Replace the three generic developer-oriented icons with mockup-faithful
custom SVGs (folder / bar-chart / pencil) tinted per Skill (warm orange
/ success green / violet) via semantic design tokens plus one arbitrary
hex for violet since no violet token exists in the design system.

Card visual switches from vertical card with description text to inline
pill (icon + title side by side, no description), matching the mockup's
light button style. Neutral chip border at rest, lifted border on hover.
Click behavior unchanged.

Home shell layout refines to match the #151 mockup: shift content down
via pt-[28vh], compact title→subtitle→pills rhythm, restore subtitle
with new copy "PawWork 可以帮你处理文件、分析信息、撰写内容并完成各类任务。"
and its English counterpart.

The upstream Icon component is kept in sidebar-items.tsx for the skill
badge (falls back to folder / status / pencil-line), so badge icons
differ from home for data-analysis during the PR #1 → PR #2 interval;
PR #2 removes the badge entirely.

Refs #151 (PR #1 commit 2 of 2).

Replace the three generic developer-oriented icons with mockup-faithful
custom SVGs (folder / bar-chart / pencil) tinted per Skill (warm orange
/ success green / violet) via semantic design tokens plus one arbitrary
hex for violet since no violet token exists in the design system.

Card visual switches from vertical card with description text to inline
pill (icon + title side by side, no description), matching the mockup's
light button style. Neutral chip border at rest, lifted border on hover.
Click behavior unchanged.

Home shell layout refines to match the #151 mockup: shift content down
via pt-[28vh], compact title→subtitle→pills rhythm, restore subtitle
with new copy "PawWork 可以帮你处理文件、分析信息、撰写内容并完成各类任务。"
and its English counterpart.

The upstream Icon component is kept in sidebar-items.tsx for the skill
badge (falls back to folder / status / pencil-line), so badge icons
differ from home for data-analysis during the PR #1 → PR #2 interval;
PR #2 removes the badge entirely.

Refs #151 (PR #1 commit 2 of 2).

…428)

Issue #428: SessionTurn used `findLast` over assistant messages, so any user prompt that triggered multiple assistant rounds (compaction, tool retries, multi-tool plans) silently lost earlier file changes from the Changes block. Users could no longer review or undo most of what the agent had written. This PR aggregates every assistant message that shares `parentID === userMessageID` into one turn-level Changes block with a single Undo / Reapply control.

## Backend (packages/opencode)

- `RESTORE_LIMIT` raised from 2 MB to 20 MB so multi-step edits in one user turn fit in the restore table; the 2 MB display window still gates the diff panel.
- `aggregateTurnInternal` collects all assistant messages under the same userMessageID, collapses RestoreRow entries by absolute path (preserving first-seen `before`, taking last-seen `after`), and runs a second-pass `disambiguateAggregatedRestoreFiles` so two sibling assistants editing different opaque external paths sharing a basename do not collide on the same `displayPath` (e.g. `/tmp/a/config.json` and `/tmp/b/config.json` become `config.json` and `config.json · external #2`).
- `preflightTurn` chains a virtual-disk state map across messages so chained same-file edits across two assistants no longer false-conflict; classifies per-message blocked items into three tiers matching single-message `mutate()` (`permission_denied` > `unsupported_size` > `conflict`); returns fatal `unsupported_size` immediately when any target state is non-restorable, so an aggregated undo/redo with one oversized/binary file blocks the whole turn instead of partially mutating sibling assistants under `force=true`.
- `mutateTurn` runs preflight first; with `force=false` returns `blocked` on any skip, with `force=true` skips the conflicting message, mid-loop rollbacks completed messages on a per-iteration write failure, and reports `mutatedPaths` (only paths actually written) plus `skipped[]`. Rollback failures surface as a dedicated `rollback_failed` reason rather than being collapsed into `write_failed`.
- New HTTP routes: `GET /session/:sessionID/turn/:userMessageID/changes`, `POST .../changes/undo`, `POST .../changes/redo` with `{ force: boolean }` body. `publishTurnChangeFiles` filters to `mutatedPaths` so File events only fire for paths that were really touched.
- White-busy filter: files created and then deleted within the same turn drop out of the aggregated display so they never reach the user as a phantom change.
- Mixed-state turn (one assistant applied, another undone) keeps both Undo and Reapply available; intentional single-button choice documented inline.

