chore(repo): bootstrap public book engine

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Repository-wide stewardship. Required review remains a branch rule rather than
+# a CODEOWNERS-only rule so knowledgeable contributors can review one another.
+* @BenAlaa

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,63 @@
+name: Book engine bug
+description: Report a reproducible problem in navigation, rendering, interaction, search, accessibility, or build behavior.
+title: "fix(engine): "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: Use the source-correction form for an inaccurate architectural claim and the upstream tracker for a T3 Code product bug.
+  - type: input
+    id: page
+    attributes:
+      label: Page or route
+      placeholder: /runtime-topologies/
+    validations:
+      required: true
+  - type: textarea
+    id: observed
+    attributes:
+      label: Observed behavior
+      description: Explain what happened and include the exact error when available.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction
+      description: Give the shortest reliable sequence, including diagram controls or keyboard input when relevant.
+      placeholder: |
+        1. Open …
+        2. Select …
+        3. Observe …
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: Browser and version, operating system, input method, and deployed or local build.
+      placeholder: Firefox 145, macOS, trackpad, GitHub Pages
+    validations:
+      required: true
+  - type: textarea
+    id: accessibility
+    attributes:
+      label: Accessibility or reduced-motion impact
+      description: Note keyboard, screen-reader, focus, contrast, motion, zoom, or print impact if relevant.
+    validations:
+      required: false
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Report checks
+      options:
+        - label: This is a T3 Code Decoded book/engine issue, not an upstream T3 Code product issue.
+          required: true
+        - label: I checked for an existing report.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Upstream T3 Code support
+    url: https://github.com/pingdotgg/t3code/issues
+    about: Report T3 Code product bugs to the upstream project, not this study guide.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,42 @@
+name: Book or engine proposal
+description: Propose a chapter, visualization, simulator, accessibility, or engine improvement.
+title: "feat(book): "
+labels: [proposal]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Reader problem
+      description: What is currently difficult to understand or use?
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Proposed outcome
+      description: Describe the chapter, figure, lab, or engine behavior—not only an implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: sources
+    attributes:
+      label: Likely source anchors
+      description: List relevant T3 Code paths or this repository's engine files.
+    validations:
+      required: false
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives and scope
+      description: What smaller explanation or existing component could solve it?
+    validations:
+      required: false
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Proposal checks
+      options:
+        - label: I checked BOOK_PLAN.md for an existing chapter or planned artifact.
+          required: true
+        - label: This is about the study guide, not an upstream T3 Code product bug.
+          required: true

.github/ISSUE_TEMPLATE/source-correction.yml

@@ -0,0 +1,49 @@
+name: Source correction
+description: Report a factual, source-link, or evidence-class problem in the book.
+title: "fix(book): "
+labels: [source-correction]
+body:
+  - type: markdown
+    attributes:
+      value: Thank you for helping keep the book grounded. Please cite the pinned source when possible.
+  - type: input
+    id: chapter
+    attributes:
+      label: Chapter or page
+      placeholder: Chapter 10 · Events, receipts, and idempotency
+    validations:
+      required: true
+  - type: textarea
+    id: current
+    attributes:
+      label: Current claim
+      description: Quote or summarize the claim that needs correction.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Source evidence
+      description: Add repository paths, line ranges, tests, or immutable links.
+      placeholder: apps/server/src/...:120-150
+    validations:
+      required: true
+  - type: dropdown
+    id: classification
+    attributes:
+      label: Suspected problem
+      options:
+        - Incorrect verified behavior
+        - Documented intent presented as behavior
+        - Inference not labeled
+        - Future or latent capability presented as shipped
+        - Stale or broken source reference
+        - Other evidence problem
+    validations:
+      required: true
+  - type: textarea
+    id: correction
+    attributes:
+      label: Suggested correction
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,36 @@
+## Outcome
+
+<!-- What will a reader or contributor be able to understand/do after this change? -->
+
+## Scope
+
+<!-- List the chapters, engine areas, or repository policies changed. -->
+
+### Non-goals
+
+<!-- State nearby work intentionally left out. -->
+
+## Evidence
+
+- Canonical source lock: `sources/t3code.lock.json` (read and verified by CI)
+- Primary anchors:
+  - <!-- path:start-end -->
+- Claim class notes: <!-- verified / documented intent / inference / future -->
+- Discrepancies or uncertainty: <!-- None, or explain -->
+
+## Visuals and interaction
+
+<!-- Figures/labs added or changed; keyboard, reduced-motion, responsive, and print notes. -->
+
+## Validation
+
+- [ ] `npm test`
+- [ ] `npm run build`
+- [ ] `npm run source:check` when source excerpts changed
+- [ ] Internal routes, source links, and headings checked
+- [ ] Claims reviewed at the pinned revision
+- [ ] Accessibility and static print state checked for changed visuals
+
+## Review focus
+
+<!-- Name the riskiest assumptions, source mappings, or design choices. -->

