@@ -0,0 +1,19 @@
+---
+'@objectstack/runtime': patch
+---
+
+fix(runtime)!: the package draft doors refuse a query parameter they do not read, so `publish-drafts?dryRun=true` no longer publishes for real
+
+Clause-②: yes (narrowing)
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, object definition, stored row or stored shape is added, removed, renamed or re-shaped, and no exported declaration is removed or narrowed, so there is nothing for `objectstack migrate meta` to rewrite. What changes is the answer two HTTP doors give a request that carries a query parameter they never read: it is refused instead of ignored. The remedy is a request edit (send no query parameters), never a rewrite of a package source or a stored row. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and nothing exported is removed or narrowed (not runtime-interface-only, type-surface-only or runtime-export-retired). -->
+
+**BREAKING** accept-set narrowing at two runtime dispatcher doors: `POST /api/v1/packages/:id/publish-drafts` and `POST /api/v1/packages/:id/discard-drafts`.
+
+- **Before.** Both doors read nothing from the query string and ignored whatever was on it. `POST /packages/:id/publish-drafts?dryRun=true` answered `200 outcome: "published"` and the drafts went live; the same parameter on `discard-drafts` dropped every pending draft. A caller asking for a preview got the irreversible act, answered like a success.
+- **Now.** Any query parameter on either door is refused `400 VALIDATION_ERROR` before anything is published or discarded. The message is the one every closed-query door answers (`unknownQueryParamRefusalMessage`, `@objectstack/rest`): it names each parameter it did not understand and says the door takes none. The capability gate still answers first, so a caller without `manage_metadata` keeps its `403`.
+- **Unchanged.** A call with no query parameters, which is how the Console, `MetadataClient.publishPackageDrafts` and the client SDK's `packages.publishDrafts` / `packages.discardDrafts` call both doors. The body (`actor`, `backfill`) is read as before.
+- **Who sees it.** A script, tool or AI agent that adds a query parameter to either door now gets `400` instead of a publish or a discard. Neither door has a dry run; a preview of what a publish would do is not offered yet.
+
+**The remedy.** Send the request without query parameters.
@@ -0,0 +1,119 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#26713] The package draft doors — `POST /packages/:id/publish-drafts` and
+ * its twin `POST /packages/:id/discard-drafts` — read no query parameter, and
+ * now say so: any name on the query string is refused `400 VALIDATION_ERROR`
+ * with the repo's one recognition sentence (`unknownQueryParamRefusalMessage`,
+ * `@objectstack/rest`), before the protocol is asked for anything.
+ *
+ * Measured before this change, driving `dispatch()`:
+ *
+ * | request | answer |
+ * |---|---|
+ * | `POST /packages/:id/publish-drafts?dryRun=true` | `200 outcome: 'published'`; `publishPackageDrafts` ran, so the draft went live |
+ * | `POST /packages/:id/discard-drafts?dryRun=true` | `200`; `discardPackageDrafts` ran, so the drafts were dropped |
+ *
+ * A caller asking for a preview got the irreversible act, answered like a
+ * success. A dry run is not a parameter these doors declare; adding one is a
+ * protocol change, so until then the name is refused rather than ignored.
+ *
+ * Both halves (AGENTS.md route rule 5): a REFUSAL pin — status, code, the
+ * shared sentence, and the protocol never called — beside a PRESERVATION pin
+ * on the call that sends no query.
