gina 0.7.2-alpha.1 → 0.7.2

package/framework/{v0.7.2-alpha.1 → v0.7.2}/core/asset/plugin/dist/vendor/gina/js/gina.js

@@ -12372,18 +12372,27 @@ function bindRegion($root, options) {
         , i         = 0
         , len       = docScripts.length
     ;
+    // #P48 — compare without gina's content token (`?v=<10 hex>`): a page's versioned tag and
+    // a fragment's plain one (or two tokens) name the same script, which must not run twice.
+    // An author's own `v=` (not 10 hex) stays significant. A local, so the function stays
+    // self-contained.
+    var assetKey = function (u) {
+        return ( typeof(u) == 'string' )
+            ? u.replace(/([?&])v=[0-9a-f]{10}(&|(?=#)|$)/, function (m, sep, next) { return ( next === '&' ) ? sep : ''; })
+            : u;
+    };
     for (; i < len; ++i) {
         if ( docScripts[i].src && !$root.contains(docScripts[i]) ) {
-            known.push(docScripts[i].src);
+            known.push(assetKey(docScripts[i].src));
         }
     }
     for (i = 0, len = scripts.length; i < len; ++i) {
         src = scripts[i].src; // the resolved absolute URL
-        if ( !src || known.indexOf(src) > -1 ) continue;
+        if ( !src || known.indexOf(assetKey(src)) > -1 ) continue;
         $s     = document.createElement('script');
         $s.src = src;
         document.head.appendChild($s);
-        known.push(src);
+        known.push(assetKey(src));
         out.scripts++;
     }
 
@@ -15008,7 +15017,17 @@ function ValidatorPlugin(rules, data, formId, culture) {
         uploadStarted   : 'Upload started',
         uploadComplete  : 'Upload complete',
         // #A11Y7/U5 — spoken when a staged file's reset/delete control removes it.
-        fileRemoved     : '%s removed'
+        fileRemoved     : '%s removed',
+        // #B724 (gh#83 part 1) — the visible text for a status-0 XHR settle. It fires for
+        // a true transport failure AND for a reverse-proxy 413 arriving mid-send over
+        // HTTP/2 or a navigation that aborted the request — both of which DID reach the
+        // server. "did not complete" is honest for all three; the old "did not reach the
+        // server" was false for the latter two. Resolved through a11yLabel() so a project
+        // can translate it, which the hardcoded literal could not.
+        transportError  : 'Transport failure: the request did not complete',
+        // #B726 (gh#83 part 3) — spoken once when a submit waits for one of its form's staged
+        // uploads to finish; the submit is sent when the last of them settles.
+        uploadPending   : 'Waiting for the upload to finish…'
     };
 
     /**
@@ -15039,6 +15058,19 @@ function ValidatorPlugin(rules, data, formId, culture) {
         return A11Y_LABELS[key] || '';
     };
 
+    // #B724 (gh#83 part 1) — track page unload once, at module load. A status-0 XHR
+    // settle during a navigation (the browser aborts in-flight requests as the page tears
+    // down) is an abort, not a transport failure; the flag lets the status-0 arm tag the
+    // result `reason: 'unload'` so a consumer's submit-error handler can distinguish it.
+    var _pageIsUnloading = false;
+    if ( typeof(window) != 'undefined' && window.addEventListener ) {
+        window.addEventListener('pagehide', function() { _pageIsUnloading = true; }, true);
+        // #B728 — a page restored from the back-forward cache keeps its JS state, so the flag the
+        // `pagehide` above set would still be true and every later status-0 settle would be tagged
+        // `unload`. The `pageshow` that restores the page ends that unload.
+        window.addEventListener('pageshow', function() { _pageIsUnloading = false; }, true);
+    }
+
     /**
      * announceA11yStatus — announce a non-error status through the form's region.
      *
@@ -17219,7 +17251,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         result = {
                             'status'        : 408,
                             'transportError': true,
-                            'error'         : 'Transport failure: the request did not reach the server'
+                            // #B724 (gh#83 part 1) — a status-0 settle also fires for a 413
+                            // arriving mid-send over HTTP/2 and for a navigation that aborted
+                            // the request, both of which DID reach the server. `reason` lets a
+                            // submit-error handler tell an unload-abort (benign) from a real
+                            // transport failure; the text is overridable + honest (see a11yLabel).
+                            'reason'        : _pageIsUnloading ? 'unload' : 'transport',
+                            'error'         : a11yLabel('transportError')
                         };
 
