@bongos/core 1.19.670 → 1.19.672

package/docs/module-api-changelog.md

@@ -1799,5 +1799,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.668 with no explicit bump. run 34619821252. (task 1002620)
   1.19.670 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.669 with no explicit bump. run 34622305231. (task 1002620)
+  1.19.671 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.670 with no explicit bump. run 34627255469. (task 1002620)
+  1.19.672 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.671 with no explicit bump. run 34629971417. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/provisioning.js

@@ -694,7 +694,7 @@ async function updateInstanceSettings(db, id, patch) {
 // impossible — the very half of "add modules later" an owner needs most. Only an
 // array ever reaches here, so the column's NULL ("never asked", ADR 0240 §2)
 // stays reachable only by never answering; no write can un-ask the question.
-async function updateInstanceDetail(db, id, { description, detail, modules } = {}) {
+async function updateInstanceDetail(db, id, { description, detail, modules, type } = {}) {
   const sets = ['updated_at = now()'];
   const params = [id];
   if (description !== undefined) {
@@ -713,6 +713,18 @@ async function updateInstanceDetail(db, id, { description, detail, modules } = {
     params.push(picked === null ? null : JSON.stringify(picked));
     sets.push(`modules = $${params.length}::jsonb`);
   }
+  // The declared type (task 1003504 — the way back into the wizard's Type step).
+  // ASSIGNED, never COALESCEd: this is the owner re-declaring, so the new word has
+  // to win even over a curated one. The route is the only caller and it refuses
+  // anything outside PROJECT_TYPES, null included — 'not-sure' is the vocabulary's
+  // own way to say "I would rather not", so a null here would be a second spelling
+  // of an answer that already exists, and the catalog projection could not carry it
+  // (it reads the type as COALESCE(new, old), so a null would leave the map showing
+  // the declaration the owner just took back).
+  if (type !== undefined) {
+    params.push(type);
+    sets.push(`type = $${params.length}`);
+  }
   const { rows } = await db.query(
     `UPDATE provisioning_instances SET ${sets.join(', ')} WHERE id = $1 RETURNING *`,
     params

