diff --git a/.agents/skills/webjs/SKILL.md b/.agents/skills/webjs/SKILL.md
index c9bf72124..3973d8d52 100644
--- a/.agents/skills/webjs/SKILL.md
+++ b/.agents/skills/webjs/SKILL.md
@@ -105,7 +105,7 @@ App-internal imports use the `#` root alias (`import { db } from '#db/connection
 9. No backtick characters inside an `html\`...\`` body, even in comments (it closes the literal and 500s).
 10. TypeScript must be erasable (`erasableSyntaxOnly: true`): no `enum`, no value `namespace`, no constructor parameter properties, no legacy decorators.
 11. Reactive properties are declared ONLY through the base-class factory `extends WebComponent({ count: Number })`. Never a `static properties` block, never a class-field initializer (it clobbers the reactive accessor).
-12. A form that writes binds its action: `<form action=${importedAction}>`, or a per-button `<button formaction=${importedAction}>` inside a bound form. Quoted bindings, non-submit controls, `<input type="submit">` (the identity needs its `value`, which is also its label, so use a `<button>`), submitter `name` / `value` / `form` / static `formaction` attributes, a `.prop` spelling of any of those, `action=${fn}` off a `<form>`, a bound form with `method="get"`, `formmethod="get"` or an unparseable `formenctype` on ANY submitter in a bound form, and a non-action function all throw. A page has no `action` export, so a bare `<form method="post">` is a 405.
+12. A form that writes binds its action: `<form action=${importedAction}>`, or a per-button `<button formaction=${importedAction}>` inside a bound form. Quoted bindings, non-submit controls, `<input type="submit">` (the identity needs its `value`, which is also its label, so use a `<button>`), submitter `name` / `value` / `form` / static `formaction` attributes, a `.prop` spelling of any of those, `action=${fn}` off a `<form>`, a bound form with `method="get"`, `formmethod="get"` or an unparseable `formenctype` on ANY submitter in a bound form, and a non-action function all throw. A page has no `action` export, so a bare `<form method="post">` is a 405. The ONE shape that does not throw is a submitter whose enclosing form the renderer cannot see (the button in a component, the form in the page): that is a cannot-tell and binds anyway. An unbound host form that still sends a parseable POST body works (the identity rides the button's own name/value pair), but one with no `method` submits as a GET with the identity in the query string, so the action silently never runs. `webjs check`'s `submitter-needs-bound-form` catches it statically.
 
 ## Export Map
 
@@ -237,6 +237,7 @@ Success is a 303 (PRG); failure re-renders the page at 422 with the result on `a
 - Writing a bare `<form method="post">` and expecting a page `action` export to catch it. There is no such export; bind the action with `action=${fn}` or the submission is a 405.
 - Putting a submitter's `formaction=${fn}` on anything that is not a submit control, or on a button carrying its own `name` / `value`. The identity IS the button's name/value pair, so both halves are spoken for.
 - Writing `formmethod="get"` or `formenctype="text/plain"` on any button inside a bound form. Neither can carry the action's body, so both are refused even when the button binds nothing.
+- Putting a `formaction=${fn}` submitter in a COMPONENT and forgetting to bind the `<form>` in the page that renders it. This is the one near-miss that does NOT throw: the component renders in a separate pass with no view of the host page, so the renderer binds anyway. If that host form has no `method` it submits as a GET, the identity rides the query string, the action never runs, and the page re-renders with a 200. (An unbound `<form method="post">` does deliver, so that one works.) Run `webjs check` (`submitter-needs-bound-form`) and see `muscle-memory-gotchas.md`.
 - Binding an action whose file declares `export const method = 'GET'`. That is a 405 at runtime and a `webjs check` error.
 - Throwing `redirect()` / `notFound()` inside a `route.ts` handler (uncaught 500). Return a `Response` there.
 - A placeholder first paint that fetches in `connectedCallback`. SSR does not call `connectedCallback`; put first-paint data in the constructor (server-known inputs) or use `async render()`.
diff --git a/.agents/skills/webjs/references/built-ins.md b/.agents/skills/webjs/references/built-ins.md
index 4c550adca..7a2a746d4 100644
--- a/.agents/skills/webjs/references/built-ins.md
+++ b/.agents/skills/webjs/references/built-ins.md
@@ -233,7 +233,7 @@ Wired at the single response funnel, covering pages, routes, actions, and assets
 
 - **Access log.** One structured `info` line per handled request (`method`, `path`, `status`, `durationMs`, `requestId`). Never logs bodies or secrets; framework `/__webjs/*` traffic is suppressed.
 - **Request id.** Each request gets a `crypto.randomUUID()` correlation id, set as `X-Request-Id` (honoring a trusted inbound one) and readable server-side with `requestId()` from `@webjsdev/server` (returns `null` outside a request scope).
-- **`onError` hook.** Register via `createRequestHandler({ onError })` or `startServer({ onError })`. Called with `(error, { request, requestId, phase })` on any caught pipeline error, before the sanitized response is sent. Best-effort (a throwing hook is ignored), purely additive (the sanitized 500 / action digest is unchanged). Point it at Sentry or an APM.
+- **`onError` hook.** Register via `createRequestHandler({ onError })` or `startServer({ onError })`. Called with `(error, { request, requestId, phase })` on any caught pipeline error, before the sanitized response is sent. Best-effort (a throwing hook is ignored), purely additive (the sanitized 500 / action digest is unchanged). Point it at Sentry or an APM. It also carries two framework DIAGNOSTICS that are not request failures, each with an `err.code` to group or filter on, both under `phase: 'action'`: `WEBJS_FORM_SUBMITTED_AS_GET` (a page GET carrying the reserved `__webjs_action` field in its query string, which only a bound submitter inside an UNBOUND form produces, #1307) and `WEBJS_FORM_ACTION_MISSING` (a PARSEABLE form body carrying no identity, the 405; an `enctype="text/plain"` submission is answered before its body is read, so it stays a bare 405). Both are detect-only, so the 200 and the 405 are unchanged; both carry `method`, `pathname`, and for the second the submitted field NAMES, never the values; and both are deduplicated per process on the code, the method, and the matched ROUTE (not the request pathname, so crafted urls on a dynamic route cannot exhaust the 256-entry cap and silence the diagnostics), since either is reachable by an unauthenticated request and an uncapped report would be a free amplifier into a paid sink.
 
 ```ts
 const app = await createRequestHandler({
diff --git a/.agents/skills/webjs/references/data-and-actions.md b/.agents/skills/webjs/references/data-and-actions.md
index e36ef7e26..79239b407 100644
--- a/.agents/skills/webjs/references/data-and-actions.md
+++ b/.agents/skills/webjs/references/data-and-actions.md
@@ -146,6 +146,7 @@ Everything the action declares applies here too, or an action would be protected
 - `invalidates` is evicted when the action actually RAN (a middleware short-circuit does not evict), and the evicted tags are reported on the response so the browser's tag coordinator bypasses a stale cached GET. One reach limit: `fetch` follows the success `303` transparently, so JS cannot read a redirect's headers; the tags are on the wire and the `422` re-render carries them, and the redirect's own render is server-side and seeds fresh data.
 - `invalidates` and `tags` receive the SAME first argument the action does, so on a form boundary they receive the `FormData`. `invalidates: (input) => ['post:' + input.id]` returns `post:undefined` for a submission and evicts nothing. Either read the field (`(fd) => ['post:' + fd.get('id')]`), declare a `validate` that transforms the `FormData` into the typed input first (the transform result is what the config functions then see), or use an argument-independent tag.
 - `method = 'GET'` cannot be bound to a form: a GET action rides its args in the url and is CSRF-exempt, so it cannot answer a form POST. That is a `405` at runtime and the `form-action-not-a-get-action` error in `webjs check`.
+- A form whose buttons run DIFFERENT actions binds each on its submitter, `<button formaction=${publishDraft}>`, inside a form that is itself bound. **Bind the enclosing form**, because `method="post"` and the enctype are supplied on the form's start tag and a per-button action cannot retrofit them. The renderer refuses an unbound host form it can see, but a submitter in a COMPONENT is a cannot-tell (the component renders in its own pass with no view of the host page) and binds anyway. What happens then depends on the host form. One that still sends a parseable POST body WORKS, because the identity rides the button's own `name`/`value` pair into the body. One with no `method` (or `method="get"`) submits a GET, so the identity rides the query string, the action never runs, and the page re-renders with a 200 with nothing thrown and nothing logged. `webjs check`'s `submitter-needs-bound-form` resolves this across modules and flags it at edit time; in dev the client logs one `console.error` at submit time, and in production both server-visible fingerprints reach `onError` with a code (`WEBJS_FORM_SUBMITTED_AS_GET` for the query-string GET, `WEBJS_FORM_ACTION_MISSING` for a body carrying no identity). See `muscle-memory-gotchas.md` for the shape.
 
 The response drives the page: a success is a `303` PRG (to `result.redirect` when it is a same-site local path, else the page's own url), a failure re-renders the SAME page with `status` (default `422`) and the result on `actionData`, a submission carrying no identity is a `405`, and one whose hash no longer resolves is a `422` with a resubmit message (a form held open across a deploy). The submission is Origin-verified like an RPC call, so no token field is needed.
 
diff --git a/.agents/skills/webjs/references/muscle-memory-gotchas.md b/.agents/skills/webjs/references/muscle-memory-gotchas.md
index 2d8f11419..0270d4d6b 100644
--- a/.agents/skills/webjs/references/muscle-memory-gotchas.md
+++ b/.agents/skills/webjs/references/muscle-memory-gotchas.md
@@ -96,7 +96,8 @@ The bound, refused, and allowed shapes in full. Every "no" row is a binding that
 | `action=${fn}` on any other tag | yes | `action` submits nothing off a `<form>`, so it is an ordinary attribute and the function would be stringified |
 | `action="${fn}"`, or a mixed `action="/x/${fn}"` | yes | quoting turns a binding hole back into a plain attribute |
 | `formaction=${fn}` unquoted, on a submitter inside a bound form | **no, it BINDS** | the second supported shape (#1207). The identity rides the button's own `name`/`value` pair, the one channel a browser submits for the pressed button alone, so no `formaction` url is emitted and the server takes the LAST `__webjs_action` entry |
-| `formaction=${fn}` inside an UNBOUND `<form>` | yes | `method="post"` and the enctype are forced on the FORM's start tag, which SSR has already emitted by the time it reaches the button, so a per-button action cannot retrofit them |
+| `formaction=${fn}` inside an UNBOUND `<form>` **the renderer can see** | yes | `method="post"` and the enctype are forced on the FORM's start tag, which SSR has already emitted by the time it reaches the button, so a per-button action cannot retrofit them |
+| `formaction=${fn}` inside an unbound form the renderer CANNOT see (the button is in a component, the form is in the page) | **no, it BINDS** | a component renders its own template in a separate pass with no view of the host page, so boundness is a cannot-tell there and cannot-tell has to bind. `webjs check`'s `submitter-needs-bound-form` is what catches this one, and it is silent at runtime otherwise: see the section below |
 | `formaction=${fn}` on a submitter carrying its own `name` or `value` | yes | the identity IS that name/value pair, so both halves are already spoken for. Bind one action on the form and dispatch on `name="intent"` if you need the button's own value |
 | `formaction=${fn}` on a non-submit control, or `<input type="image">` | yes | `formaction` is inert on anything that does not submit, and an image submitter sends `name.x` / `name.y` coordinates instead of `name=value`, so the identity would never arrive |
 | `formaction=${fn}` on a submitter with `form="other"` | yes | it re-points the submitter at a form other than the bound one it sits in, so the boundness just checked was about the wrong element |
@@ -120,6 +121,28 @@ That last row is the one to remember: quoting a binding hole turns it back into
 
 `.action=${fn}` on a native form is refused during SSR too, even though the property is dropped there and nothing could leak, so a page cannot render clean on the server and then throw on hydration.
 
+**A submitter in a component whose host form is unbound AND cannot carry a body is the one failure the renderers cannot throw on.** It is the shape to check by hand whenever you split a form across modules:
+
+```ts
+// components/publish-button.ts   <- the submitter lives here
+class PublishButton extends WebComponent({}) {
+  render() { return html`<button formaction=${publishDraft}>Publish</button>`; }
+}
+PublishButton.register('publish-button');
+
+// app/triage/page.ts             <- the form lives here
+// WRONG: the form binds nothing, and NOTHING throws.
+html`<form><publish-button></publish-button></form>`;
+// RIGHT: bind the enclosing form too.
+html`<form action=${saveAll}><publish-button></publish-button></form>`;
+```
+
+The component renders its own template in a separate pass with no view of the host page, so the renderer sees a cannot-tell and binds anyway (refusing would drop an isolated component from a page that still returned 200, which is worse). What ships is a button carrying the reserved `__webjs_action` identity inside whatever form the page wrote. Whether that is broken depends on the form, and the distinction is easy to miss: one that still sends a parseable POST body WORKS, because the identity rides the button's own `name`/`value` pair into the body and the dispatcher runs the action. One with no `method` (or `method="get"`) submits a GET, so the identity rides the QUERY STRING, the action never runs, the page re-renders, the status is 200, and there is no throw, no log, and no 405. A silent write path is the whole failure mode, so treat the address bar growing a `?__webjs_action=` as the fingerprint.
+
+**Two runtime signals back the check up.** In dev, submitting a form that carries an action identity it cannot deliver logs one `console.error` naming the fix, once per shape; it never throws, so the submission behaves exactly as it does in production. In production, both server-visible fingerprints reach the `onError` hook (the programmatic `createRequestHandler({ onError })` option and any sink an `instrumentation.{js,ts}` installed) with a code to group on: `WEBJS_FORM_SUBMITTED_AS_GET` for a page GET carrying the reserved field in its query string, and `WEBJS_FORM_ACTION_MISSING` for a form body carrying no identity at all. Both are detect-only, so no status changes, and both carry the submitted field NAMES and never the values.
+
+**Run `webjs check` and it catches this for you.** The `submitter-needs-bound-form` rule reads every template in the app at once, which neither renderer can do, so it resolves the enclosing form across module boundaries and transitively through intermediate components (a page's form around `<todo-list>` around `<todo-row>` around the button). It is conservative by design and says nothing when it cannot be sure: a tag rendered in a bound form somewhere and an unbound one elsewhere, a tag whose host form is unbound but still DELIVERS (that shape works), a form whose `method` or `enctype` comes from a hole, a tag with no call site in the app, a submitter in a bare `html` helper rather than a component class body, a file registering more than one tag, a file that opens a form of its own, a submitter or tag handed to another element through a start-tag hole (`<my-thing .tpl=${html`…`}>`), a `formaction` hole that is not a proven action binding (a url string or CONSTANT, a factory-produced export, a namespace or default import, a barrel re-export, or a non-identifier expression like `acts.publishDraft`), or a reference cycle. The one start-tag hole it DOES judge is `<webjs-suspense .fallback=${html`…`}>`, because the renderer renders a fallback inline in the enclosing form rather than handing it off. Silence from the rule is therefore not proof the form is bound; a green check plus the shape above still deserves a look.
+
 **Inside a component you may never see the error.** Per-component SSR error isolation contains the throw, so development shows an error box in place of the component and production renders it empty with the page still returning 200. A form that has silently vanished in production is this bug wearing a disguise; the message is in the server log. Nothing leaks either way.
 
 Two things that "renders it empty" understates, both worth knowing before you go looking:
diff --git a/AGENTS.md b/AGENTS.md
index 154012550..d8d793386 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -483,7 +483,7 @@ const result = await optimistic(liked, true, () => likePost(postId));
 
 11. **No em-dashes (U+2014), no hyphen or semicolon used as pause-punctuation in prose, and no colon attached to a code-shaped LHS.** Banned as a pause: U+2014, a space-surrounded hyphen between words, a space-surrounded semicolon between words. Banned colon attachments: a colon-then-prose after `xyz()`, a `<my-tag>`, an `[expr]` subscript, or a `<code>foo()</code>` definition list (rephrase verb-led). Prefer a period, comma, a colon on a plain-noun LHS, parentheses, or a restructure. Plain hyphens stay fine in compound words, flags, filenames, ranges; semicolons and colons stay fine inside code / TS / JSON / CSS. The same hook also enforces brand casing with one simple rule: `WebJs` is a proper noun, so write it capitalized wherever it NAMES the project in prose, at a sentence start AND mid-sentence (`WebJs ships`, `Most WebJs apps`, `the WebJs serializer`). It stays lowercase `webjs` ONLY as a literal code token: a `webjs <subcommand>` CLI command (`webjs dev`, `webjs db migrate`), a `webjs.dev` domain, an `@webjsdev` package, a `"webjs"` config key, a `WEBJS_*` env var, the `webjsdev/webjs` org path, or anything inside a `` `code` `` span or fenced block. If you mean the literal config key or command in prose, wrap it in backticks. Enforced via `.claude/hooks/block-prose-punctuation.sh`, which scans only NEW content (you can still edit an existing line to fix a glyph or casing).
 
-12. **A form that writes binds its action: `<form action=${importedAction}>`, and a form whose buttons run different actions binds each on its submitter, `<button formaction=${importedAction}>` inside that bound form** (#1155, #1207). Those are the two shapes the renderer reads, and every near-miss throws rather than producing a form that posts nowhere. The submitter identity rides the pressed button's own `name`/`value` pair (the one channel a browser submits for that button alone), so no `formaction` url is emitted, both entries reach the server, and the dispatcher takes the LAST `__webjs_action` in DOM order, which is the submitter's whenever one was pressed. **Refused on a form:** a quoted `action="${fn}"`, `action=${fn}` on any tag other than `<form>`, `method="get"` or an enctype the server cannot parse, a `.method` / `.enctype` / `.encoding` PROPERTY binding (a `.prop` drops at SSR and applies in the browser, so the form would submit differently with JS than without), a second `action` hole, a plain `action="/url"` alongside the bound hole (SSR keeps it and the client drops it), a whitespace-padded `method=" post "` (an enumerated attribute is matched against exact keywords, so a padded value falls to the invalid-value default and submits as a GET), and a function that is not a `'use server'` export. **Refused on a submitter:** an enclosing form that is not itself bound (`method` and the enctype are forced on the form's start tag, too late to add from the button), a control that is not a submit control, an `<input type="image">` (it submits `name.x` / `name.y` coordinates, so the identity never arrives), an `<input type="submit">` (the identity has to occupy its `value`, which on that control is also its visible label, so it would render captioned with the action id and could never be labelled; a `<button>` has no such conflict), a submitter carrying its own `name`, `value`, `form`, or static `formaction`, a `.prop` spelling of any of those (`.name` / `.value` / `.formAction` / `.formMethod` / `.formEnctype` all REFLECT on a submitter, so the write is dropped at SSR and lands in the attribute in the browser), and a second `formaction` hole. **Refused on ANY submitter inside a bound form, whether or not it binds:** `formmethod="get"` and an unparseable `formenctype` such as `text/plain`, since either works under JS (the router posts `FormData`) and is a bare `405` without it. Two carve-outs there: `formmethod="dialog"` never submits, and a plain `formaction="/url"` retargets away from the bound action. WebJs supplies `method` and `enctype` only where your template supplies neither, judged from the TEMPLATE rather than the rendered element: `?method=${false}` emits nothing so it is supplied, while `method=${null}` emits `method=""` and is refused. An `encoding=` attribute is inert in HTML (only the `.encoding` PROPERTY aliases `enctype`), so both renderers ignore it. A page has no `action` export, so a bare `<form method="post">` is a `405`. **Boundness is BEST EFFORT in both renderers, and neither always knows.** SSR reads a linear byte stream, so it knows within one template scan, but a COMPONENT renders its own template in a separate pass with no view of the host page, and the client may reconcile a submitter whose form lives in a parent template and is not in the tree yet (a `repeat()` row). Each renderer therefore distinguishes three answers: bound (fine), unbound (refused), and cannot-tell (bind anyway). Cannot-tell has to bind: refusing there would reject a per-row button in a list or a button inside a component, both ordinary shapes, and at SSR a refused component is ISOLATED, so in production the button would silently vanish from a page that still returned 200. The refusal still fires wherever the answer is genuinely known.
+12. **A form that writes binds its action: `<form action=${importedAction}>`, and a form whose buttons run different actions binds each on its submitter, `<button formaction=${importedAction}>` inside that bound form** (#1155, #1207). Those are the two shapes the renderer reads, and every near-miss throws rather than producing a form that posts nowhere. The submitter identity rides the pressed button's own `name`/`value` pair (the one channel a browser submits for that button alone), so no `formaction` url is emitted, both entries reach the server, and the dispatcher takes the LAST `__webjs_action` in DOM order, which is the submitter's whenever one was pressed. **Refused on a form:** a quoted `action="${fn}"`, `action=${fn}` on any tag other than `<form>`, `method="get"` or an enctype the server cannot parse, a `.method` / `.enctype` / `.encoding` PROPERTY binding (a `.prop` drops at SSR and applies in the browser, so the form would submit differently with JS than without), a second `action` hole, a plain `action="/url"` alongside the bound hole (SSR keeps it and the client drops it), a whitespace-padded `method=" post "` (an enumerated attribute is matched against exact keywords, so a padded value falls to the invalid-value default and submits as a GET), and a function that is not a `'use server'` export. **Refused on a submitter:** an enclosing form that is not itself bound (`method` and the enctype are forced on the form's start tag, too late to add from the button), a control that is not a submit control, an `<input type="image">` (it submits `name.x` / `name.y` coordinates, so the identity never arrives), an `<input type="submit">` (the identity has to occupy its `value`, which on that control is also its visible label, so it would render captioned with the action id and could never be labelled; a `<button>` has no such conflict), a submitter carrying its own `name`, `value`, `form`, or static `formaction`, a `.prop` spelling of any of those (`.name` / `.value` / `.formAction` / `.formMethod` / `.formEnctype` all REFLECT on a submitter, so the write is dropped at SSR and lands in the attribute in the browser), and a second `formaction` hole. **Refused on ANY submitter inside a bound form, whether or not it binds:** `formmethod="get"` and an unparseable `formenctype` such as `text/plain`, since either works under JS (the router posts `FormData`) and is a bare `405` without it. Two carve-outs there: `formmethod="dialog"` never submits, and a plain `formaction="/url"` retargets away from the bound action. WebJs supplies `method` and `enctype` only where your template supplies neither, judged from the TEMPLATE rather than the rendered element: `?method=${false}` emits nothing so it is supplied, while `method=${null}` emits `method=""` and is refused. An `encoding=` attribute is inert in HTML (only the `.encoding` PROPERTY aliases `enctype`), so both renderers ignore it. A page has no `action` export, so a bare `<form method="post">` is a `405`. **Boundness is BEST EFFORT in both renderers, and neither always knows.** SSR reads a linear byte stream, so it knows within one template scan, but a COMPONENT renders its own template in a separate pass with no view of the host page, and the client may reconcile a submitter whose form lives in a parent template and is not in the tree yet (a `repeat()` row). Each renderer therefore distinguishes three answers: bound (fine), unbound (refused), and cannot-tell (bind anyway). Cannot-tell has to bind: refusing there would reject a per-row button in a list or a button inside a component, both ordinary shapes, and at SSR a refused component is ISOLATED, so in production the button would silently vanish from a page that still returned 200. The refusal still fires wherever the answer is genuinely known. **`webjs check`'s `submitter-needs-bound-form` rule (#1307) closes the residual statically**, because it has neither renderer's limit: it reads every template in the app at once, so it flags a submitter whose enclosing form is unbound in the same scan AND one whose component is only ever rendered inside an unbound form, across module boundaries and transitively through intermediate components. It is deliberately conservative and stays silent on anything it cannot resolve (a tag with mixed call sites, a tag with no call site, an unbound call site that still DELIVERS the identity, a dynamic `method` / `enctype` hole, a submitter in a bare `html` helper, a multi-component file, a file that opens a form of its own, a submitter or tag handed to another element through a start-tag hole, a `formaction` hole that is not a proven action binding (a url string, a url CONSTANT exported from a `.server` module, a factory-produced export, a namespace or default import, a barrel re-export, or any non-identifier expression such as `acts.publishDraft` or `this.act`), a reference cycle), so it can never false-positive on the ordinary shapes the cannot-tell fallback exists to protect. The one start-tag hole it DOES judge is `<webjs-suspense .fallback=${…}>`, because the renderer renders a fallback inline in the enclosing form rather than handing it off. Worth knowing what the residual actually does when it ships, because it is narrower than it first looks. An unbound form that still sends a parseable POST body WORKS: the submitter's identity rides its own `name`/`value` pair, so it reaches the dispatcher and the action runs. What breaks is an unbound form that sends nothing readable. With no `method` (or `method="get"`) the browser submits a GET, so the identity rides the QUERY STRING, the action never runs, and the page re-renders with a 200 and nothing thrown; with an unparseable enctype it is a bare 405. The rule flags only the cross-module cases that cannot deliver, and flags a SAME-scan unbound form whatever its method, because the renderer refuses that shape outright. Two more layers make that loud instead of silent. In DEV the client logs one `console.error` at submit time when the submission cannot carry the identity (it logs and never throws, because the listener is delegated at the document and a throw there would abort before `preventDefault` and make dev behave differently from production). In PRODUCTION both server-visible fingerprints reach the `onError` hook with a code: `WEBJS_FORM_SUBMITTED_AS_GET` for a page GET carrying the field in its query string, and `WEBJS_FORM_ACTION_MISSING` for a parseable form body carrying no identity (an `enctype="text/plain"` submission is answered by the non-form 405 before its body is read, so that variant stays a bare 405 and only the dev client guard flags it). Both are detect-only (the GET keeps its 200, the bind-nothing submission keeps its 405), carry the submitted field NAMES but never the values, and are deduplicated per process on the code, the method, and the matched ROUTE (not the request pathname, so crafted urls on a dynamic route cannot exhaust the 256-entry cap and silence the diagnostics), because either fingerprint is reachable by an unauthenticated attacker and an uncapped report would be a free amplifier into a paid APM sink.
