Function merge_capabilities 

pub fn merge_capabilities(
    base: &Capabilities,
    over: &Capabilities,
) -> Capabilities

Deep-merge two [Capabilities]: each of add/drop is taken from over when set, else from base. So an over that sets only add keeps base.drop — an add-only override never silently drops the hardened drop:[ALL] (the bug ADR-0004 §2 cites).