diff --git a/.agents/skills/webjs/references/data-and-actions.md b/.agents/skills/webjs/references/data-and-actions.md
index 4be1cca2f..7ec2dcfd5 100644
--- a/.agents/skills/webjs/references/data-and-actions.md
+++ b/.agents/skills/webjs/references/data-and-actions.md
@@ -146,6 +146,7 @@ Everything the action declares applies here too, or an action would be protected
 - `invalidates` is evicted when the action actually RAN (a middleware short-circuit does not evict), and the evicted tags are reported on the response so the browser's tag coordinator bypasses a stale cached GET. One reach limit: `fetch` follows the success `303` transparently, so JS cannot read a redirect's headers; the tags are on the wire and the `422` re-render carries them, and the redirect's own render is server-side and seeds fresh data.
 - `invalidates` and `tags` receive the SAME first argument the action does, so on a form boundary they receive the `FormData`. `invalidates: (input) => ['post:' + input.id]` returns `post:undefined` for a submission and evicts nothing. Either read the field (`(fd) => ['post:' + fd.get('id')]`), declare a `validate` that transforms the `FormData` into the typed input first (the transform result is what the config functions then see), or use an argument-independent tag.
 - `method = 'GET'` cannot be bound to a form: a GET action rides its args in the url and is CSRF-exempt, so it cannot answer a form POST. That is a `405` at runtime and the `form-action-not-a-get-action` error in `webjs check`.
+- A form whose buttons run DIFFERENT actions binds each on its submitter, `<button formaction=${publishDraft}>`, inside a form that is itself bound. **Bind the enclosing form**, because `method="post"` and the enctype are supplied on the form's start tag and a per-button action cannot retrofit them. The renderer refuses an unbound host form it can see, but a submitter in a COMPONENT is a cannot-tell (the component renders in its own pass with no view of the host page) and binds anyway. What happens then depends on the host form. One that still sends a parseable POST body WORKS, because the identity rides the button's own `name`/`value` pair into the body. One with no `method` (or `method="get"`) submits a GET, so the identity rides the query string, the action never runs, and the page re-renders with a 200 with nothing thrown and nothing logged. `webjs check`'s `submitter-needs-bound-form` resolves this across modules and flags it at edit time; in dev the client logs one `console.error` at submit time, and in production both server-visible fingerprints reach `onError` with a code (`WEBJS_FORM_SUBMITTED_AS_GET` for the query-string GET, `WEBJS_FORM_ACTION_MISSING` for a body carrying no identity). See `muscle-memory-gotchas.md` for the shape.
 
 The response drives the page: a success is a `303` PRG (to `result.redirect` when it is a same-site local path, else the page's own url), a failure re-renders the SAME page with `status` (default `422`) and the result on `actionData`, a submission carrying no identity is a `405`, and one whose hash no longer resolves is a `422` with a resubmit message (a form held open across a deploy). The submission is Origin-verified like an RPC call, so no token field is needed.
 
diff --git a/.agents/skills/webjs/references/muscle-memory-gotchas.md b/.agents/skills/webjs/references/muscle-memory-gotchas.md
index ea9773e23..2e1fbd305 100644
--- a/.agents/skills/webjs/references/muscle-memory-gotchas.md
+++ b/.agents/skills/webjs/references/muscle-memory-gotchas.md
@@ -110,6 +110,7 @@ The bound, refused, and allowed shapes in full. Every "no" row is a binding that
 | `action=${fn}` on any other tag | yes | `action` submits nothing off a `<form>`, so it is an ordinary attribute and the function would be stringified |
 | `action="${fn}"`, or a mixed `action="/x/${fn}"` | yes | quoting turns a binding hole back into a plain attribute |
 | `formaction=${fn}` unquoted, on a submitter, ANYWHERE | **no, it BINDS** | the second supported shape (#1207, #1307). A bound submitter carries its WHOLE submission: the identity rides the button's own `name`/`value` pair, the one channel a browser submits for the pressed button alone, and the renderer adds `formmethod="post"` and `formenctype="multipart/form-data"` to the button itself. So it works inside a bound form, an unbound form, a `method="get"` form, or a form with no method at all, and it asks NOTHING of the element around it. No `formaction` url is emitted, and the server takes the LAST `__webjs_action` entry |
+
 | `formaction=${fn}` on a submitter carrying its own `name` or `value` | yes | the identity IS that name/value pair, so both halves are already spoken for. Bind one action on the form and dispatch on `name="intent"` if you need the button's own value |
 | `formaction=${fn}` on a non-submit control, or `<input type="image">` | yes | `formaction` is inert on anything that does not submit, and an image submitter sends `name.x` / `name.y` coordinates instead of `name=value`, so the identity would never arrive |
 | `formaction=${fn}` on a submitter with `form="other"` | yes | it re-points the submitter at a different form owner, which may not be where the identity field it needs lives |
@@ -136,6 +137,28 @@ That last row is the one to remember: quoting a binding hole turns it back into
 
 `.action=${fn}` on a native form is refused during SSR too, even though the property is dropped there and nothing could leak, so a page cannot render clean on the server and then throw on hydration.
 
+**A submitter in a component whose host form is unbound AND cannot carry a body is the one failure the renderers cannot throw on.** It is the shape to check by hand whenever you split a form across modules:
+
+```ts
+// components/publish-button.ts   <- the submitter lives here
+class PublishButton extends WebComponent({}) {
+  render() { return html`<button formaction=${publishDraft}>Publish</button>`; }
+}
+PublishButton.register('publish-button');
+
+// app/triage/page.ts             <- the form lives here
+// WRONG: the form binds nothing, and NOTHING throws.
+html`<form><publish-button></publish-button></form>`;
+// RIGHT: bind the enclosing form too.
+html`<form action=${saveAll}><publish-button></publish-button></form>`;
+```
+
+The component renders its own template in a separate pass with no view of the host page, so the renderer sees a cannot-tell and binds anyway (refusing would drop an isolated component from a page that still returned 200, which is worse). What ships is a button carrying the reserved `__webjs_action` identity inside whatever form the page wrote. Whether that is broken depends on the form, and the distinction is easy to miss: one that still sends a parseable POST body WORKS, because the identity rides the button's own `name`/`value` pair into the body and the dispatcher runs the action. One with no `method` (or `method="get"`) submits a GET, so the identity rides the QUERY STRING, the action never runs, the page re-renders, the status is 200, and there is no throw, no log, and no 405. A silent write path is the whole failure mode, so treat the address bar growing a `?__webjs_action=` as the fingerprint.
+
+**Two runtime signals back the check up.** In dev, submitting a form that carries an action identity it cannot deliver logs one `console.error` naming the fix, once per shape; it never throws, so the submission behaves exactly as it does in production. In production, both server-visible fingerprints reach the `onError` hook (the programmatic `createRequestHandler({ onError })` option and any sink an `instrumentation.{js,ts}` installed) with a code to group on: `WEBJS_FORM_SUBMITTED_AS_GET` for a page GET carrying the reserved field in its query string, and `WEBJS_FORM_ACTION_MISSING` for a form body carrying no identity at all. Both are detect-only, so no status changes, and both carry the submitted field NAMES and never the values.
+
+**Run `webjs check` and it catches this for you.** The `submitter-needs-bound-form` rule reads every template in the app at once, which neither renderer can do, so it resolves the enclosing form across module boundaries and transitively through intermediate components (a page's form around `<todo-list>` around `<todo-row>` around the button). It is conservative by design and says nothing when it cannot be sure: a tag rendered in a bound form somewhere and an unbound one elsewhere, a tag whose host form is unbound but still DELIVERS (that shape works), a form whose `method` or `enctype` comes from a hole, a tag with no call site in the app, a submitter in a bare `html` helper rather than a component class body, a file registering more than one tag, a file that opens a form of its own, a submitter or tag handed to another element through a start-tag hole (`<my-thing .tpl=${html`…`}>`), a `formaction` hole that is not a proven action binding (a url string or CONSTANT, a factory-produced export, a namespace or default import, a barrel re-export, or a non-identifier expression like `acts.publishDraft`), or a reference cycle. The one start-tag hole it DOES judge is `<webjs-suspense .fallback=${html`…`}>`, because the renderer renders a fallback inline in the enclosing form rather than handing it off. Silence from the rule is therefore not proof the form is bound; a green check plus the shape above still deserves a look.
+
 **Inside a component you may never see the error.** Per-component SSR error isolation contains the throw, so development shows an error box in place of the component and production renders it empty with the page still returning 200. A form that has silently vanished in production is this bug wearing a disguise; the message is in the server log. Nothing leaks either way.
 
 Two things that "renders it empty" understates, both worth knowing before you go looking:
diff --git a/gallery/modules/todo/actions/submit-todo.server.ts b/gallery/modules/todo/actions/submit-todo.server.ts
index 2a6cff268..cf9d24bfa 100644
--- a/gallery/modules/todo/actions/submit-todo.server.ts
+++ b/gallery/modules/todo/actions/submit-todo.server.ts
@@ -21,6 +21,18 @@ import { deleteTodo } from './delete-todo.server.ts';
 // control's visible label), and a bound submitter cannot carry its own
 // `name`/`value`, which is exactly the channel `name="intent"` uses below.
 //
+// Third thing to know, and the one that fails silently: the enclosing <form>
+// has to be bound too, because `method="post"` and the enctype are supplied on
+// the form's start tag and a per-button action cannot retrofit them. The
+// renderer refuses an unbound form it can see, but a submitter inside a
+// COMPONENT is a cannot-tell (the component renders in its own pass with no
+// view of the host page) and binds anyway. What happens then depends on that
+// form: one still declaring `method="post"` works (the identity rides the
+// button's own name/value pair into the body), but one with no method submits as
+// a GET, so the identity rides the query string and the action never runs while
+// the page returns 200. Run `webjs check`: `submitter-needs-bound-form` finds
+// these across modules.
+//
 // With JS the component intercepts the submit and calls the underlying action
 // directly for the optimistic path, so this runs only with JS off.
 export async function submitTodo(formData: FormData) {
diff --git a/packages/server/src/check.js b/packages/server/src/check.js
index ee87e3ec9..98f67dbb2 100644
--- a/packages/server/src/check.js
+++ b/packages/server/src/check.js
@@ -6,10 +6,13 @@ import {
   redactToPlaceholders,
   extractWebComponentClassBodies,
   matchClosingBrace,
+  matchClosingParenthesis,
   parsePropEntries,
+  classifyActionHole,
+  scanHtmlFormScopes,
 } from './js-scan.js';
 import { buildModuleGraph, transitiveDeps, resolveImport } from './module-graph.js';
-import { scanComponents } from './component-scanner.js';
+import { scanComponents, extractComponents } from './component-scanner.js';
 import { buildRouteTable } from './router.js';
 import { analyzeElision } from './component-elision.js';
 import { RESERVED_CONFIG } from './action-config.js';
@@ -140,6 +143,11 @@ export const RULES = [
     description:
       'Flags `<form action=${someAction}>` bound to a `\'use server\'` action whose file declares `export const method = \'GET\'` (#488). A GET action is a READ: it is CSRF-exempt and rides its arguments in the url, while a form submission is a CSRF-checked POST carrying a body, so the two contracts contradict each other and the submission is answered with a 405 at runtime. The rule reads the imported action\'s own file, so it only fires when the binding really does resolve to a GET-declared action. Fix by dropping the `method` export (an action with no `method` is a POST, which is what a form wants) or by binding a different action; if the form really is a read, use a plain `<form method="get" action="/search">` with no bound action.',
   },
+  {
+    name: 'submitter-needs-bound-form',
+    description:
+      'Flags a `<button formaction=${action}>` submitter (#1207) that a whole-app scan proves sits in a `<form>` which binds no action AND cannot carry the submitter\'s identity to the server. Those are two separate questions and only both together are a defect. An unbound `<form method="post">` still WORKS, because a submitter\'s identity rides its own `name`/`value` pair, which the browser submits for the pressed button alone, and the dispatcher takes the last `__webjs_action` entry it finds. What breaks is an unbound form that sends nothing readable: no `method` at all or `method="get"` (a GET carries the identity in the QUERY STRING, so the action never runs and the page simply re-renders with a 200, silently), or an enctype the server cannot parse (a 405). The renderers cannot catch the cross-module case alone. SSR reads one template at a time and a COMPONENT renders its own template in a separate pass with no view of the host page, so a submitter in a component is a cannot-tell, and cannot-tell has to bind (refusing there would drop an isolated component from a page that still returned 200). This rule has neither limit: it reads every template in the app at once. Deliberately conservative so it can never false-positive. A submitter whose enclosing form is UNBOUND in the SAME scan is flagged whatever its method, because the renderer refuses that shape outright. Across modules, a submitter with no enclosing form in its own scan is attributed to a component only when its file registers exactly one tag, declares exactly one WebComponent class, holds the submitter inside that class body, and opens no `<form>` of its own; every other shape (a bare `html` helper, a multi-component file, a file that could splice a fragment into its own form, a `formaction` hole that is not a PROVEN action binding (the scan is lexical while the renderer binds only a FUNCTION, so a url string, a url constant exported from a `.server` module, a factory-produced export, a namespace or default import, a barrel re-export, and any non-identifier expression are all left alone, which misses some real bindings but never misreports a working form), and a submitter or tag handed off in a START-TAG hole, which some other element receives and places, the one exception being `<webjs-suspense .fallback=${…}>`, which the renderer renders inline in the enclosing form and which IS therefore judged) is UNKNOWABLE and never flagged, because a fragment renders inside the CALLER\'s scan and inherits the caller\'s form scope. An attributed tag is then resolved across every call site, recursively and memoized: any call site that is bound, that is unbound but still delivering, that is unknowable, that has dynamic `method`/`enctype`, or that is part of a cycle makes the verdict unknowable, and a tag with no call site at all is unknowable too. The rule fires only when at least one call site exists and EVERY one places the tag in a form that cannot deliver. Fix by binding the enclosing form (`<form action=${formAction}>`), which is what supplies `method="post"` and the enctype at form start, too late to add from the button.',
+  },
   {
     name: 'no-redirect-in-api-route',
     description:
@@ -1396,26 +1404,15 @@ export async function checkConventions(appDir) {
         // with no hole in it. That distinction is the whole carve-out: the
         // framework's own website renders this exact shape as a code sample.
         const { redacted, literals } = redactToPlaceholders(content);
-        // A hole binds an action when the literal segment IMMEDIATELY before it
-        // ends inside a start tag at the attribute that tag can really bind:
-        // `action=` on a `<form>` (#1155), or `formaction=` on a `<button>` /
-        // `<input>` submitter (#1207). Reading the segment rather than the whole
-        // template is what keeps `<div action=${x}>` out. The tag and the
-        // attribute are matched as a PAIR, so `<form formaction=${x}>` and
-        // `<button action=${x}>` stay out too: both are refused at render time,
-        // and neither is this rule's failure mode.
