fix: clear the removed rule's premise from the surfaces it outlived

Review of the removal turned up five places still asserting, or still
built for, the enclosing-form question #1307 deleted.

The gallery's submit-todo comment contradicted itself four lines apart,
saying the enclosing form does NOT have to be bound and then that it does,
and pointed readers at the rule this branch removes. That file is scaffold
payload, so it ships into every generated app.

The production onError message for WEBJS_FORM_SUBMITTED_AS_GET named the
enclosing form as the cause; the dev logger four lines above it was already
correct, so the two disagreed on one event. render-server.js still carried
the four-state form-scope comment and passed a vestigial third argument to
a two-parameter render(), both left over from the same removal. check.js
kept two imports whose only uses were inside the deleted function, and the
now-callerless scanner's JSDoc still described the consumer it lost.

Author: vivek7405

gallery/modules/todo/actions/submit-todo.server.ts

@@ -21,17 +21,12 @@ import { deleteTodo } from './delete-todo.server.ts';
 // control's visible label), and a bound submitter cannot carry its own
 // `name`/`value`, which is exactly the channel `name="intent"` uses below.
 //
-// Third thing to know, and the one that fails silently: the enclosing <form>
-// has to be bound too, because `method="post"` and the enctype are supplied on
-// the form's start tag and a per-button action cannot retrofit them. The
-// renderer refuses an unbound form it can see, but a submitter inside a
-// COMPONENT is a cannot-tell (the component renders in its own pass with no
-// view of the host page) and binds anyway. What happens then depends on that
-// form: one still declaring `method="post"` works (the identity rides the
-// button's own name/value pair into the body), but one with no method submits as
-// a GET, so the identity rides the query string and the action never runs while
-// the page returns 200. Run `webjs check`: `submitter-needs-bound-form` finds
-// these across modules.
+// Third thing to know: no `formaction` url is emitted, because the identity
+// travels in the body instead. So the submission targets whatever the FORM
+// targets, and a form declaring `action="/x"` sends its buttons there. The
+// action still runs when `/x` is a PAGE route; against a `route.ts` or another
+// origin the identity is ignored and nothing runs, which the dev-time client
+// guard reports at submit time.
 //
 // With JS the component intercepts the submit and calls the underlying action
 // directly for the optimistic path, so this runs only with JS off.

packages/core/src/render-server.js

@@ -182,23 +182,6 @@ async function renderTemplate(tr, ctx) {
   let pendingPropAttrs = [];
   /** @type {string[]} */
   let pendingSubmitterProps = [];
-  // Whether the tag stream is currently inside a form that BOUND an action
-  // (#1207), as THIS scan can see it. Three states, and the third is the point:
-  //   'bound'   an enclosing <form> opened here and bound an action
-  //   'unbound' an enclosing <form> opened here and bound nothing
-  //   'none'    there is conclusively no enclosing <form>
-  //   'unknown' there may be one, but this scan cannot see it
-  //
-  // The last two look alike and must not be merged, which is what a boolean did.
-  // A component's template is rendered by a SEPARATE pass (`injectDSD` calls
-  // `render` on it), so a `<button formaction=${fn}>` inside a component inside
-  // a bound form read as "no form", was refused, and in production vanished
-  // from a page that still returned 200. That pass now says 'unknown' and the
-  // boundness question is skipped, exactly as the client skips it when it
-  // cannot reach the form, so both renderers are best effort in the same place
-  // and for the same reason. A top-level scan that simply contains no form
-  // stays 'none' and is still refused, because there the answer IS known.
-  //
   let isCloseTag = false;
 
   // A bound `action=${fn}` is committed at its hole, but the edits it implies
@@ -1037,14 +1020,12 @@ async function injectDSD(html, ctx, ancestors = [], dev) {
       // Render the template to HTML. injectDSD recurses on the result so
       // nested custom elements (e.g. <theme-toggle> inside <blog-shell>)
       // get their own DSD pass.
-      // 'unknown' for the form scope (#1207): this is a SEPARATE render pass
-      // over one component's own template, driven by walking the already-emitted
-      // HTML, so it has no idea whether the host tag sits inside a bound
-      // `<form>`. Passing the default 'none' claimed there was no form at all,
-      // which refused a perfectly good `<button formaction=${fn}>` in a
-      // component inside a bound form and, because component SSR errors are
-      // isolated, made the button vanish from a page that still returned 200.
-      const rawInner = await render(tpl, ctx, 'unknown');
+      // This is a SEPARATE render pass over one component's own template,
+      // driven by walking the already-emitted HTML, so it has no idea whether
+      // the host tag sits inside a `<form>`. It does not need to: a bound
+      // submitter carries its whole submission (#1307), so nothing here asks
+      // about an enclosing form.
+      const rawInner = await render(tpl, ctx);
 