 
 ---
 
diff --git a/examples/blog/app/feedback/triage-split/page.ts b/examples/blog/app/feedback/triage-split/page.ts
new file mode 100644
index 000000000..c7fb55af5
--- /dev/null
+++ b/examples/blog/app/feedback/triage-split/page.ts
@@ -0,0 +1,48 @@
+import { html } from '@webjsdev/core';
+import { saveDraft } from '#modules/feedback/actions/save-draft.server.ts';
+import '#modules/feedback/components/publish-button.ts';
+
+/**
+ * The same page as `/feedback/triage`, with the Publish button moved into a
+ * component (#1307).
+ *
+ * `/feedback/triage` keeps the form and the submitter in ONE template, so the
+ * renderer resolves boundness in a single scan and the cannot-tell path is
+ * never taken. This route is the other half: the form is bound here and the
+ * submitter is bound one module over, which is the shape SSR cannot judge in
+ * one pass and therefore binds on faith.
+ *
+ * It is dogfood coverage and an e2e fixture at once. With JavaScript off the
+ * served markup must still carry the component-rendered button's
+ * `name="__webjs_action"` and its `<hash>/publishDraft` value, and a native
+ * submit must run the action. If the cannot-tell fallback were ever made to
+ * refuse, the component would render empty (SSR component errors are isolated),
+ * the button would not be in the DOM at all, and that e2e would fail.
+ */
+
+type PageCtx = {
+  actionData?: { fieldErrors?: Record<string, string>; values?: Record<string, string> };
+};
+
+export const metadata = { title: 'Triage (split) - WebJs Blog' };
+
+export default function TriageSplitPage({ actionData }: PageCtx) {
+  const err = actionData?.fieldErrors?.note;
+  const val = actionData?.values?.note || '';
+  return html`
+    <div class="max-w-[460px] mt-6 mx-auto">
+      <h1 class="font-serif text-2xl font-bold mb-4">Triage a note (split)</h1>
+      <form action=${saveDraft} class="flex flex-col gap-3">
+        <label class="flex flex-col gap-1">
+          <span>Note</span>
+          <input id="note" name="note" type="text" value=${val} class="border rounded px-2 py-1">
+        </label>
+        ${err ? html`<p id="note-error" class="text-sm text-red-600">${err}</p>` : ''}
+        <div class="flex gap-2">
+          <button id="save" class="border rounded px-3 py-1">Save draft</button>
+          <publish-button></publish-button>
+        </div>
+      </form>
+    </div>
+  `;
+}
diff --git a/examples/blog/modules/feedback/components/publish-button.ts b/examples/blog/modules/feedback/components/publish-button.ts
new file mode 100644
index 000000000..9ca39df26
--- /dev/null
+++ b/examples/blog/modules/feedback/components/publish-button.ts
@@ -0,0 +1,29 @@
+import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish-draft.server.ts';
+
+/**
+ * The submitter half of the CANNOT-TELL shape (#1307), split out of its form on
+ * purpose.
+ *
+ * A component renders its own template in a separate pass with no view of the
+ * host page, so when the renderer reaches this `formaction=${publishDraft}` it
+ * cannot know whether the enclosing `<form>` binds an action. That is the
+ * cannot-tell answer, and cannot-tell BINDS: refusing there would reject a
+ * per-row button in a list and a button inside a component, both ordinary
+ * shapes, and an SSR refusal is isolated per component, so production would
+ * return 200 with this button silently gone.
+ *
+ * `/feedback/triage-split` renders this inside a form that IS bound, which is
+ * the fallback working correctly. It is also the counterfactual for the whole
+ * change: make cannot-tell refuse and this component renders empty, so the e2e
+ * that submits this button with JavaScript off goes red.
+ *
+ * The mirror image, this button inside an UNBOUND form, is what
+ * `webjs check`'s `submitter-needs-bound-form` rule exists to catch.
+ */
+class PublishButton extends WebComponent({}) {
+  render() {
+    return html`<button id="publish" formaction=${publishDraft} class="border rounded px-3 py-1">Publish</button>`;
+  }
+}
+PublishButton.register('publish-button');
diff --git a/packages/cli/templates/gallery/modules/todo/actions/submit-todo.server.ts b/packages/cli/templates/gallery/modules/todo/actions/submit-todo.server.ts
index a0f83144c..708fa2dc5 100644
--- a/packages/cli/templates/gallery/modules/todo/actions/submit-todo.server.ts
+++ b/packages/cli/templates/gallery/modules/todo/actions/submit-todo.server.ts
@@ -19,6 +19,18 @@ import { deleteTodo } from './delete-todo.server.ts';
 // control's visible label), and a bound submitter cannot carry its own
 // `name`/`value`, which is exactly the channel `name="intent"` uses below.
 //
+// Third thing to know, and the one that fails silently: the enclosing <form>
+// has to be bound too, because `method="post"` and the enctype are supplied on
+// the form's start tag and a per-button action cannot retrofit them. The
+// renderer refuses an unbound form it can see, but a submitter inside a
+// COMPONENT is a cannot-tell (the component renders in its own pass with no
+// view of the host page) and binds anyway. What happens then depends on that
+// form: one still declaring `method="post"` works (the identity rides the
+// button's own name/value pair into the body), but one with no method submits as
+// a GET, so the identity rides the query string and the action never runs while
+// the page returns 200. Run `webjs check`: `submitter-needs-bound-form` finds
+// these across modules.
+//
 // With JS the component intercepts the submit and calls the underlying action
 // directly for the optimistic path, so this runs only with JS off.
 export async function submitTodo(formData: FormData) {
diff --git a/packages/core/AGENTS.md b/packages/core/AGENTS.md
index 6998ef61c..87e3a9ada 100644
--- a/packages/core/AGENTS.md
+++ b/packages/core/AGENTS.md
@@ -35,10 +35,10 @@ the same output in all three.
 | `directives.js` | the lit-html-parity directive set (`unsafeHTML`, `live`, `keyed`, `guard`, `templateContent`, `ref` / `createRef`, `cache`, `until`, `asyncAppend` / `asyncReplace`, `watch`, plus each `is*` guard). `repeat` lives in `repeat.js`. All are re-exported from `index.js` / `index-browser.js` so the bare specifier and the `/directives` subpath (which collapses onto the dist browser bundle) expose the full set |
 | `repeat.js` | `repeat(items, keyFn, templateFn)` for keyed list reconciliation |
 | `suspense.js` | `Suspense()` page/region-level boundary primitive |
-| `webjs-suspense.js` | The `<webjs-suspense>` component-level streaming boundary element (#471). SSR (`render-server.js`) does the work: `injectDSD`'s `processSuspenseElements` pre-pass reads `.fallback` (carried as `data-webjs-fallback` by `renderTemplate`, since a TemplateResult is not serializer-safe) and, in a streaming context, flushes the fallback as `<webjs-suspense id="sN">` while pushing the children to `ctx.pending` for out-of-order streaming (concurrent across boundaries via `Promise.all`); without a streaming context the children render inline (blocking). This client element is layout-neutral (`display:contents`) and the registration home for the soft-nav apply; first-load streaming needs no client runtime (the inline swap script `replaceWith`s the boundary element with the resolved children, which then upgrade). Every swap path (the inline script, the boot `__webjsResolve`, and the soft-nav `applyStreamedResolve`) removes the transient wrapper, so a boundary settles to the same DOM however the page was reached. SSR-inert (defined client-side only) |
+| `webjs-suspense.js` | The `<webjs-suspense>` component-level streaming boundary element (#471). SSR (`render-server.js`) does the work: `injectDSD`'s `processSuspenseElements` pre-pass reads `.fallback` (carried as `data-webjs-fallback` by `renderTemplate`, because the normal `data-webjs-prop-*` path applies the property at hydration, far too late for a placeholder that must be in the first flushed bytes) and, in a streaming context, flushes the fallback as `<webjs-suspense id="sN">` while pushing the children to `ctx.pending` for out-of-order streaming (concurrent across boundaries via `Promise.all`); without a streaming context the children render inline (blocking). This client element is layout-neutral (`display:contents`) and the registration home for the soft-nav apply; first-load streaming needs no client runtime (the inline swap script `replaceWith`s the boundary element with the resolved children, which then upgrade). Every swap path (the inline script, the boot `__webjsResolve`, and the soft-nav `applyStreamedResolve`) removes the transient wrapper, so a boundary settles to the same DOM however the page was reached. SSR-inert (defined client-side only) |
 | `context.js` | Context Protocol: `createContext`, `ContextProvider`, `ContextConsumer`, `ContextRequestEvent` |
 | `task.js` | `Task` / `TaskStatus` controller for async data in components |
-| `router-client.js` | Turbo Drive–style client router; entry: `enableClientRouter` / `navigate`. Also exports `loadFrame(frameEl, url)` (#253), the reusable frame self-load `webjs-frame.js` calls: it fetches `url` as a frame nav (the `x-webjs-frame` header) and applies the matched subtree through the SAME `fetchAndApply` frame-swap path a click uses (no history push / snapshot / optimistic skeleton, since it swaps one region). Post-swap activation of a boundary range goes through `activateSwappedRange` (#1102), the ONE place both tiers (`replaceBoundaryRange`, `swapMarkerRange`) reactivate scripts and upgrade custom elements. Two things it owns and a new call site must keep: it SNAPSHOTS the range before iterating, because `reactivateScripts` replaces a top-level script and a detached node cuts a live `nextSibling` walk (every later node in the range is then silently skipped); and `reactivateScripts` handles container-IS-a-script itself, since `querySelectorAll` never matches the node it is called on. A top-level script therefore re-executes on every swap of its range, INCLUDING one the keyed differ reused by `id`, matching what a descendant script in a reused container has always done. `data-webjs-permanent` splits into two cases and they must NOT be unified (#1252). The marked element IS a script: NEVER exempt, whether the walk reaches it as the container or as a descendant of one (the regraft selector has no tag filter, so a marked script IS preserved by identity and does land in the WeakSet, which is why the exemption is STRICT containment and never reflexive). The regraft also has a both-exist guard, so on the swap that first mounts a route there is no live node to preserve and exempting the inert parsed copy would leave a script that runs on a cold load and never on a soft nav, which is #1102 itself. Script INSIDE a preserved marked element: exempt, because the attribute is subtree-scoped (`diffElementInPlace` already returns early rather than recursing into one) and re-emitting an init script against an instance the author kept alive is a double-initialization. The filter keys on the `regraftedPermanents` WeakSet, which the two regrafts populate on every successful path, so it means ACTUALLY preserved by identity rather than merely carrying the attribute; an attribute-only filter would leave a first-mount permanent element's scripts never running at all |
+| `router-client.js` | Turbo Drive–style client router; entry: `enableClientRouter` / `navigate`. Carries the dev-only submit-time guard (#1307): in `onSubmit`, after the body is built and BEFORE `preventDefault`, a submission carrying a bound action's identity that cannot deliver it logs one `console.error` per shape: a non-POST method (which loses the identity to the query string on both paths), or the literal `enctype="text/plain"` (which breaks only the no-JS path, since with JS the router posts `FormData` and ignores the attribute). `text/plain` alone, NOT the renderer's wider `PARSEABLE_ENCTYPES` allowlist: `enctype` falls back to urlencoded for a missing AND an invalid value, so testing the allowlist would warn about a form that works. It LOGS and never throws, because this is a delegated document-level listener where a throw would escape uncaught AND abort before `performSubmission`, so dev would submit differently from production; `warnOnce` takes an optional level for it. Also exports `loadFrame(frameEl, url)` (#253), the reusable frame self-load `webjs-frame.js` calls: it fetches `url` as a frame nav (the `x-webjs-frame` header) and applies the matched subtree through the SAME `fetchAndApply` frame-swap path a click uses (no history push / snapshot / optimistic skeleton, since it swaps one region). Post-swap activation of a boundary range goes through `activateSwappedRange` (#1102), the ONE place both tiers (`replaceBoundaryRange`, `swapMarkerRange`) reactivate scripts and upgrade custom elements. Two things it owns and a new call site must keep: it SNAPSHOTS the range before iterating, because `reactivateScripts` replaces a top-level script and a detached node cuts a live `nextSibling` walk (every later node in the range is then silently skipped); and `reactivateScripts` handles container-IS-a-script itself, since `querySelectorAll` never matches the node it is called on. A top-level script therefore re-executes on every swap of its range, INCLUDING one the keyed differ reused by `id`, matching what a descendant script in a reused container has always done. `data-webjs-permanent` splits into two cases and they must NOT be unified (#1252). The marked element IS a script: NEVER exempt, whether the walk reaches it as the container or as a descendant of one (the regraft selector has no tag filter, so a marked script IS preserved by identity and does land in the WeakSet, which is why the exemption is STRICT containment and never reflexive). The regraft also has a both-exist guard, so on the swap that first mounts a route there is no live node to preserve and exempting the inert parsed copy would leave a script that runs on a cold load and never on a soft nav, which is #1102 itself. Script INSIDE a preserved marked element: exempt, because the attribute is subtree-scoped (`diffElementInPlace` already returns early rather than recursing into one) and re-emitting an init script against an instance the author kept alive is a double-initialization. The filter keys on the `regraftedPermanents` WeakSet, which the two regrafts populate on every successful path, so it means ACTUALLY preserved by identity rather than merely carrying the attribute; an attribute-only filter would leave a first-mount permanent element's scripts never running at all |
 | `webjs-frame.js` | The `<webjs-frame id>` custom element (a swap anchor; the router does the swap). Adds the `src` + `loading` self-load (#253): an eager (`connectedCallback`) or lazy (viewport, via `lazy-loader.js`'s `observeViewportOnce`) self-fetch through `router-client.js`'s `loadFrame`, with a per-element loaded-URL guard so eager connect / the lazy observer / a `src` mutation never double-fetch. SSR-inert (defined client-side only) |
 | `webjs-stream.js` | The `<webjs-stream action target>` surgical-update element + `renderStream(payload)` (#248). The element self-applies its action on connect via native DOM (append / prepend / before / after / replace / update / remove against a `target` id or `targets` selector), cloning its single `<template>`, then removes itself. `renderStream(html)` parses a server payload and inserts the elements (they self-apply), so a live channel (`connectWS` / `broadcast`) reuses the SAME applier the HTTP path uses. `router-client.js` side-effect-imports this for app-wide registration and applies a content-negotiated `text/vnd.webjs-stream.html` form response through `renderStream` (sending the stream MIME in `Accept` only on a write, so a JS-off form degrades to a normal render). SSR-inert (defined client-side only) |
 | `registry.js` | Custom-element bookkeeping (`register`, `lookup`, `allTags`, `tagOf`, `isLazy`, `primeModuleUrl`) |
diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index 64f1b0f14..097f5872a 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -423,12 +423,14 @@ async function renderTemplate(tr, ctx, formScopeAtStart = 'none') {
           // page-level `.prop` on a native element could have set the
           // property to begin with.
           out = out.slice(0, attrStart);
-          // `<webjs-suspense .fallback=${html`...`}>` (#471). A TemplateResult
-          // is not serializer-safe (the normal data-webjs-prop-* path would
-          // drop it) and a normal custom-element prop applies only at
-          // hydration, too late for the streaming placeholder. So render the
-          // fallback to HTML now and carry it as data-webjs-fallback, which the
-          // injectDSD streaming pre-pass reads as the boundary placeholder.
+          // `<webjs-suspense .fallback=${html`...`}>` (#471). A custom-element
+          // prop applies only at HYDRATION, far too late for a placeholder that
+          // has to be in the first flushed bytes. So render the fallback to HTML
+          // now and carry it as data-webjs-fallback, which the injectDSD
+          // streaming pre-pass reads as the boundary placeholder. (Timing is the
+          // whole reason. A plain TemplateResult serializes fine and would ride
+          // the normal data-webjs-prop-* path; only one carrying a function
+          // fails, and that is a separate case handled below.)
           if (currentTag === 'webjs-suspense' && name === 'fallback') {
             const fbHtml = await render(val, ctx, formScope);
             out += `data-webjs-fallback="${escapeAttr(fbHtml)}"`;
diff --git a/packages/core/src/router-client.js b/packages/core/src/router-client.js
index a03c1cff4..2e6686da7 100644
--- a/packages/core/src/router-client.js
+++ b/packages/core/src/router-client.js
@@ -24,6 +24,7 @@ import {
   SLOT_STATE, LIGHT_SLOT_ATTR, PROJECTION_ATTR, PROJECTION_ACTUAL,
   projectAuthored, keyOfName, isAuthoredContentSlot,
 } from './slot.js';
+import { FORM_ACTION_FIELD } from './form-action.js';
 
 /** The content type a content-negotiated stream-action response carries (#248). */
 const STREAM_MIME = 'text/vnd.webjs-stream.html';
@@ -592,6 +593,11 @@ function onSubmit(e) {
 
   const body = buildSubmitFormData(form, submitter);
 
+  // After the body is built (that is where the identity becomes answerable) and
+  // before `preventDefault`, so it observes the submission the browser was
+  // about to make and changes nothing about it.
+  warnIfActionSubmissionCannotDeliver(form, submitter, method, body);
+
   e.preventDefault();
   // Resolve the target frame for the submit, same precedence as a link:
   // an explicit `data-webjs-frame` on (or above) the form or its submitter
@@ -768,11 +774,18 @@ function resolveTargetFrameId(trigger) {
  * @type {Set<string>}
  */
 const warnedKeys = new Set();
-/** @param {string} key @param {string} message */
-function warnOnce(key, message) {
+/**
+ * @param {string} key
+ * @param {string} message
+ * @param {'warn' | 'error'} [level] `'error'` for a BROKEN path, which is a
+ *   different severity from a correct-but-suboptimal degradation. The dev
+ *   overlay hooks neither, so raising the level pops nothing.
+ */
+function warnOnce(key, message, level = 'warn') {
   if (warnedKeys.has(key)) return;
   warnedKeys.add(key);
-  if (typeof console !== 'undefined' && console.warn) console.warn(message);
+  const sink = typeof console !== 'undefined' ? console[level] : null;
+  if (sink) sink(message);
 }
 
 /**
@@ -966,6 +979,65 @@ function reportFallback(cause, href, willReload = true) {
   );
 }
 
+/**
+ * Dev-only, fire-once hint: this submission carries a bound action's identity
+ * but cannot deliver it on at least one path, and nothing else will say so
+ * (#1307).
+ *
+ * The two branches differ in reach, so the messages do too. A non-POST method
+ * loses the identity to the query string on BOTH paths. An `enctype="text/plain"`
+ * breaks only the no-JS path, because with JS the router posts `FormData` and
+ * ignores the attribute entirely.
+ *
+ * Reachable through the cannot-tell fallback: a submitter bound inside a
+ * component whose host form is unbound. The client cannot answer that at
+ * reconcile time (the question is skipped while the fragment is detached), but
+ * by submit time both the form and the body are in hand, so the answer is
+ * always available here.
+ *
+ * Logs, never throws. This runs in a delegated document-level listener, so a
+ * throw would escape uncaught AND abort before `preventDefault` and
+ * `performSubmission`, making dev behave differently from production.
+ *
+ * @param {HTMLFormElement} form
+ * @param {HTMLElement | null} submitter
+ * @param {string} method the resolved lowercase submission method
+ * @param {FormData} body the body the submission will actually carry
+ */
+function warnIfActionSubmissionCannotDeliver(form, submitter, method, body) {
+  if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV === 'production') return;
+  // No identity in the body: an ordinary form with nothing to deliver.
+  if (!body.has(FORM_ACTION_FIELD)) return;
+  let path = '';
+  try { path = new URL(form.getAttribute('action') || location.href, location.href).pathname; }
+  catch { path = location.pathname; }
+  if (method !== 'post') {
+    warnOnce(
+      `submit-nowhere:${path}:${method}`,
+      `[webjs] this form carries a bound server action but submits as ${method.toUpperCase()}, which sends no body, so the identity rides the query string and the action never runs. Bind the enclosing <form> (<form action=\${formAction}>), which is what supplies method="post" at form start.`,
+      'error',
+    );
+    return;
+  }
+  const enctype = (submitter && submitter.getAttribute('formenctype'))
+    || form.getAttribute('enctype')
+    || 'application/x-www-form-urlencoded';
+  // `text/plain` ONLY, not the renderer's allowlist. `enctype` is an enumerated
+  // attribute whose missing AND invalid value defaults are both
+  // `application/x-www-form-urlencoded`, so `enctype="nonsense"` submits a
+  // parseable body and the action runs. Testing against the allowlist reported
+  // that working form as broken, which is the inversion `js-scan.js` documents
+  // and the check rule deliberately avoids; the two halves of one feature must
+  // not disagree on the same input.
+  if (enctype.toLowerCase() === 'text/plain') {
+    warnOnce(
+      `submit-nowhere:${path}:${enctype}`,
+      `[webjs] this form carries a bound server action but declares enctype="${enctype}", which the server cannot parse. With JavaScript on the router posts FormData and the action still runs, so this breaks only the no-JS path, where the submission is a 405. Drop the enctype and let the binding supply it.`,
+      'error',
+    );
+  }
+}
+
 /**
  * Dev-only, fire-once-per-id hint: a streamed Suspense resolution arrived but
  * its boundary placeholder was not in the DOM, so it was dropped (#1051). This
diff --git a/packages/core/test/rendering/form-action-binding.test.js b/packages/core/test/rendering/form-action-binding.test.js
index 2d097fa3c..cdad7c82b 100644
--- a/packages/core/test/rendering/form-action-binding.test.js
+++ b/packages/core/test/rendering/form-action-binding.test.js
@@ -698,6 +698,39 @@ test('an UNBOUND form is refused, which is a different answer from cannot-tell',
   );
 });
 
+test('the STREAMING renderer refuses both knowable submitter shapes too', async () => {
+  // The streamed state machine is a second implementation of the same scan, so
+  // the shapes both machines DO express have to be asserted through both entry
+  // points, or a change to one could pass on the other's coverage.
+  //
+  // Only the two knowable answers can be pinned here. A cannot-tell cannot even
+  // arise inside `streamTemplate`: the component pass that seeds 'unknown'
+  // lives in `injectDSD`, which is shared by both entry points and is not
+  // reached by `{ ssr: false }`.
+  withResolver();
+  await assert.rejects(
+    () => drain(renderToStream(html`<button formaction=${submitFeedback}>x</button>`, { ssr: false })),
+    /requires the enclosing <form> to also be bound/,
+    "'none': the scan can see there is no form at all",
+  );
+  await assert.rejects(
+    () => drain(renderToStream(
+      html`<form method="post"><button formaction=${submitFeedback}>x</button></form>`,
+      { ssr: false },
+    )),
+    /requires the enclosing <form> to also be bound/,
+    "'unbound': the form is right there and binds nothing",
+  );
+  // And the bound shape still streams, so the refusals above are discriminating
+  // rather than a blanket rejection of every submitter.
+  const ok = await drain(renderToStream(
+    html`<form action=${submitFeedback}><button formaction=${submitFeedback}>x</button></form>`,
+    { ssr: false },
+  ));
+  assert.equal((ok.match(/name="__webjs_action"/g) || []).length, 2,
+    'the form identity and the submitter identity both stream');
+});
+
 test("the 'unbound' state is what refuses inside a COMPONENT's own form", async () => {
   // The test above cannot observe the 'unbound' transition: a top-level scan
   // starts at 'none', so that template is refused either way, and deleting the
diff --git a/packages/core/test/routing/browser/form-action-submit.test.js b/packages/core/test/routing/browser/form-action-submit.test.js
index 70e8e7646..abeeb5599 100644
--- a/packages/core/test/routing/browser/form-action-submit.test.js
+++ b/packages/core/test/routing/browser/form-action-submit.test.js
@@ -185,4 +185,104 @@ suite('Client router: bound form submissions (#1155)', () => {
       teardown();
     }
   });
+  /**
+   * #1307. A submitter bound inside a component whose host form is unbound
+   * reaches the browser through the renderer's cannot-tell fallback, and the
+   * submission it produces cannot deliver the identity. The client cannot
+   * answer that at reconcile time, but by submit time both the form and the
+   * body are in hand, so the guard fires here.
+   */
+  test('a submission that cannot deliver its action logs once, and still submits', async () => {
+    // A response carrying the SAME keyed boundary the container is bracketed
+    // with, so the router morphs in place. Without it the nav degrades to a
+    // full page load, which is the real production behaviour here but would
+    // reload the test page out from under the runner.
+    setup(() => new Response(
+      '<!--wj:children:/:/--><p>ok</p><!--/wj:children:/-->',
+      { status: 200, headers: { 'content-type': 'text/html', 'x-webjs-build': '' } },
+    ));
+    const errors = [];
+    const origError = console.error;
+    console.error = (...a) => { errors.push(a.join(' ')); };
+    const before = location.pathname + location.search;
+    try {
+      // An UNBOUND form (no method) holding a bound submitter: exactly what the
+      // cannot-tell fallback emits when the button lives in a component.
+      render(html`
+        <form>
+          <button type="submit" name="__webjs_action" value="a1b2c3d4e5/publish">go</button>
+        </form>
+      `, container);
+      // A DISPATCHED submit event, not a click. The router handles it exactly
+      // the same way, but a synthetic event never triggers the browser's own
+      // submission, so a GET promotion cannot navigate the runner page away.
+      const fire = () => {
+        const btn = container.querySelector('button');
+        container.querySelector('form').dispatchEvent(
+          new SubmitEvent('submit', { bubbles: true, cancelable: true, submitter: btn }),
+        );
+      };
+      fire();
+      await tick();
+
+      assert.equal(errors.length, 1, 'exactly one console error');
+      assert.ok(errors[0].includes('[webjs]'), 'the message is framework-prefixed');
+      assert.ok(errors[0].includes('<form action='), 'and it names the fix');
+      // The guard observes; it must not change what the submission does.
+      assert.ok(calls.length, 'the submission still went through');
+
+      // Fire-once per shape, so a repeated misconfiguration does not spam.
