chore: sync the frontend template from a0fbafb to 5434760

Carries eight template commits: the provider sandbox actually running, release
admission to a named environment, the product feature manifest with its runtime
kill switch, architecture and documentation rules that match what is enforced,
the removability fixtures, and the browser, visual and performance evidence.

Product identity is unchanged. `package.json` keeps `tech-log-frontend` and the
catalog keeps the Tech Log naming; the home page was not in the delta. The
visual baselines are this product's own — the template's were excluded from the
transplant and these were regenerated here, where the only difference is the
platform overview's new product-feature section.

What this repository gains operationally: `config/runtime/{local,development,
staging,production}.json` with `FE-GATE-027` refusing an artifact whose runtime
document does not match the environment it is being admitted to, and
`FEATURE_OVERRIDES` for taking an installed feature out of service without a
rebuild.

Verified here: eight gates green, build green, visual 5/5, and 1,858 of 1,859
tests in the suites that do not need a sandbox — the one failure passes in
isolation and is a jsdom lazy-chunk timeout under parallel load. The provider
suites cannot run on this machine at all: `kernel.apparmor_restrict_unprivileged
_userns=1` makes `bwrap --unshare-net` fail, reproducible without any code from
either repository.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/application/create-application.ts

@@ -102,6 +102,12 @@ export function createApplication(
     getCapabilitySnapshot() {
       return outputPorts.runtimeCapabilities.getSnapshot();
     },
+    getFeatureSnapshot() {
+      return outputPorts.productFeatures.getSnapshot();
+    },
+    isFeatureActive(featureId: string) {
+      return outputPorts.productFeatures.isActive(featureId);
+    },
   });
 
   const recovery = Object.freeze({

src/application/policies/compatibility.ts

@@ -1,107 +1,21 @@
-export const COMPATIBILITY_TUPLE_FIELDS = Object.freeze([
-  "buildId",
-  "configSchemaVersion",
-  "apiContractVersion",
-  "assetManifestHash",
-  "releaseId",
-] as const);
-
-export type CompatibilityTupleField =
-  (typeof COMPATIBILITY_TUPLE_FIELDS)[number];
-
-export type CompatibilityTuple = Readonly<
-  Record<CompatibilityTupleField, string>
->;
-
-export type NumericVersion = Readonly<{
-  major: number;
-  minor: number;
-  patch: number;
-}>;
-
-export function parseNumericVersion(version: string): NumericVersion | null {
-  const match = /^(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(version);
-  if (!match) return null;
-  return {
-    major: Number(match[1]),
-    minor: Number(match[2] ?? 0),
-    patch: Number(match[3] ?? 0),
-  };
-}
-
-export function isVersionCompatible(
-  supported: string,
-  actual: string,
-): boolean {
-  const expected = parseNumericVersion(supported);
-  const candidate = parseNumericVersion(actual);
-  if (!expected || !candidate) return false;
-  return (
-    expected.major === candidate.major &&
-    candidate.minor >= expected.minor
-  );
-}
-
-export function verifyCompatibilityTuple(input: Readonly<{
-  frontend: CompatibilityTuple;
-  runtime: CompatibilityTuple;
-}>) {
-  const mismatches: CompatibilityTupleField[] = [];
-  if (input.frontend.buildId !== input.runtime.buildId) mismatches.push("buildId");
-  if (
-    !isVersionCompatible(
-      input.frontend.configSchemaVersion,
-      input.runtime.configSchemaVersion,
-    )
-  ) {
-    mismatches.push("configSchemaVersion");
-  }
-  if (
-    !isVersionCompatible(
-      input.frontend.apiContractVersion,
-      input.runtime.apiContractVersion,
-    )
-  ) {
-    mismatches.push("apiContractVersion");
-  }
-  if (input.frontend.assetManifestHash !== input.runtime.assetManifestHash) {
-    mismatches.push("assetManifestHash");
-  }
-
-  const releaseWarning: "releaseId" | null =
-    input.frontend.releaseId === input.runtime.releaseId
-      ? null
-      : "releaseId";
-  return Object.freeze({
-    compatible: mismatches.length === 0,
-    mismatches: Object.freeze(mismatches),
-    warnings: Object.freeze(releaseWarning ? [releaseWarning] : []),
-  });
-}
-
-export type ObjectSchemaShape = Readonly<{
-  required?: readonly string[];
-  properties?: Readonly<Record<string, unknown>>;
-}>;
-
-export type SchemaChangeClassification = "breaking" | "additive" | "none";
-
-export function classifyObjectSchemaChange(
-  before: ObjectSchemaShape,
-  after: ObjectSchemaShape,
-): SchemaChangeClassification {
-  const beforeRequired = new Set(before.required ?? []);
-  const afterRequired = new Set(after.required ?? []);
-  const removedProperties = Object.keys(before.properties ?? {}).filter(
-    (key) => !(key in (after.properties ?? {})),
-  );
-  const addedRequired = [...afterRequired].filter(
-    (key) => !beforeRequired.has(key),
-  );
-  if (removedProperties.length > 0 || addedRequired.length > 0) return "breaking";
-
-  const addedProperties = Object.keys(after.properties ?? {}).filter(
-    (key) => !(key in (before.properties ?? {})),
-  );
-  return addedProperties.length > 0 ? "additive" : "none";
-}
+/**
+ * Release compatibility comparison.
+ *
+ * The implementation lives in `src/contracts/compatibility.ts`: it is a pure
+ * predicate over release tokens with no application state, and
+ * `src/contracts/release-tokens.ts` needs it, which previously made contracts
+ * import the application layer. This module re-exports it for application-side
+ * and script-side callers.
+ */
+export {
+  COMPATIBILITY_TUPLE_FIELDS,
+  classifyObjectSchemaChange,
+  isVersionCompatible,
+  parseNumericVersion,
+  verifyCompatibilityTuple,
+  type CompatibilityTuple,
+  type CompatibilityTupleField,
+  type NumericVersion,
+  type ObjectSchemaShape,
+  type SchemaChangeClassification,
+} from "../../contracts/compatibility.ts";

