claims: the demo shows every command behind its diff, and nothing says more than Limitations does

The landing's story ran two commands and showed three changes: the one that edits /etc/hosts is
the quickstart's and was missing. "A diff of everything" and "exactly which files changed" said
more than the limit row "A diff does not see everything" allows. Install on AWS opens with the
three limits a reader meets after installing - experimental, the RPO, one-way updates - and
Status says that a link into spin opens only for someone with access, since spin is private.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: aledbf

src/content/docs/aws/overview.mdx

@@ -6,6 +6,12 @@ description: What an installation on AWS is made of, what the OpenTofu module cr
 import Figure from '../../../components/Figure.astro';
 import Value from '../../../components/Value.astro';
 
+Three limits to know before the first command, each a row of [Limitations](/overview/limitations/):
+Spinbox is experimental, and its APIs change; a runner that is lost takes with it
+[what it had not uploaded yet](/overview/limitations/#durability), up to the installation's RPO;
+and [an update is one way](/overview/limitations/#operations), so going back past a schema change
+is a restore of the database.
+
 An installation of Spinbox lives in one AWS account and one region. It is created by one OpenTofu
 module, [spin-terraform-aws](https://github.com/spin-stack/spin-terraform-aws):
 

src/content/docs/index.mdx

@@ -4,7 +4,7 @@ description: Self-hosted sandboxes in your own AWS account, a virtual machine pe
 template: splash
 hero:
   title: A virtual machine per workspace. A snapshot before, a diff after.
-  tagline: Sandboxes for people and agents that run in your own AWS account. Take a snapshot with the memory of the running processes, see exactly which files changed, and roll back. A workspace's network stays closed until you open it.
+  tagline: Sandboxes for people and agents that run in your own AWS account. Take a snapshot with the memory of the running processes, see which files changed, and roll back. A workspace's network stays closed until you open it.
   actions:
     - text: Install on AWS
       link: aws/overview/
@@ -34,7 +34,7 @@ Every workspace is a KVM virtual machine with its own kernel, root and a persist
 <BentoCard icon="memory" title="Snapshots with memory" feature="Snapshots with memory, resumed with their processes">
 Restore and the processes are running where they were.
 </BentoCard>
-<BentoCard icon="diff" title="A diff of everything" feature="A diff of the files that changed between two snapshots">
+<BentoCard icon="diff" title="A diff of what changed" feature="A diff of the files that changed between two snapshots">
 Every file added, modified or removed between two snapshots.
 </BentoCard>
 <BentoCard size="wide" icon="shield" title="Closed until you open it" feature="Egress is closed by default; policies, by tag, name what a workspace may reach">

src/content/docs/reference/status/index.md

@@ -9,7 +9,7 @@ sidebar:
 
 <!-- Generated by tools/refgen from spin:internal/features/features.go. Edit the source, not this file. -->
 
-Every row of this page is a line of `internal/features` in spin, and a test there resolves it against the tree. A row that says **built** names what shows the feature exists - a procedure the control plane serves, a command the CLI has, or a test - and, under **End to end**, the tests that drive a real runner and its guest and check what the feature did, or what no test checks yet. spin's build checks that each of those tests is there and not quarantined; whether it checks the whole feature is its review's. A row that says **not built** is an item of [`docs/ROADMAP.md`](https://github.com/spin-stack/spin/blob/c02ffc3acfd56cb242d21547cb177da68a3d4f11/docs/ROADMAP.md). The page is written by `task reference` from `spin features` at spin `c02ffc3ac`, and cannot say a feature the binary does not.
+Every row of this page is a line of `internal/features` in spin, and a test there resolves it against the tree. A row that says **built** names what shows the feature exists - a procedure the control plane serves, a command the CLI has, or a test - and, under **End to end**, the tests that drive a real runner and its guest and check what the feature did, or what no test checks yet. spin's build checks that each of those tests is there and not quarantined; whether it checks the whole feature is its review's. A row that says **not built** is an item of [`docs/ROADMAP.md`](https://github.com/spin-stack/spin/blob/c02ffc3acfd56cb242d21547cb177da68a3d4f11/docs/ROADMAP.md). The page is written by `task reference` from `spin features` at spin `c02ffc3ac`, and cannot say a feature the binary does not. spin is a private repository: a link to its code opens only for someone with access to it.
 
 ## Built
 

src/lib/story.ts

@@ -31,7 +31,7 @@ export const steps: Step[] = [
 		claim: 'A person or an agent is root in a KVM machine with its own kernel: nothing they do reaches another workspace.',
 		feature: 'A machine per workspace: KVM, its own kernel, root, a persistent disk, SSH',
 		commands: [
-			"spin exec demo -- sh -c 'echo hello > /etc/greeting; rm /etc/issue'",
+			"spin exec demo -- sh -c 'echo hello > /etc/greeting; rm /etc/issue; echo \"# edited\" >> /etc/hosts'",
 			'spin snapshot create demo --description after --wait',
 		],
 	},

tools/refgen/status.go

@@ -171,7 +171,8 @@ func statusPage(rows []feature, t tests, commit string) (map[string][]byte, erro
 		"checks the whole feature is its review's. A row that says **not built** is an item of " +
 		"[`docs/ROADMAP.md`](https://github.com/spin-stack/spin/blob/" + commit + "/docs/ROADMAP.md). " +
 		"The page is written by `task reference` from `spin features` at spin `" + commit[:9] + "`, and " +
-		"cannot say a feature the binary does not.\n\n")
+		"cannot say a feature the binary does not. spin is a private repository: a link to its code " +
+		"opens only for someone with access to it.\n\n")
 
 	b.WriteString("## Built\n\n")
 	var areas []string