+      fire();
+      await tick();
+      assert.equal(errors.length, 1, 'still one after a second submit');
+    } finally {
+      console.error = origError;
+      history.replaceState(null, '', before);
+      teardown();
+    }
+  });
+  /**
+   * #1307, the enctype branch. It is a one-keyword DENYLIST, not the renderer's
+   * allowlist: `enctype` is an enumerated attribute whose missing AND invalid
+   * value defaults are both `application/x-www-form-urlencoded`, so
+   * `enctype="nonsense"` submits a parseable body and the action runs. Warning
+   * there would report a working form as broken, which is the inversion the
+   * check rule deliberately avoids, and the two halves of one feature must not
+   * disagree on the same input.
+   */
+  test('the enctype warning fires for text/plain and NOT for an invalid value', async () => {
+    for (const [enctype, shouldWarn] of [['text/plain', true], ['nonsense', false], ['multipart/form-data', false]]) {
+      setup(() => new Response(
+        '<!--wj:children:/:/--><p>ok</p><!--/wj:children:/-->',
+        { status: 200, headers: { 'content-type': 'text/html', 'x-webjs-build': '' } },
+      ));
+      const errors = [];
+      const origError = console.error;
+      console.error = (...a) => { errors.push(a.join(' ')); };
+      const before = location.pathname + location.search;
+      try {
+        render(html`
+          <form method="post" enctype=${enctype}>
+            <button type="submit" name="__webjs_action" value="a1b2c3d4e5/publish">go</button>
+          </form>
+        `, container);
+        const btn = container.querySelector('button');
+        container.querySelector('form').dispatchEvent(
+          new SubmitEvent('submit', { bubbles: true, cancelable: true, submitter: btn }),
+        );
+        await tick();
+        const hit = errors.filter((e) => e.includes('enctype'));
+        assert.equal(hit.length, shouldWarn ? 1 : 0, `enctype="${enctype}" should ${shouldWarn ? '' : 'not '}warn`);
+        if (shouldWarn) {
+          // The message must not claim a 405 for the JS path, where the router
+          // posts FormData and the action still runs.
+          assert.ok(hit[0].includes('no-JS'), 'the message scopes the breakage to the no-JS path');
+        }
+      } finally {
+        console.error = origError;
+        history.replaceState(null, '', before);
+        teardown();
+      }
+    }
+  });
 });
diff --git a/packages/server/AGENTS.md b/packages/server/AGENTS.md
index fceaf3de3..557a79f17 100644
--- a/packages/server/AGENTS.md
+++ b/packages/server/AGENTS.md
@@ -37,7 +37,7 @@ with metadata, Suspense, streaming) for HTML, or `api.js` /
 | `dev-error.js` | Dev error overlay frame builder (#264). `buildDevErrorFrame(error, { kind, appDir, file?, line?, hint?, url? })` returns a JSON-serializable frame (message, parsed `file`/`line`/`column`, a source `codeFrame`, an optional `hint`, and an optional `url`); `parseStackLocation(stack, appDir)` finds the first app frame (preferring non-`node_modules`, splitting off the dev loader's `?t=` cache-bust query); `readCodeFrame(file, line, column)` reads the source excerpt with a `>` line marker + a caret. `url` (#1047) is the request URL that produced the frame, `null` when absent: only a `render` frame carries one, and it is what lets the browser overlay refuse a frame for a page the tab is not viewing. A `ts-strip` / `rebuild` frame passes none and stays unscoped, because it describes a still-broken build rather than one page. PURE (the only side effect is a guarded source read) and DEV-ONLY by the caller's contract, so no path / source is built in prod |
 | `dev-overlay.js` | The BROWSER half of the dev error overlay (#264), a browser-safe module (no node imports) that `reloadClientJs` inlines verbatim after an `export`-keyword strip, so the browser test drives the exact shipping code. `renderDevOverlay(frame, currentPath?)` builds the card with `createElement` + `textContent` ONLY (never `innerHTML`, so a hostile message / path / code frame is inert text); `dismissDevOverlay()` takes it down and forgets any held frame, which is what the Dismiss button calls. **URL scope (#1047):** a url-stamped `render` frame for a different path than `currentPath` (default `location.pathname + location.search`, compared encoding-tolerantly) is NOT rendered. The gate runs BEFORE any removal, so a refused frame neither paints nor wipes a live `rebuild` / `ts-strip` overlay. It cannot simply drop the frame either, because the SSE frame is pushed during the render, before the navigation response is sent, so it arrives while `location` is still the old page: a refused frame goes to a PENDING slot that `syncDevOverlayToLocation(currentPath?)` re-evaluates on the next navigation, which renders it only if the url matches AND it arrived during the navigation now finishing, and drops it otherwise (consume-once, so retention is bounded with no timer). The second half of that condition is what stops a frame held from an IDLE render (another tab's page, a background fetch of some other url, never a link prefetch since that reports nothing) painting on a later visit to that url, when the page may render fine; `markDevOverlayNavStart()` is the nav-start marker it counts. `installDevOverlayNavSync(opts?)` wires all of it to the client router's `webjs:navigate` (applied nav) + `popstate` (a snapshot-cache restore returns before `webjs:navigate`) + `webjs:before-cache` (the nav START, since `snapshotCurrent` runs at the top of every navigation and form submission), and returns an uninstall thunk. Two things keep a snapshot copy of the overlay from becoming an undismissable card (the router's tier-4 popstate restore `replaceChildren`s the body from cached HTML, and a parsed copy is not the node this module holds, so nothing could remove it and its Dismiss button has no listener). `before-cache` DETACHES the overlay across the router's synchronous `outerHTML` read and re-attaches it a microtask later, so the cached HTML carries none. That is what covers the hard ordering: under an opt-in view transition the router defers the body swap PAST the sync, so a copy the swap inserts would arrive after any sweep had already run. The sync additionally SWEEPS any `[data-webjs-error-overlay]` element it does not own, as the backstop for a copy from anywhere else (a snapshot cached before this client installed its listeners, or any other wholesale body replacement). What `before-cache` must NOT do is strip the overlay for good, which the event's own contract invites: it fires on EVERY navigation, so that would tear a `rebuild` / `ts-strip` overlay off the page on any link click while the build was still broken. `packages/core` is untouched: the fix rides existing events |
 | `frame-render.js` | Server-side `<webjs-frame>` subtree extraction (#253). `requestedFrameId(req)` reads the `x-webjs-frame` header (null when absent, the normal full-page path); `extractFrameSubtree(html, id)` returns the `<webjs-frame id>...</webjs-frame>` slice from rendered HTML verbatim (so byte-equivalent by construction), balancing nested `<webjs-frame>` tags and reading the `id` attribute (not a substring match), or null when the id is absent. Used by `ssr.js`'s frame-render branch |
-| `form-dispatch.js` | Form-submission dispatch (#1155, replacing the page `action` export of #244): `runFormAction` verifies Origin, parses the bounded form body, resolves the `__webjs_action` identity, runs the action's declared `validate` + `middleware`, evicts its `invalidates` tags, and maps the `ActionResult` to a response (303 PRG on success, 422 re-render with `actionData` on failure, honoring thrown `redirect()`/`notFound()`/`forbidden()`/`unauthorized()`). An action that returns a `Response` DIRECTLY (e.g. a content-negotiated `streamResponse`, #248) is honored verbatim; a STREAMED return is refused (a submission has no frame consumer). A submission carrying no identity is a 405, an unresolvable hash is a 422 re-render with `ACTION_SKEW_MESSAGE` plus the typed values, and a module that throws at import is a sanitized 500 (never mislabelled as skew). `dev.js` routes EVERY non-GET/HEAD page request here, wrapped in the page's segment middleware |
+| `form-dispatch.js` | Form-submission dispatch (#1155, replacing the page `action` export of #244): `runFormAction` verifies Origin, parses the bounded form body, resolves the `__webjs_action` identity, runs the action's declared `validate` + `middleware`, evicts its `invalidates` tags, and maps the `ActionResult` to a response (303 PRG on success, 422 re-render with `actionData` on failure, honoring thrown `redirect()`/`notFound()`/`forbidden()`/`unauthorized()`). An action that returns a `Response` DIRECTLY (e.g. a content-negotiated `streamResponse`, #248) is honored verbatim; a STREAMED return is refused (a submission has no frame consumer). A submission carrying no identity is a 405, an unresolvable hash is a 422 re-render with `ACTION_SKEW_MESSAGE` plus the typed values, and a module that throws at import is a sanitized 500 (never mislabelled as skew). Two DIAGNOSTICS ride the `onError` hook without changing any response (#1307): `reportFormActionMissing` on that bind-nothing 405 (the PARSEABLE-body case only: an `enctype="text/plain"` submission arrives with that content type and is answered by the non-form 405 before the body is read, so it is visible only as a bare 405 and the dev client guard covers it instead), and `reportFormSubmittedAsGet` (called from `dev.js`'s page-GET branch) when a page GET carries `__webjs_action` in the QUERY STRING, which only a bound submitter submitted through an UNBOUND form produces and which otherwise renders a silent 200. Each sets an `err.code` (`WEBJS_FORM_ACTION_MISSING` / `WEBJS_FORM_SUBMITTED_AS_GET`), carries `method` + `pathname` plus the submitted field NAMES (never the values, which are user data), and is deduplicated per process keyed on the code, the method, and the matched ROUTE (not the pathname, so crafted urls on a dynamic route cannot exhaust the 256-entry cap and silence the diagnostics). `resetFormReportDedupe` is a test seam. `dev.js` routes EVERY non-GET/HEAD page request here, wrapped in the page's segment middleware |
 | `form-action-identity.js` | The `<hash>/<fn>` identity a bound form submits (#1155). `resolveActionIdentity` maps a real action function to its identity via the always-on `'use server'` load-hook registry (`action-seed.js`), with a module-scan fallback only on a runtime that installs no hook; `lookupActionIdentity` maps a submitted identity back to `{ file, fnName, module }`, distinguishing an unknown hash (skew) from an unknown export (404) and from an import failure (`load-failed`). The scheme is the RPC endpoint's, so both transports resolve the same string to the same function |
 | `action-seed.js` | SSR action-result seeding (#472, Bun-enabled #529). `registerActionHooks({ seed })` (async) installs a load hook chosen by `serverRuntime()`: Node's synchronous `module.registerHooks`, or a `Bun.plugin` `onLoad` on Bun (the glue is in `action-seed-bun.js`, dynamically imported so `Bun.*` never loads on Node). For a `'use server'` `*.server.*` module the hook returns a transparent FACADE re-exporting each function wrapped in a `Proxy` (`__actionWrap`); the faceting decision (`isSeedCandidate`) + facade source (`buildSeedFacade`) are runtime-neutral, so both runtimes emit the identical seed. (Bun's `onLoad` must return an object for every filter match, so the non-facet cases serve the raw source.) The Proxy records `(file, fn, args) -> result` into an ambient `AsyncLocalStorage` collector when one is active (a pure passthrough otherwise, so the RPC endpoint path is untouched, and any metadata attached to the function forwards through the Proxy). `collectSeeds(fn)` runs the SSR render inside a fresh collector; `buildSeedScript(collector)` serializes it into an HTML-escaped `<script type="application/json" id="__webjs-seeds">` block (keyed `hashFile(file)/fn/stringify(args)`, the exact key the client stub looks up). `seedingEnabled()` gates the `ssr.js` emitter. Installed at boot by `dev.js` UNCONDITIONALLY, because action IDENTITY rides the same hook (#1155: `<form action=${action}>` resolves through `actionIdentitiesOf`, which returns EVERY `{file, fnName}` a function was exported as, defining module first, so the form resolver can prefer the defining module and fall back to an indexed re-exporter; `webjs.seed: false` must not break a no-JS form). Only seed COLLECTION follows the switch (`readSeedEnabled`, default on; `webjs.seed` / `WEBJS_SEED`), and with it off `__actionWrap` registers identity and returns the function unwrapped rather than building a Proxy. Fail-open on every axis: a key miss degrades to a normal RPC (never wrong data), and the facade emits an `export * from '?webjs-seed-orig'` catch-all (#535) so a named export the `extractExportNames` regex MISSES (a destructuring `export const { a }`, an exotic re-export) flows through unwrapped (it still works over a normal RPC, just is not seeded) instead of resolving to `undefined` and crashing the importer. An explicit wrapped `export const NAME` shadows the matching star binding, so an enumerated export is still wrapped and seeded. The per-runtime hook split (Node `registerHooks` vs `Bun.plugin`) is intentional and irreducible: intercepting a native ESM import has no shared API, and a load-hook facade runs pre-evaluation so it cannot use authoritative runtime enumeration. A streamable result (#489) is skipped (`isStreamable`), so a streaming action invoked during SSR neither records a non-serializable value nor drops the page's other seeds. No source transform, no build step |
 | `action-seed-bun.js` | Bun install for SSR action seeding (#529). `installBunSeedPlugin({ isSeedCandidate, buildSeedFacade, serverFileRe })` registers a `Bun.plugin` `onLoad` (the Bun analog of Node's `module.registerHooks` load hook), dynamically imported by `registerActionHooks` only on Bun so the `Bun.*` global never loads on Node (same isolation as `listener-bun.js`). Reuses the runtime-neutral faceting helpers; the only Bun glue is the plugin shell + `Bun.file` source read. Note: a Bun `onLoad` MUST return a `{ contents, loader }` for every filter match (returning `undefined` to defer is an error), so the passthrough / non-`use server` / facet-skip cases serve the raw source with the extension loader. |
@@ -85,7 +85,7 @@ with metadata, Suspense, streaming) for HTML, or `api.js` /
 | `component-scanner.js` | Maps every webjs component class to its browser-visible URL |
 | `component-elision.js` | Static analyser deciding which display-only component modules can be elided from the browser, plus the serve-time side-effect-import stripper. Conservative denylist of interactivity signals (single source of truth). `analyzeElision` also returns `shippedRouteModules` (#646): for each page/layout that ships whole (neither inert nor import-only), the first client-effecting blocker that pins it (a non-component on a component-free path from the module, #963, or `null` when the module's own code is the cause) plus a human `reason`. A reporting layer over the existing verdict, consumed by the `webjs doctor` advisory |
 | `elision-report.js` | `analyzeAppElision(appDir)` (#646): builds the module graph + runs `analyzeElision`, returning the page/layout route modules that ship whole, each with its named blocker + reason. The app-level wrapper the `webjs doctor` carrier-hygiene advisory calls; returns an empty report for a non-app dir, a malformed app, or when elision is disabled. A reporting layer over the analysis, NOT a build (webjs is no-build) |
-| `js-scan.js` | Shared lexical scanners (`redactStringsAndTemplates`, `redactToPlaceholders`, `extractWebComponentClassBodies`, `matchClosingBrace`) used by `check.js`, `component-scanner.js`, and `component-elision.js`. `redactToPlaceholders` (#634) masks comments and replaces each string / template body with a `__STR_<idx>__` placeholder (originals returned in a `literals` array, `${...}` holes scanned as code), so the component scanner and the elision import / side-effect scanners see a real top-level `register(...)` / `import` while an identical token shown inside a code-sample string is inert |
+| `js-scan.js` | Shared lexical scanners (`redactStringsAndTemplates`, `redactToPlaceholders`, `extractWebComponentClassBodies`, `matchClosingBrace`, `scanHtmlFormScopes`, `classifyActionHole`) used by `check.js`, `component-scanner.js`, and `component-elision.js`. `scanHtmlFormScopes` + `classifyActionHole` (#1307) back the `submitter-needs-bound-form` rule: the scanner walks every `html`-tagged template (only that tag, so a `<form>` written inside a plain string or a `css` template is never read as markup) and reports, per submitter action hole and per custom-element start tag, the enclosing `<form>` scope, the hole's EXPRESSION text (`expr`, which a caller MUST check before treating the hole as a binding: the scan is lexical while the renderer binds only a FUNCTION, so `formaction=${'/api/' + id}` is an ordinary url attribute), whether an UNBOUND form would still deliver a submitter's identity (`method="post"` plus a parseable enctype does; no method, `method="get"`, or an unparseable enctype does not), and whether the source opens any form at all. A template nested in a CHILD-position hole inherits the enclosing scope, mirroring how `render` threads `formScope`; one in a START-TAG hole is `'handed'` and can never be attributed to this file, because SSR does not render it in place at all (a serializable value rides to the receiving element as `data-webjs-prop-*` and applies at hydration, and one carrying a function is DROPPED at SSR with a warning), so the receiving element decides where it lands in the browser. The single exception is `<webjs-suspense .fallback=${…}>`, which the renderer really does render inline. `matchClosingBrace` takes a CONTEXT STACK over `${...}` holes: an earlier version incremented depth at a hole and never decremented it, so a class body containing a template hole was unmatchable, invisible only because every caller passed a masked source where holes are blanked. `redactToPlaceholders` (#634) masks comments and replaces each string / template body with a `__STR_<idx>__` placeholder (originals returned in a `literals` array, `${...}` holes scanned as code), so the component scanner and the elision import / side-effect scanners see a real top-level `register(...)` / `import` while an identical token shown inside a code-sample string is inert |
 | `fs-walk.js` | Async recursive directory walker |
 | `logger.js` | `defaultLogger` (JSON-shaped in prod, pretty in dev) |
 
diff --git a/packages/server/src/check.js b/packages/server/src/check.js
index dcaa3272e..67c98a982 100644
--- a/packages/server/src/check.js
+++ b/packages/server/src/check.js
@@ -6,10 +6,13 @@ import {
   redactToPlaceholders,
   extractWebComponentClassBodies,
   matchClosingBrace,
+  matchClosingParenthesis,
   parsePropEntries,
+  classifyActionHole,
+  scanHtmlFormScopes,
 } from './js-scan.js';
 import { buildModuleGraph, transitiveDeps, resolveImport } from './module-graph.js';
-import { scanComponents } from './component-scanner.js';
+import { scanComponents, extractComponents } from './component-scanner.js';
 import { buildRouteTable } from './router.js';
 import { analyzeElision } from './component-elision.js';
 import { RESERVED_CONFIG } from './action-config.js';
@@ -140,6 +143,11 @@ export const RULES = [
     description:
       'Flags `<form action=${someAction}>` bound to a `\'use server\'` action whose file declares `export const method = \'GET\'` (#488). A GET action is a READ: it is CSRF-exempt and rides its arguments in the url, while a form submission is a CSRF-checked POST carrying a body, so the two contracts contradict each other and the submission is answered with a 405 at runtime. The rule reads the imported action\'s own file, so it only fires when the binding really does resolve to a GET-declared action. Fix by dropping the `method` export (an action with no `method` is a POST, which is what a form wants) or by binding a different action; if the form really is a read, use a plain `<form method="get" action="/search">` with no bound action.',
   },
+  {
+    name: 'submitter-needs-bound-form',
+    description:
+      'Flags a `<button formaction=${action}>` submitter (#1207) that a whole-app scan proves sits in a `<form>` which binds no action AND cannot carry the submitter\'s identity to the server. Those are two separate questions and only both together are a defect. An unbound `<form method="post">` still WORKS, because a submitter\'s identity rides its own `name`/`value` pair, which the browser submits for the pressed button alone, and the dispatcher takes the last `__webjs_action` entry it finds. What breaks is an unbound form that sends nothing readable: no `method` at all or `method="get"` (a GET carries the identity in the QUERY STRING, so the action never runs and the page simply re-renders with a 200, silently), or an enctype the server cannot parse (a 405). The renderers cannot catch the cross-module case alone. SSR reads one template at a time and a COMPONENT renders its own template in a separate pass with no view of the host page, so a submitter in a component is a cannot-tell, and cannot-tell has to bind (refusing there would drop an isolated component from a page that still returned 200). This rule has neither limit: it reads every template in the app at once. Deliberately conservative so it can never false-positive. A submitter whose enclosing form is UNBOUND in the SAME scan is flagged whatever its method, because the renderer refuses that shape outright. Across modules, a submitter with no enclosing form in its own scan is attributed to a component only when its file registers exactly one tag, declares exactly one WebComponent class, holds the submitter inside that class body, and opens no `<form>` of its own; every other shape (a bare `html` helper, a multi-component file, a file that could splice a fragment into its own form, a `formaction` hole that is not a PROVEN action binding (the scan is lexical while the renderer binds only a FUNCTION, so a url string, a url constant exported from a `.server` module, a factory-produced export, a namespace or default import, a barrel re-export, and any non-identifier expression are all left alone, which misses some real bindings but never misreports a working form), and a submitter or tag handed off in a START-TAG hole, which some other element receives and places, the one exception being `<webjs-suspense .fallback=${…}>`, which the renderer renders inline in the enclosing form and which IS therefore judged) is UNKNOWABLE and never flagged, because a fragment renders inside the CALLER\'s scan and inherits the caller\'s form scope. An attributed tag is then resolved across every call site, recursively and memoized: any call site that is bound, that is unbound but still delivering, that is unknowable, that has dynamic `method`/`enctype`, or that is part of a cycle makes the verdict unknowable, and a tag with no call site at all is unknowable too. The rule fires only when at least one call site exists and EVERY one places the tag in a form that cannot deliver. Fix by binding the enclosing form (`<form action=${formAction}>`), which is what supplies `method="post"` and the enctype at form start, too late to add from the button.',
+  },
   {
     name: 'no-redirect-in-api-route',
     description:
@@ -1396,26 +1404,15 @@ export async function checkConventions(appDir) {
         // with no hole in it. That distinction is the whole carve-out: the
         // framework's own website renders this exact shape as a code sample.
         const { redacted, literals } = redactToPlaceholders(content);
-        // A hole binds an action when the literal segment IMMEDIATELY before it
-        // ends inside a start tag at the attribute that tag can really bind:
-        // `action=` on a `<form>` (#1155), or `formaction=` on a `<button>` /
-        // `<input>` submitter (#1207). Reading the segment rather than the whole
-        // template is what keeps `<div action=${x}>` out. The tag and the
-        // attribute are matched as a PAIR, so `<form formaction=${x}>` and
-        // `<button action=${x}>` stay out too: both are refused at render time,
-        // and neither is this rule's failure mode.
+        // Both binding shapes count the same here: `action=` on a `<form>`
+        // (#1155) and `formaction=` on a `<button>` / `<input>` submitter
+        // (#1207) each put the named action behind a form submission, and a
+        // GET-declared action cannot serve either. `classifyActionHole` owns
+        // the tag-and-attribute pairing (js-scan.js), shared with
+        // `submitter-needs-bound-form`.
         const bound = new Set();
         for (const m of redacted.matchAll(/__STR_(\d+)__\$\{\s*([A-Za-z_$][\w$]*)\s*\}/g)) {
-          const before = literals[Number(m[1])] || '';
-          // The last `<` opens the tag the hole sits in. Requiring no `>`
-          // after it keeps the match inside that one start tag.
-          const tagAt = before.lastIndexOf('<');
-          if (tagAt < 0) continue;
-          const tag = before.slice(tagAt);
-          if (tag.includes('>')) continue;
-          const bindsForm = /^<form\b/i.test(tag) && /\saction=$/i.test(tag);
-          const bindsSubmitter = /^<(?:button|input)\b/i.test(tag) && /\sformaction=$/i.test(tag);
-          if (!bindsForm && !bindsSubmitter) continue;
+          if (!classifyActionHole(literals[Number(m[1])] || '')) continue;
           bound.add(m[2]);
         }
         if (!bound.size) continue;
@@ -1454,9 +1451,455 @@ export async function checkConventions(appDir) {
     }
   }
 
+  // --- Rule: submitter-needs-bound-form (#1307) ---
+  // A submitter bound in a component whose host form is unbound posts nowhere:
+  // the form defaults to GET, the identity rides the query string, and the page
+  // re-renders with the action never having run. Neither renderer can see it
+  // (each judges one template scan), so the whole-app scan is the only place
+  // the answer exists.
+  checkSubmitterNeedsBoundForm(files, violations, appDir);
+
   return violations;
 }
 
+/**
+ * Implements `submitter-needs-bound-form` (#1307). Factored out because it is
+ * whole-app: a submitter's enclosing form can live in a different module, so the
+ * verdict is a fixed point over every template in the app rather than a
+ * per-file scan.
+ *
+ * The tag-to-owner map comes from `extractComponents` over the `files` array the
+ * caller has already read, so there is no second directory walk. It does take
+ * `appDir`, because deciding whether a `formaction` hole is a real action
+ * binding means resolving the import to its target module and checking the
+ * export is callable; `resolveImport` needs the app root for that.
+ *
+ * @param {{ abs: string, rel: string, content: string, scan: string }[]} files
+ * @param {Violation[]} violations appended to in place
+ * @param {string} appDir
+ */
+function checkSubmitterNeedsBoundForm(files, violations, appDir) {
+  /**
+   * The FIX line is identical for every shape this rule reports, so it is
+   * written once.
+   */
+  const FIX = 'Bind the enclosing <form> too (`<form action=${formAction}>`), which is what supplies method="post" and the enctype at form start. A per-button action cannot retrofit them.';
+  /**
+   * Mirrors `scanComponents`'s own filter: a fixture or a spec in an app tree
+   * must not claim a tag, and a `.server.` module never renders to a browser.
+   * @param {string} rel
+   */
+  const isAppTemplateFile = (rel) =>
+    /\.m?[jt]sx?$/.test(rel)
+    && !/\.(test|spec)\.m?[jt]sx?$/.test(rel)
+    && !/\.server\.m?[jt]s$/.test(rel);
+
+  /** Every scanned file by absolute path, for resolving an import's target. */
+  const byAbs = new Map(files.map((f) => [f.abs, f]));
+
+  /**
+   * Is `name` exported from `scan` as something PROVABLY callable?
