gina 0.6.6 → 0.6.7

package/framework/{v0.6.6 → v0.6.7}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -3302,7 +3302,22 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         //  - previous error detected
         if ( !self.isValid() ) {
             console.debug('stopping on errors ...');
-            triggerEvent(gina, this.target, 'asyncCompleted.' + id, self[this['name']]);
+            // #B338 — release ASYNCHRONOUSLY. A synchronous trigger fires the
+            // completion waiter MID-FIELD-LOOP (inside this very field's rule
+            // application), so the pass composed its payload before LATER
+            // fields were adjudicated — a field declared after the query field
+            // vanished from the submit verdict, its rendered error was then
+            // CLEARED by the render pass, and the outcome depended on field
+            // ORDER. A microtask runs once the call stack empties — after the
+            // whole field loop and its terminal block — which is exactly the
+            // shape a real XHR settle already has: one completion timing for
+            // every release path. (`_skipTarget`/`_skipField` are snapshotted:
+            // `this` is not the field object inside the deferred call.)
+            // was: triggerEvent(gina, this.target, 'asyncCompleted.' + id, self[this['name']]);
+            var _skipTarget = this.target, _skipFieldName = this['name'];
+            queueMicrotask(function deferredKnownInvalidRelease() {
+                triggerEvent(gina, _skipTarget, 'asyncCompleted.' + id, self[_skipFieldName]);
+            });
             //return self[this.name];
             return;
         }
@@ -3337,6 +3352,20 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
 
             }
         } else if (testedValue === this.value) {
+            // #B332 — while an XHR for this very (field, value) is still IN FLIGHT the
+            // cache below has no verdict yet, and the immediate release at the end of
+            // this branch woke every armed waiter with a verdict-less field object —
+            // the submit pass then completed on its sync-only rules and sent while the
+            // authoritative answer was still on the wire. Do nothing here: the pending
+            // request's settle (processQueryResult / releaseQueryWaiter — both clear
+            // the marker first) triggers `asyncCompleted.<id>` and wakes every waiter
+            // with the real verdict. Marker is set right before xhr.send() below.
+            if (
+                this.target && this.target.dataset
+                && this.target.dataset.ginaFormValidatorQueryPending === this.value
+            ) {
+                return self[this.name];
+            }
             // not resending to backend, but in case of cached errors, re display same error message
             var hasCachedErrors = false;
             if (
@@ -3357,7 +3386,18 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             }
             // Do not remove this test
             if ( typeof( gina.events[_evt]) != 'undefined' ) {
-                triggerEvent(gina, this.target, _evt, self[this['name']]);
+                // #B338 — same deferral as the known-invalid release above: a
+                // cached-verdict re-check fires synchronously mid-field-loop,
+                // and the waiter it wakes must not compose the pass verdict
+                // before the remaining fields are adjudicated (measured: the
+                // second click on an unchanged registered value delivered a
+                // payload missing every field declared after the query field,
+                // clearing their rendered errors).
+                // was: triggerEvent(gina, this.target, _evt, self[this['name']]);
+                var _cacheTarget = this.target, _cacheFieldName = this['name'];
+                queueMicrotask(function deferredCachedVerdictRelease() {
+                    triggerEvent(gina, _cacheTarget, _evt, self[_cacheFieldName]);
+                });
             }
 
             return self[this.name];
@@ -3492,6 +3532,17 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
 
         var processQueryResult = function(result) {
 
+            // #B332 — this request has settled: release the in-flight marker BEFORE any
+            // processing (a throw below routes to releaseQueryWaiter, which also clears).
+            // Value-guarded so a newer request's marker — a keystroke re-fired the query
+            // while this one was on the wire — is never cleared by a stale settle.
+            if (
+                _this.target && _this.target.dataset
+                && _this.target.dataset.ginaFormValidatorQueryPending === String(_this.value)
+            ) {
+                delete _this.target.dataset.ginaFormValidatorQueryPending;
+            }
+
             // #B87: a boolean checkbox routed through a `query` rule carries a real
             // boolean — `.toLowerCase()` only applies to string values
             _this.value      = local['data'][_this.name] = (_this.value && typeof(_this.value) == 'string') ? _this.value.toLowerCase() : _this.value;
@@ -3622,6 +3673,17 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
          */
         var releaseQueryWaiter = function(err) {
             console.warn('[ FormValidator ] `query` result handling failed for field `'+ (_this && _this.name) +'`: '+ ( err && err.message || err ));
+            // #B332 — the failed settle still ends this request: clear the in-flight
+            // marker (value-guarded, same as processQueryResult) or the same-value
+            // fast path would treat the field as pending forever.
+            try {
+                if (
+                    _this.target && _this.target.dataset
+                    && _this.target.dataset.ginaFormValidatorQueryPending === String(_this.value)
+                ) {
+                    delete _this.target.dataset.ginaFormValidatorQueryPending;
+                }
+            } catch (ignorePendingClear) {}
             try {
                 var _releaseId = _this.target && (_this.target.id || _this.target.getAttribute('id'));
                 if (_releaseId) {
@@ -3761,6 +3823,13 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                 }
             }// xhr.onload = function () {
 
