@hominis/fireforge 0.17.0 → 0.18.0

package/dist/src/commands/export-all.js

@@ -5,7 +5,7 @@ import { getProjectPaths, loadConfig } from '../core/config.js';
 import { collectFurnaceManagedPrefixes } from '../core/furnace-config.js';
 import { hasChanges, isGitRepository } from '../core/git.js';
 import { getAllDiff, getDiffForFilesAgainstHead } from '../core/git-diff.js';
-import { getWorkingTreeStatus } from '../core/git-status.js';
+import { expandUntrackedDirectoryEntries, getWorkingTreeStatus } from '../core/git-status.js';
 import { extractAffectedFiles } from '../core/patch-apply.js';
 import { commitExportedPatch, findAllPatchesForFiles } from '../core/patch-export.js';
 import { buildPatchQueueContext, collectNewFileCreatorsByPath, detectNewFilesInDiff, } from '../core/patch-lint.js';
@@ -41,7 +41,14 @@ async function resolveFurnaceExclusionPolicy(paths, projectRoot, excludeFurnace)
     const prefixes = await collectFurnaceManagedPrefixes(projectRoot);
     if (prefixes.size === 0)
         return new Set();
-    const changedFiles = await getWorkingTreeStatus(paths.engine);
+    // Expand collapsed `?? dir/` entries before matching against Furnace
+    // prefixes — otherwise a Furnace-introduced directory slips past the
+    // filter and later lands in the non-Furnace path list that feeds the
+    // aggregate diff, where `getDiffForFilesAgainstHead` crashes with
+    // EISDIR (eval finding: export-all unusable on a fresh project with
+    // Furnace scaffolding).
+    const rawStatus = await getWorkingTreeStatus(paths.engine);
+    const changedFiles = await expandUntrackedDirectoryEntries(paths.engine, rawStatus);
     const furnaceManagedFiles = changedFiles
         .flatMap((entry) => [entry.file, entry.originalPath].filter((value) => !!value))
         .filter((file) => [...prefixes].some((prefix) => file.startsWith(prefix)));
@@ -129,7 +136,8 @@ export async function exportAllCommand(projectRoot, options = {}) {
     // output shape aligned with the single-file `export` command.
     let diff;
     if (furnaceExcluded.size > 0) {
-        const allChanged = await getWorkingTreeStatus(paths.engine);
+        const rawChanged = await getWorkingTreeStatus(paths.engine);
+        const allChanged = await expandUntrackedDirectoryEntries(paths.engine, rawChanged);
         const nonFurnacePaths = [
             ...new Set(allChanged
                 .flatMap((entry) => [entry.file, entry.originalPath].filter((value) => !!value))

package/dist/src/commands/export-shared.d.ts

@@ -17,8 +17,14 @@ import type { SpinnerHandle } from '../utils/logger.js';
  *   `--skip-lint` when exactly one advisory rule does not apply to a
  *   specific patch — e.g. `large-patch-lines` on a cohesive branding
  *   bundle that genuinely cannot be split.
+ * @param patchTier - Optional explicit tier override (threaded from
+ *   `PatchMetadata.tier`). Forces the branding-tier thresholds when
+ *   set, independent of the auto-detect allowlist. When the branding
+ *   tier is applied (either via this opt-in or the auto-detect), a
+ *   single `info()` line surfaces the choice so the tier decision is
+ *   visible rather than silent.
  */
-export declare function runPatchLint(engineDir: string, filesAffected: string[], diffContent: string, config: FireForgeConfig, skipLint?: boolean, patchQueueCtx?: import('../core/patch-lint-cross.js').PatchQueueContext, ignoreChecks?: ReadonlySet<string>): Promise<void>;
+export declare function runPatchLint(engineDir: string, filesAffected: string[], diffContent: string, config: FireForgeConfig, skipLint?: boolean, patchQueueCtx?: import('../core/patch-lint-cross.js').PatchQueueContext, ignoreChecks?: ReadonlySet<string>, patchTier?: 'branding'): Promise<void>;
 /**
  * Resolves patch metadata interactively or from flags, with shared validation.
  * @param options - Export command options

