fix(setup): harden verification and recovery

.superpowers/sdd/2026-08-15-unified-tht-cli-product-step/task-5-report.md

@@ -53,3 +53,28 @@ installation, Pi configuration edit, or documentation rewrite was performed.
 - The existing aggregate `tht doctor` command remains a separate implementation; Task 5 performs
   its equivalent setup-time prerequisite checks plus `pi.Doctor` without invoking a nested CLI
   process.
+
+## Fix round 1
+
+The independent review identified three gaps. All were reproduced with RED tests before the
+production change:
+
+- A rendered Compose document containing any one volume was accepted. `requireVolumes` now
+  requires `settings`, `pi-state`, `workspace-registry`, `workspace-secrets`, `sessions`,
+  `qdrant-data`, and `embedding-models`; tests reject each individual omission and an
+  unrelated-only volume set.
+- Failures after `compose up` could return without recovery instructions. A single recovery
+  wrapper now preserves the underlying error while adding the retained-container, `tht logs
+  <service>`, and `tht status` guidance for failed `up`, health, aggregate doctor, and Pi doctor
+  phases. Focused tests also prove build failure stops before attempting startup.
+- LF inspection previously walked the full checkout. It now inspects only `compose.yaml`,
+  `deploy/`, and `docker/`; a test proves CRLF content under `node_modules/` is ignored.
+
+Verification added for this round:
+
+```bash
+go test ./internal/setup -run 'TestRequireVolumes|TestRun(BuildFailure|UpFailure|AggregateDoctorFailure|PiDoctorFailure|IgnoresIrrelevant|TimesOut)' -count=1
+go test ./internal/setup -count=1
+```
+
+Both passed before the final full-suite verification. No Docker or live operation was run.