@@ -16,18 +16,19 @@ Clause-②: yes (narrowing)
 - rolled the package back, and the member lost it;
 - reverted the operator's commit, and the member lost it;
 - copied the set, under the same name, into a package of their own, and `GET /meta` then served their copy;
-- discarded the operator's pending draft;
+- discarded the operator's pending draft (through `revert`, and `discard-drafts` is the same discard by a second door);
 - adopted the environment's catalog rows into their own package.
 
 **FROM → TO**, on a `group` or `isolated` deployment, for a caller below the platform operator (the `PLATFORM_ADMIN` rung: the deployment's declared `OS_PLATFORM_OWNER_EMAIL` owner). Every door is on the runtime dispatcher, and each **FROM** is: admitted to any `manage_metadata` holder. Each **TO** is `403 PERMISSION_DENIED`, naming the posture, before the verb runs:
 
-- `POST /api/v1/packages/:id/publish-drafts`, when the package has a pending position or permission-set draft.
+- `POST /api/v1/packages/:id/publish-drafts`, when the package has a pending position, permission-set or capability draft.
 - `POST /api/v1/packages/:id/revert`, when the package has such a draft.
-- `POST /api/v1/packages/:id/rollback`, when a commit it would undo touched a position or permission set.
+- `POST /api/v1/packages/:id/discard-drafts`, when the package has such a draft.
+- `POST /api/v1/packages/:id/rollback`, when a commit it would undo touched a position, permission set or capability.
 - `POST /api/v1/packages/:id/commits/:commitId/revert`, when that commit touched one. The commit's own items are judged: the verb takes the commit id alone, so the URL's package segment changes nothing.
-- `POST /api/v1/packages/:id/duplicate`, when the source package holds one.
+- `POST /api/v1/packages/:id/duplicate`, when the source package's published environment rows (the ones it copies) hold one.
 - `POST /api/v1/packages/:id/adopt-orphans`, when the environment's orphaned rows include one.
 
 **Unchanged.** A package whose drafts, commits or rows carry no catalog item is handled as before, for the same callers. The platform operator runs every verb as before. Under `single` (and with no `tenancy` service) nothing changes, and no extra read happens: the verdict is asked before the items are read.
 
-**The remedy.** The platform operator publishes, rolls back, reverts, duplicates and adopts catalog-carrying packages. `@objectstack/spec` registers the change as the ADR-0087 semantic entry `walled-catalog-package-verbs-retired`. Every door asks the one predicate the catalog's other write doors ask, `walledCatalogWriteVerdict` (`@objectstack/metadata-core`), through the same helper as the package delete.
+**The remedy.** The platform operator publishes, discards, rolls back, reverts, duplicates and adopts catalog-carrying packages. `@objectstack/spec` registers the change as the ADR-0087 semantic entry `walled-catalog-package-verbs-retired`. Every door asks the one predicate the catalog's other write doors ask, `walledCatalogWriteVerdict` (`@objectstack/metadata-core`), through the same helper as the package delete.
@@ -129,15 +129,15 @@ other caller is refused `403 PERMISSION_DENIED` (ADR-0131 D3).
 
 The package's other write verbs follow the same rule under a wall, judged by
 the items each one acts on:
-- `POST /packages/:id/publish-drafts` and `POST /packages/:id/revert`, by the
-  package's pending drafts;
+- `POST /packages/:id/publish-drafts`, `POST /packages/:id/discard-drafts` and
+  `POST /packages/:id/revert`, by the package's pending drafts;
 - `POST /packages/:id/rollback`, by the commits it would undo;
 - `POST /packages/:id/commits/:commitId/revert`, by that commit's own items,
   whatever package the URL names;
-- `POST /packages/:id/duplicate`, by the source's items;
+- `POST /packages/:id/duplicate`, by the source's published items it copies;
 - `POST /packages/:id/adopt-orphans`, by the environment's orphaned rows.
 
-When those items include a position or a permission set, only the platform
+When those items include a position, a permission set or a capability, only the platform
 operator may run the verb.
 
