chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/adapters/telemetry/best-effort-telemetry.ts

@@ -37,6 +37,31 @@ export const noOpTelemetry: TelemetryAdapter = Object.freeze({
   dispose: () => {},
 });
 
+/**
+ * N-04. Disposal is terminal: there is no durable queue and no resurrection.
+ */
+type TelemetryLifecycle = "ACTIVE" | "DISPOSED";
+
+/** N-11. Documented absolute ceiling for the in-memory best-effort queue. */
+export const MAX_TELEMETRY_QUEUE = 10_000;
+
+/**
+ * N-11. A non-finite or fractional capacity silently disables eviction, so it is
+ * a construction-time configuration error rather than a runtime drop.
+ */
+export function assertBoundedCapacity(
+  value: number,
+  ceiling: number,
+  label: string,
+): number {
+  if (!Number.isSafeInteger(value) || value < 1 || value > ceiling) {
+    throw new TypeError(
+      `${label} must be a safe integer between 1 and ${ceiling}`,
+    );
+  }
+  return value;
+}
+
 export function createTelemetryAdapter(
   options: TelemetryAdapterOptions,
 ): TelemetryAdapter {
@@ -46,11 +71,19 @@ export function createTelemetryAdapter(
 
   const endpoint = options.endpoint;
   const fetcher = options.fetcher ?? fetch;
-  const maxQueue = Math.max(1, options.maxQueue ?? 100);
+  const maxQueue = assertBoundedCapacity(
+    options.maxQueue ?? 100,
+    MAX_TELEMETRY_QUEUE,
+    "telemetry maxQueue",
+  );
   const schedule = options.schedule ?? queueMicrotask;
   const queue: TelemetryEvent[] = [];
+  let lifecycleState: TelemetryLifecycle = "ACTIVE";
+  /** Scheduled callbacks captured before disposal must not run afterwards. */
+  let scheduleGeneration = 0;
   let scheduled = false;
-  let flushing = false;
+  let activeFlush: Promise<void> | null = null;
+  let activeSink: AbortController | null = null;
   let dropped = 0;
   const dropReasons = new Map<string, number>();
   let lastDeliveryEvidence: TelemetryEvent | null = null;
@@ -93,9 +126,12 @@ export function createTelemetryAdapter(
   }
 
   function scheduleFlush(): void {
-    if (scheduled) return;
+    if (scheduled || lifecycleState === "DISPOSED") return;
     scheduled = true;
+    const generation = scheduleGeneration;
     schedule(() => {
+      // A callback captured before disposal belongs to a dead generation.
+      if (generation !== scheduleGeneration) return;
       scheduled = false;
       void flush();
     });
@@ -105,6 +141,7 @@ export function createTelemetryAdapter(
     eventName: TelemetryEventName,
     attributes: Record<string, unknown>,
   ): void {
+    if (lifecycleState === "DISPOSED") return;
     const projected = projectTelemetryEvent(
       eventName,
       attributes,
@@ -124,26 +161,44 @@ export function createTelemetryAdapter(
     scheduleFlush();
   }
 
-  async function flush(): Promise<void> {
-    if (flushing || queue.length === 0) return;
-    flushing = true;
-    const batch = queue.splice(0, queue.length);
-    try {
-      const response = await fetcher(endpoint, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ events: batch }),
-        keepalive: true,
-      });
-      if (!response.ok) recordDrop("sink-failure", batch.length);
-    } catch {
-      recordDrop("sink-failure", batch.length);
-    } finally {
-      flushing = false;
-      if (queue.length > 0) {
-        scheduleFlush();
-      }
+  /**
+   * `flush()` joins the active delivery instead of resolving immediately, so an
+   * awaited flush really means "the in-flight batch has settled".
+   */
+  function flush(): Promise<void> {
+    if (activeFlush) return activeFlush;
+    if (lifecycleState === "DISPOSED" || queue.length === 0) {
+      return Promise.resolve();
     }
+    const generation = scheduleGeneration;
+    const run = async () => {
+      const batch = queue.splice(0, queue.length);
+      const controller = new AbortController();
+      activeSink = controller;
+      try {
+        const response = await fetcher(endpoint, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ events: batch }),
+          keepalive: true,
+          signal: controller.signal,
+        });
+        // A sink that ignored the abort must not update post-dispose state.
+        if (generation !== scheduleGeneration) return;
+        if (!response.ok) recordDrop("sink-failure", batch.length);
+      } catch {
+        if (generation !== scheduleGeneration) return;
+        recordDrop("sink-failure", batch.length);
+      } finally {
+        if (activeSink === controller) activeSink = null;
+        activeFlush = null;
+        if (generation === scheduleGeneration && queue.length > 0) {
+          scheduleFlush();
+        }
+      }
+    };
+    activeFlush = run();
+    return activeFlush;
   }
 
   const flushBeforePageExit = () => {
@@ -151,8 +206,20 @@ export function createTelemetryAdapter(
   };
   lifecycle?.addEventListener("pagehide", flushBeforePageExit);
 
+  /**
+   * N-04. Terminal disposal: one state transition, no further admission, no
+   * further scheduling, and no recursive drop telemetry while shutting down.
+   */
   function dispose(): void {
+    if (lifecycleState === "DISPOSED") return;
+    lifecycleState = "DISPOSED";
+    scheduleGeneration += 1;
+    scheduled = false;
     lifecycle?.removeEventListener("pagehide", flushBeforePageExit);
+    queue.length = 0;
+    activeSink?.abort();
+    activeSink = null;
+    activeFlush = null;
   }
 
   return Object.freeze({