L2: packaged-flow disable/enable write path — operator gate + subflow guard (ADR-0126 §5, §7.3)

[os-support-ai]

Part of #12150 (Epic: ADR-0126 implementation, v17 line — 17.x minor, maintainer-ruled).
Blocked-by: #12155
Dispatch: coordinated under the #12150 program — ⛔ not from the general queue; the program dispatches on unlock (maintainer anti-preemption instruction, 2026-08-25, PM session session_01KWRU3s15AJz7PGW7a7wdCh). Contract: ADR-0126 §5 + §7.3 (merged 28b47a93).

Deliverable

The flip action for packaged flows — writing/updating the sys_metadata_activation row (active bit), install-level (organization_id NULL):

• Write authority (§5): in single posture, org admin suffices; in group/isolated postures the write requires the platform-operator capability — ⛔ a tenant org admin must never flip an install-wide switch (Decide whether POST /api/v1/automation/:name/toggle belongs in the manage_metadata write set — it mutates flow enablement with no authoring capability #10243 made durable in the correct direction).
• Subflow guard (§7.3): disabling flow B is refused while any packaged flow references B as a subflow, and the refusal names the callers (definition scan at disable time — no reference index exists, ADR §9; ⛔ do not build one).
• Loud-refusal shape throughout: the refusal message names the sanctioned path. Clause-② note: this leg adds refusal behavior on a public write surface — carry the contract-review declaration on its PR.

Acceptance

• Posture-matrix tests: single-posture admin allowed; group/isolated tenant-admin refused, operator allowed.
• Subflow-guard test: packaged caller present → disable refused, caller named in the message; caller absent → disable lands.
• Enable path symmetric; absence-of-row = active untouched.

Refs: ADR-0126 §5, §7.3, §9 · #10243 · tenancy-posture.ts

[os-support-ai]

Claim: maintainer direct-dispatch (#12150 program; standing autonomy ruling 「继续自主完成所有开发」). Unblocked — L1 merged as 428f9b24, the ledger object is on origin/main.
Session: session_01KWRU3s15AJz7PGW7a7wdCh
Branch: claude/issue-12157-flow-disable — joint with L3 #12158, one PR closing both cards. Rationale (PM re-sequencing, recorded): the write door (this card) and the runtime consult + flowEnabled retirement (#12158) share one mechanism — today's toggleFlow writes the very process-local map L3 retires, so separate PRs either collide on the same seam or ship a broken intermediate (a door writing a ledger the engine doesn't read, or an engine reading a ledger nothing writes while the old toggle mechanism is gone).
Domain: domain:services
File surface: the flow toggle/disable write path (runtime automation domain + service-automation engine seam) + execute() consult + flowEnabled map retirement + subflow-reference guard (+tests); ⛔ no packages/spec, no objectui, no ledger schema changes
Container & model: mode:subagent, model: opus
Clause-②: yes — refusal behavior lands on a public write surface and on the execute contract; the PR carries the contract-review declaration, and contract review rides this session's PR review (CONTRACT_REVIEW_TIER)
Serial constraints: PR #12026 (#11997) is in flight on packages/services/service-automation (engine.ts, flow-precedence.ts, …) — its diff must be read before choosing edit sites; overlap on a single-writer path = stop and report, never race

---

Generated by Claude Code