@hominis/fireforge 0.38.0 → 0.39.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.39.0
+
+- **`fireforge discard` restores patch-claimed paths to their PATCH-APPLIED baseline instead of pristine upstream, and re-materializes patch-created files instead of deleting them** (FORGE F1, P0 data-loss bug — 15 `patch-backed`/`owned` engine files discarded with `--yes` came back as upstream Firefox artwork, `jar.mn` lost all 134 fork entries, and patch-created files like `hominis-start.html` were deleted outright, all under the message "File restored to original state"; recovery cost a full `reset` + 207-patch `import` + rebuild): discard now consults the manifest's ownership claims per status entry and restores claimed files by folding HEAD content through every affecting patch in order (`computePatchedContent`), leaving the post-`import` worktree convention intact (patch edits stay unstaged ` M`, patch creations stay untracked `??`); patch-deleted files are removed to match the baseline. The legacy semantics are an explicit opt-in via the new `--to-upstream` flag. Success messages name the baseline (`File restored to patch baseline (0001-ui-edit.patch)`, `File re-materialized from patch baseline (…)`, `File restored to pristine upstream (HEAD)`); directory mode applies the same rule per file and its outro buckets the outcomes (`3 file(s) restored: 1 to patch baseline, 1 re-materialized, 1 to upstream state`); dry-run lines annotate each path with its restore target. A corrupt manifest or an unreconstructible baseline REFUSES (naming `--to-upstream`) rather than silently reverting to HEAD; multi-owner (conflict) claims restore the cumulative baseline with a warning pointing at `status --ownership`. Pinned by `discard-patch-baseline.integration.test.ts` (the exact handoff shape: edit-patch + create-patch, dirty both, discard each, assert patch content and git state) and `discard-baseline.test.ts`.
+- **New per-patch lint check `mozbuild-unsorted-list` catches unsorted `EXTRA_JS_MODULES` (and sibling strict-ordered moz.build lists) before any build is dispatched** (FORGE F2, feature — three friction-log occurrences where an unsorted insertion surfaced only as `mozbuild.util.UnsortedError … expected "X" but got "Y"` at configure time, each costing a full multi-minute build cycle): the check reads each patch-touched `moz.build` from the engine tree and reports the exact expected/got pair mozbuild would raise (`moz.build list EXTRA_JS_MODULES is not alphabetically sorted: expected "X" but got "Y" (mozbuild will fail at configure time with UnsortedError)`), using mozbuild's case-insensitive ordering. Covered variables: `EXTRA_COMPONENTS`, `EXTRA_JS_MODULES`, `EXTRA_PP_COMPONENTS`, `EXPORTS`, `PYTHON_UNITTEST_MANIFESTS`, `TESTING_JS_MODULES`, `XPIDL_SOURCES`, including dotted namespaces (`EXTRA_JS_MODULES.<subdir>`); `DIRS` is deliberately excluded (order-meaningful). Severity error; waivable per patch via `lintIgnore: ["mozbuild-unsorted-list"]`; participates in the per-patch lint cache like every other rule.
+- **Forward-import detection now catches a bare getter-property line added to an existing `defineESModuleGetters` map, and every refusal names the exact `patch staged-dependency` invocation to paste** (FORGE F3, bug + message — a patch inserting `Foo: "resource://gre/modules/Foo.sys.mjs",` into a PRE-EXISTING getter object carried no `defineESModuleGetters(` opener in its added lines, so the export gate missed it and the refusal surfaced one consumer at a time downstream): added-lines-only content is additionally scanned for `Name: "resource://…"` property lines (resource/chrome/moz-src schemes, forward-importable extensions only; deduped against the existing extractors so a patch adding the whole call reports once; the `// fireforge-ignore: forward-import` marker and staged-dependency suppression apply unchanged). The `forward-import` message now embeds the exact per-owner remedy — `fireforge patch staged-dependency <patch> --add --file <site> --specifier "<url>" --creates <path> --owner <patch>` — with the fingerprint unchanged. The "reports only the first offender" half of the field report did NOT reproduce on 0.38.0 code: the rule already emits one issue per site and the export gate returns all details (pinned by a two-site test); the observed one-at-a-time behavior was an artifact of the getter shapes being missed.
+- **`patch move-files <from> <to>` into an EXISTING patch is now a real transaction** (FORGE F4, feature — the preview-only flow printed two `re-export --files` commands in the WRONG order (grow first) and without the `--allow-shrink`/`--yes` flags the real execution then demanded, costing three refusals per move): the two-positional form now performs the shrink→grow as one operation under the patch-directory lock with rollback, mirroring `patch split`/`--create`: both bodies are regenerated from the worktree, per-patch linted with each patch's own `lintIgnore`/`tier`, cross-patch linted as a projection (only regressions the move itself introduces refuse; `--force-unsafe` overrides), staged-dependency owners re-point to the target, and forward edges the move introduces are auto-declared. `--dry-run` previews without writing; `-y/--yes` covers non-TTY. The equivalent manual `re-export` commands are still printed — now in EXECUTABLE order (shrink first, flags included) with a note that the shrink must land first.
+- **`lint --per-patch --max-warnings 0` on the cache-hit path: claim REFUTED; two warm-run gaps hardened** (FORGE F5 — the reported 0-exit-despite-warnings was observed once on a 0.37-line host and does not reproduce on 0.38.0+: cached issues flow through the same `--max-warnings` comparison as fresh ones, pinned since 0.38.0 by the "cached warnings still fail per-patch lint" test; the cache key hashes every affected engine file plus the engine HEAD SHA, so an engine-side revert that would empty a patch's diff always misses the cache — now pinned explicitly). One REAL warm-run gap is fixed: an all-cache-hit run previously dropped run-level checkJs errors entirely (e.g. "typescript not installed", unreadable extra shim), letting a warm run report fewer errors than a cold one; global checkJs findings are now emitted whenever checkJs is configured, building the queue-wide program lazily on demand.
+- **`patch lint-ignore --add` warns that the waiver is subject to the project's patch-policy review process** (FORGE F6, message-only — a size-only waiver turned per-patch lint green and then failed a downstream policy audit as `lint-ignore-unreviewed`, a discovery costing a full multi-minute gate run): every `--add` that lands a new check id (including `--dry-run`) prints: "This lint waiver is subject to the project's patch-policy review process. Downstream policy audits that mirror lintIgnore lists in a reviewed allow-map will refuse this patch until the map is updated to include the new ID(s)." No warning on `--remove`, `--clear`, or a no-op add. (Per the upstream adjudication, the audit demanding the patch's WHOLE lintIgnore list in the review map remains intentional; this is the write-time warning only.)
+- **The mixed-harness refusal runs BEFORE the pre-test build** (FORGE F7, inefficiency — `fireforge test <xpcshell file> <browser file> --build` spent the full build before reporting "cannot run xpcshell and browser/mochitest paths in the same mach invocation"): harness classification is a pure path→manifest lookup and now runs immediately after path normalization, ahead of the `--build` dispatch and the stale/coverage gates; a mixed request refuses in milliseconds and `runProtectedMachBuild` is never invoked (pinned by test). Stale/coverage refusals still take precedence over missing-path errors.
