From 1a08f9bdacf8f05c7987a3bcc89a331002979df7 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Fri, 7 Aug 2026 14:19:30 +0530
Subject: [PATCH 01/13] feat: make a bound form submitter carry its own
 submission

A `<button formaction=${fn}>` used to be half a submission. It carried the
action identity in its name/value pair, while `method="post"` and the enctype
were supplied on the enclosing FORM's start tag. So the button only worked
inside a form that was itself bound, and the renderer refused it anywhere else.

That refusal could not be enforced where it mattered. A component renders its
own template in a separate SSR pass with no view of the host page, and a button
inside a component is the ordinary shape, so the scan had to fall back to
binding whenever it could not tell. The result was a form that submitted as a
GET, put the identity in the query string, re-rendered the page, and ran
nothing: a silent 200 with no log.

Supply the submission attributes at the level where the action is bound, and
never override what the author wrote at that same level. A bound form still
gains `method="post"` plus `enctype`; a bound submitter now gains
`formmethod="post"` plus `formenctype` on the button itself. React does the
same thing for a function `formAction`. The button is then self-sufficient
inside a bound form, an unbound form, a `method="get"` form, or no form at all,
which deletes the failure class rather than reporting it.

Refusals narrow to same-element contradictions, which have no correct fallback.
A cross-element rule always has one, namely whatever native HTML would do, so a
PLAIN button's own `formmethod` / `formenctype` is now honoured rather than
refused: the author typed it deliberately and the form's action simply does not
run. That reverses #1207's Part B, whose stated justification ("either works
under JS and is a bare 405 without it") was only ever true of `formenctype`;
the client router already honours a submitter's `formmethod` with native
precedence, so both paths lost the identity identically.

With nothing left to ask about the enclosing element, the four-state form-scope
tracking goes: the parameter threaded through both SSR state machines, the
Suspense scope carried across the server's boundary drain, and the client's
enclosing-form walk and candidate bookkeeping.

No `formaction` url is emitted, unlike React, because an empty one is an HTML
conformance error and this repo already bans the shape. A bound submitter
inside a form declaring `action="/x"` therefore posts to `/x`, which is native
precedence, and the action still runs because the identity travels in the body.
---
 .agents/skills/webjs/SKILL.md                 |   4 +-
 .../webjs/references/muscle-memory-gotchas.md |  28 +-
 .../skills/webjs/references/optimistic-ui.md  |   2 +-
 .../webjs/references/routing-and-pages.md     |   2 +-
 AGENTS.md                                     |   4 +-
 packages/core/src/form-action.js              | 407 +++++++++---------
 packages/core/src/render-client.js            | 145 +++----
 packages/core/src/render-server.js            | 169 +++-----
 .../browser/ssr-client-parity.test.js         |  96 +++--
 .../rendering/form-action-attr-guard.test.js  |  13 +-
 .../form-action-binding-client.test.js        |  43 +-
 .../rendering/form-action-binding.test.js     | 325 ++++++++------
 packages/server/src/ssr.js                    |  19 +-
 test/bun/form-action-guard.mjs                |  22 +-
 .../bun/form-action-submitter-parity.test.mjs |  82 +++-
 15 files changed, 718 insertions(+), 643 deletions(-)

diff --git a/.agents/skills/webjs/SKILL.md b/.agents/skills/webjs/SKILL.md
index 0ebd7f322..f81983028 100644
--- a/.agents/skills/webjs/SKILL.md
+++ b/.agents/skills/webjs/SKILL.md
@@ -106,7 +106,7 @@ App-internal imports use the `#` root alias (`import { db } from '#db/connection
 9. No backtick characters inside an `html\`...\`` body, even in comments (it closes the literal and 500s).
 10. TypeScript must be erasable (`erasableSyntaxOnly: true`): no `enum`, no value `namespace`, no constructor parameter properties, no legacy decorators.
 11. Reactive properties are declared ONLY through the base-class factory `extends WebComponent({ count: Number })`. Never a `static properties` block, never a class-field initializer (it clobbers the reactive accessor).
-12. A form that writes binds its action: `<form action=${importedAction}>`, or a per-button `<button formaction=${importedAction}>` inside a bound form. Quoted bindings, non-submit controls, `<input type="submit">` (the identity needs its `value`, which is also its label, so use a `<button>`), submitter `name` / `value` / `form` / static `formaction` attributes, a `.prop` spelling of any of those, `action=${fn}` off a `<form>`, a bound form with `method="get"`, `formmethod="get"` or an unparseable `formenctype` on ANY submitter in a bound form, and a non-action function all throw. A page has no `action` export, so a bare `<form method="post">` is a 405.
+12. A form that writes binds its action: `<form action=${importedAction}>`, or a per-button `<button formaction=${importedAction}>`. A bound submitter is SELF-SUFFICIENT (#1307): the renderer puts `formmethod="post"` and `formenctype` on the button itself, so it needs no bound form around it and works inside any form or none. Quoted bindings, non-submit controls, `<input type="submit">` (the identity needs its `value`, which is also its label, so use a `<button>`), submitter `name` / `value` / `form` / static `formaction` attributes, a `.prop` spelling of any of those, `action=${fn}` off a `<form>`, a bound form with `method="get"`, a BOUND submitter's own non-post `formmethod` or unparseable `formenctype`, and a non-action function all throw. A PLAIN button's own `formmethod` / `formenctype` is a legal native override and is left alone. A page has no `action` export, so a bare `<form method="post">` is a 405.
 