package/modules/provisioning/routes/body-validators.js

@@ -0,0 +1,94 @@
+// modules/provisioning/routes/body-validators.js — the LOUD body validators the
+// provisioning routes share (task 1003504).
+//
+// Lifted out of routes/provisioning.js when that file hit the 1500-line size ratchet,
+// the same way ./callback-page.js was. These three are a natural group and the cheapest
+// thing in the file to move: PURE functions with no express, no pool and no auth in
+// them, each answering one question — "is this body field a mistake, and what do I tell
+// the caller?" — and each returning null when clean or a { code, message } to fail with.
+//
+// They exist because the kernel's strict body validator cannot do their jobs: it reaches
+// top-level fields only, so a typo INSIDE `detail` or `modules` would be dropped in
+// silence on the way to storage. Silence is the wrong answer at the boundary.
+//
+// Both the create route and PATCH …/detail run them, so the two can never drift.
+
+const provisioning = require('../provisioning');
+const { ALWAYS_ON_CORE, OPTIONAL_MODULES } = require('../starter-bundles');
+
+// The project-detail answers, validated LOUDLY (task 1002334). `detail` arrives as
+// a nested object, and the strict body validator only reaches top-level fields — so
+// without this a typo'd answer key would be dropped by normalizeProjectDetail and
+// the caller would be told nothing, which is exactly the silent-drop failure the
+// strict validator exists to prevent (and that a re-request's type_ignored receipt
+// was written to avoid). Returns null when clean, or a { code, message } to fail
+// with. Both the create route and PATCH …/detail run it, so they cannot drift.
+function badProjectDetail(detail) {
+  if (detail === undefined || detail === null) return null;
+  if (typeof detail !== 'object' || Array.isArray(detail)) {
+    return { code: 'bad_detail', message: 'detail must be an object of answers.' };
+  }
+  const vocab = provisioning.PROJECT_DETAIL_VOCAB;
+  for (const [key, value] of Object.entries(detail)) {
+    if (!Object.prototype.hasOwnProperty.call(vocab, key)) {
+      return { code: 'bad_detail', message: `Unknown detail answer "${key}" — the interview asks: ${Object.keys(vocab).join(', ')}.` };
+    }
+    // An explicit null is the UN-ANSWER, not an off-vocabulary value (task 1003577):
+    // the merge-patch way back to "never answered". Only null — an empty string or any
+    // other sentinel stays a typo, so a caller trying to SET one is never silently
+    // read as having erased their answer.
+    if (value === null) continue;
+    if (!vocab[key].includes(value)) {
+      return { code: 'bad_detail', message: `"${key}" must be one of: ${vocab[key].join(', ')} — or null to un-answer it.` };
+    }
+  }
+  return null;
+}
+
+// The creation picker's module selection, validated LOUDLY (BV1.R20, task
+// 1002339) — badProjectDetail's rule applied to a list. The strict body validator
+// checks that `modules` is an array of strings; it cannot check MEMBERSHIP, and
+// normalizeModuleSelection drops an unknown key silently on the way to storage.
+// Silence is the wrong answer at the boundary: an API caller who names a module
+// that does not exist, or one of the always-on / hub-only ones, has made a
+// mistake and would otherwise be told nothing and handed a project without it.
+// Returns null when clean, or a { code, message } to fail with.
+function badModuleSelection(modules) {
+  if (modules === undefined || modules === null) return null;
+  if (!Array.isArray(modules)) {
+    return { code: 'bad_modules', message: 'modules must be an array of module keys.' };
+  }
+  const offered = OPTIONAL_MODULES.map((m) => m.key);
+  for (const key of modules) {
+    if (offered.includes(key)) continue;
+    if (ALWAYS_ON_CORE.includes(key)) {
+      return { code: 'bad_modules', message: `"${key}" is always on for every project — it is not one of the modules to choose.` };
+    }
+    return { code: 'bad_modules', message: `Unknown module "${key}" — the choices are: ${offered.join(', ')}.` };
+  }
+  return null;
+}
+
+// The declared project type, validated LOUDLY (task 1003504) — badProjectDetail's rule
+// applied to a single closed-vocabulary value. Returns null when clean, or a
+// { code, message } to fail with.
+//
+// NULL IS REFUSED, and this is the one place the two "un-answer" conventions on
+// PATCH …/detail part company. `detail: { key: null }` un-answers a question because
+// that vocabulary has no word for "never said". The TYPE vocabulary has one —
+// 'not-sure' — so null would only be a second spelling of an answer that already
+// exists. It would also be a lie on the map: the catalog projection carries the type
+// as COALESCE(EXCLUDED.type, existing.type), so a null would leave the row showing the
+// declaration the owner had just taken back, with no second write to correct it.
+function badProjectType(type) {
+  if (type === undefined) return null;
+  if (type === null) {
+    return { code: 'bad_type', message: 'A project always has a kind — send "not-sure" to take the declaration back, not null.' };
+  }
+  if (!provisioning.PROJECT_TYPES.includes(type)) {
+    return { code: 'bad_type', message: `Unknown project type "${type}" — the choices are: ${provisioning.PROJECT_TYPES.join(', ')}.` };
+  }
+  return null;
+}
+
+module.exports = { badProjectDetail, badModuleSelection, badProjectType };

package/modules/provisioning/routes/provisioning.js

@@ -55,6 +55,8 @@ const { requireAuthorityForMeteredShape } = require('../paid-shape-gate');
 const { adoptCredentialFault } = require('../credential-preflight');
 const catalogBridge = require('../catalog-bridge');
 const { callbackPage } = require('./callback-page');
+// the LOUD body validators (task 1003504) — lifted out when this file hit the size ratchet
+const { badProjectDetail, badModuleSelection, badProjectType } = require('./body-validators');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('provisioning');
 
@@ -107,59 +109,6 @@ function ownerFromTargetRef(ref) {
   return m ? m[1] : null;
 }
 
