Severity: medium · Category: protocol defect
Evidence (verified). curl -X POST /form -H 'content-type: application/json' -d '{}' → 500. c.req.raw.formData() throws on unparseable bodies and lands in the generic catch. A client error should be 400 (or 415), not a server-error page/log line.
Fix. Wrap the formData() call in the POST handler: parse failure → 400 with the framework status page (and ActionResult JSON on the fetch channel).
Acceptance. e2e asserts 400 for JSON content-type, and the JSON channel gets the error shape.
Filed from the 0.42 round-2 review (docs/audit/2026-07-28-alpha5-round2-review.md). Target line: 0.42.0-alpha.6.
Severity: medium · Category: protocol defect
Evidence (verified).
curl -X POST /form -H 'content-type: application/json' -d '{}'→ 500.c.req.raw.formData()throws on unparseable bodies and lands in the generic catch. A client error should be 400 (or 415), not a server-error page/log line.Fix. Wrap the
formData()call in the POST handler: parse failure → 400 with the framework status page (and ActionResult JSON on the fetch channel).Acceptance. e2e asserts 400 for JSON content-type, and the JSON channel gets the error shape.
Filed from the 0.42 round-2 review (docs/audit/2026-07-28-alpha5-round2-review.md). Target line: 0.42.0-alpha.6.