                         $form.eventData.error = result;
@@ -17842,6 +17880,172 @@ function ValidatorPlugin(rules, data, formId, culture) {
         });
     };
 
+    /**
+     * getStagedUploadsInFlight — #B726: the staged uploads of a form whose staging request is
+     * on the wire.
+     *
+     * A staged file input points at its virtual `gina-upload-*` form through
+     * `data-gina-form-virtual`, written on every selection. That form's record carries `sent`,
+     * which `send()` sets only AFTER `xhr.send()` and clears when the request settles (readyState
+     * 4 and the `loadend` fail-safe). So `sent` reads true exactly while a staging request is in
+     * flight — unlike `isSending`, which is claimed before the request opens and stays true for
+     * good when something throws before it is sent.
+     *
+     * `form.elements` is walked so that a staged input reassociated with `form="<id>"` counts.
+     *
+     * @inner
+     * @param {HTMLFormElement} $formEl - the REAL form (never its virtual upload form)
+     * @returns {Array<string>} the ids of the virtual upload forms still in flight; empty when none
+     *
+     * @example
+     * getStagedUploadsInFlight(document.getElementById('profile')); // ['gina-upload-avatar']
+     */
+    var getStagedUploadsInFlight = function($formEl) {
+        var inFlight = [];
+        if ( !$formEl || !$formEl.elements ) {
+            return inFlight;
+        }
+        var $controls = $formEl.elements, $control = null, virtualId = null;
+        for (var c = 0, cLen = $controls.length; c < cLen; ++c) {
+            $control = $controls[c];
+            if ( !$control || $control.type != 'file' || typeof($control.getAttribute) != 'function' ) {
+                continue;
+            }
+            virtualId = $control.getAttribute('data-gina-form-virtual');
+            if (
+                virtualId
+                && typeof(instance.$forms[virtualId]) != 'undefined'
+                && /^true$/i.test(instance.$forms[virtualId].sent)
+                && inFlight.indexOf(virtualId) < 0
+            ) {
+                inFlight.push(virtualId);
+            }
+        }
+        return inFlight;
+    };
+
+    /**
+     * holdSubmitForStagedUploads — #B726: make a submit WAIT while one of its form's staged
+     * uploads is in flight, instead of posting the upload's still-empty hidden fields.
+     *
+     * Called at the top of both submit doors, before the payload is collected. When an upload is
+     * in flight it records ONE wait on the form's record (`stagedUploadWait`), keeps the busy
+     * state the gesture armed, announces the wait once through the form's live region
+     * (`a11yLabel('uploadPending')`) and tells the caller to stop. When the last upload settles,
+     * `resolveStagedUploadWait` either runs `replay` — which re-enters the same door, so the
+     * fields are collected again, now filled — or, if an upload failed, sends nothing.
+     *
+     * A gesture made while a wait is pending adds nothing; one made when a wait is recorded but
+     * nothing is in flight any more drops the wait and goes through.
+     *
+     * @inner
+     * @param {HTMLFormElement} $formEl - the real form being submitted
+     * @param {function} replay - re-runs this submit through the door it came in by
+     * @returns {boolean} true when the submit must stop here: it is waiting, or a wait is pending
+     *
+     * @example
+     * if ( holdSubmitForStagedUploads($form, function() { $form.requestSubmit(); }) ) {
+     *     return; // the submit runs again once the upload settles
+     * }
+     */
+    var holdSubmitForStagedUploads = function($formEl, replay) {
+        var formId = ( $formEl && typeof($formEl.getAttribute) == 'function' ) ? $formEl.getAttribute('id') : null;
+        var $formRecord = ( formId && typeof(instance.$forms[formId]) != 'undefined' ) ? instance.$forms[formId] : null;
+        if ( !$formRecord ) {
+            return false;
+        }
+        var inFlight = getStagedUploadsInFlight($formEl);
+        if ( $formRecord.stagedUploadWait ) {
+            if ( inFlight.length > 0 ) {
+                return true; // one wait per form