+- **`token add --mode override` also writes existing `:root[data-theme="dark"]` / `:root[data-theme="light"]` blocks** (FORGE F8, bug — an override add wrote `:root` and the `@media (prefers-color-scheme: dark)` block but not the explicit theme-attribute blocks, so on scaffolds requiring identical token sets across all themed lists every override add was a guaranteed half-finished edit failing the downstream invariants audit): when the tokens CSS carries top-level `:root[data-theme="dark"]`/`:root[data-theme="light"]` blocks, the dark value is mirrored into the dark block and the base value into the light block (idempotent per block; files without those blocks are unchanged), with an info line naming the blocks written. The report's claim that the FireForge-generated file header documents the CLI "cannot write" those blocks did not match this repo — no such text exists in FireForge's scaffold (it is consumer-authored); nothing to drop here.
+- **A `.patch` extension on a patch-name argument no longer double-suffixes, and `patch rename` explains its no-ops** (FORGE F9, bug + partial refutation — `patch move-files <from> 348-ui-editor-panels.patch --create` produced `348-ui-editor-panels-patch.patch`, and the repair `rename --to 348-ui-editor-panels.patch` reported "Patch rename (no-op)"): `patchNameSlug` now strips one trailing `.patch` (case-insensitive) before sanitisation, converging `export --name`, `patch split --name`, `move-files --create`, and `rename --to` — so the double-suffix never forms and the repair rename is a REAL rename. A true no-op now says why (`nothing to change — filename already "…" (slug of "X" is "Y"), name already "…"`). The claimed positional `<from> <to>` usage string on `rename` was REFUTED: registration is `rename <name>` with a required `--to` flag on 0.38.0.
+- **xpcshell-only runs skip the Marionette port preflight and the mochitest client flags** (FORGE F10, bug — `fireforge test` probed port 2828 even for xpcshell path sets, so a developer's interactive browser holding the port killed xpcshell runs, and `--marionette-port <n>` alone then failed the dispatch because the mochitest-only client flags were forwarded to mach; the only working incantation was the `--mach-arg --flavor=xpcshell` crutch): when manifest classification shows every requested path is xpcshell, the stale-port preflight is skipped (with an explanatory line when `--marionette-port`/`--kill-stale-marionette` were passed) and neither `--setpref=marionette.port` nor `--marionette=127.0.0.1:<n>` is forwarded — the crutch is unnecessary. Pathless runs and `--doctor` (whose probe launches a Marionette browser regardless) keep the preflight.
+- **New read-only coverage reporter: `fireforge status --test-coverage`** (FORGE F11, feature — with concurrent sessions sharing one engine tree, the only way to learn the current recorded test-packaging coverage was to trip the out-of-coverage refusal on a real run): prints the last build baseline's coverage (`full`, or the scoped path list with the refusal implication), `builtAt`, `binaryName`, engine HEAD, and the new `recordedBy` field (`fireforge build`, `fireforge build --ui`, `fireforge test --build <paths>`) that 0.39.0 baselines now record — older baselines render `Recorded by: unknown` and `full (implicit — baseline predates coverage recording)`. Needs only the project root (no engine/git); mutually exclusive with the other status modes. Per the upstream adjudication, coverage REPLACES — no union model; this is strictly a reporter.
+- **`typecheck` and the checkJs lint pass no longer silently suppress undefined free identifiers (TS2304/TS2552)** (FORGE F12, bug — a deployed module referencing `EditorState.create(...)` with no import typechecked as "0 errors across all three projects" because the codes were unconditionally suppressed as globals-shim noise; the failure surfaced as a runtime `ReferenceError` manifesting as a hung suite): both flows now report undefined identifiers at a configurable severity — default `warning` (visible without breaking gates; blocking under `--max-warnings 0`), `error` to make them hard failures, `off` to restore the historical suppression — via `typecheck.undefinedIdentifiers` and `patchLint.undefinedIdentifiers` in fireforge.json. Shim-covered Firefox globals stay clean; reported diagnostics append a hint naming the extra-shim and config remedies. The other module-resolution suppressions (TS2307/2306/2305/2792/2580/7016) are unchanged.
+- **`reset` and `import` warn at completion when `components.conf` diverged from the last full build** (FORGE F13, message — after a `reset` + `import` revert train, the next gate run's unit sweep refused on the stale compiled StaticComponents table one full rebuild too late): both commands now run the existing static-components probe after a successful mutation and print: "components.conf changed relative to the last full \"fireforge build\": <paths>. The compiled StaticComponents table in obj-\* no longer matches the tree, so the next \"fireforge test\" will require a full \"fireforge build\" first — a scoped \"fireforge test --build\" cannot regenerate the compiled table." Advisory only (never throws, silent without a baseline); dry-run/cancelled/failed paths skip it.
+- **The forward-import "Closest legal ordinal" hint is suppressed when no legal ordinal exists in the importing patch's category range** (FORGE F14, message bug — the hint suggested ordinal 388 for a dependency that no reorder could satisfy, sending the operator into a `patch reorder` the category-range policy then refused): when `patchPolicy` is configured and the computed ordinal falls outside the importing patch's category range, the sentence becomes "No legal ordinal in the <category> category range (<from-to>) lands after the creating patch(es); declaring the staged dependency is the recommended remedy." Fingerprints are unchanged across both variants; without a policy the hint prints as before.
+- **`export` never offers to prepend the project license header onto a vendored third-party file** (FORGE F15, bug — the header auto-fix offered EUPL-1.2 headers for three byte-identity-pinned MIT xterm bundles; accepting (or `-y`) would have mislicensed upstream code): new-file candidates carrying a recognized third-party permissive banner (MIT, ISC, BSD-2/3-Clause, Apache-2.0 — by license text markers or a bare `SPDX-License-Identifier`) are excluded from the offer and the dry-run fix list and reported separately: "N new file(s) carry a third-party permissive license banner and were left untouched (vendored); if the missing-license-header lint check flags them, waive it with --lint-ignore missing-license-header". The lint check itself still fires — the reviewed waiver (expressible at creation since 0.38.0's `export --lint-ignore`) remains the sanctioned path.
+- **Signal-shaped configure/build exits are labeled as external interruptions** (FORGE F16 — the reported `--headless`→configure exit-144 mechanism was REFUTED: `--headless` only ever lands in mach TEST args and `mach configure` receives no environment from the test path, so no plausible interaction exists): configure and build failures with exit codes in the 128+N signal convention now append e.g. "Exit 144 is signal-shaped (144 - 128 = 16, SIGURG on this host): the process was likely interrupted externally (OOM-killer, terminal disconnect, display/session teardown) rather than failing on its own, and the log may be truncated mid-step", using the host's real signal table — so the next occurrence is self-describing.
+- **Headed macOS no-output timeouts hint at display sleep and `caffeinate`** (FORGE F17, message-only — a headed single-file run with no `caffeinate` wrapper timed out at 370 s before the first TEST-START; every subsequent `caffeinate -dimsu`-wrapped run passed): when a harness crash with the no-output-timeout shape came from a HEADED run on macOS, the failure message appends: "Hint: this was a HEADED run on macOS that died at the no-output timeout. A common cause is the display going to sleep mid-run, which freezes the headed browser before any test starts. Wrap headed runs in `caffeinate -dimsu <command>` to keep the display awake, or pass --headless." Auto-wrapping dispatches in `caffeinate` was evaluated and DEFERRED — the message half is the clearly-correct, cheap half.
+
 ## 0.38.0
 
