@hominis/fireforge 0.38.0 → 0.40.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## 0.40.0
+
+- **Dependencies: adopted all five open dependabot PRs (#48, #47, #45, #44, #42) after Go-based TypeScript 6 compatibility review** — the pinned `typescript ~6.0.0` (6.0.3 installed) constrained which upgrades were feasible; every bumped tool checked out: `typescript-eslint` declares peer `typescript >=4.8.4 <6.1.0`, `knip` carries no TypeScript dependency at all (oxc parser), and `dpdm` bundles its own nested TypeScript 5.9.3, so none touch the root compiler. Production: `acorn` 8.17.0→8.18.0 (lockfile-only) and `magic-string` 0.30.21→**1.1.0** — a major that only drops the CJS/UMD builds for pure ESM (FireForge is pure ESM; the five `MagicString` call sites use the unchanged core API). Dev: `@types/node` 26.1.2, `dpdm` 4.3.0, `eslint` 10.8.0, `eslint-plugin-jsdoc` 63.3.3, `knip` 6.29.0, `lint-staged` 17.3.0, `prettier` 3.9.6, `typescript-eslint` 8.66.0, `vite` 8.2.1, and `eslint-plugin-simple-import-sort` 13→**14** (breaking only for string-literal export names, which the codebase does not use); four of these resolved one patch/minor past PR #48's snapshot within the existing caret ranges (typescript-eslint 8.66.0 re-verified against the same `<6.1.0` peer window). CI: the SHA-pinned actions group (checkout 7.0.1 with `--unset`-escaping and branch-trim fixes, setup-node, codeql init/analyze). knip 6.29's stricter re-export tracking flagged seven type re-exports (`PatchCoverage`, `ClearablePatchMetadataField`, `PatchMetadataMutation{,Result}` in `patch-export.ts`; `ForwardImportEdge` in `patch-lint-reexports.ts`; `PatchManifestRowMutation{,Result}` in `patch-manifest.ts`) that no module, test, or public-API entry consumed via the barrel hop — a real 6.26 blind spot, so the dead re-exports were removed (the types stay exported from their defining modules). Verified by a full green `release:check`.
+- **New `fireforge tree` command: copy-on-write verification clones for concurrent read-mostly work** (FORGE G15, feature — every consumer parallelisation attempt dead-ended on the ONE applied engine tree: `engine/` is gitignored by design so git worktrees provide no isolation, and the repo-root build lock plus one objdir kept all fix/test/export work serial; measured on APFS, `engine/browser` — 11,513 files, 156 MB — clones via clonefile in ~3 s): `tree create <name>` snapshots the project (fireforge.json, configs, src, patches, components, and `engine/` with `obj-*` excluded) into `.fireforge/trees/<name>` via filesystem CoW (APFS clonefile / btrfs-XFS reflink, probed BY DOING in the destination directory), taken under the primary engine-session lock so a mid-mutation state is never captured; filesystems without CoW REFUSE honestly, with `--force-copy` opting into a full physical copy explicitly (never silently). A tree is a full project root, so `status`, `lint`, `typecheck`, `verify`, `doctor`, and `export --dry-run` run inside it unmodified with their own per-tree locks — while every mutating command (`export`, `re-export`, `patch *`, `token *`, `furnace *`, `build`, headed `run`, …) is refused via the `.fireforge/tree.json` marker and a default-deny verdict table enforced in one commander preAction hook (a drift test forces every new command to be classified); patches and exports stay strictly serial in the primary tree with no merge-back model. `tree list [--json]` reports staleness against the primary engine HEAD and `patches.json` fingerprint; `tree remove` refuses while a live process holds a tree lock and path-contains its delete; `tree exec <name> -- <cmd>` runs a command inside a tree; Windows is refused (POSIX clonefile/reflink only). **Deferred to 0.41.0 with the design recorded: `--with-objdir` and in-tree `test`** — mach objdirs embed absolute `topsrcdir`/`topobjdir` paths (FireForge's own `mach-build-artifacts.ts` parses them), so a cloned objdir would silently operate against the primary tree; a `mozinfo.json` preflight is the planned gate. New invariant 7 in `docs/lifecycle-invariants.md`. Pinned by `tree-cow.test.ts` (per-platform cp argv, probe verdicts), `tree-store.integration.test.ts` (snapshot contents/exclusions, independence, staleness, live-holder refusal), `tree-guard.test.ts` (verdict drift gate), and `tree.integration.test.ts` (real clone + real-program guard refusal).
