chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/adapters/service-worker/service-worker-static-assets.ts

@@ -149,6 +149,19 @@ export async function installStaticAssets(
 
   if (outcome.kind === "REJECTED") {
     await dependencies.caches.delete(cacheName).catch(() => false);
+    // SW-09. A non-cooperative fetch, digest or `cache.put` started before the
+    // deadline cannot be cancelled, so it may recreate the candidate cache
+    // after that delete. The public result already closed at the deadline; a
+    // second exact delete is registered once the abandoned work settles. It is
+    // deliberately not awaited, so the public bound is not extended.
+    if (deadlineExceeded) {
+      void installation
+        .catch(() => undefined)
+        .then(async () => {
+          await dependencies.caches.delete(cacheName).catch(() => false);
+        })
+        .catch(() => undefined);
+    }
   }
   return outcome;
 }
@@ -173,6 +186,11 @@ async function installCandidate(
   const worker = async (): Promise<void> => {
     for (;;) {
       if (failure) return;
+      // SW-09. Once fenced, no new candidate work is started.
+      if (signal.aborted) {
+        failure ??= rejected("INSTALL_DEADLINE_EXCEEDED");
+        return;
+      }
       const asset = queue.shift();
       if (!asset) return;
       const outcome = await storeAsset(asset, cache, dependencies, signal);
@@ -205,15 +223,22 @@ async function storeAsset(
   if (signal.aborted) return rejected("FETCH_FAILED");
   let response: Response;
   try {
-    const fetched = await abortable(
-      dependencies.fetcher(asset.url, {
-        cache: "no-store",
-        credentials: "omit",
-        redirect: "error",
-        signal,
-      }),
+    // SW-09. A non-cooperative fetch that ignores the signal still settles
+    // later; its body is compensated so an abandoned response is not left open.
+    const pending = dependencies.fetcher(asset.url, {
+      cache: "no-store",
+      credentials: "omit",
+      redirect: "error",
       signal,
-    );
+    });
+    const fetched = await abortable(pending, signal);
+    if (fetched === ABORTED) {
+      void pending
+        .then(async (late) => {
+          await late.body?.cancel();
+        })
+        .catch(() => undefined);
+    }
     if (fetched === ABORTED) return rejected("FETCH_FAILED");
     response = fetched;
   } catch {
@@ -234,7 +259,17 @@ async function storeAsset(
   if (!body.ok) return rejected(body.code);
   const bytes = body.bytes;
 
-  const digest = await abortable(dependencies.digest(bytes), signal);
+  // SW-09. A digest dependency that throws becomes a closed typed outcome
+  // rather than an escaping rejection.
+  let digest: string | typeof ABORTED;
+  try {
+    digest = await abortable(
+      Promise.resolve(dependencies.digest(bytes)),
+      signal,
+    );
+  } catch {
+    return rejected("INTEGRITY_MISMATCH");
+  }
   if (digest === ABORTED) return rejected("FETCH_FAILED");
   if (digest !== asset.sha256) return rejected("INTEGRITY_MISMATCH");