@bongos/core 1.19.114 → 1.19.115

package/public-landing/projects.html

@@ -37,7 +37,6 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
    Same trust boundary as /create — every button only ASKS (enqueues an
    intent); the control-plane runner does the real infra work (ADR 0111 §2). */
 .viewWrap{padding-bottom:40px;}
-.viewWrap.narrow{max-width:820px;}
 .card{margin-bottom:26px;}
 
 /* The bongo pair on the New-project view. Component-scoped custom properties,
@@ -51,6 +50,207 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
   --skin-hi:#fffdf7;--skin-mid:#f4e6cd;--skin-lo:#cdb896;--drum-shadow:var(--ink);}
 :root[data-mode="dark"] .bongos{--skin-hi:#fdf7ea;--skin-mid:#efe1c8;--skin-lo:#c3ae90;--drum-shadow:#000;}
 @media (prefers-color-scheme:dark){:root:not([data-mode="light"]) .bongos{--skin-hi:#fdf7ea;--skin-mid:#efe1c8;--skin-lo:#c3ae90;--drum-shadow:#000;}}
+
+/* ── the create wizard (task 1002763, absorbed from /create) ──────────────
+   Tokens, the reset, the sky and the shared card/button/rail vocabulary all
+   come from cosmos.css; what lands here is the wizard's own structure. No
+   literal color anywhere: every surface is a cosmos token or a color-mix
+   over one, so both modes and a re-brand carry it for free (C1/C2/C4).
+   Naming: the wizard's field wrapper is .wizField — cosmos owns .field (the
+   orb map) — and its done checklist is .humanSteps — cosmos owns .steps
+   (the four-beat rail). Its inputs are scoped to the view so the glass
+   search pills (#mapQ, #mineQ) keep their own look. */
+.panel{display:none;}
+.panel.on{display:block;animation:fadeStep .3s ease both;}
+@keyframes fadeStep{from{opacity:0;transform:translateX(10px)}to{opacity:1;transform:none}}
+/* show() moves focus to each panel's h1 for keyboard/SR context — keep the
+   focus, lose the ring (a black rectangle around a heading; owner walk) */
+h1[tabindex="-1"]:focus{outline:none;}
+/* the done step needs the full card width — the split collapses and the
+   bongo pair steps aside for the checklist */
+.createSplit.wizDone{display:block;}
+.createSplit.wizDone .bongoCell{display:none;}
+
+.wizField{display:block;margin-bottom:18px;}
+.wizField>span{display:block;font-size:13.5px;font-weight:700;color:var(--ink-soft);margin-bottom:7px;letter-spacing:0.2px;}
+.wizField small{font-weight:500;color:var(--ink-faint);}
+#view-new input[type=text]{
+  width:100%;font-family:var(--font-body);font-size:17px;font-weight:600;color:var(--ink);
+  background:var(--bg-card);border:2px solid var(--line);border-radius:14px;padding:13px 16px;outline:none;
+  transition:border-color .15s ease, box-shadow .15s ease;
+}
+/* no fade toward the card — a 70% mix washed placeholders to 2.89:1 (task 1002749) */
+#view-new input[type=text]::placeholder{color:var(--ink-faint);font-weight:500;}
+#view-new input[type=text]:focus{border-color:var(--accent);box-shadow:0 0 0 4px color-mix(in srgb,var(--accent) 13%,transparent);}
+#view-new input[type=text].bad{border-color:var(--err);}
+.hint{font-size:13px;font-weight:600;color:var(--ink-faint);margin-top:7px;min-height:18px;}
+.hint.ok{color:var(--ok);}
+.hint.err{color:var(--err);}
+.hint code{font-family:var(--font-mono);font-size:12.5px;background:var(--bg-deep);border-radius:6px;padding:1px 6px;color:var(--accent-deep);}
+
+.row2{display:grid;grid-template-columns:1fr 1fr;gap:14px;}
+
+/* choice cards (greenfield / adopt) */
+.choices{display:grid;grid-template-columns:1fr 1fr;gap:14px;margin-bottom:18px;}
+.choice{
+  text-align:left;cursor:pointer;background:var(--bg-card);border:2px solid var(--line);border-radius:18px;
+  padding:16px;font-family:var(--font-body);transition:all .15s ease;
+}
+.choice:hover{border-color:var(--rule);transform:translateY(-1px);}
+.choice[aria-pressed=true]{border-color:var(--accent);background:color-mix(in srgb,var(--accent) 5%,var(--bg-card));box-shadow:0 8px 24px -12px color-mix(in srgb,var(--accent) 35%,transparent);}
+.choice svg{display:block;margin-bottom:9px;}
+.choice b{display:block;font-size:15.5px;font-weight:700;margin-bottom:3px;}
+.choice p{font-size:13px;font-weight:500;color:var(--ink-soft);line-height:1.45;}
+.reassure{
+  display:none;background:color-mix(in srgb,var(--sea) 8%,var(--bg-card));
+  border:1.5px solid color-mix(in srgb,var(--sea) 25%,var(--bg-card));border-radius:14px;
+  padding:12px 15px;font-size:13.5px;font-weight:500;color:color-mix(in srgb,var(--sea) 40%,var(--ink));line-height:1.5;margin-bottom:18px;
+}
+.reassure.on{display:block;}
+
+/* one-click deep link to GitHub's own "New repository" page with the name
+   pre-filled (greenfield only). No permissions — the visitor creates the empty
+   repo in GitHub's own UI; we just fill in the blanks. The GitHub brand black
+   is intentional, not a token (it must not follow a re-brand). */
+.ghbtn{
+  display:inline-flex;align-items:center;gap:9px;text-decoration:none;cursor:pointer;
+  background:#24292f;color:#fff;border:none;border-radius:999px;
+  font-family:var(--font-body);font-weight:700;font-size:15px;padding:12px 22px;
+  box-shadow:0 12px 26px -12px rgba(36,41,47,0.55);
+  transition:transform .12s ease, background .12s ease;
+}
+.ghbtn:hover{background:#1b1f24;transform:translateY(-1px);}
+.ghbtn:active{transform:translateY(0) scale(.98);}
+.ghbtn .gh{width:18px;height:18px;fill:currentColor;}
+.humanSteps .ghbtn{font-size:14px;padding:9px 16px;margin-top:10px;}
+
+.nav{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-top:26px;}
+.btn.big{width:100%;justify-content:center;font-size:18px;padding:17px 30px;}
+
+/* review list */
+.review{list-style:none;border:2px solid var(--line);border-radius:18px;overflow:hidden;margin-bottom:6px;}
+.review li{display:flex;justify-content:space-between;gap:16px;padding:13px 17px;font-size:14.5px;}
+.review li+li{border-top:1.5px solid var(--line);}
+.review .k{font-weight:600;color:var(--ink-faint);flex:0 0 auto;}
+.review .v{font-weight:700;text-align:right;word-break:break-word;}
+.review .v code{font-family:var(--font-mono);font-size:13px;background:var(--bg-deep);border-radius:6px;padding:1px 7px;color:var(--accent-deep);}
+
+/* ── done / human steps ── */
+.doneHead{display:flex;align-items:center;gap:12px;margin-bottom:8px;}
+.doneHead .tick{
+  flex:0 0 44px;width:44px;height:44px;border-radius:50%;background:var(--ok);color:var(--on-ok);
+  display:flex;align-items:center;justify-content:center;
+  animation:pop .45s cubic-bezier(.34,1.56,.64,1) both;
+}
+@keyframes pop{from{transform:scale(.4);opacity:0}to{transform:scale(1);opacity:1}}
+.humanSteps{list-style:none;counter-reset:hs;margin-top:20px;}
+.humanSteps>li{
+  position:relative;background:var(--bg-card);border:2px solid var(--line);border-radius:18px;
+  padding:16px 18px 16px 58px;margin-bottom:12px;counter-increment:hs;
+}
+.humanSteps>li::before{
+  content:counter(hs);position:absolute;left:16px;top:16px;width:28px;height:28px;border-radius:50%;
+  background:var(--bg-deep);color:var(--accent-deep);font-family:var(--font-display);font-weight:700;
+  font-size:14px;display:flex;align-items:center;justify-content:center;
+}
+.humanSteps b{font-size:15px;}
+.humanSteps p{font-size:13.5px;font-weight:500;color:var(--ink-soft);line-height:1.55;margin-top:4px;}
+/* live checklist states (task 1002694): a step the platform has verified done, and a
+   step that can't be performed yet (its prerequisite — usually the domain — is missing) */
+.humanSteps>li.sdone{border-color:color-mix(in srgb,var(--ok) 30%,var(--bg-card));background:linear-gradient(180deg,color-mix(in srgb,var(--ok) 8%,var(--bg-card)) 0%,var(--bg-card) 100%);}
+.humanSteps>li.sdone::before{content:"✓";background:var(--ok);color:var(--on-ok);}
+.humanSteps>li.slocked{opacity:.6;}
+.humanSteps details{margin-top:10px;}
+.humanSteps summary{cursor:pointer;font-weight:700;font-size:12.5px;color:var(--ink-faint);}
+.humanSteps details p{margin-top:8px;}
+.kv{
+  display:flex;align-items:center;gap:8px;margin-top:9px;background:var(--bg);border:1.5px solid var(--line);
+  border-radius:11px;padding:8px 8px 8px 12px;font-size:12.5px;
+}
+.kv .kk{font-weight:700;color:var(--ink-faint);flex:0 0 auto;}
+.kv code{font-family:var(--font-mono);font-size:12px;color:var(--accent-deep);word-break:break-all;flex:1;}
+.copy{
+  flex:0 0 auto;cursor:pointer;border-radius:8px;background:var(--bg-card);border:1.5px solid var(--line);
+  font-family:var(--font-body);font-size:11.5px;font-weight:700;color:var(--ink-soft);padding:5px 10px;
+  transition:all .12s ease;
+}
+.copy:hover{border-color:var(--accent);color:var(--accent-deep);}
+.copy.did{background:var(--ok);border-color:var(--ok);color:var(--on-ok);}
+.samePath{font-size:12.5px;font-weight:500;color:var(--ink-faint);margin-top:16px;}
+#liveProgress{margin-top:4px;}
+
+/* ── live build progress (task 2083) ── */
+.prog{
+  background:linear-gradient(180deg,color-mix(in srgb,var(--sea) 8%,var(--bg-card)) 0%,var(--bg-card) 100%);
+  border:2px solid var(--sea-soft);border-radius:18px;padding:18px 20px 16px;margin-top:14px;
+}
+.prog .stages{display:flex;list-style:none;margin-bottom:4px;}
+.prog .stages li{flex:1;display:flex;flex-direction:column;align-items:center;gap:7px;position:relative;}
+.prog .stages li:not(:first-child)::before{
+  content:"";position:absolute;top:11px;right:50%;width:100%;height:3px;border-radius:2px;
+  background:var(--sea-soft);z-index:0;margin-right:12px;
+}
+.prog .stages li.done:not(:first-child)::before{background:var(--sea);}