 ### `PATCH /packages/:id/enable`
 
@@ -354,8 +354,8 @@ permission sets is the platform operator's (ADR-0131 D3): that delete, and an
 `install-local` install, upgrade or uninstall of such a package, refuse any
 other caller `403` before anything changes. So do the package verbs that
 publish, discard, roll back, revert, duplicate or adopt catalog items
-(`publish-drafts`, `revert`, `rollback`, `commits/:commitId/revert`,
-`duplicate`, `adopt-orphans`).
+(`publish-drafts`, `discard-drafts`, `revert`, `rollback`,
+`commits/:commitId/revert`, `duplicate`, `adopt-orphans`).
 
 ## One authoritative store — the record is a projection (ADR-0094)
 
 
@@ -183,7 +183,7 @@ One of the largest consumers of the flag;
 | 53 | Package REST route capability gate bypassed | rest | Get: a marketplace publish over REST (`POST /packages/publish`, the one route the REST registrar mounts since #14503) without `manage_metadata`; the package read cohort (`studio.access` / `setup.access`) is enforced by the dispatcher `/packages` domain's own read gate, where the reads are served | `packages/rest/src/package-routes.ts#refusePackageRequest` |
 | 54 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `packages/runtime/src/domains/packages.ts#requireManageMetadata`, `#requireReadCapability` |
 | 55 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `packages/runtime/src/domains/activation-gate.ts#refuseUngrantedActivationWrite`, `#refuseUngrantedActivationAuthoring` |
-| 55b | Walled catalog refusal does not fire | metadata-core, rest, plugin-security, runtime | Get: under `isolated` / `group`, a create, change or delete of a position, a permission set or a capability, at the `/meta` write doors (save, reset, publish, rollback), at the permission-set clone door, at the data door on `sys_position`, `sys_permission_set` and `sys_capability`, and at the `/packages` write doors (delete, `publish-drafts`, `revert`, `rollback`, `commits/:commitId/revert`, `duplicate`, `adopt-orphans`) when the items they act on include a position or a permission set. Every other caller below the platform-operator rung is refused `403` there (ADR-0131 D3), because one organization's write would change what every organization resolves by name. The seeders, the package door and migrations write the catalog this way. Under `single` the refusal is inert for every caller | `packages/metadata-core/src/meta-write-capability.ts#walledCatalogWriteVerdict`, `packages/rest/src/rest-server.ts#walledCatalogRefusal`, `packages/plugins/plugin-security/src/walled-catalog-data-door.ts#createWalledCatalogDataDoorRefusal`, `packages/runtime/src/domains/packages.ts#refuseWalledCatalogPackageWrite` |
+| 55b | Walled catalog refusal does not fire | metadata-core, rest, plugin-security, runtime | Get: under `isolated` / `group`, a create, change or delete of a position, a permission set or a capability, at the `/meta` write doors (save, reset, publish, rollback), at the permission-set clone door, at the data door on `sys_position`, `sys_permission_set` and `sys_capability`, and at the `/packages` write doors (delete, `publish-drafts`, `discard-drafts`, `revert`, `rollback`, `commits/:commitId/revert`, `duplicate`, `adopt-orphans`) when the items they act on include a position, a permission set or a capability. Every other caller below the platform-operator rung is refused `403` there (ADR-0131 D3), because one organization's write would change what every organization resolves by name. The seeders, the package door and migrations write the catalog this way. Under `single` the refusal is inert for every caller | `packages/metadata-core/src/meta-write-capability.ts#walledCatalogWriteVerdict`, `packages/rest/src/rest-server.ts#walledCatalogRefusal`, `packages/plugins/plugin-security/src/walled-catalog-data-door.ts#createWalledCatalogDataDoorRefusal`, `packages/runtime/src/domains/packages.ts#refuseWalledCatalogPackageWrite` |
 | 56 | Automation run-state read, flow-authoring write, the paused-run caller gate (screen read and resume), the two operator run-lifecycle writes and the elevated self-triggered start at every door that starts a flow by name all pass | runtime | Get: run state, flow writes, a paused run's screen and its resume with no grant and without being the run's starter — and cancelling or restoring a suspension without the platform-operator rung. The screen read and the resume ask one predicate, so this is one bypass for both. The lifecycle bypass is the in-process owner's door: plugin-approvals' revise-window recall (ADR-0044) cancels on behalf of a decision it already authorized and recorded. And starting a flow declared `runAs: 'system'` whose type is self-triggered (`autolaunched`, `record_change`, `schedule`) through any door that starts a flow by name — the trigger route, an action of `type: 'flow'` (REST `/actions` and the MCP `run_action` bridge) and a declared endpoint of `type: 'flow'` — which every other caller, the guest principal included, is refused `403 PERMISSION_DENIED` (the maintainer's rulings, letters B and A). The three doors ask one predicate, so this is one bypass for all of them, and it is the in-process caller's, such as a job: inbound HTTP never carries the flag | `packages/runtime/src/domains/automation.ts#mayReadRunState`, `#refuseUngrantedFlowWrite`, `#isRunStarterOrRunStateReader`, `#refuseUngrantedRunLifecycleWrite`, `packages/runtime/src/flow-start-admission.ts#refusesElevatedSelfTriggeredStart` |
 | 57 | Audience-binding suggestion authority gate passes | plugin-security | Get: a system caller lists, accepts and dismisses suggestions without `manage_metadata` and, under a wall, without the platform-operator rung | `packages/plugins/plugin-security/src/suggested-audience-bindings.ts#assertDeploymentAuthority` |
 | 58 | Email-template organization door passes; webhook provenance stamp skipped | plugin-email, plugin-webhooks | Get (`sys_email_template`): a create or update of a template row. The door refuses every other write that names a caller, `403 PERMISSION_DENIED` (ADR-0131 D6); the plugin itself no longer writes the table (templates resolve from the registry), so the v18 migration ceremony's promotion is the one remaining writer. Lose (`sys_webhook`): the row is not marked as an admin customization | `packages/plugins/plugin-email/src/email-template-door.ts#isOrganizationWrite`, `packages/plugins/plugin-webhooks/src/webhook-provenance.ts#bindWebhookProvenanceStamp` |
 
