diff --git a/.github/workflows/autoflow-ci.yml b/.github/workflows/autoflow-ci.yml
index 29d1a3cb7..38dd3b69f 100644
--- a/.github/workflows/autoflow-ci.yml
+++ b/.github/workflows/autoflow-ci.yml
@@ -38,17 +38,15 @@ jobs:
           fetch-depth: 0
       - uses: ./.github/actions/setup-deno-workspace
       - name: Install Playwright browsers
-        run: ./node_modules/.bin/playwright install --with-deps chromium
+        # All three engines up front: the gate's fixture:request-time:gate
+        # runs the request-time fixture suite on Chromium, Firefox and WebKit.
+        run: ./node_modules/.bin/playwright install --with-deps chromium firefox webkit
       - name: AutoFlow3 CI gate
         run: deno task autoflow:ci
       # Cross-browser smoke: the main gate is chromium-only. Run the core
       # DSD/island-hydration/theme specs on Firefox and WebKit against the
       # www/dist the gate's build step already produced.
-      - name: Install Playwright Firefox
-        run: ./node_modules/.bin/playwright install --with-deps firefox
       - name: Firefox smoke E2E
         run: deno task test:e2e:firefox-smoke
-      - name: Install Playwright WebKit
-        run: ./node_modules/.bin/playwright install --with-deps webkit
       - name: WebKit smoke E2E
         run: deno task test:e2e:webkit-smoke
diff --git a/.github/workflows/autoflow-release.yml b/.github/workflows/autoflow-release.yml
index f8ee06bab..c4172ff75 100644
--- a/.github/workflows/autoflow-release.yml
+++ b/.github/workflows/autoflow-release.yml
@@ -38,7 +38,10 @@ jobs:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
       - name: Install Playwright browsers
-        run: ./node_modules/.bin/playwright install --with-deps chromium
+        # All three engines: the release tier includes fixture:request-time:gate,
+        # which runs the request-time fixture suite on Chromium, Firefox and
+        # WebKit (release evidence requirement).
+        run: ./node_modules/.bin/playwright install --with-deps chromium firefox webkit
       - name: Configure Git
         run: |
           git config user.name "github-actions[bot]"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0213edcd3..9613312dd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,50 @@ Current truth lives in:
 Historical changelog details remain available through git history and release
 evidence.
 
+## 0.42.0-alpha.5
+
+- Audit round 1 remediation (TP-5.5, ADR-0121): the first implementation
+  audit of the 0.42 line (#539–#573) is closed — protocol hardening, a
+  morph client rewrite, security hygiene and an evidence-honesty sweep.
+- Headline root cause: the alpha.3 morph enhancement never fired — the
+  `submit` event is not composed and page content lives inside
+  page-element DSD shadow roots, so the document-level listener never saw
+  enhanced forms. The client is rewritten around shadow-root submit
+  interception and shadow-content morphing; the island-survival claims
+  are now mechanically true (errata appended to the alpha.3/alpha.4
+  notes).
+- Protocol (ADR-0121): the prerender hard rule covers named `actions`;
+  named-action dispatch is own-key gated; one `x-openelement-action`
+  header (`true` = ActionResult JSON, `enhance` = HTML morph) with
+  `Vary`; an action returning a `Response` is a contract violation; the
+  default PRG strips the `?/name` marker; every 3xx coerces to 303 on
+  POST and `redirect()` validates its status; fetch callers always
+  receive ActionResult JSON (404/500 included, production-scrubbed);
+  request-time responses carry `Cache-Control: no-store`; POST takes the
+  same error boundary as GET; action POSTs get a 10 MB body limit;
+  non-GET/POST methods answer 405.
+- Morph continuity: form-scoped `data-open-region` targeting with
+  navigation fallback, id-keyed + lookahead identity matching, popstate
+  reload, `open:action-failure` restored (cancelable), submitter
+  name/value preserved in the enhanced body, 500/cross-origin responses
+  navigate instead of morphing, double-submit guard, fragment
+  preservation, `<details>`/media state protection. The full survival
+  matrix is documented in `docs/current/MORPH_CONTRACT.md`.
+- Evidence: the request-time fixture suite (42 tests) runs on Chromium,
+  Firefox and WebKit in the ci and release gate tiers; a static-output
+  determinism gate ships (`check:static-output-freeze`); a dev(hono) vs
+  build(Nitro) parity contract test boots both real servers; the perf
+  baseline records its environment
+  (`docs/release/v0.42.0-alpha.5-performance.json`).
+- Also fixed along the way: dev SSR crashed on every route (missing
+  `customElements` polyfill — now shipped to the dev entry);
+  `[...path]` request-time routes; zero-island apps with enhanced forms
+  (the enhancement layer is emitted only when enhanced forms exist, so
+  island-only sites keep their lean bundle); the starter's `/contact`
+  route (it was never shipped in `TEMPLATE_FILES`) now builds and is
+  POST-smoked in consumer CI; SPA vs request-time loader/action types
+  and docs are honest; a CSRF threat-model page ships in the guide.
+
 ## 0.42.0-alpha.4
 
 - Hardening and recipes (TP-5, ADR-0120): the 0.42 line closes with
diff --git a/README.md b/README.md
index dcd1d92d4..92a438dff 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ Elements are the durable application contract; JSX and Basic Element are the
 authoring layer; Declarative Shadow DOM is the default server representation;
 interactive regions upgrade selectively.
 
-Published package line: `0.42.0-alpha.4` (`v0.42.0-alpha.4`) — the stable five-package
+Published package line: `0.42.0-alpha.5` (`v0.42.0-alpha.5`) — the stable five-package
 release under ADR-0119's scoped interface freeze; the abandoned beta naming
 is not an active line.
 
diff --git a/README.zh.md b/README.zh.md
index 7f4e9636e..053739b84 100644
--- a/README.zh.md
+++ b/README.zh.md
@@ -6,7 +6,7 @@
 Elements 是可长期保存的应用组件模型；JSX 与 Basic Element 是作者层；
 Declarative Shadow DOM 是默认服务端表示；交互区域按需升级。
 
-已发布包线为 `0.42.0-alpha.4`（`v0.42.0-alpha.4`）——ADR-0119 范围化接口冻结下的
+已发布包线为 `0.42.0-alpha.5`（`v0.42.0-alpha.5`）——ADR-0119 范围化接口冻结下的
 stable 五包版本；已放弃的 beta 命名不再是当前版本线。
 
 ## 当前产品
diff --git a/deno.json b/deno.json
index 96b67458e..5c7cb9d30 100644
--- a/deno.json
+++ b/deno.json
@@ -91,6 +91,7 @@
     "fixture:request-time:build": "cd packages/adapter-vite/__fixtures__/request-time && deno run --config ../../../../deno.json --allow-read --allow-write --allow-net --allow-env --allow-ffi --allow-sys --allow-run ../../src/cli/build.ts",
     "fixture:request-time:e2e": "deno run -A npm:@playwright/test@1.59.1 test --config packages/adapter-vite/__fixtures__/request-time/e2e/playwright.config.ts --project=chromium",
     "fixture:request-time:e2e:browsers": "deno run -A npm:@playwright/test@1.59.1 test --config packages/adapter-vite/__fixtures__/request-time/e2e/playwright.config.ts",
+    "fixture:request-time:gate": "deno task fixture:request-time:build && deno task fixture:request-time:e2e:browsers",
     "nitro:proof:node": "deno run --allow-read --allow-write --allow-run --allow-env --allow-net tools/nitro-proof.ts node",
     "nitro:proof:workers": "deno run --allow-read --allow-write --allow-run --allow-env --allow-net tools/nitro-proof.ts workers",
     "test:coverage:check": "deno run --allow-read --allow-run --allow-write --allow-env --allow-net --allow-ffi --allow-sys tools/check-coverage.ts --threshold 73 --branch-threshold 82 --function-threshold 77",
@@ -112,6 +113,7 @@
     "autoflow:release-prepare": "deno run --allow-read --allow-write --allow-run --allow-env tools/autoflow/mod3.ts release-prepare",
     "autoflow:publish-existing": "deno run --allow-read --allow-write --allow-run --allow-env tools/autoflow/mod3.ts publish-existing",
     "autoflow:test": "deno test --allow-read --allow-write --allow-run --allow-env tools/autoflow/__tests__/",
+    "check:static-output-freeze": "deno run --allow-read --allow-write --allow-run --allow-env --allow-net --allow-ffi --allow-sys tools/check-static-output-freeze.ts",
     "verify:configs": "deno run --allow-read --allow-env tools/verify-package-configs.ts",
     "verify:configs:fix": "deno run --allow-read --allow-write --allow-env tools/verify-package-configs.ts --fix"
   },
diff --git a/docs/adr/ADR-0121-0-42-action-protocol-hardening-amendment.md b/docs/adr/ADR-0121-0-42-action-protocol-hardening-amendment.md
new file mode 100644
index 000000000..571c2f87b
--- /dev/null
+++ b/docs/adr/ADR-0121-0-42-action-protocol-hardening-amendment.md
@@ -0,0 +1,146 @@
+# ADR-0121: 0.42 Action Protocol Hardening Amendment (Audit Round 1)
+
+- Status: PROPOSED — implementation proceeds under this amendment in
+  `0.42.0-alpha.5`; maintainer acceptance to be recorded at the alpha.5
+  release
+- Date: 2026-07-27
+- Amends: ADR-0120 (action protocol rules 2, 3, 4, 6, 7)
+
+## Context
+
+The first implementation audit round of the 0.42 WC Application Loop
+(GitHub issues #539–#573, milestone `v0.42.0-alpha.5`) found the ADR-0120
+protocol skeleton faithfully implemented in its main lines, but with
+specific holes, bypasses and undocumented behaviors that are
+protocol-visible. ADR-0120 requires an amendment for protocol changes;
+this amendment records all of the protocol-visible decisions in one batch
+so the protocol document stays coherent. Implementation bugs with no
+protocol visibility (dead branches, escaping, codegen details) are fixed
+directly under the issues and are not recorded here.
+
+The round's deepest finding concerns rule 6 itself: the alpha.3 morph
+enhancement never functioned. Page content lives inside page-element DSD
+shadow roots, the `submit` event is not composed, and the document-level
+submit listener therefore never fired — the published survival-matrix
+results were silently measuring the native no-JS path, and the two
+survival specs fail deterministically at both the alpha.3 and alpha.4
+tags. Items 8–11 are written against the rewritten client that fixes
+this at the architecture level.
+
+## Decision
+
+1. **Request-header negotiation (amends rule 2).** One framework request
+   header, `x-openelement-action`, with two values: `true` marks a
+   programmatic caller and selects the serialized `ActionResult` union;
+   `enhance` marks the built-in morph enhancement and selects the same
+   full-HTML responses the no-JS path receives. The alpha.2–alpha.4
+   `x-openelement-enhance` header (never consumed by any server code) is
+   retired. The POST endpoint answers `Vary: x-openelement-action` so the
+   two response classes never share a cache entry.
+2. **Response-return policy (amends rule 3).** Actions must not return
+   `Response` objects. The return channel is data or `fail(status, data)`;
+   the redirect channel is `redirect()`; everything else is a thrown
+   error. A returned `Response` is a contract violation and answers 500
+   (clear message in dev, generic in production). This makes "a
+   successful mutation never answers 200 with a rendered page" a
+   mechanical property instead of a convention.
+3. **Redirect algebra (amends rule 3).** `redirect()` validates at
+   construction that the status is one of 301/302/303/307/308 and throws
+   otherwise. In the POST action context every 3xx is coerced to 303
+   (post/redirect/get must be method-safe and non-cacheable); in the
+   GET/loader context the author's status is kept (permanent moves remain
+   legitimate there). The `ActionResult` redirect variant is answered
+   with HTTP 200 carrying `{ type: 'redirect', status: 303, location }` —
+   it is a data message for the client, not an HTTP redirect (an HTTP 3xx
+   would be transparently followed by `fetch` and the JSON body would be
+   unreadable).
+4. **Default PRG target (amends rule 3).** The default PRG location is
+   the route pathname plus the query string with `/`-prefixed
+   action-marker keys removed; all other query parameters are preserved.
+   The action marker never reaches the address bar, history or referer.
+5. **Fetch-channel symmetry (amends rule 2).** On the JSON channel every
+   protocol outcome is an `ActionResult`: an unknown named action and a
+   POST to a route without actions both answer
+   `{ type: 'error', status: 404, error: { message } }` with HTTP 404,
+   with distinct messages for "route does not accept submissions" and
+   "no action named X". The HTML channel keeps the framework 404 page.
+6. **Caching (implements the rule-7 no-cache promise).** Every
+   request-time response kind (200/422/303/404/500) carries
+   `Cache-Control: no-store`; the POST endpoint additionally carries
+   `Vary: x-openelement-action` per item 1.
+7. **Error-channel parity (amends rule 4).** Thrown values on POST take
+   the same nearest-error-boundary channel as GET: the page's `error`
+   component renders with status 500, with the bare 500 page as fallback.
+   The audit's accepted window is recorded: an action whose mutation
+   commits and whose revalidation then fails (loader throw on the
+   follow-up GET, or a mutate-then-`fail()` contract violation) leaves
+   the mutation committed while the user sees an error page. "Validate
+   first, mutate after" remains the action contract; the guide documents
+   the window.
+8. **Region semantics (amends rule 6).** A form targets a named region
+   via `data-open-region-target="name"` (on the submitter or the form,
+   submitter wins); absent that attribute the morph targets the nearest
+   ancestor `[data-open-region]` of the form; absent any region the body
+   morphs. If the target region is missing on either side the client
+   navigates to the response URL (never a silent full-body morph).
+   Non-targeted regions are never touched.
+9. **Morph architecture and identity (amends rule 6).** Page content
+   lives inside the page element's DSD shadow root, so the morph descends
+   into shadow trees: a non-island host with a live shadow root and an
+   incoming `<template shadowrootmode>` child morphs its shadow root
+   against the template content. Submits are intercepted at every shadow
+   root (the submit event is not reliably composed across engines), with
+   the document-level listener covering light-DOM forms. Within a parent,
+   children carrying an `id` attribute match by `id` (tag must also
+   match); the remaining children match structurally (node type + tag)
+   with a bounded lookahead, so insertions and removals between matched
+   anchors are preserved instead of cascading into wholesale replacement.
+   Hydrated-island survival still requires the light-DOM surface
+   comparison (`__islandIntact`). Rows rendered in dynamic lists should
+   carry stable `id`s to survive reorders.
+10. **Popstate (amends rule 6).** The enhanced client reloads the
+    document on `popstate`. There is no client-side state cache in 0.42;
+    back/forward therefore never shows content that disagrees with the
+    URL.
+11. **Action-failure event (restores the alpha.2 hook; amends rule 6).**
+    On a 422 response the enhanced client dispatches a cancelable
+    `open:action-failure` `CustomEvent` on the form with
+    `detail: { status, form, response }` before morphing; calling
+    `preventDefault()` skips the default morph (the page handles the
+    failure itself). Network and non-HTML failures keep the reload
+    fallback.
+12. **CSRF threat model (new; records the standing assumption).** The
+    framework's form/action loop relies on the browser `SameSite=Lax`
+    default for cookie-based authentication (sessions are 0.44 scope).
+    Applications using ambient authentication (Basic, mTLS,
+    `SameSite=None` cookies) must add Origin/Fetch-Metadata validation;
+    a documented middleware recipe ships in the guide. A built-in check
+    is deferred to the 0.44 session work.
+
+## Consequences
+
+Positive:
+
+- Every protocol outcome is deterministic and mechanically testable on
+  both channels; the two channels can no longer diverge silently.
+- The header negotiation becomes honest: one header, documented values,
+  cache-safe via `Vary`.
+- The audit's high-severity protocol holes (#539–#542, #544, #547–#549)
+  become contract violations with clear errors instead of silent
+  misbehavior.
+
+Negative:
+
+- `0.42.0-alpha.2`–`alpha.4` clients sending `x-openelement-enhance`
+  are tolerated (treated as the HTML path) but the header no longer
+  appears in the shipped client; the wire was never consumed, so no
+  migration is needed.
+- Forbidding returned `Response` objects removes an escape hatch; users
+  needing full response control use API routes (Hono) instead of page
+  actions.
+
+Neutral:
+
+- Items 6, 7 and 12 record or implement promises ADR-0120 already made;
+  the rest are protocol amendments proper. The fixture e2e and the
+  codegen contract tests are the mechanical gate for every item.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index 9747433aa..24bdaf39f 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -20,6 +20,7 @@ documents:
 | Alpha.16 scope     | ADR-0116                                                         | Audit-driven correctness reset before stable freeze.           |
 | Stable 0.41 freeze | ADR-0119                                                         | Scoped interface freeze for the 0.41.x line.                   |
 | 0.42 loop scope    | ADR-0120                                                         | WC Application Loop scope boundary and action protocol.        |
+| 0.42 protocol fix  | ADR-0121                                                         | Audit round 1 hardening amendment to the ADR-0120 protocol.    |
 | Cleanup governance | ADR-0105, ADR-0106                                               | Approved cleanup train and audit-driven quality work.          |
 | Active stack truth | `docs/current/STACK_CONTRACT.md`, `docs/current/VERSION_PLAN.md` | Operational version and stack contract for current work.       |
 
@@ -136,6 +137,7 @@ decision set above to decide which records are authoritative for new work.
 | 0118 | Third Audit Round Alpha.19 Cleanup Sweep                 | Accepted                                         |
 | 0119 | Stable 0.41.0 Scoped Interface Freeze                    | Accepted                                         |
 | 0120 | 0.42.0 WC Application Loop Scope and Action Protocol     | Accepted                                         |
+| 0121 | 0.42 Action Protocol Hardening Amendment (Audit Round 1) | Proposed                                         |
 
 ## Superseded / Historical
 
diff --git a/docs/current/MORPH_CONTRACT.md b/docs/current/MORPH_CONTRACT.md
new file mode 100644
index 000000000..519c93ac8
--- /dev/null
+++ b/docs/current/MORPH_CONTRACT.md
@@ -0,0 +1,97 @@
+# Morph Continuity Contract
+
+> Status: unfrozen 0.42-line semantics (ADR-0120 rule 6, amended by ADR-0121).
+> The wire/attribute surface described here is the contract; the matching
+> algorithm is implementation detail and may improve without notice.
+> Introduced: 0.42.0-alpha.3 (broken, see below). Functional since:
+> 0.42.0-alpha.5.
+
+`data-open-enhance` forms submit via `fetch` and the returned document is
+morphed into the live tree. Without JavaScript the same form is a native
+POST, so behavior degrades to the browser by construction.
+
+Alpha.3–alpha.4 shipped a document-level submit listener that never fired:
+page content lives inside page-element DSD shadow roots and the `submit`
+event is not reliably composed, so the enhancement was inert and every
+"enhanced" page was silently using the native path. ADR-0121 rewrites the
+client around two structural facts: submit listeners attach to every shadow
+root, and the morph descends into shadow trees (the incoming document
+carries a host's shadow content in its `<template shadowrootmode>` child).
+
+## Enhancement flow
+
+1. Submit intercepted at the form's root (document or shadow root); GET
+   forms are never intercepted.
+2. POST with header `x-openelement-action: enhance`; the body is the
+   native body (`new FormData(form, submitter)` — the submitter's
+   name/value included; ADR-0120 rule 2).
+3. Only `200`/`422` responses with `text/html` are morphed. Anything else
+   (500, empty, non-HTML) navigates to the response URL. Network failure
+   reloads. Cross-origin targets always navigate (`location.assign`,
+   never `pushState`).
+4. A `422` dispatches a cancelable `open:action-failure` `CustomEvent` on
+   the form (`detail: { status, form, response }`) before morphing;
+   `preventDefault()` skips the default morph.
+5. Success updates the URL with `history.pushState`; `popstate` reloads
+   the restored URL (no client-side state cache in 0.42). The local
+   fragment is preserved when the target is the same page.
+6. A second submit while one is in flight is ignored; cross-form
+   responses are ordered by sequence.
+
+## Morph scope
+
+| Scope                                 | Selected by                                                  |
+| ------------------------------------- | ------------------------------------------------------------ |
+| Named region                          | `data-open-region-target="name"` on submitter (wins) or form |
+| Nearest ancestor `[data-open-region]` | default when the attribute is absent                         |
+| Whole body                            | no region involved                                           |
+
+A scope missing on either side (live document or incoming document) is a
+full navigation, never a silent full-body morph. Non-targeted regions are
+never touched.
+
+## Identity and survival rules
+
+- **Matching**: within a parent, children with an `id` match by `id`
+  (tag must match); the rest match structurally (node type + tag) with a
+  bounded lookahead, so insertions/removals between matched anchors are
+  preserved. Rows in dynamic lists should carry stable `id`s.
+- **Island survival**: a hydrated island (live shadow root) survives when
+  its light-DOM surface serializes identically (`__islandIntact`):
+  attributes equal, and child nodes equal after skipping the DSD template
+  and whitespace-only text. Otherwise it is replaced and its state resets
+  by design.
+- **`data-open-preserve`**: exempts the whole subtree, checked before
+  island and attribute logic.
+- **Scripts**: live `<script>` nodes are kept as-is (never re-executed;
+  a changed `src` is left stale by design).
+- **State-mirroring attributes**: `open` on `<details>` and `src` on
+  `<video>`/`<audio>` are not synced — user state wins.
+- **`client:only` and light-DOM islands** have no shadow root and are
+  never survival candidates; wrap them in `data-open-preserve` to keep
+  their state.
+
+## Survival matrix (documented and tested, TP-4)
+
+Every cell is pinned by the request-time fixture e2e (three engines):
+`packages/adapter-vite/__fixtures__/request-time/e2e/live.spec.ts`.
+
+| Cell                                                        | Pinned by                                                       |
+| ----------------------------------------------------------- | --------------------------------------------------------------- |
+| Island outside the change survives a 422 morph              | `422 morph keeps a hydrated island alive …`                     |
+| Island outside the change survives a PRG morph              | `PRG morph preserves island state and updates the URL`          |
+| Island state proves the enhanced path (not a native reload) | `enhanced submit morphs the PRG target …`                       |
+| Region-scoped morph touches only the region                 | `region-scoped morph updates only the region …`                 |
+| `data-open-preserve` subtree inside the morphed region      | `data-open-preserve exempts a subtree …`                        |
+| Missing region target                                       | `a missing region target falls back to a full navigation`       |
+| `popstate` after PRG                                        | `back after an enhanced PRG reloads the restored URL`           |
+| `open:action-failure` cancelable                            | `open:action-failure is cancelable and skips the default morph` |
+| 500 response navigates, never morphs into the page          | `a 500 response navigates instead of morphing …`                |
+| Fragment preserved on same-page morph                       | `the URL fragment survives a 422 morph`                         |
+| id-keyed islands survive a list prepend                     | `id-keyed islands survive a list prepend`                       |
+| Whitespace-only text around the DSD template                | covered by all survival cells (alpha.4 fix)                     |
+
+Known-uncovered cells (accepted, documented here until a later line):
+island surface change resets state (by design, no e2e); nested islands;
+`client:visible` island replaced before intersecting (re-observation
+code shipped, no e2e); double-submit ordering (code shipped, no e2e).
diff --git a/docs/current/PACKAGE_SURFACE.md b/docs/current/PACKAGE_SURFACE.md
index 6eb76189a..8f114d3d8 100644
--- a/docs/current/PACKAGE_SURFACE.md
+++ b/docs/current/PACKAGE_SURFACE.md
@@ -99,6 +99,12 @@ promise and are not application-authoring surface.
   the build pipeline and generated code import only relatively or through the
   supported root, `nitro-mount`, `cli/build` and `sitemap` subpaths. The module
   files remain inside the package for internal relative imports only.
+- `@openelement/ui` supported subpaths: `open-badge`, `open-button`,
+  `open-callout`, `open-card`, `open-code-block`, `open-dialog`,
+  `open-dropdown`, `open-input`, `open-props-tokens`, `open-tabs`,
+  `open-theme-toggle`.
+- `@openelement/ui/open-props-tokens.js` is a resolver-compatibility alias of
+  `open-props-tokens`.
 
 ## 0.41.0 interface freeze boundary (ADR-0119)
 
@@ -118,21 +124,18 @@ a major-version ADR.
 
 - `definePage({ renderIntent: { mode } })`: `'auto'`/`'static'`/`'dynamic'`
   rendering modes; `'dynamic'` routes render per request through the
-  generated `dist/server/index.js` (0.42.0-alpha.1).
+  generated `dist/server/index.js` (0.42.0-alpha.1). `renderIntent.revalidate`
+  declares the ISR revalidate window in seconds for static routes.
 - Route-module `loader`/`action`/`actions` exports with the ADR-0120
   protocol: `fail(status, data)` 422 re-render, 303 PRG, named actions via
   `formaction='?/name'` (0.42.0-alpha.2).
+- `isActionFailure(value)` type guard and the `OpenElementActionFailure<T>`
+  class (app root): the structured failure carrier constructed by `fail()`
+  and recognized on both the request-time and SPA action chains.
 - `ActionResult` / `ACTION_FETCH_HEADER` wire types and the
   `data-open-enhance` / `data-open-preserve` / `data-open-region`
   enhancement attributes with morph-based continuity (0.42.0-alpha.3).
 
