A child toggle needs three defences, not one

Settings grow nested flags: a switch that only makes sense while some parent condition holds — a credential present, a key entered, a capability available. The row is drawn disabled while the parent is false, and that is where the trouble starts: disabled means the user can no longer switch it off, so a child left ON when the parent goes false is now reachable only by code.

Three defences, at three layers, and each one covers a case the others do not:

1. The row turns its own child off when it sees the gate close.
2. The state owner clears it wherever the parent is withdrawn (login-state-fans-out-to-settings).
3. The consumer refuses to act on the child alone (combine-two-flags-to-gate).

The row is the one everybody writes first, and on its own it is the weakest of the three.