fix: the v0.2.0 release-review findings

[dev-bobsong]

Release review of 0.2.0 before tagging. Six findings, five commits; nothing here
changes what a key or a caller may do, except where noted.

Findings

1. Invalid nested <form> — console cache page. cache.tsx wrapped
<ConfirmButton> in a <form>, but that component renders its own. A form
start tag inside a form element pointer is a parse error and gets dropped, so
the inner form never entered the DOM and the dialog's submit button — which
points at it with form="…" — fell back to its ancestor form. "Purge
everything" only worked because the hidden csrf/all=1 inputs were adopted
by the outer form. blocked.tsx and _topbar.tsx already use it standalone.

2. /health?deep=1 was unauthenticated. It costs a D1 query + an R2 LIST
per call and returns the raw driver error, which names the database and the
bucket:

{"checks":{"d1":{"ok":false,"error":"D1_ERROR: db corx-db is inaccessible"},
           "r2":{"ok":false,"error":"R2_ERROR: bucket corx-cache not found"}}}

A free amplification path and a free map of the deployment, neither of which a
liveness probe needs — it uses the shallow form. ?deep=1 now carries the same
guard as /api/* (401 without a credential); the error text is unchanged,
because naming the failing binding is exactly what an operator needs.

3. Unbounded per-isolate memos. guard.ts's blocklistMemo (new in 0.2.0)
and dns-check.ts's resolveCache are keyed by a hostname the caller chooses,
and an isolate never shrinks on its own — so in subdomain mode, an open proxy by
design, cycling distinct hostnames grows the Map to the isolate memory cap. Both
now cap at 4096 entries and clear wholesale. Wholesale is deliberate: partial
eviction needs an LRU and a clock this code does not keep, and a clear can only
cost one extra D1 read — it cannot soften a block, because blocking fails closed
inside the memo.

4. Stale keyId in the purge API. POST /api/cache/purge accepts
{keyId}, but the 400 said "one of: url, host, all" and the c.req.json()
generic omitted the field it reads. README repeated the omission.

5. pending shadowing. The request-body streaming path shadowed pending
— the response header map — with its own pending read, inside a block that
builds a response. No overlap today, so nothing was broken, but a pending.set()
added there would silently stop setting a header. Renamed pendingRead.

6. Six new files lost their trailing newline.

Also

• SECURITY.md gained threat-model rows for per-key scope (0014),
  stale-if-error, and the unauthenticated surface; limitation feat(ui): reimplement all pages with daisyUI (Tailwind v4) #3 now describes
  the edge rate limiter's three costs; a new chore(brand): display the brand name as CORX #7 records the blocklist memo's 30 s
  staleness window and the new size cap.
• README / FEATURES.md document the deep-health gate, the endpoint row, and
  the memo cap.
• The purge on revoke stays awaited, now with the trade documented: the count is
  the console's confirmation and the walk is already bounded by the page budget.

Tests

• cache-purge.test.ts counts <form> nesting depth in the rendered page
  (balanced siblings reach 1, nesting reaches 2), checks every form="…" target
  resolves to a form that exists, and that the 400 names keyId. Verified the
  regression test fails when the wrapper is reintroduced.
• metrics.test.ts pins anonymous ?deep=1 → 401 with the shallow form still
  200, and gives the two deep cases the credential they now need.

Every commit is self-consistent (tsc + vitest run per commit, not just at the
head).

Verify

check · test (47 files / 767) · check:contrast (14/14) · build ·
wrangler deploy --dry-run — all pass locally, matching the verify workflow.
No migrations touched; no env vars or bindings added or changed.

🤖 Generated with Claude Code