chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/application/ports/auth-session-port.ts

@@ -9,7 +9,16 @@ export type SessionGateway = Readonly<{
   subscribe(listener: () => void): () => void;
   beginSignIn(returnTo?: string): Promise<void>;
   signOut(): Promise<void>;
-  recover(): Promise<"restored" | "no-session">;
+  /**
+   * LEG-01. Recovery is part of a request's lifetime, so it receives the same
+   * context a credential attach does. The context is optional for one release
+   * to keep existing owners working; the transport races the signal either way,
+   * and a recovery that answers after the request already ended is observed but
+   * never turned into a user-visible sign-out.
+   */
+  recover(
+    context?: CredentialOperationContext,
+  ): Promise<"restored" | "no-session">;
 }>;
 
 export type CredentialRequestBinding = Readonly<{
@@ -22,8 +31,21 @@ export type CredentialPatch = Readonly<{
   headers: Readonly<Record<string, string>>;
 }>;
 
+/**
+ * §8.5. The transport lifetime handed to a credential owner. A cooperative
+ * owner abandons its own work on abort; a non-cooperative one is still bounded
+ * because the transport races the same signal.
+ */
+export type CredentialOperationContext = Readonly<{
+  signal: AbortSignal;
+  deadlineAtMonotonicMs: number;
+}>;
+
 export type CredentialAttacher = Readonly<{
-  credentialPatch(binding: CredentialRequestBinding): Promise<CredentialPatch>;
+  credentialPatch(
+    binding: CredentialRequestBinding,
+    context?: CredentialOperationContext,
+  ): Promise<CredentialPatch>;
   onUnauthenticated(): void;
 }>;
 

src/application/ports/browser-file-storage/opfs-ports.ts

@@ -169,12 +169,46 @@ export type OpfsChunkReference = Readonly<{
   digestHex: string;
 }>;
 
-export type OpfsPreparedObject = Readonly<{
+/**
+ * STO-01. A transaction-unique physical fencing token.
+ *
+ * The logical `generation` is reused across transactions by design, so a late
+ * compensation from an abandoned transaction could otherwise delete the
+ * physical directory a newer transaction just created under the same logical
+ * generation. Physical paths are keyed by this token instead.
+ */
+declare const opfsPhysicalGenerationBrand: unique symbol;
+export type OpfsPhysicalGenerationId = string & {
+  readonly [opfsPhysicalGenerationBrand]: "OpfsPhysicalGenerationId";
+};
+
+export type OpfsPreparedObjectV1 = Readonly<{
   descriptor: DurableObjectDescriptor;
   chunks: readonly OpfsChunkReference[];
   physicalSchemaVersion: 1;
 }>;
 
+export type OpfsPreparedObjectV2 = Readonly<{
+  descriptor: DurableObjectDescriptor;
+  chunks: readonly OpfsChunkReference[];
+  physicalSchemaVersion: 2;
+  physicalGenerationId: OpfsPhysicalGenerationId;
+}>;
+
+/**
+ * Expand phase: v1 readers stay for the rollback window while every new write
+ * emits v2.
+ */
+export type OpfsPreparedObject = OpfsPreparedObjectV1 | OpfsPreparedObjectV2;
+
+/**
+ * STO-01. Compensation is only allowed to release journal and budget state
+ * after the physical effect is confirmed. `EFFECT_UNKNOWN` is never a success.
+ */
+export type OpfsCleanupEffect =
+  | Readonly<{ kind: "CLEANED" | "ALREADY_CLEAN" }>
+  | Readonly<{ kind: "EFFECT_UNKNOWN" }>;
+
 export type OpfsJournalMutation = "PUT" | "DELETE";
 export type OpfsJournalPhase =
   | "PREPARING"

src/application/ports/browser-file-storage/shared.ts

@@ -1,24 +1,42 @@
 import type { Result } from "../../result.ts";
 
