@@ -0,0 +1,51 @@
+---
+'@objectstack/hono': minor
+'@objectstack/plugin-hono-server': minor
+---
+
+fix(hono): `createHonoApp` answers an escaped throw that declares an ADR-0112 envelope as that envelope, not as `500 INTERNAL_ERROR` (#23365)
+
+`@objectstack/hono`'s `createHonoApp` has two catch arms: the auth mount's, and
+the `${prefix}/*` catch-all's around `HttpDispatcher.dispatch()`. Both answered
+an escaped throw from its `statusCode` alone, so a producer that declared
+`status` and a registered `code` lost both on this host. A `GET`, `PATCH` or
+`DELETE` of `/data/:object/:id` for an id that names no row answered
+`500 INTERNAL_ERROR` where the standalone REST server answers
+`404 RECORD_NOT_FOUND`. The `/data` version refusals answered `500` too (a stale
+`If-Match`'s `409 CONCURRENT_UPDATE`, and `If-Match: ""`'s
+`400 VALIDATION_FAILED`), and so did an authorization-store outage
+(`AuthzStoreUnavailableError`, `503 SERVICE_UNAVAILABLE`).
+
+**What changed.** Both arms now answer a throw that carries **both** a declared
+ADR-0112 status (a key of `HttpStatusErrorCodeMap`) **and** a code registered in
+`ErrorCode` as that envelope. The recognition is `declaredEnvelopeForThrow`, the
+rule `@objectstack/plugin-hono-server`'s direct-mount routes have used since
+#16545, so the two Hono doors answer one throw alike by construction: the same
+two conditions, the same 5xx disclosure filter (`looksLikeInternalErrorLeak`),
+and `details` and `userMessage` forwarded only when the producer declared them.
+
+**What did NOT change**, pinned in the same PR through a real `createHonoApp`
+over the real dispatcher and protocol (`packages/qa/http-conformance`):
+
+- a throw that is **not** such an envelope answers what it answered before. A
+  bare `Error` is still `500 INTERNAL_ERROR` carrying `code` and `message`, with
+  no `cause` in the body, and a throw that declares `statusCode` with no
+  registered code keeps that status;
+- ⛔ no error code is minted and no ledger row is added.
+
+`@objectstack/plugin-hono-server` gains one export, `declaredEnvelopeForThrow`,
+which was module-private. `createHonoApp` imports it rather than restating the
+rule. Its behaviour is unchanged.
+
+Earlier entries say a `createHonoApp` host still renders the `/data` version
+refusals as `500`. This change ends that: they are answered `409` and `400` as
+declared.
+
+⚠️ **Known gap, stated rather than left silent.** The `409 CONCURRENT_UPDATE`
+this host now answers carries `code` and `message`, but not the
+`currentVersion` and `currentRecord` that the standalone REST server's `409`
+carries. The recogniser forwards only the `details` a producer declares, and
+those two fields are own properties of the error. That gap is outside this
+change.
+
+Clause-②: yes (widening)