+- **Previously deferred items, re-adjudicated for 0.40.0**: auto-`caffeinate` for headed macOS dispatches stays deferred (the 0.39.0 F17 message + operator rule works; auto-wrap adds TTY/permission complexity for little gain); real co-ownership of one upstream file by two patches stays deferred (design-level — shared-file diffs are pristine-baseline so co-ownership remains unrepresentable; the consumer's single-owner consolidation plus audit-side per-patch entry lists stands); `furnace create` maintaining the consumer jsconfig path mapping for new widget modules stays deferred this release (the JSONC-preserving edit machinery exists, but the mapping shape is consumer-project-specific — revisit with a concrete config contract).
+- **Concurrent xpcshell runs no longer collide on Firefox's fixed profile directory** (FORGE G15b, bug — the harness defaults `XPCSHELL_TEST_PROFILE_DIR` to a fixed `$TMPDIR/firefox/xpcshellprofile`, so two overlapping `fireforge test` invocations corrupted each other's profiles; FireForge itself never set the variable): every harness invocation that can dispatch xpcshell (single runs, each shard, and generic `mach test` runs) now exports a fresh `mkdtemp` profile dir (`fireforge-xpcshell-profile-*`) into the mach environment via the new `withXpcshellProfileDir` helper and removes it after the run (best-effort — a cleanup failure warns and leaves the dir to the OS tmp reaper); the crash/symlink-repair retries within one invocation deliberately reuse the same directory, an operator-provided `XPCSHELL_TEST_PROFILE_DIR` is respected verbatim (and never deleted), and pure mochitest dispatches keep a byte-identical env. This is the independently-shippable half of the G15 verification-tree design — it also unblocks concurrent test runs from separate checkouts today. Pinned by uniqueness/opt-out/override/retry-reuse cases in `test-run-suite-dispatch.test.ts` and the lifecycle cases in `xpcshell-profile-dir.test.ts`.
+- **Per-patch lint can now typecheck patch-adopted test `.js` files against a consumer-configurable harness shim: `patchLint.checkJsTestFiles` + `patchLint.checkJsTestShim`** (FORGE G5, enforcement gap — honest framing: the consumer's seven TS2339s on `TestUtils.waitForCondition` were invisible to `lint --per-patch --max-warnings 0` not because the shim differed from the jsconfig projects', but because test `.js` files were never in the checkJs program at all — only new `.sys.mjs` modules were; the harness global that does not exist should fail at the patch boundary where the test was authored): opt-in (`checkJsTestFiles` requires `checkJs`; new failure surface, nonzero compile cost) extends the check set to patch-owned `browser_*`/`test_*`/`xpcshell_*` and `/test/`-path `.js` files, each checked as its OWN small script-scope program (mochitest scripts share top-level scope only with their directory's `head*.js` helpers, which are included as roots) against the built-in Firefox shim, a new loose built-in test-harness shim (`TestUtils`, `BrowserTestUtils`, `add_task`, `ok`/`is`, …), and the consumer's `checkJsTestShim` `.d.ts` — whose typed declarations compose BEFORE the loose baseline and therefore win, so a typed `TestUtils` there is exactly what turns the consumer's case into an export-time error. Wired identically into `lint --per-patch` (one merged lazy build per run) and the export/re-export path so the two agree; `typecheck.projectOverrides` remains typecheck-only by design (loading real jsconfig projects into per-patch lint's empty-tree compiler host would pull the Firefox tree in). Pinned by the was-never-checked gap pin, the TS2339-surfaces case, and the loose-baseline pass in `lint-per-patch-checkjs.integration.test.ts`, plus config cross-field validation in `config.test.ts`.
+- **Patch size metrics are now on the public API — `countNonBinaryDiffLines`, `resolvePatchSizeTier`, and the new `getPatchSizeThresholds` — plus a machine-readable per-patch report via `lint --per-patch --report <path>`** (FORGE G9, feature — the size counter `large-patch-lines` fires on was unreachable programmatically (`"./*": null` blocks deep imports and `src/index.ts` never exported it), so the consumer MIRRORED it to build waiver-freshness checks, a silent-divergence risk by construction): the three functions and the `PatchSizeTierDecision` type join the entry exports (pinned by `public-api.test.ts`), and the `--report` JSON (schemaVersion 1; requires `--per-patch`) carries per patch: filename, name, status (`linted`/`cached`/`skipped`), `lineCount` (non-binary diff lines), `filesAffected` count, the tier decision, the ACTIVE thresholds for that tier, the surfaced issues, and the lintIgnore-suppressed issues, plus run totals. Pinned by the report-shape assertions in `lint.integration.test.ts`.