+            // #B332 — mark the (field, value) as in flight BEFORE the wire call: the
+            // same-value fast path above must not immediate-release a verdict-less
+            // field while this request is pending. Cleared at both settle chokepoints
+            // (processQueryResult / releaseQueryWaiter), value-guarded.
+            if ( _this.target && _this.target.dataset ) {
+                _this.target.dataset.ginaFormValidatorQueryPending = _this.value;
+            }
             if (data) {
                 xhr.send( queryData ); // stringyfied
             }  else {
@@ -4097,15 +4166,14 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                         }
 
                         try {
-                            // security checks
-                            compiledCondition = compiledCondition.replace(/(\(|\)|return)/g, '');
                             // #SCS1e (2026-04-24) — replaced the two `eval(...)` calls below with
-                            // auditable equivalents. After `$var` substitution (lines 910-920) and
-                            // paren/return strip above, `compiledCondition` is either:
+                            // auditable equivalents. After `$var` substitution (lines 910-920),
+                            // `compiledCondition` is either:
                             //   (a) a regex literal `/<body>/<flags>` (when `/^\//` matches), or
                             //   (b) a binary comparison `<operand><op><operand>` where operand ∈
                             //       {number, "string", true, false, null, undefined} and op ∈
-                            //       {===, !==, ==, !=, <, >, <=, >=}.
+                            //       {===, !==, ==, !=, <, >, <=, >=} — paren/`return`-stripped
+                            //       inside its branch, before the grammar match.
                             // Old eval executed arbitrary JS; any value reaching `$var` substitution
                             // that contained a quote (e.g. user input `bar"; process.exit();//`)
                             // could escape the `"..."` wrapper at line 916 and reach eval as
@@ -4116,6 +4184,18 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                             // } else {
                             //     isValid = eval(compiledCondition)
                             // }
+                            // #B345 — the paren/`return` strip used to run HERE, before the branch
+                            // decision, so it also mangled every parenthesized regex literal:
+                            // groups were destroyed (`^(a|b)$` compiled as `^a|b$`, rebinding the
+                            // anchors and turning middle alternatives substring-permissive),
+                            // quantified groups were requantified (`(#TAG)?` became `#TA` plus an
+                            // optional `G`), and a literal `return` inside a pattern was deleted —
+                            // all silently, because the stripped text still compiled as a valid
+                            // regex. The strip protects the BINARY-COMPARISON shape only, so it
+                            // now lives inside that branch; the regex branch never evaluates the
+                            // condition as JS (`new RegExp(body, flags).test(value)` — no eval),
+                            // so parentheses there are legitimate syntax and a regex literal is
+                            // compiled exactly as authored.
                             if ( /^\//.test(compiledCondition) ) {
                                 var _scsRegexMatch = compiledCondition.match(/^\/(.+)\/([a-z]*)$/);
                                 if (!_scsRegexMatch) {
@@ -4123,6 +4203,10 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
                                 }
                                 isValid = new RegExp(_scsRegexMatch[1], _scsRegexMatch[2]).test(this.value);
                             } else {
+                                // security checks (#SCS1e) — strip parens/`return` before the
+                                // grammar-locked match; authored parens in a comparison stay
+                                // tolerated (`("a") === ("a")` strips to `"a" === "a"`).
+                                compiledCondition = compiledCondition.replace(/(\(|\)|return)/g, '');
                                 var _SCS_BINARY_RE = /^\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*(===|!==|<=|>=|==|!=|<|>)\s*(null|undefined|true|false|"[^"]*"|-?\d+(?:\.\d+)?)\s*$/;
                                 var _scsBinMatch = (typeof(compiledCondition) == 'string') ? compiledCondition.match(_SCS_BINARY_RE) : null;
                                 if (!_scsBinMatch) {
@@ -17399,21 +17483,28 @@ function ValidatorPlugin(rules, data, formId, culture) {
         // filter also excludes in-tree descendants whose `form="..."` points at a different
         // form (parent-form contamination guard).
         var getOwnedElements = function($form, tag) {
+            // #B333 — dedup by NODE IDENTITY, not by id. The old `seen` table was
+            // id-keyed, so an ID-LESS control already collected from `$form.elements`
+            // was pushed a second time by the in-tree sweep (`!$el.id` passed the old
+            // condition unconditionally). For an id-less `<button type=submit>` —
+            // gina auto-assigns its id only later, in the submit-binding loop — the
+            // double entry meant `bindSubmitEl` ran twice and every click executed
+            // TWO full validate()+send() cycles. `arr.indexOf($el)` is an identity
+            // test, so the same node can never enter twice regardless of id state.
             var arr  = []
-                , seen = {}
                 , tagUpper = tag.toUpperCase()
             ;
             for (let i = 0, len = $form.elements.length; i < len; i++) {
                 let $el = $form.elements[i];
                 if ($el.tagName === tagUpper) {
                     arr.push($el);
-                    if ($el.id) seen[$el.id] = true;
                 }
             }
             var inTree = $form.getElementsByTagName(tag);
             for (let i = 0, len = inTree.length; i < len; i++) {
                 let $el = inTree[i];
-                if ($el.form === $form && (!$el.id || !seen[$el.id])) {
+                // was: if ($el.form === $form && (!$el.id || !seen[$el.id])) {
+                if ($el.form === $form && arr.indexOf($el) === -1) {
                     arr.push($el);
                 }
             }
@@ -19035,7 +19126,18 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     // (which is what the operable-trigger design was bought for).
                     // Checked on the CLICKED element, not `$formInstance.submitTrigger`:
                     // a form may carry several submit buttons and only one registers.
-                    if ( /^submit\./i.test(_evt) && isTriggerDisabled($el) ) {
+                    //
+                    // #B346 carve-out — when the gate's ONLY reason is a `query` verdict
+                    // still on the wire (framework gated mark alone, no committed errors,
+                    // in-flight marker present), the reveal has NOTHING to reveal and the
+                    // refusal ate the click silently. Let that one state through: the
+                    // normal submit cycle latches, arms its waiter, and the pending
+                    // settle completes it (#B342) — valid ⇒ send, invalid ⇒ render +
+                    // release. Every other refusal shape is unchanged.
+                    if (
+                        /^submit\./i.test(_evt) && isTriggerDisabled($el)
+                        && !isAwaitingQueryVerdictOnly($el, $target, instance.$forms[$form.id] || $form)
+                    ) {
                         cancelEvent(event);
                         revealValidationState( instance.$forms[$form.id] || $form );
                         return false;
@@ -19290,6 +19392,21 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 // start validation
                 cancelEvent(event);
 
