fix: keep installer consent turn visible [closes BEAR-103]

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+### Fixed
+
+- Kept the guided installer welcome, readiness result, complete recommendation, and consent question visible together after the first turn finishes.
+
 ## v2.1.0 - 2026-07-31
 
 ### Changed

INSTALL.md

@@ -18,6 +18,8 @@ Open with this complete orientation before running a command:
 >
 > I'll check this Mac, show you exactly what will change, and answer questions before installing anything. Then I'll prove the result in a genuinely fresh Codex task and update existing titles only after you consent.
 
+Codex collapses commentary after a turn finishes. The welcome may appear there while checks run, but commentary copies do not satisfy this contract. Every terminal final answer in this first turn must be self-contained. If every check and the dry run succeeds, `phase: final_answer` must include the complete orientation above, the readiness sentence, the full recommendation card, and the consent question. Do not end a successful turn with only the consent question. If any check fails, keep the complete orientation and truthful failure visible in `phase: final_answer`; do not claim readiness, show the recommendation card, or ask for consent.
+
 Keep the tone warm, calm, capable, and lightly playful. Explain visible outcomes first. Show the complete recommendation before asking for consent. A clear yes to an unchanged complete recommendation is installation consent; ask again only if the effect changed, the answer was ambiguous, or a reinstall changes the recommendation.
 
 ## 1. Check this Mac
@@ -55,7 +57,7 @@ Require a successful candidate self-test and a dry-run limited to the binary, on
 
 ## 2. Show the recommendation
 
-Only after every check and the dry run succeeds, say: “This Mac and Codex are ready for ThreadBear.” Continue in the same response with the full card:
+Only after every check and the dry run succeeds, compose one terminal final answer with no later tool call or commentary. Repeat the complete orientation, say “This Mac and Codex are ready for ThreadBear,” then continue with the full card:
 
 > ## Recommended setup
 >
@@ -68,6 +70,8 @@ Only after every check and the dry run succeeds, say: “This Mac and Codex are
 >
 > Install ThreadBear with this recommended setup?
 
+The welcome heading, orientation, readiness sentence, every recommendation bullet, and consent question must all be present in `phase: final_answer` when the completed task is read back. Do not send the card only as commentary and do not follow it with a question-only final answer.
+
 Answer questions without inventing options or flags. A clear yes to this unchanged recommendation advances directly to installation.
 
 ## 3. Install after consent

cmd/threadbear/site_contract_test.go

@@ -56,6 +56,51 @@ func TestPublishedInstallGuideMatchesCurrentCLI(t *testing.T) {
 	}
 }
 
+func TestPublishedInstallGuideKeepsFirstConsentTurnVisible(t *testing.T) {
+	data, err := os.ReadFile(filepath.Join("..", "..", "INSTALL.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	guide := string(data)
+
+	for _, required := range []string{
+		"Codex collapses commentary after a turn finishes.",
+		"commentary copies do not satisfy this contract",
+		"Every terminal final answer in this first turn must be self-contained.",
+		"If every check and the dry run succeeds, `phase: final_answer` must include the complete orientation above, the readiness sentence, the full recommendation card, and the consent question.",
+		"Do not end a successful turn with only the consent question.",
+		"compose one terminal final answer with no later tool call or commentary",
+		"every recommendation bullet, and consent question must all be present in `phase: final_answer`",
+		"do not follow it with a question-only final answer",
+	} {
+		if !strings.Contains(guide, required) {
+			t.Errorf("published install guide is missing visible consent-turn contract %q", required)
+		}
+	}
+
+	if strings.Contains(guide, "Continue in the same response with the full card") {
+		t.Error("published install guide retains the ambiguous response-boundary rule")
+	}
+}
+
+func TestPublishedInstallGuideDoesNotRequestConsentAfterFailedChecks(t *testing.T) {
+	data, err := os.ReadFile(filepath.Join("..", "..", "INSTALL.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	guide := string(data)
+
+	for _, required := range []string{
+		"If any check fails, keep the complete orientation and truthful failure visible in `phase: final_answer`",
+		"do not claim readiness, show the recommendation card, or ask for consent",
+		"Only after every check and the dry run succeeds, compose one terminal final answer",
+	} {
+		if !strings.Contains(guide, required) {
+			t.Errorf("published install guide is missing truthful failure-turn contract %q", required)
+		}
+	}
+}
+
 func TestHomepageDoesNotPromiseRemovedCapabilities(t *testing.T) {
 	data, err := os.ReadFile(filepath.Join("..", "..", "site", "index.html"))
 	if err != nil {

site/install

@@ -18,6 +18,8 @@ Open with this complete orientation before running a command:
 >
 > I'll check this Mac, show you exactly what will change, and answer questions before installing anything. Then I'll prove the result in a genuinely fresh Codex task and update existing titles only after you consent.
 
+Codex collapses commentary after a turn finishes. The welcome may appear there while checks run, but commentary copies do not satisfy this contract. Every terminal final answer in this first turn must be self-contained. If every check and the dry run succeeds, `phase: final_answer` must include the complete orientation above, the readiness sentence, the full recommendation card, and the consent question. Do not end a successful turn with only the consent question. If any check fails, keep the complete orientation and truthful failure visible in `phase: final_answer`; do not claim readiness, show the recommendation card, or ask for consent.
+
 Keep the tone warm, calm, capable, and lightly playful. Explain visible outcomes first. Show the complete recommendation before asking for consent. A clear yes to an unchanged complete recommendation is installation consent; ask again only if the effect changed, the answer was ambiguous, or a reinstall changes the recommendation.
 
 ## 1. Check this Mac
@@ -55,7 +57,7 @@ Require a successful candidate self-test and a dry-run limited to the binary, on
 
 ## 2. Show the recommendation
 
-Only after every check and the dry run succeeds, say: “This Mac and Codex are ready for ThreadBear.” Continue in the same response with the full card:
+Only after every check and the dry run succeeds, compose one terminal final answer with no later tool call or commentary. Repeat the complete orientation, say “This Mac and Codex are ready for ThreadBear,” then continue with the full card:
 
 > ## Recommended setup
 >
@@ -68,6 +70,8 @@ Only after every check and the dry run succeeds, say: “This Mac and Codex are
 >
 > Install ThreadBear with this recommended setup?
 
+The welcome heading, orientation, readiness sentence, every recommendation bullet, and consent question must all be present in `phase: final_answer` when the completed task is read back. Do not send the card only as commentary and do not follow it with a question-only final answer.
+
 Answer questions without inventing options or flags. A clear yes to this unchanged recommendation advances directly to installation.
 
 ## 3. Install after consent