+- **A size finding waived by `lintIgnore` no longer vanishes without a trace in per-patch mode** (FORGE G10, observability — the waiver filter dropped the whole issue including the measurement embedded in its message, so a waived patch's CURRENT size could not be read back from the tool that enforces it and waiver-cited counts had to be calibrated by hand; aggregate mode printed a suppressed count while per-patch printed nothing): the finding stays suppressed (no exit-code or `--max-warnings` effect) but its measurement is reported as `NOTICE [large-patch-lines] <patch>: suppressed by lintIgnore — Patch is N lines (hard limit: M) …` (likewise `large-patch-files` / `file-too-large`), the run summary adds `Suppressed k issue(s) via per-patch lintIgnore.` mirroring the aggregate wording, and suppressed issues plus the measured line count are carried through the per-patch lint cache (schema bump to v2, one-time cold cache) so a warm run can never report less than a cold one — the same F5-class hazard the run-level checkJs fix closed. Also available structurally in the `--report` JSON. Pinned by the waived-measurement case in `lint.integration.test.ts` and the cache round-trip in `lint-cache.test.ts`.
+- **Smoke-run summaries now attribute allowlist hits per entry, with zero-hit entries flagged as removal candidates** (FORGE G8, observability — `matchesAllowlist` returned a bare boolean and `compileAllowlistFromFile` discarded source line numbers, so an allowlist entry that silently stopped matching was undetectable and the consumer rebuilt per-entry replay in ~190 lines against a retained capture): compiled entries now carry their verbatim source and origin (`allow.txt:12`, `--console-allow #2` — file origins keep the ORIGINAL line numbers, comments included) via the new `CompiledAllowlistEntry` shape, `matchAllowlist` returns the first matching index (deterministic first-match attribution, replacing the boolean `matchesAllowlist`), and the post-run summary prints one `N×  <origin>  <source>` row per entry with `0×` rows suffixed `(never matched — candidate for removal)`. The three scalar counters and the exit contract (12/13) are unchanged; the human summary is the supported surface (no JSON sidecar this release). Pinned by the attribution rows in `run.test.ts` and the origin/first-match cases in `smoke-patterns.test.ts`.
+- **`lint --per-patch <patch…>` now works: positional arguments in per-patch mode select patches through the same alias resolution as `--patches`** (FORGE G14, ergonomics — the natural invocation `lint --per-patch a.patch b.patch` was rejected with the misleading "cannot be combined with explicit engine file paths" while the suggested form required retyping the list behind a flag): positionals are appended after explicit `--patches` entries and resolved tolerantly (filename, stem, manifest name, category-prefixed slug, or bare slug); a non-matching positional fails loud with `No patch in the queue matches "…". In --per-patch mode, positional arguments and --patches select patches … drop --per-patch to lint engine paths.` plus the available-patches listing, so an engine path can never silently lint the wrong thing. The `--patches` help notes the positional equivalence. Pinned by the positional-subset and unmatched-positional cases in `lint.test.ts`.
+- **`patch staged-dependency --remove` now accepts `--file` + `--specifier` alone, inferring `--creates` from a unique match; missing-flag errors name the actually-missing flags** (FORGE G12, ergonomics + message — the remove path demanded the full triple even when file+specifier identified exactly one entry, and every `Invalid Argument` printed `Argument: patch staged-dependency`, restating the command instead of the offending flag): a unique file+specifier(+`--owner`) match infers its `creates` with an `Inferred --creates …` notice; an ambiguous match refuses listing every candidate (`pass --creates to pick one`); no match keeps the honest exit-0 "no staged forward-import matched" summary. `--kind registration` gets the identical treatment keyed on `--line`. All `Argument:` lines in this command now name flags (`--specifier, --creates`, `--kind`, `--add/--remove/--clear`, …), and the `-y/--yes` help no longer claims a confirmation prompt exists (message-only — the command never prompted; the flag records scripted consent in the history log). Pinned by the inference, ambiguity, no-match, and attribution cases in `patch-tier-and-lint-ignore.integration.test.ts`.