+   *
+   * The bias is the opposite of the sibling `'use server'` rules, and
+   * deliberately so. Those tolerate a false NEGATIVE, so anything ambiguous
+   * counts as possibly-callable. Here an ambiguous export firing the rule is a
+   * false POSITIVE on working code, so only a shape that must be a function
+   * counts: a function declaration, or a const bound to an arrow or a function
+   * expression. `export const ARCHIVE_URL = '/api/x'` is NOT callable, and a
+   * factory (`export const go = cache(fn)`) is not PROVABLE, so both stay
+   * silent.
+   *
+   * @param {string} scan fully-blanked view of the target module
+   * @param {string} name
+   * @returns {boolean}
+   */
+  const exportsCallable = (scan, name) => {
+    const n = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    // `export [async] function NAME`.
+    if (new RegExp(`\\bexport\\s+(?:async\\s+)?function\\s+${n}\\b`).test(scan)) return true;
+    // A local declaration surfaced by a clause: `function NAME(){}; export { NAME }`.
+    // Only a clause with NO `from`, since a re-export would need another hop to
+    // the module that actually declares it.
+    const reClause = /\bexport\s*\{([^}]*)\}/g;
+    let cl;
+    while ((cl = reClause.exec(scan))) {
+      // A re-export needs another hop to the module that DECLARES the name, so
+      // it stays unknowable. Tested on the text after the clause rather than
+      // with a lookahead: `\s*(?!from)` can never reject, because `\s*`
+      // backtracks to zero width and the lookahead then reads the whitespace.
+      if (/^\s*from\b/.test(scan.slice(cl.index + cl[0].length))) continue;
+      const exported = cl[1].split(',').some((part) => {
+        const m = /([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?/.exec(part.trim());
+        return !!m && (m[2] || m[1]) === name;
+      });
+      if (!exported) continue;
+      const local = cl[1].split(',').map((part) => /([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?/.exec(part.trim()))
+        .filter((m) => m && (m[2] || m[1]) === name).map((m) => m[1])[0];
+      if (local && declaresCallable(scan, local)) return true;
+    }
+    return declaresCallable(scan, name, true);
+  };
+
+  /**
+   * Index just past the assignment `=` that follows a `const NAME`, or -1.
+   *
+   * A TypeScript annotation can itself contain `=>`
+   * (`const publishDraft: (fd: FormData) => Promise<void> = async (fd) => …`),
+   * which is the idiomatic spelling this repo's derive-the-type rule pushes
+   * authors toward. Skipping the annotation with a lazy regex group stopped at
+   * the FIRST `=`, which is the one inside the annotation's own arrow, so the
+   * scan resumed on `>` and every branch failed. Walking it with bracket depth
+   * and stepping over `=>` finds the real assignment.
+   *
+   * @param {string} scan
+   * @param {number} i index just after the declared name
+   * @returns {number}
+   */
+  function assignmentAfter(scan, i) {
+    let depth = 0;
+    while (i < scan.length) {
+      const c = scan[i];
+      // A `;` ENDS the declaration only at depth zero. TypeScript's canonical
+      // member separator is `;`, so an inline object type
+      // (`: ActionFn<{ id: string; title: string }>`) carries one INSIDE its
+      // brackets, and bailing there dropped the binding.
+      if (c === ';' && depth <= 0) return -1;
+      if (c === '=' && scan[i + 1] === '>') { i += 2; continue; }   // arrow in the annotation
+      if (c === '(' || c === '[' || c === '{' || c === '<') { depth++; i++; continue; }
+      if (c === ')' || c === ']' || c === '}' || c === '>') { depth--; i++; continue; }
+      // Reject `==` and `!=`, but NOT a preceding `<` or `>`: in annotation
+      // position those are brackets this same loop already consumed as such, so
+      // reading `Promise<void>=` as a `>=` comparison classified one character
+      // two contradictory ways.
+      //
+      // Two separate guards share this line, and only one of them is
+      // unpinnable. `depth <= 0` is live and reachable: a DEFAULT type
+      // parameter (`: <T = FormData>(fd: T) => …`) puts a bare `=` inside the
+      // annotation's brackets, and without the depth check that `=` is returned
+      // as the assignment. A row pins it.
+      //
+      // The `==` / `!=` rejection is the unpinnable half: no valid TypeScript
+      // puts a comparison between a declared name and its assignment, so no
+      // test can reach it. It is here because the input is a MASK of arbitrary
+      // source, which may be mid-edit and not valid at all.
+      //
+      // Do NOT restate here how many guards in this resolver are pinned. Two
+      // successive commits asserted an exact count and both were wrong within
+      // one commit of being written, because the count decays the moment
+      // anyone adds a guard. The durable statement is the rule, not the
+      // tally: a new guard needs a row in `submitter-needs-bound-form.test.js`
+      // that FAILS when the guard is broken, verified by breaking it.
+      if (depth <= 0 && c === '=' && scan[i + 1] !== '=' && !'=!'.includes(scan[i - 1] || '')) return i + 1;
+      i++;
+    }
+    return -1;
+  }
+
+  /**
+   * Is `name` DECLARED as something provably callable in `scan`?
+   *
+   * The arrow case must see the `=>`. An earlier version accepted a bare `(`
+   * after the `=`, which proves a parenthesized EXPRESSION and not a callable,
+   * so `export const ARCHIVE_URL = ('/api/x')` and the ordinary env-fallback
+   * spelling `= (process.env.X || '/api/x')` were read as actions. That is the
+   * exact false positive this whole resolver exists to prevent.
+   *
+   * @param {string} scan
+   * @param {string} name
+   * @param {boolean} [exported] require the declaration to carry `export`
+   * @returns {boolean}
+   */
+  function declaresCallable(scan, name, exported = false) {
+    const n = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const lead = exported ? '\\bexport\\s+' : '\\b';
+    if (!exported && new RegExp(`\\bfunction\\s+${n}\\b`).test(scan)) return true;
+    const re = new RegExp(`${lead}(?:const|let|var)\\s+${n}\\b`, 'g');
+    let m;
+    while ((m = re.exec(scan))) {
+      let i = assignmentAfter(scan, m.index + m[0].length);
+      if (i === -1) continue;
+      const skipWs = () => { while (i < scan.length && /\s/.test(scan[i])) i++; };
+      skipWs();
+      if (scan.startsWith('async', i) && /[\s(<]/.test(scan[i + 5] || '')) { i += 5; skipWs(); }
+      // `= [async] function ...`
+      if (/^function\b/.test(scan.slice(i, i + 9))) return true;
+      // `= [async] [<T>](params)[: ReturnType] => ...`, which must actually reach
+      // the arrow. Both the type-parameter list and the return type are optional
+      // and can carry their own brackets, so each is walked with depth rather
+      // than matched.
+      if (scan[i] === '<') {
+        let d2 = 0;
+        while (i < scan.length) {
+          const c = scan[i];
+          if (c === '=' && scan[i + 1] === '>') { i += 2; continue; }
+          if (c === '<') d2++;
+          else if (c === '>') { d2--; if (d2 <= 0) { i++; break; } }
+          i++;
+        }
+        skipWs();
+      }
+      if (scan[i] === '(') {
+        const close = matchClosingParenthesis(scan, i + 1);
+        if (close === -1) continue;
+        i = close + 1;
+        skipWs();
+        if (scan[i] === ':') {
+          let depth = 0;
+          i++;
+          while (i < scan.length) {
+            const c = scan[i];
+            // Depth-guarded, exactly like the declaration-side walk. A return
+            // type carries both separators INSIDE its brackets:
+            // `Promise<Record<string, string>>` is the `fieldErrors` shape the
+            // ActionResult envelope pushes authors toward, and an inline object
+            // return type uses `;`.
+            if ((c === ';' || c === ',') && depth <= 0) break;
+            // An arrow at depth zero ENDS the return type; a nested one is part
+            // of it and must be stepped over whole, or its `>` is eaten by the
+            // closer branch below and the depth skews. That is the same
+            // any-depth step the declaration walk makes.
+            if (c === '=' && scan[i + 1] === '>') {
+              if (depth <= 0) break;
+              i += 2;
+              continue;
+            }
+            if (c === '(' || c === '[' || c === '{' || c === '<') depth++;
+            else if (c === ')' || c === ']' || c === '}' || c === '>') depth--;
+            i++;
+          }
+          skipWs();
+        }
+        if (scan.startsWith('=>', i)) return true;
+        continue;
+      }
+      // `= [async] param => ...`, the single-parameter arrow with no parens.
+      const id = /^[A-Za-z_$][\w$]*/.exec(scan.slice(i));
+      if (id) {
+        i += id[0].length;
+        skipWs();
+        if (scan.startsWith('=>', i)) return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * Local names this file imports from a `.server.{js,ts}` module AND that the
+   * target really exports as a callable.
+   *
+   * The scan is LEXICAL, but the renderer binds only when the hole's value is a
+   * FUNCTION (`isBoundFormAction` in `form-action.js`), so `formaction=${'/api/'
+   * + id}` on a plain progressive-enhancement form, and equally a url CONSTANT
+   * exported from a `.server.ts` module, are ordinary url attributes that render
+   * and ship fine. Treating either as a binding reports a working form as
+   * broken.
+   *
+   * Only a plain named import is resolved. A namespace import
+   * (`import * as acts`), a default import, a barrel re-export, and any
+   * non-identifier expression (a member access, `this.act`) are all left
+   * UNKNOWABLE and therefore silent: they are real bindings the rule then
+   * misses, which is the safe direction and is listed with the rule's other
+   * silences.
+   *
+   * @param {string} content
+   * @param {string} abs
+   * @returns {Set<string>}
+   */
+  const serverImportedNames = (content, abs) => {
+    /** @type {Set<string>} */
+    const names = new Set();
+    const { redacted, literals } = redactToPlaceholders(content);
+    const reImport = /\bimport\s+([^'";]*?)\bfrom\s*(['"])/g;
+    let im;
+    while ((im = reImport.exec(redacted))) {
+      const tok = /__STR_(\d+)__/.exec(redacted.slice(reImport.lastIndex, reImport.lastIndex + 24));
+      if (!tok) continue;
+      const spec = literals[Number(tok[1])] || '';
+      if (!/\.server\.m?[jt]s$/.test(spec)) continue;
+      const target = resolveImport(spec, abs, appDir);
+      const targetFile = target ? byAbs.get(target) : null;
+      if (!targetFile) continue;   // unresolvable: unknowable, so silent
+      const targetScan = redactStringsAndTemplates(targetFile.content, true);
+      for (const { local, imported } of importedLocalNames(im[1])) {
+        if (exportsCallable(targetScan, imported)) names.add(local);
+      }
+    }
+    return names;
+  };
+
+  /** @type {{ rel: string, fileSites: ReturnType<typeof scanHtmlFormScopes>, ownerTag: string | null, bodySites: ReturnType<typeof scanHtmlFormScopes> | null }[]} */
+  const scanned = [];
+  for (const { abs, rel, content, scan } of files) {
+    if (!isAppTemplateFile(rel)) continue;
+    // Cheap bail: a file with neither a submitter binding nor a hyphenated tag
+    // can contribute neither a violation nor a call site.
+    if (!/formaction/i.test(content) && !/<[A-Za-z][A-Za-z0-9]*-/.test(content)) continue;
+    const fileSites = scanHtmlFormScopes(content);
+    if (!fileSites.submitters.length && !fileSites.tagUses.length) continue;
+    // Keep only the submitter holes that really bind an action. A `formaction`
+    // hole holding a url string is an ordinary attribute the renderer ships.
+    const bound = serverImportedNames(content, abs);
+    const isActionBinding = (site) => !!site.expr && /^[A-Za-z_$][\w$]*$/.test(site.expr) && bound.has(site.expr);
+    fileSites.submitters = fileSites.submitters.filter(isActionBinding);
+    // ATTRIBUTABLE: exactly one registered tag and exactly one WebComponent
+    // class, so a cannot-tell submitter in that class body belongs to that tag
+    // with no ambiguity. Anything else stays unknowable.
+    //
+    // The class body is located in the MASK and sliced out of the RAW source at
+    // the same offsets. The mask is position-preserving, and it is what every
+    // other `extractWebComponentClassBodies` caller passes, so the brace matcher
+    // is never asked to lex raw source (where an unlexed regex literal such as
+    // `static re = /[{]/` would truncate or lose the body, silently dropping
+    // this rule's cross-module half for that file). Slicing `content` then gives
+    // the body with its templates intact, which is what the scan needs.
+    const tags = new Set(extractComponents(content).map((c) => c.tag));
+    const bodies = extractWebComponentClassBodies(scan);
+    let ownerTag = null;
+    /** @type {ReturnType<typeof scanHtmlFormScopes> | null} */
+    let bodySites = null;
+    if (tags.size === 1 && bodies.length === 1) {
+      ownerTag = /** @type {string} */ ([...tags][0]);
+      bodySites = scanHtmlFormScopes(content.slice(bodies[0].bodyStart, bodies[0].bodyEnd));
+      bodySites.submitters = bodySites.submitters.filter(isActionBinding);
+    }
+    scanned.push({ rel, fileSites, ownerTag, bodySites });
+  }
+  if (!scanned.length) return;
+
+  // Every call site of every tag, as a scope. A 'none' site needs attribution
+  // before it means anything, so it is recorded with the component that renders
+  // it (or as unknowable when no single component owns it).
+  /** @type {Map<string, Array<{ scope: import('./js-scan.js').FormScope, delivers: boolean | null, via: string | null }>>} */
+  const callSites = new Map();
+  for (const { fileSites, ownerTag, bodySites } of scanned) {
+    // A 'none' use is attributed to this file's component ONLY when the
+    // class-body scan saw it too. One found only in the whole-file scan came
+    // from a bare `html` helper, which is rendered inside the CALLER's scan and
+    // inherits the caller's form scope, so it is unknowable.
+    //
+    // And only when this file opens NO form of its own, ANYWHERE. A fragment
+    // built into a local (`const rows = html`<todo-row>`;`) and spliced into a
+    // form the same file opens (`html`<form action=${save}>${rows}</form>``)
+    // inherits the SPLICE point's scope, not this component's call-site scope,
+    // and the two templates are separate scans so nothing here can tell them
+    // apart. That is the same reasoning the submitter half already applies to a
+    // bare helper.
+    //
+    // The test is the WHOLE-FILE scan, not the class body: a module-scope
+    // helper (`const shell = (inner) => html`<form action=${save}>${inner}</form>``)
+    // opens a form the class body never sees, and splicing into that is the same
+    // hole.
+    const attributable = ownerTag && bodySites && !fileSites.opensForm ? ownerTag : null;
+    /** @type {Map<string, number>} */
+    const bodyNoneByTag = new Map();
+    for (const u of attributable && bodySites ? bodySites.tagUses : []) {
+      if (u.scope !== 'none') continue;
+      bodyNoneByTag.set(u.tag, (bodyNoneByTag.get(u.tag) || 0) + 1);
+    }
+    for (const u of fileSites.tagUses) {
+      let via = null;
+      if (u.scope === 'none') {
+        const left = bodyNoneByTag.get(u.tag) || 0;
+        if (attributable && left > 0) {
+          bodyNoneByTag.set(u.tag, left - 1);
+          via = attributable;
+        }
+      }
+      const list = callSites.get(u.tag) || [];
+      list.push({ scope: u.scope, delivers: u.delivers, via });
+      callSites.set(u.tag, list);
+    }
+  }
+
+  /** @type {Map<string, 'undeliverable' | 'unknowable'>} */
+  const verdicts = new Map();
+  /** @type {Set<string>} */
+  const inProgress = new Set();
+  /**
+   * Does EVERY place this tag is rendered put it in a form that CANNOT deliver
+   * a submitter's action?
+   *
+   * The delivery question is what decides whether the shape is broken, and it is
+   * not the same as boundness. An unbound `<form method="post">` still carries a
+   * submitter's own `name`/`value` pair to the server, so the identity arrives
+   * and the action RUNS. What breaks is a form that sends nothing the server can
+   * read: no `method` (a GET, so the identity rides the query string), an
+   * explicit `method="get"`, or an enctype the server cannot parse. So a call
+   * site inside an unbound-but-delivering form is NOT a defect, and it makes the
+   * verdict unknowable like any other non-defect site.
+   *
+   * One delivering call site, one bound call site, one unknowable call site, a
+   * cycle, or no call site at all all answer `'unknowable'`, which is silent.
+   *
+   * The scope tests below are EXACT `'none'` on purpose. A `'handed'` site (a
+   * template sitting in a start-tag hole, so some other element received it and
+   * places it) must fall through to `'unknowable'`, and it does so only because
+   * nothing here treats it as a cannot-tell. Loosening these to a catch-all
+   * would resolve a handed-off template through this component's call sites,
+   * which is the wrong component's answer.
+   *
+   * @param {string} tag
+   * @returns {'undeliverable' | 'unknowable'}
+   */
+  function resolveTagScope(tag) {
+    const memo = verdicts.get(tag);
+    if (memo) return memo;
+    // A cycle teaches nothing about the host page, so it cannot be a verdict.
+    // Not memoized: the same tag may resolve conclusively on another path.
+    if (inProgress.has(tag)) return 'unknowable';
+    const sites = callSites.get(tag) || [];
+    if (!sites.length) {
+      // A tag no app template renders may still be rendered by markup this scan
+      // cannot see.
+      verdicts.set(tag, 'unknowable');
+      return 'unknowable';
+    }
+    inProgress.add(tag);
+    /** @type {'undeliverable' | 'unknowable'} */
+    let verdict = 'undeliverable';
+    for (const site of sites) {
+      if (site.scope === 'unbound' && site.delivers === false) continue;
+      if (site.scope === 'none' && site.via && resolveTagScope(site.via) === 'undeliverable') continue;
+      verdict = 'unknowable';
+      break;
+    }
+    inProgress.delete(tag);
+    verdicts.set(tag, verdict);
+    return verdict;
+  }
+
+  for (const { rel, fileSites, ownerTag, bodySites } of scanned) {
+    // The same-scan case: the form and the submitter are both in this template,
+    // so the answer needs no cross-module step. The renderer refuses this shape
+    // too, but only if that branch actually renders.
+    for (const s of fileSites.submitters) {
+      if (s.scope !== 'unbound') continue;
+      violations.push({
+        rule: 'submitter-needs-bound-form',
+        file: rel,
+        message: `Binds an action with \`formaction=\${…}\` on a <${s.tag}>, but the enclosing <form> in the SAME template carries no \`action=\${action}\` binding. Wherever the renderer sees both halves in one pass it refuses this shape outright, so the page throws at render rather than shipping it.`,
+        fix: FIX,
+      });
+    }
+    // The SAME `opensForm` guard the tag half uses, and for the same reason: a
+    // submitter fragment built into a local and spliced into a form this file
+    // opens is inside that form, not at the component's call site. The rule
+    // description states this condition, so the code has to hold it.
+    if (!ownerTag || !bodySites || fileSites.opensForm) continue;
+    const cannotTell = bodySites.submitters.filter((s) => s.scope === 'none');
+    if (!cannotTell.length) continue;
+    if (resolveTagScope(ownerTag) !== 'undeliverable') continue;
+    for (const s of cannotTell) {
+      violations.push({
+        rule: 'submitter-needs-bound-form',
+        file: rel,
+        message: `Binds an action with \`formaction=\${…}\` on a <${s.tag}>, but every place <${ownerTag}> is rendered puts it in a <form> that binds no action AND cannot carry the identity to the server (no \`method="post"\`, or an enctype the server cannot parse). Nothing throws: the submission goes out as a GET with the identity in the query string, the action never runs, and the page simply re-renders with a 200.`,
+        fix: FIX,
+      });
+    }
+  }
+}
+
 /**
  * BFS the module graph for the shortest import path from `from` to `to`,
  * returning every hop `[from, ..., to]` so the `no-server-import-in-browser-module`
diff --git a/packages/server/src/dev.js b/packages/server/src/dev.js
index f1120d566..82c888038 100644
--- a/packages/server/src/dev.js
+++ b/packages/server/src/dev.js
@@ -15,7 +15,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { buildRouteTable, matchPage, matchApi } from './router.js';
 import { generateRouteTypes } from './route-types.js';
 import { ssrPage, ssrNotFound, setClientRouterEnabled } from './ssr.js';
-import { runFormAction } from './form-dispatch.js';
+import { runFormAction, reportFormSubmittedAsGet } from './form-dispatch.js';
 import { handleApi } from './api.js';
 import {
   buildActionIndex,
@@ -1479,7 +1479,7 @@ export async function createRequestHandler(opts) {
       // Build all whole-app analysis on the first request (memoized), before
       // any SSR, module serve, gate check, action dispatch, or middleware runs.
       await ensureReady();
-      const next = () => handleCore(req, { state, appDir, coreDir, dev, reportError, reportDevError, cspEnabled: cspConfig.enabled, allowedOrigins: allowedOriginsValue });
+      const next = () => handleCore(req, { state, appDir, coreDir, dev, logger, reportError, hasOnError, reportDevError, cspEnabled: cspConfig.enabled, allowedOrigins: allowedOriginsValue });
       if (state.middleware) {
         try {
           return await state.middleware(req, next);
@@ -1976,7 +1976,7 @@ async function tryServeFrameworkStatic(path, method, ctx) {
 }
 
 async function handleCore(req, ctx) {
-  const { state, appDir, coreDir, dev, reportError, reportDevError, cspEnabled, allowedOrigins } = ctx;
+  const { state, appDir, coreDir, dev, logger, reportError, hasOnError, reportDevError, cspEnabled, allowedOrigins } = ctx;
   const url = new URL(req.url);
   // Decode percent-encoded characters so filesystem lookups match real
   // filenames. Dynamic route segments like `[slug]` and route groups like
@@ -2252,6 +2252,20 @@ async function handleCore(req, ctx) {
           : undefined,
       };
       if (method === 'GET' || method === 'HEAD') {
+        // #1307: `__webjs_action` in the QUERY STRING is the fingerprint of a
+        // bound submitter submitted through an UNBOUND form. Nothing else in
+        // the framework ever puts that reserved field in a url. Detect only, so
+        // the render below is unchanged: answering a GET differently because of
+        // a query parameter would hand any visitor a way to turn any page into
+        // an error.
+        reportFormSubmittedAsGet(
+          url, req,
+          // Gated on hasOnError, not on `reportError`: that is always a
+          // function here and no-ops internally, so passing it would spend a
+          // dedupe slot on a report nobody receives.
+          hasOnError ? (e) => reportError(e, req, 'action') : undefined,
+          logger, dev, page.route,
+        );
         // A successful render of URL U supersedes a RETAINED render error for
         // that same URL (#1047), so a reconnecting tab is not handed a frame the
         // page has since recovered from. Keyed on BOTH frame identity and url:
@@ -2280,7 +2294,8 @@ async function handleCore(req, ctx) {
       const deps = {
         actionIndex: state.actionIndex,
         allowedOrigins,
-        onError: reportError ? (e) => reportError(e, req, 'action') : undefined,
+        onError: hasOnError ? (e) => reportError(e, req, 'action') : undefined,
+        logger,
       };
       const handler = () => runFormAction(page.route, page.params, url, req, ssrOpts, deps);
       return runWithSegmentMiddleware(req, page.route.middlewares, handler, dev);
diff --git a/packages/server/src/form-dispatch.js b/packages/server/src/form-dispatch.js
index 1dc31bb9d..f42a3541a 100644
--- a/packages/server/src/form-dispatch.js
+++ b/packages/server/src/form-dispatch.js
@@ -214,6 +214,152 @@ function looksLikeFormSubmission(req) {
   return /multipart\/form-data|application\/x-www-form-urlencoded/i.test(ct);
 }
 
+/**
+ * Fingerprints already reported this process, keyed `CODE METHOD <route>`.
+ * Capped, and never cleared.
+ *
+ * Both signals below are reachable by anyone: an empty urlencoded POST to any
+ * page path, or `?__webjs_action=x` appended to any url. Reporting every hit
+ * would turn a public endpoint into a free amplifier into a paid APM sink, and
+ * an app needs to learn the SHAPE exists rather than count it (a real bug
+ * reproduces on the next boot).
+ *
+ * The key is the matched ROUTE PATTERN, not the request pathname, and that is
+ * load-bearing rather than cosmetic. Keyed on the pathname, a dynamic route
+ * yields unbounded distinct keys, so a few hundred crafted requests to
+ * `/blog/1`, `/blog/2`, … would fill the cap and permanently silence the
+ * diagnostics for the process, which is a worse failure than the amplification
+ * the cap exists to stop. Keyed on the pattern, all of those collapse to one
+ * entry and the key space is bounded by the app's own route count, which leaves
+ * the cap as a backstop no real app reaches. The code is part of the key too, so
+ * a flood of one signal can never silence the other.
+ *
+ * @type {Set<string>}
+ */
+const reportedFormFingerprints = new Set();
+const FINGERPRINT_CAP = 256;
+
+/**
+ * @param {string} key
+ * @returns {boolean} true the first time only, and false once the cap is hit
+ */
+function firstSighting(key) {
+  if (reportedFormFingerprints.has(key)) return false;
+  if (reportedFormFingerprints.size >= FINGERPRINT_CAP) return false;
+  reportedFormFingerprints.add(key);
+  return true;
+}
+
+/**
+ * The matched route's identity for the dedupe key: its page FILE, which is one
+ * per route and reads better in a report than a serialized RegExp (`pattern` is
+ * a RegExp, not a printable path). Falls back to the request pathname only when
+ * a caller has no route in hand.
+ *
+ * @param {{ file?: string } | null | undefined} route
+ * @param {URL} url
+ * @returns {string}
+ */
+function routeKeyOf(route, url) {
+  return (route && route.file) || url.pathname;
+}
+
+/**
+ * Reset the per-process report dedupe. Test seam only: the cap and the
+ * never-cleared set are the point in production.
+ */
+export function resetFormReportDedupe() {
+  reportedFormFingerprints.clear();
+}
+
+/**
+ * A form posted to a page and carried no action identity, so nothing ran and
+ * the answer is a 405. Route it to the APM sink with a code an app can group
+ * on, instead of leaving an anonymous 405 in an access log.
