Problem

wordpress.editor-actions cannot save an edited post through the local preview proxy. Gutenberg runs at the proxy origin, but its REST request targets the upstream Playground origin. The browser rejects the preflight because x-http-method-override is not included in Access-Control-Allow-Headers.

Observed console error:

Access to fetch at 'http://127.0.0.1:<upstream>/wp-json/wp/v2/pages/5?_locale=user'
from origin 'http://127.0.0.1:<proxy>' has been blocked by CORS policy:
Request header field x-http-method-override is not allowed by Access-Control-Allow-Headers in preflight response.

The editor action reports:

wp-codebox-editor-save-failed: core/editor savePost reported a failed request

Reproduction

Run a wp-codebox/workspace-recipe/v1 recipe that:

1. Creates or imports a page.
2. Runs wordpress.editor-actions against that page.
3. Uses steps-json with updateBlockAttributes, savePost, reload, and inspectState.
4. Uses the normal local preview proxy.

The attribute mutation succeeds and marks the editor dirty, but savePost fails at the REST preflight. This reproduces with a valid custom block mutation that changes serialized content and has zero editor-invalid warnings.

Evidence

• WP Codebox workspace version: 0.15.0
• WordPress build: latest (7.0.2 in the observed run)
• Mutation before SHA-256: a84a68c808610ea1cc0215444b3293e52386ba0677eec555785190d1a2734114
• Mutation after SHA-256: bbf8f7545ed529942db05411412d1759b2f1aabc80423435499217fc1c39420b
• Editor validity after mutation: clean, zero warnings
• Save request: blocked by proxy/upstream cross-origin preflight

Expected

Editor REST traffic remains same-origin through the preview proxy, or the proxy/upstream preflight permits the headers Gutenberg sends, including x-http-method-override. savePost, reload, and post-reload inspection then complete successfully.

Acceptance Criteria

• A real wordpress.editor-actions sequence can mutate, save, reload, and inspect an existing page through the local preview proxy.
• The saved content identity matches the edited content identity after reload.
• A follow-up wordpress.editor-validate-blocks run reports zero invalid blocks.
• Add deterministic coverage for Gutenberg REST requests that send x-http-method-override through the preview proxy.