@hominis/fireforge 0.35.0 → 0.37.0

package/dist/src/commands/doctor-orphaned-harness.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Doctor check for PRE-EXISTING orphaned test-harness workers (0.37.0
+ * item 9b).
+ *
+ * Field incident: a mach invocation that died at harness startup stranded a
+ * Python 3.14 `multiprocessing` spawn worker plus its resource tracker; the
+ * worker reparented to launchd (PPID 1) and busy-spun at 100% CPU for ~26
+ * days (~415 CPU-hours) undetected. The dispatch-side fix is the
+ * process-group reaping in `utils/process.ts`; this check covers orphans
+ * that predate it (or leaked from non-FireForge invocations), using the
+ * detection recipe that found the incident process: PPID 1 + large
+ * accumulated CPU TIME + a `multiprocessing.spawn`/`resource_tracker`
+ * command line.
+ *
+ * Report-only by design: FireForge never kills pre-existing processes it
+ * did not spawn — the check names each candidate and suggests the kill.
+ *
+ * Canary integration was deliberately skipped: the friction log asked for
+ * doctor AND/OR `test --canary`, and adding a system-wide process scan to
+ * the canary hot path buys no extra coverage over the doctor check.
+ */
+import type { DoctorCheckDefinition } from './doctor-check-core.js';
+/** One process matching the orphaned-harness-worker shape. */
+export interface OrphanedHarnessWorker {
+    pid: number;
+    ppid: number;
+    /** Raw TIME column as `ps` printed it. */
+    cpuTime: string;
+    /** Parsed accumulated CPU seconds. */
+    cpuSeconds: number;
+    command: string;
+}
+/**
+ * Parses a `ps` TIME value in either dialect:
+ *   - linux `[dd-]hh:mm:ss` (e.g. `26-03:14:12`, `03:14:12`)
+ *   - darwin/BSD `mm:ss.cc` with cumulative minutes (e.g. `38412:07.55`)
+ * Returns NaN for unrecognized shapes.
+ */
+export declare function parseCpuTime(time: string): number;
+/**
+ * Scans `ps -axo pid=,ppid=,time=,command=` output for orphaned harness
+ * workers: PPID 1 (reparented to init/launchd), a multiprocessing
+ * worker/tracker command line, and at least `minCpuSeconds` of accumulated
+ * CPU time. Pure — fixture-testable without spawning anything.
+ */
+export declare function findOrphanedHarnessWorkers(psOutput: string, minCpuSeconds?: number): OrphanedHarnessWorker[];
+/**
+ * Doctor check reporting orphaned harness workers. Windows has no `ps`;
+ * the check is skipped there (best-effort platform gap, matching the
+ * process-group reaper's POSIX-only sweep).
+ */
+export declare const ORPHANED_HARNESS_DOCTOR_CHECK: DoctorCheckDefinition;