 ## Export Map
 
@@ -237,7 +237,7 @@ Success is a 303 (PRG); failure re-renders the page at 422 with the result on `a
 - Writing `fetch()` to call your own server instead of importing the action.
 - Writing a bare `<form method="post">` and expecting a page `action` export to catch it. There is no such export; bind the action with `action=${fn}` or the submission is a 405.
 - Putting a submitter's `formaction=${fn}` on anything that is not a submit control, or on a button carrying its own `name` / `value`. The identity IS the button's name/value pair, so both halves are spoken for.
-- Writing `formmethod="get"` or `formenctype="text/plain"` on any button inside a bound form. Neither can carry the action's body, so both are refused even when the button binds nothing.
+- Writing `formmethod="get"` or `formenctype="text/plain"` on a button that BINDS an action. Neither can carry that action's body, so the pair contradicts itself and throws. On a button that binds nothing it is a legal native override and is honoured.
 - Binding an action whose file declares `export const method = 'GET'`. That is a 405 at runtime and a `webjs check` error.
 - Throwing `redirect()` / `notFound()` inside a `route.ts` handler (uncaught 500). Return a `Response` there.
 - A placeholder first paint that fetches in `connectedCallback`. SSR does not call `connectedCallback`; put first-paint data in the constructor (server-known inputs) or use `async render()`.
diff --git a/.agents/skills/webjs/references/muscle-memory-gotchas.md b/.agents/skills/webjs/references/muscle-memory-gotchas.md
index 4390bf5d9..c6825d6b7 100644
--- a/.agents/skills/webjs/references/muscle-memory-gotchas.md
+++ b/.agents/skills/webjs/references/muscle-memory-gotchas.md
@@ -64,7 +64,21 @@ html`<form action=${saveDraft}>
 </form>`;
 ```
 
-The identity rides the pressed button's own `name`/`value` pair, which a browser submits for that button alone, so this works with JS off exactly as it does with JS on. Both entries reach the server and the LAST wins, which is always the submitter's when one was pressed. The submitter must be a `<button>` and cannot carry its own `name`, `value`, or `form` attribute, because the identity already occupies that pair. `<input type="submit">` is refused for the binding: the identity has to occupy its `value`, which on that control is also the visible caption, so the button would render captioned with the action id and could never be labelled. A `<button>` has no such conflict, since its label is its children.
+The identity rides the pressed button's own `name`/`value` pair, which a browser submits for that button alone, so this works with JS off exactly as it does with JS on. Both entries reach the server and the LAST wins, which is always the submitter's when one was pressed.
+
+**A bound submitter is self-sufficient, so the enclosing form does not have to be bound** (#1307). The renderer puts `formmethod="post"` and `formenctype="multipart/form-data"` on the button itself, alongside the identity, exactly as React emits `formMethod` and `formEncType` on a button carrying a function `formAction`. So a per-button action works inside a bound form, an unbound form, a `method="get"` form, or a form with no method at all:
+
+```js
+// Every button below submits a POST its action can read, with JS on or off.
+html`<form>
+  <button formaction=${saveDraft}>Save</button>
+  <button formaction=${publishPost}>Publish</button>
+</form>`;
+```
+
+One consequence worth knowing rather than discovering: no `formaction` url is emitted (an empty one is an HTML conformance error), so the submission targets whatever the FORM targets. A form declaring its own `action="/x"` sends its buttons to `/x`, which is native precedence and still runs the action, because the identity travels in the body. Leaving the form's `action` off, the ordinary shape, keeps the submission on the current page.
+
+The submitter must be a `<button>` and cannot carry its own `name`, `value`, or `form` attribute, because the identity already occupies that pair. `<input type="submit">` is refused for the binding: the identity has to occupy its `value`, which on that control is also the visible caption, so the button would render captioned with the action id and could never be labelled. A `<button>` has no such conflict, since its label is its children.
 
 **Only the bare, unquoted `action=${fn}` on a `<form>` binds.** Every near-miss is a hard render error rather than a silently-inert form, and the reason is a source leak. During SSR a `.server.ts` import is the ACTUAL function (the RPC stub exists only in the browser), and `action=` is an ordinary attribute hole, so stringifying it would write the function's body into the HTML every visitor downloads, including any literal inside it. The renderer throws instead, on the server and on the client, for `action=` and `formaction=` alike.
 
@@ -95,21 +109,21 @@ The bound, refused, and allowed shapes in full. Every "no" row is a binding that
 | `action=${fn}` unquoted, on a `<form>` | **no, it BINDS** | the one supported shape: the identity is resolved and emitted as a hidden field, nothing is stringified |
 | `action=${fn}` on any other tag | yes | `action` submits nothing off a `<form>`, so it is an ordinary attribute and the function would be stringified |
 | `action="${fn}"`, or a mixed `action="/x/${fn}"` | yes | quoting turns a binding hole back into a plain attribute |
-| `formaction=${fn}` unquoted, on a submitter inside a bound form | **no, it BINDS** | the second supported shape (#1207). The identity rides the button's own `name`/`value` pair, the one channel a browser submits for the pressed button alone, so no `formaction` url is emitted and the server takes the LAST `__webjs_action` entry |
-| `formaction=${fn}` inside an UNBOUND `<form>` | yes | `method="post"` and the enctype are forced on the FORM's start tag, which SSR has already emitted by the time it reaches the button, so a per-button action cannot retrofit them |
+| `formaction=${fn}` unquoted, on a submitter, ANYWHERE | **no, it BINDS** | the second supported shape (#1207, #1307). A bound submitter carries its WHOLE submission: the identity rides the button's own `name`/`value` pair, the one channel a browser submits for the pressed button alone, and the renderer adds `formmethod="post"` and `formenctype="multipart/form-data"` to the button itself. So it works inside a bound form, an unbound form, a `method="get"` form, or a form with no method at all, and it asks NOTHING of the element around it. No `formaction` url is emitted, and the server takes the LAST `__webjs_action` entry |
 | `formaction=${fn}` on a submitter carrying its own `name` or `value` | yes | the identity IS that name/value pair, so both halves are already spoken for. Bind one action on the form and dispatch on `name="intent"` if you need the button's own value |
 | `formaction=${fn}` on a non-submit control, or `<input type="image">` | yes | `formaction` is inert on anything that does not submit, and an image submitter sends `name.x` / `name.y` coordinates instead of `name=value`, so the identity would never arrive |
-| `formaction=${fn}` on a submitter with `form="other"` | yes | it re-points the submitter at a form other than the bound one it sits in, so the boundness just checked was about the wrong element |
-| `formmethod="get"` / `formenctype="text/plain"` on ANY submitter inside a bound form | yes | this is the Part B rule, and it applies whether or not that button binds an action of its own: a GET sends no body and `text/plain` is not parseable, so the submission works under JS (the router posts `FormData`) and 405s without it |
+| `formaction=${fn}` on a submitter with `form="other"` | yes | it re-points the submitter at a different form owner, which may not be where the identity field it needs lives |
+| `formmethod` / `formenctype` the BOUND submitter cannot submit with (`get`, `PATCH`, `text/plain`, `dialog`, a padded `" post "`) | yes | a same-element contradiction: you attached an action to THIS button and told THIS button to submit in a way that action could never read. The renderer supplies `formmethod="post"` and the enctype only where you supplied neither, so your own parseable value always wins |
+| `formmethod="get"` / `formenctype="text/plain"` on a PLAIN submitter inside a bound form | **no** | #1307 reversed this. Native HTML says the submitter's override wins, you typed it deliberately, and the form's action simply does not run, exactly as the same markup behaves anywhere else. In dev the client logs a console error at submit time if the submission is carrying an identity it cannot deliver |
 | `formmethod="dialog"` on a submitter that binds nothing | **no** | a native `<dialog>` dismissal, never a submission, so there is no body for the action to miss. It IS refused on a button that also binds an action, which is a straight contradiction |
-| a plain `formaction="/url"` on a submitter inside a bound form | **no** | it retargets the submission away from the page's bound action entirely, so its own `formmethod` is the author's business and Part B leaves it alone |
+| a plain `formaction="/url"` on a submitter inside a bound form | **no** | it retargets the submission away from the page's bound action entirely, so where it goes and how is your business |
 | `.action=` on a native form | yes | the supported binding is the plain attribute, and a `.prop` on a native element drops at SSR, so accepting it would mean a form that submits under JS and does nothing without it |
 | `.method=` / `.enctype=` / `.encoding=` on a BOUND form | yes | the same reason one level over. All three are reflected IDL attributes, so SSR drops the binding and emits `method="post"` while a browser ends at what you assigned. Write them as plain attributes |
 | a second `action=${fn}` on one form | yes | SSR emits the second as a plain url next to the identity field, the client takes the last. Bind exactly one, in either position |
 | a plain `action="/url"` beside the bound hole | yes | the hole drops only its OWN attribute, so SSR keeps the static one while the client removes it: without JS the browser posts to `/url`, with JS to the page |
 | `method=" post "` / `enctype=" multipart/form-data "` | yes | `method` and `enctype` are enumerated attributes matched against exact keywords with no whitespace stripping, so a padded value falls to the invalid-value default and the form submits as a GET with no body. Trimming it for you would emit the padded value anyway |
 | `encoding="..."` as an ATTRIBUTE on a bound form | **no** | inert in HTML (`form.encoding` reads back `enctype`), so both renderers ignore it and still supply `enctype`. Only the `.encoding` PROPERTY aliases enctype, and that spelling IS refused, one row up |
-| `.formAction=` on a button or input | yes | same reason, that is where `formAction` reflects |
+| `.formAction=` / `.formMethod=` / `.formEnctype=` on a BOUND submitter | yes | same reason, that is where they reflect: SSR drops the property and the browser applies it, so the button would submit one way with JS and another way without. On a PLAIN button they are ordinary native properties and are left alone |
 | `.action=` on any other native tag | **no** | a plain expando (`<div .action=${fn}>`, `<button .action=${fn}>`), reflecting nothing, so nothing reaches the markup |
 | `.action=` on a custom element | **no** | an author-defined property, not a reflected IDL attribute, so a function is a legitimate value. One declared `reflect: true` reflects on a path outside these commit sites, which used to write `String(value)` and emit the source. It now removes the attribute and warns instead, for a bare function and for an array carrying one, unless the prop supplies its own `converter.toAttribute`, which runs first and stays the author's call |
 | `?action=` | yes | a function never leaked through a boolean hole, but the binding is meaningless, so it is refused rather than emitting the bare `action=""` that ANY truthy value produces there. Two separate facts worth carrying: `action=""` is a conformance error (the spec wants a valid non-empty URL whenever the attribute is present), and deleting the attribute is still not the WebJs fix, since a page has no `action` export and an unbound `method="post"` form is a 405 (a bare GET form just re-renders). Bind it: `<form action=${fn}>` |
diff --git a/.agents/skills/webjs/references/optimistic-ui.md b/.agents/skills/webjs/references/optimistic-ui.md
index 8a2620bba..72e892a39 100644
--- a/.agents/skills/webjs/references/optimistic-ui.md
+++ b/.agents/skills/webjs/references/optimistic-ui.md
@@ -104,7 +104,7 @@ render() {
 
 `method` and the enctype are supplied by the renderer, and the hidden identity field is re-inserted as the form's first child on every client render, so there is nothing to manage by hand.
 
-When a page owns SEVERAL mutations (create, toggle, delete), give each form its OWN binding (`action=${createTodo}` / `action=${toggleTodo}` / `action=${deleteTodo}`), or use per-button submitter server action bindings via `formaction=${action}` on submitter buttons inside a bound form (#1207). Alternatively, a form that dispatches dynamically can bind ONE action and inspect a submit button's `name="intent"`.
+When a page owns SEVERAL mutations (create, toggle, delete), give each form its OWN binding (`action=${createTodo}` / `action=${toggleTodo}` / `action=${deleteTodo}`), or use per-button submitter server action bindings via `formaction=${action}` on submitter buttons (#1207, #1307: a bound submitter carries its own submission, so the enclosing form need not be bound). Alternatively, a form that dispatches dynamically can bind ONE action and inspect a submit button's `name="intent"`.
 
 ## Seed the list from the server for SSR plus optimistic
 
diff --git a/.agents/skills/webjs/references/routing-and-pages.md b/.agents/skills/webjs/references/routing-and-pages.md
index c727abcf0..9cbaeed7d 100644
--- a/.agents/skills/webjs/references/routing-and-pages.md
+++ b/.agents/skills/webjs/references/routing-and-pages.md
@@ -179,7 +179,7 @@ Three responses that are not the happy path:
 
 The submission is Origin-verified (the same `Sec-Fetch-Site` / `Origin` check the RPC endpoint applies), so a no-JS form needs no CSRF token field.
 
-Refusals worth knowing: `formaction=${fn}` is supported only on a `<button>` inside a bound form, and that button may not carry `name`, `value`, `form`, or a static `formaction` attribute (`<input type="submit">` is refused, because the identity needs its `value`, which is also its label). A bound form may not declare `method="get"`, and a function bound to `action=` that is not a `'use server'` export throws at render rather than producing a form that posts nowhere. See `muscle-memory-gotchas.md` for the full table.
+Refusals worth knowing: `formaction=${fn}` is supported on a `<button>` anywhere, bound form or not (#1307: the renderer gives the button its own `formmethod` and `formenctype`), and that button may not carry `name`, `value`, `form`, or a static `formaction` attribute (`<input type="submit">` is refused, because the identity needs its `value`, which is also its label). A bound form may not declare `method="get"`, and a function bound to `action=` that is not a `'use server'` export throws at render rather than producing a form that posts nowhere. See `muscle-memory-gotchas.md` for the full table.
 
 ## Error, loading, and 404 boundaries
 
diff --git a/AGENTS.md b/AGENTS.md
index 48ad9615b..5b7a021c4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -237,7 +237,7 @@ lit-html parity: `repeat` (keyed lists), `unsafeHTML(str)` (trusted raw HTML, **
 
 ### `html` expression prefixes
 
-`<div>${x}</div>` text child; `class=${x}` attribute (escaped); `action=${importedAction}` on a `<form>` or `formaction=${importedAction}` on a submitter inside a bound form binds a server action (#1155, #1207: the function-valued attribute holes where the attribute is omitted/rewritten and a `__webjs_action` identity is emitted; submitters must be actual submit controls and cannot carry their own `name`, `value`, `form`, or static `formaction` attributes; a quoted `action="${fn}"` / `formaction="${fn}"` or `action=${fn}` on un-supported tags is a render error, since stringifying a function would leak a server action's source); `@click=${fn}` event listener (client-only, drops at SSR); `.value=${v}` DOM property (round-trips through SSR on custom elements via `data-webjs-prop-*`, drops on native elements); `?disabled=${b}` boolean attribute. Event/property/boolean holes **must be unquoted** (invariant 4). Every hole is identical server and client except `@event`, `.prop` on native elements, and a **nullish-or-`false` plain-attribute hole**: the client REMOVES the attribute for `null` / `undefined` / `false`, while the server stringifies, emitting `attr=""` for nullish and `attr="false"` for `false`. So the two renderers disagree, and there is no "omit this attribute" hole value at all. `false` is the subtler half: `aria-expanded=${false}` serves `aria-expanded="false"` and hydrates to no attribute, and for a tri-state ARIA attribute those are NOT the same thing, so `?attr=${bool}` is not a substitute either. To omit an attribute conditionally, BRANCH the template (`cond ? html\`<div a=${v}>\` : html\`<div>\``) rather than passing a nullish value, and use `?attr=${bool}` for a genuine boolean attribute. This matters for ARIA in particular, where an empty `aria-labelledby` is an IDREF list resolving to nothing and an `aria-checked=""` is an attribute the role may not even allow.
+`<div>${x}</div>` text child; `class=${x}` attribute (escaped); `action=${importedAction}` on a `<form>` or `formaction=${importedAction}` on a submitter binds a server action (#1155, #1207, #1307: the function-valued attribute holes where the attribute is omitted/rewritten and a `__webjs_action` identity is emitted, plus `formmethod` / `formenctype` on a bound submitter so it needs no bound form around it; submitters must be actual submit controls and cannot carry their own `name`, `value`, `form`, or static `formaction` attributes; a quoted `action="${fn}"` / `formaction="${fn}"` or `action=${fn}` on un-supported tags is a render error, since stringifying a function would leak a server action's source); `@click=${fn}` event listener (client-only, drops at SSR); `.value=${v}` DOM property (round-trips through SSR on custom elements via `data-webjs-prop-*`, drops on native elements); `?disabled=${b}` boolean attribute. Event/property/boolean holes **must be unquoted** (invariant 4). Every hole is identical server and client except `@event`, `.prop` on native elements, and a **nullish-or-`false` plain-attribute hole**: the client REMOVES the attribute for `null` / `undefined` / `false`, while the server stringifies, emitting `attr=""` for nullish and `attr="false"` for `false`. So the two renderers disagree, and there is no "omit this attribute" hole value at all. `false` is the subtler half: `aria-expanded=${false}` serves `aria-expanded="false"` and hydrates to no attribute, and for a tri-state ARIA attribute those are NOT the same thing, so `?attr=${bool}` is not a substitute either. To omit an attribute conditionally, BRANCH the template (`cond ? html\`<div a=${v}>\` : html\`<div>\``) rather than passing a nullish value, and use `?attr=${bool}` for a genuine boolean attribute. This matters for ARIA in particular, where an empty `aria-labelledby` is an IDREF list resolving to nothing and an `aria-checked=""` is an attribute the role may not even allow.
 
 ---
 
@@ -483,7 +483,7 @@ const result = await optimistic(liked, true, () => likePost(postId));
 
 11. **No em-dashes (U+2014), no hyphen or semicolon used as pause-punctuation in prose, and no colon attached to a code-shaped LHS.** Banned as a pause: U+2014, a space-surrounded hyphen between words, a space-surrounded semicolon between words. Banned colon attachments: a colon-then-prose after `xyz()`, a `<my-tag>`, an `[expr]` subscript, or a `<code>foo()</code>` definition list (rephrase verb-led). Prefer a period, comma, a colon on a plain-noun LHS, parentheses, or a restructure. Plain hyphens stay fine in compound words, flags, filenames, ranges; semicolons and colons stay fine inside code / TS / JSON / CSS. The same hook also enforces brand casing with one simple rule: `WebJs` is a proper noun, so write it capitalized wherever it NAMES the project in prose, at a sentence start AND mid-sentence (`WebJs ships`, `Most WebJs apps`, `the WebJs serializer`). It stays lowercase `webjs` ONLY as a literal code token: a `webjs <subcommand>` CLI command (`webjs dev`, `webjs db migrate`), a `webjs.dev` domain, an `@webjsdev` package, a `"webjs"` config key, a `WEBJS_*` env var, the `webjsdev/webjs` org path, or anything inside a `` `code` `` span or fenced block. If you mean the literal config key or command in prose, wrap it in backticks. Enforced via `.claude/hooks/block-prose-punctuation.sh`, which scans only NEW content (you can still edit an existing line to fix a glyph or casing).
 
-12. **A form that writes binds its action: `<form action=${importedAction}>`, and a form whose buttons run different actions binds each on its submitter, `<button formaction=${importedAction}>` inside that bound form** (#1155, #1207). Those are the two shapes the renderer reads, and every near-miss throws rather than producing a form that posts nowhere. The submitter identity rides the pressed button's own `name`/`value` pair (the one channel a browser submits for that button alone), so no `formaction` url is emitted, both entries reach the server, and the dispatcher takes the LAST `__webjs_action` in DOM order, which is the submitter's whenever one was pressed. **Refused on a form:** a quoted `action="${fn}"`, `action=${fn}` on any tag other than `<form>`, `method="get"` or an enctype the server cannot parse, a `.method` / `.enctype` / `.encoding` PROPERTY binding (a `.prop` drops at SSR and applies in the browser, so the form would submit differently with JS than without), a second `action` hole, a plain `action="/url"` alongside the bound hole (SSR keeps it and the client drops it), a whitespace-padded `method=" post "` (an enumerated attribute is matched against exact keywords, so a padded value falls to the invalid-value default and submits as a GET), and a function that is not a `'use server'` export. **Refused on a submitter:** an enclosing form that is not itself bound (`method` and the enctype are forced on the form's start tag, too late to add from the button), a control that is not a submit control, an `<input type="image">` (it submits `name.x` / `name.y` coordinates, so the identity never arrives), an `<input type="submit">` (the identity has to occupy its `value`, which on that control is also its visible label, so it would render captioned with the action id and could never be labelled; a `<button>` has no such conflict), a submitter carrying its own `name`, `value`, `form`, or static `formaction`, a `.prop` spelling of any of those (`.name` / `.value` / `.formAction` / `.formMethod` / `.formEnctype` all REFLECT on a submitter, so the write is dropped at SSR and lands in the attribute in the browser), and a second `formaction` hole. **Refused on ANY submitter inside a bound form, whether or not it binds:** `formmethod="get"` and an unparseable `formenctype` such as `text/plain`, since either works under JS (the router posts `FormData`) and is a bare `405` without it. Two carve-outs there: `formmethod="dialog"` never submits, and a plain `formaction="/url"` retargets away from the bound action. WebJs supplies `method` and `enctype` only where your template supplies neither, judged from the TEMPLATE rather than the rendered element: `?method=${false}` emits nothing so it is supplied, while `method=${null}` emits `method=""` and is refused. An `encoding=` attribute is inert in HTML (only the `.encoding` PROPERTY aliases `enctype`), so both renderers ignore it. A page has no `action` export, so a bare `<form method="post">` is a `405`. **Boundness is BEST EFFORT in both renderers, and neither always knows.** SSR reads a linear byte stream, so it knows within one template scan, but a COMPONENT renders its own template in a separate pass with no view of the host page, and the client may reconcile a submitter whose form lives in a parent template and is not in the tree yet (a `repeat()` row). Each renderer therefore distinguishes three answers: bound (fine), unbound (refused), and cannot-tell (bind anyway). Cannot-tell has to bind: refusing there would reject a per-row button in a list or a button inside a component, both ordinary shapes, and at SSR a refused component is ISOLATED, so in production the button would silently vanish from a page that still returned 200. The refusal still fires wherever the answer is genuinely known.
+12. **A form that writes binds its action: `<form action=${importedAction}>`, and a form whose buttons run different actions binds each on its submitter, `<button formaction=${importedAction}>`** (#1155, #1207, #1307). Those are the two shapes the renderer reads, and every near-miss throws rather than producing a form that posts nowhere. The submitter identity rides the pressed button's own `name`/`value` pair (the one channel a browser submits for that button alone), so no `formaction` url is emitted, both entries reach the server, and the dispatcher takes the LAST `__webjs_action` in DOM order, which is the submitter's whenever one was pressed. **Refused on a form:** a quoted `action="${fn}"`, `action=${fn}` on any tag other than `<form>`, `method="get"` or an enctype the server cannot parse, a `.method` / `.enctype` / `.encoding` PROPERTY binding (a `.prop` drops at SSR and applies in the browser, so the form would submit differently with JS than without), a second `action` hole, a plain `action="/url"` alongside the bound hole (SSR keeps it and the client drops it), a whitespace-padded `method=" post "` (an enumerated attribute is matched against exact keywords, so a padded value falls to the invalid-value default and submits as a GET), and a function that is not a `'use server'` export. **Refused on a submitter:** a control that is not a submit control, an `<input type="image">` (it submits `name.x` / `name.y` coordinates, so the identity never arrives), an `<input type="submit">` (the identity has to occupy its `value`, which on that control is also its visible label, so it would render captioned with the action id and could never be labelled; a `<button>` has no such conflict), a submitter carrying its own `name`, `value`, `form`, or static `formaction`, a `.prop` spelling of any of those (`.name` / `.value` / `.formAction` / `.formMethod` / `.formEnctype` all REFLECT on a submitter, so the write is dropped at SSR and lands in the attribute in the browser), and a second `formaction` hole. **Refused on a BOUND submitter, as a same-element contradiction:** its own `formmethod` other than post, an unparseable `formenctype` such as `text/plain`, and `formmethod="dialog"` (which dismisses a `<dialog>` instead of submitting, so the bound action could never run). A PLAIN submitter's own `formmethod` / `formenctype` is NOT refused: native HTML says the submitter's override wins, the author typed it deliberately, and the form's action simply does not run, so the renderer honours it and the dev-time client guard reports at submit time when a submission holds an identity it cannot deliver. A plain `formaction="/url"` likewise retargets away from the bound action and is the author's business. WebJs supplies `method` and `enctype` (and, on a bound submitter, `formmethod` and `formenctype`) only where your template supplies neither, judged from the TEMPLATE rather than the rendered element: `?method=${false}` emits nothing so it is supplied, while `method=${null}` emits `method=""` and is refused. An `encoding=` attribute is inert in HTML (only the `.encoding` PROPERTY aliases `enctype`), so both renderers ignore it. A page has no `action` export, so a bare `<form method="post">` is a `405`. **A bound submitter is SELF-SUFFICIENT and asks nothing of the form around it** (#1307). The renderer supplies submission attributes at the level where the action is BOUND, and never overrides what you wrote at that same level: a bound `<form>` gains `method="post"` plus `enctype`, and a bound `<button>` gains `formmethod="post"` plus `formenctype` ON THE BUTTON, which is what React does for a function `formAction`. So a per-button action works inside a bound form, an unbound form, a `method="get"` form, or a form with no method at all. That is why the refusal list above contains no rule about a submitter's NEIGHBOURS: the renderer refuses only a SAME-ELEMENT contradiction, which has no correct fallback, and never a cross-element rule, which always has one (whatever native HTML would do). It also removed a question neither renderer could answer honestly, since a COMPONENT renders its own template in a separate pass with no view of the host page and the client may reconcile a submitter whose form is not in the tree yet. One consequence: no `formaction` url is emitted (an empty one is a conformance error), so the submission targets whatever the FORM targets, and a form declaring `action="/x"` sends its buttons there, still running the action because the identity travels in the body.
 
 ---
 
diff --git a/packages/core/src/form-action.js b/packages/core/src/form-action.js
index 728a614ee..ea79fa8ca 100644
--- a/packages/core/src/form-action.js
+++ b/packages/core/src/form-action.js
@@ -43,30 +43,43 @@ import { escapeAttr } from './escape.js';
  * needed on the JS path either: `new FormData(form, submitter)` already
  * includes the pressed button's pair.
  *
+ * THE RULE, one sentence, and the whole reason this file is shaped the way it
+ * is (#1307): the renderer supplies submission attributes at the level where
+ * the action is BOUND, and never overrides what the author wrote at that same
+ * level. A bound `<form>` gains `method="post"` and `enctype`; a bound
+ * `<button>` gains `formmethod="post"` and `formenctype` ON THE BUTTON. So a
+ * bound submitter is SELF-SUFFICIENT: it works inside a bound form, an unbound
+ * form, a `method="get"` form, or a form with no method at all, and it asks
+ * nothing of the element around it.
+ *
+ * That is what React does (`pushFormActionAttribute` emits `formMethod` and
+ * `formEncType` beside the identity, from an action descriptor that is
+ * literally `{name, method: 'POST', encType: 'multipart/form-data'}`), and it
+ * is what makes the rule below possible.
+ *
  * Refused shapes on a submitter, each because the identity would not arrive:
  *   - Its own `name` (static `name="..."` or a `name=${n}` hole) or its own
  *     `value`, because the identity occupies both halves of that one pair.
- *   - An enclosing `<form>` that is not itself bound, because `method="post"`
- *     and the enctype are forced on the FORM's start tag, which SSR has already
- *     emitted by the time it reaches the button. Refused only where the
- *     renderer can SEE that form: see `assertSubmitterFormIsBound`.
  *   - `<input type="image">`, which submits `name.x` / `name.y` coordinates
  *     instead of `name=value`, so the identity would never arrive.
  *   - A control that is not a submitter at all, where `formaction` is inert.
- *   - A `form="other"` attribute, which moves the submitter's form owner out
- *     from under the boundness the renderers just checked.
- *
- * Part B of #1207, and the reason it is not scoped to a bound submitter: a
- * submitter's `formmethod` / `formenctype` can defeat a bound form whether or
- * not that button binds its own action, and neither renderer used to see them.
- * `<form action=${fn}><button formenctype="text/plain">` submits fine under JS
- * (the router posts FormData, ignoring `formenctype`) and is a bare 405 without
- * it, which is precisely the works-one-way-only near-miss refused everywhere
- * else here. So `assertSubmitterSubmission` runs for EVERY submitter inside a
- * bound form. Two carve-outs keep it from over-refusing: `formmethod="dialog"`
- * is a native `<dialog>` dismissal that never submits, and a submitter with its
- * own static `formaction="/url"` retargets away from the bound action entirely,
- * so a GET there is the author's business.
+ *   - A `form="other"` attribute, which moves the submitter's form owner
+ *     somewhere the identity field it needs may not be.
+ *
+ * WHAT IS NOT REFUSED, and the line that decides it: only a SAME-ELEMENT
+ * contradiction refuses, never a rule about the author's OTHER elements. A
+ * same-element contradiction has no correct behaviour to fall back to (a bound
+ * button that also says `formmethod="get"` cannot both run the action and send
+ * no body). A cross-element rule always does have one, namely whatever native
+ * HTML would have done, so the renderer honours it instead of refusing.
+ *
+ * The concrete consequence, and it is a deliberate reversal of #1207's Part B:
+ * a PLAIN, non-binding `<button formmethod="get">` inside a bound form now
+ * renders untouched. Native HTML says the submitter's override wins, an author
+ * who typed it meant it, and the form's action simply does not run, which is
+ * exactly what the same markup does in any other framework. The dev-time client
+ * guard reports at submit time when a submission carries an identity it cannot
+ * deliver, which is the right place for a judgement call about intent.
  *
  * Both SSR state machines and the client renderer import from here so the
  * rules cannot drift between them. Each renderer commits attribute, boolean
@@ -351,38 +364,6 @@ export function assertSingleSubmitterAction(duplicate, tag) {
   );
 }
 
-/**
- * Refuse a `formaction=${fn}` submitter whose enclosing form is not itself
- * bound.
- *
- * `method="post"` and the enctype are forced on the FORM's start tag, which SSR
- * has already emitted by the time it reaches the button, so a per-button action
- * cannot retrofit them. An unbound form defaults to GET, which sends no body,
- * so the identity would ride the query string and the action would never run.
- *
- * BEST EFFORT in BOTH renderers, which is the honest statement and replaces an
- * earlier claim here that SSR always knows. It does not: a component renders its
- * own template in a separate pass seeded `'unknown'`, with no view of the host
- * page, and buttons usually live in components. The client is best effort for
- * its own reason (a submitter in a nested template cannot always reach its form
- * while the fragment is detached). Each renderer refuses only where its answer
- * is genuinely known, and binds where it is not, because refusing on
- * cannot-tell rejects ordinary shapes and, at SSR, silently drops an isolated
- * component from a page that still returns 200.
- *
- * @param {boolean} insideBoundForm
- * @param {string} [tag]
- */
-export function assertSubmitterFormIsBound(insideBoundForm, tag) {
-  if (insideBoundForm) return;
-  throw new Error(
-    `[webjs] formaction=\${action} on <${tag || 'button'}> requires the enclosing `
-    + `<form> to also be bound to a server action (e.g. <form action=\${formAction}>). `
-    + `The enclosing <form> must carry an action binding so method="post" and the `
-    + `enctype are set at form start, which is too late to add from the button.`,
-  );
-}
-
 /**
  * The submitter twin of `assertConvergentBoundForm`: refuse a `.prop` spelling
  * on a submitter that the two renderers can never agree on.
@@ -397,29 +378,20 @@ export function assertSubmitterFormIsBound(insideBoundForm, tag) {
  * That is the render-on-the-server, crash-on-hydration direction, which is the
  * one failure this module treats as unacceptable.
  *
- * `formMethod` / `formEnctype` are refused on ANY submitter inside a bound
- * form, not only a bound one, for the same reason Part B is: the browser write
- * reflects, so the attribute the server never saw is the one that decides
- * whether the submission can carry the action's body.
+ * Scoped to a BOUND submitter (#1307). A plain `<button .name=${'intent'}>`
+ * inside a bound form is the ordinary one-action-plus-intent-dispatch pattern
+ * and is left alone, and a plain button's `.formMethod` / `.formEnctype` is now
+ * an ordinary native property on an ordinary button, since its own override no
+ * longer contradicts anything the renderer promised. The native-property rule
+ * (SSR drops a `.prop`, the browser reflects it) is what this codebase already
+ * accepts everywhere else, including for an unbound form's `.method`.
  *
  * @param {string[] | undefined} propAttrs attribute names a property part owns
  * @param {string} tag lowercased owner tag
- * @param {boolean} [bound] whether this submitter carries its own action binding
  * @returns {void}
  */
-export function assertConvergentSubmitter(propAttrs, tag, bound) {
-  // On a submitter that binds nothing, `.name` / `.value` are not this module's
-  // business: a plain `<button .name=${'intent'}>` inside a bound form is the
-  // ordinary one-action-plus-intent-dispatch pattern, and refusing it would
-  // reject valid markup. The THREE that can still defeat the enclosing binding
-  // are judged there. `formAction` belongs in that set as surely as the other
-  // two: SSR drops the prop so the button submits to the page and runs the
-  // bound action, while a browser reflects it and the button posts somewhere
-  // else entirely. (A STATIC `formaction="/url"` stays fine, because both
-  // renderers see it and agree; only the property spelling diverges.)
-  const relevant = (propAttrs || []).filter((n) => (bound
-    ? isSubmitterReflectedProp(n)
-    : /^form(action|method|enctype)$/i.test(String(n))));
+export function assertConvergentSubmitter(propAttrs, tag) {
+  const relevant = (propAttrs || []).filter((n) => isSubmitterReflectedProp(n));
   const prop = relevant[0];
   if (!prop) return;
   throw new Error(
@@ -444,47 +416,38 @@ export function isSubmitterReflectedProp(name) {
 }
 
 /**
- * Part B of #1207: refuse a submitter whose own `formmethod` / `formenctype`
- * would defeat the bound form it sits in.
- *
- * Runs for EVERY submitter inside a bound form, not only one that binds its own
- * action, because that is where the gap was: `<form action=${fn}><button
- * formenctype="text/plain">` submits fine under JS (the router posts FormData
- * and ignores `formenctype`) and is a bare 405 without it, since the server
- * parses a submission as multipart or urlencoded only. Refusing the VALUES that
- * cannot work, never the attributes themselves, so `formenctype` naming either
- * parseable encoding stays fully supported.
- *
- * Two carve-outs, both cases where the submitter is not submitting to the bound
- * action at all:
- *   - `formmethod="dialog"` is a native `<dialog>` dismissal, never a
- *     submission, so there is no body for the action to miss. Refused only when
- *     the same button also BINDS an action, which is a straight contradiction.
- *   - A static `formaction="/url"` retargets the submission away from the
- *     page's bound action entirely, so a GET there is an ordinary form the
- *     author is entitled to write.
+ * The submitter twin of `assertSubmittableForm`: refuse a BOUND submitter whose
+ * own `formmethod` / `formenctype` contradicts the action it binds.
+ *
+ * Only a BOUND submitter reaches here (#1307), which is the reversal of #1207's
+ * Part B. A plain `<button formmethod="get">` inside a bound form is a legal
+ * native override that means exactly what the author typed, so it renders
+ * untouched and the form's action simply does not run. Refusing it would be a
+ * rule about the author's OTHER element, and native HTML already defines the
+ * outcome. The dev-time client guard reports at submit time when a submission
+ * holds an identity it cannot deliver.
+ *
+ * On a bound submitter both values ARE same-element contradictions, because the
+ * renderer would otherwise be supplying `formmethod="post"` and an enctype onto
+ * the very element the author just told to do something else. Refusing the
+ * VALUES that cannot work, never the attributes themselves, so `formenctype`
+ * naming either parseable encoding stays fully supported.
  *
  * @param {string} tag lowercased owner tag, for the message
  * @param {string | null | undefined} formMethod the submitter's `formmethod`, or null
  * @param {string | null | undefined} formEnctype the submitter's `formenctype`, or null
- * @param {{ bound?: boolean, retargeted?: boolean }} [opts]
  */
-export function assertSubmitterSubmission(tag, formMethod, formEnctype, opts) {
-  const bound = !!(opts && opts.bound);
-  const retargeted = !!(opts && opts.retargeted);
+export function assertSubmittableSubmitter(tag, formMethod, formEnctype) {
   const method = formMethod == null ? null : String(formMethod);
   const enctype = formEnctype == null ? null : String(formEnctype);
-  const isDialog = method != null && /^dialog$/i.test(method);
 
-  if (isDialog) {
-    if (!bound) return;
+  if (method != null && /^dialog$/i.test(method)) {
     throw new Error(
       `[webjs] formaction=\${action} on <${tag}> cannot be combined with `
       + `formmethod="dialog", which dismisses a <dialog> instead of submitting, `
       + `so the bound action would never run. Drop one of the two.`,
     );
   }
-  if (retargeted) return;
 
   // Compared UNTRIMMED, exactly as `assertSubmittableForm` compares a form's
   // own `method`. These are enumerated attributes a browser matches against
@@ -494,20 +457,20 @@ export function assertSubmitterSubmission(tag, formMethod, formEnctype, opts) {
   // silently-posts-nowhere submitter this refusal exists to make impossible.
   if (method != null && !/^post$/i.test(method)) {
     throw new Error(
-      `[webjs] <${tag} formmethod="${method}"> inside a bound <form action=\${action}> `
-      + `cannot work: a bound server action is submitted as a POST body, and a `
-      + `"${method}" submission sends none, so the action would never run. Drop the `
-      + `formmethod attribute, or point the button elsewhere with a plain `
-      + `formaction="/url".`,
+      `[webjs] <${tag} formmethod="${method}" formaction=\${action}> cannot work: a `
+      + `bound server action is submitted as a POST body, and a "${method}" `
+      + `submission sends none, so the action would never run. Drop the formmethod `
+      + `attribute (WebJs emits formmethod="post" on a bound submitter), or drop the `
+      + `binding.`,
     );
   }
   if (enctype != null && !PARSEABLE_ENCTYPES.has(enctype.toLowerCase())) {
     throw new Error(
-      `[webjs] <${tag} formenctype="${enctype}"> inside a bound <form action=\${action}> `
-      + `cannot work: a form submission is parsed as multipart/form-data or `
-      + `application/x-www-form-urlencoded, and a "${enctype}" body is neither, so `
-      + `the submission would run under JS and 405 without it. Drop the formenctype `
-      + `attribute (WebJs emits multipart/form-data on the form).`,
+      `[webjs] <${tag} formenctype="${enctype}" formaction=\${action}> cannot work: a `
+      + `form submission is parsed as multipart/form-data or `
+      + `application/x-www-form-urlencoded, and a "${enctype}" body is neither, so the `
+      + `bound action could never read it. Drop the formenctype attribute (WebJs emits `
+      + `multipart/form-data on a bound submitter).`,
     );
   }
 }
@@ -789,6 +752,87 @@ export function resolveBoundFormAttrs(method, enctype) {
   };
 }
 
+/**
+ * THE decision both renderers make about a bound SUBMITTER, in one place, the
+ * twin of `resolveBoundFormAttrs` (#1307).
+ *
+ * Sharing it is the point, for the same reason the form version is shared: SSR
+ * reaches it with the attributes parsed off the start tag it just emitted, the
+ * client reaches it with the values its template would have emitted, and the
+ * predicate is literally the same function.
+ *
+ * Returns what to INJECT for each attribute, or null to leave the author's own
+ * value alone. Throws when a value cannot submit at all.
+ *
+ * @param {string} tag lowercased owner tag, for the message
+ * @param {string | typeof ABSENT | null} formMethod
+ * @param {string | typeof ABSENT | null} formEnctype
+ * @returns {{ formMethod: string | null, formEnctype: string | null }}
+ */
+export function resolveBoundSubmitterAttrs(tag, formMethod, formEnctype) {
+  const hasMethod = formMethod !== ABSENT && formMethod != null;
+  const hasEnctype = formEnctype !== ABSENT && formEnctype != null;
+  assertSubmittableSubmitter(
+    tag,
+    hasMethod ? /** @type string */ (formMethod) : null,
+    hasEnctype ? /** @type string */ (formEnctype) : null,
+  );
+  return {
+    formMethod: hasMethod ? null : 'post',
+    formEnctype: hasEnctype ? null : 'multipart/form-data',
+  };
+}
+
+/**
+ * Rewrite a bound submitter's START TAG (#1307), the twin of
+ * `bindFormActionStartTag`.
+ *
+ * The identity was already written at the hole, in place of the `formaction=`
+ * the author spelled. What is added here is the REST of the submission, because
+ * only at the `>` is the whole start tag known and an attribute the author wrote
+ * AFTER the binding still counts:
+ *   - `formmethod="post"` when absent, so the submission carries a body whatever
+ *     the enclosing form declares, or fails to declare.
+ *   - `formenctype="multipart/form-data"` when absent, so a file input works on
+ *     the no-JS path.
+ *
+ * That pair is what makes the button self-sufficient, and it is the whole fix
+ * for #1307: the renderer no longer has to know anything about the enclosing
+ * form, so the cannot-tell case it could never resolve stops existing.
+ *
+ * No `formaction` is emitted. An empty url is an HTML conformance error, which
+ * is the same reason `bindFormActionStartTag` omits `action` rather than writing
+ * `action=""`. React does emit `formAction=""` here; WebJs deliberately does
+ * not. The consequence, stated so nobody rediscovers it: a bound submitter
+ * inside a form that declares its own `action="/x"` submits to `/x`. That is
+ * native precedence honoured, the author supplied a target at the form level and
+ * none on the button, and the action still RUNS there because the identity
+ * travels in the body. Leaving the form's `action` off, the ordinary shape,
+ * keeps the submission on the current page.
+ *
+ * @param {string} startTag the emitted start tag, ending in `>`
+ * @param {string} tag lowercased owner tag
+ * @param {{ duplicateAction?: boolean, propAttrs?: string[] }} shape
+ * @returns {string} the rewritten start tag
+ */
+export function bindSubmitterStartTag(startTag, tag, shape) {
+  assertSubmitterStartTag(startTag, tag, shape);
+  const attrs = parseStartTagAttrs(startTag);
+  const resolved = resolveBoundSubmitterAttrs(
+    tag,
+    attrs.has('formmethod') ? attrs.get('formmethod') : ABSENT,
+    attrs.has('formenctype') ? attrs.get('formenctype') : ABSENT,
+  );
+  // The close is `>` or `/>`; `<input>` is void and may be written either way,
+  // so keep whichever the author wrote.
+  const close = startTag.endsWith('/>') ? '/>' : '>';
+  const head = startTag.slice(0, startTag.length - close.length);
+  let inject = '';
+  if (resolved.formMethod !== null) inject += ` formmethod="${resolved.formMethod}"`;
+  if (resolved.formEnctype !== null) inject += ` formenctype="${resolved.formEnctype}"`;
+  return head + inject + close;
+}
+
 /**
  * The hidden field carrying a bound action's identity into the submission.
  * @param {string} id
@@ -863,18 +907,21 @@ export function reconcileFormAction(form, value, method, enctype, shape) {
  * the element, put there by whichever commit branch owns that hole, and is left
  * exactly as written.
  *
- * @param {Element} form
+ * Element-agnostic on purpose: a bound `<form>` reaches it for `method` /
+ * `enctype` and a bound submitter for `formmethod` / `formenctype` (#1307).
+ *
+ * @param {Element} el
  * @param {string} name
  * @param {string | typeof ABSENT} authored
  * @param {string | null} inject
  */
-function applyResolvedAttr(form, name, authored, inject) {
-  if (inject !== null) { form.setAttribute(name, inject); return; }
+export function applyResolvedAttr(el, name, authored, inject) {
+  if (inject !== null) { el.setAttribute(name, inject); return; }
   // The author's value is authoritative. It is already committed, except for a
   // hole whose value is empty, which some branches express by removing the
   // attribute; put it back so the DOM matches what SSR emitted.
-  if (authored !== ABSENT && form.getAttribute(name) !== authored) {
-    form.setAttribute(name, /** @type string */ (authored));
+  if (authored !== ABSENT && el.getAttribute(name) !== authored) {
+    el.setAttribute(name, /** @type string */ (authored));
   }
 }
 
@@ -926,11 +973,11 @@ function ensureIdentityField(form, id) {
  * because every input is an attribute the author may have written AFTER the
  * binding.
  *
- * Two callers, distinguished by `bound`:
- *   - `bound: true`, the tag carried a `formaction=${fn}` hole, so the full
- *     refusal set applies.
- *   - `bound: false`, an ordinary submitter inside a bound form, which is the
- *     Part B sweep and only looks at `formmethod` / `formenctype`.
+ * ONE caller shape since #1307: the tag carried a `formaction=${fn}` hole, so
+ * the full refusal set applies. The old `bound: false` sweep over every
+ * ordinary submitter inside a bound form is gone with Part B, because a plain
+ * button's own `formmethod` / `formenctype` is now a legal native override
+ * rather than a near-miss.
  *
  * `name` and `value` are judged by COUNT, not by value, because the renderer
  * has already injected its own pair by this point and a browser resolves a
@@ -938,101 +985,29 @@ function ensureIdentityField(form, id) {
  *
  * @param {string} startTag the emitted start tag, ending in `>`
  * @param {string} tag lowercased owner tag
- * @param {{ bound: boolean, duplicateAction?: boolean, propAttrs?: string[] }} shape
+ * @param {{ duplicateAction?: boolean, propAttrs?: string[] }} shape
  * @returns {void}
  */
 export function assertSubmitterStartTag(startTag, tag, shape) {
-  const bound = !!shape.bound;
   const attrs = parseStartTagAttrs(startTag);
   const type = attrs.has('type') ? attrs.get('type') : null;
 
-  // Gated on being a real submitter, because these properties reflect on any
-  // control: `<input .name=${'q'}>` is an ordinary field inside the form and
-  // has nothing to do with the action.
-  if (bound || isSubmitterType(tag, type)) assertConvergentSubmitter(shape.propAttrs, tag, bound);
-
-  if (bound) {
-    assertSingleSubmitterAction(!!shape.duplicateAction, tag);
-    if (attrs.has('formaction')) assertSubmitterHasNoStaticFormAction(tag);
-    if (countStartTagAttr(startTag, 'value') > 1) assertSubmitterHasNoValue(tag);
-    if (countStartTagAttr(startTag, 'name') > 1) {
-      // The renderer injected exactly one `name`, so a second is the author's.
-      // Falling back to FORM_ACTION_FIELD matters for an EMPTY author name
-      // (`name=${null}` emits `name=""`): the parse keeps the last duplicate, so
-      // reading the value back would find `''` and the guard would wave through
-      // a tag carrying two `name` attributes. A browser resolves that by keeping
-      // the FIRST, so whichever came first would silently win, and SSR would
-      // ship markup the client never produces.
-      assertSubmitterHasNoName(attrs.get('name') || FORM_ACTION_FIELD, tag, false);
-    }
-    assertSubmitterType(tag, type);
-    if (attrs.has('form')) assertSubmitterHasNoFormAttribute(tag);
-  } else if (!isSubmitterType(tag, type)) {
-    // `formmethod` / `formenctype` are inert on anything that does not submit,
-    // so a `<input type="text" formenctype="text/plain">` is not a near-miss.
-    return;
-  }
-
-  const formMethod = attrs.has('formmethod') ? attrs.get('formmethod') : null;
