@webjsdev/server 0.8.59 → 0.8.61

package/src/dev.js

@@ -15,7 +15,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { buildRouteTable, matchPage, matchApi } from './router.js';
 import { generateRouteTypes } from './route-types.js';
 import { ssrPage, ssrNotFound, setClientRouterEnabled } from './ssr.js';
-import { runFormAction } from './form-dispatch.js';
+import { runFormAction, reportFormSubmittedAsGet } from './form-dispatch.js';
 import { handleApi } from './api.js';
 import {
   buildActionIndex,
@@ -650,7 +650,7 @@ export async function createRequestHandler(opts) {
   // `webjs.seed` switch. Action identity (#1155) rides the same hook, and it is
   // what a bound `<form action=${action}>` resolves through, so gating the hook
   // on seeding would mean `webjs.seed: false` silently broke every no-JS form.
-  await registerActionHooks({ seed: await readSeedEnabled(appDir) });
+  await registerActionHooks({ seed: await readSeedEnabled(appDir), dev });
 
 
   // When an app commits a vendor pin (.webjs/vendor/importmap.json) it carries a
@@ -909,10 +909,14 @@ export async function createRequestHandler(opts) {
             // Client-router opt-out (#629): re-read each pass so toggling
             // `webjs.clientRouter` takes effect on rebuild without a restart.
             setClientRouterEnabled(await readClientRouterEnabled(appDir));
-            const r = (await readElideEnabled(appDir))
+            // Read the switch ONCE: the dev summary below reports it too, and
+            // calling readElideEnabled twice per warm re-reads package.json.
+            const elideOn = await readElideEnabled(appDir);
+            const r = elideOn
               ? await analyzeElision(components, collectRouteModules(state.routeTable),
                   state.moduleGraph, (f) => readFile(f, 'utf8'), appDir)
-              : { elidableComponents: new Set(), inertRouteModules: new Set(), importOnlyRouteModules: new Map() };
+              : { elidableComponents: new Set(), inertRouteModules: new Set(), importOnlyRouteModules: new Map(),
+                  shippedRouteModules: new Map(), componentVerdicts: new Map() };
             state.elidableComponents = r.elidableComponents;
             state.inertRouteModules = r.inertRouteModules;
             state.importOnlyRouteModules = r.importOnlyRouteModules;
@@ -982,12 +986,40 @@ export async function createRequestHandler(opts) {
             }
             t.elision = now() - m;
             if (dev) {
+              // An orphan is EITHER shape `findOrphanComponents` reports: no
+              // registration call at all, or one whose tag is computed. The
+              // scanner matches only a literal tag, so it sees neither, and
+              // what is ALWAYS lost is the verdict, the registry entry, and the
+              // preload hint. The upgrade is the part that differs, and a
+              // computed tag only survives when its importer ships WHOLE (see
+              // findOrphanComponents for why that is the exception). The doctor
+              // check and `webjs elision` say the same thing.
               for (const { className, file } of await findOrphanComponents(appDir)) {
                 logger.warn?.(
-                  `[webjs] ${className} extends WebComponent but has no customElements.define(...) call in ${file}. ` +
-                    `Add \`customElements.define('<tag-name>', ${className});\` or <${kebab(className)}> tags won't upgrade.`,
+                  `[webjs] ${className} extends WebComponent but is never registered with a literal tag in ${file} ` +
+                    `(either there is no registration call, or its tag is computed), so the scanner cannot see it: ` +
+                    `no elision verdict, no registry entry, no preload hint. ` +
+                    `<${kebab(className)}> tags never upgrade with no registration call, and a computed tag ` +
+                    `upgrades only while its importing module ships whole. ` +
+                    `Add \`${className}.register('<tag-name>');\` with a literal tag.`,
                 );
               }
+              // The elision summary (#1308), one server-console line. NOT a
+              // browser push: an inert route ships zero application JS, and the
+              // most useful manual check an author has is opening the network
+              // tab on that route and seeing nothing, which a dev-only boot
+              // script would corrupt on exactly the pages this proves. The fact
+              // is also app-wide while a browser channel is per-tab, and the
+              // per-page detail already has a home in `webjs elision`.
+              // Re-emitted after each fs.watch rebuild, because doRebuild sets
+              // analysisDone = false and this sits inside that stage.
+              logger.info?.(
+                elideOn
+                  ? `[webjs] elision: ${r.elidableComponents.size}/${new Set(components.map((c) => c.file)).size} components elided, ` +
+                    `${r.inertRouteModules.size} route modules inert, ${r.importOnlyRouteModules.size} import-only, ` +
+                    `${r.shippedRouteModules.size} ship whole. Run \`webjs elision\` for the per-module verdict.`
+                  : `[webjs] elision: disabled (WEBJS_ELIDE / webjs.elide), every module ships.`,
+              );
             }
             analysisDone = true;
             ranAnalysis = true;
@@ -1316,12 +1348,18 @@ export async function createRequestHandler(opts) {
       // root-mounted `/__webjs/*`. The logged `path` stays the RAW client URL.
       if (shouldAccessLog(headerPathname)) {
         try {
+          // #1309: fold the dev-only seeding counters into the ONE access-log
+          // line rather than adding a second one. Present only on a response
+          // that carried the header, so only page renders gain the field and
+          // production is unchanged.
+          const seed = dev ? conditioned.headers.get('x-webjs-seed') : null;
           logger.info?.('request', {
             requestId: reqId,
             method: req.method,
             path: pathname,
             status: conditioned.status,
             durationMs: Math.round((performance.now() - startedAt) * 100) / 100,
+            ...(seed ? { seed } : {}),
           });
         } catch { /* never let logging crash the response */ }
       }
@@ -1479,7 +1517,7 @@ export async function createRequestHandler(opts) {
       // Build all whole-app analysis on the first request (memoized), before
       // any SSR, module serve, gate check, action dispatch, or middleware runs.
       await ensureReady();
-      const next = () => handleCore(req, { state, appDir, coreDir, dev, reportError, reportDevError, cspEnabled: cspConfig.enabled, allowedOrigins: allowedOriginsValue });
+      const next = () => handleCore(req, { state, appDir, coreDir, dev, reportError, reportDevError, hasOnError, logger, cspEnabled: cspConfig.enabled, allowedOrigins: allowedOriginsValue });
       if (state.middleware) {
         try {
           return await state.middleware(req, next);
@@ -1976,7 +2014,7 @@ async function tryServeFrameworkStatic(path, method, ctx) {
 }
 
