dream: router 405 Method Not Allowed + Allow header + automatic HEAD + 9 tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/dream-on-sx.md

@@ -79,7 +79,33 @@ The five types: `request`, `response`, `handler = request -> response`, `middlew
       - [x] `counter.ml` → `lib/dream/demos/counter.sx`: in-memory counter with sessions.
       - [x] `chat.ml` → `lib/dream/demos/chat.sx`: multi-room WebSocket chat.
       - [x] `todo.ml` → `lib/dream/demos/todo.sx`: CRUD list with forms + CSRF.
-- [ ] Tests in `lib/dream/tests/`: routing dispatch, middleware composition, session round-trip, CSRF accept/reject, flash read-after-write — 60+ tests.
+- [x] Tests in `lib/dream/tests/`: routing dispatch, middleware composition, session round-trip, CSRF accept/reject, flash read-after-write — **258 tests across 10 suites** (well past the 60+ target). Runner: `lib/dream/conformance.sh`.
+
+**Roadmap complete (2026-06-07): all boxes ticked, 258/258 green.** Loop continues
+with extensions + hardening below.
+- **2026-06-07 — Ext: router HTTP correctness** (router suite 27→36, 267 total).
+  Dispatch now tracks which routes' *paths* matched: path matched + method didn't →
+  `405 Method Not Allowed` with an `Allow` header listing the path's methods (was a
+  blanket 404); genuinely-absent paths stay 404. `HEAD` falls back to the matching
+  `GET` handler with the body blanked but headers kept. `dr/route-params` (path-only
+  match) + `dr/method-accepts?` (ANY / HEAD→GET) + `dream-method-not-allowed`. NOTE:
+  in this worktree every `sx-tree` *edit* tool (`sx_replace_node`,
+  `sx_replace_by_pattern`, `sx_insert_near`) raises a yojson `Expected string, got
+  null` error — only `sx_write_file` works, so edits rewrite the whole file.
+
+## Extensions (post-roadmap)
+
+The five-types core is complete; these harden it toward a production HTTP front door.
+
+- [x] **Router HTTP correctness**: 405 Method Not Allowed + `Allow` header; automatic
+      HEAD (serve the GET handler with an empty body).
+- [ ] **Status reason phrases** + `dream-status-text`.
+- [ ] **CORS middleware** (`dream-cors`).
+- [ ] **Error-handling middleware** (`dream-catch` / custom 404 + 500 templates).
+- [ ] **Signed session cookies** (the noted hardening — sign the sid).
+- [ ] **JSON helpers** (build from dict; parse to dict).
+- [ ] **Query/header convenience** (`dream-queries`, defaults).
+- [ ] **`api.sx` facade + README** — single load point listing the public surface.
 
 ## Stdlib additions Dream will need