chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/application/ports/browser-transfer/image-cdn.ts

@@ -165,10 +165,18 @@ export type ImagePresentationDescriptor = Readonly<{
 }>;
 
 export interface ImageCdnPresentationPort {
+  /**
+   * BT-IMG-01. The lifetime signal is required.
+   *
+   * It used to be optional, so the `PRIMARY_REQUIRED` preset expressed a
+   * missing signal as a runtime `UNSUPPORTED` result - a hidden preset
+   * precondition. Requiring it at the type level removes that hidden rule
+   * instead of discovering it at runtime.
+   */
   resolve(request: Readonly<{
     asset: ImageAssetReference;
     preset: ImagePresetReference;
-    signal?: AbortSignal;
+    signal: AbortSignal;
   }>): Promise<BrowserDataResult<ImagePresentationDescriptor>>;
 }
 

src/application/ports/browser-transfer/presigned-transfer.ts

@@ -108,11 +108,30 @@ export interface PresignedTransferReplayGuard {
  * of the closed-Result stream. Consumers must not commit a destination until
  * the iterable finishes without a failure result.
  */
+/**
+ * BT-PRE-02. Top-level wire protocol for the capability envelope.
+ *
+ * Without it, a server that adds or reinterprets a field leaves old and new
+ * clients decoding the same shape with different meaning, and the resulting
+ * outage is not classified as a version mismatch. `PRESIGNED_MULTIPART_V1`
+ * stays as the nested multipart binding protocol.
+ */
+export const PRESIGNED_TRANSFER_PROTOCOL = "PRESIGNED_TRANSFER_V1" as const;
+
+export type PresignedTransferProtocol = typeof PRESIGNED_TRANSFER_PROTOCOL;
+
 export type PresignedDownloadByteSource = FileByteSource &
   Readonly<{
     byteLength: number;
     capability: PresignedDownloadCapability;
     integrity: "VERIFIED_ON_SUCCESSFUL_EXHAUSTION";
+    /**
+     * BT-PRE-01. Discards the lease. Before the first `stream()` this performs
+     * no network I/O at all; during streaming it cancels the body and releases
+     * the timer and listeners exactly once. Every consumer must call it in a
+     * `finally`, including on a pre-stream failure.
+     */
+    close(): void;
   }>;
 
 export interface PresignedDownloadSourcePort {

src/application/ports/browser-transfer/resumable-upload.ts

@@ -40,6 +40,14 @@ export type UploadPartReceipt = UploadPartDescriptor &
     receiptToken: string;
   }>;
 
+export type PartitionDeleteOutcome =
+  | Readonly<{ state: "DELETED"; effect: "APPLIED" }>
+  | Readonly<{
+      state: "PENDING";
+      effect: "UNKNOWN";
+      reason: "BLOCKED_DEADLINE";
+    }>;
+
 export interface UploadRangeReader {
   readonly byteLength: number;
   readRange(input: Readonly<{
@@ -273,7 +281,13 @@ export interface ResumableUploadCheckpointAdmin {
    * Account/logout lifecycle operation for this already-bound opaque partition.
    * The adapter closes its connection before deletion and bounds blocked waits.
    */
+  /**
+   * BT-UP-03. An IndexedDB `deleteDatabase()` request cannot be cancelled once
+   * dispatched, so a blocked deadline is not evidence that nothing happened.
+   * `PENDING` reports the effect honestly as `UNKNOWN`; only pre-dispatch
+   * problems are ordinary failures.
+   */
   deletePartition(
     signal?: AbortSignal,
-  ): Promise<BrowserDataResult<Readonly<{ state: "DELETED" }>>>;
+  ): Promise<BrowserDataResult<PartitionDeleteOutcome>>;
 }