fix: harden bounded state sidecars

N-05: the conditional-validator key was a colon join over components that may
themselves contain colons, so two distinct valid bindings could collide and one
definition's ETag could be prepared for another. The key is now a validated,
byte-bounded fixed tuple encoded with JSON.stringify.

N-09: capture localStorage exactly once and compare StorageEvent.storageArea
against that object identity, so a pulse from sessionStorage or any other area
is rejected instead of matching on key and value alone. The pulse key is
registered in the storage registry as CACHE_INVALIDATION_PULSE.

N-10: race loadPage against the caller signal and re-check before observing a
page, so a non-cooperative loader can neither hold loadAll forever nor have a
post-abort completion accumulated into a successful result.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/adapters/query-cache/cursor-pagination-runtime.ts

@@ -6,6 +6,36 @@ import type {
 } from "../../contracts/cursor-pagination.ts";
 import { createFailure } from "../../contracts/errors.ts";
 
+const ABORTED = Symbol("PAGINATION_ABORTED");
+
+/**
+ * Resolves as soon as the operation settles or the signal aborts, whichever
+ * comes first. A late operation result is observed and discarded, never thrown
+ * as an unhandled rejection.
+ */
+async function raceAbort<Value>(
+  operation: Promise<Value>,
+  signal: AbortSignal | undefined,
+): Promise<Value | typeof ABORTED> {
+  operation.catch(() => {});
+  if (!signal) return await operation;
+  if (signal.aborted) return ABORTED;
+  return await new Promise<Value | typeof ABORTED>((resolve) => {
+    const onAbort = () => resolve(ABORTED);
+    signal.addEventListener("abort", onAbort, { once: true });
+    operation.then(
+      (value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      },
+      () => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(ABORTED);
+      },
+    );
+  });
+}
+
 export function createCursorPaginationRuntime<Value>(dependencies: Readonly<{
   definitionId: string;
   profile: CursorPaginationProfile;
@@ -29,9 +59,21 @@ export function createCursorPaginationRuntime<Value>(dependencies: Readonly<{
         if (context.signal?.aborted) {
           return failure("REQUEST_ABORTED", "PAGINATION_ABORTED");
         }
-        const result = await dependencies.loadPage(cursor, context);
+        // N-10. A non-cooperative loader may never settle, or may settle after
+        // abort. Race the signal so `loadAll` is bounded, and re-check before
+        // observing the page so a late completion is ignored rather than
+        // accumulated into a successful result.
+        const raced: Result<CursorPage<Value>> | typeof ABORTED =
+          await raceAbort<Result<CursorPage<Value>>>(
+            dependencies.loadPage(cursor, context),
+            context.signal,
+          );
+        if (raced === ABORTED || context.signal?.aborted) {
+          return failure("REQUEST_ABORTED", "PAGINATION_ABORTED");
+        }
+        const result: Result<CursorPage<Value>> = raced;
         if (!result.ok) return result;
-        const page = result.value;
+        const page: CursorPage<Value> = result.value;
         if (!isValidPage(page, dependencies.profile)) {
           return failure(
             "PAGINATION_CONTRACT_VIOLATION",
@@ -57,7 +99,7 @@ export function createCursorPaginationRuntime<Value>(dependencies: Readonly<{
           );
         }
         if (!page.hasMore) return { ok: true, value: Object.freeze(items) };
-        const nextCursor = page.nextCursor;
+        const nextCursor: string | null = page.nextCursor;
         if (!nextCursor || cursors.has(nextCursor)) {
           return failure(
             "PAGINATION_CONTRACT_VIOLATION",