+        // Both binding shapes count the same here: `action=` on a `<form>`
+        // (#1155) and `formaction=` on a `<button>` / `<input>` submitter
+        // (#1207) each put the named action behind a form submission, and a
+        // GET-declared action cannot serve either. `classifyActionHole` owns
+        // the tag-and-attribute pairing (js-scan.js), shared with
+        // `submitter-needs-bound-form`.
         const bound = new Set();
         for (const m of redacted.matchAll(/__STR_(\d+)__\$\{\s*([A-Za-z_$][\w$]*)\s*\}/g)) {
-          const before = literals[Number(m[1])] || '';
-          // The last `<` opens the tag the hole sits in. Requiring no `>`
-          // after it keeps the match inside that one start tag.
-          const tagAt = before.lastIndexOf('<');
-          if (tagAt < 0) continue;
-          const tag = before.slice(tagAt);
-          if (tag.includes('>')) continue;
-          const bindsForm = /^<form\b/i.test(tag) && /\saction=$/i.test(tag);
-          const bindsSubmitter = /^<(?:button|input)\b/i.test(tag) && /\sformaction=$/i.test(tag);
-          if (!bindsForm && !bindsSubmitter) continue;
+          if (!classifyActionHole(literals[Number(m[1])] || '')) continue;
           bound.add(m[2]);
         }
         if (!bound.size) continue;
@@ -1454,9 +1451,455 @@ export async function checkConventions(appDir) {
     }
   }
 
+  // --- Rule: submitter-needs-bound-form (#1307) ---
+  // A submitter bound in a component whose host form is unbound posts nowhere:
+  // the form defaults to GET, the identity rides the query string, and the page
+  // re-renders with the action never having run. Neither renderer can see it
+  // (each judges one template scan), so the whole-app scan is the only place
+  // the answer exists.
+  checkSubmitterNeedsBoundForm(files, violations, appDir);
+
   return violations;
 }
 
+/**
+ * Implements `submitter-needs-bound-form` (#1307). Factored out because it is
+ * whole-app: a submitter's enclosing form can live in a different module, so the
+ * verdict is a fixed point over every template in the app rather than a
+ * per-file scan.
+ *
+ * The tag-to-owner map comes from `extractComponents` over the `files` array the
+ * caller has already read, so there is no second directory walk. It does take
+ * `appDir`, because deciding whether a `formaction` hole is a real action
+ * binding means resolving the import to its target module and checking the
+ * export is callable; `resolveImport` needs the app root for that.
+ *
+ * @param {{ abs: string, rel: string, content: string, scan: string }[]} files
+ * @param {Violation[]} violations appended to in place
+ * @param {string} appDir
+ */
+function checkSubmitterNeedsBoundForm(files, violations, appDir) {
+  /**
+   * The FIX line is identical for every shape this rule reports, so it is
+   * written once.
+   */
+  const FIX = 'Bind the enclosing <form> too (`<form action=${formAction}>`), which is what supplies method="post" and the enctype at form start. A per-button action cannot retrofit them.';
+  /**
+   * Mirrors `scanComponents`'s own filter: a fixture or a spec in an app tree
+   * must not claim a tag, and a `.server.` module never renders to a browser.
+   * @param {string} rel
+   */
+  const isAppTemplateFile = (rel) =>
+    /\.m?[jt]sx?$/.test(rel)
+    && !/\.(test|spec)\.m?[jt]sx?$/.test(rel)
+    && !/\.server\.m?[jt]s$/.test(rel);
+
+  /** Every scanned file by absolute path, for resolving an import's target. */
+  const byAbs = new Map(files.map((f) => [f.abs, f]));
+
+  /**
+   * Is `name` exported from `scan` as something PROVABLY callable?
+   *
+   * The bias is the opposite of the sibling `'use server'` rules, and
+   * deliberately so. Those tolerate a false NEGATIVE, so anything ambiguous
+   * counts as possibly-callable. Here an ambiguous export firing the rule is a
+   * false POSITIVE on working code, so only a shape that must be a function
+   * counts: a function declaration, or a const bound to an arrow or a function
+   * expression. `export const ARCHIVE_URL = '/api/x'` is NOT callable, and a
+   * factory (`export const go = cache(fn)`) is not PROVABLE, so both stay
+   * silent.
+   *
+   * @param {string} scan fully-blanked view of the target module
+   * @param {string} name
+   * @returns {boolean}
+   */
+  const exportsCallable = (scan, name) => {
+    const n = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    // `export [async] function NAME`.
+    if (new RegExp(`\\bexport\\s+(?:async\\s+)?function\\s+${n}\\b`).test(scan)) return true;
+    // A local declaration surfaced by a clause: `function NAME(){}; export { NAME }`.
+    // Only a clause with NO `from`, since a re-export would need another hop to
+    // the module that actually declares it.
+    const reClause = /\bexport\s*\{([^}]*)\}/g;
+    let cl;
+    while ((cl = reClause.exec(scan))) {
+      // A re-export needs another hop to the module that DECLARES the name, so
+      // it stays unknowable. Tested on the text after the clause rather than
+      // with a lookahead: `\s*(?!from)` can never reject, because `\s*`
+      // backtracks to zero width and the lookahead then reads the whitespace.
+      if (/^\s*from\b/.test(scan.slice(cl.index + cl[0].length))) continue;
+      const exported = cl[1].split(',').some((part) => {
+        const m = /([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?/.exec(part.trim());
+        return !!m && (m[2] || m[1]) === name;
+      });
+      if (!exported) continue;
+      const local = cl[1].split(',').map((part) => /([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?/.exec(part.trim()))
+        .filter((m) => m && (m[2] || m[1]) === name).map((m) => m[1])[0];
+      if (local && declaresCallable(scan, local)) return true;
+    }
+    return declaresCallable(scan, name, true);
+  };
+
+  /**
+   * Index just past the assignment `=` that follows a `const NAME`, or -1.
+   *
+   * A TypeScript annotation can itself contain `=>`
+   * (`const publishDraft: (fd: FormData) => Promise<void> = async (fd) => …`),
+   * which is the idiomatic spelling this repo's derive-the-type rule pushes
+   * authors toward. Skipping the annotation with a lazy regex group stopped at
+   * the FIRST `=`, which is the one inside the annotation's own arrow, so the
+   * scan resumed on `>` and every branch failed. Walking it with bracket depth
+   * and stepping over `=>` finds the real assignment.
+   *
+   * @param {string} scan
+   * @param {number} i index just after the declared name
+   * @returns {number}
+   */
+  function assignmentAfter(scan, i) {
+    let depth = 0;
+    while (i < scan.length) {
+      const c = scan[i];
+      // A `;` ENDS the declaration only at depth zero. TypeScript's canonical
+      // member separator is `;`, so an inline object type
+      // (`: ActionFn<{ id: string; title: string }>`) carries one INSIDE its
+      // brackets, and bailing there dropped the binding.
+      if (c === ';' && depth <= 0) return -1;
+      if (c === '=' && scan[i + 1] === '>') { i += 2; continue; }   // arrow in the annotation
+      if (c === '(' || c === '[' || c === '{' || c === '<') { depth++; i++; continue; }
+      if (c === ')' || c === ']' || c === '}' || c === '>') { depth--; i++; continue; }
+      // Reject `==` and `!=`, but NOT a preceding `<` or `>`: in annotation
+      // position those are brackets this same loop already consumed as such, so
+      // reading `Promise<void>=` as a `>=` comparison classified one character
+      // two contradictory ways.
+      //
+      // Two separate guards share this line, and only one of them is
+      // unpinnable. `depth <= 0` is live and reachable: a DEFAULT type
+      // parameter (`: <T = FormData>(fd: T) => …`) puts a bare `=` inside the
+      // annotation's brackets, and without the depth check that `=` is returned
+      // as the assignment. A row pins it.
+      //
+      // The `==` / `!=` rejection is the unpinnable half: no valid TypeScript
+      // puts a comparison between a declared name and its assignment, so no
+      // test can reach it. It is here because the input is a MASK of arbitrary
+      // source, which may be mid-edit and not valid at all.
+      //
+      // Do NOT restate here how many guards in this resolver are pinned. Two
+      // successive commits asserted an exact count and both were wrong within
+      // one commit of being written, because the count decays the moment
+      // anyone adds a guard. The durable statement is the rule, not the
+      // tally: a new guard needs a row in `submitter-needs-bound-form.test.js`
+      // that FAILS when the guard is broken, verified by breaking it.
+      if (depth <= 0 && c === '=' && scan[i + 1] !== '=' && !'=!'.includes(scan[i - 1] || '')) return i + 1;
+      i++;
+    }
+    return -1;
+  }
+
+  /**
+   * Is `name` DECLARED as something provably callable in `scan`?
+   *
+   * The arrow case must see the `=>`. An earlier version accepted a bare `(`
+   * after the `=`, which proves a parenthesized EXPRESSION and not a callable,
+   * so `export const ARCHIVE_URL = ('/api/x')` and the ordinary env-fallback
+   * spelling `= (process.env.X || '/api/x')` were read as actions. That is the
+   * exact false positive this whole resolver exists to prevent.
+   *
+   * @param {string} scan
+   * @param {string} name
+   * @param {boolean} [exported] require the declaration to carry `export`
+   * @returns {boolean}
+   */
+  function declaresCallable(scan, name, exported = false) {
+    const n = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const lead = exported ? '\\bexport\\s+' : '\\b';
+    if (!exported && new RegExp(`\\bfunction\\s+${n}\\b`).test(scan)) return true;
+    const re = new RegExp(`${lead}(?:const|let|var)\\s+${n}\\b`, 'g');
+    let m;
+    while ((m = re.exec(scan))) {
+      let i = assignmentAfter(scan, m.index + m[0].length);
+      if (i === -1) continue;
+      const skipWs = () => { while (i < scan.length && /\s/.test(scan[i])) i++; };
+      skipWs();
+      if (scan.startsWith('async', i) && /[\s(<]/.test(scan[i + 5] || '')) { i += 5; skipWs(); }
+      // `= [async] function ...`
+      if (/^function\b/.test(scan.slice(i, i + 9))) return true;
+      // `= [async] [<T>](params)[: ReturnType] => ...`, which must actually reach
+      // the arrow. Both the type-parameter list and the return type are optional
+      // and can carry their own brackets, so each is walked with depth rather
+      // than matched.
+      if (scan[i] === '<') {
+        let d2 = 0;
+        while (i < scan.length) {
+          const c = scan[i];
+          if (c === '=' && scan[i + 1] === '>') { i += 2; continue; }
+          if (c === '<') d2++;
+          else if (c === '>') { d2--; if (d2 <= 0) { i++; break; } }
+          i++;
+        }
+        skipWs();
+      }
+      if (scan[i] === '(') {
+        const close = matchClosingParenthesis(scan, i + 1);
+        if (close === -1) continue;
+        i = close + 1;
+        skipWs();
+        if (scan[i] === ':') {
+          let depth = 0;
+          i++;
+          while (i < scan.length) {
+            const c = scan[i];
+            // Depth-guarded, exactly like the declaration-side walk. A return
+            // type carries both separators INSIDE its brackets:
+            // `Promise<Record<string, string>>` is the `fieldErrors` shape the
+            // ActionResult envelope pushes authors toward, and an inline object
+            // return type uses `;`.
+            if ((c === ';' || c === ',') && depth <= 0) break;
+            // An arrow at depth zero ENDS the return type; a nested one is part
+            // of it and must be stepped over whole, or its `>` is eaten by the
+            // closer branch below and the depth skews. That is the same
+            // any-depth step the declaration walk makes.
+            if (c === '=' && scan[i + 1] === '>') {
+              if (depth <= 0) break;
+              i += 2;
+              continue;
+            }
+            if (c === '(' || c === '[' || c === '{' || c === '<') depth++;
+            else if (c === ')' || c === ']' || c === '}' || c === '>') depth--;
+            i++;
+          }
+          skipWs();
+        }
+        if (scan.startsWith('=>', i)) return true;
+        continue;
+      }
+      // `= [async] param => ...`, the single-parameter arrow with no parens.
+      const id = /^[A-Za-z_$][\w$]*/.exec(scan.slice(i));
+      if (id) {
+        i += id[0].length;
+        skipWs();
+        if (scan.startsWith('=>', i)) return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * Local names this file imports from a `.server.{js,ts}` module AND that the
+   * target really exports as a callable.
+   *
+   * The scan is LEXICAL, but the renderer binds only when the hole's value is a
+   * FUNCTION (`isBoundFormAction` in `form-action.js`), so `formaction=${'/api/'
+   * + id}` on a plain progressive-enhancement form, and equally a url CONSTANT
+   * exported from a `.server.ts` module, are ordinary url attributes that render
+   * and ship fine. Treating either as a binding reports a working form as
+   * broken.
+   *
+   * Only a plain named import is resolved. A namespace import
+   * (`import * as acts`), a default import, a barrel re-export, and any
+   * non-identifier expression (a member access, `this.act`) are all left
+   * UNKNOWABLE and therefore silent: they are real bindings the rule then
+   * misses, which is the safe direction and is listed with the rule's other
+   * silences.
+   *
+   * @param {string} content
+   * @param {string} abs
+   * @returns {Set<string>}
+   */
+  const serverImportedNames = (content, abs) => {
+    /** @type {Set<string>} */
+    const names = new Set();
+    const { redacted, literals } = redactToPlaceholders(content);
+    const reImport = /\bimport\s+([^'";]*?)\bfrom\s*(['"])/g;
+    let im;
+    while ((im = reImport.exec(redacted))) {
+      const tok = /__STR_(\d+)__/.exec(redacted.slice(reImport.lastIndex, reImport.lastIndex + 24));
+      if (!tok) continue;
+      const spec = literals[Number(tok[1])] || '';
+      if (!/\.server\.m?[jt]s$/.test(spec)) continue;
+      const target = resolveImport(spec, abs, appDir);
+      const targetFile = target ? byAbs.get(target) : null;
+      if (!targetFile) continue;   // unresolvable: unknowable, so silent
+      const targetScan = redactStringsAndTemplates(targetFile.content, true);
+      for (const { local, imported } of importedLocalNames(im[1])) {
+        if (exportsCallable(targetScan, imported)) names.add(local);
+      }
+    }
+    return names;
+  };
+
+  /** @type {{ rel: string, fileSites: ReturnType<typeof scanHtmlFormScopes>, ownerTag: string | null, bodySites: ReturnType<typeof scanHtmlFormScopes> | null }[]} */
+  const scanned = [];
+  for (const { abs, rel, content, scan } of files) {
+    if (!isAppTemplateFile(rel)) continue;
+    // Cheap bail: a file with neither a submitter binding nor a hyphenated tag
+    // can contribute neither a violation nor a call site.
