || document.activeElement === $field ) {
+                        return true;
+                    }
                 }
             }
+            return false;
+        } finally {
+            isAnswerFocusInProgress = false;
         }
-        return false;
     };
 
     /**
@@ -20186,6 +20576,27 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                     // trigger end of validation
                                     // console.debug(field +' is the last element to be validated for formId: '+ formId, cb._errors, instance.$forms[formId].errors);
                                     isFormValid = ( cb._errors.count() > 0 ) ? false : true;
+                                    // #B295 — `cb._errors` is `d.getErrors(field)`, which
+                                    // form-validator.js scopes to a SINGLE field, so the flag
+                                    // above means "this field passed", never "the form is
+                                    // valid". Everything below is guarded on `!isFormValid`,
+                                    // so a form that has just become valid got NO update at
+                                    // all: `updateSubmitTriggerState` was never called and the
+                                    // bind-time `aria-disabled` marker survived on a valid
+                                    // form, while `$forms[id].errors` kept listing the field.
+                                    // That was cosmetic until #B246 made the click gate read
+                                    // the marker — then the first click after the query
+                                    // settles is silently eaten.
+                                    // Hand the verdict to the fresh whole-form pass below,
+                                    // exactly as the not-last-field branch already does. It is
+                                    // the only source that can be trusted here: measured with
+                                    // another field left invalid, that pass reports its error
+                                    // while both the field-scoped `cb._errors` AND the in-pass
+                                    // `d.getErrors()` report none — so deciding from either of
+                                    // those would enable the trigger on an invalid form.
+                                    if (isFormValid) {
+                                        needsGlobalReValidation = true;
+                                    }
                                     if (!isFormValid && /^true|false$/i.test(instance.$forms[formId].isValidating)) {
                                         console.debug('[1] Should update error display now ', cb._errors);
                                         instance.$forms[formId].errors = merge(cb._errors, instance.$forms[formId].errors);
@@ -21793,9 +22204,18 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
          * @param {object} $popin - the registered popin.
          * @param {function} [onMiss] - the caller's click-time load, run only if an adopted
          *   in-flight preload ends up failing.
+         * @param {function} [onSettled] - #B285: fired when this consume stops owing
+         *   anything — synchronously after a ready (cached) apply, or when an adopted
+         *   in-flight preload resolves (success AND failure, before the body/miss
+         *   handling — the same release-before-apply order as popinLoad's readyState-4
+         *   site). Deliberately a bare notifier: the CALLERS own any busy affordance,
+         *   so this function stays loading-state-agnostic.
          * @returns {boolean} true if the preload was (or will be) consumed.
          */
-        function consumePreload(url, $popin, onMiss) {
+        function consumePreload(url, $popin, onMiss, onSettled) {
+            var _settle = function () {
+                if ( typeof(onSettled) == 'function' ) { onSettled(); }
+            };
             var slot = preloadCache[url];
             if ( typeof(slot) == 'undefined' ) {
                 return false;
@@ -21812,6 +22232,9 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                     preloadWaiters[url] = [];
                 }
                 preloadWaiters[url].push(function (body) {
+                    // #B285 — the adopted wait is over (body or failure): settle FIRST,
+                    // matching the cold path's release-before-apply order.
+                    _settle();
                     if ( body == null ) {
                         if ( typeof(onMiss) == 'function' ) { onMiss(); }
                     } else {
@@ -21834,6 +22257,10 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
             var $el = ensurePopinDialog($popin);
             if (GINA_ENV_IS_DEV) { updateToolbar(body); }
             handleLoadedBody(body, $popin, $el);
+            // #B285 — synchronous settle: tells the caller no wait ever began, so it
+            // must not arm. Load-bearing, not politeness: without this the caller
+            // could not distinguish ready from in-flight and would arm forever.
+            _settle();
             return true;
         }
 