 async function handleCore(req, ctx) {
-  const { state, appDir, coreDir, dev, reportError, reportDevError, cspEnabled, allowedOrigins } = ctx;
+  const { state, appDir, coreDir, dev, reportError, reportDevError, hasOnError, logger, cspEnabled, allowedOrigins } = ctx;
   const url = new URL(req.url);
   // Decode percent-encoded characters so filesystem lookups match real
   // filenames. Dynamic route segments like `[slug]` and route groups like
@@ -2252,6 +2290,20 @@ async function handleCore(req, ctx) {
           : undefined,
       };
       if (method === 'GET' || method === 'HEAD') {
+        // #1307: `__webjs_action` in the QUERY STRING means a submission
+        // carrying a bound action's identity went out as a GET, so the action
+        // never ran. Nothing else in the framework puts that reserved field in
+        // a url. Detect only, so the render below is unchanged: answering a GET
+        // differently because of a query parameter would hand any visitor a way
+        // to turn any page into an error.
+        reportFormSubmittedAsGet(
+          url, req,
+          // Gated on hasOnError, not on `reportError`: that is always a
+          // function here and no-ops internally, so passing it would spend a
+          // dedupe slot on a report nobody receives.
+          hasOnError ? (e) => reportError(e, req, 'action') : undefined,
+          logger, dev, page.route,
+        );
         // A successful render of URL U supersedes a RETAINED render error for
         // that same URL (#1047), so a reconnecting tab is not handed a frame the
         // page has since recovered from. Keyed on BOTH frame identity and url:
@@ -2280,7 +2332,8 @@ async function handleCore(req, ctx) {
       const deps = {
         actionIndex: state.actionIndex,
         allowedOrigins,
-        onError: reportError ? (e) => reportError(e, req, 'action') : undefined,
+        onError: hasOnError ? (e) => reportError(e, req, 'action') : undefined,
+        logger,
       };
       const handler = () => runFormAction(page.route, page.params, url, req, ssrOpts, deps);
       return runWithSegmentMiddleware(req, page.route.middlewares, handler, dev);

