[vanedaltro]

The earlier Setup design relied on deleted root-Session history to suppress repeated automatic effects and placed attempts in an aggregate that normal Session deletion purges. It also assumed the single-aggregate Store::append_checked API could atomically persist Session creation and an independently owned marker.

Correct the design to retain installation/Location markers, attempt settlement and request deduplication outside deleted Session aggregates. Specify a bounded multi-aggregate checked-append prerequisite with complete rollback and post-commit notification guarantees. Record that legacy deletion leaves incomplete evidence, so the complete migration/support decision needs review before schema or init implementation. Expand the required deletion, rebuild, retry and transaction-failure tests.

This is a one-document correction against current main, independent of PR #85. Setup tasks S1–S6 remain unchecked; the Store epoch/key and legacy-bootstrap decisions remain proposed. No marker, migration, Store API, CLI/API or dispatch behavior is implemented.

Validation:

• Strict OpenSpec: 114 passed, 0 failed.
• Spec lint: 0 errors, 25 warnings.
• Whitespace check passed.
• Reviewed the design against Session deletion, hook projection/tombstone migrations, checked append, notifications and the single writer on main dd0c927. No blocking documentation accuracy findings remain.
• Hosted OpenSpec passed all 114 items and lint reported 0 errors / 25 warnings. The Changes check passed; six code/build checks were intentionally skipped for this documentation-only diff. Rust tests were not run.
• The actual hosted checkout 426d2f0 has tree ad47ad2a1b2dc19f33e922743b6277f1bdb2f67a, equal to head 6e13f4c and the prospective merge tree.