From e5086c29d3bb5291a8c950ddb6531b614b917003 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Tue, 11 Aug 2026 01:41:11 +0530
Subject: [PATCH 1/3] fix: drop submitter-needs-bound-form, which contradicts
 #1307

The rule and its renderer differential were written against behaviour the
renderer does not have. #1307 made a bound submitter self-sufficient: the
renderer stamps formmethod="post" and formenctype on the button itself, and
a submitter's formmethod overrides the form's method per HTML. So a bound
button posts correctly inside an unbound, method-less, or method="get"
form, and the rule's premise that it "submits as a GET with the identity in
the query string" is false for every shape it flagged.

It was flagging #1307's own demonstration fixtures in examples/blog, and
the differential asserted an error string that exists nowhere in core or
server. Both have reddened main since 7683c1ba, on webjs check, the unit
suite, and the Bun matrix, blocking every open PR.

The runtime diagnostics in form-dispatch.js are untouched: they detect a
request shape server-side and stay reachable however the request was made.
---
 .../webjs/references/data-and-actions.md      |   2 +-
 .../webjs/references/muscle-memory-gotchas.md |  11 +-
 packages/server/src/check.js                  | 455 +----------
 .../check/submitter-needs-bound-form.test.js  | 716 ------------------
 .../test/scanner/html-form-scopes.test.js     |  30 +-
 .../app/docs/progressive-enhancement/page.ts  |   2 +-
 website/app/docs/troubleshooting/page.ts      |   4 +-
 7 files changed, 23 insertions(+), 1197 deletions(-)
 delete mode 100644 packages/server/test/check/submitter-needs-bound-form.test.js

diff --git a/.agents/skills/webjs/references/data-and-actions.md b/.agents/skills/webjs/references/data-and-actions.md
index 7ec2dcfd5..b79f12e08 100644
--- a/.agents/skills/webjs/references/data-and-actions.md
+++ b/.agents/skills/webjs/references/data-and-actions.md
@@ -146,7 +146,7 @@ Everything the action declares applies here too, or an action would be protected
 - `invalidates` is evicted when the action actually RAN (a middleware short-circuit does not evict), and the evicted tags are reported on the response so the browser's tag coordinator bypasses a stale cached GET. One reach limit: `fetch` follows the success `303` transparently, so JS cannot read a redirect's headers; the tags are on the wire and the `422` re-render carries them, and the redirect's own render is server-side and seeds fresh data.
 - `invalidates` and `tags` receive the SAME first argument the action does, so on a form boundary they receive the `FormData`. `invalidates: (input) => ['post:' + input.id]` returns `post:undefined` for a submission and evicts nothing. Either read the field (`(fd) => ['post:' + fd.get('id')]`), declare a `validate` that transforms the `FormData` into the typed input first (the transform result is what the config functions then see), or use an argument-independent tag.
 - `method = 'GET'` cannot be bound to a form: a GET action rides its args in the url and is CSRF-exempt, so it cannot answer a form POST. That is a `405` at runtime and the `form-action-not-a-get-action` error in `webjs check`.
-- A form whose buttons run DIFFERENT actions binds each on its submitter, `<button formaction=${publishDraft}>`, inside a form that is itself bound. **Bind the enclosing form**, because `method="post"` and the enctype are supplied on the form's start tag and a per-button action cannot retrofit them. The renderer refuses an unbound host form it can see, but a submitter in a COMPONENT is a cannot-tell (the component renders in its own pass with no view of the host page) and binds anyway. What happens then depends on the host form. One that still sends a parseable POST body WORKS, because the identity rides the button's own `name`/`value` pair into the body. One with no `method` (or `method="get"`) submits a GET, so the identity rides the query string, the action never runs, and the page re-renders with a 200 with nothing thrown and nothing logged. `webjs check`'s `submitter-needs-bound-form` resolves this across modules and flags it at edit time; in dev the client logs one `console.error` at submit time, and in production both server-visible fingerprints reach `onError` with a code (`WEBJS_FORM_SUBMITTED_AS_GET` for the query-string GET, `WEBJS_FORM_ACTION_MISSING` for a body carrying no identity). See `muscle-memory-gotchas.md` for the shape.
+- A form whose buttons run DIFFERENT actions binds each on its submitter, `<button formaction=${publishDraft}>`. **The submitter is self-sufficient** (#1307): the renderer gives it `formmethod="post"` and `formenctype` ON THE BUTTON, alongside the identity riding the button's own `name`/`value` pair, and a submitter's `formmethod` overrides the form's `method` per HTML. So a per-button action works inside a bound form, an unbound form, a `method="get"` form, or a form with no method at all, and the enclosing form does not need binding for the button's sake. Bind the form when the FORM itself should run an action on a plain submit. In dev the client logs one `console.error` at submit time for a submission holding an identity it cannot deliver, and in production both server-visible fingerprints reach `onError` with a code (`WEBJS_FORM_SUBMITTED_AS_GET` for an identity in the query string, `WEBJS_FORM_ACTION_MISSING` for a body carrying no identity). See `muscle-memory-gotchas.md` for the shape.
 
 The response drives the page: a success is a `303` PRG (to `result.redirect` when it is a same-site local path, else the page's own url), a failure re-renders the SAME page with `status` (default `422`) and the result on `actionData`, a submission carrying no identity is a `405`, and one whose hash no longer resolves is a `422` with a resubmit message (a form held open across a deploy). The submission is Origin-verified like an RPC call, so no token field is needed.
 
diff --git a/.agents/skills/webjs/references/muscle-memory-gotchas.md b/.agents/skills/webjs/references/muscle-memory-gotchas.md
index 2e1fbd305..b18835b12 100644
--- a/.agents/skills/webjs/references/muscle-memory-gotchas.md
+++ b/.agents/skills/webjs/references/muscle-memory-gotchas.md
@@ -137,7 +137,7 @@ That last row is the one to remember: quoting a binding hole turns it back into
 
 `.action=${fn}` on a native form is refused during SSR too, even though the property is dropped there and nothing could leak, so a page cannot render clean on the server and then throw on hydration.
 
-**A submitter in a component whose host form is unbound AND cannot carry a body is the one failure the renderers cannot throw on.** It is the shape to check by hand whenever you split a form across modules:
+**A bound submitter is self-sufficient and asks nothing of the form around it.** This is the shape people expect to have to wire up, and do not:
 
 ```ts
 // components/publish-button.ts   <- the submitter lives here
@@ -147,17 +147,16 @@ class PublishButton extends WebComponent({}) {
 PublishButton.register('publish-button');
 
 // app/triage/page.ts             <- the form lives here
-// WRONG: the form binds nothing, and NOTHING throws.
+// BOTH work. The button carries its own submission attributes.
 html`<form><publish-button></publish-button></form>`;
-// RIGHT: bind the enclosing form too.
 html`<form action=${saveAll}><publish-button></publish-button></form>`;
 ```
 
-The component renders its own template in a separate pass with no view of the host page, so the renderer sees a cannot-tell and binds anyway (refusing would drop an isolated component from a page that still returned 200, which is worse). What ships is a button carrying the reserved `__webjs_action` identity inside whatever form the page wrote. Whether that is broken depends on the form, and the distinction is easy to miss: one that still sends a parseable POST body WORKS, because the identity rides the button's own `name`/`value` pair into the body and the dispatcher runs the action. One with no `method` (or `method="get"`) submits a GET, so the identity rides the QUERY STRING, the action never runs, the page re-renders, the status is 200, and there is no throw, no log, and no 405. A silent write path is the whole failure mode, so treat the address bar growing a `?__webjs_action=` as the fingerprint.
+The renderer supplies the submission attributes at the level where the action is BOUND (#1307), so a bound `<button>` gains `formmethod="post"` and `formenctype` ON THE BUTTON, alongside the reserved `__webjs_action` identity riding the button's own `name`/`value` pair. A submitter's `formmethod` overrides the form's `method` per HTML, so the submission is a POST whatever the enclosing form declares, including no `method` at all or `method="get"`, and the identity travels in the body where the dispatcher reads it.
 
-**Two runtime signals back the check up.** In dev, submitting a form that carries an action identity it cannot deliver logs one `console.error` naming the fix, once per shape; it never throws, so the submission behaves exactly as it does in production. In production, both server-visible fingerprints reach the `onError` hook (the programmatic `createRequestHandler({ onError })` option and any sink an `instrumentation.{js,ts}` installed) with a code to group on: `WEBJS_FORM_SUBMITTED_AS_GET` for a page GET carrying the reserved field in its query string, and `WEBJS_FORM_ACTION_MISSING` for a form body carrying no identity at all. Both are detect-only, so no status changes, and both carry the submitted field NAMES and never the values.
+That is also why the renderer refuses only a SAME-ELEMENT contradiction (a bound submitter's own `formmethod` other than post, an `formenctype` the server cannot parse, `formmethod="dialog"`) and never a cross-element one. A component renders its template in a separate pass with no view of the host page, so the cross-element question is unanswerable at render time, and self-sufficiency leaves nothing for it to answer. One consequence: no `formaction` url is emitted, so the submission targets whatever the FORM targets, and a form declaring `action="/x"` sends its buttons there. The action still runs when `/x` is a PAGE route, since the identity travels in the body; against a `route.ts` or another origin nothing runs, which the dev-time client guard reports at submit time.
 
-**Run `webjs check` and it catches this for you.** The `submitter-needs-bound-form` rule reads every template in the app at once, which neither renderer can do, so it resolves the enclosing form across module boundaries and transitively through intermediate components (a page's form around `<todo-list>` around `<todo-row>` around the button). It is conservative by design and says nothing when it cannot be sure: a tag rendered in a bound form somewhere and an unbound one elsewhere, a tag whose host form is unbound but still DELIVERS (that shape works), a form whose `method` or `enctype` comes from a hole, a tag with no call site in the app, a submitter in a bare `html` helper rather than a component class body, a file registering more than one tag, a file that opens a form of its own, a submitter or tag handed to another element through a start-tag hole (`<my-thing .tpl=${html`…`}>`), a `formaction` hole that is not a proven action binding (a url string or CONSTANT, a factory-produced export, a namespace or default import, a barrel re-export, or a non-identifier expression like `acts.publishDraft`), or a reference cycle. The one start-tag hole it DOES judge is `<webjs-suspense .fallback=${html`…`}>`, because the renderer renders a fallback inline in the enclosing form rather than handing it off. Silence from the rule is therefore not proof the form is bound; a green check plus the shape above still deserves a look.
+**Two runtime signals cover what is left.** In dev, submitting a form that carries an action identity it cannot deliver logs one `console.error` naming the fix, once per shape; it never throws, so the submission behaves exactly as it does in production. In production, both server-visible fingerprints reach the `onError` hook (the programmatic `createRequestHandler({ onError })` option and any sink an `instrumentation.{js,ts}` installed) with a code to group on: `WEBJS_FORM_SUBMITTED_AS_GET` for a page GET carrying the reserved field in its query string, and `WEBJS_FORM_ACTION_MISSING` for a form body carrying no identity at all. Since a bound submitter carries its own `formmethod="post"`, what reaches the first one is an explicit `formmethod="get"` or `method="get"` an author wrote on a PLAIN submitter and the renderer deliberately honours, or a hand-written form. Both are detect-only, so no status changes, and both carry the submitted field NAMES and never the values.
 
 **Inside a component you may never see the error.** Per-component SSR error isolation contains the throw, so development shows an error box in place of the component and production renders it empty with the page still returning 200. A form that has silently vanished in production is this bug wearing a disguise; the message is in the server log. Nothing leaks either way.
 
diff --git a/packages/server/src/check.js b/packages/server/src/check.js
index 98f67dbb2..ceaaba3cf 100644
--- a/packages/server/src/check.js
+++ b/packages/server/src/check.js
@@ -9,7 +9,6 @@ import {
   matchClosingParenthesis,
   parsePropEntries,
   classifyActionHole,
-  scanHtmlFormScopes,
 } from './js-scan.js';
 import { buildModuleGraph, transitiveDeps, resolveImport } from './module-graph.js';
 import { scanComponents, extractComponents } from './component-scanner.js';
@@ -143,11 +142,6 @@ export const RULES = [
     description:
       'Flags `<form action=${someAction}>` bound to a `\'use server\'` action whose file declares `export const method = \'GET\'` (#488). A GET action is a READ: it is CSRF-exempt and rides its arguments in the url, while a form submission is a CSRF-checked POST carrying a body, so the two contracts contradict each other and the submission is answered with a 405 at runtime. The rule reads the imported action\'s own file, so it only fires when the binding really does resolve to a GET-declared action. Fix by dropping the `method` export (an action with no `method` is a POST, which is what a form wants) or by binding a different action; if the form really is a read, use a plain `<form method="get" action="/search">` with no bound action.',
   },
-  {
-    name: 'submitter-needs-bound-form',
-    description:
-      'Flags a `<button formaction=${action}>` submitter (#1207) that a whole-app scan proves sits in a `<form>` which binds no action AND cannot carry the submitter\'s identity to the server. Those are two separate questions and only both together are a defect. An unbound `<form method="post">` still WORKS, because a submitter\'s identity rides its own `name`/`value` pair, which the browser submits for the pressed button alone, and the dispatcher takes the last `__webjs_action` entry it finds. What breaks is an unbound form that sends nothing readable: no `method` at all or `method="get"` (a GET carries the identity in the QUERY STRING, so the action never runs and the page simply re-renders with a 200, silently), or an enctype the server cannot parse (a 405). The renderers cannot catch the cross-module case alone. SSR reads one template at a time and a COMPONENT renders its own template in a separate pass with no view of the host page, so a submitter in a component is a cannot-tell, and cannot-tell has to bind (refusing there would drop an isolated component from a page that still returned 200). This rule has neither limit: it reads every template in the app at once. Deliberately conservative so it can never false-positive. A submitter whose enclosing form is UNBOUND in the SAME scan is flagged whatever its method, because the renderer refuses that shape outright. Across modules, a submitter with no enclosing form in its own scan is attributed to a component only when its file registers exactly one tag, declares exactly one WebComponent class, holds the submitter inside that class body, and opens no `<form>` of its own; every other shape (a bare `html` helper, a multi-component file, a file that could splice a fragment into its own form, a `formaction` hole that is not a PROVEN action binding (the scan is lexical while the renderer binds only a FUNCTION, so a url string, a url constant exported from a `.server` module, a factory-produced export, a namespace or default import, a barrel re-export, and any non-identifier expression are all left alone, which misses some real bindings but never misreports a working form), and a submitter or tag handed off in a START-TAG hole, which some other element receives and places, the one exception being `<webjs-suspense .fallback=${…}>`, which the renderer renders inline in the enclosing form and which IS therefore judged) is UNKNOWABLE and never flagged, because a fragment renders inside the CALLER\'s scan and inherits the caller\'s form scope. An attributed tag is then resolved across every call site, recursively and memoized: any call site that is bound, that is unbound but still delivering, that is unknowable, that has dynamic `method`/`enctype`, or that is part of a cycle makes the verdict unknowable, and a tag with no call site at all is unknowable too. The rule fires only when at least one call site exists and EVERY one places the tag in a form that cannot deliver. Fix by binding the enclosing form (`<form action=${formAction}>`), which is what supplies `method="post"` and the enctype at form start, too late to add from the button.',
-  },
   {
     name: 'no-redirect-in-api-route',
     description:
@@ -1408,8 +1402,7 @@ export async function checkConventions(appDir) {
         // (#1155) and `formaction=` on a `<button>` / `<input>` submitter
         // (#1207) each put the named action behind a form submission, and a
         // GET-declared action cannot serve either. `classifyActionHole` owns
-        // the tag-and-attribute pairing (js-scan.js), shared with
-        // `submitter-needs-bound-form`.
+        // the tag-and-attribute pairing (js-scan.js).
         const bound = new Set();
         for (const m of redacted.matchAll(/__STR_(\d+)__\$\{\s*([A-Za-z_$][\w$]*)\s*\}/g)) {
           if (!classifyActionHole(literals[Number(m[1])] || '')) continue;
@@ -1451,455 +1444,9 @@ export async function checkConventions(appDir) {
     }
   }
 
-  // --- Rule: submitter-needs-bound-form (#1307) ---
-  // A submitter bound in a component whose host form is unbound posts nowhere:
-  // the form defaults to GET, the identity rides the query string, and the page
-  // re-renders with the action never having run. Neither renderer can see it
-  // (each judges one template scan), so the whole-app scan is the only place
-  // the answer exists.
-  checkSubmitterNeedsBoundForm(files, violations, appDir);
-
   return violations;
 }
 