package/dist/src/commands/export-shared.js

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 import { confirm, select, text } from '@clack/prompts';
 import { addLicenseHeaderToFile, getLicenseHeader } from '../core/license-headers.js';
 import { findAllPatchesForFiles } from '../core/patch-export.js';
-import { commentStyleForFile, detectNewFilesInDiff, lintExportedPatch, } from '../core/patch-lint.js';
+import { commentStyleForFile, detectNewFilesInDiff, lintExportedPatch, resolvePatchSizeTier, } from '../core/patch-lint.js';
 import { loadPatchesManifest } from '../core/patch-manifest.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { pathExists, readText } from '../utils/fs.js';
@@ -24,9 +24,27 @@ import { isValidPatchCategory, PATCH_CATEGORIES, validatePatchName } from '../ut
  *   `--skip-lint` when exactly one advisory rule does not apply to a
  *   specific patch — e.g. `large-patch-lines` on a cohesive branding
  *   bundle that genuinely cannot be split.
+ * @param patchTier - Optional explicit tier override (threaded from
+ *   `PatchMetadata.tier`). Forces the branding-tier thresholds when
+ *   set, independent of the auto-detect allowlist. When the branding
+ *   tier is applied (either via this opt-in or the auto-detect), a
+ *   single `info()` line surfaces the choice so the tier decision is
+ *   visible rather than silent.
  */
-export async function runPatchLint(engineDir, filesAffected, diffContent, config, skipLint, patchQueueCtx, ignoreChecks) {
-    const issues = await lintExportedPatch(engineDir, filesAffected, diffContent, config, patchQueueCtx, ignoreChecks);
+export async function runPatchLint(engineDir, filesAffected, diffContent, config, skipLint, patchQueueCtx, ignoreChecks, patchTier) {
+    // Compute the tier decision independently of the lint pipeline so the
+    // decision can be surfaced even when the rule body emitted no issues
+    // (e.g. a branding patch under the soft threshold still benefits from
+    // operators knowing which tier governed the run). The same helper is
+    // reused inside `lintPatchSize`, so the surfaced tier and the tier
+    // that actually drove the thresholds never drift.
+    const tierDecision = resolvePatchSizeTier(filesAffected, patchTier);
+    if (tierDecision.tier === 'branding') {
+        info(tierDecision.source === 'explicit'
+            ? 'Lint: branding threshold tier applied via patches.json `tier: "branding"` opt-in.'
+            : 'Lint: branding threshold tier applied (patch is all under browser/branding/ plus registration siblings).');
+    }
+    const issues = await lintExportedPatch(engineDir, filesAffected, diffContent, config, patchQueueCtx, ignoreChecks, patchTier);
     if (issues.length === 0)
         return;
     const errors = issues.filter((i) => i.severity === 'error');

package/dist/src/commands/furnace/override.js

@@ -79,17 +79,14 @@ async function copyOverrideFiles(engineDir, srcDir, destDir, componentName, hasF
     return copiedFiles;
 }
 /**
- * Writes override metadata to disk and updates furnace.json with the new override entry.
- * @param projectRoot - Root directory of the project
- * @param destDir - Override component directory
- * @param componentName - Component tag name
- * @param overrideType - Override mode that was created
- * @param description - Human-readable override description
- * @param details - Source component metadata from the engine scan
- * @param firefoxVersion - Firefox version recorded in the workspace config
- * @param config - Mutable Furnace config object to update
+ * Writes override metadata to disk and updates furnace.json with the new
+ * override entry. Re-reads the current on-disk furnace.json inside the
+ * operation lock and splices the new entry onto the fresh state so two
+ * concurrent `furnace override` commands cannot race their read-modify
+ * -write cycles into a single surviving entry (eval 2: parallel overrides
+ * both reported success but furnace.json kept only the second writer).
  */
-async function saveOverrideConfig(projectRoot, destDir, componentName, overrideType, description, details, firefoxVersion, config, journal, baseCommit) {
+async function saveOverrideConfig(projectRoot, destDir, componentName, overrideType, description, details, firefoxVersion, journal, baseCommit) {
     const overrideJson = {
         type: overrideType,
         description,
@@ -100,14 +97,27 @@ async function saveOverrideConfig(projectRoot, destDir, componentName, overrideT
     const overrideJsonPath = join(destDir, 'override.json');
     await snapshotFile(journal, overrideJsonPath);
     await writeJson(overrideJsonPath, overrideJson);
-    config.overrides[componentName] = {
+    // Re-read the current furnace.json inside the lock. The outer caller
+    // loaded a snapshot before entering `runFurnaceMutation`, but another
+    // furnace mutation (override / init / sync) may have landed in between
+    // — writing back the stale snapshot would drop that concurrent write.
+    const freshConfig = await loadAuthoringFurnaceConfig(projectRoot);
+    freshConfig.overrides[componentName] = {
         type: overrideType,
         description,
         basePath: details.sourcePath,
         baseVersion: firefoxVersion,
         ...(baseCommit ? { baseCommit } : {}),
     };
-    await writeFurnaceConfig(projectRoot, config);
+    // Promote from the stock bucket here, against the fresh state, so the
+    // stock→override transition survives even when another concurrent
+    // override already rewrote furnace.json between the outer read and
+    // this write.
+    const stockIndex = freshConfig.stock.indexOf(componentName);
+    if (stockIndex !== -1) {
+        freshConfig.stock.splice(stockIndex, 1);
+    }
+    await writeFurnaceConfig(projectRoot, freshConfig);
 }
 /**
  * Performs the transactional mutation phase of furnace override under the
@@ -123,7 +133,7 @@ async function performOverrideMutations(args) {
         try {
             const filesCopied = await copyOverrideFiles(args.engineDir, args.srcDir, args.destDir, args.componentName, args.details.hasFTL, args.overrideType, args.ftlDir, journal);
             await snapshotFile(journal, args.furnacePaths.furnaceConfig);
-            await saveOverrideConfig(args.projectRoot, args.destDir, args.componentName, args.overrideType, args.description, args.details, args.firefoxVersion, args.config, journal, args.baseCommit);
+            await saveOverrideConfig(args.projectRoot, args.destDir, args.componentName, args.overrideType, args.description, args.details, args.firefoxVersion, journal, args.baseCommit);
             return filesCopied;
         }
         catch (error) {

