A switched-off package is not offered on the instance
An instance's deployment record can switch a package off: Features__Flags__<name>__Enabled=false
plus that flag's Packages (for example Plugins/Codex). The platform already honours that
declaration. It excludes the package from every unattended install and retires an installed copy at
boot through phase 1 of the package uninstall request (core Doc/Architecture/EnvironmentComposition
→ "A disabled flag retires what is installed").
The Store did not read the declaration. Phase 1 keeps the package's partition, so its root stayed in the mesh and its card stayed listed. On an instance whose plan covers the package's tier, every viewer was still offered Get (Plugins#4962). The owner's decision on that issue was "switched-off fully hides", and this page describes what that means.
What a switched-off package looks like
| Surface | Behaviour |
|---|---|
| Store catalog | The card is not listed, for any viewer, an administrator included. |
| In-app extension shelf (the Threads app's harness section, the person app's Extensions tab) | The card is not listed. The shelf query carries -id:<package>, so the package is never fetched. |
| The package's cover | The acquisition row and the subscribe panel are replaced by one notice naming the flag. |
The install engine (Localizer) |
A Get, an install request or a dependency closure is refused first, before any write, with a message naming the package and the flag. |
All of them read the same thing, SwitchedOff (Store/Core), over core's live
IFeatureFlags.Composition. A configuration reload re-renders the surfaces, and no recycle is
needed. If the composition cannot be read, the install engine refuses (fails closed). It never
treats that as "nothing is switched off".
Matching. A flag names packages as Source/Package patterns.
- Where a surface knows the package's source, the pattern matches exactly as the platform matches it.
- A package root in the mesh carries no source, and a retired package has no install record. There a pattern that names the package by id matches whatever its source.
- So a source-wide
Plugins/*pattern hides only packages whose source the surface knows. To hide a package everywhere, name it.
The notice and the refusal are Store chrome (StoreTexts, English and German).
The administrator's uninstall entry
Every package page embeds the InstanceUninstall area. It renders nothing for anyone but a platform
administrator. For an administrator it offers Uninstall from this instance, which files core's
package uninstall request (Doc/Architecture/PackageUninstall). Phase 1 then:
- retires the module on this instance;
- removes the install record;
- keeps the data;
- restarts the instance once.
The click authorizes the captured caller by id before the request is written, because the request
writes as System (policy authorize-as-caller-execute-as-system). An unresolved caller is refused.
The status line links the request node, which shows the preview and the exact confirmation that
phase 2 (dropping the data) needs.
This entry is not the cover's Uninstall. That one removes a viewer's own copies and touches nothing on the instance.
Not covered
- The admin Provision and Manage-apps surfaces still let an administrator add a package that a flag switches off. The next boot retires it again, because the flag governs. Making those refuse as well is a separate change.
- The decision to switch a package off belongs to the deployment record. The Store only reads it.
Pinned by SwitchedOffTests (Store/Core), SwitchedOffInstallTests (Store/Installer) and
SwitchedOffCoverTests (Store/Plugin).