+/**
+ * STO-RR-03. The runtime membership set behind the closed failure taxonomy. A
+ * boundary decoder needs to test a value against it, and a type alone cannot
+ * stop an arbitrary string from reaching application code.
+ */
+export const BROWSER_DATA_FAILURE_CODES = Object.freeze([
+  "ABORTED",
+  "BLOCKED",
+  "CONFLICT",
+  "CORRUPT_DATA",
+  "EXPIRED_RESOURCE",
+  "INTEGRITY_FAILED",
+  "INVALID_INPUT",
+  "LIMIT_EXCEEDED",
+  "MIGRATION_FAILED",
+  "NOT_FOUND",
+  "NOT_READABLE",
+  "PERMISSION_DENIED",
+  "POLICY_REJECTED",
+  "QUOTA_EXCEEDED",
+  "STALE_RESULT",
+  "STORAGE_EVICTED",
+  "UNAVAILABLE",
+  "UNSUPPORTED",
+] as const);
+
+export function isBrowserDataFailureCode(
+  value: unknown,
+): value is BrowserDataFailureCode {
+  return (
+    typeof value === "string" &&
+    (BROWSER_DATA_FAILURE_CODES as readonly string[]).includes(value)
+  );
+}
+
 export type BrowserDataFailureCode =
-  | "ABORTED"
-  | "BLOCKED"
-  | "CONFLICT"
-  | "CORRUPT_DATA"
-  | "EXPIRED_RESOURCE"
-  | "INTEGRITY_FAILED"
-  | "INVALID_INPUT"
-  | "LIMIT_EXCEEDED"
-  | "MIGRATION_FAILED"
-  | "NOT_FOUND"
-  | "NOT_READABLE"
-  | "PERMISSION_DENIED"
-  | "POLICY_REJECTED"
-  | "QUOTA_EXCEEDED"
-  | "STALE_RESULT"
-  | "STORAGE_EVICTED"
-  | "UNAVAILABLE"
-  | "UNSUPPORTED";
+  (typeof BROWSER_DATA_FAILURE_CODES)[number];
 
 export type BrowserDataOperation =
   | "CACHE_ACTIVATE"

src/application/ports/browser-transfer/image-cdn.ts

@@ -165,10 +165,18 @@ export type ImagePresentationDescriptor = Readonly<{
 }>;
 
 export interface ImageCdnPresentationPort {
+  /**
+   * BT-IMG-01. The lifetime signal is required.
+   *
+   * It used to be optional, so the `PRIMARY_REQUIRED` preset expressed a
+   * missing signal as a runtime `UNSUPPORTED` result - a hidden preset
+   * precondition. Requiring it at the type level removes that hidden rule
+   * instead of discovering it at runtime.
+   */
   resolve(request: Readonly<{
     asset: ImageAssetReference;
     preset: ImagePresetReference;
-    signal?: AbortSignal;
+    signal: AbortSignal;
   }>): Promise<BrowserDataResult<ImagePresentationDescriptor>>;
 }
 

src/application/ports/browser-transfer/presigned-transfer.ts

@@ -108,11 +108,30 @@ export interface PresignedTransferReplayGuard {
  * of the closed-Result stream. Consumers must not commit a destination until
  * the iterable finishes without a failure result.
  */
+/**
+ * BT-PRE-02. Top-level wire protocol for the capability envelope.
+ *
+ * Without it, a server that adds or reinterprets a field leaves old and new
+ * clients decoding the same shape with different meaning, and the resulting
+ * outage is not classified as a version mismatch. `PRESIGNED_MULTIPART_V1`
+ * stays as the nested multipart binding protocol.
+ */
+export const PRESIGNED_TRANSFER_PROTOCOL = "PRESIGNED_TRANSFER_V1" as const;
+
+export type PresignedTransferProtocol = typeof PRESIGNED_TRANSFER_PROTOCOL;
+
 export type PresignedDownloadByteSource = FileByteSource &
   Readonly<{
     byteLength: number;
     capability: PresignedDownloadCapability;
     integrity: "VERIFIED_ON_SUCCESSFUL_EXHAUSTION";
+    /**
+     * BT-PRE-01. Discards the lease. Before the first `stream()` this performs
+     * no network I/O at all; during streaming it cancels the body and releases
+     * the timer and listeners exactly once. Every consumer must call it in a
+     * `finally`, including on a pre-stream failure.
+     */
+    close(): void;
   }>;
 
 export interface PresignedDownloadSourcePort {

src/application/ports/browser-transfer/resumable-upload.ts

@@ -40,6 +40,14 @@ export type UploadPartReceipt = UploadPartDescriptor &
     receiptToken: string;
   }>;
 
+export type PartitionDeleteOutcome =
+  | Readonly<{ state: "DELETED"; effect: "APPLIED" }>
+  | Readonly<{
+      state: "PENDING";
+      effect: "UNKNOWN";
+      reason: "BLOCKED_DEADLINE";
+    }>;
+
 export interface UploadRangeReader {
   readonly byteLength: number;
   readRange(input: Readonly<{
@@ -273,7 +281,13 @@ export interface ResumableUploadCheckpointAdmin {
    * Account/logout lifecycle operation for this already-bound opaque partition.
    * The adapter closes its connection before deletion and bounds blocked waits.
    */
+  /**
+   * BT-UP-03. An IndexedDB `deleteDatabase()` request cannot be cancelled once
+   * dispatched, so a blocked deadline is not evidence that nothing happened.
+   * `PENDING` reports the effect honestly as `UNKNOWN`; only pre-dispatch
+   * problems are ordinary failures.
+   */
   deletePartition(
     signal?: AbortSignal,
-  ): Promise<BrowserDataResult<Readonly<{ state: "DELETED" }>>>;
+  ): Promise<BrowserDataResult<PartitionDeleteOutcome>>;
 }