chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/adapters/web-push/service-worker-runtime.ts

@@ -1,4 +1,5 @@
 import {
+  webPushCountBucket,
   WEB_PUSH_LIMITS,
   WEB_PUSH_PROTOCOLS,
   webPushFailure,
@@ -134,6 +135,10 @@ export function createWebPushServiceWorkerRuntime(
     const facade = functionalEventFacade(event);
     if (!facade) return;
     const taskControl = createLinkedAbortController(lifecycle.signal);
+    // WP-06. Bounded fan-out is policy, but the operator must be able to see
+    // that only part of the client set was notified.
+    let observedClientCount = 0;
+    let truncatedClients = false;
     const processing = withAbortableDeadline(
       async (signal) => {
         let clients: readonly unknown[];
@@ -148,6 +153,9 @@ export function createWebPushServiceWorkerRuntime(
         if (signal.aborted) {
           return webPushFailure("ABORTED", "SUBSCRIPTION_RECONCILE");
         }
+        observedClientCount = clients.length;
+        truncatedClients =
+          clients.length > WEB_PUSH_LIMITS.clientHandoffCount;
         try {
           for (const candidate of clients.slice(
             0,
@@ -181,8 +189,15 @@ export function createWebPushServiceWorkerRuntime(
     const lifetime = processing.then((result) => {
       observeWebPush(dependencies.observer, {
         event: "web_push_subscription_rotated",
-        outcome: result.ok ? "SUCCEEDED" : "DEGRADED",
-        ...(result.ok ? {} : { reason: result.error.code }),
+        outcome:
+          result.ok && !truncatedClients ? "SUCCEEDED" : "DEGRADED",
+        ...(result.ok
+          ? truncatedClients
+            ? { reason: "LIMIT_EXCEEDED" as const }
+            : {}
+          : { reason: result.error.code }),
+        countBucket: webPushCountBucket(observedClientCount),
+        truncated: truncatedClients,
       });
     });
     try {