```yaml
id: UJ-003
title: Activate or deactivate a language
actors: [administrator]
surface: admin-spa
goal: Administrator changes one non-default language availability and fresh state preserves it.
trigger: Toggle language status at /wp-admin/admin.php?page=international-press-zone#/languages.
fixtures: [authenticated-admin, active-nondefault-language]
success_state:
  visible: "Language deactivated" or "Language activated" renders and toggle matches state.
  durable: wp_ipz_languages.is_active equals requested state.
  persistence: Fresh GET /wp-json/international-press-zone/v1/languages/{code} returns requested state.
source_specs: [admin/src/pages/languages.js, includes/API/LanguagesRestController.php, includes/Core/LanguageManager.php]
readiness: draft
canonical: false
blockers: []
```

## Path

| Hop | Evidence |
|---|---|
| UI trigger | `admin/src/pages/languages.js:202` |
| Request construction | `admin/src/pages/languages.js:697` |
| Endpoint auth and parse | `includes/API/LanguagesRestController.php:236` |
| Authoritative write | `includes/Core/LanguageManager.php:451` |
| Response | `includes/API/LanguagesRestController.php:704` |
| Terminal render | `admin/src/pages/languages.js:700` |

## Happy path

### H1
- Setup: Administrator authenticated; active non-default language exists.
- Action: Toggle that language off.
- Request: `POST /wp-json/international-press-zone/v1/languages/{code}/deactivate`.
- Response: `200` with `{success:true,message:"Language updated successfully."}`.
- Visible: `Language deactivated` renders; refreshed toggle is off.
- Durable: Matching `wp_ipz_languages.is_active` equals `0`.
- Fresh read: `GET /wp-json/international-press-zone/v1/languages/{code}` returns `200` with `isActive:false`.
- Forbidden: Default language and every other language remain unchanged.
- Evidence:
  - Setup: `admin/src/pages/languages.js:202`
  - Action: `admin/src/pages/languages.js:202`
  - Request: `admin/src/pages/languages.js:697`
  - Response: `includes/API/LanguagesRestController.php:704`
  - Visible: `admin/src/pages/languages.js:700`
  - Durable: `includes/Core/LanguageManager.php:451`
  - Fresh read: `includes/API/LanguagesRestController.php:116`
  - Forbidden: `includes/Core/LanguageManager.php:451`

## Alternate and failure paths

### A1
- Setup: Administrator authenticated; target language is current default.
- Action: Attempt to toggle default language off.
- Request: `POST /wp-json/international-press-zone/v1/languages/{code}/deactivate`.
- Response: `400` with `{code:"cannot_deactivate_default",message:"Cannot deactivate default language.",data:{status:400}}`.
- Visible: `Cannot deactivate default language.` renders; toggle remains on.
- Durable: Default `wp_ipz_languages.is_active` remains `1`.
- Fresh read: `GET /wp-json/international-press-zone/v1/languages/{code}` returns `200` with `isActive:true` and `isDefault:true`.
- Forbidden: No language availability or default flag changes.
- Evidence:
  - Setup: `includes/API/LanguagesRestController.php:695`
  - Action: `admin/src/pages/languages.js:202`
  - Request: `admin/src/pages/languages.js:697`
  - Response: `includes/API/LanguagesRestController.php:697`
  - Visible: `admin/src/pages/languages.js:708`
  - Durable: `includes/API/LanguagesRestController.php:695`
  - Fresh read: `includes/API/LanguagesRestController.php:116`
  - Forbidden: `includes/API/LanguagesRestController.php:695`

## Permissions and boundaries

### P1
- Setup: No authenticated WordPress session.
- Action: Submit deactivate request for a non-default language.
- Request: `POST /wp-json/international-press-zone/v1/languages/{code}/deactivate`.
- Response: `401` with `{code:"rest_forbidden",message:"Sorry, you are not allowed to do that.",data:{status:401}}`.
- Visible: REST denial exposes no mutation result.
- Durable: `wp_ipz_languages.is_active` remains unchanged.
- Fresh read: Anonymous mutation retry returns the same `401` denial.
- Forbidden: No language row changes; no administrator nonce is disclosed.
- Evidence:
  - Setup: `includes/API/LanguagesRestController.php:736`
  - Action: `includes/API/LanguagesRestController.php:260`
  - Request: `includes/API/LanguagesRestController.php:255`
  - Response: `includes/API/LanguagesRestController.php:736`
  - Visible: `includes/API/LanguagesRestController.php:736`
  - Durable: `includes/API/LanguagesRestController.php:736`
  - Fresh read: `includes/API/LanguagesRestController.php:736`
  - Forbidden: `includes/API/LanguagesRestController.php:736`

## Source specs

- `admin/src/pages/languages.js`
- `includes/API/LanguagesRestController.php`
- `includes/Core/LanguageManager.php`