package/dist/src/commands/doctor-orphaned-harness.js

@@ -0,0 +1,132 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Doctor check for PRE-EXISTING orphaned test-harness workers (0.37.0
+ * item 9b).
+ *
+ * Field incident: a mach invocation that died at harness startup stranded a
+ * Python 3.14 `multiprocessing` spawn worker plus its resource tracker; the
+ * worker reparented to launchd (PPID 1) and busy-spun at 100% CPU for ~26
+ * days (~415 CPU-hours) undetected. The dispatch-side fix is the
+ * process-group reaping in `utils/process.ts`; this check covers orphans
+ * that predate it (or leaked from non-FireForge invocations), using the
+ * detection recipe that found the incident process: PPID 1 + large
+ * accumulated CPU TIME + a `multiprocessing.spawn`/`resource_tracker`
+ * command line.
+ *
+ * Report-only by design: FireForge never kills pre-existing processes it
+ * did not spawn — the check names each candidate and suggests the kill.
+ *
+ * Canary integration was deliberately skipped: the friction log asked for
+ * doctor AND/OR `test --canary`, and adding a system-wide process scan to
+ * the canary hot path buys no extra coverage over the doctor check.
+ */
+import { exec } from '../utils/process.js';
+import { ok, warning } from './doctor-check-core.js';
+/**
+ * Command-line shapes of Python multiprocessing helper processes: the
+ * spawn/forkserver worker bootstrap (`from multiprocessing.spawn import
+ * spawn_main; spawn_main(...)`) and the resource tracker.
+ */
+const HARNESS_WORKER_COMMAND_PATTERN = /multiprocessing\.(?:spawn|forkserver)\b|multiprocessing\.resource_tracker|from multiprocessing\.\w+ import/;
+/** Minimum accumulated CPU time before a match is reported (10 minutes). */
+const DEFAULT_MIN_CPU_SECONDS = 600;
+/**
+ * Parses a `ps` TIME value in either dialect:
+ *   - linux `[dd-]hh:mm:ss` (e.g. `26-03:14:12`, `03:14:12`)
+ *   - darwin/BSD `mm:ss.cc` with cumulative minutes (e.g. `38412:07.55`)
+ * Returns NaN for unrecognized shapes.
+ */
+export function parseCpuTime(time) {
+    const trimmed = time.trim();
+    let days = 0;
+    let rest = trimmed;
+    const dayMatch = /^(\d+)-(.*)$/.exec(trimmed);
+    if (dayMatch) {
+        days = Number(dayMatch[1]);
+        rest = dayMatch[2] ?? '';
+    }
+    const parts = rest.split(':');
+    if (parts.length === 3) {
+        // hh:mm:ss (linux; seconds may not carry fractions but tolerate them)
+        const [h, m, s] = parts.map(Number);
+        if ([h, m, s].some((n) => Number.isNaN(n)))
+            return NaN;
+        return days * 86400 + (h ?? 0) * 3600 + (m ?? 0) * 60 + (s ?? 0);
+    }
+    if (parts.length === 2) {
+        // mm:ss.cc (darwin — the minutes field accumulates without wrapping)
+        const [m, s] = parts.map(Number);
+        if ([m, s].some((n) => Number.isNaN(n)))
+            return NaN;
+        return days * 86400 + (m ?? 0) * 60 + (s ?? 0);
+    }
+    return NaN;
+}
+/**
+ * Scans `ps -axo pid=,ppid=,time=,command=` output for orphaned harness
+ * workers: PPID 1 (reparented to init/launchd), a multiprocessing
+ * worker/tracker command line, and at least `minCpuSeconds` of accumulated
+ * CPU time. Pure — fixture-testable without spawning anything.
+ */
+export function findOrphanedHarnessWorkers(psOutput, minCpuSeconds = DEFAULT_MIN_CPU_SECONDS) {
+    const workers = [];
+    for (const line of psOutput.split('\n')) {
+        const match = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.+)$/.exec(line);
+        if (!match)
+            continue;
+        const pid = Number(match[1]);
+        const ppid = Number(match[2]);
+        const cpuTime = match[3] ?? '';
+        const command = (match[4] ?? '').trim();
+        if (ppid !== 1)
+            continue;
+        if (!HARNESS_WORKER_COMMAND_PATTERN.test(command))
+            continue;
+        const cpuSeconds = parseCpuTime(cpuTime);
+        if (Number.isNaN(cpuSeconds) || cpuSeconds < minCpuSeconds)
+            continue;
+        workers.push({ pid, ppid, cpuTime, cpuSeconds, command });
+    }
+    return workers;
+}
+/** Thin exec wrapper for the process listing (tests mock `exec` instead). */
+async function listSystemProcesses() {
+    const result = await exec('ps', ['-axo', 'pid=,ppid=,time=,command='], { timeout: 10000 });
+    if (result.exitCode !== 0) {
+        throw new Error(`ps exited ${String(result.exitCode)}`);
+    }
+    return result.stdout;
+}
+const CHECK_NAME = 'Orphaned harness workers';
+async function runOrphanedHarnessCheck() {
+    let psOutput;
+    try {
+        psOutput = await listSystemProcesses();
+    }
+    catch (error) {
+        return warning(CHECK_NAME, `Could not scan system processes (${error instanceof Error ? error.message : String(error)}); skipping the orphaned-worker check.`);
+    }
+    const orphans = findOrphanedHarnessWorkers(psOutput);
+    if (orphans.length === 0) {
+        return ok(CHECK_NAME);
+    }
+    const rows = orphans
+        .map((w) => `PID ${String(w.pid)} (CPU time ${w.cpuTime}): ${w.command.slice(0, 160)}`)
+        .join('; ');
+    const pids = orphans.map((w) => String(w.pid)).join(' ');
+    return warning(CHECK_NAME, `Found ${String(orphans.length)} orphaned Python multiprocessing worker(s) — PPID 1 with ` +
+        `high accumulated CPU time, the shape a test harness that died at startup leaves behind ` +
+        `(field incident: one such worker busy-spun for ~26 days). ${rows}`, `These look like workers orphaned by a crashed test harness. Verify each command line, ` +
+        `then terminate with: kill ${pids} (or kill -9 if a process survives). ` +
+        'FireForge never kills pre-existing processes automatically.');
+}
+/**
+ * Doctor check reporting orphaned harness workers. Windows has no `ps`;
+ * the check is skipped there (best-effort platform gap, matching the
+ * process-group reaper's POSIX-only sweep).
+ */
+export const ORPHANED_HARNESS_DOCTOR_CHECK = {
+    name: CHECK_NAME,
+    skipIf: () => process.platform === 'win32',
+    run: runOrphanedHarnessCheck,
+};

