@@ -0,0 +1,11 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+feat(studio): switch a read-only package's flow off for this deployment from the Automations pillar
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+An administrator who wanted a packaged flow off in their deployment had to leave Studio for Setup › Packaged automation, and the open flow's header showed a locked switch that read the flow's definition beside a status that read the deployment's activation ledger, so the two could disagree. A read-only package's open flow in Studio's Automations pillar now carries the activation-ledger switch on the item (ADR-0146 D4): it reads the flag `GET /automation/_status` reports and flips it through `POST /automation/<name>/toggle`, at once, with Setup's three readings: "On for this deployment", "On for this deployment, not running here" (muted, with the platform's reason as sent) and "Off for this deployment". A writable package's flow keeps its definition switch ("Enabled" / "Disabled", applied on publish) and its Delete. Under a walled tenancy posture, a caller without the platform-operator rung gets the switch disabled with the console's own sentence, read from `features.tenancyPosture` and `user.isPlatformAdmin`; a server refusal is shown as sent. The toggle request moved out of Setup's Packaged automation page into a shared `packagedFlowLedger.ts`, so the two surfaces send one request. The studio namespace gains a contiguous block of `engine.studio.auto.ledger.*` keys (en, zh).
@@ -95,7 +95,9 @@
  *
  * `actionErrorDetail` is the one place this repo reads an ADR-0112 error
  * envelope's message; a fallback string is used ONLY when the response carried
- * no message at all, never in place of one.
+ * no message at all, never in place of one. The toggle request lives in
+ * `packagedFlowLedger.ts`, shared with Studio's Automations pillar, which
+ * offers the same switch on a read-only package's flow (ADR-0146 D4).
  *
  * ## How this page is reached
  *
@@ -156,6 +158,7 @@ import {
   type FlowRuntimeStateRow,
   type PackagedFlowRow,
 } from './packagedFlows.js';
+import { requestFlowToggle, type FlowToggleOutcome } from './packagedFlowLedger.js';
 import { PackagedActionsSection } from './PackagedActionsSection.js';
 import { studioOrgScopePath } from '../studio-design/studioScope.js';
 import { PageHeader } from '../../layout/PageHeader.js';
@@ -238,8 +241,7 @@ interface CloneResult {
   switchRefusal: string | null;
 }
 
-/** The toggle's answer: the flag the server reports, or its refusal verbatim. */
-type ToggleOutcome = { ok: true; enabled: boolean } | { ok: false; message: string };
+type ToggleOutcome = FlowToggleOutcome;
 
 /* -------------------------------------------------------------------------- */
 /* The reason disclosure                                                       */
@@ -364,43 +366,16 @@ export function PackagedAutomationPage() {
    * refusal comes back as the server's sentence, verbatim.
    */
   async function requestToggle(name: string, enabled: boolean): Promise<ToggleOutcome> {
-    try {
-      const res = await fetch(`${apiBase()}/automation/${encodeURIComponent(name)}/toggle`, {
-        method: 'POST',
-        credentials: 'include',
-        headers: { ...JSON_HEADERS, 'Content-Type': 'application/json' },
-        body: JSON.stringify({ enabled }),
-      });
-      const json = await readJson(res);
-      if (!res.ok || envelopeRefused(json)) {
-        // VERBATIM. The posture gate (403) and the subflow guard (409) both
-        // carry the whole of what the admin needs in this string — the second
-        // one names the callers, which nothing on the client could reconstruct.
-        return {
-          ok: false,
-          message: actionErrorDetail(
-            json,
-            // A SEPARATE key from the catch arm's below: this one has a status
-            // to name and that one does not, and one key cannot carry a hole
-            // only half its call sites can fill.
-            t('packagedAutomation.toggleFailedHttp', {
-              defaultValue: 'Could not change activation (HTTP {{status}}).',
-              status: res.status,
-            }),
-          ),
-        };
-      }
-      const reported = envelopeData(json).enabled;
-      return { ok: true, enabled: typeof reported === 'boolean' ? reported : enabled };
-    } catch (e) {
-      return {
-        ok: false,
-        message:
-          e instanceof Error && e.message
-            ? e.message
-            : t('packagedAutomation.toggleFailed', { defaultValue: 'Could not change activation.' }),
-      };
-    }
+    return requestFlowToggle(name, enabled, {
+      // Two keys: the HTTP one has a status to name and the network one does
+      // not, and one key cannot carry a hole only half its call sites can fill.
+      http: (status) =>
+        t('packagedAutomation.toggleFailedHttp', {
+          defaultValue: 'Could not change activation (HTTP {{status}}).',
+          status,
+        }),
+      network: t('packagedAutomation.toggleFailed', { defaultValue: 'Could not change activation.' }),
+    });
   }
 
   /** A toggle the server accepted: the row shows its answer, and the runtime is re-read. */
 