package/dist/src/commands/furnace/remove.js

@@ -3,6 +3,7 @@ import { readdir, unlink } from 'node:fs/promises';
 import { join } from 'node:path';
 import { confirm } from '@clack/prompts';
 import { getProjectPaths, loadConfig } from '../../core/config.js';
+import { removeCustomFtlJarMnEntry } from '../../core/furnace-apply-ftl.js';
 import { extractComponentChecksums, getOverrideEngineTargetPath, isOverrideCopyCandidate, restoreOverrideFileToBaseline, } from '../../core/furnace-apply-helpers.js';
 import { getFurnacePaths, loadFurnaceConfig, loadFurnaceState, updateFurnaceState, writeFurnaceConfig, } from '../../core/furnace-config.js';
 import { resolveFtlDir } from '../../core/furnace-constants.js';
@@ -353,6 +354,13 @@ export async function furnaceRemoveCommand(projectRoot, name, options = {}) {
                         await removeFile(ftlPath);
                         info(`Deleted localized file engine/${ftlRel}`);
                     }
+                    // Drop the locale jar.mn chrome registration that `applyCustomFtlFile`
+                    // wrote during deploy — otherwise the engine is left with a
+                    // `locale/.../${name}.ftl` entry pointing at a file we just
+                    // deleted. 2026-04-21 eval (Finding #1): `furnace remove` left
+                    // `browser/locales/jar.mn` referencing the missing FTL, which
+                    // would break the next package-manifest validation.
+                    await removeCustomFtlJarMnEntry(paths.engine, `${name}.ftl`, ftlDir, customConfig, journal);
                 }
             }
             let testCleanupFailures = [];

package/dist/src/commands/furnace/rename.js

@@ -3,9 +3,9 @@ import { readdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { getProjectPaths, loadConfig } from '../../core/config.js';
 import { getFurnacePaths, loadFurnaceConfig, updateFurnaceState, writeFurnaceConfig, } from '../../core/furnace-config.js';
-import { isComponentSourceFile, resolveFtlDir, tagNameToClassName, } from '../../core/furnace-constants.js';
+import { isComponentSourceFile, resolveFtlChromeSubPath, resolveFtlDir, resolveFtlLocaleJarMnPath, tagNameToClassName, } from '../../core/furnace-constants.js';
 import { recordFurnaceRollbackFailure, runFurnaceMutation } from '../../core/furnace-operation.js';
-import { addCustomElementRegistration, addJarMnEntries, removeCustomElementRegistration, removeJarMnEntries, } from '../../core/furnace-registration.js';
+import { addCustomElementRegistration, addJarMnEntries, addLocaleFtlJarMnEntry, removeCustomElementRegistration, removeJarMnEntries, removeLocaleFtlJarMnEntry, } from '../../core/furnace-registration.js';
 import { CUSTOM_ELEMENT_TAG_PATTERN, CUSTOM_ELEMENT_TAG_RULES, } from '../../core/furnace-registration-validate.js';
 import { createRollbackJournal, restoreRollbackJournalOrThrow, snapshotDir, snapshotFile, } from '../../core/furnace-rollback.js';
 import { getStoriesDir } from '../../core/furnace-stories.js';
@@ -272,7 +272,8 @@ async function performRenameMutations(args) {
             // 3. Update engine registrations (custom components only)
             if (isCustom && config.custom[newName]?.register && (await pathExists(args.engineDir))) {
                 const ftlDir = resolveFtlDir(config.ftlBasePath);
-                await updateEngineRegistrations(args.engineDir, oldName, newName, newDir, ftlDir, journal);
+                const isLocalized = config.custom[newName].localized;
+                await updateEngineRegistrations(args.engineDir, oldName, newName, newDir, ftlDir, isLocalized, journal);
             }
             // 4. Re-key furnace-state.json checksums from old name to new name
             await rekeyStateChecksums(args.projectRoot, componentType, oldName, newName);
@@ -358,7 +359,7 @@ async function rekeyStateChecksums(projectRoot, componentType, oldName, newName)
         return result;
     });
 }
-async function updateEngineRegistrations(engineDir, oldName, newName, newDir, ftlDir, journal) {
+async function updateEngineRegistrations(engineDir, oldName, newName, newDir, ftlDir, isLocalized, journal) {
     const customElementsPath = join(engineDir, 'toolkit/content/customElements.js');
     const jarMnPath = join(engineDir, 'toolkit/content/jar.mn');
     if (await pathExists(customElementsPath)) {
@@ -386,6 +387,24 @@ async function updateEngineRegistrations(engineDir, oldName, newName, newDir, ft
         await writeText(newFtlPath, ftlContent);
         await removeFile(oldFtlPath);
     }
+    // Re-wire the locale jar.mn chrome registration when the component is
+    // localized. Before this, `updateEngineRegistrations` renamed the .ftl
+    // file on disk but left the locale jar.mn pointing at
+    // `locale/.../${oldName}.ftl`, so `furnace validate` passed while the
+    // engine still carried a stale registration for the now-missing file
+    // (eval finding: stale old-name registration after rename).
+    if (isLocalized) {
+        const chromeSubPath = resolveFtlChromeSubPath(ftlDir);
+        const localeJarRel = resolveFtlLocaleJarMnPath(ftlDir);
+        if (chromeSubPath !== undefined && localeJarRel !== undefined) {
+            const localeJarAbs = join(engineDir, localeJarRel);
+            if (await pathExists(localeJarAbs)) {
+                await snapshotFile(journal, localeJarAbs);
+                await removeLocaleFtlJarMnEntry(engineDir, localeJarRel, oldName, chromeSubPath);
+                await addLocaleFtlJarMnEntry(engineDir, localeJarRel, newName, chromeSubPath);
+            }
+        }
+    }
 }
 /**
  * Renames a custom or override component atomically: updates directory name,