 - **`status --ownership` reports a furnace-deployed file whose owning patch body went stale as drift** (friction-log item 1, bug — after `furnace deploy` refreshed 12 deployed widget copies, the pre-export "consult ownership" step read clean while the composed gate caught the staleness later on the re-export path): the classifier no longer short-circuits every furnace-prefixed path into the `furnace` bucket — a furnace path claimed by exactly ONE patch now runs the same expected-content comparison as any patch-owned file (`computePatchedContent` vs the deployed copy, deletion and error branches included), classifying as `patch-owned-drift` on divergence and staying `furnace` on a match. Multi-owner and unowned furnace paths keep the old bucket (cross-patch conflicts are already surfaced independently), so the only behavioral change is that stale widget patches now show as drift in the table and in `--json` (machine consumers see those paths move from `"furnace"` to `"patch-owned-drift"`). An integration test pins the exact observed sequence: deploy, export the patch, edit the component source, deploy again, and `status --ownership` reports the owning patch drifted.

package/dist/src/commands/build.js

@@ -3,7 +3,7 @@ import { Command, InvalidArgumentError as CommanderInvalidArgumentError } from '
 import { validateBrandOverride } from '../core/brand-validation.js';
 import { auditBuildArtifacts } from '../core/build-audit.js';
 import { readBuildBaseline, writeBuildBaseline } from '../core/build-baseline.js';
-import { prepareBuildEnvironment } from '../core/build-prepare.js';
+import { describeSignalShapedExit, prepareBuildEnvironment } from '../core/build-prepare.js';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { withEngineSessionLock } from '../core/engine-session-lock.js';
 import { attemptMozinfoRewrite, build, buildArtifactMismatchMessage, buildUI, hasBuildArtifacts, hasRunnableBundle, runMach, withBuildLock, } from '../core/mach.js';
@@ -147,6 +147,7 @@ function buildFailureDiagnostics(result, engineDir, objDir, machCommand) {
         : `cd ${engineDir} && ./mach build -v`;
     return [
         `Build failed with exit code ${result.exitCode}.`,
+        describeSignalShapedExit(result.exitCode),
         `Mach phase: ${machCommand}`,
         makeError ? `Last make error: ${makeError}` : undefined,
         makeContext ? `Recent make context:\n${makeContext}` : undefined,
@@ -326,13 +327,17 @@ export async function buildCommand(projectRoot, options) {
     // Record a fresh baseline only on clean success so the next run audits
     // against this build's HEAD. A failed build keeps the prior baseline so
     // the next attempt still catches long-standing packaging drops.
+    await recordFullBuildBaseline(projectRoot, paths.engine, config.binaryName, options.ui === true);
+    outro(`Build completed in ${timeStr}!`);
+}
+/** Persists the full-coverage baseline; a failed write never fails the build. */
+async function recordFullBuildBaseline(projectRoot, engineDir, binaryName, ui) {
     try {
-        await writeBuildBaseline(projectRoot, paths.engine, config.binaryName, 'full');
+        await writeBuildBaseline(projectRoot, engineDir, binaryName, 'full', undefined, ui ? 'fireforge build --ui' : 'fireforge build');
     }
     catch (baselineError) {
         verbose(`Could not persist build baseline: ${toError(baselineError).message}`);
     }
-    outro(`Build completed in ${timeStr}!`);
 }
 /** Registers the build command on the CLI program. */
 export function registerBuild(program, { getProjectRoot, withErrorHandling }) {