package/src/elision-differential.js

@@ -0,0 +1,101 @@
+/**
+ * The differential-elision primitives, shared by the framework's own guard and
+ * by the app-facing one (#1308).
+ *
+ * Elision's defining invariant is that removing the elided JS NEVER changes
+ * observable output. `packages/server/test/elision/differential-elision.test.js`
+ * proves that for the blog corpus by rendering every route with elision ON and
+ * OFF and diffing the bytes with the JS-loaded set masked out. `webjs elision
+ * --verify` runs the identical comparison over an arbitrary app's own route
+ * table, so every app gets the framework's own guard rather than inheriting a
+ * guarantee it cannot verify locally.
+ *
+ * `maskJsSet` therefore lives HERE and not in either consumer: it is the
+ * definition of "the JS-loaded set", and two copies is the one way the two
+ * guards could silently disagree about what the invariant even means.
+ *
+ * A leaf module: `node:path` is not even needed, and nothing here reads the
+ * filesystem or builds a graph.
+ */
+
+/**
+ * Mask the JS-loaded set so the diff sees only observable output. The
+ * importmap, the boot module script, and the modulepreload hints are
+ * REMOVED (not placeheld) because their COUNT differs on vs off, and the
+ * build-id hash is derived from them; collapsing whitespace afterwards
+ * means the differing-length preload block in the head leaves no trace. The
+ * two responses come from the identical SSR template pipeline, so any
+ * legitimate text/whitespace is the same on both sides regardless.
+ *
+ * Because the whole JS-loaded set is masked BY CONSTRUCTION, only the
+ * DANGEROUS direction (elision changed what the SSR emits) can fail a diff
+ * built on this. The SAFE direction (over-ship) lives entirely inside the
+ * masked region and is invisible here, by design.
+ *
+ * @param {string} html
+ * @returns {string}
+ */
+export function maskJsSet(html) {
+  return html
+    .replace(/<script type="importmap"[\s\S]*?<\/script>/g, '')
+    .replace(/<script type="module"[\s\S]*?<\/script>/g, '')
+    .replace(/<link rel="modulepreload"[^>]*>/g, '')
+    // The auto vendor preconnect / dns-prefetch (#243) is a connection-warming
+    // HINT derived from the served vendor map, which legitimately differs on vs
+    // off (a vendor reachable only through an elided component is pruned on the
+    // ON side, so its preconnect drops too, exactly like its modulepreload). It
+    // is part of the same JS-loaded set, so mask it. The blog corpus declares
+    // no `metadata.preconnect` of its own, so every preconnect/dns-prefetch
+    // there is the auto vendor one.
+    .replace(/<link rel="preconnect"[^>]*>/g, '')
+    .replace(/<link rel="dns-prefetch"[^>]*>/g, '')
+    .replace(/ data-webjs-build="[^"]*"/g, '')
+    .replace(/ data-webjs-src="[^"]*"/g, '')
+    // Render-clock nondeterminism: a page that SSRs a live wall-clock time
+    // ("posts loaded · 3:10:10 AM") ticks between the on and off captures. This
+    // is unrelated to elision (elision never changes rendered text), so
+    // normalise it. The counterfactual in differential-elision.test.js still
+    // fails because a removed element is a structural change, not a clock tick.
+    .replace(/\b\d{1,2}:\d{2}:\d{2}\s?[AP]M\b/gi, 'TIME')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+/**
+ * The URL paths of every STATIC page route in a route table, sorted and
+ * deduped. The corpus `webjs elision --verify` renders on both sides.
+ *
+ * A DYNAMIC route is excluded rather than guessed at: rendering it would mean
+ * inventing param values, and a route that 404s or throws on invented params
+ * proves nothing. The command reports the excluded routes by name and takes
+ * `--routes` for an author who wants to cover them with real values.
+ *
+ * Normalization is `routePathFromDir`'s, restated here so this leaf does not
+ * depend on `@webjsdev/mcp`: a route group `(group)` and a `_private` segment
+ * drop out of the URL, and the root `.` is `/`.
+ *
+ * @param {{ pages?: Array<{ routeDir?: string, paramNames?: string[] }> }} table  a `buildRouteTable(appDir)` result
+ * @returns {string[]}
+ */
+export function staticPageRoutes(table) {
+  const out = new Set();
+  for (const r of table?.pages || []) {
+    if (r.paramNames && r.paramNames.length) continue;
+    out.add(routePath(r.routeDir));
+  }
+  return [...out].sort();
+}
+
+/**
+ * `blog` -> `/blog`, the root `.` -> `/`. Route groups and `_private` segments
+ * drop, the same normalization `buildRouteTable` uses for matching.
+ * @param {string|undefined} routeDir
+ * @returns {string}
+ */
+function routePath(routeDir) {
+  if (!routeDir || routeDir === '.') return '/';
+  const segs = routeDir
+    .split('/')
+    .filter((s) => !(s.startsWith('(') && s.endsWith(')')) && !s.startsWith('_'));
+  return segs.length ? '/' + segs.join('/') : '/';
+}