+                // #B332 belt — one submit cycle at a time per form. `isSubmitting`
+                // latches below (before validate()) and is released on the XHR settle
+                // AND on the rejected-validation branch (#B192), so a truthy read here
+                // means a full cycle is still between click and settle: refuse the
+                // re-entry (a re-click while a query rule's XHR is in flight, or a
+                // residual duplicate listener on an older bundle) instead of racing
+                // two concurrent cycles against the same form state.
+                var _latchFormId = $target.getAttribute('id');
+                if (
+                    typeof(instance.$forms[_latchFormId]) != 'undefined'
+                    && /^true$/i.test(instance.$forms[_latchFormId].isSubmitting)
+                ) {
+                    return;
+                }
+
                 // getting fields & values
                 var $fields         = {}
                     , fields        = { '_length': 0 }
@@ -19456,7 +19573,20 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 evt = $submit['id'];
             }
 
-            if ( typeof(gina.events[evt]) == 'undefined' || gina.events[evt] != $submit.id ) {
+            // #B333 — the guard used to test `gina.events[evt]` where `evt` is the
+            // BUTTON id (`click.<uuid>`), a key nothing ever writes: `bindSubmitEl`
+            // registers under the NAMESPACED name (`submit.<id>`). The test was
+            // therefore always true and every extra pass over the same button (the
+            // id-less double-collection fixed in `getOwnedElements`, a re-bind path)
+            // stacked one more live listener -> one more full validate()+send() cycle
+            // per click. Test the key that actually gets registered, against the id
+            // the registry stores. (A trigger REPLACED in the DOM keeps the registry
+            // key but loses the expando marker — the #B294 click-time gate re-binds
+            // that case; this guard only has to stop same-node re-binds.)
+            // was:
+            // if ( typeof(gina.events[evt]) == 'undefined' || gina.events[evt] != $submit.id ) {
+            var _submitEvt = ( /^submit\./i.test(evt) ) ? evt : 'submit.'+ evt;
+            if ( typeof(gina.events[_submitEvt]) == 'undefined' || gina.events[_submitEvt] != $submit.id ) {
                 bindSubmitEl(evt, $submit);
             }
 
