chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/integration/http-execution-contract.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it, vi } from "vitest";
 
 import { createHttpClient } from "../../src/adapters/http/client.ts";
 import { createContractHttpExecutor } from "../../src/adapters/http/http-execution-v3.ts";
+import { joinMutationEffectCertainty } from "../../src/adapters/http/http-effect-certainty.ts";
 import {
   entityQueryKeys,
   TEST_HTTP_CONTRACT,
@@ -49,12 +50,27 @@ function testClient(options: HttpDependencies) {
   return createHttpClient({ ...TEST_HTTP_CONTRACT, ...options });
 }
 
+describe("mutation effect certainty lattice", () => {
+  it.each([
+    ["NOT_STARTED", "NOT_APPLIED", "NOT_APPLIED"],
+    ["NOT_APPLIED", "NOT_STARTED", "NOT_APPLIED"],
+    ["NOT_STARTED", "MAYBE_APPLIED", "MAYBE_APPLIED"],
+    ["MAYBE_APPLIED", "NOT_STARTED", "MAYBE_APPLIED"],
+    ["MAYBE_APPLIED", "NOT_APPLIED", "MAYBE_APPLIED"],
+    ["NOT_APPLIED", "MAYBE_APPLIED", "MAYBE_APPLIED"],
+    ["MAYBE_APPLIED", "APPLIED_CONFIRMED", "APPLIED_CONFIRMED"],
+    ["APPLIED_CONFIRMED", "NOT_STARTED", "APPLIED_CONFIRMED"],
+    ["APPLIED_CONFIRMED", "MAYBE_APPLIED", "APPLIED_CONFIRMED"],
+  ] as const)("joins %s with %s as %s", (current, observed, expected) => {
+    expect(joinMutationEffectCertainty(current, observed)).toBe(expected);
+  });
+});
+
 describe("HTTP operation execution contract", () => {
   it("permits a keyless command intent but rejects an unexpected key before dispatch", async () => {
     const attachCredentials = vi.fn(() => ({
       kind: "READY" as const,
       headers: {},
-      credentials: "omit" as const,
     }));
     const observedKeys: Array<string | null> = [];
     const fetcher = vi.fn(
@@ -98,7 +114,7 @@ describe("HTTP operation execution contract", () => {
       executor.execute(
         nonKeyedCommand,
         { name: "created" },
-        { scope, intent },
+        { routeId: "TEST_ROUTE", scope, intent },
       ),
     ).resolves.toMatchObject({ kind: "SUCCESS" });
     expect(observedKeys).toEqual([null]);
@@ -109,7 +125,7 @@ describe("HTTP operation execution contract", () => {
       executor.execute(
         nonKeyedCommand,
         { name: "created" },
-        { scope, intent: { ...intent, idempotencyKey: "unexpected-key" } },
+        { routeId: "TEST_ROUTE", scope, intent: { ...intent, idempotencyKey: "unexpected-key" } },
       ),
     ).resolves.toMatchObject({
       kind: "CONTRACT_VIOLATION",
@@ -290,6 +306,9 @@ describe("HTTP operation execution contract", () => {
       operationId: "LIST_ENTITIES",
       routeId: "TEST_ROUTE",
     });
+    // The credential wait is bounded by the same attempt controller, so wait
+    // until the request is actually in flight before firing the deadline.
+    await vi.waitFor(() => expect(fetcher).toHaveBeenCalledTimes(1));
     await vi.waitFor(() => expect(scheduler.callbacks).toHaveLength(1));
     scheduler.callbacks[0]();
     await expect(timeoutResult).resolves.toMatchObject({