-/**
- * Implements `submitter-needs-bound-form` (#1307). Factored out because it is
- * whole-app: a submitter's enclosing form can live in a different module, so the
- * verdict is a fixed point over every template in the app rather than a
- * per-file scan.
- *
- * The tag-to-owner map comes from `extractComponents` over the `files` array the
- * caller has already read, so there is no second directory walk. It does take
- * `appDir`, because deciding whether a `formaction` hole is a real action
- * binding means resolving the import to its target module and checking the
- * export is callable; `resolveImport` needs the app root for that.
- *
- * @param {{ abs: string, rel: string, content: string, scan: string }[]} files
- * @param {Violation[]} violations appended to in place
- * @param {string} appDir
- */
-function checkSubmitterNeedsBoundForm(files, violations, appDir) {
-  /**
-   * The FIX line is identical for every shape this rule reports, so it is
-   * written once.
-   */
-  const FIX = 'Bind the enclosing <form> too (`<form action=${formAction}>`), which is what supplies method="post" and the enctype at form start. A per-button action cannot retrofit them.';
-  /**
-   * Mirrors `scanComponents`'s own filter: a fixture or a spec in an app tree
-   * must not claim a tag, and a `.server.` module never renders to a browser.
-   * @param {string} rel
-   */
-  const isAppTemplateFile = (rel) =>
-    /\.m?[jt]sx?$/.test(rel)
-    && !/\.(test|spec)\.m?[jt]sx?$/.test(rel)
-    && !/\.server\.m?[jt]s$/.test(rel);
-
-  /** Every scanned file by absolute path, for resolving an import's target. */
-  const byAbs = new Map(files.map((f) => [f.abs, f]));
-
-  /**
-   * Is `name` exported from `scan` as something PROVABLY callable?
-   *
-   * The bias is the opposite of the sibling `'use server'` rules, and
-   * deliberately so. Those tolerate a false NEGATIVE, so anything ambiguous
-   * counts as possibly-callable. Here an ambiguous export firing the rule is a
-   * false POSITIVE on working code, so only a shape that must be a function
-   * counts: a function declaration, or a const bound to an arrow or a function
-   * expression. `export const ARCHIVE_URL = '/api/x'` is NOT callable, and a
-   * factory (`export const go = cache(fn)`) is not PROVABLE, so both stay
-   * silent.
-   *
-   * @param {string} scan fully-blanked view of the target module
-   * @param {string} name
-   * @returns {boolean}
-   */
-  const exportsCallable = (scan, name) => {
-    const n = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    // `export [async] function NAME`.
-    if (new RegExp(`\\bexport\\s+(?:async\\s+)?function\\s+${n}\\b`).test(scan)) return true;
-    // A local declaration surfaced by a clause: `function NAME(){}; export { NAME }`.
-    // Only a clause with NO `from`, since a re-export would need another hop to
-    // the module that actually declares it.
-    const reClause = /\bexport\s*\{([^}]*)\}/g;
-    let cl;
-    while ((cl = reClause.exec(scan))) {
-      // A re-export needs another hop to the module that DECLARES the name, so
-      // it stays unknowable. Tested on the text after the clause rather than
-      // with a lookahead: `\s*(?!from)` can never reject, because `\s*`
-      // backtracks to zero width and the lookahead then reads the whitespace.
-      if (/^\s*from\b/.test(scan.slice(cl.index + cl[0].length))) continue;
-      const exported = cl[1].split(',').some((part) => {
-        const m = /([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?/.exec(part.trim());
-        return !!m && (m[2] || m[1]) === name;
-      });
-      if (!exported) continue;
-      const local = cl[1].split(',').map((part) => /([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?/.exec(part.trim()))
-        .filter((m) => m && (m[2] || m[1]) === name).map((m) => m[1])[0];
-      if (local && declaresCallable(scan, local)) return true;
-    }
-    return declaresCallable(scan, name, true);
-  };
-
-  /**
-   * Index just past the assignment `=` that follows a `const NAME`, or -1.
-   *
-   * A TypeScript annotation can itself contain `=>`
-   * (`const publishDraft: (fd: FormData) => Promise<void> = async (fd) => …`),
-   * which is the idiomatic spelling this repo's derive-the-type rule pushes
-   * authors toward. Skipping the annotation with a lazy regex group stopped at
-   * the FIRST `=`, which is the one inside the annotation's own arrow, so the
-   * scan resumed on `>` and every branch failed. Walking it with bracket depth
-   * and stepping over `=>` finds the real assignment.
-   *
-   * @param {string} scan
-   * @param {number} i index just after the declared name
-   * @returns {number}
-   */
-  function assignmentAfter(scan, i) {
-    let depth = 0;
-    while (i < scan.length) {
-      const c = scan[i];
-      // A `;` ENDS the declaration only at depth zero. TypeScript's canonical
-      // member separator is `;`, so an inline object type
-      // (`: ActionFn<{ id: string; title: string }>`) carries one INSIDE its
-      // brackets, and bailing there dropped the binding.
-      if (c === ';' && depth <= 0) return -1;
-      if (c === '=' && scan[i + 1] === '>') { i += 2; continue; }   // arrow in the annotation
-      if (c === '(' || c === '[' || c === '{' || c === '<') { depth++; i++; continue; }
-      if (c === ')' || c === ']' || c === '}' || c === '>') { depth--; i++; continue; }
-      // Reject `==` and `!=`, but NOT a preceding `<` or `>`: in annotation
-      // position those are brackets this same loop already consumed as such, so
-      // reading `Promise<void>=` as a `>=` comparison classified one character
-      // two contradictory ways.
-      //
-      // Two separate guards share this line, and only one of them is
-      // unpinnable. `depth <= 0` is live and reachable: a DEFAULT type
-      // parameter (`: <T = FormData>(fd: T) => …`) puts a bare `=` inside the
-      // annotation's brackets, and without the depth check that `=` is returned
-      // as the assignment. A row pins it.
-      //
-      // The `==` / `!=` rejection is the unpinnable half: no valid TypeScript
-      // puts a comparison between a declared name and its assignment, so no
-      // test can reach it. It is here because the input is a MASK of arbitrary
-      // source, which may be mid-edit and not valid at all.
-      //
-      // Do NOT restate here how many guards in this resolver are pinned. Two
-      // successive commits asserted an exact count and both were wrong within
-      // one commit of being written, because the count decays the moment
-      // anyone adds a guard. The durable statement is the rule, not the
-      // tally: a new guard needs a row in `submitter-needs-bound-form.test.js`
-      // that FAILS when the guard is broken, verified by breaking it.
-      if (depth <= 0 && c === '=' && scan[i + 1] !== '=' && !'=!'.includes(scan[i - 1] || '')) return i + 1;
-      i++;
-    }
-    return -1;
-  }
-
-  /**
-   * Is `name` DECLARED as something provably callable in `scan`?
-   *
-   * The arrow case must see the `=>`. An earlier version accepted a bare `(`
-   * after the `=`, which proves a parenthesized EXPRESSION and not a callable,
-   * so `export const ARCHIVE_URL = ('/api/x')` and the ordinary env-fallback
-   * spelling `= (process.env.X || '/api/x')` were read as actions. That is the
-   * exact false positive this whole resolver exists to prevent.
-   *
-   * @param {string} scan
-   * @param {string} name
-   * @param {boolean} [exported] require the declaration to carry `export`
-   * @returns {boolean}
-   */
-  function declaresCallable(scan, name, exported = false) {
-    const n = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    const lead = exported ? '\\bexport\\s+' : '\\b';
-    if (!exported && new RegExp(`\\bfunction\\s+${n}\\b`).test(scan)) return true;
-    const re = new RegExp(`${lead}(?:const|let|var)\\s+${n}\\b`, 'g');
-    let m;
-    while ((m = re.exec(scan))) {
-      let i = assignmentAfter(scan, m.index + m[0].length);
-      if (i === -1) continue;
-      const skipWs = () => { while (i < scan.length && /\s/.test(scan[i])) i++; };
-      skipWs();
-      if (scan.startsWith('async', i) && /[\s(<]/.test(scan[i + 5] || '')) { i += 5; skipWs(); }
-      // `= [async] function ...`
-      if (/^function\b/.test(scan.slice(i, i + 9))) return true;
-      // `= [async] [<T>](params)[: ReturnType] => ...`, which must actually reach
-      // the arrow. Both the type-parameter list and the return type are optional
-      // and can carry their own brackets, so each is walked with depth rather
-      // than matched.
-      if (scan[i] === '<') {
-        let d2 = 0;
-        while (i < scan.length) {
-          const c = scan[i];
-          if (c === '=' && scan[i + 1] === '>') { i += 2; continue; }
-          if (c === '<') d2++;
-          else if (c === '>') { d2--; if (d2 <= 0) { i++; break; } }
-          i++;
-        }
-        skipWs();
-      }
-      if (scan[i] === '(') {
-        const close = matchClosingParenthesis(scan, i + 1);
-        if (close === -1) continue;
-        i = close + 1;
-        skipWs();
-        if (scan[i] === ':') {
-          let depth = 0;
-          i++;
-          while (i < scan.length) {
-            const c = scan[i];
-            // Depth-guarded, exactly like the declaration-side walk. A return
-            // type carries both separators INSIDE its brackets:
-            // `Promise<Record<string, string>>` is the `fieldErrors` shape the
-            // ActionResult envelope pushes authors toward, and an inline object
-            // return type uses `;`.
-            if ((c === ';' || c === ',') && depth <= 0) break;
-            // An arrow at depth zero ENDS the return type; a nested one is part
-            // of it and must be stepped over whole, or its `>` is eaten by the
-            // closer branch below and the depth skews. That is the same
-            // any-depth step the declaration walk makes.
-            if (c === '=' && scan[i + 1] === '>') {
-              if (depth <= 0) break;
-              i += 2;
-              continue;
-            }
-            if (c === '(' || c === '[' || c === '{' || c === '<') depth++;
-            else if (c === ')' || c === ']' || c === '}' || c === '>') depth--;
-            i++;
-          }
-          skipWs();
-        }
-        if (scan.startsWith('=>', i)) return true;
-        continue;
-      }
-      // `= [async] param => ...`, the single-parameter arrow with no parens.
-      const id = /^[A-Za-z_$][\w$]*/.exec(scan.slice(i));
-      if (id) {
-        i += id[0].length;
-        skipWs();
-        if (scan.startsWith('=>', i)) return true;
-      }
-    }
-    return false;
-  }
-
-  /**
-   * Local names this file imports from a `.server.{js,ts}` module AND that the
-   * target really exports as a callable.
-   *
-   * The scan is LEXICAL, but the renderer binds only when the hole's value is a
-   * FUNCTION (`isBoundFormAction` in `form-action.js`), so `formaction=${'/api/'
-   * + id}` on a plain progressive-enhancement form, and equally a url CONSTANT
-   * exported from a `.server.ts` module, are ordinary url attributes that render
-   * and ship fine. Treating either as a binding reports a working form as
-   * broken.
-   *
-   * Only a plain named import is resolved. A namespace import
-   * (`import * as acts`), a default import, a barrel re-export, and any
-   * non-identifier expression (a member access, `this.act`) are all left
-   * UNKNOWABLE and therefore silent: they are real bindings the rule then
-   * misses, which is the safe direction and is listed with the rule's other
-   * silences.
-   *
-   * @param {string} content
-   * @param {string} abs
-   * @returns {Set<string>}
-   */
-  const serverImportedNames = (content, abs) => {
-    /** @type {Set<string>} */
-    const names = new Set();
-    const { redacted, literals } = redactToPlaceholders(content);
-    const reImport = /\bimport\s+([^'";]*?)\bfrom\s*(['"])/g;
-    let im;
-    while ((im = reImport.exec(redacted))) {
-      const tok = /__STR_(\d+)__/.exec(redacted.slice(reImport.lastIndex, reImport.lastIndex + 24));
-      if (!tok) continue;
-      const spec = literals[Number(tok[1])] || '';
-      if (!/\.server\.m?[jt]s$/.test(spec)) continue;
-      const target = resolveImport(spec, abs, appDir);
-      const targetFile = target ? byAbs.get(target) : null;
-      if (!targetFile) continue;   // unresolvable: unknowable, so silent
-      const targetScan = redactStringsAndTemplates(targetFile.content, true);
-      for (const { local, imported } of importedLocalNames(im[1])) {
-        if (exportsCallable(targetScan, imported)) names.add(local);
-      }
-    }
-    return names;
-  };
-
-  /** @type {{ rel: string, fileSites: ReturnType<typeof scanHtmlFormScopes>, ownerTag: string | null, bodySites: ReturnType<typeof scanHtmlFormScopes> | null }[]} */
-  const scanned = [];
-  for (const { abs, rel, content, scan } of files) {
-    if (!isAppTemplateFile(rel)) continue;
-    // Cheap bail: a file with neither a submitter binding nor a hyphenated tag
-    // can contribute neither a violation nor a call site.
-    if (!/formaction/i.test(content) && !/<[A-Za-z][A-Za-z0-9]*-/.test(content)) continue;
-    const fileSites = scanHtmlFormScopes(content);
-    if (!fileSites.submitters.length && !fileSites.tagUses.length) continue;
-    // Keep only the submitter holes that really bind an action. A `formaction`
-    // hole holding a url string is an ordinary attribute the renderer ships.
-    const bound = serverImportedNames(content, abs);
-    const isActionBinding = (site) => !!site.expr && /^[A-Za-z_$][\w$]*$/.test(site.expr) && bound.has(site.expr);
-    fileSites.submitters = fileSites.submitters.filter(isActionBinding);
-    // ATTRIBUTABLE: exactly one registered tag and exactly one WebComponent
-    // class, so a cannot-tell submitter in that class body belongs to that tag
-    // with no ambiguity. Anything else stays unknowable.
-    //
-    // The class body is located in the MASK and sliced out of the RAW source at
-    // the same offsets. The mask is position-preserving, and it is what every
-    // other `extractWebComponentClassBodies` caller passes, so the brace matcher
-    // is never asked to lex raw source (where an unlexed regex literal such as
-    // `static re = /[{]/` would truncate or lose the body, silently dropping
-    // this rule's cross-module half for that file). Slicing `content` then gives
-    // the body with its templates intact, which is what the scan needs.
-    const tags = new Set(extractComponents(content).map((c) => c.tag));
-    const bodies = extractWebComponentClassBodies(scan);
-    let ownerTag = null;
-    /** @type {ReturnType<typeof scanHtmlFormScopes> | null} */
-    let bodySites = null;
-    if (tags.size === 1 && bodies.length === 1) {
-      ownerTag = /** @type {string} */ ([...tags][0]);
-      bodySites = scanHtmlFormScopes(content.slice(bodies[0].bodyStart, bodies[0].bodyEnd));
-      bodySites.submitters = bodySites.submitters.filter(isActionBinding);
-    }
-    scanned.push({ rel, fileSites, ownerTag, bodySites });
-  }
-  if (!scanned.length) return;
-
-  // Every call site of every tag, as a scope. A 'none' site needs attribution
-  // before it means anything, so it is recorded with the component that renders
-  // it (or as unknowable when no single component owns it).
-  /** @type {Map<string, Array<{ scope: import('./js-scan.js').FormScope, delivers: boolean | null, via: string | null }>>} */
-  const callSites = new Map();
-  for (const { fileSites, ownerTag, bodySites } of scanned) {
-    // A 'none' use is attributed to this file's component ONLY when the
-    // class-body scan saw it too. One found only in the whole-file scan came
-    // from a bare `html` helper, which is rendered inside the CALLER's scan and
-    // inherits the caller's form scope, so it is unknowable.
-    //
-    // And only when this file opens NO form of its own, ANYWHERE. A fragment
-    // built into a local (`const rows = html`<todo-row>`;`) and spliced into a
-    // form the same file opens (`html`<form action=${save}>${rows}</form>``)
-    // inherits the SPLICE point's scope, not this component's call-site scope,
-    // and the two templates are separate scans so nothing here can tell them
-    // apart. That is the same reasoning the submitter half already applies to a
-    // bare helper.
-    //
-    // The test is the WHOLE-FILE scan, not the class body: a module-scope
-    // helper (`const shell = (inner) => html`<form action=${save}>${inner}</form>``)
-    // opens a form the class body never sees, and splicing into that is the same
-    // hole.
-    const attributable = ownerTag && bodySites && !fileSites.opensForm ? ownerTag : null;
-    /** @type {Map<string, number>} */
-    const bodyNoneByTag = new Map();
-    for (const u of attributable && bodySites ? bodySites.tagUses : []) {
-      if (u.scope !== 'none') continue;
-      bodyNoneByTag.set(u.tag, (bodyNoneByTag.get(u.tag) || 0) + 1);
-    }
-    for (const u of fileSites.tagUses) {
-      let via = null;
-      if (u.scope === 'none') {
-        const left = bodyNoneByTag.get(u.tag) || 0;
-        if (attributable && left > 0) {
-          bodyNoneByTag.set(u.tag, left - 1);
-          via = attributable;
-        }
-      }
-      const list = callSites.get(u.tag) || [];
-      list.push({ scope: u.scope, delivers: u.delivers, via });
-      callSites.set(u.tag, list);
-    }
-  }
-
-  /** @type {Map<string, 'undeliverable' | 'unknowable'>} */
-  const verdicts = new Map();
-  /** @type {Set<string>} */
-  const inProgress = new Set();
-  /**
-   * Does EVERY place this tag is rendered put it in a form that CANNOT deliver
-   * a submitter's action?
-   *
-   * The delivery question is what decides whether the shape is broken, and it is
-   * not the same as boundness. An unbound `<form method="post">` still carries a
-   * submitter's own `name`/`value` pair to the server, so the identity arrives
-   * and the action RUNS. What breaks is a form that sends nothing the server can
-   * read: no `method` (a GET, so the identity rides the query string), an
-   * explicit `method="get"`, or an enctype the server cannot parse. So a call
-   * site inside an unbound-but-delivering form is NOT a defect, and it makes the
-   * verdict unknowable like any other non-defect site.
-   *
-   * One delivering call site, one bound call site, one unknowable call site, a
-   * cycle, or no call site at all all answer `'unknowable'`, which is silent.
-   *
-   * The scope tests below are EXACT `'none'` on purpose. A `'handed'` site (a
-   * template sitting in a start-tag hole, so some other element received it and
-   * places it) must fall through to `'unknowable'`, and it does so only because
-   * nothing here treats it as a cannot-tell. Loosening these to a catch-all
-   * would resolve a handed-off template through this component's call sites,
-   * which is the wrong component's answer.
-   *
-   * @param {string} tag
-   * @returns {'undeliverable' | 'unknowable'}
-   */
-  function resolveTagScope(tag) {
-    const memo = verdicts.get(tag);
-    if (memo) return memo;
-    // A cycle teaches nothing about the host page, so it cannot be a verdict.
-    // Not memoized: the same tag may resolve conclusively on another path.
-    if (inProgress.has(tag)) return 'unknowable';
-    const sites = callSites.get(tag) || [];
-    if (!sites.length) {
-      // A tag no app template renders may still be rendered by markup this scan
-      // cannot see.
-      verdicts.set(tag, 'unknowable');
-      return 'unknowable';
-    }
-    inProgress.add(tag);
-    /** @type {'undeliverable' | 'unknowable'} */
-    let verdict = 'undeliverable';
-    for (const site of sites) {
-      if (site.scope === 'unbound' && site.delivers === false) continue;
-      if (site.scope === 'none' && site.via && resolveTagScope(site.via) === 'undeliverable') continue;
-      verdict = 'unknowable';
-      break;
-    }
-    inProgress.delete(tag);
-    verdicts.set(tag, verdict);
-    return verdict;
-  }
-
-  for (const { rel, fileSites, ownerTag, bodySites } of scanned) {
-    // The same-scan case: the form and the submitter are both in this template,
-    // so the answer needs no cross-module step. The renderer refuses this shape
-    // too, but only if that branch actually renders.
-    for (const s of fileSites.submitters) {
-      if (s.scope !== 'unbound') continue;
-      violations.push({
-        rule: 'submitter-needs-bound-form',
-        file: rel,
-        message: `Binds an action with \`formaction=\${…}\` on a <${s.tag}>, but the enclosing <form> in the SAME template carries no \`action=\${action}\` binding. Wherever the renderer sees both halves in one pass it refuses this shape outright, so the page throws at render rather than shipping it.`,
-        fix: FIX,
-      });
-    }
-    // The SAME `opensForm` guard the tag half uses, and for the same reason: a
-    // submitter fragment built into a local and spliced into a form this file
-    // opens is inside that form, not at the component's call site. The rule
-    // description states this condition, so the code has to hold it.
-    if (!ownerTag || !bodySites || fileSites.opensForm) continue;
-    const cannotTell = bodySites.submitters.filter((s) => s.scope === 'none');
-    if (!cannotTell.length) continue;
-    if (resolveTagScope(ownerTag) !== 'undeliverable') continue;
-    for (const s of cannotTell) {
-      violations.push({
-        rule: 'submitter-needs-bound-form',
-        file: rel,
-        message: `Binds an action with \`formaction=\${…}\` on a <${s.tag}>, but every place <${ownerTag}> is rendered puts it in a <form> that binds no action AND cannot carry the identity to the server (no \`method="post"\`, or an enctype the server cannot parse). Nothing throws: the submission goes out as a GET with the identity in the query string, the action never runs, and the page simply re-renders with a 200.`,
-        fix: FIX,
-      });
-    }
-  }
-}
-
 /**
  * BFS the module graph for the shortest import path from `from` to `to`,
  * returning every hop `[from, ..., to]` so the `no-server-import-in-browser-module`
diff --git a/packages/server/test/check/submitter-needs-bound-form.test.js b/packages/server/test/check/submitter-needs-bound-form.test.js
deleted file mode 100644
index 7b27bd165..000000000
--- a/packages/server/test/check/submitter-needs-bound-form.test.js
+++ /dev/null
@@ -1,716 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-
-import { checkConventions, RULES } from '../../src/check.js';
-
-/**
- * Tests for `submitter-needs-bound-form` (#1307): a `<button formaction=${fn}>`
- * whose enclosing `<form>` binds nothing posts nowhere. The form defaults to
- * GET, the reserved identity field rides the query string, and the page simply
- * re-renders with the action never having run.
- *
- * Neither renderer can catch the cross-module version of this: SSR reads one
- * template at a time and a component renders its own template in a separate
- * pass with no view of the host page, so it is a cannot-tell there and
- * cannot-tell has to bind. This rule reads every template in the app at once.
- *
- * The NON-firing cases matter more than the firing ones. The rule is
- * deliberately conservative: anything it cannot resolve conclusively stays
- * silent, because a false positive on an ordinary shape (a per-row button, a
- * button inside a component) would be worse than the bug it catches.
- */
-const RULE = 'submitter-needs-bound-form';
-
-/**
- * The action modules the fixtures import. Real files, because the rule resolves
- * the binding to its target and requires a provably callable export: a hole
- * naming a url CONSTANT is not a binding, so an unresolvable or non-callable
- * import is correctly silent and a fixture without these would prove nothing.
- */
-const ACTIONS = {
-  // The `#` root alias is Node's `package.json` "imports" field, so the rule
-  // cannot resolve a `#modules/...` specifier without it. A scaffolded app
-  // always ships this catch-all.
-  'package.json': JSON.stringify({ name: 'fixture', imports: { '#*': './*' } }),
-  'modules/feedback/actions/publish.server.ts': `'use server';
-export async function publishDraft(formData) { return { success: true, got: formData }; }
-`,
-  'modules/feedback/actions/save.server.ts': `'use server';
-export async function saveAll(formData) { return { success: true, got: formData }; }
-`,
-};
-
-async function makeApp(files) {
-  const dir = await mkdtemp(join(tmpdir(), 'webjs-submitter-bound-'));
-  for (const [rel, contents] of Object.entries({ ...ACTIONS, ...files })) {
-    const abs = join(dir, rel);
-    await mkdir(abs.slice(0, abs.lastIndexOf('/')), { recursive: true });
-    await writeFile(abs, contents);
-  }
-  return dir;
-}
-const hits = (v) => v.filter((x) => x.rule === RULE);
-
-/** A one-tag, one-class component file holding the bound submitter. */
-const rowBtn = (extra = '') => `import { html, WebComponent } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-class RowBtn extends WebComponent({}) {
-  render() {
-    return html\`<button formaction=\${publishDraft}>Publish</button>\`;
-  }
-}
-RowBtn.register('row-btn');
-${extra}`;
-
-const TODO_LIST = `import { html, WebComponent } from '@webjsdev/core';
-class TodoList extends WebComponent({}) {
-  render() { return html\`<ul><todo-row></todo-row></ul>\`; }
-}
-TodoList.register('todo-list');
-`;
-const TODO_ROW = `import { html, WebComponent } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-class TodoRow extends WebComponent({}) {
-  render() { return html\`<li><button formaction=\${publishDraft}>Publish</button></li>\`; }
-}
-TodoRow.register('todo-row');
-`;
-
-test('the rule is registered', () => {
-  assert.ok(RULES.some((r) => r.name === RULE), 'RULES lists submitter-needs-bound-form');
-});
-
-test('flags a component submitter whose only call site is an unbound form', async () => {
-  const dir = await makeApp({
-    'components/row-btn.ts': rowBtn(),
-    'app/page.ts': `import { html } from '@webjsdev/core';
-import '#components/row-btn.ts';
-export default () => html\`<form><row-btn></row-btn></form>\`;
-`,
-  });
-  const v = hits(await checkConventions(dir));
-  assert.equal(v.length, 1, 'exactly one violation');
-  assert.match(v[0].file, /row-btn\.ts/);
-  assert.match(v[0].message, /<row-btn> is rendered/);
-  assert.match(v[0].fix, /<form action=/);
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent when the call site binds the form', async () => {
-  const dir = await makeApp({
-    'components/row-btn.ts': rowBtn(),
-    'app/page.ts': `import { html } from '@webjsdev/core';
-import { saveAll } from '#modules/feedback/actions/save.server.ts';
-export default () => html\`<form action=\${saveAll}><row-btn></row-btn></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), []);
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent when one call site is bound and another is not', async () => {
-  const dir = await makeApp({
-    'components/row-btn.ts': rowBtn(),
-    'app/a/page.ts': `import { html } from '@webjsdev/core';
-import { saveAll } from '#modules/feedback/actions/save.server.ts';
-export default () => html\`<form action=\${saveAll}><row-btn></row-btn></form>\`;
-`,
-    'app/b/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`<form><row-btn></row-btn></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), [], 'a mixed tag is indefinite');
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent when the unbound host form still DELIVERS the identity (method=post)', async () => {
-  // The distinction the rule turns on, and the one that is easy to get wrong.
-  // An unbound `<form method="post">` WORKS across a module boundary: the
-  // cannot-tell fallback binds the submitter, the submitter's own name/value
-  // pair carries `__webjs_action` into the POST body, and the dispatcher takes
-  // the last entry it finds. Flagging it would be a false positive on working
-  // code, with a diagnosis (a GET, a query string) that never happens.
-  const dir = await makeApp({
-    'components/row-btn.ts': rowBtn(),
-    'app/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`<form method="post"><row-btn></row-btn></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), [], 'an unbound POST form delivers, so nothing is broken');
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('fires when the unbound host form cannot deliver (method=get, or a bad enctype)', async () => {
