Merge main: click-cast fix round (stale-handle hardening, international keys, Always Cast, taint + ClickCastFrames takeover fixes)

Conflict resolutions:
- Config.lua SafeSetFont: both lines had fixed the secret-compare taint
  independently; unified on the 12.1 form (issecretvalue-gated skip) with
  the redundant ~= "" dropped.
- ClickCasting/Frames.lua RunBindingRepair: took main's #213 version
  (string mirror reset + header-side override wipe).
- AuraDesigner/Indicators.lua / Frames/Expiring.lua: kept deleted — the
  12.1 engine replaced both; main's aura-refresh expiring fix does not
  apply to the container-era code.
- CHANGELOG.md: folded main's Unreleased entries into the 5.0.0 section.

Author: mergetest

CHANGELOG.md

@@ -6,6 +6,12 @@
 
 * (Click Casting) Fixed a Lua error walking Blizzard unit frames after combat that could stop click-casting bindings from working on the default frames until reload — the frame scan now skips protected (secret) values introduced by recent client versions. (by Krathe)
 * (Click Casting) Keyboard binds that stop working mid-session now recover automatically after combat ends or a loading screen, instead of staying broken until a reload.
+* (Click Casting) **Fixed keyboard and extra-mouse-button hover binds dying addon-wide mid-combat until a /reload** — hover binds are now owned by one permanent frame instead of the unit frame under the cursor, removing the cleanup step that could hit a dead frame reference and silently break every later hover. The automatic self-repair stays as a safety net, but the cause is gone. (by Krathe)
+* (Click Casting) Fixed keyboard and mouse-wheel click-cast binds being silently dropped mid-hover during combat — the safety check that removes hover binds could misread the cursor as off the frame while the frame's position was briefly unreadable, wiping the binds until the frame was re-hovered. Binds are now only removed when the cursor is provably off the frame. (by Krathe)
+* (Click Casting) Fixed binds on keys from international keyboard layouts (such as æ, ø or å) not casting on the frame under the cursor.
+* (Click Casting) New "Always Cast" option in a binding's Advanced settings. When enabled, the key still casts with the spell's normal targeting if no other rule matches — so ground-targeted spells (like aimable Shaman totems) show their aiming circle when pressed while hovering nothing.
+* (Click Casting) Frames that other addons register for click-casting are now only taken over if they are real unit frames — non-unit buttons (such as toy or action buttons) are left alone, and frames an addon explicitly unregisters stay unregistered.
+* (Auras) Fixed a stream of blocked-action taint warnings in PvP instances (triggered while styling aura duration text) that could spill over and break Blizzard's chat or other addons until a /reload.
 * (Bars) **Fixed health bars rendering solid green when a profile references a bar texture you don't have** — imported profiles often point at another addon's texture files; if that addon isn't installed (or its files changed), the bar showed WoW's green missing-texture state and class colours appeared broken. All bar textures now fall back to the stock texture with a one-time warning, on every update path (the fallback previously only applied when a frame was first created and was immediately overwritten). (by Krathe)
 * (Bars) Fixed class-coloured health bars staying stuck on the gradient colour (usually green) after using or switching away from the Percent colour mode — the class/custom colour is now written directly to the bar texture, so it can no longer be masked by a leftover gradient tint. (by Krathe)
 
@@ -130,6 +136,28 @@ DandersFrames has been rebuilt for WoW 12.1 (Midnight), which fundamentally chan
 * Aura Designer text colouring is drawn as a cover over the text: it ignores the out-of-range text fade, and group parts with their own inline colours keep them.
 * Dragging certain aura sliders can briefly stutter.
 