+.prog .sdot{
+  position:relative;z-index:1;width:24px;height:24px;border-radius:50%;
+  border:3px solid var(--sea-soft);background:var(--bg-card);display:flex;align-items:center;justify-content:center;
+}
+.prog .stages li.done .sdot{border-color:var(--sea);background:var(--sea);}
+.prog .stages li.done .sdot::after{content:"";width:8px;height:5px;border-left:2.5px solid #fff;border-bottom:2.5px solid #fff;transform:rotate(-45deg) translate(1px,-1px);}
+.prog .stages li.now .sdot{border-color:var(--sea);}
+.prog .stages li.now .sdot::after{
+  content:"";width:8px;height:8px;border-radius:50%;background:var(--sea);
+  animation:beatPulse 1.2s ease-in-out infinite;
+}
+/* idle labels match cosmos's .strip .slbl — the 55% sea mix washed to 4.15:1 in dark */
+.prog .slbl{font-size:12px;font-weight:700;color:var(--ink-faint);}
+.prog .stages li.now .slbl,.prog .stages li.done .slbl{color:color-mix(in srgb,var(--sea) 40%,var(--ink));}
+.prog .pnote{text-align:center;font-size:13px;font-weight:600;color:color-mix(in srgb,var(--sea) 45%,var(--ink-soft));min-height:18px;}
+.prog .pnote a{color:var(--accent-deep);font-weight:700;text-decoration:none;}
+.prog .pnote a:hover{text-decoration:underline;}
+.prog.isLive{background:linear-gradient(180deg,color-mix(in srgb,var(--ok) 8%,var(--bg-card)) 0%,var(--bg-card) 100%);border-color:color-mix(in srgb,var(--ok) 30%,var(--bg-card));}
+.prog.isLive .stages li.done:not(:first-child)::before{background:var(--ok);}
+.prog.isLive .stages li.done .sdot{border-color:var(--ok);background:var(--ok);}
+.prog.isLive .slbl{color:var(--ok);}
+.prog.isLive .stages li.done .slbl{color:color-mix(in srgb,var(--ok) 75%,var(--ink));}
+.prog.isLive .pnote{color:color-mix(in srgb,var(--ok) 75%,var(--ink));font-size:14px;}
+.prog.isErr{background:var(--err-soft);border-color:color-mix(in srgb,var(--err) 25%,var(--bg-card));}
+.prog.isErr .pnote{color:var(--err);}
+.again{
+  display:inline-block;margin-top:14px;font-size:13px;font-weight:700;color:var(--ink-faint);
+  background:none;border:none;cursor:pointer;font-family:var(--font-body);text-decoration:underline;
+  text-underline-offset:3px;padding:0;
+}
+.again:hover{color:var(--accent-deep);}
+
+/* the collapsed address step — a confirmation, not a form (task 1002704) */
+.addrConfirm{border:2px solid color-mix(in srgb,var(--ok) 30%,var(--bg-card));border-radius:18px;padding:18px 20px;background:linear-gradient(180deg,color-mix(in srgb,var(--ok) 8%,var(--bg-card)) 0%,var(--bg-card) 100%);margin-bottom:16px;}
+.addrConfirm.optedOut{border-color:var(--line);background:var(--bg);opacity:.75;}
+.addrBig{font-family:var(--font-display);font-weight:700;font-size:19px;letter-spacing:-0.3px;line-height:1.4;}
+.addrBig code{font-family:var(--font-mono);font-size:15px;background:var(--bg-deep);border-radius:8px;padding:2px 9px;color:var(--accent-deep);word-break:break-all;}
+.addrConfirm>p{font-size:13.5px;font-weight:500;color:var(--ink-soft);line-height:1.5;margin-top:6px;}
+.addrConfirm details{margin-top:12px;}
+.addrConfirm summary{cursor:pointer;font-size:13px;font-weight:700;color:var(--ink-faint);}
+.addrConfirm details .inner{margin-top:10px;}
+.addrOpt{display:flex;align-items:flex-start;gap:8px;margin-top:12px;font-size:12.5px;font-weight:600;color:var(--warn);line-height:1.5;}
+.addrOpt input{margin-top:2px;}
+
+/* GitHub repo picker (task 1002099) */
+#ghConnect .btn{margin-top:4px;}
+.ghlist{margin-top:8px;max-height:220px;overflow-y:auto;border:1px solid var(--line);border-radius:10px;background:var(--bg-deep);}
+.ghlist:empty{display:none;}
+/* rows sit on --bg-deep, so their tints mix over THAT, not the card */
+.ghrow{display:flex;align-items:center;gap:8px;width:100%;text-align:left;background:none;border:0;border-bottom:1px solid color-mix(in srgb,var(--ink) 8%,transparent);padding:9px 12px;font:inherit;font-size:13.5px;color:var(--ink);cursor:pointer;}
+.ghrow:last-child{border-bottom:0;}
+.ghrow:hover{background:color-mix(in srgb,var(--accent) 6%,var(--bg-deep));}
+.ghrow[aria-selected=true]{background:color-mix(in srgb,var(--accent) 12%,var(--bg-deep));box-shadow:inset 3px 0 0 var(--accent);font-weight:600;}
+/* --ink-soft, not --ink-faint: the badge tint is the darkest ground on the page,
+   and faint ink only reaches 3.96:1 on it (task 1002749). */
+.ghrow .priv{margin-left:auto;font-size:11px;font-weight:600;color:var(--ink-soft);background:color-mix(in srgb,var(--ink) 8%,transparent);border-radius:5px;padding:1px 6px;}
+
+/* 840px matches cosmos's createSplit collapse, the breakpoint the old /create
+   used (860) — the two-up grids and the bongo cell fold together */
+@media (max-width:840px){.row2,.choices{grid-template-columns:1fr;}}
 </style>
 </head>
 <body>
@@ -117,8 +317,8 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
 </header>
 
 <noscript>
-  <div class="viewWrap wrap"><div class="fieldNote">The project map needs JavaScript. You can still
-    <a href="/create">start a project</a> or read what this is on the <a href="/">home page</a>.</div></div>
+  <div class="viewWrap wrap"><div class="fieldNote">The project hub needs JavaScript — the map, your
+    projects, and starting a new one all live here. You can read what this is on the <a href="/">home page</a>.</div></div>
 </noscript>
 
 <!-- ══════════════════ VIEW · MAP ══════════════════════════════════════════
@@ -296,7 +496,7 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
 
         <section class="empty" id="empty" hidden>
           <p>You don't own any projects yet. Creating one takes about five minutes — name it, pick a home for its code, and it gets an address of its own in this sky.</p>
-          <a class="btn" href="/create">Create your first project</a>
+          <a class="btn" href="?view=new" data-nav-to="new">Create your first project</a>
         </section>
         <ul class="projects" id="projectsList"></ul>
         <p class="finePrint">Buttons here ask the platform to act — a runner does the real work, and each card reports only what was verified, with a timestamp. Standups keep running even with this tab closed.</p>
@@ -306,31 +506,194 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
 </section>
 
 <!-- ══════════════════ VIEW · NEW PROJECT ══════════════════════════════════
-     Step 1 of the four-beat rail. Naming it here hands straight into the
-     wizard with the name already seeded (/create?name=…), which is the entry
-     point the wizard already reads. -->
+     The whole create wizard, absorbed from /create (task 1002763; direction
+     §4 — that route now 302s here). Six panels behind the four-beat rail; the
+     wizard block in the script below drives them. Same trust boundary as
+     ever: every button here only ENQUEUES a provisioning request (ADR 0111).
+     The name panel carries a static `on` so a no-script visitor still reads
+     step 1 rather than an empty card. -->
 <section id="view-new" hidden>
-  <div class="wrap viewWrap narrow">
+  <div class="wrap viewWrap">
     <div class="card">
-      <ol class="steps">
-        <li class="now"><span class="snum">1</span><span class="slbl">Name</span></li>
-        <li><span class="snum">2</span><span class="slbl">Home</span></li>
-        <li><span class="snum">3</span><span class="slbl">Address</span></li>
-        <li><span class="snum">4</span><span class="slbl">Create</span></li>
+      <ol class="steps" aria-label="Creation steps">
+        <li class="now" data-step="1"><span class="snum">1</span><span class="slbl">Name</span></li>
+        <li data-step="2"><span class="snum">2</span><span class="slbl">Home</span></li>
+        <li data-step="3"><span class="snum">3</span><span class="slbl">Address</span></li>
+        <li data-step="4"><span class="snum">4</span><span class="slbl">Create</span></li>
       </ol>
 
       <div class="createSplit">
         <div>
-          <h1>Start a project</h1>
-          <p class="lede">Your own project: its own repository, its own home on the web, and a hall of AI builders
-            who do the building. You set the direction; agents lay down the code.</p>
-          <form class="attach" id="newForm">
-            <input type="text" id="newName" placeholder="What should it be called?" maxlength="80" autocomplete="off" aria-label="Project name">
-            <button class="btn" type="submit">Continue →</button>
-          </form>
-          <p class="finePrint">Free while we find our feet. Your project’s repo and server are yours —
-            <span data-brand-product-inline>Cloud Bongos</span> is <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">open source (AGPL-3.0)</a>
-            and capture-resistant by design.</p>
+          <!-- step 0 · sign-in gate -->
+          <section class="panel" id="panel-gate" aria-labelledby="gate-h">
+            <h1 id="gate-h">Create a project</h1>
+            <p class="lede">Your own <strong data-brand-product-inline>Cloud Bongos</strong> project: its own repository, its own home on the web, and a hall of AI builders who do the building. You set the direction; agents lay down the code. Sign in with GitHub so the project belongs to <em>you</em> from the very first beat.</p>
+            <!-- The wizard's own sign-in opts into repo scope (read:user + public_repo) up
+                 front (&repos=1) — anyone here intends to create a project, which needs repo
+                 access, so we ask once at sign-in instead of a second "Connect" step at Home.