-- `@openelement/ui` supported subpaths: `open-badge`, `open-button`,
-  `open-callout`, `open-card`, `open-code-block`, `open-dialog`,
-  `open-dropdown`, `open-input`, `open-props-tokens`, `open-tabs`,
-  `open-theme-toggle`.
-- `@openelement/ui/open-props-tokens.js` is a resolver-compatibility alias of
-  `open-props-tokens`.
-
 ## Removed from current graph
 
 The following alpha implementation packages are absorbed and are not supported
diff --git a/docs/current/VERSION_PLAN.md b/docs/current/VERSION_PLAN.md
index 6ee0c4b60..3cd2911ce 100644
--- a/docs/current/VERSION_PLAN.md
+++ b/docs/current/VERSION_PLAN.md
@@ -1,7 +1,7 @@
 # v0.42.0 — WC Application Loop release plan
 
-> Current source package line: `v0.42.0-alpha.4`\
-> Current npm registry line: `v0.42.0-alpha.4`\
+> Current source package line: `v0.42.0-alpha.5`\
+> Current npm registry line: `v0.42.0-alpha.5`\
 > Active release target: `v0.41.1`\
 > Planning release target: `v0.42.0` (WC Application Loop)\
 > Next release line: `v0.43.0` (Universal WC SSR)\
@@ -45,9 +45,10 @@ invariant.
 - ADR-0120 records the scope boundary (self-built loop semantics and
   continuity mechanism; third-party server layer and Web-standard context)
   and the action protocol. Changes to either require an ADR-0120 amendment.
-- The line ships as four themed alphas plus the stable decision; the stable
-  freeze scope for request-time semantics is decided by a separate ADR at
-  the end of the line.
+- The line shipped as four themed alphas; a fifth remediation alpha
+  (TP-5.5) was inserted by the first implementation audit round before the
+  stable decision; the stable freeze scope for request-time semantics is
+  decided by a separate ADR at the end of the line.
 
 ## Task packages
 
@@ -182,12 +183,90 @@ Goal: prove someone else can use the loop.
   evidence; starter consumer smoke passes; release-tier gates green;
   alpha.4 published.
 
+### TP-5.5 — `0.42.0-alpha.5` audit round 1 remediation (protocol hardening + evidence sweep)
+
+Goal: close the 35 issues filed from the first implementation audit round
+(issues #539–#573, label `0.42.0-alpha.5`, milestone `v0.42.0-alpha.5`) —
+the protocol holes, morph-continuity gaps, security hygiene defects and
+evidence-honesty failures — without expanding the 0.42 scope. No new
+semantics beyond what the ADR-0120 amendment in step 1 records.
+
+- 准入: the audit round 1 report is filed as issues #539–#573 (done
+  2026-07-27); alpha.4 published (done).
+- 执行步骤:
+  1. **ADR-0120 amendment (one batch, before code moves).** Record every
+     protocol-visible decision in a single amendment: unified
+     request-header negotiation (#540), the Response-return policy for
+     actions (#541), redirect coercion for 301/307/308 plus `redirect()`
+     status validation (#547), default-PRG query stripping (#548),
+     fetch-channel 404/error JSON symmetry (#549), `data-open-region`
+     semantics (#553), morph identity semantics (#554), the popstate
+     policy (#545), and the CSRF threat-model decision (#559). ADR-0120
+     requires an amendment for protocol changes; batching keeps the
+     protocol document coherent.
+  2. **Protocol correctness fixes** (highest ROI first): #539 `hasAction`
+     covers named `actions` + a rejection test through real routeInfo
+     generation; #542 own-key check on named-action dispatch +
+     prototype-key e2e; #549 restructure the 404 block (fetch callers get
+     ActionResult JSON, HTML second, dead branch deleted); #544
+     `new FormData(form, submitter)` + a named-button fixture form +
+     two-path body-identity e2e; #548 strip `/`-prefixed query keys from
+     the default PRG target; #547 `redirect()` 3xx validation + POST
+     coercion of all 3xx to 303; #541 route user-returned Responses
+     through the same status algebra (or forbid them); #540 implement the
+     unified header + `Vary`, update the codegen string test and the
+     mislabeled e2e; #551 POST error-boundary parity with GET + guide
+     prose for the committed-mutation/loader-failure 500 window.
+  3. **Morph continuity fixes**: #552 status/content-type gate before
+     morphing (non-OK or non-HTML falls back to navigation); #545 popstate
+     handling per the amendment; #553 region semantics per the amendment
+     (form→region association, missing-region fallback); #554 identity
+     matching per the amendment (id-keyed, or honest ADR text); #555
+     cross-origin redirect detection → `location.assign`; #561 three-engine
+     DOMParser DSD verification + old-side template filter; #562
+     re-observe `client:visible` islands after morph; #563 script
+     src/content comparison, no executable insertion of parsed scripts;
+     #564 double-submit guard; #565 preserve the URL fragment on same-URL
+     morphs; #566 `CSS.escape` the region name; #567 state-mirroring
+     attribute policy (skip list or honest docs).
+  4. **Security hygiene**: #550 `no-store` on every request-time response
+     kind + `Vary` on the POST endpoint; #558 PROD guard on both JSON
+     error channels; #568 default body limit on action routes; #559 CSRF
+     threat-model doc + Fetch-Metadata/Origin recipe; #573 XSS payload
+     e2e for the 422 echo.
+  5. **Evidence and gates**: #543 wire `fixture:request-time:build` +
+     `fixture:request-time:e2e:browsers` into the AutoFlow3 gate tiers and
+     CI (three-engine browser installs), correct the alpha.3/alpha.4
+     counts as errata, reword `validation.md` to name the gate; #560
+     byte-identical static-output proof tool + release-tier gate; #557
+     survival-matrix cells + the hono-dev vs Nitro-build parity contract
+     test; #571 PACKAGE_SURFACE completion + section nesting + starter
+     `contact.tsx` in the check task and a serve-and-POST smoke + the
+     alpha.4 API-name erratum; #546 `open:action-failure` restored or
+     removed per the amendment; perf baseline gains machine/runtime
+     environment fields and is re-recorded after the no-cache change.
+  6. **Manifest consumer contract** (#556): ship a path-pattern matcher
+     for hosts (fixture server + documented Nitro recipe) or reject
+     `mode: 'dynamic'` on parameterized routes at build time; fix
+     `[...path]` handling.
+  7. **Surface polish**: #569 client entry emitted when enhanced forms
+     exist (or a build-time warning); #570 SPA vs server loader/action
+     type split + guide section; #572 405 + `Allow` for non-GET/POST and
+     runtime validation of `renderIntent.mode`.
+- 准出: every issue #539–#573 is closed with a code + test/gate proof
+  linked in the issue; the ADR-0120 amendment is accepted and every
+  protocol-visible change cites it; the request-time fixture suite runs in
+  CI on three engines and the release note's count is mechanically
+  reproducible from the tag; the byte-identical static-output gate is
+  green; release-tier gates green; alpha.5 published with two-stage
+  evidence.
+
 ### TP-6 — `0.42.0` stable decision
 
 Goal: decide and ship the request-time freeze scope.
 
-- 准入: alpha.4 evidence complete; the seven-day P0 watch on the last alpha
-  shows no P0.
+- 准入: TP-5.5 closed (alpha.5 published); the seven-day P0 watch on the
+  last alpha shows no P0.
 - 执行步骤:
   1. Stable-scope ADR: which request-time semantics freeze (expected: the
      loop contract and action protocol; expected unfrozen: streaming,
diff --git a/docs/governance/PROJECT_WORKFLOW.md b/docs/governance/PROJECT_WORKFLOW.md
index d306ca16d..761b1bd9d 100644
--- a/docs/governance/PROJECT_WORKFLOW.md
+++ b/docs/governance/PROJECT_WORKFLOW.md
@@ -11,8 +11,8 @@ complete because an issue, chat message, or SOP says it is complete. It is
 complete only when the repository contains the decision, the execution package,
 the implementation, and the gates that prove the claim.
 
-Current execution anchor: published package line `v0.42.0-alpha.4`, completed
-implementation anchor `v0.42.0-alpha.4`, and `0.42.0` WC Application Loop planning
+Current execution anchor: published package line `v0.42.0-alpha.5`, completed
+implementation anchor `v0.42.0-alpha.5`, and `0.42.0` WC Application Loop planning
 under ADR-0120 and `docs/current/VERSION_PLAN.md`.
 OpenElement is one Web Components-native,
 static-first application framework: Basic Element is an authoring mode, not a
diff --git a/docs/integrations/validation.md b/docs/integrations/validation.md
index cf54084bb..58bd947dd 100644
--- a/docs/integrations/validation.md
+++ b/docs/integrations/validation.md
@@ -1,9 +1,10 @@
 # Validation recipe (zod / valibot)
 
-> Status: **verified in CI** — both shapes are exercised end-to-end by the
-> request-time fixture (`packages/adapter-vite/__fixtures__/request-time/`:
-> `/register` with zod, `/subscribe` with valibot, 422/303 asserted in three
-> engines).
+> Status: **verified by the `fixture:request-time:e2e:browsers` gate in
+> AutoFlow3 CI (three engines)** — both shapes are exercised end-to-end by
+> the request-time fixture
+> (`packages/adapter-vite/__fixtures__/request-time/`: `/register` with
+> zod, `/subscribe` with valibot, 422/303 asserted in three engines).
 
 The framework is deliberately validation-agnostic: an action receives the
 standard `FormData`, and any schema library runs inside it. The contract is
diff --git a/docs/release/v0.41.0-interface-snapshot.json b/docs/release/v0.41.0-interface-snapshot.json
index 9895a7d8b..79e11194e 100644
--- a/docs/release/v0.41.0-interface-snapshot.json
+++ b/docs/release/v0.41.0-interface-snapshot.json
@@ -11,7 +11,7 @@
       },
       "declarations": {
         ".": {
-          "sha256": "90188ae78f73f1e279897853ea77fca20ccffbddfe630937997a8d5537ffa3e6",
+          "sha256": "689f3c79e06a5395f94c3fde24a8f27f42ec361dba3beebc2212b5c54bd2797b",
           "publicDeclarations": [
             "export type { ElementDefinition } from './types.ts';",
             "export type {",
@@ -56,7 +56,7 @@
       },
       "declarations": {
         ".": {
-          "sha256": "6c416f644599a98ae619395e656ff9b046da0dd89eff6cf4e7cf229bb30dd794",
+          "sha256": "965f67db0f499b61b9163dcb4a320a73184e114cccae7686518e3eea29c8156c",
           "publicDeclarations": [
             "export type {",
             "export type {",
diff --git a/docs/release/v0.42.0-alpha.3.md b/docs/release/v0.42.0-alpha.3.md
index a04785139..284c914ca 100644
--- a/docs/release/v0.42.0-alpha.3.md
+++ b/docs/release/v0.42.0-alpha.3.md
@@ -42,6 +42,20 @@ AutoFlow3 patch release evidence: `publish-existing-v0.42.0-alpha.3-2026-07-27T0
 
 `/@fs/` Windows verification status: see `docs/current/HYDRATION_CONTRACT.md` (Known limitations).
 
+## Errata (2026-07-27, alpha.5)
+
+- **Test count**: the request-time fixture suite at tag `v0.42.0-alpha.3`
+  has 14 tests × 3 engines = 42 runs, not 36 — the "36/36" figure above
+  does not match the durable tag.
+- **Island-survival claims were false at release time**: the two morph
+  island-survival specs fail deterministically at this tag. The
+  enhancement's document-level submit listener never fired for forms
+  inside page-element shadow roots (`submit` is not a composed event), so
+  the claimed morph survival was never exercised — the specs were silently
+  passing through the native no-JS path. The suite also had no CI gate.
+  Root cause fixed in `0.42.0-alpha.5` (ADR-0121); see the alpha.5
+  release note.
+
 ## Evidence
 
 - passed: verify published source version (exit 0)
diff --git a/docs/release/v0.42.0-alpha.4.md b/docs/release/v0.42.0-alpha.4.md
index 0439362ad..0428da463 100644
--- a/docs/release/v0.42.0-alpha.4.md
+++ b/docs/release/v0.42.0-alpha.4.md
@@ -52,6 +52,25 @@ AutoFlow3 patch release evidence: `publish-existing-v0.42.0-alpha.4-2026-07-27T1
 
 `/@fs/` Windows verification status: see `docs/current/HYDRATION_CONTRACT.md` (Known limitations).
 
+## Errata (2026-07-27, alpha.5)
+
+- **Test count**: the request-time fixture suite at tag
+  `v0.42.0-alpha.4` has 16 tests × 3 engines = 48 runs, not 42 — the
+  "42/42" figures above do not match the durable tag.
+- **Survival-matrix coverage was false at release time**: the two
+  island-survival specs fail deterministically at this tag. The
+  enhancement's document-level submit listener never fired for forms
+  inside page-element shadow roots (`submit` is not a composed event), so
+  "covered by the survival matrix (42/42)" for the whitespace fix was not
+  true at release time — the specs were silently exercising the native
+  no-JS path. Root cause fixed in `0.42.0-alpha.5` (ADR-0121).
+- **No CI gate**: no CI or release-tier gate ran the fixture suite at
+  this tag; the `fixture:request-time:gate` gate was added in alpha.5
+  (#543).
+- **API name error**: the starter bullet above writes
+  `rendering: 'dynamic'` — the actual page option is
+  `renderIntent: { mode: 'dynamic' }`.
+
 ## Evidence
 
 - passed: verify published source version (exit 0)
diff --git a/docs/release/v0.42.0-alpha.5-performance.json b/docs/release/v0.42.0-alpha.5-performance.json
new file mode 100644
index 000000000..e8b8ca27e
--- /dev/null
+++ b/docs/release/v0.42.0-alpha.5-performance.json
@@ -0,0 +1,31 @@
+{
+  "version": "0.42.0-alpha.5",
+  "date": "2026-07-27T16:54:01.717Z",
+  "route": "/live (request-time, loader + DSD render)",
+  "environment": {
+    "os": "darwin",
+    "arch": "aarch64",
+    "cpu": "Apple M2",
+    "deno": "2.9.1",
+    "v8": "14.9.207.2-rusty"
+  },
+  "samples": {
+    "cold": 3,
+    "warm": 50
+  },
+  "cold": {
+    "ms": 20.22,
+    "samplesMs": [
+      21.95,
+      20.22,
+      37.65
+    ]
+  },
+  "warm": {
+    "samples": 50,
+    "p50": 1.44,
+    "p95": 4.04,
+    "mean": 2.2
+  },
+  "note": "Buffered per-request DSD render via the generated dist/server entry on Deno.serve; the 0.44 stream/abort/timeout work compares against this. Cold is the best of 3 fresh-boot first requests; all samples are recorded."
+}
diff --git a/docs/release/v0.42.0-alpha.5.md b/docs/release/v0.42.0-alpha.5.md
new file mode 100644
index 000000000..6fd1da1da
--- /dev/null
+++ b/docs/release/v0.42.0-alpha.5.md
@@ -0,0 +1,86 @@
+# v0.42.0-alpha.5
+
+## Audit round 1 remediation
+
+The fifth alpha of the 0.42 line — unplanned in the original
+four-alpha shape, inserted by the first implementation audit of the WC
+Application Loop (TP-5.5, 35 issues #539–#573). It ships no new
+semantics beyond the ADR-0121 amendment; it closes the audit's protocol
+holes, rewrites the morph client, and sweeps the line's evidence
+honesty.
+
+- **The headline root cause**: the alpha.3 morph enhancement never
+  fired. The `submit` event is not composed and page content lives
+  inside page-element DSD shadow roots, so the document-level submit
+  listener never saw an enhanced form — every "enhanced" page was
+  silently using the native no-JS path, and the two island-survival
+  specs fail deterministically at both prior tags. The client is
+  rewritten around per-shadow-root submit interception and
+  shadow-content morphing; the survival matrix is now mechanically true
+  and documented cell-by-cell in
+  [`docs/current/MORPH_CONTRACT.md`](https://github.com/open-element/openelement/blob/main/docs/current/MORPH_CONTRACT.md).
+  Errata are appended to the alpha.3 and alpha.4 notes.
+- **Protocol (ADR-0121)**: the prerender hard rule covers named
+  `actions`; named-action dispatch is own-key gated (`?/constructor` is
+  a defined 404); one `x-openelement-action` header (`true` =
+  ActionResult JSON, `enhance` = HTML morph) with `Vary`; an action
+  returning a `Response` is a contract violation, never a response; the
+  default PRG strips the `?/name` marker and keeps other query
+  parameters; every 3xx coerces to 303 on POST and `redirect()`
+  validates its status; fetch callers always receive ActionResult JSON
+  (404/500 included, production-scrubbed); request-time responses carry
+  `Cache-Control: no-store`; POST takes the same error boundary as GET;
+  action POSTs get a 10 MB body limit; non-GET/POST methods answer 405
+  with `Allow`.
+- **Morph continuity**: form-scoped `data-open-region` targeting
+  (submitter `data-open-region-target` wins) with navigation fallback,
+  id-keyed + lookahead identity matching, popstate reload,
+  `open:action-failure` restored as a cancelable hook, the submitter's
+  name/value preserved in the enhanced body, 500/cross-origin responses
+  navigate instead of morphing, double-submit guard, fragment
+  preservation, `<details>`/media state protection.
+- **Evidence**: the request-time fixture suite (42 tests) runs on
+  Chromium, Firefox and WebKit in the ci and release gate tiers;
+  `check:static-output-freeze` proves build determinism in the release
+  tier; a dev(hono) vs build(Nitro) parity contract test boots both
+  real servers; the performance baseline records its environment
+  (`docs/release/v0.42.0-alpha.5-performance.json`).
+- **Also fixed**: dev SSR crashed on every route (the `customElements`
+  polyfill now ships to the dev entry); `[...path]` request-time routes
+  and a self-contained `matchRequestTimeRoute` host contract; zero-island
+  apps with enhanced forms (and the complement: the enhancement layer is
+  emitted only when enhanced forms exist, so island-only sites keep
+  their lean bundle); the starter's `/contact` (it was never shipped in
+  `TEMPLATE_FILES`) now builds and is POST-smoked in consumer CI;
+  SPA vs request-time loader/action types (`SpaLoader` et al.) and a
+  bilingual guide page for the CSRF threat model.
+
+## Verification
+
+- Request-time fixture e2e: 42 tests × 3 engines = 126 passed
+  (Chromium, Firefox, WebKit) via `fixture:request-time:gate`, now part
+  of the ci and release AutoFlow3 tiers.
+- Full unit suite 971 passed; dev/build parity contract 6/6; AutoFlow3
+  policy tests 61/61; `docs:truth`, `workflow:check`,
+  `interface:snapshot` (re-baselined: only the four `Spa*` type exports
+  added), lint/format gates green.
+- Consumer smoke builds the starter and POSTs `/contact` (422 echo,
+  303 PRG) through Nitro node; `check:static-output-freeze --self-check`
+  passes (422 files byte-identical across builds).
+
+## Migrating from alpha.4
+
+- Pure-static sites: nothing to do; the client bundle stays lean
+  (the enhancement layer is emitted only when enhanced forms exist).
+- Request-time routes: forms using the enhancement keep working; the
+  `x-openelement-enhance` header is retired — custom clients should send
+  `x-openelement-action: true` (ActionResult JSON) or `: enhance` (HTML).
+- Actions must no longer return `Response` objects (contract violation);
+  return data/`fail()`, or `throw redirect()`. `redirect()` accepts only
+  301/302/303/307/308 and coerces to 303 on POST.
+- `open:action-failure` (advertised in alpha.2, silently absent since
+  alpha.3) is restored as a cancelable hook; see MORPH_CONTRACT.md.
+
+---
+
+`/@fs/` Windows verification status: see `docs/current/HYDRATION_CONTRACT.md` (Known limitations).
diff --git a/docs/roadmap/ROADMAP.md b/docs/roadmap/ROADMAP.md
index 40cf94972..03066d8ec 100644
--- a/docs/roadmap/ROADMAP.md
+++ b/docs/roadmap/ROADMAP.md
@@ -4,8 +4,8 @@ Execution and release state follow the
 [`Project Workflow`](../governance/PROJECT_WORKFLOW.md).
 
 > Source of truth for forward product planning.\
-> Published package line: `v0.42.0-alpha.4`.\
-> Active execution target: `v0.42.0-alpha.4`.\
+> Published package line: `v0.42.0-alpha.5`.\
+> Active execution target: `v0.42.0-alpha.5`.\
 > Current implementation state: five-package convergence is published;
 > alpha.17 closed the first audit remediation, alpha.18 completed the
 > second audit sweep (ADR-0117), and alpha.19 completed the third (ADR-0118).\
@@ -116,7 +116,7 @@ making the standard Custom Element contract span both layers. See the official
 
 ## Current release state
 
-`0.42.0-alpha.4` is the published package line. npm beta.1 through beta.3 are
+`0.42.0-alpha.5` is the published package line. npm beta.1 through beta.3 are
 immutable partial artifacts and remain withdrawn from the active release story.
 The planned beta name was cancelled so the version label honestly reflects
 that breaking architecture and interface changes are still allowed.
diff --git a/docs/status/STATUS.md b/docs/status/STATUS.md
index 950fe80b5..70e78f5ac 100644
--- a/docs/status/STATUS.md
+++ b/docs/status/STATUS.md
@@ -1,9 +1,9 @@
 # OpenElement Status
 
