sync: absorb upstream v1.4.206

.gitattributes

@@ -23,10 +23,15 @@
 # runs `git apply` on one must force `-c core.autocrlf=input` rather than trust
 # the host's setting. See config/scripts/windows-process-tree-gyp-rebuild.mjs.
 /config/patches/*.patch -text
+# Same reason, and pnpm parses these too: a CRLF checkout makes the mobile
+# patches unparseable, so Windows packaging dies on ERR_PNPM_INVALID_PATCH.
+/mobile/patches/*.patch -text
 # The xterm bundle hunks also make a diff nobody can read; review the hand-written
 # source patch under xterm-src/ instead. The sibling patches stay diffable.
 /config/patches/@xterm__xterm@*.patch -diff
 /config/patches/xterm-src/*.patch text eol=lf
+# pnpm parses these unified diffs during Windows installs; keep checkout bytes stable.
+/mobile/patches/*.patch -text
 # Generated wrapper fixtures: collapse them in the PR diff so they stop drowning
 # the reviewable change, and pin LF because they are compared byte-for-byte.
 # Not -diff: the shell diff is the review surface when a wrapper does change.
@@ -41,3 +46,48 @@
 # Generated method->params catalog: compared byte-for-byte by
 # verify:rpc-params-catalog, so a CRLF checkout would fail the gate.
 /src/shared/rpc-contract/rpc-params-catalog.generated.ts linguist-generated=true text eol=lf
+# Mobile web bundle source. Every text byte here is hashed into an asset digest and
+# from there into buildId, so a CRLF checkout produces a different bundle id for the
+# same commit (91af2897 vs 9d78435e). The PNG is -text because it must not be touched.
+/src/mobile-web/index.html text eol=lf
+/src/mobile-web/src/*.ts text eol=lf
+/src/mobile-web/src/*.css text eol=lf
+/src/mobile-web/src/*.png -text
+# Mobile web page source. Same buildId hazard as src/mobile-web above: these bytes are
+# hashed into the Phase C bundle, so a CRLF Windows checkout would ship a different
+# buildId for identical source. web-entry/ does not exist yet; the pin lands ahead of it.
+/mobile/src/** text eol=lf
+/mobile/app/** text eol=lf
+/mobile/web-entry/** text eol=lf
+# The blanket pin above would mark a future binary as text; exempt the asset types an
+# RN page actually carries, the same way src/mobile-web exempts its PNG.
+/mobile/src/**/*.png -text
+/mobile/src/**/*.jpg -text
+/mobile/src/**/*.jpeg -text
+/mobile/src/**/*.gif -text
+/mobile/src/**/*.ico -text
+/mobile/src/**/*.webp -text
+/mobile/src/**/*.ttf -text
+/mobile/src/**/*.otf -text
+/mobile/src/**/*.woff -text
+/mobile/src/**/*.woff2 -text
+/mobile/app/**/*.png -text
+/mobile/app/**/*.jpg -text
+/mobile/app/**/*.jpeg -text
+/mobile/app/**/*.gif -text
+/mobile/app/**/*.ico -text
+/mobile/app/**/*.webp -text
+/mobile/app/**/*.ttf -text
+/mobile/app/**/*.otf -text
+/mobile/app/**/*.woff -text
+/mobile/app/**/*.woff2 -text
+/mobile/web-entry/**/*.png -text
+/mobile/web-entry/**/*.jpg -text
+/mobile/web-entry/**/*.jpeg -text
+/mobile/web-entry/**/*.gif -text
+/mobile/web-entry/**/*.ico -text
+/mobile/web-entry/**/*.webp -text
+/mobile/web-entry/**/*.ttf -text
+/mobile/web-entry/**/*.otf -text
+/mobile/web-entry/**/*.woff -text
+/mobile/web-entry/**/*.woff2 -text

.github/actions/install-mobile-dependencies/action.yml

@@ -0,0 +1,22 @@
+name: Install mobile dependencies
+description: Frozen pnpm install for the mobile/ project, whose node_modules the mobile web bundle build and the mobile-aware lint passes resolve React Native and Expo from.
+
+runs:
+  using: composite
+  steps:
+    # Why a separate install: mobile is its own pnpm project, so the root install leaves
+    # mobile/node_modules empty and every mobile import resolves to nothing.
+    # Why no --ignore-scripts, unlike the root install: mobile's postinstall generates the
+    # gitignored terminal/mermaid webview engine modules that tracked source imports.
+    # The drift guard mirrors the root install so a stale mobile lockfile fails by name --
+    # mobile's lockfile carries patchedDependencies that a silent rewrite would drop.
+    - name: Install mobile dependencies
+      shell: bash
+      working-directory: mobile
+      run: |
+        pnpm install --frozen-lockfile
+        # Job containers can run composite steps from a source mirror without .git.
+        if [ "$(git -C "$GITHUB_WORKSPACE" rev-parse --is-inside-work-tree 2>/dev/null)" = true ]; then
+          git -C "$GITHUB_WORKSPACE" diff --exit-code -- \
+            mobile/package.json mobile/pnpm-lock.yaml mobile/pnpm-workspace.yaml
+        fi

.github/pull_request_template.md

@@ -1,14 +1,14 @@
 ## ELI5
 
-<!-- Simple high-level explanation -->
+<!-- Simple high-level explanation, in plain language. No jargon. -->
 
 ## What Changed
 
-<!-- Describe the change clearly and keep scope tight. -->
+<!-- Describe the change clearly and keep scope tight. Cover the before and after as the user experiences it, and the mechanism you changed — not just the symptom. -->
 
 ## Why
 
-<!-- What problem does this solve, and why is this approach right? -->
+<!-- What problem does this solve, and why is this approach better than the alternatives you considered? -->
 
 ## Linked Issue
 
@@ -47,7 +47,7 @@ Ensure no issues in: Security, Cross-platoform support (Linux, Windows, Mac), Re
 ## Checklist
 
 - [ ] This PR is small and focused
-- [ ] I explained what changed and why (including ELI5)
+- [ ] I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
 - [ ] Before/after screenshots or videos attached for UI changes, or `N/A` with reason
 - [ ] Self-reviewed for correctness, security, and performance
 - [ ] Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)

.github/workflows/adhoc-mac-build.yml

@@ -184,6 +184,9 @@ jobs:
         with:
           node-version-file: package.json
           cache: pnpm
+          cache-dependency-path: |
+            pnpm-lock.yaml
+            mobile/pnpm-lock.yaml
 
       - name: Cache electron-builder downloads
         uses: actions/cache@v5
@@ -205,6 +208,10 @@ jobs:
           retry_wait_seconds: 30
           command: pnpm install --frozen-lockfile --cpu=current,x64,arm64
 
+      # Why here: electron-builder's beforePack requires out/mobile-web, and the bundle
+      # build resolves React Native and Expo from mobile/node_modules.
+      - uses: ./.github/actions/install-mobile-dependencies
+
       # Why: signing is what makes an adhoc build installable over an existing
       # Orca, so a missing cert must fail here rather than after a 20-minute build.
       - name: Verify macOS signing environment