package/src/elision-report.js

@@ -1,49 +1,82 @@
 /**
- * App-level elision report (#646).
+ * App-level elision report (#646, extended in #1308).
  *
  * A reporting layer over the `analyzeElision` verdict, NOT a second analysis
  * and NOT a build (WebJs is no-build; elision is the server's analysis pass,
  * run at dev-server start and re-derived after each fs.watch rebuild). It
- * builds the module graph, runs `analyzeElision`, and returns the page / layout
- * route modules that SHIP WHOLE to the browser, each with the first
- * client-effecting blocker that pins it (a non-component on a component-free
- * path from the module, #963, or its own signal when the module itself is
- * the cause).
+ * builds the module graph, runs `analyzeElision` ONCE, and projects the whole
+ * verdict into a sorted, app-relative, JSON-serializable object.
  *
- * Consumed by `webjs doctor` to ADVISE why a page/layout is not elided (an
- * import-only #605 / inert #179 carrier stays out of the browser; a module that
- * ships whole does not). Advisory only: a page legitimately MAY ship, and the
- * analyser is biased toward shipping by design (server AGENTS invariant 7), so
- * this never fails anything.
+ * It carries BOTH directions:
+ *
+ *   - `components`: every component module with `elided` or `shipped`, and for
+ *     a shipped one the evidence that forced it plus the module that did the
+ *     forcing. This is the direction where a wrong verdict silently loses
+ *     interactivity in production, and before #1308 an app had no way to ask
+ *     "what did you drop from my page?".
+ *   - `routeModules`: every page / layout as `inert` / `import-only` /
+ *     `shipped`, a module that ships whole naming the first client-effecting
+ *     blocker that pins it (a non-component on a component-free path from the
+ *     module, #963, or its own signal when the module itself is the cause).
+ *   - `orphans`: a `class X extends WebComponent` with no literal-tag
+ *     registration, either because there is no registration call or because
+ *     the tag is computed. The scanner never sees it (invariant 3 requires a
+ *     literal tag), so it always loses its elision verdict, its tag-to-module
+ *     registry entry, and its preload hint, and `static interactive = true`
+ *     cannot rescue it. Whether the ELEMENT still upgrades differs by shape:
+ *     with no registration call it never does, and with a computed tag only
+ *     while its importing module ships WHOLE, which is the exception rather
+ *     than the rule. It is the one shape the verdict cannot speak for.
+ *
+ * Consumed by `webjs elision` (the CLI report + `--json`), the MCP
+ * `list_elision` tool, and `webjs doctor`'s two elision checks, which share
+ * ONE call so the module graph is built once per doctor run. Advisory only: a
+ * page legitimately MAY ship, and the analyser is biased toward shipping by
+ * design (server AGENTS invariant 7), so this never fails anything.
+ *
+ * Nothing is cached here. Every out-of-process consumer runs the analysis once
+ * and exits, so a cache would never hit and would only add a staleness bug.
  */
 import { readFile, stat } from 'node:fs/promises';
-import { join } from 'node:path';
+import { join, relative, sep } from 'node:path';
 
 import { buildModuleGraph } from './module-graph.js';
-import { scanComponents } from './component-scanner.js';
+import { scanComponents, findOrphanComponents } from './component-scanner.js';
 import { buildRouteTable } from './router.js';
 import { analyzeElision } from './component-elision.js';
 
