[parsonsmatt]

Authorization tied to Yesod.isAuthorized makes a focused route test depend on every policy in the application. This prototype lets generated dispatch retain an application-supplied constraint and invoke a handler wrapper using the selected fragment and its parent captures.

setRouteDispatchWrapper wraps ordinary matched endpoints and matched subsite routes, including method mismatches. Subsite misses keep the normal 404 path. setRouteDataGenerator and the exported parseResourceTypes helper let applications generate their own route views; Yesod no longer owns RouteLeaves or its policy traversal. MWB uses these hooks to treat both nested fragments and subsite mounts as delegation to an endpoint's dictionary.

The wrapper runs inside existing middleware and shares the handler's session. Existing users retain their dispatch behavior, and no exported runtime record gains a field. Mounts retain the existing parent-runner contract, including its documented limitation for transitive raw-WAI bypasses. The named authorization and plain handler-wrapper APIs remain available.

Validation: 715 yesod-core examples passed. A separate fixture compiled and ran three focused requests without unrelated policies, and a missing policy was rejected by GHC. The data-extension test covers root, focused, and subsite data splices and verifies dispatch does not invoke it.

The ordinary hspec-yesod suite needs no library changes: validation PR, with 81 examples passing. MWB integration owns the leaf model and migration.