+                 Hall + CLI sign-in stay identity-only (ADR 0143 least-privilege default). -->
+            <a class="btn big" id="wizSignin" href="/api/bongos/auth/web/start?return=/projects%3Fview%3Dnew&amp;repos=1">
+              <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
+              Sign in with GitHub
+            </a>
+            <!-- Trust link → the AGPL license text (task 1002705): the old private-repo URL
+                 404ed, and no public code artifact exists until the ADR 0099 mirror flips
+                 (~2026-11; npm scopes are private too) — the license is the one live,
+                 instance-neutral artifact behind the claim today. -->
+            <p class="finePrint">Free while we find our feet. Your project’s repo and server are yours —
+              <span data-brand-product-inline>Cloud Bongos</span> is <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">open source (AGPL-3.0)</a>
+              and capture-resistant by design.</p>
+            <div class="alert" id="wizGateAlert" role="alert"></div>
+          </section>
+
+          <!-- step 1 · name (the hub's original step-1 form, now the wizard's) -->
+          <section class="panel on" id="panel-name" aria-labelledby="name-h">
+            <h1 id="name-h">Start a project</h1>
+            <p class="lede">Your own project: its own repository, its own home on the web, and a hall of AI builders
+              who do the building. You set the direction; agents lay down the code.</p>
+            <form id="newForm" data-next="2">
+              <label class="wizField"><span>Project name</span>
+                <input type="text" id="newName" placeholder="What should it be called?" autocomplete="off" maxlength="80" aria-label="Project name">
+                <div class="hint" id="h-name">&nbsp;</div>
+              </label>
+              <div class="nav">
+                <span></span>
+                <button type="submit" class="btn">Continue →</button>
+              </div>
+            </form>
+            <p class="finePrint">Free while we find our feet. Your project’s repo and server are yours —
+              <span data-brand-product-inline>Cloud Bongos</span> is <a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">open source (AGPL-3.0)</a>
+              and capture-resistant by design.</p>
+          </section>
+
+          <!-- step 2 · home (repo + mode) -->
+          <section class="panel" id="panel-home" aria-labelledby="home-h">
+            <h1 id="home-h">Where the code lives</h1>
+            <p class="lede">Every project is a real GitHub repository that you own. Start from a clean slate, or bring a repo you already have.</p>
+            <form data-next="3">
+              <div class="choices" role="group" aria-label="Starting point">
+                <button type="button" class="choice" id="c-green" aria-pressed="true">
+                  <!-- token-built, not platform orange — public-landing/ ships wholesale to
+                       every instance (C5), so a re-branded accent must carry these too -->
+                  <svg width="30" height="30" viewBox="0 0 30 30" fill="none" aria-hidden="true"><path d="M15 26V14" stroke="var(--accent)" stroke-width="2.6" stroke-linecap="round"/><path d="M15 15c0-5 3.5-8.5 9-8.5 0 5.5-3.5 8.5-9 8.5Z" fill="color-mix(in srgb,var(--accent) 45%,var(--bg-card))" stroke="var(--accent)" stroke-width="2"/><path d="M15 18c0-3.8-2.6-6.5-7-6.5 0 4.3 2.7 6.5 7 6.5Z" fill="color-mix(in srgb,var(--accent) 22%,var(--bg-card))" stroke="var(--accent)" stroke-width="2"/></svg>
+                  <b>Start fresh</b>
+                  <p>A new, empty <strong>public</strong> repo. We scaffold everything: config, first version, kickoff tasks.</p>
+                </button>
+                <button type="button" class="choice" id="c-adopt" aria-pressed="false">
+                  <svg width="30" height="30" viewBox="0 0 30 30" fill="none" aria-hidden="true"><rect x="4" y="9" width="22" height="16" rx="3" fill="color-mix(in srgb,var(--accent) 22%,var(--bg-card))" stroke="var(--accent)" stroke-width="2"/><path d="M4 13h22" stroke="var(--accent)" stroke-width="2"/><path d="M10 9V6.5A1.5 1.5 0 0 1 11.5 5h7A1.5 1.5 0 0 1 20 6.5V9" stroke="var(--accent)" stroke-width="2"/><path d="M12 19h6" stroke="var(--accent-deep)" stroke-width="2.4" stroke-linecap="round"/></svg>
+                  <b>Adopt a repo I have</b>
+                  <p>Layer <span data-brand-product-inline>Cloud Bongos</span> onto an existing repository — history, code, and backlog intact. Public or private, we never change it.</p>
+                </button>
+              </div>
+              <div class="reassure" id="adoptNote">Adopting never overwrites your files: you get a conflict pre-flight first, nothing is written until you accept, and your existing backlog (issues, TODOs) is imported as real tasks.</div>
+
+              <!-- GitHub-integrated repo picker (adopt) + auto-create (fresh) — task 1002099.
+                   Progressive enhancement: when the signed-in user grants repo access we let
+                   them PICK a repo (adopt) or NAME one we auto-create (fresh). Without that
+                   access — not granted yet, or the server can't store the token — we fall back
+                   to the manual owner/repo inputs below (#manualHome), which stay authoritative. -->
+              <div id="ghConnect" class="reassure">
+                <p id="ghConnectMsg">&nbsp;</p>
+                <button type="button" class="btn" id="ghConnectBtn">Allow repo access</button>
+                <button type="button" class="linklike" id="ghManualToggle">or enter it manually</button>
+              </div>
+              <div id="ghBusy" class="hint" hidden>Reading your GitHub repositories…</div>
+              <div id="ghAdopt" class="wizField" hidden>
+                <span>Pick one of your repositories</span>
+                <input type="text" id="ghSearch" placeholder="Search your repos…" autocomplete="off">
+                <div id="ghList" class="ghlist" role="listbox" aria-label="Your repositories"></div>
+                <div class="hint" id="ghAdoptHint">&nbsp;</div>
+                <!-- visibility stated on EVERY repo path (task 1002721) — the picker
+                     marks private repos, and this says what adoption does about it -->
+                <div class="hint">We never change a repo’s visibility — public stays public, private stays private.</div>
+              </div>
+              <div id="ghFresh" class="wizField" hidden>
+                <span>New repository name</span>
+                <input type="text" id="ghNewName" placeholder="mercury" autocomplete="off" maxlength="100">
+                <!-- visibility is stated on EVERY repo path (task 1002721) — this baked
+                     line is the floor; updateFreshPreview() replaces it with the same
+                     claim plus the resolved repo URL once a name is typed -->
+                <div class="hint" id="ghFreshHint">We’ll create an empty <strong>public</strong> repo — projects here are open by design. Want private code? Create the repo yourself on GitHub and “adopt” it instead.</div>
+              </div>
+
+              <div class="row2" id="manualHome">
+                <label class="wizField"><span>GitHub owner <small>(user or org)</small></span>
+                  <input type="text" id="f-owner" placeholder="acme" autocomplete="off" maxlength="60">
+                </label>
+                <label class="wizField"><span>Repository name</span>
+                  <input type="text" id="f-repo" placeholder="mercury" autocomplete="off" maxlength="120">
+                </label>
+                <!-- visibility stated BEFORE GitHub's own radio is the first place it
+                     appears (task 1002721, owner firsthand in the QA walk) -->
+                <div class="hint" style="grid-column:1 / -1;">Creating the repo yourself on GitHub? Public or private is your choice there — both work here, and we never change it.</div>
+              </div>
+              <div class="hint" id="h-home">&nbsp;</div>
+              <div class="nav">
+                <button type="button" class="btn ghost" data-back="1">← Back</button>
+                <button type="submit" class="btn">Next →</button>
+              </div>
+            </form>
+          </section>
+
+          <!-- step 3 · address — a CONFIRMATION, not a form (task 1002704: every project
+               gets its slug subdomain assigned up front; opt-out lives in the disclosure).
+               The domainless default was a proven dead-end (QA walk, task 1002702). -->
+          <section class="panel" id="panel-address" aria-labelledby="addr-h">
+            <h1 id="addr-h">Its address in the sky</h1>
+            <p class="lede">The handle names your project on the platform — and its address comes with it. Sign-in, sharing, everything just works from the moment it stands up.</p>
+            <form data-next="4">
+              <label class="wizField"><span>Project handle</span>
+                <input type="text" id="f-slug" placeholder="mercury" autocomplete="off" maxlength="40" spellcheck="false">
+                <div class="hint" id="h-slug">&nbsp;</div>
+              </label>
+              <div class="addrConfirm" id="addrConfirm">
+                <div class="addrBig" id="addrAssigned"></div>
+                <p id="addrAssignedNote">Yours from the moment it stands up. You can point a domain you own at it any time.</p>
+                <details id="addrCustom">
+                  <summary>Use a domain I own instead</summary>
+                  <div class="inner">
+                    <label class="wizField"><span>Domain you own</span>
+                      <input type="text" id="f-domain" placeholder="mercury.example.com" autocomplete="off" maxlength="253" spellcheck="false">
+                      <div class="hint" id="h-domain">&nbsp;</div>
+                    </label>
+                    <label class="addrOpt"><input type="checkbox" id="f-noaddr">
+                      <span>Start without an address — possible, but sign-in on your project can’t be set up until it has one.</span>
+                    </label>
+                  </div>
+                </details>
+              </div>
+              <div class="nav">
+                <button type="button" class="btn ghost" data-back="2">← Back</button>
+                <button type="submit" class="btn">Next →</button>
+              </div>
+            </form>
+          </section>
+
+          <!-- step 4 · review + create -->
+          <section class="panel" id="panel-review" aria-labelledby="rev-h">
+            <h1 id="rev-h">Ready to roll</h1>
+            <p class="lede">One tap files the request and the platform starts standing your project up — server, database, address. Here's the beat you're about to drop:</p>
+            <ul class="review" id="reviewList"></ul>
+            <div class="alert" id="createAlert" role="alert"></div>
+            <div class="nav" style="flex-direction:column;align-items:stretch;">
+              <button type="button" class="btn big" id="doCreate">Create my project</button>
+              <button type="button" class="btn ghost" data-back="3" style="align-self:flex-start;margin-top:10px;">← Back</button>
+            </div>
+            <p class="finePrint">This files the request; the control plane does the real standup and nothing touches servers from this page. You'll get the few steps only you can do right after.</p>
+          </section>
+
+          <!-- done · the human steps -->
+          <section class="panel" id="panel-done" aria-labelledby="done-h">
+            <div class="doneHead">
+              <span class="tick" aria-hidden="true"><svg width="22" height="22" viewBox="0 0 22 22" fill="none"><path d="M4 11.5 9 16.5 18 6" stroke="currentColor" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"/></svg></span>
+              <h1 id="done-h">The drums are rolling</h1>
+            </div>
+            <p class="lede" id="doneLede"></p>
+            <div id="liveProgress"></div>
+            <h2 style="font-family:var(--font-display);font-size:19px;margin-top:22px;">Your steps — the parts only you can play</h2>
+            <ol class="humanSteps" id="humanSteps"></ol>
+            <p class="samePath">This is the same sequence the <code style="font-family:var(--font-mono)">/new-project</code> assistant and <code style="font-family:var(--font-mono)">bongos onboard</code> use — three doors, one path.</p>
+          </section>
         </div>
 
         <!-- the bongo pair — one mark on every surface (owner, 2026-08-13).
