diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9613312dd..83564b1e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,34 @@ Current truth lives in:
 Historical changelog details remain available through git history and release
 evidence.
 
+## 0.42.0-alpha.6
+
+- Audit round 2 remediation (TP-5.6): the second, independent review of
+  the application loop
+  ([`docs/audit/2026-07-28-alpha5-round2-review.md`](./docs/audit/2026-07-28-alpha5-round2-review.md),
+  issues #576–#593) is closed — five high-severity defects in the morph
+  client plus the protocol and evidence tail.
+- Morph client correctness: an explicit `<form action>` now wins over
+  the page URL on enhanced submits (#576); the popstate guard survives
+  reloads and bfcache restores (#578); morphed-in islands show the
+  server render (manual DSD instantiation before insertion, #579);
+  morph matching is an ordered walk with exact deletion and relocation —
+  reordered id-keyed lists keep order AND island state (#580); nested
+  DSD compares normalized on both sides (#582); forms inside
+  late-hydrating islands get the enhancement listener (#584); a
+  cancelable `open:action-error` hook precedes the network-failure
+  reload (#585); morph fallbacks log a reason in dev (#589).
+- Detection: `hasEnhancedForms` follows relative imports, so an enhanced
+  form inside a shared component no longer loses the enhancement layer
+  silently (#577).
+- Protocol tail: malformed form bodies answer 400 on both channels
+  (#581); the redirect duck type honors the 3xx whitelist (#583);
+  405 responses carry no-store/Vary (#586).
+- Evidence: parity contract extended to JSON 404 / contract-violation
+  500 / malformed-body 400 / 405 / the 303→GET chain (#587); local
+  playwright retries are zero (#590); the alpha.2 note gets the
+  enhancement-inert erratum (#591).
+
 ## 0.42.0-alpha.5
 
 - Audit round 1 remediation (TP-5.5, ADR-0121): the first implementation
diff --git a/README.md b/README.md
index 92a438dff..e6b5318aa 100644
--- a/README.md
+++ b/README.md
@@ -7,7 +7,7 @@ Elements are the durable application contract; JSX and Basic Element are the
 authoring layer; Declarative Shadow DOM is the default server representation;
 interactive regions upgrade selectively.
 
-Published package line: `0.42.0-alpha.5` (`v0.42.0-alpha.5`) — the stable five-package
+Published package line: `0.42.0-alpha.6` (`v0.42.0-alpha.6`) — the stable five-package
 release under ADR-0119's scoped interface freeze; the abandoned beta naming
 is not an active line.
 
diff --git a/README.zh.md b/README.zh.md
index 053739b84..43cff0a9a 100644
--- a/README.zh.md
+++ b/README.zh.md
@@ -6,7 +6,7 @@
 Elements 是可长期保存的应用组件模型；JSX 与 Basic Element 是作者层；
 Declarative Shadow DOM 是默认服务端表示；交互区域按需升级。
 
-已发布包线为 `0.42.0-alpha.5`（`v0.42.0-alpha.5`）——ADR-0119 范围化接口冻结下的
+已发布包线为 `0.42.0-alpha.6`（`v0.42.0-alpha.6`）——ADR-0119 范围化接口冻结下的
 stable 五包版本；已放弃的 beta 命名不再是当前版本线。
 