       if (isShadow) {
         // Shadow DOM: native <slot> stays as-is in the DSD template. The

packages/server/src/check.js

@@ -6,12 +6,11 @@ import {
   redactToPlaceholders,
   extractWebComponentClassBodies,
   matchClosingBrace,
-  matchClosingParenthesis,
   parsePropEntries,
   classifyActionHole,
 } from './js-scan.js';
 import { buildModuleGraph, transitiveDeps, resolveImport } from './module-graph.js';
-import { scanComponents, extractComponents } from './component-scanner.js';
+import { scanComponents } from './component-scanner.js';
 import { buildRouteTable } from './router.js';
 import { analyzeElision } from './component-elision.js';
 import { RESERVED_CONFIG } from './action-config.js';

packages/server/src/form-dispatch.js

@@ -359,7 +359,7 @@ export function reportFormSubmittedAsGet(url, req, onError, logger, dev, route)
   }
   if (!willReport) return;
   const err = new Error(
-    `A form submission reached ${url.pathname} as a GET with the \`${FORM_ACTION_FIELD}\` identity in the query string, so no server action ran. The submitter's enclosing <form> binds no action.`,
+    `A form submission reached ${url.pathname} as a GET with the \`${FORM_ACTION_FIELD}\` identity in the query string, so no server action ran. A bound submitter carries its own formmethod="post", so look for a formmethod="get" on the button that was pressed, or a method="get" on its form: a submitter's own formmethod wins by native precedence and WebJs honours it rather than refusing it.`,
   );
   /** @type {any} */ (err).code = 'WEBJS_FORM_SUBMITTED_AS_GET';
   /** @type {any} */ (err).method = req.method;

packages/server/src/js-scan.js

@@ -895,13 +895,20 @@ function isInlineStartTagHole(tagName, literalBefore) {
  * submitter action hole (`<button|input formaction=${...}>`) and each
  * custom-element start tag, the enclosing `<form>` scope at that point (#1307).
  *
+ * NOTE: this currently has NO production caller. It was written for the
+ * `submitter-needs-bound-form` check rule, which #1384 removed because its
+ * premise was false: a bound submitter is self-sufficient, so the enclosing
+ * form's boundness does not decide whether the action runs. The scan itself is
+ * correct about what it reports and is kept for a future consumer, but nothing
+ * reads it today, so treat it as unproven against real-world input.
+ *
  * Only an `html`-tagged literal is entered, so `const s = '<form>'` and a `css`
  * or `sql` template are never read as markup. That carve-out matters: the
  * framework's own website renders `<form action=${fn}>` as a code SAMPLE.
  *
  * A template nested inside a CHILD-position hole INHERITS the enclosing scope,
- * because that is what the renderer does (`render` threads `formScope` through
- * arrays, `repeat`, and nested templates).
+ * because that is where the renderer places it (through arrays, `repeat`, and
+ * nested templates).
  *
  * One in a START-TAG hole is `'handed'`: an attribute or property value whose
  * placement this scan cannot speak for. Worth being exact about why, because the
@@ -922,10 +929,10 @@ function isInlineStartTagHole(tagName, literalBefore) {
  * the scan started in, mirroring `handleTagEnd` in `render-server.js`.
  *
  * `opensForm` reports whether ANY `<form` start tag was seen anywhere in `src`.
- * A caller attributing a scope-`'none'` site to this file needs it: a fragment
- * built into a local and spliced into a form the same file opens inherits the
- * SPLICE point's scope, not the file's own call-site scope, so a file that
- * opens a form cannot have its `'none'` sites attributed safely.
+ * It exists for a caller that attributes a scope-`'none'` site to this file: a
+ * fragment built into a local and spliced into a form the same file opens
+ * inherits the SPLICE point's scope, not the file's own call-site scope, so a
+ * file that opens a form cannot have its `'none'` sites attributed safely.
  *
  * @param {string} src
  * @returns {{ submitters: FormScopeSite[], tagUses: FormScopeSite[], opensForm: boolean }}