+    if (!/formaction/i.test(content) && !/<[A-Za-z][A-Za-z0-9]*-/.test(content)) continue;
+    const fileSites = scanHtmlFormScopes(content);
+    if (!fileSites.submitters.length && !fileSites.tagUses.length) continue;
+    // Keep only the submitter holes that really bind an action. A `formaction`
+    // hole holding a url string is an ordinary attribute the renderer ships.
+    const bound = serverImportedNames(content, abs);
+    const isActionBinding = (site) => !!site.expr && /^[A-Za-z_$][\w$]*$/.test(site.expr) && bound.has(site.expr);
+    fileSites.submitters = fileSites.submitters.filter(isActionBinding);
+    // ATTRIBUTABLE: exactly one registered tag and exactly one WebComponent
+    // class, so a cannot-tell submitter in that class body belongs to that tag
+    // with no ambiguity. Anything else stays unknowable.
+    //
+    // The class body is located in the MASK and sliced out of the RAW source at
+    // the same offsets. The mask is position-preserving, and it is what every
+    // other `extractWebComponentClassBodies` caller passes, so the brace matcher
+    // is never asked to lex raw source (where an unlexed regex literal such as
+    // `static re = /[{]/` would truncate or lose the body, silently dropping
+    // this rule's cross-module half for that file). Slicing `content` then gives
+    // the body with its templates intact, which is what the scan needs.
+    const tags = new Set(extractComponents(content).map((c) => c.tag));
+    const bodies = extractWebComponentClassBodies(scan);
+    let ownerTag = null;
+    /** @type {ReturnType<typeof scanHtmlFormScopes> | null} */
+    let bodySites = null;
+    if (tags.size === 1 && bodies.length === 1) {
+      ownerTag = /** @type {string} */ ([...tags][0]);
+      bodySites = scanHtmlFormScopes(content.slice(bodies[0].bodyStart, bodies[0].bodyEnd));
+      bodySites.submitters = bodySites.submitters.filter(isActionBinding);
+    }
+    scanned.push({ rel, fileSites, ownerTag, bodySites });
+  }
+  if (!scanned.length) return;
+
+  // Every call site of every tag, as a scope. A 'none' site needs attribution
+  // before it means anything, so it is recorded with the component that renders
+  // it (or as unknowable when no single component owns it).
+  /** @type {Map<string, Array<{ scope: import('./js-scan.js').FormScope, delivers: boolean | null, via: string | null }>>} */
+  const callSites = new Map();
+  for (const { fileSites, ownerTag, bodySites } of scanned) {
+    // A 'none' use is attributed to this file's component ONLY when the
+    // class-body scan saw it too. One found only in the whole-file scan came
+    // from a bare `html` helper, which is rendered inside the CALLER's scan and
+    // inherits the caller's form scope, so it is unknowable.
+    //
+    // And only when this file opens NO form of its own, ANYWHERE. A fragment
+    // built into a local (`const rows = html`<todo-row>`;`) and spliced into a
+    // form the same file opens (`html`<form action=${save}>${rows}</form>``)
+    // inherits the SPLICE point's scope, not this component's call-site scope,
+    // and the two templates are separate scans so nothing here can tell them
+    // apart. That is the same reasoning the submitter half already applies to a
+    // bare helper.
+    //
+    // The test is the WHOLE-FILE scan, not the class body: a module-scope
+    // helper (`const shell = (inner) => html`<form action=${save}>${inner}</form>``)
+    // opens a form the class body never sees, and splicing into that is the same
+    // hole.
+    const attributable = ownerTag && bodySites && !fileSites.opensForm ? ownerTag : null;
+    /** @type {Map<string, number>} */
+    const bodyNoneByTag = new Map();
+    for (const u of attributable && bodySites ? bodySites.tagUses : []) {
+      if (u.scope !== 'none') continue;
+      bodyNoneByTag.set(u.tag, (bodyNoneByTag.get(u.tag) || 0) + 1);
+    }
+    for (const u of fileSites.tagUses) {
+      let via = null;
+      if (u.scope === 'none') {
+        const left = bodyNoneByTag.get(u.tag) || 0;
+        if (attributable && left > 0) {
+          bodyNoneByTag.set(u.tag, left - 1);
+          via = attributable;
+        }
+      }
+      const list = callSites.get(u.tag) || [];
+      list.push({ scope: u.scope, delivers: u.delivers, via });
+      callSites.set(u.tag, list);
+    }
+  }
+
+  /** @type {Map<string, 'undeliverable' | 'unknowable'>} */
+  const verdicts = new Map();
+  /** @type {Set<string>} */
+  const inProgress = new Set();
+  /**
+   * Does EVERY place this tag is rendered put it in a form that CANNOT deliver
+   * a submitter's action?
+   *
+   * The delivery question is what decides whether the shape is broken, and it is
+   * not the same as boundness. An unbound `<form method="post">` still carries a
+   * submitter's own `name`/`value` pair to the server, so the identity arrives
+   * and the action RUNS. What breaks is a form that sends nothing the server can
+   * read: no `method` (a GET, so the identity rides the query string), an
+   * explicit `method="get"`, or an enctype the server cannot parse. So a call
+   * site inside an unbound-but-delivering form is NOT a defect, and it makes the
+   * verdict unknowable like any other non-defect site.
+   *
+   * One delivering call site, one bound call site, one unknowable call site, a
+   * cycle, or no call site at all all answer `'unknowable'`, which is silent.
+   *
+   * The scope tests below are EXACT `'none'` on purpose. A `'handed'` site (a
+   * template sitting in a start-tag hole, so some other element received it and
+   * places it) must fall through to `'unknowable'`, and it does so only because
+   * nothing here treats it as a cannot-tell. Loosening these to a catch-all
+   * would resolve a handed-off template through this component's call sites,
+   * which is the wrong component's answer.
+   *
+   * @param {string} tag
+   * @returns {'undeliverable' | 'unknowable'}
+   */
+  function resolveTagScope(tag) {
+    const memo = verdicts.get(tag);
+    if (memo) return memo;
+    // A cycle teaches nothing about the host page, so it cannot be a verdict.
+    // Not memoized: the same tag may resolve conclusively on another path.
+    if (inProgress.has(tag)) return 'unknowable';
+    const sites = callSites.get(tag) || [];
+    if (!sites.length) {
+      // A tag no app template renders may still be rendered by markup this scan
+      // cannot see.
+      verdicts.set(tag, 'unknowable');
+      return 'unknowable';
+    }
+    inProgress.add(tag);
+    /** @type {'undeliverable' | 'unknowable'} */
+    let verdict = 'undeliverable';
+    for (const site of sites) {
+      if (site.scope === 'unbound' && site.delivers === false) continue;
+      if (site.scope === 'none' && site.via && resolveTagScope(site.via) === 'undeliverable') continue;
+      verdict = 'unknowable';
+      break;
+    }
+    inProgress.delete(tag);
+    verdicts.set(tag, verdict);
+    return verdict;
+  }
+
+  for (const { rel, fileSites, ownerTag, bodySites } of scanned) {
+    // The same-scan case: the form and the submitter are both in this template,
+    // so the answer needs no cross-module step. The renderer refuses this shape
+    // too, but only if that branch actually renders.
+    for (const s of fileSites.submitters) {
+      if (s.scope !== 'unbound') continue;
+      violations.push({
+        rule: 'submitter-needs-bound-form',
+        file: rel,
+        message: `Binds an action with \`formaction=\${…}\` on a <${s.tag}>, but the enclosing <form> in the SAME template carries no \`action=\${action}\` binding. Wherever the renderer sees both halves in one pass it refuses this shape outright, so the page throws at render rather than shipping it.`,
+        fix: FIX,
+      });
+    }
+    // The SAME `opensForm` guard the tag half uses, and for the same reason: a
+    // submitter fragment built into a local and spliced into a form this file
+    // opens is inside that form, not at the component's call site. The rule
+    // description states this condition, so the code has to hold it.
+    if (!ownerTag || !bodySites || fileSites.opensForm) continue;
+    const cannotTell = bodySites.submitters.filter((s) => s.scope === 'none');
+    if (!cannotTell.length) continue;
+    if (resolveTagScope(ownerTag) !== 'undeliverable') continue;
+    for (const s of cannotTell) {
+      violations.push({
+        rule: 'submitter-needs-bound-form',
+        file: rel,
+        message: `Binds an action with \`formaction=\${…}\` on a <${s.tag}>, but every place <${ownerTag}> is rendered puts it in a <form> that binds no action AND cannot carry the identity to the server (no \`method="post"\`, or an enctype the server cannot parse). Nothing throws: the submission goes out as a GET with the identity in the query string, the action never runs, and the page simply re-renders with a 200.`,
+        fix: FIX,
+      });
+    }
+  }
+}
+
 /**
  * BFS the module graph for the shortest import path from `from` to `to`,
  * returning every hop `[from, ..., to]` so the `no-server-import-in-browser-module`
diff --git a/packages/server/src/js-scan.js b/packages/server/src/js-scan.js
index d307f5771..7236c904f 100644
--- a/packages/server/src/js-scan.js
+++ b/packages/server/src/js-scan.js
@@ -470,7 +470,13 @@ export function extractWebComponentClassBodies(content) {
         bodies.push({
           body: content.slice(bodyStart, end),
           factoryProps,
-          factoryArg
+          factoryArg,
+          // Offsets into `content`. Callers pass the position-preserving MASK,
+          // so these index the RAW source identically, which is how a caller
+          // that needs the body's real template text gets it without asking
+          // this lexer to handle raw source (#1307).
+          bodyStart,
+          bodyEnd: end,
         });
       }
     }
@@ -640,7 +646,7 @@ export function matchClosingParenthesis(s, start) {
  * (the closing `}` arrived while still in template state), so depth could
  * never return to zero and a class body holding `` html`…${x}…` `` was
  * unmatchable. Every caller passes a masked source in which holes are already
- * blanked, so the bug is invisible until one passes raw source.
+ * blanked, so the bug is invisible until one passes raw source (#1307).
  *
  * @param {string} s
  * @param {number} start
@@ -717,3 +723,422 @@ export function redactToPlaceholders(src) {
   return { redacted: out, literals };
 }
 
+/**
+ * The attribute position a template hole commits to, read from the literal
+ * segment immediately before it. Returns the attribute NAME only; a caller
+ * pairs it with the tag the hole sits in.
+ *
+ * @param {string} literalBefore
+ * @returns {'action' | 'formaction' | null}
+ */
+function trailingActionAttr(literalBefore) {
+  if (/\sformaction=$/i.test(literalBefore)) return 'formaction';
+  if (/\saction=$/i.test(literalBefore)) return 'action';
+  return null;
+}
+
+/**
+ * Classify a template hole by the start tag and attribute it commits: `'form'`
+ * for `<form action=` (#1155), `'submitter'` for `<button|input formaction=`
+ * (#1207), and `null` for anything else.
+ *
+ * Reading the segment immediately before the hole rather than the whole
+ * template is what keeps `<div action=${x}>` out. The tag and the attribute are
+ * matched as a PAIR, so `<form formaction=${x}>` and `<button action=${x}>`
+ * stay out too: both are refused at render time, and neither is a binding.
+ *
+ * @param {string} literalBefore the literal segment immediately before the hole
+ * @returns {'form' | 'submitter' | null}
+ */
+export function classifyActionHole(literalBefore) {
+  const attr = trailingActionAttr(literalBefore);
+  if (!attr) return null;
+  // The last `<` opens the tag the hole sits in. Requiring no `>` after it
+  // keeps the match inside that one start tag.
+  const tagAt = literalBefore.lastIndexOf('<');
+  if (tagAt < 0) return null;
+  const tag = literalBefore.slice(tagAt);
+  if (tag.includes('>')) return null;
+  if (attr === 'action' && /^<form\b/i.test(tag)) return 'form';
+  if (attr === 'formaction' && /^<(?:button|input)\b/i.test(tag)) return 'submitter';
+  return null;
+}
+
+/**
+ * The ONE `enctype` keyword that loses a form body the server could otherwise
+ * read.
+ *
+ * Stated as a denylist rather than an allowlist because `enctype` is an
+ * enumerated attribute whose missing value default AND invalid value default are
+ * both `application/x-www-form-urlencoded`. So `enctype="nonsense"` falls back to
+ * urlencoded and submits a perfectly parseable body; only the third valid
+ * keyword, `text/plain`, is a real loss. An allowlist inverts that and reports a
+ * working form as broken, which this rule must never do.
+ *
+ * The renderer's `PARSEABLE_ENCTYPES` (`form-action.js`) refuses the wider set,
+ * and that divergence is deliberate on BOTH sides rather than an inconsistency
+ * to unify. The two ask different questions. This rule asks whether the
+ * identity ARRIVES, and under an invalid enctype it does. The renderer asks
+ * whether the form will do what the author wrote, and there an invalid value is
+ * the dangerous case: `enctype="multipart/form-dat"` falls back to urlencoded,
+ * which silently drops every FILE from the submission, so throwing at render is
+ * the only way the author finds out. Unifying them would either make the
+ * renderer accept a typo that loses uploads, or make this rule report a working
+ * form as broken.
+ */
+const UNPARSEABLE_FORM_ENCTYPE = 'text/plain';
+
+/**
+ * Read one attribute's literal value out of a start tag's accumulated text.
+ * Returns null when absent, and the raw value otherwise (quoted or bare).
+ *
+ * @param {string} tagText
+ * @param {string} name
+ * @returns {string | null}
+ */
+function startTagAttr(tagText, name) {
+  const re = new RegExp(`\\s${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, 'i');
+  const m = re.exec(tagText);
+  if (!m) return null;
+  return m[1] ?? m[2] ?? m[3] ?? '';
+}
+
+/**
+ * Would an UNBOUND `<form>` still deliver a submitter's action identity?
