docs(quickstart): re-transcribe both boot samples against CLI 17.5.0

[objectstack-fleet]

Part of #141

This PR re-transcribes both quickstart boot samples against @objectstack/cli 17.5.0, published 2026-09-29T07:58:57Z, and moves both pins from 17.4.0. Each difference is classified against a date-resolved 17.4.0 control. The diff is one file: content/docs/quickstart.mdx.

Step 0: the 17.4.0 control, resolved as of a date and validated

• Install. The tree was installed with npm install @objectstack/cli@17.4.0 --before=2026-09-09T05:00:00.000Z.
  • The last 17.4.0 package (@objectstack/mcp) published at 2026-09-09T04:02:12Z.
  • No @objectstack package published any version between then and 17.5.0.
  • The Path B control scaffold ran os init my-app -t app --install with npm_config_before set to the same timestamp.
• Read-back.
  • CLI tree: 54 of 54 @objectstack names at 17.4.0, better-auth 1.7.2.
  • Control scaffold: 54 of 54 at 17.4.0, better-auth 1.7.2.
  • The 17.5.0 trees: 53 of 53 at 17.5.0, better-auth 1.7.3.
• Why --before is needed. A lockfile for @objectstack/cli@17.4.0 without --before resolves 48 of its 152 @objectstack copies at 17.5.0, so it would be a second copy of the experiment.
• Validation against the blocks on main (2e6f0e6).
  • Control Path A: 0 published-but-absent and 0 order violations, in 2 of 2 boots.
  • Control Path B: 0 order violations. Its only absent line is the declared machine-variable Build complete timing.

What differed at 17.5.0

Item	17.5.0	17.4.0 control	Reading	Page change
Path A Plugins:	31 loaded (3 of 3)	30 (2 of 2)	new: PackageServicePlugin added	30 to 31
Path B Plugins:	36 loaded (10 of 10)	30 (5 of 5)	new	30 to 36
Path B artifact size	1.9 KB (10 of 10)	1.8 KB (5 of 5)	new	1.8 KB to 1.9 KB
Path B Build complete	125 to 177ms	75 to 120ms	declared machine-variable	97ms to 175ms, re-transcribed from the transcription capture
Path B dev-admin group	three new continuation lines, the platform-admin caveat (10 of 10)	absent (5 of 5)	new	published whole, per the group rule
_objectstack_sequences DATABASE_ERROR	0 (A 3 of 3, B 10 of 10)	A 1 per boot, B 2 per boot	gone	removed from both declarations
sys_oauth_resource Insert operation failed	0 (A 3 of 3, B 10 of 10)	1 per boot on both paths	gone	removed from both declarations
Paged read of 'sys_migration' is NOT deterministic warning, plus a DATABASE_ERROR for a missing sys_migration table	1 of each per boot (A 3 of 3, B 10 of 10)	0	new	named in both declarations
Path B boot diagnostics	2 warnings (10 of 10)	none (5 of 5)	new	named in Path B's declaration
Path A boot diagnostics	3 warnings	1 warning	new count	none: already named
Path B MCP trailer	inside the banner in 10 of 10, interleaved line by line in 8 of 10, after Press Ctrl+C to stop in 0 of 10	after it in 3 of 5, inside in 2 of 5	race outcome shifted	reworded to "usually lands inside the banner, often interleaved line by line with it"

On the expected removals: both SQL-driver error lines are gone at 17.5.0, and the control prints them, so their removal is new at 17.5.0. In their place, 17.5.0 logs the new sys_migration warning and error on both paths. Health and ready both answer 200 throughout, so "neither of which stops the server" is measured.

The five items

1. Both blocks, as independent captures.
   • Path A: 3 fresh boots, each with a pristine HOME and cwd. They are byte-identical after normalising timestamps and paths.
   • Path B: 2 fresh scaffolds plus 8 repeat boots, with state reset between them. The transcription source is the first fresh scaffold's boot.
   • Path B's banner is not assembled from Path A's.
2. Port behaviour: no drift.
   • Uncontended, server bound to port appears 0 times in 10 of 10 boots, and the API binds 3000.
   • Contended, a real os start holds 3000 (health 200 before and after). The literal ↪ server bound to port 3001 (requested 3000) appears exactly once, and the API binds 3001 with health 200.
   • The 17.4.0 control gives the same result both ways. The sentence is unchanged.
3. Pins. Both pins move from 17.4.0 to 17.5.0. The file has 2 occurrences of 17.5.0 and 0 of 17.4.0.
4. Declarations, checked by diff. After the edit, every non-blank capture line outside each block is named.
   • Path A, 12 of 12:
     • the no-config line
     • storage
     • 2 crypto lines
     • the sys_migration warning and error
     • plugin names
     • 5 boot-diagnostics lines
   • Path B, 27 of 27:
     • 2 pnpm header lines
     • 10 compile-progress lines
     • configuration load
     • 2 crypto lines
     • the sys_migration warning and error
     • 5 trailer lines
     • plugin names
     • 4 boot-diagnostics lines
   • Server stopped and ELIFECYCLE appear only after the signal, so they are excluded.
5. Sequence. There are 0 order violations on Path A (3 of 3 boots) and on Path B (10 of 10 boots plus the contended boot).

