Gate new onboarding behind an experiment

[SawyerHood]

Summary

• add a default-off newOnboarding experiment with persisted database support
• gate the onboarding flow and provider checks on the experiment
• expose the experiment through Settings and the bb CLI
• keep replay-onboarding useful by enabling the experiment before replay
• update generated contracts, guides, and migration rewind coverage

Tests

• type checks passed for app, CLI, database, desktop, domain, plugin SDK, server, and templates
• 47 focused tests passed across app, CLI, database, domain, and server

[SawyerHood]

🚨 SLOP COP 🚨 · review

I am SlopCop. I am reviewing this stack under the review rule.

The stack contains one pull request:

• Gate new onboarding behind an experiment #1108, Gate new onboarding behind an experiment.

I did not skip a pull request. I will run security, code quality, architecture, and performance checks in parallel. I will test #1108 once.

[SawyerHood]

🚨 SLOP COP 🚨 · review

Performance review complete.

I found no performance defect. The gate stops provider CLI checks when onboarding stays off. The database still uses one primary-key lookup on a one-row table.

[SawyerHood]

🚨 SLOP COP 🚨 · review

Security review complete.

I found no security defect. The PR adds one validated Boolean and no new route, capability, or trust boundary. The experiment does not cross the server and host daemon wire.

[SawyerHood]

🚨 slopcop/review — replay-onboarding hides an install-wide experiment change

This command now enables newOnboarding, but its human output only reports that onboarding will show. Its --json result returns only general settings. Please report both updated objects, or clearly state the experiment change. This keeps the command output consistent with its new side effect.

[SawyerHood]

🚨 SLOP COP 🚨 · review

Code and architecture review complete.

I found no correctness defect. The focused app, server, CLI, database, domain, and generated-file checks passed. I left one low-severity inline comment about hidden CLI output.

The architecture scan found no duplicate onboarding gate. It found repeated experiment key lists and unstable generated declaration order. These are separate maintenance refactors.

[SawyerHood]

🚨 SLOP COP 🚨 · review

End-to-end browser test complete on 4cbf64e.

With newOnboarding off and setup incomplete, the app showed no onboarding dialog. I enabled the experiment in Settings. The onboarding dialog opened and listed connected agents. I disabled the experiment through the server API. The live app closed the dialog and cleared the switch.

The test passed. I stopped the dev server.

[SawyerHood]

🚨 SLOP COP 🚨 · review

Review complete for the one-PR stack: #1108.

I found no blocking issue.

• Security: no new capability, route, trust boundary, or sensitive-data exposure.
• Code quality: no correctness defect. One low-severity inline comment asks the CLI to report its experiment change.
• Architecture: no duplicate onboarding gate. Repeated experiment key lists remain minor maintenance debt.
• Performance: no regression. The default-off gate removes provider CLI checks from normal startup.
• End-to-end: passed on 4cbf64e. The dialog stayed closed when disabled, opened after the Settings toggle, and closed after live disable.
• Validation: focused app, server, CLI, database, domain, migration, type, lint, and generated-file checks passed.

I used a comment-only review. I did not approve or request changes.