package/dist/src/commands/lint.js

@@ -5,9 +5,9 @@ import { isBrandingManagedPath } from '../core/branding.js';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { getStatusWithCodes, hasChanges, isGitRepository } from '../core/git.js';
 import { getAllDiff, getDiffForFilesAgainstHead } from '../core/git-diff.js';
-import { getModifiedFiles, getModifiedFilesInDir, getUntrackedFiles, getUntrackedFilesInDir, } from '../core/git-status.js';
+import { expandUntrackedDirectoryEntries, getModifiedFilesInDir, getUntrackedFiles, getUntrackedFilesInDir, getWorkingTreeStatus, } from '../core/git-status.js';
 import { extractAffectedFiles } from '../core/patch-apply.js';
-import { buildPatchQueueContext, lintExportedPatch, lintPatchQueue } from '../core/patch-lint.js';
+import { buildPatchQueueContext, lintExportedPatch, lintPatchQueue, resolvePatchSizeTier, } from '../core/patch-lint.js';
 import { collectDiffFilePaths, tagLintIssues } from '../core/patch-lint-diff-tag.js';
 import { loadPatchesManifest } from '../core/patch-manifest.js';
 import { GeneralError } from '../errors/base.js';
@@ -103,10 +103,17 @@ async function resolveLintDiff(engineDir, files, binaryName) {
     // survive in the patch queue as-is. The exclusion mirrors the
     // `branding` bucket in `fireforge status` so the two views stay
     // consistent.
+    //
+    // `expandUntrackedDirectoryEntries` promotes collapsed `?? dir/`
+    // status rows to individual file entries before the diff pass.
+    // Without it, a patch that introduces a new directory shows up as
+    // `?? browser/modules/<fork>/` and `getDiffForFilesAgainstHead`
+    // crashed with EISDIR reading the directory as if it were a file
+    // (eval finding: aggregate lint unusable on a real imported queue).
     if (binaryName) {
-        const modified = await getModifiedFiles(engineDir);
-        const untracked = await getUntrackedFiles(engineDir);
-        const allPaths = [...new Set([...modified, ...untracked])];
+        const rawStatus = await getWorkingTreeStatus(engineDir);
+        const expanded = await expandUntrackedDirectoryEntries(engineDir, rawStatus);
+        const allPaths = [...new Set(expanded.map((entry) => entry.file))];
         const nonBrandingPaths = allPaths.filter((path) => !isBrandingManagedPath(path, binaryName));
         const excludedCount = allPaths.length - nonBrandingPaths.length;
         if (excludedCount > 0) {
@@ -315,7 +322,13 @@ async function lintPerPatch(projectRoot, paths) {
         if (!diff.trim())
             continue;
         const ignore = patch.lintIgnore?.length ? new Set(patch.lintIgnore) : undefined;
-        const patchIssues = await lintExportedPatch(paths.engine, existing, diff, config, ctx, ignore);
+        const decision = resolvePatchSizeTier(existing, patch.tier);
+        if (decision.tier === 'branding') {
+            info(decision.source === 'explicit'
+                ? `${patch.filename}: branding threshold tier applied via patches.json \`tier: "branding"\` opt-in.`
+                : `${patch.filename}: branding threshold tier applied (all files under browser/branding/ plus registration siblings).`);
+        }
+        const patchIssues = await lintExportedPatch(paths.engine, existing, diff, config, ctx, ignore, patch.tier);
         for (const issue of patchIssues) {
             issues.push({ ...issue, file: `${patch.filename} :: ${issue.file}` });
         }