 > Updated: 2026-07-27\
-> Repository package line: `v0.42.0-alpha.4`\
-> npm registry line: `v0.42.0-alpha.4`\
-> Active release target: `v0.42.0-alpha.4`\
+> Repository package line: `v0.42.0-alpha.5`\
+> npm registry line: `v0.42.0-alpha.5`\
+> Active release target: `v0.42.0-alpha.5`\
 > Next release line: `v0.42.0`\
 > Product graph: five packages\
 > Current maturity stage: stable (0.41.x)
diff --git a/packages/adapter-vite/__fixtures__/request-time/app/routes/boom.tsx b/packages/adapter-vite/__fixtures__/request-time/app/routes/boom.tsx
new file mode 100644
index 000000000..a960846f5
--- /dev/null
+++ b/packages/adapter-vite/__fixtures__/request-time/app/routes/boom.tsx
@@ -0,0 +1,53 @@
+/**
+ * /boom — error-boundary parity (ADR-0121 §7): the loader always throws,
+ * and the page declares an error component. GET and POST must both render
+ * the boundary with status 500 (POST parity is the alpha.5 fix).
+ */
+import { definePage, fail, type OpenElementActionFailure } from '@openelement/app';
+
+export const tagName = 'page-boom';
+
+export function loader(): never {
+  throw new Error('boom-loader');
+}
+
+export function action(): OpenElementActionFailure<{ note: string }> {
+  // Validation failure: the fail path re-runs the loader, which throws —
+  // the POST must render the error boundary, not a bare 500.
+  return fail(422, { note: 'validated' });
+}
+
+export const actions = {
+  explode(): never {
+    // A thrown action: the exception channel (boundary / scrubbed JSON).
+    throw new Error('boom-action');
+  },
+};
+
+const BoomPage = definePage({
+  renderIntent: { mode: 'dynamic' },
+  head: { title: 'request-time fixture — boom' },
+  render() {
+    return (
+      <main>
+        <h1>boom page</h1>
+        <form method='post' data-open-enhance>
+          <button id='boom-submit' type='submit'>Boom</button>
+        </form>
+      </main>
+    );
+  },
+  error({ error }) {
+    return (
+      <main>
+        <h1 id='boundary'>boom boundary: {String((error as Error)?.message ?? error)}</h1>
+        <form method='post' data-open-enhance>
+          <button id='boom-submit' type='submit'>Boom</button>
+        </form>
+      </main>
+    );
+  },
+});
+
+customElements.define(tagName, BoomPage);
+export default BoomPage;
diff --git a/packages/adapter-vite/__fixtures__/request-time/app/routes/item/[id].tsx b/packages/adapter-vite/__fixtures__/request-time/app/routes/item/[id].tsx
new file mode 100644
index 000000000..45e56748e
--- /dev/null
+++ b/packages/adapter-vite/__fixtures__/request-time/app/routes/item/[id].tsx
@@ -0,0 +1,65 @@
+/**
+ * /item/:id — request-time param route (#556).
+ *
+ * Proves the generated host matcher dispatches concrete pathnames ('/item/42')
+ * to the ':param' route pattern: the loader echoes params.id per request, and
+ * the action exercises the full protocol on a parameterized URL — empty note
+ * -> fail(422) re-render; valid note -> 303 PRG back to the same item.
+ */
+import {
+  definePage,
+  fail,
+  type OpenElementActionFailure,
+  redirect,
+  useActionData,
+} from '@openelement/app';
+
+export const tagName = 'page-item';
+
+interface ItemData {
+  id: string;
+}
+
+interface ItemActionData {
+  error?: string;
+  note?: string;
+}
+
+export function loader(ctx: { params: Record<string, string> }): ItemData {
+  return { id: ctx.params.id ?? '' };
+}
+
+export function action(ctx: {
+  params: Record<string, string>;
+  formData: FormData;
+}): OpenElementActionFailure<ItemActionData> {
+  const note = String(ctx.formData.get('note') ?? '').trim();
+  if (!note) {
+    return fail(422, { error: 'note is required', note } satisfies ItemActionData);
+  }
+  redirect(`/item/${encodeURIComponent(ctx.params.id)}?noted=${encodeURIComponent(note)}`);
+}
+
+const ItemPage = definePage<ItemData>({
+  renderIntent: { mode: 'dynamic' },
+  head: { title: 'request-time fixture — item' },
+  render({ data, request }) {
+    const actionData = useActionData() as ItemActionData | undefined;
+    const noted = request ? new URL(request.url).searchParams.get('noted') : undefined;
+    return (
+      <main>
+        <h1>request-time item</h1>
+        <p id='item-id'>id={data?.id ?? ''}</p>
+        <form method='post' data-open-enhance>
+          <input id='note' name='note' type='text' value={actionData?.note ?? ''} />
+          <button id='submit' type='submit'>Save</button>
+        </form>
+        {actionData?.error ? <p id='error'>{actionData.error}</p> : null}
+        <p id='noted'>noted={noted ?? ''}</p>
+      </main>
+    );
+  },
+});
+
+customElements.define(tagName, ItemPage);
+export default ItemPage;
diff --git a/packages/adapter-vite/__fixtures__/request-time/app/routes/items.tsx b/packages/adapter-vite/__fixtures__/request-time/app/routes/items.tsx
new file mode 100644
index 000000000..82a88a1db
--- /dev/null
+++ b/packages/adapter-vite/__fixtures__/request-time/app/routes/items.tsx
@@ -0,0 +1,44 @@
+/**
+ * /items — identity-matched islands in a dynamic list (ADR-0121 §9): each
+ * row carries a stable id, so prepending a row morphs the list without
+ * resetting the existing islands' state.
+ */
+import { definePage, redirect } from '@openelement/app';
+import '../islands/live-counter.tsx';
+
+export const tagName = 'page-items';
+
+export function loader(ctx: { request: Request }): { items: string[] } {
+  const url = new URL(ctx.request.url);
+  return { items: (url.searchParams.get('items') ?? 'a,b').split(',') };
+}
+
+export function action(ctx: { formData: FormData }): never {
+  const items = String(ctx.formData.get('items') ?? 'a,b');
+  redirect(`/items?items=${encodeURIComponent('new,' + items)}`);
+}
+
+const ItemsPage = definePage({
+  renderIntent: { mode: 'dynamic' },
+  head: { title: 'request-time fixture — items' },
+  render({ data }) {
+    return (
+      <main>
+        <form method='post' data-open-enhance>
+          <input type='hidden' name='items' value={data.items.join(',')} />
+          <button id='prepend' type='submit'>Prepend</button>
+        </form>
+        <ul>
+          {data.items.map((id) => (
+            <li id={`row-${id}`}>
+              <live-counter></live-counter>
+            </li>
+          ))}
+        </ul>
+      </main>
+    );
+  },
+});
+
+customElements.define(tagName, ItemsPage);
+export default ItemsPage;
diff --git a/packages/adapter-vite/__fixtures__/request-time/app/routes/ping.tsx b/packages/adapter-vite/__fixtures__/request-time/app/routes/ping.tsx
new file mode 100644
index 000000000..bd0b1c564
--- /dev/null
+++ b/packages/adapter-vite/__fixtures__/request-time/app/routes/ping.tsx
@@ -0,0 +1,66 @@
+/**
+ * /ping — named-only actions route exercising ADR-0121 protocol edges:
+ * - 'ping' returns nothing, so the default PRG target (action marker
+ *   stripped, other query params kept) is observable; the Ping button is
+ *   NAMED, so the enhanced path must include the submitter's name/value in
+ *   the body or the action 422s (#544);
+ * - 'mv307' redirects with an explicit 307, coerced to 303 on POST;
+ * - 'raw' returns a Response — a contract violation, never a response.
+ */
+import {
+  definePage,
+  fail,
+  type OpenElementActionFailure,
+  redirect,
+  useActionData,
+} from '@openelement/app';
+
+export const tagName = 'page-ping';
+
+interface PingActionData {
+  error?: string;
+  intent?: string;
+}
+
+export const actions = {
+  ping(ctx: { formData: FormData }): OpenElementActionFailure<PingActionData> | void {
+    const intent = String(ctx.formData.get('intent') ?? '');
+    if (intent !== 'ping') {
+      return fail(422, { error: 'intent missing', intent } satisfies PingActionData);
+    }
+    // Success returns nothing: the default PRG target applies (ADR-0121 §4).
+  },
+  mv307(): never {
+    redirect('/ping?moved=1', 307);
+  },
+  raw(): Response {
+    return new Response('<h1>raw</h1>', {
+      headers: { 'content-type': 'text/html' },
+    });
+  },
+};
+
+const PingPage = definePage({
+  renderIntent: { mode: 'dynamic' },
+  head: { title: 'request-time fixture — ping' },
+  render({ request }) {
+    const actionData = useActionData() as PingActionData | undefined;
+    const moved = request ? new URL(request.url).searchParams.get('moved') : undefined;
+    return (
+      <main>
+        <h1>ping page</h1>
+        <p id='moved'>moved={moved ?? ''}</p>
+        {actionData?.error ? <p id='intent-error'>{actionData.error}</p> : null}
+        <form method='post' data-open-enhance>
+          <button id='ping' type='submit' name='intent' value='ping' formaction='?/ping'>
+            Ping
+          </button>
+          <button id='mv307' type='submit' formaction='?/mv307'>Move</button>
+        </form>
+      </main>
+    );
+  },
+});
+
+customElements.define(tagName, PingPage);
+export default PingPage;
diff --git a/packages/adapter-vite/__fixtures__/request-time/app/routes/regions.tsx b/packages/adapter-vite/__fixtures__/request-time/app/routes/regions.tsx
new file mode 100644
index 000000000..38e940dda
--- /dev/null
+++ b/packages/adapter-vite/__fixtures__/request-time/app/routes/regions.tsx
@@ -0,0 +1,72 @@
+/**
+ * /regions — data-open-region / data-open-preserve morph semantics
+ * (ADR-0121 §8): the form is scoped to its nearest ancestor region; the
+ * preserved subtree survives untouched; a form targeting a missing region
+ * falls back to a full navigation.
+ */
+import {
+  definePage,
+  fail,
+  type OpenElementActionFailure,
+  redirect,
+  useActionData,
+} from '@openelement/app';
+import '../islands/live-counter.tsx';
+
+export const tagName = 'page-regions';
+
+interface RegionActionData {
+  error?: string;
+  message?: string;
+}
+
+export function action(
+  ctx: { formData: FormData },
+): OpenElementActionFailure<RegionActionData> {
+  const message = String(ctx.formData.get('message') ?? '').trim();
+  if (!message) {
+    return fail(422, { error: 'message is required', message } satisfies RegionActionData);
+  }
+  redirect(`/regions?echoed=${encodeURIComponent(message)}`);
+}
+
+const RegionsPage = definePage({
+  renderIntent: { mode: 'dynamic' },
+  head: { title: 'request-time fixture — regions' },
+  render({ request }) {
+    const actionData = useActionData() as RegionActionData | undefined;
+    const echoed = request ? new URL(request.url).searchParams.get('echoed') : undefined;
+    return (
+      <main>
+        <div data-open-region='banner'>
+          <p id='banner'>echo={echoed ?? ''}</p>
+        </div>
+        <section data-open-region='form-area'>
+          <form method='post' data-open-enhance>
+            <input
+              id='message'
+              name='message'
+              type='text'
+              value={actionData?.message ?? ''}
+            />
+            <button id='submit' type='submit'>Send</button>
+            <button id='missing' type='submit' data-open-region-target='no-such-region'>
+              Send to missing region
+            </button>
+          </form>
+          {actionData?.error ? <p id='error'>{actionData.error}</p> : null}
+          <div id='preserved' data-open-preserve>
+            <details id='preserved-details'>
+              <summary>keep me</summary>
+              secret
+            </details>
+          </div>
+        </section>
+        <live-counter></live-counter>
+      </main>
+    );
+  },
+});
+
+customElements.define(tagName, RegionsPage);
+export default RegionsPage;
diff --git a/packages/adapter-vite/__fixtures__/request-time/e2e/live.spec.ts b/packages/adapter-vite/__fixtures__/request-time/e2e/live.spec.ts
index 1163f3ea3..5b4fa4037 100644
--- a/packages/adapter-vite/__fixtures__/request-time/e2e/live.spec.ts
+++ b/packages/adapter-vite/__fixtures__/request-time/e2e/live.spec.ts
@@ -128,12 +128,19 @@ test.describe('action protocol (ADR-0120, 0.42.0-alpha.2)', () => {
     await context.close();
   });
 
-  test('enhanced submit follows the ActionResult redirect without a native POST', async ({ page }) => {
+  test('enhanced submit morphs the PRG target without a native POST', async ({ page }) => {
     await page.goto('/form');
+    // Island state is the honest-path guard: a native reload would reset it,
+    // so this test cannot pass through the no-JS path by accident.
+    const button = page.locator('live-counter #increment');
+    const count = page.locator('live-counter #count');
+    await button.click();
+    await expect(count).toHaveText('1');
     await page.fill('#message', 'enhanced-path');
     await page.click('#submit');
     await page.waitForURL('**/form?echoed=enhanced-path');
     await expect(page.locator('#echo')).toHaveText('echo=enhanced-path');
+    await expect(count).toHaveText('1');
   });
 });
 
@@ -205,3 +212,289 @@ test.describe('validation recipes (0.42.0-alpha.4)', () => {
     expect(success.headers()['location']).toBe('/subscribe?welcome=grace%40example.com');
   });
 });
+
+test.describe('protocol hardening (ADR-0121, 0.42.0-alpha.5)', () => {
+  test('prototype keys are not actions: ?/constructor is a defined 404 (#542)', async ({ request }) => {
+    const response = await request.post('/form?/constructor', { form: { message: 'x' } });
+    expect(response.status()).toBe(404);
+    const toString = await request.post('/form?/toString', { form: { message: 'x' } });
+    expect(toString.status()).toBe(404);
+  });
+
+  test('fetch callers receive an ActionResult JSON 404 for unknown named actions (#549)', async ({ request }) => {
+    const response = await request.post('/form?/nope', {
+      form: { message: 'x' },
+      headers: { 'x-openelement-action': 'true' },
+    });
+    expect(response.status()).toBe(404);
+    expect(response.headers()['content-type']).toContain('application/json');
+    expect(await response.json()).toEqual({
+      type: 'error',
+      status: 404,
+      error: { message: 'No action named "nope" on this route.' },
+    });
+  });
+
+  test('fetch callers receive an ActionResult JSON 404 for action-less routes (#549)', async ({ request }) => {
+    const response = await request.post('/live', {
+      form: { x: '1' },
+      headers: { 'x-openelement-action': 'true' },
+    });
+    expect(response.status()).toBe(404);
+    expect(await response.json()).toEqual({
+      type: 'error',
+      status: 404,
+      error: { message: 'This route does not accept submissions.' },
+    });
+  });
+
+  test('the default PRG strips the action marker and keeps other query params (#548)', async ({ request }) => {
+    const response = await request.post('/ping?/ping&keep=1', {
+      form: { intent: 'ping' },
+      maxRedirects: 0,
+    });
+    expect(response.status()).toBe(303);
+    expect(response.headers()['location']).toBe('/ping?keep=1');
+  });
+
+  test('a 307 redirect from an action is coerced to 303 (#547)', async ({ request }) => {
+    const response = await request.post('/ping?/mv307', {
+      form: {},
+      maxRedirects: 0,
+    });
+    expect(response.status()).toBe(303);
+    expect(response.headers()['location']).toBe('/ping?moved=1');
+  });
+
+  test('an action returning a Response is a contract violation, never a response (#541)', async ({ request }) => {
+    const response = await request.post('/ping?/raw', { form: {} });
+    expect(response.status()).toBe(500);
+    expect(await response.text()).not.toContain('<h1>raw</h1>');
+
+    const fetchResponse = await request.post('/ping?/raw', {
+      form: {},
+      headers: { 'x-openelement-action': 'true' },
+    });
+    expect(fetchResponse.status()).toBe(500);
+    const body = await fetchResponse.json();
+    expect(body.type).toBe('error');
+  });
+
+  test('request-time responses carry no-store; the POST endpoint varies on the action header (#550)', async ({ request }) => {
+    const get = await request.get('/live?x=cache');
+    expect(get.headers()['cache-control']).toBe('no-store');
+
+    const post = await request.post('/form', { form: { message: '' } });
+    expect(post.status()).toBe(422);
+    expect(post.headers()['cache-control']).toBe('no-store');
+    expect(post.headers()['vary']).toContain('x-openelement-action');
+
+    const redirect = await request.post('/form', {
+      form: { message: 'cache-check' },
+      maxRedirects: 0,
+    });
+    expect(redirect.status()).toBe(303);
+    expect(redirect.headers()['cache-control']).toBe('no-store');
+  });
+
+  test('non-GET/POST methods are a defined 405 with Allow (#572)', async ({ request }) => {
+    const response = await request.put('/form', { data: 'x=1' });
+    expect(response.status()).toBe(405);
+    expect(response.headers()['allow']).toBe('GET, POST');
+  });
+
+  test('POST takes the same error-boundary channel as GET (#551)', async ({ request }) => {
+    const get = await request.get('/boom');
+    expect(get.status()).toBe(500);
+    expect(await get.text()).toContain('boom boundary: boom-loader');
+
+    const post = await request.post('/boom', { form: {} });
+    expect(post.status()).toBe(500);
+    expect(await post.text()).toContain('boom boundary: boom-loader');
+  });
+
+  test('the production JSON error channel scrubs internals (#558)', async ({ request }) => {
+    const response = await request.post('/boom?/explode', {
+      form: {},
+      headers: { 'x-openelement-action': 'true' },
+    });
+    expect(response.status()).toBe(500);
+    const body = await response.json();
+    expect(body.type).toBe('error');
+    // The fixture is a production build: internals never leak.
+    expect(body.error.message).toBe('Internal Server Error');
+  });
+
+  test('a thrown action renders the error boundary on the HTML channel (#551)', async ({ request }) => {
+    const response = await request.post('/boom?/explode', { form: {} });
+    expect(response.status()).toBe(500);
+    expect(await response.text()).toContain('boom boundary: boom-action');
+  });
+
+  test('the 422 echo escapes markup (#573)', async ({ request }) => {
+    const payload = '"><img src=x onerror=alert(1)>';
+    const response = await request.post('/register', { form: { email: payload } });
+    expect(response.status()).toBe(422);
+    const html = await response.text();
+    expect(html).not.toContain('<img src=x');
+    expect(html).toContain('&lt;img');
+  });
+});
+
+test.describe('morph continuity hardening (ADR-0121, 0.42.0-alpha.5)', () => {
+  test('region-scoped morph updates only the region and keeps outside islands (#553)', async ({ page }) => {
+    await page.goto('/regions');
+    const count = page.locator('live-counter #count');
+    await page.locator('live-counter #increment').click();
+    await page.locator('live-counter #increment').click();
+    await expect(count).toHaveText('2');
+
+    await page.click('#submit');
+    await expect(page.locator('#error')).toHaveText('message is required');
+    // The island is outside the morphed region: untouched by construction.
+    await expect(count).toHaveText('2');
+    // The banner region was not targeted and is left alone.
+    await expect(page.locator('#banner')).toHaveText('echo=');
+  });
+
+  test('data-open-preserve exempts a subtree inside the morphed region', async ({ page }) => {
+    await page.goto('/regions');
+    const details = page.locator('#preserved-details');
+    await page.locator('#preserved-details summary').click();
+    await expect(details).toHaveAttribute('open', /.*/);
+
+    await page.click('#submit');
+    await expect(page.locator('#error')).toHaveText('message is required');
+    await expect(details).toHaveAttribute('open', /.*/);
+  });
+
+  test('a missing region target falls back to a full navigation (#553)', async ({ page }) => {
+    await page.goto('/regions');
+    await page.evaluate(() => {
+      (window as unknown as { __stillHere: number }).__stillHere = 1;
+    });
+    await page.click('#missing');
+    // Navigation wipes the JS context; a morph would have kept it.
+    await page.waitForFunction(() =>
+      (window as never as { __stillHere?: number }).__stillHere === undefined
+    );
+    await expect(page.locator('#banner')).toHaveText('echo=');
+  });
+
+  test('back after an enhanced PRG reloads the restored URL (#545)', async ({ page }) => {
+    await page.goto('/form');
+    await page.fill('#message', 'history-check');
+    await page.click('#submit');
+    await page.waitForURL('**/form?echoed=history-check');
+    await expect(page.locator('#echo')).toHaveText('echo=history-check');
+
+    await page.goBack();
+    await page.waitForURL('**/form');
+    // The popstate handler reloads, so the restored URL shows fresh content.
+    await expect(page.locator('#echo')).toHaveText('echo=');
+  });
+
+  test('open:action-failure is cancelable and skips the default morph (#546)', async ({ page }) => {
+    await page.goto('/form');
+    await page.evaluate(() => {
+      const form = document.querySelector('page-form')!.shadowRoot!.querySelector('form')!;
+      form.addEventListener('open:action-failure', (event) => {
+        (window as unknown as { __failureStatus: number }).__failureStatus =
+          (event as CustomEvent).detail.status;
+        event.preventDefault();
+      });
+    });
+    await page.click('#submit');
+    await page.waitForFunction(() =>
+      (window as never as { __failureStatus?: number }).__failureStatus === 422
+    );
+    // preventDefault skipped the morph: the error paragraph never appeared.
+    await expect(page.locator('#error')).toHaveCount(0);
+  });
+
+  test('a 500 response navigates instead of morphing the error page (#552)', async ({ page }) => {
+    await page.goto('/boom');
+    await expect(page.locator('#boundary')).toContainText('boom boundary');
+    await page.evaluate(() => {
+      (window as unknown as { __stillHere: number }).__stillHere = 1;
+    });
+    await page.click('#boom-submit');
+    await page.waitForFunction(() =>
+      (window as never as { __stillHere?: number }).__stillHere === undefined
+    );
+    await expect(page.locator('#boundary')).toContainText('boom boundary');
+  });
+
+  test('the URL fragment survives a 422 morph (#565)', async ({ page }) => {
+    await page.goto('/form#top');
+    await page.click('#submit');
+    await expect(page.locator('#error')).toHaveText('message is required');
+    expect(page.url()).toContain('#top');
+  });
+
+  test('the enhanced submit includes the submitter name/value in the body (#544)', async ({ page }) => {
+    await page.goto('/ping');
+    const post = page.waitForResponse((r) =>
+      r.request().method() === 'POST' && r.url().includes('/ping')
+    );
+    await page.click('#ping');
+    const response = await post;
+    // The named submit button travels in the enhanced body: without it the
+    // action 422s with 'intent missing'; with it the action succeeds (303).
+    expect(response.status()).toBe(303);
+    await expect(page.locator('#intent-error')).toHaveCount(0);
+  });
+
+  test('id-keyed islands survive a list prepend (#554)', async ({ page }) => {
+    await page.goto('/items');
+    const count = page.locator('li#row-a live-counter #count');
+    await page.locator('li#row-a live-counter #increment').click();
+    await page.locator('li#row-a live-counter #increment').click();
+    await expect(count).toHaveText('2');
+
+    await page.click('#prepend');
+    await page.waitForURL('**/items?items=new*');
+    await expect(page.locator('li#row-new live-counter')).toBeAttached();
+    // Identity matching: row-a keeps its island after the prepend.
+    await expect(count).toHaveText('2');
+  });
+});
+
+test.describe('param routes and the generated matcher (#556)', () => {
+  test('GET /item/42 renders params.id per request', async ({ request }) => {
+    const response = await request.get('/item/42');
+    expect(response.ok()).toBe(true);
+    const html = await response.text();
+    expect(html).toContain('id=42');
+  });
+
+  test('different param values render different pages', async ({ request }) => {
+    const first = await (await request.get('/item/42')).text();
+    const second = await (await request.get('/item/7')).text();
+    expect(first).toContain('id=42');
+    expect(second).toContain('id=7');
+    expect(second).not.toContain('id=42');
+  });
+
+  test('a pathname outside the route table stays on the static/404 path', async ({ request }) => {
+    const response = await request.get('/item');
+    expect(response.status()).toBe(404);
+  });
+
+  test('POST /item/42 with an empty note is a 422 re-render', async ({ request }) => {
+    const response = await request.post('/item/42', { form: { note: '  ' } });
+    expect(response.status()).toBe(422);
+    const html = await response.text();
+    expect(html).toContain('note is required');
+    expect(html).toContain('id=42');
+  });
+
+  test('POST /item/42 with a valid note is a 303 PRG to the same item', async ({ request }) => {
+    const response = await request.post('/item/42', {
+      form: { note: 'hello-item' },
+      maxRedirects: 0,
+    });
+    expect(response.status()).toBe(303);
+    expect(response.headers()['location']).toBe('/item/42?noted=hello-item');
+  });
+});
diff --git a/packages/adapter-vite/__fixtures__/request-time/e2e/server.ts b/packages/adapter-vite/__fixtures__/request-time/e2e/server.ts
index 914b50fd0..5cd988f86 100644
--- a/packages/adapter-vite/__fixtures__/request-time/e2e/server.ts
+++ b/packages/adapter-vite/__fixtures__/request-time/e2e/server.ts
@@ -3,9 +3,11 @@
  *
  * Serves the built app:
  *   - static files from dist/ (exact file, /path -> /path/index.html, /path.html)
- *   - request-time routes (from dist/server/server-manifest.json) are delegated
- *     to the generated dist/server/index.js default export, which takes a
- *     nitro-like event ({ request }) and returns a Response.
+ *   - request-time routes are delegated to the generated dist/server/index.js:
+ *     the named matchRequestTimeRoute export (generated from the route table,
+ *     #556) decides whether a pathname hits a request-time route, and the
+ *     default export takes a nitro-like event ({ request }) and returns a
+ *     Response.
  *
  * Usage:
  *   deno run -A server.ts --port 4180 --dir ../dist
@@ -39,15 +41,15 @@ const CONTENT_TYPES: Record<string, string> = {
   '.woff2': 'font/woff2',
 };
 
-const manifest = JSON.parse(await Deno.readTextFile(join(ROOT, 'server/server-manifest.json')));
-const requestTimePaths = new Set<string>(
-  (manifest.requestTimeRoutes as Array<{ path: string }>).map((r) => r.path),
-);
-
 const serverEntry = await import(pathToFileURL(join(ROOT, 'server/index.js')).href);
 const handleRequestTime = serverEntry.default as (
   event: { request: Request },
 ) => Promise<Response>;
+// Generated dispatch (#556): matches concrete pathnames ('/item/42') against
+// the request-time route patterns ('/item/:id') baked into the server entry.
+const matchRequestTimeRoute = serverEntry.matchRequestTimeRoute as (
+  pathname: string,
+) => { path: string; params: Record<string, string> } | null;
 
 async function serveStatic(pathname: string): Promise<Response | null> {
   const candidates = [pathname];
@@ -75,7 +77,7 @@ async function serveStatic(pathname: string): Promise<Response | null> {
 
 Deno.serve({ port: PORT, hostname: '127.0.0.1' }, async (request) => {
   const url = new URL(request.url);
-  if (requestTimePaths.has(url.pathname)) {
+  if (matchRequestTimeRoute(url.pathname) !== null) {
     return await handleRequestTime({ request });
   }
   const staticResponse = await serveStatic(url.pathname);
diff --git a/packages/adapter-vite/__tests__/entry-generators.test.ts b/packages/adapter-vite/__tests__/entry-generators.test.ts
index c4b2e15e7..765441cbb 100644
--- a/packages/adapter-vite/__tests__/entry-generators.test.ts
+++ b/packages/adapter-vite/__tests__/entry-generators.test.ts
@@ -20,6 +20,18 @@ Deno.test('empty -> zero JS', () => {
   assert(generateClientEntry([]).includes('zero client JS needed'));
 });
 
+Deno.test('zero islands + enhancedForms emits the enhancement layer (#569)', () => {
+  const code = generateClientEntry([], { enhancedForms: true });
+  assert(!code.includes('zero client JS needed'));
+  assert(code.includes('data-open-enhance'), 'enhancement submit handler is emitted');
+  assert(code.includes('__onSubmit'), 'submit interception is emitted');
+  assert(code.includes('__morphDocument'), 'document morph is emitted');
+});
+
+Deno.test('zero islands without enhancedForms keeps the stub (#569)', () => {
+  assert(generateClientEntry([], { enhancedForms: false }).includes('zero client JS needed'));
+});
+
 Deno.test('client:load island loads immediately', () => {
   const code = generateClientEntry([
     {
@@ -240,16 +252,41 @@ Deno.test('client entry rejects legacy eager/lazy strategy values', () => {
 });
 
