fix: harden bounded state sidecars

N-05: the conditional-validator key was a colon join over components that may
themselves contain colons, so two distinct valid bindings could collide and one
definition's ETag could be prepared for another. The key is now a validated,
byte-bounded fixed tuple encoded with JSON.stringify.

N-09: capture localStorage exactly once and compare StorageEvent.storageArea
against that object identity, so a pulse from sessionStorage or any other area
is rejected instead of matching on key and value alone. The pulse key is
registered in the storage registry as CACHE_INVALIDATION_PULSE.

N-10: race loadPage against the caller signal and re-check before observing a
page, so a non-cooperative loader can neither hold loadAll forever nor have a
post-abort completion accumulated into a successful result.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/adapters/query-cache/conditional-validator-store.ts

@@ -32,6 +32,26 @@ type ValidatorRow = {
   generation: number;
 };
 
+type ConditionalValidatorKeyTuple = readonly [
+  scopeFingerprint: string,
+  definitionId: string,
+  identityToken: string,
+  representationVersion: number,
+];
+
+/** The store is a trust boundary, so key components are validated and bounded. */
+const MAX_KEY_COMPONENT_BYTES = 512;
+const KEY_COMPONENT_ENCODER = new TextEncoder();
+
+function isBoundedKeyComponent(value: unknown): value is string {
+  return (
+    typeof value === "string" &&
+    value.length > 0 &&
+    KEY_COMPONENT_ENCODER.encode(value).byteLength <=
+      MAX_KEY_COMPONENT_BYTES
+  );
+}
+
 export function createConditionalValidatorStore(
   maxEntries = 1_024,
 ): ConditionalValidatorStore {
@@ -40,22 +60,31 @@ export function createConditionalValidatorStore(
   }
   const rows = new Map<string, ValidatorRow>();
 
+  /**
+   * N-05. A delimiter join is not injective here: `definitionId`,
+   * `identityToken` and the scope fingerprint may all contain the delimiter, so
+   * two distinct valid bindings could encode to the same key and one
+   * definition's ETag could be sent for another. The key is a validated fixed
+   * tuple encoded with `JSON.stringify`, which escapes the separators.
+   */
   function key(binding: ConditionalValidatorBinding): string | null {
     if (
       !binding.scope.isCurrent() ||
-      !binding.definitionId ||
+      !isBoundedKeyComponent(binding.scope.fingerprint) ||
+      !isBoundedKeyComponent(binding.definitionId) ||
       !/^[A-Za-z0-9._:-]{16,128}$/.test(binding.identityToken) ||
       !Number.isSafeInteger(binding.representationVersion) ||
       binding.representationVersion < 1
     ) {
       return null;
     }
-    return [
+    const tuple: ConditionalValidatorKeyTuple = [
       binding.scope.fingerprint,
       binding.definitionId,
       binding.identityToken,
       binding.representationVersion,
-    ].join(":");
+    ];
+    return JSON.stringify(tuple);
   }
 
   return Object.freeze({