package/dist/src/commands/patch/delete.js

@@ -39,7 +39,10 @@ export async function patchDeleteCommand(projectRoot, identifier, options = {})
     }
     const target = resolvePatchIdentifier(identifier, manifest.patches);
     if (!target) {
-        throw new InvalidArgumentError(`Patch "${identifier}" not found. Available: ${manifest.patches.map((p) => p.filename).join(', ')}`, identifier);
+        const available = manifest.patches
+            .map((p) => p.name && p.name !== p.filename ? `${p.filename} (name: ${p.name})` : p.filename)
+            .join(', ');
+        throw new InvalidArgumentError(`Patch "${identifier}" not found. Accepted identifiers: ordinal (e.g. 2), filename (e.g. 002-ui-foo.patch), or manifest name (e.g. ui-foo). Available: ${available}`, identifier);
     }
     // Build the full queue context once so we can scan each patch's newFiles
     // without re-parsing for the dependency check below.

package/dist/src/commands/patch/reorder.js

@@ -270,7 +270,10 @@ export async function patchReorderCommand(projectRoot, identifier, options = {})
     }
     const target = resolvePatchIdentifier(identifier, manifest.patches);
     if (!target) {
-        throw new InvalidArgumentError(`Patch "${identifier}" not found. Available: ${manifest.patches.map((p) => p.filename).join(', ')}`, identifier);
+        const available = manifest.patches
+            .map((p) => p.name && p.name !== p.filename ? `${p.filename} (name: ${p.name})` : p.filename)
+            .join(', ');
+        throw new InvalidArgumentError(`Patch "${identifier}" not found. Accepted identifiers: ordinal (e.g. 2), filename (e.g. 002-ui-foo.patch), or manifest name (e.g. ui-foo). Available: ${available}`, identifier);
     }
     const { destinationOrder, anchorFilename } = resolveDestination(target, manifest.patches, options);
     const renameMap = computeRenameMap(manifest.patches, target, destinationOrder);

package/dist/src/commands/re-export-files.js

@@ -75,8 +75,10 @@ export async function reExportFilesInPlace(paths, selectedPatches, options, conf
     // `lintIgnore` threads through so a shrink of an advisory-noisy-but-
     // intentional patch (branding bundle, localised-resource pack) does not
     // have to choose between `--skip-lint` (blunt) and the full rebase path.
+    // `target.tier` threads the explicit branding-threshold opt-in for
+    // the branding patch that also touches a non-allowlisted sibling.
     const ignoreChecks = target.lintIgnore?.length ? new Set(target.lintIgnore) : undefined;
-    await runPatchLint(paths.engine, actualProjectedFiles, projectedDiff, config, options.skipLint, undefined, ignoreChecks);
+    await runPatchLint(paths.engine, actualProjectedFiles, projectedDiff, config, options.skipLint, undefined, ignoreChecks, target.tier);
     // Project the cross-patch context: replace the target entry with its
     // would-be shrunken self (new diff + new newFiles + new
     // modifiedFileAdditions). The projected entry must repopulate both

package/dist/src/commands/re-export.js

@@ -201,8 +201,11 @@ async function reExportSinglePatch(patch, paths, manifest, options, isDryRun, co
     // intentional patch (a cohesive branding bundle, a localised-resource
     // pack) without either `--skip-lint` (too blunt) or falling through to
     // the full `rebase` flow (which internally skips the lint pipeline).
+    // The paired `patch.tier` threads the explicit branding-threshold
+    // opt-in the same way, for the branding patch that also touches a
+    // non-allowlisted registration sibling.
     const ignoreChecks = patch.lintIgnore?.length ? new Set(patch.lintIgnore) : undefined;
-    await runPatchLint(paths.engine, existingFiles, diffContent, config, options.skipLint, undefined, ignoreChecks);
+    await runPatchLint(paths.engine, existingFiles, diffContent, config, options.skipLint, undefined, ignoreChecks, patch.tier);
     if (isDryRun) {
         info(`[dry-run] ${patch.filename}: ${existingFiles.length} file(s)`);
     }