@@ -19501,7 +19631,15 @@ function ValidatorPlugin(rules, data, formId, culture) {
             // }
             if ($formInstance && e.isTrusted) {
                 var $registeredTrigger = document.getElementById($formInstance.submitTrigger) || null;
-                if ( isTriggerDisabled($registeredTrigger) ) {
+                // #B346 — same carve-out as the click proxy's gate: when the ONLY
+                // refusal reason is a query verdict still on the wire, refusing
+                // here ate Enter-key and wrapped-label submits silently (nothing
+                // committed to reveal). Let the pass run and wait for the settle;
+                // every other refusal shape is unchanged.
+                if (
+                    isTriggerDisabled($registeredTrigger)
+                    && !isAwaitingQueryVerdictOnly($registeredTrigger, $target, $formInstance)
+                ) {
                     cancelEvent(e);
                     revealValidationState($formInstance);
                     return false;
@@ -19522,12 +19660,19 @@ function ValidatorPlugin(rules, data, formId, culture) {
             // so the registered trigger is the best and only referent. Placed after the
             // disabled + defaultPrevented guards above, which both return first.
             // NB. the #B308 gesture gate above already cancelled any TRUSTED submit on
-            // a marked trigger, so this skip now guards the UNTRUSTED path: a
-            // programmatic submit on a marked form runs the fresh validate pass below
-            // and must not flash the trigger armed for the length of that pass.
+            // a marked trigger (#B346 excepted: a pending-verdict-only refusal now
+            // proceeds, and the arm below covers it via the same carve-out), so this
+            // skip otherwise guards the UNTRUSTED path: a programmatic submit on a
+            // marked form runs the fresh validate pass below and must not flash the
+            // trigger armed for the length of that pass.
             if ($formInstance) {
                 var $loadingTrigger = document.getElementById($formInstance.submitTrigger);
-                if ( !isTriggerDisabled($loadingTrigger) ) {
+                // #B346 — a pending-verdict bypass proceeds to a real cycle, so it
+                // gets the loading state too (#B247 parity with the click proxy).
+                if (
+                    !isTriggerDisabled($loadingTrigger)
+                    || isAwaitingQueryVerdictOnly($loadingTrigger, $target, $formInstance)
+                ) {
                     armSubmitLoading($formInstance, $loadingTrigger);
                 }
             }
@@ -19637,6 +19782,36 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 } else {
                     rule = getRuleObjByName(id.replace(/\-/g, '.'))
                 }
+                // #B346 — this pass may proceed while an async query verdict is
+                // still on the wire: the pending-aware gate above lets a trusted
+                // gesture through, and a programmatic submit() never consulted
+                // the gate at all. An un-latched async pass STARVES — with the
+                // query field not declared last, its waiter's completion resolves
+                // to the needsGlobalReValidation display-only work and never runs
+                // this callback. Latch exactly as bindSubmitEl does, so the
+                // latched completion dispatches (#B342) — and mirror the #B332
+                // belt for the window this pass now enters: one cycle at a time.
+                // The owned-field scan mirrors isAwaitingQueryVerdictOnly's
+                // (kept inline THERE — its body literals are pinned); trigger
+                // marks and recorded errors are deliberately not consulted here,
+                // because they do not affect LATCH soundness: an invalid pass
+                // completes through the errors branch and releases via the
+                // rejected-validation release, a clean pass through the latched
+                // dispatch and the send release.
+                var _pendingSel = '[data-gina-form-validator-query-pending]';
+                var _formDomId = $target.id || ( typeof($target.getAttribute) == 'function' ? $target.getAttribute('id') : null );
+                var _safeFormDomId = ( _formDomId && typeof(CSS) != 'undefined' && typeof(CSS.escape) == 'function' ) ? CSS.escape(_formDomId) : _formDomId;
+                var _awaitsQueryVerdict = (
+                    typeof($target.querySelector) == 'function' && $target.querySelector(_pendingSel)
+                    || _safeFormDomId && document.querySelector('[form="'+ _safeFormDomId +'"]'+ _pendingSel)
+                ) ? true : false;
+                if (_awaitsQueryVerdict) {
+                    if ( /^true$/i.test(instance.$forms[id].isSubmitting) ) {
+                        return false;
+                    }
+                    instance.$forms[id].isSubmitting = true;
+                    instance.$forms[id].isSending = false;
+                }
                 instance.$forms[id].isValidating = true;
                 validate($target, fields, $fields, rule, function onSubmitValidation(result){
                     instance.$forms[id].isValidating = false;
@@ -19647,6 +19822,12 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     // } else {
                         // handleErrorsDisplay($target, result.error, result.data);
                         if ( typeof(gina.events['submit.' + id]) != 'undefined' ) { // if `on('submit', cb)` is binded
+                            // #B346 — a consumer's own `on('submit')` handler owns
+                            // the rest of the cycle and may never reach send():
+                            // the latch cannot ride this dispatch (a stopping
+                            // handler would strand it — the #B342 lockout shape).
+                            // False -> false when this pass never latched.
+                            instance.$forms[id].isSubmitting = false;
                             triggerEvent(gina, $target, 'submit.' + id, result);
                         } else {
                             triggerEvent(gina, $target, 'validate.' + id, result);
@@ -19710,8 +19891,10 @@ function ValidatorPlugin(rules, data, formId, culture) {
      * marks are removed the moment the form validates. The marker is the
      * framework's OWN channel — the trigger carries no ARIA disabled claim,
      * because it stays genuinely operable: a click on a gated trigger is
-     * answered by the display-only reveal (#B246), and `isValid()` remains the
-     * real send gate.
+     * answered by the display-only reveal (#B246) — or, when the only blocker
+     * is a query verdict still on the wire, proceeds into a submit pass that
+     * waits for the settle (#B346) — and `isValid()` remains the real send
+     * gate.
      *
      * `aria-disabled` is deliberately neither written nor cleared here: an
      * authored mark belongs to the author (the gates enforce it, and nothing
@@ -19845,6 +20028,122 @@ function ValidatorPlugin(rules, data, formId, culture) {
         );
     };
 