+            }
+            // nothing is on the wire any more: a settle this wait never heard of
+            $formRecord.stagedUploadWait = null;
+            return false;
+        }
+        if ( inFlight.length == 0 ) {
+            return false;
+        }
+        $formRecord.stagedUploadWait = { replay: replay, failed: false };
+        announceA11yStatus($formEl, a11yLabel('uploadPending'));
+        if (envIsDev) {
+            try { console.info('[FormValidator][upload] form `#'+ formId +'`: submit waiting for '+ inFlight.length +' staged upload(s) to finish ('+ inFlight.join(', ') +')'); } catch (e) {}
+        }
+        return true;
+    };
+
+    /**
+     * noteStagedUploadSettled — #B726: called by `onUpload` for every staging outcome.
+     *
+     * When the real form has a submit waiting, a failure marks the wait as failed, and the
+     * decision is left to a microtask: it runs after the whole XHR settle has finished — the
+     * hidden fields filled on success, or the error rendered — and even when the rest of
+     * `onUpload` throws. Every outcome of one settle has been recorded by then, including a
+     * success that `onUpload` turned into an error.
+     *
+     * @inner
+     * @param {HTMLFormElement|undefined} $formEl - the real form (`uploadProperties.$form`)
+     * @param {string} status - `success`, or anything else for a failure
+     * @returns {undefined}
+     *
+     * @example
+     * noteStagedUploadSettled(document.getElementById('profile'), 'error');
+     */
+    var noteStagedUploadSettled = function($formEl, status) {
+        var formId = ( $formEl && typeof($formEl.getAttribute) == 'function' ) ? $formEl.getAttribute('id') : null;
+        var $formRecord = ( formId && typeof(instance.$forms[formId]) != 'undefined' ) ? instance.$forms[formId] : null;
+        if ( !$formRecord || !$formRecord.stagedUploadWait ) {
+            return;
+        }
+        if ( status != 'success' ) {
+            $formRecord.stagedUploadWait.failed = true;
+        }
+        var decide = function onStagedUploadSettled() { resolveStagedUploadWait($formEl); };
+        if ( typeof(queueMicrotask) == 'function' ) {
+            queueMicrotask(decide);
+        } else {
+            Promise.resolve().then(decide);
+        }
+    };
+
+    /**
+     * resolveStagedUploadWait — #B726: decide a waiting submit once a staged upload settled.
+     *
+     * Still waiting while another upload of the form is in flight. Otherwise the wait ends: when
+     * every upload succeeded the submit is replayed through its own door; when one failed, or the
+     * form has left the page, nothing is sent and the busy state the gesture armed is released —
+     * unless the form has a request of its own in flight, whose settle owns that state (#B247).
+     * No announcement on a failure: the upload already announced the server's message, and a
+     * second write in the same beat would replace it.
+     *
+     * @inner
+     * @param {HTMLFormElement} $formEl - the real form
+     * @returns {undefined}
+     *
+     * @example
+     * resolveStagedUploadWait(document.getElementById('profile'));
+     */
+    var resolveStagedUploadWait = function($formEl) {
+        var formId = ( $formEl && typeof($formEl.getAttribute) == 'function' ) ? $formEl.getAttribute('id') : null;
+        var $formRecord = ( formId && typeof(instance.$forms[formId]) != 'undefined' ) ? instance.$forms[formId] : null;
+        if ( !$formRecord || !$formRecord.stagedUploadWait ) {
+            return;
+        }
+        var wait = $formRecord.stagedUploadWait;
+        var isDetached = ( typeof($formEl.isConnected) != 'undefined' && !$formEl.isConnected );
+        if ( !isDetached && getStagedUploadsInFlight($formEl).length > 0 ) {
+            return;
+        }
+        $formRecord.stagedUploadWait = null;
+        if ( wait.failed || isDetached ) {
+            if ( !/^true$/i.test($formRecord.isSending) ) {
+                disarmSubmitLoading($formRecord);
+            }
+            return;
+        }
+        wait.replay();
+    };
+
     var onUpload = function(gina, $target, status, id, data) {
 