package/dist/src/commands/register.js

@@ -45,6 +45,17 @@ export async function registerCommand(projectRoot, filePath, options = {}) {
     }
     const result = await registerFile(projectRoot, engineRelativePath, options.dryRun, options.after);
     if (options.dryRun) {
+        // 2026-04-21 eval (Finding #8): dry-run always said "Would
+        // register" even when the rule's idempotency check already knew
+        // the entry was present, so automation read the plan as "work to
+        // do" and the following real run then reported "Already
+        // registered". Surface the idempotency decision in dry-run too so
+        // the plan mirrors the real command's outcome.
+        if (result.skipped) {
+            info(`[dry-run] Already registered: ${engineRelativePath} in ${result.manifest}`);
+            outro('Dry run complete');
+            return;
+        }
         info(`[dry-run] Would register ${engineRelativePath}`);
         info(`  manifest: ${result.manifest}`);
         info(`  entry: ${result.entry}`);

package/dist/src/commands/test.js

@@ -10,7 +10,7 @@ import { operatorAlreadySetAppPath, resolveXpcshellAppdirArg, } from '../core/xp
 import { GeneralError } from '../errors/base.js';
 import { AmbiguousBuildArtifactsError, BuildError } from '../errors/build.js';
 import { pathExists } from '../utils/fs.js';
-import { info, intro, outro, spinner, warn } from '../utils/logger.js';
+import { info, intro, outro, spinner, success, warn } from '../utils/logger.js';
 import { pickDefined } from '../utils/options.js';
 import { stripEnginePrefix } from '../utils/paths.js';
 async function assertTestPathsExist(engineDir, testPaths) {
@@ -47,6 +47,32 @@ function hasStaleBuildArtifactsSignal(output) {
     return (/chrome:\/\/branding\/locale\/brand\.properties/i.test(output) ||
         /browser\/branding\/[^/\s]+\/moz\.build/i.test(output));
 }
+/**
+ * Fork-module-not-registered signal. 2026-04-21 eval Finding #14:
+ * a hominis test failed with `Failed to load resource:///modules/hominis/
+ * HominisStore.sys.mjs`. The branding pattern happened to also match
+ * because the test harness printed a branding warning during its
+ * teardown, and the stale-build branch won by precedence — telling the
+ * operator to rebuild when the real fix is to register the module in
+ * the fork's `browser/modules/<binary>/moz.build`. Match a
+ * `resource:///modules/<binaryName>/` pattern so fork-owned module
+ * failures surface the right diagnosis.
+ */
+function hasForkModuleSignal(output, binaryName) {
+    const pattern = new RegExp(`Failed to load resource:\\/\\/\\/modules\\/${binaryName.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\$&')}\\/`, 'i');
+    return pattern.test(output);
+}
+function buildForkModuleMessage(binaryName) {
+    return (`Test failed to load a fork-owned module at resource:///modules/${binaryName}/*.sys.mjs.\n\n` +
+        'This is almost always a module-registration issue, not a stale build. The fork module directory is missing an entry that maps its file into the resource URI tree, so `ChromeUtils.importESModule` cannot resolve it.\n\n' +
+        'Check that:\n' +
+        `  - browser/modules/${binaryName}/moz.build lists the missing module in EXTRA_JS_MODULES.\n` +
+        `  - browser/modules/moz.build references the ${binaryName}/ subdirectory (DIRS += [...]).\n` +
+        '  - The last `fireforge build` (or `fireforge build --ui`) completed successfully against the current manifests. If the registration is new, the UI-faster build path may not pick it up — a full build may be required.\n\n' +
+        'Use `fireforge register browser/modules/' +
+        binaryName +
+        '/<file>.sys.mjs` to add the EXTRA_JS_MODULES entry if it is missing.');
+}
 // Detects the broader xpcshell symptom where every `resource:///modules/...`
 // import fails — the signature of xpcshell running with the wrong app-dir on
 // a manifest that sets `firefox-appdir = "browser"`. Checked AFTER the
@@ -87,13 +113,22 @@ function buildMochitestHttp3ServerMessage() {
         "  - The `BROWSER_CHROME_MANIFESTS` entry for your fork's chrome.manifest is registered.\n\n" +
         'This is an upstream Firefox harness interaction; FireForge can only diagnose it.');
 }
-function handleNonZeroTestExit(result, normalizedPaths, appdirInjectionAttempted) {
+function handleNonZeroTestExit(result, normalizedPaths, appdirInjectionAttempted, binaryName) {
     if (result.exitCode === 0 || result.exitCode === 130)
         return;
     const combinedOutput = `${result.stdout}\n${result.stderr}`;
     if (/UNKNOWN TEST\b/i.test(combinedOutput)) {
         throw new GeneralError(buildUnknownTestMessage(normalizedPaths));
     }
+    // Fork-owned module load failures must beat the branding stale-build
+    // branch: 2026-04-21 eval (Finding #14) saw a hominis test fail with
+    // `Failed to load resource:///modules/hominis/HominisStore.sys.mjs`
+    // while the harness teardown printed a branding warning that the old
+    // stale-build pattern matched, so the operator was told to rebuild
+    // when the real fix is to register the missing module.
+    if (hasForkModuleSignal(combinedOutput, binaryName)) {
+        throw new GeneralError(buildForkModuleMessage(binaryName));
+    }
     // Branding-specific stale-build signals keep priority over the broader
     // xpcshell-appdir hint: when `chrome://branding/locale/brand.properties`
     // fails to resolve, the fix really is "rebuild", not "pass --app-path".
@@ -157,8 +192,8 @@ export async function testCommand(projectRoot, testPaths, options = {}) {
     if (options.build) {
         await prepareBuildEnvironment(projectRoot, paths, projectConfig);
         const s = spinner('Running incremental build...');
-        const buildExitCode = await buildUI(paths.engine);
-        if (buildExitCode !== 0) {
+        const buildResult = await buildUI(paths.engine);
+        if (buildResult.exitCode !== 0) {
             s.error('Pre-test build failed');
             throw new BuildError('Pre-test build failed', 'mach build faster');
         }
@@ -200,13 +235,19 @@ export async function testCommand(projectRoot, testPaths, options = {}) {
             if (!preflight.ok) {
                 throw new GeneralError('Marionette preflight reported FAIL — see output above.');
             }
-            // Close the intro frame explicitly. Without an outro, clack's
-            // grouped-output mode left the PASS line hanging inside an
-            // unclosed tree — in the eval's non-TTY capture the info line
-            // itself failed to render, so `test --doctor` looked like it had
-            // exited silently after the spinner start line. The outro also
-            // gives scripts a deterministic "done" marker to parse.
-            outro(`Marionette preflight: PASS (${preflight.durationMs}ms)`);
+            // Belt-and-suspenders: write the PASS footer via `success()`
+            // AND `outro()` AND a direct stdout write. The eval
+            // reproducibly captured the intro + info line but nothing
+            // after the preflight returned, which we believe is a
+            // non-TTY clack rendering quirk that occasionally swallows
+            // the last log line before process exit. `success()` routes
+            // through a different clack entry point than `info()`, and
+            // `process.stdout.write` bypasses clack entirely so the
+            // PASS status is always visible in the captured output.
+            const summary = `Marionette preflight: PASS (${preflight.durationMs}ms)`;
+            success(summary);
+            outro('Test completed');
+            process.stdout.write(`${summary}\n`);
             return;
         }
         if (!preflight.ok) {
@@ -256,7 +297,7 @@ export async function testCommand(projectRoot, testPaths, options = {}) {
     catch (error) {
         throw new BuildError('Test process failed to start', 'mach test', error instanceof Error ? error : undefined);
     }
-    handleNonZeroTestExit(result, normalizedPaths, appdirInjection);
+    handleNonZeroTestExit(result, normalizedPaths, appdirInjection, projectConfig.binaryName);
 }
 /**
  * Resolves and (when applicable) appends an `--app-path=<abs>` arg to