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+import { SchemaRegistry } from '@objectstack/objectql';
+import { unknownQueryParamRefusalMessage } from '@objectstack/rest';
+import { HttpDispatcher } from '../http-dispatcher.js';
+
+const PKG = 'com.acme.app';
+
+/** Admitted by the draft doors' capability gate. */
+const AUTHOR = { userId: 'u_author', isSystem: false, systemPermissions: ['manage_metadata', 'studio.access'] };
+/** Signed in, but without `manage_metadata`. */
+const VIEWER = { userId: 'u_viewer', isSystem: false, systemPermissions: [] as string[] };
+
+const PUBLISHED_ONE = {
+    success: true, outcome: 'published', publishedCount: 1, failedCount: 0,
+    published: [{ type: 'flow', name: 'nightly_rollup', version: 'sha256:aa11' }], failed: [],
+};
+const DISCARDED_ONE = {
+    success: true, discardedCount: 1, failedCount: 0,
+    discarded: [{ type: 'flow', name: 'nightly_rollup' }], failed: [],
+};
+
+/** The dispatcher over a REAL registry holding one installed package, and a recording protocol. */
+function boot(caller: Record<string, unknown> = AUTHOR) {
+    const registry = new SchemaRegistry({ multiTenant: false, collisionPolicy: 'error' });
+    (registry as any).logLevel = 'silent';
+    registry.installPackage({ id: PKG, name: PKG, namespace: 'app', version: '1.0.0', type: 'app' } as any, 'code');
+    const protocol = {
+        publishPackageDrafts: vi.fn(async () => JSON.parse(JSON.stringify(PUBLISHED_ONE))),
+        discardPackageDrafts: vi.fn(async () => JSON.parse(JSON.stringify(DISCARDED_ONE))),
+        // The ADR-0045 visibility flip after a publish: no app to unhide.
+        getMetaItems: vi.fn(async () => ({ items: [] })),
+        saveMetaItem: vi.fn(async () => ({ ok: true })),
+    };
+    const services: Record<string, unknown> = { objectql: { registry }, protocol };
+    const get = (n: string) => services[n] ?? null;
+    const kernel: any = {
+        context: { getService: get, trigger: vi.fn() },
+        getService: get,
+        getServiceAsync: async (n: string) => get(n),
+    };
+    const dispatcher = new HttpDispatcher(kernel);
+    // The seam `dispatch()` resolves identity through (as the sibling dispatch-level pins do).
+    (dispatcher as any).timedResolveExecutionContext = async () => ({ ...caller });
+    return { dispatcher, protocol };
+}
+
+interface Answer { status: number; body: any }
+
+async function call(dispatcher: HttpDispatcher, path: string, query: Record<string, unknown>): Promise<Answer> {
+    const res = await dispatcher.dispatch('POST', path, {}, query, { request: { headers: {} } } as any);
+    return { status: res.response?.status ?? (res.handled ? 200 : 0), body: res.response?.body };
+}
+
+function expectRecognitionRefusal(answer: Answer, query: Record<string, unknown>): void {
+    expect(answer.status, `expected 400, got ${JSON.stringify(answer)}`).toBe(400);
+    expect(answer.body?.success).toBe(false);
+    expect(answer.body?.error?.code).toBe('VALIDATION_ERROR');
+    // The shared sentence, never a door-local copy: it names what was not
+    // understood and says the door takes no query parameters.
+    expect(answer.body?.error?.message).toBe(unknownQueryParamRefusalMessage(query, []));
+}
+
+const DOORS = [
+    { door: 'publish-drafts', protocolCall: 'publishPackageDrafts' },
+    { door: 'discard-drafts', protocolCall: 'discardPackageDrafts' },
+] as const;
+
+describe.each(DOORS)('[#26713] POST /packages/:id/$door — a closed, empty query set', ({ door, protocolCall }) => {
+    it.each([
+        [{ dryRun: 'true' }],
+        [{ dryRun: ['true', 'true'] }],
+        [{ dryRun: 'true', preview: '1' }],
+    ])('refuses %j before the protocol is asked', async (query) => {
+        const { dispatcher, protocol } = boot();
+        const answer = await call(dispatcher, `/packages/${PKG}/${door}`, query);
+        expectRecognitionRefusal(answer, query);
+        for (const name of Object.keys(query)) expect(answer.body.error.message).toContain(`"${name}"`);
+        expect(protocol[protocolCall]).not.toHaveBeenCalled();
+    });
+
+    it('preserves the call without a query: the protocol runs once and the door answers 200', async () => {
+        const { dispatcher, protocol } = boot();
+        const answer = await call(dispatcher, `/packages/${PKG}/${door}`, {});
+        expect(answer.status).toBe(200);
+        expect(protocol[protocolCall]).toHaveBeenCalledTimes(1);
+    });
+
+    it('answers a caller without manage_metadata 403 first: the capability gate outranks the query', async () => {
+        const { dispatcher, protocol } = boot(VIEWER);
+        const answer = await call(dispatcher, `/packages/${PKG}/${door}`, { dryRun: 'true' });
+        expect(answer.status).toBe(403);
+        expect(protocol[protocolCall]).not.toHaveBeenCalled();
+    });
+});
@@ -119,7 +119,10 @@ import { ManifestSchema, SEMVER_2_0_0_VERSION_PATTERN, manifestIdRefusal } from
 // domain calls: it writes the bare `{ error: { code, message } }` body onto a
 // `res`, and every error body on this surface is `deps.error`'s. See the
 // `@objectstack/rest` barrel entry that publishes the pair.
