Actually, the 'disable these subsystems' command was getting filtered out... because those subsystems were supposed to be blocked and therefore immutable. Woo.