package/dist/src/commands/token-coverage.js

@@ -2,7 +2,8 @@
 import { join } from 'node:path';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { furnaceConfigExists, loadFurnaceConfig } from '../core/furnace-config.js';
-import { getStatusWithCodes, isGitRepository } from '../core/git.js';
+import { isGitRepository } from '../core/git.js';
+import { expandUntrackedDirectoryEntries, getWorkingTreeStatus } from '../core/git-status.js';
 import { measureTokenCoverage } from '../core/token-coverage.js';
 import { getTokensCssPath } from '../core/token-manager.js';
 import { GeneralError } from '../errors/base.js';
@@ -23,8 +24,14 @@ export async function tokenCoverageCommand(projectRoot) {
     }
     const config = await loadConfig(projectRoot);
     const tokensCssPath = getTokensCssPath(config.binaryName);
-    const files = await getStatusWithCodes(paths.engine);
-    const statusCssFiles = files
+    // Expand collapsed `?? dir/` untracked entries so untracked CSS files
+    // inside a new patch-added directory are included in coverage. Before
+    // this, an imported fork that added a new CSS tree saw "No modified
+    // CSS files" because `git status --porcelain` collapsed the directory
+    // and the file-extension filter could not see the .css inside.
+    const rawStatus = await getWorkingTreeStatus(paths.engine);
+    const expandedStatus = await expandUntrackedDirectoryEntries(paths.engine, rawStatus);
+    const statusCssFiles = expandedStatus
         .filter((f) => f.file.endsWith('.css') && f.file !== tokensCssPath)
         .map((f) => f.file);
     // Also scan CSS files deployed by Furnace custom components. Deployed