src/application/policies/promotion-readiness.ts

@@ -20,6 +20,9 @@ export const PROMOTION_FORMULA = Object.freeze({
     "FE-GATE-015",
     "FE-GATE-019",
     "FE-GATE-026",
+    // FE-GATE-027. A candidate is only release-ready once it has been admitted
+    // to a named environment; coherence alone never proved it belonged there.
+    "FE-GATE-027",
   ]),
   PROD_PROMOTION_READY: Object.freeze([
     "FE-GATE-016",

src/application/ports/in/application-api.ts

@@ -1,8 +1,10 @@
 import type { SessionState } from "../auth-session-port.ts";
+import type { ProductFeatureStatus } from "../product-features-port.ts";
 import type { RuntimeCapabilitySnapshot } from "../runtime-capabilities-port.ts";
 import type { StoragePort } from "../storage-port.ts";
 
 export type { SessionState } from "../auth-session-port.ts";
+export type { ProductFeatureStatus };
 export type { RuntimeCapabilitySnapshot };
 
 /**
@@ -64,6 +66,13 @@ export type ApplicationApi = Readonly<{
      * reads capability state here instead of importing the composition root.
      */
     getCapabilitySnapshot(): RuntimeCapabilitySnapshot;
+    /**
+     * §3.5. Which product features this build contains and which of them the
+     * runtime document switched off. Presentation reads state here; it never
+     * learns how to reach a feature the build left out.
+     */
+    getFeatureSnapshot(): readonly ProductFeatureStatus[];
+    isFeatureActive(featureId: string): boolean;
   }>;
   recovery: Readonly<{
     recoverChunk(input: Readonly<{

src/application/ports/out/application-output-ports.ts

@@ -1,5 +1,6 @@
 import type { AuthSessionPort } from "../auth-session-port.ts";
 import type { ReleaseInfoPort } from "../release-info-port.ts";
+import type { ProductFeaturesPort } from "../product-features-port.ts";
 import type { RuntimeCapabilitiesPort } from "../runtime-capabilities-port.ts";
 import type { StoragePort } from "../storage-port.ts";
 import type { TelemetryPort } from "../telemetry-port.ts";
@@ -19,5 +20,6 @@ export type ApplicationOutputPorts = Readonly<{
   telemetry: TelemetryPort;
   releaseInfo: ReleaseInfoPort;
   runtimeCapabilities: RuntimeCapabilitiesPort;
+  productFeatures: ProductFeaturesPort;
   navigation: Readonly<{ reload(): void }>;
 }>;

src/application/ports/product-features-port.ts

@@ -0,0 +1,16 @@
+import type { ProductFeatureStatus } from "../../contracts/product-features.ts";
+
+export type { ProductFeatureStatus };
+
+/**
+ * §3.5. The application reads feature state; it never resolves it.
+ *
+ * Only the composition root knows both halves of the answer — what the build
+ * compiled in and what the runtime document disabled — so the snapshot arrives
+ * here already reduced to ids and states. It carries no feature module, so
+ * reading it cannot become a way to reach code the build left out.
+ */
+export type ProductFeaturesPort = Readonly<{
+  getSnapshot(): readonly ProductFeatureStatus[];
+  isActive(featureId: string): boolean;
+}>;

src/application/result.ts

@@ -1,10 +1,13 @@
-import type { AppFailure } from "../contracts/errors.ts";
-
 /**
  * The single success/failure carrier used across application input boundaries.
  * Adapters map technology-specific errors to an application failure before
  * constructing this value.
+ *
+ * The type itself lives in `src/contracts` because both layers need it and
+ * neither owns it: `src/contracts/server-state.ts` and
+ * `src/contracts/cursor-pagination.ts` reached back into the application layer
+ * for it, which made the ownership of the shared vocabulary ambiguous in both
+ * directions. Contracts is the lower of the two, so the shared shape sits there
+ * and this module re-exports it for every existing application-side importer.
  */
-export type Result<Value, Failure = AppFailure> =
-  | Readonly<{ ok: true; value: Value }>
-  | Readonly<{ ok: false; error: Failure }>;
+export type { Result } from "../contracts/result.ts";