[atyrode]

What

A short tutorial for Code, offered once per person and replayable from More.

• Offer: on a person's first open (any workspace, any device), the question dialog asks "Welcome to Code" with Take the tour and Skip (Esc and the backdrop skip). It opens only on the generator at rest (profile shown, no sheet, nothing running, no charge waiting, no other question), and once open it stands until answered. Agents and services are never offered it.
• Record: new personal doors readTutorial / seeTutorial on the root plugin, kept per person exactly like the model checks (tutorial/<person>, bound to the principal, compare-and-set so the first record stands). A sign-in that keeps no record (agent, service, confined or ceiling token) reads and marks keeps: false, and the panel keeps it in the browser instead. keeperOf, personOf and bound move unchanged from checks.ts to person.ts, shared by both.
• Walk: ten steps over the real controls (rows, readout, Defaults and Revert, routing, usage, machine, launch, Accounts, Sessions, More). Each draws a thin ring around its control and a card beside it, both laid over the panel so nothing moves, kept to the visible part of the panel, hidden while a popover is open, and following panes as they slide or resize. The card says what the control is, "N of M", and offers Next/Done, Back and Skip; →, ←, Esc; a held key steps once. Each step's card is its own, so focus moves to its Next and it is read out.
• Trying: choosing a word, or opening Accounts, goes on by itself; Back onto a step another view hides brings the generator back. The walk launches and spends nothing.
• End: Done, Skip or Esc records it and puts focus on More (so a second Enter of a double press opens the menu instead of launching).
• More gains Tutorial; Shortcuts gains a Tutorial group.

Verification

• Unit tests: per-person record (first record stands; another person, agents, confined and ceiling tokens; a record naming another principal is refused), the walk's order, bounds and count, the offer's way out never starting the tour.
• Real-browser verifier: every existing scenario starts from a person who has seen it; a dedicated scenario proves the offer, Skip and Esc recording it once per person, the walk (count, ring at rest, card in view, focus, keys, tries, Back across views), replay from More, and no layout shift across widths.
• Checked in Chromium on a disposable lab server at 1280, 360 and 170 px.

Closes #280

[atyrode]

Head-specific evidence for eb71b02f1e9860873e82af445796bbba3025b194:

• scripts/gate.sh (Bun 1.4.2, two CPUs, exact Manifold 82605419ea9a67198d9ea0dae1257a8fd812ecd8 and OMP pins): exit 0. 462 unit tests pass; type check clean; four bundles packed; disposable native composition; real-browser verifier PASS (531s), including the dedicated tutorial scenario and every other scenario running as people who have seen it.
• Independent review: ## Verdict: pass (eb71b02f1e) after three rounds (server record and keeper rules, offer gating, walk state machine, focus, placement across views and pane slides, popovers, reduced motion, coarse pointer, verifier coverage and flakiness).
• Real surface checked in Chromium on a disposable lab server: offer with focus on its title; Take the tour by keyboard; a tried word going on; Accounts opened going on; Back across views with the ring at rest on the launch after the generator slides back; Esc ending with focus on More; 1280, 360 and 170 px.

Residual, not covered by tests: the browser fallback for a sign-in that keeps no record, the offer waiting while a step runs or another question is open, and a replay ended before the record is read.