```yaml
id: UJ-009
title: Deactivate the site license
actors: [administrator]
surface: admin-spa
goal: Administrator releases this site's active license and fresh state is inactive.
trigger: Activate Deactivate License at /wp-admin/admin.php?page=international-press-zone#/licensing and confirm.
fixtures: [authenticated-admin, live-active-license]
success_state:
  visible: "License deactivated successfully." renders and activation form returns.
  durable: ipz_license_key, ipz_license_data, and ipz_license_usage are absent.
  persistence: Fresh GET /wp-json/international-press-zone/v1/license returns inactive state.
source_specs: [admin/src/pages/licensing.js, includes/API/LicenseRestController.php]
readiness: draft
canonical: false
blockers: []
```

## Path

| Hop | Evidence |
|---|---|
| UI trigger | `admin/src/pages/licensing.js:231` |
| Request construction | `admin/src/pages/licensing.js:775` |
| Endpoint auth and parse | `includes/API/LicenseRestController.php:102` |
| Authoritative write | `includes/API/LicenseRestController.php:262` |
| Response | `includes/API/LicenseRestController.php:266` |
| Terminal render | `admin/src/pages/licensing.js:778` |

## Happy path

### H1
- Setup: Administrator authenticated; live license active on this site.
- Action: Activate `Deactivate License` and confirm.
- Request: `POST /wp-json/international-press-zone/v1/license/deactivate`.
- Response: `200` with `{success:true,message:"License deactivated successfully."}`.
- Visible: `License deactivated successfully.` renders; activation form replaces license card.
- Durable: `ipz_license_key`, `ipz_license_data`, and `ipz_license_usage` are absent; backend seat is released.
- Fresh read: `GET /wp-json/international-press-zone/v1/license` returns `200` with `{license:{status:"inactive",key:null,plan:null,sites_used:0,expires_at:null}}`.
- Forbidden: No language, content, translation, or settings write occurs.
- Evidence:
  - Setup: `includes/API/LicenseRestController.php:235`
  - Action: `admin/src/pages/licensing.js:231`
  - Request: `admin/src/pages/licensing.js:775`
  - Response: `includes/API/LicenseRestController.php:266`
  - Visible: `admin/src/pages/licensing.js:778`
  - Durable: `includes/API/LicenseRestController.php:262`
  - Fresh read: `includes/API/LicenseRestController.php:123`
  - Forbidden: `includes/API/LicenseRestController.php:262`

## Alternate and failure paths

### A1
- Setup: Administrator authenticated; no active license option exists.
- Action: Submit deactivation request.
- Request: `POST /wp-json/international-press-zone/v1/license/deactivate`.
- Response: `400` with `{code:"no_license",message:"No active license to deactivate.",data:{status:400}}`.
- Visible: `No active license to deactivate.` renders; activation form remains.
- Durable: License options remain absent.
- Fresh read: `GET /wp-json/international-press-zone/v1/license` returns `200` with inactive state.
- Forbidden: No external deactivation call or plugin option write occurs.
- Evidence:
  - Setup: `includes/API/LicenseRestController.php:239`
  - Action: `admin/src/pages/licensing.js:775`
  - Request: `admin/src/pages/licensing.js:775`
  - Response: `includes/API/LicenseRestController.php:240`
  - Visible: `admin/src/pages/licensing.js:782`
  - Durable: `includes/API/LicenseRestController.php:239`
  - Fresh read: `includes/API/LicenseRestController.php:123`
  - Forbidden: `includes/API/LicenseRestController.php:239`

## Permissions and boundaries

### P1
- Setup: Actor lacks `manage_options`; active license exists.
- Action: Submit deactivation request.
- Request: `POST /wp-json/international-press-zone/v1/license/deactivate`.
- Response: `403` with `{code:"rest_forbidden",message:"You do not have permission to manage licenses.",data:{status:403}}`.
- Visible: REST denial exposes no key or entitlement.
- Durable: License remains active and options unchanged.
- Fresh read: Protected license GET returns the same `403` denial.
- Forbidden: No external release or option deletion occurs; key is not disclosed.
- Evidence:
  - Setup: `includes/API/LicenseRestController.php:286`
  - Action: `includes/API/LicenseRestController.php:106`
  - Request: `includes/API/LicenseRestController.php:102`
  - Response: `includes/API/LicenseRestController.php:287`
  - Visible: `includes/API/LicenseRestController.php:287`
  - Durable: `includes/API/LicenseRestController.php:286`
  - Fresh read: `includes/API/LicenseRestController.php:51`
  - Forbidden: `includes/API/LicenseRestController.php:286`

## Source specs

- `admin/src/pages/licensing.js`
- `includes/API/LicenseRestController.php`