Operational kill-switches for user-visible features. Each registered flag is default-ON; flipping it OFF reverts the owning surface to its pre-feature render path on the next page load — cutting a regression's time-to-revert from a rebuild-and-roll (~15–30 min) to a toggle (seconds). Flags are never spend or configuration gates.