package/dist/src/commands/doctor-working-tree.js

@@ -94,4 +94,3 @@ export async function inspectEngineWorkingTree(ctx) {
         : '';
     return warning('Engine working tree', `Engine working tree has ${counts.unmanaged} unmanaged change${counts.unmanaged === 1 ? '' : 's'}.${managedTail}`, 'Use "fireforge status --ownership" to separate patch-backed from unmanaged files, then export, discard, or reset only the unmanaged set.');
 }
-//# sourceMappingURL=doctor-working-tree.js.map

package/dist/src/commands/doctor.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: EUPL-1.2
+import { Command } from 'commander';
 import { configExists, getProjectPaths, loadConfig, loadState, updateState, } from '../core/config.js';
 import { furnaceConfigExists as checkFurnaceConfigExists } from '../core/furnace-config.js';
 import { getCurrentBranch, getHead, isGitRepository, isMissingHeadError } from '../core/git.js';
@@ -12,7 +14,9 @@ import { error, info, intro, outro, success, warn } from '../utils/logger.js';
 import { findExecutable } from '../utils/process.js';
 import { POST_REBASE_AUDIT_CHECK } from './doctor/post-rebase-audit.js';
 import { failure, ok, warning } from './doctor-check-core.js';
+import { EXTERNAL_TOOLCHAIN_DOCTOR_CHECK } from './doctor-external-toolchains.js';
 import { FURNACE_DOCTOR_CHECKS } from './doctor-furnace.js';
+import { ORPHANED_HARNESS_DOCTOR_CHECK } from './doctor-orphaned-harness.js';
 import { inspectEngineWorkingTree } from './doctor-working-tree.js';
 import { collectPatchQueueHealth } from './verify.js';
 /**
@@ -173,6 +177,7 @@ const DOCTOR_CHECKS = [
         },
         fix: 'Check fireforge.json for syntax errors or missing fields',
     },
+    EXTERNAL_TOOLCHAIN_DOCTOR_CHECK,
     {
         name: 'Engine directory exists',
         run: (ctx) => {
@@ -260,6 +265,7 @@ const DOCTOR_CHECKS = [
             return warning('Watchman available', 'watchman is not installed or not on PATH. "fireforge watch" requires it.', 'Install watchman (brew install watchman / dnf install watchman / https://facebook.github.io/watchman/), then re-run doctor.');
         },
     },
+    ORPHANED_HARNESS_DOCTOR_CHECK,
     {
         name: 'Patches directory exists',
         run: async (ctx) => {
@@ -476,4 +482,3 @@ export function registerDoctor(program, { getProjectRoot, withErrorHandling }) {
         }
     }));
 }
-//# sourceMappingURL=doctor.js.map

