chore: sync the frontend template from a0fbafb to 5434760

Carries eight template commits: the provider sandbox actually running, release
admission to a named environment, the product feature manifest with its runtime
kill switch, architecture and documentation rules that match what is enforced,
the removability fixtures, and the browser, visual and performance evidence.

Product identity is unchanged. `package.json` keeps `tech-log-frontend` and the
catalog keeps the Tech Log naming; the home page was not in the delta. The
visual baselines are this product's own — the template's were excluded from the
transplant and these were regenerated here, where the only difference is the
platform overview's new product-feature section.

What this repository gains operationally: `config/runtime/{local,development,
staging,production}.json` with `FE-GATE-027` refusing an artifact whose runtime
document does not match the environment it is being admitted to, and
`FEATURE_OVERRIDES` for taking an installed feature out of service without a
rebuild.

Verified here: eight gates green, build green, visual 5/5, and 1,858 of 1,859
tests in the suites that do not need a sandbox — the one failure passes in
isolation and is a jsdom lazy-chunk timeout under parallel load. The provider
suites cannot run on this machine at all: `kernel.apparmor_restrict_unprivileged
_userns=1` makes `bwrap --unshare-net` fail, reproducible without any code from
either repository.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/adapters/browser-transfer/presigned/presigned-capability-http-provider.ts

@@ -671,7 +671,14 @@ function validateCapabilityPayload(
       }),
     );
   } catch {
-    return browserDataFailure("POLICY_REJECTED", "PRESIGNED_TRANSFER");
+    // BT-PRE-04. A capability document this adapter refuses is not a dead end
+    // for the caller: the only way forward is to ask the issuer for a new one.
+    // `NONE` said the opposite — that nothing could be done — and disagreed
+    // with both the design record for an unsupported protocol and the vault,
+    // which already answers `REISSUE_CAPABILITY` for the same class of refusal.
+    return browserDataFailure("POLICY_REJECTED", "PRESIGNED_TRANSFER", {
+      recovery: "REISSUE_CAPABILITY",
+    });
   }
 }
 

src/adapters/diagnostics/bounded-diagnostics.ts

@@ -6,7 +6,7 @@ import {
   type DiagnosticRecordInput,
 } from "../../contracts/diagnostics.ts";
 import { projectTelemetryEvent } from "../../contracts/telemetry.ts";
-import { assertBoundedCapacity } from "../telemetry/best-effort-telemetry.ts";
+import { assertBoundedCapacity } from "../platform/bounded-capacity.ts";
 
 export const noOpDiagnostics: DiagnosticsPort = Object.freeze({
   record() {},

src/adapters/http/http-execution-v3.ts

@@ -269,6 +269,17 @@ export type ContractHttpExecutorDependencies = Readonly<{
   baseUrl: string;
   /** §8.2. `MAX_RETRY_ATTEMPTS` from Runtime Config; the ceiling is still 2. */
   maxRetryAttempts: number;
+  /**
+   * §6.1 / §8.5. `REQUEST_TIMEOUT_MS` from Runtime Config, as a ceiling only.
+   *
+   * The contract owns each operation's deadline, because the deadline is part
+   * of what the operation promises. A deployment still has to be able to hold
+   * the whole app to something stricter than the sum of its contracts, so this
+   * value may only shorten a deadline, never extend one — the same direction
+   * `CAPABILITY_OVERRIDES` is allowed to move in. Absent, contracts stand
+   * exactly as written.
+   */
+  requestDeadlineCeilingMs?: number;
   /** The installed profile registry; the executor never invents a profile. */
   authProfiles?: InstalledRestAuthProfiles;
   attachCredentials(
@@ -373,6 +384,13 @@ export function createContractHttpExecutor(
     dependencies.readBoundedResponseBytes ?? readBoundedBytes;
   const now = dependencies.monotonicNow ?? (() => performance.now());
   const random = dependencies.random ?? Math.random;
+  const deadlineCeilingMs = dependencies.requestDeadlineCeilingMs;
+  const effectiveDeadlineMs = (contractDeadlineMs: number): number =>
+    typeof deadlineCeilingMs === "number" &&
+    Number.isFinite(deadlineCeilingMs) &&
+    deadlineCeilingMs > 0
+      ? Math.min(contractDeadlineMs, deadlineCeilingMs)
+      : contractDeadlineMs;
   const sleep =
     dependencies.sleep ??
     ((ms: number, signal: AbortSignal) =>
@@ -400,7 +418,8 @@ export function createContractHttpExecutor(
     // §8.5. One monotonic deadline covers credential resolution, encoding,
     // backoff, every physical attempt, body read and validation.
     const startedAt = now();
-    const deadlineAt = startedAt + policy.totalDeadlineMs;
+    const totalDeadlineMs = effectiveDeadlineMs(policy.totalDeadlineMs);
+    const deadlineAt = startedAt + totalDeadlineMs;
     const remaining = () => deadlineAt - now();
 
     let attemptState: PhysicalAttemptState = "PREPARING";
@@ -451,7 +470,7 @@ export function createContractHttpExecutor(
     const lifetimeDeadlineTimer = setTimeout(() => {
       terminalCancellation ??= "DEADLINE";
       lifetimeController.abort();
-    }, policy.totalDeadlineMs);
+    }, totalDeadlineMs);
     let lifetimeDisposed = false;
     const disposeLifetime = () => {
       if (lifetimeDisposed) return;

src/adapters/platform/bounded-capacity.ts

@@ -0,0 +1,21 @@
+/**
+ * N-11. A non-finite or fractional capacity silently disables eviction, so it is
+ * a construction-time configuration error rather than a runtime drop.
+ *
+ * This lives in the adapter kernel rather than inside the telemetry adapter:
+ * the diagnostics adapter needs the same guard, and importing it from telemetry
+ * made one concrete adapter depend on another for a rule that belongs to
+ * neither of them.
+ */
+export function assertBoundedCapacity(
+  value: number,
+  ceiling: number,
+  label: string,
+): number {
+  if (!Number.isSafeInteger(value) || value < 1 || value > ceiling) {
+    throw new TypeError(
+      `${label} must be a safe integer between 1 and ${ceiling}`,
+    );
+  }
+  return value;
+}

src/adapters/telemetry/best-effort-telemetry.ts

@@ -5,6 +5,7 @@ import type {
   TelemetryEventName,
 } from "../../contracts/telemetry.ts";
 import type { TelemetryPort } from "../../application/ports/telemetry-port.ts";
+import { assertBoundedCapacity } from "../platform/bounded-capacity.ts";
 
 export type TelemetryAdapter = TelemetryPort &
   Readonly<{
@@ -45,22 +46,8 @@ type TelemetryLifecycle = "ACTIVE" | "DISPOSED";
 /** N-11. Documented absolute ceiling for the in-memory best-effort queue. */
 export const MAX_TELEMETRY_QUEUE = 10_000;
 
-/**
- * N-11. A non-finite or fractional capacity silently disables eviction, so it is
- * a construction-time configuration error rather than a runtime drop.
- */
-export function assertBoundedCapacity(
-  value: number,
-  ceiling: number,
-  label: string,
-): number {
-  if (!Number.isSafeInteger(value) || value < 1 || value > ceiling) {
-    throw new TypeError(
-      `${label} must be a safe integer between 1 and ${ceiling}`,
-    );
-  }
-  return value;
-}
+export { assertBoundedCapacity } from "../platform/bounded-capacity.ts";
+
 
 export function createTelemetryAdapter(
   options: TelemetryAdapterOptions,