 Deno.test('client entry includes the ADR-0120 form enhancement layer', () => {
-  const code = generateClientEntry([
-    { tagName: 'x-counter', modulePath: './counter.ts', strategy: 'load' },
-  ]);
-  assert(code.includes("document.addEventListener('submit'"));
+  const code = generateClientEntry(
+    [{ tagName: 'x-counter', modulePath: './counter.ts', strategy: 'load' }],
+    { enhancedForms: true },
+  );
+  // ADR-0121: submit is not reliably composed across engines, so listeners
+  // attach per shadow root, not only on the document.
+  assert(code.includes('__attachSubmit'));
+  assert(code.includes('__scanSubmitRoots'));
   assert(code.includes('data-open-enhance'));
-  assert(code.includes("'x-openelement-enhance': 'true'"));
+  assert(code.includes("'x-openelement-action': 'enhance'"));
   // Morph continuity: preserve escape hatch, intact-island survival and the
   // no-re-execute rule for the client entry script.
   assert(code.includes('data-open-preserve'));
   assert(code.includes('__islandIntact'));
   assert(code.includes("oldEl.tagName === 'SCRIPT'"));
   assert(code.includes('history.pushState'));
+  // ADR-0121 hardening: shadow-content morph, region scoping, failure hook,
+  // submitter-preserving body, popstate reload, response gating.
+  assert(code.includes('__shadowTemplate'));
+  assert(code.includes('data-open-region-target'));
+  assert(code.includes('open:action-failure'));
+  assert(code.includes('new FormData(form, submitter)'));
+  assert(code.includes("window.addEventListener('popstate'"));
+  assert(code.includes('result.status === 200 || result.status === 422'));
+});
+
+Deno.test('islands without enhancedForms omit the enhancement layer (#569 complement)', () => {
+  // Static sites with islands but no data-open-enhance forms keep a lean
+  // client bundle (ADR-0120 zero-upgrade-cost consequence) and, critically,
+  // no popstate listener that could interfere with their own routing JS.
+  const code = generateClientEntry([
+    { tagName: 'x-counter', modulePath: './counter.ts', strategy: 'load' },
+  ]);
+  assert(code.includes('live-counter') === false); // sanity: only x-counter
+  assert(!code.includes('__attachSubmit'));
+  assert(!code.includes("window.addEventListener('popstate'"));
+  assert(code.includes('the form enhancement layer is omitted'));
 });
diff --git a/packages/adapter-vite/__tests__/entry-renderer.test.ts b/packages/adapter-vite/__tests__/entry-renderer.test.ts
index a3e3ebdd0..89abfa2cf 100644
--- a/packages/adapter-vite/__tests__/entry-renderer.test.ts
+++ b/packages/adapter-vite/__tests__/entry-renderer.test.ts
@@ -803,7 +803,7 @@ Deno.test('renderEntry: action POST follows the ADR-0120 protocol', () => {
   // success, named actions via ?/name, fetch-path ActionResult JSON.
   assertStringIncludes(code, 'await c.req.raw.formData()');
   assertStringIncludes(code, '__isActionFailure(__actionResult)');
-  assertStringIncludes(code, 'return c.redirect(__url.pathname + __url.search, 303)');
+  assertStringIncludes(code, 'return c.redirect(__prgTarget, 303)');
   assertStringIncludes(code, "key.startsWith('/')");
   assertStringIncludes(code, '__namedActions[__actionName]');
   assertStringIncludes(code, "c.req.header('x-openelement-action')");
@@ -816,13 +816,53 @@ Deno.test('renderEntry: action POST follows the ADR-0120 protocol', () => {
   assertStringIncludes(code, 'This route does not accept submissions.');
 });
 
+// ─── 0.42.0-alpha.5 (ADR-0121): protocol hardening codegen ─────────────────
+
+Deno.test('renderEntry: ADR-0121 hardening is present in the action codegen', () => {
+  const desc = buildEntryDescriptor(basicRoutes, {});
+  const code = renderEntry(desc);
+
+  // #542: named-action dispatch is own-key gated (prototype keys are 404).
+  assertStringIncludes(code, 'Object.prototype.hasOwnProperty.call(__namedActions, __actionName)');
+  // #541: a returned Response is a contract violation, never a response.
+  assertStringIncludes(code, 'Actions must not return a Response object');
+  // #548: the default PRG target strips the ?/name action marker.
+  assertStringIncludes(code, '__prgParams.delete(key)');
+  assertStringIncludes(code, "{ type: 'redirect', status: 303, location: __prgTarget }");
+  // #549: fetch callers receive an ActionResult JSON 404, not an HTML page.
+  assertStringIncludes(
+    code,
+    "{ type: 'error', status: 404, error: { message: __noActionMessage } }",
+  );
+  // #550: request-time responses are never cacheable; POST is negotiated.
+  assertStringIncludes(code, "c.header('Cache-Control', 'no-store');");
+  assertStringIncludes(code, "c.header('Vary', 'x-openelement-action');");
+  // #558: the JSON error channel scrubs internals in production.
+  assertStringIncludes(code, "import.meta.env.PROD ? 'Internal Server Error' : String(err");
+  // #568: action POSTs carry a default body limit.
+  assertStringIncludes(code, '__bodyLimit({ maxSize: 10 * 1024 * 1024');
+  // #572: non-GET/POST methods on page routes are a defined 405.
+  assertStringIncludes(code, "c.text('Method Not Allowed', 405, { Allow: 'GET, POST' })");
+});
+
+Deno.test('renderEntry: hasAction codegen covers named `actions` exports (#539)', () => {
+  const desc = buildEntryDescriptor(basicRoutes, { ssg: true });
+  const code = renderEntry(desc);
+
+  // The routeInfo hasAction flag must be true for a route exporting ONLY a
+  // named `actions` map — otherwise the prerender hard rule is bypassable.
+  assertStringIncludes(code, 'hasAction: (typeof');
+  assertStringIncludes(code, '.actions === "object" &&');
+});
+
 Deno.test('renderEntry: action catch paths speak ActionResult to fetch callers', () => {
   const desc = buildEntryDescriptor(basicRoutes, {});
   const code = renderEntry(desc);
 
-  // Redirects out of a POST action are coerced to 303 (PRG), including the
-  // ActionResult redirect shape; GET handlers keep the author's status.
-  assertStringIncludes(code, 'err.status === 302 ? 303 : err.status');
+  // Redirects out of a POST action are coerced to 303 (PRG) — every 3xx,
+  // per ADR-0121 — including the ActionResult redirect shape; GET handlers
+  // keep the author's status.
+  assertStringIncludes(code, 'const __redirectStatus = 303;');
   assertStringIncludes(
     code,
     "{ type: 'redirect', status: __redirectStatus, location: err.location }",
diff --git a/packages/adapter-vite/__tests__/request-time-parity.test.ts b/packages/adapter-vite/__tests__/request-time-parity.test.ts
new file mode 100644
index 000000000..b92f6ff9d
--- /dev/null
+++ b/packages/adapter-vite/__tests__/request-time-parity.test.ts
@@ -0,0 +1,182 @@
+/**
+ * @openelement/adapter-vite — dev (hono) vs build (Nitro) semantic parity
+ * contract test (0.42.0-alpha.5 TP-5.5, issue #557, VERSION_PLAN test matrix:
+ * "Contract: dev (hono) vs build (Nitro) semantic parity").
+ *
+ * Boots BOTH servers against the same fixture and asserts the request-time
+ * protocol is semantically identical:
+ *   - dev:   vite dev server (@hono/vite-dev-server over the same virtual
+ *            entry codegen as the build) serving the request-time fixture
+ *   - build: the generated dist/server/index.js default export (the Nitro
+ *            production entry) served by Deno.serve
+ *
+ * Status codes and the listed headers must match exactly; bodies may differ
+ * in dev-only details (client script injection, stack traces) — the test
+ * asserts shape, not bytes.
+ *
+ * Prerequisite: the fixture must be built first —
+ *   deno task fixture:request-time:build
+ */
+
+import { assert, assertEquals, assertStringIncludes } from 'jsr:@std/assert@^1.0.0';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const fixtureDir = join(
+  dirname(fileURLToPath(import.meta.url)),
+  '../__fixtures__/request-time',
+);
+const serverEntryPath = join(fixtureDir, 'dist/server/index.js');
+
+type ServerHandle = { base: string; close: () => Promise<void> };
+
+async function bootBuildServer(): Promise<ServerHandle> {
+  const entry = await import(pathToFileURL(serverEntryPath).href);
+  const handle = entry.default as (event: { request: Request }) => Promise<Response>;
+  const server = Deno.serve({ port: 0, hostname: '127.0.0.1' }, (request) => handle({ request }));
+  const addr = server.addr as Deno.NetAddr;
+  return {
+    base: `http://127.0.0.1:${addr.port}`,
+    close: async () => {
+      await server.shutdown();
+    },
+  };
+}
+
+async function bootDevServer(): Promise<ServerHandle> {
+  // The dev (hono) SSR entry imports the ADR-0044 customElements polyfill as
+  // its first module (plugin.ts virtual:open-ssr-polyfill, fixed in alpha.5 —
+  // dev SSR previously crashed with "customElements is not defined" on every
+  // route, reproducible via `deno task dev` on www).
+  const { createServer } = await import('vite');
+  // The plugin scans routes relative to the process cwd, so boot from the
+  // fixture directory (same shape as `deno task dev`, which cds into www).
+  const previousCwd = Deno.cwd();
+  Deno.chdir(fixtureDir);
+  let server;
+  try {
+    server = await createServer({
+      root: fixtureDir,
+      logLevel: 'silent',
+      server: { port: 0, strictPort: false },
+    });
+    await server.listen();
+  } finally {
+    Deno.chdir(previousCwd);
+  }
+  const address = server.httpServer?.address();
+  assert(address && typeof address === 'object', 'vite dev server did not bind a port');
+  return {
+    base: `http://127.0.0.1:${address.port}`,
+    close: () => server.close(),
+  };
+}
+
+function formBody(fields: Record<string, string>): RequestInit {
+  return {
+    method: 'POST',
+    headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams(fields),
+    redirect: 'manual',
+  };
+}
+
+Deno.test({
+  name: 'request-time parity: dev (hono) vs build (Nitro)',
+  sanitizeOps: false,
+  sanitizeResources: false,
+  fn: async (t) => {
+    // The fixture dist is not committed, and the coverage/test gates run
+    // before any build gate — build it on demand (a no-op when it exists,
+    // which is the common local case).
+    let fixtureBuilt = true;
+    try {
+      await Deno.stat(serverEntryPath);
+    } catch {
+      fixtureBuilt = false;
+    }
+    if (!fixtureBuilt) {
+      const build = await new Deno.Command(Deno.execPath(), {
+        args: ['task', 'fixture:request-time:build'],
+        cwd: join(fixtureDir, '../../../..'),
+        stdout: 'inherit',
+        stderr: 'inherit',
+      }).output();
+      if (!build.success) throw new Error('fixture build failed');
+    }
+
+    const build = await bootBuildServer();
+    const dev = await bootDevServer();
+    try {
+      const both = { dev: dev.base, build: build.base };
+
+      await t.step('GET /live → 200, loader data present, Cache-Control: no-store', async () => {
+        for (const [name, base] of Object.entries(both)) {
+          const response = await fetch(`${base}/live?x=parity`);
+          assertEquals(response.status, 200, `${name}: GET /live status`);
+          assertEquals(
+            response.headers.get('cache-control'),
+            'no-store',
+            `${name}: GET /live cache-control`,
+          );
+          const body = await response.text();
+          assertStringIncludes(body, 'x=parity', `${name}: GET /live loader data`);
+        }
+      });
+
+      await t.step('POST /form empty → 422 + Vary: x-openelement-action', async () => {
+        for (const [name, base] of Object.entries(both)) {
+          const response = await fetch(`${base}/form`, formBody({ message: '' }));
+          assertEquals(response.status, 422, `${name}: POST /form empty status`);
+          assertStringIncludes(
+            response.headers.get('vary') ?? '',
+            'x-openelement-action',
+            `${name}: POST /form empty vary`,
+          );
+          const body = await response.text();
+          assertStringIncludes(body, 'message is required', `${name}: POST /form failure echo`);
+        }
+      });
+
+      await t.step('POST /form valid → 303 + Location', async () => {
+        for (const [name, base] of Object.entries(both)) {
+          const response = await fetch(`${base}/form`, formBody({ message: 'parity-check' }));
+          assertEquals(response.status, 303, `${name}: POST /form valid status`);
+          assertEquals(
+            response.headers.get('location'),
+            '/form?echoed=parity-check',
+            `${name}: POST /form valid location`,
+          );
+          await response.body?.cancel();
+        }
+      });
+
+      await t.step('POST /form?/nope → 404', async () => {
+        for (const [name, base] of Object.entries(both)) {
+          const response = await fetch(`${base}/form?/nope`, formBody({ message: 'x' }));
+          assertEquals(response.status, 404, `${name}: POST /form?/nope status`);
+          await response.body?.cancel();
+        }
+      });
+
+      await t.step('POST /live (no action) → 404', async () => {
+        for (const [name, base] of Object.entries(both)) {
+          const response = await fetch(`${base}/live`, formBody({ x: '1' }));
+          assertEquals(response.status, 404, `${name}: POST /live status`);
+          await response.body?.cancel();
+        }
+      });
+
+      await t.step('PUT /form → 405', async () => {
+        for (const [name, base] of Object.entries(both)) {
+          const response = await fetch(`${base}/form`, { method: 'PUT', body: 'x=1' });
+          assertEquals(response.status, 405, `${name}: PUT /form status`);
+          await response.body?.cancel();
+        }
+      });
+    } finally {
+      await dev.close();
+      await build.close();
+    }
+  },
+});
diff --git a/packages/adapter-vite/__tests__/ssg-helpers.test.ts b/packages/adapter-vite/__tests__/ssg-helpers.test.ts
index 29f32ac85..b9bd232f6 100644
--- a/packages/adapter-vite/__tests__/ssg-helpers.test.ts
+++ b/packages/adapter-vite/__tests__/ssg-helpers.test.ts
@@ -1,5 +1,9 @@
 import { assertEquals, assertThrows } from 'jsr:@std/assert@^1.0.0';
-import { resolveDynamicRoutePath } from '../src/internal/ssg/ssg-helpers.ts';
+import {
+  resolveDynamicRoutePath,
+  routePatternToRegExpSource,
+} from '../src/internal/ssg/ssg-helpers.ts';
+import { parseRouteFilePath } from '../src/internal/ssg/route-scanner.ts';
 
 Deno.test('resolveDynamicRoutePath encodes # ? & % and spaces', () => {
   const path = resolveDynamicRoutePath('/blog/:slug', ['slug'], {
@@ -18,3 +22,14 @@ Deno.test('resolveDynamicRoutePath preserves @ in values', () => {
 Deno.test('resolveDynamicRoutePath rejects path traversal', () => {
   assertThrows(() => resolveDynamicRoutePath('/x/:p', ['p'], { p: '../etc' }));
 });
+
+Deno.test('routePatternToRegExpSource covers exact, param and catch-all patterns (#556)', () => {
+  assertEquals(routePatternToRegExpSource('/form'), '^/form$');
+  assertEquals(routePatternToRegExpSource('/item/:id'), '^/item/([^/]+)$');
+  assertEquals(routePatternToRegExpSource('/docs/:path{.+}'), '^/docs/(.+)$');
+});
+
+Deno.test('parseRouteFilePath maps a catch-all segment to a named Hono regex param (#556)', () => {
+  assertEquals(parseRouteFilePath('docs/[...path].ts'), '/docs/:path{.+}');
+  assertEquals(parseRouteFilePath('item/[id].ts'), '/item/:id');
+});
diff --git a/packages/adapter-vite/__tests__/ssg-render.test.ts b/packages/adapter-vite/__tests__/ssg-render.test.ts
index 4515c93c5..8dac21030 100644
--- a/packages/adapter-vite/__tests__/ssg-render.test.ts
+++ b/packages/adapter-vite/__tests__/ssg-render.test.ts
@@ -493,3 +493,49 @@ export default app;
     await Deno.remove(dir, { recursive: true }).catch(() => {});
   }
 });
+
+Deno.test('request-time server entry matchRequestTimeRoute dispatches param routes (#556)', async () => {
+  const { renderRequestTimeServerModule } = await import(
+    '../src/internal/ssg/ssg-helpers.ts'
+  );
+  const { join } = await import('node:path');
+  const { pathToFileURL } = await import('node:url');
+
+  const dir = await Deno.makeTempDir();
+  try {
+    await Deno.writeTextFile(
+      join(dir, 'entry.js'),
+      `import { Hono } from 'hono';\nconst app = new Hono();\nexport default app;\n`,
+    );
+    await Deno.writeTextFile(
+      join(dir, 'index.js'),
+      renderRequestTimeServerModule([
+        { path: '/item/:id', paramNames: ['id'] },
+        { path: '/form', paramNames: [] },
+        { path: '/docs/:path{.+}', paramNames: ['path'] },
+      ]),
+    );
+    await Deno.writeTextFile(join(dir, 'client-script.js'), `export const clientScriptSrc = '';\n`);
+
+    const mod = await import(pathToFileURL(join(dir, 'index.js')).href + '?matcher') as {
+      matchRequestTimeRoute: (
+        pathname: string,
+      ) => { path: string; params: Record<string, string> } | null;
+    };
+    assertEquals(mod.matchRequestTimeRoute('/form'), { path: '/form', params: {} });
+    assertEquals(mod.matchRequestTimeRoute('/item/42'), {
+      path: '/item/:id',
+      params: { id: '42' },
+    });
+    // The exact route wins over any parameterized pattern.
+    assertEquals(mod.matchRequestTimeRoute('/item'), null);
+    // Catch-all matches across segments and keeps the param name.
+    assertEquals(mod.matchRequestTimeRoute('/docs/a/b/c'), {
+      path: '/docs/:path{.+}',
+      params: { path: 'a/b/c' },
+    });
+    assertEquals(mod.matchRequestTimeRoute('/nope'), null);
+  } finally {
+    await Deno.remove(dir, { recursive: true }).catch(() => {});
+  }
+});
diff --git a/packages/adapter-vite/deno.json b/packages/adapter-vite/deno.json
index 025441ef9..bb4114df3 100644
--- a/packages/adapter-vite/deno.json
+++ b/packages/adapter-vite/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/adapter-vite",
-  "version": "0.42.0-alpha.4",
+  "version": "0.42.0-alpha.5",
   "exports": {
     ".": "./src/index.ts",
     "./nitro-mount": "./src/nitro-mount.ts",
diff --git a/packages/adapter-vite/src/build.ts b/packages/adapter-vite/src/build.ts
index 55e88e949..00f120f3b 100644
--- a/packages/adapter-vite/src/build.ts
+++ b/packages/adapter-vite/src/build.ts
@@ -213,8 +213,13 @@ export function buildPlugin(
         throw error;
       }
 
-      // Phase 2: Client island bundle (only if islands exist)
-      if (totalIslands > 0) {
+      // Phase 2: Client island bundle (only if islands exist — or enhanced
+      // forms, #569: an island-free app with data-open-enhance forms still
+      // needs the client entry for the enhancement layer)
+      const hasEnhancedForms = (ctx.phase1.cachedRoutes ?? []).some((route) =>
+        route.type === 'page' && route.hasEnhancedForms === true
+      );
+      if (totalIslands > 0 || hasEnhancedForms) {
         await runClientIslandBuild(ctx);
       }
 
diff --git a/packages/adapter-vite/src/cli/build-client.ts b/packages/adapter-vite/src/cli/build-client.ts
index fcf500f3e..cabc41149 100644
--- a/packages/adapter-vite/src/cli/build-client.ts
+++ b/packages/adapter-vite/src/cli/build-client.ts
@@ -169,13 +169,22 @@ async function buildClient(ctx: OpenElementBuildContext): Promise<void> {
     return findB - findA;
   });
 
-  if (localIslands.length === 0 && packageIslandDecls.length === 0) {
+  // #569: an island-free app with data-open-enhance forms still needs the
+  // client entry — it carries the form-enhancement layer.
+  const enhancedForms = (ctx.phase1.cachedRoutes ?? []).some((route) =>
+    route.type === 'page' && route.hasEnhancedForms === true
+  );
+
+  if (localIslands.length === 0 && packageIslandDecls.length === 0 && !enhancedForms) {
     log.info('No islands found - zero client JS output');
     return;
   }
 
   const totalIslands = localIslands.length + packageIslandDecls.length;
-  log.info(`Building client bundle for ${totalIslands} island(s)...`);
+  log.info(
+    `Building client bundle for ${totalIslands} island(s)` +
+      (enhancedForms ? ' + data-open-enhance form enhancement' : '') + '...',
+  );
 
   // Generate client entry code
   const islandEntries: ClientIslandEntry[] = [
@@ -212,7 +221,7 @@ async function buildClient(ctx: OpenElementBuildContext): Promise<void> {
     ),
   ];
 
-  const clientEntryCode = generateClientEntry(islandEntries);
+  const clientEntryCode = generateClientEntry(islandEntries, { enhancedForms });
 
   // Restore RegExp from serialized noExternal patterns
   const noExternalPatterns = (ctx.phase3.ssrNoExternal || []).map((item) => {
diff --git a/packages/adapter-vite/src/cli/build-ssg.ts b/packages/adapter-vite/src/cli/build-ssg.ts
index d65708213..b9dc22c6e 100644
--- a/packages/adapter-vite/src/cli/build-ssg.ts
+++ b/packages/adapter-vite/src/cli/build-ssg.ts
@@ -34,7 +34,10 @@ import { createSsgRenderEvidence } from './ssg-render.ts';
 import { createGeneratedDataResolverPlugin } from '../generated-data-resolver.ts';
 import { createNpmSpecifierPlugin } from '../npm-specifier-plugin.ts';
 import { quoteGeneratedJavaScriptValue } from '../internal/ssg/codegen-literals.ts';
-import { generateSsrPolyfillBanner } from '../internal/ssg/index.ts';
+import {
+  generateCustomElementsPolyfill,
+  generateSsrPolyfillBanner,
+} from '../internal/ssg/index.ts';
 import { optionalPackageStubsPlugin } from '../plugin.ts';
 import { normalizeViteAliases } from '../alias-utils.ts';
 import { DEFAULT_OUT_DIR, OPEN_ELEMENT_DIR } from '../internal/paths.ts';
@@ -299,17 +302,7 @@ async function buildSSG(
             // Uses Map-backed define()/get(); renderDsdByName() looks up
             // components via customElements.get(tagName) during SSG rendering.
             // SOP-016: HTMLElement stub is self-contained in @openelement/element/dsd-element.ts.
-            banner: `\
-if (typeof globalThis.customElements === 'undefined') {
-  const __openCeRegistry = new Map();
-  globalThis.customElements = {
-    define(name, ctor, _opts) { __openCeRegistry.set(name, ctor); },
-    get(name) { return __openCeRegistry.get(name); },
-    whenDefined(name) { return Promise.resolve(__openCeRegistry.get(name)); },
-    upgrade(_root) {},
-  };
-}
-`,
+            banner: generateCustomElementsPolyfill(),
           },
         },
       },
diff --git a/packages/adapter-vite/src/internal/ssg/entry-descriptor.ts b/packages/adapter-vite/src/internal/ssg/entry-descriptor.ts
index 7ae60721f..2e1d74113 100644
--- a/packages/adapter-vite/src/internal/ssg/entry-descriptor.ts
+++ b/packages/adapter-vite/src/internal/ssg/entry-descriptor.ts
@@ -99,6 +99,8 @@ export function buildEntryDescriptor(
 
   // Always needed
   imports.push({ from: 'hono', names: ['Hono'] });
+  // ADR-0121 (#568): default body limit on action POST routes.
+  imports.push({ from: 'hono/body-limit', names: ['bodyLimit'], alias: '__bodyLimit' });
   imports.push({
     from: '@openelement/element',
     names: ['renderDsd', 'renderDsdTree', 'escapeHtml'],
diff --git a/packages/adapter-vite/src/internal/ssg/entry-generators.ts b/packages/adapter-vite/src/internal/ssg/entry-generators.ts
index ad194e76e..b3915fb51 100644
--- a/packages/adapter-vite/src/internal/ssg/entry-generators.ts
+++ b/packages/adapter-vite/src/internal/ssg/entry-generators.ts
@@ -111,12 +111,22 @@ export function validateClientIslandEntry(entry: ClientIslandEntry): AdmittedCli
   return { ...entry, modulePath };
 }
 
+export interface GenerateClientEntryOptions {
+  /**
+   * True when any page route carries data-open-enhance (#569): emit the form
+   * enhancement layer even with zero islands, so enhanced forms are not
+   * silently left as plain no-JS posts.
+   */
+  enhancedForms?: boolean;
+}
+
 export function generateClientEntry(
   islands: ClientIslandEntry[],
+  options: GenerateClientEntryOptions = {},
 ): string {
   const admittedIslands = islands.map(validateClientIslandEntry);
 
-  if (admittedIslands.length === 0) {
+  if (admittedIslands.length === 0 && options.enhancedForms !== true) {
     return '// openElement Client Entry - No islands detected, zero client JS needed\n';
   }
 