-  // The other side of the same coin: these really do lose the identity.
-  for (const form of ['<form method="get">', '<form method="post" enctype="text/plain">', '<form method=" post ">']) {
-    const dir = await makeApp({
-      'components/row-btn.ts': rowBtn(),
-      'app/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`${form}<row-btn></row-btn></form>\`;
-`,
-    });
-    const v = hits(await checkConventions(dir));
-    assert.equal(v.length, 1, `${form} cannot carry the identity`);
-    assert.match(v[0].message, /cannot carry the identity to the server/);
-    await rm(dir, { recursive: true, force: true });
-  }
-});
-
-test('silent when the host form method is a dynamic hole', async () => {
-  const dir = await makeApp({
-    'components/row-btn.ts': rowBtn(),
-    'app/page.ts': `import { html } from '@webjsdev/core';
-export default ({ m }) => html\`<form method=\${m}><row-btn></row-btn></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), [], 'a dynamic method is unknowable');
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent when the component could splice a fragment into a form it opens itself', async () => {
-  // A fragment built into a local and spliced into a form the SAME file opens
-  // inherits the splice point's scope, not this component's call-site scope,
-  // and the two templates are separate scans. Same reasoning the submitter half
-  // already applies to a bare helper.
-  const dir = await makeApp({
-    'components/todo-list.ts': `import { html, WebComponent } from '@webjsdev/core';
-class TodoList extends WebComponent({}) {
-  render() {
-    const rows = html\`<todo-row></todo-row>\`;
-    return html\`<form action=\${save}>\${rows}</form>\`;
-  }
-}
-TodoList.register('todo-list');
-`,
-    'components/todo-row.ts': TODO_ROW,
-    'app/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`<form><todo-list></todo-list></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), [], 'a file that opens its own form cannot attribute a none-scope use');
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('a regex literal in a component file does not silently disable the rule', async () => {
-  // The class body is located in the MASK and sliced out of the raw source at
-  // the same offsets, so the brace matcher never lexes raw source. Feeding it
-  // raw source made `static re = /[{]/` yield zero class bodies, which dropped
-  // the cross-module half for that file with no signal at all.
-  const dir = await makeApp({
-    'components/row-btn.ts': `import { html, WebComponent } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-class RowBtn extends WebComponent({}) {
-  static re = /[{]/;
-  render() { return html\`<button formaction=\${publishDraft}>Publish</button>\`; }
-}
-RowBtn.register('row-btn');
-`,
-    'app/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`<form><row-btn></row-btn></form>\`;
-`,
-  });
-  const v = hits(await checkConventions(dir));
-  assert.equal(v.length, 1, 'the rule still sees the class body');
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent when a module-scope helper in the component file opens a form', async () => {
-  // The guard is the WHOLE-FILE scan, not the class body: a helper outside the
-  // class can open a form the body never sees, and splicing into that is the
-  // same hole the class-body case has.
-  const dir = await makeApp({
-    'components/row-btn.ts': `import { html, WebComponent } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-const shell = (inner) => html\`<form action=\${save}>\${inner}</form>\`;
-class RowBtn extends WebComponent({}) {
-  render() { return shell(html\`<button formaction=\${publishDraft}>Publish</button>\`); }
-}
-RowBtn.register('row-btn');
-`,
-    'app/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`<form><row-btn></row-btn></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), [], 'the submitter may be spliced into the helper form');
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent on an unrecognised enctype, which falls back to a parseable body', async () => {
-  // `enctype` defaults to application/x-www-form-urlencoded for a missing AND an
-  // invalid value, so this form really does deliver.
-  const dir = await makeApp({
-    'components/row-btn.ts': rowBtn(),
-    'app/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`<form method="post" enctype="nonsense"><row-btn></row-btn></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), []);
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent when the submitter template is passed as a component PROPERTY', async () => {
-  // Lexically inside the form, but the scan cannot say where it lands. SSR
-  // renders nothing for it at all: the binding carries a function, so it fails
-  // to serialize and is dropped with a warning, and <my-thing> decides where the
-  // button goes at hydration. A conclusive verdict here was never this scan's
-  // to give.
-  const dir = await makeApp({
-    'app/page.ts': `import { html } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-export default () => html\`<form method="post"><my-thing .tpl=\${html\`<button formaction=\${publishDraft}>P</button>\`}></my-thing></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), []);
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent when a COMPONENT hands its submitter template to another element', async () => {
-  // The variant that matters most, and the one a page-only test misses. Marking
-  // the handed-off template 'none' silences it on a page and recreates the false
-  // positive here, because 'none' is exactly the value the cross-module half
-  // attributes to this file's own tag and resolves against ITS call sites.
-  // <my-thing> is what decides where the button lands.
-  const dir = await makeApp({
-    'components/row-btn.ts': `import { html, WebComponent } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-class RowBtn extends WebComponent({}) {
-  render() { return html\`<my-thing .tpl=\${html\`<button formaction=\${publishDraft}>P</button>\`}></my-thing>\`; }
-}
-RowBtn.register('row-btn');
-`,
-    'app/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`<form><row-btn></row-btn></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), [], 'the receiving element places the button');
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent when a component hands a TAG to another element', async () => {
-  // The same root cause on the tag half: <my-shell> places the row, so
-  // <todo-list>'s call sites say nothing about where <todo-row> renders.
-  const dir = await makeApp({
-    'components/todo-list.ts': `import { html, WebComponent } from '@webjsdev/core';
-class TodoList extends WebComponent({}) {
-  render() { return html\`<my-shell .rows=\${html\`<todo-row></todo-row>\`}></my-shell>\`; }
-}
-TodoList.register('todo-list');
-`,
-    'components/todo-row.ts': TODO_ROW,
-    'app/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`<form><todo-list></todo-list></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), [], 'a handed-off tag has no attributable call site');
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('a tag inside a suspense FALLBACK is a real call site, unlike an ordinary prop', async () => {
-  // The suspense carve-out changes the tag half too, and that half can create
-  // violations rather than only silence them, so it needs its own coverage. The
-  // fallback is rendered inline inside the enclosing form, so <todo-row> really
-  // does land there and the verdict is truthful.
-  const page = (host) => `import { html } from '@webjsdev/core';
-export default () => html\`<form>${host}</form>\`;
-`;
-  const fallback = await makeApp({
-    'components/todo-row.ts': TODO_ROW,
-    'app/page.ts': page('<webjs-suspense .fallback=\${html\`<todo-row></todo-row>\`}></webjs-suspense>'),
-  });
-  assert.equal(hits(await checkConventions(fallback)).length, 1, 'the fallback renders inline, so it is a call site');
-  await rm(fallback, { recursive: true, force: true });
-
-  // The same shape through an ordinary property is handed off and stays silent.
-  const handed = await makeApp({
-    'components/todo-row.ts': TODO_ROW,
-    'app/page.ts': page('<my-shell .rows=\${html\`<todo-row></todo-row>\`}></my-shell>'),
-  });
-  assert.deepEqual(hits(await checkConventions(handed)), [], 'my-shell decides where the row lands');
-  await rm(handed, { recursive: true, force: true });
-});
-
-test('silent on a formaction hole that is a URL, not an action', async () => {
-  // The scan is lexical; the RENDERER binds only when the hole's value is a
-  // FUNCTION (`isBoundFormAction`). So an ordinary progressive-enhancement form
-  // whose buttons post to different `route.ts` endpoints is not a binding at
-  // all, and reporting it was a false positive on working code.
-  for (const hole of ["\\${'/api/items/' + id + '/archive'}", "\\${'/api/x'}", '\\${localUrl}']) {
-    const dir = await makeApp({
-      'app/items/page.ts': `import { html } from '@webjsdev/core';
-const localUrl = '/api/x';
-export default ({ id }) => html\`<form method="post" action="/api/items"><button formaction=${hole}>Archive</button></form>\`;
-`,
-    });
-    assert.deepEqual(hits(await checkConventions(dir)), [], `${hole} is a url, not an action`);
-    await rm(dir, { recursive: true, force: true });
-  }
-});
-
-test('the callable matrix: every url shape silent, every function shape flagged', async () => {
-  // The whole table in one place, because two review rounds found defects here
-  // and both were a single spelling. The rule fires only on a PROVABLY callable
-  // export: an earlier version accepted a bare `(` after the `=`, which proves a
-  // parenthesized EXPRESSION, so the ordinary env-fallback url constant read as
-  // an action. A single-parameter arrow was the mirror error, silently dropping
-  // a real binding.
-  const cases = [
-    // [export source, should the rule fire]
-    ["export const publishDraft = '/api/x';", false],
-    ["export const publishDraft = ('/api/x');", false],
-    ["export const publishDraft = (process.env.X || '/api/x');", false],
-    ["export const publishDraft = (process.env.X ? '/a' : '/b');", false],
-    ['export const publishDraft = cache(async () => 1);', false],
-    ["const publishDraft = '/api/x';\nexport { publishDraft };", false],
-    ['export async function publishDraft(fd) { return 1; }', true],
-    ['export function publishDraft(fd) { return 1; }', true],
-    ['export const publishDraft = async (fd) => 1;', true],
-    ['export const publishDraft = async fd => 1;', true],
-    ['export const publishDraft = () => 1;', true],
-    ['export const publishDraft = async function (fd) { return 1; };', true],
-    ['async function publishDraft(fd) { return 1; }\nexport { publishDraft };', true],
-    // A TS annotation can contain its own `=>`, and this is the spelling the
-    // derive-the-type rule pushes authors toward. Skipping the annotation with a
-    // lazy regex stopped at the arrow's `=` and silently dropped the binding.
-    ['export const publishDraft: (fd: FormData) => Promise<number> = async (fd) => 1;', true],
-    ['export const publishDraft: (fd: FormData) => Promise<number> = async function (fd) { return 1; };', true],
-    ['export const publishDraft: ActionFn = async (fd) => 1;', true],
-    // A RETURN-type annotation on the arrow, which is at least as common as the
-    // declaration-side one and was silent until it had its own rows.
-    ['export const publishDraft = async (fd: FormData): Promise<number> => 1;', true],
-    ['export const publishDraft = async (fd): Promise<number> => 1;', true],
-    ['export const publishDraft = (fd: FormData): number => 1;', true],
-    ['export const publishDraft = async (fd: FormData): Promise<ActionResult<Draft>> => 1;', true],
-    // ...and the annotated NON-callable must still be silent.
-    ["export const publishDraft: string = (process.env.X || '/api/x');", false],
-    ["export const publishDraft: string = '/api/x';", false],
-    // An inline object type carries TypeScript's canonical `;` member
-    // separator INSIDE the annotation's brackets, and a generic can close
-    // immediately before the `=`. Both were read as end-of-declaration.
-    ['export const publishDraft: ActionFn<{ id: string; title: string }> = async (input) => 1;', true],
-    ['export const publishDraft: { (fd: FormData): Promise<number>; } = async (fd) => 1;', true],
-    ['export const publishDraft: Promise<void>= async () => 1;', true],
-    ["export const publishDraft: { a: string; b: string }['a'] = '/api/x';", false],
-  ];
-  for (const [body, shouldFire] of cases) {
-    const dir = await makeApp({
-      'modules/feedback/actions/publish.server.ts': `'use server';\n${body}\n`,
-      'app/page.ts': `import { html } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-export default () => html\`<form method="get"><button formaction=\${publishDraft}>P</button></form>\`;
-`,
-    });
-    assert.equal(hits(await checkConventions(dir)).length, shouldFire ? 1 : 0,
-      `${shouldFire ? 'should fire' : 'should be silent'}: ${body.split('\n')[0]}`);
-    await rm(dir, { recursive: true, force: true });
-  }
-});
-
-test('a re-export clause is unknowable, even beside a same-named local function', async () => {
-  // The guard has to reject on the text AFTER the clause: a `\\s*(?!from)`
-  // lookahead can never reject, because `\\s*` backtracks to zero width and the
-  // lookahead then reads the whitespace. Without it, a module that re-exports a
-  // name AND declares a same-named local is read as exporting that local, which
-  // contradicts the barrel-re-export silence the docs promise.
-  const dir = await makeApp({
-    'modules/feedback/actions/other.server.ts': `'use server';
-export async function publishDraft() { return 1; }
-`,
-    'modules/feedback/actions/publish.server.ts': `'use server';
-function publishDraft() { return 1; }
-export { publishDraft } from './other.server.ts';
-`,
-    'app/page.ts': `import { html } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-export default () => html\`<form method="get"><button formaction=\${publishDraft}>P</button></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), [], 'a re-export needs another hop, so it stays silent');
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('the binding resolver across a broad sweep of TypeScript spellings', async () => {
-  // Five review rounds each found one more spelling this resolver got wrong, so
-  // this sweeps the space instead of waiting to be told the next one. Every row
-  // is a way a real app might export an action, or a url constant.
-  const cases = [
-    // Callables that must FIRE.
-    ['export async function publishDraft(fd) {}', true],
-    ['export function publishDraft(fd) {}', true],
-    ['export async function publishDraft<T>(fd: T): Promise<void> {}', true],
-    ['export const publishDraft = async ({ id, title }: Input): Promise<void> => {};', true],
-    ['export const publishDraft = async (...args: unknown[]) => {};', true],
-    ['export const publishDraft = async (\n  fd: FormData,\n): Promise<void> => {};', true],
-    ['export const publishDraft = function publishDraft(fd) {};', true],
-    ['export let publishDraft = async (fd) => {};', true],
-    ['const publishDraft = async (fd) => {};\nexport { publishDraft };', true],
-    ['async function impl(fd) {}\nexport { impl as publishDraft };', true],
-    // BOTH separators, inside BOTH annotation positions. The previous sweep
-    // had neither, so it stayed green through a walk that broke on a comma or
-    // a `;` at any depth. `Promise<Record<string, string>>` is the fieldErrors
-    // shape the ActionResult envelope pushes authors toward.
-    ['export const publishDraft = async (fd): Promise<Record<string, string>> => ({});', true],
-    ['export const publishDraft = async (fd): Promise<ActionResult<Draft, Err>> => ({});', true],
-    ['export const publishDraft = async (fd): { ok: boolean; id: string } => ({});', true],
-    ['export const publishDraft = async (fd: Map<string, number>) => 1;', true],
-    // These pin the depth guard on `;` / `,` inside a return type. They do NOT
-    // pin the arrow step beside it: a mutant that breaks at any arrow answers
-    // true on these by accident, and no input distinguishes it, because
-    // reaching that walk needs a `(…)` group followed by `:`, which in
-    // expression position only ever precedes an arrow's return type.
-    ['export const publishDraft = async (fd): { a: () => void, b: string } => ({});', true],
-    ['export const publishDraft = async (fd): [() => void, string] => ({});', true],
-    // A GENERIC arrow, which never reached the parameter-list branch at all.
-    ['export const publishDraft = async <T>(fd: T): Promise<void> => {};', true],
-    ['export const publishDraft = <T,>(fd: T) => 1;', true],
-    // A generic CONSTRAINT containing its own arrow: without the arrow step in
-    // the type-parameter walk, that `>` closes the list early and the parameter
-    // branch is never reached. Nothing pinned this guard until this row.
-    ['export const publishDraft = <T extends (fd: FormData) => void>(fd: T) => 1;', true],
-    // `async` with no space before the type parameters, which is valid and was
-    // unreachable because the async skip required whitespace or a paren.
-    ['export const publishDraft = async<T>(fd: T) => 1;', true],
-    // A constraint carrying its own type ARGUMENTS. Without the depth condition
-    // on the type-parameter walk's `>`, the inner `>` closes the list early and
-    // the parameter branch is never reached. `Record<string, …>` is the shape
-    // the ActionResult envelope pushes authors toward.
-    ['export const publishDraft = <T extends Array<string>>(fd: T) => 1;', true],
-    ['export const publishDraft = async <T extends Record<string, unknown>>(fd: T) => 1;', true],
-    ['export const publishDraft = <A, B extends Map<A, string>>(fd: A) => 1;', true],
-    // A DEFAULT type parameter puts a bare `=` inside the annotation's
-    // brackets, which is the only thing keeping the depth condition on the
-    // assignment scan honest.
-    ['export const publishDraft: <T = FormData>(fd: T) => Promise<void> = async (fd) => 1;', true],
-    // Whitespace between the type-parameter list and the parameter list, which
-    // is what the trailing skip after that walk exists for.
-    ['export const publishDraft = <T> (fd: T) => 1;', true],
-    // Non-callables that must stay SILENT.
-    ["export const publishDraft = `/api/${'x'}`;", false],
-    ['export const publishDraft = 42;', false],
-    ["export const publishDraft = ['/a', '/b'].join('/');", false],
-  ];
-  for (const [body, shouldFire] of cases) {
-    const dir = await makeApp({
-      'modules/feedback/actions/publish.server.ts': `'use server';\n${body}\n`,
-      'app/page.ts': `import { html } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-export default () => html\`<form method="get"><button formaction=\${publishDraft}>P</button></form>\`;
-`,
-    });
-    assert.equal(hits(await checkConventions(dir)).length, shouldFire ? 1 : 0,
-      `${shouldFire ? 'should fire' : 'should be silent'}: ${body.replace(/\n/g, ' ')}`);
-    await rm(dir, { recursive: true, force: true });
-  }
-});
-
-test('silent on a url CONSTANT exported from a .server module', async () => {
-  // "Imported from a `.server` module" is not enough: a server module exports
-  // non-functions too, and the renderer binds only a FUNCTION. A url constant
-  // renders as an ordinary attribute, so reporting it is the same false positive
-  // wearing a different hat.
-  const dir = await makeApp({
-    'lib/urls.server.ts': "export const ARCHIVE_URL = '/api/items/archive';\n",
-    'app/items/page.ts': `import { html } from '@webjsdev/core';
-import { ARCHIVE_URL } from '#lib/urls.server.ts';
-export default () => html\`<form method="get"><button formaction=\${ARCHIVE_URL}>Archive</button></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), [], 'a url constant is not an action binding');
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent on an ambiguous factory-produced export', async () => {
-  // `export const go = cache(fn)` may well be callable, but it is not PROVABLY
-  // a function from the source, and an ambiguous export firing the rule is the
-  // false-positive direction.
-  const dir = await makeApp({
-    'modules/feedback/actions/factory.server.ts': `'use server';
-import { cache } from '@webjsdev/server';
-export const publishCached = cache(async () => ({ success: true }));
-`,
-    'app/items/page.ts': `import { html } from '@webjsdev/core';
-import { publishCached } from '#modules/feedback/actions/factory.server.ts';
-export default () => html\`<form method="get"><button formaction=\${publishCached}>P</button></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), []);
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent on binding shapes the resolver cannot follow', async () => {
-  // Real bindings the rule now MISSES rather than misreports: a namespace
-  // import, a default import, and a non-identifier expression. Silence is the
-  // safe direction, and these are named in the rule's silence list.
-  const shapes = {
-    'namespace import': `import * as acts from '#modules/feedback/actions/publish.server.ts';
-export default () => html\`<form method="get"><button formaction=\${acts.publishDraft}>P</button></form>\`;`,
-    'member expression': `import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-const bag = { publishDraft };
-export default () => html\`<form method="get"><button formaction=\${bag.publishDraft}>P</button></form>\`;`,
-  };
-  for (const [label, body] of Object.entries(shapes)) {
-    const dir = await makeApp({
-      'app/items/page.ts': `import { html } from '@webjsdev/core';\n${body}\n`,
-    });
-    assert.deepEqual(hits(await checkConventions(dir)), [], `${label} is unknowable, so silent`);
-    await rm(dir, { recursive: true, force: true });
-  }
-});
-
-test('still fires when the hole IS an imported server action', async () => {
-  // The counterfactual for the filter above: narrowing to real bindings must not
-  // silence the shape the rule exists for.
-  const dir = await makeApp({
-    'app/items/page.ts': `import { html } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-export default () => html\`<form><button formaction=\${publishDraft}>P</button></form>\`;
-`,
-  });
-  assert.equal(hits(await checkConventions(dir)).length, 1);
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent when the tag has no call site anywhere in the app', async () => {
-  const dir = await makeApp({
-    'components/row-btn.ts': rowBtn(),
-    'app/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`<h1>hi</h1>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), []);
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent when the submitter lives in a bare html helper, not the class body', async () => {
-  const dir = await makeApp({
-    'components/row-btn.ts': `import { html, WebComponent } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-export const publishBtn = () => html\`<button formaction=\${publishDraft}>Publish</button>\`;
-class RowBtn extends WebComponent({}) {
-  render() { return html\`<span>row</span>\`; }
-}
-RowBtn.register('row-btn');
-`,
-    'app/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`<form><row-btn></row-btn></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), [], 'a fragment inherits the caller scope');
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('silent when the file registers two tags (ambiguous attribution)', async () => {
-  const dir = await makeApp({
-    'components/pair.ts': `import { html, WebComponent } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-class RowBtn extends WebComponent({}) {
-  render() { return html\`<button formaction=\${publishDraft}>Publish</button>\`; }
-}
-RowBtn.register('row-btn');
-class RowLabel extends WebComponent({}) {
-  render() { return html\`<span>label</span>\`; }
-}
-RowLabel.register('row-label');
-`,
-    'app/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`<form><row-btn></row-btn></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), []);
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('flags the same-scan case with no cross-module step', async () => {
-  const dir = await makeApp({
-    'app/page.ts': `import { html } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-export default () => html\`<form><button formaction=\${publishDraft}>Publish</button></form>\`;
-`,
-  });
-  const v = hits(await checkConventions(dir));
-  assert.equal(v.length, 1);
-  assert.match(v[0].file, /page\.ts/);
-  // The same-scan case is a RENDER error, not the silent one, so it says so.
-  assert.match(v[0].message, /SAME template/);
-  assert.match(v[0].message, /refuses this shape outright/);
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('the same-scan case is flagged even with method="post", because the renderer refuses it', async () => {
-  // Unlike the cross-module case, delivery is irrelevant here: the renderer
-  // sees both halves in one scan and throws, whatever the method.
-  const dir = await makeApp({
-    'app/page.ts': `import { html } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-export default () => html\`<form method="post"><button formaction=\${publishDraft}>P</button></form>\`;
-`,
-  });
-  const v = hits(await checkConventions(dir));
-  assert.equal(v.length, 1);
-  assert.match(v[0].message, /refuses this shape outright/);
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('transitive: silent when the outer page binds the form', async () => {
-  const dir = await makeApp({
-    'components/todo-list.ts': TODO_LIST,
-    'components/todo-row.ts': TODO_ROW,
-    'app/page.ts': `import { html } from '@webjsdev/core';
-import { saveAll } from '#modules/feedback/actions/save.server.ts';
-export default () => html\`<form action=\${saveAll}><todo-list></todo-list></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), []);
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('transitive: fires through an intermediate component when the outer form is unbound', async () => {
-  const dir = await makeApp({
-    'components/todo-list.ts': TODO_LIST,
-    'components/todo-row.ts': TODO_ROW,
-    'app/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`<form><todo-list></todo-list></form>\`;
-`,
-  });
-  const v = hits(await checkConventions(dir));
-  assert.equal(v.length, 1, 'a one-level rule would go silent here');
-  assert.match(v[0].file, /todo-row\.ts/);
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('a reference cycle is silent and does not hang', async () => {
-  const dir = await makeApp({
-    'components/a-one.ts': `import { html, WebComponent } from '@webjsdev/core';
-import { publishDraft } from '#modules/feedback/actions/publish.server.ts';
-class AOne extends WebComponent({}) {
-  render() { return html\`<b-two></b-two><button formaction=\${publishDraft}>Publish</button>\`; }
-}
-AOne.register('a-one');
-`,
-    'components/b-two.ts': `import { html, WebComponent } from '@webjsdev/core';
-class BTwo extends WebComponent({}) {
-  render() { return html\`<a-one></a-one>\`; }
-}
-BTwo.register('b-two');
-`,
-    'app/page.ts': `import { html } from '@webjsdev/core';
-export default () => html\`<form><a-one></a-one></form>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), [], 'a cycle can never be a verdict');
-  await rm(dir, { recursive: true, force: true });
-});
-
-test('a docs page showing the shape as a code sample stays clean', async () => {
-  const dir = await makeApp({
-    'app/docs/page.ts': `import { html } from '@webjsdev/core';
-const sample = '<form><button formaction=\${del}>x</button></form>';
-export default () => html\`<pre><code>\${sample}</code></pre>
-  <p>Write &lt;form action=\${'$'}{save}&gt; around it.</p>\`;
-`,
-  });
-  assert.deepEqual(hits(await checkConventions(dir)), [], 'a string is never read as markup');
-  await rm(dir, { recursive: true, force: true });
-});
diff --git a/packages/server/test/scanner/html-form-scopes.test.js b/packages/server/test/scanner/html-form-scopes.test.js
index 95b77d3c6..8448665c5 100644
--- a/packages/server/test/scanner/html-form-scopes.test.js
+++ b/packages/server/test/scanner/html-form-scopes.test.js
@@ -12,10 +12,12 @@ import { PARSEABLE_ENCTYPES } from '../../../core/src/form-action.js';
 import { readFile } from 'node:fs/promises';
 