@@ -481,6 +844,10 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       else a.removeAttribute('aria-current');
     });
     try { history.replaceState(null, '', '?view=' + v); } catch (e) {}
+    /* the shell's sign-in door returns the visitor to the view they left, and
+       carries the repo scope when that view is the wizard (ADR 0143: the
+       create path asks once up front instead of a second consent at Home) */
+    $('signinTop').href = '/api/bongos/auth/web/start?return=/projects%3Fview%3D' + v + (v === 'new' ? '&repos=1' : '');
     /* the mine view is the only one that polls; it re-reads on entry so a
        card that changed while you were on the map is not stale */
     if (v === 'mine' && me) refreshList();
@@ -492,9 +859,11 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       if (skyNeedsRebuild) rebuildSkyBodies();
       startSky();
     } else { stopSky(); hideHover(); }
-    /* focus the name field only on a deliberate move into the view — never on
-       boot, where it would steal focus from whatever the visitor arrived at */
-    if (v === 'new' && focus) $('newName').focus();
+    /* the wizard runs only on stage too (C8): enter() paints the right step
+       (focusing only on a deliberate move — never on boot, where it would
+       steal focus from whatever the visitor arrived at) and leave() parks
+       its watch + manifest polls */
+    if (v === 'new') wizard.enter(focus); else wizard.leave();
   }
 
   document.querySelectorAll('[data-nav]').forEach(function (a) {
@@ -1548,14 +1917,984 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     $('mapStars').appendChild(frag);
   })();
 
-  /* ══ NEW PROJECT — step 1 of the four-beat rail. Naming it here hands into
-     the wizard with the name already seeded; /create?name= is the entry point
-     the wizard already reads, so nothing about the flow changes. ══ */
-  $('newForm').addEventListener('submit', function (ev) {
-    ev.preventDefault();
-    var name = String($('newName').value || '').trim();
-    location.assign('/create' + (name ? '?name=' + encodeURIComponent(name) : ''));
-  });
+  /* ══ THE CREATE WIZARD (task 1002763) — absorbed whole from /create, which
+     now 302s here. An inner scope so its ~40 helpers stay out of the hub's
+     namespace; it shares the hub's $, esc, API and `me`, so there is one
+     GET /me, one mode toggle and one identity chip on the page. The hub talks
+     to it through exactly three doors: enter(focus) / leave() from setView —
+     the same start/stop contract the sky obeys (C8) — and onAuth() from the
+     boot's identity settle. Same trust boundary as ever: every call here only
+     ENQUEUES; the control-plane runner does the real infra work (ADR 0111). ══ */
+  var wizard = (function () {
+    var root = $('view-new');
+
+    /* ── state ── */
+    var DRAFT_KEY = 'cb-create-draft';
+    var CREATED_KEY = 'cb-created-instance';
+    var state = { step: 0, name: '', mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
+    try { Object.assign(state, JSON.parse(sessionStorage.getItem(DRAFT_KEY) || '{}')); } catch (e) {}
+    var authKnown = false;   /* flips true when the boot's /me settles, either way */
+
+    /* A name handed over by URL (the /create?name= redirect still carries it,
+       task 2087→1002763): seed the draft BEFORE boot's setView rewrites the
+       URL to its bare '?view=' form, so the seed survives the GitHub sign-in
+       round-trip and a later reload can't re-seed over the visitor's edits. */
+    try {
+      var handedName = new URLSearchParams(location.search).get('name');
+      if (handedName && handedName.trim()) {
+        state.name = handedName.trim().slice(0, 80);
+        state.slug = deriveSlug(state.name); state.slugTouched = false;
+        state.repo = deriveRepo(state.name); state.repoTouched = false;
+        state.step = state.step >= 1 && state.step <= 4 ? state.step : 1;
+        try { sessionStorage.setItem(DRAFT_KEY, JSON.stringify(state)); } catch (e) {}
+      }
+    } catch (e) {}
+
+    /* Mirror provisioning.isValidSlug (DNS/db-safe): 2–40 of [a-z0-9-], starts+ends
+       alnum, no double dash. Client-side pre-check; the server re-validates. */
+    function validSlug(s) {
+      var v = String(s || '');
+      return v.length >= 2 && v.length <= 40 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(v) && v.indexOf('--') === -1;
+    }
+    function slugify(name, maxLen) {
+      return String(name || '').toLowerCase()
+        .replace(/['’]/g, '')
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/-+/g, '-')
+        .replace(/^-|-$/g, '')
+        .slice(0, maxLen);
+    }
+    function deriveSlug(name) { return slugify(name, 40); }
+    /* Repo-name default from the project name — the same slug-safe transform (GitHub
+       repo names accept [A-Za-z0-9._-], so a lowercase-dashed name is always valid and
+       matches the placeholder). Wider cap than the handle; the visitor can still edit. */
+    function deriveRepo(name) { return slugify(name, 100); }
+    function looksLikeDomain(d) {
+      return /^(?!-)[a-z0-9-]{1,63}(?<!-)(\.(?!-)[a-z0-9-]{1,63}(?<!-))+$/i.test(String(d || ''));
+    }
+    /* ── the assigned address (task 1002704): every project gets <slug>.<apex> up
+       front, derived from the host this wizard runs on — the platform apex assigns
+       slug.<apex>; a self-hosted apex assigns under its own name. On a
+       dotless/local host (localhost, an IP) there is nothing sane to assign, so
+       the step degrades to the old optional-domain form. ── */
+    function apexBase() {
+      var h = String(location.hostname || '').toLowerCase().replace(/^www\./, '');
+      if (!h || h.indexOf('.') < 0) return null;
+      if (/^(localhost|127\.|\d+\.\d+\.\d+\.\d+$|\[)/.test(h)) return null;
+      return h;
+    }
+    function assignedDomain() {
+      var base = apexBase();
+      return base && validSlug(state.slug) ? state.slug + '.' + base : null;
+    }
+    /* What the create actually files: a custom domain wins; opting out files none;
+       otherwise the assigned subdomain. Everything downstream (review, submit,
+       the done-panel steps) reads THIS, never state.domain directly. */
+    function resolvedDomain() {
+      if (state.domain) return state.domain;
+      if (state.noAddress) return '';
+      return assignedDomain() || '';
+    }
+    function renderAddrPanel() {
+      var box = $('addrConfirm');
+      if (!box) return;
+      var assigned = assignedDomain();
+      var custom = state.domain && looksLikeDomain(state.domain) ? state.domain : '';
+      box.classList.toggle('optedOut', state.noAddress && !custom);
+      var big = $('addrAssigned');
+      var note = $('addrAssignedNote');
+      if (custom) {
+        big.innerHTML = '<code>' + esc(custom) + '</code> — your own domain, wired up for you.';
+        note.textContent = 'DNS pointing happens after the standup; the card on your projects page walks you through it.';
+      } else if (state.noAddress) {
+        big.textContent = 'Starting without an address.';
+        note.textContent = 'Sign-in on your project can’t be set up until it has one — add it any time from your projects page.';
+      } else if (assigned) {
+        big.innerHTML = '<code>' + esc(assigned) + '</code> — yours from the moment it stands up.';
+        note.textContent = 'Sign-in, sharing, everything just works. You can point a domain you own at it any time.';
+      } else if (!validSlug(state.slug)) {
+        big.textContent = 'Pick a handle above and the address comes with it.';
+        note.textContent = '';
+      } else {
+        /* dotless host (local dev): nothing sane to auto-assign — the domain
+           field IS the step here, so unfold it (a folded disclosure made the
+           opt-out checkbox unreachable-by-default; owner walk, 2026-08-12) */
+        big.textContent = 'No address is assigned on this host.';
+        note.textContent = 'Add a domain you own below, or start without one.';
+        $('addrCustom').open = true;
+      }
+    }
+    /* Pinned GitHub OAuth-app values for a domain (auth.js WEB_REDIRECT_ORIGIN —
+       callback is the apex /api/gds/auth/web/callback). Mirrors onboard.oauthAppInstructions. */
+    function oauthAppValues(domain) {
+      var origin = 'https://' + domain;
+      return { homepageUrl: origin, callbackUrl: origin + '/api/gds/auth/web/callback' };
+    }
+    /* GitHub's own "New repository" page, pre-filled with the owner + name. No auth or
+       permissions on our side — the visitor creates the empty repo in GitHub's UI, which
+       is exactly what the scaffold then clones. `owner` selects the account/org; omitting
+       a blank param just leaves that field empty on GitHub. */
+    function githubNewRepoUrl(owner, repo) {
+      var u = new URL('https://github.com/new');
+      if (repo) u.searchParams.set('name', repo);
+      if (owner) u.searchParams.set('owner', owner);
+      return u.toString();
+    }
+    function saveDraft() {
+      try { sessionStorage.setItem(DRAFT_KEY, JSON.stringify(state)); } catch (e) {}
+    }
+
+    /* ── step navigation ── */
+    var panels = { 0: 'panel-gate', 1: 'panel-name', 2: 'panel-home', 3: 'panel-address', 4: 'panel-review', 5: 'panel-done' };
+    function show(step, moveFocus) {
+      state.step = step;
+      Object.keys(panels).forEach(function (k) {
+        $(panels[k]).classList.toggle('on', Number(k) === step);
+      });
+      root.querySelectorAll('.steps li').forEach(function (li) {
+        var n = Number(li.getAttribute('data-step'));
+        li.classList.toggle('now', n === step);
+        li.classList.toggle('done', n < step || step === 5);
+      });
+      saveDraft();
+      /* the done step takes the whole card — the bongo pair steps aside */
+      root.querySelector('.createSplit').classList.toggle('wizDone', step === 5);
+      /* focus moves ONLY on a deliberate step (the hub rule setView already
+         applies to this view: never on boot, never on a background settle) */
+      if (moveFocus) {
+        var h = $(panels[step]).querySelector('h1');
+        if (h) { h.setAttribute('tabindex', '-1'); h.focus({ preventScroll: false }); }
+      }
+      /* the repo probe is authenticated — never fire it before /me settles
+         (a pre-auth probe 401s for strangers and, worse, could seed the
+         draft's owner with myLogin()'s placeholder) */
+      if (step === 2) { syncHome(); if (authKnown) ensureRepoAccess(); }
+      if (step === 3) renderAddrPanel();
+      if (step === 4) renderReview();
+    }
+
+    /* ── field wiring ── */
+    $('newName').value = state.name;
+    $('f-owner').value = state.owner;
+    $('f-repo').value = state.repo;
+    $('f-slug').value = state.slug;
+    $('f-domain').value = state.domain;
+    $('f-noaddr').checked = !!state.noAddress;
+
+    /* Auto-fill the repo name from the project name until the visitor edits it
+       directly (mirrors the handle's auto-derive). The owner is filled once we know
+       who's signed in — see onAuth below. */
+    if (!state.repoTouched && state.name && !state.repo) {
+      state.repo = deriveRepo(state.name);
+      $('f-repo').value = state.repo;
+    }
+
+    $('newName').addEventListener('input', function () {
+      state.name = this.value;
+      if (!state.slugTouched) {
+        state.slug = deriveSlug(state.name);
+        $('f-slug').value = state.slug;
+      }
+      if (!state.repoTouched) {
+        state.repo = deriveRepo(state.name);
+        $('f-repo').value = state.repo;
+      }
+      var h = $('h-name');
+      if (state.slug) { h.innerHTML = 'its handle on the platform: <code>' + esc(state.slug) + '</code>'; h.className = 'hint'; }
+      else { h.innerHTML = '&nbsp;'; }
+      saveDraft();
+    });
+    if (state.name && state.slug) $('h-name').innerHTML = 'its handle on the platform: <code>' + esc(state.slug) + '</code>';
+
+    function setMode(mode) {
+      state.mode = mode;
+      $('c-green').setAttribute('aria-pressed', String(mode === 'greenfield'));
+      $('c-adopt').setAttribute('aria-pressed', String(mode === 'adopt'));
+      $('adoptNote').classList.toggle('on', mode === 'adopt');
+      saveDraft();
+      syncHome();
+    }
+    $('c-green').addEventListener('click', function () { setMode('greenfield'); });
+    $('c-adopt').addEventListener('click', function () { setMode('adopt'); });
+    setMode(state.mode);
+
+    /* ── GitHub-integrated repo picker (adopt) + auto-create (fresh) — task 1002099 / ADR 0143.
+          Progressive enhancement: probe GET /github/repos once we reach step 2.
