From ecac50591cd56f2dd8018b7470c92c8bc0cdd65a Mon Sep 17 00:00:00 2001
From: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Date: Mon, 27 Jul 2026 20:06:16 +0800
Subject: [PATCH] =?UTF-8?q?docs(hono):=20verdict=20anchor=20on=20the=20cat?=
 =?UTF-8?q?ch-all=20=E2=80=94=20read=20ADR-0076=20OQ#9=20before=20splittin?=
 =?UTF-8?q?g=20into=20per-prefix=20mounts=20(#3608)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The first place anyone (human or agent) tempted to "fix" the catch-all
looks is this line, not the issue tracker. Anchor the #3576 verdict and
the #2852 RLS-leak failure mode here; reopen conditions stay archived
on #3608 (closing as deliberately-unscheduled).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 packages/adapters/hono/src/index.ts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/packages/adapters/hono/src/index.ts b/packages/adapters/hono/src/index.ts
index a060e7053..8aab0c070 100644
--- a/packages/adapters/hono/src/index.ts
+++ b/packages/adapters/hono/src/index.ts
@@ -359,6 +359,16 @@ export function createHonoApp(options: ObjectStackHonoOptions): Hono {
   // ─── Catch-all: delegate to dispatcher.dispatch() ─────────────────────────
   // Handles meta, data, packages, analytics, automation, i18n, ui, openapi,
   // custom API endpoints, and any future routes added to HttpDispatcher.
+  //
+  // DELIBERATE SHAPE — read before "improving" this into explicit per-prefix
+  // mounts (ADR-0076 OQ#9 verdict, #3576 / #3608): dispatch() is a thin
+  // gates+registry pipeline (env resolution → identity → auth gate →
+  // membership → scope strip, then a first-match DomainHandlerRegistry
+  // lookup — enumerable via registry.list()). A naive split into
+  // `app.all(prefix + domain + '/*')` mounts bypasses those cross-cutting
+  // gate stages (the #2852 RLS-leak class: handlers running without an
+  // ExecutionContext). Revisit only if the gate stages are middleware-ized
+  // for an independent reason — reopen conditions are archived on #3608.
   app.all(`${prefix}/*`, async (c) => {
     try {
       const subPath = c.req.path.substring(prefix.length);