-// The project-detail answers, validated LOUDLY (task 1002334). `detail` arrives as
-// a nested object, and the strict body validator only reaches top-level fields — so
-// without this a typo'd answer key would be dropped by normalizeProjectDetail and
-// the caller would be told nothing, which is exactly the silent-drop failure the
-// strict validator exists to prevent (and that a re-request's type_ignored receipt
-// was written to avoid). Returns null when clean, or a { code, message } to fail
-// with. Both the create route and PATCH …/detail run it, so they cannot drift.
-function badProjectDetail(detail) {
-  if (detail === undefined || detail === null) return null;
-  if (typeof detail !== 'object' || Array.isArray(detail)) {
-    return { code: 'bad_detail', message: 'detail must be an object of answers.' };
-  }
-  const vocab = provisioning.PROJECT_DETAIL_VOCAB;
-  for (const [key, value] of Object.entries(detail)) {
-    if (!Object.prototype.hasOwnProperty.call(vocab, key)) {
-      return { code: 'bad_detail', message: `Unknown detail answer "${key}" — the interview asks: ${Object.keys(vocab).join(', ')}.` };
-    }
-    // An explicit null is the UN-ANSWER, not an off-vocabulary value (task 1003577):
-    // the merge-patch way back to "never answered". Only null — an empty string or any
-    // other sentinel stays a typo, so a caller trying to SET one is never silently
-    // read as having erased their answer.
-    if (value === null) continue;
-    if (!vocab[key].includes(value)) {
-      return { code: 'bad_detail', message: `"${key}" must be one of: ${vocab[key].join(', ')} — or null to un-answer it.` };
-    }
-  }
-  return null;
-}
-
-// The creation picker's module selection, validated LOUDLY (BV1.R20, task
-// 1002339) — badProjectDetail's rule applied to a list. The strict body validator
-// checks that `modules` is an array of strings; it cannot check MEMBERSHIP, and
-// normalizeModuleSelection drops an unknown key silently on the way to storage.
-// Silence is the wrong answer at the boundary: an API caller who names a module
-// that does not exist, or one of the always-on / hub-only ones, has made a
-// mistake and would otherwise be told nothing and handed a project without it.
-// Returns null when clean, or a { code, message } to fail with.
-function badModuleSelection(modules) {
-  if (modules === undefined || modules === null) return null;
-  if (!Array.isArray(modules)) {
-    return { code: 'bad_modules', message: 'modules must be an array of module keys.' };
-  }
-  const offered = OPTIONAL_MODULES.map((m) => m.key);
-  for (const key of modules) {
-    if (offered.includes(key)) continue;
-    if (ALWAYS_ON_CORE.includes(key)) {
-      return { code: 'bad_modules', message: `"${key}" is always on for every project — it is not one of the modules to choose.` };
-    }
-    return { code: 'bad_modules', message: `Unknown module "${key}" — the choices are: ${offered.join(', ')}.` };
-  }
-  return null;
-}
-
 // Register this module's kernel seam (ADR 0083 / the registerBoxSeams precedent).
 // Idempotent — the loader calls this factory once at boot, but tests may
 // instantiate the router repeatedly; gating on hasProvider keeps the port
@@ -716,6 +665,21 @@ module.exports = function provisioningRoutes() {
   // a later edit. The always-on core stays unremovable by construction:
   // badModuleSelection refuses its keys and `effectiveModules` re-adds it on read.
   //
+  // `type` RIDES IT TOO (task 1003504), and for the third time the same argument: the
+  // wizard's Type step declared something at creation and nothing owner-facing could
+  // change it afterwards, so task 1002772 had to narrow the wizard's own promise and
+  // stop saying "you can change it later". This is the route that earns the sentence
+  // back. It belongs here rather than on the settings channel for the mModules reason —
+  // a type is a DECLARATION on the platform row, not a policy the running instance
+  // obeys, so nothing is pushed to the project and nothing restarts.
+  //
+  // One consequence is worth naming, because the owner has to be told it: for a project
+  // whose picker was SKIPPED, `modules` is NULL and effectiveModules resolves the type's
+  // starter bundle at read time (ADR 0240 §2) — so changing the type moves the extras
+  // too. A set the owner picked for themselves is stored and never moves. The reply
+  // carries `modules` on every patch precisely so the caller learns which happened
+  // without a follow-up GET.
+  //
   // AN ANSWER CAN BE TAKEN BACK (task 1003577). `detail` merges, so before this the
   // first `team_shape` an owner sent was permanent — and "never answered" is a state
   // `effectiveModules` reads (ADR 0240), not merely the absence of one. Sending
@@ -731,16 +695,22 @@ module.exports = function provisioningRoutes() {
       description: { type: 'string', maxLength: provisioning.DESCRIPTION_MAX },
       detail: { type: 'object' },
       modules: { type: 'array', itemsType: 'string', maxItems: 50 },
+      type: { type: 'string', maxLength: 40 },
     })) return;
     const body = req.body || {};
     const detailFault = badProjectDetail(body.detail);
     if (detailFault) return res.fail(detailFault.code, { status: 400, message: detailFault.message });
     const modulesFault = badModuleSelection(body.modules);
     if (modulesFault) return res.fail(modulesFault.code, { status: 400, message: modulesFault.message });
+    // `type: null` reaches here because the kernel validator reads null as ABSENT —
+    // which is exactly why the refusal has to be its own check and not an enum rule.
+    const typeFault = badProjectType(Object.prototype.hasOwnProperty.call(body, 'type') ? body.type : undefined);
+    if (typeFault) return res.fail(typeFault.code, { status: 400, message: typeFault.message });
     const wantsModules = Array.isArray(body.modules);
-    if (body.description === undefined && body.detail === undefined && !wantsModules) {
+    const wantsType = typeof body.type === 'string';
+    if (body.description === undefined && body.detail === undefined && !wantsModules && !wantsType) {
       return res.fail('bad_detail', { status: 400,
-        message: 'The body carries nothing to change — send description, detail, modules, or any mix.' });
+        message: 'The body carries nothing to change — send description, detail, modules, type, or any mix.' });
     }
     try {
       const inst = await provisioning.getInstanceById(pool, id);
@@ -753,6 +723,7 @@ module.exports = function provisioningRoutes() {
       if (body.description !== undefined) patch.description = provisioning.normalizeDescription(body.description);
       if (body.detail !== undefined) patch.detail = body.detail;
       if (wantsModules) patch.modules = body.modules;
+      if (wantsType) patch.type = body.type;
       const updated = await provisioning.updateInstanceDetail(pool, id, patch);
       await provisioning.recordEvent(pool, {
         instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'detail',
@@ -775,7 +746,12 @@ module.exports = function provisioningRoutes() {
         // Re-deriving it from a follow-up GET would let the two answers disagree.
         publish: publishVerdict(updated),
         // `team_shape` MOVES a bundle-sourced project's modules — effect with cause (ADR 0243 §5).
+        // So does `type`, for a project whose picker was skipped — same reason, said once here.
         modules: effectiveModules(updated),
+        // The declaration as it now stands (task 1003504) — the caller repaints from the
+        // platform's answer, never from the word it sent, so a refused or clamped write
+        // can never leave the picker showing a choice the row does not hold.
+        type: updated.type || null,
       });
     } catch (err) {
       log.error('[provisioning] PATCH /provisioning/instances/:id/detail', err);