 ## 当前产品
diff --git a/docs/audit/2026-07-28-alpha5-round2-review.md b/docs/audit/2026-07-28-alpha5-round2-review.md
new file mode 100644
index 000000000..05a696f21
--- /dev/null
+++ b/docs/audit/2026-07-28-alpha5-round2-review.md
@@ -0,0 +1,208 @@
+# openElement 0.42.0-alpha.5 第二轮全面审查报告
+
+- **审查对象**:main @ `1a3a5878`(v0.42.0-alpha.5)
+- **审查性质**:只读独立审查;所有结论附文件:行号或可复现命令
+- **亲自复现清单**:
+  - `deno task test`:971 单测全绿
+  - 夹具 e2e:126 passed(18.4s,`--retries` 复核为无重试通过)
+  - CI run `30321243918`(commit `d2685b0a`)日志级核查:35 门禁全量,含 `PASS fixture:request-time:gate`(2026-07-28T01:52:41)
+  - alpha.4 tag worktree 复现:两个生存 spec `--retries=0` 确定性失败(`Expected: "2" Received: "0"` ×2)——Errata 声称属实
+
+---
+
+## 一、全栈框架评估
+
+### 1.1 定位与参照系
+
+openElement 的 Application Loop 属 **Hotwire/Enhance 谱系**(HTML over the wire + 渐进增强),而非 Remix/SvelteKit 谱系(客户端路由 + loader/action 数据协议):
+
+| 维度       | openElement 0.42                          | 最近参照                         |
+| ---------- | ----------------------------------------- | -------------------------------- |
+| 提交模型   | 原生 form POST + PRG,增强层 fetch + morph | Hotwire Turbo / Enhance          |
+| 无 JS 退化 | 一等公民(协议双通道对称)                  | Enhance(同级)、Remix(有但非重心) |
+| 组件模型   | 原生 WC + DSD,零岛默认零 JS               | Enhance(WC)、Astro(islands)      |
+| 更新粒度   | region 域内 morph                         | Turbo Frames / htmx `hx-target`  |
+| 历史/导航  | pushState + popstate 整页 reload          | 远弱于所有参照(Turbo 有快照缓存) |
+
+### 1.2 闭环自洽性
+
+ADR-0120 七规则 + ADR-0121 十二项加固构成的协议,规范化程度**超过 Hotwire 的非正式约定**。双通道对称性(fetch 404 对称、POST 强转 303、JSON 通道 redirect 用 200 载荷避开 fetch 自动跟随、全响应 no-store)是 Remix 早期踩过的坑,openElement 在 alpha 阶段就以 ADR 钉死,且 126 个夹具 e2e ×3 引擎全绿。**协议设计是本框架最强一环。**
+
+结构性豁口:**morph 客户端是协议的"另一半",却是手写 ~330 行 vanilla JS**(`packages/adapter-vite/src/internal/ssg/entry-generators.ts:340-590`)。本轮 5 个高危全部落在这一半(第三节)。morphdom/idiomorph 十年磨平的边缘情形(键控重定位、跨 shadow 边界、DSD 实例化)正在被重走。
+
+### 1.3 DX
+
+**好**:文件路由 + `definePage` + `fail()`/`redirect()` authoring 面干净,接近 SvelteKit form actions;`?/name` 命名 action 借鉴 SvelteKit 是明智的;夹具应用本身是可跑的活文档。
+
+**弱**:
+
+1. morph 失败静默降级为整页导航,无 dev 模式诊断,region 匹配失败只能靠猜;
+2. `hasEnhancedForms` 静态扫描(`route-scanner.ts:247`)使"增强层是否被包含"成为页面源码字面量的函数——共享组件里的表单静默失去增强;
+3. 422 后表单值回填要用户手写,Remix/SvelteKit 均有约定。
+
+### 1.4 架构赌注
+
+1. **DSD-first**(ADR-0037/0062):成立——零岛页面真正零 JS,SSR 无需模拟补水。代价:morph 跨 shadow 边界成为全框架最难问题域,当前有洞(H4/H5)。
+2. **无客户端路由,popstate 一律 reload**(ADR-0121 §10):诚实但原始;且守卫变量是内存态(H3),连"诚实的 reload"都没做对。
+3. **codegen 无运行时依赖客户端**:可审计、体积可控,但 morph 的每个 bug 都要自己发现自己修。
+4. **协议以 ADR 冻结**(ADR-0086 AI 协作赌注):从审查可判定性看,赌注在兑现。
+
+### 1.5 缺失基元及影响面
+
+- **session/cookie 签名基元**:无。CSRF 靠 SameSite=Lax 假设 + 文档配方(`www/app/routes/guide/security.tsx:144-157` 的 `sec-fetch-site` 中间件)。0.42 明确决策(§12)可接受,stable 前应把 `csrfGuard` 提升为可导入官方中间件。
+- **表单值回填**:422 后手动回填,每个真实应用都要重写一遍。
+- **导航缓存/滚动恢复**:无;popstate reload 丢滚动位置。
+- **流式渲染**:ADR-0040 有铺垫,与 action loop 未打通。
+
+这些缺失不否定 0.42 定位(只做 loop),但决定它当前"够写内容站 + 轻表单应用",不够写"真实业务后台"。
+
+### 1.6 0.42.0 stable 独立判断
+
+**不建议现在切 stable。** 5 个新高危全部位于本版本核心交付物(morph/增强层),其中 H1(formAction fallback)破坏 `<form action>` 基础 HTML 语义——主路径 bug,非边缘情形。协议层已够格冻结;实现层需再一轮修复 + 补测试。**建议:alpha.6 修 5 高危 + 补第七节三个测试 → beta → stable 顺延。**
+
+---
+
+## 二、第一轮修复复核:16 项中 14 项真实修复,2 项修复不足
+
+逐项核查代码 + 回归测试双证据(注:任务书 issue 编号与仓库编号存在系统性错位,按仓库语义描述):
+
+**真实修复(14 项)**,代表性举证:
+
+- action 返回 Response → 500:实现 + 单测 + e2e 齐全
+- POST redirect 强转 303、JSON 通道 200 载荷、PRG 剥 `?/` 前缀键、fetch 404 对称:均有夹具 e2e(live.spec.ts 126 用例)
+- `?/constructor` 原型污染:`hasOwnProperty` 封死(处理链 + live.spec.ts:217-222)
+- morph 岛生存:alpha.4 上两个生存 spec 确定性失败(亲自 worktree 复现),alpha.5 上 126/126——修复真实且 Errata 诚实
+
+**修复不足(2 项)**:
+
+1. **redirect() 构造期校验无单测**(authoring.ts:50-70):3xx 白名单代码在,非法 status 抛错路径零测试。类别:测试缺口。
+2. **405 handler 漏 no-store**(entry-render-helpers.ts:439-443):违反 ADR-0121 §7"全响应 no-store"。类别:协议缺陷。
+
+---
+
+## 三、新发现 issue list
+
+### 高危(5 项)
+
+| #  | 位置                             | 问题                                                                                                                            | 类别         |
+| -- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------------ |
+| H1 | entry-generators.ts:517          | `(submitter && submitter.formAction) \|\| form.action`:`formAction` 属性在无 `formaction` 特性时返回文档 URL(恒真),永远压过 `form.action`。任何 `<form action="/other" data-open-enhance>` 增强提交 POST 到当前页而非声明地址;无 JS 路径正确 → 双通道不对称,违反 ADR-0120 规则 2 | 实现 bug     |
+| H2 | route-scanner.ts:247-249         | `hasEnhancedForms` 正则扫页面源码字面量;表单在共享组件(import 引入)时漏报 → 增强层静默省略,退化整页 POST 且无告警               | 框架设计问题 |
+| H3 | entry-generators.ts:503, 588-590 | popstate 守卫 `__enhancedNav` 是内存变量;增强导航→刷新(复位)→back/forward→守卫失效不 reload,URL 与内容不一致,违背 §10 自身承诺  | 实现 bug     |
+| H4 | entry-generators.ts:390, 397     | `insertBefore`/`appendChild` 插入含 `template[shadowrootmode]` 的新节点时 DSD 不实例化(DSD 只在解析期生效),morph 新增的岛是死的 | 实现 bug     |
+| H5 | entry-generators.ts:377-397      | id 键控节点从不重定位:配对节点原地 morph,新中间节点全部 `appendChild` 追加尾部(L397),列表重排序时 DOM 顺序错误                  | 实现 bug     |
+
+### 中危(8 项确证)
+
+1. `formData()` 解析失败落 500 而非 400/415——恶意 content-type 制造 500 噪音。类别:协议缺陷。
+2. `__islandIntact` 对嵌套 DSD 恒判"已变更"(entry-generators.ts:340-344 `outerHTML` 逐子比较)→ 已补水岛被无谓 replace、状态重置。类别:实现 bug。
+3. `isOpenElementRedirect` 鸭子类型不校验 status 白名单——伪造形状对象可携带任意 status 进 redirect 通道(开放重定向面)。类别:协议缺陷。
+4. 前瞻窗口硬编码 4(entry-generators.ts:386)且 MORPH_CONTRACT 未载明——连续插入 >4 兄弟节点时旧节点被误删重建。类别:框架设计问题。
+5. idle/visible 懒补水岛首次提交漏增强——补水前 shadow root 不存在,`__scanSubmitRoots` 扫不到;补水完成无重扫钩子(仅 morph 后重扫 L560)。类别:实现 bug。
+6. parity 测试仅 6 组状态码——§8 的矩阵不含 401/403/405/redirect-chain。类别:测试缺口。
+7. catch → `window.location.reload()`(entry-generators.ts:575-578)——网络瞬断静默 reload 丢全部表单输入,不派发 `open:action-failure`。类别:框架设计问题。
+8. 405 无 no-store(同第二节 #2,计入缺陷面)。
+
+> 注:第一轮子代理共报 12 项中危,其余 4 项细节因上下文压缩且 transcript 不存在而无法恢复;以上 8 项均经代码定点复核确证,不掺推测。
+
+### 低危(4 项定点确证)
+
+1. entry-generators.ts:467 — `CSS.escape` 缺失时裸拼 region name 进选择器,region 名含引号时选择器损坏(仅古董引擎)。
+2. entry-generators.ts:482-486 — `__submitRoots` 只增不减,morph 掉的 shadow root 引用滞留(小量级内存泄漏)。
+3. entry-generators.ts:410-415 — script 节点 morph 时 src 变更有意留旧(有注释,属已文档化取舍,但 MORPH_CONTRACT 应载明)。
+4. entry-generators.ts:566 — `target.hash` 存在时直接丢弃本地 hash,与 #565 注释语义有细微出入。
+
+---
+
+## 四、ADR-0121 十二项决策符合性
+
+| §  | 决策                                                    | 结论    | 证据                                                         |
+| -- | ------------------------------------------------------- | ------- | ------------------------------------------------------------ |
+| 1  | 统一头 `x-openelement-action: true\|enhance`            | ✅      | 客户端 L526 发 `enhance`;服务端判别有 e2e                    |
+| 2  | 禁 Response 返回 → 500                                  | ✅      | 代码+单测+e2e                                                |
+| 3  | redirect 3xx 校验 + POST 强转 303                       | ⚠️ 部分 | 实现在;构造期校验无单测                                      |
+| 4  | JSON 通道 redirect 用 200 载荷                          | ✅      | e2e                                                          |
+| 5  | PRG 剥 `?/` 前缀键                                      | ✅      | e2e                                                          |
+| 6  | fetch 404 对称                                          | ✅      | e2e                                                          |
+| 7  | 全响应 no-store                                         | ⚠️ 部分 | 405 分支漏(entry-render-helpers.ts:439-443)                  |
+| 8  | POST/GET 错误边界 parity                                | ⚠️ 部分 | 实现在;parity 测试仅 6 组状态码                              |
+| 9  | region 语义(scope 缺失→整页导航)                        | ✅      | entry-generators.ts:456-479(L475 `return false` → L574 导航) |
+| 10 | shadow root 级 submit + id 键控 morph + popstate reload | ❌      | 监听✅(L483-500);id 键控不重定位(H5);popstate 守卫失效(H3)   |
+| 11 | `open:action-failure` cancelable                        | ✅      | L551-557                                                     |
+| 12 | CSRF SameSite=Lax 假设 + 文档配方                       | ✅      | security.tsx:144-157                                         |
+
+**结论:9 项符合;§3/§7/§8 部分符合;§10 不符合(且为本版本核心交付项)。**
+
+---
+
+## 五、证据与流程诚实度复核
+
+**总判定:发布证据链真实,无造假;3 处强度虚标,2 处未回溯勘误。**
+
+**真实(日志级/复现级核实)**:
+
+- alpha.5 走 publish-existing(run 30321687103),门禁语义为 `verifyMainCiSuccessForHead()`(tools/autoflow/release.ts:506-535)核对 HEAD=`d2685b0a` 的主 CI;主 CI run 30321243918 日志确认 35 门禁全量 + `PASS fixture:request-time:gate`——证据链闭合。
+- fixture 门禁真进 ci+release tier(tools/autoflow/policy.ts:241-245)。
+- alpha.4 Errata 亲自复现属实。
+- 本地 126/126 无重试、971 单测全绿。
+
+**强度虚标(3 处)**:
+
+1. 静态输出冻结:release 门禁只跑 `--self-check`(policy.ts:253-257),对 v0.41.2 字节级基线对比是手动工具,不在自动门禁——"静态输出不变"声称强度被高估。类别:文档失信(轻度)。
+2. 0.41 冻结面:interface snapshot 在 alpha.2 已 re-baseline,"no frozen export changed"是 prose 声称;check-public-interface-snapshot.ts:16-20 只抓行首 export 声明,类型形状/重导出语义变更不设防——冻结面无机械守卫。类别:架构回流风险。
+3. playwright 本地 retries=1(CI=2):可能掩盖 flaky;本轮 `--retries=0` 复跑通过,当前无实际掩盖,但配置是坏味道。
+
+**未回溯勘误(2 处)**:alpha.1"12/12"、alpha.2"33/33"在生存 spec 问题曝光后未回溯 Errata(alpha.4 出了,前两个没有)。
+
+---
+
+## 六、TP-6 准出判断与补项清单(按 ROI 排序)
+
+**判断:TP-6 未就绪。** 协议层(ADR 文本 + 服务端实现)已达冻结质量;客户端增强层(morph/history/检测)是阻塞项。
+
+| 序 | 补项                                                                        | ROI 依据                     |
+| -- | --------------------------------------------------------------------------- | ---------------------------- |
+| 1  | 修 H1(改 `submitter.hasAttribute('formaction')`,一行)+ e2e                  | 一行消除主路径双通道不对称   |
+| 2  | 修 H2 检测策略:任一 route 含 enhance 即全局包含增强层,或构建期告警          | 消除最难排查的"静默降级"故障 |
+| 3  | 修 H3:popstate 守卫改 `sessionStorage`                                      | 一行级,兑现 §10 承诺         |
+| 4  | 修 H4:morph 插入后对新子树扫 `template[shadowrootmode]` 手动 `attachShadow` | 补生存矩阵空白格             |
+| 5  | H5 + 前瞻窗口:实现重定位,或 MORPH_CONTRACT 载明"不保证重排序"               | 契约诚实优先于功能完备       |
+| 6  | 收尾:405 no-store + redirect() 构造校验单测                                 | 关掉"已修复"清单尾巴         |
+| 7  | 公共接口冻结改机械守卫(如 `deno doc --json` diff)                           | 防冻结面无声漂移             |
+| 8  | 补 alpha.1/2 勘误;静态输出基线对比进 release 门禁或降级措辞                 | 诚实度一致性,成本≈0          |
+| 9  | parity 矩阵扩全状态码族;本地 retries 归零                                   | 测试强度对齐声称强度         |
+
+---
+
+## 七、最值得立刻补的三个测试
+
+1. **e2e:`<form action="/other-route" data-open-enhance>` + 无 formaction 的 submitter → 断言 POST 命中 `/other-route`。**
+   命中 H1,今天就会红;永久钉死 ADR-0120 规则 2 的双通道 URL 对称性。
+
+2. **e2e:增强表单只存在于被 import 的共享组件(页面源码无 `data-open-enhance` 字面量)→ 断言增强层存在且提交走 fetch。**
+   命中 H2,今天就会红;是"框架隐式行为"类 bug 的唯一防线。
+
+3. **e2e:morph 后新插入的岛节点(响应 HTML 多一个带 `template[shadowrootmode]` 的岛)→ 断言 shadowRoot 存在且补水后可交互。**
+   命中 H4,把 MORPH_CONTRACT"morph 新增岛"空白格变成受测契约——alpha.4 事故已证明这类空白格会真实爆炸。
+
+(候补:redirect() 非法 status 构造期抛错单测,一并关掉第二节 #1。)
+
+---
+
+## 附:全栈框架成熟度记分卡(独立评估)
+
+以"生产级全栈框架"为满分基准(参照 Remix/SvelteKit/Astro 的 1.0 水位):
+
+| 维度                | 成熟度 | 说明                                                          |
+| ------------------- | ------ | ------------------------------------------------------------- |
+| 协议/契约设计       | ★★★★★  | ADR-0120/0121 规范化程度超过多数 1.0 框架的同期水平           |
+| 服务端 action 实现  | ★★★★☆  | 14/16 修复真实,余 2 项小尾巴                                  |
+| 客户端增强层(morph) | ★★☆☆☆  | 5 高危全在此;核心交付物但质量最低                             |
+| 路由/渲染(SSG+DSD)  | ★★★★☆  | 0.41 冻结面,稳定;缺流式与 loop 打通                           |
+| 数据/状态基元       | ★★☆☆☆  | 无 session/CSRF 基元/回填约定,靠配方                          |
+| 测试与门禁工程      | ★★★★☆  | 971+126×3 引擎+35 门禁全量;缺口在 parity 矩阵与冻结面机械守卫 |
+| 流程诚实度          | ★★★★☆  | 证据链真实;3 处强度虚标、2 处未勘误                           |
+| DX/诊断             | ★★★☆☆  | authoring 面好;morph 静默降级无诊断                           |
+| 生态/文档           | ★★★☆☆  | ADR 极佳;面向使用者的指南薄                                   |
+
+**综合:约相当于同类框架的 0.4~0.5 水位(恰与版本号一致)。** 定位清晰、协议扎实、工程纪律罕见地好;短板集中且明确——客户端增强层一轮加固后,0.42 stable 即可站得住。适用边界:今天可用于内容站+轻表单应用;真实业务后台需等 session/CSRF/回填基元落地(0.43+ 范围)。
diff --git a/docs/current/MORPH_CONTRACT.md b/docs/current/MORPH_CONTRACT.md
index 519c93ac8..5141c93c6 100644
--- a/docs/current/MORPH_CONTRACT.md
+++ b/docs/current/MORPH_CONTRACT.md
@@ -31,10 +31,14 @@ carries a host's shadow content in its `<template shadowrootmode>` child).
    never `pushState`).
 4. A `422` dispatches a cancelable `open:action-failure` `CustomEvent` on
    the form (`detail: { status, form, response }`) before morphing;
-   `preventDefault()` skips the default morph.
-5. Success updates the URL with `history.pushState`; `popstate` reloads
-   the restored URL (no client-side state cache in 0.42). The local
-   fragment is preserved when the target is the same page.
+   `preventDefault()` skips the default morph. A network/fetch failure
+   dispatches a cancelable `open:action-error` (`detail: { error, form }`)
+   before the reload fallback; `preventDefault()` skips the reload.
+5. Success updates the URL with `history.pushState`; `popstate` (and
+   bfcache `pageshow` restores) reload the restored URL when the session
+   has enhanced-navigated (a `sessionStorage` marker — no client-side
+   state cache in 0.42). The local fragment is preserved when the target
+   is the same page.
 6. A second submit while one is in flight is ignored; cross-form
    responses are ordered by sequence.
 