package/dist/src/commands/download.js

@@ -2,10 +2,11 @@
 import { randomUUID } from 'node:crypto';
 import { rename } from 'node:fs/promises';
 import { join } from 'node:path';
+import { Command } from 'commander';
 import { getProjectPaths, loadConfig, loadState, updateState } from '../core/config.js';
 import { withFileLock } from '../core/file-lock.js';
-import { downloadFirefoxSource, formatBytes } from '../core/firefox.js';
-import { getFurnacePaths, updateFurnaceState } from '../core/furnace-config.js';
+import { downloadFirefoxSource, formatBytes, sweepOrphanedEngineWorkDirs, } from '../core/firefox.js';
+import { clearAppliedFurnaceState } from '../core/furnace-config.js';
 import { getHead, initRepository, isGitRepository, isMissingHeadError, resumeRepository, } from '../core/git.js';
 import { restoreTrackedPath } from '../core/git-file-ops.js';
 import { getDirtyFiles } from '../core/git-status.js';
@@ -116,15 +117,8 @@ function closeRestoreSpinner(restoreSpinner, result) {
 }
 async function clearStaleFurnaceApplyState(projectRoot) {
     // --force installs a new baseCommit, which invalidates every applied
-    // checksum in furnace-state.json. Preserve pendingRepair: authoring-side
-    // rollback markers describe unresolved component workspace state and
-    // should survive an engine refresh.
-    const furnacePaths = getFurnacePaths(projectRoot);
-    if (await pathExists(furnacePaths.furnaceState)) {
-        await updateFurnaceState(projectRoot, (current) => ({
-            ...(current.pendingRepair ? { pendingRepair: current.pendingRepair } : {}),
-        }));
-    }
+    // checksum in furnace-state.json.
+    await clearAppliedFurnaceState(projectRoot);
 }
 async function activateReplacementEngine(args) {
     const { engineDir, replacementDir, backupDir } = args;
@@ -285,7 +279,29 @@ export async function downloadCommand(projectRoot, options) {
     const previousVersion = (await loadState(projectRoot)).downloadedVersion;
     info(`Firefox version: ${version}`);
     await checkDiskSpace(projectRoot, 5 * 1024 * 1024 * 1024, warn);
+    // A legitimate holder of this lock runs for 10+ minutes (download +
+    // extract + git indexing). The previous default 30 s timeout failed the
+    // second invocation with "remove the lock directory if it is stale" advice
+    // while the lock was actively held — dangerous guidance mid-extraction.
+    // Wait generously instead: a dead holder is reaped within seconds by the
+    // PID-based stale probe, so a long timeout only ever waits on real work.
+    const downloadLockOptions = {
+        timeoutMs: 30 * 60_000,
+        onTimeoutMessage: 'Timed out waiting for another FireForge download to finish. ' +
+            'If no other `fireforge download` is running, remove .fireforge/download.fireforge.lock and retry.',
+        onStaleLockMessage: (ageMs) => `Removing download lock left behind by a crashed run (${Math.round(ageMs / 1000)}s old).`,
+    };
     await withFileLock(join(paths.fireforgeDir, 'download.fireforge.lock'), async () => {
+        // Reclaim multi-GB partial trees left behind by interrupted runs.
+        // Safe under the download lock: any `.tmp-*`/`.replacement-*` dir
+        // present now is orphaned, since live ones only exist while a
+        // download holds this lock. `.backup-*` dirs are NOT swept — a
+        // backup can hold the previous engine after a failed forced
+        // replacement and is the operator's recovery copy.
+        const sweptDirs = await sweepOrphanedEngineWorkDirs(paths.engine);
+        if (sweptDirs.length > 0) {
+            info(`Removed ${sweptDirs.length} orphaned working director${sweptDirs.length === 1 ? 'y' : 'ies'} from interrupted downloads.`);
+        }
         let installEngineDir = paths.engine;
         let replacementEngineDir;
         let backupEngineDir;
@@ -413,7 +429,7 @@ export async function downloadCommand(projectRoot, options) {
             replacementActivated,
             ...(backupEngineDir !== undefined ? { backupEngineDir } : {}),
         });
-    });
+    }, downloadLockOptions);
 }
 /** Registers the download command on the CLI program. */
 export function registerDownload(program, { getProjectRoot, withErrorHandling }) {
@@ -425,4 +441,3 @@ export function registerDownload(program, { getProjectRoot, withErrorHandling })
         await downloadCommand(getProjectRoot(), pickDefined(options));
     }));
 }
-//# sourceMappingURL=download.js.map

package/dist/src/commands/export-all.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: EUPL-1.2
+import { Command } from 'commander';
 import { isBrandingManagedPath } from '../core/branding.js';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { collectFurnaceManagedPrefixes, furnaceConfigExists, loadFurnaceConfig, } from '../core/furnace-config.js';
@@ -228,8 +230,9 @@ export async function exportAllCommand(projectRoot, options = {}) {
     await checkDanglingFurnaceRegistrations(projectRoot, diff, furnaceExcluded);
     // Check for non-interactive mode
     const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
-    // Auto-fix missing license headers on new files (interactive only)
-    const headersAdded = await autoFixLicenseHeaders(paths.engine, diff, config, isInteractive);
+    // Auto-fix missing license headers on new files (interactive only;
+    // report-only under --dry-run so the preview never mutates engine/)
+    const headersAdded = await autoFixLicenseHeaders(paths.engine, diff, config, isInteractive, isDryRun);
     if (headersAdded) {
         diff = await getAllDiff(paths.engine);
     }
@@ -335,4 +338,3 @@ export function registerExportAll(program, { getProjectRoot, withErrorHandling }
         });
     }));
 }
-//# sourceMappingURL=export-all.js.map