package/modules/public-landing/public/assets/cosmos.css

@@ -1585,6 +1585,12 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 #view-new .panel .lede strong,#view-new .panel .lede em{color:var(--ink);font-weight:500;font-style:normal;}
 /* the done clause's link to Your projects clears the 24px hit floor as a box (an inline's rect is its content box) */
 #view-new .panel .lede a{display:inline-block;padding:3px 0;min-height:24px;line-height:18px;color:var(--ink);font-weight:400;text-decoration:underline;text-underline-offset:3px;}
+/* the "still watching …" line above step 1 (task 1003503): a quiet offer, not a
+   banner — the fresh wizard is what the click asked for. Its link clears the 24px
+   hit floor as a box, the same way the lede's does. */
+#view-new .resumeOffer{font-weight:400;font-size:13.5px;line-height:1.5;color:var(--ink-soft);margin:0 0 22px;max-width:62ch;}
+#view-new .resumeOffer strong{color:var(--ink);font-weight:500;}
+#view-new .resumeOffer a{display:inline-block;padding:3px 0;min-height:24px;line-height:18px;color:var(--ink);font-weight:400;text-decoration:underline;text-underline-offset:3px;}
 #view-new .finePrint{font-weight:400;font-size:13.5px;line-height:1.5;color:var(--ink-soft);margin-top:18px;max-width:62ch;}
 #view-new .finePrint a{color:var(--ink);font-weight:400;text-decoration:underline;text-underline-offset:3px;}
 #view-new .finePrint em{font-style:normal;color:var(--ink);}

package/modules/public-landing/public/projects.html

@@ -829,6 +829,28 @@ summary{min-height:24px;padding:3px 0;}
         </details>
       </div>
 