package/dist/src/commands/discard.js

@@ -2,9 +2,9 @@
 import { confirm } from '@clack/prompts';
 import { Command } from 'commander';
 import { getProjectPaths } from '../core/config.js';
+import { applyDiscardBaseline, describeConflictWarning, describeDiscardBaseline, describeDiscardOutcome, planDiscardBaselines, planUpstreamDiscards, summarizeDiscardBaselines, } from '../core/discard-baseline.js';
 import { collectFurnaceManagedPrefixes } from '../core/furnace-config.js';
 import { getHead, isGitRepository, isMissingHeadError } from '../core/git.js';
-import { discardStatusEntry } from '../core/git-file-ops.js';
 import { expandUntrackedDirectoryEntries, getWorkingTreeStatus } from '../core/git-status.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { GitError } from '../errors/git.js';
@@ -12,6 +12,42 @@ import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
 import { info, intro, isCancel, outro, spinner, warn } from '../utils/logger.js';
 import { pickDefined } from '../utils/options.js';
+/**
+ * Shared interactive confirmation for the single-file and directory paths.
+ * Returns false when the operator cancelled (the caller printed the outro).
+ */
+async function confirmDiscard(message, hint, options) {
+    if (options.yes || options.dryRun)
+        return true;
+    const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
+    if (!isInteractive) {
+        throw new InvalidArgumentError('Interactive confirmation not available. Use --yes flag to discard without confirmation.', hint);
+    }
+    const confirmed = await confirm({ message, initialValue: false });
+    if (isCancel(confirmed) || !confirmed) {
+        outro('Discard cancelled');
+        return false;
+    }
+    return true;
+}
+/**
+ * Plans the restore baseline for `entries`: the patch-applied baseline for
+ * patch-claimed paths (FORGE F1), or pristine HEAD when `--to-upstream`
+ * explicitly requests the legacy semantics.
+ */
+async function planDiscards(patchesDir, engineDir, entries, options) {
+    if (options.toUpstream)
+        return planUpstreamDiscards(entries);
+    return planDiscardBaselines(patchesDir, engineDir, entries);
+}
+/** Dry-run label including the rename pair and the restore-baseline suffix. */
+function dryRunLabel(plan) {
+    const { entry } = plan;
+    const target = entry.originalPath && entry.originalPath !== entry.file
+        ? `${entry.originalPath} -> ${entry.file}`
+        : entry.file;
+    return `${target} (${describeDiscardBaseline(plan)})`;
+}
 /**
  * Discards every status entry whose path lives under `dirPath`. Used by
  * `discardCommand` as a directory-recursion fallback when the operator
@@ -23,28 +59,15 @@ import { pickDefined } from '../utils/options.js';
  * discard runs sequentially under its own try/catch so a failure on one
  * file is reported but does not block the remaining files in the batch.
  */
-async function discardDirectoryEntries(projectRoot, engineDir, dirPath, entries, options) {
-    if (!options.yes && !options.dryRun) {
-        const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
-        if (!isInteractive) {
-            throw new InvalidArgumentError('Interactive confirmation not available. Use --yes flag to discard without confirmation.', 'Use: fireforge discard <directory> --yes');
-        }
-        const confirmed = await confirm({
-            message: `Discard changes to ${entries.length} file${entries.length === 1 ? '' : 's'} under ${dirPath}/?`,
-            initialValue: false,
-        });
-        if (isCancel(confirmed) || !confirmed) {
-            outro('Discard cancelled');
-            return;
-        }
-    }
+async function discardDirectoryEntries(projectRoot, engineDir, patchesDir, dirPath, entries, options) {
+    const proceed = await confirmDiscard(`Discard changes to ${entries.length} file${entries.length === 1 ? '' : 's'} under ${dirPath}/?`, 'Use: fireforge discard <directory> --yes', options);
+    if (!proceed)
+        return;
+    const plans = await planDiscards(patchesDir, engineDir, entries, options);
     if (options.dryRun) {
         info(`Would discard changes to ${entries.length} file(s) under ${dirPath}/:`);
-        for (const entry of entries) {
-            const target = entry.originalPath && entry.originalPath !== entry.file
-                ? `${entry.originalPath} -> ${entry.file}`
-                : entry.file;
-            info(`  ${target}`);
+        for (const plan of plans) {
+            info(`  ${dryRunLabel(plan)}`);
         }
         outro('Dry run complete — no changes made');
         return;
@@ -52,20 +75,26 @@ async function discardDirectoryEntries(projectRoot, engineDir, dirPath, entries,
     const s = spinner(`Discarding ${entries.length} file(s) under ${dirPath}/...`);
     let succeeded = 0;
     const failures = [];
+    const appliedPlans = [];
     try {
-        for (const entry of entries) {
+        for (const plan of plans) {
             try {
-                await discardStatusEntry(engineDir, entry);
+                await applyDiscardBaseline(engineDir, plan);
+                appliedPlans.push(plan);
                 succeeded += 1;
             }
             catch (error) {
-                failures.push(`${entry.file}: ${toError(error).message}`);
+                failures.push(`${plan.entry.file}: ${toError(error).message}`);
             }
         }
         s.stop(`Discarded ${succeeded} of ${entries.length} file(s) under ${dirPath}/${failures.length > 0 ? ` (${failures.length} failed)` : ''}`);
         for (const failure of failures) {
             warn(`  ${failure}`);
         }
+        for (const plan of appliedPlans) {
+            if (plan.conflicted)
+                warn(describeConflictWarning(plan));
+        }
         try {
             const furnacePrefixes = await collectFurnaceManagedPrefixes(projectRoot);
