phase: 115_doc_draft_discard

All green — this was the final verification pass; everything from the four completed tasks was already in the working tree and verified.

**Phase 115 — Doc drafts: Discard + DELETE route + title fix — verification report**

- Verified all 4 task deliverables present: DELETE route (`app/api/doc_drafts.py`), Discard UI (`doc-edit.html` + `doc-edit.js` + `.discard-draft` CSS), title fix (`defaultDocTitle(wrap)` pairing + `saveAsDoc` call site), and all test pins (integration, frontend unit, E2E). No code changes needed.
- **Completion criteria:**
  1. ✅ Orphaned draft discardable from edit screen; row gone — `test_delete_removes_row_and_invalidates_token` (204 → GET 404), unknown-token 404, admin-gate 403 on all routes, E2E `test_discard_draft_from_edit_screen` all pass.
  2. ✅ Title after retry redo = redone answer's own question — E2E `test_save_title_is_the_redo_question_after_retry` passes.
  3. ✅ Push flow byte-identical — `git diff` shows only the new DELETE route + module docstring; all 7 existing push tests green.
  4. ✅ `uv run pytest --cov=app` → **2457 passed**, app coverage **99%** (>90%); `uv run pytest tests/e2e/test_save_doc_session.py -v --no-cov` → **4 passed**; `uv run ruff check .` → clean; `uv run pyright` → 0 errors.
  5. ⏳ Commit + phase-dir move left to the harness (per executor rules, no `git` run; all changes left in the working tree).
- No defects found; no deviations.
- Next pending phase: none in `todo/` other than this one (`115_doc_draft_discard` is the last).

app/api/doc_drafts.py

@@ -19,7 +19,10 @@ token — 404 ``draft not found`` when unknown), ``PUT
 /api/doc-drafts/{token}`` (partial update — absent fields unchanged,
 ``updated_at`` bumped; editing a ``pushed`` draft resets ``status``
 back to ``draft`` — the stored sha no longer describes the current
-body, so the next push re-commits; phase 59 D3 ASSUMPTION), ``POST
+body, so the next push re-commits; phase 59 D3 ASSUMPTION), ``DELETE
+/api/doc-drafts/{token}`` (discard — 204 No Content; the row is
+removed, so every subsequent GET/PUT/push 404s; phase 115, the edit
+screen's Discard control), ``POST
 /api/doc-drafts/{token}/push`` (the single mutation the edit screen
 triggers — commit + ``git push`` the draft's file to the
 ``BOR_DOCS_REPO`` ``BOR_DOCS_BRANCH`` via
@@ -233,6 +236,24 @@ def update_draft(
     return _to_out(row)
 
 
+@router.delete("/{token}", status_code=204)
+def delete_draft(
+    token: uuid.UUID,
+    db: Session = Depends(get_db),  # noqa: B008
+) -> None:
+    """Discard a draft (the edit screen's Discard control, phase 115).
+
+    Admin-gated like the whole router (phase 59); the uuid4 token is
+    the screen's credential — after a successful discard, GET/PUT/push
+    all 404. 204 No Content (no body): the token is a one-way
+    credential and nothing else references the row (no FK targets, no
+    push-side state — the git push happens only on push).
+    """
+    row = _get_draft_or_404(db, token)
+    db.delete(row)
+    db.commit()
+
+
 @router.post("/{token}/push", response_model=DocDraftPushed)
 def push_doc_draft(
     token: uuid.UUID,