+      <!-- live since task 1003504: the way back into the creation wizard's Type
+           step. Task 1002772 shipped the declaration with a deliberately NARROWED
+           promise — the wizard stopped saying "you can change it later", because
+           nothing owner-facing could. This is the surface that earns the sentence
+           back, and it sits beside "Its extras" for that section's own reason and
+           on the same channel: a type is a DECLARATION on the platform row, not a
+           policy the running instance obeys, so nothing is pushed to the project
+           and nothing restarts.
+           The one way it differs from its neighbour: this is a choice of ONE, not
+           a set of toggles, so picking the kind already chosen is a no-op rather
+           than an un-declaration. "Not Sure" is the vocabulary's own way back to
+           saying nothing, which is why the route refuses null. The fold is a
+           SIBLING of the volatile slot so no re-render can drop it. -->
+      <div class="card mSec" id="mKind">
+        <h2>Its kind</h2>
+        <div id="mKindPick"><p class="finePrint">Reading the project…</p></div>
+        <details class="finePrint" id="mKindWhat">
+          <summary>What the choice changes</summary>
+          <p>How this project is listed — the kind shown beside its name on the map, in the table and on its card. It is a declaration about the project, not a setting the project obeys: nothing is pushed to it and nothing restarts. One thing does follow the kind: if you never picked your extras yourself, they are the set this kind suggests, so changing the kind changes them too — you will be told when that happens. Extras you picked for yourself are stored and never move. Not Sure is a real answer, and it is the way back if you would rather not say.</p>
+        </details>
+      </div>
+
       <!-- live since task 1002342 (BV1.R23): the way back into the creation
            wizard's module picker. Step 4 of the wizard is skippable, and an
            optional step is a default rather than a dead end only if there is a
@@ -978,6 +1000,11 @@ summary{min-height:24px;padding:3px 0;}
             <h1 id="name-h">Start a project</h1>
             <p class="lede">Your own project: its own repository, its own home on the web, and a hall of AI builders
               who do the building. You set the direction; agents lay down the code.</p>
+            <!-- The standup already being watched, kept one click away (task 1003503).
+                 A deliberate "New project" click opens THIS fresh step 1; the previous
+                 project's done panel is reachable here instead of taking the panel over.
+                 Baked markup, hidden until enter() has a record to name. -->
+            <p class="resumeOffer" id="wizResume" hidden>still watching <strong id="wizResumeName">your project</strong> — <a href="#" id="wizResumeGo">resume it</a></p>
             <form id="newForm" data-next="2">
               <label class="wizField"><span>Project name</span>
                 <input type="text" id="newName" placeholder="What should it be called?" autocomplete="off" maxlength="80" aria-label="Project name">
@@ -1000,7 +1027,7 @@ summary{min-height:24px;padding:3px 0;}
                forced into a wrong answer, and it can change later. -->
           <section class="panel" id="panel-type" aria-labelledby="type-h">
             <h1 id="type-h">What kind of project is it?</h1>
-            <p class="lede">Pick the shape that fits best — it’s how the project is listed on the map, and it stays as you pick it for now. Not sure is a fine answer.</p>
+            <p class="lede">Pick the shape that fits best — it’s how the project is listed on the map, and you can change it later from the project’s own page. Not sure is a fine answer.</p>
             <form data-next="3">
               <div class="typeCards" id="typeCards" role="group" aria-label="Project type">
                 <button type="button" class="tpill" data-type="game" aria-pressed="false">Game</button>
@@ -4613,6 +4640,36 @@ summary{min-height:24px;padding:3px 0;}
       tick();
     }
 