@@ -13,10 +13,10 @@ export const entry: SemanticMigration = {
   // code span AND a table cell.
   surface:
     'on a group or isolated deployment, by a caller below the platform operator, on the runtime '
-    + 'dispatcher: POST /api/v1/packages/:id/publish-drafts and /revert when the package has a pending '
-    + 'position or permission-set draft; /rollback when a commit it would undo touched one; '
+    + 'dispatcher: POST /api/v1/packages/:id/publish-drafts, /discard-drafts and /revert when the package has a pending '
+    + 'position, permission-set or capability draft; /rollback when a commit it would undo touched one; '
     + '/commits/:commitId/revert when that commit touched one, whatever package the URL names; '
-    + '/duplicate when the source holds one; and /adopt-orphans when the orphaned rows include one',
+    + '/duplicate when the published rows it copies hold one; and /adopt-orphans when the orphaned rows include one',
   replacement:
     'the platform operator (the `PLATFORM_ADMIN` rung, the deployment\'s declared '
     + '`OS_PLATFORM_OWNER_EMAIL` owner) runs those verbs on catalog-carrying packages; a package whose '
@@ -35,11 +35,12 @@ export const entry: SemanticMigration = {
     'On an isolated or group deployment, the operator publishes a permission set in a writable '
     + 'package twice (the second adding manage_users) and leaves a third draft pending; another '
     + 'organization\'s member holds the set. An organization owner holding manage_metadata inside '
-    + 'their own organization then calls publish-drafts, revert, rollback to the first commit, '
+    + 'their own organization then calls publish-drafts, discard-drafts, revert, rollback to the first commit, '
     + 'commits/<second>/revert (also under a URL naming their own package), duplicate and, from a '
     + 'package of their own, adopt-orphans: each answers 403 PERMISSION_DENIED naming the posture, '
     + 'the draft stays pending, nothing is copied or rebound, and the member resolves exactly what it '
-    + 'resolved before. The same owner runs every verb on a package of their own whose items carry no '
+    + 'resolved before. The same owner runs every verb but adopt-orphans (which reads the '
+    + 'environment\'s orphans, not the package) on a package of their own whose items carry no '
     + 'catalog item with 200; the platform operator runs every verb on the catalog-carrying package '
     + 'with 200; and on a single deployment a manage_metadata holder runs them exactly as before.',
 };