## Frontend (packages/app, packages/ui)

- `SessionTurn` no longer uses `findLast`. The Changes block renders the aggregated `display.files` with one Undo / Reapply button, an additions/deletions summary, and per-file status. Status badge for fully undone turns and a Reapply control are new.
- New helper module `turn-change-fetch.ts` plus `turn-change-fetch.test.ts` derive the fetch signature and target list from completed assistant siblings, so the timeline re-fetches when a new sibling assistant under the same parent completes.
- Conflict path: when preflight returns `blocked` with `reason: "conflict"`, a Kobalte Dialog confirms with the user, lists the skipped paths in a tinted bordered panel (`+N more` overflow label localized via `ui.sessionTurn.turnChanges.confirmListMore` in en + zh), and re-issues the request with `force=true`. A yellow skipped notice on the bottom of the Changes block surfaces partial-skip outcomes after a force apply.
- Trailing icons (open file / show in folder) now have `<Tooltip>` wrappers; Changes panel rows tightened (header 48 -> 36, action 28 -> 24, row 44 -> 32, chevron 24 -> 20) to fit denser turns without scrolling.
- Retry hardening: a 500 ms re-fetch on initial empty response, plus a `createEffect(on(sessionID, ...))` that cancels pending retry timers and clears `fetchedTurnChanges` when the active session changes, so a stale retry queued under the previous session cannot land on a freshly opened one.
- Marks the message dirty when rollback blocks with no files so the UI does not stay in a stuck loading state.
- English copy polished for `session.turnChange.blocked.*`: contractions, jargon removed, references the user's brand name.

## Tests

New regression coverage in `turn-change-aggregate.test.ts` and `turn-change-aggregate-routes.test.ts`:

- collapse two assistants editing different files into one display
- collapse same-file edits across two assistants into single net diff
- white-busy file (created then deleted) filtered out
- ignore assistant messages with a different parent
- undo / redo all assistant changes in a turn
- block whole turn on conflict by default; `force=true` reports `skipped[]`
- chained same-file edits undo cleanly without false conflict
- two assistants editing different absolute paths sharing a basename do not merge
- opaque external basenames from sibling assistants disambiguate after aggregation
- mixed-state turn keeps both undo and redo available
- `aggregateTurnUndo` reports `mutatedPaths` only for messages actually written
- preflight returns fatal `unsupported_size` when any assistant has an unrestorable target (both `force=false` and `force=true`)
- `MutationResultSchema` accepts `rollback_failed` as a blocked reason

Plus existing `turn-change.test.ts` extended for the new restore-limit boundaries (medium and huge file states).

## Verification

- typecheck across 9 packages (tsgo): green
- packages/opencode session + server tests: 594 passed / 4 skipped / 1 todo / 0 failed across 44 files
- Manual UI verification (Electron): two-assistant turn with three files (one shared), tampered-file conflict path, force-apply skipped notice
- Two rounds of crosscheck (Claude Opus + Codex), one round of CodeRabbit review (4 inline comments addressed)

## Risk Notes

- 20 MB per-file restore quota grows the SQLite turn-change tables for sessions with very large edits; existing per-message rows still apply, no migration.
- Aggregate route is additive; legacy single-message `/turn-change/:messageID/{undo,redo}` endpoints unchanged.
- Force-undo with conflicts is now a partial operation; the UI renders a skipped notice and File events only fire for `mutatedPaths`.

Closes #428.

…ssue #440)

Slice #1 of eleven. Establishes the semantic token foundation for all subsequent
PawWork UI component slices (#2–#11). This is a permanent carve-out from upstream
opencode — see AGENTS.md §Upstream Sync and .gitattributes.

## What changed

- theme.css: full rewrite against PawWork STANDARDS (warm neutrals, brand orange
  #ff5910, 13px dense, system-font). Three-selector structure:
    :root (light) → [data-color-scheme="dark"] (authoritative dark) → @media mirror
  Fixes a latent upstream bug: @media-only meant the Settings toggle had no effect.

- pawwork.json: rewritten to STANDARDS values with new token names.

- colors.txt → tailwind/colors.css: 104 tokens (incl. legacy compat aliases);
  regenerated Tailwind --color-* bridge via script/tailwind.ts.

- 50+ token renames across 144 component files in packages/ui/src and packages/app/src.

- HTML entry files (app/index.html, desktop-electron renderer/*.html): updated to
  var(--bg-base) and synced theme-color meta. Now in .gitattributes carve-out.

- UNREGULATED section in theme.css: holds legacy compat aliases (button-brand-*,
  icon-success-base, icon-info-base, icon-on-interactive-base, surface-base-active)
  so existing component consumers stay styled without entering STANDARDS managed set.

