docs: lead Onboarding with single-paste flow; mark scripts Shipping

Reflects the reality on the ground after PRs #29/#30/#31 land the
v2 scripts:

onboarding.mdx:
- Promotes 'irm https://kun.databayt.org/install | iex' to the
  recommended path (one paste, one UAC, three OAuth sign-ins)
- Demotes Cowork-driven flow to "Alternative" — still works for
  Pro/Max users who want narration over a bare paste
- Manual fallback updated to use databayt/kun raw URL (the codebase
  one is now tombstoned in databayt/codebase#2)
- Adds 'doctor' to Daily entry points and 'maintain -Install' to
  the manual fallback chain
- "What you end up with" mentions the scheduled task

onboarding-reference.mdx:
- Scripts contract table flipped: bootstrap, doctor, maintain are
  now Shipping (no longer 'Planned v2'); health.ps1 marked Deprecated;
  finish.ps1 reduced to 'Planned (alias for bootstrap)'
- Source-of-truth URL changed from databayt/codebase to databayt/kun
- Migration order section refreshed — 4 of 6 items checked off,
  fresh-VM test + team comms remaining

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: abdout

content/docs/onboarding-reference.mdx

@@ -56,20 +56,18 @@ Pre-authorizes the common tool set so even default `claude` doesn't prompt for r
 
 ## Scripts contract
 
-The executable layer lives at `~/.claude/scripts/`. Today's scripts are authoritative — Cowork and Claude Code only invoke them. The v2 column documents the bootstrap layer that will land in `databayt/codebase` to collapse the cold-start paste further.
+The executable layer lives at `~/.claude/scripts/`. All scripts are authoritative — Cowork and Claude Code only invoke them. Source of truth is [databayt/kun/.claude/scripts](https://github.com/databayt/kun/tree/main/.claude/scripts). Any PR that changes a script must touch the matching row below.
 
 | Script | Status | Purpose |
 |---|---|---|
-| `install.ps1` | Shipping | Installs Claude Code CLI if missing, copies kun config to `~/.claude/`, clones `databayt/codebase` to `~/codebase`. Role-aware (`engineer`, `business`, `content`, `ops`). |
+| `bootstrap.ps1` | Shipping | Single-paste cold start: ExecutionPolicy → self-elevate → winget bundle → PATH refresh → pnpm → WebStorm → plugin pre-drop → install.ps1 → `$PROFILE` → batched OAuth → secrets → sync-repos → `maintain -Install` → `doctor`. 16 idempotent steps. |
+| `install.ps1` | Shipping | Installs Claude Code CLI if missing, copies kun config to `~/.claude/`, clones `databayt/codebase` to `~/codebase`. Role-aware. Copies `lib/` recursively. |
 | `secrets.ps1` | Shipping | Pulls `.env` from the team Gist into `~/.claude/.env`. Idempotent. |
-| `sync-repos.ps1` | Shipping | Clones all active org repos: `codebase` to `~/codebase`, others to `~/oss/<name>`. `--status` prints branch/commit per repo. |
-| `health.ps1` | Shipping | Audits `~/.claude/` — files exist, JSON valid, agent/command/MCP counts, config age. `-Report` posts to `databayt/kun#health`. |
-| `bootstrap.ps1` | Planned (v2) | Single-paste cold start: ExecutionPolicy fix, winget bundle, install, secrets, sync-repos, WebStorm via Toolbox, plugin pre-drop, scheduled task. Exits with codes documented in `databayt/codebase`. |
-| `finish.ps1` | Planned (v2) | Idempotent re-runner — same shape as bootstrap but skips installs if tools are already on PATH. Used to repair interrupted runs. |
-| `doctor.ps1` | Planned (v2) | Rename of `health.ps1` with extra org-specific checks: `.env` freshness, repo layout, scheduled task armed, plugin loaded in WebStorm. |
-| `maintain.ps1` | Planned (v2) | Daily scheduled task: sync-repos, self-update `~/.claude/`, run doctor, notify Slack on red. |
-
-Each shipping script lives in [databayt/codebase/.claude/scripts](https://github.com/databayt/codebase/tree/main/.claude/scripts). Any PR that changes a script must touch the matching row above.
+| `sync-repos.ps1` | Shipping | Clones all active org repos. Reads `~/.claude/memory/repositories.json` as source of truth (with a hardcoded fallback for cold-bootstrap). |
+| `doctor.ps1` | Shipping | Health audit + update check + self-repair. 7 check modules (Core, Shell, Identity, Repos, Updates, Scheduled, IDE) + 1 fix module. Flags `-Fix`, `-Update`, `-Report`, `-Json`, `-Quiet`. Exits 0/1/2/3. |
+| `maintain.ps1` | Shipping | Daily Windows scheduled task. Composes `sync-repos → self-update → doctor → notify → log`. Silent on green; toast on warnings/updates; toast + Slack on errors. `-Install` / `-Uninstall` / `-Status` / `-Run` / `-DryRun`. |
+| `health.ps1` | Deprecated | 5-line back-compat shim → `doctor.ps1`. Removed in a follow-up after a 2-week co-existence window. |
+| `finish.ps1` | Planned | Alias for `bootstrap.ps1` (every step is already idempotent). Ships as a one-line wrapper. |
 