+/**
+ * @typedef {'own'|'observed'|'closure'|'render'|'import'|'unreadable'} ElisionEvidence
+ * @typedef {{ file: string, tags: string[], verdict: 'elided'|'shipped', evidence: ElisionEvidence|null, reason: string|null, by: string|null }} ElisionComponentRow
+ * @typedef {{ file: string, verdict: 'inert'|'import-only'|'shipped', emits: string[], blocker: string|null, reason: string|null }} ElisionRouteModuleRow
+ * @typedef {{ file: string, className: string }} ElisionOrphanRow
+ * @typedef {{ components: number, elided: number, shipped: number, routeModules: number, inert: number, importOnly: number, shippedWhole: number, orphans: number }} ElisionSummary
+ * @typedef {{ analysed: boolean, skipped: 'no-app'|'elide-off'|'unanalysable'|null, components: ElisionComponentRow[], routeModules: ElisionRouteModuleRow[], orphans: ElisionOrphanRow[], summary: ElisionSummary }} ElisionReport
+ */
+
 /**
  * @param {string} appDir
- * @returns {Promise<{ analysed: boolean, shipped: Array<{ file: string, blocker: string|null, reason: string }> }>}
+ * @returns {Promise<ElisionReport>}
  */
 export async function analyzeAppElision(appDir) {
   // No `app/` means this is not a routable app (a bare component library, a
-  // lib-only fixture); nothing ships, so there is nothing to advise on.
-  if (!(await pathExists(join(appDir, 'app')))) return { analysed: false, shipped: [] };
-  // Elision off (opt-out) ships everything by design, so the advisory is moot.
-  if (!(await readElideEnabled(appDir))) return { analysed: false, shipped: [] };
+  // lib-only fixture); nothing ships, so there is nothing to report on.
+  if (!(await pathExists(join(appDir, 'app')))) return empty('no-app');
+  // Elision off (opt-out) ships everything by design, so the verdict is moot.
+  if (!(await readElideEnabled(appDir))) return empty('elide-off');
 
-  let moduleGraph, components, routeTable;
+  let moduleGraph, components, routeTable, orphans;
   try {
     moduleGraph = await buildModuleGraph(appDir);
     components = await scanComponents(appDir);
     routeTable = await buildRouteTable(appDir);
+    // Not a second elision analysis: a lexical scan for the one shape elision
+    // never gets to judge, reusing what the dev server already runs.
+    orphans = await findOrphanComponents(appDir);
   } catch {
-    // A malformed app the analysis cannot process degrades to no advice (the
+    // A malformed app the analysis cannot process degrades to no report (the
     // dev server and `webjs check` surface the real problem).
-    return { analysed: false, shipped: [] };
+    return empty('unanalysable');
   }
 
   // Exactly the page + layout set the dev server feeds to analyzeElision, so
@@ -55,16 +88,86 @@ export async function analyzeAppElision(appDir) {
     for (const f of page.layouts || []) routeModuleSet.add(f);
   }
 
-  const { shippedRouteModules } = await analyzeElision(
-    components, [...routeModuleSet], moduleGraph, (f) => readFile(f, 'utf8'), appDir,
-  );
+  const { inertRouteModules, importOnlyRouteModules, shippedRouteModules, componentVerdicts } =
+    await analyzeElision(components, [...routeModuleSet], moduleGraph, (f) => readFile(f, 'utf8'), appDir);
+
+  const rel = (f) => (f == null ? null : relative(appDir, f) || f);
+  const byFile = (a, b) => a.file.localeCompare(b.file);
+
+  /** @type {ElisionComponentRow[]} */
+  const componentRows = [...componentVerdicts.entries()].map(([file, v]) => ({
+    file: /** @type {string} */ (rel(file)),
+    tags: v.tags,
+    verdict: v.shipped ? 'shipped' : 'elided',
+    evidence: v.shipped ? /** @type {ElisionEvidence|null} */ (v.evidence) : null,
+    reason: v.shipped ? relativizeReason(v.reason, appDir) : null,
+    by: v.shipped ? rel(v.by) : null,
+  })).sort(byFile);
+
+  /** @type {ElisionRouteModuleRow[]} */
+  const routeRows = [
+    ...[...inertRouteModules].map((f) => ({
+      file: /** @type {string} */ (rel(f)), verdict: /** @type {const} */ ('inert'), emits: [], blocker: null, reason: null,
+    })),
+    ...[...importOnlyRouteModules].map(([f, emits]) => ({
+      file: /** @type {string} */ (rel(f)), verdict: /** @type {const} */ ('import-only'),
+      emits: emits.map((e) => /** @type {string} */ (rel(e))).sort(), blocker: null, reason: null,
+    })),
+    ...[...shippedRouteModules].map(([f, v]) => ({
+      file: /** @type {string} */ (rel(f)), verdict: /** @type {const} */ ('shipped'), emits: [],
+      blocker: rel(v.blocker), reason: relativizeReason(v.reason, appDir),
+    })),
+  ].sort(byFile);
+
+  /** @type {ElisionOrphanRow[]} */
+  const orphanRows = orphans
+    .map((o) => ({ file: /** @type {string} */ (rel(o.file)), className: o.className }))
+    .sort((a, b) => byFile(a, b) || a.className.localeCompare(b.className));
 
