diff --git a/docs/architecture.md b/docs/architecture.md
index a3aacc4..6db3581 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -17,6 +17,9 @@ HTTP 401/403 clears the saved session and requests login. Server failures retain
 the credential and retry immediately, then after 3, 10, 15, and repeatedly 30
 seconds. Manual login and logout cancel pending restoration. Dashboard-loading
 failures do not invalidate a successfully verified session.
+Restored sessions retain the server's mandatory credential-replacement state.
+An omitted replacement flag is treated conservatively as requiring setup rather
+than silently allowing the dashboard to consider setup complete.
 
 Run `node --test src/session-recovery.test.js` for response classification and
 retry-schedule coverage. This is not a substitute for native AppImage acceptance.
diff --git a/src/App.svelte b/src/App.svelte
index e975ea3..8a35754 100644
--- a/src/App.svelte
+++ b/src/App.svelte
@@ -100,7 +100,7 @@
       authError = '';
       sessionToken = storedSession;
       authenticated = true;
-      mustReplaceCredentials = result.must_replace_credentials;
+      mustReplaceCredentials = result.must_replace_credentials !== false;
       connectionState = 'CONNECTED';
       await loadAuthenticatedData().catch(() => {
         authError = 'Authenticated, but dashboard data could not be loaded.';