 ## `.claude` layout
 
@@ -154,13 +152,14 @@ Anything else can be automated, and probably should be.
 
 ## Migration order
 
-For the person rolling out the v2 scripts:
+The v2 rollout, mostly done. Remaining items are flagged.
 
-1. Land scripts in `databayt/codebase/.claude/scripts/` (`bootstrap`, `finish`, `doctor`, `maintain`). They work standalone — the current doc keeps functioning while these exist alongside it.
-2. Cut a redirect at `kun.databayt.org/install` → `raw.githubusercontent.com/databayt/codebase/main/.claude/scripts/bootstrap.ps1`. Same for `/finish`.
-3. Collapse the [Onboarding](/docs/onboarding) paste block to the single-line `irm https://kun.databayt.org/install | iex`. Keep Manual fallback as the existing chain for Team/Enterprise plans.
-4. Update the team channel topic and joiner doc to point at the new flow.
-5. **Run the new bootstrap on one volunteer's fresh VM** before any new hire sees it. The current doc shipped without this step — that's how we ended up with the lessons below.
+1. ✅ Land scripts in `databayt/kun/.claude/scripts/` — `bootstrap`, `doctor`, `maintain`, `install`, `secrets`, `sync-repos`, plus 9 lib modules. All idempotent, syntax-checked, smoke-tested.
+2. ✅ Redirect set in `next.config.ts`: `kun.databayt.org/install` → `raw.githubusercontent.com/databayt/kun/main/.claude/scripts/bootstrap.ps1`. Same for `/doctor` and `/finish`.
+3. ✅ Tombstone `databayt/codebase/.claude/scripts/install.ps1` — prevents duplicate-edit drift.
+4. ✅ [Onboarding](/docs/onboarding) collapsed to single-paste, with Cowork-driven and Manual as alternatives.
+5. ⏳ **Run on one volunteer's fresh Windows 11 VM** before pointing new hires at it. Validates: direct `winget install JetBrains.WebStorm` ships intact JBR (vs. needing Toolbox fallback), Marketplace plugin pre-drop loads on first IDE launch, OAuth batch survives the actual sign-in screens.
+6. ⏳ Update team channel topic + joiner doc to cite the new flow.
 
 ## Lessons from first run
 

content/docs/onboarding.mdx

@@ -1,130 +1,82 @@
 ---
 title: Onboarding
-description: Three actions, ~90 minutes to your first PR
+description: One paste, one UAC, three sign-ins
 ---
 
 # Onboarding
 
-> Three actions. Cowork drives the rest.
+> One paste. One UAC. Three sign-ins. ~90 minutes wall-clock, ~10 minutes of your attention.
 
-The fastest path from a fresh Windows laptop to a databayt PR: install Claude Desktop, paste the team prompt into the Code tab, stay near the keyboard while it sets your machine up. Wall-clock ~90 minutes, mostly downloads. Human time ~10.
+The canonical path from fresh Windows laptop to a databayt PR. Paste a single line, click Yes on one UAC prompt, walk away. Come back at the OAuth batch at the end, sign in to GitHub + Claude + JetBrains, done.
 