             const dirIsFurnace = [...furnacePrefixes].some((prefix) => `${dirPath}/`.startsWith(prefix) || prefix.startsWith(`${dirPath}/`));
@@ -79,7 +108,7 @@ async function discardDirectoryEntries(projectRoot, engineDir, dirPath, entries,
         if (failures.length > 0) {
             throw new GeneralError(`Failed to discard ${failures.length} file(s) under ${dirPath}/. See warnings above.`);
         }
-        outro(`${succeeded} file(s) restored to original state`);
+        outro(summarizeDiscardBaselines(appliedPlans, succeeded));
     }
     catch (error) {
         if (!(error instanceof GeneralError)) {
@@ -138,40 +167,33 @@ export async function discardCommand(projectRoot, file, options = {}) {
         const dirPrefix = `${dirPath}/`;
         const dirEntries = statusEntries.filter((entry) => entry.file.startsWith(dirPrefix) || entry.originalPath?.startsWith(dirPrefix));
         if (dirEntries.length > 0) {
-            await discardDirectoryEntries(projectRoot, paths.engine, dirPath, dirEntries, options);
+            await discardDirectoryEntries(projectRoot, paths.engine, paths.patches, dirPath, dirEntries, options);
             return;
         }
         throw new GeneralError(`File "${file}" has no changes to discard.`);
     }
-    if (!options.yes && !options.dryRun) {
-        const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
-        if (!isInteractive) {
-            throw new InvalidArgumentError('Interactive confirmation not available. Use --yes flag to discard without confirmation.', 'Use: fireforge discard <file> --yes');
-        }
-        const confirmed = await confirm({
-            message: `Discard all changes to ${statusEntry.file}?`,
-            initialValue: false,
-        });
-        if (isCancel(confirmed) || !confirmed) {
-            outro('Discard cancelled');
-            return;
-        }
+    const proceed = await confirmDiscard(`Discard all changes to ${statusEntry.file}?`, 'Use: fireforge discard <file> --yes', options);
+    if (!proceed)
+        return;
+    const [plan] = await planDiscards(paths.patches, paths.engine, [statusEntry], options);
+    if (!plan) {
+        throw new GeneralError(`File "${file}" has no changes to discard.`);
     }
     if (options.dryRun) {
         // Show the rename pair regardless of which side the operator passed —
         // passing the NEW path of a rename used to hide that discarding also
         // resurrects the old path, exactly when the full picture matters most.
-        const target = statusEntry.originalPath
-            ? `${statusEntry.originalPath} -> ${statusEntry.file}`
-            : statusEntry.file;
-        info(`Would discard changes to: ${target}`);
+        info(`Would discard changes to: ${dryRunLabel(plan)}`);
         outro('Dry run complete — no changes made');
         return;
     }
     const s = spinner(`Discarding changes to ${file}...`);
     try {
-        await discardStatusEntry(paths.engine, statusEntry);
+        await applyDiscardBaseline(paths.engine, plan);
         s.stop(`Discarded changes to ${file}`);
+        if (plan.conflicted) {
+            warn(describeConflictWarning(plan));
+        }
         // Warn when the discarded file is managed by Furnace so the user knows
         // to re-apply if they want the component's deployed state back.
         try {
@@ -183,16 +205,18 @@ export async function discardCommand(projectRoot, file, options = {}) {
         catch {
             // Furnace config may not exist — skip silently
         }
-        outro('File restored to original state');
+        outro(describeDiscardOutcome(plan, options.toUpstream === true));
     }
     catch (error) {
         s.error('Discard failed');
-        if (error instanceof GitError) {
+        if (error instanceof GitError || error instanceof GeneralError) {
             throw error;
         }
-        throw new GitError(`Failed to discard ${file}`, statusEntry.isUntracked
-            ? `rm ${statusEntry.file}`
-            : `restore --source HEAD --staged --worktree -- ${statusEntry.file}`, 
+        throw new GitError(`Failed to discard ${file}`, plan.kind === 'unmanaged'
+            ? statusEntry.isUntracked
+                ? `rm ${statusEntry.file}`
+                : `restore --source HEAD --staged --worktree -- ${statusEntry.file}`
+            : `write patch baseline for ${statusEntry.file}`, 
         // Always attach the cause via toError so thrown primitives (strings,
         // numbers) produced by poorly-behaved utilities still propagate as
         // an Error, preserving stack traces for verbose-mode triage.
@@ -203,8 +227,9 @@ export async function discardCommand(projectRoot, file, options = {}) {
 export function registerDiscard(program, { getProjectRoot, withErrorHandling }) {
     program
         .command('discard <file>')
-        .description('Discard changes to a specific file (deletes untracked files). Pass a directory path to discard every modified or untracked file beneath it; the operation walks the status output and reverts each match individually.')
+        .description('Discard changes to a specific file, restoring patch-claimed paths to their patch-applied baseline (unmanaged untracked files are deleted). Pass a directory path to discard every modified or untracked file beneath it; the operation walks the status output and reverts each match individually.')
         .option('--dry-run', 'Show what would be discarded without doing it')
+        .option('--to-upstream', 'Restore to pristine upstream (HEAD) instead of the patch-applied baseline; deletes patch-created files')
         .option('-y, --yes', 'Skip confirmation prompt')
         .action(withErrorHandling(async (file, options) => {
         await discardCommand(getProjectRoot(), file, pickDefined(options));