+    /**
+     * isAwaitingQueryVerdictOnly
+     *
+     * Tells whether a refused submit trigger is refused ONLY because a `query`
+     * verdict is still pending — the one state the #B246 gate misclassifies.
+     *
+     * #B346 — `updateSubmitTriggerState()` gates on a boolean (`isFormValid`)
+     * over a state that is really tri-valued: valid, invalid with COMMITTED
+     * errors, and VERDICT-PENDING (an async `query` XHR on the wire, so the
+     * form has no verdict yet). The #B246 refuse-and-reveal answer is only
+     * coherent for the middle state — with nothing committed there is nothing
+     * to reveal, and the click died silently (measured: wake path fully
+     * healthy, `isSubmitting` never latched, zero sends inside the round-trip
+     * window; the window scales with query LATENCY, not typing speed). When
+     * this returns true the proxy lets the click run the normal submit cycle:
+     * the pass latches and arms its waiter, the engine's in-flight branch
+     * declines to duplicate the XHR, the pending settle wakes the waiter, and
+     * the latched completion dispatches (#B342) — the exact flow live-check-off
+     * forms already run.
+     *
+     * Deliberately NARROW — every arm fails toward the shipped refusal:
+     * - the framework's own gated mark must be the ONLY refusal reason; an
+     *   AUTHORED `aria-disabled="true"` or a (non-IDL) native `disabled`
+     *   keeps refusing (#B312 — an author's claim is enforced, not
+     *   second-guessed);
+     * - any COMMITTED error keeps refusing — refuse-and-reveal stays coherent
+     *   when there is something to reveal. Committed means a SETTLED field's:
+     *   the pending field itself may carry a provisional `query` entry staged
+     *   by the same-value fast path while its verdict is on the wire, and a
+     *   provisional entry is not a verdict (measured — counting it refused
+     *   every window this helper exists to recognize);
+     * - an owned field must actually carry the in-flight query marker
+     *   (`data-gina-form-validator-query-pending`, set by the engine right
+     *   before `xhr.send()` and cleared at both settle chokepoints), looked up
+     *   inside the form AND among form-reassociated controls (`form="<id>"`).
+     *
+     * @param {object} $el - the clicked submit trigger (DOMObject)
+     * @param {object} $formDom - the owning form element (DOMObject)
+     * @param {object} [$formRecord] - the validator record (`instance.$forms[id]`)
+     *
+     * @returns {boolean} true when the only thing standing between the click
+     *  and a verdict is a query still on the wire
+     *
+     * @example
+     * // gated trigger, clean form, uniqueness query in flight -> the click waits for the verdict
+     * isAwaitingQueryVerdictOnly($button, $form, instance.$forms[$form.id]); // true
+     *
+     * @example
+     * // same window but a sibling field has a committed error -> shipped refuse-and-reveal stands
+     * isAwaitingQueryVerdictOnly($button, $form, instance.$forms[$form.id]); // false
+     *
+     * @inner
+     */
+    var isAwaitingQueryVerdictOnly = function($el, $formDom, $formRecord) {
+        if ( !$el || typeof($el.getAttribute) != 'function' || !$formDom || typeof($formDom.querySelector) != 'function' ) {
+            return false;
+        }
+        // the gated mark must be present, and be the ONLY firing arm
+        if ( $el.getAttribute('data-gina-form-submit-gated') != 'true' ) {
+            return false;
+        }
+        var nativeCounts = !('disabled' in $el);
+        if (
+            nativeCounts