package/dist/src/commands/export-flow.js

@@ -8,10 +8,12 @@
  * testable without dragging the whole command harness along for the ride.
  */
 import { join } from 'node:path';
-import { findAllPatchesForFilesWithDetails, planExport, sanitizeName, } from '../core/patch-export.js';
+import {} from '../core/destructive.js';
+import { normalizePatchArtifact } from '../core/patch-artifact-normalize.js';
+import { findAllPatchesForFilesWithDetails, patchNameSlug, planExport, } from '../core/patch-export.js';
 import { buildModifiedFileAdditionsFromDiff, buildPatchQueueContext, detectNewFilesInDiff, lintPatchQueue, } from '../core/patch-lint.js';
 import { withPatchDirectoryLock } from '../core/patch-lock.js';
-import { addPatchToManifest, loadPatchesManifest, renumberPatchesInManifest, resolvePatchIdentifier, savePatchesManifest, } from '../core/patch-manifest.js';
+import { addPatchToManifest, loadPatchesManifest, loadPatchesManifestForWrite, renumberPatchesInManifest, resolvePatchIdentifier, savePatchesManifest, } from '../core/patch-manifest.js';
 import { applyRenameMapToManifest, buildProjectedManifest, enforcePatchPolicy, } from '../core/patch-policy.js';
 import { extractNewFileContentFromDiff } from '../core/patch-transform.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
@@ -22,7 +24,7 @@ import { assertPlacementPreservesReservedRanges } from './export-placement-polic
 import { findPartialOwnershipOverlap } from './export-shared.js';
 function buildFilenameForPlacement(category, name, order, width) {
     const padded = String(order).padStart(Math.max(3, width), '0');
-    return `${padded}-${category}-${sanitizeName(name)}.patch`;
+    return `${padded}-${category}-${patchNameSlug(name, category)}.patch`;
 }
 function prefixWidthForPatches(manifestPatches, requestedOrder) {
     return manifestPatches.reduce((width, patch) => {
@@ -113,7 +115,9 @@ export function computeExactPlacementPlan(manifestPatches, newPatchCategory, new
  * Resolves a placement plan from CLI flags against the current manifest.
  */
 export async function resolvePlacementPlan(patchesDir, options, category, name) {
-    const manifest = await loadPatchesManifest(patchesDir);
+    // ForWrite: placement planning feeds a manifest rewrite; a corrupt
+    // manifest read as empty would allocate colliding orders.
+    const manifest = await loadPatchesManifestForWrite(patchesDir);
     const existingPatches = manifest?.patches ?? [];
     let targetOrder;
     if (options.order !== undefined) {
@@ -232,7 +236,7 @@ export async function commitPlacementExport(input) {
                 're-run the export with an explicit file list that leaves those files with their owner — ' +
                 'do NOT bypass with --force-unsafe. Pass --force-unsafe only for a reviewed placement conflict.', '--force-unsafe');
         }
-        const originalManifest = await loadPatchesManifest(input.patchesDir);
+        const originalManifest = await loadPatchesManifestForWrite(input.patchesDir);
         if (originalManifest !== null) {
             assertPlacementPreservesReservedRanges(currentPlan, originalManifest.patches, input.config, input.category);
         }
@@ -269,7 +273,9 @@ export async function commitPlacementExport(input) {
                 await renumberPatchesInManifest(input.patchesDir, currentPlan.renameMap);
                 renumberApplied = true;
             }
-            await writeText(patchPath, input.diff);
+            // Normalize identically to commitExportedPatch — the two export
+            // paths must produce one artifact contract for the same diff.
+            await writeText(patchPath, normalizePatchArtifact(input.diff));
             await addPatchToManifest(input.patchesDir, {
                 ...input.metadata,
                 filename: currentPlan.newFilename,
@@ -414,4 +420,3 @@ export async function renderDryRunPreview(input) {
         info('[dry-run] No cross-patch ownership overlap detected.');
     }
 }
-//# sourceMappingURL=export-flow.js.map

package/dist/src/commands/export-placement-gate.js

@@ -105,4 +105,3 @@ export async function gatePlacementPlan(args) {
     }
     return placementPlan;
 }
-//# sourceMappingURL=export-placement-gate.js.map

package/dist/src/commands/export-placement-policy.js

@@ -51,4 +51,3 @@ export function assertPlacementPreservesReservedRanges(plan, manifestPatches, co
             suggestionText, 'export placement');
     }
 }
-//# sourceMappingURL=export-placement-policy.js.map

package/dist/src/commands/export-shared.d.ts

@@ -56,9 +56,13 @@ export declare function confirmSupersedePatches(patchesDir: string, filesAffecte
  * @param diffContent - Current unified diff
  * @param config - Project configuration
  * @param isInteractive - Whether interactive prompts are available
+ * @param dryRun - When true, only REPORT missing headers, never prompt or
+ *   write. Dry-run must stay read-only: before this flag existed, an
+ *   interactive `export --dry-run` prompted (default Yes) and wrote license
+ *   headers into engine/ files, then closed with "no changes made".
  * @returns true if files were modified on disk (caller must regenerate diff)
  */
-export declare function autoFixLicenseHeaders(engineDir: string, diffContent: string, config: FireForgeConfig, isInteractive: boolean): Promise<boolean>;
+export declare function autoFixLicenseHeaders(engineDir: string, diffContent: string, config: FireForgeConfig, isInteractive: boolean, dryRun?: boolean): Promise<boolean>;
 /**
  * Maps every file in `filesAffected` to the existing patches that already
  * claim ownership of it, excluding the caller's own patch (when `newFilename`