+- **`token add` can no longer silently strand or skip a token when its category is wrong — every bypass around the missing-category refusal is closed** (FORGE G3, bug + claim partially REFUTED — the reported plain-path "missing category exits 0" is contradicted by the pre-existing `assertTokenCategoryExists` throw, pinned since before 0.39.0; the 19 observed silent no-ops reproduce only through three real bypasses, all fixed): (1) category banners now match EXACTLY (`/* = Name = */` text equality, multi-line block-line equality) instead of by substring, so a TOC comment mentioning "Colors — Terminal" or a `Colors — Canvas` banner can no longer satisfy a lookup for a different name — assert and writer share the matcher (new `token-category.ts`); (2) the whole-file idempotency check is replaced by a per-category one — a token already in the TARGET category skips with its location named (`already exists in category "X" (line N)`), while a token declared elsewhere in the base `:root` block REFUSES with `Token "…" is already declared outside category "…" (<file>:<line>, section "…")` instead of silently skipping and discarding `--create-category`; dark-`@media`/variant companion blocks are excluded from ownership; the exact name must match (`--foo` no longer collides with `--x-foo`); (3) `--variant` now validates `--category` against the file instead of silently discarding it, and `--variant` + `--create-category` is refused. Dry-run agrees with the real run on all three. Behavior change: loose banner matches that previously "worked" now fail loud with the existing available-categories listing. Pinned by the bypass matrix in `token-manager.test.ts`.
+- **Patch-lint `raw-color-value` no longer fires on hex colors inside CSS comments that span the context/added-line boundary** (FORGE G4, bug — the per-patch comment stripper only saw the joined added lines, so a `/*` opened on an unchanged context line never suppressed a hex mention on an added line; two prose references to a vendored sheet's black paint inside comments tripped the rule for the consumer on 2026-07-30): the diff branch now masks comments across the full post-patch file (spaces preserve line numbers; an unclosed trailing `/*` masks to EOF) via the new `extractAddedLineNumbersPerFile` diff walker, then scans only the patch's added line numbers. Inline `fireforge-ignore: raw-color-value` waivers keep matching against pre-strip text; the no-diff branch is unchanged; and when the diff's line numbers fall outside the on-disk file (drifted patch) the scan falls back to the previous joined-added-lines behavior instead of misattributing lines. Pinned by the boundary-spanning, still-fails-in-declaration, waiver, and drift-fallback cases in `patch-lint.test.ts`.
+- **`export --name ui-foo --category ui` now lands manifest `name: "foo"` in one step, and `--name <stem>.patch` no longer trips the dot validator** (FORGE G13, bug + message — the filename slug pipeline has stripped redundant category prefixes since 0.33.0 (and `.patch` suffixes since 0.39.0's F9) but the manifest display name kept the raw flag value, so a bare-filename-slug naming policy required a follow-up `patch rename --to` after every export): display names are normalized after category resolution with the same require-the-category-token rule as filenames via the new `normalizePatchDisplayName` (`NNN-ui-` / `ui-` prefixes stripped case-insensitively and repeatedly; a bare leading number is never stripped, so `2-step-verification` survives; the strip falls back to the stem rather than emptying the name), announced with `Patch name normalized: "ui-foo" → "foo" (the filename carries the order and category prefix).`; a trailing `.patch` is stripped before `validatePatchName` runs. Applies to `export` and `export-all`. `patch rename` additionally gains `-d` as an alias for `--description`; multi-target `re-export --scan --scan-file` remains deferred (file→patch assignment would be ambiguous — `--scan-files <manifest>` already serves bulk assignment). Pinned in `export-shared.test.ts` and `validation.test.ts`.
+- **New `status --check` (and `--fail-on <class,...>`) turns classification drift into a CI-enforceable non-zero exit** (FORGE G1, enforcement gap — every 0.39.0 status variant exited 0 even while reporting unmanaged/drifted/conflicted files, so "refuse if dirty" required every consumer to parse `--json` and re-implement the classification policy; combined with the G2 gap this let two manifest-registered proving suites ship into no patch while every advertised gate stayed green): `--check` fails with exit 1 whenever any `unmanaged`, `patch-owned-drift`, or `conflict` file exists, naming each offending classification with its first three paths (`status --check failed: 2 unmanaged (a, b), 1 patch-owned-drift (c). …`); `--fail-on` replaces the policy set (implying `--check`, refusing unknown values by naming the valid six); composes with the default view and `--json` (the JSON stays parseable on stdout, the refusal routes to stderr) and is refused alongside `--raw`/`--unmanaged`/`--ownership`/`--test-coverage`. A clean tree passes. Pinned by `status-check.test.ts` and the `--check` cases in `status.test.ts`.