+            && $el.getAttribute('disabled') != null && $el.getAttribute('disabled') != 'false'
+            ||
+            $el.getAttribute('aria-disabled') == 'true'
+        ) {
+            return false;
+        }
+        // a query verdict must actually be pending for an owned field — inside
+        // the form, or a form-reassociated control (`form="<id>"`)
+        var pendingSel = '[data-gina-form-validator-query-pending]';
+        var _id = $formDom.id || ( typeof($formDom.getAttribute) == 'function' ? $formDom.getAttribute('id') : null );
+        var _safeId = ( _id && typeof(CSS) != 'undefined' && typeof(CSS.escape) == 'function' ) ? CSS.escape(_id) : _id;
+        var hasPending = (
+            $formDom.querySelector(pendingSel)
+            || _safeId && document.querySelector('[form="'+ _safeId +'"]'+ pendingSel)
+        ) ? true : false;
+        if (!hasPending) {
+            return false;
+        }
+        // COMMITTED errors keep the shipped refuse-and-reveal — but committed
+        // means a SETTLED field's verdict. Measured (#B346): while a query is
+        // on the wire, the same-value fast path stages a provisional `query`
+        // entry under the PENDING field's own key in `$formRecord.errors`, so
+        // a bare `errors.count() > 0` reads the very state this helper exists
+        // to recognize as "no verdict yet" and refuses every window. Count an
+        // erroring field only when it is NOT itself awaiting the verdict.
+        if ( $formRecord && typeof($formRecord.errors) != 'undefined' && $formRecord.errors ) {
+            for (var _fieldName in $formRecord.errors) {
+                if ( !$formRecord.errors.hasOwnProperty(_fieldName) ) {
+                    continue;
+                }
+                var _fieldErrors = $formRecord.errors[_fieldName];
+                var _isErroring = ( _fieldErrors && typeof(_fieldErrors.count) == 'function' )
+                    ? _fieldErrors.count() > 0
+                    : !!_fieldErrors;
+                if (!_isErroring) {
+                    continue;
+                }
+                var _safeName = ( typeof(CSS) != 'undefined' && typeof(CSS.escape) == 'function' ) ? CSS.escape(_fieldName) : _fieldName;
+                var _erroringIsPending = (
+                    $formDom.querySelector('[name="'+ _safeName +'"]'+ pendingSel)
+                    || _safeId && document.querySelector('[form="'+ _safeId +'"][name="'+ _safeName +'"]'+ pendingSel)
+                ) ? true : false;
+                if (!_erroringIsPending) {
+                    // a settled field carries a real verdict — there IS
+                    // something to reveal, the shipped refusal stands
+                    return false;
+                }
+            }
+        }
+        return true;
+    };
+
     /**
      * focusFirstInvalidField
      *
@@ -20375,6 +20674,14 @@ function ValidatorPlugin(rules, data, formId, culture) {
             , $asyncFieldId     = null
             , asyncEvt          = null
             , asyncCount        = 0
+            // #B332 — fields THIS pass armed an `asyncCompleted.<id>` waiter for.
+            // The arm guard used to consult the global `gina.events` registry, which
+            // cannot tell "this pass already armed it" (legitimate skip — a rules
+            // re-application within one pass) from "a CONCURRENT pass armed it"
+            // (must NOT skip: zeroing `asyncCount` there made this pass complete on
+            // a sync-only verdict and send() fired while the query XHR was in
+            // flight). Pass-local by construction, so only the first case matches.
+            , armedAsyncFields  = {}
         ;
 