- .gitattributes: added merge=pawwork-keep-ours driver entries for packages/ui/**
  and key packages/app paths. Driver must be registered per-clone:
    git config merge.pawwork-keep-ours.driver "true"
  Verify before upstream sync: bash packages/ui/script/verify-merge-driver.sh

## Tests added

- packages/ui/test/theme-parity.test.ts (128 assertions, 0 fail):
  light root ↔ pawwork.json light.overrides, dark block ↔ dark.overrides,
  dark completeness (SAME_IN_DARK set), @media mirror exact-match, and two
  runtime-critical non-regulated token assertions (--text-mix-blend-mode: plus-lighter).

- packages/ui/test/undefined-tokens.test.ts:
  Scans every var(--xxx) in theme.css, Tailwind bridge, and HTML entry files;
  asserts each resolves to a definition.

## Deferred to slice #2

- colors.txt ↔ colors.css generation consistency test (manual regen + review for now)
- TSX/class utility audit (old token utility names, misspelled utilities)
- --surface-base-active classification (state token vs. compat bridge)
- Legacy runtime token deprecation checklist

## Key decisions for future agents

1. [data-color-scheme="dark"] is authoritative. @media block is mirror-only (first-paint).
   Both must stay in sync — theme-parity.test.ts enforces this.
2. UNREGULATED section in theme.css is intentional scope. Tokens there are consumed by
   components but not STANDARDS-managed. Do not promote to regulated without adding to
   pawwork.json and updating the parity test.
3. The merge driver only fires on two-sided conflicts. One-sided upstream changes still
   clean-merge. Always review upstream-sync PR diffs for carve-out paths.
4. colors.css is a generated file (do not hand-edit). Regen: bun run script/tailwind.ts.

…ssue #440)

Slice #1 of eleven. Establishes the semantic token foundation for all subsequent
PawWork UI component slices (#2–#11). This is a permanent carve-out from upstream
opencode — see AGENTS.md §Upstream Sync and .gitattributes.

## What changed

- theme.css: full rewrite against PawWork STANDARDS (warm neutrals, brand orange
  #ff5910, 13px dense, system-font). Three-selector structure:
    :root (light) → [data-color-scheme="dark"] (authoritative dark) → @media mirror
  Fixes a latent upstream bug: @media-only meant the Settings toggle had no effect.

- pawwork.json: rewritten to STANDARDS values with new token names.

- colors.txt → tailwind/colors.css: 104 tokens (incl. legacy compat aliases);
  regenerated Tailwind --color-* bridge via script/tailwind.ts.

- 50+ token renames across 144 component files in packages/ui/src and packages/app/src.

- HTML entry files (app/index.html, desktop-electron renderer/*.html): updated to
  var(--bg-base) and synced theme-color meta. Now in .gitattributes carve-out.

- UNREGULATED section in theme.css: holds legacy compat aliases (button-brand-*,
  icon-success-base, icon-info-base, icon-on-interactive-base, surface-base-active)
  so existing component consumers stay styled without entering STANDARDS managed set.

- .gitattributes: added merge=pawwork-keep-ours driver entries for packages/ui/**
  and key packages/app paths. Driver must be registered per-clone:
    git config merge.pawwork-keep-ours.driver "true"
  Verify before upstream sync: bash packages/ui/script/verify-merge-driver.sh

## Tests added

- packages/ui/test/theme-parity.test.ts (128 assertions, 0 fail):
  light root ↔ pawwork.json light.overrides, dark block ↔ dark.overrides,
  dark completeness (SAME_IN_DARK set), @media mirror exact-match, and two
  runtime-critical non-regulated token assertions (--text-mix-blend-mode: plus-lighter).

- packages/ui/test/undefined-tokens.test.ts:
  Scans every var(--xxx) in theme.css, Tailwind bridge, and HTML entry files;
  asserts each resolves to a definition.

## Deferred to slice #2

- colors.txt ↔ colors.css generation consistency test (manual regen + review for now)
- TSX/class utility audit (old token utility names, misspelled utilities)
- --surface-base-active classification (state token vs. compat bridge)
- Legacy runtime token deprecation checklist

## Key decisions for future agents

1. [data-color-scheme="dark"] is authoritative. @media block is mirror-only (first-paint).
   Both must stay in sync — theme-parity.test.ts enforces this.
2. UNREGULATED section in theme.css is intentional scope. Tokens there are consumed by
   components but not STANDARDS-managed. Do not promote to regulated without adding to
   pawwork.json and updating the parity test.
3. The merge driver only fires on two-sided conflicts. One-sided upstream changes still
   clean-merge. Always review upstream-sync PR diffs for carve-out paths.
4. colors.css is a generated file (do not hand-edit). Regen: bun run script/tailwind.ts.