Standing checks

• Item 3 of the original card stays discharged. There are 0 > **Warning blockquotes. The live control is the > **Hand-coding blockquote at :108.
• Seeded dev credential. 🔑 Dev admin: admin@objectos.ai / admin123 and seeded on empty DB · dev only — do not use in production are byte-identical at 17.4.0, at 17.5.0 and on the page.
  • Flagged: at 17.5.0 the same group gains three continuation lines that start platform admin — Setup, Studio and every record. They appear in 10 of 10 boots and 0 of 5 control boots.
  • They are published whole, unaltered, under the settled group-completeness convention. Declaring them as omitted instead is a one-line change.
• Scope. reference/cli.mdx and the locale siblings are untouched.

Gates, on 0d7a234 (porcelain 0)

Gate	Exit	Verdict
verify lock: pnpm turbo run build --force --concurrency=2	0	Tasks: 1 successful, 1 total, Cached: 0 cached, 1 total
verify lock: pnpm turbo run test --force --concurrency=2	0	Tasks: 1 successful, 1 total, Cached: 0 cached, 1 total
verify lock: pnpm turbo run type-check --force --continue --concurrency=2	0	Tasks: 1 successful, 1 total, Cached: 0 cached, 1 total
check-locale-surface.mjs	0	✓ every advertised URL has a source file and every source file is advertised
check-translations.mjs	0	✓ translations gate passed
check-translation-ownership.mjs, using the workflow's --actor and --files flags	0	This PR touches 0 translation artifact(s) and 1 other file(s).
check-translation-output.mjs --self-test	0	✓ self-test: 29 rule case(s), 9 split case(s) and 5 derived-locale case(s)
check-translation-output.mjs --files	0	✓ translation output gate passed (145 pre-existing finding(s) reported)
check-node-floor.mjs and its --self-test	0 / 0	✅ Every declared floor clears what the dependency tree requires
check-half-states.mjs --self-test	0	✓ check-half-states self-test: 1551 cases pass.
gen-zh-hant.mjs --check	0	✓ zh-Hant: 73 generated file(s) match the zh-Hans sources byte for byte.

The built page en/docs/quickstart.html carries Plugins: 31 loaded, Plugins: 36 loaded, Build complete (175ms) and the inline code for the new warning. It has 0 occurrences of _objectstack_sequences and 0 of sys_oauth_resource.

Acceptance notes

• Not edited (outside this card's five items): "What's loaded out of the box". That list names exactly the 30 plugins of a 17.4.0 Path A boot. At 17.5.0 it no longer covers either path:
  • Path A additionally loads PackageServicePlugin.
  • Path B additionally loads PackageServicePlugin, AutomationServicePlugin, ApiTriggerPlugin, RecordChangeTriggerPlugin, ScheduleTriggerPlugin and TimeRelativeTriggerPlugin.
  • This is reported to the seat rather than folded into this PR.
• Upstream observation, reported to the seat and not filed. A first boot of 17.5.0 logs DATABASE_ERROR for select * from sys_migration where id = 'adr-0104-file-references', with no such table: sys_migration.
  • It happens on both paths, in every fresh boot.
  • On a second boot of the same home the error is absent, but the paged-read warning still prints.
  • The fix would land in objectstack, not here.

Method notes

• The CLI ran from isolated npm --prefix trees, not from npm i -g or npx.
• Each boot ran under a pty with its own fresh HOME and was stopped with Ctrl+C through the tty. Leftover processes were killed by PID resolved through /proc.
• Port claims are curl probes.
• Installs, scaffolds and turbo runs went through the shared verify lock. The CLI boots ran outside it.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0d7a234a847e0223832bc218665bb6243beee496
Local-runs: none

PR #288 on card #141, one file, content/docs/quickstart.mdx, +17/−14, against base main @ 2e6f0e6 (the branch was restarted from that tip, per claim 5925774509, so the PR diff is the net diff against main). Check-runs on the head, each read by its own conclusion: build success, Node floor success, Ownership & freshness success, Deploy docs skipped (gated to a push on main, so skipped is the correct answer on a PR event). The dev report (5926180364) was read as the dev's account; every judgment below is checked against the diff and the card's rulings, not taken from it.

