docs(quickstart): re-transcribe both boot samples against CLI 17.2.0

[claude]

Fixes #141

Both documented paths re-booted on @objectstack/cli 17.2.0 (published 2026-08-23T07:01:18.191Z), captured separately under a pty, and each raw capture diffed against its published block. Path B's banner was not assembled from Path A's — they are two independent captures, and the diffs below are machine-produced, not reasoned.

Headline: neither published block was stale

Every line both blocks publish still appears verbatim in a 17.2.0 boot. The mechanical check, run against the edited file:

PATH A: lines published but NOT in the 17.2.0 capture  ->  count=0
PATH B: lines published but NOT in the 17.2.0 capture  ->  count=0

So this is not a rewrite. What changed is what 17.2.0 prints around the published blocks, plus two pins.

Item-by-item, against the card's re-arm record

1. Both blocks re-transcribed (independent captures).

Path A boots identically at 17.2.0. Two pristine boots (home moved aside between them) were byte-identical apart from timestamps inside the omitted diagnostics block. Config: is still absent from Path A — still suppressed, not removed.

Path B reproduces too, except the compile timing, which is per-machine; it now carries this round's measured value.

2. Port behaviour re-verified — no drift. Alone, the dev server binds 3000. With os start already holding 3000:

  ➜  API:       http://localhost:3001/
  ↪ server bound to port 3001 (requested 3000)

Byte-exact against the sentence the page publishes. Controlled both ways: the literal appears exactly once in the contended capture and zero times in the uncontended one, so the match is a live probe rather than a string that is always present. The page and reference/cli.mdx agree on 3000; my measurement agrees with both.

3. Both pins 17.1.0 to 17.2.0 (Path A and Path B declaration sentences). Path B's scaffold pins caret ranges, and both the creating CLI and the resolved runtime were 17.2.0.

4. Declaration sentences re-checked by diffing, not by reasoning. Three omissions were unnamed. To tell genuine 17.2.0 drift from pre-existing under-declaration, I booted both paths again on 17.1.0 as a version control — for Path B that meant a second scaffold with dependencies pinned to exact 17.1.0, since the caret ranges otherwise resolve to 17.2.0.

Unnamed omission	17.1.0 control	Verdict	Fix
Path B UI: 0 Apps / Logic: 0 Flows / Security: 0 Positions 0 Permissions	absent	new at 17.2.0	published in the block
Path B Boot diagnostics block	absent	new at 17.2.0	declared as omitted
Path A No objectstack.config.ts or artifact found	present	pre-existing under-declaration, not drift	declared as omitted

The one judgment call, flagged for review

The three new Path B counters are published rather than declared, while the new diagnostics block is declared. The rule I applied is the one Path A already sets: keep a summary group whole, omit only its long continuation line. Path A publishes all four of Mode/Driver/Tenancy/Plugins and omits the plugin-name continuation; Path B was publishing one member of a four-line counter group, which leaves a hole in the middle of a summary a reader sees intact on their own screen.

The alternative — leave the block at one counter and add "three further compile-summary counters" to the declaration sentence — is equally correct and three lines shorter. Happy to switch if you prefer the tighter block.

Verification

Gate union re-run on the final commit ba72d38, tree clean against it. Exit codes captured before any pipe; verdicts are each gate's own printed line.

Gate	Exit	Verdict
pnpm turbo run build test type-check --force --continue	0	Tasks: 3 successful, 3 total (lock VERDICT command-exit 0)
check-locale-surface.mjs	0	every advertised URL has a source file and every source file is advertised
check-node-floor.mjs	0	every declared floor clears what the dependency tree requires
check-translations.mjs	0	translations gate passed
check-translation-ownership.mjs --actor ... --files ...	0	0 translation artifacts, 1 other file
check-translation-output.mjs --self-test	0	29 rule cases, every rule demonstrated able to fail
check-translation-output.mjs --files ...	0	passed (139 pre-existing findings, none mine)

Heavy runs went through the shared verify lock. Every server started was killed by explicit PID resolved through /proc, never by name — siblings were running in this container — and ports 3000/3001 were confirmed free after teardown.

Scope

content/docs/quickstart.mdx only. reference/cli.mdx untouched. No locale sibling touched — all seven remain the translation pass's input. Item 3 of the original card stays discharged: 0 hits for a Warning blockquote and 0 for security-owd-unset, with a control confirming another > ** blockquote is still present, so the zero is absence and not a dead probe. No new caveat appeared in 17.2.0's output.

The seeded dev credential and its dev-only caveat are byte-identical at 17.1.0, at 17.2.0, and on the page. Transcribed faithfully, not altered; the standing exposure question is unchanged by this PR.

---

Generated by Claude Code