@@ -52,15 +56,23 @@ never touched.
 
 ## Identity and survival rules
 
-- **Matching**: within a parent, children with an `id` match by `id`
-  (tag must match); the rest match structurally (node type + tag) with a
-  bounded lookahead, so insertions/removals between matched anchors are
-  preserved. Rows in dynamic lists should carry stable `id`s.
+- **Matching**: an ordered walk. Old children are indexed by `id` (id'd
+  nodes are consumed only by an id match); each new child in order matches
+  by id else structurally ahead of the reference point; the match is
+  morphed and MOVED into position (moves preserve shadow roots and state);
+  unmatched new nodes are inserted in place; only never-matched old nodes
+  are removed. Reorders therefore keep both order and state, and rows in
+  dynamic lists should carry stable `id`s.
+- **DSD instantiation**: nodes inserted by a morph (new subtrees,
+  replacements) have their `<template shadowrootmode>` instantiated
+  manually before insertion — the HTML parser is the only other place DSD
+  activates — so morphed-in islands show the server render, not a
+  client-initial one.
 - **Island survival**: a hydrated island (live shadow root) survives when
   its light-DOM surface serializes identically (`__islandIntact`):
-  attributes equal, and child nodes equal after skipping the DSD template
-  and whitespace-only text. Otherwise it is replaced and its state resets
-  by design.
+  attributes equal, and child nodes equal after recursively skipping DSD
+  templates and whitespace-only text on both sides. Otherwise it is
+  replaced and its state resets by design.
 - **`data-open-preserve`**: exempts the whole subtree, checked before
   island and attribute logic.
 - **Scripts**: live `<script>` nodes are kept as-is (never re-executed;
diff --git a/docs/current/VERSION_PLAN.md b/docs/current/VERSION_PLAN.md
index 3cd2911ce..083261da0 100644
--- a/docs/current/VERSION_PLAN.md
+++ b/docs/current/VERSION_PLAN.md
@@ -1,7 +1,7 @@
 # v0.42.0 — WC Application Loop release plan
 
-> Current source package line: `v0.42.0-alpha.5`\
-> Current npm registry line: `v0.42.0-alpha.5`\
+> Current source package line: `v0.42.0-alpha.6`\
+> Current npm registry line: `v0.42.0-alpha.6`\
 > Active release target: `v0.41.1`\
 > Planning release target: `v0.42.0` (WC Application Loop)\
 > Next release line: `v0.43.0` (Universal WC SSR)\
@@ -261,11 +261,38 @@ semantics beyond what the ADR-0120 amendment in step 1 records.
   green; release-tier gates green; alpha.5 published with two-stage
   evidence.
 
+### TP-5.6 — `0.42.0-alpha.6` audit round 2 remediation (morph client correctness)
+
+Goal: close the second, independent review round (issues #576–#593,
+`docs/audit/2026-07-28-alpha5-round2-review.md`) — five high-severity
+morph/enhancement defects and the protocol/test/evidence tail — without
+expanding the 0.42 scope.
+
+- 准入: TP-5.5 closed (alpha.5 published); the round-2 review report is
+  archived and its claims verified (done 2026-07-28).
+- 执行步骤:
+  1. Morph client correctness: form-action URL resolution (#576),
+     sessionStorage popstate guard + bfcache pageshow (#578), manual DSD
+     instantiation before morph insertions (#579), ordered-walk
+     `__morphChildren` with exact deletion and relocation (#580),
+     recursive normalized island comparison (#582), late-hydration submit
+     rescan (#584), `open:action-error` hook (#585), diagnostics (#589),
+     submit-root pruning (#588).
+  2. Detection: import-following `hasEnhancedForms` scan (#577).
+  3. Protocol tail: 400 for malformed bodies (#581), redirect duck-type
+     whitelist + constructor tests (#583, #586), 405 no-store/Vary (#586).
+  4. Evidence: parity matrix extension (#587), local retries zeroed
+     (#590), alpha.2 enhancement-inert erratum (#591).
+- 准出: every issue #576–#593 is closed with a code + test/gate proof;
+  the fixture suite passes on three engines with the new round-2 specs
+  included; release-tier gates green; alpha.6 published with two-stage
+  evidence; #592/#593 stay open as the TP-6 agenda they record.
+
 ### TP-6 — `0.42.0` stable decision
 
 Goal: decide and ship the request-time freeze scope.
 
-- 准入: TP-5.5 closed (alpha.5 published); the seven-day P0 watch on the
+- 准入: TP-5.6 closed (alpha.6 published); the seven-day P0 watch on the
   last alpha shows no P0.
 - 执行步骤:
   1. Stable-scope ADR: which request-time semantics freeze (expected: the
diff --git a/docs/governance/PROJECT_WORKFLOW.md b/docs/governance/PROJECT_WORKFLOW.md
index 761b1bd9d..5f9cea960 100644
--- a/docs/governance/PROJECT_WORKFLOW.md
+++ b/docs/governance/PROJECT_WORKFLOW.md
@@ -11,8 +11,8 @@ complete because an issue, chat message, or SOP says it is complete. It is
 complete only when the repository contains the decision, the execution package,
 the implementation, and the gates that prove the claim.
 
-Current execution anchor: published package line `v0.42.0-alpha.5`, completed
-implementation anchor `v0.42.0-alpha.5`, and `0.42.0` WC Application Loop planning
+Current execution anchor: published package line `v0.42.0-alpha.6`, completed
+implementation anchor `v0.42.0-alpha.6`, and `0.42.0` WC Application Loop planning
 under ADR-0120 and `docs/current/VERSION_PLAN.md`.
 OpenElement is one Web Components-native,
 static-first application framework: Basic Element is an authoring mode, not a
diff --git a/docs/release/v0.42.0-alpha.2.md b/docs/release/v0.42.0-alpha.2.md
index e180cca38..fa51b39c1 100644
--- a/docs/release/v0.42.0-alpha.2.md
+++ b/docs/release/v0.42.0-alpha.2.md
@@ -41,6 +41,17 @@ should `return fail(422, data)` for validation errors and `redirect()`
 (or nothing, for the default PRG) on success. The loader now runs after
 the action on POST.
 