…#2, issue #440) (#448)

## Slice 02 of issue #440 — token housekeeping, typography wiring, icon CSS, colors-generation test

**Commits squashed (7):**
- refactor(ui): add icon color state selectors and document size tiers
- refactor(ui): replace inline font-size literals with font-size tokens
- refactor(ui): remove shadow/blend tokens from Tailwind --color-* namespace
- refactor(ui): promote --surface-base-active to REGULATED token section
- test(ui): add colors.txt ↔ colors.css generation consistency check
- test(ui): align colors-generation parser with generator script
- test(ui): add duplicate-token guard to colors-generation test

**Why:**
- Icon CSS now declares `[data-color]` state selectors for strong/weak/disabled; size tiers (small/normal/medium/large) documented in comment
- All inline `font-size` px literals in component CSS replaced with `var(--font-size-*)` tokens; establishes consistent token dependency chain
- Shadow, blend, and overlay tokens removed from `--color-*` Tailwind namespace — those utilities were never used and conflated design-token categories
- `--surface-base-active` moved from ad-hoc section to REGULATED block so downstream color-generation tests can pick it up
- New bidirectional consistency test (colors.txt ↔ tailwind/colors.css) catches stale generated artifacts; parser aligned with generator logic (`split(":")[0].trim().substring(2)`) and token-name charset relaxed to `[^\s:]+` to handle non-kebab names; duplicate-token guards added to prevent silent Set-dedup masking

**Key decisions:**
- Parser uses same `split(":")[0]` approach as `script/tailwind.ts` — not a regex — so any future token-name character additions are automatically handled
- `indexOf`-based dedup check preferred over frequency-map approach: simpler and directly catches the actual failure mode (duplicate in one file)
- Desktop-smoke runner flake (11+ min stuck run) diagnosed as GitHub macOS runner congestion, not a code regression; rerun passed in 2m54s

AstroHan W1 second retest #2: the dark user bubble was "看不清". Token
math confirms the regression — `--bg-cream` (#211d19) on `--bg-base`
(#1a1714) leaves only ~5 RGB of delta, which sits right at the edge of
human perception at low luminance (Weber's law: the same delta that
reads cleanly between #FAF9F7 and #FFFFFF in light becomes inscrutable
in dark). Light stays on cream because the high-luminance side has
plenty of edge sensitivity.

The smallest impeccable fix: in dark only, lift the bubble shell one
tier to `--surface-raised` (#2a2622, Δ ~14 RGB vs `--bg-base`). The
warm-coffee hue family is preserved — surface-raised is literally the
next step up from cream in the same dark palette — so the bubble keeps
reading as part of the "your input" surface family. The prompt-input
gradient already lands at this tier, so the bubble + composer link
DESIGN.md L460 references stays intact in spirit (the composer fades
into surface-raised at its top edge in dark mode).

Cream stays canonical in light; the override is scoped to
`session-turn-user-bubble [data-slot="bubble"]` only — code blocks,
input fills, sheets, and other cream-using surfaces are untouched.

AstroHan's third W1 retest (msg=362e9b72) raised two visual issues
on the trow block; both land in `session-turn-trow-block.css`.

**#2 — per-tool box wrapper.** Slice 11b.1 #5 B+ added a transparent
+ 1px --border-weaker frame around each tool's rich body
(`data-slot="trow-result-body"`) as the L417-spec scope marker.
AstroHan reported the chrome makes tools look like isolated cards
and (when bash is expanded) stacks on top of bash-output's own
border. The W1 intent is a flat stacked feed where tools 叠在一起.
The wrapper stays — it is still the scope boundary for the inner
chrome typography reset — but its visual chrome (border / radius /
padding) is removed.

**#4 — chev direction + inner tool chev size.** Two parts:

  (a) Trow summary chev direction. The third retest re-defined the
      affordance: 折叠朝右、展开朝下. The second-retest fix that
      pointed the chev up on `details[open]` is reverted —
      file-tree, Collapsible, and the W1 mocks all use down-when-
      open, so trow should match. Default `transform: rotate(-90deg)`
      (chevron-down → right when collapsed); `details[open]` flips to
      `rotate(0)` (natural down).