@@ -22108,7 +22535,17 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
          */
         function openFromTrigger($trigger) {
             if (
-                $trigger.getAttribute('disabled') != null && $trigger.getAttribute('disabled') != 'false'
+                // #B296: the native `disabled` attribute is only meaningful where the browser
+                // does NOT enforce it. On a real form control the browser suppresses the click
+                // outright (measured: 0 clicks reach JS), so this arm could only ever fire on a
+                // `disabled` written DURING the dispatch — the shape of every consumer
+                // double-submit guard — which silently ate the open and left nothing marked.
+                // Elements the browser does not enforce (`<a>`, custom elements, spans) keep it,
+                // which is also what still honours armPopinTrigger's own `:1923` native write on
+                // a non-<a> trigger. Mirrors the validator's isTriggerDisabled (#B293).
+                // was: $trigger.getAttribute('disabled') != null && ... != 'false'
+                !('disabled' in $trigger)
+                && $trigger.getAttribute('disabled') != null && $trigger.getAttribute('disabled') != 'false'
                 || $trigger.getAttribute('aria-disabled') == 'true'
             ) {
                 return;
@@ -22161,7 +22598,26 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                 // sibling trigger's warm), so skip the consume entirely — its GET
                 // always happens at open time.
                 var _noPreload = /^false$/i.test($trigger.getAttribute('data-gina-dialog-preload'));
-                if ( !_noPreload && consumePreload(descriptor.src, existing, onMiss) ) {
+                // #B285 — an ADOPTED in-flight preload is a genuine wait: arm the trigger
+                // for its duration exactly as the cold click-time XHR does, and release
+                // when the adoption settles (the failure leg re-arms through popinLoad's
+                // own path). The ready branch settles synchronously inside consumePreload,
+                // so _adoptedWait is already false when it returns and nothing is armed —
+                // nothing is owed when nothing is waited for.
+                var _adoptedWait = true;
+                var _armedForAdoption = false;
+                var _onAdoptionSettled = function () {
+                    _adoptedWait = false;
+                    if (_armedForAdoption) {
+                        _armedForAdoption = false;
+                        releasePopinTrigger($trigger);
+                    }
+                };
+                if ( !_noPreload && consumePreload(descriptor.src, existing, onMiss, _onAdoptionSettled) ) {
+                    if (_adoptedWait) {
+                        armPopinTrigger($trigger);
+                        _armedForAdoption = true;
+                    }
                     return;
                 }
                 onMiss();
@@ -22269,6 +22725,30 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                         // attach click events
                         addListener(gina, $el, evt, function(e) {
                             cancelEvent(e);
+                            // #B298 — the legacy twin of openFromTrigger's own entry gate; the
+                            // predicate is copied verbatim from there, native arm included (see
+                            // its comment for why `disabled` counts only where the browser does
+                            // not enforce it). armPopinTrigger marks an <a> trigger
+                            // `aria-disabled` for the duration of the load, but the only dispatch
+                            // route for a legacy trigger — the document click proxy — tests the
+                            // native attribute alone, which an <a> never carries; a second click
+                            // during the load therefore reached here and started a second XHR.
+                            //
+                            // Gating HERE rather than in the proxy is load-bearing, not stylistic:
+                            // a trigger's direct children each get their own listener from
+                            // proxyClick, which fires the custom event DIRECTLY and never passes
+                            // the proxy predicate at all. Both routes converge on this handler,
+                            // and `currentTarget` is the element bindOpen bound, so a click that
+                            // lands on child markup cannot dodge the gate. Measured: a
+                            // proxy-level gate still let the child-click route fire twice.
+                            var $trigger = e.currentTarget;
+                            if (
+                                !('disabled' in $trigger)
+                                && $trigger.getAttribute('disabled') != null && $trigger.getAttribute('disabled') != 'false'
+                                || $trigger.getAttribute('aria-disabled') == 'true'
+                            ) {
+                                return;
+                            }
                             // console.debug("[POPIN CLICK #3]", $popin.openTrigger, " VS ", e.currentTarget.id);
                             $popin.openTrigger = e.currentTarget.id || e.currentTarget.getAttribute('id');
 