+ *
+ * This is the difference between a broken write path and a working one, and it
+ * is not intuitive. A submitter carries its identity in its OWN `name`/`value`
+ * pair, which a browser submits for the pressed button alone, so an unbound
+ * form that still sends a parseable POST body delivers it and the action RUNS
+ * (the dispatcher takes the last `__webjs_action` entry it finds). What breaks
+ * is a form that sends no body the server can read: no `method` at all or
+ * `method="get"` (a GET puts the identity in the query string and the page just
+ * re-renders), or an enctype `parseFormBody` cannot parse (a 405).
+ *
+ * Both are enumerated attributes matched against exact keywords with no
+ * whitespace stripping, and their defaults pull in OPPOSITE directions, which is
+ * why they are tested differently. `method` defaults to GET, so anything that is
+ * not exactly `post` loses the body (a padded `method=" post "` included).
+ * `enctype` defaults to `application/x-www-form-urlencoded` for both a missing
+ * AND an invalid value, so only the `text/plain` keyword actually loses it.
+ *
+ * @param {string} tagText the form's start tag, from `<form` to just before `>`
+ * @returns {boolean}
+ */
+function unboundFormDelivers(tagText) {
+  const method = startTagAttr(tagText, 'method');
+  if (method === null || method.toLowerCase() !== 'post') return false;
+  const enctype = startTagAttr(tagText, 'enctype');
+  if (enctype !== null && enctype.toLowerCase() === UNPARSEABLE_FORM_ENCTYPE) return false;
+  return true;
+}
+
+/**
+ * The ONE start-tag hole the renderer renders INLINE, in the enclosing scan and
+ * with the enclosing form scope, rather than handing to the receiving element:
+ * `<webjs-suspense .fallback=${html`…`}>` (#471).
+ *
+ * A custom-element property applies only at HYDRATION, which is too late for a
+ * placeholder that has to be in the first flushed bytes, so `render-server.js`
+ * renders the fallback right there and carries the HTML as
+ * `data-webjs-fallback`. (The timing is the operative reason on its own. A
+ * serializable `TemplateResult` would otherwise ride as `data-webjs-prop-*`
+ * perfectly well; only one carrying a function fails to serialize.) That means a submitter in a fallback IS judged against
+ * the enclosing form, and the renderer really does throw for an unbound one.
+ * Treating it as handed off would make the same-scan half blind to the one shape
+ * it exists to pre-warn about.
+ *
+ * @param {string} tagName lowercased
+ * @param {string} literalBefore the literal segment immediately before the hole
+ * @returns {boolean}
+ */
+function isInlineStartTagHole(tagName, literalBefore) {
+  // The property name is a JS identifier, so it is case-SENSITIVE, unlike an
+  // attribute name.
+  return tagName === 'webjs-suspense' && /\.fallback=$/.test(literalBefore);
+}
+
+/**
+ * @typedef {'none'|'unbound'|'bound'|'handed'} FormScope
+ *
+ * `'none'` and `'handed'` are BOTH "no enclosing form in this scan", and they
+ * are deliberately separate values because a caller must treat them
+ * differently. `'none'` is a cannot-tell that the file's own component may
+ * legitimately own, so a caller may attribute it and resolve it against that
+ * component's call sites. `'handed'` is a template sitting in a start-tag hole,
+ * which is an attribute or property VALUE: some OTHER element received it and
+ * decides where it renders, so this file's call sites say nothing about it and
+ * it can never be attributed to anything. Collapsing the two makes a handed-off
+ * template resolve through the wrong component's call sites.
+ *
+ * @typedef {{
+ *   tag: string,
+ *   scope: FormScope,
+ *   delivers: boolean | null,
+ *   expr: string | null,
+ * }} FormScopeSite
+ *
+ * `expr` is the submitter hole's expression text, verbatim from the redacted
+ * source, and null for a tag use. A caller MUST look at it before treating the
+ * hole as an action binding: this scan is lexical, while the renderer binds only
+ * when the value is a FUNCTION (`isBoundFormAction`), so
+ * `formaction=${'/api/' + id}` is an ordinary url attribute that ships fine.
+ *
+ * `delivers` is meaningful only when `scope` is `'unbound'`: true when that
+ * form would still carry a submitter's identity to the server, false when it
+ * would not, and null when a hole in its start tag makes the answer dynamic and
+ * therefore unknowable.
+ */
+
+/**
+ * Walk every `` html`...` `` template literal in `src` and report, for each
+ * submitter action hole (`<button|input formaction=${...}>`) and each
+ * custom-element start tag, the enclosing `<form>` scope at that point (#1307).
+ *
+ * Only an `html`-tagged literal is entered, so `const s = '<form>'` and a `css`
+ * or `sql` template are never read as markup. That carve-out matters: the
+ * framework's own website renders `<form action=${fn}>` as a code SAMPLE.
+ *
+ * A template nested inside a CHILD-position hole INHERITS the enclosing scope,
+ * because that is what the renderer does (`render` threads `formScope` through
+ * arrays, `repeat`, and nested templates).
+ *
+ * One in a START-TAG hole is `'handed'`: an attribute or property value whose
+ * placement this scan cannot speak for. Worth being exact about why, because the
+ * obvious reason is not the operative one. SSR does NOT render such a template
+ * in place: a serializable value rides to the receiving element as
+ * `data-webjs-prop-*` and is applied at HYDRATION, and one carrying a function
+ * (a bound submitter, by definition) fails to serialize, so `render-server.js`
+ * DROPS the binding with a warning and emits nothing for it at all. Either way
+ * the element that receives the property decides where the content lands, in the
+ * browser, which is exactly what this scan cannot see.
+ *
+ * The single exception is `<webjs-suspense .fallback=${…}>`, which the renderer
+ * really does render inline with the enclosing scope (see
+ * `isInlineStartTagHole`), so that one inherits.
+ *
+ * A separate top-level template starts fresh at
+ * `'none'`, because it is its own scan there too. `</form>` returns to the scope
+ * the scan started in, mirroring `handleTagEnd` in `render-server.js`.
+ *
+ * `opensForm` reports whether ANY `<form` start tag was seen anywhere in `src`.
+ * A caller attributing a scope-`'none'` site to this file needs it: a fragment
+ * built into a local and spliced into a form the same file opens inherits the
+ * SPLICE point's scope, not the file's own call-site scope, so a file that
+ * opens a form cannot have its `'none'` sites attributed safely.
+ *
+ * @param {string} src
+ * @returns {{ submitters: FormScopeSite[], tagUses: FormScopeSite[], opensForm: boolean }}
+ */
+export function scanHtmlFormScopes(src) {
+  const { redacted, literals } = redactToPlaceholders(src);
+  /** @type {FormScopeSite[]} */
+  const submitters = [];
+  /** @type {FormScopeSite[]} */
+  const tagUses = [];
+  let opensForm = false;
+  const n = redacted.length;
+  // Sticky, so matching a literal placeholder at the cursor costs no slice.
+  const STR = /__STR_(\d+)__/y;
+
+  /**
+   * Walk code. In placeholder mode a comment body and a regex body are already
+   * blanked to spaces and a string body is one opaque token, so the only
+   * structure left to track is braces, quote delimiters, and backticks.
+   *
+   * @param {number} i
+   * @param {boolean} stopAtBrace return at the `}` closing the enclosing hole
+   * @param {FormScope} scope inherited by any template found here
+   * @param {boolean | null} delivers inherited alongside `scope`
+   * @returns {number}
+   */
+  function walkCode(i, stopAtBrace, scope, delivers) {
+    let brace = 0;
+    while (i < n) {
+      const c = redacted[i];
+      if (stopAtBrace && c === '}' && brace === 0) return i;
+      if (c === '{') { brace++; i++; continue; }
+      if (c === '}') { brace--; i++; continue; }
+      if (c === "'" || c === '"') {
+        i++;
+        while (i < n && redacted[i] !== c && redacted[i] !== '\n') i++;
+        if (i < n) i++;
+        continue;
+      }
+      if (c === '`') {
+        const before = redacted.slice(Math.max(0, i - 32), i);
+        const tagged = /([A-Za-z_$][\w$]*)\s*$/.exec(before);
+        i = walkTemplate(i + 1, !!tagged && tagged[1] === 'html', scope, delivers);
+        continue;
+      }
+      i++;
+    }
+    return i;
+  }
+
+  /**
+   * Walk one template literal from just after its opening backtick.
+   *
+   * @param {number} i
+   * @param {boolean} isHtml whether its markup should be read
+   * @param {FormScope} startScope
+   * @param {boolean | null} startDelivers
+   * @returns {number} the index just past the closing backtick
+   */
+  function walkTemplate(i, isHtml, startScope, startDelivers) {
+    /** @type {FormScope} */
+    let scope = startScope;
+    /** @type {boolean | null} */
+    let delivers = startDelivers;
+    /**
+     * The start tag currently open. It persists across literal segments AND
+     * across holes, because `<form action=${fn} class="x">` is one tag split
+     * into three pieces by the scan. `text` accumulates the tag's literal
+     * source so its attributes can be read at the `>`, and `dynamicAttrs`
+     * records that a hole other than the action binding landed in it, which
+     * makes those attributes unknowable.
+     * @type {null | { name: string, isClose: boolean, quote: string | null, formHole: boolean, submitterHole: boolean, submitterExpr: string | null, text: string, dynamicAttrs: boolean }}
+     */
+    let tag = null;
+    let inComment = false;
+    let lastLiteral = '';
+
+    const closeTag = () => {
+      const t = tag;
+      tag = null;
+      if (!t) return;
+      if (t.isClose) {
+        // Back to the scope this scan STARTED in, not a flat 'none': a nested
+        // template closing a form of its own learns nothing about the form its
+        // caller may have opened.
+        if (t.name === 'form') { scope = startScope; delivers = startDelivers; }
+        return;
+      }
+      if (t.name === 'form') {
+        opensForm = true;
+        // A form that opened and bound NOTHING still opens a scope: a submitter
+        // inside it is a different answer from one with no form at all. Whether
+        // that unbound form would still DELIVER a submitter's identity is a
+        // separate question, and the one that decides if the shape is broken.
+        scope = t.formHole ? 'bound' : 'unbound';
+        delivers = t.formHole ? null : (t.dynamicAttrs ? null : unboundFormDelivers(t.text));
+        return;
+      }
+      if (t.submitterHole) submitters.push({ tag: t.name, scope, delivers, expr: t.submitterExpr || null });
+      if (t.name.includes('-')) tagUses.push({ tag: t.name, scope, delivers, expr: null });
+    };
+
+    /** @param {string} text one literal segment, read as markup */
+    const consumeMarkup = (text) => {
+      let p = 0;
+      while (p < text.length) {
+        if (inComment) {
+          const end = text.indexOf('-->', p);
+          if (end < 0) return;
+          inComment = false;
+          p = end + 3;
+          continue;
+        }
+        if (tag) {
+          const ch = text[p];
+          if (tag.quote) {
+            if (ch === tag.quote) tag.quote = null;
+            tag.text += ch;
+            p++;
+            continue;
+          }
+          if (ch === '"' || ch === "'") { tag.quote = ch; tag.text += ch; p++; continue; }
+          if (ch === '>') { p++; closeTag(); continue; }
+          tag.text += ch;
+          p++;
+          continue;
+        }
+        const lt = text.indexOf('<', p);
+        if (lt < 0) return;
+        if (text.startsWith('<!--', lt)) { inComment = true; p = lt + 4; continue; }
+        const m = /^<(\/?)([A-Za-z][A-Za-z0-9-]*)/.exec(text.slice(lt));
+        if (!m) { p = lt + 1; continue; }
+        tag = {
+          name: m[2].toLowerCase(),
+          isClose: m[1] === '/',
+          quote: null,
+          formHole: false,
+          submitterHole: false,
+          submitterExpr: null,
+          text: m[0],
+          dynamicAttrs: false,
+        };
+        p = lt + m[0].length;
+      }
+    };
+
+    while (i < n) {
+      const c = redacted[i];
+      if (c === '`') return i + 1;
+      if (c === '$' && redacted[i + 1] === '{') {
+        let capturingSubmitter = false;
+        if (isHtml && tag && !tag.isClose) {
+          const attr = trailingActionAttr(lastLiteral);
+          if (attr === 'action' && tag.name === 'form') tag.formHole = true;
+          else if (attr === 'formaction' && (tag.name === 'button' || tag.name === 'input')) {
+            tag.submitterHole = true;
+            capturingSubmitter = true;
+          }
+          // Any OTHER hole in a form's start tag makes its `method` / `enctype`
+          // dynamic, so whether an unbound form would deliver becomes unknowable.
+          else if (tag.name === 'form') tag.dynamicAttrs = true;
+        }
+        // A hole inside a START TAG is USUALLY an attribute or property VALUE
+        // whose placement this scan cannot speak for, so it starts at 'handed'
+        // instead of inheriting. A hole in CHILD position is rendered inline by
+        // this scan and does inherit, and so does the one start-tag hole the
+        // renderer also renders inline (`isInlineStartTagHole`).
+        //
+        // Read the JSDoc on `scanHtmlFormScopes` for why 'handed' is right: SSR
+        // does NOT render such a template in place, so the receiving element
+        // decides where it lands, in the browser.
+        //
+        // Without the split, `<form method="post"><my-thing .tpl=${html`<button
+        // formaction=${del}>x</button>`}></my-thing></form>` scored the button
+        // 'unbound' from lexical nesting. Nothing renders that button at SSR at
+        // all (the binding carries a function, so it fails to serialize and is
+        // dropped), and where it ends up is `my-thing`'s decision at hydration,
+        // so a conclusive verdict here was never this scan's to give.
+        //
+        // 'handed' and NOT 'none', which is the subtle half: 'none' is the
+        // cannot-tell a caller attributes to this file's own component and
+        // resolves against ITS call sites, and a handed-off template belongs to
+        // whichever element received it instead. Using 'none' here silences the
+        // false positive on a page and recreates it in a component file.
+        const inlineHole = tag && !tag.isClose && isInlineStartTagHole(tag.name, lastLiteral);
+        const handOff = tag && !tag.isClose && !inlineHole;
+        const holeScope = handOff ? 'handed' : scope;
+        const holeDelivers = handOff ? null : delivers;
+        // Only the segment IMMEDIATELY before a hole can commit an attribute,
+        // so two adjacent holes leave nothing for the second to read.
