chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/cross-tab-invalidation.test.ts

@@ -112,9 +112,14 @@ class FakeStorageEventTarget implements StorageEventTargetFacade {
     this.listeners.delete(listener);
   }
 
-  emit(key: string | null, newValue: string | null): void {
+  emit(
+    key: string | null,
+    newValue: string | null,
+    storageArea: "EXPECTED_LOCAL_STORAGE" | "OTHER_OR_UNKNOWN" =
+      "EXPECTED_LOCAL_STORAGE",
+  ): void {
     for (const listener of [...this.listeners]) {
-      listener({ key, newValue });
+      listener({ key, newValue, storageArea });
     }
   }
 }
@@ -135,6 +140,9 @@ class FakeStorageBus {
     });
   }
 
+  /** Simulates the event arriving from a different Storage area. */
+  emitAsForeignArea = false;
+
   set(
     owner: FakeStorageEventTarget,
     key: string,
@@ -142,7 +150,15 @@ class FakeStorageBus {
   ): void {
     this.values.set(key, value);
     for (const target of this.targets) {
-      if (target !== owner) target.emit(key, value);
+      if (target !== owner) {
+        target.emit(
+          key,
+          value,
+          this.emitAsForeignArea
+            ? "OTHER_OR_UNKNOWN"
+            : "EXPECTED_LOCAL_STORAGE",
+        );
+      }
     }
   }
 
@@ -487,6 +503,50 @@ describe("browser cross-context invalidation transport", () => {
     second.close();
   });
 
+  it("rejects storage pulses from another or unknown storage area", () => {
+    const storageBus = new FakeStorageBus();
+    const publisherStorage = storageBus.createEndpoint();
+    const receiverStorage = storageBus.createEndpoint();
+    const storageOnly = {
+      createBroadcastChannel: () => {
+        throw new DOMException("Denied", "SecurityError");
+      },
+    };
+    const publisher = createBrowserCrossContextInvalidation(
+      dependencies("tab-a", {
+        ...storageOnly,
+        storage: publisherStorage.storage,
+        storageEvents: publisherStorage.target,
+      }),
+    );
+    const receiver = createBrowserCrossContextInvalidation(
+      dependencies("tab-b", {
+        ...storageOnly,
+        storage: receiverStorage.storage,
+        storageEvents: receiverStorage.target,
+      }),
+    );
+    const received = vi.fn();
+    receiver.subscribe(received);
+
+    // N-09. sessionStorage and every other Storage area raise the same event,
+    // so an identical key and value from a foreign area must be ignored.
+    storageBus.emitAsForeignArea = true;
+    expect(
+      publisher.publish({ topic: TOPIC, topicVersion: 1 }),
+    ).toMatchObject({ ok: true });
+    expect(received).not.toHaveBeenCalled();
+
+    storageBus.emitAsForeignArea = false;
+    expect(
+      publisher.publish({ topic: TOPIC, topicVersion: 1 }),
+    ).toMatchObject({ ok: true });
+    expect(received).toHaveBeenCalledOnce();
+
+    publisher.close();
+    receiver.close();
+  });
+
   it("enters explicit local-only degradation when every transport fails", () => {
     const storageBus = new FakeStorageBus();
     const endpoint = storageBus.createEndpoint();