package/dist/src/commands/export-flow.d.ts

@@ -51,7 +51,7 @@ export declare function resolvePlacementPlan(patchesDir: string, options: Export
  * introduce by landing earlier than one of its dependencies. Returns null
  * when the projection is clean.
  */
-export declare function projectPlacementForLint(patchesDir: string, plan: PlacementPlan, diff: string): Promise<ConflictReport | null>;
+export declare function projectPlacementForLint(patchesDir: string, plan: PlacementPlan, diff: string, config?: FireForgeConfig): Promise<ConflictReport | null>;
 /**
  * Builds the change-summary lines printed by the placement confirmation.
  */

package/dist/src/commands/export-flow.js

@@ -176,8 +176,8 @@ function buildNewFilesFromDiff(diff) {
  * introduce by landing earlier than one of its dependencies. Returns null
  * when the projection is clean.
  */
-export async function projectPlacementForLint(patchesDir, plan, diff) {
-    const baseCtx = await buildPatchQueueContext(patchesDir);
+export async function projectPlacementForLint(patchesDir, plan, diff, config) {
+    const baseCtx = await buildPatchQueueContext(patchesDir, config);
     const projectedEntries = baseCtx.entries.map((entry) => {
         const rename = plan.renameMap.get(entry.filename);
         if (!rename)
@@ -199,7 +199,10 @@ export async function projectPlacementForLint(patchesDir, plan, diff) {
         modifiedFileAdditions: buildModifiedFileAdditionsFromDiff(diff),
     });
     projectedEntries.sort((a, b) => a.order - b.order || a.filename.localeCompare(b.filename));
-    const projectedIssues = lintPatchQueue({ entries: projectedEntries }).filter((i) => i.severity === 'error');
+    const projectedIssues = lintPatchQueue({
+        entries: projectedEntries,
+        ...(baseCtx.patchPolicy ? { patchPolicy: baseCtx.patchPolicy } : {}),
+    }).filter((i) => i.severity === 'error');
     if (projectedIssues.length === 0)
         return null;
     return {
@@ -235,7 +238,7 @@ export async function commitPlacementExport(input) {
         if (!placementPlansEqual(currentPlan, input.expectedPlan)) {
             throw new InvalidArgumentError('Patch queue changed while waiting for export confirmation. Re-run the command to recompute placement.', 'export placement');
         }
-        const conflicts = await projectPlacementForLint(input.patchesDir, currentPlan, input.diff);
+        const conflicts = await projectPlacementForLint(input.patchesDir, currentPlan, input.diff, input.config);
         if (conflicts && input.unsafeOverride !== true) {
             throw new InvalidArgumentError(`Refusing to run export: ${conflicts.reason}. ` +
                 'If the conflict names files owned by another patch (e.g. duplicate-new-file-creation), ' +

package/dist/src/commands/export-placement-gate.js

@@ -44,7 +44,7 @@ export async function gatePlacementPlan(args) {
     // is passed — one up-front error per run instead of per-patch findings.
     const placementPlan = await resolvePlacementPlan(patchesDir, options, selectedCategory, patchName, config);
     const currentManifest = await loadPatchesManifest(patchesDir);
-    const conflicts = await projectPlacementForLint(patchesDir, placementPlan, diff);
+    const conflicts = await projectPlacementForLint(patchesDir, placementPlan, diff, config);
     const renamed = currentManifest !== null
         ? applyRenameMapToManifest(currentManifest, placementPlan.renameMap)
         : buildProjectedManifest(null, []);