-  const formEnctype = attrs.has('formenctype') ? attrs.get('formenctype') : null;
-  if (formMethod == null && formEnctype == null) return;
-  assertSubmitterSubmission(tag, formMethod, formEnctype, {
-    bound,
-    retargeted: !bound && attrs.has('formaction'),
-  });
-}
-
-/**
- * Part B of #1207 on the CLIENT: sweep a bound form's submitters for a
- * `formmethod` / `formenctype` that would defeat the binding.
- *
- * SSR reaches the same rule a byte at a time as it emits each start tag inside
- * an open bound form. The client has no such stream, so it sweeps the form once
- * the binding is settled. Scoped to a bound form, which is rare on a page, so
- * the query cost is paid only where the rule applies.
- *
- * Runs AFTER every submitter in the pass has reconciled, which is what makes
- * `bound` and `retargeted` readable off the DOM: a bound submitter has had its
- * `formaction` removed and carries `name="__webjs_action"`, so a surviving
- * `formaction` attribute is the author's own static one.
- *
- * BEST EFFORT in the same sense as the enclosing-form check: a submitter living
- * in a nested template that has not been inserted yet is simply not in the
- * query, and SSR is the renderer that sees every page.
- *
- * ATTRIBUTE-BASED, which is a second limit worth stating. This reads the live
- * DOM, so it cannot see a divergence that exists only in the TEMPLATE: a
- * `.formMethod` / `.formEnctype` / `.formAction` PROPERTY on a submitter that
- * binds no action of its own is refused by SSR (`assertConvergentSubmitter`
- * runs there from the parsed start tag) and is invisible here, because the
- * client builds a record only for a submitter that owns an action hole. Worse
- * for `.formAction` specifically: a browser reflects it, so the query below
- * reads a `formaction` attribute and treats the button as deliberately
- * retargeted, skipping the check.
- *
- * Left as is on purpose. It is the server-strict direction, so the page never
- * ships: SSR renders every page and refuses the shape before a browser sees it.
- * The only way through is a component that renders ONLY on the client, and
- * closing it would mean building template records for submitters that bind
- * nothing, which is a wider change than the hole justifies. The reverse
- * asymmetry, client refusing what SSR accepts, is the one this module treats as
- * unacceptable, and none of these are that.
- *
- * @param {HTMLFormElement} form
- * @returns {void}
- */
-export function assertBoundFormSubmitters(form) {
-  for (const el of form.querySelectorAll('button, input')) {
-    const tag = el.localName;
-    if (!isSubmitterType(tag, el.getAttribute('type'))) continue;
-    const formMethod = el.getAttribute('formmethod');
-    const formEnctype = el.getAttribute('formenctype');
-    if (formMethod == null && formEnctype == null) continue;
-    assertSubmitterSubmission(tag, formMethod, formEnctype, {
-      bound: el.getAttribute('name') === FORM_ACTION_FIELD,
-      retargeted: el.hasAttribute('formaction'),
-    });
+  assertConvergentSubmitter(shape.propAttrs, tag);
+  assertSingleSubmitterAction(!!shape.duplicateAction, tag);
+  if (attrs.has('formaction')) assertSubmitterHasNoStaticFormAction(tag);
+  if (countStartTagAttr(startTag, 'value') > 1) assertSubmitterHasNoValue(tag);
+  if (countStartTagAttr(startTag, 'name') > 1) {
+    // The renderer injected exactly one `name`, so a second is the author's.
+    // Falling back to FORM_ACTION_FIELD matters for an EMPTY author name
+    // (`name=${null}` emits `name=""`): the parse keeps the last duplicate, so
+    // reading the value back would find `''` and the guard would wave through
+    // a tag carrying two `name` attributes. A browser resolves that by keeping
+    // the FIRST, so whichever came first would silently win, and SSR would
+    // ship markup the client never produces.
+    assertSubmitterHasNoName(attrs.get('name') || FORM_ACTION_FIELD, tag, false);
   }
+  assertSubmitterType(tag, type);
+  if (attrs.has('form')) assertSubmitterHasNoFormAttribute(tag);
 }
 
 /**
@@ -1090,6 +1065,32 @@ function releaseFormAction(form, method, enctype, propAttrs) {
   if (enctype === ABSENT && !owned('enctype')) form.removeAttribute('enctype');
 }
 
+/**
+ * The submitter twin of `releaseFormAction`'s attribute half (#1307).
+ *
+ * When a submitter's action hole stops resolving to an action, the `formmethod`
+ * / `formenctype` the framework supplied must come off with the identity, or a
+ * released button keeps attributes SSR does not emit for the same template.
+ *
+ * Recomputed rather than remembered, exactly as the form version is: an
+ * attribute is the framework's precisely when the template supplies nothing for
+ * it on THIS pass, so there is no bookkeeping to go stale. A `.formMethod` /
+ * `.formEnctype` PROPERTY binding is named rather than inferred for the same
+ * reason it is on a form: its write reflects to the content attribute but it is
+ * not an attribute part, so "the template supplies nothing" reads true and a
+ * blind removal would wipe the author's own value on every re-render.
+ *
+ * @param {Element} el
+ * @param {string | typeof ABSENT} formMethod
+ * @param {string | typeof ABSENT} formEnctype
+ * @param {string[] | undefined} propAttrs attribute names a property part owns
+ */
+export function releaseSubmitterAttrs(el, formMethod, formEnctype, propAttrs) {
+  const owned = (name) => (propAttrs || []).some((p) => String(p).toLowerCase() === name);
+  if (formMethod === ABSENT && !owned('formmethod')) el.removeAttribute('formmethod');
+  if (formEnctype === ABSENT && !owned('formenctype')) el.removeAttribute('formenctype');
+}
+
 /**
  * Parse the attributes of an emitted start tag into `name -> value`, where a
  * valueless attribute maps to the empty string.
diff --git a/packages/core/src/render-client.js b/packages/core/src/render-client.js
index 0613ef7e4..c2b8fa8e7 100644
--- a/packages/core/src/render-client.js
+++ b/packages/core/src/render-client.js
@@ -6,7 +6,7 @@ import {
   reconcileFormAction, isBoundFormAction, ABSENT, assertSubmitterHasNoName,
   assertSubmitterType, assertSubmitterHasNoValue, assertSubmitterHasNoStaticFormAction,
   assertSubmitterHasNoFormAttribute, assertSingleSubmitterAction,
-  assertSubmitterFormIsBound, assertSubmitterSubmission, assertBoundFormSubmitters,
+  resolveBoundSubmitterAttrs, applyResolvedAttr, releaseSubmitterAttrs,
   assertConvergentSubmitter, isSubmitterReflectedProp,
   formActionId, assertIdentifiableAction, FORM_ACTION_FIELD,
 } from './form-action.js';
@@ -104,14 +104,6 @@ function commitInto(node, fn) {
 
 /** @type {WeakMap<TemplateStringsArray | string[], { templateEl: HTMLTemplateElement, parts: PartDescriptor[], formActions: FormActionRecord[] | null }>} */
 const templateCache = new WeakMap();
-/**
- * Forms whose `action` hole currently holds a function (#1207). Read by a
- * submitter that reconciles before its form does, so it can tell a form that is
- * about to be bound from one that never will be. Keyed weakly so a detached
- * form is collected with its entry.
- * @type {WeakMap<HTMLFormElement, unknown>}
- */
-const formActionCandidates = new WeakMap();
 /**
  * Submitters this renderer stamped with an identity, so a later release removes
  * only the framework's own `name` / `value` and never an author's.
@@ -652,6 +644,11 @@ function assignPaths(root, parts) {
 function buildFormActionRecord(el, onEl, parts) {
   const isForm = el.localName === 'form';
   const targetAttr = isForm ? 'action' : 'formaction';
+  // The submission pair, named per element (#1307). A form declares `method` /
+  // `enctype`; a submitter declares `formmethod` / `formenctype`, and a bound
+  // one receives them from the renderer exactly as a bound form does.
+  const methodAttr = isForm ? 'method' : 'formmethod';
+  const enctypeAttr = isForm ? 'enctype' : 'formenctype';
   const actionParts = onEl.filter((p) => p.kind === 'attr' && p.name.toLowerCase() === targetAttr);
   if (!actionParts.length) return null;
 
@@ -697,7 +694,11 @@ function buildFormActionRecord(el, onEl, parts) {
       }
       continue;
     }
-    if (name !== 'method' && name !== 'enctype') continue;
+    // #1307: a bound submitter carries its OWN submission attributes, so the
+    // pair to capture depends on the element. `formmethod` / `formenctype` on a
+    // button are exactly what `method` / `enctype` are on a form, and they flow
+    // through the same resolution below untouched.
+    if (name !== methodAttr && name !== enctypeAttr) continue;
     if (p.kind !== 'attr' && p.kind !== 'attr-mixed' && p.kind !== 'bool') continue;
     const d = /** @type any */ (parts[p.idx]);
     /** @type {FormAttrPart} */
@@ -728,8 +729,8 @@ function buildFormActionRecord(el, onEl, parts) {
     propAttrs,
     nameParts,
     valueParts,
-    staticMethod: el.getAttribute('method'),
-    staticEnctype: el.getAttribute('enctype'),
+    staticMethod: el.getAttribute(methodAttr),
+    staticEnctype: el.getAttribute(enctypeAttr),
     methodParts,
     enctypeParts,
   };
@@ -754,8 +755,9 @@ function buildFormActionRecord(el, onEl, parts) {
  */
 function reconcileFormActions(formActions, bound, values) {
   if (!formActions) return;
-  /** @type {HTMLFormElement[]} */
-  const boundForms = [];
+  // Forms first, then submitters. The original motivation was a boundness read
+  // that is gone with #1307, but the ordering still makes a form's RELEASE run
+  // before its submitters reconcile, so it is kept rather than churned.
   for (const pass of [true, false]) {
     for (const rec of formActions) {
       if (rec.isForm !== pass) continue;
@@ -779,9 +781,6 @@ function reconcileFormActions(formActions, bound, values) {
           effectiveFormAttr(rec.enctypeParts, rec.staticEnctype, values),
           rec,
         );
-        if (typeof val === 'function' && formActionId(val)) {
-          boundForms.push(/** @type any */ (part.el));
-        }
       } else {
         // What SSR would have emitted for this pass. An attribute hole always
         // emits (even `name=${null}`, as `name=""`); a boolean hole emits only
@@ -791,14 +790,14 @@ function reconcileFormActions(formActions, bound, values) {
           ? !!resolveHoleValue(values[np.i])
           : true));
         reconcileSubmitterAction(
-          /** @type any */ (part.el), val, rec, emits(rec.nameParts), emits(rec.valueParts),
+          /** @type any */ (part.el), val, rec,
+          emits(rec.nameParts), emits(rec.valueParts),
+          effectiveFormAttr(rec.methodParts, rec.staticMethod, values),
+          effectiveFormAttr(rec.enctypeParts, rec.staticEnctype, values),
         );
       }
     }
   }
-  // Part B (#1207), last, because it reads the DOM state every reconcile above
-  // has finished writing. See `assertBoundFormSubmitters`.
-  for (const form of boundForms) assertBoundFormSubmitters(form);
 }
 
 /**
@@ -820,65 +819,47 @@ function releaseSubmitterAction(el) {
   submitterActionBindings.delete(el);
 }
 
-/**
- * Find the enclosing `<form>` by walking parents.
- *
- * Deliberately a parent walk rather than `closest('form')`: the element may
- * still be inside a detached DocumentFragment when this runs, and the walk
- * gives the same answer there for a form and a button in the same template.
- * Returns null when the fragment's root is reached, which is the honest answer
- * for a nested template whose form lives in the parent.
- *
- * @param {Element} el
- * @returns {HTMLFormElement | null}
- */
-function enclosingForm(el) {
-  let node = el.parentNode;
-  while (node) {
-    if (node.nodeType === 1 && /** @type {Element} */ (node).localName === 'form') {
-      return /** @type {HTMLFormElement} */ (node);
-    }
-    node = node.parentNode;
-  }
-  return null;
-}
-
 /**
  * Converge a live submitter on what SSR emitted for `<button formaction=${fn}>`
- * (#1207): the `formaction` attribute gone, and the identity in the button's
- * own `name` / `value` pair.
+ * (#1207, #1307): the `formaction` attribute gone, the identity in the button's
+ * own `name` / `value` pair, and the submission the framework supplies in its
+ * own `formmethod` / `formenctype`.
  *
- * The enclosing-form check is BEST EFFORT, and that is a deliberate asymmetry
- * with SSR rather than a gap. SSR reads a linear byte stream and always knows
- * whether the open form was bound, so it refuses an unbound one outright. The
- * client may be reconciling a fragment that is not in the tree yet (a submitter
- * inside a `repeat()` or an array item is built detached, by design, and its
- * form lives in the parent template), where the question has no answer. Asking
- * anyway and throwing on "no" would refuse the single most ordinary shape this
- * feature exists for, a per-row button in a list, on a page SSR renders
- * perfectly. So an UNRESOLVED form skips the assertion and the binding is
- * applied: the server is the renderer that sees every page, and a genuinely
- * unbound form is still refused there, loudly, before anything ships.
+ * There is no enclosing-form question here any more. It used to be the hard
+ * part of this function, asked once per element and BEST EFFORT because a
+ * fragment reconciling detached (a submitter inside a `repeat()` or an array
+ * item, whose form lives in the parent template) has no answer to give. With
+ * the submission attributes now on the button itself (#1307) the button needs
+ * nothing from the form, so the question stopped mattering and the whole
+ * asymmetry with SSR went with it.
  *
  * @param {Element} el
  * @param {unknown} value
  * @param {FormActionRecord} rec
  * @param {boolean} emitsName whether SSR would emit a `name` attribute this pass
  * @param {boolean} emitsValue whether SSR would emit a `value` attribute this pass
+ * @param {string | typeof ABSENT} authoredFormMethod what the template supplies for `formmethod`
+ * @param {string | typeof ABSENT} authoredFormEnctype what the template supplies for `formenctype`
  */
-function reconcileSubmitterAction(el, value, rec, emitsName, emitsValue) {
+function reconcileSubmitterAction(
+  el, value, rec, emitsName, emitsValue, authoredFormMethod, authoredFormEnctype,
+) {
   const id = typeof value === 'function' ? formActionId(value) : null;
   if (!id) {
     // A function that was MEANT as an action still refuses, so a button never
     // silently submits the form's action instead of its own.
     if (typeof value === 'function') assertIdentifiableAction(null, el.localName);
     releaseSubmitterAction(el);
+    // The submission attributes the framework supplied go with the identity, or
+    // a released button keeps a `formmethod` / `formenctype` SSR does not emit
+    // for the same template (#1307).
+    releaseSubmitterAttrs(el, authoredFormMethod, authoredFormEnctype, rec.propAttrs);
     return;
   }
   // Template-shaped refusals first, from the compiled record, because the live
   // element may already carry this renderer's own `name` / `value`.
   assertSingleSubmitterAction(rec.duplicateAction, el.localName);
-  assertConvergentSubmitter(rec.propAttrs, el.localName, true);
+  assertConvergentSubmitter(rec.propAttrs, el.localName);
   if (rec.staticAction) assertSubmitterHasNoStaticFormAction(el.localName);
   if (rec.authoredValue || emitsValue) assertSubmitterHasNoValue(el.localName);
   if (rec.authoredName || emitsName) {
@@ -892,32 +873,23 @@ function reconcileSubmitterAction(el, value, rec, emitsName, emitsValue) {
   if (rec.authoredForm || el.hasAttribute('form')) assertSubmitterHasNoFormAttribute(el.localName);
   assertSubmitterType(el.localName, el.getAttribute('type'));
 
-  const form = enclosingForm(el);
-  // Asked ONCE per element. The answer depends on whether this element happened
-  // to be in the tree when it reconciled, which differs between a first render
-  // (fragment still detached, so `enclosingForm` finds nothing and the check is
-  // skipped) and any later update (attached, so it resolves). Re-asking made the
-  // SAME template with the SAME values bind on first paint and then throw on an
-  // arbitrary later re-render, which is far worse to diagnose than a refusal at
-  // first paint. Skipping for an element already stamped can only REMOVE a
-  // throw, never add one, so it cannot refuse anything that used to render.
-  if (form && !submitterActionBindings.has(el)) {
-    // `formActionCandidates` covers the pass where the form's own action hole
-    // has committed but its reconcile has not run yet; the identity field is
-    // the settled answer, including for an SSR'd form on first hydration.
-    const isFormBound = !!(form.querySelector(`input[name="${FORM_ACTION_FIELD}"]`)
-      || formActionCandidates.has(form));
-    assertSubmitterFormIsBound(isFormBound, el.localName);
-  }
-  assertSubmitterSubmission(
-    el.localName,
-    el.getAttribute('formmethod'),
-    el.getAttribute('formenctype'),
-    { bound: true },
+  // The submission decision, made from the TEMPLATE rather than by reading the
+  // DOM back, exactly as `reconcileFormAction` makes it for a bound form. The
+  // distinction the DOM cannot preserve is the same one: `?formmethod=${false}`
+  // and `formmethod=${null}` both leave no attribute, and SSR resolves them to
+  // opposite answers.
+  const resolved = resolveBoundSubmitterAttrs(
+    el.localName, authoredFormMethod, authoredFormEnctype,
   );
   el.removeAttribute('formaction');
   el.setAttribute('name', FORM_ACTION_FIELD);
   el.setAttribute('value', id);
+  // AFTER the identity, matching SSR's byte order: the identity replaces the
+  // `formaction=` hole in place and the submission pair is appended at the `>`.
+  // The differential parity suite compares these two renderers byte for byte,
+  // so the order is part of the contract, not a detail.
+  applyResolvedAttr(el, 'formmethod', authoredFormMethod, resolved.formMethod);
+  applyResolvedAttr(el, 'formenctype', authoredFormEnctype, resolved.formEnctype);
   submitterActionBindings.set(el, id);
 }
 
@@ -1180,17 +1152,6 @@ function applyPart(part, value, _prev, allValues) {
       applyChild(part, value);
       break;
     case 'attr': {
-      // #1207: note a form whose action hole holds a function, so a submitter
-      // reconciling BEFORE that form's own reconcile can still tell the form is
-      // going to be bound. Recorded at commit time because that is the only
-      // moment the hole's value is in hand for a form the submitter does not
-      // own. Cleared on a non-function so a form that stops being bound does
-      // not keep vouching for its buttons.
-      if (part.el.localName === 'form' && part.name.toLowerCase() === 'action') {
-        const candidate = resolveHoleValue(value);
-        if (typeof candidate === 'function') formActionCandidates.set(part.el, candidate);
-        else formActionCandidates.delete(part.el);
-      }
       if (value == null || value === false) part.el.removeAttribute(part.name);
       else if (isBoundFormAction(value, part.name, part.el.localName)) {
         // #1155: the ONE supported form-action binding, applied to the live
diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index 64f1b0f14..ef47b7294 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -5,8 +5,8 @@ import {
   assertNotFunctionActionAttr, assertNotFunctionReflectedActionProp,
   assertIdentifiableAction, bindFormActionStartTag, isBoundFormAction, resolveFormActionId,
   assertConvergentBoundForm, assertSubmitterHasNoName, assertSubmitterHasNoValue,
-  assertSubmitterFormIsBound, assertSubmitterHasNoFormAttribute,
-  assertSingleSubmitterAction, assertSubmitterStartTag, parseStartTagAttrs,
+  assertSubmitterHasNoFormAttribute,
+  assertSingleSubmitterAction, bindSubmitterStartTag, parseStartTagAttrs,
   isSubmitterReflectedProp, FORM_ACTION_FIELD,
 } from './form-action.js';
 import { lookup, lookupModuleUrl, allTags } from './registry.js';
@@ -31,19 +31,18 @@ import { cspNonce } from './csp-nonce.js';
  * Suspense still works but we fall back to emitting only the fallback
  * (the promise is dropped: appropriate for static pre-render).
  *
- * @typedef {{ pending: {id: string, promise: Promise<unknown>, formScope?: 'none'|'unbound'|'bound'|'unknown'}[], nextId: number }} SuspenseCtx
+ * @typedef {{ pending: {id: string, promise: Promise<unknown>}[], nextId: number }} SuspenseCtx
  *
- * `formScope` (#1207) is how a caller that resolves a Suspense boundary ITSELF
- * tells this render what the boundary's surroundings were. The page pipeline in
- * `@webjsdev/server` drains `ctx.pending` and re-renders each resolved child
- * through here, which is a fresh scan with no view of the shell it belongs to,
- * so without the recorded scope a `<button formaction=${fn}>` inside a bound
- * form's Suspense boundary reads as form-less and is refused. That refusal is
- * caught and replaced by the empty string in production, so the whole boundary
- * would silently disappear from a page that still returned 200.
+ * A boundary's enclosing form scope used to be recorded here and threaded back
+ * in (#1207), because the page pipeline in `@webjsdev/server` drains
+ * `ctx.pending` and re-renders each resolved child through a FRESH scan with no
+ * view of the shell it belongs to, so a `<button formaction=${fn}>` inside a
+ * bound form's Suspense boundary read as form-less and was refused. Gone with
+ * #1307: a bound submitter carries its own `formmethod` and enctype, so no
+ * renderer needs to know what encloses it and there is nothing left to thread.
  *
  * @param {unknown} value
- * @param {{ ssr?: boolean, suspenseCtx?: SuspenseCtx, dev?: boolean, formScope?: 'none'|'unbound'|'bound'|'unknown' }} [opts]
+ * @param {{ ssr?: boolean, suspenseCtx?: SuspenseCtx, dev?: boolean }} [opts]
  * @returns {Promise<string>}
  */
 export async function renderToString(value, opts = { ssr: true }) {
@@ -54,23 +53,20 @@ export async function renderToString(value, opts = { ssr: true }) {
   // sharing it see the same flag. Undefined stays undefined (NODE_ENV fallback).
   const dev = opts && opts.dev !== undefined ? opts.dev : ctx && ctx.dev;
   if (ctx && ctx.dev === undefined && dev !== undefined) ctx.dev = dev;
-  // A caller that knows the scope passes it. Absent, this is a top-level render
-  // and 'none' is the honest answer: there is conclusively no enclosing form.
-  const html = await render(value, ctx, (opts && opts.formScope) || 'none');
+  const html = await render(value, ctx);
   return opts && opts.ssr === false ? html : await injectDSD(html, ctx, [], dev);
 }
 
 /**
  * @param {unknown} value
  * @param {SuspenseCtx} [ctx]
- * @param {'none'|'unbound'|'bound'|'unknown'} [formScope] enclosing form scope, as seen from THIS scan
  * @returns {Promise<string>}
  */
-async function render(value, ctx, formScope = 'none') {
+async function render(value, ctx) {
   if (value == null || value === false || value === true) return '';
   if (value && typeof /** @type any */ (value).then === 'function') {
     value = await value;
-    return render(value, ctx, formScope);
+    return render(value, ctx);
   }
   // unsafeHTML: inject raw HTML string without escaping.
   if (isUnsafeHTML(value)) {
@@ -78,21 +74,21 @@ async function render(value, ctx, formScope = 'none') {
   }
   // live() on the server just unwraps and renders the inner value.
   if (isLive(value)) {
-    return render(/** @type any */ (value).value, ctx, formScope);
+    return render(/** @type any */ (value).value, ctx);
   }
   // watch() on the server reads the signal once and inlines the
   // result. Subscription is a client-only concern; the SSR HTML
   // freezes a snapshot of the current value.
   if (isWatch(value)) {
-    return render(/** @type any */ (value).signal.get(), ctx, formScope);
+    return render(/** @type any */ (value).signal.get(), ctx);
   }
   // keyed() on the server: render the wrapped template; key is client-only.
   if (isKeyed(value)) {
-    return render(/** @type any */ (value).value, ctx, formScope);
+    return render(/** @type any */ (value).value, ctx);
   }
   // guard() on the server: always invoke the value function (no cache on SSR).
   if (isGuard(value)) {
-    return render(/** @type any */ (value).fn(), ctx, formScope);
+    return render(/** @type any */ (value).fn(), ctx);
   }
   // templateContent() on the server: emit the template's innerHTML verbatim.
   if (isTemplateContent(value)) {
@@ -105,7 +101,7 @@ async function render(value, ctx, formScope = 'none') {
   }
   // cache() on the server: pass-through to the inner value.
   if (isCache(value)) {
-    return render(/** @type any */ (value).value, ctx, formScope);
+    return render(/** @type any */ (value).value, ctx);
   }
   // until() on the server: render the first synchronous candidate, or
   // await the first Promise to settle when all candidates are Promises.
@@ -115,13 +111,13 @@ async function render(value, ctx, formScope = 'none') {
     const args = /** @type any */ (value).args;
     for (const a of args) {
       if (!a || typeof (/** @type any */ (a).then) !== 'function') {
-        return render(a, ctx, formScope);
+        return render(a, ctx);
       }
     }
     if (args.length > 0) {
       try {
         const winner = await Promise.race(args.map((p) => Promise.resolve(p).catch(() => undefined)));
-        return render(winner, ctx, formScope);
+        return render(winner, ctx);
       } catch {
         return '';
       }
@@ -134,35 +130,34 @@ async function render(value, ctx, formScope = 'none') {
     return '';
   }
   if (Array.isArray(value)) {
-    const parts = await Promise.all(value.map((v) => render(v, ctx, formScope)));
+    const parts = await Promise.all(value.map((v) => render(v, ctx)));
     return parts.join('');
   }
   if (isRepeat(value)) {
     const r = /** @type any */ (value);
-    const parts = await Promise.all(r.items.map((it, i) => render(r.templateFn(it, i), ctx, formScope)));
+    const parts = await Promise.all(r.items.map((it, i) => render(r.templateFn(it, i), ctx)));
     return parts.join('');
   }
   if (isSuspense(value)) {
     const s = /** @type any */ (value);
-    const fallback = await render(s.fallback, ctx, formScope);
+    const fallback = await render(s.fallback, ctx);
     if (ctx) {
       const id = `s${ctx.nextId++}`;
-      ctx.pending.push({ id, promise: Promise.resolve(s.children), formScope });
+      ctx.pending.push({ id, promise: Promise.resolve(s.children) });
       return `<webjs-boundary id="${id}">${fallback}</webjs-boundary>`;
     }
     return fallback;
   }
-  if (isTemplate(value)) return renderTemplate(/** @type any */ (value), ctx, formScope);
+  if (isTemplate(value)) return renderTemplate(/** @type any */ (value), ctx);
   return escapeText(String(value));
 }
 
 /**
  * @param {import('./html.js').TemplateResult} tr
  * @param {SuspenseCtx} [ctx]
- * @param {'none'|'unbound'|'bound'|'unknown'} [formScopeAtStart]
  * @returns {Promise<string>}
  */
-async function renderTemplate(tr, ctx, formScopeAtStart = 'none') {
+async function renderTemplate(tr, ctx) {
   const { strings, values } = tr;
   let out = '';
   let state = 'text';
@@ -202,9 +197,6 @@ async function renderTemplate(tr, ctx, formScopeAtStart = 'none') {
   // and for the same reason. A top-level scan that simply contains no form
   // stays 'none' and is still refused, because there the answer IS known.
   //
-  // Seeded from the caller so a nested template rendered into a form's children
-  // inherits the scope, since each template is its own scan.
-  let formScope = formScopeAtStart;
   let isCloseTag = false;
 
   // A bound `action=${fn}` is committed at its hole, but the edits it implies
@@ -229,21 +221,15 @@ async function renderTemplate(tr, ctx, formScopeAtStart = 'none') {
       const bound = bindFormActionStartTag(out.slice(tagStart), pendingActionId);
       out = out.slice(0, tagStart) + bound.tag + bound.hidden;
       pendingActionId = null;
-      formScope = 'bound';
     }
-    // A form that opened and bound NOTHING still opens a scope: a submitter
-    // inside it must be refused, which is a different answer from 'none'.
-    if (!isCloseTag && currentTag === 'form' && formScope !== 'bound') formScope = 'unbound';
     if (submitterTag != null) {
-      assertSubmitterStartTag(out.slice(tagStart), submitterTag, { bound: true, duplicateAction, propAttrs: submitterProps });
-    } else if (formScope === 'bound' && !isCloseTag && (currentTag === 'button' || currentTag === 'input')) {
-      // Part B (#1207): an ordinary submitter inside a bound form, whose own
-      // `formmethod` / `formenctype` can defeat the binding without carrying an
-      // action of its own. Neither renderer used to look at those. Gated on
-      // 'bound' because that is the only scope in which the sweep has anything
-      // to protect: under 'unknown' the enclosing form is not this scan's to
-      // judge, and under 'none' / 'unbound' there is no binding to defeat.
-      assertSubmitterStartTag(out.slice(tagStart), currentTag, { bound: false, propAttrs: submitterProps });
+      // #1307: a bound submitter carries its WHOLE submission, so `formmethod`
+      // and the enctype are injected onto the button here rather than inherited
+      // from a form this scan may not even be able to see. That is what removed
+      // the enclosing-form question, and with it the four-state scope tracking
+      // that could never answer it for a button inside a component.
+      out = out.slice(0, tagStart)
+        + bindSubmitterStartTag(out.slice(tagStart), submitterTag, { duplicateAction, propAttrs: submitterProps });
     }
   };
   // #1155: a `.method` / `.enctype` / `.encoding` prop on a form is dropped
@@ -275,8 +261,7 @@ async function renderTemplate(tr, ctx, formScopeAtStart = 'none') {
   };
 
   // Every `>` in a tag state funnels through here, so the bound-form bookkeeping
-  // stays in one place rather than at five call sites. `</form>` closes the form
-  // scope: a submitter after it is outside.
+  // stays in one place rather than at five call sites.
   //
   // `allowRawtext` is NOT a preference. Only two of those five call sites ever
   // entered rawtext: the `tag-name` and `in-tag` exits. The three attribute
@@ -289,14 +274,6 @@ async function renderTemplate(tr, ctx, formScopeAtStart = 'none') {
   // question from #1207; this preserves it exactly.
   const handleTagEnd = (allowRawtext) => {
     closeBoundFormTag();
-    if (isCloseTag && currentTag === 'form') {
-      // Back to the scope this scan STARTED in, not a flat 'none'. Under an
-      // 'unknown' seed (the component pass) the scan never learned whether the
-      // host page has a bound form, and closing a form of its own teaches it
-      // nothing about that, so asserting 'none' here would downgrade a
-      // cannot-tell into a conclusive refusal.
-      formScope = formScopeAtStart === 'unknown' ? 'unknown' : 'none';
-    }
     isCloseTag = false;
     state = allowRawtext && isRawtextTag(currentTag) ? 'rawtext' : 'text';
     if (state === 'rawtext') rawTail = '';
@@ -401,7 +378,7 @@ async function renderTemplate(tr, ctx, formScopeAtStart = 'none') {
         out += String(val ?? '');
         rawTail = '';
       } else if (state === 'text') {
-        out += await render(val, ctx, formScope);
+        out += await render(val, ctx);
       } else if (state === 'after-eq') {
         const prefix = attrName[0];
         const name = attrName.slice(1);
@@ -430,7 +407,7 @@ async function renderTemplate(tr, ctx, formScopeAtStart = 'none') {
           // fallback to HTML now and carry it as data-webjs-fallback, which the
           // injectDSD streaming pre-pass reads as the boundary placeholder.
           if (currentTag === 'webjs-suspense' && name === 'fallback') {
-            const fbHtml = await render(val, ctx, formScope);
+            const fbHtml = await render(val, ctx);
             out += `data-webjs-fallback="${escapeAttr(fbHtml)}"`;
             state = 'in-tag';
             attrName = '';
@@ -516,11 +493,6 @@ async function renderTemplate(tr, ctx, formScopeAtStart = 'none') {
             // author gets the duplicate message rather than a confusing
             // complaint about the `name` the FIRST hole just injected.
             assertSingleSubmitterAction(pendingSubmitterTag != null, currentTag);
-            // Only 'unknown' defers: a component renders its own template in a
-            // separate pass that cannot see the enclosing form, so the question
-            // is not this scan's to answer. 'none' and 'unbound' are known
-            // answers and are still refused.
-            if (formScope !== 'unknown') assertSubmitterFormIsBound(formScope === 'bound', currentTag);
             const attrs = parseStartTagAttrs(out.slice(tagStart));
             if (attrs.has('name')) assertSubmitterHasNoName(attrs.get('name') || '', currentTag, false);
             if (attrs.has('value')) assertSubmitterHasNoValue(currentTag);
@@ -1889,29 +1861,28 @@ export function renderToStream(value, opts = { ssr: true }) {
  * @param {unknown} value
  * @param {SuspenseCtx} [ctx]
  * @param {ReadableStreamDefaultController<string>} controller
- * @param {'none'|'unbound'|'bound'|'unknown'} [formScope] enclosing form scope, as seen from THIS scan
  */
-async function streamRender(value, ctx, controller, formScope = 'none') {
+async function streamRender(value, ctx, controller) {
   if (value == null || value === false || value === true) return;
   if (value && typeof /** @type any */ (value).then === 'function') {
     value = await value;
-    return streamRender(value, ctx, controller, formScope);
+    return streamRender(value, ctx, controller);
   }
   if (isUnsafeHTML(value)) {
     controller.enqueue(String(/** @type any */ (value).value ?? ''));
     return;
   }
   if (isLive(value)) {
-    return streamRender(/** @type any */ (value).value, ctx, controller, formScope);
+    return streamRender(/** @type any */ (value).value, ctx, controller);
   }
   if (isWatch(value)) {
-    return streamRender(/** @type any */ (value).signal.get(), ctx, controller, formScope);
+    return streamRender(/** @type any */ (value).signal.get(), ctx, controller);
   }
   if (isKeyed(value)) {
-    return streamRender(/** @type any */ (value).value, ctx, controller, formScope);
+    return streamRender(/** @type any */ (value).value, ctx, controller);
   }
   if (isGuard(value)) {
-    return streamRender(/** @type any */ (value).fn(), ctx, controller, formScope);
+    return streamRender(/** @type any */ (value).fn(), ctx, controller);
   }
   if (isTemplateContent(value)) {
     const tpl = /** @type any */ (value).template;
@@ -1922,19 +1893,19 @@ async function streamRender(value, ctx, controller, formScope = 'none') {
     return;
   }
   if (isCache(value)) {
-    return streamRender(/** @type any */ (value).value, ctx, controller, formScope);
+    return streamRender(/** @type any */ (value).value, ctx, controller);
   }
   if (isUntil(value)) {
     const args = /** @type any */ (value).args;
     for (const a of args) {
       if (!a || typeof (/** @type any */ (a).then) !== 'function') {
-        return streamRender(a, ctx, controller, formScope);
+        return streamRender(a, ctx, controller);
       }
     }
     if (args.length > 0) {
       try {
         const winner = await Promise.race(args.map((p) => Promise.resolve(p).catch(() => undefined)));
-        return streamRender(winner, ctx, controller, formScope);
+        return streamRender(winner, ctx, controller);
       } catch {
         return;
       }
@@ -1945,13 +1916,13 @@ async function streamRender(value, ctx, controller, formScope = 'none') {
     return;
   }
   if (Array.isArray(value)) {
-    for (const v of value) await streamRender(v, ctx, controller, formScope);
+    for (const v of value) await streamRender(v, ctx, controller);
     return;
   }
   if (isRepeat(value)) {
     const r = /** @type any */ (value);
     for (let i = 0; i < r.items.length; i++) {
-      await streamRender(r.templateFn(r.items[i], i), ctx, controller, formScope);
+      await streamRender(r.templateFn(r.items[i], i), ctx, controller);
     }
     return;
   }
@@ -1960,16 +1931,16 @@ async function streamRender(value, ctx, controller, formScope = 'none') {
     if (ctx) {
       const id = `s${ctx.nextId++}`;
       controller.enqueue(`<webjs-boundary id="${id}">`);
-      await streamRender(s.fallback, ctx, controller, formScope);
+      await streamRender(s.fallback, ctx, controller);
       controller.enqueue(`</webjs-boundary>`);
-      ctx.pending.push({ id, promise: Promise.resolve(s.children), formScope });
+      ctx.pending.push({ id, promise: Promise.resolve(s.children) });
     } else {
-      await streamRender(s.fallback, ctx, controller, formScope);
+      await streamRender(s.fallback, ctx, controller);
     }
     return;
   }
   if (isTemplate(value)) {
-    await streamTemplate(/** @type any */ (value), ctx, controller, formScope);
+    await streamTemplate(/** @type any */ (value), ctx, controller);
     return;
   }
   controller.enqueue(escapeText(String(value)));
@@ -1982,9 +1953,8 @@ async function streamRender(value, ctx, controller, formScope = 'none') {
  * @param {import('./html.js').TemplateResult} tr
  * @param {SuspenseCtx} [ctx]
  * @param {ReadableStreamDefaultController<string>} controller
- * @param {'none'|'unbound'|'bound'|'unknown'} [formScopeAtStart]
  */
-async function streamTemplate(tr, ctx, controller, formScopeAtStart = 'none') {
+async function streamTemplate(tr, ctx, controller) {
   const { strings, values } = tr;
   let state = 'text';
   let attrName = '';
@@ -2010,7 +1980,6 @@ async function streamTemplate(tr, ctx, controller, formScopeAtStart = 'none') {
   let pendingSubmitterTag = null;  // tag of a bound submitter, until it closes
   // See the buffered machine: seeded from the caller so a nested template
   // rendered into a bound form's children knows it is inside one.
-  let formScope = formScopeAtStart;
   let isCloseTag = false;
 
   // See the buffered machine for why this runs at the `>` rather than at the
@@ -2032,17 +2001,12 @@ async function streamTemplate(tr, ctx, controller, formScopeAtStart = 'none') {
       const bound = bindFormActionStartTag(buf.slice(tagStart), pendingActionId);
       buf = buf.slice(0, tagStart) + bound.tag + bound.hidden;
       pendingActionId = null;
-      formScope = 'bound';
     }
-    // A form that opened and bound NOTHING still opens a scope: a submitter
-    // inside it must be refused, which is a different answer from 'none'.
-    if (!isCloseTag && currentTag === 'form' && formScope !== 'bound') formScope = 'unbound';
     if (submitterTag != null) {
-      assertSubmitterStartTag(buf.slice(tagStart), submitterTag, { bound: true, duplicateAction, propAttrs: submitterProps });
-    } else if (formScope === 'bound' && !isCloseTag && (currentTag === 'button' || currentTag === 'input')) {
-      // Part B (#1207), the SAME sweep as the buffered machine, through the
-      // same helper, so this second state machine cannot drift from it.
-      assertSubmitterStartTag(buf.slice(tagStart), currentTag, { bound: false, propAttrs: submitterProps });
+      // #1307, the SAME injection as the buffered machine, through the same
+      // helper, so this second state machine cannot drift from it.
+      buf = buf.slice(0, tagStart)
+        + bindSubmitterStartTag(buf.slice(tagStart), submitterTag, { duplicateAction, propAttrs: submitterProps });
     }
   };
   // #1155: a `.method` / `.enctype` / `.encoding` prop on a form is dropped
@@ -2078,14 +2042,6 @@ async function streamTemplate(tr, ctx, controller, formScopeAtStart = 'none') {
   // tag ending on a bare or unquoted attribute must keep escaping its body.
   const handleTagEnd = (allowRawtext) => {
     closeBoundFormTag();
-    if (isCloseTag && currentTag === 'form') {
-      // Back to the scope this scan STARTED in, not a flat 'none'. Under an
-      // 'unknown' seed (the component pass) the scan never learned whether the
-      // host page has a bound form, and closing a form of its own teaches it
-      // nothing about that, so asserting 'none' here would downgrade a
-      // cannot-tell into a conclusive refusal.
-      formScope = formScopeAtStart === 'unknown' ? 'unknown' : 'none';
-    }
     isCloseTag = false;
     state = allowRawtext && isRawtextTag(currentTag) ? 'rawtext' : 'text';
     if (state === 'rawtext') rawTail = '';
@@ -2189,7 +2145,7 @@ async function streamTemplate(tr, ctx, controller, formScopeAtStart = 'none') {
       } else if (state === 'text') {
         // Flush the buffered static content before streaming the value.
         if (buf) { controller.enqueue(buf); buf = ''; }
-        await streamRender(val, ctx, controller, formScope);
+        await streamRender(val, ctx, controller);
       } else if (state === 'after-eq') {
         const prefix = attrName[0];
         const name = attrName.slice(1);
@@ -2246,11 +2202,6 @@ async function streamTemplate(tr, ctx, controller, formScopeAtStart = 'none') {
             buf = buf.slice(0, attrStart).replace(/\s+$/, '');
           } else {
             assertSingleSubmitterAction(pendingSubmitterTag != null, currentTag);
-            // Only 'unknown' defers: a component renders its own template in a
-            // separate pass that cannot see the enclosing form, so the question
-            // is not this scan's to answer. 'none' and 'unbound' are known
-            // answers and are still refused.
-            if (formScope !== 'unknown') assertSubmitterFormIsBound(formScope === 'bound', currentTag);
             const attrs = parseStartTagAttrs(buf.slice(tagStart));
             if (attrs.has('name')) assertSubmitterHasNoName(attrs.get('name') || '', currentTag, false);
             if (attrs.has('value')) assertSubmitterHasNoValue(currentTag);
@@ -2306,10 +2257,10 @@ async function streamSuspenseBoundaries(ctx, controller, dev) {
   while (ctx.pending.length) {
     const batch = ctx.pending.splice(0);
     await Promise.all(
-      batch.map(async ({ id, promise, formScope }) => {
+      batch.map(async ({ id, promise }) => {
         try {
           const resolved = await promise;
-          const html = await render(resolved, ctx, formScope);
+          const html = await render(resolved, ctx);
           const full = await injectDSD(html, ctx, [], dev);
           controller.enqueue(
             `<template data-webjs-resolve="${id}">${full}</template>` +
diff --git a/packages/core/test/rendering/browser/ssr-client-parity.test.js b/packages/core/test/rendering/browser/ssr-client-parity.test.js
index 0b952f618..53d325bea 100644
--- a/packages/core/test/rendering/browser/ssr-client-parity.test.js
+++ b/packages/core/test/rendering/browser/ssr-client-parity.test.js
@@ -411,6 +411,22 @@ suite('SSR/client parity: form actions (#1155)', () => {
     'inert encoding= attribute': () => html`<form action=${boundAction()} encoding=${'application/x-www-form-urlencoded'}></form>`,
     'inert encoding= with an unsubmittable value': () => html`<form action=${boundAction()} encoding=${'text/plain'}></form>`,
     'submitter formaction inside bound form': () => html`<form action=${boundAction()}><button formaction=${boundAction()}>Save</button></form>`,
+    // #1307: a bound submitter carries its whole submission, so none of these
+    // depend on the form around it. Each moved here from a refusal table, and
+    // each must render IDENTICALLY on both renderers, which is what proves the
+    // two inject the same `formmethod` / `formenctype` pair in the same order.
+    'submitter with no form at all': () => html`<button formaction=${boundAction()}>Save</button>`,
+    'submitter inside an unbound form': () => html`<form method="post"><button formaction=${boundAction()}>Save</button></form>`,
+    'submitter inside a form with no method at all': () => html`<form><button formaction=${boundAction()}>Save</button></form>`,
+    'submitter inside a method=get form': () => html`<form method="get"><button formaction=${boundAction()}>Save</button></form>`,
+    // The author's own value wins; only the attribute they did NOT supply is
+    // injected. Both renderers make that call through `resolveBoundSubmitterAttrs`.
+    'bound submitter supplying its own formmethod': () => html`<button formaction=${boundAction()} formmethod="post">Save</button>`,
+    'bound submitter supplying its own formenctype': () => html`<button formaction=${boundAction()} formenctype="application/x-www-form-urlencoded">Save</button>`,
+    // #1307 reverses #1207's Part B: a PLAIN button's own override is a legal
+    // native instruction, so both renderers leave it exactly as written.
+    'plain submitter formmethod=get inside a bound form': () => html`<form action=${boundAction()}><button formmethod="get">Save</button></form>`,
+    'plain submitter formenctype=text/plain inside a bound form': () => html`<form action=${boundAction()}><button formenctype="text/plain">Save</button></form>`,
   };
 
   for (const [name, tpl] of Object.entries(ACCEPTS)) {
@@ -434,12 +450,6 @@ suite('SSR/client parity: form actions (#1155)', () => {
     'quoted action hole is a stringify': [() => html`<form action="${boundAction()}"></form>`, /interpolated into/],
     'array-wrapped action': [() => html`<form action=${[boundAction()]}></form>`, /interpolated into/],
     'action off a form': [() => html`<div action=${boundAction()}></div>`, /interpolated into/],
-    // #1207: the submitter's form is RIGHT THERE in the same template, so both
-    // renderers can see it is unbound and both must say so.
-    'submitter inside an unbound form': [
-      () => html`<form method="post"><button formaction=${boundAction()}></button></form>`,
-      /requires the enclosing <form> to also be bound/,
-    ],
     'submitter that is not a submit control': [
       () => html`<form action=${boundAction()}><button type="button" formaction=${boundAction()}></button></form>`,
       /submitter control/,
@@ -448,16 +458,30 @@ suite('SSR/client parity: form actions (#1155)', () => {
       () => html`<form action=${boundAction()}><button name="intent" formaction=${boundAction()}></button></form>`,
       /already carries a "name" attribute/,
     ],
-    // #1207 Part B: a submitter that binds nothing, whose own formenctype would
-    // still defeat the bound form it sits in.
-    'unparseable submitter enctype': [
-      () => html`<form action=${boundAction()}><button formenctype="text/plain"></button></form>`,
+    // #1307: same-element contradictions on a BOUND submitter. These replace
+    // #1207's Part B rows, which asked about the button's NEIGHBOUR and are now
+    // in ACCEPTS. Here the author bound an action to this very button and then
+    // told the same button to submit in a way that action could never read.
+    'unparseable enctype on a BOUND submitter': [
+      () => html`<button formaction=${boundAction()} formenctype="text/plain"></button>`,
       /formenctype=/,
     ],
-    'non-POST submitter method': [
-      () => html`<form action=${boundAction()}><button formmethod="get"></button></form>`,
+    'non-POST method on a BOUND submitter': [
+      () => html`<button formaction=${boundAction()} formmethod="get"></button>`,
       /formmethod=/,
     ],
+    'dialog method on a BOUND submitter': [
+      () => html`<button formaction=${boundAction()} formmethod="dialog"></button>`,
+      /formmethod="dialog"/,
+    ],
+    'padded formmethod on a BOUND submitter': [
+      () => html`<button formaction=${boundAction()} formmethod=${' post '}></button>`,
+      /cannot work/,
+    ],
+    'prop binding on a BOUND submitter': [
+      () => html`<button formaction=${boundAction()} .formMethod=${'get'}></button>`,
+      /reflected IDL attribute/,
+    ],
     'a function that is not an action': [() => html`<form action=${async () => {}}></form>`, /is not a server action/],
     'prop binding on a bound form': [() => html`<form action=${boundAction()} .method=${'get'}></form>`, /also binds \./],
     'two action holes': [() => html`<form action=${boundAction()} action=${'/legacy'}></form>`, /two action=/],
@@ -488,41 +512,25 @@ suite('SSR/client parity: form actions (#1155)', () => {
   }
 
   /**
-   * The ONE asymmetry in #1207, stated here rather than left to be discovered.
+   * There is deliberately NO third table here any more.
    *
-   * "Is my enclosing form bound" is a question SSR always answers and the client
-   * sometimes cannot. SSR reads a linear byte stream, so an open `<form>` either
-   * bound an action or did not. The client reconciles a template whose root may
-   * be a DocumentFragment that is not in the tree yet, and a submitter with no
-   * form ABOVE IT IN ITS OWN TEMPLATE is genuinely ambiguous there: it looks
-   * identical whether it is a stray button or a list row about to be inserted
-   * into a bound form by its parent. Those two are indistinguishable at that
-   * moment, and the list row is the shape the whole feature exists for.
+   * #1207 had one, holding a single row: a `formaction=${fn}` submitter with no
+   * enclosing form. "Is my enclosing form bound" was a question SSR always
+   * answered and the client sometimes could not, because the client reconciles
+   * a template whose root may be a DocumentFragment not yet in the tree, where a
+   * stray button and a list row about to be inserted into a bound form look
+   * identical. So SSR refused and the client deferred, and that asymmetry was
+   * documented here as permanent.
    *
-   * So the client BINDS when it cannot tell, and SSR refuses. The asymmetry is
-   * safe in that direction and only in that direction: the server renders every
-   * page, so a genuinely form-less submitter is still refused loudly before
-   * anything ships. The reverse (client refuses, SSR accepts) is what would
-   * render a page on the server and crash it on hydration.
+   * #1307 removed the question rather than the asymmetry. A bound submitter now
+   * carries its own `formmethod` and `formenctype`, so no renderer needs to know
+   * what encloses it, and the row moved to ACCEPTS where both renderers must now
+   * produce identical bytes for it.
+   *
+   * Keep this table absent. A new "SSR refuses, client defers" entry is a signal
+   * that a cross-element rule has crept back in, which is exactly the shape both
+   * issues concluded cannot be enforced honestly.
    */
-  const SSR_ONLY_REFUSES = {
-    'submitter with no form at all': [
-      () => html`<button formaction=${boundAction()}></button>`,
-      /requires the enclosing <form> to also be bound/,
-    ],
-  };
-
-  for (const [name, [tpl, pattern]] of Object.entries(SSR_ONLY_REFUSES)) {
-    test(`SSR refuses, client defers: ${name}`, async () => {
-      const r = await bothWays(tpl);
-      assert.ok(r.ssrErr, `SSR must refuse: ${name}`);
-      assert.ok(pattern.test(r.ssrErr), `SSR reason (${r.ssrErr})`);
-      assert.ok(!r.clientErr, `client must NOT refuse what it cannot know: ${name} (${r.clientErr})`);
-      // Deferring the question must not defer the LEAK guard: the client still
-      // binds an identity rather than stringifying the function.
-      assert.ok(!/PARITY_SECRET/.test(String(r.ssrErr) + String(r.client)), 'no source on either path');
-    });
-  }
 
   test('the identity field is submitted, which is what all of this is for', () => {
     // The end state, read the way a browser reads it: `new FormData(form)` is
diff --git a/packages/core/test/rendering/form-action-attr-guard.test.js b/packages/core/test/rendering/form-action-attr-guard.test.js
index dc10c4662..9b03a4926 100644
--- a/packages/core/test/rendering/form-action-attr-guard.test.js
+++ b/packages/core/test/rendering/form-action-attr-guard.test.js
@@ -152,16 +152,19 @@ test('mixed hole action="/x/${fn}" throws', async () => {
 });
 
 test('formaction=${fn} on a submit button inside an unbound form throws', async () => {
