Reset ThreadBear to one local title write and friendly lifecycle UX [BEAR-116] [BEAR-117]

[ericlitman]

Summary

• reduce ThreadBear to a local planner plus the mounted Codex app's native title setter as the sole writer
• preserve each task's exact safe subject and change only one visible status icon, with at most one write attempt and no retry or reconciliation
• prepare the complete local catalog before onboarding, then serially re-read each target immediately before its one possible mounted write
• retain a task-blind, update-only LaunchAgent; serialize uninstall behind in-flight updates and reject queued updater processes after binary replacement
• include BEAR-117 in v3.0.0: every install, onboarding, update, and uninstall change gets an upbeat, jargon-light preview before consent and a durable ThreadBear recap 🐻 as the final response after tools finish
• remove hooks, SQLite access, the persistent ThreadBear task, controller phases, pending-title recovery, waves, and global title failure state

Why

The prior product accumulated machinery around an unreliable title path and could turn one title uncertainty into a product-wide failure. This reset keeps title failures local, uses the mounted writer that visibly repaints Codex, and keeps lifecycle actions understandable without exposing implementation jargon. BEAR-117 ships in v3.0.0 rather than being deferred.

Verification

• go test -count=1 ./...
• go test -race -count=1 ./...
• go vet ./...
• formatting, shell syntax, ShellCheck, installer/guide parity, skill-size, and experiment-registry validation
• executable tests run the exact installed ordinary-turn and onboarding JavaScript, including raw JSON-string native responses, wrong-task responses, drift skips, malformed results, one-write limits, yielded preparation resumption, and serial full-plan accounting
• exact-candidate v3.0.0 release smoke with the real LaunchAgent, reset path, current-task plan, complete onboarding preparation, updater overlap, and binary-last uninstall
• reproducible CGO-disabled artifacts: arm64 SHA-256 a1ecec67bc7c2fb5c2a166d454c113c307bcd9a8d220fabd9c5f3825d8210a31; amd64 SHA-256 99a20910d5ff8f6c3bc04920853509dd52c28a343964ba0b4fb6ad82ea35658d
• exact ordinary-turn cell confirmed one mounted write and immediately rendered ➡️ Diagnose ThreadBear failures
• complete 360-task onboarding plan prepared one controlled historical target, reread its exact ID/title, confirmed one mounted write with zero unconfirmed outcomes, and immediately rendered 🐻 Update website copy boxes
• live BEAR-117 lifecycle canary ran uninstall dry-run, ended with the friendly preview and one yes/no consent question, required explicit consent and uninstalled:true, then left the exact removal recap as the final visible content after reopen and a clean Codex restart
• confirmed uninstall removed only owned artifacts and left hooks.json byte-identical; the same exact artifact reinstalled byte-for-byte, survived another clean process start, retained both controlled titles through the native catalog, and reported ready with the exact update-only LaunchAgent
• installed final skill is byte-identical to source, SHA-256 4fa64eb271df4f639d4f5aaf5b6a2abd8f04aa153a9ec7edab5c26da20ef0d44, and 5,061 bytes
• preflights TB-PRE-0116-001 through TB-PRE-0116-004 are closed by TB-EXP-0116-003 through TB-EXP-0116-006; the final mounted-repaint capability is established
• final Fable verdict on the exact evidence: Ship

The remaining delivery gate is mechanical: protected checks/review, merge, v3.0.0 tag, and hosted published-artifact smoke.

Linear: BEAR-116
Linear: BEAR-117

[openswebot]

Open SWE Review found 4 potential issues.

Open in Web

[openswebot]

Open SWE Review found 4 potential issues.

Open in Web

[ericlitman]

@Mergifyio queue

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-08 16:59 UTC · Rule: default · triggered by @ericlitman with the @mergifyio queue command
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-08-08 16:59 UTC · at ba3f2f38513af98ab8fda856197912ebc84f4670

This pull request spent 26 seconds in the queue, including 5 seconds running CI.

Required conditions to merge

• github-review-approved [🛡 GitHub repository ruleset rule Mergify automatic merge queue]
  • Reset ThreadBear to one local title write and friendly lifecycle UX [BEAR-116] [BEAR-117] #124
• all of [🛡 Merge Protections rule Queue ready pull requests]:
  • -draft
    • Reset ThreadBear to one local title write and friendly lifecycle UX [BEAR-116] [BEAR-117] #124
• any of [🛡 GitHub branch protection]:
  • check-success = verify
  • check-neutral = verify
  • check-skipped = verify
• any of [🛡 GitHub branch protection]:
  • check-success = Open SWE Review
  • check-neutral = Open SWE Review
  • check-skipped = Open SWE Review
• any of [🛡 GitHub repository ruleset rule Mergify automatic merge queue]:
  • check-success = @mergify/Mergify Merge Protections
  • check-neutral = @mergify/Mergify Merge Protections
  • check-skipped = @mergify/Mergify Merge Protections
• any of [🛡 GitHub repository ruleset rule Review gate]:
  • check-success = Open SWE Review
  • check-neutral = Open SWE Review
  • check-skipped = Open SWE Review

[ericlitman]

Superseded by v3.0.1

This PR and the v3.0.0 tag are retained as historical evidence, but they are not the shipping contract.

PR #125 removed the remaining ordinary App Server/state path, made the title helper stateless under the default sandbox, constrained onboarding to compatible fixed Codex Desktop locations, and retained the BEAR-117 friendly lifecycle recap. It merged as bed4552 and shipped as v3.0.1.

The v3.0.1 release CI, publication, and hosted smoke passed. The downloaded published arm64 asset also passed the full local real-LaunchAgent smoke, was installed byte-for-byte, and survived a genuine Codex Desktop process replacement with the exact task title visible in the header and sidebar.

Use PR #125, v3.0.1, and TB-EXP-0116-007 for final BEAR-116/BEAR-117 evidence.