feat(adapters): envelope the hono adapter's two discovery bodies (#9436)

[huangyiirene]

Fixes#9436

Maintainer ruling on that card (2026-08-18, option A, recorded 22:30:43Z): envelope both discovery bodies. GET {prefix} and GET {prefix}/discovery in packages/adapters/hono/src/index.ts now answer { success: true, data } instead of bare { data }. The ruling deliberately does not inherit #9389's pre-auth exemption — these bodies are read by SDKs, codegen and AI clients, and the migration is one key.

Reader sweep (ruled to run first — it did)

Every reported search ran with a control; no zero was accepted without one.

• @objectstack/clientconnect() (packages/client/src/index.ts 531-532, 557-558): unwraps body.data || body on both the /api/v1/discovery probe and the .well-known fallback — bare, { data }, and { success, data } all resolve to the same document. Unaffected.
• QA http-adapter (packages/core/src/qa/http-adapter.tsresolveDataMount()): discriminates on 'routes' in body, else reads body.data. The new shape falls to body.data. Unaffected.
• http-conformance integration test: body.data?.routes ?? body.routes. Unaffected.
• objectui (cross-repo, read-only sweep): ConditionalAuthWrapper.tsx and data-objectstack/src/index.ts unwrap only when typeof body.success === 'boolean' && 'data' in body — today's bare { data } fails that test; the post-flip shape satisfies it, so those readers now unwrap this mount correctly. ConnectAgentWidget.tsx uses the tolerant (json?.data ?? json)?.routes. No intolerant reader; no cross-repo flip needed, so no Blocked-by split.
• Controls: .well-known/objectstack literal — 20 files subject, 20 on the intolerant spelling; objectui fetch( count 156 (nonzero harness); examples tree 197 ts files scanned, zero discovery readers (both hits were prose); cli 7 discovery mentions, all comments, against 17 fetch( sites.
• The adapter's own tests were the only exact-shape assertions found; they are updated and strengthened here (six success: true pins added).

Gate table (scripts/check-route-envelope.mjs)

• This file's entry graduates to conformant {} with a conversion comment; its ratchet/note drop per the gate's own last-counter rule.
• The exempt-block header prose now records the adapters/hono's two bare { data } discovery bodies lose their ratchet owner when #9364 lands #9436 ruling as the other side of [Decision] Pre-auth discovery/bootstrap payloads: inside BaseResponseSchema (coordinated objectui flip) or ruled exempt with reasons — today they are neither #9389's boundary (who reads the body decides), replacing the text that carried the fork as open.
• Premise delta (dispatch brief Zone 2b): the card's "four ratchet entries name 20 hand-built plugin-route bodies depart from the declared envelope — the ratchet #9267's third gate surface opened with #9364" was already discharged on main before this PR — PR chore(lint): record the ruled pre-auth exemption in the route-envelope gate #9455 had converted the three [Decision] Pre-auth discovery/bootstrap payloads: inside BaseResponseSchema (coordinated objectui flip) or ruled exempt with reasons — today they are neither #9389 files to exempt entries (no ratchet field) and had repointed this file's ratchet at adapters/hono's two bare { data } discovery bodies lose their ratchet owner when #9364 lands #9436. No pointer edits remained beyond this file's entry graduating; zero counters moved by pointer work. The two '#9364' strings still in the file are self-test fixture literals, not table entries.

Verification (all readings at head c938eea)

• check:route-envelope before: 11 modules, 161 bodies — 7 conformant, 1 ratcheted (this file, unenveloped 2), 3 exempt; exit 0. After: 8 conformant, 0 ratcheted, 3 exempt; exit 0, self-test green. The unenveloped counter is what dropped, 2 → 0, confirming Zone 2a — success: true was the only key the gate needed.
• Reverse verification, from the committed state: de-enveloping one body turned the gate red (exit 1, "unenveloped: found 1, declared 0") and exactly the 3 test pins on that route red (70 passed / 3 failed); restore via checkout from the branch, gate green again. The vitest legs resolve ./index relatively (source path, no dist in the chain), so no rebuild was involved in either leg — stated per ablation discipline.
• pnpm --filter @objectstack/hono test: 73/73 passed (2 files), exit 0. tsc --noEmit on the package: exit 0.
• Derived union (node scripts/pm/dispatch-gates.mjs, no hand-fed paths — 4 paths matched, exactly this PR's files): check:changeset-gate-self-tests, check:cross-package-test-inputs, check:objectui-changeset, check:route-envelope, check:test-source-alias, check:type-source-resolution, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, docs-audit/check-affected-docs, plus convention-triggered check:query-options-erasure, check:type-check-coverage, check:type-check-debt (full packages closure built first, 70 tasks; re-measure: no entry above its recorded number), check:engine-double-contract, check:where-matcher — all exit 0.
• pnpm lint (run regardless, per the brief — the derivation does not name it): exit 0. check:nul-bytes: green.

Out of scope, filed

• runtime dispatcher's two discovery bodies (.well-known + REST-less {prefix}/discovery fallback) are the machine-read { data } class #9436 ruled on, and sit outside check-route-envelope's scan #9813 remains open and is not addressed here: packages/runtime/src/dispatcher-plugin.ts serves the same { data } discovery shape on /.well-known/objectstack and the REST-less {prefix}/discovery fallback, outside this ruling's named file and outside the envelope gate's scan populations.

Changeset: minor for @objectstack/hono (additive wire change; adr-0087 marker: not-required, no key renamed or removed).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them. ✅

What this run could not see

Coarse fallback — 1 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 06f9848f91fc787e67af32b2f6f88e55b5d93e86 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 4b799c11a02d42149c4f979c854b461fb79ecb0a — the merge of head c938eeabe7bca1594c5425e2aedd270a4e6b7de6 into base 06f9848f91fc787e67af32b2f6f88e55b5d93e86, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 4b799c11a02d42149c4f979c854b461fb79ecb0a && git checkout 4b799c11a02d42149c4f979c854b461fb79ecb0a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 06f9848f91fc787e67af32b2f6f88e55b5d93e86 c938eeabe7bca1594c5425e2aedd270a4e6b7de6 && git checkout -B drift-repro 06f9848f91fc787e67af32b2f6f88e55b5d93e86 && git merge --no-ff c938eeabe7bca1594c5425e2aedd270a4e6b7de6
node scripts/docs-audit/affected-docs.mjs --json 06f9848f91fc787e67af32b2f6f88e55b5d93e86

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.