+## Errata (2026-07-28, alpha.6)
+
+- **The form-enhancement layer was inert at this tag**: the
+  document-level submit listener never fired for forms inside
+  page-element shadow roots (`submit` is not a composed event), so the
+  enhancement described above — including the `open:action-failure`
+  hook — never executed; every form submitted natively. Harmless by
+  design (the no-JS path is the baseline), but the enhancement claims
+  were not exercised. Same root cause as the alpha.3/alpha.4 errata;
+  fixed in `0.42.0-alpha.5` (ADR-0121).
+
 ---
 
 AutoFlow3 patch release evidence: `publish-existing-v0.42.0-alpha.2-2026-07-27T07-43-59-379Z`.
diff --git a/docs/release/v0.42.0-alpha.6.md b/docs/release/v0.42.0-alpha.6.md
new file mode 100644
index 000000000..eb05957d2
--- /dev/null
+++ b/docs/release/v0.42.0-alpha.6.md
@@ -0,0 +1,67 @@
+# v0.42.0-alpha.6
+
+## Audit round 2 remediation
+
+The sixth alpha of the 0.42 line closes the second, independent review
+of the WC Application Loop
+([`docs/audit/2026-07-28-alpha5-round2-review.md`](https://github.com/open-element/openelement/blob/main/docs/audit/2026-07-28-alpha5-round2-review.md)
+— TP-5.6, issues #576–#593). Five high-severity defects in the morph
+client, plus the protocol and evidence tail.
+
+- **`<form action>` wins on enhanced submits** (#576): the submitter's
+  `formAction` IDL value is only honored when a `formaction` attribute
+  exists — previously every enhanced submit posted to the current page,
+  diverging from the no-JS path.
+- **History guard survives reloads** (#578): the enhanced-navigation
+  marker lives in `sessionStorage`, and bfcache `pageshow` restores are
+  covered too — back/forward after a reload no longer shows stale
+  content for the restored URL.
+- **Morphed-in islands show the server render** (#579): DSD templates in
+  morph-inserted subtrees are instantiated manually before insertion
+  (the HTML parser is otherwise the only place DSD activates), so new
+  island instances hydrate the server's content instead of a
+  client-initial render.
+- **Ordered morph matching** (#580): `__morphChildren` is an ordered
+  walk — id-keyed nodes relocate correctly (moves preserve state),
+  insertion batches of any size insert in place, and deletion is exact
+  (no lookahead window). Reordered id-keyed lists keep both order and
+  island state. Nested DSD compares normalized on both sides (#582).
+- **Detection follows imports** (#577): an enhanced form inside a shared
+  component no longer loses the enhancement layer silently — the scanner
+  follows relative imports (bounded, cycle-safe; prose still never
+  triggers).
+- **Protocol tail**: malformed form bodies answer 400 on both channels
+  (#581); the redirect duck type honors the 3xx whitelist (#583); 405
+  responses carry no-store/Vary (#586); `redirect()`'s constructor
+  validation has unit tests.
+- **Client hooks and hygiene**: forms inside late-hydrating
+  (idle/visible) islands get the submit listener (#584); a cancelable
+  `open:action-error` event precedes the network-failure reload (#585);
+  morph fallbacks log a reason in dev (#589); detached shadow roots are
+  pruned from the listener registry (#588).
+- **Evidence**: the dev/build parity contract now covers the JSON 404,
+  contract-violation 500, malformed-body 400, 405 and the 303→GET chain
+  (#587); local playwright retries are zero (#590); the alpha.2 note
+  gets the enhancement-inert erratum (#591).
+
+## Verification
+
+- Request-time fixture e2e: 49 tests × 3 engines = 147 passed
+  (Chromium, Firefox, WebKit) via `fixture:request-time:gate`.
+- Unit suite green; parity contract 10/10 across the real dev (hono) and
+  built (Nitro) servers; scanner import-following covered by a unit
+  test.
+- Reviewer's three recommended tests all exist and were
+  failing-then-passing: enhanced `<form action>` (#576), shared-component
+  enhancement (#577), morphed-in island server render (#579).
+
+## Migrating from alpha.5
+
+Nothing required. Apps that worked around #576 (explicit `form action`
+with `data-open-enhance`) should verify the now-correct behavior; apps
+relying on reload-on-popstate semantics see no change beyond bfcache
+correctness.
+
+---
+
+`/@fs/` Windows verification status: see `docs/current/HYDRATION_CONTRACT.md` (Known limitations).
diff --git a/docs/roadmap/ROADMAP.md b/docs/roadmap/ROADMAP.md
index 03066d8ec..1bdec0d7c 100644
--- a/docs/roadmap/ROADMAP.md
+++ b/docs/roadmap/ROADMAP.md
@@ -4,8 +4,8 @@ Execution and release state follow the
 [`Project Workflow`](../governance/PROJECT_WORKFLOW.md).
 
 > Source of truth for forward product planning.\
-> Published package line: `v0.42.0-alpha.5`.\
-> Active execution target: `v0.42.0-alpha.5`.\
+> Published package line: `v0.42.0-alpha.6`.\
+> Active execution target: `v0.42.0-alpha.6`.\
 > Current implementation state: five-package convergence is published;
 > alpha.17 closed the first audit remediation, alpha.18 completed the
 > second audit sweep (ADR-0117), and alpha.19 completed the third (ADR-0118).\
@@ -116,7 +116,7 @@ making the standard Custom Element contract span both layers. See the official
 
 ## Current release state
 
-`0.42.0-alpha.5` is the published package line. npm beta.1 through beta.3 are
+`0.42.0-alpha.6` is the published package line. npm beta.1 through beta.3 are
 immutable partial artifacts and remain withdrawn from the active release story.
 The planned beta name was cancelled so the version label honestly reflects
 that breaking architecture and interface changes are still allowed.
diff --git a/docs/status/STATUS.md b/docs/status/STATUS.md
index 70e78f5ac..6f3807774 100644
--- a/docs/status/STATUS.md
+++ b/docs/status/STATUS.md
@@ -1,9 +1,9 @@
 # OpenElement Status
 
 > Updated: 2026-07-27\
-> Repository package line: `v0.42.0-alpha.5`\
-> npm registry line: `v0.42.0-alpha.5`\
-> Active release target: `v0.42.0-alpha.5`\
+> Repository package line: `v0.42.0-alpha.6`\
+> npm registry line: `v0.42.0-alpha.6`\
+> Active release target: `v0.42.0-alpha.6`\
 > Next release line: `v0.42.0`\
 > Product graph: five packages\
 > Current maturity stage: stable (0.41.x)
diff --git a/packages/adapter-vite/__fixtures__/request-time/app/components/shared-enhanced-form.tsx b/packages/adapter-vite/__fixtures__/request-time/app/components/shared-enhanced-form.tsx
new file mode 100644
index 000000000..1f15e9a9a
--- /dev/null
+++ b/packages/adapter-vite/__fixtures__/request-time/app/components/shared-enhanced-form.tsx
@@ -0,0 +1,12 @@
+/**
+ * Shared component carrying the ONLY data-open-enhance literal in its tree
+ * (#577): routes that render this component contain no enhance attribute in
+ * their own source — the scanner must follow the import to ship the layer.
+ */
+export function SharedEnhancedForm() {
+  return (
+    <form method='post' action='/form' data-open-enhance>
+      <button id='shared-submit' type='submit'>Shared submit</button>
+    </form>
+  );
+}
diff --git a/packages/adapter-vite/__fixtures__/request-time/app/routes/items.tsx b/packages/adapter-vite/__fixtures__/request-time/app/routes/items.tsx
index 82a88a1db..1976501f3 100644
--- a/packages/adapter-vite/__fixtures__/request-time/app/routes/items.tsx
+++ b/packages/adapter-vite/__fixtures__/request-time/app/routes/items.tsx
@@ -18,6 +18,13 @@ export function action(ctx: { formData: FormData }): never {
   redirect(`/items?items=${encodeURIComponent('new,' + items)}`);
 }
 