① Derived judgments

Accept-set changes: none. The diff touches no gate, script, workflow, schema, lockfile or config, so the accept-set of every gate on this head is what it was on main. Ownership & freshness fired because the path is under content/docs/, exactly as its filter says (ruling 5540309205).

Public-surface changes, all on the en quickstart page (the locale siblings are untouched, which the standing scope ruling requires), each one judged:

1. Path A block, Plugins: 30 loaded to 31 loaded: RIGHT. 31 in 3 of 3 boots at 17.5.0, 30 in 2 of 2 boots of the date-resolved 17.4.0 control, so the change belongs to 17.5.0 (PackageServicePlugin), not to the capture.
2. Path A pin, 17.4.0 to 17.5.0: RIGHT. Standing item 3.
3. Path A declaration, the _objectstack_sequences and sys_oauth_resource error sentences removed and the sys_migration paged-read warning plus DATABASE_ERROR named instead: RIGHT. The 17.4.0 re-arm (5808924282) said to expect both lines to leave, to measure rather than assume, and to remove the sentences when they do. Measured: 0 of each at 17.5.0 (A 3 of 3, B 10 of 10, contended 1 of 1) against 1 and 1 per boot in the control. The two new lines print once per fresh boot on both paths and 0 times in the control, so they are 17.5.0's. "Neither of which stops the server" is backed by health and ready 200 in every boot, not asserted.
4. Path B Build complete (97ms) to (175ms): RIGHT. A declared machine-variable ([finding] quickstart Path B publishes a machine-variable compile timing as a literal #249, docs(quickstart): declare the Path B compile timing as machine-variable #260), and the 17.3.0 ruling (5540309205) is that once the pin moves the number must come from a boot of that version. Re-transcribed from the fresh-scaffold capture, not carried over, not averaged.
5. Path B Artifact … (1.8 KB) to (1.9 KB): RIGHT. 1.9 in every 17.5.0 boot, 1.8 in every control boot.
6. Path B dev-admin group gains the three platform admin — … continuation lines, published whole: RIGHT, and it is the one reviewer's-choice item on this diff (answered under ③). Present in 11 of 11 boots at 17.5.0 and 0 of 6 in the control. The credential line and its dev only caveat are byte-identical at both versions and on the page, which is what the standing ruling (5462968550: transcribe, never redact or alter, flag any change) requires, and the change was flagged.
7. Path B block, Plugins: 30 loaded to 36 loaded: RIGHT. 36 in every 17.5.0 boot, 30 in every control boot; the six added names are listed in the report.
8. Path B pin, 17.4.0 to 17.5.0: RIGHT. The 17.4.0 re-arm verified exactly two 17.4.0 occurrences on main after docs(quickstart): re-transcribe both boot samples against CLI 17.4.0 #286; both are in this diff, so the file now carries 0 of 17.4.0 and 2 of 17.5.0.
9. Path B declaration adds boot diagnostics: RIGHT. Dropped at 17.4.0 because Path B printed none; now 2 warnings in every 17.5.0 boot and 0 in the control.
10. Path B MCP-trailer sentence, from "usually follows Press Ctrl+C to stop but can land inside the banner" to "usually lands inside the banner, often interleaved line by line with it": RIGHT. The 17.4.0 rulings (5808791302, 5808924282) require a frequency word and a count, never one capture. Counted: inside the banner 10 of 10 (interleaved 8 of 10), after the stop line 0 of 10; control 3 of 5 after, 2 of 5 inside. Framed as a race outcome, not as a release change, which is the correct reading of two processes writing one terminal. The hedge "usually" at 10 of 10 is conservative, and right, because the control shows the other outcome at the same round.
11. Path B declaration, SQL-driver sentences replaced as on Path A: RIGHT, same evidence as judgment 3.
12. Unchanged, and verified unchanged by the diff: the port sentence (contended literal count 1, uncontended 0, at both versions, API on 3001 under contention); the No objectstack.config.ts or artifact found declaration; the two blocks remain independent captures (the Config: row is on Path B only, Mode: differs). No Warning blockquote is added anywhere in the diff, so original item 3 stays discharged (0 hits with a live control at :108). RIGHT.