@@ -22315,7 +22795,24 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                             // always-refetch means the GET happens at open time, never from
                             // the cache (see the openFromTrigger twin).
                             var _noPreload = /^false$/i.test(this.getAttribute('data-gina-dialog-preload'));
-                            if ( !_noPreload && consumePreload(url, $popin, doLoad) ) {
+                            // #B285 — same adopted-wait arm as the openFromTrigger twin: a
+                            // click adopting a still-in-flight preload waits for real; arm
+                            // for the wait, release on settle (a failed adoption's doLoad
+                            // re-arms through popinLoad's own path).
+                            var _adoptedWait = true;
+                            var _armedForAdoption = false;
+                            var _onAdoptionSettled = function () {
+                                _adoptedWait = false;
+                                if (_armedForAdoption) {
+                                    _armedForAdoption = false;
+                                    releasePopinTrigger($trigger);
+                                }
+                            };
+                            if ( !_noPreload && consumePreload(url, $popin, doLoad, _onAdoptionSettled) ) {
+                                if (_adoptedWait) {
+                                    armPopinTrigger($trigger);
+                                    _armedForAdoption = true;
+                                }
                                 return;
                             }
                             doLoad();
@@ -22344,7 +22841,15 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
             // for proxies, use popinInstance.id as target is always `document`
             addListener(gina, document, evt, function(event) {
 
-                if ( event.target.getAttribute('disabled') != null && event.target.getAttribute('disabled') != 'false' ) {
+                // #B296: native `disabled` counts only where the browser does not enforce it —
+                // see the openFromTrigger gate for the full rationale. This is the SOLE dispatch
+                // path for legacy `data-gina-popin-name` triggers (bindDelegatedOpen returns
+                // early for them at the `data-gina-dialog` check), so the same guard shape is
+                // latent here. Reachability of THIS site was traced, not exercised.
+                if (
+                    !('disabled' in event.target)
+                    && event.target.getAttribute('disabled') != null && event.target.getAttribute('disabled') != 'false'
+                ) {
                     return false;
                 }
 
@@ -22434,7 +22939,16 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                 addListener(gina, $element, 'click', function(event) {
                     cancelEvent(event);
                     // ignore disabled
-                    if ( event.target.getAttribute('disabled') != null && event.target.getAttribute('disabled') != 'false' ) {
+                    // #B296: native `disabled` counts only where the browser does not enforce it —
+                    // see the openFromTrigger gate. MEASURED reachable here: an in-popin
+                    // `.gina-popin-close` <button> plus a CAPTURE-phase consumer guard leaves the
+                    // popin open with nothing marked. A target-phase guard bound after gina's own
+                    // listener (:1327) does NOT reproduce it — gina runs first — so this site is
+                    // narrower than openFromTrigger's, but real.
+                    if (
+                        !('disabled' in event.target)
+                        && event.target.getAttribute('disabled') != null && event.target.getAttribute('disabled') != 'false'
+                    ) {
                         return false;
                     }
                     // NB.: `type == 'action'` will be handled by the form validator
@@ -22463,14 +22977,33 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                             event.target.id = event.target.getAttribute('id')
                         }
 
-                        if ( /^popin\.close\./.test(event.target.id) ) {
+                        // #B299/#B301: reaching this branch ALREADY proves the element is a
+                        // `.gina-popin-close` — register('close', …) has a single call site, fed
+                        // only from `$el.querySelectorAll('.gina-popin-close')`. Re-deriving that
+                        // fact from the id prefix was the defect twice over: a consumer-supplied
+                        // id matches neither prefix (#B299), and `event.target` is whatever was
+                        // actually CLICKED, so an icon nested inside the button matched neither
+                        // either (#B301 — the ordinary `<button class="gina-popin-close"><svg/></button>`
+                        // shape, and the wider of the two). Both left the button inert and silent,
+                        // since `cancelEvent` at the top of this listener had already swallowed the
+                        // default. So read the element `register()` actually bound —
+                        // `event.currentTarget` — and treat a `popin.click.*` id as the SOLE
+                        // exception, which preserves the dual-role element (a trigger that is also
+                        // a close button; `bindOpen` scans the whole document, so it is reachable)
+                        // exactly as before.
+                        // The element's id is deliberately NOT touched: the `$close` teardown
+                        // sweep removes this listener via `gina.events[eId] == eId`, i.e. it
+                        // depends on the event name and the element id being the same string.
+                        var _isClickTrigger = /^popin\.click\./.test(event.currentTarget.id);
+
+                        if ( !_isClickTrigger ) {
                             cancelEvent(event);
                             // Just in case we left the popin with a link:target = _blank
                             $popin.isRedirecting = false;
                             popinClose($popin.name);
                         }
 
-                        if ( /^popin\.click\./.test(event.target.id) ) {
+                        if ( _isClickTrigger ) {
                             cancelEvent(event);
                             var _evt = event.target.id;
 
