@@ -0,0 +1,10 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): Studio's flow ledger switch keeps keyboard focus while its toggle is in flight and after the answer lands
+
+Clause-②: no
+Metadata-protocol: none
+
+On Studio › Automations, a read-only package's flow offers the switch that turns it on or off for this deployment. While a toggle was in flight the switch drew `disabled`, and a browser moves focus off a focused control that turns disabled, to the page body, where it stayed once the answer landed. A keyboard or screen reader author had to tab back from the top of the page after every flip, accepted or refused. In flight the switch is now `aria-disabled` and refuses the press in its own handler, so it keeps focus and a second Space still sends no second request. A switch the deployment's posture walls off stays `disabled` and described by its reason, as before.
@@ -22,7 +22,10 @@
  *  - a refusal is the server's sentence, verbatim, announced as an alert
  *    (objectstack#29139), and announced again when the next flip is refused;
  *  - a writable package's flow (CONTROL) keeps its definition switch and its
- *    Delete, with no ledger switch.
+ *    Delete, with no ledger switch;
+ *  - a keyboard flip keeps focus on the switch while the request is in flight
+ *    and after its answer lands, accepted or refused, and a second Space in
+ *    flight sends nothing (objectstack#29228).
  *
  * The harness is `AutomationsPillar.deleteFlow-27356`'s: the metadata server
  * doubled at the client, the `/automation` doors doubled at `fetch`.
@@ -32,6 +35,7 @@ import '@testing-library/jest-dom/vitest';
 import * as React from 'react';
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { render, screen, fireEvent, cleanup, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
 import { toast } from 'sonner';
 import { MemoryRouter } from 'react-router-dom';
 
@@ -297,3 +301,77 @@ describe('Automations — the ledger switch on a read-only package (ADR-0146 D4)
     expect(await screen.findByTestId('auto-item-delete')).toBeInTheDocument();
   });
 });
+
+// objectstack#29228 — a focused control that turns `disabled` drops focus to
+// the page, and nothing hands it back. In flight the switch is refused to a
+// press but stays focusable, so a keyboard author's focus never leaves it.
+// A browser runs the HTML focus fixup: a focused control that turns `disabled`
+// drops focus to the body (measured in Chromium 153, and not handed back when
+// it is enabled again). happy-dom keeps focus on it, so the test runs the
+// fixup on the switch the way the browser does, else the focus pins could not
+// fail. (happy-dom's `blur()` does nothing on a disabled control, so focus is
+// moved to the body itself.)
+function runFocusFixup(el: HTMLElement): () => void {
+  const observer = new MutationObserver(() => {
+    if (el.hasAttribute('disabled') && document.activeElement === el) document.body.focus();
+  });
+  observer.observe(el, { attributes: true, attributeFilter: ['disabled'] });
+  return () => observer.disconnect();
+}
+
+describe('Automations — the ledger switch keeps keyboard focus across a flip (objectstack#29228)', () => {
+  const subflowSentence =
+    "Flow 'approval' cannot be disabled while 1 packaged flow still calls it as a subflow: 'notify_owner'.";
+
+  it.each([
+    ['accepted', null],
+    ['refused (409)', { status: 409, body: { success: false, error: { code: 'DELETE_RESTRICTED', message: subflowSentence } } }],
+  ])('a keyboard flip that is %s leaves focus on the switch, and a second Space in flight sends nothing', async (_answer, refusal) => {
+    doors.toggle = refusal;
+    let release!: () => void;
+    doors.toggleGate = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    const user = userEvent.setup();
+    mount();
+    const sw = await ledgerSwitch();
+    const stopFixup = runFocusFixup(sw);
+    sw.focus();
+    expect(document.activeElement).toBe(sw);
+
+    await user.keyboard(' ');
+    await waitFor(() => expect(calls('/automation/approval/toggle')).toHaveLength(1));
+    await waitFor(() => expect(sw).toHaveAttribute('aria-disabled', 'true'));
+    // In flight: still focused, refused to a press, still focusable.
+    expect(document.activeElement).toBe(sw);
+    expect(sw).toBeEnabled();
+    await user.keyboard(' ');
+    await new Promise((r) => setTimeout(r, 50));
+    expect(calls('/automation/approval/toggle')).toHaveLength(1);
+
+    release();
+    await waitFor(() => expect(sw).not.toHaveAttribute('aria-disabled'));
+    if (refusal) {
+      expect((await screen.findByRole('alert')).textContent).toBe(subflowSentence);
+      expect(sw).toHaveAttribute('aria-checked', 'true');
+    } else {
+      await waitFor(() => expect(sw).toHaveAttribute('aria-checked', 'false'));
+    }
+    // The answer landed on the same switch, and focus is still on it.
+    expect(screen.getByTestId('auto-ledger-switch')).toBe(sw);
+    expect(document.activeElement).toBe(sw);
+    stopFixup();
+  });
+
+  it('a walled switch stays disabled, out of the tab order, and described by its reason', async () => {
+    posture = 'group';
+    operator = false;
+    mount();
+    const sw = await ledgerSwitch();
+    expect(sw).toBeDisabled();
+    expect(sw).not.toHaveAttribute('aria-disabled');
+    expect(sw.getAttribute('aria-describedby')).toContain(screen.getByTestId('auto-ledger-walled-reason').id);
+    sw.focus();
+    expect(document.activeElement).not.toBe(sw);
+  });
+});
@@ -21,6 +21,12 @@
  * own sentence for why (`notRunningReason`, rendered verbatim, ⛔ never parsed).
  * When the caller's posture facts say the door refuses them (`walledReason`),
  * the switch draws disabled, described by the console's own sentence.
+ *
+ * While a toggle is in flight (`busy`) the switch is `aria-disabled`, never
+ * `disabled`: a focused control that turns `disabled` drops focus to the page,
+ * and nothing hands it back when the answer lands, so a keyboard author would
+ * tab back from the top after every flip. The press is refused here instead,
+ * so a second Space sends no second request.
  */
 
 import * as React from 'react';
@@ -57,15 +63,18 @@ export function FlowLedgerSwitch({ checked, reading, notRunningReason, busy, wal
       aria-checked={checked}
       data-testid="auto-ledger-switch"
       data-reading={reading}
-      onClick={onToggle}
-      disabled={busy || !!walledReason}
+      onClick={() => {
+        if (!busy) onToggle();
+      }}
+      disabled={!!walledReason}
+      aria-disabled={busy || undefined}
       aria-describedby={describedBy}
       title={walledReason ? undefined : why ? `${hint}\n${why}` : hint}
       className={
         'inline-flex h-7 items-center gap-2 rounded-md px-1 text-[12px] ' +
         (walledReason
           ? 'text-muted-foreground disabled:pointer-events-none'
-          : 'text-foreground hover:bg-muted disabled:opacity-50')
+          : 'text-foreground hover:bg-muted aria-disabled:opacity-50')
       }
     >
       <span