 ## What you end up with
 
 - Claude Code CLI on `PATH`
-- Full `~/.claude/` config — every agent, command, MCP server, rule, hook, memory file
+- Full `~/.claude/` config — agents, commands, MCP servers, rules, hooks, memory
 - The `c` function — `claude --dangerously-skip-permissions` in one keystroke
-- WebStorm with the Claude Code [Beta] plugin
-- `databayt/codebase` cloned to `~\codebase`
-- Every other active org repo cloned under `~\oss\<name>`
-- `claude doctor` green
+- WebStorm with the Claude Code [Beta] plugin pre-installed
+- `databayt/codebase` at `~\codebase` + every other active org repo under `~\oss\<name>`
+- Daily `kun-maintain` scheduled task armed for 09:00 — auto sync, doctor, notify
+- `doctor` exits green
 
 ## Before you start
 
 | Requirement | Why |
 |---|---|
-| **Pro or Max plan** | Computer use isn't on Team or Enterprise. Without it, jump to [Manual fallback](#manual-fallback). |
-| Windows 11, admin rights | `winget` installs and `$PROFILE` edits need them. |
-| ~3 GB free disk | Claude Desktop + Node + WebStorm + org repos. |
+| **Pro or Max plan** | The CLI needs a paid account; Cowork (if you use the alternative path below) needs computer use, which is Pro/Max only |
+| Windows 11, admin rights | `winget` installs and `$PROFILE` edits need elevation |
+| ~3 GB free disk | Claude Desktop + Node + WebStorm + org repos |
 
-If any row is missing, sort it before pasting — Cowork can't fix a Team plan.
+## Recommended: single-paste
 
-## The three actions
+Open PowerShell and paste:
 
-### 1. Install Claude Desktop and turn on computer use
-
-Download and run the [Windows x64 installer](https://claude.ai/api/desktop/win32/x64/setup/latest/redirect) (or [ARM64](https://claude.ai/api/desktop/win32/arm64/setup/latest/redirect)).
-
-Launch it. Sign in with your Anthropic account. Confirm the bottom-left badge says **Pro** or **Max** — if it says Team or Enterprise, the rest of this flow won't work; use [Manual fallback](#manual-fallback).
+```powershell
+irm https://kun.databayt.org/install | iex
+```
 
-Settings → General → scroll to **Desktop app** → toggle **Allow Claude to use your computer**. The first time Claude controls the screen, Windows prompts for accessibility access. Grant it. Reference: [Anthropic — computer use in Desktop](https://code.claude.com/docs/en/desktop#let-claude-use-your-computer).
+That's the whole flow. The script:
 
-### 2. Open the Code tab and paste the team prompt
+1. Sets `ExecutionPolicy CurrentUser RemoteSigned` and re-launches elevated (one UAC prompt).
+2. Installs the CLI tools via `winget`: Git, Node-LTS, gh, PowerShell 7, Claude Code CLI, Claude Desktop, WebStorm.
+3. Refreshes `PATH`, installs `pnpm`, pre-drops the Claude Code [Beta] plugin into WebStorm.
+4. Copies the kun config into `~/.claude/` and pulls secrets from the team Gist.
+5. Appends the `c` / `cc` functions to your `$PROFILE` (idempotent — re-runs skip if present).
+6. Pauses at the **OAuth batch** — three sign-ins, one tab at a time:
+   - `gh auth login` device code (clipboard-copied)
+   - `claude` first run (browser sign-in)
+   - WebStorm first launch (sign in or click "Start trial")
+7. Clones every active org repo via `sync-repos.ps1`.
+8. Arms the daily `kun-maintain` scheduled task.
+9. Runs `doctor` for final verification.
 
-Claude Desktop has three tabs — **Chat**, **Cowork**, **Code**. Computer use lives in Code. Start a new Code session. Paste the block below.
+Press **Esc** at any point during the OAuth pause to abort cleanly. Re-running the same paste resumes where it left off (every step is idempotent).
 