+  // The enclosing form no longer decides anything (#1307). What still refuses is
+  // the LEAK guard: `leaky` is not a registered action, so it has no identity to
+  // bind and stringifying it would write the function's source into the HTML.
   await assert.rejects(
     () => renderToString(html`<form method="post"><button formaction=${leaky}>Go</button></form>`, { ssr: true }),
-    /requires the enclosing <form> to also be bound/,
+    NOT_AN_ACTION,
   );
 });
 
 test('camelCase formAction=${fn} throws on an unbound form (React spells it this way)', async () => {
   await assert.rejects(
     () => renderToString(html`<form method="post"><button formAction=${leaky}>Go</button></form>`, { ssr: true }),
-    /requires the enclosing <form> to also be bound/,
+    NOT_AN_ACTION,
   );
   await assert.rejects(
     () => renderToString(html`<form action=${'/x'}><button formAction="${leaky}">Go</button></form>`, { ssr: true }),
@@ -188,7 +191,7 @@ test('a quoted mixed-case Action="${fn}" throws (sigil strip and case-fold compo
 test('the streaming renderer folds case too', async () => {
   await assert.rejects(
     () => drain(renderToStream(html`<button formAction=${leaky}></button>`, { ssr: false })),
-    /requires the enclosing <form> to also be bound/,
+    NOT_AN_ACTION,
   );
 });
 
@@ -273,10 +276,10 @@ test('the streaming renderer refuses a mixed hole', async () => {
   );
 });
 
-test('the streaming renderer refuses formaction on an unbound button', async () => {
+test('the streaming renderer refuses a formaction that is not an action', async () => {
   await assert.rejects(
     () => drain(renderToStream(html`<button formaction=${leaky}></button>`, { ssr: false })),
-    /requires the enclosing <form> to also be bound/,
+    NOT_AN_ACTION,
   );
   await assert.rejects(
     () => drain(renderToStream(html`<form action=${'/x'}><button formaction="${leaky}"></button></form>`, { ssr: false })),
diff --git a/packages/core/test/rendering/form-action-binding-client.test.js b/packages/core/test/rendering/form-action-binding-client.test.js
index 5bab41881..be2ecac8e 100644
--- a/packages/core/test/rendering/form-action-binding-client.test.js
+++ b/packages/core/test/rendering/form-action-binding-client.test.js
@@ -646,35 +646,52 @@ test('a detached submitter still refuses what the template alone decides', () =>
   );
 });
 
-test('a submitter whose enclosing form is resolvable and UNBOUND is still refused', () => {
-  // The skip is narrow: it applies when there is no form to ask, not when the
-  // answer is no. An inline submitter can always reach its form.
+test('a submitter whose enclosing form is UNBOUND now binds, carrying its own submission', () => {
+  // The client used to ask "is my enclosing form bound" and refuse when it could
+  // reach the form and the answer was no. #1307 removed the question: the button
+  // supplies `formmethod` / `formenctype` itself, so the form is irrelevant.
   const rowAction = HOISTED();
   const host = document.createElement('div');
-  assert.throws(
-    () => render(html`<form method="post"><button formaction=${rowAction}>x</button></form>`, host),
-    /requires the enclosing <form> to also be bound/,
-  );
+  render(html`<form method="post"><button formaction=${rowAction}>x</button></form>`, host);
+  const btn = host.querySelector('button');
+  assert.equal(btn.getAttribute('name'), '__webjs_action');
+  assert.equal(btn.getAttribute('formmethod'), 'post');
+  assert.equal(btn.getAttribute('formenctype'), 'multipart/form-data');
+  assert.equal(btn.hasAttribute('formaction'), false, 'no url is emitted');
 });
 
 // ---------------------------------------------------------------------------
-// #1207 Part B on the client, so a component-only page (never SSR'd) gets the
-// same answer the server would have given.
+// The same-element rule on the client, so a component-only page (never SSR'd)
+// gets the same answer the server would have given.
 // ---------------------------------------------------------------------------
 
-test('the client refuses an unparseable submitter enctype inside a bound form', () => {
-  const formAction = HOISTED();
+test('the client refuses a BOUND submitter contradicting its own binding', () => {
+  const rowAction = HOISTED();
   const host = document.createElement('div');
   assert.throws(
-    () => render(html`<form action=${formAction}><button formenctype="text/plain">Save</button></form>`, host),
+    () => render(html`<button formaction=${rowAction} formenctype="text/plain">Save</button>`, host),
     /formenctype=/,
   );
   assert.throws(
-    () => render(html`<form action=${formAction}><button formmethod="get">Save</button></form>`, host),
+    () => render(html`<button formaction=${rowAction} formmethod="get">Save</button>`, host),
     /formmethod=/,
   );
 });
 
+test('the client leaves a PLAIN submitter\'s own override alone, matching SSR', () => {
+  // #1207's Part B refused these on both renderers. #1307 allows them on both,
+  // which is the half that keeps the two in step.
+  const formAction = HOISTED();
+  const host = document.createElement('div');
+  render(
+    html`<form action=${formAction}><button formenctype="text/plain">a</button><button formmethod="get">b</button></form>`,
+    host,
+  );
+  const [a, b] = host.querySelectorAll('button');
+  assert.equal(a.getAttribute('formenctype'), 'text/plain');
+  assert.equal(b.getAttribute('formmethod'), 'get');
+});
+
 test('the client leaves dialog and retargeted submitters alone', () => {
   const formAction = HOISTED();
   const host = document.createElement('div');
diff --git a/packages/core/test/rendering/form-action-binding.test.js b/packages/core/test/rendering/form-action-binding.test.js
index 2d097fa3c..b4a7f9643 100644
--- a/packages/core/test/rendering/form-action-binding.test.js
+++ b/packages/core/test/rendering/form-action-binding.test.js
@@ -258,10 +258,10 @@ test('binding is scoped to <form> and bound submitters: non-action shapes refuse
     assert.match(msg, /function was interpolated into/, 'refused as a stringify, not bound');
     assert.doesNotMatch(msg, /SECRET/);
   }
-  // Standalone submitter outside a bound form throws the form-binding requirement error:
-  let unboundMsg = '';
-  try { await renderToString(html`<button formaction=${submitFeedback}></button>`, { ssr: true }); } catch (e) { unboundMsg = String(e.message); }
-  assert.match(unboundMsg, /requires the enclosing <form> to also be bound/);
+  // A standalone submitter is NOT a non-action shape. Since #1307 it binds and
+  // carries its own submission, so it belongs in neither refusal above.
+  const standalone = await renderToString(html`<button formaction=${submitFeedback}></button>`, { ssr: true });
+  assert.match(standalone, /name="__webjs_action"/);
 });
 
 test('formaction=${fn} on submitter inside a bound form emits submitter action identity', async () => {
@@ -270,7 +270,51 @@ test('formaction=${fn} on submitter inside a bound form emits submitter action i
     html`<form action=${submitFeedback}><button formaction=${submitFeedback}>Save</button></form>`,
     { ssr: true }
   );
-  assert.match(out, /<button name="__webjs_action" value="[0-9a-f]{10}\/submitFeedback">Save<\/button>/);
+  assert.match(
+    out,
+    /<button name="__webjs_action" value="[0-9a-f]{10}\/submitFeedback" formmethod="post" formenctype="multipart\/form-data">Save<\/button>/,
+  );
+});
+
+test('a bound submitter is SELF-SUFFICIENT: it needs nothing from its form (#1307)', async () => {
+  withResolver();
+  // The shape #1307 was filed about: a form that binds nothing and declares no
+  // method. Before this change SSR refused it where it could see the form, and
+  // bound it silently where it could not, producing a GET that ran no action.
+  const bare = await renderToString(
+    html`<form><button formaction=${submitFeedback}>Go</button></form>`, { ssr: true });
+  assert.match(bare, /formmethod="post"/, 'the button supplies its own method');
+  assert.match(bare, /formenctype="multipart\/form-data"/, 'and its own enctype');
+  assert.match(bare, /name="__webjs_action"/);
+  // No enclosing form at all, and a form that explicitly declares GET. The
+  // button overrides both, exactly as native HTML says a submitter does.
+  for (const tpl of [
+    html`<button formaction=${submitFeedback}>Go</button>`,
+    html`<form method="get"><button formaction=${submitFeedback}>Go</button></form>`,
+  ]) {
+    const out = await renderToString(tpl, { ssr: true });
+    assert.match(out, /formmethod="post"/);
+    assert.match(out, /formenctype="multipart\/form-data"/);
+  }
+  // COUNTERFACTUAL: delete the two injections in `bindSubmitterStartTag` and
+  // every assertion above fails, because the button falls back to whatever the
+  // enclosing form declares, which here is a GET carrying no body.
+});
+
+test('the author\'s own formmethod / formenctype wins; only the missing one is injected', async () => {
+  withResolver();
+  const ownMethod = await renderToString(
+    html`<button formaction=${submitFeedback} formmethod="post">Go</button>`, { ssr: true });
+  assert.equal(ownMethod.match(/formmethod=/g).length, 1, 'not duplicated');
+  assert.match(ownMethod, /formenctype="multipart\/form-data"/, 'the missing one is still supplied');
+
+  const ownEnctype = await renderToString(
+    html`<button formaction=${submitFeedback} formenctype="application/x-www-form-urlencoded">Go</button>`,
+    { ssr: true },
+  );
+  assert.equal(ownEnctype.match(/formenctype=/g).length, 1);
+  assert.match(ownEnctype, /formenctype="application\/x-www-form-urlencoded"/, 'the author\'s value survives');
+  assert.match(ownEnctype, /formmethod="post"/);
 });
 
 test('a bound form nested among siblings does not disturb them', async () => {
@@ -380,10 +424,10 @@ test('formaction=${fn} submitter refusals: name attribute, input type=image, unp
 });
 
 test('a formaction binding on <input type="submit"> is refused for its label', async () => {
-  // `<input type="submit">` IS a submitter, so Part B still judges it, but the
-  // identity has to occupy `value`, which on this control is also the visible
-  // caption. Binding would render a button captioned with the action id, and
-  // the only fix (`value="Publish"`) is the channel the identity needs.
+  // `<input type="submit">` IS a submitter, but the identity has to occupy
+  // `value`, which on this control is also the visible caption. Binding would
+  // render a button captioned with the action id, and the only fix
+  // (`value="Publish"`) is the channel the identity needs.
   withResolver();
   await assert.rejects(
     () => renderToString(
@@ -392,13 +436,15 @@ test('a formaction binding on <input type="submit"> is refused for its label', a
     ),
     /also its visible label/,
   );
-  // Part B still reaches it, so the control is not simply ignored.
+  // The label refusal fires FIRST, before any submission attribute is looked
+  // at, so a bound `<input type="submit">` reports the label conflict whatever
+  // else it carries.
   await assert.rejects(
     () => renderToString(
-      html`<form action=${submitFeedback}><input type="submit" formmethod="get"></form>`,
+      html`<form action=${submitFeedback}><input type="submit" formaction=${submitFeedback} formmethod="get"></form>`,
       { ssr: true },
     ),
-    /formmethod=/,
+    /also its visible label/,
   );
   // And a plain labelled one renders untouched.
   const ok = await renderToString(
@@ -459,7 +505,7 @@ test('formaction submitters work when rendered by a nested template', async () =
   withResolver();
   const buttons = () => html`<button formaction=${submitFeedback}>Delete</button>`;
   const out = await renderToString(html`<form action=${submitFeedback}>${buttons()}</form>`, { ssr: true });
-  assert.match(out, /<button name="__webjs_action" value="[0-9a-f]{10}\/submitFeedback">Delete<\/button>/);
+  assert.match(out, /<button name="__webjs_action" value="[0-9a-f]{10}\/submitFeedback" formmethod="post" formenctype="multipart\/form-data">Delete<\/button>/);
 });
 
 test('two action holes are refused whichever position the bound one is in', async () => {
@@ -473,60 +519,86 @@ test('two action holes are refused whichever position the bound one is in', asyn
 });
 
 // ---------------------------------------------------------------------------
-// #1207 Part B: a submitter's own `formmethod` / `formenctype` can defeat a
-// bound form WITHOUT the button binding an action of its own, and neither
-// renderer used to look at them. `<form action=${fn}><button
-// formenctype="text/plain">` submitted fine under JS (the router posts
-// FormData, ignoring formenctype) and was a bare 405 without it, which is the
-// works-one-way-only near-miss refused everywhere else in this module. So the
-// sweep runs for EVERY submitter inside a bound form, not only a bound one.
+// #1307 REVERSES #1207's Part B.
+//
+// Part B refused a `formmethod` / `formenctype` on EVERY submitter inside a
+// bound form, binding or not, on the stated grounds that either "works under JS
+// (the router posts FormData) and is a bare 405 without it". That reasoning was
+// only ever true of `formenctype`. For `formmethod` the router already honours
+// the submitter's override with native precedence and promotes a safe-method
+// body to the query string, so both paths lose the identity identically and
+// there was never a works-one-way-only half to refuse.
+//
+// The rule now is same-element only: a BOUND submitter's own contradictory
+// value refuses, and a PLAIN submitter's override is a legal native
+// instruction that renders untouched. The dev-time client guard reports at
+// submit time when a submission holds an identity it cannot deliver.
 // ---------------------------------------------------------------------------
 
-test('an unparseable formenctype on a plain submitter inside a bound form is refused', async () => {
+test('a PLAIN submitter\'s own formenctype inside a bound form renders untouched', async () => {
+  // #1207 refused every one of these. Native HTML says the submitter's override
+  // wins, the author typed it deliberately, and the form's action simply does
+  // not run, which is what the same markup does in any other framework.
   withResolver();
-  // The exact shape #1207 opened with: no formaction hole anywhere on the
-  // button, so nothing about the BINDING brings the renderer to this tag.
   for (const tpl of [
     html`<form action=${submitFeedback}><button formenctype="text/plain">Save</button></form>`,
     html`<form action=${submitFeedback}><input type="submit" formenctype="text/plain"></form>`,
     html`<form action=${submitFeedback}><button formenctype="TEXT/PLAIN">Save</button></form>`,
   ]) {
-    await assert.rejects(() => renderToString(tpl, { ssr: true }), /formenctype=/);
+    const out = await renderToString(tpl, { ssr: true });
+    assert.match(out, /formenctype="(text\/plain|TEXT\/PLAIN)"/, 'left exactly as written');
   }
 });
 
-test('a non-POST formmethod on a plain submitter inside a bound form is refused', async () => {
+test('a PLAIN submitter\'s own formmethod inside a bound form renders untouched', async () => {
   withResolver();
   for (const tpl of [
     html`<form action=${submitFeedback}><button formmethod="get">Save</button></form>`,
     html`<form action=${submitFeedback}><button formmethod="GET">Save</button></form>`,
     html`<form action=${submitFeedback}><input type="submit" formmethod="get"></form>`,
+    html`<form action=${submitFeedback}><button formmethod=" post ">Save</button></form>`,
   ]) {
-    await assert.rejects(() => renderToString(tpl, { ssr: true }), /formmethod=/);
+    const out = await renderToString(tpl, { ssr: true });
+    assert.match(out, /formmethod=/, 'left exactly as written');
   }
 });
 
-test('a padded formmethod is refused, matching the form-level untrimmed rule', async () => {
+test('a padded formmethod on a BOUND submitter is refused, matching the form-level untrimmed rule', async () => {
   // `formmethod` is an enumerated attribute matched against exact keywords with
   // no whitespace stripping, so `" post "` falls to the invalid-value default
   // and the button submits as a GET. Trimming here would accept it and ship the
-  // silently-posts-nowhere submitter the refusal exists to prevent.
+  // silently-posts-nowhere submitter the refusal exists to prevent. Scoped to a
+  // BOUND submitter now: on a plain one the author owns the consequence.
   withResolver();
   await assert.rejects(
     () => renderToString(
-      html`<form action=${submitFeedback}><button formmethod=" post ">Save</button></form>`,
+      html`<button formaction=${submitFeedback} formmethod=" post ">Save</button>`,
       { ssr: true },
     ),
     /formmethod=" post "/,
   );
 });
 
+test('a BOUND submitter contradicting its own binding is still refused', async () => {
+  // The surviving half of Part B, and the whole of the new rule: the author
+  // bound an action to THIS button and then told THIS button to submit in a way
+  // that action could never read.
+  withResolver();
+  for (const [tpl, pattern] of [
+    [html`<button formaction=${submitFeedback} formmethod="get">x</button>`, /formmethod=/],
+    [html`<button formaction=${submitFeedback} formmethod="PATCH">x</button>`, /formmethod=/],
+    [html`<button formaction=${submitFeedback} formenctype="text/plain">x</button>`, /formenctype=/],
+  ]) {
+    await assert.rejects(() => renderToString(tpl, { ssr: true }), pattern);
+  }
+});
+
 test('parseable submitter enctypes stay fully supported', async () => {
-  // Part B refuses VALUES that cannot work, never the attribute itself.
+  // The rule refuses VALUES that cannot work, never the attribute itself.
   withResolver();
   for (const enc of ['multipart/form-data', 'application/x-www-form-urlencoded']) {
     const out = await renderToString(
-      html`<form action=${submitFeedback}><button formenctype="${enc}">Save</button></form>`,
+      html`<form action=${submitFeedback}><button formaction=${submitFeedback} formenctype="${enc}">Save</button></form>`,
       { ssr: true },
     );
     assert.match(out, new RegExp(`formenctype="${enc.replace(/[/]/g, '\\/')}"`));
@@ -572,9 +644,9 @@ test('a submitter retargeted by a static formaction keeps its own method', async
   assert.match(out, /formmethod="get"/);
 });
 
-test('Part B ignores controls that do not submit', async () => {
-  // `formmethod` / `formenctype` are inert on anything that is not a submitter,
-  // so flagging them there would be a false positive on valid markup.
+test('formmethod / formenctype on a non-submitting control are inert and untouched', async () => {
+  // Inert on anything that is not a submitter, so touching them there would be a
+  // false positive on valid markup.
   withResolver();
   const out = await renderToString(
     html`<form action=${submitFeedback}><input type="text" name="q" formenctype="text/plain"><button type="button" formmethod="get">x</button></form>`,
@@ -583,8 +655,7 @@ test('Part B ignores controls that do not submit', async () => {
   assert.match(out, /name="q"/);
 });
 
-test('Part B applies only INSIDE a bound form', async () => {
-  // An ordinary hand-written form is not this module's business.
+test('an ordinary hand-written form is not this module\'s business', async () => {
   withResolver();
   const out = await renderToString(
     html`<form method="post"><button formenctype="text/plain">Save</button></form>`,
@@ -593,9 +664,10 @@ test('Part B applies only INSIDE a bound form', async () => {
   assert.match(out, /formenctype="text\/plain"/);
 });
 
-test('the bound-form scope closes at </form>', async () => {
-  // `insideBoundForm` is scoped by the tag stream, so a submitter written after
-  // the bound form has closed is outside it and judged by nothing.
+test('a plain submitter after a bound form closes is untouched', async () => {
+  // There is no enclosing-form scope left to leak (#1307 deleted it), so this
+  // pins the absence: a plain button anywhere keeps whatever it was written
+  // with, before or after any form.
   withResolver();
   const out = await renderToString(
     html`<form action=${submitFeedback}><button>Save</button></form><form method="post"><button formmethod="get">Later</button></form>`,
@@ -604,35 +676,37 @@ test('the bound-form scope closes at </form>', async () => {
   assert.match(out, /formmethod="get"/);
 });
 
-test('Part B reaches a submitter arriving through a nested template', async () => {
-  // The flag is threaded into nested renders, so a button rendered by a child
-  // template inside a bound form is judged exactly like an inline one.
+test('a plain submitter arriving through a nested template is untouched too', async () => {
+  // Nothing is threaded into nested renders any more, which is the point: the
+  // verdict does not depend on how the button reached the page.
   withResolver();
   const row = () => html`<button formenctype="text/plain">Save</button>`;
-  await assert.rejects(
-    () => renderToString(html`<form action=${submitFeedback}>${row()}</form>`, { ssr: true }),
-    /formenctype=/,
-  );
+  const out = await renderToString(html`<form action=${submitFeedback}>${row()}</form>`, { ssr: true });
+  assert.match(out, /formenctype="text\/plain"/);
 });
 
-test('the streaming machine applies Part B identically', async () => {
+test('the streaming machine judges a BOUND submitter identically', async () => {
   // `streamTemplate` is a SEPARATE state machine that inherits nothing, and
   // #1154 already shipped a guard in one machine and not the other once.
   withResolver();
   await assert.rejects(
     () => drain(renderToStream(
-      html`<form action=${submitFeedback}><button formenctype="text/plain">Save</button></form>`,
+      html`<button formaction=${submitFeedback} formenctype="text/plain">Save</button>`,
       { ssr: false },
     )),
     /formenctype=/,
   );
   await assert.rejects(
     () => drain(renderToStream(
-      html`<form action=${submitFeedback}><button formmethod="get">Save</button></form>`,
+      html`<button formaction=${submitFeedback} formmethod="get">Save</button>`,
       { ssr: false },
     )),
     /formmethod=/,
   );
+  // And INJECTS identically, which is the half a refusal-only test would miss.
+  const bound = await drain(renderToStream(
+    html`<form><button formaction=${submitFeedback}>Save</button></form>`, { ssr: false }));
+  assert.match(bound, /formmethod="post" formenctype="multipart\/form-data"/);
   const ok = await drain(renderToStream(
     html`<form action=${submitFeedback}><button formmethod="dialog">Close</button></form>`,
     { ssr: false },
@@ -664,50 +738,37 @@ test('a submitter rendered by a component inside a bound form binds', async () =
     html`<form action=${submitFeedback}><row-actions-bind></row-actions-bind></form>`,
     { ssr: true, dev: false },
   );
-  assert.match(out, /<button name="__webjs_action" value="[0-9a-f]{10}\/submitFeedback">Delete<\/button>/,
+  assert.match(out, /<button name="__webjs_action" value="[0-9a-f]{10}\/submitFeedback" formmethod="post" formenctype="multipart\/form-data">Delete<\/button>/,
     'the component-rendered button carries the identity');
   assert.ok(!out.includes('data-webjs-error'), 'and the component did not fail to render');
 });
 
-test('a conclusively form-less submitter is still refused', async () => {
-  // The skip is narrow. Where the scan really can see there is no form, the
-  // answer is known and the refusal stands.
-  withResolver();
-  await assert.rejects(
-    () => renderToString(html`<button formaction=${submitFeedback}>x</button>`, { ssr: true }),
-    /requires the enclosing <form> to also be bound/,
-  );
-  await assert.rejects(
-    () => renderToString(
-      html`<form action=${submitFeedback}><button>a</button></form><button formaction=${submitFeedback}>x</button>`,
-      { ssr: true },
-    ),
-    /requires the enclosing <form> to also be bound/,
-    'and the scope really does close at </form>',
-  );
-});
-
-test('an UNBOUND form is refused, which is a different answer from cannot-tell', async () => {
+test('a form-less submitter BINDS now, which is the whole of #1307', async () => {
+  // This block used to prove the opposite. SSR distinguished cannot-tell from
+  // conclusively-none and refused the latter, because a submitter could not
+  // supply `method="post"` for itself. It can now, so every shape below binds.
   withResolver();
-  await assert.rejects(
-    () => renderToString(
-      html`<form method="post"><button formaction=${submitFeedback}>x</button></form>`,
-      { ssr: true },
-    ),
-    /requires the enclosing <form> to also be bound/,
-  );
+  for (const tpl of [
+    html`<button formaction=${submitFeedback}>x</button>`,
+    html`<form action=${submitFeedback}><button>a</button></form><button formaction=${submitFeedback}>x</button>`,
+    html`<form method="post"><button formaction=${submitFeedback}>x</button></form>`,
+    html`<form><button formaction=${submitFeedback}>x</button></form>`,
+  ]) {
+    const out = await renderToString(tpl, { ssr: true });
+    assert.match(out, /formmethod="post"/);
+    assert.match(out, /formenctype="multipart\/form-data"/);
+  }
 });
 
-test("the 'unbound' state is what refuses inside a COMPONENT's own form", async () => {
-  // The test above cannot observe the 'unbound' transition: a top-level scan
-  // starts at 'none', so that template is refused either way, and deleting the
-  // transition left the whole suite green. 'unbound' differs from 'none' only
-  // under an 'unknown' seed, which is the component pass.
+test("a component's own unbound form no longer swallows its submitter", async () => {
+  // The #1307 failure in its purest form. A component renders in a SEPARATE SSR
+  // pass with no view of the host page, so the old scan seeded 'unknown' and
+  // could not judge the enclosing form. Where it thought it COULD judge (the
+  // component's own form), it refused, and because a component's SSR error is
+  // ISOLATED the button silently vanished from a page that still returned 200.
   //
-  // Without it, a component's own GET-defaulting form would happily bind a
-  // submitter inside it, which is the silently-posts-nowhere shape the guard
-  // exists to prevent. The component's SSR error is isolated, so the proof is
-  // that the component renders EMPTY rather than emitting the identity.
+  // Both halves are fixed by the same change: nothing is judged, so nothing is
+  // isolated away.
   withResolver();
   const { WebComponent } = await import('../../src/component.js');
   class OwnUnbound extends WebComponent({}) {
@@ -718,16 +779,12 @@ test("the 'unbound' state is what refuses inside a COMPONENT's own form", async
     html`<form action=${submitFeedback}><own-unbound-form></own-unbound-form></form>`,
     { ssr: true, dev: false },
   );
-  assert.equal((out.match(/name="__webjs_action"/g) || []).length, 1,
-    "only the page form's identity is emitted; the component's submitter never bound");
-  assert.ok(!out.includes('<button'), 'the refusal was isolated to the component');
+  assert.match(out, /<button name="__webjs_action"/, 'the component\'s submitter bound');
+  assert.match(out, /formmethod="post"/);
+  assert.ok(!out.includes('data-webjs-error'), 'and nothing was isolated away');
 });
 
-test("a component that CLOSES its own form keeps deferring, rather than downgrading", async () => {
-  // `</form>` used to hard-reset the scope to 'none', which asserted a fact the
-  // component scan cannot know: closing a form of its own teaches it nothing
-  // about the host page. A bound submitter written after it was then refused
-  // and, being isolated, vanished from a 200.
+test('a component that closes its own form still binds a later submitter', async () => {
   withResolver();
   const { WebComponent } = await import('../../src/component.js');
   class ClosesOwnForm extends WebComponent({}) {
@@ -740,16 +797,20 @@ test("a component that CLOSES its own form keeps deferring, rather than downgrad
     html`<form action=${submitFeedback}><closes-own-form></closes-own-form></form>`,
     { ssr: true, dev: false },
   );
-  assert.match(out, /<button name="__webjs_action" value="[0-9a-f]{10}\/submitFeedback">P<\/button>/);
+  assert.match(out, /<button name="__webjs_action" value="[0-9a-f]{10}\/submitFeedback" formmethod="post" formenctype="multipart\/form-data">P<\/button>/);
   assert.ok(!out.includes('data-webjs-error'), 'and the component did not fail to render');
 });
 
 // ---------------------------------------------------------------------------
-// Suspense (#1207). The page pipeline in @webjsdev/server drains `ctx.pending`
-// ITSELF and re-renders each resolved child through `renderToString`, which is
-// a fresh scan with no view of the shell. Without the recorded scope a bound
-// form's boundary content read as form-less, was refused, and the drain's catch
-// turned that into an EMPTY boundary on a page that still returned 200.
+// Suspense (#1207, #1307). The page pipeline in @webjsdev/server drains
+// `ctx.pending` ITSELF and re-renders each resolved child through
+// `renderToString`, which is a fresh scan with no view of the shell. That used
+// to need the enclosing form scope threaded back in, or a bound form's boundary
+// content read as form-less, was refused, and the drain's catch turned it into
+// an EMPTY boundary on a page that still returned 200.
+//
+// #1307 removed the need: a bound submitter carries its own submission, so a
+// fresh scan with no view of the shell has nothing left to be told.
 // ---------------------------------------------------------------------------
 
 async function drainSuspense(tpl) {
@@ -758,10 +819,9 @@ async function drainSuspense(tpl) {
   const parts = [];
   for (const p of ctx.pending) {
     const sub = { pending: [], nextId: ctx.nextId, dev: false };
-    // Mirrors ssr.js's drain, including how it carries the scope forward.
-    parts.push(await renderToString(await p.promise, {
-      ssr: true, suspenseCtx: sub, formScope: p.formScope || 'unknown',
-    }));
+    // Mirrors ssr.js's drain. Nothing about the shell is carried forward, which
+    // is exactly what this suite now pins.
+    parts.push(await renderToString(await p.promise, { ssr: true, suspenseCtx: sub }));
   }
   return { shell, parts, pending: ctx.pending };
 }
@@ -774,20 +834,23 @@ test('a submitter inside a bound form\'s Suspense boundary binds', async () => {
     children: Promise.resolve(html`<button formaction=${submitFeedback}>Publish</button>`),
   })}</form>`);
   assert.match(shell, /<webjs-boundary id="s1"><p>loading<\/p><\/webjs-boundary>/);
-  assert.equal(pending[0].formScope, 'bound', 'the shell records the scope');
-  assert.match(parts[0], /<button name="__webjs_action" value="[0-9a-f]{10}\/submitFeedback">Publish<\/button>/,
-    'and the resolved content is rendered with it');
+  assert.equal(pending[0].formScope, undefined, 'no scope is recorded, because none is needed');
+  assert.match(parts[0], /<button name="__webjs_action" value="[0-9a-f]{10}\/submitFeedback" formmethod="post" formenctype="multipart\/form-data">Publish<\/button>/,
+    'and the resolved content binds on its own');
 });
 
-test('a Suspense boundary outside a bound form still refuses a submitter', async () => {
-  // The counterfactual: carrying the scope must not become a blanket amnesty.
+test('a Suspense boundary outside a bound form binds its submitter too', async () => {
+  // This asserted a refusal, as the counterfactual proving the carried scope was
+  // not a blanket amnesty. There is no scope and nothing to amnesty: the button
+  // is self-sufficient wherever the boundary sits.
   withResolver();
   const { Suspense } = await import('../../src/suspense.js');
   for (const shell of [
     html`<div>${Suspense({ fallback: html`<p>l</p>`, children: Promise.resolve(html`<button formaction=${submitFeedback}>P</button>`) })}</div>`,
     html`<form method="post">${Suspense({ fallback: html`<p>l</p>`, children: Promise.resolve(html`<button formaction=${submitFeedback}>P</button>`) })}</form>`,
   ]) {
-    await assert.rejects(() => drainSuspense(shell), /requires the enclosing <form> to also be bound/);
+    const { parts } = await drainSuspense(shell);
+    assert.match(parts[0], /formmethod="post" formenctype="multipart\/form-data"/);
   }
 });
 
@@ -801,11 +864,17 @@ test('a Suspense boundary outside a bound form still refuses a submitter', async
 
 test('a reflected .prop on a submitter is refused, in both machines', async () => {
   withResolver();
+  // Every row binds its own action (#1307). The rule is same-element: a `.prop`
+  // on a button the author bound is refused, because SSR drops it and the
+  // browser reflects it, so the SAME button would submit differently with JS
+  // than without. On a PLAIN button it is an ordinary native property and is
+  // left alone, which is the row below this test.
   const refused = [
-    html`<form action=${submitFeedback}><button .name=${'intent'} formaction=${submitFeedback}>x</button></form>`,
-    html`<form action=${submitFeedback}><button .value=${'v'} formaction=${submitFeedback}>x</button></form>`,
-    html`<form action=${submitFeedback}><button .formMethod=${'get'}>x</button></form>`,
-    html`<form action=${submitFeedback}><button .formEnctype=${'text/plain'}>x</button></form>`,
+    html`<button .name=${'intent'} formaction=${submitFeedback}>x</button>`,
+    html`<button .value=${'v'} formaction=${submitFeedback}>x</button>`,
+    html`<button .formMethod=${'get'} formaction=${submitFeedback}>x</button>`,
+    html`<button .formEnctype=${'text/plain'} formaction=${submitFeedback}>x</button>`,
+    html`<button .formAction=${'/elsewhere'} formaction=${submitFeedback}>x</button>`,
   ];
   for (const tpl of refused) {
     await assert.rejects(() => renderToString(tpl, { ssr: true }), /reflected IDL attribute/);
@@ -839,23 +908,29 @@ test('an empty author name after the hole is refused, not shipped as a duplicate
   }
 });
 
-test('a .formAction prop is refused on a submitter that binds nothing', async () => {
-  // The narrowing that spares `.name` / `.value` on a non-binding submitter must
-  // NOT spare `.formAction`. SSR drops the prop, so with JS off the button
-  // submits to the page and runs the bound action; a browser reflects it, so
-  // with JS on the button posts elsewhere and the action never runs. That is the
-  // works-one-way-only shape, and it is why the STATIC `formaction="/url"` stays
-  // fine: both renderers see that one and agree.
+test('a .prop on a submitter that binds NOTHING is an ordinary native property', async () => {
+  // #1307 narrowed this. `.formMethod` / `.formEnctype` / `.formAction` on a
+  // button that binds no action used to be refused, on the grounds that they
+  // could defeat the enclosing form's binding. That is a rule about the
+  // author's OTHER element, and the ordinary native-property behaviour (SSR
+  // drops a `.prop`, the browser reflects it) is what this codebase already
+  // accepts everywhere else, including for an unbound form's own `.method`.
   withResolver();
-  const tpl = html`<form action=${submitFeedback}><button .formAction=${'/elsewhere'}>Save</button></form>`;
-  await assert.rejects(() => renderToString(tpl, { ssr: true }), /reflected IDL attribute/);
-  await assert.rejects(() => drain(renderToStream(tpl, { ssr: false })), /reflected IDL attribute/);
+  for (const tpl of [
+    html`<form action=${submitFeedback}><button .formAction=${'/elsewhere'}>Save</button></form>`,
+    html`<form action=${submitFeedback}><button .formMethod=${'get'}>Save</button></form>`,
+    html`<form action=${submitFeedback}><button .formEnctype=${'text/plain'}>Save</button></form>`,
+  ]) {
+    const out = await renderToString(tpl, { ssr: true });
+    assert.match(out, /<button\s*>Save<\/button>/, 'the prop is dropped at SSR, as every native prop is');
+    assert.ok(!/formaction|formmethod|formenctype/.test(out), 'and nothing is invented for it');
+  }
 
   const ok = await renderToString(
     html`<form action=${submitFeedback}><button formaction="/search" formmethod="get">Go</button></form>`,
     { ssr: true },
   );
-  assert.match(ok, /formaction="\/search"/, 'the static retarget is still allowed');
+  assert.match(ok, /formaction="\/search"/, 'a static retarget is still allowed');
 });
 
 test('a falsy boolean name hole leaves the identity channel free', async () => {
@@ -866,7 +941,7 @@ test('a falsy boolean name hole leaves the identity channel free', async () => {
     html`<form action=${submitFeedback}><button ?name=${false} formaction=${submitFeedback}>x</button></form>`,
     { ssr: true },
   );
-  assert.match(out, /<button\s+name="__webjs_action" value="[0-9a-f]{10}\/submitFeedback">x<\/button>/);
+  assert.match(out, /<button\s+name="__webjs_action" value="[0-9a-f]{10}\/submitFeedback" formmethod="post" formenctype="multipart\/form-data">x<\/button>/);
   // Truthy emits `name=""`, which collides with the identity.
   await assert.rejects(
     () => renderToString(
diff --git a/packages/server/src/ssr.js b/packages/server/src/ssr.js
index b6344773f..d69feb635 100644
--- a/packages/server/src/ssr.js
+++ b/packages/server/src/ssr.js
@@ -2109,7 +2109,7 @@ function reachedVendorSpecifiers(graph, entryFiles, componentUrls, appDir, elida
  * @param {string} prefix
  * @param {string} bodyHtml
  * @param {string} closer
- * @param {{ pending: {id: string, promise: Promise<unknown>, formScope?: 'none'|'unbound'|'bound'|'unknown'}[], nextId: number }} ctx
+ * @param {{ pending: {id: string, promise: Promise<unknown>}[], nextId: number }} ctx
  * @param {number} status
  * @param {Request | undefined} req
  * @param {URL | undefined} url
@@ -2165,15 +2165,14 @@ function streamingHtmlResponse(prefix, bodyHtml, closer, ctx, status, req, url,
               try {
                 const resolved = await p.promise;
                 const sub = { pending: [], nextId: ctx.nextId, dev: ctx.dev };
-                // Carry the boundary's form scope (#1207). This is a fresh scan
-                // that cannot see the shell the boundary sits in, so without it
-                // a `<button formaction=${fn}>` inside a bound form's boundary
-                // reads as form-less and is refused, and the catch below turns
-                // that into an empty boundary on a 200 in production. 'unknown'
-                // when the entry predates the field: defer rather than refuse.
-                const html = await renderToString(resolved, {
-                  ssr: true, suspenseCtx: sub, formScope: p.formScope || 'unknown',
-                });
+                // A fresh scan that cannot see the shell the boundary sits in.
+                // That used to require carrying the boundary's form scope
+                // (#1207), or a `<button formaction=${fn}>` inside a bound
+                // form's boundary read as form-less, was refused, and the catch
+                // below turned it into an empty boundary on a 200 in
+                // production. #1307 made a bound submitter self-sufficient, so
+                // there is nothing left to carry.
+                const html = await renderToString(resolved, { ssr: true, suspenseCtx: sub });
                 ctx.nextId = sub.nextId;
                 for (const n of sub.pending) ctx.pending.push(n);
                 return { id: p.id, html };
diff --git a/test/bun/form-action-guard.mjs b/test/bun/form-action-guard.mjs
index 238d75d5b..565d62f4c 100644
--- a/test/bun/form-action-guard.mjs
+++ b/test/bun/form-action-guard.mjs
@@ -84,10 +84,6 @@ const refused = {
   'reflecting prop .formAction=${fn} on a button': () => html`<button .formAction=${leaky}></button>`,
 };
 
-const refusedUnboundSubmitter = {
-  'formaction=${fn}': () => html`<button type="submit" formaction=${leaky}></button>`,
-  'camelCase formAction=${fn}': () => html`<button type="submit" formAction=${leaky}></button>`,
-};
 
 /**
  * The two shapes #1155 turned into a BINDING rather than a stringify:
@@ -99,6 +95,12 @@ const refusedAsUnidentified = {
   'action=${fn}': () => html`<form action=${leaky}></form>`,
   'upper-case ACTION=${fn}': () => html`<form ACTION=${leaky}></form>`,
   'formaction=${fn} inside bound form': () => html`<form action=${leaky}><button formaction=${leaky}></button></form>`,
+  // #1307: a bound submitter no longer asks anything of its enclosing form, so
+  // these two moved here from their own table. They still refuse, because
+  // `leaky` has no identity to bind, which is the leak guard this file exists
+  // for. The enclosing form has nothing to do with it either way.
+  'formaction=${fn} with no bound form': () => html`<button type="submit" formaction=${leaky}></button>`,
+  'camelCase formAction=${fn} with no bound form': () => html`<button type="submit" formAction=${leaky}></button>`,
 };
 
 for (const [name, mk] of Object.entries(refused)) {
@@ -123,18 +125,6 @@ for (const [name, mk] of Object.entries(refused)) {
     `[${runtime}] streaming refusal must not carry the source (${name})`);
 }
 
-for (const [name, mk] of Object.entries(refusedUnboundSubmitter)) {
-  let threw = null;
-  try { await renderToString(mk(), { ssr: true }); } catch (e) { threw = e; }
-  assert.ok(threw, `[${runtime}] buffered SSR must refuse ${name}`);
-  assert.match(threw.message, /requires the enclosing <form> to also be bound/, `[${runtime}] ${name} message`);
-
-  let streamThrew = null;
-  try { await drain(renderToStream(mk(), { ssr: false })); } catch (e) { streamThrew = e; }
-  assert.ok(streamThrew, `[${runtime}] streaming SSR must refuse ${name}`);
-  assert.match(streamThrew.message, /requires the enclosing <form> to also be bound/, `[${runtime}] ${name} message`);
-}
-
 for (const [name, mk] of Object.entries(refusedAsUnidentified)) {
   for (const [machine, run] of [
     ['buffered', () => renderToString(mk(), { ssr: true })],
diff --git a/test/bun/form-action-submitter-parity.test.mjs b/test/bun/form-action-submitter-parity.test.mjs
index bf8716a49..b80d29882 100644
--- a/test/bun/form-action-submitter-parity.test.mjs
+++ b/test/bun/form-action-submitter-parity.test.mjs
@@ -1,5 +1,11 @@
 /**
- * Cross-runtime parity test for per-submitter `formaction=${action}` (#1207).
+ * Cross-runtime parity test for per-submitter `formaction=${action}` (#1207),
+ * and for the submission attributes a bound submitter carries itself (#1307).
+ *
+ * SSR is runtime-sensitive, so the emission has to be proven on Bun as well as
+ * Node: the whole point of #1307 is that the button ships `formmethod="post"`
+ * and an enctype in the served HTML, and a runtime that emitted one and not the
+ * other would produce a form that silently posts nowhere with JS off.
  */
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
@@ -20,15 +26,46 @@ test('SSR: formaction=${fn} on submitter inside bound form emits submitter name=
   `;
   const out = await renderToString(tpl, { ssr: true });
   assert.match(out, /<input type="hidden" name="__webjs_action" value="hash\/saveAction">/);
-  assert.match(out, /<button name="__webjs_action" value="hash\/deleteAction">Delete<\/button>/);
+  assert.match(
+    out,
+    /<button name="__webjs_action" value="hash\/deleteAction" formmethod="post" formenctype="multipart\/form-data">Delete<\/button>/,
+  );
 });
 
-test('SSR: formaction=${fn} on unbound button throws actionable refusal', async () => {
-  const tpl = html`<button formaction=${deleteAction}>Delete</button>`;
-  await assert.rejects(
-    () => renderToString(tpl, { ssr: true }),
-    /requires the enclosing <form> to also be bound/,
+test('SSR: a bound submitter is self-sufficient on this runtime (#1307)', async () => {
+  // The headline of #1307, asserted cross-runtime: a form that binds nothing and
+  // declares no method, whose button still submits a POST the action can read.
+  // This threw before the change, on both runtimes.
+  for (const tpl of [
+    html`<form><button formaction=${deleteAction}>Delete</button></form>`,
+    html`<button formaction=${deleteAction}>Delete</button>`,
+    html`<form method="get"><button formaction=${deleteAction}>Delete</button></form>`,
+  ]) {
+    const out = await renderToString(tpl, { ssr: true });
+    assert.match(out, /name="__webjs_action" value="hash\/deleteAction"/);
+    assert.match(out, /formmethod="post"/, 'the button supplies its own method');
+    assert.match(out, /formenctype="multipart\/form-data"/, 'and its own enctype');
+  }
+});
+
+test('SSR: a bound submitter contradicting its own binding refuses on this runtime', async () => {
+  for (const [tpl, expected] of [
+    [html`<button formaction=${deleteAction} formmethod="get">D</button>`, /formmethod=/],
+    [html`<button formaction=${deleteAction} formenctype="text/plain">D</button>`, /formenctype=/],
+    [html`<button formaction=${deleteAction} formmethod="dialog">D</button>`, /dialog/],
+  ]) {
+    await assert.rejects(() => renderToString(tpl, { ssr: true }), expected);
+  }
+});
+
+test("SSR: a PLAIN submitter's own override is left alone on this runtime", async () => {
+  // #1307 reverses #1207's Part B, and the reversal has to be identical on both
+  // runtimes or the same markup would refuse on one and render on the other.
+  const out = await renderToString(
+    html`<form action=${saveAction}><button formmethod="get">Search</button></form>`,
+    { ssr: true },
   );
+  assert.match(out, /formmethod="get"/);
 });
 
 test('SSR: formaction=${fn} on submitter with name attribute throws refusal', async () => {
@@ -72,13 +109,16 @@ test('SSR: nested submitter templates keep the enclosing form binding', async ()
 // runtime and not the other would ship a page that works in dev and 405s in
 // production, which is the same works-one-way-only failure Part B exists to
 // close.
-test('SSR: Part B refuses an unparseable submitter enctype on both runtimes', async () => {
+test('SSR: a BOUND submitter\'s own contradictions refuse on both runtimes', async () => {
+  // Was "Part B refuses ...". #1307 scoped every row here to a submitter that
+  // BINDS: the author attached an action to this button and then told this same
+  // button to submit in a way that action could never read. The rows about a
+  // PLAIN button's override moved to the carve-out test below, because native
+  // HTML defines that outcome and the renderer now honours it.
   const refused = [
-    ['plain formenctype', html`<form action=${saveAction}><button formenctype="text/plain">Save</button></form>`],
-    ['plain formmethod', html`<form action=${saveAction}><button formmethod="get">Save</button></form>`],
-    ['padded formmethod', html`<form action=${saveAction}><button formmethod=" post ">Save</button></form>`],
-    ['submit input', html`<form action=${saveAction}><input type="submit" formenctype="text/plain"></form>`],
-    ['nested template', html`<form action=${saveAction}>${html`<button formmethod="get">Save</button>`}</form>`],
+    ['bound formenctype', html`<button formaction=${deleteAction} formenctype="text/plain">Save</button>`],
+    ['bound formmethod', html`<button formaction=${deleteAction} formmethod="get">Save</button>`],
+    ['bound padded formmethod', html`<button formaction=${deleteAction} formmethod=" post ">Save</button>`],
     ['bound plus dialog', html`<form action=${saveAction}><button formmethod="dialog" formaction=${deleteAction}>x</button></form>`],
   ];
   for (const [label, tpl] of refused) {
@@ -86,6 +126,22 @@ test('SSR: Part B refuses an unparseable submitter enctype on both runtimes', as
   }
 });
 
+test("SSR: a PLAIN submitter's overrides render untouched on both runtimes", async () => {
+  // Every row here refused before #1307. The reversal has to be identical on
+  // Node and Bun, or the same markup would refuse on one runtime and render on
+  // the other, which is the precise class of bug this file exists to catch.
+  const allowed = [
+    ['plain formenctype', html`<form action=${saveAction}><button formenctype="text/plain">Save</button></form>`, /formenctype="text\/plain"/],
+    ['plain formmethod', html`<form action=${saveAction}><button formmethod="get">Save</button></form>`, /formmethod="get"/],
+    ['submit input', html`<form action=${saveAction}><input type="submit" formenctype="text/plain">`, /formenctype="text\/plain"/],
+    ['nested template', html`<form action=${saveAction}>${html`<button formmethod="get">Save</button>`}</form>`, /formmethod="get"/],
+  ];
+  for (const [label, tpl, expected] of allowed) {
+    const out = await renderToString(tpl, { ssr: true });
+    assert.match(out, expected, label);
+  }
+});
+
 test('SSR: Part B carve-outs render on both runtimes', async () => {
   const allowed = [
     ['dialog dismissal', html`<form action=${saveAction}><button formmethod="dialog">Close</button></form>`, /formmethod="dialog"/],

From a8606dd00ae18ce3e0631aef51aae5d1f246e84b Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Fri, 7 Aug 2026 14:26:38 +0530
Subject: [PATCH 02/13] fix: send a form submission with the enctype the author
 declared

The client router built a FormData for every submission and sent it with no
explicit content type, so fetch always derived multipart/form-data and the
authored enctype was never read at all.

`application/x-www-form-urlencoded` is the HTML default, so a plain
`<form method="post">` MEANS urlencoded. That form sent a urlencoded body with
JS off and a multipart body with JS on: one template, two different requests,
which is the thing progressive enhancement is supposed to rule out. It is
independent of the submitter work but lives in the same function, so it is
fixed here rather than left as a known divergence.

Resolve the effective enctype with native precedence (a submitter's
formenctype over the form's) and encode the body to match. Multipart keeps
sending FormData; urlencoded sends URLSearchParams, with a File serialized as
its name, which is what the platform's own urlencoded serializer does. Turbo
drops file entries here instead, losing a field the no-JS path sends.

`text/plain` gets no encoder. The HTML spec calls its payload not reliably
interpretable by computer, and `looksLikeFormSubmission` accepts multipart and
urlencoded only, so such a POST is answered by a bare 405 before its body is
read. The router declines the submission and lets the browser perform it
natively, so both paths do the same thing. Turbo enumerates this encoding and
then sends FormData anyway, which is the divergence being avoided.

The value is matched UNTRIMMED, like every other enumerated attribute here: a
padded `enctype=" multipart/form-data "` falls to the invalid-value default and
a browser sends urlencoded for it, so trimming would have reintroduced the same
disagreement one level down. A test caught that.

The real proof is in the browser suite, reading the encoded body off a stubbed
fetch, because the linkedom unit harness cannot drive onSubmit as far as
preventDefault (`new FormData(formElement)` throws there). That limit is now
recorded beside the bail tests it weakens, since they can show a submission was
not routed but not that it bailed for the stated reason.
---
 .../webjs/references/data-and-actions.md      |   2 +-
 AGENTS.md                                     |   2 +-
 packages/core/src/router-client.js            |  92 +++++++++++++-
 .../browser/form-action-submit.test.js        | 113 ++++++++++++++++++
 .../core/test/routing/router-client.test.js   |  93 ++++++++++++++
 .../app/docs/progressive-enhancement/page.ts  |   5 +-
 6 files changed, 302 insertions(+), 5 deletions(-)

diff --git a/.agents/skills/webjs/references/data-and-actions.md b/.agents/skills/webjs/references/data-and-actions.md
index f6772bd63..a94342116 100644
--- a/.agents/skills/webjs/references/data-and-actions.md
+++ b/.agents/skills/webjs/references/data-and-actions.md
@@ -135,7 +135,7 @@ import { createPost } from '#modules/posts/actions/create-post.server.ts';
 html`<form action=${createPost}><input name="title"></form>`;
 ```
 