+export const actions = {
+  reverse(ctx: { formData: FormData }): never {
+    const items = String(ctx.formData.get('items') ?? 'a,b').split(',');
+    redirect(`/items?items=${encodeURIComponent(items.reverse().join(','))}`);
+  },
+};
+
 const ItemsPage = definePage({
   renderIntent: { mode: 'dynamic' },
   head: { title: 'request-time fixture — items' },
@@ -27,6 +34,7 @@ const ItemsPage = definePage({
         <form method='post' data-open-enhance>
           <input type='hidden' name='items' value={data.items.join(',')} />
           <button id='prepend' type='submit'>Prepend</button>
+          <button id='reverse' type='submit' formaction='?/reverse'>Reverse</button>
         </form>
         <ul>
           {data.items.map((id) => (
diff --git a/packages/adapter-vite/__fixtures__/request-time/app/routes/ping.tsx b/packages/adapter-vite/__fixtures__/request-time/app/routes/ping.tsx
index bd0b1c564..60dec5dc0 100644
--- a/packages/adapter-vite/__fixtures__/request-time/app/routes/ping.tsx
+++ b/packages/adapter-vite/__fixtures__/request-time/app/routes/ping.tsx
@@ -57,6 +57,13 @@ const PingPage = definePage({
           </button>
           <button id='mv307' type='submit' formaction='?/mv307'>Move</button>
         </form>
+        {
+          /* #576: an explicit action attribute with an attribute-less
+            submitter — the enhanced POST must hit /form, not this page. */
+        }
+        <form method='post' action='/form' data-open-enhance>
+          <button id='to-form' type='submit'>Send to /form</button>
+        </form>
       </main>
     );
   },
diff --git a/packages/adapter-vite/__fixtures__/request-time/app/routes/shared.tsx b/packages/adapter-vite/__fixtures__/request-time/app/routes/shared.tsx
new file mode 100644
index 000000000..aceb69bdb
--- /dev/null
+++ b/packages/adapter-vite/__fixtures__/request-time/app/routes/shared.tsx
@@ -0,0 +1,25 @@
+/**
+ * /shared — a route whose enhanced form lives in an IMPORTED component
+ * (#577): this file contains no data-open-enhance literal, so the
+ * enhancement layer only ships because the scanner follows the import.
+ */
+import { definePage } from '@openelement/app';
+import { SharedEnhancedForm } from '../components/shared-enhanced-form.tsx';
+
+export const tagName = 'page-shared';
+
+const SharedPage = definePage({
+  renderIntent: { mode: 'dynamic' },
+  head: { title: 'request-time fixture — shared' },
+  render() {
+    return (
+      <main>
+        <h1>shared component form</h1>
+        <SharedEnhancedForm />
+      </main>
+    );
+  },
+});
+
+customElements.define(tagName, SharedPage);
+export default SharedPage;
diff --git a/packages/adapter-vite/__fixtures__/request-time/e2e/live.spec.ts b/packages/adapter-vite/__fixtures__/request-time/e2e/live.spec.ts
index 5b4fa4037..867117485 100644
--- a/packages/adapter-vite/__fixtures__/request-time/e2e/live.spec.ts
+++ b/packages/adapter-vite/__fixtures__/request-time/e2e/live.spec.ts
@@ -498,3 +498,97 @@ test.describe('param routes and the generated matcher (#556)', () => {
     expect(response.headers()['location']).toBe('/item/42?noted=hello-item');
   });
 });
+
+test.describe('round-2 morph client fixes (0.42.0-alpha.6)', () => {
+  test('an explicit form action wins over the page URL (#576)', async ({ page }) => {
+    await page.goto('/ping');
+    const post = page.waitForResponse((r) =>
+      r.request().method() === 'POST' && r.url().includes('/form')
+    );
+    await page.click('#to-form');
+    const response = await post;
+    expect(response.status()).toBe(422);
+    // The enhanced POST hit /form (its 422 page), not /ping.
+    await expect(page.locator('#error')).toHaveText('message is required');
+  });
+
+  test('back after a reload following an enhanced submit reloads again (#578)', async ({ page }) => {
+    await page.goto('/form');
+    await page.fill('#message', 'nav-guard');
+    await page.click('#submit');
+    await page.waitForURL('**/form?echoed=nav-guard');
+    await expect(page.locator('#echo')).toHaveText('echo=nav-guard');
+    await page.reload();
+    // History shape after a reload differs across engines (Firefox grows an
+    // extra entry); walk back until the pre-submit URL is reached.
+    for (let i = 0; i < 3 && !page.url().endsWith('/form'); i++) await page.goBack();
+    // The invariant §10 promises: displayed content always matches the URL.
+    // With a memory-only guard (pre-fix) a bfcache/persisted restore shows
+    // the morphed page at the pre-submit URL — stale.
+    if (page.url().endsWith('/form')) {
+      await expect(page.locator('#echo')).toHaveText('echo=');
+    } else {
+      await expect(page.locator('#echo')).toHaveText('echo=nav-guard');
+    }
+  });
+
+  test('a morphed-in island instance shows the server render and hydrates (#579)', async ({ page }) => {
+    await page.goto('/items');
+    await page.click('#prepend');
+    await page.waitForURL('**/items?items=new*');
+    const count = page.locator('li#row-new live-counter #count');
+    // DSD instantiated on insertion: the server's render ('0'), not a blank
+    // client-initial span.
+    await expect(count).toHaveText('0');
+    await page.locator('li#row-new live-counter #increment').click();
+    await expect(count).toHaveText('1');
+  });
+
+  test('id-keyed rows keep order and island state through a reverse (#580)', async ({ page }) => {
+    await page.goto('/items');
+    const count = page.locator('li#row-a live-counter #count');
+    await page.locator('li#row-a live-counter #increment').click();
+    await page.locator('li#row-a live-counter #increment').click();
+    await expect(count).toHaveText('2');
+
+    await page.click('#reverse');
+    await page.waitForURL('**/items?items=b*');
+    await expect(page.locator('ul > li').first()).toHaveId('row-b');
+    await expect(count).toHaveText('2');
+  });
+
+  test('a malformed form body is a defined 400 on both channels (#581)', async ({ request }) => {
+    const html = await request.post('/form', {
+      headers: { 'content-type': 'application/json' },
+      data: '{"x":1}',
+    });
+    expect(html.status()).toBe(400);
+    const json = await request.post('/form', {
+      headers: { 'content-type': 'application/json', 'x-openelement-action': 'true' },
+      data: '{"x":1}',
+    });
+    expect(json.status()).toBe(400);
+    expect((await json.json()).type).toBe('error');
+  });
+
+  test('405 carries no-store (#586)', async ({ request }) => {
+    const response = await request.put('/form', { data: 'x=1' });
+    expect(response.status()).toBe(405);
+    expect(response.headers()['cache-control']).toBe('no-store');
+  });
+
+  test('an enhanced form inside an imported component enhances (#577)', async ({ page }) => {
+    await page.goto('/shared');
+    await page.evaluate(() => {
+      (window as unknown as { __stillHere: number }).__stillHere = 1;
+    });
+    const post = page.waitForResponse((r) => r.request().method() === 'POST');
+    await page.click('#shared-submit');
+    await post;
+    // Enhancement intercepted (fetch + morph): the JS context survives; a
+    // native POST would have wiped it.
+    expect(await page.evaluate(() => (window as never as { __stillHere?: number }).__stillHere))
+      .toBe(1);
+    await expect(page.locator('#error')).toHaveText('message is required');
+  });
+});
diff --git a/packages/adapter-vite/__fixtures__/request-time/e2e/playwright.config.ts b/packages/adapter-vite/__fixtures__/request-time/e2e/playwright.config.ts
index fb6a43133..388ca1e30 100644
--- a/packages/adapter-vite/__fixtures__/request-time/e2e/playwright.config.ts
+++ b/packages/adapter-vite/__fixtures__/request-time/e2e/playwright.config.ts
@@ -21,7 +21,7 @@ export default defineConfig({
   testMatch: '*.spec.ts',
   fullyParallel: false,
   forbidOnly: !!process.env.CI,
-  retries: process.env.CI ? 2 : 1,
+  retries: process.env.CI ? 2 : 0,
   workers: 1,
   reporter: 'list',
   timeout: 60_000,
diff --git a/packages/adapter-vite/__tests__/request-time-parity.test.ts b/packages/adapter-vite/__tests__/request-time-parity.test.ts
index b92f6ff9d..89d0fb85e 100644
--- a/packages/adapter-vite/__tests__/request-time-parity.test.ts
+++ b/packages/adapter-vite/__tests__/request-time-parity.test.ts
@@ -167,13 +167,83 @@ Deno.test({
         }
       });
 
-      await t.step('PUT /form → 405', async () => {
+      await t.step('PUT /form → 405 + no-store', async () => {
         for (const [name, base] of Object.entries(both)) {
           const response = await fetch(`${base}/form`, { method: 'PUT', body: 'x=1' });
           assertEquals(response.status, 405, `${name}: PUT /form status`);
+          assertEquals(
+            response.headers.get('cache-control'),
+            'no-store',
+            `${name}: PUT /form cache-control`,
+          );
           await response.body?.cancel();
         }
       });
+
+      await t.step('fetch-header unknown action → ActionResult JSON 404', async () => {
+        for (const [name, base] of Object.entries(both)) {
+          const response = await fetch(`${base}/form?/nope`, {
+            method: 'POST',
+            headers: {
+              'content-type': 'application/x-www-form-urlencoded',
+              'x-openelement-action': 'true',
+            },
+            body: 'message=x',
+          });
+          assertEquals(response.status, 404, `${name}: JSON 404 status`);
+          assertStringIncludes(
+            response.headers.get('content-type') ?? '',
+            'application/json',
+            `${name}: JSON 404 content-type`,
+          );
+          const body = await response.json() as { type?: string; status?: number };
+          assertEquals(body.type, 'error', `${name}: JSON 404 type`);
+        }
+      });
+
+      await t.step('action returning a Response → 500 contract violation', async () => {
+        for (const [name, base] of Object.entries(both)) {
+          const response = await fetch(`${base}/ping?/raw`, formBody({}));
+          assertEquals(response.status, 500, `${name}: /ping?/raw status`);
+          const body = await response.text();
+          assertEquals(body.includes('<h1>raw</h1>'), false, `${name}: raw HTML must not leak`);
+        }
+      });
+
+      await t.step('malformed body (JSON content-type) → 400, both channels', async () => {
+        for (const [name, base] of Object.entries(both)) {
+          const response = await fetch(`${base}/form`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: '{"x":1}',
+          });
+          assertEquals(response.status, 400, `${name}: JSON body status`);
+          const json = await fetch(`${base}/form`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', 'x-openelement-action': 'true' },
+            body: '{"x":1}',
+          });
+          assertEquals(json.status, 400, `${name}: JSON body (fetch channel) status`);
+          assertStringIncludes(
+            json.headers.get('content-type') ?? '',
+            'application/json',
+            `${name}: fetch channel speaks JSON`,
+          );
+        }
+      });
+
+      await t.step('303 PRG chain: POST → 303 → GET renders the target', async () => {
+        for (const [name, base] of Object.entries(both)) {
+          const post = await fetch(`${base}/form`, {
+            ...formBody({ message: 'chain' }),
+            redirect: 'manual',
+          });
+          assertEquals(post.status, 303, `${name}: PRG status`);
+          const get = await fetch(`${base}${post.headers.get('location')}`);
+          assertEquals(get.status, 200, `${name}: PRG target status`);
+          assertStringIncludes(await get.text(), 'echo=chain', `${name}: PRG target body`);
+        }
+      });
     } finally {
       await dev.close();
       await build.close();
diff --git a/packages/adapter-vite/__tests__/route-scanner-enhance.test.ts b/packages/adapter-vite/__tests__/route-scanner-enhance.test.ts
new file mode 100644
index 000000000..b9707ad14
--- /dev/null
+++ b/packages/adapter-vite/__tests__/route-scanner-enhance.test.ts
@@ -0,0 +1,55 @@
+/**
+ * route-scanner: enhanced-form detection follows relative imports (#577).
+ */
+import { assertEquals } from 'jsr:@std/assert@^1.0.0';
+import { join } from 'jsr:@std/path@^1.0.0';
+import { scanRoutes } from '../src/internal/ssg/index.ts';
+
+Deno.test('scanRoutes detects data-open-enhance inside an imported component (#577)', async () => {
+  const dir = await Deno.makeTempDir({ prefix: 'oe-scan-enhance-' });
+  try {
+    const routesDir = join(dir, 'routes');
+    const componentsDir = join(dir, 'components');
+    await Deno.mkdir(routesDir, { recursive: true });
+    await Deno.mkdir(componentsDir, { recursive: true });
+    await Deno.writeTextFile(
+      join(componentsDir, 'the-form.tsx'),
+      `export function TheForm() {
+  return (
+    <form method='post' data-open-enhance>
+      <button type='submit'>Go</button>
+    </form>
+  );
+}
+`,
+    );
+    // The route's own source carries NO enhance attribute — only the import.
+    await Deno.writeTextFile(
+      join(routesDir, 'index.tsx'),
+      `import { TheForm } from '../components/the-form.tsx';
+export const tagName = 'page-index';
+export default function Page() {
+  return <TheForm />;
+}
+`,
+    );
+    // A prose mention in an unrelated route must NOT trigger.
+    await Deno.writeTextFile(
+      join(routesDir, 'about.tsx'),
+      `export const tagName = 'page-about';
+// data-open-enhance is mentioned here only as prose.
+export default function Page() {
+  return <p>about</p>;
+}
+`,
+    );
+
+    const entries = await scanRoutes(routesDir);
+    const index = entries.find((e) => e.path === '/');
+    const about = entries.find((e) => e.path === '/about');
+    assertEquals(index?.hasEnhancedForms, true, 'imported component form must be detected');
+    assertEquals(about?.hasEnhancedForms, undefined, 'prose mention must not trigger');
+  } finally {
+    await Deno.remove(dir, { recursive: true }).catch(() => {});
+  }
+});
diff --git a/packages/adapter-vite/deno.json b/packages/adapter-vite/deno.json
index bb4114df3..b527a9bf7 100644
--- a/packages/adapter-vite/deno.json
+++ b/packages/adapter-vite/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/adapter-vite",
-  "version": "0.42.0-alpha.5",
+  "version": "0.42.0-alpha.6",
   "exports": {
     ".": "./src/index.ts",
     "./nitro-mount": "./src/nitro-mount.ts",
diff --git a/packages/adapter-vite/src/internal/ssg/entry-generators.ts b/packages/adapter-vite/src/internal/ssg/entry-generators.ts
index b3915fb51..438dd81fc 100644
--- a/packages/adapter-vite/src/internal/ssg/entry-generators.ts
+++ b/packages/adapter-vite/src/internal/ssg/entry-generators.ts
@@ -174,7 +174,11 @@ var __tags = [${tags}];
 