-```text
-Set up this fresh Windows laptop for databayt with computer use.
-
-End state I want:
-- GitHub, JetBrains, and Claude (Pro/Max) accounts ready
-- Side-tools installed: git, Node 22, pnpm, gh CLI, PowerShell 7
-- Claude Code CLI installed and signed in
-- The `c` function added to my $PROFILE so it survives new terminals
-- The databayt config installed at %USERPROFILE%\.claude\ (install.ps1 + secrets.ps1)
-- WebStorm installed with the Claude Code [Beta] plugin
-- Every active databayt repo cloned via sync-repos.ps1
-  (codebase to ~\codebase, others to ~\oss\<name>)
-- `claude doctor` all green
-
-Walk me through each step. Open the right app for me. Pause at every OAuth
-or browser screen so I sign in myself — your browser is view-only. Ask for
-my confirmation before any destructive command. I can press Esc to stop you.
-
-One-liners you can use when you reach them:
-
-  winget install Git.Git OpenJS.NodeJS.LTS GitHub.cli Microsoft.PowerShell
-  npm install -g pnpm
-  winget install Anthropic.ClaudeCode
-  irm https://raw.githubusercontent.com/databayt/codebase/main/.claude/scripts/install.ps1 | iex
-  & "$env:USERPROFILE\.claude\scripts\secrets.ps1" -GistId 68453b25fa9d28c94426c55c179b3838
-  winget install JetBrains.WebStorm
-  & "$env:USERPROFILE\.claude\scripts\sync-repos.ps1"
-
-The `c` function block for $PROFILE:
-
-  function c  { claude --dangerously-skip-permissions $args }
-  function cc { claude $args }
-  if (Test-Path "$env:USERPROFILE\.claude\.env") {
-      Get-Content "$env:USERPROFILE\.claude\.env" | ForEach-Object {
-          if ($_ -and -not $_.StartsWith("#")) {
-              $parts = $_ -split "=", 2
-              if ($parts.Length -eq 2) {
-                  [Environment]::SetEnvironmentVariable($parts[0], $parts[1], "Process")
-              }
-          }
-      }
-  }
-  $env:Path = "$env:USERPROFILE\.claude\bin;" + $env:Path
-
-When done, run `claude doctor`, screenshot the result, and list anything
-still pending or anything I owe (OAuth completions, plan upgrades, etc.).
-```
+## Alternative: Cowork-driven
 
-### 3. Stay near the keyboard
+If you'd rather have an agent narrate every step (and you're on Pro/Max), use Claude Desktop's Code tab and paste the prompt below.
 
-Cowork drives the installs. Your job is the irreducible human bits:
+Download [Claude Desktop](https://claude.ai/api/desktop/win32/x64/setup/latest/redirect), sign in, turn on **Settings → General → Allow Claude to use your computer**. Open the **Code** tab, start a new session, paste:
 
-- **One UAC prompt** when `winget` first elevates — click Yes.
-- **OAuth sign-ins.** Cowork pauses on browser screens for GitHub (`gh auth login` device code), Claude (`claude` sign-in), and JetBrains (WebStorm first launch). Type the codes, click Authorize, return to Code, tell it to continue.
-- **Plugin trust** if WebStorm prompts to trust the Claude Code [Beta] plugin.
+```text
+Set up this fresh Windows laptop for databayt.
 
-Total human time: ~10 minutes spread over ~30–45 minutes of installs. Press **Esc** anywhere on screen to abort — Claude releases control and unhides your apps.
+End state: everything in https://kun.databayt.org/docs/onboarding "What you end up with".
 
-## When you're done
+Use the kun bootstrap as your reference, run as much from PowerShell as
+possible. Open browser tabs for OAuth and pause for me to sign in.
+Press Esc to abort at any time.
 