-import { repeatedQueryParamMessage } from '@objectstack/rest';
+// [#26713] …and its recognition sibling, the one sentence for a query
+// parameter a door does not read (`packages/rest/src/query-allowlist.ts`),
+// asked by the draft doors (`refuseDraftDoorQuery`).
+import { repeatedQueryParamMessage, unknownQueryParamRefusalMessage } from '@objectstack/rest';
 // [commit 0862063ba] The repo's ONE coercion for a query parameter its schema declares
 // `z.boolean()`, from the module whose header is the authority on the rule
 // (`packages/runtime/src/query-param.ts`). Imported, never restated: the list
@@ -1062,6 +1065,34 @@ function refuseRepeatedWriteFlag(
     return null;
 }
 
+/**
+ * [#26713] The closed query set of the package draft doors —
+ * `POST /packages/:id/publish-drafts` and `POST /packages/:id/discard-drafts`.
+ * **Measured**: EMPTY. Both read the path's id, the session and the body
+ * (`actor`, and `backfill` on publish); neither reads a query parameter.
+ */
+const DRAFT_DOOR_QUERY_PARAMS: readonly string[] = Object.freeze([]);
+
+/**
+ * [#26713] AGENTS.md route rule 5 at the draft doors: a query parameter they
+ * do not read is refused `400 VALIDATION_ERROR` with the recognition sentence
+ * every closed-query door answers ({@link unknownQueryParamRefusalMessage}),
+ * in this domain's envelope, as the `/meta` doors write it (#23072). Asked
+ * after the capability and wall gates and before anything else is read.
+ *
+ * Both doors ignored the query string, so `publish-drafts?dryRun=true`
+ * published the drafts for real and answered `200 outcome: "published"`, and
+ * the same parameter on `discard-drafts` dropped them. A dry run is not a
+ * parameter these doors declare; until one is, the name is refused.
+ *
+ * @returns the refusal to answer, or `null` when the query names nothing.
+ */
+function refuseDraftDoorQuery(deps: DomainHandlerDeps, query: unknown): HttpDispatcherResult | null {
+    const message = unknownQueryParamRefusalMessage(query, DRAFT_DOOR_QUERY_PARAMS);
+    if (message === undefined) return null;
+    return { handled: true, response: deps.error(message, 400, { code: 'VALIDATION_ERROR' }) };
+}
+
 /**
  * Whether a registry row counts as enabled, for {@link readEnabledFilter}'s
  * comparison (commit 0862063ba).
@@ -1699,6 +1730,7 @@ export async function handlePackagesRequest(deps: DomainHandlerDeps, path: strin
             // [ADR-0131 D12 items 7–8] Under a wall, the platform operator's.
             const walled = await refuseWalledCatalogPackageWrite(deps, _context, `Publishing the drafts of package "${id}"`);
             if (walled) return walled;
+            const queryRefused = refuseDraftDoorQuery(deps, query); if (queryRefused) return queryRefused;
             const protocol = await resolveProtocol(deps, _context);
             if (protocol && typeof protocol.publishPackageDrafts === 'function') {
                 try {
@@ -2059,6 +2091,7 @@ export async function handlePackagesRequest(deps: DomainHandlerDeps, path: strin
             // [ADR-0131 D12 items 7–8] Under a wall, the platform operator's.
             const walled = await refuseWalledCatalogPackageWrite(deps, _context, `Discarding the drafts of package "${id}"`);
             if (walled) return walled;
+            const queryRefused = refuseDraftDoorQuery(deps, query); if (queryRefused) return queryRefused;
             const protocol = await resolveProtocol(deps, _context);
             if (protocol && typeof protocol.discardPackageDrafts === 'function') {
                 try {