+            200 → we hold repo access → show the picker (adopt) / name field (fresh);
+            403 → offer to grant repo access (a ?repos=1 re-sign-in);
+            503 (server can't store the token) or any error → the manual inputs.
+          #manualHome (the classic owner/repo fields) is the always-safe fallback. ── */
+    var repoAccess = null;   /* null=unknown/loading · true · 'need-connect' · 'unavailable' · 'manual' */
+    var repoList = [];       /* the user's repos (from the probe) — feeds the picker + the fresh-name clash hint */
+    var ghProbed = false;
+
+    function isManualHome() { return repoAccess === 'manual' || repoAccess === 'unavailable'; }
+    function validRepoName(s) { return /^[A-Za-z0-9._-]{1,100}$/.test(String(s || '')); }
+    function myLogin() { return (me && me.github_login) || 'you'; }
+
+    function connectRepos(e) {
+      if (e) e.preventDefault();
+      /* Same-tab navigation so the sessionStorage draft round-trips back to step 2. */
+      window.location.assign(API + '/auth/web/start?return=/projects%3Fview%3Dnew&repos=1');
+    }
+    $('ghConnectBtn').addEventListener('click', connectRepos);
+    $('ghManualToggle').addEventListener('click', function () { repoAccess = 'manual'; syncHome(); $('f-owner').focus(); });
+
+    function syncHome() {
+      var need = repoAccess === 'need-connect';
+      var ok = repoAccess === true;
+      var adopt = state.mode === 'adopt';
+      $('ghBusy').hidden = !!repoAccess;              /* busy only while still probing (null) */
+      $('ghConnect').classList.toggle('on', need);    /* .reassure box: shown via .on (not hidden — .reassure sets display:none) */
+      $('ghAdopt').hidden = !(ok && adopt);
+      $('ghFresh').hidden = !(ok && !adopt);
+      $('manualHome').hidden = !isManualHome();
+      if (need) {
+        /* Informed consent (ADR 0155): this grants `repo`, which GitHub's own screen
+           words as full control of ALL your repositories — so say plainly why we ask
+           and what we do with it, rather than letting GitHub's wording be the first
+           the user hears of it. Private repos are the reason the scope is this wide. */
+        $('ghConnectMsg').textContent = adopt
+          ? 'You’re signed in — creating your project needs one more GitHub permission. GitHub will ask for repository access (it words this as access to all your repositories — that is the only scope it offers that can write to a private repo). We use it to read the repo you pick and push the setup commit to it. Nothing else is touched.'
+          : 'You’re signed in — creating your project needs one more GitHub permission. GitHub will ask for repository access (it words this as access to all your repositories — the narrower option cannot write to private repos). We use it to create your new empty repo and push the setup commit to it. Nothing else is touched.';
+      }
+      if (ok && adopt) initAdoptPicker();
+      if (ok && !adopt) syncFresh();
+    }
+
+    function syncFresh() {
+      /* Fresh + access: the repo is created under the signed-in account. Seed owner for
+         the review/target now; the create response confirms the real full_name.
+         Never before identity settles — myLogin()'s 'you' is display copy, and a
+         draft that stored it would file target_ref "you/<repo>". */
+      if (!me) return;
+      state.owner = myLogin();
+      $('ghNewName').value = state.repo || '';
+      updateFreshPreview();
+    }
+    function updateFreshPreview() {
+      var hint = $('ghFreshHint');
+      var clash = state.repo && repoList.some(function (r) { return String(r.name).toLowerCase() === state.repo.toLowerCase(); });
+      if (state.repo && !validRepoName(state.repo)) {
+        hint.className = 'hint err'; hint.textContent = 'Use letters, numbers, and . _ - (1–100 chars).';
+      } else if (clash) {
+        hint.className = 'hint err'; hint.innerHTML = 'You already have a repo named <strong>' + esc(state.repo) + '</strong> — pick another name, or adopt it instead.';
+      } else {
+        /* Visibility stated up front (task 1002694 / idea 1000684): repos WE create are
+           public by design (github-repos.js — open-source, capture-resistant); the
+           private path is adopting a private repo the owner makes themselves. */
+        hint.className = 'hint'; hint.innerHTML = 'We’ll create an empty <strong>public</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code> — projects here are open by design. Want private code? Create the repo yourself on GitHub and “adopt” it instead.';
+      }
+    }
+    $('ghNewName').addEventListener('input', function () { state.repo = this.value.trim(); updateFreshPreview(); saveDraft(); });
+
+    /* The adopt picker behaves like a standard combobox (owner design review, task
+       1002247): the dropdown is open only while the visitor is choosing. Selecting a
+       repo fills the search box with its full_name and collapses the list; focusing or
+       typing reopens it. */
+    function openRepoList() { $('ghList').hidden = false; renderRepoList(); }
+    function closeRepoList() { $('ghList').hidden = true; }
+    function renderRepoList() {
+      var q = ($('ghSearch').value || '').trim().toLowerCase();
+      var sel = state.owner && state.repo ? (state.owner + '/' + state.repo) : '';
+      /* When the box just shows the current selection verbatim, list everything (so the
+         visitor can switch) instead of filtering down to the one selected repo. */
+      var effectiveQ = q === sel.toLowerCase() ? '' : q;
+      var rows = repoList.filter(function (r) { return !effectiveQ || String(r.full_name).toLowerCase().indexOf(effectiveQ) >= 0; }).slice(0, 100);
+      $('ghList').innerHTML = rows.length
+        ? rows.map(function (r) {
+            return '<button type="button" class="ghrow" role="option" data-full="' + esc(r.full_name) + '" aria-selected="' + (r.full_name === sel) + '">' +
+              '<span>' + esc(r.full_name) + '</span>' + (r.private ? '<span class="priv">Private</span>' : '') + '</button>';
+          }).join('')
+        : '<div class="hint" style="padding:10px 12px">No repositories match “' + esc(effectiveQ) + '”.</div>';
+    }
+    /* Fill the search box with the current selection (if any) and collapse the list;
+       with nothing chosen yet, open it so the visitor sees their repos right away. */
+    function initAdoptPicker() {
+      var sel = state.owner && state.repo ? state.owner + '/' + state.repo : '';
+      /* Only treat it as a confirmed pick if it's actually one of the visitor's repos.
+         owner/repo are auto-derived from the project name, so a bare derived value must
+         NOT masquerade as a chosen repo — that would collapse the list onto a repo that
+         may not even exist. */
+      var picked = sel && repoList.some(function (r) { return String(r.full_name).toLowerCase() === sel.toLowerCase(); });
+      var h = $('ghAdoptHint');
+      if (picked) {
+        $('ghSearch').value = sel;
+        h.className = 'hint ok'; h.innerHTML = 'Adopting <strong>' + esc(sel) + '</strong>.';
+        closeRepoList();
+      } else {
+        $('ghSearch').value = '';
+        h.className = 'hint'; h.innerHTML = '&nbsp;';
+        openRepoList();
+      }
+    }
+    $('ghSearch').addEventListener('focus', function () { this.select(); openRepoList(); });
+    $('ghSearch').addEventListener('input', openRepoList);
+    $('ghList').addEventListener('click', function (ev) {
+      var row = ev.target.closest('.ghrow'); if (!row) return;
+      var full = row.getAttribute('data-full'); var slash = full.indexOf('/');
+      state.owner = full.slice(0, slash); state.repo = full.slice(slash + 1);
+      state.ownerTouched = true; state.repoTouched = true;   /* a real pick — don't let name-derive clobber it */
+      saveDraft();
+      $('ghSearch').value = full;                       /* pull the choice into the search box … */
+      var h = $('ghAdoptHint'); h.className = 'hint ok'; h.innerHTML = 'Adopting <strong>' + esc(full) + '</strong>.';
+      closeRepoList();                                  /* … and collapse the dropdown (typical UX) */
+    });
+
+    function ensureRepoAccess() {
+      if (ghProbed && repoAccess !== null) return;   /* already known this session */
+      if (isManualHome()) return;                     /* user chose manual — don't nag */
+      repoAccess = null; syncHome();                  /* show "reading your repos…" */
+      fetch(API + '/github/repos', { credentials: 'same-origin' })
+        .then(function (res) {
+          ghProbed = true;
+          if (res.status === 200) return res.json().then(function (d) { repoList = (d && d.repos) || []; repoAccess = true; });
+          if (res.status === 403 || res.status === 401) { repoAccess = 'need-connect'; return; }
+          repoAccess = 'unavailable'; return;         /* 503 or anything else → manual fallback */
+        })
+        .catch(function () { ghProbed = true; repoAccess = 'unavailable'; })
+        .then(syncHome);
+    }
+
+    $('f-owner').addEventListener('input', function () { state.owner = this.value.trim(); state.ownerTouched = true; saveDraft(); });
+    $('f-repo').addEventListener('input', function () { state.repo = this.value.trim(); state.repoTouched = true; saveDraft(); });
+
+    $('f-slug').addEventListener('input', function () {
+      state.slugTouched = true;
+      state.slug = this.value.trim().toLowerCase();
+      this.value = state.slug;
+      var h = $('h-slug');
+      if (!state.slug) { h.innerHTML = '&nbsp;'; h.className = 'hint'; this.classList.remove('bad'); }
+      else if (validSlug(state.slug)) { h.textContent = 'Nice — that works.'; h.className = 'hint ok'; this.classList.remove('bad'); }
+      else { h.textContent = '2–40 lowercase letters, numbers, or dashes; no leading/trailing/double dash.'; h.className = 'hint err'; this.classList.add('bad'); }
+      renderAddrPanel();
+      saveDraft();
+    });
+    $('f-domain').addEventListener('input', function () {
+      state.domain = this.value.trim().toLowerCase();
+      var h = $('h-domain');
+      if (!state.domain) { h.innerHTML = '&nbsp;'; h.className = 'hint'; this.classList.remove('bad'); }
+      else if (looksLikeDomain(state.domain)) { h.textContent = 'Looks like a domain.'; h.className = 'hint ok'; this.classList.remove('bad'); }
+      else { h.textContent = 'That doesn’t look like a domain yet (e.g. mercury.example.com).'; h.className = 'hint err'; this.classList.add('bad'); }
+      renderAddrPanel();
+      saveDraft();
+    });
+    $('f-noaddr').addEventListener('change', function () {
+      state.noAddress = !!this.checked;
+      renderAddrPanel();
+      saveDraft();
+    });
+
+    /* per-panel validation on Next */
+    function validateStep(step) {
+      if (step === 1) {
+        if (!state.name.trim()) { $('h-name').textContent = 'Give it a name to start.'; $('h-name').className = 'hint err'; return false; }
+        return true;
+      }
+      if (step === 2) {
+        var homeErr = function (msg) { $('h-home').textContent = msg; $('h-home').className = 'hint err'; return false; };
+        if (repoAccess === 'need-connect') return homeErr('Allow GitHub repo access to pick or create your repository — or choose “enter it manually”.');
+        if (repoAccess === true && state.mode !== 'adopt') {
+          /* Fresh with access: just the new repo NAME (owner is the signed-in account). */
+          if (!validRepoName(state.repo)) return homeErr('Name the new repository (letters, numbers, and . _ -).');
+        } else {
+          /* Adopt (picker or manual) and the manual fallback: need a concrete owner + repo. */
+          if (!state.owner || !state.repo) {
+            return homeErr(state.mode === 'adopt' && repoAccess === true ? 'Pick one of your repositories.' : 'Both owner and repository name are needed.');
+          }
+        }
+        $('h-home').innerHTML = '&nbsp;'; $('h-home').className = 'hint';
+        return true;
+      }