 /**
- * Unit tests for the lexical half of `submitter-needs-bound-form` (#1307):
- * the whole-app rule in `check.js` is only as good as the scan under it, and
- * the shapes it must NOT read as markup (a plain string, a `css` template, an
- * HTML comment) are what keep the rule from firing on a docs page.
+ * Unit tests for the lexical form-scope scan in `js-scan.js`, plus the shared
+ * template primitives around it (`classifyActionHole`, `matchClosingBrace`,
+ * `extractWebComponentClassBodies`) and the enctype constant the renderer and
+ * the client guard both answer to. The shapes the scan must NOT read as markup
+ * (a plain string, a `css` template, an HTML comment) are what keep any
+ * consumer of it off a docs page.
  */
 
 test('a submitter reports the scope of its enclosing form', () => {
@@ -230,33 +232,27 @@ test('the unparseable-enctype constant tracks the renderer\'s own set', async ()
     'and does not reach for the renderer allowlist again');
 });
 
-test('the start-tag-hole rule matches what the RENDERER actually does', async () => {
+test('a start-tag hole is handed off or inherited, and SSR agrees', async () => {
   // A differential rather than an assertion about the scanner alone, because the
   // whole 'handed' state is a claim about the renderer's behaviour. Most
   // start-tag holes are values the receiving element places, but
   // `<webjs-suspense .fallback=${…}>` is rendered INLINE with the enclosing form
   // scope (#471: a custom-element property applies at hydration, too late for a
-  // placeholder that must be in the first flushed bytes). Treating that one as
-  // handed off would blind the same-scan half to a real render-time throw.
+  // placeholder that must be in the first flushed bytes), so the scanner reads
+  // it against that form rather than treating it as handed off.
   const { html } = await import('../../../core/src/html.js');
   const { renderToString } = await import('../../../core/src/render-server.js');
   const { setFormActionResolver } = await import('../../../core/src/form-action.js');
   setFormActionResolver(async () => 'abc1234567/publish');
   const publish = async () => ({ success: true });
 