@@ -196,7 +206,17 @@ ${
 ${
     visibleTags
       ? `var __visibleTags = [${visibleTags || ''}];
-var __observedTags = [];
+var __observedEls = [];
+function __queryAllDeep(root, tag, out) {
+  // Islands live inside page-element shadow roots; a plain
+  // document.querySelectorAll never sees them (#562).
+  var found = root.querySelectorAll(tag);
+  for (var i = 0; i < found.length; i++) out.push(found[i]);
+  var all = root.querySelectorAll('*');
+  for (var j = 0; j < all.length; j++) {
+    if (all[j].shadowRoot) __queryAllDeep(all[j].shadowRoot, tag, out);
+  }
+}
 function __observeVisible() {
   if (!('IntersectionObserver' in window)) {
     __visibleTags.forEach(__load);
@@ -204,22 +224,25 @@ function __observeVisible() {
     return;
   }
   __visibleTags.forEach(function(tag) {
-    var els = document.querySelectorAll(tag);
-    if (els.length > 0 && __observedTags.indexOf(tag) === -1) {
-      __observedTags.push(tag);
-      els.forEach(function(el) {
-        var obs = new IntersectionObserver(function(entries) {
-          entries.forEach(function(entry) {
-            if (entry.isIntersecting) {
-              __load(tag);
-              __dispatchReady('visible', [tag]);
-              obs.disconnect();
-            }
-          });
-        }, { rootMargin: '200px' });
-        obs.observe(el);
-      });
-    }
+    if (!__map[tag]) return;
+    var els = [];
+    __queryAllDeep(document, tag, els);
+    els.forEach(function(el) {
+      // Re-observable after a morph: a replaced island is a new element and
+      // gets a fresh observer (#562).
+      if (__observedEls.indexOf(el) !== -1) return;
+      __observedEls.push(el);
+      var obs = new IntersectionObserver(function(entries) {
+        entries.forEach(function(entry) {
+          if (entry.isIntersecting) {
+            __load(tag);
+            __dispatchReady('visible', [tag]);
+            obs.disconnect();
+          }
+        });
+      }, { rootMargin: '200px' });
+      obs.observe(el);
+    });
   });
 }
 __onReady(__observeVisible);`
@@ -239,52 +262,76 @@ __schedule(__deferred);`
       : '// No client:idle islands'
   }
 
-// Form enhancement (ADR-0120, 0.42.0-alpha.2/alpha.3): forms marked
-// data-open-enhance submit via fetch and the returned document is morphed
-// into place — no full reload, and untouched subtrees (including hydrated
-// islands whose light DOM did not change) keep their state. Without
-// JavaScript the same form is a native POST (303/422 HTML), so behavior
-// degrades to the browser by construction.
+${
+    options.enhancedForms === true
+      ? `// Form enhancement (ADR-0120, hardened by ADR-0121 in 0.42.0-alpha.5):
+// forms marked data-open-enhance submit via fetch and the returned document
+// is morphed into the live tree — INSIDE the page element's shadow root,
+// which is where page content lives under DSD. Two structural facts drive
+// this implementation:
+//   1. The submit event is not composed in every engine, so a document-level
+//      listener never sees forms inside page DSD — listeners attach to every
+//      shadow root instead (a composed submit still reaches the root listener
+//      first; the document listener only handles light-DOM forms).
+//   2. The page's real content is the page host's shadow tree; the incoming
+//      document carries it in the host's <template shadowrootmode> child, so
+//      the morph descends into shadow roots and treats DSD templates as the
+//      incoming shadow content.
+// Without JavaScript the same form is a native POST (303/422 HTML), so
+// behavior degrades to the browser by construction.
+var __STATE_ATTRS = { DETAILS: { open: 1 }, VIDEO: { src: 1 }, AUDIO: { src: 1 } };
+
 function __syncAttrs(oldEl, newEl) {
+  // State-mirroring attributes (#567): user-toggled state (an open <details>,
+  // a playing media element) wins over the incoming document.
+  var skip = __STATE_ATTRS[oldEl.tagName];
   for (var i = oldEl.attributes.length - 1; i >= 0; i--) {
     var name = oldEl.attributes[i].name;
+    if (skip && skip[name]) continue;
     if (!newEl.hasAttribute(name)) oldEl.removeAttribute(name);
   }
   for (var j = 0; j < newEl.attributes.length; j++) {
     var attr = newEl.attributes[j];
+    if (skip && skip[attr.name]) continue;
     if (oldEl.getAttribute(attr.name) !== attr.value) {
       oldEl.setAttribute(attr.name, attr.value);
     }
   }
 }
 
+function __shadowTemplate(el) {
+  for (var i = 0; i < el.childNodes.length; i++) {
+    var n = el.childNodes[i];
+    if (n.nodeType === 1 && n.tagName === 'TEMPLATE' && n.hasAttribute('shadowrootmode')) return n;
+  }
+  return null;
+}
+
 function __islandIntact(oldEl, newEl) {
-  // A hydrated island (live shadow root) survives when its light-DOM
-  // surface serializes identically in the incoming document. The incoming
-  // <template shadowrootmode> child is skipped in the comparison: the
-  // browser already consumed it into the live shadow root. Replacing an
-  // intact island would reset its state.
+  // A hydrated island (live shadow root) survives when its light-DOM surface
+  // serializes identically in the incoming document. The DSD template child
+  // is skipped on both sides: the browser already consumed it into the live
+  // shadow root, and DOMParser does not consume it here.
   if (!oldEl.shadowRoot) return false;
   if (oldEl.attributes.length !== newEl.attributes.length) return false;
   for (var i = 0; i < newEl.attributes.length; i++) {
     var attr = newEl.attributes[i];
     if (oldEl.getAttribute(attr.name) !== attr.value) return false;
   }
-  var newKids = [];
-  for (var k = 0; k < newEl.childNodes.length; k++) {
-    var n = newEl.childNodes[k];
-    if (n.nodeType === 1 && n.tagName === 'TEMPLATE' && n.hasAttribute('shadowrootmode')) continue;
-    // Whitespace-only text nodes carry no meaning: hydration normalizes the
-    // live tree (merged text), the fresh parse keeps them split.
-    if (n.nodeType === 3 && n.data.trim() === '') continue;
-    newKids.push(n);
-  }
-  var oldKids = [];
-  for (var k0 = 0; k0 < oldEl.childNodes.length; k0++) {
-    var o0 = oldEl.childNodes[k0];
-    if (o0.nodeType === 3 && o0.data.trim() === '') continue;
-    oldKids.push(o0);
+  function significantKids(el, skipTemplate) {
+    var out = [];
+    for (var k = 0; k < el.childNodes.length; k++) {
+      var n = el.childNodes[k];
+      if (skipTemplate && n.nodeType === 1 && n.tagName === 'TEMPLATE' && n.hasAttribute('shadowrootmode')) continue;
+      // Whitespace-only text nodes carry no meaning: hydration normalizes the
+      // live tree (merged text), the fresh parse keeps them split.
+      if (n.nodeType === 3 && n.data.trim() === '') continue;
+      out.push(n);
+    }
+    return out;
   }
+  var newKids = significantKids(newEl, true);
+  var oldKids = significantKids(oldEl, true);
   if (oldKids.length !== newKids.length) return false;
   for (var m = 0; m < newKids.length; m++) {
     var o = oldKids[m];
@@ -296,8 +343,62 @@ function __islandIntact(oldEl, newEl) {
   return true;
 }
 
+function __compatible(a, b) {
+  return a.nodeType === b.nodeType && (a.nodeType !== 1 || a.tagName === b.tagName);
+}
+
+function __morphChildren(oldParent, newParent) {
+  // ADR-0121 §9 (#554): id-keyed matching first, then a structural walk with
+  // bounded lookahead — insertions and removals between compatible anchors
+  // are preserved instead of cascading into wholesale replacement.
+  var oldKids = Array.prototype.slice.call(oldParent.childNodes);
+  var newKids = Array.prototype.slice.call(newParent.childNodes);
+  var byId = {};
+  for (var j = 0; j < newKids.length; j++) {
+    var cand = newKids[j];
+    if (cand.nodeType === 1 && cand.id && !byId[cand.id]) byId[cand.id] = cand;
+  }
+  var usedNew = [];
+  var pairs = [];
+  for (var i = 0; i < oldKids.length; i++) {
+    var o = oldKids[i];
+    var match = null;
+    if (o.nodeType === 1 && o.id && byId[o.id] && usedNew.indexOf(byId[o.id]) === -1 &&
+        __compatible(o, byId[o.id])) {
+      match = byId[o.id];
+      usedNew.push(match);
+    }
+    pairs.push([o, match]);
+  }
+  var remainingNew = [];
+  for (var r = 0; r < newKids.length; r++) {
+    if (usedNew.indexOf(newKids[r]) === -1) remainingNew.push(newKids[r]);
+  }
+  var ni = 0;
+  for (var p = 0; p < pairs.length; p++) {
+    var oldEl = pairs[p][0];
+    var paired = pairs[p][1];
+    if (paired) {
+      __morphNode(oldEl, paired);
+      continue;
+    }
+    var found = -1;
+    for (var w = ni; w < Math.min(ni + 4, remainingNew.length); w++) {
+      if (__compatible(oldEl, remainingNew[w])) { found = w; break; }
+    }
+    if (found !== -1) {
+      for (var ins = ni; ins < found; ins++) oldParent.insertBefore(remainingNew[ins], oldEl);
+      __morphNode(oldEl, remainingNew[found]);
+      ni = found + 1;
+    } else {
+      oldEl.remove();
+    }
+  }
+  for (var tail = ni; tail < remainingNew.length; tail++) oldParent.appendChild(remainingNew[tail]);
+}
+
 function __morphNode(oldEl, newEl) {
-  if (oldEl.nodeType !== newEl.nodeType || oldEl.tagName !== newEl.tagName) {
+  if (!__compatible(oldEl, newEl)) {
     oldEl.replaceWith(newEl);
     return;
   }
@@ -307,69 +408,189 @@ function __morphNode(oldEl, newEl) {
   }
   if (oldEl.nodeType !== 1) return;
   if (oldEl.tagName === 'SCRIPT') {
-    // Keep the live script node: replacing it would re-execute the island
-    // client entry and double every listener.
+    // Keep the live script node (#563): replacing it would re-execute the
+    // island client entry and double every listener; a changed src is left
+    // stale by design (parsed scripts never execute anyway).
     return;
   }
   if (oldEl.hasAttribute('data-open-preserve')) return;
-  if (__islandIntact(oldEl, newEl)) return;
-  if (oldEl.shadowRoot) {
-    // Hydrated island whose surface changed: replace (state resets by design).
-    oldEl.replaceWith(newEl);
-    return;
+  var isIsland = __tags.indexOf(oldEl.tagName.toLowerCase()) !== -1;
+  if (isIsland) {
+    if (__islandIntact(oldEl, newEl)) return;
+    if (oldEl.shadowRoot) {
+      // Hydrated island whose surface changed: replace (state resets by design).
+      oldEl.replaceWith(newEl);
+      return;
+    }
+    // Unhydrated island: morph it like any other element below.
   }
   __syncAttrs(oldEl, newEl);
-  var oldChildren = Array.from(oldEl.childNodes);
-  var newChildren = Array.from(newEl.childNodes);
-  var shared = Math.max(oldChildren.length, newChildren.length);
-  for (var i = 0; i < shared; i++) {
-    var o = oldChildren[i];
-    var n = newChildren[i];
-    if (o && n) __morphNode(o, n);
-    else if (n) oldEl.appendChild(n);
-    else if (o) o.remove();
+  if (!isIsland) {
+    // Page-level DSD: the element's real content is its shadow tree; the
+    // incoming document carries it in the <template shadowrootmode> child.
+    var newTemplate = __shadowTemplate(newEl);
+    if (oldEl.shadowRoot && newTemplate) {
+      __morphChildren(oldEl.shadowRoot, newTemplate.content);
+      return;
+    }
   }
+  __morphChildren(oldEl, newEl);
 }
 
-function __morphDocument(html) {
+function __findDeep(root, selector) {
+  // Region lookup that descends into shadowrootmode templates (#553): the
+  // incoming document's regions live inside the page host's template.
+  var direct = root.querySelector(selector);
+  if (direct) return direct;
+  var templates = root.querySelectorAll('template[shadowrootmode]');
+  for (var i = 0; i < templates.length; i++) {
+    var found = __findDeep(templates[i].content, selector);
+    if (found) return found;
+  }
+  return null;
+}
+
+function __morphDocument(html, form, regionName) {
   var doc = new DOMParser().parseFromString(html, 'text/html');
-  document.title = doc.title;
-  var region = document.querySelector('[data-open-region]');
-  if (region) {
-    var next = doc.querySelector('[data-open-region="' + region.getAttribute('data-open-region') + '"]');
-    if (next) {
-      __morphNode(region, next);
-      return;
+  if (doc.title) document.title = doc.title;
+  // ADR-0121 §8 (#553): the form scopes the morph — data-open-region-target
+  // (submitter wins over the form), else its nearest ancestor region, else
+  // the whole body. A scope missing on either side is a full navigation,
+  // never a silent full morph.
+  if (form) {
+    var name = regionName || form.getAttribute('data-open-region-target');
+    if (!name) {
+      var host = form.closest('[data-open-region]');
+      if (host) name = host.getAttribute('data-open-region');
+    }
+    if (name) {
+      var selector = '[data-open-region="' + (window.CSS && CSS.escape ? CSS.escape(name) : name) + '"]';
+      var root = form.getRootNode ? form.getRootNode() : document;
+      var oldScope = root.querySelector ? root.querySelector(selector) : null;
+      var newScope = __findDeep(doc.body, selector);
+      if (oldScope && newScope) {
+        __morphNode(oldScope, newScope);
+        return true;
+      }
+      return false;
     }
   }
   __morphNode(document.body, doc.body);
+  return true;
 }
 
-document.addEventListener('submit', function (event) {
+var __submitRoots = [];
+function __attachSubmit(root) {
+  if (__submitRoots.indexOf(root) !== -1) return;
+  __submitRoots.push(root);
+  root.addEventListener('submit', __onSubmit);
+}
+function __scanSubmitRoots(root) {
+  // The submit event is not reliably composed across engines, so enhanced
+  // forms inside shadow roots are intercepted at the root. Idempotent; runs
+  // at ready time and after every morph (new hosts may appear).
+  var all = root.querySelectorAll('*');
+  for (var i = 0; i < all.length; i++) {
+    var el = all[i];
+    if (el.shadowRoot) {
+      __attachSubmit(el.shadowRoot);
+      __scanSubmitRoots(el.shadowRoot);
+    }
+  }
+}
+
+var __submitSeq = 0;
+var __enhancedNav = false;
+function __onSubmit(event) {
   var form = event.target;
   if (!(form instanceof HTMLFormElement)) return;
   if (!form.hasAttribute('data-open-enhance')) return;
   var method = (form.getAttribute('method') || 'get').toUpperCase();
   if (method === 'GET') return;
   event.preventDefault();
+  // #564: a second submit while one is in flight is ignored; cross-form
+  // responses are ordered by the sequence check below.
+  if (form.__openElementBusy) return;
+  form.__openElementBusy = true;
+  var seq = ++__submitSeq;
   var submitter = event.submitter;
   var actionUrl = (submitter && submitter.formAction) || form.action || window.location.href;
+  // #544: the submitter's name/value is part of the body — the body never
+  // differs between the two paths (ADR-0120 rule 2).
+  var body = submitter ? new FormData(form, submitter) : new FormData(form);
+  var regionName = (submitter && submitter.getAttribute('data-open-region-target')) ||
+    form.getAttribute('data-open-region-target');
   fetch(actionUrl, {
     method: method,
-    body: new FormData(form),
-    headers: { 'x-openelement-enhance': 'true' },
+    body: body,
+    headers: { 'x-openelement-action': 'enhance' },
   }).then(function (response) {
     return response.text().then(function (html) {
-      return { html: html, url: response.url };
+      return {
+        html: html,
+        url: response.url,
+        status: response.status,
+        type: response.headers.get('content-type') || '',
+      };
     });
   }).then(function (result) {
-    __morphDocument(result.html);
-    if (result.url && result.url !== window.location.href) {
-      history.pushState({}, '', result.url);
+    form.__openElementBusy = false;
+    if (seq !== __submitSeq) return;
+    var target = new URL(result.url, window.location.href);
+    // #555: cross-origin targets are real navigations, never pushState.
+    if (target.origin !== window.location.origin) {
+      window.location.assign(target.href);
+      return;
     }
+    // #552: only 200/422 HTML responses morph; anything else (500, empty,
+    // non-HTML) navigates so the real page shows instead of morphing an
+    // error page into place.
+    var morphable = (result.status === 200 || result.status === 422) &&
+      result.type.indexOf('text/html') !== -1;
+    if (morphable) {
+      // ADR-0121 §11 (#546): cancelable failure hook before the default morph.
+      if (result.status === 422) {
+        var proceed = form.dispatchEvent(new CustomEvent('open:action-failure', {
+          cancelable: true,
+          detail: { status: result.status, form: form, response: result },
+        }));
+        if (!proceed) return;
+      }
+      if (__morphDocument(result.html, form, regionName)) {
+        __scanSubmitRoots(document);
+        if (typeof __observeVisible === 'function') __observeVisible();
+        // #565: the fragment never travels over the wire; keep the local one
+        // when the target is the same page.
+        var samePage = target.pathname === window.location.pathname &&
+          target.search === window.location.search;
+        var finalUrl = target.href + (samePage && !target.hash ? window.location.hash : '');
+        if (finalUrl !== window.location.href) {
+          __enhancedNav = true;
+          history.pushState({}, '', finalUrl);
+        }
+        return;
+      }
+    }
+    window.location.assign(target.href);
   }).catch(function () {
+    form.__openElementBusy = false;
     window.location.reload();
   });
+}
+
+__attachSubmit(document);
+__onReady(function () { __scanSubmitRoots(document); });
+
+// ADR-0121 §10 (#545): enhanced navigation is pushState-based; back/forward
+// reloads the restored URL so content never disagrees with the address bar.
+// The guard keeps the listener inert on pages that never enhanced-navigated
+// (e.g. sites running their own client-side routing on the same bundle).
+window.addEventListener('popstate', function () {
+  if (__enhancedNav) window.location.reload();
 });
+`
+      : '// No data-open-enhance forms: the form enhancement layer is omitted (#569 complement),\n// keeping the client bundle free of morph and popstate code.'
+  }
+
 `;
 }
diff --git a/packages/adapter-vite/src/internal/ssg/entry-render-helpers.ts b/packages/adapter-vite/src/internal/ssg/entry-render-helpers.ts
index 7314a7ac6..e286b2e9f 100644
--- a/packages/adapter-vite/src/internal/ssg/entry-render-helpers.ts
+++ b/packages/adapter-vite/src/internal/ssg/entry-render-helpers.ts
@@ -149,12 +149,26 @@ export function renderRouteHandler(
   if (!isAction) {
     lines.push('// GET handler - renders the page with loader data');
   }
-  lines.push(`app.${method}(${pathLiteral}, async (c) => {`);
+  if (isAction) {
+    // ADR-0121 (#568): conservative default body limit on action POSTs;
+    // larger uploads belong on API routes with explicit limits.
+    lines.push(
+      `app.post(${pathLiteral}, __bodyLimit({ maxSize: 10 * 1024 * 1024, onError: (c) => { c.header('Cache-Control', 'no-store'); c.header('Vary', 'x-openelement-action'); return c.text('Payload Too Large', 413); } }), async (c) => {`,
+    );
+  } else {
+    lines.push(`app.get(${pathLiteral}, async (c) => {`);
+  }
   lines.push(`  let __tag = ${tagNameExpr}`);
   lines.push(`  let __page = ${pageDefExpr}`);
   lines.push(`  let __params = {}`);
   lines.push(`  let __routeMetaValue = ${routeMeta}`);
   lines.push(`  const __routeContext = ${routeContext}`);
+  // ADR-0121 section 6 (#550): request-time responses are never cacheable;
+  // the POST endpoint is negotiated by the framework action header.
+  lines.push(`  c.header('Cache-Control', 'no-store');`);
+  if (isAction) {
+    lines.push(`  c.header('Vary', 'x-openelement-action');`);
+  }
   if (isAction) {
     // Declared outside try so the catch can branch on the fetch path without
     // hitting a TDZ error when the action block never ran.
@@ -178,14 +192,17 @@ export function renderRouteHandler(
   }
 
   if (isAction) {
-    // ADR-0120 action protocol (0.42.0-alpha.2):
-    // - named actions: ?/name selects module.actions[name] (SvelteKit shape);
+    // ADR-0120 action protocol (0.42.0-alpha.2), hardened by ADR-0121:
+    // - named actions: ?/name selects module.actions[name] (SvelteKit shape),
+    //   with an own-key lookup so prototype members are never callable;
     // - the action runs BEFORE the loader so a mutation never renders stale
     //   data (revalidation invariant);
     // - fail() returns take the 422 re-render channel with the failure data
     //   echoed; everything else succeeds;
     // - a successful non-GET action never answers 200 with a rendered page:
-    //   303 back to the route (PRG), or an ActionResult for fetch callers.
+    //   303 back to the route (PRG, action marker stripped), or an
+    //   ActionResult for fetch callers; a returned Response is a contract
+    //   violation, not a response.
     lines.push(`    const __url = new URL(c.req.url);`);
     lines.push(
       `    const __actionName = (() => { for (const key of __url.searchParams.keys()) { if (key.startsWith('/')) return key.slice(1); } return undefined; })();`,
@@ -193,27 +210,57 @@ export function renderRouteHandler(
     lines.push(
       `    const __namedActions = (typeof ${route.varName}.actions === 'object' && ${route.varName}.actions !== null) ? ${route.varName}.actions : {};`,
     );
+    // ADR-0121 (#542): own-key lookup — ?/constructor and other prototype
+    // members are never callable as actions.
     lines.push(
-      `    const __actionFn = __actionName !== undefined ? __namedActions[__actionName] : (typeof ${route.varName}.action === 'function' ? ${route.varName}.action : undefined);`,
+      `    const __actionFn = __actionName !== undefined ? (Object.prototype.hasOwnProperty.call(__namedActions, __actionName) ? __namedActions[__actionName] : undefined) : (typeof ${route.varName}.action === 'function' ? ${route.varName}.action : undefined);`,
     );
-    lines.push(`    __isFetch = c.req.header('x-openelement-action') === 'true';`);
+    // ADR-0121 section 1 (#540): one header, two values — 'true' selects the
+    // ActionResult JSON channel; 'enhance' marks the built-in morph client
+    // (HTML responses identical to the no-JS path).
+    lines.push(`    const __actionHeader = c.req.header('x-openelement-action');`);
+    lines.push(`    __isFetch = __actionHeader === 'true';`);
     lines.push(`    if (typeof __actionFn !== 'function') {`);
     lines.push(
-      `      return c.html(wrapInDocument(__statusHtml('404 Not Found', 'This route does not accept submissions.'), { title: '404 Not Found', lang: ${
+      `      const __noActionMessage = __actionName !== undefined ? 'No action named "' + __actionName + '" on this route.' : 'This route does not accept submissions.';`,
+    );
+    // ADR-0121 section 5 (#549): fetch callers always receive ActionResult
+    // JSON — the two channels never diverge in shape.
+    lines.push(`      if (__isFetch) {`);
+    lines.push(
+      `        return c.json({ type: 'error', status: 404, error: { message: __noActionMessage } }, 404);`,
+    );
+    lines.push(`      }`);
+    lines.push(
+      `      return c.html(wrapInDocument(__statusHtml('404 Not Found', __noActionMessage), { title: '404 Not Found', lang: ${
         jsStringLiteral(docConfig.lang)
       }, headExtras: ${headExtrasExpr}, allowHeadExtrasScripts: ${
         JSON.stringify(docConfig.allowHeadExtrasScripts)
       }, cspNonce: c.get('cspNonce') }), 404);`,
     );
     lines.push(`    }`);
-    lines.push(`    if (__actionName !== undefined && typeof __actionFn !== 'function') {`);
+    lines.push(`    const __formData = await c.req.raw.formData();`);
+    lines.push(
+      `    const __actionResult = await __actionFn({ ...__loadContext, formData: __formData });`,
+    );
+    // ADR-0121 section 2 (#541): actions must not return a Response — the
+    // return channel is data or fail(), the redirect channel is redirect().
+    // A returned Response used to bypass every status rule; it is now a
+    // contract violation on both channels.
+    lines.push(`    if (__actionResult instanceof Response) {`);
     lines.push(
-      `      return c.json({ type: 'error', status: 404, error: { message: 'No action named "' + __actionName + '" on this route.' } }, 404);`,
+      `      throw new Error('[openElement] Actions must not return a Response object; return data, fail(status, data), or throw redirect() (ADR-0121).');`,
     );
     lines.push(`    }`);
-    lines.push(`    const __formData = await c.req.raw.formData();`);
+    // ADR-0121 section 4 (#548): the default PRG target strips the ?/name
+    // action marker; all other query parameters are preserved.
+    lines.push(`    const __prgParams = new URLSearchParams(__url.search);`);
+    lines.push(
+      `    for (const key of [...__prgParams.keys()]) { if (key.startsWith('/')) __prgParams.delete(key); }`,
+    );
+    lines.push(`    const __prgSearch = __prgParams.toString();`);
     lines.push(
-      `    const __actionResult = typeof __actionFn === 'function' ? await __actionFn({ ...__loadContext, formData: __formData }) : undefined;`,
+      `    const __prgTarget = __url.pathname + (__prgSearch ? '?' + __prgSearch : '');`,
     );
     lines.push(`    if (__isFetch) {`);
     lines.push(`      if (__isActionFailure(__actionResult)) {`);
@@ -221,13 +268,14 @@ export function renderRouteHandler(
       `        return c.json({ type: 'failure', status: __actionResult.status, data: __actionResult.data }, __actionResult.status);`,
     );
     lines.push(`      }`);
+    // ADR-0121 section 3: HTTP 200 carrying a data message, not an HTTP
+    // redirect (fetch would follow a 3xx and the JSON would be unreadable).
     lines.push(
-      `      return c.json({ type: 'redirect', status: 303, location: __url.pathname + __url.search });`,
+      `      return c.json({ type: 'redirect', status: 303, location: __prgTarget });`,
     );
     lines.push(`    }`);
     lines.push(`    if (!__isActionFailure(__actionResult)) {`);
-    lines.push(`      if (__actionResult instanceof Response) return __actionResult;`);
-    lines.push(`      return c.redirect(__url.pathname + __url.search, 303);`);
+    lines.push(`      return c.redirect(__prgTarget, 303);`);
     lines.push(`    }`);
     lines.push(
       `    const __data = typeof ${route.varName}.loader === "function" ? await ${route.varName}.loader(__loadContext) : undefined;`,
@@ -276,8 +324,11 @@ export function renderRouteHandler(
   lines.push(`  } catch (err) {`);
   lines.push(`    if (__isOpenElementRedirect(err)) {`);
   if (isAction) {
+    // ADR-0121 section 3 (#547): in the POST action context every 3xx is
+    // coerced to 303 (PRG must be method-safe and non-cacheable); GET
+    // handlers keep the author's status.
     lines.push(
-      `      const __redirectStatus = err.status === 302 ? 303 : err.status;`,
+      `      const __redirectStatus = 303;`,
     );
     lines.push(
       `      if (__isFetch) return c.json({ type: 'redirect', status: __redirectStatus, location: err.location });`,
@@ -301,7 +352,22 @@ export function renderRouteHandler(
   lines.push(`      }), 404)`);
   lines.push(`    }`);
 