+    /* Everything the wizard must FORGET to start a second project: the watch, the
+       manifest leg, the answers, the fields. Deliberately not the created record —
+       the caller owns that. "Start another project" drops it (the founder said they
+       were done); the intent-driven resume below keeps it, so the standup stays one
+       click away while a fresh step 1 is filled in. */
+    function resetForNewProject() {
+      stopPolling();
+      stopManifestPoll();
+      instanceId = null;
+      watchPending = false; manifestPending = false; manifestState = null;
+      manifestStartedAt = 0; manifestStale = false;
+      live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
+      lastStepsHtml = '';
+      lastProgHtml = '';
+      try { sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
+      /* Every key the initial state declares has to be re-declared here. `modules`
+         is three-valued and null is its "nothing said" sentinel; leaving the key out
+         left it UNDEFINED, which is not null — so pickedModules() reached .slice()
+         on it and the second project's Modules step threw. */
+      state = { step: 1, name: '', projType: null, description: '', teamShape: null, modules: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
+      $('newName').value = ''; $('f-owner').value = ''; $('f-repo').value = ''; $('f-slug').value = ''; $('f-domain').value = '';
+      $('f-noaddr').checked = false; $('f-desc').value = '';
+      /* Re-seed the owner from the signed-in account for the next project. */
+      if (me && me.github_login) { state.owner = me.github_login; $('f-owner').value = state.owner; }
+      $('h-name').innerHTML = '&nbsp;';
+      paintType(null);
+      paintTeam(null);
+      setMode('greenfield');
+    }
+
     /* start another project: clear the stored instance + draft, back to step 1 */
     function wireAgain() {
       var again = document.createElement('button');
@@ -4620,24 +4677,11 @@ summary{min-height:24px;padding:3px 0;}
       again.addEventListener('click', function () {
         /* a standup still being watched is not abandoned by accident */
         if (instanceId && pollTimer && !confirm((state.name || state.slug) + ' keeps building — you’ll find it on your projects page. Start a new one?')) return;
-        stopPolling();
-        stopManifestPoll();
-        instanceId = null;
-        watchPending = false; manifestPending = false; manifestState = null;
-        manifestStartedAt = 0; manifestStale = false;
-        live = { instStatus: null, manifest: null, manifestMsg: '', manifestCode: '', appSlug: null };
-        lastStepsHtml = '';
-        lastProgHtml = '';
-        try { sessionStorage.removeItem(CREATED_KEY); sessionStorage.removeItem(DRAFT_KEY); } catch (e) {}
-        state = { step: 1, name: '', projType: null, description: '', teamShape: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
-        $('newName').value = ''; $('f-owner').value = ''; $('f-repo').value = ''; $('f-slug').value = ''; $('f-domain').value = '';
-        $('f-noaddr').checked = false; $('f-desc').value = '';
-        /* Re-seed the owner from the signed-in account for the next project. */
-        if (me && me.github_login) { state.owner = me.github_login; $('f-owner').value = state.owner; }
-        $('h-name').innerHTML = '&nbsp;';
-        paintType(null);
-        paintTeam(null);
-        setMode('greenfield');
+        resetForNewProject();
+        /* the deliberate goodbye: the record goes too, so nothing offers to resume
+           the project the founder has just said they are finished watching */
+        try { sessionStorage.removeItem(CREATED_KEY); } catch (e) {}
+        paintResumeOffer(null);
         show(1, true);
       });
       $('panel-done').appendChild(again);
@@ -4648,6 +4692,81 @@ summary{min-height:24px;padding:3px 0;}
     function createdRecord() {
       try { return JSON.parse(sessionStorage.getItem(CREATED_KEY) || 'null'); } catch (e) { return null; }
     }
+    /* The "still watching …" offer above step 1 (task 1003503). Its markup is baked
+       into the panel, so this only names the project and shows or hides the line —
+       this surface builds no live DOM from strings. null takes it down. */
+    function paintResumeOffer(created) {
+      var el = $('wizResume');
+      if (!el) return;
+      if (created && created.id) {
+        $('wizResumeName').textContent = created.name || created.slug || 'your project';
+        el.hidden = false;
+      } else {
+        el.hidden = true;
+      }
+    }
+    /* Raised by the resume link so the enter() it triggers reads as "yes, the done
+       panel" instead of one more ask for a fresh wizard. One-shot: enter() lowers it. */
+    var resumeIntent = false;
+    $('wizResumeGo').addEventListener('click', function (ev) {
+      ev.preventDefault();
+      resumeIntent = true;
+      enter(true);
+    });
+
+    /* enterCreated(created, focus) — a stored record means a standup is (or was)
+       being watched, and WHO IS ARRIVING decides what that means (task 1003503,
+       owner call 2026-09-11):
+
+         • a reload, Back, or the identity settle (focus false) — the same visit
+           continuing, so the done panel and its human-steps checklist come back