@@ -0,0 +1,106 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The packaged-flow ledger switch the console offers in two places (ADR-0146
+ * D4): Setup › Packaged automation, the deployment-wide overview, and Studio's
+ * Automations pillar, on a read-only package's open flow. It is
+ * `POST /api/v1/automation/<name>/toggle`, the ADR-0126 §7.2 activation
+ * ledger's switch, the bit `GET /automation/_status` reports as `enabled`.
+ *
+ * One copy of the request, so the two surfaces cannot drift on the body they
+ * send or on how a refusal reaches the operator: VERBATIM, through
+ * `actionErrorDetail`, the one reader of an ADR-0112 envelope's message. A
+ * fallback string is used only when the response carried no message at all,
+ * and the caller supplies it in its own surface's words.
+ *
+ * And one pre-judgement of the gate, from the two facts the server publishes
+ * for it ({@link flowLedgerWalledReadOnly}), never a client copy of its sentence.
+ */
+
+import { useAuth } from '@object-ui/auth';
+import type { TenancyPosture } from '@object-ui/auth';
+import { actionErrorDetail } from '@object-ui/core';
+import { postureHasOrgWall, useTenancyPosture } from '../../hooks/useTenancyPosture.js';
+import { apiBase } from '../../utils/apiBase.js';
+import { envelopeData, envelopeRefused } from './packagedFlows.js';
+
+const JSON_HEADERS = { Accept: 'application/json', 'Content-Type': 'application/json' } as const;
+
+/** The caller's own words for a refusal that carried no message. */
+export interface FlowDoorFallbacks {
+  /** The response failed with this status and no message. */
+  http: (status: number) => string;
+  /** The request itself failed (network, abort) with no message. */
+  network: string;
+}
+
+/** The toggle's answer: the flag the server reports, or its refusal verbatim. */
+export type FlowToggleOutcome = { ok: true; enabled: boolean } | { ok: false; message: string };
+
+async function readJson(res: Response): Promise<unknown> {
+  return res.json().catch(() => null);
+}
+
+function thrownMessage(e: unknown, fallback: string): string {
+  return e instanceof Error && e.message ? e.message : fallback;
+}
+
+/**
+ * `POST …/toggle`. Never throws: a refusal comes back as the server's
+ * sentence. The posture gate (403) and the subflow guard (409, which names the
+ * callers that would break) both carry the whole of what the operator needs in
+ * that string, and nothing on the client could reconstruct it.
+ */
+export async function requestFlowToggle(
+  name: string,
+  enabled: boolean,
+  fallbacks: FlowDoorFallbacks,
+): Promise<FlowToggleOutcome> {
+  try {
+    const res = await fetch(`${apiBase()}/automation/${encodeURIComponent(name)}/toggle`, {
+      method: 'POST',
+      credentials: 'include',
+      headers: JSON_HEADERS,
+      body: JSON.stringify({ enabled }),
+    });
+    const json = await readJson(res);
+    if (!res.ok || envelopeRefused(json)) {
+      return { ok: false, message: actionErrorDetail(json, fallbacks.http(res.status)) };
+    }
+    const reported = envelopeData(json).enabled;
+    return { ok: true, enabled: typeof reported === 'boolean' ? reported : enabled };
+  } catch (e) {
+    return { ok: false, message: thrownMessage(e, fallbacks.network) };
+  }
+}
+
+/**
+ * Does the toggle door refuse this caller on this deployment?
+ *
+ * ADR-0126 §5: under the walled `group` / `isolated` postures the activation
+ * row is install-wide, so the door
+ * (`activation-gate.ts#refuseUngrantedActivationWrite`) admits only the
+ * `PLATFORM_ADMIN` posture rung; under `single`, or with no posture served, it
+ * admits the `manage_metadata` holder Studio already requires. The verdict is
+ * read from the two facts `walledCatalogReadOnly`
+ * (`metadata-admin/catalog-scope.ts`) reads for the catalog doors, the posture
+ * (`features.tenancyPosture`) and the session's `user.isPlatformAdmin`, without
+ * that function's catalog-type filter: the ledger gate has no type input, so
+ * the function itself answers `false` for a flow. The server stays the judge:
+ * a refusal after an attempt is still shown as sent. An unknown posture fails
+ * toward a live control; a session that never published the flag reads as no
+ * operator.
+ */
+export function flowLedgerWalledReadOnly(input: {
+  posture: TenancyPosture | undefined;
+  isPlatformOperator: boolean;
+}): boolean {
+  return postureHasOrgWall(input.posture) && !input.isPlatformOperator;
+}
+
+/** {@link flowLedgerWalledReadOnly} for this session and this deployment. */
+export function useFlowLedgerWalledReadOnly(): boolean {
+  const posture = useTenancyPosture();
+  const { user } = useAuth();
+  return flowLedgerWalledReadOnly({ posture, isPlatformOperator: user?.isPlatformAdmin === true });
+}