-  if (!isAction) {
+  // ADR-0121 (#558): the JSON error channel scrubs internals in production,
+  // matching the HTML channel. Fetch callers get ActionResult JSON, never
+  // the boundary page.
+  if (isAction) {
+    lines.push(`    if (__isFetch) {`);
+    lines.push(
+      `      console.error('[openElement] Action POST failed for ' + ${pathLiteral} + ':', err)`,
+    );
+    lines.push(
+      `      return c.json({ type: 'error', status: 500, error: { message: import.meta.env.PROD ? 'Internal Server Error' : String(err && err.message ? err.message : err) } }, 500);`,
+    );
+    lines.push(`    }`);
+  }
+  // ADR-0121 section 7 (#551): POST takes the same nearest-error-boundary
+  // channel as GET — the page's error component renders with status 500.
+  {
     lines.push(`    if (typeof __page.error === "function") {`);
     lines.push(`      try {`);
     lines.push(
@@ -336,13 +402,6 @@ export function renderRouteHandler(
   lines.push(
     `    console.error('[openElement] ${failureLabel} for ' + ${pathLiteral} + ':', err)`,
   );
-  if (isAction) {
-    lines.push(`    if (__isFetch) {`);
-    lines.push(
-      `      return c.json({ type: 'error', status: 500, error: { message: String(err && err.message ? err.message : err) } }, 500);`,
-    );
-    lines.push(`    }`);
-  }
   lines.push(`    if (import.meta.env.PROD) {`);
   lines.push(`      return c.html('<h1>500 Internal Server Error</h1>', 500)`);
   lines.push(`    } else {`);
@@ -373,6 +432,16 @@ export function renderActionRoute(
   isSSG: boolean,
 ): void {
   renderRouteHandler(lines, { method: 'post', route, renderers, docConfig, isSSG });
+  // ADR-0121 (#572): only GET/POST are defined for page routes — other
+  // methods get a defined 405 instead of the server fallback 404. The
+  // method-specific handlers above are registered first and win for
+  // GET/POST/HEAD.
+  lines.push(
+    `app.all(${
+      jsStringLiteral(route.path)
+    }, (c) => c.text('Method Not Allowed', 405, { Allow: 'GET, POST' }));`,
+  );
+  lines.push('');
 }
 
 /** Generate the route-to-module map for /_data endpoint. */
@@ -409,7 +478,9 @@ export function renderDataEndpoint(lines: string[]): void {
   lines.push(`    const data = await mod.loader(loadContext);`);
   lines.push(`    return c.json({ data });`);
   lines.push(`  } catch (err) {`);
-  lines.push(`    return c.json({ error: String(err) }, 500);`);
+  lines.push(
+    `    return c.json({ error: import.meta.env.PROD ? 'Internal Server Error' : String(err) }, 500);`,
+  );
   lines.push(`  }`);
   lines.push(`})`);
   lines.push('');
diff --git a/packages/adapter-vite/src/internal/ssg/entry-render-ssg.ts b/packages/adapter-vite/src/internal/ssg/entry-render-ssg.ts
index f1edaf2fa..6f59d1c8b 100644
--- a/packages/adapter-vite/src/internal/ssg/entry-render-ssg.ts
+++ b/packages/adapter-vite/src/internal/ssg/entry-render-ssg.ts
@@ -69,7 +69,7 @@ export function renderSsgSection(desc: EntryDescriptor): string {
         (r.paramNames || []).map(jsStringLiteral).join(', ')
       }], revalidate: ${
         routeRevalidateExpr(r.varName)
-      }, rendering: (__pageDefinition(${r.varName}).renderIntent?.mode || "auto"), hasAction: (typeof ${r.varName}.action === "function") },`,
+      }, rendering: (__pageDefinition(${r.varName}).renderIntent?.mode || "auto"), hasAction: (typeof ${r.varName}.action === "function" || (typeof ${r.varName}.actions === "object" && ${r.varName}.actions !== null)) },`,
     );
   }
   lines.push('];');
diff --git a/packages/adapter-vite/src/internal/ssg/index.ts b/packages/adapter-vite/src/internal/ssg/index.ts
index a57abdd80..d8737e7ce 100644
--- a/packages/adapter-vite/src/internal/ssg/index.ts
+++ b/packages/adapter-vite/src/internal/ssg/index.ts
@@ -77,7 +77,7 @@ export {
 export { cleanSsrArtifacts, postProcessClientIslandBuild } from './build-postprocess.ts';
 export type { BuildContextView } from './build-postprocess.ts';
 
-export { generateSsrPolyfillBanner } from './ssr-polyfills.ts';
+export { generateCustomElementsPolyfill, generateSsrPolyfillBanner } from './ssr-polyfills.ts';
 
 export {
   detectAndClassifyCemPackages,
diff --git a/packages/adapter-vite/src/internal/ssg/route-scanner.ts b/packages/adapter-vite/src/internal/ssg/route-scanner.ts
index 7047d2ace..5af3cd544 100644
--- a/packages/adapter-vite/src/internal/ssg/route-scanner.ts
+++ b/packages/adapter-vite/src/internal/ssg/route-scanner.ts
@@ -90,6 +90,10 @@ export function parseRouteFilePath(
 
   if (options.paramSyntax === ':') {
     // v0.25: AST-verified — path utility, converts [param] to :param
+    // 0.42.0-alpha.5 (#556): a catch-all segment [...path] becomes the Hono
+    // named regex parameter :path{.+} (matches across '/'), not the literal
+    // single-segment ':...path' the naive replacement produced.
+    p = p.replace(/\[\.\.\.([^\]]+)\]/g, ':$1{.+}');
     p = p.replace(/\[([^\]]+)\]/g, ':$1');
   }
 
@@ -209,8 +213,12 @@ export async function scanRoutes(
         const routePath = parseRouteFilePath(relativePath, { paramSyntax: ':' });
         const routeType = getRouteType(relativePath);
         // v0.25: AST-verified — path utility, extracts [param] patterns
+        // 0.42.0-alpha.5 (#556): a catch-all [...path] contributes the bare
+        // param name 'path' (no '...' prefix) to match the ':path{.+}' pattern.
         const paramMatches = relativePath.match(/\[([^\]]+)\]/g);
-        const params = paramMatches ? paramMatches.map((m) => m.slice(1, -1)) : undefined;
+        const params = paramMatches
+          ? paramMatches.map((m) => m.slice(1, -1).replace(/^\.\.\./, ''))
+          : undefined;
         let tagName: string | undefined;
         let source: string | undefined;
         if (routeType === 'page') {
@@ -232,6 +240,13 @@ export async function scanRoutes(
           type: routeType,
           varName: pathToVarName(routePath),
           tagName,
+          // #569: page sources carrying data-open-enhance require the client
+          // enhancement layer even when the app has zero islands. The match
+          // requires attribute shape (= or >) so prose mentioning the
+          // attribute (e.g. guide pages) does not pull the layer in.
+          ...(source !== undefined && /data-open-enhance\s*(?:=|>)/.test(source)
+            ? { hasEnhancedForms: true }
+            : {}),
           ...(options.includeSource && source !== undefined ? { source } : {}),
           params,
         });
diff --git a/packages/adapter-vite/src/internal/ssg/ssg-helpers.ts b/packages/adapter-vite/src/internal/ssg/ssg-helpers.ts
index 710cac464..ce78b3f6a 100644
--- a/packages/adapter-vite/src/internal/ssg/ssg-helpers.ts
+++ b/packages/adapter-vite/src/internal/ssg/ssg-helpers.ts
@@ -107,6 +107,60 @@ export function buildIsrManifestEntries(
 
 // ─── Request-time server entry module (0.42.0-alpha.1, ADR-0120) ──────────
 
+/** One request-time route as recorded in server-manifest.json. */
+export interface RequestTimeRoutePattern {
+  path: string;
+  paramNames: string[];
+}
+
+function escapeRegExpLiteral(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Convert a route path pattern ('/item/:id', '/docs/:path{.+}') into a RegExp
+ * source string that captures params in `paramNames` order. Used to generate
+ * the self-contained matcher inside dist/server/index.js (#556): hosts get a
+ * dispatch function instead of re-implementing pattern matching against the
+ * raw ':param' strings in server-manifest.json.
+ */
+export function routePatternToRegExpSource(path: string): string {
+  let source = '';
+  for (const segment of path.split('/')) {
+    if (segment === '') continue;
+    source += '/';
+    if (segment.startsWith(':')) {
+      const brace = segment.indexOf('{');
+      if (brace !== -1 && segment.endsWith('}')) {
+        // Named regex parameter (:path{.+} from a [...path] catch-all).
+        source += `(${segment.slice(brace + 1, -1)})`;
+      } else {
+        source += '([^/]+)';
+      }
+    } else {
+      source += escapeRegExpLiteral(segment);
+    }
+  }
+  return `^${source}$`;
+}
+
+/** Serialize the request-time route table embedded in the generated server entry. */
+export function renderRequestTimeRouteTable(routes: RequestTimeRoutePattern[]): string {
+  // Exact paths first, then parameterized, then catch-alls: the first match
+  // wins, so the most specific pattern must be consulted first.
+  const rank = (path: string): number => path.includes('{.+}') ? 2 : path.includes(':') ? 1 : 0;
+  const sorted = [...routes].sort((a, b) => rank(a.path) - rank(b.path));
+  return sorted
+    .map((route) => {
+      const params = route.paramNames.map((name) => JSON.stringify(name)).join(', ');
+      // '/' must be escaped or it would terminate the regex literal.
+      const pattern = routePatternToRegExpSource(route.path).replace(/\//g, '\\/');
+      return `  { path: ${JSON.stringify(route.path)}, paramNames: [${params}], ` +
+        `pattern: /${pattern}/ },`;
+    })
+    .join('\n');
+}
+
 /**
  * Source of the generated `dist/server/index.js`. Emitted only when at
  * least one route declares `renderIntent: { mode: 'dynamic' }`, so
@@ -115,8 +169,13 @@ export function buildIsrManifestEntries(
  * public `nitro-mount` seam; Nitro Node/Workers builds bundle it as the
  * server entry, and plain Node can run it directly with adapter-vite
  * installed.
+ *
+ * The named `matchRequestTimeRoute` export (#556) is a self-contained
+ * pathname matcher generated from the route table, so hosts dispatch
+ * '/item/1' to the '/item/:id' request-time route without reading
+ * server-manifest.json or re-implementing pattern matching.
  */
-export function renderRequestTimeServerModule(): string {
+export function renderRequestTimeServerModule(routes: RequestTimeRoutePattern[] = []): string {
   return `// Generated by openElement build — request-time server entry (0.42.0-alpha.1).
 // Serves renderIntent: { mode: 'dynamic' } routes at request time through the
 // same SSR bundle used for prerendering. Do not edit; regenerated per build.
@@ -129,6 +188,26 @@ const openElementHandler = createOpenElementNitroHandler({
     app.fetch(request, context?.env || {}, context?.platform),
 });
 
+// Request-time route table (#556): pathname -> { path, params }. Exact paths
+// first, then parameterized, then catch-alls; the first match wins.
+const requestTimeRoutes = [
+${renderRequestTimeRouteTable(routes)}
+];
+
+export function matchRequestTimeRoute(pathname) {
+  for (let i = 0; i < requestTimeRoutes.length; i++) {
+    const route = requestTimeRoutes[i];
+    const match = route.pattern.exec(pathname);
+    if (!match) continue;
+    const params = {};
+    for (let p = 0; p < route.paramNames.length; p++) {
+      params[route.paramNames[p]] = decodeURIComponent(match[p + 1]);
+    }
+    return { path: route.path, params };
+  }
+  return null;
+}
+
 // Island hydration parity with static pages: the static pipeline injects the
 // island client entry into prerendered HTML as a post-build step, which
 // request-time rendering bypasses. Inject the same script at serve time.
diff --git a/packages/adapter-vite/src/internal/ssg/ssg-render.ts b/packages/adapter-vite/src/internal/ssg/ssg-render.ts
index ba6ff4186..a0ccb4e3a 100644
--- a/packages/adapter-vite/src/internal/ssg/ssg-render.ts
+++ b/packages/adapter-vite/src/internal/ssg/ssg-render.ts
@@ -193,7 +193,13 @@ export async function ssgRender(
       formatJson(serverManifest),
       'utf-8',
     );
-    writeFileSync(join(serverDir, 'index.js'), renderRequestTimeServerModule(), 'utf-8');
+    writeFileSync(
+      join(serverDir, 'index.js'),
+      renderRequestTimeServerModule(
+        requestTimeRoutes.map((r) => ({ path: r.path, paramNames: r.paramNames ?? [] })),
+      ),
+      'utf-8',
+    );
     // Placeholder: Phase 2 overwrites this with the real island client entry
     // URL when the project has islands (build.ts writeRequestTimeClientScript).
     writeFileSync(
diff --git a/packages/adapter-vite/src/internal/ssg/ssr-polyfills.ts b/packages/adapter-vite/src/internal/ssg/ssr-polyfills.ts
index d3b25abe9..09bda0fd7 100644
--- a/packages/adapter-vite/src/internal/ssg/ssr-polyfills.ts
+++ b/packages/adapter-vite/src/internal/ssg/ssr-polyfills.ts
@@ -26,3 +26,25 @@ if (typeof globalThis.CSSStyleSheet === 'undefined') {
 }
 `;
 }
+
+/**
+ * customElements registry stub (ADR-0044). Must run before any route module
+ * evaluates: route modules call customElements.define() at module top level.
+ * At build time this ships as the Rollup output banner (build-ssg.ts); in
+ * dev the virtual SSR entry imports it as its first module (plugin.ts), which
+ * ESM evaluates before all other imports. Uses Map-backed define()/get();
+ * renderDsdByName() looks up components via customElements.get(tagName).
+ */
+export function generateCustomElementsPolyfill(): string {
+  return `\
+if (typeof globalThis.customElements === 'undefined') {
+  const __openCeRegistry = new Map();
+  globalThis.customElements = {
+    define(name, ctor, _opts) { __openCeRegistry.set(name, ctor); },
+    get(name) { return __openCeRegistry.get(name); },
+    whenDefined(name) { return Promise.resolve(__openCeRegistry.get(name)); },
+    upgrade(_root) {},
+  };
+}
+`;
+}
diff --git a/packages/adapter-vite/src/plugin.ts b/packages/adapter-vite/src/plugin.ts
index 99554ba4c..d99f5a4cf 100644
--- a/packages/adapter-vite/src/plugin.ts
+++ b/packages/adapter-vite/src/plugin.ts
@@ -25,7 +25,11 @@ import { findWorkspaceRoot, generateWorkspaceAliases } from './workspace-alias.t
 import { normalizeViteAliases } from './alias-utils.ts';
 import { buildPlugin } from './build.ts';
 import type { EntryDescriptor } from './internal/ssg/index.ts';
-import { buildEntryDescriptor, renderEntry } from './internal/ssg/index.ts';
+import {
+  buildEntryDescriptor,
+  generateCustomElementsPolyfill,
+  renderEntry,
+} from './internal/ssg/index.ts';
 import { buildHeadExtras } from './head-injection.ts';
 import { islandTransformPlugin } from './island-transform.ts';
 import { createGeneratedDataResolverPlugin } from './generated-data-resolver.ts';
@@ -142,6 +146,12 @@ export function createOpenPlugin(
   const RESOLVED_ENTRY_ID = '\0' + VIRTUAL_ENTRY_ID;
   const VIRTUAL_BUILD_TRIGGER_ID = 'virtual:open-build-trigger';
   const RESOLVED_BUILD_TRIGGER_ID = '\0' + VIRTUAL_BUILD_TRIGGER_ID;
+  // Dev SSR polyfill (ADR-0044): route modules call customElements.define()
+  // at module top level, so the dev SSR entry imports the polyfill as its
+  // first module — ESM evaluates it before every other import. The build
+  // path ships the same stub as the Rollup banner (build-ssg.ts).
+  const VIRTUAL_POLYFILL_ID = 'virtual:open-ssr-polyfill';
+  const RESOLVED_POLYFILL_ID = '\0' + VIRTUAL_POLYFILL_ID;
 
   function buildDescriptor(
     routes: RouteEntry[],
@@ -349,9 +359,13 @@ export function createOpenPlugin(
     resolveId(id) {
       if (id === VIRTUAL_ENTRY_ID) return RESOLVED_ENTRY_ID;
       if (id === VIRTUAL_BUILD_TRIGGER_ID) return RESOLVED_BUILD_TRIGGER_ID;
+      if (id === VIRTUAL_POLYFILL_ID) return RESOLVED_POLYFILL_ID;
     },
 
     load(id) {
+      if (id === RESOLVED_POLYFILL_ID) {
+        return generateCustomElementsPolyfill();
+      }
       if (id === RESOLVED_BUILD_TRIGGER_ID) {
         return 'export default null;';
       }
@@ -360,13 +374,13 @@ export function createOpenPlugin(
         // and ctx.phase1.ssrAdmissionPlan must come from one instantiation.
         // The descriptor does not depend on late-settled plugin data, so
         // regeneration is only a fallback for the pre-buildStart placeholder.
-        if (entryDescriptor) return renderEntry(entryDescriptor);
-        return generateEntry(
+        const entryCode = entryDescriptor ? renderEntry(entryDescriptor) : generateEntry(
           ctx.phase1.cachedRoutes || [],
           ctx.phase1.islandTagNames,
           ctx.phase1.packageManifests,
           ctx.phase1.islandFiles,
         );
+        return `import '${VIRTUAL_POLYFILL_ID}';\n` + entryCode;
       }
     },
   };
diff --git a/packages/app/deno.json b/packages/app/deno.json
index c50777723..8323baa31 100644
--- a/packages/app/deno.json
+++ b/packages/app/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/app",
-  "version": "0.42.0-alpha.4",
+  "version": "0.42.0-alpha.5",
   "exports": {
     ".": "./src/index.ts",
     "./hono": "./src/hono.ts",
diff --git a/packages/app/src/authoring.ts b/packages/app/src/authoring.ts
index da6c6076d..72d579bc8 100644
--- a/packages/app/src/authoring.ts
+++ b/packages/app/src/authoring.ts
@@ -47,11 +47,21 @@ export interface PageRouteContext {
   filePath?: string;
 }
 
+const REDIRECT_STATUSES: ReadonlySet<number> = new Set([301, 302, 303, 307, 308]);
+
 export class OpenElementRedirect extends Error {
   readonly location: string;
   readonly status: number;
 
   constructor(location: string | URL, status = 302) {
+    // ADR-0121 §3: only real redirect statuses — a non-3xx "redirect" is a
+    // response the browser never follows, silently stranding the mutation.
+    if (!REDIRECT_STATUSES.has(status)) {
+      throw new Error(
+        `${ERROR_PREFIX} redirect() status must be one of 301/302/303/307/308 (got ${status}). ` +
+          'In the POST action context every 3xx is coerced to 303 (PRG).',
+      );
+    }
     super(`Redirect to ${String(location)}`);
     this.name = 'OpenElementRedirect';
     this.location = String(location);
@@ -266,11 +276,20 @@ export function definePage<
 ): PageConstructor<Data, Params> {
   assertCanonicalPageDefinition(input);
   const definition = input;
+  // ADR-0121 (#572): validate the mode at definition time — a typo like
+  // 'dynmaic' must not silently prerender a request-time page.
+  const renderMode = definition.renderIntent?.mode ?? 'auto';
+  if (renderMode !== 'auto' && renderMode !== 'static' && renderMode !== 'dynamic') {
+    throw new Error(
+      `${ERROR_PREFIX} renderIntent.mode must be 'auto', 'static' or 'dynamic' ` +
+        `(got "${String(definition.renderIntent?.mode)}").`,
+    );
+  }
   const pageDescriptor = {
     kind: 'page',
     ...definition,
     renderIntent: {
-      mode: definition.renderIntent?.mode ?? 'auto',
+      mode: renderMode,
       revalidate: definition.renderIntent?.revalidate ?? false,
     },
   } as OpenElementPageDescriptor<Data, Params>;
diff --git a/packages/app/src/index.ts b/packages/app/src/index.ts
index 11de27c09..15603ef00 100644
--- a/packages/app/src/index.ts
+++ b/packages/app/src/index.ts
@@ -38,6 +38,10 @@ export type {
   ActionResult,
   Loader,
   LoaderContext,
+  SpaAction,
+  SpaActionContext,
+  SpaLoader,
+  SpaLoaderContext,
 } from '@openelement/element';
 export { ACTION_FETCH_HEADER } from '@openelement/element';
 
diff --git a/packages/app/src/internal/router/client-router.ts b/packages/app/src/internal/router/client-router.ts
index a13d534b7..c02f54440 100644
--- a/packages/app/src/internal/router/client-router.ts
+++ b/packages/app/src/internal/router/client-router.ts
@@ -4,6 +4,12 @@
  * Supports history (pushState), hash, and auto-detection modes.
  * Route patterns use `:param` for named params and `:param?` for optional params.
  */
+// SPA loader/action contexts are deliberately narrower than the request-time
+// LoaderContext/ActionContext: the client-side chain supplies only params
+// (+ formData for actions) and signals failure by throwing (#570, ADR-0119
+// frozen semantics — types clarified, runtime unchanged).
+import type { SpaActionContext, SpaLoaderContext } from '@openelement/element';
+
 export type RouterMode = 'history' | 'hash' | 'auto';
 
 export interface RouteConfig {
@@ -11,10 +17,10 @@ export interface RouteConfig {
   /** Custom element tag to instantiate directly in SPA mode. */
   tagName: string;
   /** Client-side loader — runs before component render. Receives matched route params. */
-  loader?: (ctx: { params: Record<string, string> }) => Promise<unknown>;
+  loader?: (ctx: SpaLoaderContext) => Promise<unknown>;
   /** Client-side action — runs on form submit. Receives matched route params and form data. */
   action?: (
-    ctx: { params: Record<string, string>; formData?: FormData },
+    ctx: SpaActionContext,
   ) => Promise<unknown>;
   guard?: () => Promise<boolean | string>;
 }
diff --git a/packages/create/__tests__/cli.test.ts b/packages/create/__tests__/cli.test.ts
index 7dca33a7d..91d6035fe 100644
--- a/packages/create/__tests__/cli.test.ts
+++ b/packages/create/__tests__/cli.test.ts
@@ -113,6 +113,7 @@ Deno.test('starter templates use the supported Element JSX entrypoint', () => {
     const path of [
       'app/routes/index.tsx',
       'app/routes/freshness.tsx',
+      'app/routes/contact.tsx',
       'app/components/app-shell.tsx',
       'app/islands/my-counter.tsx',
     ]
diff --git a/packages/create/deno.json b/packages/create/deno.json
index d8d8bbcc4..750e84744 100644
--- a/packages/create/deno.json
+++ b/packages/create/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/create",
-  "version": "0.42.0-alpha.4",
+  "version": "0.42.0-alpha.5",
   "exports": "./src/cli.ts",
   "imports": {},
   "tasks": {
diff --git a/packages/create/src/template-builder.ts b/packages/create/src/template-builder.ts
index 82e59f882..34d33e666 100644
--- a/packages/create/src/template-builder.ts
+++ b/packages/create/src/template-builder.ts
@@ -47,6 +47,7 @@ export const TEMPLATE_FILES: readonly (readonly [string, string])[] = [
   ['app/components/app-shell.tsx', 'app/components/app-shell.tsx'],
   ['app/routes/index.tsx', 'app/routes/index.tsx'],
   ['app/routes/freshness.tsx', 'app/routes/freshness.tsx'],
+  ['app/routes/contact.tsx', 'app/routes/contact.tsx'],
   ['app/routes/api/health.ts', 'app/routes/api/health.ts'],
   ['app/islands/my-counter.tsx', 'app/islands/my-counter.tsx'],
 ];
diff --git a/packages/create/src/version.ts b/packages/create/src/version.ts
index 6c78da291..d90d756ec 100644
--- a/packages/create/src/version.ts
+++ b/packages/create/src/version.ts
@@ -1,2 +1,2 @@
 /** The published CLI version, embedded so packed npm installs are self-contained. */
-export const CREATE_VERSION = '0.42.0-alpha.4';
+export const CREATE_VERSION = '0.42.0-alpha.5';
diff --git a/packages/create/templates/app/routes/contact.tsx b/packages/create/templates/app/routes/contact.tsx
index cb317f2a1..cdf741995 100644
--- a/packages/create/templates/app/routes/contact.tsx
+++ b/packages/create/templates/app/routes/contact.tsx
@@ -53,5 +53,7 @@ const ContactPage = definePage({
   },
 });
 