+ *
+ * Carries the field NAMES, which are template constants and are what identify
+ * WHICH form posted nowhere. Never the values, which are user data. The form's
+ * own `action` attribute is not carried because a bound form has none (the
+ * renderer strips it so the form posts to its own url), so the request url
+ * already is that information.
+ *
+ * @param {URL} url
+ * @param {Request} req
+ * @param {FormData} formData
+ * @param {((error: unknown) => void) | undefined} onError
+ * @param {{ warn?: (msg: string, meta?: Record<string, unknown>) => void }} [logger]
+ * @param {boolean} [dev]
+ * @param {{ file?: string } | null} [route] the matched page route, for the dedupe key
+ */
+export function reportFormActionMissing(url, req, formData, onError, logger, dev, route) {
+  const willLog = !!(dev && logger && logger.warn);
+  const willReport = typeof onError === 'function';
+  // Nothing to say: do not spend a dedupe slot, which would let a run with no
+  // sink configured quietly consume the cap for one that does.
+  if (!willLog && !willReport) return;
+  if (!firstSighting(`WEBJS_FORM_ACTION_MISSING ${req.method} ${routeKeyOf(route, url)}`)) return;
+  const fields = [...new Set([...formData.keys()])];
+  if (willLog) {
+    logger.warn(
+      `[webjs] a form posted to ${url.pathname} carrying no action identity, so nothing ran (405). Bind the action: <form action=\${yourAction}>.`,
+      { fields },
+    );
+  }
+  if (!willReport) return;
+  const err = new Error(
+    `A form submission to ${url.pathname} carried no \`${FORM_ACTION_FIELD}\` identity, so no server action ran and the request was answered with a 405.`,
+  );
+  /** @type {any} */ (err).code = 'WEBJS_FORM_ACTION_MISSING';
+  /** @type {any} */ (err).method = req.method;
+  /** @type {any} */ (err).pathname = url.pathname;
+  /** @type {any} */ (err).fields = fields;
+  onError(err);
+}
+
+/**
+ * A page GET carrying `__webjs_action` in the QUERY STRING (#1307). Nothing in
+ * this framework ever puts the reserved field in a url, so this can only be a
+ * bound submitter submitted through an UNBOUND form: the form defaulted to GET,
+ * the browser (or `performSubmission`, which promotes a safe-method body to the
+ * query string) put the identity in the url, and the page is about to render as
+ * if nothing was submitted.
+ *
+ * DETECTS ONLY. The GET keeps rendering its 200 page, because answering
+ * differently on a query parameter would hand any visitor a way to turn any
+ * page into an error.
+ *
+ * @param {URL} url
+ * @param {Request} req
+ * @param {((error: unknown) => void) | undefined} onError
+ * @param {{ warn?: (msg: string, meta?: Record<string, unknown>) => void }} [logger]
+ * @param {boolean} [dev]
+ * @param {{ file?: string } | null} [route] the matched page route, for the dedupe key
+ */
+export function reportFormSubmittedAsGet(url, req, onError, logger, dev, route) {
+  // Cheapest possible guard first, and it runs on EVERY page GET: a substring
+  // test on the already-parsed `search` string, so the common case never builds
+  // a URLSearchParams at all.
+  if (!url.search || !url.search.includes(FORM_ACTION_FIELD)) return;
+  if (!url.searchParams.has(FORM_ACTION_FIELD)) return;
+  const willLog = !!(dev && logger && logger.warn);
+  const willReport = typeof onError === 'function';
+  if (!willLog && !willReport) return;
+  if (!firstSighting(`WEBJS_FORM_SUBMITTED_AS_GET ${req.method} ${routeKeyOf(route, url)}`)) return;
+  if (willLog) {
+    logger.warn(
+      `[webjs] ${url.pathname} was requested with \`${FORM_ACTION_FIELD}\` in the query string, which only a bound submitter inside an UNBOUND <form> produces. The form had no method, so the browser submitted it as a GET, the action never ran, and this page is simply re-rendering. Bind the enclosing form: <form action=\${yourAction}>. The submitter-needs-bound-form rule finds these statically.`,
+    );
+  }
+  if (!willReport) return;
+  const err = new Error(
+    `A form submission reached ${url.pathname} as a GET with the \`${FORM_ACTION_FIELD}\` identity in the query string, so no server action ran. The submitter's enclosing <form> binds no action.`,
+  );
+  /** @type {any} */ (err).code = 'WEBJS_FORM_SUBMITTED_AS_GET';
+  /** @type {any} */ (err).method = req.method;
+  /** @type {any} */ (err).pathname = url.pathname;
+  onError(err);
+}
+
 /**
  * The submitted TEXT fields as a plain record, for repopulating a form the
  * dispatcher could not run.
@@ -258,11 +404,12 @@ function methodNotAllowed() {
  *   actionIndex: import('./actions.js').ActionIndex,
  *   allowedOrigins?: string[],
  *   onError?: (error: unknown) => void,
+ *   logger?: { warn?: (msg: string, meta?: Record<string, unknown>) => void },
  * }} deps
  * @returns {Promise<Response>}
  */
 export async function runFormAction(route, params, url, req, ssrOpts, deps) {
-  const { actionIndex, allowedOrigins = [], onError } = deps;
+  const { actionIndex, allowedOrigins = [], onError, logger } = deps;
 
   // Not a form body at all (a stray JSON POST, a probe): the page path exists
   // and only renders. Answered before the body is touched.
@@ -289,8 +436,20 @@ export async function runFormAction(route, params, url, req, ssrOpts, deps) {
   const actions = formData.getAll(FORM_ACTION_FIELD);
   const id = actions.length ? actions[actions.length - 1] : null;
   // A form body carrying no identity: a hand-written `<form method="post">`
-  // that binds no action. Nothing to run, and the page only renders.
-  if (typeof id !== 'string' || !id) return methodNotAllowed();
+  // that binds no action. Nothing to run, and the page only renders. Reported
+  // before the 405 so the shape is not just an anonymous status in an access
+  // log.
+  //
+  // NOT the unparseable-enctype variant of #1307. An `enctype="text/plain"`
+  // submission arrives with that content type, so `looksLikeFormSubmission`
+  // answers it above, before the body is read and before this point. That is
+  // deliberate (buffering an attacker-chosen body to classify it is exactly what
+  // the early return avoids), and it means the text/plain variant is visible
+  // only as a bare 405. The dev-time client guard covers it instead.
+  if (typeof id !== 'string' || !id) {
+    reportFormActionMissing(url, req, formData, onError, logger, !!ssrOpts.dev, route);
+    return methodNotAllowed();
+  }
   // The field is framework wire, not app data. Removing it keeps an action
   // that iterates the FormData (building a record, echoing values back into a
   // 422 re-render) from seeing a key it did not put there.
diff --git a/packages/server/src/js-scan.js b/packages/server/src/js-scan.js
index 7b4e6e2a0..50928413c 100644
--- a/packages/server/src/js-scan.js
+++ b/packages/server/src/js-scan.js
@@ -470,7 +470,13 @@ export function extractWebComponentClassBodies(content) {
         bodies.push({
           body: content.slice(bodyStart, end),
           factoryProps,
-          factoryArg
+          factoryArg,
+          // Offsets into `content`. Callers pass the position-preserving MASK,
+          // so these index the RAW source identically, which is how a caller
+          // that needs the body's real template text gets it without asking
+          // this lexer to handle raw source (#1307).
+          bodyStart,
+          bodyEnd: end,
         });
       }
     }
@@ -632,28 +638,46 @@ export function matchClosingParenthesis(s, start) {
  * `}` inside `'…'`, `"…"`, or backtick templates don't decrement depth.
  * Returns -1 if no balanced brace is found.
  *
+ * A template hole is a CODE context nested inside a template, not a brace in
+ * the enclosing block, so it gets its own frame on the stack: `${` pushes,
+ * and the `}` that returns that frame to depth zero pops back into the
+ * template rather than counting toward the block being matched. An earlier
+ * version incremented the outer depth at `${` and then never decremented it
+ * (the closing `}` arrived while still in template state), so depth could
+ * never return to zero and a class body holding `` html`…${x}…` `` was
+ * unmatchable. Every caller passed a masked source in which holes are already
+ * blanked, so the bug was invisible until one passed raw source (#1307).
+ *
  * @param {string} s
  * @param {number} start
  */
 export function matchClosingBrace(s, start) {
-  let depth = 1;
+  // Innermost first. `tpl` frames are template literals (no brace counting);
+  // `!tpl` frames are code, each with its own depth.
+  /** @type {Array<{ tpl: boolean, depth: number }>} */
+  const stack = [{ tpl: false, depth: 1 }];
   let i = start;
-  let str = ''; // '', "'", '"', or backtick
   while (i < s.length) {
+    const top = stack[stack.length - 1];
     const c = s[i];
-    if (str) {
+    if (top.tpl) {
       if (c === '\\') { i += 2; continue; }
-      if (c === str) str = '';
-      else if (str === '`' && c === '$' && s[i + 1] === '{') {
-        // template hole, count its closing `}` toward our brace depth.
-        depth++;
-        i += 2;
-        continue;
-      }
+      if (c === '`') { stack.pop(); i++; continue; }
+      if (c === '$' && s[i + 1] === '{') { stack.push({ tpl: false, depth: 1 }); i += 2; continue; }
       i++;
       continue;
     }
-    if (c === "'" || c === '"' || c === '`') { str = c; i++; continue; }
+    if (c === "'" || c === '"') {
+      i++;
+      while (i < s.length) {
+        if (s[i] === '\\') { i += 2; continue; }
+        const d = s[i];
+        i++;
+        if (d === c || d === '\n') break;   // closed, or unterminated at EOL
+      }
+      continue;
+    }
+    if (c === '`') { stack.push({ tpl: true, depth: 0 }); i++; continue; }
     if (c === '/' && s[i + 1] === '/') { // line comment
       while (i < s.length && s[i] !== '\n') i++;
       continue;
@@ -664,8 +688,18 @@ export function matchClosingBrace(s, start) {
       i += 2;
       continue;
     }
-    if (c === '{') depth++;
-    else if (c === '}') { depth--; if (depth === 0) return i; }
+    if (c === '{') { top.depth++; i++; continue; }
+    if (c === '}') {
+      top.depth--;
+      // Depth zero closes this frame: the outermost one is the answer, an inner
+      // one is a template hole ending and hands control back to its template.
+      if (top.depth === 0) {
+        if (stack.length === 1) return i;
+        stack.pop();
+      }
+      i++;
+      continue;
+    }
     i++;
   }
   return -1;
@@ -689,3 +723,422 @@ export function redactToPlaceholders(src) {
   return { redacted: out, literals };
 }
 
+/**
+ * The attribute position a template hole commits to, read from the literal
+ * segment immediately before it. Returns the attribute NAME only; a caller
+ * pairs it with the tag the hole sits in.
+ *
+ * @param {string} literalBefore
+ * @returns {'action' | 'formaction' | null}
+ */
+function trailingActionAttr(literalBefore) {
+  if (/\sformaction=$/i.test(literalBefore)) return 'formaction';
+  if (/\saction=$/i.test(literalBefore)) return 'action';
+  return null;
+}
+
+/**
+ * Classify a template hole by the start tag and attribute it commits: `'form'`
+ * for `<form action=` (#1155), `'submitter'` for `<button|input formaction=`
+ * (#1207), and `null` for anything else.
+ *
+ * Reading the segment immediately before the hole rather than the whole
+ * template is what keeps `<div action=${x}>` out. The tag and the attribute are
+ * matched as a PAIR, so `<form formaction=${x}>` and `<button action=${x}>`
+ * stay out too: both are refused at render time, and neither is a binding.
+ *
+ * @param {string} literalBefore the literal segment immediately before the hole
+ * @returns {'form' | 'submitter' | null}
+ */
+export function classifyActionHole(literalBefore) {
+  const attr = trailingActionAttr(literalBefore);
+  if (!attr) return null;
+  // The last `<` opens the tag the hole sits in. Requiring no `>` after it
+  // keeps the match inside that one start tag.
+  const tagAt = literalBefore.lastIndexOf('<');
+  if (tagAt < 0) return null;
+  const tag = literalBefore.slice(tagAt);
+  if (tag.includes('>')) return null;
+  if (attr === 'action' && /^<form\b/i.test(tag)) return 'form';
+  if (attr === 'formaction' && /^<(?:button|input)\b/i.test(tag)) return 'submitter';
+  return null;
+}
+
+/**
+ * The ONE `enctype` keyword that loses a form body the server could otherwise
+ * read.
+ *
+ * Stated as a denylist rather than an allowlist because `enctype` is an
+ * enumerated attribute whose missing value default AND invalid value default are
+ * both `application/x-www-form-urlencoded`. So `enctype="nonsense"` falls back to
+ * urlencoded and submits a perfectly parseable body; only the third valid
+ * keyword, `text/plain`, is a real loss. An allowlist inverts that and reports a
+ * working form as broken, which this rule must never do.
+ *
+ * The renderer's `PARSEABLE_ENCTYPES` (`form-action.js`) refuses the wider set,
+ * and that divergence is deliberate on BOTH sides rather than an inconsistency
+ * to unify. The two ask different questions. This rule asks whether the
+ * identity ARRIVES, and under an invalid enctype it does. The renderer asks
+ * whether the form will do what the author wrote, and there an invalid value is
+ * the dangerous case: `enctype="multipart/form-dat"` falls back to urlencoded,
+ * which silently drops every FILE from the submission, so throwing at render is
+ * the only way the author finds out. Unifying them would either make the
+ * renderer accept a typo that loses uploads, or make this rule report a working
+ * form as broken.
+ */
+const UNPARSEABLE_FORM_ENCTYPE = 'text/plain';
+
+/**
+ * Read one attribute's literal value out of a start tag's accumulated text.
+ * Returns null when absent, and the raw value otherwise (quoted or bare).
+ *
+ * @param {string} tagText
+ * @param {string} name
+ * @returns {string | null}
+ */
+function startTagAttr(tagText, name) {
+  const re = new RegExp(`\\s${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, 'i');
+  const m = re.exec(tagText);
+  if (!m) return null;
+  return m[1] ?? m[2] ?? m[3] ?? '';
+}
+
+/**
+ * Would an UNBOUND `<form>` still deliver a submitter's action identity?
+ *
+ * This is the difference between a broken write path and a working one, and it
+ * is not intuitive. A submitter carries its identity in its OWN `name`/`value`
+ * pair, which a browser submits for the pressed button alone, so an unbound
+ * form that still sends a parseable POST body delivers it and the action RUNS
+ * (the dispatcher takes the last `__webjs_action` entry it finds). What breaks
+ * is a form that sends no body the server can read: no `method` at all or
+ * `method="get"` (a GET puts the identity in the query string and the page just
+ * re-renders), or an enctype `parseFormBody` cannot parse (a 405).
+ *
+ * Both are enumerated attributes matched against exact keywords with no
+ * whitespace stripping, and their defaults pull in OPPOSITE directions, which is
+ * why they are tested differently. `method` defaults to GET, so anything that is
+ * not exactly `post` loses the body (a padded `method=" post "` included).
+ * `enctype` defaults to `application/x-www-form-urlencoded` for both a missing
+ * AND an invalid value, so only the `text/plain` keyword actually loses it.
+ *
+ * @param {string} tagText the form's start tag, from `<form` to just before `>`
+ * @returns {boolean}
+ */
+function unboundFormDelivers(tagText) {
+  const method = startTagAttr(tagText, 'method');
+  if (method === null || method.toLowerCase() !== 'post') return false;
+  const enctype = startTagAttr(tagText, 'enctype');
+  if (enctype !== null && enctype.toLowerCase() === UNPARSEABLE_FORM_ENCTYPE) return false;
+  return true;
+}
+
+/**
+ * The ONE start-tag hole the renderer renders INLINE, in the enclosing scan and
+ * with the enclosing form scope, rather than handing to the receiving element:
+ * `<webjs-suspense .fallback=${html`…`}>` (#471).
+ *
+ * A custom-element property applies only at HYDRATION, which is too late for a
+ * placeholder that has to be in the first flushed bytes, so `render-server.js`
+ * renders the fallback right there and carries the HTML as
+ * `data-webjs-fallback`. (The timing is the operative reason on its own. A
+ * serializable `TemplateResult` would otherwise ride as `data-webjs-prop-*`
+ * perfectly well; only one carrying a function fails to serialize.) That means a submitter in a fallback IS judged against
+ * the enclosing form, and the renderer really does throw for an unbound one.
+ * Treating it as handed off would make the same-scan half blind to the one shape
+ * it exists to pre-warn about.
+ *
+ * @param {string} tagName lowercased
+ * @param {string} literalBefore the literal segment immediately before the hole
+ * @returns {boolean}
+ */
+function isInlineStartTagHole(tagName, literalBefore) {
+  // The property name is a JS identifier, so it is case-SENSITIVE, unlike an
+  // attribute name.
+  return tagName === 'webjs-suspense' && /\.fallback=$/.test(literalBefore);
+}
+
+/**
+ * @typedef {'none'|'unbound'|'bound'|'handed'} FormScope
+ *
+ * `'none'` and `'handed'` are BOTH "no enclosing form in this scan", and they
+ * are deliberately separate values because a caller must treat them
+ * differently. `'none'` is a cannot-tell that the file's own component may
+ * legitimately own, so a caller may attribute it and resolve it against that
+ * component's call sites. `'handed'` is a template sitting in a start-tag hole,
+ * which is an attribute or property VALUE: some OTHER element received it and
+ * decides where it renders, so this file's call sites say nothing about it and
+ * it can never be attributed to anything. Collapsing the two makes a handed-off
+ * template resolve through the wrong component's call sites.
+ *
+ * @typedef {{
+ *   tag: string,
+ *   scope: FormScope,
+ *   delivers: boolean | null,
+ *   expr: string | null,
+ * }} FormScopeSite
+ *
+ * `expr` is the submitter hole's expression text, verbatim from the redacted
+ * source, and null for a tag use. A caller MUST look at it before treating the
+ * hole as an action binding: this scan is lexical, while the renderer binds only
+ * when the value is a FUNCTION (`isBoundFormAction`), so
+ * `formaction=${'/api/' + id}` is an ordinary url attribute that ships fine.
+ *
+ * `delivers` is meaningful only when `scope` is `'unbound'`: true when that
+ * form would still carry a submitter's identity to the server, false when it
+ * would not, and null when a hole in its start tag makes the answer dynamic and
+ * therefore unknowable.
+ */
+
+/**
+ * Walk every `` html`...` `` template literal in `src` and report, for each
+ * submitter action hole (`<button|input formaction=${...}>`) and each
+ * custom-element start tag, the enclosing `<form>` scope at that point (#1307).
+ *
+ * Only an `html`-tagged literal is entered, so `const s = '<form>'` and a `css`
+ * or `sql` template are never read as markup. That carve-out matters: the
+ * framework's own website renders `<form action=${fn}>` as a code SAMPLE.
+ *
+ * A template nested inside a CHILD-position hole INHERITS the enclosing scope,
+ * because that is what the renderer does (`render` threads `formScope` through
+ * arrays, `repeat`, and nested templates).
+ *
+ * One in a START-TAG hole is `'handed'`: an attribute or property value whose
+ * placement this scan cannot speak for. Worth being exact about why, because the
+ * obvious reason is not the operative one. SSR does NOT render such a template
+ * in place: a serializable value rides to the receiving element as
+ * `data-webjs-prop-*` and is applied at HYDRATION, and one carrying a function
+ * (a bound submitter, by definition) fails to serialize, so `render-server.js`
+ * DROPS the binding with a warning and emits nothing for it at all. Either way
+ * the element that receives the property decides where the content lands, in the
+ * browser, which is exactly what this scan cannot see.
+ *
+ * The single exception is `<webjs-suspense .fallback=${…}>`, which the renderer
+ * really does render inline with the enclosing scope (see
+ * `isInlineStartTagHole`), so that one inherits.
+ *
+ * A separate top-level template starts fresh at
+ * `'none'`, because it is its own scan there too. `</form>` returns to the scope
+ * the scan started in, mirroring `handleTagEnd` in `render-server.js`.
+ *
+ * `opensForm` reports whether ANY `<form` start tag was seen anywhere in `src`.
+ * A caller attributing a scope-`'none'` site to this file needs it: a fragment
+ * built into a local and spliced into a form the same file opens inherits the
+ * SPLICE point's scope, not the file's own call-site scope, so a file that
+ * opens a form cannot have its `'none'` sites attributed safely.
+ *
+ * @param {string} src
+ * @returns {{ submitters: FormScopeSite[], tagUses: FormScopeSite[], opensForm: boolean }}
+ */
+export function scanHtmlFormScopes(src) {
+  const { redacted, literals } = redactToPlaceholders(src);
+  /** @type {FormScopeSite[]} */
+  const submitters = [];
+  /** @type {FormScopeSite[]} */
+  const tagUses = [];
+  let opensForm = false;
+  const n = redacted.length;
+  // Sticky, so matching a literal placeholder at the cursor costs no slice.
+  const STR = /__STR_(\d+)__/y;
+
+  /**
+   * Walk code. In placeholder mode a comment body and a regex body are already
+   * blanked to spaces and a string body is one opaque token, so the only
+   * structure left to track is braces, quote delimiters, and backticks.
+   *
+   * @param {number} i
+   * @param {boolean} stopAtBrace return at the `}` closing the enclosing hole
+   * @param {FormScope} scope inherited by any template found here
+   * @param {boolean | null} delivers inherited alongside `scope`
+   * @returns {number}
+   */
+  function walkCode(i, stopAtBrace, scope, delivers) {
+    let brace = 0;
+    while (i < n) {
+      const c = redacted[i];
+      if (stopAtBrace && c === '}' && brace === 0) return i;
+      if (c === '{') { brace++; i++; continue; }
+      if (c === '}') { brace--; i++; continue; }
+      if (c === "'" || c === '"') {
+        i++;
+        while (i < n && redacted[i] !== c && redacted[i] !== '\n') i++;
+        if (i < n) i++;
+        continue;
+      }
+      if (c === '`') {
+        const before = redacted.slice(Math.max(0, i - 32), i);
+        const tagged = /([A-Za-z_$][\w$]*)\s*$/.exec(before);
+        i = walkTemplate(i + 1, !!tagged && tagged[1] === 'html', scope, delivers);
+        continue;
+      }
+      i++;
+    }
+    return i;
+  }
+
+  /**
+   * Walk one template literal from just after its opening backtick.
+   *
+   * @param {number} i
+   * @param {boolean} isHtml whether its markup should be read
+   * @param {FormScope} startScope
+   * @param {boolean | null} startDelivers
+   * @returns {number} the index just past the closing backtick
+   */
+  function walkTemplate(i, isHtml, startScope, startDelivers) {
+    /** @type {FormScope} */
+    let scope = startScope;
+    /** @type {boolean | null} */
+    let delivers = startDelivers;
+    /**
+     * The start tag currently open. It persists across literal segments AND
+     * across holes, because `<form action=${fn} class="x">` is one tag split
+     * into three pieces by the scan. `text` accumulates the tag's literal
+     * source so its attributes can be read at the `>`, and `dynamicAttrs`
+     * records that a hole other than the action binding landed in it, which
+     * makes those attributes unknowable.
+     * @type {null | { name: string, isClose: boolean, quote: string | null, formHole: boolean, submitterHole: boolean, submitterExpr: string | null, text: string, dynamicAttrs: boolean }}
+     */
+    let tag = null;
+    let inComment = false;
+    let lastLiteral = '';
+
+    const closeTag = () => {
+      const t = tag;
+      tag = null;
+      if (!t) return;
+      if (t.isClose) {
+        // Back to the scope this scan STARTED in, not a flat 'none': a nested
+        // template closing a form of its own learns nothing about the form its
+        // caller may have opened.
+        if (t.name === 'form') { scope = startScope; delivers = startDelivers; }
+        return;
+      }
+      if (t.name === 'form') {
+        opensForm = true;
+        // A form that opened and bound NOTHING still opens a scope: a submitter
+        // inside it is a different answer from one with no form at all. Whether
+        // that unbound form would still DELIVER a submitter's identity is a
+        // separate question, and the one that decides if the shape is broken.
+        scope = t.formHole ? 'bound' : 'unbound';
+        delivers = t.formHole ? null : (t.dynamicAttrs ? null : unboundFormDelivers(t.text));
+        return;
+      }
+      if (t.submitterHole) submitters.push({ tag: t.name, scope, delivers, expr: t.submitterExpr || null });
+      if (t.name.includes('-')) tagUses.push({ tag: t.name, scope, delivers, expr: null });
+    };
+
+    /** @param {string} text one literal segment, read as markup */
+    const consumeMarkup = (text) => {
+      let p = 0;
+      while (p < text.length) {
+        if (inComment) {
+          const end = text.indexOf('-->', p);
+          if (end < 0) return;
+          inComment = false;
+          p = end + 3;
+          continue;
+        }
+        if (tag) {
+          const ch = text[p];
+          if (tag.quote) {
+            if (ch === tag.quote) tag.quote = null;
+            tag.text += ch;
+            p++;
+            continue;
+          }
+          if (ch === '"' || ch === "'") { tag.quote = ch; tag.text += ch; p++; continue; }
+          if (ch === '>') { p++; closeTag(); continue; }
+          tag.text += ch;
+          p++;
+          continue;
+        }
+        const lt = text.indexOf('<', p);
+        if (lt < 0) return;
+        if (text.startsWith('<!--', lt)) { inComment = true; p = lt + 4; continue; }
+        const m = /^<(\/?)([A-Za-z][A-Za-z0-9-]*)/.exec(text.slice(lt));
+        if (!m) { p = lt + 1; continue; }
+        tag = {
+          name: m[2].toLowerCase(),
+          isClose: m[1] === '/',
+          quote: null,
+          formHole: false,
+          submitterHole: false,
+          submitterExpr: null,
+          text: m[0],
+          dynamicAttrs: false,
+        };
+        p = lt + m[0].length;
+      }
+    };
+
+    while (i < n) {
+      const c = redacted[i];
+      if (c === '`') return i + 1;
+      if (c === '$' && redacted[i + 1] === '{') {
+        let capturingSubmitter = false;
+        if (isHtml && tag && !tag.isClose) {
+          const attr = trailingActionAttr(lastLiteral);
+          if (attr === 'action' && tag.name === 'form') tag.formHole = true;
+          else if (attr === 'formaction' && (tag.name === 'button' || tag.name === 'input')) {
+            tag.submitterHole = true;
+            capturingSubmitter = true;
+          }
+          // Any OTHER hole in a form's start tag makes its `method` / `enctype`
+          // dynamic, so whether an unbound form would deliver becomes unknowable.