-The renderer omits the `action` attribute so the form posts to the page's own url, supplies `method="post"` and an enctype, and emits a hidden `__webjs_action` field carrying the action's `<hash>/<fn>` identity, the same identity the RPC endpoint resolves. Nothing about the action's source reaches the browser. With JS off this is an ordinary HTML submission; with JS the client router posts the same body to the same url, so the two paths are identical by construction.
+The renderer omits the `action` attribute so the form posts to the page's own url, supplies `method="post"` and an enctype, and emits a hidden `__webjs_action` field carrying the action's `<hash>/<fn>` identity, the same identity the RPC endpoint resolves. Nothing about the action's source reaches the browser. With JS off this is an ordinary HTML submission; with JS the client router posts the same body to the same url, encoded per the declared `enctype` (#1307: multipart stays `FormData`, urlencoded, which is the HTML default, is sent as `URLSearchParams`), so the two paths are identical by construction.
 
 **A form-bound action always receives the `FormData`**, which is where it differs from the same function called over RPC (rich arguments) or server-to-server. `validate` is the typing seam: it takes the `FormData` and its transform-return becomes the action's typed input.
 
diff --git a/AGENTS.md b/AGENTS.md
index 5b7a021c4..6da30576e 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -367,7 +367,7 @@ Derive the type at every boundary: a DB row from the schema (`typeof todos.$infe
 
 ## Client navigation: automatic, nothing to opt into
 
-The router auto-enables when `@webjsdev/core` loads (any page with a component), so there is nothing to opt INTO. An app that wants plain full-page (MPA) navigation can opt OUT app-wide with `{ "webjs": { "clientRouter": false } }` (#629), or per-moment at runtime with `disableClientRouter()`. SSR auto-emits KEYED boundary comment pairs around each layout's children AND the page itself (open `<!--wj:children:<segment>:<route-key>-->`, close `<!--/wj:children:<segment>-->`; the route-key is the resolved path with param values percent-encoded, #1015). The router strictly scans both DOMs (any truncated, mispaired, or duplicated boundary poisons the scan) and applies a two-tier swap with Next.js remount parity: a changed route-key REPLACES (remounts) at the PARENT of the shallowest changed boundary (the range that contains the changed layout's own markup, exact Next remount scope), an unchanged one MORPHS the deepest shared boundary in place (a searchParams-only nav preserves hydrated component state). A poisoned or disjoint scan degrades to a full page load, never a guessed recovery, so silent DOM corruption is structurally impossible; outer-layout DOM identity is preserved on every soft path. **Every degradation dispatches `webjs:navigation-fallback` on `document` in ALL environments** (detail `{ cause, href, willReload }`, not cancelable), so a full page load on a click is observable in production rather than silent (#1114). Form submissions ride the same pipeline (`data-no-router` opts out). Wire bytes are minimized via the `X-Webjs-Have` header (`segment:route-key` entries, so a dynamic layout held for OTHER params is re-rendered rather than short-circuited; the server returns only the divergent fragment, served `private` so a shared cache can never store the reduced body and serve it to a full-page navigation, and additionally marked `Vary: X-Webjs-Have` for caches that honour it (#1140; `Vary` alone was not enough, since Cloudflare honours only `Accept-Encoding`)); scroll is restored on back/forward. **The link-prefetch cache is ANCHOR-VALIDATED** (#1114): a reduced fragment begins at the boundary the server short-circuited on, and on consume the router checks that boundary is still live with the same route-key. A root-anchored fragment therefore survives an unrelated navigation (still a cache hit), while one anchored deeper is discarded once that layout is gone, because applying it would share no boundary with the live DOM and force a full page load. The router also never prefetches the page it is already on (#1106): that request can never serve a later navigation and only occupies a capped cache slot. A non-GET `<form>` that BINDS a server action (`action=${fn}`) is the no-JS write-path (with JS the router posts the same body to the same url and applies the response in place: a `422` swaps without reload, a `303` is followed via fetch). A failed navigation recovers in place (a cancelable `webjs:navigation-error` event, else a minimal in-place alert), never a destructive full reload.
+The router auto-enables when `@webjsdev/core` loads (any page with a component), so there is nothing to opt INTO. An app that wants plain full-page (MPA) navigation can opt OUT app-wide with `{ "webjs": { "clientRouter": false } }` (#629), or per-moment at runtime with `disableClientRouter()`. SSR auto-emits KEYED boundary comment pairs around each layout's children AND the page itself (open `<!--wj:children:<segment>:<route-key>-->`, close `<!--/wj:children:<segment>-->`; the route-key is the resolved path with param values percent-encoded, #1015). The router strictly scans both DOMs (any truncated, mispaired, or duplicated boundary poisons the scan) and applies a two-tier swap with Next.js remount parity: a changed route-key REPLACES (remounts) at the PARENT of the shallowest changed boundary (the range that contains the changed layout's own markup, exact Next remount scope), an unchanged one MORPHS the deepest shared boundary in place (a searchParams-only nav preserves hydrated component state). A poisoned or disjoint scan degrades to a full page load, never a guessed recovery, so silent DOM corruption is structurally impossible; outer-layout DOM identity is preserved on every soft path. **Every degradation dispatches `webjs:navigation-fallback` on `document` in ALL environments** (detail `{ cause, href, willReload }`, not cancelable), so a full page load on a click is observable in production rather than silent (#1114). Form submissions ride the same pipeline (`data-no-router` opts out). Wire bytes are minimized via the `X-Webjs-Have` header (`segment:route-key` entries, so a dynamic layout held for OTHER params is re-rendered rather than short-circuited; the server returns only the divergent fragment, served `private` so a shared cache can never store the reduced body and serve it to a full-page navigation, and additionally marked `Vary: X-Webjs-Have` for caches that honour it (#1140; `Vary` alone was not enough, since Cloudflare honours only `Accept-Encoding`)); scroll is restored on back/forward. **The link-prefetch cache is ANCHOR-VALIDATED** (#1114): a reduced fragment begins at the boundary the server short-circuited on, and on consume the router checks that boundary is still live with the same route-key. A root-anchored fragment therefore survives an unrelated navigation (still a cache hit), while one anchored deeper is discarded once that layout is gone, because applying it would share no boundary with the live DOM and force a full page load. The router also never prefetches the page it is already on (#1106): that request can never serve a later navigation and only occupies a capped cache slot. A non-GET `<form>` that BINDS a server action (`action=${fn}`) is the no-JS write-path (with JS the router posts the same body to the same url and applies the response in place: a `422` swaps without reload, a `303` is followed via fetch). **The router ENCODES that body per the declared `enctype`** (#1307), resolved with native precedence (a submitter's `formenctype` over the form's): `multipart/form-data` sends `FormData`, and `application/x-www-form-urlencoded`, the HTML default and therefore what a plain `<form method="post">` means, sends `URLSearchParams` (a `File` serializes as its name, as the platform does). It previously built `FormData` for everything, so an ordinary POST form sent a urlencoded body with JS off and a multipart body with JS on. A `text/plain` POST is the one encoding the server cannot parse, so the router declines it and lets the browser submit natively, which keeps both paths doing the same thing. A failed navigation recovers in place (a cancelable `webjs:navigation-error` event, else a minimal in-place alert), never a destructive full reload.
 
 The advanced client-router surface is in `references/client-router-and-streaming.md`: **link prefetch** (on by default, device-adaptive default: `intent` on a hover pointer, `viewport` (dwell-gated, cancel-on-scroll-out) on touch, per-link `data-prefetch` override), **`<webjs-frame>`** partial-swap regions, **View Transitions** (opt-in via `<meta name="view-transition" content="same-origin">`, where the router checks that exact `content` value and a bare tag enables nothing, plus `data-webjs-permanent` to persist a live element), **stream actions** (`<webjs-stream>` element-level updates, #248), and the **opt-in nav-loading indicator** (`<html data-webjs-nav-progress>` exposes a `data-navigating` attribute during a nav so you can style a CSS-only progress affordance, off by default because toggling a root attribute re-resolves `oklch()` tokens to a one-frame repaint flash on iOS WebKit, #610). Production benefits from HTTP/2 at the edge; `npm run start` speaks plain HTTP/1.1 (put a reverse proxy in front for TLS + HTTP/2).
 
diff --git a/packages/core/src/router-client.js b/packages/core/src/router-client.js
index e39904853..e3d8fe9ed 100644
--- a/packages/core/src/router-client.js
+++ b/packages/core/src/router-client.js
@@ -866,6 +866,18 @@ function onSubmit(e) {
   const method = getSubmitMethod(form, submitter);
   if (method === 'dialog') return;
 
+  // #1307: `text/plain` is a legal native encoding the server cannot parse
+  // (`looksLikeFormSubmission` accepts multipart and urlencoded only), and
+  // there is no honest way to send it over `fetch` and have the response mean
+  // anything. Bail to the browser so BOTH paths do the same thing, rather than
+  // silently sending multipart, which is what made the same form behave one way
+  // with JS and another way without it. Turbo enumerates this encoding and then
+  // sends FormData anyway, which is the divergence being avoided here. A safe
+  // method ignores the enctype entirely, per the form-submission algorithm.
+  const enctype = getSubmitEnctype(form, submitter);
+  const isSafeMethod = method === 'get' || method === 'head';
+  if (!isSafeMethod && enctype === 'text/plain') return;
+
   const action = getSubmitAction(form, submitter);
   /** @type {URL} */ let url;
   try { url = new URL(action, location.href); }
@@ -873,7 +885,7 @@ function onSubmit(e) {
   if (url.origin !== location.origin) return;
   if (NON_HTML_EXTENSIONS.test(url.pathname)) return;
 
-  const body = buildSubmitFormData(form, submitter);
+  const body = encodeSubmitBody(buildSubmitFormData(form, submitter), enctype);
 
   e.preventDefault();
   // Resolve the target frame for the submit, same precedence as a link:
@@ -911,6 +923,76 @@ function getSubmitAction(form, submitter) {
   return form.getAttribute('action') || form.action || location.href;
 }
 
+/**
+ * The three `enctype` keywords, plus the normalization a browser applies.
+ *
+ * Both the missing-value AND the invalid-value default of the `enctype`
+ * enumerated attribute are `application/x-www-form-urlencoded`, so
+ * `enctype="nonsense"` really does mean urlencoded and has to be sent as such.
+ * Only an exact, ASCII-case-insensitive match on one of the other two keywords
+ * means anything else.
+ *
+ * @param {string | null | undefined} raw
+ * @returns {'application/x-www-form-urlencoded' | 'multipart/form-data' | 'text/plain'}
+ */
+function normalizeEnctype(raw) {
+  // Compared UNTRIMMED, the same rule `assertSubmittableForm` applies in
+  // `form-action.js`. An enumerated attribute is matched against exact
+  // keywords with no whitespace stripping, so `enctype=" multipart/form-data "`
+  // falls to the invalid-value default and a BROWSER sends urlencoded for it.
+  // Trimming here would send multipart, so the router would disagree with the
+  // no-JS path on exactly the shape this function exists to keep in step.
+  const v = String(raw || '').toLowerCase();
+  if (v === 'multipart/form-data') return 'multipart/form-data';
+  if (v === 'text/plain') return 'text/plain';
+  return 'application/x-www-form-urlencoded';
+}
+
+/**
+ * Enctype resolution: the submitter's `formenctype` wins over the form's
+ * `enctype`, exactly as `getSubmitMethod` resolves the method (#1307). Turbo
+ * resolves it the same way, in `core/drive/form_submission.js`.
+ *
+ * @param {HTMLFormElement} form
+ * @param {HTMLElement | null} submitter
+ */
+function getSubmitEnctype(form, submitter) {
+  return normalizeEnctype(
+    (submitter && submitter.getAttribute('formenctype')) || form.getAttribute('enctype'),
+  );
+}
+
+/**
+ * Encode a submission body the way the DECLARED enctype says to (#1307).
+ *
+ * The router used to build a `FormData` and send it with no explicit content
+ * type, so `fetch` always derived `multipart/form-data` and the authored
+ * `enctype` was never read at all. An author writing
+ * `enctype="application/x-www-form-urlencoded"`, which is also the HTML
+ * DEFAULT and therefore what a plain `<form method="post">` means, got
+ * urlencoded with JS off and multipart with JS on. Same form, two different
+ * request bodies, which is exactly what progressive enhancement rules out.
+ *
+ * A `File` entry serializes as its NAME under urlencoded, which is what the
+ * platform's own urlencoded serializer does. (Turbo drops file entries here
+ * entirely, in `http/fetch_request.js`, which loses a field the no-JS path
+ * sends.)
+ *
+ * A bound form is unaffected: it carries an explicit
+ * `enctype="multipart/form-data"`, and since #1307 a bound submitter carries
+ * `formenctype="multipart/form-data"`, so both resolve to multipart as before.
+ *
+ * @param {FormData} formData
+ * @param {'application/x-www-form-urlencoded' | 'multipart/form-data' | 'text/plain'} enctype
+ * @returns {FormData | URLSearchParams}
+ */
+function encodeSubmitBody(formData, enctype) {
+  if (enctype === 'multipart/form-data') return formData;
+  const params = new URLSearchParams();
+  for (const [k, v] of formData) params.append(k, typeof v === 'string' ? v : v.name);
+  return params;
+}
+
 /**
  * Build FormData honoring the submitter's name=value (per HTML5 form
  * submission algorithm). Modern browsers + the `FormData(form, submitter)`
@@ -1827,7 +1909,11 @@ async function performNavigation(href, isPopState, frameId) {
  *
  * @param {string} href     Absolute target URL.
  * @param {string} method   Lowercased HTTP verb.
- * @param {FormData} body
+ * @param {FormData | URLSearchParams} body  Encoded per the declared enctype
+ *   (#1307): `FormData` for multipart, `URLSearchParams` for urlencoded. Both
+ *   iterate as `[name, value]` pairs, which is all the safe-method query-string
+ *   promotion below needs, and `fetch` derives the right content type from
+ *   either without an explicit header.
  * @param {string | null} frameId
  * @param {HTMLFormElement | null} [form]  The submitted form, for busy + events.
  */
@@ -5116,6 +5202,8 @@ export {
   getSubmitMethod as _getSubmitMethod,
   getSubmitAction as _getSubmitAction,
   buildSubmitFormData as _buildSubmitFormData,
+  getSubmitEnctype as _getSubmitEnctype,
+  encodeSubmitBody as _encodeSubmitBody,
   restoreOptimistic as _restoreOptimistic,
   eligibleAnchorHref as _eligibleAnchorHref,
   viewTransitionsEnabled as _viewTransitionsEnabled,
diff --git a/packages/core/test/routing/browser/form-action-submit.test.js b/packages/core/test/routing/browser/form-action-submit.test.js
index 70e8e7646..03ada250e 100644
--- a/packages/core/test/routing/browser/form-action-submit.test.js
+++ b/packages/core/test/routing/browser/form-action-submit.test.js
@@ -185,4 +185,117 @@ suite('Client router: bound form submissions (#1155)', () => {
       teardown();
     }
   });
+
+  // -------------------------------------------------------------------------
+  // #1307: the router honours the DECLARED enctype.
+  //
+  // It used to build a `FormData` for every submission and send it with no
+  // explicit content type, so `fetch` always derived `multipart/form-data` and
+  // the authored `enctype` was never read at all. A plain `<form method="post">`
+  // MEANS `application/x-www-form-urlencoded` in HTML, so the same form sent a
+  // urlencoded body with JS off and a multipart body with JS on. Two different
+  // requests from one template is exactly what progressive enhancement rules
+  // out, and it is why these assertions read the real RequestInit rather than
+  // trusting the resolver in isolation.
+  // -------------------------------------------------------------------------
+
+  const okHtml = () => new Response(
+    '<!--wj:children:/:/--><p>ok</p><!--/wj:children:/-->',
+    { headers: { 'content-type': 'text/html', 'x-webjs-build': '' } },
+  );
+
+  test('a form declaring no enctype sends URLENCODED, the HTML default (#1307)', async () => {
+    setup(okHtml);
+    try {
+      render(html`
+        <form method="post">
+          <input name="email" value="a@b.com">
+          <button type="submit">go</button>
+        </form>
+      `, container);
+      container.querySelector('button').click();
+      await tick();
+      const post = calls[0];
+      assert.ok(post, 'router issued the submission fetch');
+      assert.ok(post.init.body instanceof URLSearchParams,
+        'a form with no enctype must NOT be sent as multipart');
+      assert.equal(post.init.body.get('email'), 'a@b.com', 'and the field survives the encoding');
+      // COUNTERFACTUAL: revert `encodeSubmitBody` to return the FormData
+      // unconditionally and this goes red, which is what pins the fix.
+    } finally { teardown(); }
+  });
+
+  test('a form declaring multipart still sends FormData', async () => {
+    setup(okHtml);
+    try {
+      render(html`
+        <form method="post" enctype="multipart/form-data">
+          <input name="email" value="a@b.com">
+          <button type="submit">go</button>
+        </form>
+      `, container);
+      container.querySelector('button').click();
+      await tick();
+      assert.ok(calls[0].init.body instanceof FormData, 'multipart is still FormData');
+    } finally { teardown(); }
+  });
+
+  test("a submitter's formenctype overrides the form's, as native precedence says", async () => {
+    setup(okHtml);
+    try {
+      render(html`
+        <form method="post" enctype="multipart/form-data">
+          <input name="email" value="a@b.com">
+          <button type="submit" formenctype="application/x-www-form-urlencoded">go</button>
+        </form>
+      `, container);
+      container.querySelector('button').click();
+      await tick();
+      assert.ok(calls[0].init.body instanceof URLSearchParams,
+        "the button's own formenctype decides the encoding");
+    } finally { teardown(); }
+  });
+
+  test('an invalid enctype is urlencoded, not passed through or treated as text/plain', async () => {
+    // `enctype` is an enumerated attribute whose invalid-value default is
+    // urlencoded, so a browser sends urlencoded for this and so must the router.
+    setup(okHtml);
+    try {
+      render(html`
+        <form method="post" enctype="nonsense">
+          <input name="email" value="a@b.com">
+          <button type="submit">go</button>
+        </form>
+      `, container);
+      container.querySelector('button').click();
+      await tick();
+      assert.ok(calls[0], 'the submission was still routed, not bailed');
+      assert.ok(calls[0].init.body instanceof URLSearchParams);
+    } finally { teardown(); }
+  });
+
+  test('a text/plain POST is NOT routed, so both paths do the same native thing', async () => {
+    // The server parses multipart and urlencoded only, so there is no honest
+    // way to send this over fetch. Bailing means the browser performs exactly
+    // the submission it would have without JS. The nav guard would catch the
+    // real navigation, so what is asserted is simply that no fetch was issued.
+    setup(okHtml);
+    try {
+      render(html`
+        <form method="post" enctype="text/plain" action="/never">
+          <button type="submit">go</button>
+        </form>
+      `, container);
+      const btn = container.querySelector('button');
+      // Stop the native submission the bail deliberately allows, so the test
+      // page is not navigated away. The router runs on the BUBBLE phase, so a
+      // capture-phase listener here would pre-empt what is being measured.
+      const stop = (e) => e.preventDefault();
+      container.addEventListener('submit', stop);
+      btn.click();
+      await tick();
+      container.removeEventListener('submit', stop);
+      assert.equal(calls.length, 0, 'the router did not take it');
+    } finally { teardown(); }
+  });
 });
diff --git a/packages/core/test/routing/router-client.test.js b/packages/core/test/routing/router-client.test.js
index 7c3a6c913..06ac6717b 100644
--- a/packages/core/test/routing/router-client.test.js
+++ b/packages/core/test/routing/router-client.test.js
@@ -30,6 +30,7 @@ let _collect, _plan, _keyOf, _diffEl, _reconcile,
   _applySwap, _prefetchCache,
   _snapshotCache, _LIVE_ATTRS, _blurOutgoingFocus,
   _onSubmit, _getSubmitMethod, _getSubmitAction, _buildSubmitFormData,
+  _getSubmitEnctype, _encodeSubmitBody,
   _restoreOptimistic, _navToken, _bumpNavToken,
   _currentPageUrl, _setCurrentPageUrl, _resetWarnOnce,
   _eligibleAnchorHref, _prefetchSuppressed, _prefetchMode, _prefetchHasHoverPointer, _prefetch, _prefetchTake, _prefetchAnchor,
@@ -101,6 +102,8 @@ before(async () => {
     _getSubmitMethod,
     _getSubmitAction,
     _buildSubmitFormData,
+    _getSubmitEnctype,
+    _encodeSubmitBody,
     _restoreOptimistic,
     _navToken,
     _bumpNavToken,
@@ -3006,6 +3009,66 @@ test('getSubmitMethod: tolerates null submitter (programmatic submit)', () => {
   assert.equal(_getSubmitMethod(form, null), 'post');
 });
 
+test('getSubmitEnctype: submitter formenctype overrides form enctype', () => {
+  // Native precedence, the same rule `getSubmitMethod` follows one line up.
+  const form = formFrom('<form enctype="application/x-www-form-urlencoded"><button formenctype="multipart/form-data">x</button></form>');
+  assert.equal(_getSubmitEnctype(form, form.querySelector('button')), 'multipart/form-data');
+});
+
+test('getSubmitEnctype: the missing-value default is urlencoded, per HTML', () => {
+  // This is the case that mattered (#1307). A plain `<form method="post">`
+  // MEANS urlencoded, and the router used to send multipart for it, so the
+  // same form produced a different request body with JS on than with JS off.
+  const form = formFrom('<form method="post"><button>x</button></form>');
+  assert.equal(_getSubmitEnctype(form, form.querySelector('button')), 'application/x-www-form-urlencoded');
+});
+
+test('getSubmitEnctype: an INVALID value is urlencoded too, not passed through', () => {
+  // `enctype` is an enumerated attribute whose invalid-value default is also
+  // urlencoded, so `nonsense` really does mean urlencoded. Treating an
+  // unrecognised value as text/plain would bail a form that submits perfectly.
+  for (const raw of ['nonsense', 'TEXT/HTML', '', ' multipart/form-data ']) {
+    const form = formFrom(`<form method="post" enctype="${raw}"><button>x</button></form>`);
+    assert.equal(
+      _getSubmitEnctype(form, form.querySelector('button')),
+      'application/x-www-form-urlencoded',
+      `${raw || '(empty)'} normalizes to the invalid-value default`,
+    );
+  }
+});
+
+test('getSubmitEnctype: the two other keywords are matched case-insensitively', () => {
+  for (const [raw, want] of [
+    ['MULTIPART/FORM-DATA', 'multipart/form-data'],
+    ['Text/Plain', 'text/plain'],
+  ]) {
+    const form = formFrom(`<form method="post" enctype="${raw}"><button>x</button></form>`);
+    assert.equal(_getSubmitEnctype(form, form.querySelector('button')), want);
+  }
+});
+
+test('encodeSubmitBody: urlencoded sends URLSearchParams, multipart sends FormData', () => {
+  const fd = new FormData();
+  fd.append('email', 'a@b.com');
+  fd.append('note', 'hi there');
+  const params = _encodeSubmitBody(fd, 'application/x-www-form-urlencoded');
+  assert.ok(params instanceof URLSearchParams, 'urlencoded must not send FormData');
+  assert.equal(params.get('email'), 'a@b.com');
+  assert.equal(params.get('note'), 'hi there');
+  assert.equal(_encodeSubmitBody(fd, 'multipart/form-data'), fd, 'multipart passes the FormData through');
+});
+
+test('encodeSubmitBody: a File under urlencoded is sent as its NAME, matching the platform', () => {
+  // The platform's urlencoded serializer writes the file's name. Turbo drops
+  // file entries entirely here, which loses a field the no-JS path sends.
+  const fd = new FormData();
+  fd.append('avatar', new File(['x'], 'portrait.png', { type: 'image/png' }));
+  fd.append('email', 'a@b.com');
+  const params = _encodeSubmitBody(fd, 'application/x-www-form-urlencoded');
+  assert.equal(params.get('avatar'), 'portrait.png');
+  assert.equal(params.get('email'), 'a@b.com', 'and the sibling text field survives');
+});
+
 test('getSubmitAction: submitter formaction overrides form action', () => {
   const form = formFrom('<form action="/a"><button formaction="/b">x</button></form>');
   const submitter = form.querySelector('button');
@@ -3070,6 +3133,36 @@ test('onSubmit: ignores submissions with method="dialog"', () => {
   assert.equal(e._wasPrevented(), false, 'native dialog dismissal not routed');
 });
 
+// NOTE on these two bail tests, and on every `onSubmit: ignores ...` test
+// around them: this harness is linkedom, where `new FormData(formElement)`
+// throws, so `onSubmit` cannot be driven all the way to `preventDefault()`
+// here. A bail assertion therefore proves that the submission was NOT routed,
+// but cannot prove it bailed for the stated REASON. The positive control (an
+// ordinary POST still being intercepted, and the body actually encoded per the
+// declared enctype) lives in the browser suite, in
+// `packages/core/test/routing/browser/form-action-submit.test.js`, against a
+// real DOM and a stubbed fetch.
+test('onSubmit: an unsafe text/plain submission bails to the browser (#1307)', () => {
+  // The server parses multipart and urlencoded only, so there is no honest way
+  // to send text/plain over fetch and have the response mean anything. Bailing
+  // makes the JS-on and JS-off paths do the SAME thing (both a native
+  // text/plain POST, both answered the same way), which is the requirement.
+  const form = formFrom('<form action="/x" method="post" enctype="text/plain"></form>');
+  const e = fakeSubmitEvent(form);
+  _onSubmit(e);
+  assert.equal(e._wasPrevented(), false, 'the browser performs the submission');
+});
+
+test('onSubmit: a submitter formenctype="text/plain" bails too', () => {
+  // Native precedence: the submitter's override decides the encoding, so the
+  // bail has to read it there as well or a per-button text/plain would be sent
+  // as multipart under JS and natively without it.
+  const form = formFrom('<form action="/x" method="post"><button formenctype="text/plain">x</button></form>');
+  const e = fakeSubmitEvent(form, form.querySelector('button'));
+  _onSubmit(e);
+  assert.equal(e._wasPrevented(), false);
+});
+
 test('onSubmit: ignores cross-origin actions', () => {
   const form = formFrom('<form action="https://other.example.com/x" method="post"></form>');
   const e = fakeSubmitEvent(form);
diff --git a/website/app/docs/progressive-enhancement/page.ts b/website/app/docs/progressive-enhancement/page.ts
index ef923652f..a07318850 100644
--- a/website/app/docs/progressive-enhancement/page.ts
+++ b/website/app/docs/progressive-enhancement/page.ts
@@ -177,7 +177,10 @@ export default function NewPost({ actionData }: {
     </p>
 
     <p>
-      "Identical by construction" is a claim about the whole submission, submitter included. A button's own <code>formmethod</code> / <code>formenctype</code> can defeat the form it sits in, so the renderers read those on EVERY submitter inside a bound form, whether or not that button binds an action of its own: <code>&lt;form action=\${fn}&gt;&lt;button formenctype="text/plain"&gt;</code> would submit fine with JS (the router posts <code>FormData</code> and ignores the attribute) and be a bare <code>405</code> without it, so it is refused at render instead. The same goes for <code>formmethod="get"</code>, which sends no body. Two shapes are deliberately left alone, because neither submits to the bound action: <code>formmethod="dialog"</code> is a native <code>&lt;dialog&gt;</code> dismissal, and a plain <code>formaction="/url"</code> points the submission somewhere else entirely.
+      "Identical by construction" is a claim about the whole submission, encoding included, and it is enforced in two places. The router resolves the effective <code>enctype</code> with native precedence (a submitter's <code>formenctype</code> over the form's) and ENCODES the body accordingly: <code>multipart/form-data</code> sends <code>FormData</code>, and <code>application/x-www-form-urlencoded</code>, which is the HTML default and therefore what a plain <code>&lt;form method="post"&gt;</code> means, sends <code>URLSearchParams</code>. Before that the router built <code>FormData</code> for everything, so an ordinary POST form sent a urlencoded body without JS and a multipart body with it. A <code>text/plain</code> POST is the one encoding the server cannot parse, so the router declines it and lets the browser submit natively, which makes both paths do the same thing rather than one of them appear to work.
+    </p>
+    <p>
+      A submitter that BINDS its own action is refused when it also declares a <code>formmethod</code> other than post, an unparseable <code>formenctype</code>, or <code>formmethod="dialog"</code>, because those contradict the action attached to that same button. A button that binds nothing is left alone: its <code>formmethod</code> / <code>formenctype</code> is a legal native override, the author wrote it deliberately, and the form's action simply does not run, exactly as the same markup behaves anywhere else. In dev the client logs a console error at submit time when a submission is carrying an identity it cannot deliver.
     </p>
 
     <h3>3. Make components render correctly on the server</h3>

From 50d2d7614447dd64f034f3e3116369ddbd522e2d Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Fri, 7 Aug 2026 14:31:50 +0530
Subject: [PATCH 03/13] test: prove a bound submitter runs from an unbound form
 with JS off

Adds the dogfood route the headline claim needs. `/feedback/triage-split`
renders a form with NO action and NO method, so a browser defaults it to GET,
and both of its buttons bind their own action.

Both shapes are present because they exercise different renderer paths. "Save
draft" is inline in the page template, which SSR scans in one pass, and was the
case the renderer used to REFUSE outright. "Publish" comes from a component,
whose template SSR renders in a separate pass with no view of the host page,
and was the case it bound anyway because it could not tell. The second is why
the fix had to remove the question rather than answer it better: no scan can
see a page from inside a component's own render.

The e2e asserts the served markup carries `formmethod` and `formenctype` on
the button itself, and then that pressing it actually RUNS the action, in a
real browser with scripting disabled. Markup alone would not prove the second.

Note for anyone re-checking this: e2e resolves `@webjsdev/core` through the
BUILT dist, so `npm run --prefix packages/core build:dist` has to run before
the suite or it exercises the previous build. The counterfactual for this test
passed vacuously until that was done, and fails correctly after it.
---
 .../blog/app/feedback/triage-split/page.ts    | 58 +++++++++++++++
 .../feedback/components/publish-button.ts     | 38 ++++++++++
 test/e2e/e2e.test.mjs                         | 73 +++++++++++++++++++
 3 files changed, 169 insertions(+)
 create mode 100644 examples/blog/app/feedback/triage-split/page.ts
 create mode 100644 examples/blog/modules/feedback/components/publish-button.ts

diff --git a/examples/blog/app/feedback/triage-split/page.ts b/examples/blog/app/feedback/triage-split/page.ts
new file mode 100644
index 000000000..8c188f70e
--- /dev/null
+++ b/examples/blog/app/feedback/triage-split/page.ts
@@ -0,0 +1,58 @@
+import { html } from '@webjsdev/core';
+import { saveDraft } from '#modules/feedback/actions/save-draft.server.ts';
+import '#modules/feedback/components/publish-button.ts';
+
+/**
+ * The #1307 shape, as an e2e fixture: a COMPLETELY UNBOUND form whose buttons
+ * each bind their own action.
+ *
+ * Note what this `<form>` does NOT have. No `action=${...}`, so it binds
+ * nothing. No `method`, so a browser would default it to GET. Before #1307
+ * that was the silent failure: the renderer refused a bound submitter where it
+ * could see the form was unbound, and bound one anyway where it could not see
+ * (a button inside a component, which is the ordinary shape). The latter
+ * submitted as a GET, put the identity in the query string, re-rendered this
+ * page, and ran nothing. A 200 with no log and no visible symptom.
+ *
+ * It works now because a bound submitter carries its whole submission: the
+ * renderer puts `formmethod="post"` and `formenctype="multipart/form-data"` on
+ * the button itself, alongside the identity, so the button needs nothing from
+ * the form around it.
+ *
+ * Both shapes are here on purpose, because they exercise different renderer
+ * paths. "Save draft" is written INLINE in this page's template, which SSR
+ * scans in one pass. "Publish" is rendered by `<publish-button>`, a COMPONENT,
+ * whose template SSR renders in a separate pass with no view of this page.
+ * That second one is the case no scan could ever resolve, and it is why the
+ * fix had to remove the question rather than answer it better.
+ *
+ * `/feedback/triage` keeps the bound-form-plus-bound-submitter shape, so the
+ * two routes together cover a bound and an unbound host form.
+ */
+
+type PageCtx = {
+  actionData?: { fieldErrors?: Record<string, string>; values?: Record<string, string> };
+};
+
+export const metadata = { title: 'Triage (split) - WebJs Blog' };
+
+export default function TriageSplitPage({ actionData }: PageCtx) {
+  const err = actionData?.fieldErrors?.note;
+  const val = actionData?.values?.note || '';
+  return html`
+    <div class="max-w-[460px] mt-6 mx-auto">
+      <h1 class="font-serif text-2xl font-bold mb-4">Triage a note (split)</h1>
+      <form class="flex flex-col gap-3">
+        <label class="flex flex-col gap-1">
+          <span>Note</span>
+          <input id="note" name="note" type="text" value=${val} class="border rounded px-2 py-1">
+        </label>
+        ${err ? html`<p id="note-error" class="text-sm text-red-600">${err}</p>` : ''}
+        <div class="flex gap-2">
+          <button id="save" formaction=${saveDraft} class="border rounded px-3 py-1">Save draft</button>
+          <publish-button></publish-button>
+        </div>
+      </form>
+    </div>
+  `;
+}
diff --git a/examples/blog/modules/feedback/components/publish-button.ts b/examples/blog/modules/feedback/components/publish-button.ts
new file mode 100644
index 000000000..fa59935bf
--- /dev/null
+++ b/examples/blog/modules/feedback/components/publish-button.ts
@@ -0,0 +1,38 @@
+import { WebComponent, html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish-draft.server.ts';
+
+/**
+ * A bound submitter rendered by a COMPONENT (#1307).
+ *
+ * This is the case the old enclosing-form check could never resolve. SSR
+ * renders a component's template in a SEPARATE pass, walking the
+ * already-emitted HTML, so this template's scan has no view of the page that
+ * placed the tag and cannot see whether the surrounding `<form>` bound
+ * anything. The scan therefore had a third answer, cannot-tell, and had to
+ * bind on it: refusing would have rejected a per-row button in a list, and a
+ * refused component is ISOLATED at SSR, so production would have returned 200
+ * with the button silently missing.
+ *
+ * Binding on cannot-tell is what produced the silent failure, because the
+ * button then carried an identity with no way to send it as a POST.
+ *
+ * Nothing here asks about the form any more. The renderer gives this button
+ * `formmethod="post"` and `formenctype="multipart/form-data"` alongside the
+ * identity, so it submits correctly inside `/feedback/triage-split`'s unbound,
+ * method-less form, with JavaScript on or off.
+ *
+ * The component itself is display-only, so elision drops its module from the
+ * browser. That is the point rather than an oversight: the button is a plain
+ * HTML submitter once SSR has run, and the no-JS e2e proves it needs no
+ * script at all.
+ */
+class PublishButton extends WebComponent({}) {
+  render() {
+    return html`
+      <button id="publish" formaction=${publishDraft} class="border rounded px-3 py-1">
+        Publish
+      </button>
+    `;
+  }
+}
+PublishButton.register('publish-button');
diff --git a/test/e2e/e2e.test.mjs b/test/e2e/e2e.test.mjs
index 6323abdf8..2655fcbef 100644
--- a/test/e2e/e2e.test.mjs
+++ b/test/e2e/e2e.test.mjs
@@ -3463,6 +3463,79 @@ describe('E2E: form actions (no-JS + enhanced)', { skip: !process.env.WEBJS_E2E
     } finally { await p.close(); }
   });
 
+  test('JS DISABLED: a bound submitter runs its action inside a COMPLETELY UNBOUND form (#1307)', async () => {
+    // THE headline assertion of #1307, and the one-line proof the whole change
+    // works. `/feedback/triage-split` renders a `<form>` with NO action and NO
+    // method, so a browser defaults it to GET. Both of its buttons bind their
+    // own action, and "Publish" is rendered by a COMPONENT, which SSR renders
+    // in a separate pass that cannot see this page at all.
+    //
+    // Before the change this submitted as a GET: the identity rode the query
+    // string, the page re-rendered, and nothing ran. A 200 with no log, which
+    // is exactly why detection was the original plan and making it WORK is the
+    // better one.
+    //
+    // COUNTERFACTUAL: delete the `formmethod` / `formenctype` injection from
+    // `bindSubmitterStartTag` and this test goes red, because the button falls
+    // back to the form's GET default and the action never runs.
+    const p = await paBrowser.newPage();
+    await p.setJavaScriptEnabled(false);
+    try {
+      await p.goto(`${paBase}/feedback/triage-split`, { waitUntil: 'domcontentloaded', timeout: 10000 });
+
+      // The served markup carries the whole submission on the button itself.
+      const shape = await p.evaluate(() => {
+        const btn = document.getElementById('publish');
+        const form = btn.closest('form');
+        return {
+          formMethodAttr: form.getAttribute('method'),
+          formActionAttr: form.getAttribute('action'),
+          name: btn.getAttribute('name'),
+          value: btn.getAttribute('value'),
+          formmethod: btn.getAttribute('formmethod'),
+          formenctype: btn.getAttribute('formenctype'),
+          formaction: btn.getAttribute('formaction'),
+        };
+      });
+      assert.equal(shape.formMethodAttr, null, 'the host form declares no method');
+      assert.equal(shape.formActionAttr, null, 'and binds no action');
+      assert.equal(shape.name, '__webjs_action', 'the component-rendered button carries the identity');
+      assert.ok(/\/publishDraft$/.test(shape.value || ''), `identity value, got "${shape.value}"`);
+      assert.equal(shape.formmethod, 'post', 'and supplies its own method');
+      assert.equal(shape.formenctype, 'multipart/form-data', 'and its own enctype');
+      assert.equal(shape.formaction, null, 'no formaction url is emitted');
+
+      // And it actually RUNS, which is the part markup alone cannot prove.
+      await p.type('#note', 'ship it');
+      await Promise.all([
+        p.waitForNavigation({ waitUntil: 'domcontentloaded', timeout: 10000 }),
+        p.click('#publish'),
+      ]);
+      const ran = await p.evaluate(() => document.getElementById('ran')?.textContent || '');
+      assert.equal(ran, 'publishDraft',
+        `the action must RUN from an unbound form, got "${ran}"`);
+    } finally { await p.close(); }
+  });
+
+  test('JS DISABLED: the INLINE bound submitter in the same unbound form runs too', async () => {
+    // The sibling path. "Save draft" is written inline in the page template, so
+    // SSR sees it in the same scan as the form and knew that form was unbound.
+    // That is the case the renderer used to REFUSE outright, as distinct from
+    // the component case it bound anyway. Both now bind and both work.
+    const p = await paBrowser.newPage();
+    await p.setJavaScriptEnabled(false);
+    try {
+      await p.goto(`${paBase}/feedback/triage-split`, { waitUntil: 'domcontentloaded', timeout: 10000 });
+      await p.type('#note', 'later');
+      await Promise.all([
+        p.waitForNavigation({ waitUntil: 'domcontentloaded', timeout: 10000 }),
+        p.click('#save'),
+      ]);
+      const ran = await p.evaluate(() => document.getElementById('ran')?.textContent || '');
+      assert.equal(ran, 'saveDraft', `the inline submitter's action must run, got "${ran}"`);
+    } finally { await p.close(); }
+  });
+
   test('JS DISABLED: a failing submitter action re-renders THIS page at 422', async () => {
     // The per-button path has to reach the same 422 re-render as the form-level
     // one, or a validation failure on a submitter action would lose the page.