+        lastLiteral = '';
+        const holeStart = i + 2;
+        i = walkCode(i + 2, true, holeScope, holeDelivers);
+        // The hole's expression, so a caller can require a real action binding.
+        if (capturingSubmitter && tag) tag.submitterExpr = redacted.slice(holeStart, i).trim();
+        if (i < n && redacted[i] === '}') i++;
+        continue;
+      }
+      STR.lastIndex = i;
+      const m = STR.exec(redacted);
+      if (m) {
+        const text = literals[Number(m[1])] || '';
+        lastLiteral = text;
+        if (isHtml) consumeMarkup(text);
+        i = STR.lastIndex;
+        continue;
+      }
+      i++;
+    }
+    return i;
+  }
+
+  walkCode(0, false, 'none', null);
+  return { submitters, tagUses, opensForm };
+}
+
diff --git a/packages/server/test/check/submitter-needs-bound-form.test.js b/packages/server/test/check/submitter-needs-bound-form.test.js
new file mode 100644
index 000000000..7b27bd165
--- /dev/null
+++ b/packages/server/test/check/submitter-needs-bound-form.test.js
@@ -0,0 +1,716 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+import { checkConventions, RULES } from '../../src/check.js';
+
+/**
+ * Tests for `submitter-needs-bound-form` (#1307): a `<button formaction=${fn}>`
+ * whose enclosing `<form>` binds nothing posts nowhere. The form defaults to
+ * GET, the reserved identity field rides the query string, and the page simply
+ * re-renders with the action never having run.
+ *
+ * Neither renderer can catch the cross-module version of this: SSR reads one
+ * template at a time and a component renders its own template in a separate
+ * pass with no view of the host page, so it is a cannot-tell there and
+ * cannot-tell has to bind. This rule reads every template in the app at once.
+ *
+ * The NON-firing cases matter more than the firing ones. The rule is
+ * deliberately conservative: anything it cannot resolve conclusively stays
+ * silent, because a false positive on an ordinary shape (a per-row button, a
+ * button inside a component) would be worse than the bug it catches.
+ */
+const RULE = 'submitter-needs-bound-form';
+
+/**
+ * The action modules the fixtures import. Real files, because the rule resolves
+ * the binding to its target and requires a provably callable export: a hole
+ * naming a url CONSTANT is not a binding, so an unresolvable or non-callable
+ * import is correctly silent and a fixture without these would prove nothing.
+ */
+const ACTIONS = {
+  // The `#` root alias is Node's `package.json` "imports" field, so the rule
+  // cannot resolve a `#modules/...` specifier without it. A scaffolded app
+  // always ships this catch-all.
+  'package.json': JSON.stringify({ name: 'fixture', imports: { '#*': './*' } }),
+  'modules/feedback/actions/publish.server.ts': `'use server';
+export async function publishDraft(formData) { return { success: true, got: formData }; }
+`,
+  'modules/feedback/actions/save.server.ts': `'use server';
+export async function saveAll(formData) { return { success: true, got: formData }; }
+`,
+};
+
+async function makeApp(files) {
+  const dir = await mkdtemp(join(tmpdir(), 'webjs-submitter-bound-'));
+  for (const [rel, contents] of Object.entries({ ...ACTIONS, ...files })) {
+    const abs = join(dir, rel);
+    await mkdir(abs.slice(0, abs.lastIndexOf('/')), { recursive: true });
+    await writeFile(abs, contents);
+  }
+  return dir;
+}
+const hits = (v) => v.filter((x) => x.rule === RULE);
+
+/** A one-tag, one-class component file holding the bound submitter. */
+const rowBtn = (extra = '') => `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+class RowBtn extends WebComponent({}) {
+  render() {
+    return html\`<button formaction=\${publishDraft}>Publish</button>\`;
+  }
+}
+RowBtn.register('row-btn');
+${extra}`;
+
+const TODO_LIST = `import { html, WebComponent } from '@webjsdev/core';
+class TodoList extends WebComponent({}) {
+  render() { return html\`<ul><todo-row></todo-row></ul>\`; }
+}
+TodoList.register('todo-list');
+`;
+const TODO_ROW = `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+class TodoRow extends WebComponent({}) {
+  render() { return html\`<li><button formaction=\${publishDraft}>Publish</button></li>\`; }
+}
+TodoRow.register('todo-row');
+`;
+
+test('the rule is registered', () => {
+  assert.ok(RULES.some((r) => r.name === RULE), 'RULES lists submitter-needs-bound-form');
+});
+
+test('flags a component submitter whose only call site is an unbound form', async () => {
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import '#components/row-btn.ts';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  const v = hits(await checkConventions(dir));
+  assert.equal(v.length, 1, 'exactly one violation');
+  assert.match(v[0].file, /row-btn\.ts/);
+  assert.match(v[0].message, /<row-btn> is rendered/);
+  assert.match(v[0].fix, /<form action=/);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the call site binds the form', async () => {
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import { saveAll } from '#modules/feedback/actions/save.server.ts';
+export default () => html\`<form action=\${saveAll}><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when one call site is bound and another is not', async () => {
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/a/page.ts': `import { html } from '@webjsdev/core';
+import { saveAll } from '#modules/feedback/actions/save.server.ts';
+export default () => html\`<form action=\${saveAll}><row-btn></row-btn></form>\`;
+`,
+    'app/b/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a mixed tag is indefinite');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the unbound host form still DELIVERS the identity (method=post)', async () => {
+  // The distinction the rule turns on, and the one that is easy to get wrong.
+  // An unbound `<form method="post">` WORKS across a module boundary: the
+  // cannot-tell fallback binds the submitter, the submitter's own name/value
+  // pair carries `__webjs_action` into the POST body, and the dispatcher takes
+  // the last entry it finds. Flagging it would be a false positive on working
+  // code, with a diagnosis (a GET, a query string) that never happens.
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form method="post"><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'an unbound POST form delivers, so nothing is broken');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('fires when the unbound host form cannot deliver (method=get, or a bad enctype)', async () => {
+  // The other side of the same coin: these really do lose the identity.
+  for (const form of ['<form method="get">', '<form method="post" enctype="text/plain">', '<form method=" post ">']) {
+    const dir = await makeApp({
+      'components/row-btn.ts': rowBtn(),
+      'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`${form}<row-btn></row-btn></form>\`;
+`,
+    });
+    const v = hits(await checkConventions(dir));
+    assert.equal(v.length, 1, `${form} cannot carry the identity`);
+    assert.match(v[0].message, /cannot carry the identity to the server/);
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('silent when the host form method is a dynamic hole', async () => {
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default ({ m }) => html\`<form method=\${m}><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a dynamic method is unknowable');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the component could splice a fragment into a form it opens itself', async () => {
+  // A fragment built into a local and spliced into a form the SAME file opens
+  // inherits the splice point's scope, not this component's call-site scope,
+  // and the two templates are separate scans. Same reasoning the submitter half
+  // already applies to a bare helper.
+  const dir = await makeApp({
+    'components/todo-list.ts': `import { html, WebComponent } from '@webjsdev/core';
+class TodoList extends WebComponent({}) {
+  render() {
+    const rows = html\`<todo-row></todo-row>\`;
+    return html\`<form action=\${save}>\${rows}</form>\`;
+  }
+}
+TodoList.register('todo-list');
+`,
+    'components/todo-row.ts': TODO_ROW,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><todo-list></todo-list></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a file that opens its own form cannot attribute a none-scope use');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('a regex literal in a component file does not silently disable the rule', async () => {
+  // The class body is located in the MASK and sliced out of the raw source at
+  // the same offsets, so the brace matcher never lexes raw source. Feeding it
+  // raw source made `static re = /[{]/` yield zero class bodies, which dropped
+  // the cross-module half for that file with no signal at all.
+  const dir = await makeApp({
+    'components/row-btn.ts': `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+class RowBtn extends WebComponent({}) {
+  static re = /[{]/;
+  render() { return html\`<button formaction=\${publishDraft}>Publish</button>\`; }
+}
+RowBtn.register('row-btn');
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  const v = hits(await checkConventions(dir));
+  assert.equal(v.length, 1, 'the rule still sees the class body');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when a module-scope helper in the component file opens a form', async () => {
+  // The guard is the WHOLE-FILE scan, not the class body: a helper outside the
+  // class can open a form the body never sees, and splicing into that is the
+  // same hole the class-body case has.
+  const dir = await makeApp({
+    'components/row-btn.ts': `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+const shell = (inner) => html\`<form action=\${save}>\${inner}</form>\`;
+class RowBtn extends WebComponent({}) {
+  render() { return shell(html\`<button formaction=\${publishDraft}>Publish</button>\`); }
+}
+RowBtn.register('row-btn');
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'the submitter may be spliced into the helper form');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent on an unrecognised enctype, which falls back to a parseable body', async () => {
+  // `enctype` defaults to application/x-www-form-urlencoded for a missing AND an
+  // invalid value, so this form really does deliver.
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form method="post" enctype="nonsense"><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the submitter template is passed as a component PROPERTY', async () => {
+  // Lexically inside the form, but the scan cannot say where it lands. SSR
+  // renders nothing for it at all: the binding carries a function, so it fails
+  // to serialize and is dropped with a warning, and <my-thing> decides where the
+  // button goes at hydration. A conclusive verdict here was never this scan's
+  // to give.
+  const dir = await makeApp({
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form method="post"><my-thing .tpl=\${html\`<button formaction=\${publishDraft}>P</button>\`}></my-thing></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when a COMPONENT hands its submitter template to another element', async () => {
+  // The variant that matters most, and the one a page-only test misses. Marking
+  // the handed-off template 'none' silences it on a page and recreates the false
+  // positive here, because 'none' is exactly the value the cross-module half
+  // attributes to this file's own tag and resolves against ITS call sites.
+  // <my-thing> is what decides where the button lands.
+  const dir = await makeApp({
+    'components/row-btn.ts': `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+class RowBtn extends WebComponent({}) {
+  render() { return html\`<my-thing .tpl=\${html\`<button formaction=\${publishDraft}>P</button>\`}></my-thing>\`; }
+}
+RowBtn.register('row-btn');
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'the receiving element places the button');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when a component hands a TAG to another element', async () => {
+  // The same root cause on the tag half: <my-shell> places the row, so
+  // <todo-list>'s call sites say nothing about where <todo-row> renders.
+  const dir = await makeApp({
+    'components/todo-list.ts': `import { html, WebComponent } from '@webjsdev/core';
+class TodoList extends WebComponent({}) {
+  render() { return html\`<my-shell .rows=\${html\`<todo-row></todo-row>\`}></my-shell>\`; }
+}
+TodoList.register('todo-list');
+`,
+    'components/todo-row.ts': TODO_ROW,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><todo-list></todo-list></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a handed-off tag has no attributable call site');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('a tag inside a suspense FALLBACK is a real call site, unlike an ordinary prop', async () => {
+  // The suspense carve-out changes the tag half too, and that half can create
+  // violations rather than only silence them, so it needs its own coverage. The
+  // fallback is rendered inline inside the enclosing form, so <todo-row> really
+  // does land there and the verdict is truthful.
+  const page = (host) => `import { html } from '@webjsdev/core';
+export default () => html\`<form>${host}</form>\`;
+`;
+  const fallback = await makeApp({
+    'components/todo-row.ts': TODO_ROW,
+    'app/page.ts': page('<webjs-suspense .fallback=\${html\`<todo-row></todo-row>\`}></webjs-suspense>'),
+  });
+  assert.equal(hits(await checkConventions(fallback)).length, 1, 'the fallback renders inline, so it is a call site');
+  await rm(fallback, { recursive: true, force: true });
+
+  // The same shape through an ordinary property is handed off and stays silent.
+  const handed = await makeApp({
+    'components/todo-row.ts': TODO_ROW,
+    'app/page.ts': page('<my-shell .rows=\${html\`<todo-row></todo-row>\`}></my-shell>'),
+  });
+  assert.deepEqual(hits(await checkConventions(handed)), [], 'my-shell decides where the row lands');
+  await rm(handed, { recursive: true, force: true });
+});
+
+test('silent on a formaction hole that is a URL, not an action', async () => {
+  // The scan is lexical; the RENDERER binds only when the hole's value is a
+  // FUNCTION (`isBoundFormAction`). So an ordinary progressive-enhancement form
+  // whose buttons post to different `route.ts` endpoints is not a binding at
+  // all, and reporting it was a false positive on working code.
+  for (const hole of ["\\${'/api/items/' + id + '/archive'}", "\\${'/api/x'}", '\\${localUrl}']) {
+    const dir = await makeApp({
+      'app/items/page.ts': `import { html } from '@webjsdev/core';
+const localUrl = '/api/x';
+export default ({ id }) => html\`<form method="post" action="/api/items"><button formaction=${hole}>Archive</button></form>\`;
+`,
+    });
+    assert.deepEqual(hits(await checkConventions(dir)), [], `${hole} is a url, not an action`);
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('the callable matrix: every url shape silent, every function shape flagged', async () => {
+  // The whole table in one place, because two review rounds found defects here
+  // and both were a single spelling. The rule fires only on a PROVABLY callable
+  // export: an earlier version accepted a bare `(` after the `=`, which proves a
+  // parenthesized EXPRESSION, so the ordinary env-fallback url constant read as
+  // an action. A single-parameter arrow was the mirror error, silently dropping
+  // a real binding.
+  const cases = [
+    // [export source, should the rule fire]
+    ["export const publishDraft = '/api/x';", false],
+    ["export const publishDraft = ('/api/x');", false],
+    ["export const publishDraft = (process.env.X || '/api/x');", false],
+    ["export const publishDraft = (process.env.X ? '/a' : '/b');", false],
+    ['export const publishDraft = cache(async () => 1);', false],
+    ["const publishDraft = '/api/x';\nexport { publishDraft };", false],
+    ['export async function publishDraft(fd) { return 1; }', true],
+    ['export function publishDraft(fd) { return 1; }', true],
+    ['export const publishDraft = async (fd) => 1;', true],
+    ['export const publishDraft = async fd => 1;', true],
+    ['export const publishDraft = () => 1;', true],
+    ['export const publishDraft = async function (fd) { return 1; };', true],
+    ['async function publishDraft(fd) { return 1; }\nexport { publishDraft };', true],
+    // A TS annotation can contain its own `=>`, and this is the spelling the
+    // derive-the-type rule pushes authors toward. Skipping the annotation with a
+    // lazy regex stopped at the arrow's `=` and silently dropped the binding.