package/dist/src/commands/export-shared.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { join } from 'node:path';
 import { confirm, select, text } from '@clack/prompts';
-import { addLicenseHeaderToFile } from '../core/license-headers.js';
+import { addLicenseHeaderToFile, hasThirdPartyPermissiveBanner } from '../core/license-headers.js';
 import { findAllPatchesForFiles } from '../core/patch-export.js';
 import { commentStyleForFile, detectNewFilesInDiff, isAcceptableNewFileHeader, lintExportedPatch, resolvePatchSizeTier, } from '../core/patch-lint.js';
 import { resolvePatchOwnedSysMjs } from '../core/patch-lint-ownership.js';
@@ -218,6 +218,7 @@ export async function autoFixLicenseHeaders(engineDir, diffContent, config, isIn
     if (newFiles.size === 0)
         return false;
     const filesToFix = [];
+    const vendoredFiles = [];
     for (const file of newFiles) {
         const style = commentStyleForFile(file);
         if (!style)
@@ -231,9 +232,23 @@ export async function autoFixLicenseHeaders(engineDir, diffContent, config, isIn
         // MPL block header on a derived JS/CSS file) would stack a second
         // header on top of a legitimate one.
         if (!isAcceptableNewFileHeader(file, content, style, license)) {
-            filesToFix.push(file);
+            // A recognized third-party permissive banner marks the file as
+            // vendored: prepending the project's own license header would break
+            // byte-identity pins and mislicense upstream code (FORGE F15).
+            if (hasThirdPartyPermissiveBanner(content)) {
+                vendoredFiles.push(file);
+            }
+            else {
+                filesToFix.push(file);
+            }
         }
     }
+    if (vendoredFiles.length > 0) {
+        const vendoredList = vendoredFiles.map((f) => `  - ${f}`).join('\n');
+        info(`${vendoredFiles.length} new file(s) carry a third-party permissive license banner and ` +
+            'were left untouched (vendored); if the missing-license-header lint check flags them, ' +
+            `waive it with --lint-ignore missing-license-header:\n${vendoredList}`);
+    }
     if (filesToFix.length === 0)
         return false;
     if (dryRun) {

package/dist/src/commands/import.js

@@ -8,6 +8,7 @@ import { getDirtyFiles } from '../core/git-status.js';
 import { applyPatchesWithContinue, countPatches, createPatchedContentComputer, discoverPatches, extractAffectedFiles, matchesUntilFilename, PatchError, } from '../core/patch-apply.js';
 import { checkVersionCompatibility, loadPatchesManifest, validatePatchesManifestConsistency, validatePatchIntegrity, } from '../core/patch-manifest.js';
 import { getPatchSourceVersion } from '../core/patch-source-metadata.js';
+import { warnIfStaticComponentsStale } from '../core/test-stale-check.js';
 import { GeneralError } from '../errors/base.js';
 import { toError } from '../utils/errors.js';
 import { pathExists, readText } from '../utils/fs.js';
@@ -419,6 +420,10 @@ export async function importCommand(projectRoot, options = {}) {
             const suffix = result.autoResolved ? ' (auto-resolved)' : '';
             success(`  ${result.patch.filename}${suffix}`);
         }
+        // The re-applied queue may have moved components.conf away from what
+        // the last full build compiled in — surface that now instead of at the
+        // next test refusal (FORGE F13).
+        await warnIfStaticComponentsStale(projectRoot, paths.engine);
         outro('All patches applied successfully!');
     }
     catch (error) {

package/dist/src/commands/lint-per-patch.js

@@ -56,6 +56,11 @@ async function lintQueuedPatch(patch, lintCtx) {
         });
         const cached = getCachedPerPatchLintIssues(cache, patch.filename, cacheKey);
         if (cached) {
+            // Returning before the empty-diff probe below is safe: the cache key
+            // hashes every affected engine file's content plus engineHeadSha, so
+            // an engine-side revert that would empty the diff always changes the
+            // key and misses the cache (pinned by the "engine-side content
+            // revert invalidates the per-patch cache" test — FORGE F5).
             return { status: 'cached', existingFiles: existing, rawIssues: cached, usedCheckJs: false };
         }
     }
@@ -115,9 +120,14 @@ async function applyPerPatchResults(subset, results, issues, checkJs, cache) {
             continue;
         }
         emitTierNotice(patch.filename, result.existingFiles, patch.tier);
-        // Run-level checkJs errors are emitted once, before the first freshly
-        // linted patch's own issues — matching the serial emit point.
-        if (result.usedCheckJs && checkJs && !globalCheckJsEmitted) {
+        // Run-level checkJs errors are emitted once, before the first
+        // non-skipped patch's own issues — matching the serial emit point.
+        // Deliberately NOT gated on `result.usedCheckJs`: global findings are
+        // run-level, never cached, and an all-cache-hit run previously dropped
+        // them entirely, letting a warm run report fewer errors than a cold
+        // one (FORGE F5 hardening). PerRunCheckJs builds its program lazily,
+        // so the cost only materialises when checkJs is configured.
+        if (checkJs && !globalCheckJsEmitted) {
             globalCheckJsEmitted = true;
             issues.push(...(await checkJs.getGlobal()));
         }
@@ -276,7 +286,7 @@ function buildPerRunCheckJs(projectRoot, paths, config, ctx) {
     return {
         ownedByPatch,
         getGrouped: () => (groupedPromise ??= invokePatchLintCheckJsGrouped(paths.engine, resolvePatchOwnedSysMjs(new Set(), ctx), patchLint, projectRoot)),
-        getGlobal: async () => (groupedPromise ? (await groupedPromise).global : []),
+        getGlobal: async () => (await (groupedPromise ??= invokePatchLintCheckJsGrouped(paths.engine, resolvePatchOwnedSysMjs(new Set(), ctx), patchLint, projectRoot))).global,
     };
 }
 /**
@@ -299,7 +309,7 @@ export async function lintPerPatch(projectRoot, paths, options = {}) {
     const subsetNames = new Set(subset.map((p) => p.filename));
     const isSubset = subset.length !== manifest.patches.length;
     const config = await loadConfig(projectRoot);
-    const ctx = await buildPatchQueueContext(paths.patches);
+    const ctx = await buildPatchQueueContext(paths.patches, config);
     // Queue-level findings (policy, cross-patch) are scoped to the requested
     // subset: a 5-patch slice should not fail on a policy or forward-import
     // problem owned entirely by patches the operator did not target.