+      if (step === 3) {
+        if (!validSlug(state.slug)) {
+          $('h-slug').textContent = '2–40 lowercase letters, numbers, or dashes; no leading/trailing/double dash.';
+          $('h-slug').className = 'hint err'; $('f-slug').classList.add('bad');
+          return false;
+        }
+        if (state.domain && !looksLikeDomain(state.domain)) return false;
+        /* no auto-assigned address (dotless host): going domainless must be an
+           EXPLICIT choice — a domain, or the opt-out box. Never silent. */
+        if (!resolvedDomain() && !state.noAddress) {
+          $('addrCustom').open = true;
+          var hd = $('h-domain');
+          hd.textContent = 'Add a domain you own — or tick “start without an address” to go without one.';
+          hd.className = 'hint err';
+          return false;
+        }
+        return true;
+      }
+      return true;
+    }
+
+    root.querySelectorAll('.panel form').forEach(function (form) {
+      form.addEventListener('submit', function (ev) {
+        ev.preventDefault();
+        var next = Number(form.getAttribute('data-next'));
+        if (validateStep(next - 1)) show(next, true);
+      });
+    });
+    root.querySelectorAll('[data-back]').forEach(function (btn) {
+      btn.addEventListener('click', function () { show(Number(btn.getAttribute('data-back')), true); });
+    });
+
+    /* ── review ── */
+    function renderReview() {
+      /* every road back to this step gets a live button — the create path
+         disables it and only the failure branch used to restore it, which
+         left "Start another project" walking into a dead Create */
+      var cb = $('doCreate');
+      cb.disabled = false; cb.textContent = 'Create my project';
+      var rows = [
+        ['Project', esc(state.name)],
+        ['Starting from', state.mode === 'adopt' ? 'A repo you already have' : 'A fresh, empty repo'],
+        ['Repository', '<code>' + esc(state.owner + '/' + state.repo) + '</code>'],
+        ['Handle', '<code>' + esc(state.slug) + '</code>'],
+        ['Address', resolvedDomain()
+          ? '<code>' + esc(resolvedDomain()) + '</code>'
+          : '<em style="font-weight:600;color:var(--warn)">none — sign-in stays locked until it has one</em>'],
+        ['Shape', 'Standalone — your own repo, pinned platform core']
+      ];
+      $('reviewList').innerHTML = rows.map(function (r) {
+        return '<li><span class="k">' + r[0] + '</span><span class="v">' + r[1] + '</span></li>';
+      }).join('');
+    }
+
+    /* ── create ── */
+    function friendlyCreateError(err) {
+      var code = err && err.data && err.data.error && (err.data.error.code || '');
+      if (code === 'slug_taken') return 'That handle is already taken by another project. Pick a different one.';
+      if (code === 'bad_slug') return 'The handle didn’t pass the server’s checks — 2–40 lowercase letters, numbers, or dashes.';
+      return 'Couldn’t file the request: ' + (err && err.message ? err.message : 'something went sideways. Try again.');
+    }
+
+    /* Fresh + repo access: auto-create the empty GitHub repo NOW (the commit moment),
+       then hand its real full_name to provisioning. No-op for adopt / manual / no-access.
+       Idempotent across a retry — once created we reuse the stashed full_name so a second
+       click doesn't trip GitHub's 422 "name already exists". Errors set err.gotoHome so
+       the caller bounces the user back to the Home step to fix the name / reconnect. */
+    function ensureFreshRepo() {
+      if (state.mode === 'adopt' || repoAccess !== true) return Promise.resolve();
+      if (state.repoAutoCreated && state.owner && state.repo) return Promise.resolve();
+      return fetch(API + '/github/repos', {
+        method: 'POST', credentials: 'same-origin',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ name: state.repo })
+      }).then(function (res) {
+        return res.json().catch(function () { return {}; }).then(function (data) {
+          if (res.status === 401 || res.status === 403) {
+            repoAccess = 'need-connect';
+            var e0 = new Error('reconnect'); e0.gotoHome = true;
+            e0.homeMsg = 'Your GitHub authorization expired — reconnect on the Home step to create the repo.';
+            throw e0;
+          }
+          if (!res.ok) {
+            var e = new Error((data.error && (data.error.message || data.error.code)) || ('HTTP ' + res.status));
+            e.data = data;
+            if (data.error && data.error.code === 'name_taken') { e.gotoHome = true; e.homeMsg = data.error.message; }
+            throw e;
+          }
+          var full = data.repo && data.repo.full_name;
+          if (full && full.indexOf('/') > 0) {
+            state.owner = full.slice(0, full.indexOf('/'));
+            state.repo = full.slice(full.indexOf('/') + 1);
+          }
+          state.repoAutoCreated = true; saveDraft();
+        });
+      });
+    }
+
+    $('doCreate').addEventListener('click', function () {
+      var btn = this;
+      var alertBox = $('createAlert');
+      alertBox.classList.remove('on');
+      btn.disabled = true; btn.textContent = 'Raising it into the sky…';
+      ensureFreshRepo().then(function () {
+        return fetch(API + '/provisioning/instances', {
+          method: 'POST', credentials: 'same-origin',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            slug: state.slug,
+            hosting_shape: 'standalone',
+            domain: resolvedDomain() || undefined,
+            target_ref: state.owner + '/' + state.repo,
+            /* LOAD-BEARING for the control-plane runner, not just for the checklist we
+               render (task 1002562): 'adopt' makes it clone + layer onto the repo's
+               existing history instead of pushing a fresh tree, which a repo that already
+               has commits rejects as unrelated history. state.mode already tracked
+               greenfield|adopt for the UI — it has to reach the server too. */
+            onboard_mode: state.mode === 'adopt' ? 'adopt' : 'greenfield'
+          })
+        });
+      }).then(function (res) {
+        if (res.status === 401) { window.location.assign(API + '/auth/web/start?return=/projects%3Fview%3Dnew'); throw new Error('signing in'); }
+        return res.json().catch(function () { return {}; }).then(function (data) {
+          if (!res.ok) {
+            var e = new Error((data.error && (data.error.message || data.error.code)) || ('HTTP ' + res.status));
+            e.data = data; throw e;
+          }
+          return data;
+        });
+      }).then(function (data) {
+        try {
+          sessionStorage.setItem(CREATED_KEY, JSON.stringify({
+            id: data.instance && data.instance.id, slug: state.slug, domain: resolvedDomain(),
+            mode: state.mode, name: state.name, at: Date.now()
+          }));
+          sessionStorage.removeItem(DRAFT_KEY);
+        } catch (e) {}
+        renderDone();
+        show(5, true);
+        startProgress(data.instance && data.instance.id);
+      }).catch(function (err) {
+        if (String(err && err.message) === 'signing in') return;
+        btn.disabled = false; btn.textContent = 'Create my project';
+        if (err && err.gotoHome) {
+          /* A repo-creation problem (name taken / reconnect) — bounce back to the Home
+             step with the reason, so the user fixes it where the repo is chosen. */
+          show(2, true);
+          $('h-home').textContent = err.homeMsg || 'Please revisit the repository step.';
+          $('h-home').className = 'hint err';
+          return;
+        }
+        alertBox.textContent = friendlyCreateError(err);
+        alertBox.classList.add('on');
+      });
+    });
+
+    /* ── done panel: rendered FROM the canonical onboard plan (task 1002694, gap 2 /
+          idea 1000675). GET /provisioning/onboard-plan is the single source the
+          /new-project skill + `bongos onboard` read too, so the checklist can't
+          drift. A per-key renderer adds this page's rich UI; an unknown human step
+          falls back to the plan's own label, so a new canonical step surfaces here
+          by default instead of silently vanishing. ── */
+    function copyBtn(text) {
+      return '<button type="button" class="copy" data-copy="' + esc(text) + '">Copy</button>';
+    }
+    var GH_ICON = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
+
+    var instanceId = null;             /* set when a create lands / a resumed watch starts */
+    var live = { instStatus: null, manifest: null, manifestMsg: '' };
+    var planPromises = {};             /* mode|domain → Promise<steps[]> */
+    var lastStepsHtml = '';
+    var FALLBACK_HUMAN_KEYS = ['github-repo', 'oauth-app', 'first-sign-in', 'enter-hall'];
+
+    function fetchPlan() {
+      var domain = resolvedDomain() || '';
+      var key = state.mode + '|' + domain;
+      if (!planPromises[key]) {
+        /* shape=standalone: this wizard only creates control-plane standalone
+           instances, and the plan is shape-filtered server-side (direction §7) */
+        planPromises[key] = fetch(API + '/provisioning/onboard-plan?mode=' + encodeURIComponent(state.mode) + '&shape=standalone' + (domain ? '&domain=' + encodeURIComponent(domain) : ''))
+          .then(function (res) { if (!res.ok) throw new Error('plan'); return res.json(); })
+          .then(function (d) { return (d && d.steps) || []; })
+          .catch(function () {
+            delete planPromises[key];  /* transient — retried on the next render */
+            return FALLBACK_HUMAN_KEYS.map(function (k) { return { key: k, kind: 'human', label: '' }; });
+          });
+      }
+      return planPromises[key];
+    }
+
+    /* github-repo — adopt / auto-created / manual-create, each aware of whether the
+       scaffold has landed (instance active ⇒ the build already pushed). The wizard
+       files onboard_mode to the server, so for adopt the RUNNER clones + layers
+       (task 1002562) — the owner no longer runs `bongos init --adopt` here. */
+    function renderStepGithubRepo() {
+      var landed = live.instStatus === 'active';
+      var repoLabel = state.owner && state.repo ? '<strong>' + esc(state.owner + '/' + state.repo) + '</strong>' : 'your new repository';
+      if (state.mode === 'adopt') {
+        return landed
+          ? '<li class="sdone" data-onboard-step="github-repo"><b>Your repo carries the platform</b><p>The build layered the platform onto ' + repoLabel + ' — existing files, history, and backlog kept. Pull to see it.</p></li>'
+          : '<li data-onboard-step="github-repo"><b>Your existing repo</b><p>The build clones ' + repoLabel + ' and layers the platform onto its existing history — nothing is created or emptied, and your backlog is imported. Nothing for you to do here.</p></li>';
+      }
+      if (state.repoAutoCreated) {
+        return landed
+          ? '<li class="sdone" data-onboard-step="github-repo"><b>Repo ready — scaffold landed</b><p>We created ' + repoLabel + ' (public, by design) and the build pushed your project’s starting files to it.</p></li>'
+          : '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLabel + ' on GitHub for you — public (projects here are open by design), empty, and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>';
+      }
+      var ghNewUrl = githubNewRepoUrl(state.owner, state.repo);
+      return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. GitHub will ask public or private — your choice; both work here, and we never change it. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
+        '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + GH_ICON + 'Create ' + repoLabel + ' on GitHub</a></li>';
+    }
+
+    /* The manual OAuth-app path stays as a documented fallback (ADR 0133), but the
+       control-plane placement is named as the operator's, never handed to the owner
+       as a command to run (gap 4). */
+    function manualOauthDetails() {
+      var oa = oauthAppValues(resolvedDomain());