+    ['export const publishDraft: (fd: FormData) => Promise<number> = async (fd) => 1;', true],
+    ['export const publishDraft: (fd: FormData) => Promise<number> = async function (fd) { return 1; };', true],
+    ['export const publishDraft: ActionFn = async (fd) => 1;', true],
+    // A RETURN-type annotation on the arrow, which is at least as common as the
+    // declaration-side one and was silent until it had its own rows.
+    ['export const publishDraft = async (fd: FormData): Promise<number> => 1;', true],
+    ['export const publishDraft = async (fd): Promise<number> => 1;', true],
+    ['export const publishDraft = (fd: FormData): number => 1;', true],
+    ['export const publishDraft = async (fd: FormData): Promise<ActionResult<Draft>> => 1;', true],
+    // ...and the annotated NON-callable must still be silent.
+    ["export const publishDraft: string = (process.env.X || '/api/x');", false],
+    ["export const publishDraft: string = '/api/x';", false],
+    // An inline object type carries TypeScript's canonical `;` member
+    // separator INSIDE the annotation's brackets, and a generic can close
+    // immediately before the `=`. Both were read as end-of-declaration.
+    ['export const publishDraft: ActionFn<{ id: string; title: string }> = async (input) => 1;', true],
+    ['export const publishDraft: { (fd: FormData): Promise<number>; } = async (fd) => 1;', true],
+    ['export const publishDraft: Promise<void>= async () => 1;', true],
+    ["export const publishDraft: { a: string; b: string }['a'] = '/api/x';", false],
+  ];
+  for (const [body, shouldFire] of cases) {
+    const dir = await makeApp({
+      'modules/feedback/actions/publish.server.ts': `'use server';\n${body}\n`,
+      'app/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form method="get"><button formaction=\${publishDraft}>P</button></form>\`;
+`,
+    });
+    assert.equal(hits(await checkConventions(dir)).length, shouldFire ? 1 : 0,
+      `${shouldFire ? 'should fire' : 'should be silent'}: ${body.split('\n')[0]}`);
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('a re-export clause is unknowable, even beside a same-named local function', async () => {
+  // The guard has to reject on the text AFTER the clause: a `\\s*(?!from)`
+  // lookahead can never reject, because `\\s*` backtracks to zero width and the
+  // lookahead then reads the whitespace. Without it, a module that re-exports a
+  // name AND declares a same-named local is read as exporting that local, which
+  // contradicts the barrel-re-export silence the docs promise.
+  const dir = await makeApp({
+    'modules/feedback/actions/other.server.ts': `'use server';
+export async function publishDraft() { return 1; }
+`,
+    'modules/feedback/actions/publish.server.ts': `'use server';
+function publishDraft() { return 1; }
+export { publishDraft } from './other.server.ts';
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form method="get"><button formaction=\${publishDraft}>P</button></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a re-export needs another hop, so it stays silent');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('the binding resolver across a broad sweep of TypeScript spellings', async () => {
+  // Five review rounds each found one more spelling this resolver got wrong, so
+  // this sweeps the space instead of waiting to be told the next one. Every row
+  // is a way a real app might export an action, or a url constant.
+  const cases = [
+    // Callables that must FIRE.
+    ['export async function publishDraft(fd) {}', true],
+    ['export function publishDraft(fd) {}', true],
+    ['export async function publishDraft<T>(fd: T): Promise<void> {}', true],
+    ['export const publishDraft = async ({ id, title }: Input): Promise<void> => {};', true],
+    ['export const publishDraft = async (...args: unknown[]) => {};', true],
+    ['export const publishDraft = async (\n  fd: FormData,\n): Promise<void> => {};', true],
+    ['export const publishDraft = function publishDraft(fd) {};', true],
+    ['export let publishDraft = async (fd) => {};', true],
+    ['const publishDraft = async (fd) => {};\nexport { publishDraft };', true],
+    ['async function impl(fd) {}\nexport { impl as publishDraft };', true],
+    // BOTH separators, inside BOTH annotation positions. The previous sweep
+    // had neither, so it stayed green through a walk that broke on a comma or
+    // a `;` at any depth. `Promise<Record<string, string>>` is the fieldErrors
+    // shape the ActionResult envelope pushes authors toward.
+    ['export const publishDraft = async (fd): Promise<Record<string, string>> => ({});', true],
+    ['export const publishDraft = async (fd): Promise<ActionResult<Draft, Err>> => ({});', true],
+    ['export const publishDraft = async (fd): { ok: boolean; id: string } => ({});', true],
+    ['export const publishDraft = async (fd: Map<string, number>) => 1;', true],
+    // These pin the depth guard on `;` / `,` inside a return type. They do NOT
+    // pin the arrow step beside it: a mutant that breaks at any arrow answers
+    // true on these by accident, and no input distinguishes it, because
+    // reaching that walk needs a `(…)` group followed by `:`, which in
+    // expression position only ever precedes an arrow's return type.
+    ['export const publishDraft = async (fd): { a: () => void, b: string } => ({});', true],
+    ['export const publishDraft = async (fd): [() => void, string] => ({});', true],
+    // A GENERIC arrow, which never reached the parameter-list branch at all.
+    ['export const publishDraft = async <T>(fd: T): Promise<void> => {};', true],
+    ['export const publishDraft = <T,>(fd: T) => 1;', true],
+    // A generic CONSTRAINT containing its own arrow: without the arrow step in
+    // the type-parameter walk, that `>` closes the list early and the parameter
+    // branch is never reached. Nothing pinned this guard until this row.
+    ['export const publishDraft = <T extends (fd: FormData) => void>(fd: T) => 1;', true],
+    // `async` with no space before the type parameters, which is valid and was
+    // unreachable because the async skip required whitespace or a paren.
+    ['export const publishDraft = async<T>(fd: T) => 1;', true],
+    // A constraint carrying its own type ARGUMENTS. Without the depth condition
+    // on the type-parameter walk's `>`, the inner `>` closes the list early and
+    // the parameter branch is never reached. `Record<string, …>` is the shape
+    // the ActionResult envelope pushes authors toward.
+    ['export const publishDraft = <T extends Array<string>>(fd: T) => 1;', true],
+    ['export const publishDraft = async <T extends Record<string, unknown>>(fd: T) => 1;', true],
+    ['export const publishDraft = <A, B extends Map<A, string>>(fd: A) => 1;', true],
+    // A DEFAULT type parameter puts a bare `=` inside the annotation's
+    // brackets, which is the only thing keeping the depth condition on the
+    // assignment scan honest.
+    ['export const publishDraft: <T = FormData>(fd: T) => Promise<void> = async (fd) => 1;', true],
+    // Whitespace between the type-parameter list and the parameter list, which
+    // is what the trailing skip after that walk exists for.
+    ['export const publishDraft = <T> (fd: T) => 1;', true],
+    // Non-callables that must stay SILENT.
+    ["export const publishDraft = `/api/${'x'}`;", false],
+    ['export const publishDraft = 42;', false],
+    ["export const publishDraft = ['/a', '/b'].join('/');", false],
+  ];
+  for (const [body, shouldFire] of cases) {
+    const dir = await makeApp({
+      'modules/feedback/actions/publish.server.ts': `'use server';\n${body}\n`,
+      'app/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form method="get"><button formaction=\${publishDraft}>P</button></form>\`;
+`,
+    });
+    assert.equal(hits(await checkConventions(dir)).length, shouldFire ? 1 : 0,
+      `${shouldFire ? 'should fire' : 'should be silent'}: ${body.replace(/\n/g, ' ')}`);
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('silent on a url CONSTANT exported from a .server module', async () => {
+  // "Imported from a `.server` module" is not enough: a server module exports
+  // non-functions too, and the renderer binds only a FUNCTION. A url constant
+  // renders as an ordinary attribute, so reporting it is the same false positive
+  // wearing a different hat.
+  const dir = await makeApp({
+    'lib/urls.server.ts': "export const ARCHIVE_URL = '/api/items/archive';\n",
+    'app/items/page.ts': `import { html } from '@webjsdev/core';
+import { ARCHIVE_URL } from '#lib/urls.server.ts';
+export default () => html\`<form method="get"><button formaction=\${ARCHIVE_URL}>Archive</button></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a url constant is not an action binding');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent on an ambiguous factory-produced export', async () => {
+  // `export const go = cache(fn)` may well be callable, but it is not PROVABLY
+  // a function from the source, and an ambiguous export firing the rule is the
+  // false-positive direction.
+  const dir = await makeApp({
+    'modules/feedback/actions/factory.server.ts': `'use server';
+import { cache } from '@webjsdev/server';
+export const publishCached = cache(async () => ({ success: true }));
+`,
+    'app/items/page.ts': `import { html } from '@webjsdev/core';
+import { publishCached } from '#modules/feedback/actions/factory.server.ts';
+export default () => html\`<form method="get"><button formaction=\${publishCached}>P</button></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent on binding shapes the resolver cannot follow', async () => {
+  // Real bindings the rule now MISSES rather than misreports: a namespace
+  // import, a default import, and a non-identifier expression. Silence is the
+  // safe direction, and these are named in the rule's silence list.
+  const shapes = {
+    'namespace import': `import * as acts from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form method="get"><button formaction=\${acts.publishDraft}>P</button></form>\`;`,
+    'member expression': `import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+const bag = { publishDraft };
+export default () => html\`<form method="get"><button formaction=\${bag.publishDraft}>P</button></form>\`;`,
+  };
+  for (const [label, body] of Object.entries(shapes)) {
+    const dir = await makeApp({
+      'app/items/page.ts': `import { html } from '@webjsdev/core';\n${body}\n`,
+    });
+    assert.deepEqual(hits(await checkConventions(dir)), [], `${label} is unknowable, so silent`);
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+test('still fires when the hole IS an imported server action', async () => {
+  // The counterfactual for the filter above: narrowing to real bindings must not
+  // silence the shape the rule exists for.
+  const dir = await makeApp({
+    'app/items/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form><button formaction=\${publishDraft}>P</button></form>\`;
+`,
+  });
+  assert.equal(hits(await checkConventions(dir)).length, 1);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the tag has no call site anywhere in the app', async () => {
+  const dir = await makeApp({
+    'components/row-btn.ts': rowBtn(),
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<h1>hi</h1>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the submitter lives in a bare html helper, not the class body', async () => {
+  const dir = await makeApp({
+    'components/row-btn.ts': `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export const publishBtn = () => html\`<button formaction=\${publishDraft}>Publish</button>\`;
+class RowBtn extends WebComponent({}) {
+  render() { return html\`<span>row</span>\`; }
+}
+RowBtn.register('row-btn');
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a fragment inherits the caller scope');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('silent when the file registers two tags (ambiguous attribution)', async () => {
+  const dir = await makeApp({
+    'components/pair.ts': `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+class RowBtn extends WebComponent({}) {
+  render() { return html\`<button formaction=\${publishDraft}>Publish</button>\`; }
+}
+RowBtn.register('row-btn');
+class RowLabel extends WebComponent({}) {
+  render() { return html\`<span>label</span>\`; }
+}
+RowLabel.register('row-label');
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><row-btn></row-btn></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('flags the same-scan case with no cross-module step', async () => {
+  const dir = await makeApp({
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form><button formaction=\${publishDraft}>Publish</button></form>\`;
+`,
+  });
+  const v = hits(await checkConventions(dir));
+  assert.equal(v.length, 1);
+  assert.match(v[0].file, /page\.ts/);
+  // The same-scan case is a RENDER error, not the silent one, so it says so.
+  assert.match(v[0].message, /SAME template/);
+  assert.match(v[0].message, /refuses this shape outright/);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('the same-scan case is flagged even with method="post", because the renderer refuses it', async () => {
+  // Unlike the cross-module case, delivery is irrelevant here: the renderer
+  // sees both halves in one scan and throws, whatever the method.
+  const dir = await makeApp({
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+export default () => html\`<form method="post"><button formaction=\${publishDraft}>P</button></form>\`;
+`,
+  });
+  const v = hits(await checkConventions(dir));
+  assert.equal(v.length, 1);
+  assert.match(v[0].message, /refuses this shape outright/);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('transitive: silent when the outer page binds the form', async () => {
+  const dir = await makeApp({
+    'components/todo-list.ts': TODO_LIST,
+    'components/todo-row.ts': TODO_ROW,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+import { saveAll } from '#modules/feedback/actions/save.server.ts';
+export default () => html\`<form action=\${saveAll}><todo-list></todo-list></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), []);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('transitive: fires through an intermediate component when the outer form is unbound', async () => {
+  const dir = await makeApp({
+    'components/todo-list.ts': TODO_LIST,
+    'components/todo-row.ts': TODO_ROW,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><todo-list></todo-list></form>\`;
+`,
+  });
+  const v = hits(await checkConventions(dir));
+  assert.equal(v.length, 1, 'a one-level rule would go silent here');
+  assert.match(v[0].file, /todo-row\.ts/);
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('a reference cycle is silent and does not hang', async () => {
+  const dir = await makeApp({
+    'components/a-one.ts': `import { html, WebComponent } from '@webjsdev/core';
+import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
+class AOne extends WebComponent({}) {
+  render() { return html\`<b-two></b-two><button formaction=\${publishDraft}>Publish</button>\`; }
+}
+AOne.register('a-one');
+`,
+    'components/b-two.ts': `import { html, WebComponent } from '@webjsdev/core';
+class BTwo extends WebComponent({}) {
+  render() { return html\`<a-one></a-one>\`; }
+}
+BTwo.register('b-two');
+`,
+    'app/page.ts': `import { html } from '@webjsdev/core';
+export default () => html\`<form><a-one></a-one></form>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a cycle can never be a verdict');
+  await rm(dir, { recursive: true, force: true });
+});
+
+test('a docs page showing the shape as a code sample stays clean', async () => {
+  const dir = await makeApp({
+    'app/docs/page.ts': `import { html } from '@webjsdev/core';
+const sample = '<form><button formaction=\${del}>x</button></form>';
+export default () => html\`<pre><code>\${sample}</code></pre>
+  <p>Write &lt;form action=\${'$'}{save}&gt; around it.</p>\`;
+`,
+  });
+  assert.deepEqual(hits(await checkConventions(dir)), [], 'a string is never read as markup');
+  await rm(dir, { recursive: true, force: true });
+});
diff --git a/packages/server/test/scanner/html-form-scopes.test.js b/packages/server/test/scanner/html-form-scopes.test.js
new file mode 100644
index 000000000..95b77d3c6
--- /dev/null
+++ b/packages/server/test/scanner/html-form-scopes.test.js
@@ -0,0 +1,329 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+import {
+  scanHtmlFormScopes,
+  classifyActionHole,
+  matchClosingBrace,
+  extractWebComponentClassBodies,
+  redactStringsAndTemplates,
+} from '../../src/js-scan.js';
+import { PARSEABLE_ENCTYPES } from '../../../core/src/form-action.js';
+import { readFile } from 'node:fs/promises';
+
+/**
+ * Unit tests for the lexical half of `submitter-needs-bound-form` (#1307):
+ * the whole-app rule in `check.js` is only as good as the scan under it, and
+ * the shapes it must NOT read as markup (a plain string, a `css` template, an
+ * HTML comment) are what keep the rule from firing on a docs page.