package/dist/src/commands/lint.js

@@ -461,7 +461,7 @@ export async function lintCommand(projectRoot, files, options = {}) {
     // per-patch ownership resolver and the cross-patch rules.
     let ctx;
     if (await pathExists(paths.patches)) {
-        ctx = await buildPatchQueueContext(paths.patches);
+        ctx = await buildPatchQueueContext(paths.patches, config);
     }
     // Ad-hoc explicit-file-list mode evaluates the patch-size rules per
     // owning patch (see `lintOwningPatchSizes`), so suppress the synthetic

package/dist/src/commands/patch/lint-ignore.js

@@ -26,6 +26,16 @@ import { GeneralError, InvalidArgumentError } from '../../errors/base.js';
 import { toError } from '../../utils/errors.js';
 import { info, intro, outro, warn } from '../../utils/logger.js';
 import { requirePatchQueue, requirePatchTarget } from './patch-context.js';
+/**
+ * Printed whenever `--add` lands a new check id. The waiver this command
+ * writes turns per-patch lint green immediately, but consumer projects
+ * commonly audit lintIgnore lists against a reviewed allow-map — the
+ * discovery that the map also needs updating otherwise costs a full
+ * downstream gate run (FORGE F6).
+ */
+const LINT_IGNORE_REVIEW_WARNING = "This lint waiver is subject to the project's patch-policy review process. " +
+    'Downstream policy audits that mirror lintIgnore lists in a reviewed allow-map ' +
+    'will refuse this patch until the map is updated to include the new ID(s).';
 /**
  * Computes the post-mutation `lintIgnore` list for a given mode.
  * Returns `undefined` when the result should drop the field from the
@@ -114,7 +124,10 @@ export async function patchLintIgnoreCommand(projectRoot, identifier, options =
     // the flag only appeared in the history record — and suppressing lint
     // findings is precisely the mutation an operator should consciously
     // approve.
-    const projectedSummary = describeChange(target.lintIgnore ?? [], applyMode(target.lintIgnore ?? [], mode, values) ?? [], mode, values);
+    const currentList = target.lintIgnore ?? [];
+    const projectedList = applyMode(currentList, mode, values) ?? [];
+    const addsNewIds = mode === 'add' && projectedList.length > currentList.length;
+    const projectedSummary = describeChange(currentList, projectedList, mode, values);
     const decision = await confirmDestructive({
         operation: 'patch-lint-ignore',
         title: `Patch lint-ignore: ${target.filename}`,
@@ -123,6 +136,9 @@ export async function patchLintIgnoreCommand(projectRoot, identifier, options =
         dryRun: isDryRun,
     });
     if (decision === 'dry-run') {
+        if (addsNewIds) {
+            warn(LINT_IGNORE_REVIEW_WARNING);
+        }
         outro('Dry run complete — no changes made');
         return;
     }
@@ -148,6 +164,9 @@ export async function patchLintIgnoreCommand(projectRoot, identifier, options =
     const existing = result.before.lintIgnore ?? [];
     const projected = result.after.lintIgnore ?? [];
     info(`${target.filename}: ${describeChange(existing, projected, mode, values)}.`);
+    if (mode === 'add' && projected.length > existing.length) {
+        warn(LINT_IGNORE_REVIEW_WARNING);
+    }
     try {
         await appendHistory(paths.patches, {
             operation: 'patch-lint-ignore',

package/dist/src/commands/patch/move-files-into.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Transactional file-ownership move into an EXISTING patch (FORGE F4).
+ *
+ * Before 0.39.0, `patch move-files <from> <to>` with an existing target was
+ * preview-only: it printed two `re-export --files` commands whose real
+ * execution cost three further refusals (`--allow-shrink`, `--yes`, and a
+ * projected `duplicate-new-file-creation` unless the SHRINK landed first —
+ * while the printed plan listed the grow first). This module performs the
+ * same shrink→grow as one transaction under the patch-directory lock with
+ * rollback, mirroring `patch split` / `move-files --create`.
+ *
+ * Preconditions match `re-export`: the engine worktree must currently
+ * reflect both patches' content, because both bodies are regenerated from
+ * the worktree.
+ */
+import type { PatchMetadata, PatchMoveFilesOptions, PatchStagedForwardImport } from '../../types/commands/index.js';
+import type { FireForgeConfig } from '../../types/config.js';
+/** Everything the commit step needs, computed and confirmed up front. */
+export interface MoveIntoPlan {
+    source: PatchMetadata;
+    target: PatchMetadata;
+    movedFiles: string[];
+    sourceAfter: string[];
+    targetAfter: string[];
+    sourceDiff: string;
+    targetDiff: string;
+    /** Patches (by filename) whose staged-dependency owners re-point to the target. */
+    ownerRewrites: string[];
+    /** Forward-import declarations the move introduces, keyed by importing patch. */
+    stagedDependencyAdditions: Map<string, PatchStagedForwardImport[]>;
+}
+/**
+ * Plans, lints, confirms, and commits a file-ownership move into an
+ * existing patch. Called by `patchMoveFilesCommand` after its ownership
+ * pre-checks resolved and validated both patches.
+ */
+export declare function runMoveFilesInto(args: {
+    enginePath: string;
+    patchesDir: string;
+    source: PatchMetadata;
+    target: PatchMetadata;
+    files: string[];
+    sourceAfter: string[];
+    targetAfter: string[];
+    options: PatchMoveFilesOptions;
+    config: FireForgeConfig;
+}): Promise<void>;