v2.3.1

A Fettler release: the guardrail closes a route it had been leaving open, the
two verbs that configure a machine can now run on a machine that has not been
configured yet, and the documentation gains a quick start.

Changed

• fettle setup now denies the shell as well as the built-in file tools.
  The list it writes went from six entries to eight: Bash and PowerShell
  join Read, Write, Edit, NotebookEdit, Grep and Glob.

  A shell is a complete route round the boundary, and not a second-order one ΓÇö
  node x.js writes anything anywhere and is not a writing command at all,
  so no blocklist of commands could ever close it. Denying the two tool names
  is as short, closed and platform-identical as denying the other six; it is
  the commands behind them that never close, and those are yours to name.

  This stops your build and test commands the first time you run it. That
  is the deny working, and the point at which you decide what to let through.
  Allow back only what the project needs ΓÇö "allow": ["Bash(git status:*)"] ΓÇö
  or better, declare them as tasks in .fettler.json, which run inside the
  boundary. Never allow a command that writes files.
  The exclusion list
  has the reasoning and both recipes.

• doctor check 2.8 covers all eight names. A project with the six file
  tools denied and the shell wide open used to report a clean bill of health ΓÇö
  not because that was judged safe, but because nothing looked. It is now a
  finding, and doctor exits 1 rather than 0.

• doctor check B.17 exempts a narrowed shell allow. allow: Bash(git status:*) beside deny: Bash is exactly the shape setup now asks for, and
  B.17 matched on the tool name ΓÇö so it reported the recommended configuration
  as a conflict and named "remove the allow" as the fix, which is the one edit
  that breaks it. A narrowed allow on Read is still flagged: reading is
  precisely what Fettler replaces.

Fixed

• fettle setup and fettle doctor could not run before .fettler.json
  existed ΓÇö and setup --local is what creates it. Every verb resolved the
  boundary before dispatch, so the file needed to run setup was the file
  setup writes, and a first run in a new project exited 2. Both verbs now
  fall back to the current directory when nothing at all is declared. The
  fallback is read-only, reaches only a compiled-in list of well-known
  configuration paths, and does not apply to any other verb; a configuration
  that is present and malformed is still refused rather than fallen back from.

• fettle setup --hooks installed nothing when the deny list was already
  complete. The hook sat after an early return taken whenever there was
  nothing to deny ΓÇö so asking for it on an already-configured project, or at
  --global without --deny, reported success and wrote no hook. The deny
  list and the hook are now decided independently and saved once.

• fettle setup --global left you with no working project. A global run
  declares no tree and therefore writes no .fettler.json, and said so
  nowhere. It now names the per-project command that creates one.

Added

• Quick Start ΓÇö
  install it, register it for the machine, turn it on in a project, check it.
  Four steps, one command each, with the real output of each and a table
  routing every unclean doctor verdict and finding to the page that clears
  it. It is the second page in the Fettler sequence; the install and project
  pages are the reference behind it.

Documentation

• fettler-boundary.html is now
  fettler-install.html.
  The v2.3.0 release notes link to the old name and that link no longer
  resolves; what it pointed at is now
  Fettler §7.

• The three Fettler pages were reordered so each answers one question and the
  steps appear in the order they depend on each other. Page one is what Fettler
  is and asks you to type nothing; the install page is the machine, with the
  MCP front end gathered into one section at the end rather than opening the
  page; the project page is .fettler.json first, because every other step
  needs it.

• Thirteen machine pages carried breadcrumbs pointing at catalog anchors that
  no longer existed, and eleven of them displayed a category name that does
  not exist at all. Both halves fixed, and the checker that missed them now
  compares the label as well as the link.

• scripts/verify-docs.js dropped any navigation item carrying a class of its
  own, so an item could vanish from every page at once with the consistency
  check still passing.

• Every code block on the Fettler pages has the site's copy button, and the
  Fettler link moved to the top navigation row, which had room for it.