+- **`status --json` files[] entries now carry a `patch` field naming the owning patch filename (`null` when unowned)** (FORGE G11, feature — the classifier resolved every file's owner at classify time and then discarded it for non-conflict entries, so resolving 16 drifted files to their patches meant scraping the human `--ownership` box table with `awk`): single-owner `patch-backed`, `patch-owned-drift`, and healthy single-owner `furnace` entries name their owner; `branding`, unowned `furnace`, and `conflict` entries report `null` (conflicts keep the existing `claimedBy` array — a single-owner field must not misrepresent a multi-claim). Additive to `schemaVersion: 1`, so consumers pinning the schema keep parsing; the post-slice re-export loop is now scriptable straight off `--json`. Pinned by the owner-matrix case in `status.test.ts`.
+- **Scan-less `re-export`'s adjacency notice is now classification-aware, and the new `--refuse-adjacent-unmanaged` flag upgrades it to a non-zero refusal that skips the write** (FORGE G2, bug + message — the claim that 0.39.0 was fully silent is partially REFUTED: the v0.27.2 sibling advisory did fire for the reported shape, a new test created beside a patch's owned tests, and is pinned by the pre-fix reproduction in `re-export.integration.test.ts`; but it counted tool-managed paths as "unowned siblings" and offered no enforcement). The notice now names only genuinely unmanaged adjacent files — generated branding paths and furnace-managed prefixes are excluded, while a brand-new unowned file under the branding root stays listed (the Assets.car precedent) — with the wording `found N unmanaged file(s) adjacent to this patch's ownership (<first 3>)`. Under `--refuse-adjacent-unmanaged` (scan-less path only; refused alongside `--scan`/`--files`) each offending patch is skipped unwritten and the run fails with one refusal naming every offender, so CI cannot ship a patch refresh past an unadopted file. Residual blind spot documented in-test: a new file in a cousin directory no owned file lives in is still unreported (recursive scans are too noisy on Firefox-sized trees). Pinned in `re-export.test.ts` (branding/furnace exclusion, skip-and-refuse) and `re-export.integration.test.ts`.
+- **`re-export` now retries once, after a 300 ms backoff, when a patch fails on transient git `index.lock` contention** (FORGE G7, bug — an external git process touching `engine/.git/index.lock` during the binary-staging `git add -N`/`git diff --binary` window permanently failed that patch while the run reported `Re-exported 1 of 2` and exited 0; the identical immediate rerun succeeded with no hand cleanup, which is exactly the shape an internal retry should absorb): lock-class failures are detected via the new `isGitIndexLockConflict` heuristic in `errors/git.ts` (a `GitIndexLockError`, or a `GitError` whose message pairs `index.lock` with lock phrasing), the retry re-enters the per-patch export from the top so it re-reads clean state, and a second failure keeps the honest `N of M` summary. Non-lock failures never retry. Partial-failure exit code is intentionally unchanged this release; a non-zero exit (or `--strict`) for partial runs is the recommended follow-up. Pinned by the retry, double-failure, partial-success, and no-retry cases in `re-export.test.ts` and the heuristic table in `git-index-lock.test.ts`.
+- **`export --before/--after` no longer refuses placements whose renumber never actually reaches a reserved range** (FORGE G6, bug — `computePlacementPlan` shifted every patch at or above the insertion point by +1, so any positional insert below a `patchPolicy.reservedRanges` block dragged the reserved patches into the rename map and tripped the up-front refusal even with free ordinals in between; in a ~230-patch tree with a 900-999 reserved block, `--before`/`--after` were effectively unavailable and every insert needed an explicit `--order`): the +1 cascade now stops at the first unoccupied ordinal — a gap absorbs the insert, so the tail beyond it (including any reserved block) keeps its numbering — while a genuinely contiguous run into the block still refuses with the same single up-front error. The same cascade serves `patch split` and `patch move-files --create` placements. Pinned by the stop-at-gap and contiguous-refusal cases in `export-placement-policy.test.ts` and the rewritten sparse-queue case in `export-flow.test.ts`.