  (b) Inner Collapsible.Arrow chev size inside the trow result body.
      AstroHan flagged that the chev inside each tool trigger ("执行
      命令 XXXX" row) renders as a "大 chevron" — Collapsible's default
      is 16px, but the W1 caption surface (DESIGN.md L412 lock) caps
      the chev at 12px. Scoped reset fires only inside
      `[data-slot="trow-result-body"]`, so the Collapsible default
      elsewhere (file-tree, settings, etc.) is unaffected.

… WebFetch parity

AstroHan's fourth W1 retest (msg=ac13481a) flagged three trow visuals.

**#1 — Missing expand/collapse animation.** The header comment on
`session-turn-trow-block.css` claimed `session-turn.css` owned the
`::details-content` rule, but it was never actually wired anywhere.
Add the rule (mirror of preview `message-flow.html` L13-23): height +
opacity transition gated by `prefers-reduced-motion: no-preference`,
with `transition-behavior: allow-discrete` covering the discrete
`content-visibility` step. The `:root { interpolate-size:
allow-keywords }` declaration in utilities.css is what lets
`height: 0` ↔ `height: auto` interpolate; the rule silently no-ops to
a snap without it. Inner Collapsible.Content gets a matching scoped
animation — Solid's `collapsible.css` ships its keyframes commented
out (L92-101), so without the override the per-tool body would snap
open. The scoped selector keeps the file-tree / settings Collapsibles
on their default behaviour.

**#2 — Tighter expanded body.** AstroHan reported the expanded trow
body felt too loose vs preview. `.mf-tlist` in
`docs/design/preview/message-flow.html` L199 locks gap at 6px between
sub-tool rows; trow-body now matches (was 8px).

**#3 — WebFetch layout parity.** WebFetch is the only tool that ships
a right-aligned `[data-component="tool-action"]` arrow inside its
trigger row (`message-part-tools-basic.tsx` L142). The other tools
use the plain `trigger={{ title, subtitle }}` object form, so they
already flow left without the action chrome. Suppress the action icon
only inside the trow result body — standalone WebFetch outside the
trow keeps the affordance.

…resize sync (#887)

Three connected fixes for the right-panel titlebar seam, reported post-release as a follow-up to #880. All three only become visible together: once the seam aligns, the toggle slide and the drag-resize lag become readable.

**Fix 1 — macOS seam alignment (8px)**
`padding-inline: 8px` → `padding-inline-start: 8px` on the macOS `[data-component="titlebar-shell"]` rule (`packages/app/src/index.css`). The symmetric 8px padding pushed the right rail 8px inboard of the viewport while the `<aside>` directly below reached the actual edge — `border-l`s ended up 8px apart on macOS only. Windows already correct.

**Fix 2 — Stable toggle position across open/close**
`#pawwork-titlebar-right` (`packages/app/src/components/titlebar.tsx`) changed from in-flow flex sibling of the tabs slot to absolute-positioned at the rail's top-right corner (`right-2` macOS / `right-0` Windows). PR #880's flex layout slid the toggle by `--right-panel-width` on a 240ms transition; that motion read as jarring once fix #1 aligned the seam.

**Fix 3 — Drag-resize seam sync**
New effect in `SessionSidePanel` mirrors `props.size.active()` to a `data-resizing-right-panel` attribute on `<desktop-shell>`; matching CSS rule in `index.css` disables the shell's transition while the attribute is present. During drag the body's inline `width` snapped per-pointermove while the shell's `--right-panel-width` kept its 240ms transition — the two sides of the seam moved at different speeds. Attribute-bridge avoids plumbing session-scope sizing state into the global layout context.

**Hardening from code review**
- P1 (toggle/+ collision risk): added `padding-right: 44px` reserve on `#pawwork-titlebar-tabs` when the rail is active (toggle 30 + `right-2` 8 + gap 4 + 2px buffer for Tabs.List `px-1`) so the no-collision contract no longer depends on Kobalte's Tabs.List rendering at content-width.
- P2 (attribute leak): effect now unconditionally `removeAttribute` first then re-evaluates, plus `onCleanup` clear. Closes leaks via `isDesktop()` flip, component unmount, and stale residue.
- P3 (test quality): tightened tolerance to 1px, replaced `waitForTimeout` with `expect.poll`, added `+` click test and a collision-guard that runtime-injects `width: 100% !important` on Tabs.List.
- Bot-review follow-up: x-axis seam test now polls for steady state (panel open/close runs a 240ms transition that the drag-only gate doesn't suppress); toggle test normalizes `aria-expanded` to false before sampling closed state.