-  const shipped = [...shippedRouteModules.entries()].map(([file, v]) => ({
-    file,
-    blocker: v.blocker,
-    reason: v.reason,
-  }));
-  return { analysed: true, shipped };
+  return {
+    analysed: true, skipped: null,
+    components: componentRows, routeModules: routeRows, orphans: orphanRows,
+    summary: {
+      components: componentRows.length,
+      elided: componentRows.filter((c) => c.verdict === 'elided').length,
+      shipped: componentRows.filter((c) => c.verdict === 'shipped').length,
+      routeModules: routeRows.length,
+      inert: inertRouteModules.size,
+      importOnly: importOnlyRouteModules.size,
+      shippedWhole: shippedRouteModules.size,
+      orphans: orphanRows.length,
+    },
+  };
+}
+
+/**
+ * The no-verdict report, naming WHY nothing was analysed so a machine consumer
+ * can tell "elision is switched off" from "this is not an app".
+ * @param {'no-app'|'elide-off'|'unanalysable'} skipped
+ * @returns {ElisionReport}
+ */
+function empty(skipped) {
+  return {
+    analysed: false, skipped,
+    components: [], routeModules: [], orphans: [],
+    summary: { components: 0, elided: 0, shipped: 0, routeModules: 0, inert: 0, importOnly: 0, shippedWhole: 0, orphans: 0 },
+  };
+}
+
+/**
+ * `analyzeElision` bakes ABSOLUTE paths into its reason phrases (it works in
+ * absolute paths throughout). No absolute filesystem path may reach the JSON
+ * contract, so strip the app dir prefix wherever it appears in the sentence.
+ * A plain split/join rather than a regex, so an appDir containing regex
+ * metacharacters (a `(group)` directory, a `+`) is safe.
+ *
+ * @param {string|null} reason
+ * @param {string} appDir
+ * @returns {string|null}
+ */
+function relativizeReason(reason, appDir) {
+  if (reason == null) return null;
+  return reason.split(appDir.endsWith(sep) ? appDir : appDir + sep).join('');
 }
 
 /** Mirror of the dev server's elide flag: WEBJS_ELIDE override, then webjs.elide. */

package/src/form-dispatch.js

@@ -214,6 +214,159 @@ function looksLikeFormSubmission(req) {
   return /multipart\/form-data|application\/x-www-form-urlencoded/i.test(ct);
 }
 