+      return '<details><summary>Prefer to create an OAuth app by hand?</summary>' +
+        '<p>GitHub → <em>your account’s</em> Settings → Developer settings → OAuth Apps → New OAuth App. (Developer settings live under your account, not the repo.)</p>' +
+        '<div class="kv"><span class="kk">Homepage URL</span><code>' + esc(oa.homepageUrl) + '</code>' + copyBtn(oa.homepageUrl) + '</div>' +
+        '<div class="kv"><span class="kk">Callback URL</span><code>' + esc(oa.callbackUrl) + '</code>' + copyBtn(oa.callbackUrl) + '</div>' +
+        '<p>The generated credentials are placed on the platform’s control plane by an operator — that part isn’t yours to run (the one-click path above does it all automatically). It’s done when <code style="font-family:var(--font-mono)">' + esc(oa.homepageUrl) + '/healthz</code> reports <code style="font-family:var(--font-mono)">auth_configured: true</code>.</p></details>';
+    }
+
+    /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow is the primary path
+       (gap 3 / idea 1000676); locked until a domain exists (the App needs the real
+       callback host — the server refuses domainless with domain_required). */
+    function renderStepOauthApp() {
+      var domain = resolvedDomain();
+      if (!domain) {
+        return '<li class="slocked" data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Unlocks once your project has an address — sign-in needs a real domain. Attach one any time from <a href="?view=mine">your projects page</a>.</p></li>';
+      }
+      /* honesty about the venue (owner walk, 2026-08-12): GitHub rejects app
+         manifests whose hook URL isn't publicly reachable, so a locally-hosted
+         platform can't complete the one-click flow — say it BEFORE the bounce. */
+      if (!apexBase()) {
+        return '<li class="slocked" data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>This platform is running on a local address, and GitHub refuses app setups it can’t reach over the public internet — so the one-click flow can’t complete here. On a publicly-addressed platform this is one click.</p>' + manualOauthDetails() + '</li>';
+      }
+      if (live.manifest === 'done') {
+        return '<li class="sdone" data-onboard-step="oauth-app"><b>GitHub sign-in is wired</b><p>Credentials placed and verified — sign-in on <code style="font-family:var(--font-mono)">' + esc(domain) + '</code> is live.</p></li>';
+      }
+      if (live.manifest === 'error' || live.manifest === 'expired') {
+        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>' +
+          (live.manifest === 'expired' ? 'That setup link expired (they last 30 minutes) — mint a fresh one.' : 'GitHub setup hit a snag' + (live.manifestMsg ? ': ' + esc(live.manifestMsg) : '') + '. Try again.') + '</p>' +
+          '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
+      }
+      if (live.manifest) {   /* pending / code_received — GitHub or the runner is mid-flight */
+        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p></li>';
+      }
+      return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in — one click</b><p>Approve a pre-filled GitHub App and the platform wires sign-in by itself: no keys to copy, and the secret never leaves the server side.</p>' +
+        '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
+    }
+
+    function renderStepFirstSignIn() {
+      var domain = resolvedDomain();
+      if (!domain) {
+        return '<li class="slocked" data-onboard-step="first-sign-in"><b>First sign-in</b><p>Unlocks with sign-in above — you’ll open your project’s address, sign in with GitHub once, and be seated as the owner (the founding Archon).</p></li>';
+      }
+      return '<li data-onboard-step="first-sign-in"><b>First sign-in</b><p>Open <a href="https://' + esc(domain) + '" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(domain) + '</code></a> and sign in with GitHub once. That seats you as the owner — the founding Archon.</p></li>';
+    }
+
+    function renderStepEnterHall() {
+      var domain = resolvedDomain();
+      return domain
+        ? '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>Your project’s home — open <a href="https://' + esc(domain) + '/builders" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(domain) + '/builders</code></a> and start building.</p></li>'
+        : '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>No address yet — run <code style="font-family:var(--font-mono)">bongos dev</code> in your repo checkout to start the local hall on your machine.</p></li>';
+    }
+
+    var STEP_RENDERERS = {
+      'github-repo': renderStepGithubRepo,
+      'oauth-app': renderStepOauthApp,
+      'first-sign-in': renderStepFirstSignIn,
+      'enter-hall': renderStepEnterHall
+    };
+
+    /* The newborn-instance welcome + account-nag suppression (direction §5.6,
+       idea 1000701) is NOT implemented here by design: it lives on the CHILD
+       instance's own surfaces (its hall greeting + needs roster), which this
+       control-plane wizard cannot reach. Spun out per the direction's §9
+       delivery-split as task 1002739. */
+
+    function renderSteps() {
+      fetchPlan().then(function (steps) {
+        var html = steps.filter(function (s) { return s && s.kind === 'human'; }).map(function (s) {
+          var r = STEP_RENDERERS[s.key];
+          return r ? r(s) : '<li data-onboard-step="' + esc(s.key) + '"><b>' + esc(s.label || s.key) + '</b></li>';
+        }).join('');
+        if (html === lastStepsHtml) return;   /* change-only re-render — polls never clobber open UI */
+        lastStepsHtml = html;
+        $('humanSteps').innerHTML = html;
+      });
+    }
+
+    function renderDone() {
+      var adopt = state.mode === 'adopt';
+      $('doneLede').innerHTML = 'Provisioning is requested for <strong>' + esc(state.name || state.slug) + '</strong>' +
+        (adopt ? ' — adopting your existing repo' : '') +
+        '. The platform stands up the server, database, and address on its own — watch it right here, or any time on <a href="?view=mine">your projects page</a>.';
+      renderSteps();
+    }
+
+    /* The wizard's own copy links between views ("your projects page", the
+       give-up hand-off) — delegated so innerHTML swaps keep them working, and
+       routed through setView so a click can't tear down the page (and with it
+       the very watch the copy promises to keep). Plain-click only: modified
+       clicks stay with the browser, matching the hub's isPlainClick rule. */
+    root.addEventListener('click', function (ev) {
+      if (ev.defaultPrevented || ev.button !== 0 || ev.metaKey || ev.ctrlKey || ev.shiftKey || ev.altKey) return;
+      var a = ev.target.closest && ev.target.closest('a[href^="?view="]');
+      if (!a || !root.contains(a)) return;
+      ev.preventDefault();
+      setView((a.getAttribute('href').match(/view=(\w+)/) || [])[1], true);
+    });
+
+    /* One delegated listener — renderSteps swaps innerHTML, so handlers live on the list. */
+    $('humanSteps').addEventListener('click', function (ev) {
+      var mBtn = ev.target.closest('[data-action="manifest-start"]');
+      if (mBtn) { startManifest(mBtn); return; }
+      var t = ev.target.closest('.copy');
+      if (!t) return;
+      navigator.clipboard.writeText(t.getAttribute('data-copy')).then(function () {
+        t.classList.add('did'); t.textContent = 'Copied';
+        setTimeout(function () { t.classList.remove('did'); t.textContent = 'Copy'; }, 1600);
+      });
+    });
+
+    /* ── C8: the wizard's polls run only on stage, exactly like the sky.
+       Off-view or hidden-tab, a due tick parks itself instead of fetching;
+       enter() and the visibility flip resume whatever was parked. ── */
+    function wizPollActive() {
+      return !document.hidden && currentView === 'new';
+    }
+    function resumePolls() {
+      if (watchPending && instanceId) { watchPending = false; startProgress(instanceId); }
+      if (manifestPending && manifestState) { manifestPending = false; pollManifest(manifestState); }
+    }
+    document.addEventListener('visibilitychange', function () {
+      if (wizPollActive()) resumePolls();
+    });
+
+    /* ── GitHub-App manifest flow (ADR 0133): mint a one-time state for OUR instance,
+          form-POST the pre-filled manifest to GitHub in a new tab (opened inside the
+          click gesture so popup blockers allow it; blocked → same-tab, the callback
+          page carries the rest), then poll the public status until the control-plane
+          runner has placed + verified the credentials. ── */
+    var manifestPollTimer = null;
+    var manifestState = null;      /* the one-time state token — kept so a parked poll can resume */
+    var manifestPending = false;
+    /* a cleared setTimeout id can't cancel a chain that's mid-fetch — each chain
+       carries the generation it was born under, and stopping bumps it so an
+       orphaned chain goes quiet instead of re-arming itself forever */
+    var manifestGen = 0;
+    function stopManifestPoll() { manifestGen += 1; if (manifestPollTimer) { clearTimeout(manifestPollTimer); manifestPollTimer = null; } }
+
+    function startManifest(btn) {
+      if (!instanceId) return;
+      btn.disabled = true; btn.textContent = 'Preparing GitHub…';
+      var tab = window.open('about:blank', 'ghAppSetup');
+      fetch(API + '/provisioning/instances/' + encodeURIComponent(instanceId) + '/github-app', {
+        method: 'POST', credentials: 'same-origin',
+        headers: { 'Content-Type': 'application/json' }, body: '{}'
+      }).then(function (res) {
+        if (res.status === 401) { window.location.assign(API + '/auth/web/start?return=/projects%3Fview%3Dnew'); throw new Error('signing in'); }
+        return res.json().catch(function () { return {}; }).then(function (d) {
+          if (!res.ok) {
+            var e = new Error((d.error && (d.error.message || d.error.code)) || ('HTTP ' + res.status));
+            throw e;
+          }
+          return d;
+        });
+      }).then(function (d) {
+        var form = document.createElement('form');
+        form.method = 'POST'; form.action = d.post_url; form.target = tab ? 'ghAppSetup' : '_self';
+        var inp = document.createElement('input');
+        inp.type = 'hidden'; inp.name = 'manifest'; inp.value = JSON.stringify(d.manifest);
+        form.appendChild(inp); document.body.appendChild(form);
+        form.submit(); form.remove();
+        live.manifest = 'pending'; live.manifestMsg = '';
+        renderSteps();
+        pollManifest(d.state);
+      }).catch(function (err) {
+        if (String(err && err.message) === 'signing in') return;
+        if (tab) { try { tab.close(); } catch (e) {} }
+        live.manifest = 'error'; live.manifestMsg = String((err && err.message) || 'could not start');
+        renderSteps();
+      });
+    }
+
+    function pollManifest(stateToken) {
+      stopManifestPoll();
+      manifestState = stateToken;
+      var myGen = manifestGen;
+      function tick() {
+        if (myGen !== manifestGen) return;
+        if (!wizPollActive()) { manifestPending = true; stopManifestPoll(); return; }
+        fetch(API + '/provisioning/github-app/status?state=' + encodeURIComponent(stateToken))
+          .then(function (res) { if (!res.ok) throw new Error('soft'); return res.json(); })
+          .then(function (d) {
+            if (myGen !== manifestGen) return;
+            var next = d.ready ? 'done' : (d.status || 'pending');
+            if (next !== live.manifest) { live.manifest = next; renderSteps(); }
+            if (!d.terminal) manifestPollTimer = setTimeout(tick, 4000);
+            else manifestPollTimer = null;   /* a stale fired id would read as "still polling" and resume a finished poll */
+          })
+          .catch(function () { if (myGen === manifestGen) manifestPollTimer = setTimeout(tick, 8000); });
+      }
+      tick();
+    }
+
+    /* ── live build progress (task 2083): poll the instance until it's up.