From dcbdb5ddfe640140b84b6f7922aae8545eb64fd4 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Fri, 7 Aug 2026 14:33:27 +0530
Subject: [PATCH 04/13] fix: balance a template hole in matchClosingBrace

The scanner kept one flat depth counter and incremented it at `${`, but the
matching `}` arrived while it was still in template state, so nothing ever
decremented it. Depth could not return to zero, and a class body containing an
interpolated template was unmatchable.

A template hole is a code context nested INSIDE a template, not a brace in the
enclosing block, so it gets its own frame on a stack. The `}` that returns that
frame to zero pops back into the template rather than counting toward the block
being matched.

Latent rather than live: every caller passes a position-preserving mask in
which holes are already blanked, so no caller has ever fed it a `${`. Fixed
independently of the form-submitter work it was found alongside, and committed
on its own because it is its own defect in a shared lexer.

The new test's counterfactual is the flat counter: it returns -1 for a balanced
body and the template-hole case goes red.
---
 packages/server/AGENTS.md                     |  2 +-
 packages/server/src/js-scan.js                | 54 +++++++++---
 .../test/scanner/match-closing-brace.test.js  | 85 +++++++++++++++++++
 3 files changed, 127 insertions(+), 14 deletions(-)
 create mode 100644 packages/server/test/scanner/match-closing-brace.test.js

diff --git a/packages/server/AGENTS.md b/packages/server/AGENTS.md
index 846f0c677..6cbd5264b 100644
--- a/packages/server/AGENTS.md
+++ b/packages/server/AGENTS.md
@@ -86,7 +86,7 @@ with metadata, Suspense, streaming) for HTML, or `api.js` /
 | `component-elision.js` | Static analyser deciding which display-only component modules can be elided from the browser, plus the serve-time side-effect-import stripper. Conservative denylist of interactivity signals (single source of truth). `analyzeElision` also returns `shippedRouteModules` (#646): for each page/layout that ships whole (neither inert nor import-only), the first client-effecting blocker that pins it (a non-component on a component-free path from the module, #963, or `null` when the module's own code is the cause) plus a human `reason`. It further returns `componentVerdicts` (#1308): per component FILE, its sorted tag list, whether it ships, and the EVIDENCE that forced it (`own` / `observed` / `closure` / `render` / `import` / `unreadable`, first match wins) plus the module that did the forcing. Both are projections of what the passes already computed, never a second analysis. A reporting layer over the existing verdict, consumed by the `webjs doctor` advisory |
 | `elision-report.js` | `analyzeAppElision(appDir)` (#646, #1308): builds the module graph + runs `analyzeElision` ONCE, returning the WHOLE verdict as a sorted, app-relative, JSON-serializable `{ analysed, skipped, components, routeModules, orphans, summary }`. Both directions: which component modules the browser never downloads and why each shipped one ships, which page/layout is inert / import-only / shipped, and every orphan class that gets no verdict at all. Consumed by `webjs elision` (plus `--json`), the MCP `list_elision` tool, and BOTH `webjs doctor` elision checks, which share one call so the graph is built once. `skipped` names why nothing was analysed (`no-app` / `elide-off` / `unanalysable`), and the report caches nothing (every consumer runs once and exits). A reporting layer over the analysis, NOT a build (webjs is no-build) |
 | `elision-differential.js` | The differential primitives shared by the framework's own guard and the app-facing one (#1308): `maskJsSet(html)` (the ONE definition of the JS-loaded set, so `test/elision/differential-elision.test.js` and `webjs elision --verify` can never disagree about what the invariant means) and `staticPageRoutes(table)` (the dynamic-free render corpus). A leaf: no filesystem, no module graph |
-| `js-scan.js` | Shared lexical scanners (`redactStringsAndTemplates`, `redactToPlaceholders`, `extractWebComponentClassBodies`, `matchClosingBrace`) used by `check.js`, `component-scanner.js`, and `component-elision.js`. `redactToPlaceholders` (#634) masks comments and replaces each string / template body with a `__STR_<idx>__` placeholder (originals returned in a `literals` array, `${...}` holes scanned as code), so the component scanner and the elision import / side-effect scanners see a real top-level `register(...)` / `import` while an identical token shown inside a code-sample string is inert |
+| `js-scan.js` | Shared lexical scanners (`redactStringsAndTemplates`, `redactToPlaceholders`, `extractWebComponentClassBodies`, `matchClosingBrace`) used by `check.js`, `component-scanner.js`, and `component-elision.js`. **`matchClosingBrace` keeps a STACK of frames, not one flat depth counter** (#1307): a `${` hole is a code context nested inside a template, so it pushes its own frame and the `}` that closes it pops back into the template instead of counting toward the block being matched. The flat counter incremented at `${` and never decremented (the closing `}` arrived while still in template state), so a class body containing an interpolated template was unmatchable. It stayed latent because every caller passes a position-preserving MASK in which holes are already blanked, so none ever fed it a `${`. `redactToPlaceholders` (#634) masks comments and replaces each string / template body with a `__STR_<idx>__` placeholder (originals returned in a `literals` array, `${...}` holes scanned as code), so the component scanner and the elision import / side-effect scanners see a real top-level `register(...)` / `import` while an identical token shown inside a code-sample string is inert |
 | `fs-walk.js` | Async recursive directory walker |
 | `logger.js` | `defaultLogger` (JSON-shaped in prod, pretty in dev) |
 
diff --git a/packages/server/src/js-scan.js b/packages/server/src/js-scan.js
index 7b4e6e2a0..d307f5771 100644
--- a/packages/server/src/js-scan.js
+++ b/packages/server/src/js-scan.js
@@ -632,28 +632,46 @@ export function matchClosingParenthesis(s, start) {
  * `}` inside `'…'`, `"…"`, or backtick templates don't decrement depth.
  * Returns -1 if no balanced brace is found.
  *
+ * A template hole is a CODE context nested inside a template, not a brace in
+ * the enclosing block, so it gets its own frame on the stack: `${` pushes,
+ * and the `}` that returns that frame to depth zero pops back into the
+ * template rather than counting toward the block being matched. An earlier
+ * version incremented the outer depth at `${` and then never decremented it
+ * (the closing `}` arrived while still in template state), so depth could
+ * never return to zero and a class body holding `` html`…${x}…` `` was
+ * unmatchable. Every caller passes a masked source in which holes are already
+ * blanked, so the bug is invisible until one passes raw source.
+ *
  * @param {string} s
  * @param {number} start
  */
 export function matchClosingBrace(s, start) {
-  let depth = 1;
+  // Innermost first. `tpl` frames are template literals (no brace counting);
+  // `!tpl` frames are code, each with its own depth.
+  /** @type {Array<{ tpl: boolean, depth: number }>} */
+  const stack = [{ tpl: false, depth: 1 }];
   let i = start;
-  let str = ''; // '', "'", '"', or backtick
   while (i < s.length) {
+    const top = stack[stack.length - 1];
     const c = s[i];
-    if (str) {
+    if (top.tpl) {
       if (c === '\\') { i += 2; continue; }
-      if (c === str) str = '';
-      else if (str === '`' && c === '$' && s[i + 1] === '{') {
-        // template hole, count its closing `}` toward our brace depth.
-        depth++;
-        i += 2;
-        continue;
-      }
+      if (c === '`') { stack.pop(); i++; continue; }
+      if (c === '$' && s[i + 1] === '{') { stack.push({ tpl: false, depth: 1 }); i += 2; continue; }
       i++;
       continue;
     }
-    if (c === "'" || c === '"' || c === '`') { str = c; i++; continue; }
+    if (c === "'" || c === '"') {
+      i++;
+      while (i < s.length) {
+        if (s[i] === '\\') { i += 2; continue; }
+        const d = s[i];
+        i++;
+        if (d === c || d === '\n') break;   // closed, or unterminated at EOL
+      }
+      continue;
+    }
+    if (c === '`') { stack.push({ tpl: true, depth: 0 }); i++; continue; }
     if (c === '/' && s[i + 1] === '/') { // line comment
       while (i < s.length && s[i] !== '\n') i++;
       continue;
@@ -664,8 +682,18 @@ export function matchClosingBrace(s, start) {
       i += 2;
       continue;
     }
-    if (c === '{') depth++;
-    else if (c === '}') { depth--; if (depth === 0) return i; }
+    if (c === '{') { top.depth++; i++; continue; }
+    if (c === '}') {
+      top.depth--;
+      // Depth zero closes this frame: the outermost one is the answer, an inner
+      // one is a template hole ending and hands control back to its template.
+      if (top.depth === 0) {
+        if (stack.length === 1) return i;
+        stack.pop();
+      }
+      i++;
+      continue;
+    }
     i++;
   }
   return -1;
diff --git a/packages/server/test/scanner/match-closing-brace.test.js b/packages/server/test/scanner/match-closing-brace.test.js
new file mode 100644
index 000000000..653bec6bf
--- /dev/null
+++ b/packages/server/test/scanner/match-closing-brace.test.js
@@ -0,0 +1,85 @@
+/**
+ * `matchClosingBrace`: balance a `{` against its `}` across strings, comments,
+ * regex-free JS, and nested template literals.
+ *
+ * The template-hole case is the one worth a dedicated file. A hole is a CODE
+ * context nested inside a template, not a brace in the enclosing block. The
+ * previous implementation kept ONE flat depth counter and incremented it at
+ * `${`, but the matching `}` arrived while the scanner was still in template
+ * state, so nothing ever decremented it. Depth could not return to zero and a
+ * class body containing an interpolated template was unmatchable.
+ *
+ * It stayed invisible because every caller passes a position-preserving MASK
+ * in which holes are already blanked, so no caller ever fed it a `${`. That is
+ * exactly the kind of latent defect a shared lexer should not be carrying, and
+ * the counterfactual below pins the fix rather than the symptom.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { matchClosingBrace } from '../../src/js-scan.js';
+
+/** Index of the `}` that closes the `{` at index 0. */
+function close(src) {
+  assert.equal(src[0], '{', 'fixture must start at the opening brace');
+  return matchClosingBrace(src, 1);
+}
+
+test('matches a plain nested block', () => {
+  const src = '{ a { b } }';
+  assert.equal(close(src), src.length - 1);
+});
+
+test('walks PAST a template hole, which the flat depth counter could not', () => {
+  // The regression case. With one counter this returns -1, because `${`
+  // incremented a depth that its own `}` never decremented.
+  const src = '{ render() { return html`<p>${x}</p>`; } }';
+  assert.equal(close(src), src.length - 1);
+});
+
+test('handles several holes, and a hole holding braces of its own', () => {
+  for (const src of [
+    '{ html`${a}${b}` }',
+    '{ html`${ { k: 1 } }` }',
+    '{ html`${ items.map((i) => html`<li>${i}</li>`) }` }',
+  ]) {
+    assert.equal(close(src), src.length - 1, src);
+  }
+});
+
+test('a brace inside a string or a template TEXT run is not counted', () => {
+  for (const src of [
+    '{ const a = "}"; }',
+    "{ const a = '}'; }",
+    '{ const a = `}`; }',
+    '{ const a = "${x}"; }',
+  ]) {
+    assert.equal(close(src), src.length - 1, src);
+  }
+});
+
+test('a brace inside a comment is not counted', () => {
+  for (const src of [
+    '{ // }\n }',
+    '{ /* } */ }',
+    '{ /* ` */ }',
+  ]) {
+    assert.equal(close(src), src.length - 1, src);
+  }
+});
+
+test('an escaped quote does not end the string early', () => {
+  const src = '{ const a = "\\"}"; }';
+  assert.equal(close(src), src.length - 1);
+});
+
+test('an unterminated single-quoted string stops at the newline, not at EOF', () => {
+  // A JS string cannot span a raw newline, so treating one as still-open would
+  // swallow the rest of the file and report no match for a perfectly balanced
+  // block.
+  const src = "{ const a = 'oops\n }";
+  assert.equal(close(src), src.length - 1);
+});
+
+test('returns -1 when there is genuinely no balanced brace', () => {
+  assert.equal(close('{ a { b }'), -1);
+});

From 58ae261a1e763a2c779bd0790b0ea2a0b0b1a22c Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Fri, 7 Aug 2026 14:36:44 +0530
Subject: [PATCH 05/13] feat: report at submit time when a submission cannot
 deliver its action

The renderer deliberately stopped refusing a plain submitter's own formmethod
and formenctype, because native HTML defines what those mean and an author who
typed one meant it. That leaves an honest gap: the shape is also what a mistake
looks like, and nothing else in the pipeline can tell the two apart.

Submit time can, because it is the only moment the resolved method, the
resolved enctype and whether a bound identity is actually in the body all exist
together. So a dev-only console.error reports it there, once per shape, and is
silent in production where the visitor could not act on it anyway.

Placed BEFORE the text/plain bail rather than after. Putting it after made the
text/plain branch dead code, which a test caught: that is precisely the case
where the router declines the submission, both paths are answered with a 405,
and the author gets no other signal.

The enctype test is `text/plain` alone, NOT the renderer's parseable-enctype
allowlist. `enctype` is an enumerated attribute whose missing and invalid value
defaults are both urlencoded, so `enctype="nonsense"` submits a parseable body
and the action runs; testing the allowlist would report that working form as
broken.

Two of the new tests initially passed for the wrong reason. A `submit` listener
on the container bubbles BEFORE the router's document-level one, so it set
defaultPrevented and onSubmit returned at its first line, meaning the router
never made the decision being measured. The suite's nav guard already handles
this correctly by listening on window bubble, and its own docs warn about the
capture-phase version of the same mistake.
---
 packages/core/src/router-client.js            |  72 ++++++++++-
 .../browser/form-action-submit.test.js        | 114 ++++++++++++++++--
 2 files changed, 175 insertions(+), 11 deletions(-)

diff --git a/packages/core/src/router-client.js b/packages/core/src/router-client.js
index e3d8fe9ed..67cfcf788 100644
--- a/packages/core/src/router-client.js
+++ b/packages/core/src/router-client.js
@@ -8,6 +8,7 @@ import './webjs-frame.js';
 // live-channel `connectWS` handler.
 import './webjs-stream.js';
 import { renderStream } from './webjs-stream.js';
+import { FORM_ACTION_FIELD } from './form-action.js';
 // Register <webjs-suspense> (the element-level streaming boundary, #471) so it
 // is layout-neutral and available for the progressive soft-nav streaming apply.
 import './webjs-suspense.js';
@@ -876,6 +877,15 @@ function onSubmit(e) {
   // method ignores the enctype entirely, per the form-submission algorithm.
   const enctype = getSubmitEnctype(form, submitter);
   const isSafeMethod = method === 'get' || method === 'head';
+
+  // The dev report runs BEFORE the bail below, not after it. `text/plain` is
+  // precisely the case where the router declines the submission, so a guard
+  // placed after the bail would be dead code for the one shape that most needs
+  // reporting: both paths are then answered with a 405 and the author gets no
+  // other signal. Observational, and silent in production.
+  const rawBody = buildSubmitFormData(form, submitter);
+  warnIfActionSubmissionCannotDeliver(form, submitter, method, rawBody);
+
   if (!isSafeMethod && enctype === 'text/plain') return;
 
   const action = getSubmitAction(form, submitter);
@@ -885,7 +895,7 @@ function onSubmit(e) {
   if (url.origin !== location.origin) return;
   if (NON_HTML_EXTENSIONS.test(url.pathname)) return;
 
-  const body = encodeSubmitBody(buildSubmitFormData(form, submitter), enctype);
+  const body = encodeSubmitBody(rawBody, enctype);
 
   e.preventDefault();
   // Resolve the target frame for the submit, same precedence as a link:
@@ -1134,10 +1144,66 @@ function resolveTargetFrameId(trigger) {
  */
 const warnedKeys = new Set();
 /** @param {string} key @param {string} message */
-function warnOnce(key, message) {
+function warnOnce(key, message, level = 'warn') {
   if (warnedKeys.has(key)) return;
   warnedKeys.add(key);
-  if (typeof console !== 'undefined' && console.warn) console.warn(message);
+  if (typeof console === 'undefined') return;
+  const fn = level === 'error' ? console.error : console.warn;
+  if (fn) fn.call(console, message);
+}
+
+/**
+ * DEV-ONLY: report at submit time when a submission is carrying a bound
+ * action's identity it cannot actually deliver (#1307).
+ *
+ * This is the backstop for the shapes the renderer deliberately stopped
+ * refusing. A PLAIN `<button formmethod="get">` inside a bound form is a legal
+ * native override, so it renders, and the form's action then simply does not
+ * run. That is what the author asked for, but it is also what a mistake looks
+ * like, and submit time is the only moment the whole picture (the resolved
+ * method, the resolved enctype, and whether a bound identity is actually in
+ * the body) exists in one place.
+ *
+ * Observational: it runs BEFORE `preventDefault` and changes nothing about the
+ * submission. Silent in production, where a console error would be noise the
+ * visitor cannot act on; the server-side `onError` telemetry covers that side.
+ *
+ * @param {HTMLFormElement} form
+ * @param {HTMLElement | null} submitter
+ * @param {string} method lowercased, already resolved with native precedence
+ * @param {FormData} body
+ */
+function warnIfActionSubmissionCannotDeliver(form, submitter, method, body) {
+  if (typeof process !== 'undefined' && process.env && process.env.NODE_ENV === 'production') return;
+  // No identity in the body: an ordinary form with nothing to deliver.
+  if (!body.has(FORM_ACTION_FIELD)) return;
+  let path = '';
+  try { path = new URL(form.getAttribute('action') || location.href, location.href).pathname; }
+  catch { path = location.pathname; }
+  if (method !== 'post') {
+    warnOnce(
+      `submit-nowhere:${path}:${method}`,
+      `[webjs] this submission carries a bound server action's identity but submits as ${method.toUpperCase()}, which sends no body, so the identity rides the query string and the action never runs. A submitter's own formmethod overrides the form's, and WebJs honours it rather than refusing it, so check for a formmethod on the button that was pressed.`,
+      'error',
+    );
+    return;
+  }
+  const enctype = (submitter && submitter.getAttribute('formenctype'))
+    || form.getAttribute('enctype')
+    || 'application/x-www-form-urlencoded';
+  // `text/plain` ONLY, not the renderer's parseable-enctype allowlist.
+  // `enctype` is an enumerated attribute whose missing AND invalid value
+  // defaults are both `application/x-www-form-urlencoded`, so
+  // `enctype="nonsense"` submits a perfectly parseable body and the action
+  // runs. Testing against the allowlist would report that working form as
+  // broken.
+  if (enctype.toLowerCase() === 'text/plain') {
+    warnOnce(
+      `submit-nowhere:${path}:${enctype}`,
+      `[webjs] this submission carries a bound server action's identity but declares enctype="${enctype}", which the server cannot parse. The router declines to send it so both paths behave the same way, and both are answered with a 405. Drop the enctype and let the binding supply it.`,
+      'error',
+    );
+  }
 }
 
 /**
diff --git a/packages/core/test/routing/browser/form-action-submit.test.js b/packages/core/test/routing/browser/form-action-submit.test.js
index 03ada250e..52de3b64a 100644
--- a/packages/core/test/routing/browser/form-action-submit.test.js
+++ b/packages/core/test/routing/browser/form-action-submit.test.js
@@ -286,16 +286,114 @@ suite('Client router: bound form submissions (#1155)', () => {
           <button type="submit">go</button>
         </form>
       `, container);
-      const btn = container.querySelector('button');
-      // Stop the native submission the bail deliberately allows, so the test
-      // page is not navigated away. The router runs on the BUBBLE phase, so a
-      // capture-phase listener here would pre-empt what is being measured.
-      const stop = (e) => e.preventDefault();
-      container.addEventListener('submit', stop);
-      btn.click();
+      // The native submission this bail deliberately allows is cancelled by
+      // the suite's nav guard, which listens on WINDOW bubble, i.e. after the
+      // router's own document-bubble listener. A listener on `container` would
+      // run BEFORE the router and set `defaultPrevented`, so `onSubmit` would
+      // return at its first line and this test would pass without the router
+      // ever making the decision it claims to measure.
+      container.querySelector('button').click();
       await tick();
-      container.removeEventListener('submit', stop);
       assert.equal(calls.length, 0, 'the router did not take it');
     } finally { teardown(); }
   });
+
+  // -------------------------------------------------------------------------
+  // #1307: the dev-time submit guard.
+  //
+  // The renderer deliberately stopped refusing a PLAIN submitter's own
+  // `formmethod` / `formenctype`, because native HTML defines what those mean
+  // and the author wrote them on purpose. That leaves one honest gap: the
+  // shape is also what a mistake looks like. Submit time is the only moment
+  // the resolved method, the resolved enctype, and whether a bound identity is
+  // actually in the body all exist together, so the report happens there.
+  //
+  // Observational by construction: it runs before `preventDefault` and changes
+  // nothing about the submission.
+  // -------------------------------------------------------------------------
+
+  function captureErrors(fn) {
+    const orig = console.error;
+    const seen = [];
+    console.error = (...a) => { seen.push(a.join(' ')); };
+    try { return fn(seen); } finally { console.error = orig; }
+  }
+
+  test('a bound identity submitted as GET logs once, and still submits', async () => {
+    setup(okHtml);
+    try {
+      await captureErrors(async (seen) => {
+        render(html`
+          <form method="post">
+            <input type="hidden" name="__webjs_action" value="a1b2c3d4e5/act">
+            <button type="submit" formmethod="get">go</button>
+          </form>
+        `, container);
+        container.querySelector('button').click();
+        await tick();
+        assert.ok(
+          seen.some((m) => /never runs/.test(m)),
+          `expected a submit-time console.error, saw: ${JSON.stringify(seen)}`,
+        );
+      });
+    } finally { teardown(); }
+  });
+
+  test('the guard stays silent for a form carrying no bound identity', async () => {
+    // An ordinary hand-written form is not this feature's business, and a
+    // console error on every plain GET form would be pure noise.
+    setup(okHtml);
+    try {
+      await captureErrors(async (seen) => {
+        render(html`
+          <form method="get" action="/search">
+            <input name="q" value="x">
+            <button type="submit">go</button>
+          </form>
+        `, container);
+        container.querySelector('button').click();
+        await tick();
+        assert.equal(seen.length, 0, `expected silence, saw: ${JSON.stringify(seen)}`);
+      });
+    } finally { teardown(); }
+  });
+
+  test('the guard fires for text/plain but NOT for an invalid enctype', async () => {
+    // `enctype` is an enumerated attribute whose invalid-value default is
+    // urlencoded, so `nonsense` submits a perfectly parseable body and the
+    // action runs. Testing against the renderer's parseable-enctype allowlist
+    // instead of `text/plain` alone would report that working form as broken.
+    setup(okHtml);
+    try {
+      await captureErrors(async (seen) => {
+        render(html`
+          <form method="post" enctype="nonsense">
+            <input type="hidden" name="__webjs_action" value="a1b2c3d4e5/act">
+            <button type="submit">go</button>
+          </form>
+        `, container);
+        container.querySelector('button').click();
+        await tick();
+        assert.equal(seen.length, 0, `an invalid enctype is urlencoded and works, saw: ${JSON.stringify(seen)}`);
+      });
+    } finally { teardown(); }
+
+    setup(okHtml);
+    try {
+      await captureErrors(async (seen) => {
+        render(html`
+          <form method="post" enctype="text/plain" action="/never">
+            <input type="hidden" name="__webjs_action" value="a1b2c3d4e5/act">
+            <button type="submit">go</button>
+          </form>
+        `, container);
+        container.querySelector('button').click();
+        await tick();
+        assert.ok(
+          seen.some((m) => /cannot parse/.test(m)),
+          `expected the text/plain report, saw: ${JSON.stringify(seen)}`,
+        );
+      });
+    } finally { teardown(); }
+  });
 });

From aab7b1e46e9149e8c3951f682ad5ec9765a6f49e Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Fri, 7 Aug 2026 14:37:50 +0530
Subject: [PATCH 06/13] fix: build the submission body after the cheap bails,
 not before

The previous commit moved `buildSubmitFormData` ahead of the origin and
file-extension checks so the dev report could precede the text/plain bail. That
reached the FormData construction for submissions the router ignores, and two
pre-existing unit tests went red: `new FormData(formElement)` throws under the
linkedom harness those tests run in.

Move the text/plain bail down instead. The order is now the cheap bails, then
the body, then the report, then the bail, which keeps the report ahead of the
bail (the reason for the original move) without building a body for a
submission that was never going to be routed.

I committed the previous change with those two tests already failing, because
the verifying command was chained with `&&` on a grep that succeeded whatever
the tally said. The tally was in the output and I did not read it.
---
 packages/core/src/router-client.js | 38 ++++++++++++++++--------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/packages/core/src/router-client.js b/packages/core/src/router-client.js
index 67cfcf788..456aec28a 100644
--- a/packages/core/src/router-client.js
+++ b/packages/core/src/router-client.js
@@ -867,27 +867,9 @@ function onSubmit(e) {
   const method = getSubmitMethod(form, submitter);
   if (method === 'dialog') return;
 
-  // #1307: `text/plain` is a legal native encoding the server cannot parse
-  // (`looksLikeFormSubmission` accepts multipart and urlencoded only), and
-  // there is no honest way to send it over `fetch` and have the response mean
-  // anything. Bail to the browser so BOTH paths do the same thing, rather than
-  // silently sending multipart, which is what made the same form behave one way
-  // with JS and another way without it. Turbo enumerates this encoding and then
-  // sends FormData anyway, which is the divergence being avoided here. A safe
-  // method ignores the enctype entirely, per the form-submission algorithm.
   const enctype = getSubmitEnctype(form, submitter);
   const isSafeMethod = method === 'get' || method === 'head';
 
-  // The dev report runs BEFORE the bail below, not after it. `text/plain` is
-  // precisely the case where the router declines the submission, so a guard
-  // placed after the bail would be dead code for the one shape that most needs
-  // reporting: both paths are then answered with a 405 and the author gets no
-  // other signal. Observational, and silent in production.
-  const rawBody = buildSubmitFormData(form, submitter);
-  warnIfActionSubmissionCannotDeliver(form, submitter, method, rawBody);
-
-  if (!isSafeMethod && enctype === 'text/plain') return;
-
   const action = getSubmitAction(form, submitter);
   /** @type {URL} */ let url;
   try { url = new URL(action, location.href); }
@@ -895,6 +877,26 @@ function onSubmit(e) {
   if (url.origin !== location.origin) return;
   if (NON_HTML_EXTENSIONS.test(url.pathname)) return;
 
+  // Built once, after the cheap bails (a submission the router ignores should
+  // not pay for a FormData) and BEFORE the text/plain bail below. That order
+  // matters for the dev report: `text/plain` is precisely the case where the
+  // router declines the submission, so reporting after the bail would be dead
+  // code for the one shape that most needs it, since both paths are then
+  // answered with a 405 and the author gets no other signal.
+  const rawBody = buildSubmitFormData(form, submitter);
+  // Observational, and silent in production. Runs before `preventDefault`.
+  warnIfActionSubmissionCannotDeliver(form, submitter, method, rawBody);
+
+  // #1307: `text/plain` is a legal native encoding the server cannot parse
+  // (`looksLikeFormSubmission` accepts multipart and urlencoded only), and
+  // there is no honest way to send it over `fetch` and have the response mean
+  // anything. Bail to the browser so BOTH paths do the same thing, rather than
+  // silently sending multipart, which is what made the same form behave one
+  // way with JS and another way without it. Turbo enumerates this encoding and
+  // then sends FormData anyway, which is the divergence being avoided here. A
+  // safe method ignores the enctype entirely, per the submission algorithm.
+  if (!isSafeMethod && enctype === 'text/plain') return;
+
   const body = encodeSubmitBody(rawBody, enctype);
 
   e.preventDefault();

From c93b9eb0d60c7c7ac95fdb164227a7ffdaa5bdab Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Fri, 7 Aug 2026 14:46:24 +0530
Subject: [PATCH 07/13] feat: report a form that submitted nowhere through
 onError

Two detect-only diagnostics, each with an err.code an app can group on.

WEBJS_FORM_ACTION_MISSING: a parseable form body carrying no identity, which
is answered with a 405 and otherwise leaves nothing but an anonymous status in
an access log.

WEBJS_FORM_SUBMITTED_AS_GET: a page GET carrying the reserved field in its
query string, meaning a submission holding a bound action's identity went out
as a GET, so the action never ran and the page still returned 200. Nothing in
the framework puts that field in a url. A bound submitter now carries its own
formmethod="post", so what reaches this is an explicit formmethod="get" or
method="get" the author wrote and the renderer deliberately honours. It is the
production counterpart to the dev-time console error the router logs at submit
time, and it is why honouring the override rather than refusing it does not
mean shipping a silent failure.

Both keep rendering their normal response. Answering a GET differently because
of a query parameter would hand any visitor a way to turn any page into an
error. Both carry field NAMES and never values, and both dedupe per process on
code plus method plus matched ROUTE with a 256-entry cap, because either is
reachable unauthenticated and an uncapped report is a free amplifier into a
paid sink. Keying on the route pattern rather than the pathname is what stops
crafted urls on a dynamic route from filling the cap and silencing the
diagnostics.

Applying the original patch with `git apply --3way` silently reverted unrelated
newer work in dev.js, including #1308's orphan warning and the elision verdict
fields, because it was computed against an older main. One test caught it. The
hunk is hand-applied instead, threading hasOnError and logger through
handleCore's context rather than reaching for a binding that is not in scope
there.
---
 .agents/skills/webjs/references/built-ins.md  |   4 +-
 packages/server/AGENTS.md                     |   2 +-
 packages/server/src/dev.js                    |  23 ++-
 packages/server/src/form-dispatch.js          | 172 +++++++++++++++++-
 .../server/test/routing/form-dispatch.test.js | 137 ++++++++++++++
 website/app/docs/deployment/page.ts           |   4 +-
 website/app/docs/server-actions/page.ts       |   3 +-
 website/app/docs/troubleshooting/page.ts      |  11 +-
 8 files changed, 341 insertions(+), 15 deletions(-)

diff --git a/.agents/skills/webjs/references/built-ins.md b/.agents/skills/webjs/references/built-ins.md
index 3aadfb86c..65edf7396 100644
--- a/.agents/skills/webjs/references/built-ins.md
+++ b/.agents/skills/webjs/references/built-ins.md
@@ -231,9 +231,9 @@ Two guarantees worth knowing. A result that could not check (a network or toolch
 
 Wired at the single response funnel, covering pages, routes, actions, and assets uniformly.
 