+## [4.7.3]
+
+### Bug Fixes
+
+* (Bars) **Fixed health bars rendering solid green when a profile references a bar texture you don't have** — imported profiles often point at another addon's texture files; if that addon isn't installed (or its files changed), the bar showed WoW's green missing-texture state and class colours appeared broken. All bar textures now fall back to the stock texture with a one-time warning, on every update path (the fallback previously only applied when a frame was first created and was immediately overwritten). (by Krathe)
+* (Bars) Fixed class-coloured health bars staying stuck on the gradient colour (usually green) after using or switching away from the Percent colour mode — the class/custom colour is now written directly to the bar texture, so it can no longer be masked by a leftover gradient tint. (by Krathe)
+
+## [4.7.2]
+
+### Bug Fixes
+
+* (Click Casting) Fixed a Lua error walking Blizzard unit frames after combat that could stop click-casting bindings from working on the default frames until reload — the frame scan now skips protected (secret) values introduced by recent client versions. (by Krathe)
+* (Click Casting) Keyboard binds that stop working mid-session now recover automatically after combat ends or a loading screen, instead of staying broken until a reload.
+
+## [4.7.1]
+
+### Bug Fixes
+
+* (Text Designer) Element colour changes now take effect immediately while the colour picker is open, instead of only after closing it with OK. (by Krathe)
+* (Interface) Opening a colour picker no longer counts as a colour change — the picker fired its change handlers once during setup, which could commit settings (such as a Text Designer element's colour override) without any edit. (by Krathe)
+* (Aura Designer) Fixed expiring border animations staying stuck on after the tracked aura was refreshed (for example re-casting a HoT in its pandemic window). (by Krathe)
+
 ## [4.7.0]
 
 ### Bug Fixes

ClickCasting/Bindings.lua

@@ -511,12 +511,22 @@ function CC:ApplyBindings()
         self.needsBindingRefresh = true
         return
     end
-    
+
     -- Cancel any pending batch binding pass from a previous call
     if self.batchBindingTimer then
         self.batchBindingTimer:Cancel()
         self.batchBindingTimer = nil
     end
+
+    -- Hover keyboard/scroll binds are owned by the click-cast header, so a
+    -- full rebuild starts by wiping the header's override bindings — any
+    -- bind from the outgoing set that is still active (e.g. the user is
+    -- hovering a frame right now) would otherwise survive with its OLD
+    -- action until the next leave/enter cycle. The next OnEnter re-applies
+    -- from the freshly built snippets.
+    if self.header then
+        pcall(ClearOverrideBindings, self.header)
+    end
 
     -- Migrate existing macro bindings to have no fallbacks
     if self.db and self.db.bindings then
@@ -773,8 +783,11 @@ function CC:GetHovercastSuffix(binding)
         -- Mouse button
         return "dfmouse" .. modKey .. buttonNum
     else
-        -- Keyboard/scroll key
-        return "dfbutton" .. modKey .. key:lower()
+        -- Keyboard/scroll key. EncodeKeyToken: identical to the old :lower()
+        -- for alphanumeric keys; international and punctuation keys get an
+        -- ASCII-safe encoding so their bytes never enter attribute names
+        -- (bug #977).
+        return "dfbutton" .. modKey .. self:EncodeKeyToken(key)
     end
 end
 
@@ -812,7 +825,9 @@ function CC:BuildHovercastSetupScript()
             -- These fallbacks only work when NOT hovering a frame, so we need
             -- the key binding to be active globally, not just when hovering
             local fallback = binding.fallback or {}
-            local hasFallbackThatNeedsGlobal = fallback.mouseover or fallback.target or fallback.selfCast
+            -- alwaysCast needs the key active everywhere too — its whole point
+            -- is casting while hovering nothing (bug #991)
+            local hasFallbackThatNeedsGlobal = fallback.mouseover or fallback.target or fallback.selfCast or fallback.alwaysCast
 
             -- Check for useGlobalBind flag (for items/macros that need to work everywhere)
             local hasGlobalBindFlag = binding.useGlobalBind == true
@@ -960,6 +975,33 @@ function CC:ClearGlobalBindings()
     end
 end
 