-  // Rendered inline, so the renderer judges it against the unbound form and
-  // throws. The scanner must see the same thing.
+  // Read against the enclosing form, not handed off. Nothing is asserted about
+  // a render-time refusal here: a bound submitter is SELF-SUFFICIENT (#1307), so
+  // the renderer stamps it with its own `formmethod="post"` and refuses only a
+  // same-element contradiction, never a cross-element one.
   const fallbackSrc = 'html`<form><webjs-suspense .fallback=${html`<button formaction=${p}>x</button>`}></webjs-suspense></form>`';
   assert.deepEqual(scanHtmlFormScopes(fallbackSrc).submitters,
     [{ tag: 'button', scope: 'unbound', delivers: false, expr: 'p' }]);
-  await assert.rejects(
-    () => renderToString(
-      html`<form><webjs-suspense .fallback=${html`<button formaction=${publish}>x</button>`}></webjs-suspense></form>`,
-      { ssr: true },
-    ),
-    /requires the enclosing <form> to also be bound/,
-    'the renderer really does refuse it, so the scanner must not be silent',
-  );
 
   // The negative half, and it has to assert the MECHANISM rather than "it did
   // not throw". A template carrying a function cannot serialize, so SSR drops
diff --git a/website/app/docs/progressive-enhancement/page.ts b/website/app/docs/progressive-enhancement/page.ts
index 57e606c40..b1c0201b4 100644
--- a/website/app/docs/progressive-enhancement/page.ts
+++ b/website/app/docs/progressive-enhancement/page.ts
@@ -177,7 +177,7 @@ export default function NewPost({ actionData }: {
     </p>
 
     <p>
-      <strong>A per-button action needs its enclosing form bound.</strong> <code>method="post"</code> and the enctype are supplied on the form's start tag, which is already emitted by the time the renderer reaches the button, so a submitter cannot retrofit them. An unbound host form the renderer can see is refused at render. One it CANNOT see is not: a submitter inside a component is a cannot-tell, because the component renders its own template in a separate pass with no view of the host page, and cannot-tell has to bind (refusing there would drop the component from a page that still returned 200). So a <code>formaction=\${action}</code> button in a component inside an unbound form ships. If that form still declares <code>method="post"</code> it works, because the identity rides the button's own <code>name</code>/<code>value</code> pair into the body; if it declares no method it submits as a GET, puts the reserved identity in the query string, and the action never runs. Run <code>webjs check</code>: the <code>submitter-needs-bound-form</code> rule reads every template in the app at once, so it resolves the enclosing form across modules and flags this at edit time.
+      <strong>A per-button action is self-sufficient.</strong> The renderer supplies the submission attributes at the level where the action is bound, so a <code>formaction=\${action}</code> button gains <code>formmethod="post"</code> and <code>formenctype</code> ON THE BUTTON, alongside the identity riding its own <code>name</code>/<code>value</code> pair. A submitter's <code>formmethod</code> overrides the form's <code>method</code> per HTML, so the button posts correctly inside a bound form, an unbound form, a form with no method, or a <code>method="get"</code> form. That is what makes a submitter inside a component safe: the component renders its own template in a separate pass with no view of the host page, and it no longer needs one. Bind the enclosing form when the FORM itself should run an action on a plain submit.
     </p>
 
     <p>
diff --git a/website/app/docs/troubleshooting/page.ts b/website/app/docs/troubleshooting/page.ts
index 476462e1c..6044369a7 100644
--- a/website/app/docs/troubleshooting/page.ts
+++ b/website/app/docs/troubleshooting/page.ts
@@ -56,8 +56,8 @@ export default function Troubleshooting() {
 
     <h2>A button submits and the page just re-renders</h2>
     <p><strong>Symptom:</strong> clicking a <code>formaction=\${action}</code> button reloads the same page with a 200, nothing was written, no error appears anywhere, and the address bar has grown a <code>?__webjs_action=</code> parameter.</p>
-    <p><strong>Cause:</strong> the enclosing <code>&lt;form&gt;</code> binds no action AND declares no <code>method="post"</code>, so the browser submits it as a GET. (An unbound form that DOES declare <code>method="post"</code> still works, because the identity rides the button's own name/value pair and reaches the server in the body.) A GET sends no body, so the identity the button carries rides the query string instead, and a GET at a page url just renders the page. That is why there is no 405 and no log line. The renderer refuses this shape when it can see both halves in one template, but a submitter inside a COMPONENT is a cannot-tell (the component renders in its own pass with no view of the host page) and cannot-tell has to bind, so a split-across-modules form reaches production.</p>
-    <p><strong>Fix:</strong> bind the enclosing form too (<code>&lt;form action=\${saveAll}&gt;</code>), which is what supplies <code>method="post"</code> and the enctype. Run <code>webjs check</code> to find it: the <code>submitter-needs-bound-form</code> rule reads every template in the app at once, so it resolves the enclosing form across module boundaries and transitively through intermediate components. It is conservative and stays silent when a tag is rendered in a bound form somewhere and an unbound one elsewhere, so a clean check is not by itself proof the form is bound. Two runtime signals back it up: in dev the browser console carries one <code>[webjs]</code> error at submit time naming the fix, and in production the <code>onError</code> hook receives the fingerprint with <code>err.code === 'WEBJS_FORM_SUBMITTED_AS_GET'</code>. The 405 case has its own code, <code>WEBJS_FORM_ACTION_MISSING</code>. Neither changes the response.</p>
+    <p><strong>Cause:</strong> the submission went out as a GET, so it carried no body and the identity rode the query string instead, and a GET at a page url just renders the page. That is why there is no 405 and no log line. A submitter you bound with <code>formaction=\${action}</code> does NOT reach this on its own: the renderer gives it <code>formmethod="post"</code>, which overrides the form's method per HTML, so it posts correctly inside a form that is unbound, method-less, or even <code>method="get"</code>. What reaches this is a <code>formmethod="get"</code> or <code>method="get"</code> written by hand and deliberately honoured, or a hand-authored form carrying the reserved field.</p>
+    <p><strong>Fix:</strong> remove the explicit <code>formmethod="get"</code> or <code>method="get"</code> from the submission path you meant to write. Two runtime signals find it: in dev the browser console carries one <code>[webjs]</code> error at submit time naming the fix, and in production the <code>onError</code> hook receives the fingerprint with <code>err.code === 'WEBJS_FORM_SUBMITTED_AS_GET'</code>. The 405 case has its own code, <code>WEBJS_FORM_ACTION_MISSING</code>. Neither changes the response.</p>
 
     <h2>A render fails on a button's formmethod or formenctype</h2>
     <p><strong>Symptom:</strong> a page fails at render with <code>&lt;button formenctype="text/plain" formaction=\${action}&gt; cannot work</code>, or the same message naming <code>formmethod</code>.</p>

From ec59af0c59753c9bb0321d56d33b927257728177 Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Tue, 11 Aug 2026 01:50:30 +0530
Subject: [PATCH 2/3] fix: clear the removed rule's premise from the surfaces
 it outlived

Review of the removal turned up five places still asserting, or still
built for, the enclosing-form question #1307 deleted.

The gallery's submit-todo comment contradicted itself four lines apart,
saying the enclosing form does NOT have to be bound and then that it does,
and pointed readers at the rule this branch removes. That file is scaffold
payload, so it ships into every generated app.

The production onError message for WEBJS_FORM_SUBMITTED_AS_GET named the
enclosing form as the cause; the dev logger four lines above it was already
correct, so the two disagreed on one event. render-server.js still carried
the four-state form-scope comment and passed a vestigial third argument to
a two-parameter render(), both left over from the same removal. check.js
kept two imports whose only uses were inside the deleted function, and the
now-callerless scanner's JSDoc still described the consumer it lost.
---
 .../todo/actions/submit-todo.server.ts        | 17 ++++------
 packages/core/src/render-server.js            | 31 ++++---------------
 packages/server/src/check.js                  |  3 +-
 packages/server/src/form-dispatch.js          |  2 +-
 packages/server/src/js-scan.js                | 19 ++++++++----
 5 files changed, 27 insertions(+), 45 deletions(-)

diff --git a/gallery/modules/todo/actions/submit-todo.server.ts b/gallery/modules/todo/actions/submit-todo.server.ts
index cf9d24bfa..3ba7bba1c 100644
--- a/gallery/modules/todo/actions/submit-todo.server.ts
+++ b/gallery/modules/todo/actions/submit-todo.server.ts
@@ -21,17 +21,12 @@ import { deleteTodo } from './delete-todo.server.ts';
 // control's visible label), and a bound submitter cannot carry its own
 // `name`/`value`, which is exactly the channel `name="intent"` uses below.
 //
-// Third thing to know, and the one that fails silently: the enclosing <form>
-// has to be bound too, because `method="post"` and the enctype are supplied on
-// the form's start tag and a per-button action cannot retrofit them. The
-// renderer refuses an unbound form it can see, but a submitter inside a
-// COMPONENT is a cannot-tell (the component renders in its own pass with no
-// view of the host page) and binds anyway. What happens then depends on that
-// form: one still declaring `method="post"` works (the identity rides the
-// button's own name/value pair into the body), but one with no method submits as
-// a GET, so the identity rides the query string and the action never runs while
-// the page returns 200. Run `webjs check`: `submitter-needs-bound-form` finds
-// these across modules.
+// Third thing to know: no `formaction` url is emitted, because the identity
+// travels in the body instead. So the submission targets whatever the FORM
+// targets, and a form declaring `action="/x"` sends its buttons there. The
+// action still runs when `/x` is a PAGE route; against a `route.ts` or another
+// origin the identity is ignored and nothing runs, which the dev-time client
+// guard reports at submit time.
 //
 // With JS the component intercepts the submit and calls the underlying action
 // directly for the optimistic path, so this runs only with JS off.
diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index e5e1d28cc..9e9683759 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -182,23 +182,6 @@ async function renderTemplate(tr, ctx) {
   let pendingPropAttrs = [];
   /** @type {string[]} */
   let pendingSubmitterProps = [];
-  // Whether the tag stream is currently inside a form that BOUND an action
-  // (#1207), as THIS scan can see it. Three states, and the third is the point:
-  //   'bound'   an enclosing <form> opened here and bound an action
-  //   'unbound' an enclosing <form> opened here and bound nothing
-  //   'none'    there is conclusively no enclosing <form>
-  //   'unknown' there may be one, but this scan cannot see it
-  //
-  // The last two look alike and must not be merged, which is what a boolean did.
-  // A component's template is rendered by a SEPARATE pass (`injectDSD` calls
-  // `render` on it), so a `<button formaction=${fn}>` inside a component inside
-  // a bound form read as "no form", was refused, and in production vanished
-  // from a page that still returned 200. That pass now says 'unknown' and the
-  // boundness question is skipped, exactly as the client skips it when it
-  // cannot reach the form, so both renderers are best effort in the same place
-  // and for the same reason. A top-level scan that simply contains no form
-  // stays 'none' and is still refused, because there the answer IS known.
-  //
   let isCloseTag = false;
 
   // A bound `action=${fn}` is committed at its hole, but the edits it implies
@@ -1037,14 +1020,12 @@ async function injectDSD(html, ctx, ancestors = [], dev) {
       // Render the template to HTML. injectDSD recurses on the result so
       // nested custom elements (e.g. <theme-toggle> inside <blog-shell>)
       // get their own DSD pass.
-      // 'unknown' for the form scope (#1207): this is a SEPARATE render pass
-      // over one component's own template, driven by walking the already-emitted
-      // HTML, so it has no idea whether the host tag sits inside a bound
-      // `<form>`. Passing the default 'none' claimed there was no form at all,
-      // which refused a perfectly good `<button formaction=${fn}>` in a
-      // component inside a bound form and, because component SSR errors are
-      // isolated, made the button vanish from a page that still returned 200.
-      const rawInner = await render(tpl, ctx, 'unknown');
+      // This is a SEPARATE render pass over one component's own template,
+      // driven by walking the already-emitted HTML, so it has no idea whether
+      // the host tag sits inside a `<form>`. It does not need to: a bound
+      // submitter carries its whole submission (#1307), so nothing here asks
+      // about an enclosing form.
+      const rawInner = await render(tpl, ctx);
 
       if (isShadow) {
         // Shadow DOM: native <slot> stays as-is in the DSD template. The
diff --git a/packages/server/src/check.js b/packages/server/src/check.js
index ceaaba3cf..b74289029 100644
--- a/packages/server/src/check.js
+++ b/packages/server/src/check.js
@@ -6,12 +6,11 @@ import {
   redactToPlaceholders,
   extractWebComponentClassBodies,
   matchClosingBrace,
-  matchClosingParenthesis,
   parsePropEntries,
   classifyActionHole,
 } from './js-scan.js';
 import { buildModuleGraph, transitiveDeps, resolveImport } from './module-graph.js';
-import { scanComponents, extractComponents } from './component-scanner.js';
+import { scanComponents } from './component-scanner.js';
 import { buildRouteTable } from './router.js';
 import { analyzeElision } from './component-elision.js';
 import { RESERVED_CONFIG } from './action-config.js';
diff --git a/packages/server/src/form-dispatch.js b/packages/server/src/form-dispatch.js
index 00fb0f717..12d9ea18e 100644
--- a/packages/server/src/form-dispatch.js
+++ b/packages/server/src/form-dispatch.js
@@ -359,7 +359,7 @@ export function reportFormSubmittedAsGet(url, req, onError, logger, dev, route)
   }
   if (!willReport) return;
   const err = new Error(
-    `A form submission reached ${url.pathname} as a GET with the \`${FORM_ACTION_FIELD}\` identity in the query string, so no server action ran. The submitter's enclosing <form> binds no action.`,
+    `A form submission reached ${url.pathname} as a GET with the \`${FORM_ACTION_FIELD}\` identity in the query string, so no server action ran. A bound submitter carries its own formmethod="post", so look for a formmethod="get" on the button that was pressed, or a method="get" on its form: a submitter's own formmethod wins by native precedence and WebJs honours it rather than refusing it.`,
   );
   /** @type {any} */ (err).code = 'WEBJS_FORM_SUBMITTED_AS_GET';
   /** @type {any} */ (err).method = req.method;
diff --git a/packages/server/src/js-scan.js b/packages/server/src/js-scan.js
index 7236c904f..7d6a76244 100644
--- a/packages/server/src/js-scan.js
+++ b/packages/server/src/js-scan.js
@@ -895,13 +895,20 @@ function isInlineStartTagHole(tagName, literalBefore) {
  * submitter action hole (`<button|input formaction=${...}>`) and each
  * custom-element start tag, the enclosing `<form>` scope at that point (#1307).
  *
+ * NOTE: this currently has NO production caller. It was written for the
+ * `submitter-needs-bound-form` check rule, which #1384 removed because its
+ * premise was false: a bound submitter is self-sufficient, so the enclosing
+ * form's boundness does not decide whether the action runs. The scan itself is
+ * correct about what it reports and is kept for a future consumer, but nothing
+ * reads it today, so treat it as unproven against real-world input.
+ *
  * Only an `html`-tagged literal is entered, so `const s = '<form>'` and a `css`
  * or `sql` template are never read as markup. That carve-out matters: the
  * framework's own website renders `<form action=${fn}>` as a code SAMPLE.
  *
  * A template nested inside a CHILD-position hole INHERITS the enclosing scope,
- * because that is what the renderer does (`render` threads `formScope` through
- * arrays, `repeat`, and nested templates).
+ * because that is where the renderer places it (through arrays, `repeat`, and
+ * nested templates).
  *
  * One in a START-TAG hole is `'handed'`: an attribute or property value whose
  * placement this scan cannot speak for. Worth being exact about why, because the
@@ -922,10 +929,10 @@ function isInlineStartTagHole(tagName, literalBefore) {
  * the scan started in, mirroring `handleTagEnd` in `render-server.js`.
  *
  * `opensForm` reports whether ANY `<form` start tag was seen anywhere in `src`.
- * A caller attributing a scope-`'none'` site to this file needs it: a fragment
- * built into a local and spliced into a form the same file opens inherits the
- * SPLICE point's scope, not the file's own call-site scope, so a file that
- * opens a form cannot have its `'none'` sites attributed safely.
+ * It exists for a caller that attributes a scope-`'none'` site to this file: a
+ * fragment built into a local and spliced into a form the same file opens
+ * inherits the SPLICE point's scope, not the file's own call-site scope, so a
+ * file that opens a form cannot have its `'none'` sites attributed safely.
  *
  * @param {string} src
  * @returns {{ submitters: FormScopeSite[], tagUses: FormScopeSite[], opensForm: boolean }}

From e8755dcb5ce0a3d90e9ba5286a0c0b23857ac09d Mon Sep 17 00:00:00 2001
From: Vivek <vivek7405@gmail.com>
Date: Tue, 11 Aug 2026 02:03:50 +0530
Subject: [PATCH 3/3] fix: delete the form-scope scan, whose delivers verdict
 is now wrong

The second review round found the scan is not merely callerless. Its
`delivers` field encodes the premise this branch removes:
`unboundFormDelivers` answers false for a form with no method or a
method="get" one, but a bound submitter now carries its own
formmethod="post", which overrides the form, so those forms DO deliver.
Its tests asserted the wrong values, and the blog fixture it would score
false is the one the e2e proves runs its action.

Salvaged the two live surfaces into form-action-holes.test.js:
classifyActionHole, which the form-action-not-a-get-action rule still
uses, and the enctype pin that keeps the renderer allowlist and the client
denylist from drifting.

