chore: sync the frontend template from 4dc033c to 8157ad4

The product was materialized from the template at `4dc033c` and has stayed
on it through 43 template commits, so it was missing all three rounds of
adapter remediation — including files it never had, such as the shared
`abortable-operation` primitive and the `exact-snapshot` decoder that
later fixes are written against. Taking only the newest round was not
possible for that reason: the delta is coherent only as a whole.

The product had not touched `src/adapters` at all since materialization,
so the 140-file delta applied with a three-way merge and no conflicts.
`package.json` was the single overlap and merged cleanly: the product owns
`name`, the template contributed `check:adapter-inventory`,
`check:remediation-ledger` and the image-resolve-signal type fixture.
All 24 product-owned files — README, index.html, CI workflow, i18n
catalog, home page, generated schemas, evidence scripts, component and
visual snapshots — are byte-identical to `main`.

`template.lock.json` now pins the synced revision and tree.

Verified in this repository, not inherited from the template: six type
projects, lint, nine gates (adapter inventory, remediation ledger,
registries, diagnostics, realtime boundaries, architecture, browser
file/storage boundaries, optional recipes, documentation), the production
build, and 2,054 of 2,073 tests. The 19 failures are all in
`tests/unit/ci-artifact-contract.test.ts` and are the same pre-existing
sandbox RLIMIT, EMFILE, umask and `/tmp` permission behaviour the template
records; four suites that failed once under parallel load pass in
isolation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/unit/cursor-pagination-runtime.test.ts

@@ -12,6 +12,45 @@ const profile = {
 } as const;
 
 describe("bounded cursor pagination runtime", () => {
+  it("returns PAGINATION_ABORTED when a non-cooperative page resolves after abort", async () => {
+    const controller = new AbortController();
+    let releasePage: ((page: unknown) => void) | undefined;
+    const loadPage = vi.fn(
+      () =>
+        new Promise((resolve) => {
+          releasePage = resolve as (page: unknown) => void;
+        }),
+    );
+    const runtime = createCursorPaginationRuntime({
+      definitionId: "bounded",
+      profile,
+      loadPage: loadPage as never,
+    });
+
+    const loading = runtime.loadAll({ signal: controller.signal });
+    await Promise.resolve();
+    controller.abort();
+
+    const result = await loading;
+    expect(result).toMatchObject({
+      ok: false,
+      error: { kind: "REQUEST_ABORTED", code: "PAGINATION_ABORTED" },
+    });
+
+    // The late page completion must be ignored, not accumulated.
+    releasePage?.({
+      ok: true,
+      value: {
+        items: ["late"],
+        nextCursor: null,
+        hasMore: false,
+        snapshotToken: "snapshot-1",
+      },
+    });
+    await Promise.resolve();
+    expect(loadPage).toHaveBeenCalledOnce();
+  });
+
   it("loads a stable finite chain without exposing cursors in its value", async () => {
     const loadPage = vi
       .fn()
@@ -119,3 +158,121 @@ describe("bounded cursor pagination runtime", () => {
     });
   });
 });
+
+/**
+ * NS-07. The profile was validated once and then re-read on every page, so
+ * raising `maxPages` after construction widened a cap that had already been
+ * checked — the runtime issued more requests and returned more items than the
+ * validated profile allowed.
+ */
+describe("NS-07 the caps are the ones that were validated", () => {
+  it("keeps the page cap captured at construction", async () => {
+    const mutable: {
+      profileId: string;
+      maxPages: number;
+      maxTotalItems: number;
+      maxEstimatedBytes: number;
+      maxCursorBytes: number;
+      allowSparsePage: boolean;
+    } = { ...profile, maxPages: 1 };
+    const loadPage = vi.fn(async () => ({
+      ok: true as const,
+      value: {
+        items: [1],
+        nextCursor: `cursor-${loadPage.mock.calls.length}`,
+        hasMore: true,
+        snapshotToken: "snapshot-a",
+      },
+    }));
+    const runtime = createCursorPaginationRuntime({
+      definitionId: "LIST_ALL",
+      profile: mutable,
+      loadPage,
+    });
+
+    mutable.maxPages = 3;
+    mutable.maxTotalItems = 99;
+
+    await expect(runtime.loadAll({})).resolves.toMatchObject({
+      ok: false,
+      error: { code: "PAGINATION_PAGE_LIMIT" },
+    });
+    expect(loadPage).toHaveBeenCalledTimes(1);
+  });
+
+  it("keeps the loader captured at construction", async () => {
+    const original = vi.fn(async () => ({
+      ok: true as const,
+      value: {
+        items: [1],
+        nextCursor: null,
+        hasMore: false,
+        snapshotToken: null,
+      },
+    }));
+    const replacement = vi.fn();
+    const dependencies = {
+      definitionId: "LIST_ALL",
+      profile,
+      loadPage: original,
+    };
+    const runtime = createCursorPaginationRuntime(dependencies);
+    dependencies.loadPage = replacement as never;
+
+    await expect(runtime.loadAll({})).resolves.toMatchObject({ ok: true });
+    expect(original).toHaveBeenCalledTimes(1);
+    expect(replacement).not.toHaveBeenCalled();
+  });
+
+  const hostileProfiles: readonly (readonly [string, () => unknown])[] = [
+    [
+      "an accessor cap",
+      () =>
+        Object.defineProperty({ ...profile }, "maxPages", {
+          enumerable: true,
+          get: () => 3,
+        }),
+    ],
+    [
+      "an inherited cap",
+      () => Object.create({ ...profile }) as unknown,
+    ],
+    ["an extra own field", () => ({ ...profile, injected: true })],
+    [
+      "a symbol field",
+      () => ({ ...profile, [Symbol.for("injected")]: true }),
+    ],
+    [
+      "a non-enumerable own field",
+      () =>
+        Object.defineProperty({ ...profile }, "injected", {
+          enumerable: false,
+          value: true,
+        }),
+    ],
+    [
+      "a throwing ownKeys trap",
+      () =>
+        new Proxy(
+          { ...profile },
+          {
+            ownKeys() {
+              throw new TypeError("hostile ownKeys trap");
+            },
+          },
+        ),
+    ],
+  ];
+
+  for (const [label, build] of hostileProfiles) {
+    it(`refuses to build a runtime from ${label}`, () => {
+      expect(() =>
+        createCursorPaginationRuntime({
+          definitionId: "LIST_ALL",
+          profile: build() as never,
+          loadPage: vi.fn(),
+        }),
+      ).toThrow(TypeError);
+    });
+  }
+});