-customElements.define(tagName, ContactPage);
+// The generated server registers route default exports itself
+// (entry-renderer.ts) — route modules never call customElements.define,
+// which also keeps the packed-consumer typecheck clean.
 export default ContactPage;
diff --git a/packages/create/templates/deno.json.tmpl b/packages/create/templates/deno.json.tmpl
index b81464bea..77391add5 100644
--- a/packages/create/templates/deno.json.tmpl
+++ b/packages/create/templates/deno.json.tmpl
@@ -13,7 +13,7 @@
   "minimumDependencyAge": 0,
   "tasks": {
     "dev": "deno run --config deno.json -A npm:vite",
-    "check": "deno check --config deno.json app/routes/index.tsx app/routes/freshness.tsx app/islands/my-counter.tsx",
+    "check": "deno check --config deno.json app/routes/index.tsx app/routes/freshness.tsx app/routes/contact.tsx app/islands/my-counter.tsx",
     "test": "deno test --config deno.json --permit-no-files",
     "build": "deno run --config deno.json -A npm:@openelement/adapter-vite@${v.adapterVite}/cli/build",
     "preview": "deno run --config deno.json -A npm:vite preview"
diff --git a/packages/element/deno.json b/packages/element/deno.json
index 46f891a1a..28c55c07f 100644
--- a/packages/element/deno.json
+++ b/packages/element/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/element",
-  "version": "0.42.0-alpha.4",
+  "version": "0.42.0-alpha.5",
   "exports": {
     ".": "./src/index.ts",
     "./jsx-runtime": "./src/jsx-runtime.ts",
diff --git a/packages/element/src/index.ts b/packages/element/src/index.ts
index 54ffa4bcb..01231b65d 100644
--- a/packages/element/src/index.ts
+++ b/packages/element/src/index.ts
@@ -89,6 +89,10 @@ export type {
   ActionResult,
   Loader,
   LoaderContext,
+  SpaAction,
+  SpaActionContext,
+  SpaLoader,
+  SpaLoaderContext,
 } from './internal/protocol/data.ts';
 export { ACTION_FETCH_HEADER } from './internal/protocol/data.ts';
 export type {
diff --git a/packages/element/src/internal/core/index.ts b/packages/element/src/internal/core/index.ts
index 1931504d8..c43c79e86 100644
--- a/packages/element/src/internal/core/index.ts
+++ b/packages/element/src/internal/core/index.ts
@@ -173,6 +173,10 @@ export type {
   DataAdapter,
   Loader,
   LoaderContext,
+  SpaAction,
+  SpaActionContext,
+  SpaLoader,
+  SpaLoaderContext,
 } from '../protocol/data.ts';
 
 // WC Package Protocol (v0.17+)
diff --git a/packages/element/src/internal/protocol/data.ts b/packages/element/src/internal/protocol/data.ts
index 38242e75c..ff30bad11 100644
--- a/packages/element/src/internal/protocol/data.ts
+++ b/packages/element/src/internal/protocol/data.ts
@@ -18,7 +18,15 @@ export interface DataAdapter<T = unknown> {
 
 // ─── Route data layer types (v0.40.0) ──────────────────────────────
 
-/** Context passed to a route loader function. */
+/**
+ * Context passed to a request-time ('dynamic') route loader. This is the
+ * server contract: the loader runs on the server with the Web-standard
+ * request, matched route params, the host environment and the platform
+ * object, and signals validation failure via fail()/redirect() (ADR-0120).
+ *
+ * SPA-mode loaders are a different chain — see SpaLoaderContext. The names
+ * are intentionally parallel; the contexts are not interchangeable (#570).
+ */
 export interface LoaderContext {
   request: Request;
   params: Record<string, string>;
@@ -37,6 +45,31 @@ export type Loader<T = unknown> = (ctx: LoaderContext) => T | Promise<T>;
 /** Route action: handles form submissions for a page route. */
 export type Action<T = unknown> = (ctx: ActionContext) => T | Promise<T>;
 
+// ─── SPA route data types (ADR-0119 frozen semantics) ──────────────
+
+/**
+ * Context passed to an SPA-mode route loader (#570). The SPA chain runs
+ * client-side and supplies only the matched route params — no request, env
+ * or platform — and signals failure by throwing (a throw is normalized to
+ * action data by the SPA submit handler). These semantics are frozen under
+ * ADR-0119; this type names the existing narrowing without changing any
+ * runtime behavior.
+ */
+export interface SpaLoaderContext {
+  params: Record<string, string>;
+}
+
+/** Context passed to an SPA-mode route action (client-side). */
+export interface SpaActionContext extends SpaLoaderContext {
+  formData?: FormData;
+}
+
+/** SPA route loader: client-side data fetch receiving route params only. */
+export type SpaLoader<T = unknown> = (ctx: SpaLoaderContext) => T | Promise<T>;
+
+/** SPA route action: client-side submit handler; signal failure by throwing. */
+export type SpaAction<T = unknown> = (ctx: SpaActionContext) => T | Promise<T>;
+
 /**
  * Wire shape returned to the JavaScript form-enhancement path (0.42.0-alpha.2,
  * ADR-0120). The no-JS path never sees this: it gets the equivalent semantics
@@ -49,5 +82,10 @@ export type ActionResult<Success = unknown, Failure = unknown> =
   | { type: 'redirect'; status: number; location: string }
   | { type: 'error'; status: number; error: { message: string } };
 
-/** Request header marking a fetch from the JS form-enhancement layer. */
+/**
+ * Request header selecting the action response channel (ADR-0121, amends
+ * ADR-0120): `true` marks a programmatic caller and selects the serialized
+ * ActionResult union; `enhance` marks the built-in morph enhancement and
+ * selects the same full-HTML responses the no-JS path receives.
+ */
 export const ACTION_FETCH_HEADER = 'x-openelement-action';
diff --git a/packages/element/src/internal/protocol/framework.ts b/packages/element/src/internal/protocol/framework.ts
index 47049996b..bff532ce8 100644
--- a/packages/element/src/internal/protocol/framework.ts
+++ b/packages/element/src/internal/protocol/framework.ts
@@ -106,6 +106,12 @@ export interface RouteEntry {
   tagName?: string;
   /** Source text captured during scanning when includeSource is enabled. */
   source?: string;
+  /**
+   * True when the page route source carries data-open-enhance (0.42.0-alpha.5,
+   * #569): the client entry must ship the form-enhancement layer even when the
+   * app has zero islands.
+   */
+  hasEnhancedForms?: boolean;
   special?: SpecialFileType;
   revalidate?: number;
   params?: string[];
diff --git a/packages/ui/deno.json b/packages/ui/deno.json
index c5adace3e..7cd278ada 100644
--- a/packages/ui/deno.json
+++ b/packages/ui/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/ui",
-  "version": "0.42.0-alpha.4",
+  "version": "0.42.0-alpha.5",
   "exports": {
     ".": "./src/index.ts",
     "./open-button": "./src/open-button.tsx",
diff --git a/packages/ui/src/generated-manifest.json b/packages/ui/src/generated-manifest.json
index 9bd3d9af6..71dd4b263 100644
--- a/packages/ui/src/generated-manifest.json
+++ b/packages/ui/src/generated-manifest.json
@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "packageName": "@openelement/ui",
-  "version": "0.42.0-alpha.4",
+  "version": "0.42.0-alpha.5",
   "description": "Open Props Web Component library for openElement",
   "author": "openElement",
   "license": "MIT",
diff --git a/tools/autoflow/policy.ts b/tools/autoflow/policy.ts
index 9cb3860a9..30bf59080 100644
--- a/tools/autoflow/policy.ts
+++ b/tools/autoflow/policy.ts
@@ -233,6 +233,28 @@ export const GATES: readonly GateDefinition[] = [
     tiers: ['ci', 'release'],
     triggers: [/^packages\//, /^www\//, /^deno\.json$/],
   },
+  {
+    // Request-time fixture suite (#543): build the fixture, then run its
+    // live.spec.ts on Chromium, Firefox and WebKit. The job must have all
+    // three browsers installed (see .github/workflows/autoflow-ci.yml and
+    // autoflow-release.yml).
+    name: 'fixture:request-time:gate',
+    command: ['deno', 'task', 'fixture:request-time:gate'],
+    tiers: ['ci', 'release'],
+    triggers: [/^packages\/adapter-vite\/(src|__fixtures__)\//, /^deno\.json$/],
+  },
+  {
+    // Static-output determinism (#560): the release-tier form of the
+    // byte-identical freeze proof. Builds www twice and requires
+    // byte-identical output (builtAt-normalized). The full baseline
+    // comparison (`deno task check:static-output-freeze --baseline <ref>`)
+    // stays a release-evidence tool: content drift between versions makes a
+    // fixed-ref byte comparison meaningless as a gate.
+    name: 'check:static-output-freeze',
+    command: ['deno', 'task', 'check:static-output-freeze', '--self-check'],
+    tiers: ['release'],
+    triggers: [/^packages\//, /^www\//, /^deno\.json$/],
+  },
   {
     name: 'nitro:proof:node',
     command: ['deno', 'task', 'nitro:proof:node'],
diff --git a/tools/check-static-output-freeze.ts b/tools/check-static-output-freeze.ts
new file mode 100644
index 000000000..0d2f16af0
--- /dev/null
+++ b/tools/check-static-output-freeze.ts
@@ -0,0 +1,266 @@
+/**
+ * Static-output freeze proof (0.42.0-alpha.5 TP-5.5, issue #560).
+ *
+ * VERSION_PLAN.md requires the TP-2 byte-identical static-output regression
+ * proof to be repeated at every alpha and at 0.42.0; the alpha.1 proof was a
+ * one-time manual worktree comparison. This tool makes it repeatable:
+ *
+ *   1. determinism self-check: build the CURRENT working tree twice and
+ *      compare the two output trees byte-for-byte. If the current build is
+ *      not self-deterministic (embedded timestamps, unstable hashes), the
+ *      freeze proof against a baseline is meaningless, so the tool reports
+ *      the differing files and exits non-zero.
+ *   2. baseline comparison: create a temp git worktree of the baseline ref
+ *      (default v0.41.2), build the same site there, and compare the two
+ *      output trees file-by-file (byte comparison).
+ *
+ * Site: `www` is the designated vehicle (VERSION_PLAN TP-4 amendment: "www
+ * deploys to Cloudflare Pages as a pure-static site and doubles as the
+ * byte-identical regression vehicle"). `--site` accepts only `www` today —
+ * there is no smaller pure-static fixture under packages/adapter-vite/
+ * __fixtures__/ (request-time and nitro-proof both carry request-time
+ * routes). If one is added later, extend SITES below.
+ *
+ * The baseline worktree is prepared by symlinking the current tree's
+ * `node_modules/` and `vendor/` into it (both are gitignored); the build at
+ * the baseline ref then runs offline. If the baseline build still fails
+ * (toolchain drift, missing deps), the failure is reported with the command
+ * to reproduce it and the tool exits non-zero — use `--self-check` as the
+ * gate form until the baseline builds again.
+ *
+ * CLI:
+ *   --baseline <ref>   baseline git ref (default: v0.41.2)
+ *   --site <www>       site to build (default: www; only www exists today)
+ *   --self-check       run only the current-tree determinism check
+ *
+ * Exit codes: 0 = identical, 1 = byte difference or build/environment failure.
+ *
+ * Normalization: the www build embeds a `builtAt` ISO timestamp in every
+ * `island-manifests/*.json` (packages/adapter-vite/src/internal/ssg/
+ * island-manifest.ts). That field is build metadata, not site content, so the
+ * comparison strips it; everything else — including content-hashed chunk
+ * filenames — is compared byte-for-byte. The applied normalization is logged.
+ * Any further nondeterminism fails the self-check instead of being silently
+ * masked.
+ *
+ * CI wiring note: tools/autoflow/policy.ts owns gate wiring and is edited by
+ * another stream; the wiring point is the root task `check:static-output-freeze`.
+ */
+
+import { walk } from '@std/fs/walk';
+
+type Snapshot = Map<string, Uint8Array>;
+
+/** Build-metadata normalizers applied before comparison (see header). */
+const NORMALIZERS: Array<{ match: RegExp; description: string; apply: (text: string) => string }> =
+  [
+    {
+      match: /(^|\/)island-manifests\/[^/]*\.json$/,
+      description: 'strip builtAt timestamp from island-manifests/*.json',
+      apply: (text) => {
+        const data = JSON.parse(text) as Record<string, unknown>;
+        delete data.builtAt;
+        return JSON.stringify(data);
+      },
+    },
+  ];
+
+function normalize(relPath: string, bytes: Uint8Array): Uint8Array {
+  for (const normalizer of NORMALIZERS) {
+    if (normalizer.match.test(relPath)) {
+      const text = new TextDecoder().decode(bytes);
+      return new TextEncoder().encode(normalizer.apply(text));
+    }
+  }
+  return bytes;
+}
+
+const SITES: Record<string, { dir: string; outDir: string; buildTask: string }> = {
+  www: { dir: 'www', outDir: 'www/dist', buildTask: 'build' },
+};
+
+function parseArgs(): { baseline: string; site: string; selfCheck: boolean } {
+  const args: Record<string, string> = {};
+  const flags = new Set<string>();
+  for (let i = 0; i < Deno.args.length; i++) {
+    const arg = Deno.args[i];
+    if (arg.startsWith('--')) {
+      const key = arg.slice(2);
+      const next = Deno.args[i + 1];
+      if (next !== undefined && !next.startsWith('--')) {
+        args[key] = next;
+        i++;
+      } else {
+        flags.add(key);
+      }
+    }
+  }
+  return {
+    baseline: args.baseline ?? 'v0.41.2',
+    site: args.site ?? 'www',
+    selfCheck: flags.has('self-check'),
+  };
+}
+
+async function run(cmd: string[], cwd: string): Promise<{ ok: boolean; output: string }> {
+  const command = new Deno.Command(cmd[0], {
+    args: cmd.slice(1),
+    cwd,
+    stdout: 'piped',
+    stderr: 'piped',
+  });
+  const { code, stdout, stderr } = await command.output();
+  const output = new TextDecoder().decode(stdout) + new TextDecoder().decode(stderr);
+  return { ok: code === 0, output };
+}
+
+function tail(output: string, lines = 40): string {
+  const all = output.trimEnd().split('\n');
+  return all.slice(Math.max(0, all.length - lines)).join('\n');
+}
+
+/** Build the site in `root` and snapshot its output tree (path -> bytes). */
+async function buildAndSnapshot(root: string, site: { outDir: string; buildTask: string }) {
+  const build = await run(['deno', 'task', site.buildTask], root);
+  if (!build.ok) {
+    return { error: tail(build.output) };
+  }
+  const snapshot: Snapshot = new Map();
+  const outRoot = `${root}/${site.outDir}`;
+  for await (const entry of walk(outRoot, { includeDirs: false })) {
+    const rel = entry.path.slice(outRoot.length + 1);
+    snapshot.set(rel, normalize(rel, await Deno.readFile(entry.path)));
+  }
+  if (snapshot.size === 0) {
+    return { error: `build succeeded but ${site.outDir} is empty in ${root}` };
+  }
+  return { snapshot };
+}
+
+/** Byte-compare two snapshots; returns a list of human-readable diffs. */
+function diffSnapshots(a: Snapshot, b: Snapshot, labelA: string, labelB: string): string[] {
+  const diffs: string[] = [];
+  for (const [path, bytesA] of a) {
+    const bytesB = b.get(path);
+    if (bytesB === undefined) {
+      diffs.push(`only in ${labelA}: ${path}`);
+    } else if (bytesA.length !== bytesB.length || !bytesA.every((v, i) => v === bytesB[i])) {
+      diffs.push(
+        `content differs: ${path} (${labelA}: ${bytesA.length}B, ${labelB}: ${bytesB.length}B)`,
+      );
+    }
+  }
+  for (const path of b.keys()) {
+    if (!a.has(path)) diffs.push(`only in ${labelB}: ${path}`);
+  }
+  return diffs;
+}
+
+function fail(message: string): never {
+  console.error(`static-output-freeze: FAIL — ${message}`);
+  Deno.exit(1);
+}
+
+const { baseline, site, selfCheck } = parseArgs();
+const siteConfig = SITES[site];
+if (!siteConfig) {
+  fail(
+    `unknown --site '${site}'. Only 'www' exists today: there is no pure-static fixture under ` +
+      `packages/adapter-vite/__fixtures__/ (request-time and nitro-proof carry request-time routes).`,
+  );
+}
+
+const root = Deno.cwd();
+
+// Phase 1: determinism self-check — build the current tree twice.
+for (const n of NORMALIZERS) console.log(`static-output-freeze: normalizing — ${n.description}`);
+console.log(`static-output-freeze: building current tree (${site}) — run 1/2`);
+const run1 = await buildAndSnapshot(root, siteConfig);
+if (run1.error) fail(`current-tree build (run 1) failed:\n${run1.error}`);
+console.log('static-output-freeze: building current tree — run 2/2');
+const run2 = await buildAndSnapshot(root, siteConfig);
+if (run2.error) fail(`current-tree build (run 2) failed:\n${run2.error}`);
+
+const selfDiffs = diffSnapshots(run1.snapshot!, run2.snapshot!, 'run 1', 'run 2');
+if (selfDiffs.length > 0) {
+  console.error(
+    `static-output-freeze: the current build is NOT self-deterministic — ${selfDiffs.length} file(s) differ across two runs:`,
+  );
+  for (const d of selfDiffs.slice(0, 50)) console.error(`  ${d}`);
+  fail(
+    'freeze proof against a baseline is meaningless until the build is deterministic. ' +
+      'Fix the nondeterminism (embedded timestamps, unstable ordering) or add normalization here.',
+  );
+}
+console.log(
+  `static-output-freeze: determinism OK (${run1.snapshot!.size} files byte-identical across runs)`,
+);
+
+if (selfCheck) {
+  console.log('static-output-freeze: PASS (self-check only)');
+  Deno.exit(0);
+}
+
+// Phase 2: baseline worktree build + comparison.
+const tmp = await Deno.makeTempDir({ prefix: 'static-output-freeze-' });
+const worktreeDir = `${tmp}/baseline`;
+try {
+  const add = await run(['git', 'worktree', 'add', '--detach', worktreeDir, baseline], root);
+  if (!add.ok) {
+    fail(
+      `could not create worktree of '${baseline}':\n${tail(add.output)}\n` +
+        `Reproduce: git worktree add --detach <dir> ${baseline}`,
+    );
+  }
+
+  // node_modules/ is gitignored: symlink it from the current tree so the
+  // baseline build resolves npm dependencies offline. vendor/ is partially
+  // tracked (license attribution), so it already exists in the worktree —
+  // merge-copy the current tree's vendored sources over it instead.
+  try {
+    await Deno.symlink(`${root}/node_modules`, `${worktreeDir}/node_modules`);
+  } catch (err) {
+    fail(
+      `could not symlink node_modules into the baseline worktree: ${err}\n` +
+        `Manual fallback: cd <worktree of ${baseline}> && deno install (needs network).`,
+    );
+  }
+  const vendorCopy = await run(['cp', '-R', `${root}/vendor/`, `${worktreeDir}/vendor/`], root);
+  if (!vendorCopy.ok) {
+    fail(`could not copy vendor/ into the baseline worktree:\n${tail(vendorCopy.output)}`);
+  }
+
+  console.log(`static-output-freeze: building baseline ${baseline} in ${worktreeDir}`);
+  const base = await buildAndSnapshot(worktreeDir, siteConfig);
+  if (base.error) {
+    fail(
+      `baseline build failed at '${baseline}' (environmental — old toolchain or missing deps):\n${base.error}\n` +
+        `Reproduce: cd <worktree of ${baseline}> && deno task build. ` +
+        `Until this is fixed, gate on: deno task check:static-output-freeze -- --self-check`,
+    );
+  }
+
+  const diffs = diffSnapshots(base.snapshot!, run2.snapshot!, baseline, 'current');
+  if (diffs.length > 0) {
+    console.error(
+      `static-output-freeze: ${diffs.length} file(s) differ between ${baseline} and the current tree:`,
+    );
+    for (const d of diffs.slice(0, 50)) console.error(`  ${d}`);
+    if (diffs.length > 50) console.error(`  ... and ${diffs.length - 50} more`);
+    fail(`static output is not byte-identical to ${baseline}`);
+  }
+  console.log(
+    `static-output-freeze: PASS — ${
+      base.snapshot!.size
+    } files byte-identical between ${baseline} and current tree`,
+  );
+} finally {
+  // Best-effort cleanup; report but do not mask the result.
+  const remove = await run(['git', 'worktree', 'remove', '--force', worktreeDir], root);
+  if (!remove.ok) {
+    console.error(
+      `static-output-freeze: warning — worktree cleanup failed: ${tail(remove.output, 5)}`,
+    );
+  }
+  await Deno.remove(tmp, { recursive: true }).catch(() => {});
+}
diff --git a/tools/consumer-local.ts b/tools/consumer-local.ts
index 4d52037ac..e537bded3 100644
--- a/tools/consumer-local.ts
+++ b/tools/consumer-local.ts
@@ -227,8 +227,9 @@ const buildEvidence = JSON.parse(readFileSync(buildEvidencePath, 'utf-8')) as {
 const manifestRoutes = buildEvidence.manifest?.routes ?? [];
 const pageRoutes = manifestRoutes.filter((route) => route.kind === 'page');
 const apiRoutes = manifestRoutes.filter((route) => route.kind === 'api');
+// Pages: index, freshness (ISR intent), contact (0.42 request-time action).
 if (
-  buildEvidence.success !== true || pageRoutes.length !== 2 || apiRoutes.length !== 1 ||
+  buildEvidence.success !== true || pageRoutes.length !== 3 || apiRoutes.length !== 1 ||
   (buildEvidence.pages ?? []).some((page) => (page.errors?.length ?? 0) > 0)
 ) {
   console.error('Structured build manifest did not contain the expected page/API surface.');
@@ -360,7 +361,7 @@ writeFileSync(
   `import { createOpenElementNitroHandler } from '${
     pathToFileURL(join(repoRoot, 'packages', 'adapter-vite', 'src', 'nitro-mount.ts')).href
   }';
-import { eventHandler, getMethod, getRequestHeaders, getRequestURL } from 'h3';
+import { eventHandler, getMethod, getRequestHeaders, getRequestURL, readRawBody } from 'h3';
 import { openElementHandler } from '../../dist/server/entry.js';
 
 const handler = createOpenElementNitroHandler({
@@ -370,10 +371,13 @@ const handler = createOpenElementNitroHandler({
 
 export default eventHandler(async (event) => {
   const url = getRequestURL(event);
+  const method = getMethod(event);
   const result = await handler({
-    method: getMethod(event),
-    path: url.pathname,
+    method,
+    path: url.pathname + url.search,
     headers: getRequestHeaders(event),
+    // Form actions need the POST body forwarded (#571 starter smoke).
+    body: method === 'GET' || method === 'HEAD' ? undefined : await readRawBody(event),
     platform: {
       waitUntil() {},
       passThroughOnException() {},
@@ -531,6 +535,47 @@ try {
       nitroSmokeFailed = true;
     }
   }
+
+  // 0.42 request-time action route (#571): the starter's /contact page must
+  // render per request and answer the form protocol — empty submission is a
+  // 422 echo, a valid one a 303 PRG redirect.
+  if (!nitroSmokeFailed) {
+    const contact = await fetch(`${baseUrl}/contact`);
+    const contactHtml = await contact.text();
+    if (contact.status !== 200 || !contactHtml.includes('Stay in the loop')) {
+      console.error(
+        JSON.stringify({ status: contact.status, body: contactHtml.slice(-500) }, null, 2),
+      );
+      nitroSmokeFailed = true;
+    }
+  }
+
+  if (!nitroSmokeFailed) {
+    const invalid = await fetch(`${baseUrl}/contact`, {
+      method: 'POST',
+      body: new URLSearchParams({ email: '' }),
+    });
+    const invalidHtml = await invalid.text();
+    if (invalid.status !== 422 || !invalidHtml.includes('a valid email is required')) {
+      console.error(
+        JSON.stringify({ status: invalid.status, body: invalidHtml.slice(-500) }, null, 2),
+      );
+      nitroSmokeFailed = true;
+    }
+  }
+
+  if (!nitroSmokeFailed) {
+    const valid = await fetch(`${baseUrl}/contact`, {
+      method: 'POST',
+      body: new URLSearchParams({ email: 'ada@example.com' }),
+      redirect: 'manual',
+    });
+    const location = valid.headers.get('location');
+    if (valid.status !== 303 || location !== '/contact?subscribed=ada%40example.com') {
+      console.error(JSON.stringify({ status: valid.status, location }, null, 2));
+      nitroSmokeFailed = true;
+    }
+  }
 } finally {
   if (!serverExited) {
     try {
diff --git a/tools/perf-request-time.ts b/tools/perf-request-time.ts
index 868e94d2e..6ba15048c 100644
--- a/tools/perf-request-time.ts
+++ b/tools/perf-request-time.ts
@@ -1,18 +1,26 @@
 /**
- * Request-time render latency baseline (0.42.0-alpha.4, TP-5).
+ * Request-time render latency baseline (0.42.0-alpha.5, TP-5.5).
  *
  * Boots the request-time fixture server and measures /live latency: the
- * first request after boot (cold) and a warm series. Writes the result to
- * docs/release/v0.42.0-alpha.4-performance.json as the 0.44 stream/abort/
- * timeout baseline.
+ * first request after boot (cold, best of 3 fresh boots with all samples
+ * recorded) and a warm series. Writes the result to
+ * docs/release/v0.42.0-alpha.5-performance.json as the 0.44 stream/abort/
+ * timeout baseline, including the environment it was measured on.
  *
- * Usage: deno run -A tools/perf-request-time.ts
+ * Usage: deno run -A tools/perf-request-time.ts [--out <path>]
  */
 
 import { join } from 'node:path';
 
 const fixture = 'packages/adapter-vite/__fixtures__/request-time';
 const port = 4387;
+const COLD_SAMPLES = 3;
+const WARM_SAMPLES = 50;
+
+const outFlagIndex = Deno.args.indexOf('--out');
+const outPath = outFlagIndex >= 0 && Deno.args[outFlagIndex + 1]
+  ? Deno.args[outFlagIndex + 1]
+  : 'docs/release/v0.42.0-alpha.5-performance.json';
 
 async function build(): Promise<void> {
   const out = await new Deno.Command('deno', {
@@ -26,21 +34,21 @@ async function build(): Promise<void> {
   }
 }
 