         var uploadProperties = $target.uploadProperties || null;
@@ -17868,6 +18072,9 @@ function ValidatorPlugin(rules, data, formId, culture) {
         // #R8 slice 2 — the dropzone (if bound) returns to idle at the same
         // single chokepoint
         updateUploadDropzoneState(uploadProperties.dropzoneContainer || null, 'idle');
+        // #B726 — a submit of the real form may be waiting for this upload; it is decided once
+        // this whole settle has run (see noteStagedUploadSettled)
+        noteStagedUploadSettled(uploadProperties.$form, status);
         // parent form
         // var $mainForm = uploadProperties.$form;
         var $uploadTriger = document.getElementById(uploadProperties.uploadTriggerId);
@@ -17897,7 +18104,16 @@ function ValidatorPlugin(rules, data, formId, culture) {
            // console.error('[ mainUploadError ] ', status, data)
             var errMsg = data.message || data.error;
 
-            $error.innerHTML = '<p>'+ errMsg +'</p>';
+            // #B727 — render the server's error message as TEXT, never HTML. A non-JSON
+            // error response is kept verbatim as `result.message` (see the XHR response
+            // handler), so `innerHTML` here parsed a proxy/WAF HTML error page — or a
+            // reflected upload filename (the server rejects a disallowed extension by
+            // echoing the name) — as live markup. textContent closes the injection sink;
+            // the <p> wrapper is kept for the existing styling + fadeIn.
+            $error.textContent = '';
+            var _errP = document.createElement('p');
+            _errP.textContent = errMsg;
+            $error.appendChild(_errP);
             fadeIn($error);
             // #A11Y7/U3 — the container is `display:none` when the text is written and
             // only revealed by the fadeIn above, which is exactly the case where a
@@ -17909,8 +18125,22 @@ function ValidatorPlugin(rules, data, formId, culture) {
             if ( $uploadTriger && $uploadTriger.form ) {
                 announceA11yError($uploadTriger.form, $error.textContent);
             }
-        } else if(!$error && status != 'success') {
-            throw new Error(errMsg)
+        } else if ( status != 'success' ) {
+            // #B731 — no error element. Every error site calls onUpload BEFORE it dispatches
+            // `error.<id>` and the declared `data-gina-form-upload-on-error` callback, so the
+            // throw this branch held (`new Error(undefined)`: `errMsg` is assigned only in the
+            // branch above) cancelled both. The message is announced instead of shown, and the
+            // dispatch goes on.
+            // was: } else if(!$error && status != 'success') {
+            // was:     throw new Error(errMsg)
+            var noSlotMsg = data.message || data.error;
+            noSlotMsg = ( typeof(noSlotMsg) == 'undefined' || noSlotMsg === null ) ? '' : String(noSlotMsg);
+            if ( $uploadTriger && $uploadTriger.form && noSlotMsg != '' ) {
+                announceA11yError($uploadTriger.form, noSlotMsg);
+            }
+            if (envIsDev) {
+                try { console.warn('[FormValidator] upload `#'+ uploadProperties.uploadTriggerId +'`: no error element `#'+ uploadProperties.errorField +'`; the staging error is announced, not shown'); } catch (warnErr) {}
+            }
         } else {
             // #A11Y7/U2 — success is the other end of the `uploadStarted` transition.
             // It lives in this branch rather than at the indicator chokepoint above so
@@ -20927,6 +21157,9 @@ function ValidatorPlugin(rules, data, formId, culture) {
         // or
         // $form.target.dataset.ginaFormIsResetting = true;
         // handleErrorsDisplay($form.target, {});
+        // #B726 — a submit waiting for a staged upload belongs to the binding being torn down:
+        // drop it, so that upload's settle never replays a submit on an unbound form
+        $form.stagedUploadWait = null;
         $form.binded = false;
 