Also cleared four more residuals of the same premise: the onError message
claimed a bound submitter's formmethod="get" is honoured when it is
refused at render, the renderer comment said a submission targets the page
rather than whatever the form targets, the streaming machine kept an
orphaned form-scope comment, and three doc surfaces called a refused
method="get" on a bound form a warning.
---
 .agents/skills/webjs/SKILL.md                 |   2 +-
 .../webjs/references/data-and-actions.md      |   2 +-
 .../webjs/references/muscle-memory-gotchas.md |   4 +-
 packages/core/src/render-client.js            |   9 +-
 packages/core/src/render-server.js            |  13 +-
 packages/server/src/form-dispatch.js          |   2 +-
 packages/server/src/js-scan.js                | 385 ------------------
 .../test/scanner/form-action-holes.test.js    |  70 ++++
 .../test/scanner/html-form-scopes.test.js     | 325 ---------------
 9 files changed, 84 insertions(+), 728 deletions(-)
 create mode 100644 packages/server/test/scanner/form-action-holes.test.js
 delete mode 100644 packages/server/test/scanner/html-form-scopes.test.js

diff --git a/.agents/skills/webjs/SKILL.md b/.agents/skills/webjs/SKILL.md
index fb5a1e10e..5f069802f 100644
--- a/.agents/skills/webjs/SKILL.md
+++ b/.agents/skills/webjs/SKILL.md
@@ -240,7 +240,7 @@ Success is a 303 (PRG); failure re-renders the page at 422 with the result on `a
 - Writing `formmethod="get"` or `formenctype="text/plain"` on a button that BINDS an action. Neither can carry that action's body, so the pair contradicts itself and throws. On a button that binds nothing it is a legal native override and is honoured.
 - Binding an action whose file declares `export const method = 'GET'`. Form-bound actions strictly require POST (default). Binding a GET action to a form is a 405 at runtime and a `webjs check` error (`form-action-not-a-get-action`).
 - Leaving read-only RPC server query actions as default `POST`. Always export `export const method = 'GET'` for RPC data queries so arguments ride URL params, ETags/304 caching work, and CSRF is safely bypassed.
-- Writing `method="get"` on a bound `<form action=${fn}>`. WebJs supplies `method="post"` and `formenctype` automatically; manually setting `method="get"` triggers a `WEBJS_FORM_SUBMITTED_AS_GET` diagnostic warning.
+- Writing `method="get"` on a bound `<form action=${fn}>`. WebJs supplies `method="post"` and `formenctype` automatically, and a bound form declaring `method="get"` is REFUSED at render (a thrown error, not a warning), because a GET sends no body for the action to read.
 - Throwing `redirect()` / `notFound()` inside a `route.ts` handler (uncaught 500). Return a `Response` there.
 - A placeholder first paint that fetches in `connectedCallback`. SSR does not call `connectedCallback`; put first-paint data in the constructor (server-known inputs) or use `async render()`.
 - A browser global (`window`, `document`, `localStorage`) in the constructor or `render()`. It throws at SSR; do browser-only work in `connectedCallback`.
diff --git a/.agents/skills/webjs/references/data-and-actions.md b/.agents/skills/webjs/references/data-and-actions.md
index b79f12e08..5eb4c60c6 100644
--- a/.agents/skills/webjs/references/data-and-actions.md
+++ b/.agents/skills/webjs/references/data-and-actions.md
@@ -169,7 +169,7 @@ A `'use server'` action is a POST by default. Reserved sibling exports, read sta
 1. **Form-Bound Actions (`<form action=${fn}>` / `<button formaction=${fn}>`):**
    - **MUST be POST.** Leave unannotated (default) or export `export const method = 'POST'`.
    - **NEVER export `export const method = 'GET'` for form actions.** The HTML renderer automatically emits `method="post"` and `formenctype` for form actions. Binding a `method = 'GET'` action to a form returns a `405 Method Not Allowed` at runtime and triggers a `webjs check` error (`form-action-not-a-get-action`).
-   - **NEVER add `method="get"` to a bound `<form action=${fn}>`.** WebJs manages form submission semantics automatically; adding `method="get"` causes a `WEBJS_FORM_SUBMITTED_AS_GET` diagnostic warning.
+   - **NEVER add `method="get"` to a bound `<form action=${fn}>`.** WebJs manages form submission semantics automatically, and a bound form declaring `method="get"` is REFUSED at render (a thrown error, not a warning), because a GET sends no body for the action to read.
 
 2. **Programmatic / RPC Read Actions (Queries):**
    - **ALWAYS export `export const method = 'GET'` for read-only queries.**
diff --git a/.agents/skills/webjs/references/muscle-memory-gotchas.md b/.agents/skills/webjs/references/muscle-memory-gotchas.md
index b18835b12..d6c9c8ecd 100644
--- a/.agents/skills/webjs/references/muscle-memory-gotchas.md
+++ b/.agents/skills/webjs/references/muscle-memory-gotchas.md
@@ -120,7 +120,7 @@ The bound, refused, and allowed shapes in full. Every "no" row is a binding that
 | a plain `formaction="/url"` on a submitter inside a bound form | **no** | it retargets the submission away from the page's bound action entirely, so where it goes and how is your business |
 | `.action=` on a native form | yes | the supported binding is the plain attribute, and a `.prop` on a native element drops at SSR, so accepting it would mean a form that submits under JS and does nothing without it |
 | `export const method = 'GET'` on a form-bound action file | yes | form-bound actions strictly enforce `POST`. Binding a GET action to a form produces a 405 runtime refusal and `webjs check` error (`form-action-not-a-get-action`) |
-| `method="get"` on a bound `<form action=${fn}>` | yes | WebJs supplies `method="post"` and `formenctype` automatically; manually setting `method="get"` triggers a `WEBJS_FORM_SUBMITTED_AS_GET` diagnostic warning |
+| `method="get"` on a bound `<form action=${fn}>` | yes | WebJs supplies `method="post"` and `formenctype` automatically, and a bound form declaring `method="get"` is REFUSED at render (a thrown error, not a warning), because a GET sends no body for the action to read |
 | `.method=` / `.enctype=` / `.encoding=` on a BOUND form | yes | the same reason one level over. All three are reflected IDL attributes, so SSR drops the binding and emits `method="post"` while a browser ends at what you assigned. Write them as plain attributes |
 | a second `action=${fn}` on one form | yes | SSR emits the second as a plain url next to the identity field, the client takes the last. Bind exactly one, in either position |
 | a plain `action="/url"` beside the bound hole | yes | the hole drops only its OWN attribute, so SSR keeps the static one while the client removes it: without JS the browser posts to `/url`, with JS to the page |
@@ -156,7 +156,7 @@ The renderer supplies the submission attributes at the level where the action is
 
 That is also why the renderer refuses only a SAME-ELEMENT contradiction (a bound submitter's own `formmethod` other than post, an `formenctype` the server cannot parse, `formmethod="dialog"`) and never a cross-element one. A component renders its template in a separate pass with no view of the host page, so the cross-element question is unanswerable at render time, and self-sufficiency leaves nothing for it to answer. One consequence: no `formaction` url is emitted, so the submission targets whatever the FORM targets, and a form declaring `action="/x"` sends its buttons there. The action still runs when `/x` is a PAGE route, since the identity travels in the body; against a `route.ts` or another origin nothing runs, which the dev-time client guard reports at submit time.
 
-**Two runtime signals cover what is left.** In dev, submitting a form that carries an action identity it cannot deliver logs one `console.error` naming the fix, once per shape; it never throws, so the submission behaves exactly as it does in production. In production, both server-visible fingerprints reach the `onError` hook (the programmatic `createRequestHandler({ onError })` option and any sink an `instrumentation.{js,ts}` installed) with a code to group on: `WEBJS_FORM_SUBMITTED_AS_GET` for a page GET carrying the reserved field in its query string, and `WEBJS_FORM_ACTION_MISSING` for a form body carrying no identity at all. Since a bound submitter carries its own `formmethod="post"`, what reaches the first one is an explicit `formmethod="get"` or `method="get"` an author wrote on a PLAIN submitter and the renderer deliberately honours, or a hand-written form. Both are detect-only, so no status changes, and both carry the submitted field NAMES and never the values.
+**Two runtime signals cover what is left.** In dev, submitting a form that carries an action identity it cannot deliver logs one `console.error` naming the fix, once per shape; it never throws, so the submission behaves exactly as it does in production. In production, both server-visible fingerprints reach the `onError` hook (the programmatic `createRequestHandler({ onError })` option and any sink an `instrumentation.{js,ts}` installed) with a code to group on: `WEBJS_FORM_SUBMITTED_AS_GET` for a page GET carrying the reserved field in its query string, and `WEBJS_FORM_ACTION_MISSING` for a form body carrying no identity at all. A BOUND submitter carries its own `formmethod="post"`, and a bound form is refused a `method="get"` outright, so what reaches the first one is a PLAIN submitter's `formmethod="get"`, which native precedence lets win and the renderer deliberately honours, or a hand-authored form carrying the reserved field. Both are detect-only, so no status changes, and both carry the submitted field NAMES and never the values.
 
 **Inside a component you may never see the error.** Per-component SSR error isolation contains the throw, so development shows an error box in place of the component and production renders it empty with the page still returning 200. A form that has silently vanished in production is this bug wearing a disguise; the message is in the server log. Nothing leaks either way.
 
diff --git a/packages/core/src/render-client.js b/packages/core/src/render-client.js
index 7cbc4ce26..af1084481 100644
--- a/packages/core/src/render-client.js
+++ b/packages/core/src/render-client.js
@@ -750,11 +750,10 @@ function buildFormActionRecord(el, onEl, parts) {
  * record.
  *
  * FORMS FIRST, submitters second, regardless of the order the records were
- * collected in. A submitter asks whether its enclosing form is bound, and the
- * cheapest true answer is the identity field the form's own reconcile just
- * inserted. Document order gets this right for a form and a button in the SAME
- * template, but not for a `<form>` whose submitter arrives through a nested
- * template, so the ordering is made explicit rather than relied upon.
+ * collected in. Nothing reads an enclosing form's boundness any more (#1307
+ * made a bound submitter self-sufficient), but the ordering still makes a
+ * form's RELEASE run before its submitters reconcile, so it is kept rather
+ * than churned. See the note in the body.
  *
  * @param {FormActionRecord[] | null} formActions
  * @param {BoundPart[]} bound
diff --git a/packages/core/src/render-server.js b/packages/core/src/render-server.js
index 9e9683759..b96d2b041 100644
--- a/packages/core/src/render-server.js
+++ b/packages/core/src/render-server.js
@@ -468,14 +468,13 @@ async function renderTemplate(tr, ctx) {
             // #1207: the submitter binding. The identity replaces the
             // `formaction=` hole IN PLACE with the button's own name/value
             // pair, the one channel a browser submits for the pressed button
-            // alone. No `formaction` url is emitted, so the submission still
-            // targets the page and the form-level identity is simply overridden
-            // by this later entry.
+            // alone. No `formaction` url is emitted, so the submission targets
+            // whatever the FORM targets, and a form-level identity is simply
+            // overridden by this later entry.
             //
             // Refused here rather than at the `>` only where the answer cannot
-            // change later: boundness of the ENCLOSING form is already decided
-            // (its start tag is emitted), and an attribute written BEFORE the
-            // hole is already in `out`. Everything else waits for the close,
+            // change later: an attribute written BEFORE the hole is already in
+            // `out`. Everything else waits for the close,
             // where `assertSubmitterStartTag` sees the whole tag.
             // A second binding hole on this same tag, refused here so the
             // author gets the duplicate message rather than a confusing
@@ -2083,8 +2082,6 @@ async function streamTemplate(tr, ctx, controller) {
   let pendingSubmitterProps = [];
   /** @type {string | null} */
   let pendingSubmitterTag = null;  // tag of a bound submitter, until it closes
-  // See the buffered machine: seeded from the caller so a nested template
-  // rendered into a bound form's children knows it is inside one.
   let isCloseTag = false;
 
   // See the buffered machine for why this runs at the `>` rather than at the
diff --git a/packages/server/src/form-dispatch.js b/packages/server/src/form-dispatch.js
index 12d9ea18e..2e1c7f17e 100644
--- a/packages/server/src/form-dispatch.js
+++ b/packages/server/src/form-dispatch.js
@@ -359,7 +359,7 @@ export function reportFormSubmittedAsGet(url, req, onError, logger, dev, route)
   }
   if (!willReport) return;
   const err = new Error(
-    `A form submission reached ${url.pathname} as a GET with the \`${FORM_ACTION_FIELD}\` identity in the query string, so no server action ran. A bound submitter carries its own formmethod="post", so look for a formmethod="get" on the button that was pressed, or a method="get" on its form: a submitter's own formmethod wins by native precedence and WebJs honours it rather than refusing it.`,
+    `A form submission reached ${url.pathname} as a GET with the \`${FORM_ACTION_FIELD}\` identity in the query string, so no server action ran. A BOUND submitter carries its own formmethod="post" and a bound form is refused a method="get" outright, so look instead for a PLAIN submitter's formmethod="get", or a hand-authored form carrying the reserved field: a plain submitter's own formmethod wins by native precedence and WebJs honours it rather than refusing it.`,
   );
   /** @type {any} */ (err).code = 'WEBJS_FORM_SUBMITTED_AS_GET';
   /** @type {any} */ (err).method = req.method;
diff --git a/packages/server/src/js-scan.js b/packages/server/src/js-scan.js
index 7d6a76244..18ef93406 100644
--- a/packages/server/src/js-scan.js
+++ b/packages/server/src/js-scan.js
@@ -764,388 +764,3 @@ export function classifyActionHole(literalBefore) {
   return null;
 }
 