package/dist/src/commands/export-shared.js

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { join } from 'node:path';
 import { confirm, select, text } from '@clack/prompts';
-import { addLicenseHeaderToFile, getLicenseHeader } from '../core/license-headers.js';
+import { addLicenseHeaderToFile } from '../core/license-headers.js';
 import { findAllPatchesForFiles } from '../core/patch-export.js';
-import { commentStyleForFile, detectNewFilesInDiff, lintExportedPatch, resolvePatchSizeTier, } from '../core/patch-lint.js';
+import { commentStyleForFile, detectNewFilesInDiff, isAcceptableNewFileHeader, lintExportedPatch, resolvePatchSizeTier, } from '../core/patch-lint.js';
 import { resolvePatchOwnedSysMjs } from '../core/patch-lint-ownership.js';
 import { loadPatchesManifest } from '../core/patch-manifest.js';
 import { getPatchPolicyCategories, isCategoryAllowedByConfig } from '../core/patch-policy.js';
@@ -206,9 +206,13 @@ export async function confirmSupersedePatches(patchesDir, filesAffected, superse
  * @param diffContent - Current unified diff
  * @param config - Project configuration
  * @param isInteractive - Whether interactive prompts are available
+ * @param dryRun - When true, only REPORT missing headers, never prompt or
+ *   write. Dry-run must stay read-only: before this flag existed, an
+ *   interactive `export --dry-run` prompted (default Yes) and wrote license
+ *   headers into engine/ files, then closed with "no changes made".
  * @returns true if files were modified on disk (caller must regenerate diff)
  */
-export async function autoFixLicenseHeaders(engineDir, diffContent, config, isInteractive) {
+export async function autoFixLicenseHeaders(engineDir, diffContent, config, isInteractive, dryRun = false) {
     const license = config.license ?? 'MPL-2.0';
     const newFiles = detectNewFilesInDiff(diffContent);
     if (newFiles.size === 0)
@@ -222,13 +226,22 @@ export async function autoFixLicenseHeaders(engineDir, diffContent, config, isIn
         if (!(await pathExists(filePath)))
             continue;
         const content = await readText(filePath);
-        const expectedHeader = getLicenseHeader(license, style);
-        if (!content.startsWith(expectedHeader)) {
+        // Same acceptance policy as the missing-license-header rule: offering
+        // to "fix" a file the lint already accepts (e.g. a verbatim upstream
+        // MPL block header on a derived JS/CSS file) would stack a second
+        // header on top of a legitimate one.
+        if (!isAcceptableNewFileHeader(file, content, style, license)) {
             filesToFix.push(file);
         }
     }
     if (filesToFix.length === 0)
         return false;
+    if (dryRun) {
+        const fileList = filesToFix.map((f) => `  - ${f}`).join('\n');
+        info(`[dry-run] ${filesToFix.length} new file(s) missing the ${license} license header ` +
+            `(a real export would offer to add them):\n${fileList}`);
+        return false;
+    }
     if (!isInteractive)
         return false;
     const fileList = filesToFix.map((f) => `  - ${f}`).join('\n');
@@ -360,4 +373,3 @@ export async function runSupersedeAndOverlapGates(args) {
         s,
     });
 }
-//# sourceMappingURL=export-shared.js.map

