chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/adapters/web-push/inbound/notification-click-adapter.ts

@@ -3,6 +3,7 @@ import {
   WEB_PUSH_PROTOCOLS,
   webPushFailure,
   webPushSuccess,
+  type WebPushNativeEffectCertainty,
   type WebPushObserver,
   type WebPushResult,
 } from "../../../contracts/web-push.ts";
@@ -44,6 +45,41 @@ export type NotificationClickAdapter = Readonly<{
   handle(event: NotificationClickEventFacade): Promise<WebPushResult<void>>;
 }>;
 
+/**
+ * WP-RR-01. Bounds a native effect by the handler lifetime while keeping the
+ * abandoned promise observable exactly once.
+ */
+const ABORT_OWNED = Symbol("web-push-click-aborted");
+
+/**
+ * WP-01. Per-click observation state: the current native-effect certainty and
+ * the bounded tail tasks that observe an effect landing after the terminal
+ * result. `waitUntil` owns the tails so the worker cannot be terminated before
+ * the evidence lands, and the certainty is monotone from `NOT_APPLIED` through
+ * `MAYBE_APPLIED` to `CONFIRMED`.
+ */
+type ClickEffectState = {
+  certainty: WebPushNativeEffectCertainty;
+  tails: Promise<unknown>[];
+};
+
+async function raceAbort<Value>(
+  operation: Promise<Value>,
+  signal: AbortSignal,
+): Promise<Value | typeof ABORT_OWNED> {
+  if (signal.aborted) return ABORT_OWNED;
+  let onAbort: (() => void) | undefined;
+  const aborted = new Promise<typeof ABORT_OWNED>((resolve) => {
+    onAbort = () => resolve(ABORT_OWNED);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+  try {
+    return await Promise.race([operation, aborted]);
+  } finally {
+    if (onAbort) signal.removeEventListener("abort", onAbort);
+  }
+}
+
 export function createNotificationClickAdapter(dependencies: Readonly<{
   fenceStore: PushAssociationFenceStore;
   clients: WorkerClientsFacade;
@@ -79,8 +115,17 @@ export function createNotificationClickAdapter(dependencies: Readonly<{
       const taskControl = createLinkedAbortController(
         dependencies.signal,
       );
+      // WP-01. One observation authority per click. The terminal record was
+      // emitted both inside `process` and again here, so an ordinary click was
+      // counted twice, and the native-effect evidence was detached from
+      // `waitUntil` entirely — a worker that shut down after the terminal
+      // result simply lost it.
+      const effect: ClickEffectState = {
+        certainty: "NOT_APPLIED",
+        tails: [],
+      };
       const processing = withAbortableDeadline(
-        (signal) => process(event.notification.data, signal),
+        (signal) => process(event.notification.data, signal, effect),
         {
           deadlineMs: handlerDeadlineMs,
           operation: "NOTIFICATION_CLICK",
@@ -90,12 +135,16 @@ export function createNotificationClickAdapter(dependencies: Readonly<{
       ).finally(taskControl.dispose);
       try {
         event.waitUntil(
-          processing.then((result) => {
+          processing.then(async (result) => {
             observeWebPush(dependencies.observer, {
               event: "web_push_click_dispatched",
               outcome: result.ok ? "SUCCEEDED" : "FAILED",
               ...(result.ok ? {} : { reason: result.error.code }),
+              nativeEffect: effect.certainty,
             });
+            // The late-effect observation is this handler's own work, so the
+            // worker stays alive for it without extending the public deadline.
+            await Promise.allSettled(effect.tails);
           }),
         );
       } catch {
@@ -109,6 +158,7 @@ export function createNotificationClickAdapter(dependencies: Readonly<{
   async function process(
     data: unknown,
     signal: AbortSignal,
+    effect: ClickEffectState,
   ): Promise<WebPushResult<void>> {
     const decoded = decodeNotificationClickData(data, now());
