From faf1df8a392f0a2352cb0c9ecbce829dd19b80fb Mon Sep 17 00:00:00 2001
From: OpenCode Agent <agent@siax.io>
Date: Thu, 5 Nov 2026 20:00:43 +0100
Subject: [PATCH] chore(0pt): document the canonical-fact machine route (no
 behavior change)

---
 middleware.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/middleware.ts b/middleware.ts
index f183e1e..1af30ef 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -4,7 +4,7 @@
  * Customer calls use verified Zitadel bearer identity and receive immutable
  * x-0pt-verified-* headers. Explicit machine routes may instead use the
  * shared X-Internal-Token convention; mutation handlers verify it again for
- * defence in depth.
+ * defence in depth. The canonical-fact write is one such explicit machine route.
  */
 import { NextResponse, type NextRequest } from 'next/server';
 import { assertAuthConfigSafe, resolveAuthContext } from '@/src/auth/context';