package/dist/src/commands/export.js

@@ -1,10 +1,12 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { stat } from 'node:fs/promises';
 import { join } from 'node:path';
-import { Option } from 'commander';
+import { Command, Option } from 'commander';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { appendHistory } from '../core/destructive.js';
+import { withEngineSessionLock } from '../core/engine-session-lock.js';
 import { collectFurnaceManagedPrefixes } from '../core/furnace-config.js';
+import { enforceFreshFurnaceSources } from '../core/furnace-stale-export.js';
 import { getStatusWithCodes, isGitRepository } from '../core/git.js';
 import { generateBinaryFilePatch, generateFullFilePatch } from '../core/git-diff.js';
 import { isBinaryFile } from '../core/git-file-ops.js';
@@ -18,7 +20,7 @@ import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { toError } from '../utils/errors.js';
 import { ensureDir, pathExists } from '../utils/fs.js';
 import { info, intro, outro, spinner, verbose, warn } from '../utils/logger.js';
-import { pickDefined } from '../utils/options.js';
+import { commanderArgParser, pickDefined } from '../utils/options.js';
 import { stripEnginePrefix } from '../utils/paths.js';
 import { parsePositiveIntegerFlag } from '../utils/validation.js';
 import { commitPlacementExport, renderDryRunPreview } from './export-flow.js';
@@ -200,6 +202,11 @@ async function prepareExport(projectRoot, files, options) {
         throw new GeneralError(`Paths "${pathList}" have no changes to export.\n\n` +
             'Run "fireforge status" to see modified files.');
     }
+    // Stale-furnace-source gate (0.37.0 item 4): the export captures deployed
+    // engine copies; refuse (or warn under --allow-stale-furnace) when a
+    // covered component's source changed since the last furnace apply. Runs
+    // after --exclude-furnace so excluded furnace files never trigger it.
+    await enforceFreshFurnaceSources(projectRoot, allFiles, options.allowStaleFurnace === true, 'export');
     let diff = await generatePatchDiff(paths.engine, allFiles);
     if (!diff.trim()) {
         if (options.skipLint) {
@@ -209,12 +216,16 @@ async function prepareExport(projectRoot, files, options) {
         }
         throw new GeneralError('The specified paths have no diff content to export.');
     }
-    // Ensure patches directory exists
-    await ensureDir(paths.patches);
+    // Ensure patches directory exists. Skip during a dry-run so the command
+    // is purely read-only (matching export-all's dry-run contract).
+    if (!options.dryRun) {
+        await ensureDir(paths.patches);
+    }
     const config = await loadConfig(projectRoot);
     const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
-    // Auto-fix missing license headers on new files (interactive only)
-    const headersAdded = await autoFixLicenseHeaders(paths.engine, diff, config, isInteractive);
+    // Auto-fix missing license headers on new files (interactive only;
+    // report-only under --dry-run so the preview never mutates engine/)
+    const headersAdded = await autoFixLicenseHeaders(paths.engine, diff, config, isInteractive, options.dryRun ?? false);
     if (headersAdded) {
         diff = await generatePatchDiff(paths.engine, allFiles);
     }
@@ -398,23 +409,24 @@ export function registerExport(program, { getProjectRoot, withErrorHandling }) {
         .option('--supersede', 'Allow superseding multiple existing patches')
         .option('--skip-lint', 'Skip patch lint checks (downgrade errors to warnings)')
         .option('--dry-run', 'Print the export plan (including supersede preview) without writing')
-        .addOption(new Option('--order <N>', 'Place the new patch at this exact unused order without renumbering existing patches').argParser((v) => parsePositiveIntegerFlag('--order', v)))
+        .addOption(new Option('--order <N>', 'Place the new patch at this exact unused order without renumbering existing patches').argParser(commanderArgParser((v) => parsePositiveIntegerFlag('--order', v))))
         .option('--before <anchor>', 'Place the new patch immediately before <anchor>')
         .option('--after <anchor>', 'Place the new patch immediately after <anchor>')
         .option('-y, --yes', 'Skip confirmation for placement renumbers (required for non-TTY)')
         .option('--force-unsafe', 'Bypass cross-patch lint refusal on projected placement')
         .option('--exclude-furnace', 'Exclude furnace-managed file paths from the export')
+        .option('--allow-stale-furnace', 'Export the deployed engine copy even when the components/ source changed since the last furnace apply')
         .option('--allow-overlap', 'Acknowledge cross-patch ownership overlap (default mode only; the resulting queue fails verify)')
         .addOption(new Option('--tier <tier>', 'Force a tier override on the new patch (only "branding" recognised)').choices(['branding']))
         .option('--lint-ignore <check-id>', 'Suppress a lint check on this patch (writes to PatchMetadata.lintIgnore; repeatable)', (value, prev) => [...prev, value], [])
         .action(withErrorHandling(async (paths, options) => {
         const { category, tier, lintIgnore, ...rest } = options;
-        await exportCommand(getProjectRoot(), paths, {
+        const projectRoot = getProjectRoot();
+        await withEngineSessionLock(projectRoot, 'export', () => exportCommand(projectRoot, paths, {
             ...pickDefined(rest),
             ...(category !== undefined ? { category } : {}),
             ...(tier !== undefined ? { tier: tier } : {}),
             ...(lintIgnore !== undefined && lintIgnore.length > 0 ? { lintIgnore } : {}),
-        });
+        }));
     }));
 }
-//# sourceMappingURL=export.js.map