-/**
- * The ONE `enctype` keyword that loses a form body the server could otherwise
- * read.
- *
- * Stated as a denylist rather than an allowlist because `enctype` is an
- * enumerated attribute whose missing value default AND invalid value default are
- * both `application/x-www-form-urlencoded`. So `enctype="nonsense"` falls back to
- * urlencoded and submits a perfectly parseable body; only the third valid
- * keyword, `text/plain`, is a real loss. An allowlist inverts that and reports a
- * working form as broken, which this rule must never do.
- *
- * The renderer's `PARSEABLE_ENCTYPES` (`form-action.js`) refuses the wider set,
- * and that divergence is deliberate on BOTH sides rather than an inconsistency
- * to unify. The two ask different questions. This rule asks whether the
- * identity ARRIVES, and under an invalid enctype it does. The renderer asks
- * whether the form will do what the author wrote, and there an invalid value is
- * the dangerous case: `enctype="multipart/form-dat"` falls back to urlencoded,
- * which silently drops every FILE from the submission, so throwing at render is
- * the only way the author finds out. Unifying them would either make the
- * renderer accept a typo that loses uploads, or make this rule report a working
- * form as broken.
- */
-const UNPARSEABLE_FORM_ENCTYPE = 'text/plain';
-
-/**
- * Read one attribute's literal value out of a start tag's accumulated text.
- * Returns null when absent, and the raw value otherwise (quoted or bare).
- *
- * @param {string} tagText
- * @param {string} name
- * @returns {string | null}
- */
-function startTagAttr(tagText, name) {
-  const re = new RegExp(`\\s${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, 'i');
-  const m = re.exec(tagText);
-  if (!m) return null;
-  return m[1] ?? m[2] ?? m[3] ?? '';
-}
-
-/**
- * Would an UNBOUND `<form>` still deliver a submitter's action identity?
- *
- * This is the difference between a broken write path and a working one, and it
- * is not intuitive. A submitter carries its identity in its OWN `name`/`value`
- * pair, which a browser submits for the pressed button alone, so an unbound
- * form that still sends a parseable POST body delivers it and the action RUNS
- * (the dispatcher takes the last `__webjs_action` entry it finds). What breaks
- * is a form that sends no body the server can read: no `method` at all or
- * `method="get"` (a GET puts the identity in the query string and the page just
- * re-renders), or an enctype `parseFormBody` cannot parse (a 405).
- *
- * Both are enumerated attributes matched against exact keywords with no
- * whitespace stripping, and their defaults pull in OPPOSITE directions, which is
- * why they are tested differently. `method` defaults to GET, so anything that is
- * not exactly `post` loses the body (a padded `method=" post "` included).
- * `enctype` defaults to `application/x-www-form-urlencoded` for both a missing
- * AND an invalid value, so only the `text/plain` keyword actually loses it.
- *
- * @param {string} tagText the form's start tag, from `<form` to just before `>`
- * @returns {boolean}
- */
-function unboundFormDelivers(tagText) {
-  const method = startTagAttr(tagText, 'method');
-  if (method === null || method.toLowerCase() !== 'post') return false;
-  const enctype = startTagAttr(tagText, 'enctype');
-  if (enctype !== null && enctype.toLowerCase() === UNPARSEABLE_FORM_ENCTYPE) return false;
-  return true;
-}
-
-/**
- * The ONE start-tag hole the renderer renders INLINE, in the enclosing scan and
- * with the enclosing form scope, rather than handing to the receiving element:
- * `<webjs-suspense .fallback=${html`…`}>` (#471).
- *
- * A custom-element property applies only at HYDRATION, which is too late for a
- * placeholder that has to be in the first flushed bytes, so `render-server.js`
- * renders the fallback right there and carries the HTML as
- * `data-webjs-fallback`. (The timing is the operative reason on its own. A
- * serializable `TemplateResult` would otherwise ride as `data-webjs-prop-*`
- * perfectly well; only one carrying a function fails to serialize.) That means a submitter in a fallback IS judged against
- * the enclosing form, and the renderer really does throw for an unbound one.
- * Treating it as handed off would make the same-scan half blind to the one shape
- * it exists to pre-warn about.
- *
- * @param {string} tagName lowercased
- * @param {string} literalBefore the literal segment immediately before the hole
- * @returns {boolean}
- */
-function isInlineStartTagHole(tagName, literalBefore) {
-  // The property name is a JS identifier, so it is case-SENSITIVE, unlike an
-  // attribute name.
-  return tagName === 'webjs-suspense' && /\.fallback=$/.test(literalBefore);
-}
-
-/**
- * @typedef {'none'|'unbound'|'bound'|'handed'} FormScope
- *
- * `'none'` and `'handed'` are BOTH "no enclosing form in this scan", and they
- * are deliberately separate values because a caller must treat them
- * differently. `'none'` is a cannot-tell that the file's own component may
- * legitimately own, so a caller may attribute it and resolve it against that
- * component's call sites. `'handed'` is a template sitting in a start-tag hole,
- * which is an attribute or property VALUE: some OTHER element received it and
- * decides where it renders, so this file's call sites say nothing about it and
- * it can never be attributed to anything. Collapsing the two makes a handed-off
- * template resolve through the wrong component's call sites.
- *
- * @typedef {{
- *   tag: string,
- *   scope: FormScope,
- *   delivers: boolean | null,
- *   expr: string | null,
- * }} FormScopeSite
- *
- * `expr` is the submitter hole's expression text, verbatim from the redacted
- * source, and null for a tag use. A caller MUST look at it before treating the
- * hole as an action binding: this scan is lexical, while the renderer binds only
- * when the value is a FUNCTION (`isBoundFormAction`), so
- * `formaction=${'/api/' + id}` is an ordinary url attribute that ships fine.
- *
- * `delivers` is meaningful only when `scope` is `'unbound'`: true when that
- * form would still carry a submitter's identity to the server, false when it
- * would not, and null when a hole in its start tag makes the answer dynamic and
- * therefore unknowable.
- */
-
-/**
- * Walk every `` html`...` `` template literal in `src` and report, for each
- * submitter action hole (`<button|input formaction=${...}>`) and each
- * custom-element start tag, the enclosing `<form>` scope at that point (#1307).
- *
- * NOTE: this currently has NO production caller. It was written for the
- * `submitter-needs-bound-form` check rule, which #1384 removed because its
- * premise was false: a bound submitter is self-sufficient, so the enclosing
- * form's boundness does not decide whether the action runs. The scan itself is
- * correct about what it reports and is kept for a future consumer, but nothing
- * reads it today, so treat it as unproven against real-world input.
- *
- * Only an `html`-tagged literal is entered, so `const s = '<form>'` and a `css`
- * or `sql` template are never read as markup. That carve-out matters: the
- * framework's own website renders `<form action=${fn}>` as a code SAMPLE.
- *
- * A template nested inside a CHILD-position hole INHERITS the enclosing scope,
- * because that is where the renderer places it (through arrays, `repeat`, and
- * nested templates).
- *
- * One in a START-TAG hole is `'handed'`: an attribute or property value whose
- * placement this scan cannot speak for. Worth being exact about why, because the
- * obvious reason is not the operative one. SSR does NOT render such a template
- * in place: a serializable value rides to the receiving element as
- * `data-webjs-prop-*` and is applied at HYDRATION, and one carrying a function
- * (a bound submitter, by definition) fails to serialize, so `render-server.js`
- * DROPS the binding with a warning and emits nothing for it at all. Either way
- * the element that receives the property decides where the content lands, in the
- * browser, which is exactly what this scan cannot see.
- *
- * The single exception is `<webjs-suspense .fallback=${…}>`, which the renderer
- * really does render inline with the enclosing scope (see
- * `isInlineStartTagHole`), so that one inherits.
- *
- * A separate top-level template starts fresh at
- * `'none'`, because it is its own scan there too. `</form>` returns to the scope
- * the scan started in, mirroring `handleTagEnd` in `render-server.js`.
- *
- * `opensForm` reports whether ANY `<form` start tag was seen anywhere in `src`.
- * It exists for a caller that attributes a scope-`'none'` site to this file: a
- * fragment built into a local and spliced into a form the same file opens
- * inherits the SPLICE point's scope, not the file's own call-site scope, so a
- * file that opens a form cannot have its `'none'` sites attributed safely.
- *
- * @param {string} src
- * @returns {{ submitters: FormScopeSite[], tagUses: FormScopeSite[], opensForm: boolean }}
- */
-export function scanHtmlFormScopes(src) {
-  const { redacted, literals } = redactToPlaceholders(src);
-  /** @type {FormScopeSite[]} */
-  const submitters = [];
-  /** @type {FormScopeSite[]} */
-  const tagUses = [];
-  let opensForm = false;
-  const n = redacted.length;
-  // Sticky, so matching a literal placeholder at the cursor costs no slice.
-  const STR = /__STR_(\d+)__/y;
-
-  /**
-   * Walk code. In placeholder mode a comment body and a regex body are already
-   * blanked to spaces and a string body is one opaque token, so the only
-   * structure left to track is braces, quote delimiters, and backticks.
-   *
-   * @param {number} i
-   * @param {boolean} stopAtBrace return at the `}` closing the enclosing hole
-   * @param {FormScope} scope inherited by any template found here
-   * @param {boolean | null} delivers inherited alongside `scope`
-   * @returns {number}
-   */
-  function walkCode(i, stopAtBrace, scope, delivers) {
-    let brace = 0;
-    while (i < n) {
-      const c = redacted[i];
-      if (stopAtBrace && c === '}' && brace === 0) return i;
-      if (c === '{') { brace++; i++; continue; }
-      if (c === '}') { brace--; i++; continue; }
-      if (c === "'" || c === '"') {
-        i++;
-        while (i < n && redacted[i] !== c && redacted[i] !== '\n') i++;
-        if (i < n) i++;
-        continue;
-      }
-      if (c === '`') {
-        const before = redacted.slice(Math.max(0, i - 32), i);
-        const tagged = /([A-Za-z_$][\w$]*)\s*$/.exec(before);
-        i = walkTemplate(i + 1, !!tagged && tagged[1] === 'html', scope, delivers);
-        continue;
-      }
-      i++;
-    }
-    return i;
-  }
-
-  /**
-   * Walk one template literal from just after its opening backtick.
-   *
-   * @param {number} i
-   * @param {boolean} isHtml whether its markup should be read
-   * @param {FormScope} startScope
-   * @param {boolean | null} startDelivers
-   * @returns {number} the index just past the closing backtick
-   */
-  function walkTemplate(i, isHtml, startScope, startDelivers) {
-    /** @type {FormScope} */
-    let scope = startScope;
-    /** @type {boolean | null} */
-    let delivers = startDelivers;
-    /**
-     * The start tag currently open. It persists across literal segments AND
-     * across holes, because `<form action=${fn} class="x">` is one tag split
-     * into three pieces by the scan. `text` accumulates the tag's literal
-     * source so its attributes can be read at the `>`, and `dynamicAttrs`
-     * records that a hole other than the action binding landed in it, which
-     * makes those attributes unknowable.
-     * @type {null | { name: string, isClose: boolean, quote: string | null, formHole: boolean, submitterHole: boolean, submitterExpr: string | null, text: string, dynamicAttrs: boolean }}
-     */
-    let tag = null;
-    let inComment = false;
-    let lastLiteral = '';
-
-    const closeTag = () => {
-      const t = tag;
-      tag = null;
-      if (!t) return;
-      if (t.isClose) {
-        // Back to the scope this scan STARTED in, not a flat 'none': a nested
-        // template closing a form of its own learns nothing about the form its
-        // caller may have opened.
-        if (t.name === 'form') { scope = startScope; delivers = startDelivers; }
-        return;
-      }
-      if (t.name === 'form') {
-        opensForm = true;
-        // A form that opened and bound NOTHING still opens a scope: a submitter
-        // inside it is a different answer from one with no form at all. Whether
-        // that unbound form would still DELIVER a submitter's identity is a
-        // separate question, and the one that decides if the shape is broken.
-        scope = t.formHole ? 'bound' : 'unbound';
-        delivers = t.formHole ? null : (t.dynamicAttrs ? null : unboundFormDelivers(t.text));
-        return;
-      }
-      if (t.submitterHole) submitters.push({ tag: t.name, scope, delivers, expr: t.submitterExpr || null });
-      if (t.name.includes('-')) tagUses.push({ tag: t.name, scope, delivers, expr: null });
-    };
-
-    /** @param {string} text one literal segment, read as markup */
-    const consumeMarkup = (text) => {
-      let p = 0;
-      while (p < text.length) {
-        if (inComment) {
-          const end = text.indexOf('-->', p);
-          if (end < 0) return;
-          inComment = false;
-          p = end + 3;
-          continue;
-        }
-        if (tag) {
-          const ch = text[p];
-          if (tag.quote) {
-            if (ch === tag.quote) tag.quote = null;
-            tag.text += ch;
-            p++;
-            continue;
-          }
-          if (ch === '"' || ch === "'") { tag.quote = ch; tag.text += ch; p++; continue; }
-          if (ch === '>') { p++; closeTag(); continue; }
-          tag.text += ch;
-          p++;
-          continue;
-        }
-        const lt = text.indexOf('<', p);
-        if (lt < 0) return;
-        if (text.startsWith('<!--', lt)) { inComment = true; p = lt + 4; continue; }
-        const m = /^<(\/?)([A-Za-z][A-Za-z0-9-]*)/.exec(text.slice(lt));
-        if (!m) { p = lt + 1; continue; }
-        tag = {
-          name: m[2].toLowerCase(),
-          isClose: m[1] === '/',
-          quote: null,
-          formHole: false,
-          submitterHole: false,
-          submitterExpr: null,
-          text: m[0],
-          dynamicAttrs: false,
-        };
-        p = lt + m[0].length;
-      }
-    };
-
-    while (i < n) {
-      const c = redacted[i];
-      if (c === '`') return i + 1;
-      if (c === '$' && redacted[i + 1] === '{') {
-        let capturingSubmitter = false;
-        if (isHtml && tag && !tag.isClose) {
-          const attr = trailingActionAttr(lastLiteral);
-          if (attr === 'action' && tag.name === 'form') tag.formHole = true;
-          else if (attr === 'formaction' && (tag.name === 'button' || tag.name === 'input')) {
-            tag.submitterHole = true;
-            capturingSubmitter = true;
-          }
-          // Any OTHER hole in a form's start tag makes its `method` / `enctype`
-          // dynamic, so whether an unbound form would deliver becomes unknowable.
-          else if (tag.name === 'form') tag.dynamicAttrs = true;
-        }
-        // A hole inside a START TAG is USUALLY an attribute or property VALUE
-        // whose placement this scan cannot speak for, so it starts at 'handed'
-        // instead of inheriting. A hole in CHILD position is rendered inline by
-        // this scan and does inherit, and so does the one start-tag hole the
-        // renderer also renders inline (`isInlineStartTagHole`).
-        //
-        // Read the JSDoc on `scanHtmlFormScopes` for why 'handed' is right: SSR
-        // does NOT render such a template in place, so the receiving element
-        // decides where it lands, in the browser.
-        //
-        // Without the split, `<form method="post"><my-thing .tpl=${html`<button
-        // formaction=${del}>x</button>`}></my-thing></form>` scored the button
-        // 'unbound' from lexical nesting. Nothing renders that button at SSR at
-        // all (the binding carries a function, so it fails to serialize and is
-        // dropped), and where it ends up is `my-thing`'s decision at hydration,
-        // so a conclusive verdict here was never this scan's to give.
-        //
-        // 'handed' and NOT 'none', which is the subtle half: 'none' is the
-        // cannot-tell a caller attributes to this file's own component and
-        // resolves against ITS call sites, and a handed-off template belongs to
-        // whichever element received it instead. Using 'none' here silences the
-        // false positive on a page and recreates it in a component file.
-        const inlineHole = tag && !tag.isClose && isInlineStartTagHole(tag.name, lastLiteral);
-        const handOff = tag && !tag.isClose && !inlineHole;
-        const holeScope = handOff ? 'handed' : scope;
-        const holeDelivers = handOff ? null : delivers;
-        // Only the segment IMMEDIATELY before a hole can commit an attribute,
-        // so two adjacent holes leave nothing for the second to read.
-        lastLiteral = '';
-        const holeStart = i + 2;
-        i = walkCode(i + 2, true, holeScope, holeDelivers);
-        // The hole's expression, so a caller can require a real action binding.
-        if (capturingSubmitter && tag) tag.submitterExpr = redacted.slice(holeStart, i).trim();
-        if (i < n && redacted[i] === '}') i++;
-        continue;
-      }
-      STR.lastIndex = i;
-      const m = STR.exec(redacted);
-      if (m) {
-        const text = literals[Number(m[1])] || '';
-        lastLiteral = text;
-        if (isHtml) consumeMarkup(text);
-        i = STR.lastIndex;
-        continue;
-      }
-      i++;
-    }
-    return i;
-  }
-
-  walkCode(0, false, 'none', null);
-  return { submitters, tagUses, opensForm };
-}
-
diff --git a/packages/server/test/scanner/form-action-holes.test.js b/packages/server/test/scanner/form-action-holes.test.js
new file mode 100644
index 000000000..416c1e9b6
--- /dev/null
+++ b/packages/server/test/scanner/form-action-holes.test.js
@@ -0,0 +1,70 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { classifyActionHole } from '../../src/js-scan.js';
+import { PARSEABLE_ENCTYPES } from '../../../core/src/form-action.js';
+import { readFile } from 'node:fs/promises';
+
+/**
+ * Tests for the form-action template primitives that outlived the
+ * `submitter-needs-bound-form` rule (#1384 removed it, and with it the
+ * whole-app form-scope scan it was built on).
+ *
+ * `classifyActionHole` is still live: the `form-action-not-a-get-action` rule
+ * in `check.js` uses it to pair a tag with the attribute that binds an action.
+ * The enctype tests pin the relationship between the renderer's allowlist and
+ * the client guard's one-keyword denylist, which is a real cross-half drift
+ * risk and has nothing to do with the removed rule.
+ */
+
+test('classifyActionHole matches the tag and the attribute as a pair', () => {
+  assert.equal(classifyActionHole('<form action='), 'form');
+  assert.equal(classifyActionHole('<button formaction='), 'submitter');
+  assert.equal(classifyActionHole('<input formaction='), 'submitter');
+  assert.equal(classifyActionHole('<div action='), null, 'a div binds nothing');
+  assert.equal(classifyActionHole('<form formaction='), null, 'wrong attribute for the tag');
+  assert.equal(classifyActionHole('<button action='), null, 'wrong attribute for the tag');
+  assert.equal(classifyActionHole('<form action=x><span>'), null, 'the tag already closed');
+  assert.equal(classifyActionHole('plain text'), null);
+});
+
+test('the enctype allowlist and the client guard do not drift apart', async () => {
+  // The renderer refuses an enctype outside its allowlist; the client guard
+  // declines only `text/plain`, the one encoding the server cannot parse. Pin
+  // the relationship rather than asserting the two are equal, so a change to
+  // core's set surfaces here instead of drifting silently.
+  assert.ok(!PARSEABLE_ENCTYPES.has('text/plain'), 'the renderer cannot parse text/plain either');
+  assert.deepEqual([...PARSEABLE_ENCTYPES].sort(),
+    ['application/x-www-form-urlencoded', 'multipart/form-data'],
+    'if core gains an enctype, revisit the client guard denylist');
+
+  // Two hardcoded copies of the denylist keyword remain: the client guard in
+  // `router-client.js` and this test. Pin the client one, so the two halves of
+  // the feature cannot drift into disagreeing on the same input (which is what
+  // the allowlist did).
+  const clientSrc = await readFile(new URL('../../../core/src/router-client.js', import.meta.url), 'utf8');
+  assert.match(clientSrc, /enctype\.toLowerCase\(\) === 'text\/plain'/,
