- Shipped
- August 24, 2026 at 10:02 PM UTC
- Author
- Kamo
- Commit
- 327d277
Enabling a child enables its parent; disabling a parent disables every child; disabling the last child disables the parent. Enabling a parent leaves children alone, so a parent switched on deliberately with no children stays on. The cascade is event-driven and there is deliberately no reconciliation sweep. That is a safety property: a continuously-enforced "a parent with no enabled children is off" invariant would switch commerce off for every existing org the moment this shipped, because no child rows exist until the KamoInitializer backfill runs. A child asserts the PHI guard on its parent's module as well as its own, before any write — otherwise a permitted child under a blocked parent would either be stranded or would silently switch the blocked parent on.