+          else if (tag.name === 'form') tag.dynamicAttrs = true;
+        }
+        // A hole inside a START TAG is USUALLY an attribute or property VALUE
+        // whose placement this scan cannot speak for, so it starts at 'handed'
+        // instead of inheriting. A hole in CHILD position is rendered inline by
+        // this scan and does inherit, and so does the one start-tag hole the
+        // renderer also renders inline (`isInlineStartTagHole`).
+        //
+        // Read the JSDoc on `scanHtmlFormScopes` for why 'handed' is right: SSR
+        // does NOT render such a template in place, so the receiving element
+        // decides where it lands, in the browser.
+        //
+        // Without the split, `<form method="post"><my-thing .tpl=${html`<button
+        // formaction=${del}>x</button>`}></my-thing></form>` scored the button
+        // 'unbound' from lexical nesting. Nothing renders that button at SSR at
+        // all (the binding carries a function, so it fails to serialize and is
+        // dropped), and where it ends up is `my-thing`'s decision at hydration,
+        // so a conclusive verdict here was never this scan's to give.
+        //
+        // 'handed' and NOT 'none', which is the subtle half: 'none' is the
+        // cannot-tell a caller attributes to this file's own component and
+        // resolves against ITS call sites, and a handed-off template belongs to
+        // whichever element received it instead. Using 'none' here silences the
+        // false positive on a page and recreates it in a component file.
+        const inlineHole = tag && !tag.isClose && isInlineStartTagHole(tag.name, lastLiteral);
+        const handOff = tag && !tag.isClose && !inlineHole;
+        const holeScope = handOff ? 'handed' : scope;
+        const holeDelivers = handOff ? null : delivers;
+        // Only the segment IMMEDIATELY before a hole can commit an attribute,
+        // so two adjacent holes leave nothing for the second to read.
+        lastLiteral = '';
+        const holeStart = i + 2;
+        i = walkCode(i + 2, true, holeScope, holeDelivers);
+        // The hole's expression, so a caller can require a real action binding.
+        if (capturingSubmitter && tag) tag.submitterExpr = redacted.slice(holeStart, i).trim();
+        if (i < n && redacted[i] === '}') i++;
+        continue;
+      }
+      STR.lastIndex = i;
+      const m = STR.exec(redacted);
+      if (m) {
+        const text = literals[Number(m[1])] || '';
+        lastLiteral = text;
+        if (isHtml) consumeMarkup(text);
+        i = STR.lastIndex;
+        continue;
+      }
+      i++;
+    }
+    return i;
+  }
+
+  walkCode(0, false, 'none', null);
+  return { submitters, tagUses, opensForm };
+}
+
diff --git a/packages/server/test/check/submitter-needs-bound-form.test.js b/packages/server/test/check/submitter-needs-bound-form.test.js
new file mode 100644
index 000000000..7b27bd165
--- /dev/null
+++ b/packages/server/test/check/submitter-needs-bound-form.test.js
@@ -0,0 +1,716 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+import { checkConventions, RULES } from '../../src/check.js';
+
+/**
+ * Tests for `submitter-needs-bound-form` (#1307): a `<button formaction=${fn}>`
+ * whose enclosing `<form>` binds nothing posts nowhere. The form defaults to
+ * GET, the reserved identity field rides the query string, and the page simply
+ * re-renders with the action never having run.
+ *
+ * Neither renderer can catch the cross-module version of this: SSR reads one
+ * template at a time and a component renders its own template in a separate
+ * pass with no view of the host page, so it is a cannot-tell there and
+ * cannot-tell has to bind. This rule reads every template in the app at once.
+ *
+ * The NON-firing cases matter more than the firing ones. The rule is
+ * deliberately conservative: anything it cannot resolve conclusively stays
+ * silent, because a false positive on an ordinary shape (a per-row button, a
+ * button inside a component) would be worse than the bug it catches.
+ */
+const RULE = 'submitter-needs-bound-form';
+
+/**
+ * The action modules the fixtures import. Real files, because the rule resolves
+ * the binding to its target and requires a provably callable export: a hole
+ * naming a url CONSTANT is not a binding, so an unresolvable or non-callable
+ * import is correctly silent and a fixture without these would prove nothing.
+ */
+const ACTIONS = {
+  // The `#` root alias is Node's `package.json` "imports" field, so the rule
+  // cannot resolve a `#modules/...` specifier without it. A scaffolded app
+  // always ships this catch-all.
+  'package.json': JSON.stringify({ name: 'fixture', imports: { '#*': './*' } }),
+  'modules/feedback/actions/publish.server.ts': `'use server';
+export async function publishDraft(formData) { return { success: true, got: formData }; }
+`,
+  'modules/feedback/actions/save.server.ts': `'use server';
+export async function saveAll(formData) { return { success: true, got: formData }; }
+`,
+};
+
+async function makeApp(files) {
+  const dir = await mkdtemp(join(tmpdir(), 'webjs-submitter-bound-'));
+  for (const [rel, contents] of Object.entries({ ...ACTIONS, ...files })) {
+    const abs = join(dir, rel);
+    await mkdir(abs.slice(0, abs.lastIndexOf('/')), { recursive: true });
+    await writeFile(abs, contents);
+  }
+  return dir;
+}
+const hits = (v) => v.filter((x) => x.rule === RULE);
+
+/** A one-tag, one-class component file holding the bound submitter. */
+const rowBtn = (extra = '') => `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+class RowBtn extends WebComponent({}) {
+  render() {
+    return html\`<button formaction=\${publishDraft}>Publish</button>\`;
+  }
+}
+RowBtn.register('row-btn');
+${extra}`;
+
+const TODO_LIST = `import { html, WebComponent } from '@webjsdev/core';
+class TodoList extends WebComponent({}) {
+  render() { return html\`<ul><todo-row></todo-row></ul>\`; }
+}
+TodoList.register('todo-list');
+`;
+const TODO_ROW = `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+class TodoRow extends WebComponent({}) {
+  render() { return html\`<li><button formaction=\${publishDraft}>Publish</button></li>\`; }
+}
+TodoRow.register('todo-row');
+`;
+
+test('the rule is registered', () => {
+  assert.ok(RULES.some((r) => r.name === RULE), 'RULES lists submitter-needs-bound-form');
+});
+
+test('flags a component submitter whose only call site is an unbound form', async () => {
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import '#components/row-btn.ts';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  const v = hits(await checkConventions(dir));
+  assert.equal(v.length, 1, 'exactly one violation');
+  assert.match(v[0].file, /row-btn\.ts/);
+  assert.match(v[0].message, /<row-btn> is rendered/);
+  assert.match(v[0].fix, /<form action=/);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the call site binds the form', async () => {
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import { saveAll } from '#modules/feedback/actions/save.server.ts';
+export default () => html\`<form action=\${saveAll}><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when one call site is bound and another is not', async () => {
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/a/page.ts': `import { html } from '@webjsdev/core';
+import { saveAll } from '#modules/feedback/actions/save.server.ts';
+export default () => html\`<form action=\${saveAll}><row-btn></row-btn></form>\`;
+`,
+    'app/b/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a mixed tag is indefinite');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the unbound host form still DELIVERS the identity (method=post)', async () => {
+  // The distinction the rule turns on, and the one that is easy to get wrong.
+  // An unbound `<form method="post">` WORKS across a module boundary: the
+  // cannot-tell fallback binds the submitter, the submitter's own name/value
+  // pair carries `__webjs_action` into the POST body, and the dispatcher takes
+  // the last entry it finds. Flagging it would be a false positive on working
+  // code, with a diagnosis (a GET, a query string) that never happens.
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form method="post"><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'an unbound POST form delivers, so nothing is broken');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('fires when the unbound host form cannot deliver (method=get, or a bad enctype)', async () => {
+  // The other side of the same coin: these really do lose the identity.
+  for (const form of ['<form method="get">', '<form method="post" enctype="text/plain">', '<form method=" post ">']) {
+    const dir = await makeApp({
+      'components/row-btn.ts': rowBtn(),
+      'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`${form}<row-btn></row-btn></form>\`;
+`,
+    });
+    const v = hits(await checkConventions(dir));
+    assert.equal(v.length, 1, `${form} cannot carry the identity`);
+    assert.match(v[0].message, /cannot carry the identity to the server/);
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('silent when the host form method is a dynamic hole', async () => {
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default ({ m }) => html\`<form method=\${m}><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a dynamic method is unknowable');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the component could splice a fragment into a form it opens itself', async () => {
+  // A fragment built into a local and spliced into a form the SAME file opens
+  // inherits the splice point's scope, not this component's call-site scope,
+  // and the two templates are separate scans. Same reasoning the submitter half
+  // already applies to a bare helper.
+  const dir = await makeApp({
+    'components/todo-list.ts': `import { html, WebComponent } from '@webjsdev/core';
+class TodoList extends WebComponent({}) {
+  render() {
+    const rows = html\`<todo-row></todo-row>\`;
+    return html\`<form action=\${save}>\${rows}</form>\`;
+  }
+}
+TodoList.register('todo-list');
+`,
+    'components/todo-row.ts': TODO_ROW,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><todo-list></todo-list></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a file that opens its own form cannot attribute a none-scope use');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('a regex literal in a component file does not silently disable the rule', async () => {
+  // The class body is located in the MASK and sliced out of the raw source at
+  // the same offsets, so the brace matcher never lexes raw source. Feeding it
+  // raw source made `static re = /[{]/` yield zero class bodies, which dropped
+  // the cross-module half for that file with no signal at all.
+  const dir = await makeApp({
+    'components/row-btn.ts': `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+class RowBtn extends WebComponent({}) {
+  static re = /[{]/;
+  render() { return html\`<button formaction=\${publishDraft}>Publish</button>\`; }
+}
+RowBtn.register('row-btn');
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  const v = hits(await checkConventions(dir));
+  assert.equal(v.length, 1, 'the rule still sees the class body');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when a module-scope helper in the component file opens a form', async () => {
+  // The guard is the WHOLE-FILE scan, not the class body: a helper outside the
+  // class can open a form the body never sees, and splicing into that is the
+  // same hole the class-body case has.
+  const dir = await makeApp({
+    'components/row-btn.ts': `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+const shell = (inner) => html\`<form action=\${save}>\${inner}</form>\`;
+class RowBtn extends WebComponent({}) {
+  render() { return shell(html\`<button formaction=\${publishDraft}>Publish</button>\`); }
+}
+RowBtn.register('row-btn');
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'the submitter may be spliced into the helper form');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent on an unrecognised enctype, which falls back to a parseable body', async () => {
+  // `enctype` defaults to application/x-www-form-urlencoded for a missing AND an
+  // invalid value, so this form really does deliver.
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form method="post" enctype="nonsense"><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the submitter template is passed as a component PROPERTY', async () => {
+  // Lexically inside the form, but the scan cannot say where it lands. SSR
+  // renders nothing for it at all: the binding carries a function, so it fails
+  // to serialize and is dropped with a warning, and <my-thing> decides where the
+  // button goes at hydration. A conclusive verdict here was never this scan's
+  // to give.
+  const dir = await makeApp({
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form method="post"><my-thing .tpl=\${html\`<button formaction=\${publishDraft}>P</button>\`}></my-thing></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when a COMPONENT hands its submitter template to another element', async () => {
+  // The variant that matters most, and the one a page-only test misses. Marking
+  // the handed-off template 'none' silences it on a page and recreates the false
+  // positive here, because 'none' is exactly the value the cross-module half
+  // attributes to this file's own tag and resolves against ITS call sites.
+  // <my-thing> is what decides where the button lands.
+  const dir = await makeApp({
+    'components/row-btn.ts': `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+class RowBtn extends WebComponent({}) {
+  render() { return html\`<my-thing .tpl=\${html\`<button formaction=\${publishDraft}>P</button>\`}></my-thing>\`; }
+}
+RowBtn.register('row-btn');
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'the receiving element places the button');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when a component hands a TAG to another element', async () => {
+  // The same root cause on the tag half: <my-shell> places the row, so
+  // <todo-list>'s call sites say nothing about where <todo-row> renders.
+  const dir = await makeApp({
+    'components/todo-list.ts': `import { html, WebComponent } from '@webjsdev/core';
+class TodoList extends WebComponent({}) {
+  render() { return html\`<my-shell .rows=\${html\`<todo-row></todo-row>\`}></my-shell>\`; }
+}
+TodoList.register('todo-list');
+`,
+    'components/todo-row.ts': TODO_ROW,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><todo-list></todo-list></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a handed-off tag has no attributable call site');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('a tag inside a suspense FALLBACK is a real call site, unlike an ordinary prop', async () => {
+  // The suspense carve-out changes the tag half too, and that half can create
+  // violations rather than only silence them, so it needs its own coverage. The
+  // fallback is rendered inline inside the enclosing form, so <todo-row> really
+  // does land there and the verdict is truthful.
+  const page = (host) => `import { html } from '@webjsdev/core';
+export default () => html\`<form>${host}</form>\`;
+`;
+  const fallback = await makeApp({
+    'components/todo-row.ts': TODO_ROW,
+    'app/page.ts': page('<webjs-suspense .fallback=\${html\`<todo-row></todo-row>\`}></webjs-suspense>'),
+  });
+  assert.equal(hits(await checkConventions(fallback)).length, 1, 'the fallback renders inline, so it is a call site');
+  await rm(fallback, { recursive: true, force: true });
+
+  // The same shape through an ordinary property is handed off and stays silent.
+  const handed = await makeApp({
+    'components/todo-row.ts': TODO_ROW,
+    'app/page.ts': page('<my-shell .rows=\${html\`<todo-row></todo-row>\`}></my-shell>'),
+  });
+  assert.deepEqual(hits(await checkConventions(handed)), [], 'my-shell decides where the row lands');
+  await rm(handed, { recursive: true, force: true });
+});
+
+test('silent on a formaction hole that is a URL, not an action', async () => {
+  // The scan is lexical; the RENDERER binds only when the hole's value is a
+  // FUNCTION (`isBoundFormAction`). So an ordinary progressive-enhancement form
+  // whose buttons post to different `route.ts` endpoints is not a binding at
+  // all, and reporting it was a false positive on working code.
+  for (const hole of ["\\${'/api/items/' + id + '/archive'}", "\\${'/api/x'}", '\\${localUrl}']) {
+    const dir = await makeApp({
+      'app/items/page.ts': `import { html } from '@webjsdev/core';
+const localUrl = '/api/x';
+export default ({ id }) => html\`<form method="post" action="/api/items"><button formaction=${hole}>Archive</button></form>\`;
+`,
+    });
+    assert.deepEqual(hits(await checkConventions(dir)), [], `${hole} is a url, not an action`);
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('the callable matrix: every url shape silent, every function shape flagged', async () => {
+  // The whole table in one place, because two review rounds found defects here
+  // and both were a single spelling. The rule fires only on a PROVABLY callable
+  // export: an earlier version accepted a bare `(` after the `=`, which proves a
+  // parenthesized EXPRESSION, so the ordinary env-fallback url constant read as
+  // an action. A single-parameter arrow was the mirror error, silently dropping
+  // a real binding.
+  const cases = [
+    // [export source, should the rule fire]
+    ["export const publishDraft = '/api/x';", false],
+    ["export const publishDraft = ('/api/x');", false],
+    ["export const publishDraft = (process.env.X || '/api/x');", false],
+    ["export const publishDraft = (process.env.X ? '/a' : '/b');", false],
+    ['export const publishDraft = cache(async () => 1);', false],
+    ["const publishDraft = '/api/x';\nexport { publishDraft };", false],
+    ['export async function publishDraft(fd) { return 1; }', true],
+    ['export function publishDraft(fd) { return 1; }', true],
+    ['export const publishDraft = async (fd) => 1;', true],
+    ['export const publishDraft = async fd => 1;', true],
+    ['export const publishDraft = () => 1;', true],
+    ['export const publishDraft = async function (fd) { return 1; };', true],
+    ['async function publishDraft(fd) { return 1; }\nexport { publishDraft };', true],
+    // A TS annotation can contain its own `=>`, and this is the spelling the
+    // derive-the-type rule pushes authors toward. Skipping the annotation with a
+    // lazy regex stopped at the arrow's `=` and silently dropped the binding.
+    ['export const publishDraft: (fd: FormData) => Promise<number> = async (fd) => 1;', true],
+    ['export const publishDraft: (fd: FormData) => Promise<number> = async function (fd) { return 1; };', true],
+    ['export const publishDraft: ActionFn = async (fd) => 1;', true],
+    // A RETURN-type annotation on the arrow, which is at least as common as the
+    // declaration-side one and was silent until it had its own rows.
+    ['export const publishDraft = async (fd: FormData): Promise<number> => 1;', true],
+    ['export const publishDraft = async (fd): Promise<number> => 1;', true],
+    ['export const publishDraft = (fd: FormData): number => 1;', true],
+    ['export const publishDraft = async (fd: FormData): Promise<ActionResult<Draft>> => 1;', true],
+    // ...and the annotated NON-callable must still be silent.
+    ["export const publishDraft: string = (process.env.X || '/api/x');", false],
+    ["export const publishDraft: string = '/api/x';", false],
+    // An inline object type carries TypeScript's canonical `;` member
+    // separator INSIDE the annotation's brackets, and a generic can close
+    // immediately before the `=`. Both were read as end-of-declaration.
+    ['export const publishDraft: ActionFn<{ id: string; title: string }> = async (input) => 1;', true],
+    ['export const publishDraft: { (fd: FormData): Promise<number>; } = async (fd) => 1;', true],
+    ['export const publishDraft: Promise<void>= async () => 1;', true],
+    ["export const publishDraft: { a: string; b: string }['a'] = '/api/x';", false],
+  ];
+  for (const [body, shouldFire] of cases) {
+    const dir = await makeApp({
+      'modules/feedback/actions/publish.server.ts': `'use server';\n${body}\n`,
+      'app/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form method="get"><button formaction=\${publishDraft}>P</button></form>\`;
+`,
+    });
+    assert.equal(hits(await checkConventions(dir)).length, shouldFire ? 1 : 0,
+      `${shouldFire ? 'should fire' : 'should be silent'}: ${body.split('\n')[0]}`);
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('a re-export clause is unknowable, even beside a same-named local function', async () => {
+  // The guard has to reject on the text AFTER the clause: a `\\s*(?!from)`
+  // lookahead can never reject, because `\\s*` backtracks to zero width and the
+  // lookahead then reads the whitespace. Without it, a module that re-exports a
+  // name AND declares a same-named local is read as exporting that local, which
+  // contradicts the barrel-re-export silence the docs promise.
+  const dir = await makeApp({
+    'modules/feedback/actions/other.server.ts': `'use server';
+export async function publishDraft() { return 1; }
+`,
+    'modules/feedback/actions/publish.server.ts': `'use server';
+function publishDraft() { return 1; }
+export { publishDraft } from './other.server.ts';
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form method="get"><button formaction=\${publishDraft}>P</button></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a re-export needs another hop, so it stays silent');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('the binding resolver across a broad sweep of TypeScript spellings', async () => {
+  // Five review rounds each found one more spelling this resolver got wrong, so
+  // this sweeps the space instead of waiting to be told the next one. Every row
+  // is a way a real app might export an action, or a url constant.
+  const cases = [
+    // Callables that must FIRE.
+    ['export async function publishDraft(fd) {}', true],
+    ['export function publishDraft(fd) {}', true],
+    ['export async function publishDraft<T>(fd: T): Promise<void> {}', true],
+    ['export const publishDraft = async ({ id, title }: Input): Promise<void> => {};', true],
+    ['export const publishDraft = async (...args: unknown[]) => {};', true],
+    ['export const publishDraft = async (\n  fd: FormData,\n): Promise<void> => {};', true],
+    ['export const publishDraft = function publishDraft(fd) {};', true],
+    ['export let publishDraft = async (fd) => {};', true],
+    ['const publishDraft = async (fd) => {};\nexport { publishDraft };', true],
+    ['async function impl(fd) {}\nexport { impl as publishDraft };', true],
+    // BOTH separators, inside BOTH annotation positions. The previous sweep
+    // had neither, so it stayed green through a walk that broke on a comma or
+    // a `;` at any depth. `Promise<Record<string, string>>` is the fieldErrors
+    // shape the ActionResult envelope pushes authors toward.
+    ['export const publishDraft = async (fd): Promise<Record<string, string>> => ({});', true],
+    ['export const publishDraft = async (fd): Promise<ActionResult<Draft, Err>> => ({});', true],
+    ['export const publishDraft = async (fd): { ok: boolean; id: string } => ({});', true],
+    ['export const publishDraft = async (fd: Map<string, number>) => 1;', true],
+    // These pin the depth guard on `;` / `,` inside a return type. They do NOT
+    // pin the arrow step beside it: a mutant that breaks at any arrow answers
+    // true on these by accident, and no input distinguishes it, because
+    // reaching that walk needs a `(…)` group followed by `:`, which in
+    // expression position only ever precedes an arrow's return type.
+    ['export const publishDraft = async (fd): { a: () => void, b: string } => ({});', true],
+    ['export const publishDraft = async (fd): [() => void, string] => ({});', true],
+    // A GENERIC arrow, which never reached the parameter-list branch at all.
+    ['export const publishDraft = async <T>(fd: T): Promise<void> => {};', true],
+    ['export const publishDraft = <T,>(fd: T) => 1;', true],
+    // A generic CONSTRAINT containing its own arrow: without the arrow step in
+    // the type-parameter walk, that `>` closes the list early and the parameter
+    // branch is never reached. Nothing pinned this guard until this row.
+    ['export const publishDraft = <T extends (fd: FormData) => void>(fd: T) => 1;', true],
+    // `async` with no space before the type parameters, which is valid and was
+    // unreachable because the async skip required whitespace or a paren.
+    ['export const publishDraft = async<T>(fd: T) => 1;', true],
+    // A constraint carrying its own type ARGUMENTS. Without the depth condition
+    // on the type-parameter walk's `>`, the inner `>` closes the list early and
+    // the parameter branch is never reached. `Record<string, …>` is the shape
+    // the ActionResult envelope pushes authors toward.
+    ['export const publishDraft = <T extends Array<string>>(fd: T) => 1;', true],
+    ['export const publishDraft = async <T extends Record<string, unknown>>(fd: T) => 1;', true],
+    ['export const publishDraft = <A, B extends Map<A, string>>(fd: A) => 1;', true],
+    // A DEFAULT type parameter puts a bare `=` inside the annotation's
+    // brackets, which is the only thing keeping the depth condition on the
+    // assignment scan honest.
+    ['export const publishDraft: <T = FormData>(fd: T) => Promise<void> = async (fd) => 1;', true],
+    // Whitespace between the type-parameter list and the parameter list, which
+    // is what the trailing skip after that walk exists for.
+    ['export const publishDraft = <T> (fd: T) => 1;', true],
+    // Non-callables that must stay SILENT.
+    ["export const publishDraft = `/api/${'x'}`;", false],
+    ['export const publishDraft = 42;', false],
+    ["export const publishDraft = ['/a', '/b'].join('/');", false],
+  ];
+  for (const [body, shouldFire] of cases) {
+    const dir = await makeApp({
+      'modules/feedback/actions/publish.server.ts': `'use server';\n${body}\n`,
+      'app/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form method="get"><button formaction=\${publishDraft}>P</button></form>\`;
+`,
+    });
+    assert.equal(hits(await checkConventions(dir)).length, shouldFire ? 1 : 0,
+      `${shouldFire ? 'should fire' : 'should be silent'}: ${body.replace(/\n/g, ' ')}`);
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('silent on a url CONSTANT exported from a .server module', async () => {
+  // "Imported from a `.server` module" is not enough: a server module exports
+  // non-functions too, and the renderer binds only a FUNCTION. A url constant
+  // renders as an ordinary attribute, so reporting it is the same false positive
+  // wearing a different hat.
+  const dir = await makeApp({
+    'lib/urls.server.ts': "export const ARCHIVE_URL = '/api/items/archive';\n",
+    'app/items/page.ts': `import { html } from '@webjsdev/core';
+import { ARCHIVE_URL } from '#lib/urls.server.ts';
+export default () => html\`<form method="get"><button formaction=\${ARCHIVE_URL}>Archive</button></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a url constant is not an action binding');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent on an ambiguous factory-produced export', async () => {
+  // `export const go = cache(fn)` may well be callable, but it is not PROVABLY
+  // a function from the source, and an ambiguous export firing the rule is the
+  // false-positive direction.
+  const dir = await makeApp({
+    'modules/feedback/actions/factory.server.ts': `'use server';
+import { cache } from '@webjsdev/server';
+export const publishCached = cache(async () => ({ success: true }));
+`,
+    'app/items/page.ts': `import { html } from '@webjsdev/core';
+import { publishCached } from '#modules/feedback/actions/factory.server.ts';
+export default () => html\`<form method="get"><button formaction=\${publishCached}>P</button></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent on binding shapes the resolver cannot follow', async () => {
+  // Real bindings the rule now MISSES rather than misreports: a namespace
+  // import, a default import, and a non-identifier expression. Silence is the
+  // safe direction, and these are named in the rule's silence list.