+          Read-only — GET /provisioning/instances/:id (own-scoped) every 5s. ── */
+    var pollTimer = null;
+    var watchPending = false;      /* a parked progress watch, resumed on re-entry */
+    var watchGen = 0;              /* same orphaning contract as manifestGen above */
+    function stopPolling() { watchGen += 1; if (pollTimer) { clearTimeout(pollTimer); pollTimer = null; } }
+    function progressMarkup(stageNow, stagesDone, note, cls) {
+      var names = ['Request filed', 'Standing it up', 'Live'];
+      return '<div class="prog ' + (cls || '') + '" role="status" aria-live="polite">' +
+        '<ul class="stages">' + names.map(function (n, i) {
+          var c = stagesDone > i ? 'done' : (stageNow === i ? 'now' : '');
+          return '<li class="' + c + '"><span class="sdot"></span><span class="slbl">' + n + '</span></li>';
+        }).join('') + '</ul>' +
+        '<p class="pnote">' + note + '</p></div>';
+    }
+    /* Renders the current instance state; returns true when the state is terminal
+       (no further polling wanted). */
+    function renderProgress(inst) {
+      var el = $('liveProgress');
+      if (!el) return true;
+      var s = inst && inst.status;
+      if (s === 'requested') {
+        el.innerHTML = progressMarkup(1, 1, 'Waiting for a runner to pick it up. This updates the moment it starts.');
+      } else if (s === 'provisioning') {
+        el.innerHTML = progressMarkup(1, 1, 'Raising the server, database, and address — nothing needed from you.');
+      } else if (s === 'active') {
+        var addr = inst.domain ? 'https://' + inst.domain : null;
+        el.innerHTML = progressMarkup(-1, 3,
+          'Your project is up' + (addr ? ' — <a href="' + esc(addr) + '" target="_blank" rel="noopener">' + esc(inst.domain) + '</a>' : '') +
+          '. Finish the steps below and the hall is yours.', 'isLive');
+        return true;
+      } else if (s === 'error') {
+        /* the honest snag (direction §5 / F19): no raw stderr as the headline, no
+           false "keeps retrying" — retries stop, and the retry door is the mine view */
+        el.innerHTML = progressMarkup(1, 1,
+          'The standup stopped partway — it won’t continue on its own. Retry it (and see the technical details) from <a href="?view=mine">your projects page</a>.', 'isErr');
+      } else if (s === 'tearing_down' || s === 'torn_down') {
+        /* a deliberate end is calm, never styled as a failure (direction §5) */
+        el.innerHTML = progressMarkup(-1, 0, 'This instance was torn down. Bring it back any time from <a href="?view=mine">your projects page</a>, or start another below.');
+        return true;
+      } else {
+        el.innerHTML = progressMarkup(0, 1, 'Filed. Watching for the standup to start…');
+      }
+      return false;
+    }
+    function startProgress(id) {
+      if (!id) return;
+      instanceId = id;   /* the manifest flow mints against this instance */
+      stopPolling();
+      watchPending = false;
+      var myGen = watchGen;
+      var ticks = 0;
+      var el = $('liveProgress');
+      el.innerHTML = progressMarkup(0, 1, 'Filed. Watching for the standup to start…');
+      function tick() {
+        if (myGen !== watchGen) return;
+        if (!wizPollActive()) { watchPending = true; stopPolling(); return; }
+        ticks += 1;
+        if (ticks > 400) {
+          /* ~33 min: this tab stops watching, but the standup keeps going — hand
+             the long watch to the mine view, the owner's durable surface (task
+             1002693). The old "stop quietly" here was a dead-end lie: the hall
+             card it assumed was removed in task 1002675. */
+          $('liveProgress').innerHTML = progressMarkup(1, 1,
+            'Still building — this tab will stop watching now. Follow it any time on <a href="?view=mine">your projects page</a>.');
+          stopPolling();
+          return;
+        }
+        fetch(API + '/provisioning/instances/' + encodeURIComponent(id), { credentials: 'same-origin' })
+          .then(function (res) {
+            if (res.status === 401) { throw new Error('gone:Your session expired — <a href="' + API + '/auth/web/start?return=/projects%3Fview%3Dnew">sign in again</a> to keep watching.'); }
+            if (res.status === 404) { throw new Error('gone:Can’t see this instance any more — it may have been torn down.'); }
+            if (!res.ok) throw new Error('soft');
+            return res.json();
+          })
+          .then(function (data) {
+            if (myGen !== watchGen) return;
+            var inst = data.instance;
+            /* the checklist reflects live state (task 1002694): a status transition —
+               e.g. the scaffold landing — re-renders the steps (change-only, so the
+               5s tick never clobbers an open dropdown or mid-flight button) */
+            if (inst && inst.status !== live.instStatus) { live.instStatus = inst.status; renderSteps(); }
+            var terminal = renderProgress(inst);
+            if (!terminal) pollTimer = setTimeout(tick, 5000);
+            else stopPolling();
+          })
+          .catch(function (err) {
+            if (myGen !== watchGen) return;
+            var m = String(err && err.message || '');
+            if (m.indexOf('gone:') === 0) {
+              $('liveProgress').innerHTML = progressMarkup(1, 1, m.slice(5), 'isErr');
+              stopPolling();
+              return;
+            }
+            /* transient (network / 5xx): keep the last view, try again a bit later */
+            pollTimer = setTimeout(tick, 10000);
+          });
+      }
+      tick();
+    }
+
+    /* start another project: clear the stored instance + draft, back to step 1 */
+    function wireAgain() {
+      var again = document.createElement('button');
+      again.type = 'button'; again.className = 'again'; again.textContent = 'Start another project';
+      again.addEventListener('click', function () {
+        stopPolling();
+        stopManifestPoll();
+        instanceId = null;
+        watchPending = false; manifestPending = false; manifestState = null;
+        live = { instStatus: null, manifest: null, manifestMsg: '' };
+        lastStepsHtml = '';
+        try { sessionStorage.removeItem(CREATED_KEY); sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
+        state = { step: 1, name: '', mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
+        $('newName').value = ''; $('f-owner').value = ''; $('f-repo').value = ''; $('f-slug').value = ''; $('f-domain').value = '';
+        $('f-noaddr').checked = false;
+        /* Re-seed the owner from the signed-in account for the next project. */
+        if (me && me.github_login) { state.owner = me.github_login; $('f-owner').value = state.owner; }
+        $('h-name').innerHTML = '&nbsp;';
+        setMode('greenfield');
+        show(1, true);
+      });
+      $('panel-done').appendChild(again);
+    }
+    wireAgain();
+
+    /* ── the hub's three doors ── */
+    function createdRecord() {
+      try { return JSON.parse(sessionStorage.getItem(CREATED_KEY) || 'null'); } catch (e) { return null; }
+    }
+    /* enter(focus) — paint the right step for whoever just arrived. Before the
+       identity settles it shows the draft step optimistically (the page stays
+       usable while /me is in flight — the boot's own rule); onAuth() re-enters
+       once the answer lands. Focus only moves on a deliberate nav (the flag). */
+    function enter(focus) {
+      if (authKnown && !me) { show(0, !!focus); return; }
+      var created = authKnown ? createdRecord() : null;
+      if (created && created.id) {
+        /* returning after a create — resume watching that instance instead of a
+           blank wizard */
+        state.name = created.name || created.slug; state.slug = created.slug || '';
+        state.domain = created.domain || ''; state.mode = created.mode || 'greenfield';
+        renderDone();
+        show(5, !!focus);
+        startProgress(created.id);
+        resumePolls();
+        return;
+      }
+      /* before identity settles, never render past the name step: deeper steps
+         carry authenticated side effects (the step-2 repo probe), and onAuth()
+         re-enters to the real draft step the moment /me answers */
+      var step = authKnown && state.step >= 1 && state.step <= 4 ? state.step : 1;
+      if (step === 1) {
+        show(1, false);
+        if (focus) $('newName').focus();
+      } else {
+        show(step, !!focus);
+      }
+    }
+    /* leave() — park the polls (C8). The due tick would park itself anyway;
+       this just stops the timers immediately so nothing fires off-stage. */
+    function leave() {
+      if (pollTimer) { stopPolling(); watchPending = true; }
+      if (manifestPollTimer) { stopManifestPoll(); manifestPending = true; }
+    }
+    /* onAuth() — the boot's /me settled (either way). Seed the owner field for
+       the common "my own account" case, then settle the view if the visitor is
+       already standing on it. */
+    function onAuth() {
+      authKnown = true;
+      if (me && !state.ownerTouched && !state.owner && me.github_login) {
+        state.owner = me.github_login;
+        $('f-owner').value = state.owner;
+        saveDraft();
+      }
+      if (currentView === 'new') enter(false);
+    }
+
+    return { enter: enter, leave: leave, onAuth: onAuth };
+  })();
 
   /* ══ YOUR PROJECTS — search + the five state pills. The filter GROUPS the
      chip outcomes; it never relabels them, so "Live" holding both `live` and
@@ -1847,7 +3186,7 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     body += stripFor(inst);
     if (gone) {
       body += '<div class="projMsg">Torn down' + (inst.torn_down_at ? ' ' + esc(shortDate(inst.torn_down_at)) : '') +
-        '. The repository is still yours, and its database is kept — bringing it back takes one click. Or <a href="/create">start another</a>.</div>';
+        '. The repository is still yours, and its database is kept — bringing it back takes one click. Or <a href="?view=new">start another</a>.</div>';
     }
     var lm = lastMsg[inst.id];
     body += '<div class="projMsg' + (lm && lm.cls ? ' ' + lm.cls : '') + '" id="msg-' + iid + '">' + (lm ? lm.text : '') + '</div>';
@@ -2206,6 +3545,7 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       me = data.builder || data.me || data;
       renderWho();
       paintShellIdentity();
+      wizard.onAuth();
       $('gate').hidden = true;
       $('mine').hidden = false;
       load();
@@ -2217,12 +3557,16 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       paintShellIdentity();
       $('gate').hidden = false;
       if (String(err && err.message) !== '401') {
-        var g = $('gateAlert');
         if (!navigator.onLine || String(err && err.message).indexOf('Failed') === 0) {
-          g.textContent = 'Can’t reach the platform right now — sign-in will work once you’re online with it.';
-          g.classList.add('on');
+          /* both sign-in gates (mine + wizard) carry the same honest note */
+          ['gateAlert', 'wizGateAlert'].forEach(function (id) {
+            var g = $(id);
+            g.textContent = 'Can’t reach the platform right now — sign-in will work once you’re online with it.';
+            g.classList.add('on');
+          });
         }
       }
+      wizard.onAuth();
     })
     /* the catalog is PUBLIC, so it loads either way — the map is the view a
        signed-out stranger lands on and it must not depend on identity */