+/**
+ * Fingerprints already reported this process, keyed `CODE METHOD <route>`.
+ * Capped, and never cleared.
+ *
+ * Both signals below are reachable by anyone: an empty urlencoded POST to any
+ * page path, or `?__webjs_action=x` appended to any url. Reporting every hit
+ * would turn a public endpoint into a free amplifier into a paid APM sink, and
+ * an app needs to learn the SHAPE exists rather than count it (a real bug
+ * reproduces on the next boot).
+ *
+ * The key is the matched ROUTE PATTERN, not the request pathname, and that is
+ * load-bearing rather than cosmetic. Keyed on the pathname, a dynamic route
+ * yields unbounded distinct keys, so a few hundred crafted requests to
+ * `/blog/1`, `/blog/2`, … would fill the cap and permanently silence the
+ * diagnostics for the process, which is a worse failure than the amplification
+ * the cap exists to stop. Keyed on the pattern, all of those collapse to one
+ * entry and the key space is bounded by the app's own route count, which leaves
+ * the cap as a backstop no real app reaches. The code is part of the key too, so
+ * a flood of one signal can never silence the other.
+ *
+ * @type {Set<string>}
+ */
+const reportedFormFingerprints = new Set();
+const FINGERPRINT_CAP = 256;
+
+/**
+ * @param {string} key
+ * @returns {boolean} true the first time only, and false once the cap is hit
+ */
+function firstSighting(key) {
+  if (reportedFormFingerprints.has(key)) return false;
+  if (reportedFormFingerprints.size >= FINGERPRINT_CAP) return false;
+  reportedFormFingerprints.add(key);
+  return true;
+}
+
+/**
+ * The matched route's identity for the dedupe key: its page FILE, which is one
+ * per route and reads better in a report than a serialized RegExp (`pattern` is
+ * a RegExp, not a printable path). Falls back to the request pathname only when
+ * a caller has no route in hand.
+ *
+ * @param {{ file?: string } | null | undefined} route
+ * @param {URL} url
+ * @returns {string}
+ */
+function routeKeyOf(route, url) {
+  return (route && route.file) || url.pathname;
+}
+
+/**
+ * Reset the per-process report dedupe. Test seam only: the cap and the
+ * never-cleared set are the point in production.
+ */
+export function resetFormReportDedupe() {
+  reportedFormFingerprints.clear();
+}
+
+/**
+ * A form posted to a page and carried no action identity, so nothing ran and
+ * the answer is a 405. Route it to the APM sink with a code an app can group
+ * on, instead of leaving an anonymous 405 in an access log.
+ *
+ * Carries the field NAMES, which are template constants and are what identify
+ * WHICH form posted nowhere. Never the values, which are user data. The form's
+ * own `action` attribute is not carried because a bound form has none (the
+ * renderer strips it so the form posts to its own url), so the request url
+ * already is that information.
+ *
+ * @param {URL} url
+ * @param {Request} req
+ * @param {FormData} formData
+ * @param {((error: unknown) => void) | undefined} onError
+ * @param {{ warn?: (msg: string, meta?: Record<string, unknown>) => void }} [logger]
+ * @param {boolean} [dev]
+ * @param {{ file?: string } | null} [route] the matched page route, for the dedupe key
+ */
+export function reportFormActionMissing(url, req, formData, onError, logger, dev, route) {
+  const willLog = !!(dev && logger && logger.warn);
+  const willReport = typeof onError === 'function';
+  // Nothing to say: do not spend a dedupe slot, which would let a run with no
+  // sink configured quietly consume the cap for one that does.
+  if (!willLog && !willReport) return;
+  if (!firstSighting(`WEBJS_FORM_ACTION_MISSING ${req.method} ${routeKeyOf(route, url)}`)) return;
+  const fields = [...new Set([...formData.keys()])];
+  if (willLog) {
+    logger.warn(
+      `[webjs] a form posted to ${url.pathname} carrying no action identity, so nothing ran (405). Bind the action: <form action=\${yourAction}>.`,
+      { fields },
+    );
+  }
+  if (!willReport) return;
+  const err = new Error(
+    `A form submission to ${url.pathname} carried no \`${FORM_ACTION_FIELD}\` identity, so no server action ran and the request was answered with a 405.`,
+  );
+  /** @type {any} */ (err).code = 'WEBJS_FORM_ACTION_MISSING';
+  /** @type {any} */ (err).method = req.method;
+  /** @type {any} */ (err).pathname = url.pathname;
+  /** @type {any} */ (err).fields = fields;
+  onError(err);
+}
+
+/**
+ * A page GET carrying `__webjs_action` in the QUERY STRING (#1307). Nothing in
+ * this framework ever puts the reserved field in a url, so a submission
+ * carrying a bound action's identity went out as a GET: the identity rode the
+ * query string (a browser does this natively, and `performSubmission` promotes
+ * a safe-method body the same way), no action ran, and the page is about to
+ * render as if nothing was submitted.
+ *
+ * A bound submitter no longer produces this by accident, because it carries its
+ * own `formmethod="post"`. What reaches here now is an explicit override the
+ * author wrote and the renderer deliberately honours: a `formmethod="get"` on
+ * the pressed button, or on the form, wins by native precedence. This is the
+ * production counterpart to the dev-time client guard, which reports the same
+ * shape at submit time.
+ *
+ * DETECTS ONLY. The GET keeps rendering its 200 page, because answering
+ * differently on a query parameter would hand any visitor a way to turn any
+ * page into an error.
+ *
+ * @param {URL} url
+ * @param {Request} req
+ * @param {((error: unknown) => void) | undefined} onError
+ * @param {{ warn?: (msg: string, meta?: Record<string, unknown>) => void }} [logger]
+ * @param {boolean} [dev]
+ * @param {{ file?: string } | null} [route] the matched page route, for the dedupe key
+ */
+export function reportFormSubmittedAsGet(url, req, onError, logger, dev, route) {
+  // Cheapest possible guard first, and it runs on EVERY page GET: a substring
+  // test on the already-parsed `search` string, so the common case never builds
+  // a URLSearchParams at all.
+  if (!url.search || !url.search.includes(FORM_ACTION_FIELD)) return;
+  if (!url.searchParams.has(FORM_ACTION_FIELD)) return;
+  const willLog = !!(dev && logger && logger.warn);
+  const willReport = typeof onError === 'function';
+  if (!willLog && !willReport) return;
+  if (!firstSighting(`WEBJS_FORM_SUBMITTED_AS_GET ${req.method} ${routeKeyOf(route, url)}`)) return;
+  if (willLog) {
+    logger.warn(
+      `[webjs] ${url.pathname} was requested with \`${FORM_ACTION_FIELD}\` in the query string, which means a submission carrying a bound action's identity went out as a GET. A GET sends no body, so the identity rode the url, the action never ran, and this page is simply re-rendering. Look for a formmethod="get" on the button that was pressed, or a method="get" on its form: a submitter's own formmethod wins by native precedence and WebJs honours it rather than refusing it.`,
+    );
+  }
+  if (!willReport) return;
+  const err = new Error(
+    `A form submission reached ${url.pathname} as a GET with the \`${FORM_ACTION_FIELD}\` identity in the query string, so no server action ran. The submitter's enclosing <form> binds no action.`,
+  );
+  /** @type {any} */ (err).code = 'WEBJS_FORM_SUBMITTED_AS_GET';
+  /** @type {any} */ (err).method = req.method;
+  /** @type {any} */ (err).pathname = url.pathname;
+  onError(err);
+}
+
 /**
  * The submitted TEXT fields as a plain record, for repopulating a form the
  * dispatcher could not run.
@@ -258,11 +411,12 @@ function methodNotAllowed() {
  *   actionIndex: import('./actions.js').ActionIndex,
  *   allowedOrigins?: string[],
  *   onError?: (error: unknown) => void,
+ *   logger?: { warn?: (msg: string, meta?: Record<string, unknown>) => void },
  * }} deps
  * @returns {Promise<Response>}
  */
 export async function runFormAction(route, params, url, req, ssrOpts, deps) {
-  const { actionIndex, allowedOrigins = [], onError } = deps;
+  const { actionIndex, allowedOrigins = [], onError, logger } = deps;
 