package/dist/src/commands/furnace/apply.js

@@ -6,6 +6,8 @@ import { logApplyResult } from '../../core/furnace-apply-output.js';
 import { furnaceConfigExists, getFurnacePaths, loadFurnaceConfig, } from '../../core/furnace-config.js';
 import { isComponentSourceFile } from '../../core/furnace-constants.js';
 import { runFurnaceMutation } from '../../core/furnace-operation.js';
+import { getPersistableAppliedEntry, persistSingleComponentState, shouldPersistSingleComponentState, } from '../../core/furnace-state-persist.js';
+import { countEntriesWithBlockingStepErrors } from '../../core/furnace-step-errors.js';
 import { findOverrideBaseVersionDrift, formatOverrideBaseVersionDriftError, formatOverrideBaseVersionDriftWarning, } from '../../core/furnace-version-drift.js';
 import { FurnaceError } from '../../errors/furnace.js';
 import { pathExists } from '../../utils/fs.js';
@@ -282,17 +284,32 @@ export async function furnaceApplyCommand(projectRoot, name, options = {}) {
         throw new FurnaceError(formatOverrideBaseVersionDriftError(driftEntries));
     }
     const applySpinner = dryRun ? undefined : spinner('Applying components to engine...');
-    const result = await runFurnaceMutation(projectRoot, 'apply-rollback', (ctx) => applyAllComponents(projectRoot, dryRun, {
-        operationContext: ctx,
-        ...(name !== undefined ? { componentName: name } : {}),
-    }), { dryRun });
+    const result = await runFurnaceMutation(projectRoot, 'apply-rollback', async (ctx) => {
+        // `persistState: false` for a NAMED apply is load-bearing: the batch
+        // persist path replaces `appliedChecksums` wholesale with only this
+        // run's entries, and the batch loops filter to the named component —
+        // so routing a named apply through it persisted a state file
+        // containing ONLY that component, wiping every other component's
+        // checksums. Orphan detection and deleted-file undeploy both key on
+        // that state, so the wiped components' stale engine files became
+        // invisible to apply AND to `furnace validate`. Named apply merges
+        // per-component state below, exactly like `furnace deploy <name>`.
+        const applyResult = await applyAllComponents(projectRoot, dryRun, {
+            operationContext: ctx,
+            ...(name !== undefined ? { componentName: name, persistState: false } : {}),
+        });
+        if (name !== undefined && shouldPersistSingleComponentState(applyResult, dryRun)) {
+            await persistSingleComponentState(projectRoot, getPersistableAppliedEntry('Apply', name, applyResult.applied[0]), getFurnacePaths(projectRoot));
+        }
+        return applyResult;
+    }, { dryRun });
     if (applySpinner) {
         applySpinner.stop('Components applied');
     }
     logApplyResult(result, dryRun);
     const appliedWithStepErrorsCount = dryRun
         ? 0
-        : result.applied.filter((entry) => (entry.stepErrors?.length ?? 0) > 0).length;
+        : countEntriesWithBlockingStepErrors(result.applied);
     const totalApplyFailures = result.errors.length + appliedWithStepErrorsCount;
     if (totalApplyFailures > 0) {
         throw new FurnaceError(`${totalApplyFailures} component${totalApplyFailures === 1 ? '' : 's'} failed to apply cleanly`);
@@ -310,4 +327,3 @@ export async function furnaceApplyCommand(projectRoot, name, options = {}) {
         await runWatchLoop(projectRoot);
     }
 }
-//# sourceMappingURL=apply.js.map

package/dist/src/commands/furnace/chrome-doc-remove.js

@@ -139,4 +139,3 @@ export async function furnaceChromeDocRemoveCommand(projectRoot, name, options =
     }
     outro('Chrome document removed');
 }
-//# sourceMappingURL=chrome-doc-remove.js.map

package/dist/src/commands/furnace/chrome-doc-templates.js

@@ -329,4 +329,3 @@ export function localeJarMnEntryForChromeDoc(name) {
 export function localesFtlWildcardCapturesScaffoldedName(jarMnContents) {
     return /\(%browser\/(?:\*\*\/)?\*\.ftl\)/.test(jarMnContents);
 }
-//# sourceMappingURL=chrome-doc-templates.js.map

package/dist/src/commands/furnace/chrome-doc-tests.js

@@ -149,4 +149,3 @@ firefox-appdir = "browser"
 ["${chromeDocPackagingTestFileName(name)}"]
 `;
 }
-//# sourceMappingURL=chrome-doc-tests.js.map

package/dist/src/commands/furnace/chrome-doc.js

@@ -359,4 +359,3 @@ export async function furnaceChromeDocCreateCommand(projectRoot, name, options =
     ].join('\n'), name);
     outro('Chrome document created');
 }
-//# sourceMappingURL=chrome-doc.js.map

package/dist/src/commands/furnace/create-browser-test.js

@@ -177,4 +177,3 @@ add_task(async function test_${underscored}_defined() {
     }
     return testFiles;
 }
-//# sourceMappingURL=create-browser-test.js.map