This matches how I run things. The disable-isn't-remove point is the one people miss most: switching an extension off in the admin panel leaves it in composer.json and it can still load migrations and hold back a core update, so it's not really gone. If you're actually done with something, remove it properly with composer remove then run php flarum migrate and php flarum cache:clear, don't just toggle it grey. The habit that's saved me the most is keeping a one-line note next to each extension for why it's installed. If I ever can't fill that line in, that's usually my answer come audit time.