+ */
+
+test('a submitter reports the scope of its enclosing form', () => {
+  assert.deepEqual(
+    scanHtmlFormScopes('html`<form action=${save}><button formaction=${del}>x</button></form>`').submitters,
+    [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }],
+  );
+  assert.deepEqual(
+    scanHtmlFormScopes('html`<form><button formaction=${del}>x</button></form>`').submitters,
+    [{ tag: 'button', scope: 'unbound', delivers: false, expr: 'del' }],
+  );
+  assert.deepEqual(
+    scanHtmlFormScopes('html`<button formaction=${del}>x</button>`').submitters,
+    [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }],
+  );
+});
+
+test('a nested template inherits the enclosing form scope', () => {
+  // What the renderer does: `render` threads `formScope` through arrays,
+  // `repeat`, and nested templates, so a per-row button in a bound form is
+  // bound.
+  const bound = 'html`<form action=${save}>${rows.map((r) => html`<button formaction=${del}>x</button>`)}</form>`';
+  assert.deepEqual(scanHtmlFormScopes(bound).submitters, [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }]);
+  const unbound = 'html`<form>${rows.map((r) => html`<button formaction=${del}>x</button>`)}</form>`';
+  assert.deepEqual(scanHtmlFormScopes(unbound).submitters, [{ tag: 'button', scope: 'unbound', delivers: false, expr: 'del' }]);
+});
+
+test('the scope closes at </form> and does not leak forward', () => {
+  const src = 'html`<form action=${save}></form><button formaction=${del}>x</button>`';
+  assert.deepEqual(scanHtmlFormScopes(src).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
+});
+
+test('a start tag split across holes is still one tag', () => {
+  const src = 'html`<form action=${save} class="a"><button class=${c} formaction=${del}>x</button></form>`';
+  assert.deepEqual(scanHtmlFormScopes(src).submitters, [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }]);
+});
+
+test('a `>` inside a quoted attribute value does not close the tag', () => {
+  const src = 'html`<form action=${save}><div title="a>b"></div><button formaction=${del}>x</button></form>`';
+  assert.deepEqual(scanHtmlFormScopes(src).submitters, [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }]);
+});
+
+test('a custom-element start tag is reported, its close tag is not', () => {
+  assert.deepEqual(
+    scanHtmlFormScopes('html`<form action=${save}><row-btn></row-btn></form>`').tagUses,
+    [{ tag: 'row-btn', scope: 'bound', delivers: null, expr: null }],
+  );
+  assert.deepEqual(
+    scanHtmlFormScopes('html`<form><row-btn></row-btn></form>`').tagUses,
+    [{ tag: 'row-btn', scope: 'unbound', delivers: false, expr: null }],
+  );
+});
+
+test('only an html-tagged literal is read as markup', () => {
+  // The carve-out the whole rule rests on: the framework's own website renders
+  // `<form action=${fn}>` as a code SAMPLE.
+  assert.deepEqual(scanHtmlFormScopes("const s = '<form><button formaction=x></button></form>';").submitters, []);
+  assert.deepEqual(scanHtmlFormScopes('css`.a { }` + html`<row-btn></row-btn>`').tagUses, [{ tag: 'row-btn', scope: 'none', delivers: null, expr: null }]);
+  // A form written inside a plain string cannot open a scope for real markup.
+  const mixed = "const s = '<form>'; export default () => html`<button formaction=${del}>x</button>`;";
+  assert.deepEqual(scanHtmlFormScopes(mixed).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
+});
+
+test('an HTML comment is not markup', () => {
+  const src = 'html`<!-- <form> --><button formaction=${del}>x</button>`';
+  assert.deepEqual(scanHtmlFormScopes(src).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
+});
+
+test('classifyActionHole matches the tag and the attribute as a pair', () => {
+  assert.equal(classifyActionHole('<form action='), 'form');
+  assert.equal(classifyActionHole('<button formaction='), 'submitter');
+  assert.equal(classifyActionHole('<input formaction='), 'submitter');
+  assert.equal(classifyActionHole('<div action='), null, 'a div binds nothing');
+  assert.equal(classifyActionHole('<form formaction='), null, 'wrong attribute for the tag');
+  assert.equal(classifyActionHole('<button action='), null, 'wrong attribute for the tag');
+  assert.equal(classifyActionHole('<form action=x><span>'), null, 'the tag already closed');
+  assert.equal(classifyActionHole('plain text'), null);
+});
+
+test('matchClosingBrace walks past a template hole (#1307)', () => {
+  // A hole is a CODE context nested in a template, not a brace in the block
+  // being matched. Counting it toward the outer depth (the earlier behaviour)
+  // meant depth could never return to zero.
+  const s = '{ return html`<b>${x}</b>`; }';
+  assert.equal(matchClosingBrace(s, 1), s.length - 1);
+  const nested = '{ a(html`${ b(html`${c}`) }`); }';
+  assert.equal(matchClosingBrace(nested, 1), nested.length - 1);
+  // Still returns -1 when there really is no match.
+  assert.equal(matchClosingBrace('{ a(', 1), -1);
+});
+
+test('a class body holding a template hole is extractable from RAW source', () => {
+  // Every other caller passes a masked source in which holes are blanked, so
+  // this path was the one that exposed the brace bug.
+  const src = [
+    'class RowBtn extends WebComponent({}) {',
+    '  render() { return html`<button formaction=${del}>x</button>`; }',
+    '}',
+  ].join('\n');
+  const bodies = extractWebComponentClassBodies(src);
+  assert.equal(bodies.length, 1);
+  assert.match(bodies[0].body, /formaction=\$\{del\}/);
+  assert.deepEqual(scanHtmlFormScopes(bodies[0].body).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
+});
+
+test('an unbound form reports whether it would still DELIVER the identity', () => {
+  // This is the bit that decides broken from working, and it is not boundness.
+  // A submitter's identity rides its OWN name/value pair, so an unbound form
+  // that still sends a parseable POST body delivers it and the action runs.
+  const sub = (formTag) => scanHtmlFormScopes(
+    'html`' + formTag + '<button formaction=${del}>x</button></form>`',
+  ).submitters[0];
+
+  assert.equal(sub('<form method="post">').delivers, true, 'a POST body carries the pair');
+  assert.equal(sub('<form method="POST">').delivers, true, 'the keyword folds case');
+  assert.equal(sub('<form method="post" enctype="multipart/form-data">').delivers, true);
+  assert.equal(sub('<form>').delivers, false, 'no method is a GET');
+  assert.equal(sub('<form method="get">').delivers, false);
+  // `method` is an enumerated attribute matched against exact keywords with no
+  // whitespace stripping, so a padded value falls to the GET default.
+  assert.equal(sub('<form method=" post ">').delivers, false);
+  assert.equal(sub('<form method="post" enctype="text/plain">').delivers, false, 'the server cannot parse it');
+  // `enctype` is an enumerated attribute whose missing AND invalid value default
+  // are both application/x-www-form-urlencoded, so an unrecognised value falls
+  // back to a parseable body. Treating it as unparseable reported a working form
+  // as broken, which is the one thing this rule must never do.
+  assert.equal(sub('<form method="post" enctype="nonsense">').delivers, true, 'an invalid enctype falls back to urlencoded');
+  assert.equal(sub('<form method="post" enctype=" text/plain ">').delivers, true, 'padded, so invalid, so urlencoded');
+  assert.equal(sub('<form method="post" enctype="TEXT/PLAIN">').delivers, false, 'the keyword folds case');
+  // A hole anywhere else in the start tag makes the answer dynamic.
+  assert.equal(sub('<form method=${m}>').delivers, null);
+  assert.equal(sub('<form enctype=${e} method="post">').delivers, null);
+});
+
+test('opensForm reports whether the source opens any form at all', () => {
+  assert.equal(scanHtmlFormScopes('html`<button formaction=${d}>x</button>`').opensForm, false);
+  assert.equal(scanHtmlFormScopes('html`<form action=${s}></form>`').opensForm, true);
+  // A form written only inside a plain string is not a form.
+  assert.equal(scanHtmlFormScopes("const s = '<form>';").opensForm, false);
+});
+
+test('class-body offsets index the RAW source identically to the mask', () => {
+  // How the rule gets a body with its templates intact without asking the brace
+  // matcher to lex raw source: locate in the position-preserving mask, slice
+  // from `content`. A regex literal holding a brace is the case that broke when
+  // raw source was passed directly.
+  const src = [
+    'class RowBtn extends WebComponent({}) {',
+    '  static re = /[{]/;',
+    '  render() { return html`<button formaction=${del}>x</button>`; }',
+    '}',
+  ].join('\n');
+  const masked = redactStringsAndTemplates(src);
+  assert.equal(masked.length, src.length, 'the mask is position-preserving');
+  const bodies = extractWebComponentClassBodies(masked);
+  assert.equal(bodies.length, 1, 'the masked view blanks the regex body, so the braces balance');
+  const body = src.slice(bodies[0].bodyStart, bodies[0].bodyEnd);
+  assert.match(body, /formaction=\$\{del\}/, 'the raw slice keeps the template intact');
+  assert.deepEqual(scanHtmlFormScopes(body).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
+});
+
+test('a template in an ordinary START-TAG hole is handed off, not inherited', () => {
+  // A hole inside a start tag is an attribute or property VALUE whose placement
+  // this scan cannot speak for: SSR never renders it in place (a serializable
+  // value applies at hydration, a function-carrying one is dropped outright), so
+  // the receiving element decides where it lands in the browser. Scoring it by
+  // lexical nesting reported a shape the renderer treats as cannot-tell (and
+  // therefore binds) as a conclusive 'unbound'. `<webjs-suspense .fallback>` is
+  // the one exception and has its own test below.
+  const passed = 'html`<form method="post"><my-thing .tpl=${html`<button formaction=${del}>x</button>`}></my-thing></form>`';
+  // 'handed', NOT 'none'. Both mean "no enclosing form in this scan", but only
+  // 'none' is a cannot-tell the caller may attribute to this file's own
+  // component. A handed-off template belongs to whichever element received it,
+  // so collapsing the two resolves it through the wrong call sites.
+  assert.deepEqual(scanHtmlFormScopes(passed).submitters, [{ tag: 'button', scope: 'handed', delivers: null, expr: 'del' }]);
+  // A hyphenated tag inside a property hole is placed by the receiving element
+  // too, so it is not this file's call site either.
+  const tagPassed = 'html`<my-shell .rows=${html`<todo-row></todo-row>`}></my-shell>`';
+  assert.deepEqual(scanHtmlFormScopes(tagPassed).tagUses.filter((u) => u.tag === 'todo-row'),
+    [{ tag: 'todo-row', scope: 'handed', delivers: null, expr: null }]);
+  // A form the handed-off template opens ITSELF is still its own scope.
+  const ownForm = 'html`<my-thing .tpl=${html`<form action=${s}><button formaction=${del}>x</button></form>`}></my-thing>`';
+  assert.deepEqual(scanHtmlFormScopes(ownForm).submitters, [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }]);
+  // A hole in CHILD position IS rendered inline by this scan, so it still
+  // inherits. This is the pair that keeps the fix from being a blanket opt-out.
+  const child = 'html`<form method="post">${html`<button formaction=${del}>x</button>`}</form>`';
+  assert.deepEqual(scanHtmlFormScopes(child).submitters, [{ tag: 'button', scope: 'unbound', delivers: true, expr: 'del' }]);
+});
+
+test('the unparseable-enctype constant tracks the renderer\'s own set', async () => {
+  // The scanner states its enctype rule as a DENYLIST of one because of the
+  // invalid-value default, while the renderer refuses the wider allowlist. This
+  // pins the relationship rather than asserting the two are equal, so a change
+  // to core's set surfaces here instead of drifting silently.
+  assert.ok(!PARSEABLE_ENCTYPES.has('text/plain'), 'the renderer cannot parse text/plain either');
+  for (const e of PARSEABLE_ENCTYPES) {
+    const src = `html\`<form method="post" enctype="${e}"><button formaction=\${d}>x</button></form>\``;
+    assert.equal(scanHtmlFormScopes(src).submitters[0].delivers, true, `${e} delivers`);
+  }
+  assert.deepEqual([...PARSEABLE_ENCTYPES].sort(),
+    ['application/x-www-form-urlencoded', 'multipart/form-data'],
+    'if core gains an enctype, revisit the scanner denylist');
+
+  // There are now THREE hardcoded copies of the denylist keyword: the scanner's
+  // `UNPARSEABLE_FORM_ENCTYPE`, the client guard in `router-client.js`, and this
+  // test. Pin the client one too, so the two halves of the feature cannot drift
+  // into disagreeing on the same input (which is what the allowlist did).
+  const clientSrc = await readFile(new URL('../../../core/src/router-client.js', import.meta.url), 'utf8');
+  assert.match(clientSrc, /enctype\.toLowerCase\(\) === 'text\/plain'/,
+    'the client guard uses the same one-keyword denylist, not the renderer allowlist');
+  assert.doesNotMatch(clientSrc, /PARSEABLE_ENCTYPES/,
+    'and does not reach for the renderer allowlist again');
+});
+
+test('the start-tag-hole rule matches what the RENDERER actually does', async () => {
+  // A differential rather than an assertion about the scanner alone, because the
+  // whole 'handed' state is a claim about the renderer's behaviour. Most
+  // start-tag holes are values the receiving element places, but
+  // `<webjs-suspense .fallback=${…}>` is rendered INLINE with the enclosing form
+  // scope (#471: a custom-element property applies at hydration, too late for a
+  // placeholder that must be in the first flushed bytes). Treating that one as
+  // handed off would blind the same-scan half to a real render-time throw.