-await build();
-
-const server = new Deno.Command('deno', {
-  args: [
-    'run',
-    '-A',
-    join(fixture, 'e2e/server.ts'),
-    '--port',
-    String(port),
-    '--dir',
-    join(fixture, 'dist'),
-  ],
-  stdout: 'piped',
-  stderr: 'piped',
-}).spawn();
+function startServer(): Deno.ChildProcess {
+  return new Deno.Command('deno', {
+    args: [
+      'run',
+      '-A',
+      join(fixture, 'e2e/server.ts'),
+      '--port',
+      String(port),
+      '--dir',
+      join(fixture, 'dist'),
+    ],
+    stdout: 'piped',
+    stderr: 'piped',
+  }).spawn();
+}
 
 async function waitForServer(): Promise<void> {
   for (let i = 0; i < 50; i++) {
@@ -53,6 +61,24 @@ async function waitForServer(): Promise<void> {
   throw new Error('fixture server did not start');
 }
 
+async function fetchLive(query: string): Promise<number> {
+  const start = performance.now();
+  const res = await fetch(`http://127.0.0.1:${port}/live?x=${query}`);
+  await res.text();
+  return performance.now() - start;
+}
+
+async function measureCold(): Promise<number> {
+  const server = startServer();
+  try {
+    await waitForServer();
+    return await fetchLive('perf-cold');
+  } finally {
+    server.kill('SIGTERM');
+    await server.status.catch(() => {});
+  }
+}
+
 function stats(samples: number[]): { p50: number; p95: number; mean: number } {
   const sorted = [...samples].sort((a, b) => a - b);
   const pick = (q: number) => sorted[Math.min(sorted.length - 1, Math.floor(q * sorted.length))];
@@ -63,28 +89,55 @@ function stats(samples: number[]): { p50: number; p95: number; mean: number } {
   };
 }
 
+async function cpuModel(): Promise<string | undefined> {
+  try {
+    const cmd = Deno.build.os === 'darwin'
+      ? new Deno.Command('sysctl', { args: ['-n', 'machdep.cpu.brand_string'] })
+      : new Deno.Command('sh', {
+        args: ['-c', "grep -m1 'model name' /proc/cpuinfo | cut -d: -f2-"],
+      });
+    const out = await cmd.output();
+    if (out.code !== 0) return undefined;
+    const text = new TextDecoder().decode(out.stdout).trim();
+    return text || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+await build();
+
+const round = (n: number) => Math.round(n * 100) / 100;
+
+// Cold: first request after a fresh server boot, 3 boots, all samples kept.
+const coldSamples: number[] = [];
+for (let i = 0; i < COLD_SAMPLES; i++) {
+  coldSamples.push(await measureCold());
+}
+
+// Warm series on one more fresh server.
+const server = startServer();
 try {
   await waitForServer();
 
-  const coldStart = performance.now();
-  const coldRes = await fetch(`http://127.0.0.1:${port}/live?x=perf`);
-  await coldRes.text();
-  const coldMs = performance.now() - coldStart;
-
   const warm: number[] = [];
-  for (let i = 0; i < 50; i++) {
-    const start = performance.now();
-    const res = await fetch(`http://127.0.0.1:${port}/live?x=perf-${i}`);
-    await res.text();
-    warm.push(performance.now() - start);
+  for (let i = 0; i < WARM_SAMPLES; i++) {
+    warm.push(await fetchLive(`perf-${i}`));
   }
 
-  const round = (n: number) => Math.round(n * 100) / 100;
   const result = {
-    version: '0.42.0-alpha.4',
+    version: '0.42.0-alpha.5',
     date: new Date().toISOString(),
     route: '/live (request-time, loader + DSD render)',
-    cold: { ms: round(coldMs) },
+    environment: {
+      os: Deno.build.os,
+      arch: Deno.build.arch,
+      cpu: await cpuModel(),
+      deno: Deno.version.deno,
+      v8: Deno.version.v8,
+    },
+    samples: { cold: COLD_SAMPLES, warm: WARM_SAMPLES },
+    cold: { ms: round(Math.min(...coldSamples)), samplesMs: coldSamples.map(round) },
     warm: {
       samples: warm.length,
       p50: round(stats(warm).p50),
@@ -92,12 +145,11 @@ try {
       mean: round(stats(warm).mean),
     },
     note:
-      'Buffered per-request DSD render via the generated dist/server entry on Deno.serve; the 0.44 stream/abort/timeout work compares against this.',
+      'Buffered per-request DSD render via the generated dist/server entry on Deno.serve; the 0.44 stream/abort/timeout work compares against this. Cold is the best of 3 fresh-boot first requests; all samples are recorded.',
   };
-  const path = 'docs/release/v0.42.0-alpha.4-performance.json';
-  await Deno.writeTextFile(path, JSON.stringify(result, null, 2) + '\n');
+  await Deno.writeTextFile(outPath, JSON.stringify(result, null, 2) + '\n');
   console.log(JSON.stringify(result, null, 2));
-  console.log(`written -> ${path}`);
+  console.log(`written -> ${outPath}`);
 } finally {
   server.kill('SIGTERM');
 }
diff --git a/tools/project-constants.ts b/tools/project-constants.ts
index 5d4a44af6..d084e54b3 100644
--- a/tools/project-constants.ts
+++ b/tools/project-constants.ts
@@ -1,6 +1,6 @@
-export const PACKAGE_VERSION = '0.42.0-alpha.4';
+export const PACKAGE_VERSION = '0.42.0-alpha.5';
 export const PACKAGE_VERSION_TAG = `v${PACKAGE_VERSION}`;
-export const ACTIVE_EXECUTION_VERSION = 'v0.42.0-alpha.4';
+export const ACTIVE_EXECUTION_VERSION = 'v0.42.0-alpha.5';
 export const RETAINED_PACKAGE_NAMES = Object.freeze([
   '@openelement/adapter-vite',
   '@openelement/app',
@@ -49,7 +49,7 @@ export const NITRO_COMPATIBILITY_DATE = '2026-06-12';
 // single source of truth for the "from" side of version-anchor replacements
 // (see buildVersionAnchorReplacements in tools/autoflow/release.ts). It is
 // kept in sync automatically by updateProjectConstants() during a bump.
-export const PREVIOUS_PACKAGE_VERSION = '0.42.0-alpha.3';
+export const PREVIOUS_PACKAGE_VERSION = '0.42.0-alpha.4';
 export const PREVIOUS_PACKAGE_VERSION_TAG = `v${PREVIOUS_PACKAGE_VERSION}`;
 
 // The theme the www roadmap current-line timeline entry carried immediately
@@ -60,7 +60,7 @@ export const PREVIOUS_PACKAGE_VERSION_TAG = `v${PREVIOUS_PACKAGE_VERSION}`;
 // sweep' describing alpha.19 under the v0.41.1 entry). The bump side
 // re-records this constant from the pre-bump entry; bootstrap value
 // documents the incident.
-export const PREVIOUS_RELEASE_THEME = 'revalidation continuity';
+export const PREVIOUS_RELEASE_THEME = 'hardening and recipes';
 
 /**
  * Version strings that must never reappear in the head anchor zone of the
diff --git a/www/app/data/_generated-nav.ts b/www/app/data/_generated-nav.ts
index 4aab31d51..8a3b7ca5a 100644
--- a/www/app/data/_generated-nav.ts
+++ b/www/app/data/_generated-nav.ts
@@ -185,6 +185,11 @@ export const navSections = [
         "label": "Islands and SSR",
         "order": 90
       },
+      {
+        "path": "/guide/security",
+        "label": "Security",
+        "order": 95
+      },
       {
         "path": "/guide/deployment",
         "label": "Deployment",
diff --git a/www/app/data/version.ts b/www/app/data/version.ts
index e2ee50a18..443a6d65d 100644
--- a/www/app/data/version.ts
+++ b/www/app/data/version.ts
@@ -1,2 +1,2 @@
 // Current published package line. Release tooling owns the next bump.
-export const OPENELEMENT_VERSION = 'v0.42.0-alpha.4';
+export const OPENELEMENT_VERSION = 'v0.42.0-alpha.5';
diff --git a/www/app/routes/guide/routing-and-data.tsx b/www/app/routes/guide/routing-and-data.tsx
index b060f58f3..738a3ca83 100644
--- a/www/app/routes/guide/routing-and-data.tsx
+++ b/www/app/routes/guide/routing-and-data.tsx
@@ -27,6 +27,7 @@ const content: Record<'en' | 'zh', GuideContent> = {
       { id: 'data-boundary', label: 'Data boundary', level: 3 },
       { id: 'rendering-modes', label: 'Rendering modes', level: 3 },
       { id: 'form-actions', label: 'Form actions', level: 3 },
+      { id: 'two-chains', label: 'Two loader/action chains', level: 3 },
     ],
     previous: { href: '/guide/comparison', label: 'Comparison' },
     next: { href: '/guide/mdx', label: 'MDX' },
@@ -58,6 +59,12 @@ const content: Record<'en' | 'zh', GuideContent> = {
         body:
           "A dynamic route may export an action ({ formData }) — plain HTML forms work without JavaScript: validation failures return fail(4xx, data) and re-render with the echo (HTTP 422), successes answer 303 (PRG). Named actions dispatch via formaction='?/name'. Forms marked data-open-enhance submit via fetch and morph the returned document into place: hydrated islands whose light DOM did not change keep their state, data-open-preserve exempts a subtree, and the URL follows the PRG target. An action must be safe to re-run after a failed validation (0.42 line, unfrozen).",
       },
+      {
+        id: 'two-chains',
+        title: 'Two loader/action chains',
+        body:
+          "Request-time ('dynamic') loaders/actions run on the server with the Web-standard context { request, params, env, platform, route } and the fail()/redirect() protocol. SPA-mode loaders/actions run client-side with only { params } (plus formData for actions) and signal failure by throwing — a throw is normalized into action data. The names are intentionally parallel, but the contexts differ: code written against one chain cannot assume the other's context (#570, ADR-0119 frozen SPA semantics).",
+      },
     ],
   },
   zh: {
@@ -70,6 +77,7 @@ const content: Record<'en' | 'zh', GuideContent> = {
       { id: 'data-boundary', label: '数据边界', level: 3 },
       { id: 'rendering-modes', label: '渲染模式', level: 3 },
       { id: 'form-actions', label: '表单 action', level: 3 },
+      { id: 'two-chains', label: '两条 loader/action 链', level: 3 },
     ],
     previous: { href: '/guide/comparison', label: '对比' },
     next: { href: '/guide/mdx', label: 'MDX' },
@@ -101,6 +109,12 @@ const content: Record<'en' | 'zh', GuideContent> = {
         body:
           "dynamic 路由可导出 action({ formData })——纯 HTML 表单无需 JavaScript 即可工作:校验失败返回 fail(4xx, data),以 422 重渲染并回显;成功则以 303 应答(PRG)。命名 action 通过 formaction='?/name' 分派。标记 data-open-enhance 的表单经 fetch 提交并把返回的文档 morph 就位:light DOM 未变化的已水合 island 状态保留,data-open-preserve 豁免子树,URL 跟随 PRG 目标。action 在校验失败后必须可安全重跑(0.42 版本线,未冻结)。",
       },
+      {
+        id: 'two-chains',
+        title: '两条 loader/action 链',
+        body:
+          "request-time('dynamic')loader/action 运行在服务端,上下文是 Web 标准的 { request, params, env, platform, route },并使用 fail()/redirect() 协议。SPA 模式的 loader/action 运行在客户端,上下文只有 { params }(action 另有 formData),通过抛出异常来表达失败——throw 会被规整为 action 数据。两者命名刻意保持一致,但上下文不同:针对其中一条链编写的代码不能假设另一条链的上下文(#570,ADR-0119 已冻结的 SPA 语义)。",
+      },
     ],
   },
 };
diff --git a/www/app/routes/guide/security.tsx b/www/app/routes/guide/security.tsx
new file mode 100644
index 000000000..c3226da17
--- /dev/null
+++ b/www/app/routes/guide/security.tsx
@@ -0,0 +1,178 @@
+export const meta = { section: 'Guide', label: 'Security', order: 95 };
+
+import { OpenElement } from '@openelement/element';
+import { StyleSheet } from '@openelement/element';
+import { pageStyles } from '../../components/page-styles.js';
+import { guideSectionStyles } from '@openelement/site-ui/guide-section-styles.ts';
+import '@openelement/ui/open-card';
+import '@openelement/ui/open-code-block';
+
+type GuideContent = {
+  breadcrumb: string;
+  title: string;
+  lede: string;
+  outline: ReadonlyArray<{ id: string; label: string; level: 2 | 3 }>;
+  previous?: { href: string; label: string };
+  next?: { href: string; label: string };
+  cards: ReadonlyArray<{ id: string; title: string; body: string }>;
+  recipeTitle: string;
+  recipeNote: string;
+};
+
+const content: Record<'en' | 'zh', GuideContent> = {
+  en: {
+    breadcrumb: 'Guide',
+    title: 'Security',
+    lede:
+      'The CSRF threat model of the form/action loop, and the middleware recipe for ambient-auth apps.',
+    outline: [
+      { id: 'standing-assumption', label: 'Standing assumption', level: 3 },
+      { id: 'ambient-auth', label: 'Ambient authentication', level: 3 },
+      { id: 'middleware-recipe', label: 'Middleware recipe', level: 3 },
+    ],
+    previous: { href: '/guide/islands-and-ssr', label: 'Islands and SSR' },
+    next: { href: '/guide/deployment', label: 'Deployment' },
+    cards: [
+      {
+        id: 'standing-assumption',
+        title: 'Standing assumption',
+        body:
+          'The form/action loop relies on the browser SameSite=Lax default for cookie-based authentication: a cross-site POST does not carry the session cookie, so same-site cookies are not a CSRF vector for actions (ADR-0121 §12). First-party sessions are 0.44 scope; until then the framework ships no built-in CSRF token check.',
+      },
+      {
+        id: 'ambient-auth',
+        title: 'Ambient authentication',
+        body:
+          'Apps authenticated by ambient credentials — HTTP Basic, mTLS, or cookies set with SameSite=None — cannot rely on the Lax default: the browser attaches those credentials to cross-site requests. Such apps must validate the request origin on every state-changing method.',
+      },
+      {
+        id: 'middleware-recipe',
+        title: 'Middleware recipe',
+        body:
+          'Drop the middleware below into app/routes/_middleware.ts. A root _middleware.ts default-exports a Hono middleware scoped to /*, in front of every page action and API route. It allows safe methods and same-site Fetch Metadata, and falls back to an Origin allowlist for older browsers.',
+      },
+    ],
+    recipeTitle: 'app/routes/_middleware.ts',
+    recipeNote:
+      'middleware.corsOrigin (createOpenPlugin option) governs cross-origin resource sharing only — it is not a CSRF check. The two compose: CORS for reads, this guard for writes.',
+  },
+  zh: {
+    breadcrumb: '指南',
+    title: '安全',
+    lede: '表单/action 循环的 CSRF 威胁模型，以及使用隐式凭据的应用所需的 middleware 配方。',
+    outline: [
+      { id: 'standing-assumption', label: '基本假设', level: 3 },
+      { id: 'ambient-auth', label: '隐式身份验证', level: 3 },
+      { id: 'middleware-recipe', label: 'Middleware 配方', level: 3 },
+    ],
+    previous: { href: '/guide/islands-and-ssr', label: 'Islands 与 SSR' },
+    next: { href: '/guide/deployment', label: '部署' },
+    cards: [
+      {
+        id: 'standing-assumption',
+        title: '基本假设',
+        body:
+          '表单/action 循环依赖浏览器 SameSite=Lax 默认值来保护基于 cookie 的身份验证：跨站 POST 不携带会话 cookie，因此 same-site cookie 不会成为 action 的 CSRF 入口（ADR-0121 §12）。第一方会话属于 0.44 范围；在此之前框架不内置 CSRF token 校验。',
+      },
+      {
+        id: 'ambient-auth',
+        title: '隐式身份验证',
+        body:
+          '使用隐式凭据（HTTP Basic、mTLS，或 SameSite=None 的 cookie）的应用无法依赖 Lax 默认值：浏览器会在跨站请求中附带这些凭据。这类应用必须在每个会改变状态的方法上校验请求来源。',
+      },
+      {
+        id: 'middleware-recipe',
+        title: 'Middleware 配方',
+        body:
+          '把下面的 middleware 放入 app/routes/_middleware.ts。根级 _middleware.ts 默认导出一个作用于 /* 的 Hono middleware，位于每个页面 action 与 API 路由之前。它放行安全方法与 same-site Fetch Metadata，并为旧浏览器回退到 Origin 白名单。',
+      },
+    ],
+    recipeTitle: 'app/routes/_middleware.ts',
+    recipeNote:
+      'middleware.corsOrigin（createOpenPlugin 选项）只管跨域资源共享，不是 CSRF 校验。两者组合使用：CORS 管读取，这个守卫管写入。',
+  },
+};
+
+const routeSheet = new StyleSheet();
+routeSheet.replaceSync(
+  pageStyles + guideSectionStyles + `
+    .guide-grid {
+      display: grid;
+      grid-template-columns: repeat(3, minmax(0, 1fr));
+      gap: var(--size-4);
+      margin: var(--size-8) 0;
+    }
+
+    @media (max-width: 860px) {
+      .guide-grid {
+        grid-template-columns: 1fr;
+      }
+    }
+  `,
+);
+
+export class GuideSecurityPage extends OpenElement {
+  static override styles = [routeSheet];
+
+  override render() {
+    const locale = this._getLocale('en');
+    const t = content[locale === 'zh' ? 'zh' : 'en'];
+    return (
+      <open-reading-shell
+        rail
+        footer
+        metadata={JSON.stringify({ breadcrumb: t.breadcrumb, title: t.title, lede: t.lede })}
+        previous={t.previous?.href}
+        previous-label={t.previous?.label}
+        next={t.next?.href}
+        next-label={t.next?.label}
+      >
+        <open-page-rail slot='rail' items={JSON.stringify(t.outline)}></open-page-rail>
+        <div class='container guide-sections'>
+          <div class='guide-grid'>
+            {t.cards.map((card) => (
+              <open-card>
+                <h3 id={card.id}>{card.title}</h3>
+                <p>{card.body}</p>
+              </open-card>
+            ))}
+          </div>
+          <h3>{t.recipeTitle}</h3>
+          <open-code-block>
+            <pre><code>{`import type { Context, Next } from 'hono';
+
+// CSRF guard (ADR-0121 §12): the framework's form/action loop assumes
+// SameSite=Lax cookies. Apps using ambient authentication (Basic, mTLS,
+// SameSite=None cookies) must reject cross-site state-changing requests
+// themselves until built-in support lands with 0.44 sessions.
+const ALLOWED_ORIGINS = new Set(['https://app.example.com']);
+
+export default async function csrfGuard(c: Context, next: Next) {
+  const method = c.req.method;
+  if (method === 'GET' || method === 'HEAD' || method === 'OPTIONS') {
+    return next();
+  }
+  // Fetch Metadata: same-origin/same-site submissions and user-typed
+  // navigations are always fine.
+  const site = c.req.header('sec-fetch-site');
+  if (site === 'same-origin' || site === 'same-site' || site === 'none') {
+    return next();
+  }
+  // Older browsers without Fetch Metadata: fall back to the Origin header.
+  const origin = c.req.header('origin');
+  if (origin && ALLOWED_ORIGINS.has(new URL(origin).origin)) {
+    return next();
+  }
+  return c.text('Forbidden', 403);
+}`}</code></pre>
+          </open-code-block>
+          <p>{t.recipeNote}</p>
+        </div>
+      </open-reading-shell>
+    );
+  }
+}
+
+customElements.define('guide-security-page', GuideSecurityPage);
+export default GuideSecurityPage;
+export const tagName = 'guide-security-page';
diff --git a/www/app/routes/roadmap.tsx b/www/app/routes/roadmap.tsx
index 1e6493521..01346cf82 100644
--- a/www/app/routes/roadmap.tsx
+++ b/www/app/routes/roadmap.tsx
@@ -332,10 +332,10 @@ type TimelineEntry = {
 
 const entries: TimelineEntry[] = [
   {
-    version: 'v0.42.0-alpha.4',
-    theme: 'hardening and recipes',
+    version: 'v0.42.0-alpha.5',
+    theme: 'audit round 1 remediation',
     copy:
-      'Validation recipes verified in CI (zod, valibot), the starter ships a request-time contact page, and the 0.44 latency baseline is recorded.',
+      'The first implementation audit of the application loop closes 35 issues: ADR-0121 protocol hardening, a morph client rewrite (the earlier enhancement never fired), and an evidence-honesty sweep with the fixture suite now gated in CI.',
     state: 'stable',
     stamp: 'CURRENT',
   },
@@ -420,7 +420,7 @@ export class RoadmapPage extends OpenElement {
               {entries.map((phase) => {
                 // The current-line stamp follows the bump-maintained anchor so a
                 // release bump re-marks the timeline without manual edits.
-                const stamp = phase.version === 'v0.42.0-alpha.4' ? 'CURRENT' : phase.stamp;
+                const stamp = phase.version === 'v0.42.0-alpha.5' ? 'CURRENT' : phase.stamp;
                 return (
                   <div class={`tl-row tl-${phase.state}`}>
                     <span class='tl-node' aria-hidden='true'></span>
diff --git a/www/public/search-index.json b/www/public/search-index.json
index caa5c7fe6..5799cca21 100644
--- a/www/public/search-index.json
+++ b/www/public/search-index.json
@@ -155,6 +155,12 @@
     "section": "Guide",
     "text": "Islands and SSR Guide"
   },
+  {
+    "path": "/guide/security",
+    "title": "Security",
+    "section": "Guide",
+    "text": "Security Guide"
+  },
   {
     "path": "/guide/deployment",
     "title": "Deployment",