+    'the client guard uses the same one-keyword denylist, not the renderer allowlist');
+  assert.doesNotMatch(clientSrc, /PARSEABLE_ENCTYPES/,
+    'and does not reach for the renderer allowlist again');
+});
+
+test('the renderer refuses an enctype it cannot honour', async () => {
+  // The renderer asks whether the form does what the author wrote, and an
+  // invalid value is the dangerous case: a typo'd `multipart/form-dat` falls
+  // back to urlencoded and silently drops every FILE from the submission.
+  const { html } = await import('../../../core/src/html.js');
+  const { renderToString } = await import('../../../core/src/render-server.js');
+  const { setFormActionResolver } = await import('../../../core/src/form-action.js');
+  setFormActionResolver(async () => 'abc1234567/save');
+  const save = async () => ({ success: true });
+
+  await assert.rejects(
+    () => renderToString(html`<form action=${save} enctype=${'multipart/form-dat'}></form>`, { ssr: true }),
+    /cannot work|enctype/i,
+  );
+  await assert.rejects(
+    () => renderToString(html`<form action=${save} enctype=${'text/plain'}></form>`, { ssr: true }),
+    /cannot work|enctype/i,
+  );
+});
diff --git a/packages/server/test/scanner/html-form-scopes.test.js b/packages/server/test/scanner/html-form-scopes.test.js
deleted file mode 100644
index 8448665c5..000000000
--- a/packages/server/test/scanner/html-form-scopes.test.js
+++ /dev/null
@@ -1,325 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-
-import {
-  scanHtmlFormScopes,
-  classifyActionHole,
-  matchClosingBrace,
-  extractWebComponentClassBodies,
-  redactStringsAndTemplates,
-} from '../../src/js-scan.js';
-import { PARSEABLE_ENCTYPES } from '../../../core/src/form-action.js';
-import { readFile } from 'node:fs/promises';
-
-/**
- * Unit tests for the lexical form-scope scan in `js-scan.js`, plus the shared
- * template primitives around it (`classifyActionHole`, `matchClosingBrace`,
- * `extractWebComponentClassBodies`) and the enctype constant the renderer and
- * the client guard both answer to. The shapes the scan must NOT read as markup
- * (a plain string, a `css` template, an HTML comment) are what keep any
- * consumer of it off a docs page.
- */
-
-test('a submitter reports the scope of its enclosing form', () => {
-  assert.deepEqual(
-    scanHtmlFormScopes('html`<form action=${save}><button formaction=${del}>x</button></form>`').submitters,
-    [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }],
-  );
-  assert.deepEqual(
-    scanHtmlFormScopes('html`<form><button formaction=${del}>x</button></form>`').submitters,
-    [{ tag: 'button', scope: 'unbound', delivers: false, expr: 'del' }],
-  );
-  assert.deepEqual(
-    scanHtmlFormScopes('html`<button formaction=${del}>x</button>`').submitters,
-    [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }],
-  );
-});
-
-test('a nested template inherits the enclosing form scope', () => {
-  // What the renderer does: `render` threads `formScope` through arrays,
-  // `repeat`, and nested templates, so a per-row button in a bound form is
-  // bound.
-  const bound = 'html`<form action=${save}>${rows.map((r) => html`<button formaction=${del}>x</button>`)}</form>`';
-  assert.deepEqual(scanHtmlFormScopes(bound).submitters, [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }]);
-  const unbound = 'html`<form>${rows.map((r) => html`<button formaction=${del}>x</button>`)}</form>`';
-  assert.deepEqual(scanHtmlFormScopes(unbound).submitters, [{ tag: 'button', scope: 'unbound', delivers: false, expr: 'del' }]);
-});
-
-test('the scope closes at </form> and does not leak forward', () => {
-  const src = 'html`<form action=${save}></form><button formaction=${del}>x</button>`';
-  assert.deepEqual(scanHtmlFormScopes(src).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
-});
-
-test('a start tag split across holes is still one tag', () => {
-  const src = 'html`<form action=${save} class="a"><button class=${c} formaction=${del}>x</button></form>`';
-  assert.deepEqual(scanHtmlFormScopes(src).submitters, [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }]);
-});
-
-test('a `>` inside a quoted attribute value does not close the tag', () => {
-  const src = 'html`<form action=${save}><div title="a>b"></div><button formaction=${del}>x</button></form>`';
-  assert.deepEqual(scanHtmlFormScopes(src).submitters, [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }]);
-});
-
-test('a custom-element start tag is reported, its close tag is not', () => {
-  assert.deepEqual(
-    scanHtmlFormScopes('html`<form action=${save}><row-btn></row-btn></form>`').tagUses,
-    [{ tag: 'row-btn', scope: 'bound', delivers: null, expr: null }],
-  );
-  assert.deepEqual(
-    scanHtmlFormScopes('html`<form><row-btn></row-btn></form>`').tagUses,
-    [{ tag: 'row-btn', scope: 'unbound', delivers: false, expr: null }],
-  );
-});
-
-test('only an html-tagged literal is read as markup', () => {
-  // The carve-out the whole rule rests on: the framework's own website renders
-  // `<form action=${fn}>` as a code SAMPLE.
-  assert.deepEqual(scanHtmlFormScopes("const s = '<form><button formaction=x></button></form>';").submitters, []);
-  assert.deepEqual(scanHtmlFormScopes('css`.a { }` + html`<row-btn></row-btn>`').tagUses, [{ tag: 'row-btn', scope: 'none', delivers: null, expr: null }]);
-  // A form written inside a plain string cannot open a scope for real markup.
-  const mixed = "const s = '<form>'; export default () => html`<button formaction=${del}>x</button>`;";
-  assert.deepEqual(scanHtmlFormScopes(mixed).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
-});
-
-test('an HTML comment is not markup', () => {
-  const src = 'html`<!-- <form> --><button formaction=${del}>x</button>`';
-  assert.deepEqual(scanHtmlFormScopes(src).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
-});
-
-test('classifyActionHole matches the tag and the attribute as a pair', () => {
-  assert.equal(classifyActionHole('<form action='), 'form');
-  assert.equal(classifyActionHole('<button formaction='), 'submitter');
-  assert.equal(classifyActionHole('<input formaction='), 'submitter');
-  assert.equal(classifyActionHole('<div action='), null, 'a div binds nothing');
-  assert.equal(classifyActionHole('<form formaction='), null, 'wrong attribute for the tag');
-  assert.equal(classifyActionHole('<button action='), null, 'wrong attribute for the tag');
-  assert.equal(classifyActionHole('<form action=x><span>'), null, 'the tag already closed');
-  assert.equal(classifyActionHole('plain text'), null);
-});
-
-test('matchClosingBrace walks past a template hole (#1307)', () => {
-  // A hole is a CODE context nested in a template, not a brace in the block
-  // being matched. Counting it toward the outer depth (the earlier behaviour)
-  // meant depth could never return to zero.
-  const s = '{ return html`<b>${x}</b>`; }';
-  assert.equal(matchClosingBrace(s, 1), s.length - 1);
-  const nested = '{ a(html`${ b(html`${c}`) }`); }';
-  assert.equal(matchClosingBrace(nested, 1), nested.length - 1);
-  // Still returns -1 when there really is no match.
-  assert.equal(matchClosingBrace('{ a(', 1), -1);
-});
-
-test('a class body holding a template hole is extractable from RAW source', () => {
-  // Every other caller passes a masked source in which holes are blanked, so
-  // this path was the one that exposed the brace bug.
-  const src = [
-    'class RowBtn extends WebComponent({}) {',
-    '  render() { return html`<button formaction=${del}>x</button>`; }',
-    '}',
-  ].join('\n');
-  const bodies = extractWebComponentClassBodies(src);
-  assert.equal(bodies.length, 1);
-  assert.match(bodies[0].body, /formaction=\$\{del\}/);
-  assert.deepEqual(scanHtmlFormScopes(bodies[0].body).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
-});
-
-test('an unbound form reports whether it would still DELIVER the identity', () => {
-  // This is the bit that decides broken from working, and it is not boundness.
-  // A submitter's identity rides its OWN name/value pair, so an unbound form
-  // that still sends a parseable POST body delivers it and the action runs.
-  const sub = (formTag) => scanHtmlFormScopes(
-    'html`' + formTag + '<button formaction=${del}>x</button></form>`',
-  ).submitters[0];
-
-  assert.equal(sub('<form method="post">').delivers, true, 'a POST body carries the pair');
-  assert.equal(sub('<form method="POST">').delivers, true, 'the keyword folds case');
-  assert.equal(sub('<form method="post" enctype="multipart/form-data">').delivers, true);
-  assert.equal(sub('<form>').delivers, false, 'no method is a GET');
-  assert.equal(sub('<form method="get">').delivers, false);
-  // `method` is an enumerated attribute matched against exact keywords with no
-  // whitespace stripping, so a padded value falls to the GET default.
-  assert.equal(sub('<form method=" post ">').delivers, false);
-  assert.equal(sub('<form method="post" enctype="text/plain">').delivers, false, 'the server cannot parse it');
-  // `enctype` is an enumerated attribute whose missing AND invalid value default
-  // are both application/x-www-form-urlencoded, so an unrecognised value falls
-  // back to a parseable body. Treating it as unparseable reported a working form
-  // as broken, which is the one thing this rule must never do.
-  assert.equal(sub('<form method="post" enctype="nonsense">').delivers, true, 'an invalid enctype falls back to urlencoded');
-  assert.equal(sub('<form method="post" enctype=" text/plain ">').delivers, true, 'padded, so invalid, so urlencoded');
-  assert.equal(sub('<form method="post" enctype="TEXT/PLAIN">').delivers, false, 'the keyword folds case');
-  // A hole anywhere else in the start tag makes the answer dynamic.
-  assert.equal(sub('<form method=${m}>').delivers, null);
-  assert.equal(sub('<form enctype=${e} method="post">').delivers, null);
-});
-
-test('opensForm reports whether the source opens any form at all', () => {
-  assert.equal(scanHtmlFormScopes('html`<button formaction=${d}>x</button>`').opensForm, false);
-  assert.equal(scanHtmlFormScopes('html`<form action=${s}></form>`').opensForm, true);
-  // A form written only inside a plain string is not a form.
-  assert.equal(scanHtmlFormScopes("const s = '<form>';").opensForm, false);
-});
-
-test('class-body offsets index the RAW source identically to the mask', () => {
-  // How the rule gets a body with its templates intact without asking the brace
-  // matcher to lex raw source: locate in the position-preserving mask, slice
-  // from `content`. A regex literal holding a brace is the case that broke when
-  // raw source was passed directly.
-  const src = [
-    'class RowBtn extends WebComponent({}) {',
-    '  static re = /[{]/;',
-    '  render() { return html`<button formaction=${del}>x</button>`; }',
-    '}',
-  ].join('\n');
-  const masked = redactStringsAndTemplates(src);
-  assert.equal(masked.length, src.length, 'the mask is position-preserving');
-  const bodies = extractWebComponentClassBodies(masked);
-  assert.equal(bodies.length, 1, 'the masked view blanks the regex body, so the braces balance');
-  const body = src.slice(bodies[0].bodyStart, bodies[0].bodyEnd);
-  assert.match(body, /formaction=\$\{del\}/, 'the raw slice keeps the template intact');
-  assert.deepEqual(scanHtmlFormScopes(body).submitters, [{ tag: 'button', scope: 'none', delivers: null, expr: 'del' }]);
-});
-
-test('a template in an ordinary START-TAG hole is handed off, not inherited', () => {
-  // A hole inside a start tag is an attribute or property VALUE whose placement
-  // this scan cannot speak for: SSR never renders it in place (a serializable
-  // value applies at hydration, a function-carrying one is dropped outright), so
-  // the receiving element decides where it lands in the browser. Scoring it by
-  // lexical nesting reported a shape the renderer treats as cannot-tell (and
-  // therefore binds) as a conclusive 'unbound'. `<webjs-suspense .fallback>` is
-  // the one exception and has its own test below.
-  const passed = 'html`<form method="post"><my-thing .tpl=${html`<button formaction=${del}>x</button>`}></my-thing></form>`';
-  // 'handed', NOT 'none'. Both mean "no enclosing form in this scan", but only
-  // 'none' is a cannot-tell the caller may attribute to this file's own
-  // component. A handed-off template belongs to whichever element received it,
-  // so collapsing the two resolves it through the wrong call sites.
-  assert.deepEqual(scanHtmlFormScopes(passed).submitters, [{ tag: 'button', scope: 'handed', delivers: null, expr: 'del' }]);
-  // A hyphenated tag inside a property hole is placed by the receiving element
-  // too, so it is not this file's call site either.
-  const tagPassed = 'html`<my-shell .rows=${html`<todo-row></todo-row>`}></my-shell>`';
-  assert.deepEqual(scanHtmlFormScopes(tagPassed).tagUses.filter((u) => u.tag === 'todo-row'),
-    [{ tag: 'todo-row', scope: 'handed', delivers: null, expr: null }]);
-  // A form the handed-off template opens ITSELF is still its own scope.
-  const ownForm = 'html`<my-thing .tpl=${html`<form action=${s}><button formaction=${del}>x</button></form>`}></my-thing>`';
-  assert.deepEqual(scanHtmlFormScopes(ownForm).submitters, [{ tag: 'button', scope: 'bound', delivers: null, expr: 'del' }]);
-  // A hole in CHILD position IS rendered inline by this scan, so it still
-  // inherits. This is the pair that keeps the fix from being a blanket opt-out.
-  const child = 'html`<form method="post">${html`<button formaction=${del}>x</button>`}</form>`';
-  assert.deepEqual(scanHtmlFormScopes(child).submitters, [{ tag: 'button', scope: 'unbound', delivers: true, expr: 'del' }]);
-});
-
-test('the unparseable-enctype constant tracks the renderer\'s own set', async () => {
-  // The scanner states its enctype rule as a DENYLIST of one because of the
-  // invalid-value default, while the renderer refuses the wider allowlist. This
-  // pins the relationship rather than asserting the two are equal, so a change
-  // to core's set surfaces here instead of drifting silently.
-  assert.ok(!PARSEABLE_ENCTYPES.has('text/plain'), 'the renderer cannot parse text/plain either');
-  for (const e of PARSEABLE_ENCTYPES) {
-    const src = `html\`<form method="post" enctype="${e}"><button formaction=\${d}>x</button></form>\``;
-    assert.equal(scanHtmlFormScopes(src).submitters[0].delivers, true, `${e} delivers`);
-  }
-  assert.deepEqual([...PARSEABLE_ENCTYPES].sort(),
-    ['application/x-www-form-urlencoded', 'multipart/form-data'],
-    'if core gains an enctype, revisit the scanner denylist');
-
-  // There are now THREE hardcoded copies of the denylist keyword: the scanner's
-  // `UNPARSEABLE_FORM_ENCTYPE`, the client guard in `router-client.js`, and this
-  // test. Pin the client one too, so the two halves of the feature cannot drift
-  // into disagreeing on the same input (which is what the allowlist did).
-  const clientSrc = await readFile(new URL('../../../core/src/router-client.js', import.meta.url), 'utf8');
-  assert.match(clientSrc, /enctype\.toLowerCase\(\) === 'text\/plain'/,
-    'the client guard uses the same one-keyword denylist, not the renderer allowlist');
-  assert.doesNotMatch(clientSrc, /PARSEABLE_ENCTYPES/,
-    'and does not reach for the renderer allowlist again');
-});
-
-test('a start-tag hole is handed off or inherited, and SSR agrees', async () => {
-  // A differential rather than an assertion about the scanner alone, because the
-  // whole 'handed' state is a claim about the renderer's behaviour. Most
-  // start-tag holes are values the receiving element places, but
-  // `<webjs-suspense .fallback=${…}>` is rendered INLINE with the enclosing form
-  // scope (#471: a custom-element property applies at hydration, too late for a
-  // placeholder that must be in the first flushed bytes), so the scanner reads
-  // it against that form rather than treating it as handed off.
-  const { html } = await import('../../../core/src/html.js');
-  const { renderToString } = await import('../../../core/src/render-server.js');
-  const { setFormActionResolver } = await import('../../../core/src/form-action.js');
-  setFormActionResolver(async () => 'abc1234567/publish');
-  const publish = async () => ({ success: true });
-
-  // Read against the enclosing form, not handed off. Nothing is asserted about
-  // a render-time refusal here: a bound submitter is SELF-SUFFICIENT (#1307), so
-  // the renderer stamps it with its own `formmethod="post"` and refuses only a
-  // same-element contradiction, never a cross-element one.
-  const fallbackSrc = 'html`<form><webjs-suspense .fallback=${html`<button formaction=${p}>x</button>`}></webjs-suspense></form>`';
-  assert.deepEqual(scanHtmlFormScopes(fallbackSrc).submitters,
-    [{ tag: 'button', scope: 'unbound', delivers: false, expr: 'p' }]);
-
-  // The negative half, and it has to assert the MECHANISM rather than "it did
-  // not throw". A template carrying a function cannot serialize, so SSR drops
-  // the whole property binding and emits nothing for it: the submitter is never
-  // rendered and never judged here at all. Asserting only that the render
-  // succeeded would stay green for ANY scanner verdict, which is precisely the
-  // non-discriminating test this differential exists to avoid.
-  const propSrc = 'html`<form><my-thing .tpl=${html`<button formaction=${p}>x</button>`}></my-thing></form>`';
-  assert.deepEqual(scanHtmlFormScopes(propSrc).submitters,
-    [{ tag: 'button', scope: 'handed', delivers: null, expr: 'p' }]);
-  const warns = [];
-  const quiet = console.warn;
-  console.warn = (...a) => warns.push(a.join(' '));
-  let out;
-  try {
-    out = await renderToString(
-      html`<form><my-thing .tpl=${html`<button formaction=${publish}>x</button>`}></my-thing></form>`,
-      { ssr: true },
-    );
-  } finally { console.warn = quiet; }
-  assert.doesNotMatch(out, /<button/, 'SSR emits nothing for the dropped property');
-  assert.ok(warns.some((w) => /unserializable value during SSR/.test(w)),
-    'and it says so, which is the proof SSR never judged this submitter');
-
-  // The tag half of the same carve-out. A hyphenated tag in a fallback IS a real
-  // call site (rendered inline, inside the enclosing form); one in an ordinary
-  // property hole is not.
-  const fbTag = 'html`<form><webjs-suspense .fallback=${html`<todo-row></todo-row>`}></webjs-suspense></form>`';
-  assert.deepEqual(scanHtmlFormScopes(fbTag).tagUses.filter((u) => u.tag === 'todo-row'),
-    [{ tag: 'todo-row', scope: 'unbound', delivers: false, expr: null }]);
-  const propTag = 'html`<form><my-shell .rows=${html`<todo-row></todo-row>`}></my-shell></form>`';
-  assert.deepEqual(scanHtmlFormScopes(propTag).tagUses.filter((u) => u.tag === 'todo-row'),
-    [{ tag: 'todo-row', scope: 'handed', delivers: null, expr: null }]);
-});
-
-test('the enctype divergence from the renderer is deliberate, on both sides', async () => {
-  // The scanner uses a one-keyword denylist and the renderer an allowlist, and
-  // it would be easy to "unify" them later. This pins WHY they differ, so that
-  // change breaks a test carrying its own reason.
-  //
-  // They ask different questions. This rule asks whether the identity ARRIVES,
-  // and an invalid enctype falls back to urlencoded, so it does. The renderer
-  // asks whether the form does what the author wrote, and an invalid value is
-  // the dangerous case: a typo'd `multipart/form-dat` falls back to urlencoded
-  // and silently drops every FILE from the submission.
-  const { html } = await import('../../../core/src/html.js');
-  const { renderToString } = await import('../../../core/src/render-server.js');
-  const { setFormActionResolver } = await import('../../../core/src/form-action.js');
-  setFormActionResolver(async () => 'abc1234567/save');
-  const save = async () => ({ success: true });
-
-  const sub = (formTag) => scanHtmlFormScopes(
-    'html`' + formTag + '<button formaction=${del}>x</button></form>`',
-  ).submitters[0];
-
-  // The scanner: an invalid enctype still delivers, so it is not a defect.
-  assert.equal(sub('<form method="post" enctype="multipart/form-dat">').delivers, true);
-  // The renderer: the same typo throws, because it would cost the author their
-  // file upload with no other signal.
-  await assert.rejects(
-    () => renderToString(html`<form action=${save} enctype=${'multipart/form-dat'}></form>`, { ssr: true }),
-    /cannot work|enctype/i,
-  );
-  // And both agree that text/plain is broken.
-  assert.equal(sub('<form method="post" enctype="text/plain">').delivers, false);
-  await assert.rejects(
-    () => renderToString(html`<form action=${save} enctype=${'text/plain'}></form>`, { ssr: true }),
-    /cannot work|enctype/i,
-  );
-});