+           untouched. Losing the checklist there would be the bug;
+         • a deliberate "New project" click (focus true) — an ask for ANOTHER
+           project, so it opens a fresh step 1 and leaves the standup one click
+           away on the resume link. That nav used to land on the previous
+           project's checklist for the rest of the tab session, with "Start
+           another project" the only way out.
+
+       The reset fires only when there is a SECOND DRAFT to lose, and the draft's own
+       step is what says so. A landed create clears DRAFT_KEY — but show(8) then
+       persists the done panel's own position straight back into it, so "is there a
+       draft?" is always yes and would have skipped the reset forever, leaving the
+       finished project's name sitting in the fresh form. Only steps 1–7 are wizard
+       steps: anything else is the done panel's bookkeeping, not a project someone
+       is part-way through typing. */
+    function enterCreated(created, focus) {
+      if (focus && !resumeIntent) {
+        var draft = null;
+        try { draft = JSON.parse(sessionStorage.getItem(DRAFT_KEY) || 'null'); } catch (e) {}
+        var at = draft && draft.step >= 1 && draft.step <= 7 ? draft.step : 0;
+        if (!at) { resetForNewProject(); at = 1; }
+        paintResumeOffer(created);
+        /* step 1's own focus target is the name field, not the heading — the same
+           deliberate-nav rule enter() applies below */
+        show(at, at !== 1);
+        if (at === 1) $('newName').focus();
+        return;
+      }
+      resumeIntent = false;
+      paintResumeOffer(null);
+      /* returning after a create — resume watching that instance instead of a
+         blank wizard */
+      state.name = created.name || created.slug; state.slug = created.slug || '';
+      state.domain = created.domain || ''; state.mode = created.mode || 'greenfield';
+      /* restore the opt-out too — without it resolvedDomain() re-derives the
+         assigned address and the done panel promises one that doesn't exist */
+      state.noAddress = !!created.noaddr;
+      /* the manifest leg's last known truth, kept across a reload */
+      if (created.manifest) { live.manifest = created.manifest; live.appSlug = created.app_slug || null; }
+      if (created.manifest_state && created.manifest !== 'done' && created.manifest !== 'error' && created.manifest !== 'expired') {
+        manifestState = created.manifest_state; manifestPending = true;
+      }
+      renderDone();
+      show(8, !!focus);
+      startProgress(created.id);
+      resumePolls();
+    }
+
     /* enter(focus) — paint the right step for whoever just arrived. Before the
        identity settles it shows the draft step optimistically (the page stays
        usable while /me is in flight — the boot's own rule); onAuth() re-enters
@@ -4655,25 +4774,8 @@ summary{min-height:24px;padding:3px 0;}
     function enter(focus) {
       if (authKnown && !me) { show(0, !!focus); return; }
       var created = authKnown ? createdRecord() : null;
-      if (created && created.id) {
-        /* returning after a create — resume watching that instance instead of a
-           blank wizard */
-        state.name = created.name || created.slug; state.slug = created.slug || '';
-        state.domain = created.domain || ''; state.mode = created.mode || 'greenfield';
-        /* restore the opt-out too — without it resolvedDomain() re-derives the
-           assigned address and the done panel promises one that doesn't exist */
-        state.noAddress = !!created.noaddr;
-        /* the manifest leg's last known truth, kept across a reload */
-        if (created.manifest) { live.manifest = created.manifest; live.appSlug = created.app_slug || null; }
-        if (created.manifest_state && created.manifest !== 'done' && created.manifest !== 'error' && created.manifest !== 'expired') {
-          manifestState = created.manifest_state; manifestPending = true;
-        }
-        renderDone();
-        show(8, !!focus);
-        startProgress(created.id);
-        resumePolls();
-        return;
-      }
+      if (created && created.id) { enterCreated(created, !!focus); return; }
+      paintResumeOffer(null);
       /* before identity settles, never render past the name step: deeper steps
          carry authenticated side effects (the Home-step repo probe), and onAuth()
          re-enters to the real draft step the moment /me answers */
@@ -5720,6 +5822,9 @@ summary{min-height:24px;padding:3px 0;}
         /* the extras band (task 1002342) rides the same guard: its own toggles
            are the only thing that should ever repaint it, never the tick */
         if (!keepRepo) renderMods(inst);
+        /* the kind picker (task 1003504) rides it for the same reason — and it can
+           move the band above, so the two must never be repainted out of step */
+        if (!keepRepo) renderKind(inst);
       })
       .catch(function (err) {
         var m = String(err && err.message);
@@ -6591,6 +6696,85 @@ summary{min-height:24px;padding:3px 0;}
      repaints from the server's own answer — never from the list we sent — so it
      can never show a set the platform did not accept. ── */
 