Method, as the card prescribes it. Step 0 control resolved as of a date (54 of 54 at 17.4.0, better-auth 1.7.2) and validated against the blocks on main: Path A 0 absent and 0 order violations in 2 of 2, Path B 0 order violations with only the declared timing absent. Declarations checked by diff, not by reasoning: Path A 12 of 12 omitted lines named, Path B 27 of 27, 0 unnamed. Sequence: 0 order violations on both paths, contended boot included. Each of the twelve judgments above rests on that control; none would be classifiable without it.

② Semver level

No changeset flow exists in this repo (rulings 5463128604, 5540309205, 5808791302). The diff publishes a docs page and no package, so the level is none, and no changeset file or skip-changeset marker is expected or present: the file list is one .mdx, nothing under .changeset/. Clause-②: no on the claim comment (5925774509) matches what the diff publishes. The same claim records that content/docs/** is a contract-review face whatever the Clause-② line says, which is why this record exists.

③ Boundary flags

open_questions is empty; nothing to answer there. The PR body's Flagged item, its two acceptance notes, the report's eight deviations and its two out-of-scope findings, each answered or escalated:

• Flagged: the three dev-admin continuation lines, published whole or declared omitted. ANSWERED: publish, as the diff does. The page's omission rule is group completeness, settled twice (Q1 at 17.2.0, the reviewer's choice at 17.3.0). The only continuation the page omits is the plugin-name list, and it omits that because it is environment-dependent; these three lines are deterministic (11 of 11) and they are the caveat a reader needs before the "Add your own object" section has them sign in. Declaring them omitted would hide the one line of boot output that changes what the reader does next.
• Acceptance note and out-of-scope finding 2: the "What's loaded out of the box" list at :280 names 30 plugins and says either path gives them automatically; at 17.5.0 Path A loads 31 and Path B 36. ESCALATED to the seat; not a defect of this diff. The list is outside the five items and the diff does not touch it. Before the merge it was equally stale against the CLI a reader installs today, so the merge does not make it worse, and the four blocks and sentences this diff corrects are more wrong without the merge than the list is with it. But once this lands the page is visibly self-inconsistent (31 loaded and 36 loaded above a 30-name list), and that list is exactly the class of prose this card exists to watch. The seat's re-arm must add it as a standing item, and the refresh should be dispatched on this trigger, not the next one: the names are already measured this round (A adds PackageServicePlugin; B adds that plus AutomationServicePlugin, ApiTriggerPlugin, RecordChangeTriggerPlugin, ScheduleTriggerPlugin, TimeRelativeTriggerPlugin). How to present a set that now differs by path is a content decision for the seat, which is why it is escalated rather than folded into this PR.
• Out-of-scope finding 1: the sys_migration DATABASE_ERROR on every clean first boot at 17.5.0, fix in objectstack. ESCALATED to the seat for upstream filing, with a dedupe search first, as this seat did for objectstack#13256 at 17.2.0 and as the 17.4.0 round did for #17175 and #17176. The report records no upstream search this round, so the seat's filing starts with one. The re-arm should name this line as the first thing to check at the next trigger, in the shape the 17.4.0 re-arm used for the two lines that have now left.
• Deviation 1 (empty write-route push before the first real commit; dev contract vs dispatch wording). ANSWERED: no effect on the diff; the PR carries one commit. Aligning the dispatch wording with the contract is the seat's housekeeping.
• Deviations 2, 3, 4 and 6 (isolated npm --prefix trees instead of a global install; pty with a fresh HOME and stripped tokens; repeat boots on reset scaffolds with the transcription from a fresh one; boots outside the verify lock). ANSWERED: the method this card's rulings accepted at 17.3.0 and 17.4.0; versions were read back from every tree and 0 processes were alive after each boot.
• Deviation 5 (no CPU burners this round). ANSWERED: fine, and it matters for judgment 10: the trailer counts at both versions come from an idle container, so the shift from 3 of 5 after the banner to 0 of 10 is not a load artefact.
• Deviation 7 (extra gates run). ANSWERED: all exit 0; they add nothing the head's check-runs did not already answer.
• Deviation 8 (commit trailer carries no card reference). ANSWERED: correct. The PR body's Part of #141 carries the link and keeps the closing-keyword trap away from the card number, as the 17.3.0 ruling requires.

Implemented-by: claude/pm-dispatch-objectos-ju9td1
Reviewed-by: session_01FeA1nwBz1ohH65dvffUGKr

VERDICT: PASS

---

Generated by Claude Code