diff --git a/openspec/changes/fix-bun-install-trust-rollback/.openspec.yaml b/openspec/changes/archive/2026-07-02-fix-bun-install-trust-rollback/.openspec.yaml
similarity index 100%
rename from openspec/changes/fix-bun-install-trust-rollback/.openspec.yaml
rename to openspec/changes/archive/2026-07-02-fix-bun-install-trust-rollback/.openspec.yaml
diff --git a/openspec/changes/fix-bun-install-trust-rollback/design.md b/openspec/changes/archive/2026-07-02-fix-bun-install-trust-rollback/design.md
similarity index 100%
rename from openspec/changes/fix-bun-install-trust-rollback/design.md
rename to openspec/changes/archive/2026-07-02-fix-bun-install-trust-rollback/design.md
diff --git a/openspec/changes/fix-bun-install-trust-rollback/proposal.md b/openspec/changes/archive/2026-07-02-fix-bun-install-trust-rollback/proposal.md
similarity index 100%
rename from openspec/changes/fix-bun-install-trust-rollback/proposal.md
rename to openspec/changes/archive/2026-07-02-fix-bun-install-trust-rollback/proposal.md
diff --git a/openspec/changes/fix-bun-install-trust-rollback/specs/agent-update/spec.md b/openspec/changes/archive/2026-07-02-fix-bun-install-trust-rollback/specs/agent-update/spec.md
similarity index 100%
rename from openspec/changes/fix-bun-install-trust-rollback/specs/agent-update/spec.md
rename to openspec/changes/archive/2026-07-02-fix-bun-install-trust-rollback/specs/agent-update/spec.md
diff --git a/openspec/changes/fix-bun-install-trust-rollback/tasks.md b/openspec/changes/archive/2026-07-02-fix-bun-install-trust-rollback/tasks.md
similarity index 100%
rename from openspec/changes/fix-bun-install-trust-rollback/tasks.md
rename to openspec/changes/archive/2026-07-02-fix-bun-install-trust-rollback/tasks.md
diff --git a/openspec/specs/agent-update/spec.md b/openspec/specs/agent-update/spec.md
index 503b203..6126970 100644
--- a/openspec/specs/agent-update/spec.md
+++ b/openspec/specs/agent-update/spec.md
@@ -141,7 +141,7 @@ When Quantex performs a grouped managed batch update for an installer type, it S
 
 ### Requirement: Bun-managed updates MUST trust requested blocked lifecycle scripts across platform path styles
 
-The agent update system SHALL recognize Bun global untrusted package output for requested managed packages regardless of whether Bun prints `node_modules` paths with POSIX or Windows separators. When the untrusted probe cannot be read after a successful Bun global install or update command, Quantex SHALL NOT report that managed operation as successful.
+The agent update system SHALL recognize Bun global untrusted package output for requested managed packages regardless of whether Bun prints `node_modules` paths with POSIX or Windows separators. When the untrusted probe cannot be read after a successful Bun global install or update command, Quantex SHALL NOT report that managed operation as successful. When trust verification fails after a successful Bun global **install** command, Quantex SHALL roll back the newly added package before reporting install failure.
 
 #### Scenario: Trusting a requested scoped package from Windows Bun output
 
@@ -168,6 +168,16 @@ The agent update system SHALL recognize Bun global untrusted package output for
 - THEN Quantex reports the managed operation as failed
 - AND it does not claim the install or update succeeded without completing trust verification
 
+#### Scenario: Rolling back a Bun install when trust verification fails
+
+- GIVEN a Bun-managed install requested one or more package names
+- AND `bun add -g` exits successfully for those packages
+- AND Bun trust verification fails afterward
+- WHEN Quantex evaluates the managed install outcome
+- THEN Quantex removes the packages that were just added with `bun remove -g`
+- AND it reports the Bun install attempt as failed
+- AND a subsequent fallback install method may run without leaving a duplicate Bun global install behind
+
 #### Scenario: Skipping untracked PATH detections during batch update
 
 - GIVEN an agent binary is detected in `PATH`