@@ -22998,6 +23531,34 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
             loadingState.arm($popinTrigger);
         }
 
+        /**
+         * releasePopinTrigger
+         *
+         * armPopinTrigger's mirror: removes the attribute the arm set
+         * (`aria-disabled` on an `<a>`, native `disabled` everywhere else) and
+         * releases the shared `data-gina-loading` marker. Same shape as
+         * popinLoad's own readyState-4 release; used by the adopted-preload
+         * wait (#B285), whose release has no XHR of its own to hang it on.
+         *
+         * @inner
+         * @param {HTMLElement} [$popinTrigger] - the control armPopinTrigger marked
+         * @returns {void}
+         *
+         * @example
+         * releasePopinTrigger($popinTrigger);
+         */
+        function releasePopinTrigger($popinTrigger) {
+            if ( !$popinTrigger ) {
+                return;
+            }
+            if ( /^A$/i.test($popinTrigger.tagName) ) {
+                $popinTrigger.removeAttribute('aria-disabled');
+            } else {
+                $popinTrigger.removeAttribute('disabled');
+            }
+            loadingState.disarm($popinTrigger);
+        }
+
         /**
          * popinLoad
          *
@@ -23786,14 +24347,36 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                     loadingState.disarm( document.getElementById($popin.openTrigger) );
 
                     // removing from FormValidator instance
-                    if ($validatorInstance) {
-                        var i = 0, formsLength = $popin['$forms'].length;
-                        if ($validatorInstance['$forms'] && formsLength > 0) {
-                            for (; i < formsLength; ++i) {
-                                if ( typeof($validatorInstance['$forms'][ $popin['$forms'][i] ]) != 'undefined' )
-                                    $validatorInstance['$forms'][ $popin['$forms'][i] ].destroy();
-
-                                $popin['$forms'].splice( i, 1);
+                    if ($validatorInstance && $validatorInstance['$forms']) {
+                        // #B265: iterate a COPY, and clear the array ONCE. The previous loop
+                        // spliced `$popin['$forms']` while walking it against a length captured
+                        // BEFORE the loop, so every element shifted left under the cursor and the
+                        // read index skipped one each time: the originally odd-indexed forms were
+                        // never destroyed AND were left behind in the very array the loop exists
+                        // to empty. Their validator entries then survived pointing at nodes the
+                        // `innerHTML = ''` above had already detached, so `validateFormById`
+                        // returned the stale entry on the next open and the form — trigger
+                        // included — was silently never re-bound.
+                        var _formIds = $popin['$forms'].slice();
+                        $popin['$forms'].length = 0;
+                        for (var i = 0, _formIdsLen = _formIds.length; i < _formIdsLen; ++i) {
+                            var $formToDestroy = $validatorInstance['$forms'][ _formIds[i] ];
+                            if ( typeof($formToDestroy) == 'undefined' ) {
+                                continue;
+                            }
+                            try {
+                                $formToDestroy.destroy();
+                            } catch (destroyErr) {
+                                // One form must never abort the teardown of the others.
+                                // `destroy()` -> `unbindForm` -> `getFormById(vFormId)` throws for
+                                // a form holding a `data-gina-form-virtual` file input whose
+                                // virtual form is no longer resolvable — and by this point every
+                                // form here is detached, which is exactly when that lookup fails.
+                                // This hazard is PRE-EXISTING, not introduced by the fix above:
+                                // before it, a throw here silently left every LATER form bound.
+                                if ( typeof(console) != 'undefined' && console.warn ) {
+                                    console.warn('[gina] popin teardown: destroy() failed for form `' + _formIds[i] + '`', destroyErr);
+                                }
                             }
                         }
                     }
@@ -27150,8 +27733,9 @@ if ( ( typeof(module) !== 'undefined' ) && module.exports ) {
  *
  *      <script type="text/javascript" src="/js/vendor/gina/gina.min.js"></script>
  *
- *  You can add or edit config options through the `data-gina-config`
- *      <script type="text/javascript" src="/js/vendor/gina/gina.min.js" data-gina-config="{ env: 'dev', envIsDev: true, webroot: '/' }"></script>
+ *  Config options come from the server-rendered page environment. Once the
+ *  framework has loaded, option properties can be added or overridden through
+ *      gina.setOptions({ ... })
  *
  *  Through RequireJS
  *