+  const { html } = await import('../../../core/src/html.js');
+  const { renderToString } = await import('../../../core/src/render-server.js');
+  const { setFormActionResolver } = await import('../../../core/src/form-action.js');
+  setFormActionResolver(async () => 'abc1234567/publish');
+  const publish = async () => ({ success: true });
+
+  // Rendered inline, so the renderer judges it against the unbound form and
+  // throws. The scanner must see the same thing.
+  const fallbackSrc = 'html`<form><webjs-suspense .fallback=${html`<button formaction=${p}>x</button>`}></webjs-suspense></form>`';
+  assert.deepEqual(scanHtmlFormScopes(fallbackSrc).submitters,
+    [{ tag: 'button', scope: 'unbound', delivers: false, expr: 'p' }]);
+  await assert.rejects(
+    () => renderToString(
+      html`<form><webjs-suspense .fallback=${html`<button formaction=${publish}>x</button>`}></webjs-suspense></form>`,
+      { ssr: true },
+    ),
+    /requires the enclosing <form> to also be bound/,
+    'the renderer really does refuse it, so the scanner must not be silent',
+  );
+
+  // The negative half, and it has to assert the MECHANISM rather than "it did
+  // not throw". A template carrying a function cannot serialize, so SSR drops
+  // the whole property binding and emits nothing for it: the submitter is never
+  // rendered and never judged here at all. Asserting only that the render
+  // succeeded would stay green for ANY scanner verdict, which is precisely the
+  // non-discriminating test this differential exists to avoid.
+  const propSrc = 'html`<form><my-thing .tpl=${html`<button formaction=${p}>x</button>`}></my-thing></form>`';
+  assert.deepEqual(scanHtmlFormScopes(propSrc).submitters,
+    [{ tag: 'button', scope: 'handed', delivers: null, expr: 'p' }]);
+  const warns = [];
+  const quiet = console.warn;
+  console.warn = (...a) => warns.push(a.join(' '));
+  let out;
+  try {
+    out = await renderToString(
+      html`<form><my-thing .tpl=${html`<button formaction=${publish}>x</button>`}></my-thing></form>`,
+      { ssr: true },
+    );
+  } finally { console.warn = quiet; }
+  assert.doesNotMatch(out, /<button/, 'SSR emits nothing for the dropped property');
+  assert.ok(warns.some((w) => /unserializable value during SSR/.test(w)),
+    'and it says so, which is the proof SSR never judged this submitter');
+
+  // The tag half of the same carve-out. A hyphenated tag in a fallback IS a real
+  // call site (rendered inline, inside the enclosing form); one in an ordinary
+  // property hole is not.
+  const fbTag = 'html`<form><webjs-suspense .fallback=${html`<todo-row></todo-row>`}></webjs-suspense></form>`';
+  assert.deepEqual(scanHtmlFormScopes(fbTag).tagUses.filter((u) => u.tag === 'todo-row'),
+    [{ tag: 'todo-row', scope: 'unbound', delivers: false, expr: null }]);
+  const propTag = 'html`<form><my-shell .rows=${html`<todo-row></todo-row>`}></my-shell></form>`';
+  assert.deepEqual(scanHtmlFormScopes(propTag).tagUses.filter((u) => u.tag === 'todo-row'),
+    [{ tag: 'todo-row', scope: 'handed', delivers: null, expr: null }]);
+});
+
+test('the enctype divergence from the renderer is deliberate, on both sides', async () => {
+  // The scanner uses a one-keyword denylist and the renderer an allowlist, and
+  // it would be easy to "unify" them later. This pins WHY they differ, so that
+  // change breaks a test carrying its own reason.
+  //
+  // They ask different questions. This rule asks whether the identity ARRIVES,
+  // and an invalid enctype falls back to urlencoded, so it does. The renderer
+  // asks whether the form does what the author wrote, and an invalid value is
+  // the dangerous case: a typo'd `multipart/form-dat` falls back to urlencoded
+  // and silently drops every FILE from the submission.
+  const { html } = await import('../../../core/src/html.js');
+  const { renderToString } = await import('../../../core/src/render-server.js');
+  const { setFormActionResolver } = await import('../../../core/src/form-action.js');
+  setFormActionResolver(async () => 'abc1234567/save');
+  const save = async () => ({ success: true });
+
+  const sub = (formTag) => scanHtmlFormScopes(
+    'html`' + formTag + '<button formaction=${del}>x</button></form>`',
+  ).submitters[0];
+
+  // The scanner: an invalid enctype still delivers, so it is not a defect.
+  assert.equal(sub('<form method="post" enctype="multipart/form-dat">').delivers, true);
+  // The renderer: the same typo throws, because it would cost the author their
+  // file upload with no other signal.
+  await assert.rejects(
+    () => renderToString(html`<form action=${save} enctype=${'multipart/form-dat'}></form>`, { ssr: true }),
+    /cannot work|enctype/i,
+  );
+  // And both agree that text/plain is broken.
+  assert.equal(sub('<form method="post" enctype="text/plain">').delivers, false);
+  await assert.rejects(
+    () => renderToString(html`<form action=${save} enctype=${'text/plain'}></form>`, { ssr: true }),
+    /cannot work|enctype/i,
+  );
+});
diff --git a/test/bun/form-action-dispatch.mjs b/test/bun/form-action-dispatch.mjs
index 408d3e4e9..fbcb3dd87 100644
--- a/test/bun/form-action-dispatch.mjs
+++ b/test/bun/form-action-dispatch.mjs
@@ -28,6 +28,7 @@ import { join, dirname, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
 import { createRequestHandler } from '../../packages/server/src/dev.js';
+import { resetFormReportDedupe } from '../../packages/server/src/form-dispatch.js';
 
 const runtime = process.versions.bun ? `bun ${process.versions.bun}` : `node ${process.versions.node}`;
 const CORE = JSON.stringify(pathToFileURL(resolve('packages/core/index.js')).toString());
@@ -154,5 +155,45 @@ function urlencoded(fields) {
   assert.equal(res.status, 405, `[${runtime}] a submission with no identity is a 405`);
 }
 
+// #1307: both fingerprints of a form that posts nowhere reach the `onError`
+// sink with a groupable code, and neither changes the response. Cross-runtime
+// by construction: the code paths are `url.searchParams.has()`,
+// `formData.keys()`, and `Error` property assignment, all of which Node and Bun
+// implement separately.
+{
+  resetFormReportDedupe();
+  /** @type {any[]} */
+  const seen = [];
+  const reporting = await createRequestHandler({
+    appDir: dir, dev: false, onError: (e) => seen.push(e),
+  });
+  await reporting.warmup();
+
+  // A page GET carrying the reserved field in the QUERY STRING: the fingerprint
+  // of a bound submitter submitted through an UNBOUND form.
+  const got = await reporting.handle(new Request(`http://x/signup?${FIELD}=abc123%2Fsignup`));
+  assert.equal(got.status, 200, `[${runtime}] the GET still renders (detect only)`);
+  assert.equal(seen.length, 1, `[${runtime}] the query-string GET is reported once`);
+  assert.equal(seen[0].code, 'WEBJS_FORM_SUBMITTED_AS_GET', `[${runtime}] with a groupable code`);
+
+  // Deduplicated per process on method + pathname, so a crafted flood cannot
+  // amplify into a paid APM sink.
+  await reporting.handle(new Request(`http://x/signup?${FIELD}=abc123%2Fsignup`));
+  assert.equal(seen.length, 1, `[${runtime}] a second identical request adds no report`);
+
+  // A submission carrying no identity: still a 405, now with a report naming
+  // the submitted field NAMES and none of the values.
+  const missing = await reporting.handle(new Request('http://x/signup', {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded', origin: 'http://x' },
+    body: new URLSearchParams({ email: 'a@b.com' }).toString(),
+  }));
+  assert.equal(missing.status, 405, `[${runtime}] the 405 is unchanged`);
+  const bodyless = seen.find((e) => e.code === 'WEBJS_FORM_ACTION_MISSING');
+  assert.ok(bodyless, `[${runtime}] the bind-nothing 405 is reported`);
+  assert.deepEqual(bodyless.fields, ['email'], `[${runtime}] field names ride, values do not`);
+  assert.ok(!JSON.stringify(bodyless.fields).includes('a@b.com'), `[${runtime}] no user data`);
+}
+
 rmSync(dir, { recursive: true, force: true });
-console.log(`[form-action-dispatch] #1155 dispatch OK on ${runtime} (identity ${id})`);
+console.log(`[form-action-dispatch] #1155 dispatch + #1307 reporting OK on ${runtime} (identity ${id})`);
diff --git a/website/app/docs/progressive-enhancement/page.ts b/website/app/docs/progressive-enhancement/page.ts
index 0af393b2e..57e606c40 100644
--- a/website/app/docs/progressive-enhancement/page.ts
+++ b/website/app/docs/progressive-enhancement/page.ts
@@ -173,7 +173,11 @@ export default function NewPost({ actionData }: {
     </p>
 
     <p>
-      A form that binds nothing gets a <code>405</code>: there is no page <code>action</code> export to catch a bare <code>&lt;form method="post"&gt;</code>. Multi-submitter forms can bind per-button actions using <code>formaction=\${action}</code> on submitter buttons inside a bound form, which work with JavaScript disabled via standard DOM submitter precedence.
+      A form that binds nothing gets a <code>405</code>: there is no page <code>action</code> export to catch a bare <code>&lt;form method="post"&gt;</code>. The quieter half of that is worth knowing too. A form with no <code>method</code> at all submits as a GET, so there is no body and no 405; the page simply re-renders with a 200. Multi-submitter forms can bind per-button actions using <code>formaction=\${action}</code> on submitter buttons inside a bound form, which work with JavaScript disabled via standard DOM submitter precedence.
+    </p>
+
+    <p>
+      <strong>A per-button action needs its enclosing form bound.</strong> <code>method="post"</code> and the enctype are supplied on the form's start tag, which is already emitted by the time the renderer reaches the button, so a submitter cannot retrofit them. An unbound host form the renderer can see is refused at render. One it CANNOT see is not: a submitter inside a component is a cannot-tell, because the component renders its own template in a separate pass with no view of the host page, and cannot-tell has to bind (refusing there would drop the component from a page that still returned 200). So a <code>formaction=\${action}</code> button in a component inside an unbound form ships. If that form still declares <code>method="post"</code> it works, because the identity rides the button's own <code>name</code>/<code>value</code> pair into the body; if it declares no method it submits as a GET, puts the reserved identity in the query string, and the action never runs. Run <code>webjs check</code>: the <code>submitter-needs-bound-form</code> rule reads every template in the app at once, so it resolves the enclosing form across modules and flags this at edit time.
     </p>
 
     <p>
diff --git a/website/app/docs/troubleshooting/page.ts b/website/app/docs/troubleshooting/page.ts
index 23e39c361..476462e1c 100644
--- a/website/app/docs/troubleshooting/page.ts
+++ b/website/app/docs/troubleshooting/page.ts
@@ -54,6 +54,11 @@ export default function Troubleshooting() {
     <p><strong>Cause:</strong> the form binds no action. A page has no <code>action</code> export, so a bare <code>&lt;form method="post"&gt;</code> has nothing to run: the url exists and only renders, which is what the 405 says. The other way to get one is binding an action whose file declares <code>export const method = 'GET'</code>; a GET action rides its arguments in the url and skips the CSRF check, so it cannot answer a form POST. That case answers <code>Allow: GET</code>, and <code>webjs check</code>'s <code>form-action-not-a-get-action</code> rule catches it before it ships.</p>
     <p><strong>Fix:</strong> bind the action (<code>&lt;form action=\${submitFeedback}&gt;</code>), or drop the <code>method</code> export from the action's file so it is an ordinary POST.</p>
 
+    <h2>A button submits and the page just re-renders</h2>
+    <p><strong>Symptom:</strong> clicking a <code>formaction=\${action}</code> button reloads the same page with a 200, nothing was written, no error appears anywhere, and the address bar has grown a <code>?__webjs_action=</code> parameter.</p>
+    <p><strong>Cause:</strong> the enclosing <code>&lt;form&gt;</code> binds no action AND declares no <code>method="post"</code>, so the browser submits it as a GET. (An unbound form that DOES declare <code>method="post"</code> still works, because the identity rides the button's own name/value pair and reaches the server in the body.) A GET sends no body, so the identity the button carries rides the query string instead, and a GET at a page url just renders the page. That is why there is no 405 and no log line. The renderer refuses this shape when it can see both halves in one template, but a submitter inside a COMPONENT is a cannot-tell (the component renders in its own pass with no view of the host page) and cannot-tell has to bind, so a split-across-modules form reaches production.</p>
+    <p><strong>Fix:</strong> bind the enclosing form too (<code>&lt;form action=\${saveAll}&gt;</code>), which is what supplies <code>method="post"</code> and the enctype. Run <code>webjs check</code> to find it: the <code>submitter-needs-bound-form</code> rule reads every template in the app at once, so it resolves the enclosing form across module boundaries and transitively through intermediate components. It is conservative and stays silent when a tag is rendered in a bound form somewhere and an unbound one elsewhere, so a clean check is not by itself proof the form is bound. Two runtime signals back it up: in dev the browser console carries one <code>[webjs]</code> error at submit time naming the fix, and in production the <code>onError</code> hook receives the fingerprint with <code>err.code === 'WEBJS_FORM_SUBMITTED_AS_GET'</code>. The 405 case has its own code, <code>WEBJS_FORM_ACTION_MISSING</code>. Neither changes the response.</p>
+
     <h2>A render fails on a button's formmethod or formenctype</h2>
     <p><strong>Symptom:</strong> a page fails at render with <code>&lt;button formenctype="text/plain" formaction=\${action}&gt; cannot work</code>, or the same message naming <code>formmethod</code>.</p>
     <p><strong>Cause:</strong> that button BINDS an action and also tells itself to submit in a way the action could never read. A bound action needs a POST body the server can parse as <code>multipart/form-data</code> or <code>application/x-www-form-urlencoded</code>. A GET sends no body at all, <code>text/plain</code> is flagged by the HTML spec as not intended for machine parsing, and <code>formmethod="dialog"</code> dismisses a <code>&lt;dialog&gt;</code> rather than submitting. The renderer supplies <code>formmethod="post"</code> and the enctype on a bound submitter, so writing a conflicting value on the same button is a straight contradiction.</p>