 
@@ -20525,15 +20832,42 @@ function ValidatorPlugin(rules, data, formId, culture) {
                             asyncEvt        = 'asyncCompleted.'+ $asyncFieldId;
 
                             var triggeredCount = 0, eventTriggered = false;
-                            if ( typeof(gina.events[asyncEvt]) != 'undefined' ) {
-                                console.debug('event `'+ asyncEvt +'` already added');
-                                asyncCount = 0;
-                                return;
+                            // #B332 — the arm guard is PASS-LOCAL now (see `armedAsyncFields`
+                            // at the declaration block). The old registry test saw only that
+                            // SOME pass had armed the field: when that pass was a concurrent
+                            // one (a duplicate submit listener — #B333, a re-click while the
+                            // query XHR was in flight, a live-check cycle beside a submit),
+                            // this pass zeroed ITS OWN pending-async counter and returned —
+                            // so its terminal block completed on the sync-only verdict, the
+                            // `validate.<id>` valid branch ran, and `send()` fired ~200ms
+                            // BEFORE the query answered (the "email already registered" error
+                            // rendered after the POST had already left). A foreign waiter must
+                            // not starve this pass of its own wake-up: waiters stack per pass
+                            // (each self-detaches on first fire below) and the ENGINE dedups
+                            // the wire via `ginaFormValidatorQueryPending` — no duplicate XHR.
+                            // was:
+                            // if ( typeof(gina.events[asyncEvt]) != 'undefined' ) {
+                            //     console.debug('event `'+ asyncEvt +'` already added');
+                            //     asyncCount = 0;
+                            //     return;
+                            // }
+                            if ( typeof(armedAsyncFields[$asyncFieldId]) != 'undefined' ) {
+                                console.debug('event `'+ asyncEvt +'` already armed by this pass');
+                                continue;
                             }
+                            armedAsyncFields[$asyncFieldId] = true;
                             ++asyncCount;
                             //console.debug('Adding listner '+asyncEvt);
                             addListener(gina, $asyncField, asyncEvt, function onasyncCompleted(event) {
                                 event.preventDefault();
+                                // #B332/#B334 — one settle per waiter. Waiters stack per pass
+                                // now, so each must consume exactly one wake-up and leave the
+                                // node: the registry-only `removeListener` in the completion
+                                // block below carries no fn ref (a DOM no-op — it only deletes
+                                // the `gina.events` key), and a stale un-latched waiter used to
+                                // re-enter on every later settle of the same field, replaying a
+                                // finished pass's completion against a live one.
+                                event.currentTarget.removeEventListener(event.type, onasyncCompleted, false);
 
                                 triggeredCount++;
                                 --asyncCount;
@@ -20571,7 +20905,23 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                     removeListener(gina, event.target, _asyncEvt);
 
                                     cb._data = d['toData']();
-                                    cb._errors = d['getErrors'](field);
+                                    // #B337 — the completion payload must carry the WHOLE pass's
+                                    // verdict, not the query field's slice. On a full-form submit
+                                    // pass `d` holds every field, and scoping to `field` starved
+                                    // the `validate.<id>` handler of every OTHER invalid field:
+                                    // their errors were adjudicated (DOM attributes set) but never
+                                    // rendered on the submit path, and the #A11Y1 first-invalid
+                                    // focus loop could only ever land on the query field. It also
+                                    // inverted the query-passes-but-another-field-invalid scene:
+                                    // the scoped set read empty, the early-return branch was
+                                    // skipped, and the validated dispatch went out with NO errors
+                                    // at all. On a single-element live-check pass `d` holds one
+                                    // field, so the no-arg call is byte-equivalent there — the
+                                    // touched-field-only DISPLAY below keeps its `field` argument,
+                                    // which is the live-check contract (§4c). The validated
+                                    // listener's own fallback was already `d.getErrors()` no-arg.
+                                    // was: cb._errors = d['getErrors'](field);
+                                    cb._errors = d['getErrors']();
                                     // console.debug('query callbakc triggered ', cb._errors, '\nisValidating: ', instance.$forms[formId].isValidating);
                                     // update instance form errors
                                     if ( cb._errors && cb._errors.count() > 0) {
@@ -20608,11 +20958,51 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                         }
 
 
-                                        triggerEvent(gina, $currentForm, 'validated.' + formId, cb);
+                                        // #B334 — dispatch where THIS pass's listener actually
+                                        // sits: $formOrElement (the form on a full-form pass —
+                                        // identical to $currentForm there — but the ELEMENT on
+                                        // a single-element pass, whose listener could never
+                                        // hear a form-dispatched event: bubbling goes up, not
+                                        // down; it still bubbles up THROUGH the form so
+                                        // consumer `on('validated')` bindings keep hearing it).
+                                        // was: triggerEvent(gina, $currentForm, 'validated.' + formId, cb);
+                                        triggerEvent(gina, $formOrElement, 'validated.' + formId, cb);
                                         return;
                                     }
                                 }
 