 function __load(tag) {
   if (__map[tag]) {
-    __map[tag]().catch(function(e) { log.warn(tag, e); });
+    __map[tag]().then(function () {
+      // #584: late-hydrating islands create their shadow roots after the
+      // ready-time scan; rescan so enhanced forms inside them are heard.
+      setTimeout(function () { __scanSubmitRoots(document); }, 0);
+    }).catch(function(e) { log.warn(tag, e); });
     __map[tag] = null;
   }
 }
@@ -330,15 +334,32 @@ function __islandIntact(oldEl, newEl) {
     }
     return out;
   }
+  function kidsEqual(o, nn) {
+    // #582: nested DSD compares normalized on both sides — the live subtree
+    // already consumed its template, the fresh parse still carries it, so a
+    // raw outerHTML comparison would always judge the island 'changed'.
+    if (o.nodeType !== nn.nodeType) return false;
+    if (o.nodeType === 3) return o.data === nn.data;
+    if (o.nodeType !== 1) return true;
+    if (o.tagName !== nn.tagName) return false;
+    if (o.attributes.length !== nn.attributes.length) return false;
+    for (var a = 0; a < nn.attributes.length; a++) {
+      var attr = nn.attributes[a];
+      if (o.getAttribute(attr.name) !== attr.value) return false;
+    }
+    var oks = significantKids(o, true);
+    var nks = significantKids(nn, true);
+    if (oks.length !== nks.length) return false;
+    for (var i = 0; i < oks.length; i++) {
+      if (!kidsEqual(oks[i], nks[i])) return false;
+    }
+    return true;
+  }
   var newKids = significantKids(newEl, true);
   var oldKids = significantKids(oldEl, true);
   if (oldKids.length !== newKids.length) return false;
   for (var m = 0; m < newKids.length; m++) {
-    var o = oldKids[m];
-    var nn = newKids[m];
-    if (o.nodeType !== nn.nodeType) return false;
-    if (o.nodeType === 3 && o.data !== nn.data) return false;
-    if (o.nodeType === 1 && o.outerHTML !== nn.outerHTML) return false;
+    if (!kidsEqual(oldKids[m], newKids[m])) return false;
   }
   return true;
 }
@@ -347,58 +368,80 @@ function __compatible(a, b) {
   return a.nodeType === b.nodeType && (a.nodeType !== 1 || a.tagName === b.tagName);
 }
 
+function __instantiateDsd(node) {
+  // #579: DSD is only instantiated by the HTML parser; a DOMParser-parsed
+  // node inserted into the live tree keeps an inert <template> child and the
+  // island would render client-initial content instead of the server's.
+  // Instantiate declarative shadow roots manually so upgrades hydrate the
+  // server-rendered content. Runs after insertion (upgrade reactions fire
+  // after this synchronous code, so the DSD path is taken).
+  if (node.nodeType !== 1) return;
+  var templates = node.querySelectorAll('template[shadowrootmode]');
+  for (var i = 0; i < templates.length; i++) {
+    var template = templates[i];
+    var host = template.parentNode;
+    if (!host || host.shadowRoot) continue;
+    var root = host.attachShadow({ mode: template.getAttribute('shadowrootmode') });
+    root.appendChild(template.content);
+    template.remove();
+  }
+}
+
 function __morphChildren(oldParent, newParent) {
-  // ADR-0121 §9 (#554): id-keyed matching first, then a structural walk with
-  // bounded lookahead — insertions and removals between compatible anchors
-  // are preserved instead of cascading into wholesale replacement.
+  // ADR-0121 §9 (#554, rewritten for #580): an ordered walk. Old children
+  // are indexed by id (id'd nodes are consumed ONLY by an id match); each
+  // new child in order matches by id else structurally ahead of the
+  // reference point; the match is morphed and MOVED into position (moves
+  // preserve shadow roots and state); unmatched new nodes are inserted in
+  // place (with DSD instantiation); only never-matched old nodes are
+  // removed — there is no lookahead window, so deletion is exact.
   var oldKids = Array.prototype.slice.call(oldParent.childNodes);
   var newKids = Array.prototype.slice.call(newParent.childNodes);
-  var byId = {};
-  for (var j = 0; j < newKids.length; j++) {
-    var cand = newKids[j];
-    if (cand.nodeType === 1 && cand.id && !byId[cand.id]) byId[cand.id] = cand;
-  }
-  var usedNew = [];
-  var pairs = [];
+  var oldById = {};
   for (var i = 0; i < oldKids.length; i++) {
-    var o = oldKids[i];
-    var match = null;
-    if (o.nodeType === 1 && o.id && byId[o.id] && usedNew.indexOf(byId[o.id]) === -1 &&
-        __compatible(o, byId[o.id])) {
-      match = byId[o.id];
-      usedNew.push(match);
-    }
-    pairs.push([o, match]);
-  }
-  var remainingNew = [];
-  for (var r = 0; r < newKids.length; r++) {
-    if (usedNew.indexOf(newKids[r]) === -1) remainingNew.push(newKids[r]);
-  }
-  var ni = 0;
-  for (var p = 0; p < pairs.length; p++) {
-    var oldEl = pairs[p][0];
-    var paired = pairs[p][1];
-    if (paired) {
-      __morphNode(oldEl, paired);
-      continue;
-    }
-    var found = -1;
-    for (var w = ni; w < Math.min(ni + 4, remainingNew.length); w++) {
-      if (__compatible(oldEl, remainingNew[w])) { found = w; break; }
+    var ok = oldKids[i];
+    if (ok.nodeType === 1 && ok.id && !oldById[ok.id]) oldById[ok.id] = ok;
+  }
+  var usedOld = [];
+  var ref = oldParent.firstChild;
+  for (var j = 0; j < newKids.length; j++) {
+    var n = newKids[j];
+    var o = null;
+    if (n.nodeType === 1 && n.id && oldById[n.id] && usedOld.indexOf(oldById[n.id]) === -1 &&
+        __compatible(oldById[n.id], n)) {
+      o = oldById[n.id];
+    } else {
+      var c = ref;
+      while (c) {
+        if (usedOld.indexOf(c) === -1 && __compatible(c, n) &&
+            !(c.nodeType === 1 && c.id && oldById[c.id] === c)) {
+          o = c;
+          break;
+        }
+        c = c.nextSibling;
+      }
     }
-    if (found !== -1) {
-      for (var ins = ni; ins < found; ins++) oldParent.insertBefore(remainingNew[ins], oldEl);
-      __morphNode(oldEl, remainingNew[found]);
-      ni = found + 1;
+    if (o) {
+      usedOld.push(o);
+      __morphNode(o, n);
+      if (o !== ref) oldParent.insertBefore(o, ref);
+      ref = o.nextSibling;
     } else {
-      oldEl.remove();
+      // Instantiate BEFORE insertion: upgrade reactions for a defined custom
+      // element fire synchronously with the DOM call, and the hydration path
+      // must already find the server-rendered shadow content (#579).
+      __instantiateDsd(n);
+      oldParent.insertBefore(n, ref);
     }
   }
-  for (var tail = ni; tail < remainingNew.length; tail++) oldParent.appendChild(remainingNew[tail]);
+  for (var k = 0; k < oldKids.length; k++) {
+    if (usedOld.indexOf(oldKids[k]) === -1) oldKids[k].remove();
+  }
 }
 
 function __morphNode(oldEl, newEl) {
   if (!__compatible(oldEl, newEl)) {
+    __instantiateDsd(newEl);
     oldEl.replaceWith(newEl);
     return;
   }
@@ -418,7 +461,10 @@ function __morphNode(oldEl, newEl) {
   if (isIsland) {
     if (__islandIntact(oldEl, newEl)) return;
     if (oldEl.shadowRoot) {
-      // Hydrated island whose surface changed: replace (state resets by design).
+      // Hydrated island whose surface changed: replace (state resets by
+      // design); the replacement is DSD-instantiated BEFORE the swap so the
+      // upgrade hydrates the server's render, not a client-initial one (#579).
+      __instantiateDsd(newEl);
       oldEl.replaceWith(newEl);
       return;
     }
@@ -472,6 +518,9 @@ function __morphDocument(html, form, regionName) {
         __morphNode(oldScope, newScope);
         return true;
       }
+      // #589: a scoped morph that cannot find its region is a navigation,
+      // and it should say so (silent navigations were the round-2 DX finding).
+      log.warn('data-open-region "' + name + '" missing on one side; navigating instead of morphing');
       return false;
     }
   }
@@ -488,7 +537,11 @@ function __attachSubmit(root) {
 function __scanSubmitRoots(root) {
   // The submit event is not reliably composed across engines, so enhanced
   // forms inside shadow roots are intercepted at the root. Idempotent; runs
-  // at ready time and after every morph (new hosts may appear).
+  // at ready time and after every morph (new hosts may appear). Roots
+  // detached by earlier morphs are pruned (#588).
+  __submitRoots = __submitRoots.filter(function (r) {
+    return r === document || r.isConnected !== false;
+  });
   var all = root.querySelectorAll('*');
   for (var i = 0; i < all.length; i++) {
     var el = all[i];
@@ -500,7 +553,22 @@ function __scanSubmitRoots(root) {
 }
 