         return $form;
@@ -21573,12 +21806,23 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     var url             = $el.getAttribute('data-gina-form-upload-action');
                     var name            = $el.getAttribute('name');
                     var fileId          = name;
-                    var uploadFormId    = 'gina-upload-' + name.replace(/\[/g, '-').replace(/\]/g, '-' + $form.id);
+                    // #B732 — the virtual form id must be unique per form. A bracketed name
+                    // already carries the form id (once per `]`), but a bracket-less one
+                    // (`doc`) gave `gina-upload-doc` in EVERY form, so two forms with
+                    // same-named staged inputs shared one virtual form: the second form's
+                    // upload filled the first form's hidden fields and left its own empty.
+                    // was: var uploadFormId    = 'gina-upload-' + name.replace(/\[/g, '-').replace(/\]/g, '-' + $form.id);
+                    var uploadFormId    = 'gina-upload-' + name.replace(/\[/g, '-').replace(/\]/g, '-' + $form.id) + ( (/\]/.test(name)) ? '' : '-' + $form.id );
                     $el.setAttribute('data-gina-form-virtual', uploadFormId);
                     var eventOnSuccess  = $el.getAttribute('data-gina-form-upload-on-success');
                     var eventOnError    = $el.getAttribute('data-gina-form-upload-on-error');
                     var eventOnProgress = $el.getAttribute('data-gina-form-upload-on-progress'); // #R8
-                    var errorField    = null;
+                    // #B731 — the error slot is an attribute of THIS file input (default
+                    // `<id>-error`), read once. It was recomputed for every <input> of the real
+                    // form and kept the last one's, so a custom slot was honoured only when the
+                    // file input was the form's last input.
+                    // was: var errorField    = null;
+                    var errorField    = $el.getAttribute('data-gina-form-upload-error') || ( ($el.id) ? $el.id + '-error' : null );
                     // #B572 — which popin, if any, this upload belongs to is decided by
                     // CONTAINMENT (the popin the real form is inside), captured ONCE per
                     // selection and read by every site below — never by "some popin is open"
@@ -21611,10 +21855,31 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         }
 
                         if ( !$uploadForm ) {
-                            try {
-                                $uploadForm = getFormById(uploadFormId) || null;
-                            } catch (noExistingFormErr) {
-                                // do nothing
+                            // #B733 — `getFormById()` returns the validator RECORD, not the form
+                            // element, and every line below treats `$uploadForm` as the element
+                            // (`setAttribute`, `appendChild`). A record is still registered here
+                            // when an earlier selection's virtual form has left the document: a
+                            // popin close wipes the content but nothing destroys that record, so
+                            // after a reopen the next selection threw and sent nothing. A record's
+                            // element is reused only while it is in the document; a detached one
+                            // is destroyed (its own `destroy()` removes its listeners and their
+                            // registry entries, so the new form binds afresh) and a new form is built.
+                            // was:
+                            // try {
+                            //     $uploadForm = getFormById(uploadFormId) || null;
+                            // } catch (noExistingFormErr) {
+                            //     // do nothing
+                            // }
+                            var $knownUpload = instance.$forms[uploadFormId] || null;
+                            if ( $knownUpload && $knownUpload.target && $knownUpload.target.isConnected ) {
+                                $uploadForm = $knownUpload.target;
+                            } else if ( $knownUpload ) {
+                                try {
+                                    $knownUpload.destroy();
+                                } catch (staleUploadErr) {
+                                    // a record that cannot unbind must still never be reused
+                                }
+                                delete instance.$forms[uploadFormId];
                             }
 
                             if (!$uploadForm) {
@@ -21705,7 +21970,8 @@ function ValidatorPlugin(rules, data, formId, culture) {
                                         fieldType   = formInputsFields[h].getAttribute('type');
                                         hiddenField = null;
                                         _name       = null, _userName = null;
-                                        errorField= formInputsFields[h].getAttribute('data-gina-form-upload-error') || fieldId + '-error' || null;
+                                        // #B731 — read once from the file input, above
+                                        // was: errorField= formInputsFields[h].getAttribute('data-gina-form-upload-error') || fieldId + '-error' || null;
 
                                         if (fieldType && /hidden/i.test(fieldType) ) {
                                             hiddenField = formInputsFields[h];
@@ -21828,6 +22094,14 @@ function ValidatorPlugin(rules, data, formId, culture) {
                             if (eventOnProgress) {
                                 $uploadForm.setAttribute('data-gina-form-event-on-upload-progress', eventOnProgress);
                             }
+                            // #B729 — a file chosen while this input's previous staging request is
+                            // still on the wire supersedes that request: the input now shows the new
+                            // file, so only the new file's metadata may reach the form. Without this
+                            // the one-request-at-a-time gate in send() returned silently, the new
+                            // selection was never sent, and the earlier request filled the form with
+                            // the file the user had just replaced. A superseded request settles
+                            // through `abort.<id>` only: no error, no on-error callback.
+                            $uploadForm.setAttribute('data-gina-form-sync', 'replace');
 
 
                             // adding for to current document
@@ -23165,6 +23439,13 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 //     return;
                 // }
 