package/dist/src/commands/wire.js

@@ -226,6 +226,15 @@ export async function wireCommand(projectRoot, name, options = {}) {
     // dry-run is meant to preview the mutation plan without requiring
     // the subscript to already exist, matching the "plan before write"
     // pattern operators rely on for setup scripts).
+    //
+    // Dry-run keeps the existence check advisory rather than fatal: the
+    // "wire first, create file after" workflow is a legitimate use of
+    // preview, but operators who run dry-run over a typo were surprised
+    // when the real command then refused with `Subscript file not
+    // found`. 2026-04-23 eval (Finding in eval 2): dry-run produced a
+    // plausible plan and the non-dry-run invocation then errored. The
+    // info line surfaces the mismatch in preview mode so the operator
+    // can act on the warning before re-running without --dry-run.
     if (!options.dryRun) {
         const paths = getProjectPaths(projectRoot);
         const subscriptPath = join(paths.engine, subscriptDir, `${name}.js`);
@@ -234,6 +243,13 @@ export async function wireCommand(projectRoot, name, options = {}) {
                 'Create the file in engine/ before wiring.', 'name');
         }
     }
+    else {
+        const paths = getProjectPaths(projectRoot);
+        const subscriptPath = join(paths.engine, subscriptDir, `${name}.js`);
+        if (!(await pathExists(subscriptPath))) {
+            info(`Note: ${subscriptDir}/${name}.js does not exist yet — the real wire command will require it before writing. Create the file before re-running without --dry-run.`);
+        }
+    }
     if (options.dryRun) {
         printWireDryRun(getProjectPaths(projectRoot).engine, name, subscriptDir, domFilePath, domTargetPath, options);
         return;

package/dist/src/core/browser-wire.js

@@ -2,8 +2,9 @@
 import { join, relative } from 'node:path';
 import { GeneralError } from '../errors/base.js';
 import { toError } from '../utils/errors.js';
+import { verbose } from '../utils/logger.js';
 import { toRootRelativePath } from '../utils/paths.js';
-import { getProjectPaths } from './config.js';
+import { getProjectPaths, loadConfig } from './config.js';
 import { createRollbackJournal, restoreRollbackJournal, snapshotFile } from './furnace-rollback.js';
 import { registerBrowserContent } from './manifest-register.js';
 import { DEFAULT_DOM_TARGET } from './wire-dom-fragment.js';
@@ -63,18 +64,34 @@ export async function wireSubscript(root, name, options = {}) {
         await snapshotFile(journal, join(engineDir, effectiveDomTargetPath));
     }
     await snapshotFile(journal, join(engineDir, 'browser/base/jar.mn'));
+    // Compute the project-scoped patch-lint marker (`// <BINARY>:`) so
+    // every wire mutator can stamp it into the emitted comment block.
+    // Without this, `lintModificationComments` trips
+    // `missing-modification-comment` on wire-generated edits the next
+    // time the operator exports — the same tool wrote the code and a
+    // sibling tool then rejected it (eval 1 Finding #9). A broken config
+    // should not block the wire, so the fallback marker keeps the
+    // previous lint-friendly default when the config cannot be loaded.
+    let marker = 'FIREFORGE:';
+    try {
+        const config = await loadConfig(root);
+        marker = `${config.binaryName.toUpperCase()}:`;
+    }
+    catch (error) {
+        verbose(`Using default wire marker because fireforge.json could not be loaded: ${toError(error).message}`);
+    }
     try {
         // 1. Add subscript to browser-main.js
-        const subscriptAdded = await addSubscriptToBrowserMain(engineDir, name);
+        const subscriptAdded = await addSubscriptToBrowserMain(engineDir, name, marker);
         // 2. Add init expression to browser-init.js (if provided)
         let initAdded = false;
         if (options.init) {
-            initAdded = await addInitToBrowserInit(engineDir, options.init, options.after);
+            initAdded = await addInitToBrowserInit(engineDir, options.init, options.after, marker);
         }
         // 3. Add destroy expression to browser-init.js onUnload() (if provided)
         let destroyAdded = false;
         if (options.destroy) {
-            destroyAdded = await addDestroyToBrowserInit(engineDir, options.destroy);
+            destroyAdded = await addDestroyToBrowserInit(engineDir, options.destroy, marker);
         }
         // 4. Add #include directive to the top-level chrome document (if provided)
         let domInserted = false;

package/dist/src/core/build-audit.js

@@ -94,6 +94,16 @@ export function isPackageablePath(sourcePath) {
     }
     if (BUILD_INPUT_BASENAMES.has(basename(sourcePath)))
         return false;
+    // `.inc.xhtml` fragments are consumed via `#include` from a registered
+    // chrome document and resolved at packaging time — they never ship as
+    // a standalone packaged artifact. 2026-04-21 eval (Finding #11):
+    // `fireforge build --ui` after `wire --dom` flagged the wired
+    // `*.inc.xhtml` as "missing packaged artifact" even though
+    // `register` correctly refuses to register it and the operator
+    // followed the documented workflow. Mirror the same carve-out the
+    // register rules apply.
+    if (sourcePath.endsWith('.inc.xhtml'))
+        return false;
     for (const ext of PACKAGEABLE_EXTENSIONS) {
         if (sourcePath.endsWith(ext))
             return true;