+                                // #B342 — a SUBMIT pass has exactly ONE legitimate completer: this
+                                // waiter (post-#B338 the terminal block runs while asyncCount is
+                                // still > 0, so it can never dispatch for an async pass). On a
+                                // CLEAN pass the errors>0 branch above is skipped, and both
+                                // branches below are conditional — last-field matches only when
+                                // the query field happens to be declared last in the rule set
+                                // (minus `exclude:true` splices), and the live-check branch needs
+                                // `isValidating`, which a submit pass does not set. A clean submit
+                                // whose query field was NOT last exited this block having
+                                // dispatched NOTHING: `cb` starved, `validate.<id>` never fired,
+                                // no send ever left, and the #B332 `isSubmitting` latch stranded —
+                                // gating every later click until reload (measured live on a
+                                // consumer login form: value present, every field clean, click
+                                // swallowed). Pre-arc this hole was MASKED by the very bugs
+                                // #B332/#B333 removed: the duplicate pass's premature sync-only
+                                // completion was the accidental completer. A latched form means
+                                // this completion belongs to the submit cycle (live-check passes
+                                // hard-return while the latch is held), so dispatch it — display
+                                // work belongs to the `validate.<id>` handler's send/reject
+                                // branches, same as the errors>0 dispatch above.
+                                // #B346 note: waiters ARMED before the latch — live-check
+                                // passes mid-window, the reveal's own pass — also wake through
+                                // this branch once a pending-window gesture latches; each such
+                                // dispatch carries THAT waiter's own pass cb, and the #B334
+                                // own-pass listener filtering keeps every completion with its
+                                // own pass. NEW live-check passes still hard-return on the
+                                // latch.
+                                if ( /^true$/i.test(instance.$forms[formId].isSubmitting) ) {
+                                    triggerEvent(gina, $formOrElement, 'validated.' + formId, cb);
+                                    return;
+                                }
+
                                 // is this the last or the only field to be validated ?
                                 var needsGlobalReValidation = false;
                                 if ( listedFields.length == 1 || listedFields[listedFields.length-1] == field) {
@@ -20647,7 +21037,9 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                         handleErrorsDisplay($currentForm, cb._errors, cb._data, field);
                                         updateSubmitTriggerState( $currentForm, isFormValid);
                                     }
-                                    triggerEvent(gina, $currentForm, 'validated.' + formId, cb);
+                                    // #B334 — same retarget as the completion branch above.
+                                    // was: triggerEvent(gina, $currentForm, 'validated.' + formId, cb);
+                                    triggerEvent(gina, $formOrElement, 'validated.' + formId, cb);
                                 }
                                 // just update warning state
                                 else if (/^true$/i.test(instance.$forms[formId].isValidating) && listedFields.length > 1 && listedFields[listedFields.length-1] != field ) {
@@ -21421,10 +21813,33 @@ function ValidatorPlugin(rules, data, formId, culture) {
         }
 
 
-        if (isGFFCtx) {
-            addListener(gina, $formOrElement, evt, function(event) {
+        // #B334 — three defects lived in this one registration:
+        //   (a) it registered for EVERY pass, but a cb-less pass never dispatches
+        //       `validated.<id>` (the terminal block returns the result object
+        //       instead) — its listener was pure accumulation;
+        //   (b) `event.detail` IS the DISPATCHING pass's callback, and the body ran
+        //       it unconditionally — so every stale listener replayed the dispatcher's
+        //       callback once (measured: two listeners -> one dispatch -> two
+        //       `validate.<id>` dispatches -> two send() calls for one click);
+        //   (c) the `removeListener` call in the body carries no fn ref, and
+        //       events.js then only deletes the registry key —
+        //       `removeEventListener(name, undefined)` detaches nothing, so every
+        //       pass's listener stayed on the node for the page's lifetime.
+        // The listener now registers only when a callback exists, consumes ONLY its
+        // own pass's dispatch (detail identity), and detaches itself on consumption
+        // (a mid-dispatch removal also stops a not-yet-run duplicate per DOM spec).
+        // was: if (isGFFCtx) {
+        //          addListener(gina, $formOrElement, evt, function(event) {
+        if ( isGFFCtx && typeof(cb) === 'function' ) {
+            addListener(gina, $formOrElement, evt, function onValidatedOwnPass(event) {
                 event.preventDefault();
 
+                if ( event.detail !== cb ) {
+                    // another pass's completion — not ours to consume
+                    return;
+                }
+                event.currentTarget.removeEventListener(event.type, onValidatedOwnPass, false);
+
                 if (!hasBeenValidated) {
                     hasBeenValidated    = true;
                     hasParsedAllRules   = false;