The unattended policy has two states: wait for an idle moment, and — on a host
that is never idle — book a forced upgrade for the next midnight. Neither is an
operator saying "take it now". There was no way to say that at all. The only
lever was the booking file:

    echo 1 > ~/.local/state/coderai/force-upgrade-at

which works by accident (epoch 1 is in the past, so the next tick fires), is
written nowhere, and is NOT self-clearing when the run finds nothing to upgrade.
Observed on a production orchestrator: a `1` left from one forced release turned
every hourly tick for the next day into "a FORCED upgrade is booked", silently
disarming the idle check that protects live requests. Nobody asked for that; it
was the residue of a one-off.

So the three things an operator actually wants are options now:

  --force          upgrade and restart on THIS run, idle or not, and leave no
                   booking behind. It sets FORCED before the upgrade block, so
                   it also lands an upgrade already sitting in the image behind
                   deferrals — that host is precisely who types this.
  --force-at WHEN  book one (anything date -d takes). No second timer: the
                   hourly tick at or after WHEN takes it.
  --cancel-force   drop a booking, whether an operator made it or the script
                   armed it after MAX_DEFERRALS busy ticks. The arming message
                   now names this instead of telling you to delete a file.

The two booking edits return before the runner check and before anything touches
a container engine, so they work on a host where the upgrade itself could not
run, and they are written to the same log as the runs they change — a schedule
change belongs in the history of the schedule.

--help exists, and an unknown option is a usage error rather than a silent
unattended run under a typo.

Also drops one install's name from a sentence in the guide that did not need it.

13 tests. Suite: 3105 passed, the same 13 known-stale failures.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KnfkxBpcZ1v6ypRFFyhrVM