Severity: medium · Category: protocol defect
Evidence (verified). curl -X PUT /form → 405 with only Allow: GET, POST — no Cache-Control: no-store and no Vary, violating the all-response-kinds no-store rule. Also add the redirect() constructor-validation unit test (round-2 review section 2 item 1: the whitelist exists but has zero tests).
Fix. Set both headers in the generated 405 handler; add authoring tests for redirect() non-3xx rejection and valid 3xx acceptance.
Filed from the 0.42 round-2 review (docs/audit/2026-07-28-alpha5-round2-review.md). Target line: 0.42.0-alpha.6.
Severity: medium · Category: protocol defect
Evidence (verified).
curl -X PUT /form→405with onlyAllow: GET, POST— noCache-Control: no-storeand noVary, violating the all-response-kinds no-store rule. Also add the redirect() constructor-validation unit test (round-2 review section 2 item 1: the whitelist exists but has zero tests).Fix. Set both headers in the generated 405 handler; add authoring tests for
redirect()non-3xx rejection and valid 3xx acceptance.Filed from the 0.42 round-2 review (docs/audit/2026-07-28-alpha5-round2-review.md). Target line: 0.42.0-alpha.6.