+                // #B726 (gh#83 part 3) — a staged upload of this form still on the wire would post
+                // its hidden fields empty: wait for it, then re-run this click, which collects them
+                // again once filled. Placed before the latch below, so there is nothing to release.
+                if ( holdSubmitForStagedUploads($target, function replayStagedUploadClick() { triggerEvent(gina, $submit, evt); }) ) {
+                    return;
+                }
+
                 var validatorInfos = getFormValidationInfos($target, rules);
                 fields  = validatorInfos.fields;
                 $fields = validatorInfos.$fields;
@@ -23421,6 +23702,14 @@ function ValidatorPlugin(rules, data, formId, culture) {
                 cancelEvent(e);
             }
 
+            // #B726 (gh#83 part 3) — the same wait as the click door: a click inside the button,
+            // Enter in a form with no submit button, `<input type=submit>`, requestSubmit() and
+            // `$forms[id].submit()` all arrive here. Only once the native submit is cancelled above:
+            // an earlier return would let the browser post the form itself.
+            if ( (withRules || isBinded) && holdSubmitForStagedUploads($target, function replayStagedUploadSubmit() { triggerEvent(gina, $target, 'submit'); }) ) {
+                return false;
+            }
+
 
             // just collect data over forms
             // getting fields & values
@@ -23482,6 +23771,10 @@ function ValidatorPlugin(rules, data, formId, culture) {
                         fields[name] = '';
                     }
 
+                } else if ( $target[i].type == 'file' && $target[i].getAttribute('data-gina-form-upload-action') ) {
+                    // #B725 (gh#83 part 2) — a staged file input's `.value` is the browser
+                    // placeholder `C:\fakepath\<name>`; its real data travels through the
+                    // staged hidden fields, so keep it out of the XHR payload.
                 } else {
                     fields[name]    = $target[i].value;
                 }
@@ -24343,6 +24636,11 @@ function ValidatorPlugin(rules, data, formId, culture) {
                     fields[name] = '';
                 }
 
+            } else if ( $form[i].type == 'file' && $form[i].getAttribute('data-gina-form-upload-action') ) {
+                // #B725 (gh#83 part 2) — a staged file input's `.value` is the browser
+                // placeholder `C:\fakepath\<name>`; its real data travels through the staged
+                // hidden fields, so keep it out of the XHR payload. The element is still
+                // registered in `$fields` below for any rule that inspects it.
             } else {
                 fields[name] = $form[i].value;
             }
@@ -28936,9 +29234,11 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                 if ( typeof(scripts[i].src) == 'undefined' || scripts[i].src == '' ) {
                     continue;
                 }
+                // #P48 — keyed without gina's content token (`?v=<10 hex>`), as registered
                 let filename = scripts[i].src
                                 .replace(/(https|http|)\:\/\//, '')
-                                .replace(reDomain, '');
+                                .replace(reDomain, '')
+                                .replace(/([?&])v=[0-9a-f]{10}(&|(?=#)|$)/, function (m, sep, next) { return ( next === '&' ) ? sep : ''; });
                 // don't load if already in the global context
                 if ( globalScriptsList.indexOf(filename) > -1 )
                     continue;
@@ -28953,9 +29253,11 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                 if ( typeof(styles[i].href) == 'undefined' || styles[i].href == '' ) {
                     continue;
                 }
+                // #P48 — keyed without gina's content token, as registered
                 let filename = styles[i].href
                                 .replace(/(https|http|)\:\/\//, '')
-                                .replace(reDomain, '');
+                                .replace(reDomain, '')
+                                .replace(/([?&])v=[0-9a-f]{10}(&|(?=#)|$)/, function (m, sep, next) { return ( next === '&' ) ? sep : ''; });
                 // don't load if already in the global context
                 if ( globalStylesList.indexOf(filename) > -1 )
                     continue;
@@ -29120,7 +29422,16 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                     loadingState.disarm( document.getElementById($popin.openTrigger) );
 