**Regression tests** (`packages/app/e2e/session/titlebar-right-rail-contract.spec.ts`, 8 total)
- `border-l aligns horizontally with right-panel body` — pre-fix #1: `Received: 8`; post: passes
- `toggle keeps the same x-position across open/close` — pre-fix #2: `Received: 229.25`; post: <1px
- `+ add-tab button stays clickable and does not close the panel`
- `+ stays clickable even if Tabs.List is forced to fill the slot (collision guard)`
- `data-resizing-right-panel attribute does not leak when viewport drops below the desktop breakpoint mid-resize state`
- Plus 3 pre-existing tabs-rail contract tests

**Verification**
- `bun run test:e2e:local titlebar-right-rail-contract.spec.ts` → 8/8 pass
- `bun run snap right-panel-titlebar` → pass, no visual regression
- `bun run lint` → clean
- `bun --cwd packages/app run typecheck` → clean
- Manual Electron (macOS): toggle stable across open/close, drag-resize seam moves as one continuous line
- CI: 27/27 green

**Follow-up tracked separately**
- #889 — `session-side-panel.tsx` is 604 lines and growing; refactor scheduled in a dedicated PR.

**Risk notes**
- Fix #1 macOS-only; fixes #2 and #3 affect both platforms.
- Closed-state toggle inset changes from 16px to 8px on macOS, matching native toolbar conventions.
- Open-state 240ms toggle slide is removed; body width still animates as before.
- No `.github/workflows/` touched.

Rework README hero to lead with the BYOK + OAuth outbound frame.

Context: Day 1 of the 14-day 43→100★ outbound run. Master frame settled in shape interview is "Open-source alternative to Codex App and Claude Cowork. Bring your own key. Works with any model — including ChatGPT OAuth." Previous hero opened with the OpenCode Zen free plan, which buries the BYOK/OAuth differentiator that the English channels (claude-code / openai-codex issues, r/MacApps, r/electronjs, Awesome lists) actually respond to.

Changes:
- README.md: hero rewritten to lead with the alternative-to framing; second line states BYOK + ChatGPT OAuth as the entry path; first paragraph reframed around real desktop work (files, documents, spreadsheets, research, writing, code) and lists OpenAI, Claude, Gemini, DeepSeek, Kimi, GLM + 75+ providers including local. OpenCode Zen free plan kept in the "Less setup" bullet and the "Models, Plans, and Search" section, so users without an API key still see the onramp — just not in the hero. Cover image alt updated to match the new framing.
- README_CN.md: only narrowed "Claude Desktop" → "Claude Cowork" (Cowork is the actual competing product surface, bundled into Claude Desktop). Chinese hero intentionally keeps the OpenCode Zen onramp and 开箱即用 framing — the Chinese channels (小红书 / 知乎) lean onboarding-first, the English channels lean differentiation-first.
- .github/labeler.yml: added README.md / README_CN.md to the `app` rule. pr-triage requires a routing label (app / ui / platform / harness / ci) plus type + priority, and README-only PRs previously matched none of the routing globs, so pr-triage failed. Adding them to `app` is consistent with how README changes are framed (product surface). Side effect: this commit itself triggers full CI because labeler.yml is not in ci.yml's docs_only allowlist, which is fine — we want it covered by the routing rule for future README PRs.

Verification: full CI green on the final commit (typecheck, lint, unit-app/ui/opencode/desktop, smoke-macos-arm64, unit-windows-* matrix, CodeQL, dependency-review, dev-dep-audit, pr-triage, actionlint, frontend-architecture, e2e-artifacts). mergeStateStatus CLEAN, mergeable MERGEABLE.

Review follow-ups: Gemini bot left two inline comments — (1) hero comma-splice between "Bring your own key" and "Works with any model"; (2) first paragraph ambiguity between "OAuth via ChatGPT plan" and "API key path". Fix #1 split the line into two sentences keeping PawWork-as-subject semantics; fix #2 disambiguated by listing OpenAI explicitly in the API-key sentence so OAuth-vs-key paths read distinctly. Both threads replied inline and resolved via GraphQL resolveReviewThread.

Residual risk: documentation-only product copy + a labeler routing rule. No runtime, build, or release-path code changes. labeler.yml change is additive (extends `app` rule's glob list); no existing rule semantics are altered.