Merge remote-tracking branch 'origin/staging' into staging

# Conflicts:
#	.codex/skills/release-mobile/SKILL.md
#	apps/mobile/package.json
#	docs/releasing.md

.codex/skills/generate-release/SKILL.md

@@ -43,6 +43,8 @@ Require all of the following:
 - consistent public and OTA runtime versions across `app.json`, explicit
   `app.config.js` runtime, Android, and every iOS target
   (`scripts/set_version.mjs --check`);
+- `npm run release:preflight -w @sauci/mobile`, which also checks the iOS widget
+  effective build settings and OTA certificate archive inclusion;
 - Node 20, JDK 17 for Android, and Xcode/CocoaPods for iOS;
 - the configured production API/Auth/RevenueCat environment, without printing
   secret values.
@@ -84,6 +86,15 @@ Build from the clean prepared source using the package scripts in
 versioned artifact directory. When building both platforms, build Android first,
 then iOS.
 
+For local EAS, retain the working directory and logs under a stable ignored path,
+set `EAS_LOCAL_BUILD_ARTIFACTS_DIR`, and preflight available disk space before
+starting. Set `EAS_LOCAL_BUILD_PLUGIN_PATH` only to the matching plugin
+executable `bin/run`, never a package directory or a hardcoded cache location.
+Classify plugin, archive, npm, and ENOSPC failures as pre-compilation failures;
+repair and preflight them without spending another build. Make at most one
+meaningful build for each newly proven input state. After a signing, profile, or
+capability failure, read back and prove the provider correction before rebuilding.
+
 After each build:
 
 1. Inspect the worktree before doing anything else. Accept only the documented
@@ -92,15 +103,19 @@ After each build:
    dependency, or native-project regeneration as a failed build.
 2. Independently inspect the binary for package/bundle identifier, public
    version, platform build number, production endpoint configuration where
-   inspectable, and signing identity/fingerprint. Require the embedded public
-   version to equal the requested version.
+   inspectable, signing identity/fingerprint, OTA runtime/channel/certificate,
+   and SHA-256. Require the embedded public version to equal the requested
+   version. For Android, also inspect all required ABIs, Worklets/Reanimated/Skia
+   libraries, and the release permissions. For iOS, inspect every packaged
+   extension after export.
 3. Record the verified platform build number in the new release-note entry.
 4. Commit only the expected metadata and release-note update as
    `chore(<platform>): record v<version> build <number>`. The worktree must be
    clean before starting the next platform build.
 
-Do not accept a successful EAS exit code as proof of a valid artifact. If either
-requested platform fails, do not tag a partial release.
+Do not accept a successful EAS exit code as proof of a valid artifact. Quarantine
+or remove rejected artifacts so only accepted paths can be offered for upload. If
+either requested platform fails, do not tag a partial release.
 
 ## Tag and prove the result
 

.codex/skills/release-mobile/SKILL.md

@@ -52,6 +52,25 @@ verified EAS version metadata. Sauci tracks its native iOS and Android projects,
 so routine release builds must package those checked-in sources. Do not run
 `expo prebuild` first; native regeneration is a separate reviewed change.
 
+Run `npm run release:preflight -w @sauci/mobile` before allocating an EAS build.
+It rejects inconsistent public/runtime versions, an iOS widget build-setting
+override, and a public OTA certificate that would be omitted from the archive.
+For a local EAS build, also run `npm run release:preflight:local-eas -w
+@sauci/mobile` after setting `EAS_LOCAL_BUILD_PLUGIN_PATH` to the matching
+plugin's executable `bin/run`. Do not point it at the package directory or
+hardcode a machine-local cache path.
+
+Classify a failure before rebuilding. Archive, plugin-spawn, package-install, and
+disk-space failures happen before native compilation and must be repaired and
+preflighted without consuming another build. After a signing, profile, or
+capability failure, read back the provider state and prove only the affected
+input changed before rebuilding. Retain the EAS work directory, command log, and
+stable artifact path for every meaningful attempt. Never retry an ambiguous
+upload.
+
+Report provider progress by phase: packaging, native compilation, submission
+queue, or store processing. Do not describe every failure as a rebuild.
+
 Use the package scripts in `apps/mobile/package.json` to build artifacts and the
 Fastlane lanes in `apps/mobile/fastlane/Fastfile` to upload, submit, and roll
 out.
@@ -83,6 +102,11 @@ submission, and rollout without requesting further confirmation.
   when used, pass explicit `--platform`, `--profile production`, `--path`, and
   `--wait` — never `--latest`.
 
+App Store Connect API group association does not establish the automatic-
+distribution switch. Verify that switch in an authenticated App Store Connect UI
+session before upload; if that UI verification is unavailable, stop rather
+than inferring the distribution effect from API data.
+
 If an upload or submission command returns an ambiguous result, inspect EAS and
 the store before doing anything else; do not retry blind. After submission, read
 back the store state (Play Console track status / App Store Connect version
@@ -97,3 +121,27 @@ warnings as diagnostic evidence, not the final artifact state: decide whether to
 reject or rebuild only after reading the exported IPA itself. Report the
 artifact, version/build number, upload and submission results, rollout state,
 and store read-back state.
+
+For Android, verify the accepted AAB has all four required ABIs, the Worklets,
+Reanimated, and Skia native libraries, no broad `READ_MEDIA_IMAGES` or
+`READ_MEDIA_VIDEO` permissions, and the production OTA runtime, channel, and
+public certificate. For iOS, verify the exported IPA, not archive warnings, and
+check both the containing app and every extension.
+
+For the Android native dependency ordering already tracked in Gradle, preserve
+the explicit task dependency that makes Prefab inputs available before dependent
+native tasks. Fix task validation with ordering, not Firebase removal or
+dependency-version roulette.
+
+After Android upload, EAS Submit `FINISHED`, the exact internal/DRAFT/no-rollout
+submit configuration, and the retained artifact digest are the available
+authoritative read-back when a direct Play track read would require creating an
+edit. Never create an edit merely to claim read-only verification.
+
+For a checked-in iOS entitlement, inspect the real Apple App ID capability state
+before a signing rebuild. The capability sync bug tracked in
+https://github.com/expo/eas-cli/issues/3986 can report success while Apple
+rejects a malformed update. Read back Associated Domains, regenerate only the
+affected profile, and decode that profile to prove the entitlement before
+rebuilding. Noninteractive managed App Store Connect key auth may require
+`EXPO_APPLE_TEAM_ID`; preserve certificates and unrelated target profiles.