                     // removing from FormValidator instance
-                    if ($validatorInstance && $validatorInstance['$forms']) {
+                    // #B756 — the forms belong to the validator THIS popin was registered with,
+                    // which is not necessarily this closure's: `gina.popin` is the boot instance,
+                    // built without a validator, so `gina.popin.close(name)` reached this point
+                    // with `$validatorInstance` null, the teardown below was skipped, every form
+                    // record survived pointing at its detached node, and the reopened form was
+                    // never bound again. A popin registered without a validator has no forms
+                    // recorded, so for it nothing changes.
+                    var $popinValidator = ( $popin.options && $popin.options['validator'] ) || $validatorInstance;
+                    // was: if ($validatorInstance && $validatorInstance['$forms']) {
+                    if ($popinValidator && $popinValidator['$forms']) {
                         // #B265: iterate a COPY, and clear the array ONCE. The previous loop
                         // spliced `$popin['$forms']` while walking it against a length captured
                         // BEFORE the loop, so every element shifted left under the cursor and the
@@ -29133,7 +29444,8 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                         var _formIds = $popin['$forms'].slice();
                         $popin['$forms'].length = 0;
                         for (var i = 0, _formIdsLen = _formIds.length; i < _formIdsLen; ++i) {
-                            var $formToDestroy = $validatorInstance['$forms'][ _formIds[i] ];
+                            // was: var $formToDestroy = $validatorInstance['$forms'][ _formIds[i] ];
+                            var $formToDestroy = $popinValidator['$forms'][ _formIds[i] ];
                             if ( typeof($formToDestroy) == 'undefined' ) {
                                 continue;
                             }
@@ -29381,10 +29693,12 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                 for (let s = 0, len = mainDocumentScripts.length; s < len; s++ ) {
                     if (!mainDocumentScripts[s].src || mainDocumentScripts[s].src == '')
                         continue;
-                    // Filename without domain
+                    // Filename without domain, nor gina's content token (#P48: a page's
+                    // versioned tag and a popin's plain one name the same file)
                     let filename = mainDocumentScripts[s].src
                                     .replace(/(https|http|)\:\/\//, '')
-                                    .replace(reDomain, '');
+                                    .replace(reDomain, '')
+                                    .replace(/([?&])v=[0-9a-f]{10}(&|(?=#)|$)/, function (m, sep, next) { return ( next === '&' ) ? sep : ''; });
                     $popin.parentScripts[s] = filename;
                 }
                 // Parent Styles
@@ -29392,10 +29706,11 @@ define('gina/popin', [ 'require', 'lib/domain', 'lib/loading-state', 'lib/merge'
                 for (let s = 0, len = mainDocumentStyles.length; s < len; s++ ) {
                     if ( typeof(mainDocumentStyles[s].rel) == 'undefined' || !/stylesheet/i.test(mainDocumentStyles[s].rel) )
                         continue;
-                    // Filename without domain
+                    // Filename without domain, nor gina's content token (#P48)
                     let filename = mainDocumentStyles[s].href
                                     .replace(/(https|http|)\:\/\//, '')
-                                    .replace(reDomain, '');
+                                    .replace(reDomain, '')
+                                    .replace(/([?&])v=[0-9a-f]{10}(&|(?=#)|$)/, function (m, sep, next) { return ( next === '&' ) ? sep : ''; });
                     $popin.parentStyles[s] = filename;
                 }
 
@@ -33264,12 +33579,24 @@ function getDependencies(gina, cb) {
     var _webroot = (typeof window !== 'undefined' && window.__ginaWebroot)
         || (gina && gina.config && gina.config.webroot)
         || '/';
+    // #P48 — the routing table's content token, rendered per request on gina's own script tag
+    // (`data-gina-routing-v`); the server answers `immutable` only to the token of the table
+    // variant it serves. Taken only when it is exactly 10 hex: an absent attribute (versioning
+    // off, dev, a layoutless page) keeps today's revalidating fetch.
+    var _routingV = null;
+    try {
+        var _routingTag  = ( typeof(document) != 'undefined' ) ? document.querySelector('script[data-gina-routing-v]') : null;
+        var _routingAttr = ( _routingTag ) ? _routingTag.getAttribute('data-gina-routing-v') : null;
+        _routingV = ( typeof(_routingAttr) == 'string' && /^[0-9a-f]{10}$/.test(_routingAttr) ) ? _routingAttr : null;
+    } catch (routingVErr) {
+        _routingV = null;
+    }
     var arr = [
         // Get routing to populate `window.gina.config.routing`
         // Now fetching routing from gina
         {
             func: loadRoutingConf,
-            args: [ 'routing', {url:  _webroot + '_gina/assets/routing.json'} ]
+            args: [ 'routing', {url:  _webroot + '_gina/assets/routing.json' + ( _routingV ? '?v=' + _routingV : '' )} ]
         }
         // {
         //     func: loadRoutingConf,