 var __submitSeq = 0;
-var __enhancedNav = false;
+// #578: the marker lives in sessionStorage so it survives a page reload
+// (a memory variable resets, and Back after a reload would show stale
+// content for the restored URL — the exact thing §10 forbids).
+var __NAV_KEY = 'openelement:enhanced-nav';
+function __markEnhancedNav() {
+  try {
+    sessionStorage.setItem(__NAV_KEY, '1');
+  } catch (e) { /* privacy modes */ }
+}
+function __hasEnhancedNav() {
+  try {
+    return sessionStorage.getItem(__NAV_KEY) === '1';
+  } catch (e) {
+    return false;
+  }
+}
 function __onSubmit(event) {
   var form = event.target;
   if (!(form instanceof HTMLFormElement)) return;
@@ -514,7 +582,11 @@ function __onSubmit(event) {
   form.__openElementBusy = true;
   var seq = ++__submitSeq;
   var submitter = event.submitter;
-  var actionUrl = (submitter && submitter.formAction) || form.action || window.location.href;
+  // #576: the formAction IDL attribute returns the document URL when no
+  // formaction attribute is present, so it must only win when the attribute
+  // exists — otherwise form.action (the declared address) is ignored.
+  var actionUrl = (submitter && submitter.hasAttribute('formaction') && submitter.formAction) ||
+    form.action || window.location.href;
   // #544: the submitter's name/value is part of the body — the body never
   // differs between the two paths (ADR-0120 rule 2).
   var body = submitter ? new FormData(form, submitter) : new FormData(form);
@@ -565,16 +637,27 @@ function __onSubmit(event) {
           target.search === window.location.search;
         var finalUrl = target.href + (samePage && !target.hash ? window.location.hash : '');
         if (finalUrl !== window.location.href) {
-          __enhancedNav = true;
+          __markEnhancedNav();
           history.pushState({}, '', finalUrl);
         }
         return;
       }
     }
     window.location.assign(target.href);
-  }).catch(function () {
+  }).catch(function (err) {
     form.__openElementBusy = false;
-    window.location.reload();
+    // #585: give the app a hook before the reload fallback — a transient
+    // failure must not silently discard in-flight input elsewhere on the
+    // page. preventDefault() suppresses the reload.
+    var proceed = form.dispatchEvent(new CustomEvent('open:action-error', {
+      cancelable: true,
+      detail: { error: err, form: form },
+    }));
+    // #589: the fallback is invisible without a trace — say why.
+    if (proceed) {
+      log.warn('enhanced submit failed; reloading the page', err);
+      window.location.reload();
+    }
   });
 }
 
@@ -584,9 +667,16 @@ __onReady(function () { __scanSubmitRoots(document); });
 // ADR-0121 §10 (#545): enhanced navigation is pushState-based; back/forward
 // reloads the restored URL so content never disagrees with the address bar.
 // The guard keeps the listener inert on pages that never enhanced-navigated
-// (e.g. sites running their own client-side routing on the same bundle).
+// (e.g. sites running their own client-side routing on the same bundle);
+// the marker persists across reloads via sessionStorage (#578).
 window.addEventListener('popstate', function () {
-  if (__enhancedNav) window.location.reload();
+  if (__hasEnhancedNav()) window.location.reload();
+});
+// bfcache restores do not fire popstate (Firefox restores the morphed
+// document as-is); a persisted pageshow with the marker set is the same
+// situation and must also reload.
+window.addEventListener('pageshow', function (event) {
+  if (event.persisted && __hasEnhancedNav()) window.location.reload();
 });
 `
       : '// No data-open-enhance forms: the form enhancement layer is omitted (#569 complement),\n// keeping the client bundle free of morph and popstate code.'
diff --git a/packages/adapter-vite/src/internal/ssg/entry-render-helpers.ts b/packages/adapter-vite/src/internal/ssg/entry-render-helpers.ts
index e286b2e9f..398a78734 100644
--- a/packages/adapter-vite/src/internal/ssg/entry-render-helpers.ts
+++ b/packages/adapter-vite/src/internal/ssg/entry-render-helpers.ts
@@ -239,7 +239,24 @@ export function renderRouteHandler(
       }, cspNonce: c.get('cspNonce') }), 404);`,
     );
     lines.push(`    }`);
-    lines.push(`    const __formData = await c.req.raw.formData();`);
+    lines.push(`    let __formData;`);
+    // ADR-0121 (#581): an unparseable body is a client error, not a 500.
+    lines.push(`    try {`);
+    lines.push(`      __formData = await c.req.raw.formData();`);
+    lines.push(`    } catch {`);
+    lines.push(`      if (__isFetch) {`);
+    lines.push(
+      `        return c.json({ type: 'error', status: 400, error: { message: 'Could not parse the form body.' } }, 400);`,
+    );
+    lines.push(`      }`);
+    lines.push(
+      `      return c.html(wrapInDocument(__statusHtml('400 Bad Request', 'Could not parse the form body.'), { title: '400 Bad Request', lang: ${
+        jsStringLiteral(docConfig.lang)
+      }, headExtras: ${headExtrasExpr}, allowHeadExtrasScripts: ${
+        JSON.stringify(docConfig.allowHeadExtrasScripts)
+      }, cspNonce: c.get('cspNonce') }), 400);`,
+    );
+    lines.push(`    }`);
     lines.push(
       `    const __actionResult = await __actionFn({ ...__loadContext, formData: __formData });`,
     );
@@ -435,11 +452,11 @@ export function renderActionRoute(
   // ADR-0121 (#572): only GET/POST are defined for page routes — other
   // methods get a defined 405 instead of the server fallback 404. The
   // method-specific handlers above are registered first and win for
-  // GET/POST/HEAD.
+  // GET/POST/HEAD. no-store/Vary apply to the 405 as well (#586).
   lines.push(
     `app.all(${
       jsStringLiteral(route.path)
-    }, (c) => c.text('Method Not Allowed', 405, { Allow: 'GET, POST' }));`,
+    }, (c) => { c.header('Cache-Control', 'no-store'); c.header('Vary', 'x-openelement-action'); return c.text('Method Not Allowed', 405, { Allow: 'GET, POST' }); });`,
   );
   lines.push('');
 }
diff --git a/packages/adapter-vite/src/internal/ssg/route-scanner.ts b/packages/adapter-vite/src/internal/ssg/route-scanner.ts
index 5af3cd544..e565ddc31 100644
--- a/packages/adapter-vite/src/internal/ssg/route-scanner.ts
+++ b/packages/adapter-vite/src/internal/ssg/route-scanner.ts
@@ -51,9 +51,44 @@
 import type { RouteEntry, SpecialFileType } from '../protocol/framework.ts';
 import { createLogger } from '@openelement/element';
 import { normalizeSeparators, pathToTagName } from '@openelement/element/build-utils';
-import { join, posix, sep } from 'node:path';
+import { dirname, join, posix, sep } from 'node:path';
 import { safeReadDir, safeReadFile, safeStat } from './route-scanner-fs.ts';
 
+/** data-open-enhance in attribute form (= or >), so prose never triggers (#569). */
+const ENHANCED_FORM_RE = /data-open-enhance\s*(?:=|>)/;
+const RELATIVE_IMPORT_RE = /^import\s[^'"]*from\s*['"](\.[^'"]+)['"]/gm;
+const IMPORT_EXTENSIONS = ['.tsx', '.ts', '.jsx', '.js'];
+
+/**
+ * #577: a page's enhanced form may live in an imported component — scanning
+ * only the route source would silently drop the enhancement layer. Follow
+ * project-local relative imports (bounded depth, cycle-safe) and scan those
+ * sources too.
+ */
+async function sourceTreeHasEnhancedForms(
+  filePath: string,
+  source: string,
+  depth = 0,
+  seen: Set<string> = new Set(),
+): Promise<boolean> {
+  if (ENHANCED_FORM_RE.test(source)) return true;
+  if (depth >= 3 || seen.has(filePath)) return false;
+  seen.add(filePath);
+  const dir = dirname(filePath);
+  for (const match of source.matchAll(RELATIVE_IMPORT_RE)) {
+    const specifier = match[1];
+    const candidates = [specifier, ...IMPORT_EXTENSIONS.map((ext) => specifier + ext)];
+    for (const rel of candidates) {
+      const candidate = join(dir, rel);
+      const imported = await safeReadFile(candidate);
+      if (imported === undefined) continue;
+      if (await sourceTreeHasEnhancedForms(candidate, imported, depth + 1, seen)) return true;
+      break;
+    }
+  }
+  return false;
+}
+
 const log = createLogger('core');
 
 /** Read a static route tagName export from source text. */
@@ -243,8 +278,9 @@ export async function scanRoutes(
           // #569: page sources carrying data-open-enhance require the client
           // enhancement layer even when the app has zero islands. The match
           // requires attribute shape (= or >) so prose mentioning the
-          // attribute (e.g. guide pages) does not pull the layer in.
-          ...(source !== undefined && /data-open-enhance\s*(?:=|>)/.test(source)
+          // attribute (e.g. guide pages) does not pull the layer in. #577:
+          // follow relative imports so forms inside shared components count.
+          ...(source !== undefined && await sourceTreeHasEnhancedForms(fullPath, source)
             ? { hasEnhancedForms: true }
             : {}),
           ...(options.includeSource && source !== undefined ? { source } : {}),
diff --git a/packages/app/__tests__/authoring.test.tsx b/packages/app/__tests__/authoring.test.tsx
index 7376e305b..d3cb495f0 100644
--- a/packages/app/__tests__/authoring.test.tsx
+++ b/packages/app/__tests__/authoring.test.tsx
@@ -181,6 +181,41 @@ Deno.test('redirect() and notFound() expose typed lifecycle control errors', ()
   assertEquals((notFoundError as { status: number }).status, 404);
 });
 