-Open a fresh PowerShell and run:
+  irm https://kun.databayt.org/install | iex
 
-```powershell
-claude --version             # CLI installed
-claude doctor                # all checks pass
-Get-Command c                # c function loaded from $PROFILE
-Test-Path ~\codebase         # codebase cloned
-(Get-ChildItem ~\oss).Count  # org repos cloned (>= 6)
+When done, run `doctor` and report any non-green rows.
 ```
 
-If every line returns a non-empty result and `claude doctor` is green, you're done. Open WebStorm in any cloned repo and press `Ctrl+Esc` to start a Claude session in the IDE.
-
-## If something fails
-
-- **Esc aborts computer use** at any time. Apps unhide, control returns to you.
-- **`claude doctor` is the single source of truth.** Re-run it after any fix; the output names what's missing.
-- **Secrets out of date or missing?** Re-run `& "$env:USERPROFILE\.claude\scripts\secrets.ps1" -GistId 68453b25fa9d28c94426c55c179b3838` — it's idempotent.
-- **Deeper failures?** [Onboarding reference](/docs/onboarding-reference) covers the orchestration model, the scripts contract, and the lessons from the first real run.
+The Cowork path costs more tokens than the bare PowerShell paste (Cowork narrates each step) but gives you live commentary, the ability to interrupt with "stop, do X first," and a record of decisions in the chat history.
 
 ## Manual fallback
 
-For Team or Enterprise plans (no computer use), or when you'd rather type. Run these in PowerShell.
+For Team or Enterprise plans (no computer use), or when you'd rather drive every command yourself. Paste these in PowerShell:
 
 ```powershell
 # Side-tools
@@ -152,7 +104,7 @@ if (Test-Path "$env:USERPROFILE\.claude\.env") {
 $env:Path = "$env:USERPROFILE\.claude\bin;" + $env:Path
 
 # databayt config + secrets
-irm https://raw.githubusercontent.com/databayt/codebase/main/.claude/scripts/install.ps1 | iex
+irm https://raw.githubusercontent.com/databayt/kun/main/.claude/scripts/install.ps1 | iex
 & "$env:USERPROFILE\.claude\scripts\secrets.ps1" -GistId 68453b25fa9d28c94426c55c179b3838
 
 # WebStorm + plugin (install plugin from the Marketplace inside WebStorm)
@@ -161,14 +113,36 @@ winget install JetBrains.WebStorm
 # Clone every active databayt repo
 & "$env:USERPROFILE\.claude\scripts\sync-repos.ps1"
 
+# Arm the daily heartbeat
+& "$env:USERPROFILE\.claude\scripts\maintain.ps1" -Install
+
 # Verify
-claude --version
-claude doctor
-Get-Command c
+& "$env:USERPROFILE\.claude\scripts\doctor.ps1"
 ```
 
 For hogwarts and other private secrets, your team contact shares the `.env` out-of-band.
 
+## When you're done
+
+Open a fresh PowerShell and run:
+
+```powershell
+doctor                       # all checks pass (or run from ~/.claude/scripts/doctor.ps1)
+claude --version             # CLI installed
+Get-Command c                # c function loaded from $PROFILE
+(Get-ChildItem ~\oss).Count  # org repos cloned (>= 9)
+```
+
+If `doctor` is green, open WebStorm in any cloned repo and press `Ctrl+Esc` to start a Claude session in the IDE.
+
+## If something fails
+
+- **Re-run the same paste.** Every step is idempotent — second run skips what's done.
+- **`doctor` is the single source of truth.** Output names exactly what's missing and how to fix it.
+- **`doctor -Fix`** repairs the trivially-fixable: missing `c` function in `$PROFILE`, `~/.claude/bin` not on PATH.
+- **OAuth aborted?** Re-paste; the script resumes at the OAuth step.
+- **Deeper failures?** [Onboarding reference](/docs/onboarding-reference) covers the orchestration model, the scripts contract, and the lessons from the first real run.
+
 ## Daily entry points
 
 | Action | How |
@@ -181,6 +155,7 @@ For hogwarts and other private secrets, your team contact shares the `.env` out-
 | Send a note to the team | `c "/dispatch <message>"` |
 | Open a GitHub issue | `c "/issue"` |
 | Verify a production deploy | `c "/watch"` |
+| Re-audit machine health | `doctor` |
 
 Full keyword list: [keywords](/docs/keywords).