     if (!decoded.ok) return decoded;
@@ -156,21 +206,86 @@ export function createNotificationClickAdapter(dependencies: Readonly<{
       expiresAt: decoded.value.expiresAt,
       path,
     });
+    // WP-RR-01. `focus` and `openWindow` are user-visible native effects, so
+    // they carry the same certainty phase `showNotification` already does:
+    // NOT_APPLIED before the call, MAYBE_APPLIED while the promise is pending,
+    // CONFIRMED on fulfilment. An effect that lands after this handler's
+    // deadline is still observed exactly once — as evidence only, never as
+    // authorization to retry.
+    const observeLateEffect = (
+      pending: Promise<unknown>,
+      appliedWhen: (value: unknown) => boolean,
+    ): void => {
+      let observed = false;
+      // WP-01. The tail is tracked so `waitUntil` owns it. Certainty is
+      // monotone: once the native call has been made the effect can only be
+      // confirmed or stay uncertain. A rejection says the call did not report
+      // success, not that it never happened, so downgrading it to NOT_APPLIED
+      // told operators the click had definitely not been applied.
+      effect.tails.push(
+        pending.then(
+          (value) => {
+            if (observed) return;
+            observed = true;
+            const applied = appliedWhen(value);
+            effect.certainty = applied ? "CONFIRMED" : "NOT_APPLIED";
+            observeWebPush(dependencies.observer, {
+              event: "web_push_click_dispatched",
+              outcome: applied ? "DEGRADED" : "FAILED",
+              reason: "ABORTED",
+              nativeEffect: effect.certainty,
+            });
+          },
+          () => {
+            if (observed) return;
+            observed = true;
+            observeWebPush(dependencies.observer, {
+              event: "web_push_click_dispatched",
+              outcome: "DEGRADED",
+              reason: "ABORTED",
+              nativeEffect: "MAYBE_APPLIED",
+            });
+          },
+        ),
+      );
+    };
     try {
       if (signal.aborted) {
         return webPushFailure("ABORTED", "NOTIFICATION_CLICK");
       }
       if (existing) {
         existing.postMessage(handoff);
-        await existing.focus();
+        const focused = Promise.resolve(existing.focus());
+        effect.certainty = "MAYBE_APPLIED";
+        const raced = await raceAbort(focused, signal);
+        if (raced === ABORT_OWNED) {
+          observeLateEffect(focused, () => true);
+          return webPushFailure("ABORTED", "NOTIFICATION_CLICK");
+        }
+        effect.certainty = "CONFIRMED";
       } else {
-        const opened = await dependencies.clients.openWindow(target);
-        if (!opened) return nativeFailure("NOTIFICATION_CLICK", true);
+        const opening = Promise.resolve(
+          dependencies.clients.openWindow(target),
+        );
+        effect.certainty = "MAYBE_APPLIED";
+        const raced = await raceAbort(opening, signal);
+        if (raced === ABORT_OWNED) {
+          observeLateEffect(opening, (value) => value !== null);
+          return webPushFailure("ABORTED", "NOTIFICATION_CLICK");
+        }
+        if (!raced) {
+          // An explicit null is the one answer that confirms no window opened.
+          effect.certainty = "NOT_APPLIED";
+          return nativeFailure("NOTIFICATION_CLICK", true);
+        }
+        effect.certainty = "CONFIRMED";
       }
       if (signal.aborted) {
         return webPushFailure("ABORTED", "NOTIFICATION_CLICK");
       }
     } catch {
+      // The native call threw, so it never reported success; whether it took
+      // effect is unknown rather than settled.
       return nativeFailure("NOTIFICATION_CLICK", true);
     }
     return webPushSuccess(undefined);

