I worked it out!!! Stupid HTML GUI is hard coded to send that internal captive portal setup the second you configure anything to do with captive portal. Even external captive portal.
But if you are using external captive portal, you never turn on the internal one. Why would you?
But the Instant is rejecting the internal captive portal config options if it is not turned on.
Go turn on your internal captive portal (even tough you don’t use it) and the config will push through perfectly!
So much time wasted because they don’t do robust regression testing. :(