.github/REPOSITORY_SETUP.md

@@ -0,0 +1,151 @@
+# Public repository launch runbook
+
+This is the owner checklist for publishing T3 Code Decoded. It deliberately keeps
+repository creation, policy activation, branch publication, and Pages deployment
+as separate checkpoints. Completing one checkpoint does not authorize the next.
+
+## Fixed decisions
+
+- Owner: personal GitHub account [`BenAlaa`](https://github.com/BenAlaa), never the
+  EasyGenerator organization.
+- Visibility: public.
+- Repository and Pages project name: `t3code-decoded`.
+- Default branch: `main`; do not create or retain `master`.
+- Authored changes: pull requests only. Never push project commits directly to
+  `main`.
+- Merge method: rebase merge, preserving the fine-grained Conventional Commits.
+- Solo-owner escape hatch: `BenAlaa` may bypass rules **for pull requests only**.
+  The bypass may merge an existing owner PR; it must not become a direct-push path.
+- Pages source: a GitHub Actions artifact, never a committed `dist/` branch.
+
+## 1. Local preflight
+
+- [ ] `git status` contains only the intended milestone.
+- [ ] `npm ci` succeeds from the lockfile.
+- [ ] `npm run source:check` succeeds against the locked T3 Code checkout.
+- [ ] `npm test` succeeds.
+- [ ] `npm run build` succeeds with `/`.
+- [ ] `BASE_PATH=/t3code-decoded/ SITE_URL=https://benalaa.github.io npm run build`
+      succeeds.
+- [ ] Every local commit that will be replayed follows Conventional Commits.
+- [ ] The GitHub CLI or browser session is visibly authenticated as `BenAlaa`.
+
+## 2. Create the inert public remote
+
+Create `BenAlaa/t3code-decoded` as public with GitHub's generated README. That one
+placeholder commit establishes remote `main`; do not initialize another license or
+`.gitignore`, and do not push the local repository during creation.
+
+- [ ] Confirm the owner is exactly `BenAlaa` and visibility is **Public**.
+- [ ] Confirm the default branch is `main` and no `master` branch exists.
+- [ ] Add the description, Pages URL, and topics such as `t3code`, `architecture`,
+      `astro`, `effect`, `reverse-engineering`, and `interactive-book`.
+- [ ] Add the remote locally and fetch the placeholder branch read-only.
+
+## 3. Protect `main` before publishing authored work
+
+In **Settings → Rules → Rulesets**, create an active branch ruleset named
+`protected-main` targeting the default branch.
+
+Bypass list:
+
+- [ ] Add the `BenAlaa` user actor.
+- [ ] Change its bypass mode from **Always allow** to **For pull requests only**.
+- [ ] Do not grant the bypass to write/maintain roles or automation generally.
+
+Rules:
+
+- [ ] Restrict deletions.
+- [ ] Require a pull request before merging.
+- [ ] Require one approving review.
+- [ ] Dismiss stale approvals when new commits are pushed.
+- [ ] Require review from Code Owners.
+- [ ] Require approval of the most recent reviewable push.
+- [ ] Require all review conversations to be resolved.
+- [ ] Require linear history.
+- [ ] Block force pushes.
+
+Repository merge settings:
+
+- [ ] Enable **rebase merging**.
+- [ ] Disable merge commits and squash merging so reviewed fine-grained commits
+      survive on `main`.
+- [ ] Automatically delete head branches after merge.
+
+The first publication PR introduces the workflows, so the status-check contexts do
+not exist when the initial ruleset is created. Open that PR, wait for both checks to
+run, then edit the ruleset before merging:
+
+- [ ] Require `Validate and build`.
+- [ ] Require `Conventional changes`.
+- [ ] Require branches to be up to date before merging.
+- [ ] Verify the ruleset is **Active**, then inspect Rule Insights after the first
+      owner bypass.
+
+## 4. Replay the local milestones through PR branches