+  /* The declared kind (task 1003504). Painted from TYPE_META — the page's single
+     copy of the vocabulary, shared with the table cell and the card — so a sixth
+     kind, or a re-worded one, can never mean two things on one page. Reuses the
+     extras band's own classes: the control is the same control (a labelled choice
+     with its line of explanation), and a second set of rules for it would drift
+     from the first. aria-pressed, not aria-checked, mirrors the wizard's own Type
+     pills — this is that picker, met again. */
+  function kindSlot(html) { $('mKindPick').innerHTML = html; }
+  var kindBusy = false;
+
+  function renderKind(inst) {
+    var now = (inst && inst.type) || null;
+    kindSlot('<div class="modBand" id="mKindBand" role="group" aria-label="Project kind">' +
+      Object.keys(TYPE_META).map(function (k) {
+        return '<button type="button" class="modOpt" data-kind="' + esc(k) + '" aria-pressed="' +
+          (now === k ? 'true' : 'false') + '"' + (kindBusy ? ' disabled' : '') +
+          '><b>' + esc(TYPE_META[k].label) + '</b><small>' + esc(TYPE_META[k].desc) + '</small></button>';
+      }).join('') + '</div>' +
+      (now ? '' : '<p class="finePrint">This project has never said what kind it is. Saying so puts the word beside its name wherever it is listed; it changes nothing else.</p>') +
+      '<div class="projMsg" id="mKindMsg" role="status" aria-live="polite"></div>');
+  }
+
+  /* One pick, sent as the whole declaration. Re-picking the kind already chosen is
+     a NO-OP, not an un-declaration: the vocabulary's way back is "Not Sure", and a
+     toggle-off here would send a null the route refuses anyway. */
+  function doKindPick(key) {
+    if (!manageInst || kindBusy) return;
+    if ((manageInst.type || null) === key) return;
+    kindBusy = true;
+    renderKind(manageInst);
+    var box = $('mKindMsg');
+    box.className = 'projMsg'; box.textContent = 'Saving…';
+    var asked = manageId; /* a stale answer must never repaint a newer project */
+    var hadPicked = modsSource(manageInst) === 'picked';
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/detail', {
+      method: 'PATCH', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ type: key })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        kindBusy = false;
+        if (asked !== manageId) return;
+        if (res.ok) {
+          /* the platform's own answer, never the word we sent */
+          manageInst.type = data.type || null;
+          manageInst.modules = data.modules || manageInst.modules;
+          renderKind(manageInst);
+          /* the extras band reads the same row: a bundle-sourced set has just moved
+             with the kind, and leaving it painted from the old one would be a lie */
+          renderMods(manageInst);
+          var ok = $('mKindMsg');
+          ok.className = 'projMsg ok';
+          ok.textContent = hadPicked || modsSource(manageInst) !== 'bundle'
+            ? 'Saved. Nothing on the project itself changes — there is nothing to restart.'
+            : 'Saved. Your extras follow the kind, because you never picked them yourself — they are now the set this kind suggests. Nothing on the project itself changes.';
+          return;
+        }
+        renderKind(manageInst);   /* the band goes back to what the row still says */
+        var e = apiError(data, res.status);
+        var m = $('mKindMsg');
+        m.className = 'projMsg err';
+        if (res.status === 401) { m.innerHTML = signInAgain(); return; }
+        m.textContent = e;
+      });
+    }).catch(function () {
+      kindBusy = false;
+      if (asked !== manageId) return;
+      renderKind(manageInst);
+      var m = $('mKindMsg');
+      m.className = 'projMsg err';
+      m.textContent = 'Couldn’t reach the platform just now. Nothing about your project has changed — try again in a moment.';
+    });
+  }
+
+  document.addEventListener('click', function (ev) {
+    var b = ev.target.closest && ev.target.closest('#mKindBand [data-kind]');
+    if (!b) return;
+    doKindPick(b.getAttribute('data-kind'));
+  });
+
   var modsCatalog = null;    /* { core, optional } — the public catalog, read once */
   var modsPromise = null;
   var modsFailed = false;    /* asked and did not get it; distinct from not yet asked */
@@ -6617,6 +6801,12 @@ summary{min-height:24px;padding:3px 0;}
   function modsSelected(inst) {
     return ((inst && inst.modules && inst.modules.selected) || []).slice();
   }
+  /* 'bundle' = the kind's suggested set, resolved at read time because the picker
+     was skipped; 'picked' = an answer the owner gave and the column stores. The
+     kind picker beside this reads it to say whether a change moved the extras. */
+  function modsSource(inst) {
+    return (inst && inst.modules && inst.modules.source) || null;
+  }
 
   function renderMods(inst) {
     ensureModsCatalog();