src/adapters/web-push/inbound/push-event-adapter.ts

@@ -1,4 +1,5 @@
 import {
+  type WebPushNativeEffectCertainty,
   WEB_PUSH_LIMITS,
   webPushFailure,
   webPushSuccess,
@@ -148,14 +149,30 @@ export function createPushEventAdapter(dependencies: Readonly<{
     );
     if (!finalFence.ok) return finalFence;
     const clickData = clickDataFromHint(decoded.value);
+    // WP-07. The user-visible effect has its own certainty phase: NOT_APPLIED
+    // before the native call, MAYBE_APPLIED while the promise is pending and
+    // CONFIRMED on fulfilment. It is evidence only and never authorizes retry.
+    let nativeEffect: WebPushNativeEffectCertainty = "NOT_APPLIED";
     try {
-      await dependencies.notifications.showNotification(definition.title, {
-        body: definition.body,
-        data: clickData,
-        requireInteraction: false,
-        tag,
-      });
+      const shown = dependencies.notifications.showNotification(
+        definition.title,
+        {
+          body: definition.body,
+          data: clickData,
+          requireInteraction: false,
+          tag,
+        },
+      );
+      nativeEffect = "MAYBE_APPLIED";
+      await shown;
+      nativeEffect = "CONFIRMED";
       if (signal.aborted) {
+        observeWebPush(dependencies.observer, {
+          event: "web_push_notification_finished",
+          outcome: "DEGRADED",
+          reason: "ABORTED",
+          nativeEffect,
+        });
         return webPushFailure("ABORTED", "NOTIFICATION_SHOW");
       }
     } catch {
@@ -164,12 +181,14 @@ export function createPushEventAdapter(dependencies: Readonly<{
         event: "web_push_notification_finished",
         outcome: "FAILED",
         reason: failureCode(failed),
+        nativeEffect,
       });
       return failed;
     }
     observeWebPush(dependencies.observer, {
       event: "web_push_notification_finished",
       outcome: "SUCCEEDED",
+      nativeEffect,
     });
     return webPushSuccess(undefined);
   }

src/adapters/web-push/push-association-fence-store.ts

@@ -502,7 +502,7 @@ export function createPushAssociationFenceStore(
       operation,
     );
     if (!written.ok) return written;
-    if (!validWriteReceipt(written.value)) {
+    if (!validWriteReceipt(written.value, expectedRevision)) {
       return webPushFailure("CONTROL_CORRUPT", operation);
     }
     return webPushSuccess(
@@ -537,10 +537,7 @@ export function createPushAssociationFenceStore(
       "CONTROL_PURGE",
     );
     if (!removed.ok) return removed;
-    if (
-      !validWriteReceipt(removed.value) ||
-      removed.value.revision !== expectedRevision + 1
-    ) {
+    if (!validWriteReceipt(removed.value, expectedRevision)) {
       return webPushFailure("CONTROL_CORRUPT", "CONTROL_PURGE");
     }
     return webPushSuccess(undefined);
@@ -693,14 +690,25 @@ function validRepository(
   );
 }
 
+/**
+ * WP-01. One validator for both write and remove.
+ *
+ * A CAS receipt is only evidence when it names the expected key and the exact
+ * next revision. Accepting any well-typed revision let a stale or arbitrary
+ * repository receipt be packaged as a confirmed control, after which the whole
+ * CAS authority is wrong. A replayed receipt must still carry that exact
+ * revision, since replay means "this command already produced this revision".
+ */
 function validWriteReceipt(
   value: PushControlWriteReceipt,
+  expectedRevision: number | null,
 ): value is PushControlWriteReceipt {
   return (
     Boolean(value) &&
     value.key === CONTROL_KEY &&
     validRevision(value.revision) &&
-    typeof value.replayed === "boolean"
+    typeof value.replayed === "boolean" &&
+    value.revision === (expectedRevision ?? 0) + 1
   );
 }
 

src/adapters/web-push/push-subscription-adapter.ts

@@ -1,5 +1,6 @@
 import type { WebPushControlPort } from "../../application/ports/out/web-push-control.ts";
 import {
+  webPushCountBucket,
   WEB_PUSH_LIMITS,
   samePushAuthority,
   webPushFailure,
@@ -474,7 +475,9 @@ export function createWebPushSubscriptionAdapter(
     if (closed) return webPushSuccess(unavailable("CLOSED"));
     if (busy) return webPushSuccess(unavailable("BUSY"));
     if (signal?.aborted) {
-      return webPushFailure("ABORTED", "SUBSCRIPTION_INSPECT");
+      // WP-05. A pre-aborted command is recorded as the operation the caller
+      // actually requested, not always as an inspection.
+      return webPushFailure("ABORTED", failureOperation);
     }
     busy = true;
     const generation = lifecycleGeneration;
@@ -879,7 +882,9 @@ export function createWebPushSubscriptionAdapter(
           await Promise.allSettled([
             unsubscribe,
             associationEpoch === null
-              ? Promise.resolve(webPushSuccess(undefined))
+              ? Promise.resolve(
+                  webPushSuccess(Object.freeze({ complete: true })),
+                )
               : closeOwnedNotifications(
                   associationEpoch,
                   signal,
@@ -891,7 +896,8 @@ export function createWebPushSubscriptionAdapter(
           nativeResult.value;
         const notificationsClean =
           notificationResult.status === "fulfilled" &&
-          notificationResult.value.ok;
+          notificationResult.value.ok &&
+          notificationResult.value.value.complete;
         return webPushSuccess(
           nativeClean && notificationsClean,
         );
@@ -905,11 +911,16 @@ export function createWebPushSubscriptionAdapter(
     return cleanup.ok && cleanup.value;
   }
 