   // Not a form body at all (a stray JSON POST, a probe): the page path exists
   // and only renders. Answered before the body is touched.
@@ -289,8 +443,20 @@ export async function runFormAction(route, params, url, req, ssrOpts, deps) {
   const actions = formData.getAll(FORM_ACTION_FIELD);
   const id = actions.length ? actions[actions.length - 1] : null;
   // A form body carrying no identity: a hand-written `<form method="post">`
-  // that binds no action. Nothing to run, and the page only renders.
-  if (typeof id !== 'string' || !id) return methodNotAllowed();
+  // that binds no action. Nothing to run, and the page only renders. Reported
+  // before the 405 so the shape is not just an anonymous status in an access
+  // log.
+  //
+  // NOT the unparseable-enctype variant of #1307. An `enctype="text/plain"`
+  // submission arrives with that content type, so `looksLikeFormSubmission`
+  // answers it above, before the body is read and before this point. That is
+  // deliberate (buffering an attacker-chosen body to classify it is exactly what
+  // the early return avoids), and it means the text/plain variant is visible
+  // only as a bare 405. The dev-time client guard covers it instead.
+  if (typeof id !== 'string' || !id) {
+    reportFormActionMissing(url, req, formData, onError, logger, !!ssrOpts.dev, route);
+    return methodNotAllowed();
+  }
   // The field is framework wire, not app data. Removing it keeps an action
   // that iterates the FormData (building a record, echoing values back into a
   // 422 re-render) from seeing a key it did not put there.