+-- Encode a captured key name into an ASCII-only token for use inside derived
+-- names (virtual mouse button names -> secure attribute names). Keys from
+-- non-US keyboard layouts (æ, ø, å, ñ, ü, ...) arrive from OnKeyDown as
+-- multibyte UTF-8; embedding those raw bytes in attribute names is the one
+-- structural difference between this pipeline and the systems that handle
+-- such keys correctly (Blizzard's own bindings, Dominos, EllesmereUI — none
+-- of which put key characters into derived names). The BINDING key itself is
+-- always passed byte-exact as captured; only derived names go through this.
+-- a-z / 0-9 pass through and A-Z lowercases, so alphanumeric keys (the vast
+-- majority) produce the identical name the old :lower() did. Every other
+-- byte — multibyte sequences AND ASCII punctuation — becomes "_" plus its
+-- zero-padded byte value: fixed width, so two distinct keys can never encode
+-- to the same token. Punctuation is deliberately encoded too: characters
+-- like "*" carry wildcard meaning in secure attribute names, so raw
+-- punctuation in a derived name was never safe either. (bug #977)
+function CC:EncodeKeyToken(key)
+    return (tostring(key or ""):gsub(".", function(c)
+        local b = c:byte()
+        if (b >= 97 and b <= 122) or (b >= 48 and b <= 57) then
+            return c                            -- a-z, 0-9 unchanged
+        elseif b >= 65 and b <= 90 then
+            return string.char(b + 32)          -- A-Z -> a-z (legacy casing)
+        end
+        return string.format("_%03d", b)        -- everything else: byte-encoded
+    end))
+end
+
 -- Get the WoW key string for a binding
 function CC:GetBindingKeyString(binding)
     local key = ""
@@ -1969,7 +2011,18 @@ function CC:BuildMacroTextForBinding(binding, forGlobalBinding)
         if hasSelf then
             table.insert(parts, "[@player" .. combatStr .. mountedStr .. "] " .. spellName)
         end
-        
+
+        -- Always Cast: terminal unconditional clause — when no clause above
+        -- matches (nothing hovered / ineligible unit), cast with WoW's default
+        -- targeting so ground-targeted spells show their aiming circle
+        -- (bug #991). With Self enabled the [@player] clause above always
+        -- resolves first, so Self takes precedence. Combat/mounted gating
+        -- still applies.
+        if fallback.alwaysCast then
+            local conds = (combatStr .. mountedStr):sub(2)   -- strip leading comma; "" when ungated
+            table.insert(parts, (conds ~= "" and ("[" .. conds .. "] ") or "") .. spellName)
+        end
+
         -- If no fallbacks enabled, just cast normally (will use WoW's default targeting)
         if #parts == 0 then
             table.insert(parts, spellName)
@@ -2287,7 +2340,20 @@ function CC:BuildCombinedMacroForBindings(bindings, forGlobalBinding)
             table.insert(parts, "[@player" .. combatStr .. "] " .. friendlySpell)
         end
     end
-    
+
+    -- Always Cast (bug #991): terminal unconditional clause, mirroring the
+    -- single-binding builder. First contributing binding with the flag wins;
+    -- the self-cast clause above resolves first when enabled.
+    for _, b in ipairs({friendlyBinding, hostileBinding, anyBinding}) do
+        if b and b.fallback and b.fallback.alwaysCast and b.spellName then
+            local spell = GetLocalizedSpellName(b.spellId) or b.spellName
+            local combatCond = GetCombatCondition(b)
+            local combatStr = combatCond == "combat" and ",combat" or (combatCond == "nocombat" and ",nocombat" or "")
+            table.insert(parts, (combatStr ~= "" and ("[" .. combatStr:sub(2) .. "] ") or "") .. spell)
+            break
+        end
+    end
+
     if #parts == 0 then return nil end
 
     -- Check if any contributing binding has stopSpellTarget enabled

ClickCasting/Constants.lua

@@ -303,6 +303,7 @@ local DEFAULT_BINDING = {
         target = false,
         selfCast = false,
         stopSpellTarget = false,
+        alwaysCast = false,
     },
     -- Load conditions
     loadSpec = nil, -- nil = all specs, or table of spec IDs
@@ -453,6 +454,10 @@ local FALLBACK_INFO = {
         name = "Self",
         desc = "Cast on yourself as a last resort if no other valid target is found.",
     },
+    alwaysCast = {
+        name = "Always Cast",
+        desc = "If no rule above matches (hovering nothing, or an ineligible unit), cast anyway using the spell's normal targeting. Lets ground-targeted spells show their aiming circle when pressed in the open. If Self is also enabled, Self applies first.",
+    },
     stopSpellTarget = {
         name = "Cancel Targeting",
         desc = "Adds /stopspelltarget to the macro which cancels the blue targeting hand after casting. Disable this for spells like Rescue that require a targeting phase to complete.",