+Deno.test('redirect() validates the 3xx whitelist at construction (ADR-0121 §3)', () => {
+  // Valid statuses construct fine.
+  for (const status of [301, 302, 303, 307, 308]) {
+    let err: unknown;
+    try {
+      redirect('/target', status);
+    } catch (error) {
+      err = error;
+    }
+    assertEquals(isOpenElementRedirect(err), true, `status ${status} must be accepted`);
+  }
+  // A non-3xx "redirect" is a response the browser never follows — reject it.
+  for (const status of [200, 201, 204, 400, 404, 418, 500]) {
+    assertThrows(
+      () => redirect('/target', status as never),
+      Error,
+      'redirect() status must be one of 301/302/303/307/308',
+    );
+  }
+  // The duck-typed guard honors the same whitelist (#583): a shaped object
+  // with an arbitrary status must not take the redirect channel.
+  assertEquals(
+    isOpenElementRedirect({
+      name: 'OpenElementRedirect',
+      location: 'https://evil.example',
+      status: 200,
+    }),
+    false,
+  );
+  assertEquals(
+    isOpenElementRedirect({ name: 'OpenElementRedirect', location: '/ok', status: 303 }),
+    true,
+  );
+});
+
 Deno.test('defineElement() validates custom element tag names', () => {
   assertThrows(
     () => {
diff --git a/packages/app/deno.json b/packages/app/deno.json
index 8323baa31..9e87e937f 100644
--- a/packages/app/deno.json
+++ b/packages/app/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/app",
-  "version": "0.42.0-alpha.5",
+  "version": "0.42.0-alpha.6",
   "exports": {
     ".": "./src/index.ts",
     "./hono": "./src/hono.ts",
diff --git a/packages/app/src/authoring.ts b/packages/app/src/authoring.ts
index 72d579bc8..37878a89a 100644
--- a/packages/app/src/authoring.ts
+++ b/packages/app/src/authoring.ts
@@ -93,7 +93,11 @@ export function isOpenElementRedirect(error: unknown): error is OpenElementRedir
       error !== null &&
       (error as { name?: unknown }).name === 'OpenElementRedirect' &&
       typeof (error as { location?: unknown }).location === 'string' &&
-      typeof (error as { status?: unknown }).status === 'number'
+      typeof (error as { status?: unknown }).status === 'number' &&
+      // ADR-0121 (#583): the duck-typed branch honors the same whitelist —
+      // a shaped object must not smuggle an arbitrary status into the
+      // redirect channel.
+      REDIRECT_STATUSES.has((error as { status: number }).status)
     );
 }
 
diff --git a/packages/create/deno.json b/packages/create/deno.json
index 750e84744..5802b4dc4 100644
--- a/packages/create/deno.json
+++ b/packages/create/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/create",
-  "version": "0.42.0-alpha.5",
+  "version": "0.42.0-alpha.6",
   "exports": "./src/cli.ts",
   "imports": {},
   "tasks": {
diff --git a/packages/create/src/version.ts b/packages/create/src/version.ts
index d90d756ec..fb5d24b63 100644
--- a/packages/create/src/version.ts
+++ b/packages/create/src/version.ts
@@ -1,2 +1,2 @@
 /** The published CLI version, embedded so packed npm installs are self-contained. */
-export const CREATE_VERSION = '0.42.0-alpha.5';
+export const CREATE_VERSION = '0.42.0-alpha.6';
diff --git a/packages/element/deno.json b/packages/element/deno.json
index 28c55c07f..d96e7962d 100644
--- a/packages/element/deno.json
+++ b/packages/element/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/element",
-  "version": "0.42.0-alpha.5",
+  "version": "0.42.0-alpha.6",
   "exports": {
     ".": "./src/index.ts",
     "./jsx-runtime": "./src/jsx-runtime.ts",
diff --git a/packages/ui/deno.json b/packages/ui/deno.json
index 7cd278ada..ccd414c7b 100644
--- a/packages/ui/deno.json
+++ b/packages/ui/deno.json
@@ -1,6 +1,6 @@
 {
   "name": "@openelement/ui",
-  "version": "0.42.0-alpha.5",
+  "version": "0.42.0-alpha.6",
   "exports": {
     ".": "./src/index.ts",
     "./open-button": "./src/open-button.tsx",
diff --git a/packages/ui/src/generated-manifest.json b/packages/ui/src/generated-manifest.json
index 71dd4b263..5285b62f4 100644
--- a/packages/ui/src/generated-manifest.json
+++ b/packages/ui/src/generated-manifest.json
@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "packageName": "@openelement/ui",
-  "version": "0.42.0-alpha.5",
+  "version": "0.42.0-alpha.6",
   "description": "Open Props Web Component library for openElement",
   "author": "openElement",
   "license": "MIT",
diff --git a/tools/check-public-docs-integrity.ts b/tools/check-public-docs-integrity.ts
index 0d07cdf5b..08c230e67 100644
--- a/tools/check-public-docs-integrity.ts
+++ b/tools/check-public-docs-integrity.ts
@@ -52,7 +52,8 @@ const staleCurrentClaims: RegExp[] = [
   /Vue adapter proof/i,
   /Vue is .*heavy-framework island/i,
   /Vue 是.*heavy-framework island/i,
-  /npm registry (?:line|baseline).*alpha\.6/i,
+  // 0.41-era leftover guard; must not collide with a real 0.42.0-alpha.6.
+  /npm registry (?:line|baseline).*0\.41\.0-alpha\.6/i,
   /active release target.*alpha\.11/i,
   /alpha\.13 was\s+the prior recovery train/i,
   /five-package convergence is published as\s+`?0\.41\.0-alpha\.10/i,
diff --git a/tools/project-constants.ts b/tools/project-constants.ts
index d084e54b3..35d54deb1 100644
--- a/tools/project-constants.ts
+++ b/tools/project-constants.ts
@@ -1,6 +1,6 @@
-export const PACKAGE_VERSION = '0.42.0-alpha.5';
+export const PACKAGE_VERSION = '0.42.0-alpha.6';
 export const PACKAGE_VERSION_TAG = `v${PACKAGE_VERSION}`;
-export const ACTIVE_EXECUTION_VERSION = 'v0.42.0-alpha.5';
+export const ACTIVE_EXECUTION_VERSION = 'v0.42.0-alpha.6';
 export const RETAINED_PACKAGE_NAMES = Object.freeze([
   '@openelement/adapter-vite',
   '@openelement/app',
@@ -49,7 +49,7 @@ export const NITRO_COMPATIBILITY_DATE = '2026-06-12';
 // single source of truth for the "from" side of version-anchor replacements
 // (see buildVersionAnchorReplacements in tools/autoflow/release.ts). It is
 // kept in sync automatically by updateProjectConstants() during a bump.
-export const PREVIOUS_PACKAGE_VERSION = '0.42.0-alpha.4';
+export const PREVIOUS_PACKAGE_VERSION = '0.42.0-alpha.5';
 export const PREVIOUS_PACKAGE_VERSION_TAG = `v${PREVIOUS_PACKAGE_VERSION}`;
 
 // The theme the www roadmap current-line timeline entry carried immediately
@@ -60,7 +60,7 @@ export const PREVIOUS_PACKAGE_VERSION_TAG = `v${PREVIOUS_PACKAGE_VERSION}`;
 // sweep' describing alpha.19 under the v0.41.1 entry). The bump side
 // re-records this constant from the pre-bump entry; bootstrap value
 // documents the incident.
-export const PREVIOUS_RELEASE_THEME = 'hardening and recipes';
+export const PREVIOUS_RELEASE_THEME = 'audit round 1 remediation';
 
 /**
  * Version strings that must never reappear in the head anchor zone of the
diff --git a/www/app/data/version.ts b/www/app/data/version.ts
index 443a6d65d..2fb8aa651 100644
--- a/www/app/data/version.ts
+++ b/www/app/data/version.ts
@@ -1,2 +1,2 @@
 // Current published package line. Release tooling owns the next bump.
-export const OPENELEMENT_VERSION = 'v0.42.0-alpha.5';
+export const OPENELEMENT_VERSION = 'v0.42.0-alpha.6';
diff --git a/www/app/routes/roadmap.tsx b/www/app/routes/roadmap.tsx
index 01346cf82..871eb139f 100644
--- a/www/app/routes/roadmap.tsx
+++ b/www/app/routes/roadmap.tsx
@@ -332,10 +332,10 @@ type TimelineEntry = {
 
 const entries: TimelineEntry[] = [
   {
-    version: 'v0.42.0-alpha.5',
-    theme: 'audit round 1 remediation',
+    version: 'v0.42.0-alpha.6',
+    theme: 'audit round 2 remediation',
     copy:
-      'The first implementation audit of the application loop closes 35 issues: ADR-0121 protocol hardening, a morph client rewrite (the earlier enhancement never fired), and an evidence-honesty sweep with the fixture suite now gated in CI.',
+      'The second independent review closes 18 issues: explicit form actions win on enhanced submits, morphed-in islands show the server render, morph matching is an ordered walk, and enhancement detection follows imports.',
     state: 'stable',
     stamp: 'CURRENT',
   },
@@ -420,7 +420,7 @@ export class RoadmapPage extends OpenElement {
               {entries.map((phase) => {
                 // The current-line stamp follows the bump-maintained anchor so a
                 // release bump re-marks the timeline without manual edits.
-                const stamp = phase.version === 'v0.42.0-alpha.5' ? 'CURRENT' : phase.stamp;
+                const stamp = phase.version === 'v0.42.0-alpha.6' ? 'CURRENT' : phase.stamp;
                 return (
                   <div class={`tl-row tl-${phase.state}`}>
                     <span class='tl-node' aria-hidden='true'></span>