+
+The local history and GitHub placeholder have unrelated roots. Do not merge those
+roots and do not force the local branch onto remote `main`. For each publication
+milestone, create a clean branch from the latest `origin/main`, then cherry-pick
+the already-reviewed local commits in their original order.
+
+Recommended PR sequence:
+
+1. `bootstrap/initial-edition` — book engine, source pipeline, front matter,
+   Chapters 1–4, and the public governance/CI foundation. The opening maps link
+   into Part I, so this is the smallest complete milestone that passes the
+   built-site link gate;
+2. `docs/part-02-boot-connect` — Chapters 5–8 and their evidence;
+3. one branch and PR per later coherent part or review milestone.
+
+For every branch:
+
+- [ ] Branch from the latest protected remote `main`.
+- [ ] Replay only the intended fine-grained commits; resolve no unrelated changes.
+- [ ] Run the full local preflight again.
+- [ ] Push the named feature/docs/chore branch, never `main`.
+- [ ] Use a Conventional Commit title for the PR and complete every template
+      section with outcome, scope, evidence, validation, and review focus.
+- [ ] Review the Files changed and commit list as `BenAlaa`.
+- [ ] Resolve conversations and wait for required checks.
+- [ ] For owner-authored PRs, choose the explicit ruleset bypass in the merge box;
+      do not disable or edit protection merely to self-merge.
+- [ ] Rebase-merge, verify `main`, and delete the remote head branch.
+
+## 5. Configure GitHub Pages
+
+After the CI foundation reaches `main`:
+
+- [ ] In **Settings → Pages**, select **GitHub Actions** as the source.
+- [ ] Keep the `github-pages` environment restricted to deployments from `main`.
+- [ ] Confirm the Pages workflow build job has only `contents: read` and the deploy
+      job alone has `pages: write` plus `id-token: write`.
+- [ ] Confirm every external action is pinned to an immutable full commit SHA.
+- [ ] Confirm Pages checks out the T3 revision read from
+      `sources/t3code.lock.json` and runs `npm run source:check` before upload.
+- [ ] Verify canonical URLs, assets, search, favicon, internal links, diagrams, and
+      expanded zoom/pan at `https://benalaa.github.io/t3code-decoded/`.
+
+## 6. Community and security settings
+
+- [ ] Enable Issues and preserve the bug, source-correction, and proposal forms.
+- [ ] Create labels `bug`, `proposal`, `source-correction`, `accessibility`,
+      `documentation`, `engine`, and `dependencies`.
+- [ ] Enable the dependency graph, Dependabot alerts, and Dependabot security
+      updates.
+- [ ] Enable private vulnerability reporting so the link in `SECURITY.md` works.
+- [ ] Confirm `CODEOWNERS` resolves `@BenAlaa` and the PR template loads.
+- [ ] Confirm the repository displays the mixed-license notice and upstream T3
+      Code attribution.
+
+## 7. Launch evidence
+
+Record the final URLs or screenshots in the launch PR:
+
+- [ ] public repository;
+- [ ] active `protected-main` ruleset and pull-request-only bypass;
+- [ ] required checks on a real PR;
+- [ ] successful Pages deployment;
+- [ ] live book route and search result;
+- [ ] private vulnerability reporting enabled;
+- [ ] no `master`, no published `dist/`, and no authored direct commit to `main`.

.github/dependabot.yml

@@ -0,0 +1,27 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      astro-book-engine:
+        patterns:
+          - astro
+          - "@astrojs/*"
+      search-and-diagrams:
+        patterns:
+          - pagefind
+          - mermaid
+    commit-message:
+      prefix: chore
+      include: scope
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    commit-message:
+      prefix: chore
+      include: scope