+  const shapes = {
+    'namespace import': `import * as acts from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form method="get"><button formaction=\${acts.publishDraft}>P</button></form>\`;`,
+    'member expression': `import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+const bag = { publishDraft };
+export default () => html\`<form method="get"><button formaction=\${bag.publishDraft}>P</button></form>\`;`,
+  };
+  for (const [label, body] of Object.entries(shapes)) {
+    const dir = await makeApp({
+      'app/items/page.ts': `import { html } from '@webjsdev/core';\n${body}\n`,
+    });
+    assert.deepEqual(hits(await checkConventions(dir)), [], `${label} is unknowable, so silent`);
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('still fires when the hole IS an imported server action', async () => {
+  // The counterfactual for the filter above: narrowing to real bindings must not
+  // silence the shape the rule exists for.
+  const dir = await makeApp({
+    'app/items/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form><button formaction=\${publishDraft}>P</button></form>\`;
+`,
+  });
+  assert.equal(hits(await checkConventions(dir)).length, 1);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the tag has no call site anywhere in the app', async () => {
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<h1>hi</h1>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the submitter lives in a bare html helper, not the class body', async () => {
+  const dir = await makeApp({
+    'components/row-btn.ts': `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export const publishBtn = () => html\`<button formaction=\${publishDraft}>Publish</button>\`;
+class RowBtn extends WebComponent({}) {
+  render() { return html\`<span>row</span>\`; }
+}
+RowBtn.register('row-btn');
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a fragment inherits the caller scope');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the file registers two tags (ambiguous attribution)', async () => {
+  const dir = await makeApp({
+    'components/pair.ts': `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+class RowBtn extends WebComponent({}) {
+  render() { return html\`<button formaction=\${publishDraft}>Publish</button>\`; }
+}
+RowBtn.register('row-btn');
+class RowLabel extends WebComponent({}) {
+  render() { return html\`<span>label</span>\`; }
+}
+RowLabel.register('row-label');
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('flags the same-scan case with no cross-module step', async () => {
+  const dir = await makeApp({
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form><button formaction=\${publishDraft}>Publish</button></form>\`;
+`,
+  });
+  const v = hits(await checkConventions(dir));
+  assert.equal(v.length, 1);
+  assert.match(v[0].file, /page\.ts/);
+  // The same-scan case is a RENDER error, not the silent one, so it says so.
+  assert.match(v[0].message, /SAME template/);
+  assert.match(v[0].message, /refuses this shape outright/);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('the same-scan case is flagged even with method="post", because the renderer refuses it', async () => {
+  // Unlike the cross-module case, delivery is irrelevant here: the renderer
+  // sees both halves in one scan and throws, whatever the method.
+  const dir = await makeApp({
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form method="post"><button formaction=\${publishDraft}>P</button></form>\`;
+`,
+  });
+  const v = hits(await checkConventions(dir));
+  assert.equal(v.length, 1);
+  assert.match(v[0].message, /refuses this shape outright/);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('transitive: silent when the outer page binds the form', async () => {
+  const dir = await makeApp({
+    'components/todo-list.ts': TODO_LIST,
+    'components/todo-row.ts': TODO_ROW,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import { saveAll } from '#modules/feedback/actions/save.server.ts';
+export default () => html\`<form action=\${saveAll}><todo-list></todo-list></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('transitive: fires through an intermediate component when the outer form is unbound', async () => {
+  const dir = await makeApp({
+    'components/todo-list.ts': TODO_LIST,
+    'components/todo-row.ts': TODO_ROW,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><todo-list></todo-list></form>\`;
+`,
+  });
+  const v = hits(await checkConventions(dir));
+  assert.equal(v.length, 1, 'a one-level rule would go silent here');
+  assert.match(v[0].file, /todo-row\.ts/);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('a reference cycle is silent and does not hang', async () => {
+  const dir = await makeApp({
+    'components/a-one.ts': `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+class AOne extends WebComponent({}) {
+  render() { return html\`<b-two></b-two><button formaction=\${publishDraft}>Publish</button>\`; }
+}
+AOne.register('a-one');
+`,
+    'components/b-two.ts': `import { html, WebComponent } from '@webjsdev/core';
+class BTwo extends WebComponent({}) {
+  render() { return html\`<a-one></a-one>\`; }
+}
+BTwo.register('b-two');
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><a-one></a-one></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a cycle can never be a verdict');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('a docs page showing the shape as a code sample stays clean', async () => {
+  const dir = await makeApp({
+    'app/docs/page.ts': `import { html } from '@webjsdev/core';
+const sample = '<form><button formaction=\${del}>x</button></form>';
+export default () => html\`<pre><code>\${sample}</code></pre>
+  <p>Write &lt;form action=\${'$'}{save}&gt; around it.</p>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a string is never read as markup');
+  await rm(dir, { recursive: true, force: true });
+});
diff --git a/packages/server/test/routing/form-dispatch.test.js b/packages/server/test/routing/form-dispatch.test.js
index f48f20c88..c68f87c4d 100644
--- a/packages/server/test/routing/form-dispatch.test.js
+++ b/packages/server/test/routing/form-dispatch.test.js
@@ -30,6 +30,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { createRequestHandler } from '../../src/dev.js';
 import { hashFile } from '../../src/actions.js';
+import { resetFormReportDedupe } from '../../src/form-dispatch.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 // A tmpdir app fixture cannot resolve the bare `@webjsdev/core` specifier
@@ -1069,3 +1070,139 @@ export default ({ actionData }) => html\`<form action=\${updatePost}><p>\${actio
       'and it failed with a message written for a DIFFERENT action');
   } finally { console.warn = quiet; }
 });
+
+/**
+ * #1307 telemetry. Both fingerprints of a form that posts nowhere reach the
+ * `onError` sink with a code an app can group on, and neither changes the
+ * response: the GET keeps its 200 and the bind-nothing submission keeps its
+ * 405. Answering a GET differently because of a query parameter would hand any
+ * visitor a way to turn any page into an error.
+ */
+const READ_ONLY_APP = {
+  'app/info/page.ts': `import { html } from ${CORE};\nexport default () => html\`<p>read-only</p>\`;\n`,
+};
+
+test('#1307: a form body carrying no identity reports WEBJS_FORM_ACTION_MISSING', async () => {
+  resetFormReportDedupe();
+  const seen = [];
+  const app = await createRequestHandler({
+    appDir: makeApp(READ_ONLY_APP),
+    dev: false,
+    onError: (e) => seen.push(e),
+  });
+  await app.warmup();
+
+  const post = await app.handle(new Request('http://x/info', form({ email: 'a@b.c', note: 'secret text' })));
+  assert.equal(post.status, 405, 'the response is unchanged');
+
+  assert.equal(seen.length, 1, 'exactly one report');
+  assert.equal(seen[0].code, 'WEBJS_FORM_ACTION_MISSING');
+  assert.equal(seen[0].pathname, '/info');
+  assert.equal(seen[0].method, 'POST');
+  // Field NAMES identify WHICH form posted nowhere and are template constants.
+  assert.deepEqual(seen[0].fields, ['email', 'note']);
+  // Field VALUES are user data and must never ride the report.
+  assert.doesNotMatch(JSON.stringify(seen[0].fields) + seen[0].message, /secret text|a@b\.c/);
+});
+
+test('#1307: a page GET carrying __webjs_action still renders 200 and reports', async () => {
+  resetFormReportDedupe();
+  const seen = [];
+  const app = await createRequestHandler({
+    appDir: makeApp(READ_ONLY_APP),
+    dev: false,
+    onError: (e) => seen.push(e),
+  });
+  await app.warmup();
+
+  const resp = await app.handle(new Request('http://x/info?__webjs_action=abc%2FdoThing'));
+  assert.equal(resp.status, 200, 'detect only: the page still renders');
+  assert.match(await resp.text(), /read-only/);
+
+  assert.equal(seen.length, 1);
+  assert.equal(seen[0].code, 'WEBJS_FORM_SUBMITTED_AS_GET');
+  assert.equal(seen[0].pathname, '/info');
+
+  // Deduplicated per process on method + pathname: either fingerprint is
+  // reachable by an unauthenticated attacker, so an unbounded report would be a
+  // free amplifier into a paid APM sink.
+  await app.handle(new Request('http://x/info?__webjs_action=abc%2FdoThing'));
+  await app.handle(new Request('http://x/info?__webjs_action=other'));
+  assert.equal(seen.length, 1, 'a flood of crafted requests produces one report');
+});
+
+test('#1307: crafted requests to a dynamic route cannot exhaust the dedupe', async () => {
+  // The dedupe key is the matched ROUTE, not the request pathname. Keyed on the
+  // pathname a dynamic route yields unbounded distinct keys, so a few hundred
+  // crafted urls would fill the 256-entry cap and permanently silence BOTH
+  // diagnostics for the process, which is worse than the amplification the cap
+  // exists to stop.
+  resetFormReportDedupe();
+  const seen = [];
+  const app = await createRequestHandler({
+    appDir: makeApp({
+      'app/blog/[slug]/page.ts': `import { html } from ${CORE};\nexport default () => html\`<p>post</p>\`;\n`,
+      'app/info/page.ts': `import { html } from ${CORE};\nexport default () => html\`<p>read-only</p>\`;\n`,
+    }),
+    dev: false,
+    onError: (e) => seen.push(e),
+  });
+  await app.warmup();
+
+  for (let i = 0; i < 400; i++) {
+    const r = await app.handle(new Request(`http://x/blog/post-${i}?__webjs_action=x`));
+    assert.equal(r.status, 200);
+  }
+  assert.equal(seen.length, 1, '400 distinct paths on ONE route are one report');
+
+  // And the flood did not consume the budget for a different route.
+  await app.handle(new Request('http://x/info?__webjs_action=x'));
+  assert.equal(seen.length, 2, 'a genuinely different route still reports');
+
+  // Nor for the OTHER signal, which has its own key space.
+  const post = await app.handle(new Request('http://x/info', form({ a: '1' })));
+  assert.equal(post.status, 405);
+  assert.equal(seen.filter((e) => e.code === 'WEBJS_FORM_ACTION_MISSING').length, 1,
+    'one signal can never silence the other');
+});
+
+test('#1307: no onError and not dev spends no dedupe slot', async () => {
+  // A slot consumed with nothing to report would let a sink-less run quietly
+  // eat the cap for one that has a sink.
+  resetFormReportDedupe();
+  // The SAME app dir for both handlers, so the route key is identical and the
+  // assertion is discriminating: two different dirs would produce two different
+  // keys and the test would pass even if the slot HAD been spent.
+  const appDir = makeApp(READ_ONLY_APP);
+  const silent = await createRequestHandler({ appDir, dev: false });
+  await silent.warmup();
+  assert.equal((await silent.handle(new Request('http://x/info?__webjs_action=x'))).status, 200);
+
+  const seen = [];
+  const app = await createRequestHandler({ appDir, dev: false, onError: (e) => seen.push(e) });
+  await app.warmup();
+  await app.handle(new Request('http://x/info?__webjs_action=x'));
+  assert.equal(seen.length, 1, 'the slot was still free');
+});
+
+test('#1307: an ordinary page GET and a non-form POST report nothing', async () => {
+  resetFormReportDedupe();
+  const seen = [];
+  const app = await createRequestHandler({
+    appDir: makeApp(READ_ONLY_APP),
+    dev: false,
+    onError: (e) => seen.push(e),
+  });
+  await app.warmup();
+
+  assert.equal((await app.handle(new Request('http://x/info'))).status, 200);
+  // The 405 answered before the body is read: a stray JSON POST or a probe is
+  // not an app bug, and it is the cheapest thing on the file to flood.
+  const probe = await app.handle(new Request('http://x/info', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: '{}',
+  }));
+  assert.equal(probe.status, 405);
+  assert.deepEqual(seen, []);
+});
diff --git a/packages/server/test/scanner/html-form-scopes.test.js b/packages/server/test/scanner/html-form-scopes.test.js
new file mode 100644
index 000000000..95b77d3c6
--- /dev/null
+++ b/packages/server/test/scanner/html-form-scopes.test.js
@@ -0,0 +1,329 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+import {
+  scanHtmlFormScopes,
+  classifyActionHole,
+  matchClosingBrace,
+  extractWebComponentClassBodies,
+  redactStringsAndTemplates,
+} from '../../src/js-scan.js';
+import { PARSEABLE_ENCTYPES } from '../../../core/src/form-action.js';
+import { readFile } from 'node:fs/promises';
+
+/**
+ * Unit tests for the lexical half of `submitter-needs-bound-form` (#1307):
+ * the whole-app rule in `check.js` is only as good as the scan under it, and
+ * the shapes it must NOT read as markup (a plain string, a `css` template, an
+ * HTML comment) are what keep the rule from firing on a docs page.
+ */
+
+test('a submitter reports the scope of its enclosing form', () => {
+  assert.deepEqual(
+    scanHtmlFormScopes('html`<form action=${save}><button formaction=${del}>x</button></form>`').submitters,
+    [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }],
+  );
+  assert.deepEqual(
+    scanHtmlFormScopes('html`<form><button formaction=${del}>x</button></form>`').submitters,
+    [{ tag: 'button', scope: 'unbound', delivers: false, expr: 'del' }],
+  );
+  assert.deepEqual(
+    scanHtmlFormScopes('html`<button formaction=${del}>x</button>`').submitters,
+    [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }],
+  );
+});
+
+test('a nested template inherits the enclosing form scope', () => {
+  // What the renderer does: `render` threads `formScope` through arrays,
+  // `repeat`, and nested templates, so a per-row button in a bound form is
+  // bound.
+  const bound = 'html`<form action=${save}>${rows.map((r) => html`<button formaction=${del}>x</button>`)}</form>`';
+  assert.deepEqual(scanHtmlFormScopes(bound).submitters, [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }]);
+  const unbound = 'html`<form>${rows.map((r) => html`<button formaction=${del}>x</button>`)}</form>`';
+  assert.deepEqual(scanHtmlFormScopes(unbound).submitters, [{ tag: 'button', scope: 'unbound', delivers: false, expr: 'del' }]);
+});
+
+test('the scope closes at </form> and does not leak forward', () => {
+  const src = 'html`<form action=${save}></form><button formaction=${del}>x</button>`';
+  assert.deepEqual(scanHtmlFormScopes(src).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
+});
+
+test('a start tag split across holes is still one tag', () => {
+  const src = 'html`<form action=${save} class="a"><button class=${c} formaction=${del}>x</button></form>`';
+  assert.deepEqual(scanHtmlFormScopes(src).submitters, [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }]);
+});
+
+test('a `>` inside a quoted attribute value does not close the tag', () => {
+  const src = 'html`<form action=${save}><div title="a>b"></div><button formaction=${del}>x</button></form>`';
+  assert.deepEqual(scanHtmlFormScopes(src).submitters, [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }]);
+});
+
+test('a custom-element start tag is reported, its close tag is not', () => {
+  assert.deepEqual(
+    scanHtmlFormScopes('html`<form action=${save}><row-btn></row-btn></form>`').tagUses,
+    [{ tag: 'row-btn', scope: 'bound', delivers: null, expr: null }],
+  );
+  assert.deepEqual(
+    scanHtmlFormScopes('html`<form><row-btn></row-btn></form>`').tagUses,
+    [{ tag: 'row-btn', scope: 'unbound', delivers: false, expr: null }],
+  );
+});
+
+test('only an html-tagged literal is read as markup', () => {
+  // The carve-out the whole rule rests on: the framework's own website renders
+  // `<form action=${fn}>` as a code SAMPLE.
+  assert.deepEqual(scanHtmlFormScopes("const s = '<form><button formaction=x></button></form>';").submitters, []);
+  assert.deepEqual(scanHtmlFormScopes('css`.a { }` + html`<row-btn></row-btn>`').tagUses, [{ tag: 'row-btn', scope: 'none', delivers: null, expr: null }]);
+  // A form written inside a plain string cannot open a scope for real markup.
+  const mixed = "const s = '<form>'; export default () => html`<button formaction=${del}>x</button>`;";
+  assert.deepEqual(scanHtmlFormScopes(mixed).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
+});
+
+test('an HTML comment is not markup', () => {
+  const src = 'html`<!-- <form> --><button formaction=${del}>x</button>`';
+  assert.deepEqual(scanHtmlFormScopes(src).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
+});
+
+test('classifyActionHole matches the tag and the attribute as a pair', () => {
+  assert.equal(classifyActionHole('<form action='), 'form');
+  assert.equal(classifyActionHole('<button formaction='), 'submitter');
+  assert.equal(classifyActionHole('<input formaction='), 'submitter');
+  assert.equal(classifyActionHole('<div action='), null, 'a div binds nothing');
+  assert.equal(classifyActionHole('<form formaction='), null, 'wrong attribute for the tag');
+  assert.equal(classifyActionHole('<button action='), null, 'wrong attribute for the tag');
+  assert.equal(classifyActionHole('<form action=x><span>'), null, 'the tag already closed');
+  assert.equal(classifyActionHole('plain text'), null);
+});
+
+test('matchClosingBrace walks past a template hole (#1307)', () => {
+  // A hole is a CODE context nested in a template, not a brace in the block
+  // being matched. Counting it toward the outer depth (the earlier behaviour)
+  // meant depth could never return to zero.
+  const s = '{ return html`<b>${x}</b>`; }';
+  assert.equal(matchClosingBrace(s, 1), s.length - 1);
+  const nested = '{ a(html`${ b(html`${c}`) }`); }';
+  assert.equal(matchClosingBrace(nested, 1), nested.length - 1);
+  // Still returns -1 when there really is no match.
+  assert.equal(matchClosingBrace('{ a(', 1), -1);
+});
+
+test('a class body holding a template hole is extractable from RAW source', () => {
+  // Every other caller passes a masked source in which holes are blanked, so
+  // this path was the one that exposed the brace bug.
+  const src = [
+    'class RowBtn extends WebComponent({}) {',
+    '  render() { return html`<button formaction=${del}>x</button>`; }',
+    '}',
+  ].join('\n');
+  const bodies = extractWebComponentClassBodies(src);
+  assert.equal(bodies.length, 1);
+  assert.match(bodies[0].body, /formaction=\$\{del\}/);
+  assert.deepEqual(scanHtmlFormScopes(bodies[0].body).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
+});
+
+test('an unbound form reports whether it would still DELIVER the identity', () => {
+  // This is the bit that decides broken from working, and it is not boundness.
+  // A submitter's identity rides its OWN name/value pair, so an unbound form
+  // that still sends a parseable POST body delivers it and the action runs.
+  const sub = (formTag) => scanHtmlFormScopes(
+    'html`' + formTag + '<button formaction=${del}>x</button></form>`',
+  ).submitters[0];
+
+  assert.equal(sub('<form method="post">').delivers, true, 'a POST body carries the pair');
+  assert.equal(sub('<form method="POST">').delivers, true, 'the keyword folds case');
+  assert.equal(sub('<form method="post" enctype="multipart/form-data">').delivers, true);
+  assert.equal(sub('<form>').delivers, false, 'no method is a GET');
+  assert.equal(sub('<form method="get">').delivers, false);
+  // `method` is an enumerated attribute matched against exact keywords with no
+  // whitespace stripping, so a padded value falls to the GET default.
+  assert.equal(sub('<form method=" post ">').delivers, false);
+  assert.equal(sub('<form method="post" enctype="text/plain">').delivers, false, 'the server cannot parse it');
+  // `enctype` is an enumerated attribute whose missing AND invalid value default
+  // are both application/x-www-form-urlencoded, so an unrecognised value falls
+  // back to a parseable body. Treating it as unparseable reported a working form
+  // as broken, which is the one thing this rule must never do.
+  assert.equal(sub('<form method="post" enctype="nonsense">').delivers, true, 'an invalid enctype falls back to urlencoded');
+  assert.equal(sub('<form method="post" enctype=" text/plain ">').delivers, true, 'padded, so invalid, so urlencoded');
+  assert.equal(sub('<form method="post" enctype="TEXT/PLAIN">').delivers, false, 'the keyword folds case');
+  // A hole anywhere else in the start tag makes the answer dynamic.
+  assert.equal(sub('<form method=${m}>').delivers, null);
+  assert.equal(sub('<form enctype=${e} method="post">').delivers, null);
+});
+
+test('opensForm reports whether the source opens any form at all', () => {
+  assert.equal(scanHtmlFormScopes('html`<button formaction=${d}>x</button>`').opensForm, false);
+  assert.equal(scanHtmlFormScopes('html`<form action=${s}></form>`').opensForm, true);
+  // A form written only inside a plain string is not a form.
+  assert.equal(scanHtmlFormScopes("const s = '<form>';").opensForm, false);
+});
+
+test('class-body offsets index the RAW source identically to the mask', () => {
+  // How the rule gets a body with its templates intact without asking the brace
+  // matcher to lex raw source: locate in the position-preserving mask, slice
+  // from `content`. A regex literal holding a brace is the case that broke when
+  // raw source was passed directly.
+  const src = [
+    'class RowBtn extends WebComponent({}) {',
+    '  static re = /[{]/;',
+    '  render() { return html`<button formaction=${del}>x</button>`; }',
+    '}',
+  ].join('\n');
+  const masked = redactStringsAndTemplates(src);
+  assert.equal(masked.length, src.length, 'the mask is position-preserving');
+  const bodies = extractWebComponentClassBodies(masked);
+  assert.equal(bodies.length, 1, 'the masked view blanks the regex body, so the braces balance');
+  const body = src.slice(bodies[0].bodyStart, bodies[0].bodyEnd);
+  assert.match(body, /formaction=\$\{del\}/, 'the raw slice keeps the template intact');
+  assert.deepEqual(scanHtmlFormScopes(body).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
+});
+
+test('a template in an ordinary START-TAG hole is handed off, not inherited', () => {
+  // A hole inside a start tag is an attribute or property VALUE whose placement
+  // this scan cannot speak for: SSR never renders it in place (a serializable
+  // value applies at hydration, a function-carrying one is dropped outright), so
+  // the receiving element decides where it lands in the browser. Scoring it by
+  // lexical nesting reported a shape the renderer treats as cannot-tell (and
+  // therefore binds) as a conclusive 'unbound'. `<webjs-suspense .fallback>` is
+  // the one exception and has its own test below.
+  const passed = 'html`<form method="post"><my-thing .tpl=${html`<button formaction=${del}>x</button>`}></my-thing></form>`';
+  // 'handed', NOT 'none'. Both mean "no enclosing form in this scan", but only
+  // 'none' is a cannot-tell the caller may attribute to this file's own
+  // component. A handed-off template belongs to whichever element received it,
+  // so collapsing the two resolves it through the wrong call sites.
+  assert.deepEqual(scanHtmlFormScopes(passed).submitters, [{ tag: 'button', scope: 'handed', delivers: null, expr: 'del' }]);
+  // A hyphenated tag inside a property hole is placed by the receiving element
+  // too, so it is not this file's call site either.
+  const tagPassed = 'html`<my-shell .rows=${html`<todo-row></todo-row>`}></my-shell>`';
+  assert.deepEqual(scanHtmlFormScopes(tagPassed).tagUses.filter((u) => u.tag === 'todo-row'),
+    [{ tag: 'todo-row', scope: 'handed', delivers: null, expr: null }]);
+  // A form the handed-off template opens ITSELF is still its own scope.
+  const ownForm = 'html`<my-thing .tpl=${html`<form action=${s}><button formaction=${del}>x</button></form>`}></my-thing>`';
+  assert.deepEqual(scanHtmlFormScopes(ownForm).submitters, [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }]);
+  // A hole in CHILD position IS rendered inline by this scan, so it still
+  // inherits. This is the pair that keeps the fix from being a blanket opt-out.
+  const child = 'html`<form method="post">${html`<button formaction=${del}>x</button>`}</form>`';
+  assert.deepEqual(scanHtmlFormScopes(child).submitters, [{ tag: 'button', scope: 'unbound', delivers: true, expr: 'del' }]);
+});
+
+test('the unparseable-enctype constant tracks the renderer\'s own set', async () => {
+  // The scanner states its enctype rule as a DENYLIST of one because of the
+  // invalid-value default, while the renderer refuses the wider allowlist. This
+  // pins the relationship rather than asserting the two are equal, so a change
+  // to core's set surfaces here instead of drifting silently.
+  assert.ok(!PARSEABLE_ENCTYPES.has('text/plain'), 'the renderer cannot parse text/plain either');
+  for (const e of PARSEABLE_ENCTYPES) {
+    const src = `html\`<form method="post" enctype="${e}"><button formaction=\${d}>x</button></form>\``;
+    assert.equal(scanHtmlFormScopes(src).submitters[0].delivers, true, `${e} delivers`);
+  }
+  assert.deepEqual([...PARSEABLE_ENCTYPES].sort(),
+    ['application/x-www-form-urlencoded', 'multipart/form-data'],
+    'if core gains an enctype, revisit the scanner denylist');
+
+  // There are now THREE hardcoded copies of the denylist keyword: the scanner's
+  // `UNPARSEABLE_FORM_ENCTYPE`, the client guard in `router-client.js`, and this
+  // test. Pin the client one too, so the two halves of the feature cannot drift
+  // into disagreeing on the same input (which is what the allowlist did).
+  const clientSrc = await readFile(new URL('../../../core/src/router-client.js', import.meta.url), 'utf8');
+  assert.match(clientSrc, /enctype\.toLowerCase\(\) === 'text\/plain'/,
+    'the client guard uses the same one-keyword denylist, not the renderer allowlist');
+  assert.doesNotMatch(clientSrc, /PARSEABLE_ENCTYPES/,
+    'and does not reach for the renderer allowlist again');
+});
+
+test('the start-tag-hole rule matches what the RENDERER actually does', async () => {
+  // A differential rather than an assertion about the scanner alone, because the
+  // whole 'handed' state is a claim about the renderer's behaviour. Most
+  // start-tag holes are values the receiving element places, but
+  // `<webjs-suspense .fallback=${…}>` is rendered INLINE with the enclosing form
+  // scope (#471: a custom-element property applies at hydration, too late for a
+  // placeholder that must be in the first flushed bytes). Treating that one as
+  // handed off would blind the same-scan half to a real render-time throw.
