Standard app settings, like iPhone Settings: apps declare settings in forge.json; one store edited from the forge or the app; live, no restart #5943

Owner, 2026-10-25: "had a really cool idea. App settings can be edited in the app and the forge. Standardize settings like an iPhone and its apps."

Why now: the arm's Open/Closed switch lived only inside the app, so closing the app locked its owner out (arm issue: the lockout). Every app reinvents its own settings page.

Done when (the iOS Settings model):

• Apps declare their settings in forge.json, with a settings block of typed entries: toggle, choice, number (min/max/unit), text, time, secret (write-only), each with label, help, default and section. For example, the arm declares open (toggle, "Open to visitors"), note (text) and reopenAt (time).
• One store, one API. The forge keeps the values per app and environment, with history (who changed what, when) and undo. The app reads them over the forge's app API, or a mounted file, and gets a push on change, so it never needs a restart to see a new value.
• Two doors to the same values:

- The forge: each app's page gets a Settings pane, rendered from the declaration with the component library (#5817). It looks the same for every app, and there's a forge-wide Settings → Apps list like the iPhone's. - The app: a standard settings sheet the app can embed (/_settings served by the forge runtime, styled with the app's tokens), or its own UI over the same API.

• The rules carry over: who may change what (owner / admin / team) comes from the app's roles; secret values never come back out. A setting that would lock the owner out (like closing an app) is always reachable from the forge.
• The first adopters: the arm (open/closed, note, reopen time, camera fps, the visitor turn length), then the app template, so every new app gets it free.
• Tests:

- A change in the forge shows in the app within 2 s without a restart. - A change in the app shows in the forge. - Role rules are enforced on both doors. - Secrets are write-only.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.