-- **Access log.** One structured `info` line per handled request (`method`, `path`, `status`, `durationMs`, `requestId`, plus a dev-only `seed` field on a page render carrying the SSR action-seeding counters, #1309). Never logs bodies or secrets; framework `/__webjs/*` traffic is suppressed.
+- **Access log.** One structured `info` line per handled request (`method`, `path`, `status`, `durationMs`, `requestId`). Never logs bodies or secrets; framework `/__webjs/*` traffic is suppressed.
 - **Request id.** Each request gets a `crypto.randomUUID()` correlation id, set as `X-Request-Id` (honoring a trusted inbound one) and readable server-side with `requestId()` from `@webjsdev/server` (returns `null` outside a request scope).
-- **`onError` hook.** Register via `createRequestHandler({ onError })` or `startServer({ onError })`. Called with `(error, { request, requestId, phase })` on any caught pipeline error, before the sanitized response is sent. Best-effort (a throwing hook is ignored), purely additive (the sanitized 500 / action digest is unchanged). Point it at Sentry or an APM.
+- **`onError` hook.** Register via `createRequestHandler({ onError })` or `startServer({ onError })`. Called with `(error, { request, requestId, phase })` on any caught pipeline error, before the sanitized response is sent. Best-effort (a throwing hook is ignored), purely additive (the sanitized 500 / action digest is unchanged). Point it at Sentry or an APM. It also carries two framework DIAGNOSTICS that are not request failures, each with an `err.code` to group or filter on, both under `phase: 'action'`: `WEBJS_FORM_SUBMITTED_AS_GET` (a page GET carrying the reserved `__webjs_action` field in its query string, so a submission holding a bound action's identity went out as a GET and the action never ran, #1307; a bound submitter carries its own `formmethod="post"`, so what reaches this is an explicit `formmethod="get"` / `method="get"` the author wrote and the renderer honours rather than refuses) and `WEBJS_FORM_ACTION_MISSING` (a PARSEABLE form body carrying no identity, the 405; an `enctype="text/plain"` submission is answered before its body is read, so it stays a bare 405). Both are detect-only, so the 200 and the 405 are unchanged; both carry `method`, `pathname`, and for the second the submitted field NAMES, never the values; and both are deduplicated per process on the code, the method, and the matched ROUTE (not the request pathname, so crafted urls on a dynamic route cannot exhaust the 256-entry cap and silence the diagnostics), since either is reachable by an unauthenticated request and an uncapped report would be a free amplifier into a paid sink.
 
 ```ts
 const app = await createRequestHandler({
diff --git a/packages/server/AGENTS.md b/packages/server/AGENTS.md
index 6cbd5264b..119278edd 100644
--- a/packages/server/AGENTS.md
+++ b/packages/server/AGENTS.md
@@ -37,7 +37,7 @@ with metadata, Suspense, streaming) for HTML, or `api.js` /
 | `dev-error.js` | Dev error overlay frame builder (#264). `buildDevErrorFrame(error, { kind, appDir, file?, line?, hint?, url? })` returns a JSON-serializable frame (message, parsed `file`/`line`/`column`, a source `codeFrame`, an optional `hint`, and an optional `url`); `parseStackLocation(stack, appDir)` finds the first app frame (preferring non-`node_modules`, splitting off the dev loader's `?t=` cache-bust query); `readCodeFrame(file, line, column)` reads the source excerpt with a `>` line marker + a caret. `url` (#1047) is the request URL that produced the frame, `null` when absent: only a `render` frame carries one, and it is what lets the browser overlay refuse a frame for a page the tab is not viewing. A `ts-strip` / `rebuild` frame passes none and stays unscoped, because it describes a still-broken build rather than one page. PURE (the only side effect is a guarded source read) and DEV-ONLY by the caller's contract, so no path / source is built in prod |
 | `dev-overlay.js` | The BROWSER half of the dev error overlay (#264), a browser-safe module (no node imports) that `reloadClientJs` inlines verbatim after an `export`-keyword strip, so the browser test drives the exact shipping code. `renderDevOverlay(frame, currentPath?)` builds the card with `createElement` + `textContent` ONLY (never `innerHTML`, so a hostile message / path / code frame is inert text); `dismissDevOverlay()` takes it down and forgets any held frame, which is what the Dismiss button calls. **URL scope (#1047):** a url-stamped `render` frame for a different path than `currentPath` (default `location.pathname + location.search`, compared encoding-tolerantly) is NOT rendered. The gate runs BEFORE any removal, so a refused frame neither paints nor wipes a live `rebuild` / `ts-strip` overlay. It cannot simply drop the frame either, because the SSE frame is pushed during the render, before the navigation response is sent, so it arrives while `location` is still the old page: a refused frame goes to a PENDING slot that `syncDevOverlayToLocation(currentPath?)` re-evaluates on the next navigation, which renders it only if the url matches AND it arrived during the navigation now finishing, and drops it otherwise (consume-once, so retention is bounded with no timer). The second half of that condition is what stops a frame held from an IDLE render (another tab's page, a background fetch of some other url, never a link prefetch since that reports nothing) painting on a later visit to that url, when the page may render fine; `markDevOverlayNavStart()` is the nav-start marker it counts. `installDevOverlayNavSync(opts?)` wires all of it to the client router's `webjs:navigate` (applied nav) + `popstate` (a snapshot-cache restore returns before `webjs:navigate`) + `webjs:before-cache` (the nav START, since `snapshotCurrent` runs at the top of every navigation and form submission), and returns an uninstall thunk. Two things keep a snapshot copy of the overlay from becoming an undismissable card (the router's tier-4 popstate restore `replaceChildren`s the body from cached HTML, and a parsed copy is not the node this module holds, so nothing could remove it and its Dismiss button has no listener). `before-cache` DETACHES the overlay across the router's synchronous `outerHTML` read and re-attaches it a microtask later, so the cached HTML carries none. That is what covers the hard ordering: under an opt-in view transition the router defers the body swap PAST the sync, so a copy the swap inserts would arrive after any sweep had already run. The sync additionally SWEEPS any `[data-webjs-error-overlay]` element it does not own, as the backstop for a copy from anywhere else (a snapshot cached before this client installed its listeners, or any other wholesale body replacement). What `before-cache` must NOT do is strip the overlay for good, which the event's own contract invites: it fires on EVERY navigation, so that would tear a `rebuild` / `ts-strip` overlay off the page on any link click while the build was still broken. `packages/core` is untouched: the fix rides existing events |
 | `frame-render.js` | Server-side `<webjs-frame>` subtree extraction (#253). `requestedFrameId(req)` reads the `x-webjs-frame` header (null when absent, the normal full-page path); `extractFrameSubtree(html, id)` returns the `<webjs-frame id>...</webjs-frame>` slice from rendered HTML verbatim (so byte-equivalent by construction), balancing nested `<webjs-frame>` tags and reading the `id` attribute (not a substring match), or null when the id is absent. Used by `ssr.js`'s frame-render branch |
-| `form-dispatch.js` | Form-submission dispatch (#1155, replacing the page `action` export of #244): `runFormAction` verifies Origin, parses the bounded form body, resolves the `__webjs_action` identity, runs the action's declared `validate` + `middleware`, evicts its `invalidates` tags, and maps the `ActionResult` to a response (303 PRG on success, 422 re-render with `actionData` on failure, honoring thrown `redirect()`/`notFound()`/`forbidden()`/`unauthorized()`). An action that returns a `Response` DIRECTLY (e.g. a content-negotiated `streamResponse`, #248) is honored verbatim; a STREAMED return is refused (a submission has no frame consumer). A submission carrying no identity is a 405, an unresolvable hash is a 422 re-render with `ACTION_SKEW_MESSAGE` plus the typed values, and a module that throws at import is a sanitized 500 (never mislabelled as skew). `dev.js` routes EVERY non-GET/HEAD page request here, wrapped in the page's segment middleware |
+| `form-dispatch.js` | Form-submission dispatch (#1155, replacing the page `action` export of #244): `runFormAction` verifies Origin, parses the bounded form body, resolves the `__webjs_action` identity, runs the action's declared `validate` + `middleware`, evicts its `invalidates` tags, and maps the `ActionResult` to a response (303 PRG on success, 422 re-render with `actionData` on failure, honoring thrown `redirect()`/`notFound()`/`forbidden()`/`unauthorized()`). An action that returns a `Response` DIRECTLY (e.g. a content-negotiated `streamResponse`, #248) is honored verbatim; a STREAMED return is refused (a submission has no frame consumer). A submission carrying no identity is a 405, an unresolvable hash is a 422 re-render with `ACTION_SKEW_MESSAGE` plus the typed values, and a module that throws at import is a sanitized 500 (never mislabelled as skew). `dev.js` routes EVERY non-GET/HEAD page request here, wrapped in the page's segment middleware. **Two detect-only `onError` signals (#1307):** `WEBJS_FORM_ACTION_MISSING` for a parseable form body carrying no identity (the 405 above), and `WEBJS_FORM_SUBMITTED_AS_GET` for a page GET carrying the reserved field in its QUERY STRING, which means a submission holding a bound action's identity went out as a GET so the action never ran. Nothing in the framework puts that field in a url, and a bound submitter now carries its own `formmethod="post"`, so what reaches the second signal is an explicit `formmethod="get"` / `method="get"` the author wrote and the renderer deliberately honours; it is the production counterpart to the dev-time client guard. Both keep rendering their normal response (answering differently on a query parameter would let any visitor turn any page into a different status), carry field NAMES and never values, and dedupe per process on code plus method plus matched ROUTE with a 256-entry cap. Keying on the route PATTERN rather than the pathname is load-bearing: keyed on the pathname a dynamic route yields unbounded keys, so a few hundred crafted requests would fill the cap and permanently silence the diagnostics |
 | `form-action-identity.js` | The `<hash>/<fn>` identity a bound form submits (#1155). `resolveActionIdentity` maps a real action function to its identity via the always-on `'use server'` load-hook registry (`action-seed.js`), with a module-scan fallback only on a runtime that installs no hook; `lookupActionIdentity` maps a submitted identity back to `{ file, fnName, module }`, distinguishing an unknown hash (skew) from an unknown export (404) and from an import failure (`load-failed`). The scheme is the RPC endpoint's, so both transports resolve the same string to the same function |
 | `action-seed.js` | SSR action-result seeding (#472, Bun-enabled #529). `registerActionHooks({ seed, dev })` (async, `dev` gating only the determinism assertion below) installs a load hook chosen by `serverRuntime()`: Node's synchronous `module.registerHooks`, or a `Bun.plugin` `onLoad` on Bun (the glue is in `action-seed-bun.js`, dynamically imported so `Bun.*` never loads on Node). For a `'use server'` `*.server.*` module the hook returns a transparent FACADE re-exporting each function wrapped in a `Proxy` (`__actionWrap`); the faceting decision (`isSeedCandidate`) + facade source (`buildSeedFacade`) are runtime-neutral, so both runtimes emit the identical seed. (Bun's `onLoad` must return an object for every filter match, so the non-facet cases serve the raw source.) The Proxy records `(file, fn, args) -> result` into an ambient `AsyncLocalStorage` collector when one is active (a pure passthrough otherwise, so the RPC endpoint path is untouched, and any metadata attached to the function forwards through the Proxy). `collectSeeds(fn)` runs the SSR render inside a fresh collector; `buildSeedScript(collector, { dev, reason })` serializes it into an HTML-escaped `<script type="application/json" id="__webjs-seeds">` block (keyed `hashFile(file)/fn/stringify(args)`, the exact key the client stub looks up); in DEV it stamps a `data-webjs-dev` marker (`ok` / `streamed` / `drop`) and emits the block even when EMPTY, which is the only dev signal the browser can trust (#1309); a serializer throw emits the exported `SEED_DROP_BLOCK` so the browser can name that cause, and `ssr.js` excludes it from `emitted` so the header still reports the divergence. Dev observability (#1309): `recordSeed` warns once per action function when one render records two DIFFERENT results for the same FULL key (compared `Object.is` then through the same serializer, in its own try/catch so a diagnostic failure never drops the seed), and `ssr.js` stamps `X-Webjs-Seed` (`off` / `html-cache` / `collected=<m>, emitted=<n>` / `... streamed`) which `dev.js` folds into the access-log line as `seed`. `seedingEnabled()` gates the `ssr.js` emitter. Installed at boot by `dev.js` UNCONDITIONALLY, because action IDENTITY rides the same hook (#1155: `<form action=${action}>` resolves through `actionIdentitiesOf`, which returns EVERY `{file, fnName}` a function was exported as, defining module first, so the form resolver can prefer the defining module and fall back to an indexed re-exporter; `webjs.seed: false` must not break a no-JS form). Only seed COLLECTION follows the switch (`readSeedEnabled`, default on; `webjs.seed` / `WEBJS_SEED`), and with it off `__actionWrap` registers identity and returns the function unwrapped rather than building a Proxy. Fail-open on every axis: a key miss degrades to a normal RPC (never wrong data), and the facade emits an `export * from '?webjs-seed-orig'` catch-all (#535) so a named export the `extractExportNames` regex MISSES (a destructuring `export const { a }`, an exotic re-export) flows through unwrapped (it still works over a normal RPC, just is not seeded) instead of resolving to `undefined` and crashing the importer. An explicit wrapped `export const NAME` shadows the matching star binding, so an enumerated export is still wrapped and seeded. The per-runtime hook split (Node `registerHooks` vs `Bun.plugin`) is intentional and irreducible: intercepting a native ESM import has no shared API, and a load-hook facade runs pre-evaluation so it cannot use authoritative runtime enumeration. A streamable result (#489) is skipped (`isStreamable`), so a streaming action invoked during SSR neither records a non-serializable value nor drops the page's other seeds. No source transform, no build step |
 | `action-seed-bun.js` | Bun install for SSR action seeding (#529). `installBunSeedPlugin({ isSeedCandidate, buildSeedFacade, serverFileRe })` registers a `Bun.plugin` `onLoad` (the Bun analog of Node's `module.registerHooks` load hook), dynamically imported by `registerActionHooks` only on Bun so the `Bun.*` global never loads on Node (same isolation as `listener-bun.js`). Reuses the runtime-neutral faceting helpers; the only Bun glue is the plugin shell + `Bun.file` source read. Note: a Bun `onLoad` MUST return a `{ contents, loader }` for every filter match (returning `undefined` to defer is an error), so the passthrough / non-`use server` / facet-skip cases serve the raw source with the extension loader. |
diff --git a/packages/server/src/dev.js b/packages/server/src/dev.js
index f2da938dd..48a20befe 100644
--- a/packages/server/src/dev.js
+++ b/packages/server/src/dev.js
@@ -15,7 +15,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { buildRouteTable, matchPage, matchApi } from './router.js';
 import { generateRouteTypes } from './route-types.js';
 import { ssrPage, ssrNotFound, setClientRouterEnabled } from './ssr.js';
-import { runFormAction } from './form-dispatch.js';
+import { runFormAction, reportFormSubmittedAsGet } from './form-dispatch.js';
 import { handleApi } from './api.js';
 import {
   buildActionIndex,
@@ -1517,7 +1517,7 @@ export async function createRequestHandler(opts) {
       // Build all whole-app analysis on the first request (memoized), before
       // any SSR, module serve, gate check, action dispatch, or middleware runs.
       await ensureReady();
-      const next = () => handleCore(req, { state, appDir, coreDir, dev, reportError, reportDevError, cspEnabled: cspConfig.enabled, allowedOrigins: allowedOriginsValue });
+      const next = () => handleCore(req, { state, appDir, coreDir, dev, reportError, reportDevError, hasOnError, logger, cspEnabled: cspConfig.enabled, allowedOrigins: allowedOriginsValue });
       if (state.middleware) {
         try {
           return await state.middleware(req, next);
@@ -2014,7 +2014,7 @@ async function tryServeFrameworkStatic(path, method, ctx) {
 }
 
 async function handleCore(req, ctx) {
-  const { state, appDir, coreDir, dev, reportError, reportDevError, cspEnabled, allowedOrigins } = ctx;
+  const { state, appDir, coreDir, dev, reportError, reportDevError, hasOnError, logger, cspEnabled, allowedOrigins } = ctx;
   const url = new URL(req.url);
   // Decode percent-encoded characters so filesystem lookups match real
   // filenames. Dynamic route segments like `[slug]` and route groups like
@@ -2290,6 +2290,20 @@ async function handleCore(req, ctx) {
           : undefined,
       };
       if (method === 'GET' || method === 'HEAD') {
+        // #1307: `__webjs_action` in the QUERY STRING means a submission
+        // carrying a bound action's identity went out as a GET, so the action
+        // never ran. Nothing else in the framework puts that reserved field in
+        // a url. Detect only, so the render below is unchanged: answering a GET
+        // differently because of a query parameter would hand any visitor a way
+        // to turn any page into an error.
+        reportFormSubmittedAsGet(
+          url, req,
+          // Gated on hasOnError, not on `reportError`: that is always a
+          // function here and no-ops internally, so passing it would spend a
+          // dedupe slot on a report nobody receives.
+          hasOnError ? (e) => reportError(e, req, 'action') : undefined,
+          logger, dev, page.route,
+        );
         // A successful render of URL U supersedes a RETAINED render error for
         // that same URL (#1047), so a reconnecting tab is not handed a frame the
         // page has since recovered from. Keyed on BOTH frame identity and url:
@@ -2318,7 +2332,8 @@ async function handleCore(req, ctx) {
       const deps = {
         actionIndex: state.actionIndex,
         allowedOrigins,
-        onError: reportError ? (e) => reportError(e, req, 'action') : undefined,
+        onError: hasOnError ? (e) => reportError(e, req, 'action') : undefined,
+        logger,
       };
       const handler = () => runFormAction(page.route, page.params, url, req, ssrOpts, deps);
       return runWithSegmentMiddleware(req, page.route.middlewares, handler, dev);
diff --git a/packages/server/src/form-dispatch.js b/packages/server/src/form-dispatch.js
index 1dc31bb9d..00fb0f717 100644
--- a/packages/server/src/form-dispatch.js
+++ b/packages/server/src/form-dispatch.js
@@ -214,6 +214,159 @@ function looksLikeFormSubmission(req) {
   return /multipart\/form-data|application\/x-www-form-urlencoded/i.test(ct);
 }
 
+/**
+ * Fingerprints already reported this process, keyed `CODE METHOD <route>`.
+ * Capped, and never cleared.
+ *
+ * Both signals below are reachable by anyone: an empty urlencoded POST to any
+ * page path, or `?__webjs_action=x` appended to any url. Reporting every hit
+ * would turn a public endpoint into a free amplifier into a paid APM sink, and
+ * an app needs to learn the SHAPE exists rather than count it (a real bug
+ * reproduces on the next boot).
+ *
+ * The key is the matched ROUTE PATTERN, not the request pathname, and that is
+ * load-bearing rather than cosmetic. Keyed on the pathname, a dynamic route
+ * yields unbounded distinct keys, so a few hundred crafted requests to
+ * `/blog/1`, `/blog/2`, … would fill the cap and permanently silence the
+ * diagnostics for the process, which is a worse failure than the amplification
+ * the cap exists to stop. Keyed on the pattern, all of those collapse to one
+ * entry and the key space is bounded by the app's own route count, which leaves
+ * the cap as a backstop no real app reaches. The code is part of the key too, so
+ * a flood of one signal can never silence the other.
+ *
+ * @type {Set<string>}
+ */
+const reportedFormFingerprints = new Set();
+const FINGERPRINT_CAP = 256;
+
+/**
+ * @param {string} key
+ * @returns {boolean} true the first time only, and false once the cap is hit
+ */
+function firstSighting(key) {
+  if (reportedFormFingerprints.has(key)) return false;
+  if (reportedFormFingerprints.size >= FINGERPRINT_CAP) return false;
+  reportedFormFingerprints.add(key);
+  return true;
+}
+
+/**
+ * The matched route's identity for the dedupe key: its page FILE, which is one
+ * per route and reads better in a report than a serialized RegExp (`pattern` is
+ * a RegExp, not a printable path). Falls back to the request pathname only when
+ * a caller has no route in hand.
+ *
+ * @param {{ file?: string } | null | undefined} route
+ * @param {URL} url
+ * @returns {string}
+ */
+function routeKeyOf(route, url) {
+  return (route && route.file) || url.pathname;
+}
+
+/**
+ * Reset the per-process report dedupe. Test seam only: the cap and the
+ * never-cleared set are the point in production.
+ */
+export function resetFormReportDedupe() {
+  reportedFormFingerprints.clear();
+}
+
+/**
+ * A form posted to a page and carried no action identity, so nothing ran and
+ * the answer is a 405. Route it to the APM sink with a code an app can group
+ * on, instead of leaving an anonymous 405 in an access log.
+ *
+ * Carries the field NAMES, which are template constants and are what identify
+ * WHICH form posted nowhere. Never the values, which are user data. The form's
+ * own `action` attribute is not carried because a bound form has none (the
+ * renderer strips it so the form posts to its own url), so the request url
+ * already is that information.
+ *
+ * @param {URL} url
+ * @param {Request} req
+ * @param {FormData} formData
+ * @param {((error: unknown) => void) | undefined} onError
+ * @param {{ warn?: (msg: string, meta?: Record<string, unknown>) => void }} [logger]
+ * @param {boolean} [dev]
+ * @param {{ file?: string } | null} [route] the matched page route, for the dedupe key
+ */
+export function reportFormActionMissing(url, req, formData, onError, logger, dev, route) {
+  const willLog = !!(dev && logger && logger.warn);
+  const willReport = typeof onError === 'function';
+  // Nothing to say: do not spend a dedupe slot, which would let a run with no
+  // sink configured quietly consume the cap for one that does.
+  if (!willLog && !willReport) return;
+  if (!firstSighting(`WEBJS_FORM_ACTION_MISSING ${req.method} ${routeKeyOf(route, url)}`)) return;
+  const fields = [...new Set([...formData.keys()])];
+  if (willLog) {
+    logger.warn(
+      `[webjs] a form posted to ${url.pathname} carrying no action identity, so nothing ran (405). Bind the action: <form action=\${yourAction}>.`,
+      { fields },
+    );
+  }
+  if (!willReport) return;
+  const err = new Error(
+    `A form submission to ${url.pathname} carried no \`${FORM_ACTION_FIELD}\` identity, so no server action ran and the request was answered with a 405.`,
+  );
+  /** @type {any} */ (err).code = 'WEBJS_FORM_ACTION_MISSING';
+  /** @type {any} */ (err).method = req.method;
+  /** @type {any} */ (err).pathname = url.pathname;
+  /** @type {any} */ (err).fields = fields;
+  onError(err);
+}
+
+/**
+ * A page GET carrying `__webjs_action` in the QUERY STRING (#1307). Nothing in
+ * this framework ever puts the reserved field in a url, so a submission
+ * carrying a bound action's identity went out as a GET: the identity rode the
+ * query string (a browser does this natively, and `performSubmission` promotes
+ * a safe-method body the same way), no action ran, and the page is about to
+ * render as if nothing was submitted.
+ *
+ * A bound submitter no longer produces this by accident, because it carries its
+ * own `formmethod="post"`. What reaches here now is an explicit override the
+ * author wrote and the renderer deliberately honours: a `formmethod="get"` on
+ * the pressed button, or on the form, wins by native precedence. This is the
+ * production counterpart to the dev-time client guard, which reports the same
+ * shape at submit time.
+ *
+ * DETECTS ONLY. The GET keeps rendering its 200 page, because answering
+ * differently on a query parameter would hand any visitor a way to turn any
+ * page into an error.
+ *
+ * @param {URL} url
+ * @param {Request} req
+ * @param {((error: unknown) => void) | undefined} onError
+ * @param {{ warn?: (msg: string, meta?: Record<string, unknown>) => void }} [logger]
+ * @param {boolean} [dev]
+ * @param {{ file?: string } | null} [route] the matched page route, for the dedupe key
+ */
+export function reportFormSubmittedAsGet(url, req, onError, logger, dev, route) {
+  // Cheapest possible guard first, and it runs on EVERY page GET: a substring
+  // test on the already-parsed `search` string, so the common case never builds
+  // a URLSearchParams at all.
+  if (!url.search || !url.search.includes(FORM_ACTION_FIELD)) return;
+  if (!url.searchParams.has(FORM_ACTION_FIELD)) return;
+  const willLog = !!(dev && logger && logger.warn);
+  const willReport = typeof onError === 'function';
+  if (!willLog && !willReport) return;
+  if (!firstSighting(`WEBJS_FORM_SUBMITTED_AS_GET ${req.method} ${routeKeyOf(route, url)}`)) return;
+  if (willLog) {
+    logger.warn(
+      `[webjs] ${url.pathname} was requested with \`${FORM_ACTION_FIELD}\` in the query string, which means a submission carrying a bound action's identity went out as a GET. A GET sends no body, so the identity rode the url, the action never ran, and this page is simply re-rendering. Look for a formmethod="get" on the button that was pressed, or a method="get" on its form: a submitter's own formmethod wins by native precedence and WebJs honours it rather than refusing it.`,
+    );
+  }
+  if (!willReport) return;
+  const err = new Error(
+    `A form submission reached ${url.pathname} as a GET with the \`${FORM_ACTION_FIELD}\` identity in the query string, so no server action ran. The submitter's enclosing <form> binds no action.`,
+  );
+  /** @type {any} */ (err).code = 'WEBJS_FORM_SUBMITTED_AS_GET';
+  /** @type {any} */ (err).method = req.method;
+  /** @type {any} */ (err).pathname = url.pathname;
+  onError(err);
+}
+
 /**
  * The submitted TEXT fields as a plain record, for repopulating a form the
  * dispatcher could not run.
@@ -258,11 +411,12 @@ function methodNotAllowed() {
  *   actionIndex: import('./actions.js').ActionIndex,
  *   allowedOrigins?: string[],
  *   onError?: (error: unknown) => void,
+ *   logger?: { warn?: (msg: string, meta?: Record<string, unknown>) => void },
  * }} deps
  * @returns {Promise<Response>}
  */
 export async function runFormAction(route, params, url, req, ssrOpts, deps) {
-  const { actionIndex, allowedOrigins = [], onError } = deps;
+  const { actionIndex, allowedOrigins = [], onError, logger } = deps;
 
   // Not a form body at all (a stray JSON POST, a probe): the page path exists
   // and only renders. Answered before the body is touched.
@@ -289,8 +443,20 @@ export async function runFormAction(route, params, url, req, ssrOpts, deps) {
   const actions = formData.getAll(FORM_ACTION_FIELD);
   const id = actions.length ? actions[actions.length - 1] : null;
   // A form body carrying no identity: a hand-written `<form method="post">`
-  // that binds no action. Nothing to run, and the page only renders.
-  if (typeof id !== 'string' || !id) return methodNotAllowed();
+  // that binds no action. Nothing to run, and the page only renders. Reported
+  // before the 405 so the shape is not just an anonymous status in an access
+  // log.
+  //
+  // NOT the unparseable-enctype variant of #1307. An `enctype="text/plain"`
+  // submission arrives with that content type, so `looksLikeFormSubmission`
+  // answers it above, before the body is read and before this point. That is
+  // deliberate (buffering an attacker-chosen body to classify it is exactly what
+  // the early return avoids), and it means the text/plain variant is visible
+  // only as a bare 405. The dev-time client guard covers it instead.
+  if (typeof id !== 'string' || !id) {
+    reportFormActionMissing(url, req, formData, onError, logger, !!ssrOpts.dev, route);
+    return methodNotAllowed();
+  }
   // The field is framework wire, not app data. Removing it keeps an action
   // that iterates the FormData (building a record, echoing values back into a
   // 422 re-render) from seeing a key it did not put there.
diff --git a/packages/server/test/routing/form-dispatch.test.js b/packages/server/test/routing/form-dispatch.test.js
index f48f20c88..c68f87c4d 100644
--- a/packages/server/test/routing/form-dispatch.test.js
+++ b/packages/server/test/routing/form-dispatch.test.js
@@ -30,6 +30,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { createRequestHandler } from '../../src/dev.js';
 import { hashFile } from '../../src/actions.js';
+import { resetFormReportDedupe } from '../../src/form-dispatch.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 // A tmpdir app fixture cannot resolve the bare `@webjsdev/core` specifier
@@ -1069,3 +1070,139 @@ export default ({ actionData }) => html\`<form action=\${updatePost}><p>\${actio
       'and it failed with a message written for a DIFFERENT action');
   } finally { console.warn = quiet; }
 });
+
+/**
+ * #1307 telemetry. Both fingerprints of a form that posts nowhere reach the
+ * `onError` sink with a code an app can group on, and neither changes the
+ * response: the GET keeps its 200 and the bind-nothing submission keeps its
+ * 405. Answering a GET differently because of a query parameter would hand any
+ * visitor a way to turn any page into an error.
+ */
+const READ_ONLY_APP = {
+  'app/info/page.ts': `import { html } from ${CORE};\nexport default () => html\`<p>read-only</p>\`;\n`,
+};
+
+test('#1307: a form body carrying no identity reports WEBJS_FORM_ACTION_MISSING', async () => {
+  resetFormReportDedupe();
+  const seen = [];
+  const app = await createRequestHandler({
+    appDir: makeApp(READ_ONLY_APP),
+    dev: false,
+    onError: (e) => seen.push(e),
+  });
+  await app.warmup();
+
+  const post = await app.handle(new Request('http://x/info', form({ email: 'a@b.c', note: 'secret text' })));
+  assert.equal(post.status, 405, 'the response is unchanged');
+
+  assert.equal(seen.length, 1, 'exactly one report');
+  assert.equal(seen[0].code, 'WEBJS_FORM_ACTION_MISSING');
+  assert.equal(seen[0].pathname, '/info');
+  assert.equal(seen[0].method, 'POST');
+  // Field NAMES identify WHICH form posted nowhere and are template constants.
+  assert.deepEqual(seen[0].fields, ['email', 'note']);
+  // Field VALUES are user data and must never ride the report.
+  assert.doesNotMatch(JSON.stringify(seen[0].fields) + seen[0].message, /secret text|a@b\.c/);
+});
+
+test('#1307: a page GET carrying __webjs_action still renders 200 and reports', async () => {
+  resetFormReportDedupe();
+  const seen = [];
+  const app = await createRequestHandler({
+    appDir: makeApp(READ_ONLY_APP),
+    dev: false,
+    onError: (e) => seen.push(e),
+  });
+  await app.warmup();
+
+  const resp = await app.handle(new Request('http://x/info?__webjs_action=abc%2FdoThing'));
+  assert.equal(resp.status, 200, 'detect only: the page still renders');
+  assert.match(await resp.text(), /read-only/);
+
+  assert.equal(seen.length, 1);
+  assert.equal(seen[0].code, 'WEBJS_FORM_SUBMITTED_AS_GET');
+  assert.equal(seen[0].pathname, '/info');
+
+  // Deduplicated per process on method + pathname: either fingerprint is
+  // reachable by an unauthenticated attacker, so an unbounded report would be a
+  // free amplifier into a paid APM sink.
+  await app.handle(new Request('http://x/info?__webjs_action=abc%2FdoThing'));
+  await app.handle(new Request('http://x/info?__webjs_action=other'));
+  assert.equal(seen.length, 1, 'a flood of crafted requests produces one report');
+});
+
+test('#1307: crafted requests to a dynamic route cannot exhaust the dedupe', async () => {
+  // The dedupe key is the matched ROUTE, not the request pathname. Keyed on the
+  // pathname a dynamic route yields unbounded distinct keys, so a few hundred
+  // crafted urls would fill the 256-entry cap and permanently silence BOTH
+  // diagnostics for the process, which is worse than the amplification the cap
+  // exists to stop.
+  resetFormReportDedupe();
+  const seen = [];
+  const app = await createRequestHandler({
+    appDir: makeApp({
+      'app/blog/[slug]/page.ts': `import { html } from ${CORE};\nexport default () => html\`<p>post</p>\`;\n`,
+      'app/info/page.ts': `import { html } from ${CORE};\nexport default () => html\`<p>read-only</p>\`;\n`,
+    }),
+    dev: false,
+    onError: (e) => seen.push(e),
+  });
+  await app.warmup();
+
+  for (let i = 0; i < 400; i++) {
+    const r = await app.handle(new Request(`http://x/blog/post-${i}?__webjs_action=x`));
+    assert.equal(r.status, 200);
+  }
+  assert.equal(seen.length, 1, '400 distinct paths on ONE route are one report');
+
+  // And the flood did not consume the budget for a different route.
+  await app.handle(new Request('http://x/info?__webjs_action=x'));
+  assert.equal(seen.length, 2, 'a genuinely different route still reports');
+
+  // Nor for the OTHER signal, which has its own key space.
+  const post = await app.handle(new Request('http://x/info', form({ a: '1' })));
+  assert.equal(post.status, 405);
+  assert.equal(seen.filter((e) => e.code === 'WEBJS_FORM_ACTION_MISSING').length, 1,
+    'one signal can never silence the other');
+});
+
+test('#1307: no onError and not dev spends no dedupe slot', async () => {
+  // A slot consumed with nothing to report would let a sink-less run quietly
+  // eat the cap for one that has a sink.
+  resetFormReportDedupe();
+  // The SAME app dir for both handlers, so the route key is identical and the
+  // assertion is discriminating: two different dirs would produce two different
+  // keys and the test would pass even if the slot HAD been spent.
+  const appDir = makeApp(READ_ONLY_APP);
+  const silent = await createRequestHandler({ appDir, dev: false });
+  await silent.warmup();
+  assert.equal((await silent.handle(new Request('http://x/info?__webjs_action=x'))).status, 200);
+
+  const seen = [];
+  const app = await createRequestHandler({ appDir, dev: false, onError: (e) => seen.push(e) });
+  await app.warmup();
+  await app.handle(new Request('http://x/info?__webjs_action=x'));
+  assert.equal(seen.length, 1, 'the slot was still free');
+});
+
+test('#1307: an ordinary page GET and a non-form POST report nothing', async () => {
+  resetFormReportDedupe();
+  const seen = [];
+  const app = await createRequestHandler({
+    appDir: makeApp(READ_ONLY_APP),
+    dev: false,
+    onError: (e) => seen.push(e),
+  });
+  await app.warmup();
+
+  assert.equal((await app.handle(new Request('http://x/info'))).status, 200);
+  // The 405 answered before the body is read: a stray JSON POST or a probe is
+  // not an app bug, and it is the cheapest thing on the file to flood.
+  const probe = await app.handle(new Request('http://x/info', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: '{}',
+  }));
+  assert.equal(probe.status, 405);
+  assert.deepEqual(seen, []);
+});
diff --git a/website/app/docs/deployment/page.ts b/website/app/docs/deployment/page.ts
index 57b3f101e..d3a237f43 100644
--- a/website/app/docs/deployment/page.ts
+++ b/website/app/docs/deployment/page.ts
@@ -172,7 +172,7 @@ const app = await createRequestHandler({
     <p>Day-2 ops needs more than liveness probes. WebJs ships four standards-native observability surfaces, all wired at the single response funnel so they apply uniformly across pages, route handlers, server actions, and assets.</p>
 
     <h3>Per-request access log</h3>
-    <p>Every handled request emits ONE structured <code>info</code> line through the pluggable logger after the response is produced, carrying <code>method</code>, <code>path</code>, <code>status</code>, <code>durationMs</code>, and <code>requestId</code>. It never logs request bodies or secrets. In development a page render also carries a <code>seed</code> field, the SSR action-seeding counters described in <a href="/docs/configuration">Configuration</a>; it is absent in production. In prod the default logger writes it as one JSON object per line; in dev it is a readable line.</p>
+    <p>Every handled request emits ONE structured <code>info</code> line through the pluggable logger after the response is produced, carrying <code>method</code>, <code>path</code>, <code>status</code>, <code>durationMs</code>, and <code>requestId</code>. It never logs request bodies or secrets. In prod the default logger writes it as one JSON object per line; in dev it is a readable line.</p>
     <code-block>{"level":"info","msg":"request","time":"2026-06-03T10:30:00.000Z","requestId":"4f1c…","method":"GET","path":"/dashboard","status":200,"durationMs":12.4}</code-block>
     <p>The framework's own <code>/__webjs/*</code> probe and static traffic is suppressed from the access log so it does not spam. App routes (including your <code>/api/*</code>) are logged. Swap in pino / your aggregator via the pluggable logger above and these lines flow straight into it.</p>
     <p><code>durationMs</code> is time-to-response-headers (a TTFB-like measure), not full-stream completion. For a streaming / Suspense response it reflects when the headers were produced, not when the last chunk flushed.</p>
@@ -199,6 +199,8 @@ const app = await createRequestHandler({
 });</code-block>
     <p><strong>The contract is best-effort.</strong> A throwing <code>onError</code> is caught and ignored so it can never crash the response, and the hook is purely additive: webjs's existing behavior (the sanitized 500, with only <code>error.message</code> in prod and never the stack) is unchanged. The hook fires BEFORE the sanitized response is sent, so the sink always sees the real error.</p>
 
+    <p><strong>Two framework diagnostics ride the same hook</strong>, and neither is a request failure, so both carry an <code>err.code</code> you can group or filter on. <code>WEBJS_FORM_SUBMITTED_AS_GET</code> fires on a page GET carrying the reserved <code>__webjs_action</code> field in its query string, which means a submission holding a bound action's identity went out as a GET, so the action never ran and the page still rendered a 200. A bound submitter carries its own <code>formmethod="post"</code>, so what reaches this is an explicit <code>formmethod="get"</code> or <code>method="get"</code> the author wrote and the renderer deliberately honours rather than refuses. It is the production counterpart to the dev-time console error the client router logs at submit time. <code>WEBJS_FORM_ACTION_MISSING</code> fires when a parseable form body carries no identity at all, the case answered with a 405. (An <code>enctype="text/plain"</code> submission is answered before its body is read, so that one stays a bare 405.) Both are detect-only, so neither changes the status; each carries <code>method</code> and <code>pathname</code>, plus the submitted field NAMES for the second (template constants that identify WHICH form posted nowhere, never the values, which are user data); and each is deduplicated per process on the code, the method, and the matched ROUTE (not the request pathname, so crafted urls on a dynamic route cannot exhaust the 256-entry cap and silence the diagnostics), because both are reachable by an unauthenticated request and an uncapped report would be a free amplifier into a paid sink. In dev the same two detections also log a warning, which is what makes the no-JS write path visible without an APM wired. See <a href="/docs/troubleshooting">Troubleshooting</a>.</p>
+
     <h3>Build-info endpoint</h3>
     <p><code>GET /__webjs/version</code> returns JSON describing the live build, alongside the health and readiness probes. A deploy can curl it to confirm which build is serving. It carries no secrets, and it is answered before the analysis warms (like the other probes), so it responds on a cold instance.</p>
     <code-block>GET /__webjs/version
diff --git a/website/app/docs/server-actions/page.ts b/website/app/docs/server-actions/page.ts
index 388b17937..fe77e485d 100644
--- a/website/app/docs/server-actions/page.ts
+++ b/website/app/docs/server-actions/page.ts
@@ -473,7 +473,8 @@ export default function NewPost({ actionData }: {
     </ul>
     <p>Everything the action declares applies here too, or an action would be protected over RPC and open over a form: <code>validate</code> runs on the submitted <code>FormData</code>, the <code>middleware</code> chain runs (with the page's <code>params</code> / <code>searchParams</code> / <code>url</code> on <code>ctx</code>), and <code>invalidates</code> is evicted when the action actually ran. The submission is Origin-verified exactly like an RPC call, so a no-JS form needs no CSRF token field. An action declaring <code>method = 'GET'</code> cannot be bound to a form (it rides its arguments in the URL and skips the CSRF check), which is a <code>405</code> at runtime and the <code>form-action-not-a-get-action</code> error in <code>webjs check</code>. A streamed return is refused on this path: a submission is answered with a redirect or a page, and with JS off there is no consumer for frames.</p>
     <p><strong>A form whose buttons run different actions binds each one on its submitter</strong>, with the same unquoted spelling one level down: <code>&lt;form action=\${saveDraft}&gt;…&lt;button formaction=\${publishPost}&gt;Publish&lt;/button&gt;&lt;/form&gt;</code>. The identity rides the pressed button's own <code>name</code>/<code>value</code> pair, which a browser submits for that button alone, so no <code>formaction</code> url is emitted and the whole thing works with JavaScript off. Both identities reach the server and the LAST wins, which is the submitter's whenever one was pressed.</p>
-    <p>The submitter must be a <code>&lt;button&gt;</code> inside a form that is itself bound, and it cannot carry its own <code>name</code>, <code>value</code>, <code>form</code>, or a static <code>formaction</code>, because the identity already occupies that name/value pair. Two input controls are refused for the same underlying reason. <code>&lt;input type="image"&gt;</code> submits <code>name.x</code> / <code>name.y</code> coordinates rather than <code>name=value</code>, so the identity would never arrive. <code>&lt;input type="submit"&gt;</code> would receive the identity in its <code>value</code>, which on that control is also the visible caption, so it would render captioned with the action id and the only way to label it is the channel the identity needs. A <code>&lt;button&gt;</code> avoids both, because its label is its children. A <code>.prop</code> spelling of any of these (<code>.name</code>, <code>.value</code>, <code>.formAction</code>, <code>.formMethod</code>, <code>.formEnctype</code>) is refused as well: all reflect on a submitter, so the write is dropped at SSR and lands in the attribute in the browser. Separately, <code>formmethod="get"</code> and an unparseable <code>formenctype</code> like <code>text/plain</code> are refused on ANY submitter inside a bound form, binding or not, since neither can carry the action's body. <code>formmethod="dialog"</code> and a plain <code>formaction="/url"</code> are left alone, because neither submits to the bound action.</p>
+    <p><strong>A bound submitter carries its whole submission, so the enclosing form does not have to be bound.</strong> The renderer puts <code>formmethod="post"</code> and <code>formenctype="multipart/form-data"</code> on the button itself, alongside the identity, which is what React does for a button carrying a function <code>formAction</code>. So a per-button action works inside a bound form, an unbound form, a <code>method="get"</code> form, or a form with no method at all. No <code>formaction</code> url is emitted, because an empty one is an HTML conformance error, so the submission targets whatever the form targets: a form declaring its own <code>action="/x"</code> sends its buttons there, still running the action, since the identity travels in the body.</p>
+    <p>The submitter must be a <code>&lt;button&gt;</code>, and it cannot carry its own <code>name</code>, <code>value</code>, <code>form</code>, or a static <code>formaction</code>, because the identity already occupies that name/value pair. Two input controls are refused for the same underlying reason. <code>&lt;input type="image"&gt;</code> submits <code>name.x</code> / <code>name.y</code> coordinates rather than <code>name=value</code>, so the identity would never arrive. <code>&lt;input type="submit"&gt;</code> would receive the identity in its <code>value</code>, which on that control is also the visible caption, so it would render captioned with the action id and the only way to label it is the channel the identity needs. A <code>&lt;button&gt;</code> avoids both, because its label is its children. A <code>.prop</code> spelling of any of these (<code>.name</code>, <code>.value</code>, <code>.formAction</code>, <code>.formMethod</code>, <code>.formEnctype</code>) is refused as well: all reflect on a submitter, so the write is dropped at SSR and lands in the attribute in the browser. Separately, a BOUND submitter is refused when it declares a <code>formmethod</code> other than post, an unparseable <code>formenctype</code> like <code>text/plain</code>, or <code>formmethod="dialog"</code>: each contradicts the action attached to that same button. A button that binds NOTHING is left alone, whatever it declares. Its <code>formmethod</code> / <code>formenctype</code> is a legal native override, the author wrote it deliberately, and the form's action simply does not run, exactly as the same markup behaves anywhere else. In dev the client logs a console error at submit time when a submission is carrying an identity it cannot deliver.</p>
     <p>With JavaScript off this is a native round-trip (the browser submits, follows the 303, or renders the 422). With JavaScript on the client router applies the 422 in place (no reload, typed input preserved) and follows the 303 via fetch. Both ends of the progressive-enhancement spectrum from one piece of code, no form library. See the <a href="/docs/client-router">client router</a> docs for the rendering behavior, and <a href="/docs/progressive-enhancement">progressive enhancement</a> for the full write-path pattern.</p>
   `;
 }
diff --git a/website/app/docs/troubleshooting/page.ts b/website/app/docs/troubleshooting/page.ts
index 0e35f0e20..10c43d311 100644
--- a/website/app/docs/troubleshooting/page.ts
+++ b/website/app/docs/troubleshooting/page.ts
@@ -55,9 +55,14 @@ export default function Troubleshooting() {
     <p><strong>Fix:</strong> bind the action (<code>&lt;form action=\${submitFeedback}&gt;</code>), or drop the <code>method</code> export from the action's file so it is an ordinary POST.</p>
 
     <h2>A render fails on a button's formmethod or formenctype</h2>
-    <p><strong>Symptom:</strong> a page that renders fine with JavaScript on fails at render with <code>&lt;button formenctype="text/plain"&gt; inside a bound &lt;form action=\${action}&gt; cannot work</code>, or the same message naming <code>formmethod</code>.</p>
-    <p><strong>Cause:</strong> a submitter's <code>formmethod</code> / <code>formenctype</code> overrides the form's own for that button, and a bound action needs a POST body the server can parse as <code>multipart/form-data</code> or <code>application/x-www-form-urlencoded</code>. A GET sends no body at all, and <code>text/plain</code> is flagged by the HTML spec as not intended for machine parsing. Either one submits fine with JavaScript (the client router posts <code>FormData</code> and ignores the attribute) and is a bare <code>405</code> without it, so it is refused at render rather than shipped as a form that works one way only. The check runs on EVERY submitter inside a bound form, whether or not that button binds an action of its own, which is why it can fire on a button you never touched.</p>
-    <p><strong>Fix:</strong> drop the attribute and let the form's own <code>method="post"</code> and enctype apply, which is what the renderer already supplies. If the button was meant to go somewhere else entirely, give it a plain <code>formaction="/url"</code>; that retargets the submission away from the bound action and its own <code>formmethod</code> is then left alone. A <code>formmethod="dialog"</code> button is never refused either, because it dismisses a <code>&lt;dialog&gt;</code> instead of submitting.</p>
+    <p><strong>Symptom:</strong> a page fails at render with <code>&lt;button formenctype="text/plain" formaction=\${action}&gt; cannot work</code>, or the same message naming <code>formmethod</code>.</p>
+    <p><strong>Cause:</strong> that button BINDS an action and also tells itself to submit in a way the action could never read. A bound action needs a POST body the server can parse as <code>multipart/form-data</code> or <code>application/x-www-form-urlencoded</code>. A GET sends no body at all, <code>text/plain</code> is flagged by the HTML spec as not intended for machine parsing, and <code>formmethod="dialog"</code> dismisses a <code>&lt;dialog&gt;</code> rather than submitting. The renderer supplies <code>formmethod="post"</code> and the enctype on a bound submitter, so writing a conflicting value on the same button is a straight contradiction.</p>
+    <p><strong>Fix:</strong> drop the attribute and let the renderer supply it, or drop the binding. Note this fires only on a button that binds an action. A button that binds NOTHING keeps whatever you wrote, because a submitter's override is legal HTML and means what you typed. If such a button is inside a bound form, its override defeats that form's action, and the page will log a console error at submit time in dev saying the submission is carrying an identity it cannot deliver.</p>
+
+    <h2>A per-button action does nothing and the page just reloads</h2>
+    <p><strong>Symptom:</strong> clicking a <code>formaction=\${action}</code> button re-renders the same page with a 200, nothing was written, and there is no error anywhere.</p>
+    <p><strong>Cause:</strong> the submission went out as a GET, so the action identity rode the query string instead of a request body and no action ran. Before the submitter carried its own <code>formmethod</code> this happened whenever the enclosing form was unbound, which is fixed. What can still cause it is an explicit override you wrote: a <code>formmethod="get"</code> on the button that was pressed, or on the form, wins over everything else by native precedence and WebJs honours it rather than refusing it.</p>
+    <p><strong>Fix:</strong> remove the <code>formmethod="get"</code>, or move that button out of the form whose action you wanted to run. In dev the client logs a console error naming this at submit time; in production it reaches your <code>onError</code> hook as <code>WEBJS_FORM_SUBMITTED_AS_GET</code>.</p>
 
     <h2>A form re-renders asking you to submit again</h2>
     <p><strong>Symptom:</strong> a submission comes back at 422 with a message about the page having been updated, and the typed values still filled in.</p>

From a48a86c20e24a55475806c1c60b611d5f82a6fd7 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Fri, 7 Aug 2026 17:58:45 +0530
Subject: [PATCH 08/13] docs: drop the bound-form requirement from the scaffold
 comment

---
 .../gallery/modules/todo/actions/submit-todo.server.ts    | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/packages/cli/templates/gallery/modules/todo/actions/submit-todo.server.ts b/packages/cli/templates/gallery/modules/todo/actions/submit-todo.server.ts
index a0f83144c..2a6cff268 100644
--- a/packages/cli/templates/gallery/modules/todo/actions/submit-todo.server.ts
+++ b/packages/cli/templates/gallery/modules/todo/actions/submit-todo.server.ts
@@ -12,9 +12,11 @@ import { deleteTodo } from './delete-todo.server.ts';
 // action: this form carries the todo's `id` on a hidden input and needs the
 // SAME id for whichever mutation runs, so one action reading both fields is the
 // simpler shape. When the buttons need no shared payload, bind each one
-// directly instead, with `formaction=${action}` on a <button> inside the bound
-// form. The identity then rides that button's own name/value pair, so it works
-// with JS off too. Two things to know: it must be a <button> (on an
+// directly instead, with `formaction=${action}` on a <button>. The enclosing
+// <form> does NOT have to be bound: a bound submitter carries its own
+// `formmethod` and enctype, so it works in any form or none. The identity rides
+// that button's own name/value pair, so it works with JS off too. Two things to
+// know: it must be a <button> (on an
 // <input type="submit"> the identity would occupy `value`, which is also that
 // control's visible label), and a bound submitter cannot carry its own
 // `name`/`value`, which is exactly the channel `name="intent"` uses below.

From dad2754eb3e3e84a3713b4c75d7b0a4ade41de3b Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Fri, 7 Aug 2026 19:08:21 +0530
Subject: [PATCH 09/13] fix: file a submitter's formmethod hole under the right
 attribute

`buildFormActionRecord` selects the submission pair by element, `method` /
`enctype` on a form and `formmethod` / `formenctype` on a submitter. The filter
was updated for that; the dispatch one line below still compared against the
literal 'method'.

So on a submitter every hole-provided `formmethod` fell through to
`enctypeParts`. The client then resolved it as the ENCTYPE and refused
`formenctype="post"` on a template SSR renders happily: render on the server,
throw on hydration, which is the one failure direction this module treats as
unacceptable. A STATIC `formmethod="post"` was unaffected, because that reaches
the record through `staticMethod`, which already used the right attribute name.

Found by auditing every consumer of the record's fields rather than by a test,
which is why the fix ships with the differential rows that would have caught it.
SSR reads the emitted start tag and is unaffected, so only a row comparing the
two renderers on a HOLE-provided value sees this at all. Counterfactual
verified: those rows go red against the literal comparison and green with it
fixed.
---
 packages/core/src/render-client.js                       | 9 ++++++++-
 .../test/rendering/browser/ssr-client-parity.test.js     | 8 ++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/packages/core/src/render-client.js b/packages/core/src/render-client.js
index c2b8fa8e7..7cbc4ce26 100644
--- a/packages/core/src/render-client.js
+++ b/packages/core/src/render-client.js
@@ -707,7 +707,14 @@ function buildFormActionRecord(el, onEl, parts) {
     // pieces have to travel with the record; reading the anchor's value alone
     // is right only when the statics are empty.
     if (p.kind === 'attr-mixed') { entry.statics = d.statics || []; entry.group = d.group || []; }
-    (name === 'method' ? methodParts : enctypeParts).push(entry);
+    // Compared against `methodAttr`, NOT the literal 'method'. On a submitter
+    // the pair is `formmethod` / `formenctype`, so a literal comparison sent
+    // every hole-provided `formmethod` into `enctypeParts`: the client then
+    // resolved it as the enctype, refused `formenctype="post"`, and threw on
+    // hydration for a template SSR renders happily. That is the
+    // render-on-the-server, crash-in-the-browser direction this module treats
+    // as the one unacceptable failure.
+    (name === methodAttr ? methodParts : enctypeParts).push(entry);
   }
 
   return {
diff --git a/packages/core/test/rendering/browser/ssr-client-parity.test.js b/packages/core/test/rendering/browser/ssr-client-parity.test.js
index 53d325bea..bd94541d0 100644
--- a/packages/core/test/rendering/browser/ssr-client-parity.test.js
+++ b/packages/core/test/rendering/browser/ssr-client-parity.test.js
@@ -423,6 +423,14 @@ suite('SSR/client parity: form actions (#1155)', () => {
     // injected. Both renderers make that call through `resolveBoundSubmitterAttrs`.
     'bound submitter supplying its own formmethod': () => html`<button formaction=${boundAction()} formmethod="post">Save</button>`,
     'bound submitter supplying its own formenctype': () => html`<button formaction=${boundAction()} formenctype="application/x-www-form-urlencoded">Save</button>`,
+    // HOLE-provided, not static. These are the rows that catch a client record
+    // which files a submitter's `formmethod` hole under the wrong attribute:
+    // SSR reads the emitted start tag and is unaffected, so only a DIFFERENTIAL
+    // row sees it. The first spelling shipped broken and threw
+    // `formenctype="post"` on hydration for a template SSR renders happily.
+    'bound submitter with a HOLE-provided formmethod': () => html`<button formaction=${boundAction()} formmethod=${'post'}>Save</button>`,
+    'bound submitter with a HOLE-provided formenctype': () => html`<button formaction=${boundAction()} formenctype=${'application/x-www-form-urlencoded'}>Save</button>`,
+    'bound submitter with BOTH provided by holes': () => html`<button formaction=${boundAction()} formmethod=${'post'} formenctype=${'multipart/form-data'}>Save</button>`,
     // #1307 reverses #1207's Part B: a PLAIN button's own override is a legal
     // native instruction, so both renderers leave it exactly as written.
     'plain submitter formmethod=get inside a bound form': () => html`<form action=${boundAction()}><button formmethod="get">Save</button></form>`,

From 733b212b9a6422f5c88f79dd08944c63004757f9 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Fri, 7 Aug 2026 19:10:13 +0530
Subject: [PATCH 10/13] test: pin the submitter release path and drop a stale
 comment

The bind/release cycle had no direct test. It has two halves that can fail
independently: a released button that keeps `formmethod="post"` no longer
matches what SSR emits for the same template, and one that loses an author's
own value has had its markup destroyed by a framework that never owned it.
Both are now asserted.

Also renames a client test whose comment still named `enclosingForm`, deleted
in this branch. The property it guards still holds, but for a better reason
than the cache it was written for: there is no longer an enclosing-form
question to give two different answers on a first render and an update. Kept
as a regression guard, because any future rule that reads outside the element
reintroduces exactly that split.
---
 .../form-action-binding-client.test.js        | 51 ++++++++++++++++---
 1 file changed, 45 insertions(+), 6 deletions(-)

diff --git a/packages/core/test/rendering/form-action-binding-client.test.js b/packages/core/test/rendering/form-action-binding-client.test.js
index be2ecac8e..5a778160f 100644
--- a/packages/core/test/rendering/form-action-binding-client.test.js
+++ b/packages/core/test/rendering/form-action-binding-client.test.js
@@ -848,12 +848,17 @@ test('a value HOLE is judged by what SSR would emit, exactly as a name hole is',
   );
 });
 
-test('the enclosing-form verdict does not change between renders', () => {
-  // Whether `enclosingForm` resolves depends on whether the element happened to
-  // be in the tree when it reconciled: not on a first render (the fragment is
-  // detached) and yes on an update. Re-asking made the SAME template with the
-  // SAME values bind at first paint and then throw on an arbitrary later
-  // re-render, which is far worse to diagnose than refusing at first paint.
+test('a bound submitter binds identically on a first render and an update', () => {
+  // This used to guard an enclosing-form verdict whose answer depended on
+  // whether the element happened to be in the tree when it reconciled: no on a
+  // first render (the fragment is still detached) and yes on an update. That
+  // asymmetry made the SAME template with the SAME values bind at first paint
+  // and throw on an arbitrary later re-render.
+  //
+  // #1307 deleted the question, so the property now holds for a much better
+  // reason than a carefully-placed cache: there is nothing left to ask. Kept as
+  // a regression guard, because any future rule that reads OUTSIDE the element
+  // reintroduces exactly this first-render-versus-update split.
   const buttonAction = HOISTED();
   const outer = document.createElement('form');
   outer.setAttribute('method', 'post');
@@ -869,6 +874,40 @@ test('the enclosing-form verdict does not change between renders', () => {
   } finally { outer.remove(); }
 });
 
+test('releasing a submitter takes back the framework attrs, never the author\'s (#1307)', () => {
+  // Both halves matter. A released button that keeps `formmethod="post"` no
+  // longer matches what SSR emits for the same template, and one that loses an
+  // author's own value has had its markup destroyed by a framework that should
+  // never have owned it.
+  //
+  // Which attribute is whose is RECOMPUTED, not remembered from the bind: it is
+  // the framework's exactly when the template supplies nothing for it on this
+  // pass. That is why there is no bookkeeping here to go stale.
+  const act = HOISTED();
+
+  const host = document.createElement('div');
+  const framework = (v) => html`<button formaction=${v}>Go</button>`;
+  render(framework(act), host);
+  let btn = host.querySelector('button');
+  assert.equal(btn.getAttribute('formmethod'), 'post');
+  assert.equal(btn.getAttribute('formenctype'), 'multipart/form-data');
+
+  render(framework('/plain-url'), host);
+  btn = host.querySelector('button');
+  assert.equal(btn.getAttribute('name'), null, 'the identity is released');
+  assert.equal(btn.getAttribute('formmethod'), null, 'and the supplied method with it');
+  assert.equal(btn.getAttribute('formenctype'), null, 'and the supplied enctype');
+
+  const host2 = document.createElement('div');
+  const authored = (v) => html`<button formaction=${v} formmethod="post">Go</button>`;
+  render(authored(act), host2);
+  render(authored('/plain-url'), host2);
+  const btn2 = host2.querySelector('button');
+  assert.equal(btn2.getAttribute('name'), null, 'the identity is still released');
+  assert.equal(btn2.getAttribute('formmethod'), 'post', "the AUTHOR's own value survives");
+  assert.equal(btn2.getAttribute('formenctype'), null, 'only the supplied one is taken back');
+});
+
 test('a bound form still binds its submitter on every re-render', () => {
   // The counterfactual for the stability guard: it must not become a blanket
   // skip that stops the binding from being re-applied.

From 7f3ff270411ce4fa6aadccfd14837203060cdf08 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Fri, 7 Aug 2026 19:19:39 +0530
Subject: [PATCH 11/13] test: assert the urlencoded body a form with no enctype
 actually sends

CI caught this, in an e2e file that runs as its own job and that I had not run
locally. The test built `<form method="POST">` with no enctype and asserted the
body contained `Hello World`, which only held while the router promoted every
submission to multipart.

Its comment said "FormData is sent multipart by default in browsers". That is
backwards, and it is why the assertion looked reasonable: a BROWSER defaults to
`application/x-www-form-urlencoded`, and multipart is what `fetch` derives from
a FormData object. The test had encoded the bug as the expected behaviour, so
the same form sent urlencoded with JS off and multipart with JS on and nothing
noticed.

It now asserts `title=Hello+World` and that no multipart marker appears, which
is exactly what the browser sends for that form with JS disabled.

Adds the other half too: a form DECLARING multipart must still get multipart.
Without it, someone could satisfy the first assertion by hardcoding urlencoded
and silently break every file upload on the no-JS path.
---
 test/e2e/form-submission-and-race.test.mjs | 70 +++++++++++++++++++---
 1 file changed, 63 insertions(+), 7 deletions(-)

diff --git a/test/e2e/form-submission-and-race.test.mjs b/test/e2e/form-submission-and-race.test.mjs
index dabd75492..d1013518c 100644
--- a/test/e2e/form-submission-and-race.test.mjs
+++ b/test/e2e/form-submission-and-race.test.mjs
@@ -118,7 +118,7 @@ test('form GET: body is promoted to query string and response is applied', async
   }
 });
 
-test('form POST: FormData body is sent, response applied, snapshot cache cleared', async () => {
+test('form POST: an urlencoded body is sent, response applied, snapshot cache cleared', async () => {
   await ensureServer();
   const browser = await chromium.launch();
   const page = await (await browser.newContext()).newPage();
@@ -176,12 +176,20 @@ test('form POST: FormData body is sent, response applied, snapshot cache cleared
     assert.equal(r.method, 'POST');
     assert.ok(r.postData && r.postData.length > 0,
       'POST request carries a body');
-    // FormData is sent multipart by default in browsers; the boundary
-    // varies but the body must contain the field name + value.
-    assert.match(r.postData, /title/,
-      'FormData body contains the input name');
-    assert.match(r.postData, /Hello World/,
-      'FormData body contains the input value');
+    // URLENCODED, because this form declares no `enctype` and the HTML
+    // missing-value default for that attribute is
+    // `application/x-www-form-urlencoded` (#1307). The comment here used to say
+    // "FormData is sent multipart by default in browsers", which is backwards:
+    // a BROWSER defaults to urlencoded, and multipart is what `fetch` derives
+    // from a `FormData` object. The router used to build a FormData for every
+    // submission regardless, so this same form sent urlencoded with JS off and
+    // multipart with JS on. Asserting the urlencoded shape is what pins the two
+    // paths together.
+    assert.match(r.postData, /title/, 'body carries the input name');
+    assert.match(r.postData, /title=Hello\+World|title=Hello%20World/,
+      `body must be urlencoded, matching what the browser sends with JS off; got: ${r.postData}`);
+    assert.doesNotMatch(r.postData, /Content-Disposition/,
+      'an undeclared enctype must NOT be promoted to multipart');
 
     const probe = await page.locator('#probe').textContent();
     assert.equal(probe, 'arrived-from-post');
@@ -190,6 +198,54 @@ test('form POST: FormData body is sent, response applied, snapshot cache cleared
   }
 });
 
+test('form POST: a DECLARED multipart enctype is still sent as multipart (#1307)', async () => {
+  // The other half of the encoding rule, and the reason the test above is not
+  // simply "always urlencoded". The router honours what the form DECLARES, so a
+  // form that asks for multipart gets multipart. Without this row, someone
+  // could make the previous test pass by hardcoding urlencoded and break every
+  // file upload on the no-JS path.
+  await ensureServer();
+  const browser = await chromium.launch();
+  const page = await (await browser.newContext()).newPage();
+  try {
+    /** @type {{ postData: string | null }[]} */
+    const requests = [];
+    await page.route('**/test-form-multipart', (route) => {
+      requests.push({ postData: route.request().postData() });
+      route.fulfill({
+        status: 200,
+        headers: { 'content-type': 'text/html; charset=utf-8' },
+        body: mockResponseBody('arrived-multipart'),
+      });
+    });
+
+    await page.goto(`${BASE}/ui/button`);
+    await page.waitForLoadState('domcontentloaded');
+    await page.evaluate(() => {
+      const f = document.createElement('form');
+      f.action = '/test-form-multipart';
+      f.method = 'POST';
+      f.enctype = 'multipart/form-data';
+      f.id = 'mform';
+      f.innerHTML =
+        '<input name="title" value="Hello World">' +
+        '<button type="submit">Save</button>';
+      document.body.appendChild(f);
+    });
+    await page.locator('#mform button').click();
+    await page.waitForFunction(() => !!document.getElementById('probe'), { timeout: 4000 });
+
+    const r = requests[0];
+    assert.ok(r, 'router intercepted the submit and fetched');
+    assert.match(r.postData || '', /Content-Disposition: form-data; name="title"/,
+      `a declared multipart enctype must stay multipart; got: ${r.postData}`);
+    assert.match(r.postData || '', /Hello World/,
+      'and multipart carries the value unescaped');
+  } finally {
+    await browser.close();
+  }
+});
+
 test('form with data-no-router: NOT intercepted (browser does full nav)', async () => {
   await ensureServer();
   const browser = await chromium.launch();

From c1e2f07e61edb9e3bfd441d09d2389995225b6b3 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Fri, 7 Aug 2026 19:56:39 +0530
Subject: [PATCH 12/13] feat: report a bound identity posting somewhere other
 than this page

Auditing for shapes this change leaves both unrefused AND unreported turned up
exactly one, and it is one the change itself created.

A bound submitter emits no `formaction` url, so the submission targets whatever
the FORM targets, and a form declaring its own `action="/x"` sends its buttons
to `/x` by ordinary native precedence. The renderer used to throw for that, but
only where it could SEE the form, which is precisely the cross-element
judgement it cannot make from inside a component. Nothing else caught it
either: the dev guard stayed silent because the method is post, the enctype is
fine and the identity is present and deliverable, and no telemetry fires
because the POST never reaches a page GET.

Reported at submit time instead, where the resolved target is a fact rather
than an inference.

A warning rather than an error, because it is not necessarily wrong. If `/x` is
a PAGE route the action really does run there and the 422 re-render simply
lands on that page. It is dead only against a `route.ts`, another origin, or
nothing at all, and the client cannot tell which from here.

The counterfactual ships with it: a bound FORM has its action stripped by the
renderer so it always posts to its own page, and must never trip this. Without
that row the guard could fire on every submission and the positive test would
still pass.
---
 .../webjs/references/muscle-memory-gotchas.md |  2 +-
 AGENTS.md                                     |  2 +-
 packages/core/src/router-client.js            | 23 ++++++++
 .../browser/form-action-submit.test.js        | 54 +++++++++++++++++++
 4 files changed, 79 insertions(+), 2 deletions(-)

diff --git a/.agents/skills/webjs/references/muscle-memory-gotchas.md b/.agents/skills/webjs/references/muscle-memory-gotchas.md
index c6825d6b7..61c3264b5 100644
--- a/.agents/skills/webjs/references/muscle-memory-gotchas.md
+++ b/.agents/skills/webjs/references/muscle-memory-gotchas.md
@@ -76,7 +76,7 @@ html`<form>
 </form>`;
 ```
 