+  const { html } = await import('../../../core/src/html.js');
+  const { renderToString } = await import('../../../core/src/render-server.js');
+  const { setFormActionResolver } = await import('../../../core/src/form-action.js');
+  setFormActionResolver(async () => 'abc1234567/publish');
+  const publish = async () => ({ success: true });
+
+  // Rendered inline, so the renderer judges it against the unbound form and
+  // throws. The scanner must see the same thing.
+  const fallbackSrc = 'html`<form><webjs-suspense .fallback=${html`<button formaction=${p}>x</button>`}></webjs-suspense></form>`';
+  assert.deepEqual(scanHtmlFormScopes(fallbackSrc).submitters,
+    [{ tag: 'button', scope: 'unbound', delivers: false, expr: 'p' }]);
+  await assert.rejects(
+    () => renderToString(
+      html`<form><webjs-suspense .fallback=${html`<button formaction=${publish}>x</button>`}></webjs-suspense></form>`,
+      { ssr: true },
+    ),
+    /requires the enclosing <form> to also be bound/,
+    'the renderer really does refuse it, so the scanner must not be silent',
+  );
+
+  // The negative half, and it has to assert the MECHANISM rather than "it did
+  // not throw". A template carrying a function cannot serialize, so SSR drops
+  // the whole property binding and emits nothing for it: the submitter is never
+  // rendered and never judged here at all. Asserting only that the render
+  // succeeded would stay green for ANY scanner verdict, which is precisely the
+  // non-discriminating test this differential exists to avoid.
+  const propSrc = 'html`<form><my-thing .tpl=${html`<button formaction=${p}>x</button>`}></my-thing></form>`';
+  assert.deepEqual(scanHtmlFormScopes(propSrc).submitters,
+    [{ tag: 'button', scope: 'handed', delivers: null, expr: 'p' }]);
+  const warns = [];
+  const quiet = console.warn;
+  console.warn = (...a) => warns.push(a.join(' '));
+  let out;
+  try {
+    out = await renderToString(
+      html`<form><my-thing .tpl=${html`<button formaction=${publish}>x</button>`}></my-thing></form>`,
+      { ssr: true },
+    );
+  } finally { console.warn = quiet; }
+  assert.doesNotMatch(out, /<button/, 'SSR emits nothing for the dropped property');
+  assert.ok(warns.some((w) => /unserializable value during SSR/.test(w)),
+    'and it says so, which is the proof SSR never judged this submitter');
+
+  // The tag half of the same carve-out. A hyphenated tag in a fallback IS a real
+  // call site (rendered inline, inside the enclosing form); one in an ordinary
+  // property hole is not.
+  const fbTag = 'html`<form><webjs-suspense .fallback=${html`<todo-row></todo-row>`}></webjs-suspense></form>`';
+  assert.deepEqual(scanHtmlFormScopes(fbTag).tagUses.filter((u) => u.tag === 'todo-row'),
+    [{ tag: 'todo-row', scope: 'unbound', delivers: false, expr: null }]);
+  const propTag = 'html`<form><my-shell .rows=${html`<todo-row></todo-row>`}></my-shell></form>`';
+  assert.deepEqual(scanHtmlFormScopes(propTag).tagUses.filter((u) => u.tag === 'todo-row'),
+    [{ tag: 'todo-row', scope: 'handed', delivers: null, expr: null }]);
+});
+
+test('the enctype divergence from the renderer is deliberate, on both sides', async () => {
+  // The scanner uses a one-keyword denylist and the renderer an allowlist, and
+  // it would be easy to "unify" them later. This pins WHY they differ, so that
+  // change breaks a test carrying its own reason.
+  //
+  // They ask different questions. This rule asks whether the identity ARRIVES,
+  // and an invalid enctype falls back to urlencoded, so it does. The renderer
+  // asks whether the form does what the author wrote, and an invalid value is
+  // the dangerous case: a typo'd `multipart/form-dat` falls back to urlencoded
+  // and silently drops every FILE from the submission.
+  const { html } = await import('../../../core/src/html.js');
+  const { renderToString } = await import('../../../core/src/render-server.js');
+  const { setFormActionResolver } = await import('../../../core/src/form-action.js');
+  setFormActionResolver(async () => 'abc1234567/save');
+  const save = async () => ({ success: true });
+
+  const sub = (formTag) => scanHtmlFormScopes(
+    'html`' + formTag + '<button formaction=${del}>x</button></form>`',
+  ).submitters[0];
+
+  // The scanner: an invalid enctype still delivers, so it is not a defect.
+  assert.equal(sub('<form method="post" enctype="multipart/form-dat">').delivers, true);
+  // The renderer: the same typo throws, because it would cost the author their
+  // file upload with no other signal.
+  await assert.rejects(
+    () => renderToString(html`<form action=${save} enctype=${'multipart/form-dat'}></form>`, { ssr: true }),
+    /cannot work|enctype/i,
+  );
+  // And both agree that text/plain is broken.
+  assert.equal(sub('<form method="post" enctype="text/plain">').delivers, false);
+  await assert.rejects(
+    () => renderToString(html`<form action=${save} enctype=${'text/plain'}></form>`, { ssr: true }),
+    /cannot work|enctype/i,
+  );
+});
diff --git a/test/bun/form-action-dispatch.mjs b/test/bun/form-action-dispatch.mjs
index 408d3e4e9..fbcb3dd87 100644
--- a/test/bun/form-action-dispatch.mjs
+++ b/test/bun/form-action-dispatch.mjs
@@ -28,6 +28,7 @@ import { join, dirname, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
 import { createRequestHandler } from '../../packages/server/src/dev.js';
+import { resetFormReportDedupe } from '../../packages/server/src/form-dispatch.js';
 
 const runtime = process.versions.bun ? `bun ${process.versions.bun}` : `node ${process.versions.node}`;
 const CORE = JSON.stringify(pathToFileURL(resolve('packages/core/index.js')).toString());
@@ -154,5 +155,45 @@ function urlencoded(fields) {
   assert.equal(res.status, 405, `[${runtime}] a submission with no identity is a 405`);
 }
 
+// #1307: both fingerprints of a form that posts nowhere reach the `onError`
+// sink with a groupable code, and neither changes the response. Cross-runtime
+// by construction: the code paths are `url.searchParams.has()`,
+// `formData.keys()`, and `Error` property assignment, all of which Node and Bun
+// implement separately.
+{
+  resetFormReportDedupe();
+  /** @type {any[]} */
+  const seen = [];
+  const reporting = await createRequestHandler({
+    appDir: dir, dev: false, onError: (e) => seen.push(e),
+  });
+  await reporting.warmup();
+
+  // A page GET carrying the reserved field in the QUERY STRING: the fingerprint
+  // of a bound submitter submitted through an UNBOUND form.
+  const got = await reporting.handle(new Request(`http://x/signup?${FIELD}=abc123%2Fsignup`));
+  assert.equal(got.status, 200, `[${runtime}] the GET still renders (detect only)`);
+  assert.equal(seen.length, 1, `[${runtime}] the query-string GET is reported once`);
+  assert.equal(seen[0].code, 'WEBJS_FORM_SUBMITTED_AS_GET', `[${runtime}] with a groupable code`);
+
+  // Deduplicated per process on method + pathname, so a crafted flood cannot
+  // amplify into a paid APM sink.
+  await reporting.handle(new Request(`http://x/signup?${FIELD}=abc123%2Fsignup`));
+  assert.equal(seen.length, 1, `[${runtime}] a second identical request adds no report`);
+
+  // A submission carrying no identity: still a 405, now with a report naming
+  // the submitted field NAMES and none of the values.
+  const missing = await reporting.handle(new Request('http://x/signup', {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded', origin: 'http://x' },
+    body: new URLSearchParams({ email: 'a@b.com' }).toString(),
+  }));
+  assert.equal(missing.status, 405, `[${runtime}] the 405 is unchanged`);
+  const bodyless = seen.find((e) => e.code === 'WEBJS_FORM_ACTION_MISSING');
+  assert.ok(bodyless, `[${runtime}] the bind-nothing 405 is reported`);
+  assert.deepEqual(bodyless.fields, ['email'], `[${runtime}] field names ride, values do not`);
+  assert.ok(!JSON.stringify(bodyless.fields).includes('a@b.com'), `[${runtime}] no user data`);
+}
+
 rmSync(dir, { recursive: true, force: true });
-console.log(`[form-action-dispatch] #1155 dispatch OK on ${runtime} (identity ${id})`);
+console.log(`[form-action-dispatch] #1155 dispatch + #1307 reporting OK on ${runtime} (identity ${id})`);
diff --git a/test/e2e/e2e.test.mjs b/test/e2e/e2e.test.mjs
index 1ba141386..40fbf3a2c 100644
--- a/test/e2e/e2e.test.mjs
+++ b/test/e2e/e2e.test.mjs
@@ -3426,6 +3426,45 @@ describe('E2E: form actions (no-JS + enhanced)', { skip: !process.env.WEBJS_E2E
     } finally { await p.close(); }
   });
 
+  test('JS DISABLED: a component-rendered submitter still carries its identity (#1307)', async () => {
+    // `/feedback/triage-split` is the CANNOT-TELL shape: the form is bound in
+    // the page and the submitter is bound one module over, inside a component
+    // that renders in its own pass with no view of the host page. SSR cannot
+    // resolve boundness there, so it binds on faith.
+    //
+    // This is the counterfactual for that decision. If the fallback were ever
+    // made to refuse, the component would render EMPTY (an SSR component error
+    // is isolated) and the button would not be in the DOM at all, so both
+    // assertions here would fail on a page that still returned 200.
+    const p = await paBrowser.newPage();
+    await p.setJavaScriptEnabled(false);
+    try {
+      await p.goto(`${paBase}/feedback/triage-split`, { waitUntil: 'domcontentloaded', timeout: 10000 });
+      const shape = await p.evaluate(() => {
+        const publish = document.getElementById('publish');
+        return {
+          present: !!publish,
+          name: publish?.getAttribute('name') || null,
+          value: publish?.getAttribute('value') || null,
+          hasFormAction: publish ? publish.hasAttribute('formaction') : null,
+        };
+      });
+      assert.ok(shape.present, 'the component-rendered submitter must be in the served markup');
+      assert.equal(shape.name, '__webjs_action', 'the cannot-tell fallback binds, so the identity is emitted');
+      assert.ok(/^[0-9a-f]{10}\/publishDraft$/.test(shape.value || ''),
+        `the submitter value must name publishDraft, got ${shape.value}`);
+      assert.equal(shape.hasFormAction, false, 'no formaction url is emitted, so it posts to this page');
+
+      await p.type('#note', 'ship it');
+      await Promise.all([
+        p.waitForNavigation({ waitUntil: 'domcontentloaded', timeout: 10000 }),
+        p.click('#publish'),
+      ]);
+      const ran = await p.evaluate(() => document.getElementById('ran')?.textContent || '');
+      assert.equal(ran, 'publishDraft', `the component's action must run with JS off, got "${ran}"`);
+    } finally { await p.close(); }
+  });
+
   test('JS DISABLED: a failing submitter action re-renders THIS page at 422', async () => {
     // The per-button path has to reach the same 422 re-render as the form-level
     // one, or a validation failure on a submitter action would lose the page.
diff --git a/website/app/docs/deployment/page.ts b/website/app/docs/deployment/page.ts
index 5fd3233da..1074c69a0 100644
--- a/website/app/docs/deployment/page.ts
+++ b/website/app/docs/deployment/page.ts
@@ -199,6 +199,8 @@ const app = await createRequestHandler({
 });</code-block>
     <p><strong>The contract is best-effort.</strong> A throwing <code>onError</code> is caught and ignored so it can never crash the response, and the hook is purely additive: webjs's existing behavior (the sanitized 500, with only <code>error.message</code> in prod and never the stack) is unchanged. The hook fires BEFORE the sanitized response is sent, so the sink always sees the real error.</p>
 
+    <p><strong>Two framework diagnostics ride the same hook</strong>, and neither is a request failure, so both carry an <code>err.code</code> you can group or filter on. <code>WEBJS_FORM_SUBMITTED_AS_GET</code> fires on a page GET carrying the reserved <code>__webjs_action</code> field in its query string, which only a bound submitter inside an UNBOUND form can produce; it is the one form-binding mistake that reaches production silently, because the page still renders a 200. <code>WEBJS_FORM_ACTION_MISSING</code> fires when a parseable form body carries no identity at all, the case answered with a 405. (An <code>enctype="text/plain"</code> submission is answered before its body is read, so that one stays a bare 405.) Both are detect-only, so neither changes the status; each carries <code>method</code> and <code>pathname</code>, plus the submitted field NAMES for the second (template constants that identify WHICH form posted nowhere, never the values, which are user data); and each is deduplicated per process on the code, the method, and the matched ROUTE (not the request pathname, so crafted urls on a dynamic route cannot exhaust the 256-entry cap and silence the diagnostics), because both are reachable by an unauthenticated request and an uncapped report would be a free amplifier into a paid sink. In dev the same two detections also log a warning, which is what makes the no-JS write path visible without an APM wired. See <a href="/docs/troubleshooting">Troubleshooting</a>.</p>
+
     <h3>Build-info endpoint</h3>
     <p><code>GET /__webjs/version</code> returns JSON describing the live build, alongside the health and readiness probes. A deploy can curl it to confirm which build is serving. It carries no secrets, and it is answered before the analysis warms (like the other probes), so it responds on a cold instance.</p>
     <code-block>GET /__webjs/version
diff --git a/website/app/docs/progressive-enhancement/page.ts b/website/app/docs/progressive-enhancement/page.ts
index fcd321d6d..cbab54f1a 100644
--- a/website/app/docs/progressive-enhancement/page.ts
+++ b/website/app/docs/progressive-enhancement/page.ts
@@ -169,7 +169,11 @@ export default function NewPost({ actionData }: {
     </p>
 
     <p>
-      A form that binds nothing gets a <code>405</code>: there is no page <code>action</code> export to catch a bare <code>&lt;form method="post"&gt;</code>. Multi-submitter forms can bind per-button actions using <code>formaction=\${action}</code> on submitter buttons inside a bound form, which work with JavaScript disabled via standard DOM submitter precedence.
+      A form that binds nothing gets a <code>405</code>: there is no page <code>action</code> export to catch a bare <code>&lt;form method="post"&gt;</code>. The quieter half of that is worth knowing too. A form with no <code>method</code> at all submits as a GET, so there is no body and no 405; the page simply re-renders with a 200. Multi-submitter forms can bind per-button actions using <code>formaction=\${action}</code> on submitter buttons inside a bound form, which work with JavaScript disabled via standard DOM submitter precedence.
+    </p>
+
+    <p>
+      <strong>A per-button action needs its enclosing form bound.</strong> <code>method="post"</code> and the enctype are supplied on the form's start tag, which is already emitted by the time the renderer reaches the button, so a submitter cannot retrofit them. An unbound host form the renderer can see is refused at render. One it CANNOT see is not: a submitter inside a component is a cannot-tell, because the component renders its own template in a separate pass with no view of the host page, and cannot-tell has to bind (refusing there would drop the component from a page that still returned 200). So a <code>formaction=\${action}</code> button in a component inside an unbound form ships. If that form still declares <code>method="post"</code> it works, because the identity rides the button's own <code>name</code>/<code>value</code> pair into the body; if it declares no method it submits as a GET, puts the reserved identity in the query string, and the action never runs. Run <code>webjs check</code>: the <code>submitter-needs-bound-form</code> rule reads every template in the app at once, so it resolves the enclosing form across modules and flags this at edit time.
     </p>
 
     <p>
diff --git a/website/app/docs/server-actions/page.ts b/website/app/docs/server-actions/page.ts
index ab320a5b0..7c3a24537 100644
--- a/website/app/docs/server-actions/page.ts
+++ b/website/app/docs/server-actions/page.ts
@@ -474,6 +474,8 @@ export default function NewPost({ actionData }: {
     <p>Everything the action declares applies here too, or an action would be protected over RPC and open over a form: <code>validate</code> runs on the submitted <code>FormData</code>, the <code>middleware</code> chain runs (with the page's <code>params</code> / <code>searchParams</code> / <code>url</code> on <code>ctx</code>), and <code>invalidates</code> is evicted when the action actually ran. The submission is Origin-verified exactly like an RPC call, so a no-JS form needs no CSRF token field. An action declaring <code>method = 'GET'</code> cannot be bound to a form (it rides its arguments in the URL and skips the CSRF check), which is a <code>405</code> at runtime and the <code>form-action-not-a-get-action</code> error in <code>webjs check</code>. A streamed return is refused on this path: a submission is answered with a redirect or a page, and with JS off there is no consumer for frames.</p>
     <p><strong>A form whose buttons run different actions binds each one on its submitter</strong>, with the same unquoted spelling one level down: <code>&lt;form action=\${saveDraft}&gt;…&lt;button formaction=\${publishPost}&gt;Publish&lt;/button&gt;&lt;/form&gt;</code>. The identity rides the pressed button's own <code>name</code>/<code>value</code> pair, which a browser submits for that button alone, so no <code>formaction</code> url is emitted and the whole thing works with JavaScript off. Both identities reach the server and the LAST wins, which is the submitter's whenever one was pressed.</p>
     <p>The submitter must be a <code>&lt;button&gt;</code> inside a form that is itself bound, and it cannot carry its own <code>name</code>, <code>value</code>, <code>form</code>, or a static <code>formaction</code>, because the identity already occupies that name/value pair. Two input controls are refused for the same underlying reason. <code>&lt;input type="image"&gt;</code> submits <code>name.x</code> / <code>name.y</code> coordinates rather than <code>name=value</code>, so the identity would never arrive. <code>&lt;input type="submit"&gt;</code> would receive the identity in its <code>value</code>, which on that control is also the visible caption, so it would render captioned with the action id and the only way to label it is the channel the identity needs. A <code>&lt;button&gt;</code> avoids both, because its label is its children. A <code>.prop</code> spelling of any of these (<code>.name</code>, <code>.value</code>, <code>.formAction</code>, <code>.formMethod</code>, <code>.formEnctype</code>) is refused as well: all reflect on a submitter, so the write is dropped at SSR and lands in the attribute in the browser. Separately, <code>formmethod="get"</code> and an unparseable <code>formenctype</code> like <code>text/plain</code> are refused on ANY submitter inside a bound form, binding or not, since neither can carry the action's body. <code>formmethod="dialog"</code> and a plain <code>formaction="/url"</code> are left alone, because neither submits to the bound action.</p>
+
+    <p><strong>The enclosing form has to be bound, and that is the one requirement the renderer cannot always enforce.</strong> SSR reads a linear byte stream one template at a time, and a component renders its own template in a separate pass with no view of the host page, so a <code>formaction=\${action}</code> button inside a component is a cannot-tell. Cannot-tell binds anyway, deliberately: refusing there would reject a per-row button in a list and a button inside a component, and an SSR refusal is isolated per component, so production would return 200 with the button silently gone. The cost is that a submitter in a component inside an UNBOUND form reaches production. Whether that breaks depends on the form: one that still sends a parseable POST body works, because the identity rides the button's own <code>name</code>/<code>value</code> pair into the body. One with no <code>method</code> (or <code>method="get"</code>) is submitted as a GET, so the reserved identity rides the query string, the action never runs, and the page re-renders with a 200 and no error. <code>webjs check</code>'s <code>submitter-needs-bound-form</code> rule closes that gap: it reads every template in the app at once, so it resolves the enclosing form across module boundaries and transitively through intermediate components, and it stays silent on anything indefinite (a tag rendered in a bound form somewhere and an unbound one elsewhere, a tag whose unbound host form still delivers, a form whose <code>method</code> or <code>enctype</code> comes from a hole, a tag with no call site, a submitter in a bare <code>html</code> helper, a file registering more than one tag, a file that opens a form of its own, a submitter or tag handed to another element through a start-tag hole, a <code>formaction</code> hole that is not a proven action binding (a url string or constant, a factory-produced export, a namespace or default import, a barrel re-export, or a non-identifier expression), a reference cycle). The one start-tag hole it does judge is <code>&lt;webjs-suspense .fallback=\${…}&gt;</code>, which the renderer renders inline in the enclosing form rather than handing off.</p>
     <p>With JavaScript off this is a native round-trip (the browser submits, follows the 303, or renders the 422). With JavaScript on the client router applies the 422 in place (no reload, typed input preserved) and follows the 303 via fetch. Both ends of the progressive-enhancement spectrum from one piece of code, no form library. See the <a href="/docs/client-router">client router</a> docs for the rendering behavior, and <a href="/docs/progressive-enhancement">progressive enhancement</a> for the full write-path pattern.</p>
   `;
 }
diff --git a/website/app/docs/suspense/page.ts b/website/app/docs/suspense/page.ts
index 375774d23..f82e5176d 100644
--- a/website/app/docs/suspense/page.ts
+++ b/website/app/docs/suspense/page.ts
@@ -91,7 +91,7 @@ With Suspense:     TTFB = shell render = ~40ms
       <li><strong>Error-isolated.</strong> A throwing component inside a boundary renders its own error state while siblings stream.</li>
       <li><strong>Progressive on soft navigation.</strong> A client-router navigation to a streamed page applies the shell (with fallbacks) immediately, advances the URL, then streams each boundary in, matching the initial-load experience.</li>
     </ul>
-    <p>The <code>.fallback</code> is read at SSR as the inline placeholder (never through the <code>data-webjs-prop-*</code> path, since a <code>TemplateResult</code> is not serializer-safe) and must be an unquoted property hole. <code>renderFallback()</code> on a component is a DIFFERENT concern (the client re-fetch loading state, never the first paint); see <a href="/docs/loading-states">Loading States</a>.</p>
+    <p>The <code>.fallback</code> is read at SSR as the inline placeholder (never through the <code>data-webjs-prop-*</code> path, because that applies the property at hydration, far too late for a placeholder that has to be in the first flushed bytes) and must be an unquoted property hole. <code>renderFallback()</code> on a component is a DIFFERENT concern (the client re-fetch loading state, never the first paint); see <a href="/docs/loading-states">Loading States</a>.</p>
 
     <h2>When to Use Suspense</h2>
     <ul>
diff --git a/website/app/docs/troubleshooting/page.ts b/website/app/docs/troubleshooting/page.ts
index 0e35f0e20..07009aeba 100644
--- a/website/app/docs/troubleshooting/page.ts
+++ b/website/app/docs/troubleshooting/page.ts
@@ -54,6 +54,11 @@ export default function Troubleshooting() {
     <p><strong>Cause:</strong> the form binds no action. A page has no <code>action</code> export, so a bare <code>&lt;form method="post"&gt;</code> has nothing to run: the url exists and only renders, which is what the 405 says. The other way to get one is binding an action whose file declares <code>export const method = 'GET'</code>; a GET action rides its arguments in the url and skips the CSRF check, so it cannot answer a form POST. That case answers <code>Allow: GET</code>, and <code>webjs check</code>'s <code>form-action-not-a-get-action</code> rule catches it before it ships.</p>
     <p><strong>Fix:</strong> bind the action (<code>&lt;form action=\${submitFeedback}&gt;</code>), or drop the <code>method</code> export from the action's file so it is an ordinary POST.</p>
 
+    <h2>A button submits and the page just re-renders</h2>
+    <p><strong>Symptom:</strong> clicking a <code>formaction=\${action}</code> button reloads the same page with a 200, nothing was written, no error appears anywhere, and the address bar has grown a <code>?__webjs_action=</code> parameter.</p>
+    <p><strong>Cause:</strong> the enclosing <code>&lt;form&gt;</code> binds no action AND declares no <code>method="post"</code>, so the browser submits it as a GET. (An unbound form that DOES declare <code>method="post"</code> still works, because the identity rides the button's own name/value pair and reaches the server in the body.) A GET sends no body, so the identity the button carries rides the query string instead, and a GET at a page url just renders the page. That is why there is no 405 and no log line. The renderer refuses this shape when it can see both halves in one template, but a submitter inside a COMPONENT is a cannot-tell (the component renders in its own pass with no view of the host page) and cannot-tell has to bind, so a split-across-modules form reaches production.</p>
+    <p><strong>Fix:</strong> bind the enclosing form too (<code>&lt;form action=\${saveAll}&gt;</code>), which is what supplies <code>method="post"</code> and the enctype. Run <code>webjs check</code> to find it: the <code>submitter-needs-bound-form</code> rule reads every template in the app at once, so it resolves the enclosing form across module boundaries and transitively through intermediate components. It is conservative and stays silent when a tag is rendered in a bound form somewhere and an unbound one elsewhere, so a clean check is not by itself proof the form is bound. Two runtime signals back it up: in dev the browser console carries one <code>[webjs]</code> error at submit time naming the fix, and in production the <code>onError</code> hook receives the fingerprint with <code>err.code === 'WEBJS_FORM_SUBMITTED_AS_GET'</code>. The 405 case has its own code, <code>WEBJS_FORM_ACTION_MISSING</code>. Neither changes the response.</p>
+
     <h2>A render fails on a button's formmethod or formenctype</h2>
     <p><strong>Symptom:</strong> a page that renders fine with JavaScript on fails at render with <code>&lt;button formenctype="text/plain"&gt; inside a bound &lt;form action=\${action}&gt; cannot work</code>, or the same message naming <code>formmethod</code>.</p>
     <p><strong>Cause:</strong> a submitter's <code>formmethod</code> / <code>formenctype</code> overrides the form's own for that button, and a bound action needs a POST body the server can parse as <code>multipart/form-data</code> or <code>application/x-www-form-urlencoded</code>. A GET sends no body at all, and <code>text/plain</code> is flagged by the HTML spec as not intended for machine parsing. Either one submits fine with JavaScript (the client router posts <code>FormData</code> and ignores the attribute) and is a bare <code>405</code> without it, so it is refused at render rather than shipped as a form that works one way only. The check runs on EVERY submitter inside a bound form, whether or not that button binds an action of its own, which is why it can fire on a button you never touched.</p>