carlos / platform Public

First landable increment of the layout-migration build plan (docs/superpowers/plans/2026-10-06-layout-migration-build-plan.md, on branch nested-layout-runbooks). It exists because the 2026-10-06 assessment confirmed every instance on carlos.exciting.io runs flat (no tenant isolation); this gives us a way to see that and to keep flat from coming back silently.

What it does. carlos status --layout lists every ActivatorManaged instance and its layout — nested (ok), flat (FAIL), foreign — and exits non-zero if any managed instance is still flat. Read-only; touches no spawn path, no running instance, no internal/activator.

Shape. An operator-gated, registry-backed console door GET /api/cli/status/layout classifies each route via activator.Classify (reused, not reimplemented, so the gate and the spawn path can't disagree about what "flat" is); the CLI is a thin client. API-backed per the AGENTS.md "operate via API and CLI" rule — works for a user with no box access.

Two deliberate deviations from the plan doc's Increment B, flagged for review:

1. Served through a dedicated door, not internal/status/snapshot.go + agent.go. Reason: the --instances path is metrics-backed and sees only awake units, so it structurally can't cover a hibernating managed instance — which the gate must. (This also means the plan doc's note that console lives under cmd/console/ is wrong; it's internal/console/.)
2. Only flat fails the gate. foreign is an operator-look item; fenced/conflict are not reported from this registry-only view at all (they need box-local journal/peer seams the door deliberately doesn't pass) — documented in the handler and printed as a scope caveat by the CLI.

Tests: operator-gate (byte-identical 404), classify-from-columns (flat/nested/foreign + non-managed excluded), the closed-door pin (count 36→37), and the CLI gate (flat→FAIL+exit-1, all-nested→ok, foreign/fenced render but don't fail, empty→ok). Reviewer ran go build ./..., go vet, and the console+root layout/door tests green locally; full ./... is on CI.

Sequencing: B stands alone and depends on nothing unlanded. It does not migrate anything — it only reports. The next steps (A: nested-path primitives + stop-the-drift; C: the converter) are where instances actually move, and those want their own careful review.