carlos / platform Public

Instance update settings, plan 5: surfaces (settings spec rev 11 §5). Copy awaiting Paul's review.

What it adds:

• carlos apps set gains --instance-control, --default-updates, --default-channel and --default-major, sent to plan 3's app policy door. Zero-downtime plan 6's approved apps set text is unchanged; the new flags get their own usage paragraph.
• carlos instances set <host> (--updates, --channel, --major, --pin; an empty value clears) and carlos instances update <host> [--fast-track]. Only the flags given are sent. Settings go first and the channel second, through the existing channel door with its pipeline rules. Console refusals are printed verbatim. Both commands refuse direct bucket mode, naming the console.
• carlos instances list: REASON shows the settings reason after the rollout reason. A box's update report is joined only with positive account/app attribution: boxes stamp it on each report entry and on root's stored decision (status.HostUpdates and release.Consumed gain additive account/app fields). A report without attribution contributes only "enforced or not".
• The console instance page gains an Updates section. It shows a status line, auto updates, the channel (read-only, with a CLI hint), major and pin, Save, and Update now, with "skip the safety delay" for owners only, behind fresh auth. It shares one core with plan 3's JSON doors, which answer byte for byte as before. Settings the app keeps for itself are read-only. No control is ever disabled. Each live control carries the value the member saw, so a stale page never undoes another member's change, and clearing works while the fleet gate is closed.
• A hostname that changes tenant on a box resolves its update settings fresh (task 8). The registry upsert stops carrying updatesettings and buildstate across an effective account/app change. Root and the agent ignore a stored decision tagged for another tenant. Untagged legacy files are read as before.
• docs/site/cli.md sections for the new verbs, and a README roll note.

Copy: 46 new drafts in internal/updatewords/words_surfaces.go (TODO-COPY). TestApprovedCopyIsApplied fails until docs/superpowers/plans/2026-10-07-instance-settings-5-copy.json records Paul's approved text, so CI is red on that one test only until the copy is applied.

Review: per-task reviews are in the SDD ledger. Astra rejected r1 and r2 and accepted r3; task 8 was rejected in r4 and r5 and accepted in r6. See docs/superpowers/plans/CODEX-FINDINGS-SETTINGS-IMPL-5*.md.

Not merged, not rolled. Do not merge before the copy is approved and applied.