-One consequence worth knowing rather than discovering: no `formaction` url is emitted (an empty one is an HTML conformance error), so the submission targets whatever the FORM targets. A form declaring its own `action="/x"` sends its buttons to `/x`, which is native precedence and still runs the action, because the identity travels in the body. Leaving the form's `action` off, the ordinary shape, keeps the submission on the current page.
+One consequence worth knowing rather than discovering: no `formaction` url is emitted (an empty one is an HTML conformance error), so the submission targets whatever the FORM targets. A form declaring its own `action="/x"` sends its buttons to `/x`, which is native precedence. The action still runs if `/x` is a PAGE route, because the identity travels in the body, but against a `route.ts` or another origin the identity is ignored and nothing runs. In dev the client logs a warning at submit time naming the url. Leaving the form's `action` off, the ordinary shape, keeps the submission on the current page.
 
 The submitter must be a `<button>` and cannot carry its own `name`, `value`, or `form` attribute, because the identity already occupies that pair. `<input type="submit">` is refused for the binding: the identity has to occupy its `value`, which on that control is also the visible caption, so the button would render captioned with the action id and could never be labelled. A `<button>` has no such conflict, since its label is its children.
 
diff --git a/AGENTS.md b/AGENTS.md
index 6da30576e..295d2bd96 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -483,7 +483,7 @@ const result = await optimistic(liked, true, () => likePost(postId));
 
 11. **No em-dashes (U+2014), no hyphen or semicolon used as pause-punctuation in prose, and no colon attached to a code-shaped LHS.** Banned as a pause: U+2014, a space-surrounded hyphen between words, a space-surrounded semicolon between words. Banned colon attachments: a colon-then-prose after `xyz()`, a `<my-tag>`, an `[expr]` subscript, or a `<code>foo()</code>` definition list (rephrase verb-led). Prefer a period, comma, a colon on a plain-noun LHS, parentheses, or a restructure. Plain hyphens stay fine in compound words, flags, filenames, ranges; semicolons and colons stay fine inside code / TS / JSON / CSS. The same hook also enforces brand casing with one simple rule: `WebJs` is a proper noun, so write it capitalized wherever it NAMES the project in prose, at a sentence start AND mid-sentence (`WebJs ships`, `Most WebJs apps`, `the WebJs serializer`). It stays lowercase `webjs` ONLY as a literal code token: a `webjs <subcommand>` CLI command (`webjs dev`, `webjs db migrate`), a `webjs.dev` domain, an `@webjsdev` package, a `"webjs"` config key, a `WEBJS_*` env var, the `webjsdev/webjs` org path, or anything inside a `` `code` `` span or fenced block. If you mean the literal config key or command in prose, wrap it in backticks. Enforced via `.claude/hooks/block-prose-punctuation.sh`, which scans only NEW content (you can still edit an existing line to fix a glyph or casing).
 
-12. **A form that writes binds its action: `<form action=${importedAction}>`, and a form whose buttons run different actions binds each on its submitter, `<button formaction=${importedAction}>`** (#1155, #1207, #1307). Those are the two shapes the renderer reads, and every near-miss throws rather than producing a form that posts nowhere. The submitter identity rides the pressed button's own `name`/`value` pair (the one channel a browser submits for that button alone), so no `formaction` url is emitted, both entries reach the server, and the dispatcher takes the LAST `__webjs_action` in DOM order, which is the submitter's whenever one was pressed. **Refused on a form:** a quoted `action="${fn}"`, `action=${fn}` on any tag other than `<form>`, `method="get"` or an enctype the server cannot parse, a `.method` / `.enctype` / `.encoding` PROPERTY binding (a `.prop` drops at SSR and applies in the browser, so the form would submit differently with JS than without), a second `action` hole, a plain `action="/url"` alongside the bound hole (SSR keeps it and the client drops it), a whitespace-padded `method=" post "` (an enumerated attribute is matched against exact keywords, so a padded value falls to the invalid-value default and submits as a GET), and a function that is not a `'use server'` export. **Refused on a submitter:** a control that is not a submit control, an `<input type="image">` (it submits `name.x` / `name.y` coordinates, so the identity never arrives), an `<input type="submit">` (the identity has to occupy its `value`, which on that control is also its visible label, so it would render captioned with the action id and could never be labelled; a `<button>` has no such conflict), a submitter carrying its own `name`, `value`, `form`, or static `formaction`, a `.prop` spelling of any of those (`.name` / `.value` / `.formAction` / `.formMethod` / `.formEnctype` all REFLECT on a submitter, so the write is dropped at SSR and lands in the attribute in the browser), and a second `formaction` hole. **Refused on a BOUND submitter, as a same-element contradiction:** its own `formmethod` other than post, an unparseable `formenctype` such as `text/plain`, and `formmethod="dialog"` (which dismisses a `<dialog>` instead of submitting, so the bound action could never run). A PLAIN submitter's own `formmethod` / `formenctype` is NOT refused: native HTML says the submitter's override wins, the author typed it deliberately, and the form's action simply does not run, so the renderer honours it and the dev-time client guard reports at submit time when a submission holds an identity it cannot deliver. A plain `formaction="/url"` likewise retargets away from the bound action and is the author's business. WebJs supplies `method` and `enctype` (and, on a bound submitter, `formmethod` and `formenctype`) only where your template supplies neither, judged from the TEMPLATE rather than the rendered element: `?method=${false}` emits nothing so it is supplied, while `method=${null}` emits `method=""` and is refused. An `encoding=` attribute is inert in HTML (only the `.encoding` PROPERTY aliases `enctype`), so both renderers ignore it. A page has no `action` export, so a bare `<form method="post">` is a `405`. **A bound submitter is SELF-SUFFICIENT and asks nothing of the form around it** (#1307). The renderer supplies submission attributes at the level where the action is BOUND, and never overrides what you wrote at that same level: a bound `<form>` gains `method="post"` plus `enctype`, and a bound `<button>` gains `formmethod="post"` plus `formenctype` ON THE BUTTON, which is what React does for a function `formAction`. So a per-button action works inside a bound form, an unbound form, a `method="get"` form, or a form with no method at all. That is why the refusal list above contains no rule about a submitter's NEIGHBOURS: the renderer refuses only a SAME-ELEMENT contradiction, which has no correct fallback, and never a cross-element rule, which always has one (whatever native HTML would do). It also removed a question neither renderer could answer honestly, since a COMPONENT renders its own template in a separate pass with no view of the host page and the client may reconcile a submitter whose form is not in the tree yet. One consequence: no `formaction` url is emitted (an empty one is a conformance error), so the submission targets whatever the FORM targets, and a form declaring `action="/x"` sends its buttons there, still running the action because the identity travels in the body.
+12. **A form that writes binds its action: `<form action=${importedAction}>`, and a form whose buttons run different actions binds each on its submitter, `<button formaction=${importedAction}>`** (#1155, #1207, #1307). Those are the two shapes the renderer reads, and every near-miss throws rather than producing a form that posts nowhere. The submitter identity rides the pressed button's own `name`/`value` pair (the one channel a browser submits for that button alone), so no `formaction` url is emitted, both entries reach the server, and the dispatcher takes the LAST `__webjs_action` in DOM order, which is the submitter's whenever one was pressed. **Refused on a form:** a quoted `action="${fn}"`, `action=${fn}` on any tag other than `<form>`, `method="get"` or an enctype the server cannot parse, a `.method` / `.enctype` / `.encoding` PROPERTY binding (a `.prop` drops at SSR and applies in the browser, so the form would submit differently with JS than without), a second `action` hole, a plain `action="/url"` alongside the bound hole (SSR keeps it and the client drops it), a whitespace-padded `method=" post "` (an enumerated attribute is matched against exact keywords, so a padded value falls to the invalid-value default and submits as a GET), and a function that is not a `'use server'` export. **Refused on a submitter:** a control that is not a submit control, an `<input type="image">` (it submits `name.x` / `name.y` coordinates, so the identity never arrives), an `<input type="submit">` (the identity has to occupy its `value`, which on that control is also its visible label, so it would render captioned with the action id and could never be labelled; a `<button>` has no such conflict), a submitter carrying its own `name`, `value`, `form`, or static `formaction`, a `.prop` spelling of any of those (`.name` / `.value` / `.formAction` / `.formMethod` / `.formEnctype` all REFLECT on a submitter, so the write is dropped at SSR and lands in the attribute in the browser), and a second `formaction` hole. **Refused on a BOUND submitter, as a same-element contradiction:** its own `formmethod` other than post, an unparseable `formenctype` such as `text/plain`, and `formmethod="dialog"` (which dismisses a `<dialog>` instead of submitting, so the bound action could never run). A PLAIN submitter's own `formmethod` / `formenctype` is NOT refused: native HTML says the submitter's override wins, the author typed it deliberately, and the form's action simply does not run, so the renderer honours it and the dev-time client guard reports at submit time when a submission holds an identity it cannot deliver. A plain `formaction="/url"` likewise retargets away from the bound action and is the author's business. WebJs supplies `method` and `enctype` (and, on a bound submitter, `formmethod` and `formenctype`) only where your template supplies neither, judged from the TEMPLATE rather than the rendered element: `?method=${false}` emits nothing so it is supplied, while `method=${null}` emits `method=""` and is refused. An `encoding=` attribute is inert in HTML (only the `.encoding` PROPERTY aliases `enctype`), so both renderers ignore it. A page has no `action` export, so a bare `<form method="post">` is a `405`. **A bound submitter is SELF-SUFFICIENT and asks nothing of the form around it** (#1307). The renderer supplies submission attributes at the level where the action is BOUND, and never overrides what you wrote at that same level: a bound `<form>` gains `method="post"` plus `enctype`, and a bound `<button>` gains `formmethod="post"` plus `formenctype` ON THE BUTTON, which is what React does for a function `formAction`. So a per-button action works inside a bound form, an unbound form, a `method="get"` form, or a form with no method at all. That is why the refusal list above contains no rule about a submitter's NEIGHBOURS: the renderer refuses only a SAME-ELEMENT contradiction, which has no correct fallback, and never a cross-element rule, which always has one (whatever native HTML would do). It also removed a question neither renderer could answer honestly, since a COMPONENT renders its own template in a separate pass with no view of the host page and the client may reconcile a submitter whose form is not in the tree yet. One consequence: no `formaction` url is emitted (an empty one is a conformance error), so the submission targets whatever the FORM targets, and a form declaring `action="/x"` sends its buttons there. The action still runs if `/x` is a PAGE route, since the identity travels in the body; against a `route.ts` or another origin the identity is ignored and nothing runs, which the dev-time client guard reports at submit time.
 
 ---
 
diff --git a/packages/core/src/router-client.js b/packages/core/src/router-client.js
index 456aec28a..b83ab3b89 100644
--- a/packages/core/src/router-client.js
+++ b/packages/core/src/router-client.js
@@ -1205,6 +1205,29 @@ function warnIfActionSubmissionCannotDeliver(form, submitter, method, body) {
       `[webjs] this submission carries a bound server action's identity but declares enctype="${enctype}", which the server cannot parse. The router declines to send it so both paths behave the same way, and both are answered with a 405. Drop the enctype and let the binding supply it.`,
       'error',
     );
+    return;
+  }
+  // The identity is going somewhere OTHER than this page (#1307). A bound
+  // submitter emits no `formaction` url, so the submission targets whatever the
+  // FORM targets, and a form declaring its own `action="/x"` sends its buttons
+  // to `/x` by ordinary native precedence.
+  //
+  // This is the one shape the redesign left both unrefused and, until here,
+  // unreported. The renderer used to throw for it, but only where it could SEE
+  // the form, which is exactly the cross-element judgement that could not be
+  // made from inside a component. So it is reported at submit time instead,
+  // where the resolved target is a fact rather than an inference.
+  //
+  // A warning rather than an error, because it is not necessarily wrong: if
+  // `/x` is a PAGE route the action really does run there, and the 422
+  // re-render simply lands on that page. It is only dead if `/x` is a
+  // `route.ts`, another origin, or nothing at all, and the client cannot tell
+  // which from here.
+  if (path && path !== location.pathname) {
+    warnOnce(
+      `submit-elsewhere:${path}`,
+      `[webjs] this submission carries a bound server action's identity but posts to "${path}" rather than this page, because the enclosing <form> declares its own action. A bound submitter emits no formaction, so the form's target wins, which is what native HTML does. The action runs only if "${path}" is a page route; against a route.ts or another origin the identity is ignored and nothing runs. Drop the form's action attribute to keep the submission on this page.`,
+    );
   }
 }
 
diff --git a/packages/core/test/routing/browser/form-action-submit.test.js b/packages/core/test/routing/browser/form-action-submit.test.js
index 52de3b64a..7224cdee0 100644
--- a/packages/core/test/routing/browser/form-action-submit.test.js
+++ b/packages/core/test/routing/browser/form-action-submit.test.js
@@ -312,6 +312,13 @@ suite('Client router: bound form submissions (#1155)', () => {
   // nothing about the submission.
   // -------------------------------------------------------------------------
 
+  function captureWarnings(fn) {
+    const orig = console.warn;
+    const seen = [];
+    console.warn = (...a) => { seen.push(a.join(' ')); };
+    try { return fn(seen); } finally { console.warn = orig; }
+  }
+
   function captureErrors(fn) {
     const orig = console.error;
     const seen = [];
@@ -339,6 +346,53 @@ suite('Client router: bound form submissions (#1155)', () => {
     } finally { teardown(); }
   });
 
+  test('a bound identity posting to ANOTHER url is reported (#1307)', async () => {
+    // The one shape the redesign left unrefused. A bound submitter emits no
+    // `formaction`, so a form declaring its own action sends the identity
+    // there by native precedence. The renderer used to throw, but only where
+    // it could SEE the form, which is the cross-element judgement it cannot
+    // make from inside a component. Reported here, where the resolved target
+    // is a fact rather than an inference.
+    setup(okHtml);
+    try {
+      await captureWarnings(async (seen) => {
+        render(html`
+          <form method="post" action="/somewhere-else">
+            <input type="hidden" name="__webjs_action" value="a1b2c3d4e5/act">
+            <button type="submit">go</button>
+          </form>
+        `, container);
+        container.querySelector('button').click();
+        await tick();
+        assert.ok(
+          seen.some((m) => /posts to "\/somewhere-else"/.test(m)),
+          `expected the submit-elsewhere report, saw: ${JSON.stringify(seen)}`,
+        );
+      });
+    } finally { teardown(); }
+  });
+
+  test('the submit-elsewhere guard stays silent for a form posting to its own page', async () => {
+    // The counterfactual. A bound FORM has its action stripped by the renderer,
+    // so it always posts to the page and must never trip this. Without this
+    // row the guard could be written to fire on every submission and the test
+    // above would still pass.
+    setup(okHtml);
+    try {
+      await captureWarnings(async (seen) => {
+        render(html`
+          <form method="post">
+            <input type="hidden" name="__webjs_action" value="a1b2c3d4e5/act">
+            <button type="submit">go</button>
+          </form>
+        `, container);
+        container.querySelector('button').click();
+        await tick();
+        assert.equal(seen.length, 0, `expected silence, saw: ${JSON.stringify(seen)}`);
+      });
+    } finally { teardown(); }
+  });
+
   test('the guard stays silent for a form carrying no bound identity', async () => {
     // An ordinary hand-written form is not this feature's business, and a
     // console error on every plain GET form would be pure noise.

From e7be0d00c43db37dcfb42c8b43537a51033daf55 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Fri, 7 Aug 2026 20:09:36 +0530
Subject: [PATCH 13/13] test: pin the awkward hole kinds in the SSR/client
 differential

The parity suite covered a plain `attr` hole for a bound submitter's
`formmethod` / `formenctype`, which is one commit branch of four. An
`attr-mixed` value is assembled from statics plus values, and a FALSY boolean
hole emits nothing so the framework supplies the attribute as if the template
were silent. Each resolves through a different path and none was pinned.

All four now render byte-identically on both renderers, in three real browsers.
Adds the truthy boolean row too: `?formmethod=${true}` emits `formmethod=""`,
an empty enumerated value that cannot submit, so it must refuse rather than be
mistaken for absent and quietly supplied.

Found by working the review areas by hand after two review agents failed to
report. The other areas came back clean: the GET query-string promotion is
byte-identical over a FormData and a URLSearchParams including File-to-name,
and the telemetry dedupe keys on the matched route rather than the pathname.
---
 .../rendering/browser/ssr-client-parity.test.js | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/packages/core/test/rendering/browser/ssr-client-parity.test.js b/packages/core/test/rendering/browser/ssr-client-parity.test.js
index bd94541d0..4fcd42917 100644
--- a/packages/core/test/rendering/browser/ssr-client-parity.test.js
+++ b/packages/core/test/rendering/browser/ssr-client-parity.test.js
@@ -431,6 +431,15 @@ suite('SSR/client parity: form actions (#1155)', () => {
     'bound submitter with a HOLE-provided formmethod': () => html`<button formaction=${boundAction()} formmethod=${'post'}>Save</button>`,
     'bound submitter with a HOLE-provided formenctype': () => html`<button formaction=${boundAction()} formenctype=${'application/x-www-form-urlencoded'}>Save</button>`,
     'bound submitter with BOTH provided by holes': () => html`<button formaction=${boundAction()} formmethod=${'post'} formenctype=${'multipart/form-data'}>Save</button>`,
+    // The awkward hole KINDS, which resolve through different commit branches
+    // than a plain `attr` hole. An `attr-mixed` value is assembled from statics
+    // plus values, and a FALSY boolean hole emits nothing at all, so the
+    // framework supplies the attribute exactly as if the template were silent.
+    // Each is a separate path through `effectiveFormAttr`, and a plain `attr`
+    // row does not exercise any of them.
+    'bound submitter with an attr-mixed formmethod': () => html`<button formaction=${boundAction()} formmethod="${'po'}${'st'}">Save</button>`,
+    'bound submitter with a FALSY boolean formmethod hole': () => html`<button formaction=${boundAction()} ?formmethod=${false}>Save</button>`,
+    'bound submitter with a FALSY boolean formenctype hole': () => html`<button formaction=${boundAction()} ?formenctype=${false}>Save</button>`,
     // #1307 reverses #1207's Part B: a PLAIN button's own override is a legal
     // native instruction, so both renderers leave it exactly as written.
     'plain submitter formmethod=get inside a bound form': () => html`<form action=${boundAction()}><button formmethod="get">Save</button></form>`,
@@ -482,6 +491,14 @@ suite('SSR/client parity: form actions (#1155)', () => {
       () => html`<button formaction=${boundAction()} formmethod="dialog"></button>`,
       /formmethod="dialog"/,
     ],
+    // A TRUTHY boolean hole emits `formmethod=""`, an empty enumerated value
+    // that cannot submit, so it must refuse rather than be treated as absent
+    // and quietly supplied. This is the submitter twin of the form-level
+    // `?enctype=${true}` row above.
+    'truthy boolean formmethod hole on a BOUND submitter': [
+      () => html`<button formaction=${boundAction()} ?formmethod=${true}></button>`,
+      /cannot work/,
+    ],
     'padded formmethod on a BOUND submitter': [
       () => html`<button formaction=${boundAction()} formmethod=${' post '}></button>`,
       /cannot work/,