Merge remote-tracking branch 'origin/master' into ci/prefetch-electron-binary

# Conflicts:
#	.github/workflows/ci.yml

.github/workflows/ci.yml

@@ -130,6 +130,10 @@ jobs:
         name: Initial bytes ratchet
         runs-on: ubuntu-latest
         timeout-minutes: 30
+        # pull-requests: read lets the direction check read the PR's labels.
+        permissions:
+            contents: read
+            pull-requests: read
 
         steps:
             - name: Checkout code
@@ -153,12 +157,24 @@ jobs:
             # the revision this one is measured against instead: the target
             # branch for a pull request, the previous head for a master push,
             # master for a manual dispatch. Any raised limit, widened tolerance
-            # or removed entry fails.
+            # or slack, or removed entry fails, unless a maintainer put the
+            # perf-baseline-increase label on the pull request. For a master
+            # push the label counts only when the push added exactly one
+            # first-parent commit (a squash or merge of one PR) and that
+            # commit's PR carries it: the check compares the whole push, so a
+            # multi-commit push cannot borrow one PR's label for another's
+            # increase. Labels are read from the API, not the event payload,
+            # so re-running this job after adding the label picks it up.
             - name: Refuse baseline increases against the previous revision
               env:
                   EVENT_NAME: ${{ github.event_name }}
                   BASE_REF: ${{ github.base_ref }}
                   BEFORE_SHA: ${{ github.event.before }}
+                  HEAD_SHA: ${{ github.sha }}
+                  PR_NUMBER: ${{ github.event.pull_request.number }}
+                  REPOSITORY: ${{ github.repository }}
+                  GH_TOKEN: ${{ github.token }}
+                  INCREASE_LABEL: perf-baseline-increase
               run: |
                   set -euo pipefail
                   case "$EVENT_NAME" in
@@ -178,9 +194,32 @@ jobs:
                   esac
                   git show "FETCH_HEAD:tools/performance/journey-baselines.json" > /tmp/base-journey-baselines.json 2>/dev/null ||
                       rm -f /tmp/base-journey-baselines.json
+                  case "$EVENT_NAME" in
+                      pull_request)
+                          labels="$(gh api "repos/$REPOSITORY/issues/$PR_NUMBER/labels?per_page=100" --paginate --jq '.[].name')"
+                          ;;
+                      push)
+                          parent="$(gh api "repos/$REPOSITORY/commits/$HEAD_SHA" --jq '.parents[0].sha')"
+                          if [ "$parent" = "$BEFORE_SHA" ]; then
+                              labels="$(gh api "repos/$REPOSITORY/commits/$HEAD_SHA/pulls?per_page=100" --paginate --jq '.[].labels[].name')"
+                          else
+                              echo "This push added more than one commit; the $INCREASE_LABEL label is not consulted."
+                              labels=""
+                          fi
+                          ;;
+                      *)
+                          labels=""
+                          ;;
+                  esac
+                  allow=()
+                  if grep -qxF "$INCREASE_LABEL" <<< "$labels"; then
+                      echo "The $INCREASE_LABEL label is set; weakened baselines are reported, not failed."
+                      allow=(--allow-increase)
+                  fi
                   node tools/performance/check-baseline-direction.mjs \
                       --base /tmp/base-journey-baselines.json \
-                      --head tools/performance/journey-baselines.json
+                      --head tools/performance/journey-baselines.json \
+                      "${allow[@]}"
 
             # The production configuration is what users download; measuring
             # any other build would ratchet a number nobody ships.
@@ -190,8 +229,8 @@ jobs:
                   CI: true
                   NX_TASKS_RUNNER_DYNAMIC_OUTPUT: false
 
-            # Fails when renderer.initialBytes exceeds the value committed in
-            # tools/performance/journey-baselines.json. Baselines only move
+            # Fails when renderer.initialBytes exceeds value + slack committed
+            # in tools/performance/journey-baselines.json. Baselines only move
             # down, with the printed measurement as evidence; the contract is
             # docs/architecture/performance-journeys.md.
             - name: Check renderer.initialBytes against the baseline
@@ -427,16 +466,17 @@ jobs:
                       --paginate --jq '.[] | .filename, (.previous_filename // empty)' |
                       node tools/coverage/unit-coverage-scope.mjs --base FETCH_HEAD --github-output
 
-            # pnpm skips Electron's postinstall (it is not in
-            # onlyBuiltDependencies), so the binary is fetched on the first
-            # require('electron'). Specs that run SQLite under
-            # ELECTRON_RUN_AS_NODE resolve it that way while Tier A projects
-            # run concurrently, and one exec'ing it mid-extraction fails with
-            # ETXTBSY. Download and verify it once, before any test starts;
-            # the Tier A runner does the same, so this step only separates a
-            # download failure from test failures. Skipped suites need no
-            # binary.
-            - name: Download Electron binary
+            # pnpm only runs build scripts for allow-listed packages
+            # (pnpm-workspace.yaml), so electron's postinstall never fetches
+            # its binary. `require('electron')` then downloads it lazily, and
+            # parallel Jest workers and Tier A projects that spawn Electron
+            # race on the same download: one executes the half-written binary
+            # (ETXTBSY). Fetch it once before the Tier A suite, the only step
+            # here whose specs spawn Electron. Unlike a bare install.js, the
+            # helper also runs the binary, so a partial extraction fails here.
+            # The Tier A runner calls it too; this step only separates a
+            # download failure from test failures.
+            - name: Install the Electron binary
               if: steps.scope.outputs.run == 'true'
               run: node tools/testing/ensure-electron-binary.mjs