supported_http_methods replaces Pumas default list rather than extending
it, so naming PROPFIND and REPORT had dropped PUT and DELETE — Puma
answered 501 before Rack saw the request, and UnhandledRequests never got
to capture it.

Assisted-by: Claude Opus 5 via Claude Code

diff --git a/config/puma.rb b/config/puma.rb
index ec4bd7a..bbcf25c 100644
--- a/config/puma.rb
+++ b/config/puma.rb
@@ -1,3 +1,8 @@
 
-# Allow WebDAV methods (PROPFIND, REPORT) in addition to standard HTTP methods
-supported_http_methods %w[GET HEAD OPTIONS PROPFIND REPORT]
+# Puma replaces its default method list with this one rather than adding to
+# it, so every method the app answers has to be named here or Puma rejects
+# the request with a 501 before Rack sees it — and UnhandledRequests never
+# gets to capture it. Keep this list matching the privileges advertised in
+# current-user-privilege-set: DAV:write and DAV:bind imply PUT, DAV:unbind
+# implies DELETE (RFC 3744 sections 3.2, 3.9, and 3.10).
+supported_http_methods %w[GET HEAD OPTIONS PROPFIND REPORT PUT DELETE]