docs: AWS Bedrock setup walkthrough for new AWS accounts

README.md

@@ -47,8 +47,8 @@ Before your first deploy, ensure your AWS account in `us-east-1` has an active A
 Marketplace subscription for `zai.glm-4.7-flash` (Bedrock enables foundation-model access
 by default in commercial Regions once the Marketplace subscription is in place; the legacy
 manual *Bedrock → Model access* console flow is no longer the gate for this model) — see
-[docs/02-rehydration.md](docs/02-rehydration.md#bedrock-setup) for what else is required and
-what breaks if you skip it.
+[docs/11-aws-bedrock-setup.md](docs/11-aws-bedrock-setup.md) for the full setup, what else
+is required, and what breaks if you skip it.
 
 ## Loop mode
 
@@ -183,6 +183,7 @@ multi-writer escape hatch it looks like.
 | [docs/08-rag-vector-search.md](docs/08-rag-vector-search.md) | SQLite as a vector database too: sqlite-vec + Titan embeddings |
 | [docs/09-lesson-script.md](docs/09-lesson-script.md) | A 10-lesson script for teaching the RAG extension (frame, check-in questions, expected reasoning) |
 | [docs/10-concurrency.md](docs/10-concurrency.md) | Optimistic S3 rehydration, 412 handling, rebase-and-retry, the single-writer queue |
+| [docs/11-aws-bedrock-setup.md](docs/11-aws-bedrock-setup.md) | Account type, deployer IAM, Marketplace subscription, Region, EULA, first-deploy smoke |
 | [docs/bedrock-model-comparison.md](docs/bedrock-model-comparison.md) | Why `zai.glm-4.7-flash` is the default, and alternatives |
 
 ## Cost

docs/02-rehydration.md

@@ -96,24 +96,3 @@ redeploy. At the AWS cap the same math gives roughly 2.6 million ticks of headro
 about 25 years at 5-minute cadence. The RAG corpus (`agent_notifications` +
 `agent_embeddings`) is the dominant growth term; status reads and `agent_runs` rows are
 small by comparison.
-
-## Bedrock setup
-
-Before the first `fetch` invocation can succeed, the deploying account in `us-east-1` needs
-two things: an active AWS Marketplace subscription for the configured `bedrockModelId`
-(default `zai.glm-4.7-flash`), and an IAM policy that grants `bedrock:InvokeModel` against
-it. Bedrock enables foundation-model access by default in commercial Regions once the
-Marketplace subscription is in place — the legacy manual *Bedrock → Model access* console
-flow is no longer the gating step for this model. If you point `bedrockModelId` at an
-Anthropic model instead, Bedrock requires a separate first-time-use EULA acceptance on the
-same page before that model will invoke; that step *is* still a manual console action and
-is the one remaining reason to open the *Model access* screen.
-
-The CDK stack's IAM policy is generated at synth time from the configured model's family
-(see `src/format/families.ts`) and is permissive enough to invoke the chosen model — but a
-Marketplace subscription must already exist on the account, or `bedrock:InvokeModel`
-returns `AccessDeniedException` regardless of what the IAM policy says. `cdk deploy` does
-not check for the subscription, so the stack deploys cleanly and the first `fetch` fails —
-which is why this tutorial calls it out before the first deploy rather than after.
-
-For Discord webhook setup, see [docs/06-discord-webhook-setup.md](06-discord-webhook-setup.md).

docs/09-lesson-script.md

@@ -2,7 +2,7 @@
 
 **Audience:** a teacher walking a student through the RAG extension.
 **Length:** 10 lessons, roughly 30 minutes including the closing test run.
-**Prerequisite:** the student has read [08-rag-vector-search.md](08-rag-vector-search.md) and the base tutorial's [01-architecture.md](01-architecture.md). Familiarity with the writer/reader asymmetry in [01-architecture.md](01-architecture.md) and the per-source error isolation in [03-schema.md](03-schema.md) is assumed.
+**Prerequisite:** the student has completed the base tutorial end-to-end, including the AWS setup in [11-aws-bedrock-setup.md](11-aws-bedrock-setup.md) — the RAG lesson assumes a deployed, working bot, and that doc is where to go if the base deploy is broken. The student has read [08-rag-vector-search.md](08-rag-vector-search.md) and the base tutorial's [01-architecture.md](01-architecture.md). Familiarity with the writer/reader asymmetry in [01-architecture.md](01-architecture.md) and the per-source error isolation in [03-schema.md](03-schema.md) is assumed.
 
 ## How to use this script