# WP-47 — Runtime feature flags (catalog-in-code, admin-toggled)

Status: done
Phase: 8 — platform/DX/showcase

## Why

Ops needs to turn features on/off at runtime without a deploy. Mirrors the two house templates: the
capability spine (server-resolved, FE reads) and the org-template runtime-SQLite config (admin edits
at runtime). Per ADR-0004 the **catalog** (which flags exist + defaults) is config-as-code; only the
**on/off state** is runtime.

## Decisions (locked with the user)

- Catalog in code (typed, build-validated); on/off state in SQLite; admin toggles at runtime.
- **FE + backend enforcement** — the FE hides the surface AND the server enforces (a flag can guard
  a real feature, not just UI).

## Outcome

- Backend: `Domain/Features/FeatureFlags.cs` (catalog: one flag `inschrijving-open`, default on) +
  `Data/FeatureFlagStore.cs` (`FeatureFlagEntity` in SQLite + migration; `All()` merges catalog
  defaults with overrides, `IsEnabled`, `Set` rejects unknown keys). `GET /flags` (readable, drives
  FE gating) + `PUT /admin/flags/{key}` (gated by new `flags:manage` cap + `FlagsAdmin`). Enforced
  end-to-end: `POST /applications` for a `registratie` returns 403 when `inschrijving-open` is off.
- FE: `shared/domain/feature-flag.ts` + `feature-flags.adapter.ts` (parse boundary) +
  `shared/application/feature-flags.store.ts` (root singleton, `enabled(key)` deny-by-default,
  `set`). Capability `flags:manage` (union + me.adapter + role.interceptor `/api/v1/admin/flags`).
  The "Inschrijven" nav item + dashboard action hide when the flag is off. Admin toggle page
  `beheer/ui/feature-flags.page.ts` at `/beheer/functies`, in `ADMIN_LINKS`.
- Tests: catalog-unique + endpoint (admin-only toggle, 404 unknown key, close→403 / reopen→201).
  `/me` cap-list test updated. Backend 136; typed client regenerated.

## Acceptance criteria

- [x] Admin toggles a flag at runtime; state persists (SQLite) and the whole app reads it.
- [x] FE hides the flagged feature AND the backend enforces it (registration close → 403).
- [x] `npm run ci` green (dep:check, localized build, backend `dotnet test`, drift clean after commit).