+  /**
+   * WP-06. Notification cleanup is bounded best effort and is reported
+   * separately from revoke authority: an incomplete pass returns
+   * `{ complete: false }` and is observed as DEGRADED rather than success.
+   */
   async function closeOwnedNotifications(
     associationEpoch: string,
     signal: AbortSignal | undefined,
     generation: number,
-  ): Promise<WebPushResult<void>> {
+  ): Promise<WebPushResult<Readonly<{ complete: boolean }>>> {
     let notifications: readonly OwnedNotificationFacade[];
     try {
       notifications = await dependencies.registration.getNotifications();
@@ -923,6 +934,15 @@ export function createWebPushSubscriptionAdapter(
     if (stale(signal, generation)) {
       return webPushFailure("ABORTED", "NOTIFICATION_CLEANUP");
     }
+    const truncated =
+      notifications.length > WEB_PUSH_LIMITS.notificationCleanupCount;
+    observeWebPush(dependencies.observer, {
+      event: "web_push_notification_finished",
+      outcome: truncated ? "DEGRADED" : "SUCCEEDED",
+      ...(truncated ? { reason: "LIMIT_EXCEEDED" as const } : {}),
+      countBucket: webPushCountBucket(notifications.length),
+      truncated,
+    });
     for (const notification of notifications.slice(
       0,
       WEB_PUSH_LIMITS.notificationCleanupCount,
@@ -941,7 +961,7 @@ export function createWebPushSubscriptionAdapter(
         }
       }
     }
-    return webPushSuccess(undefined);
+    return webPushSuccess(Object.freeze({ complete: !truncated }));
   }
 
   function stale(

src/adapters/web-push/service-worker-runtime.ts

@@ -1,4 +1,5 @@
 import {
+  webPushCountBucket,
   WEB_PUSH_LIMITS,
   WEB_PUSH_PROTOCOLS,
   webPushFailure,
@@ -134,6 +135,10 @@ export function createWebPushServiceWorkerRuntime(
     const facade = functionalEventFacade(event);
     if (!facade) return;
     const taskControl = createLinkedAbortController(lifecycle.signal);
+    // WP-06. Bounded fan-out is policy, but the operator must be able to see
+    // that only part of the client set was notified.
+    let observedClientCount = 0;
+    let truncatedClients = false;
     const processing = withAbortableDeadline(
       async (signal) => {
         let clients: readonly unknown[];
@@ -148,6 +153,9 @@ export function createWebPushServiceWorkerRuntime(
         if (signal.aborted) {
           return webPushFailure("ABORTED", "SUBSCRIPTION_RECONCILE");
         }
+        observedClientCount = clients.length;
+        truncatedClients =
+          clients.length > WEB_PUSH_LIMITS.clientHandoffCount;
         try {
           for (const candidate of clients.slice(
             0,
@@ -181,8 +189,15 @@ export function createWebPushServiceWorkerRuntime(
     const lifetime = processing.then((result) => {
       observeWebPush(dependencies.observer, {
         event: "web_push_subscription_rotated",
-        outcome: result.ok ? "SUCCEEDED" : "DEGRADED",
-        ...(result.ok ? {} : { reason: result.error.code }),
+        outcome:
+          result.ok && !truncatedClients ? "SUCCEEDED" : "DEGRADED",
+        ...(result.ok
+          ? truncatedClients
+            ? { reason: "LIMIT_EXCEEDED" as const }
+            : {}
+          : { reason: result.error.code }),
+        countBucket: webPushCountBucket(observedClientCount),
+        truncated: truncatedClients,
       });
     });
     try {