Merge branch 'main' into feature/techlog-ui-migration

Integrates the frontend template sync (a0fbafb → 5434760) into the TechLog UI
migration. Merged in this direction so every conflict is resolved and proved in
the worktree; main is only fast-forwarded afterwards and never holds a state
that was not verified here.

15 conflicts. The rule throughout: keep the template's mechanism, keep the
product's content, and never invent a third state neither branch would accept.

The template's product manifest and its runtime feature kill switch are adopted.
The route registry is deliberately not composed from contract.routes: the
reference feature still declares screens this product deleted, and reducing over
them would register paths with no component behind them. ROUTE_FEATURE_OWNER is
narrowed to registered routes for the same reason. The first resolution did
compose from contract.routes and was rejected by product-features.test.ts.

Three files pinned counts and a digest describing the gate contract. Neither
side's numbers describe the merged config/ci/gates.json, so they were recomputed
from it rather than chosen: 27 gates, 82 commands, 94 command references, 107
evidence references, 128 artifacts, shape sha256 5063586d.

README.md and docs/accessibility/manual-checklist.md now enumerate this
product's 27 routes, which the template's own verify:documentation requires.

product-feature-switch.test.tsx was rewritten around the invariant that still
applies here — no registered route without a component — rather than deleted
with the screens it used to exercise.

docs/operations/template-merge-2026-08-17.md records every decision, the gate
results, and the three follow-ups this merge deliberately did not decide.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/bootstrap/runtime-adapters.ts

@@ -41,6 +41,14 @@ import {
   INVALIDATION_TOPIC_VERSIONS,
 } from "../features/installed-feature-contracts.ts";
 import { INSTALLED_RUNTIME_CAPABILITIES } from "../features/installed-runtime-capabilities.ts";
+import {
+  COMPILED_PRODUCT_FEATURE_IDS,
+  INSTALLED_PRODUCT_FEATURE_IDS,
+} from "../features/installed-product-manifest.ts";
+import {
+  activeProductFeatureIds,
+  resolveProductFeatures,
+} from "../contracts/product-features.ts";
 import { describeRuntimeCapabilities } from "../contracts/runtime-capabilities.ts";
 import {
   fetchReleaseManifest,
@@ -382,6 +390,27 @@ export async function createRuntimeAdapters(
       );
     },
   });
+  /**
+   * §3.5. The two halves of the feature answer meet here and nowhere else: the
+   * manifest says what the build compiled in, the runtime document says what is
+   * switched off. Neither can add to the other.
+   */
+  const productFeatureStatuses = resolveProductFeatures(
+    COMPILED_PRODUCT_FEATURE_IDS,
+    INSTALLED_PRODUCT_FEATURE_IDS,
+    config.FEATURE_OVERRIDES,
+  );
+  const activeFeatureIds = new Set(
+    activeProductFeatureIds(productFeatureStatuses),
+  );
+  const productFeatures = Object.freeze({
+    getSnapshot() {
+      return productFeatureStatuses;
+    },
+    isActive(featureId: string) {
+      return activeFeatureIds.has(featureId);
+    },
+  });
   const navigation = Object.freeze({
     reload() {
       const location = host.location;
@@ -394,6 +423,11 @@ export async function createRuntimeAdapters(
   const contractHttp = createContractHttpExecutor({
     baseUrl: config.API_BASE_URL,
     maxRetryAttempts: config.MAX_RETRY_ATTEMPTS,
+    // §6.1. `REQUEST_TIMEOUT_MS` was declared, validated and then dropped on the
+    // floor here: every V3 operation ran on its contract's own 10s deadline and
+    // the deployment dial did nothing. It is a ceiling, so it can tighten an
+    // operation but never loosen one.
+    requestDeadlineCeilingMs: config.REQUEST_TIMEOUT_MS,
     fetcher: context.fetcher,
     // §7.7. The installed registry owns Fetch credentials and the exact
     // credential-header sets; this collaborator only supplies proof headers.
@@ -481,6 +515,7 @@ export async function createRuntimeAdapters(
       telemetry,
       releaseInfo,
       runtimeCapabilities,
+      productFeatures,
       navigation,
     }),
     infrastructure: Object.freeze({

src/bootstrap/runtime-config-schema.ts

@@ -1,3 +1,4 @@
+import type { ProductFeatureOverrideMap } from "../contracts/product-features.ts";
 import {
   runtimeConfigV1ArtifactSchema,
   runtimeConfigV2ArtifactSchema,
@@ -44,6 +45,11 @@ export type RuntimeConfig = Readonly<{
   RELEASE_ID?: string;
   BUILD_ID?: string;
   CAPABILITY_OVERRIDES: CapabilityOverrides;
+  /**
+   * §3.5. Runtime kill switch per installed feature. Subtractive only: a
+   * feature the build did not install cannot be named into existence here.
+   */
+  FEATURE_OVERRIDES: ProductFeatureOverrideMap;
   /** Present only while a V1 document is still accepted. */
   LEGACY_API_CONTRACT_VERSION?: string;
 }>;
@@ -122,6 +128,10 @@ export function validateRuntimeConfig(value: unknown): RuntimeConfigValidation {
         ? (parsed as RuntimeConfigV2).CAPABILITY_OVERRIDES
         : DEFAULT_OVERRIDES),
     }),
+    // A V1 document predates feature overrides, so it disables nothing.
+    FEATURE_OVERRIDES: Object.freeze({
+      ...(isV2 ? (parsed as RuntimeConfigV2).FEATURE_OVERRIDES : {}),
+    }),
     ...(isV2
       ? {}
       : {