+
+## 0.39.0
+
+- **`fireforge discard` restores patch-claimed paths to their PATCH-APPLIED baseline instead of pristine upstream, and re-materializes patch-created files instead of deleting them** (FORGE F1, P0 data-loss bug — 15 `patch-backed`/`owned` engine files discarded with `--yes` came back as upstream Firefox artwork, `jar.mn` lost all 134 fork entries, and patch-created files like `hominis-start.html` were deleted outright, all under the message "File restored to original state"; recovery cost a full `reset` + 207-patch `import` + rebuild): discard now consults the manifest's ownership claims per status entry and restores claimed files by folding HEAD content through every affecting patch in order (`computePatchedContent`), leaving the post-`import` worktree convention intact (patch edits stay unstaged ` M`, patch creations stay untracked `??`); patch-deleted files are removed to match the baseline. The legacy semantics are an explicit opt-in via the new `--to-upstream` flag. Success messages name the baseline (`File restored to patch baseline (0001-ui-edit.patch)`, `File re-materialized from patch baseline (…)`, `File restored to pristine upstream (HEAD)`); directory mode applies the same rule per file and its outro buckets the outcomes (`3 file(s) restored: 1 to patch baseline, 1 re-materialized, 1 to upstream state`); dry-run lines annotate each path with its restore target. A corrupt manifest or an unreconstructible baseline REFUSES (naming `--to-upstream`) rather than silently reverting to HEAD; multi-owner (conflict) claims restore the cumulative baseline with a warning pointing at `status --ownership`. Pinned by `discard-patch-baseline.integration.test.ts` (the exact handoff shape: edit-patch + create-patch, dirty both, discard each, assert patch content and git state) and `discard-baseline.test.ts`.
+- **New per-patch lint check `mozbuild-unsorted-list` catches unsorted `EXTRA_JS_MODULES` (and sibling strict-ordered moz.build lists) before any build is dispatched** (FORGE F2, feature — three friction-log occurrences where an unsorted insertion surfaced only as `mozbuild.util.UnsortedError … expected "X" but got "Y"` at configure time, each costing a full multi-minute build cycle): the check reads each patch-touched `moz.build` from the engine tree and reports the exact expected/got pair mozbuild would raise (`moz.build list EXTRA_JS_MODULES is not alphabetically sorted: expected "X" but got "Y" (mozbuild will fail at configure time with UnsortedError)`), using mozbuild's case-insensitive ordering. Covered variables: `EXTRA_COMPONENTS`, `EXTRA_JS_MODULES`, `EXTRA_PP_COMPONENTS`, `EXPORTS`, `PYTHON_UNITTEST_MANIFESTS`, `TESTING_JS_MODULES`, `XPIDL_SOURCES`, including dotted namespaces (`EXTRA_JS_MODULES.<subdir>`); `DIRS` is deliberately excluded (order-meaningful). Severity error; waivable per patch via `lintIgnore: ["mozbuild-unsorted-list"]`; participates in the per-patch lint cache like every other rule.
+- **Forward-import detection now catches a bare getter-property line added to an existing `defineESModuleGetters` map, and every refusal names the exact `patch staged-dependency` invocation to paste** (FORGE F3, bug + message — a patch inserting `Foo: "resource://gre/modules/Foo.sys.mjs",` into a PRE-EXISTING getter object carried no `defineESModuleGetters(` opener in its added lines, so the export gate missed it and the refusal surfaced one consumer at a time downstream): added-lines-only content is additionally scanned for `Name: "resource://…"` property lines (resource/chrome/moz-src schemes, forward-importable extensions only; deduped against the existing extractors so a patch adding the whole call reports once; the `// fireforge-ignore: forward-import` marker and staged-dependency suppression apply unchanged). The `forward-import` message now embeds the exact per-owner remedy — `fireforge patch staged-dependency <patch> --add --file <site> --specifier "<url>" --creates <path> --owner <patch>` — with the fingerprint unchanged. The "reports only the first offender" half of the field report did NOT reproduce on 0.38.0 code: the rule already emits one issue per site and the export gate returns all details (pinned by a two-site test); the observed one-at-a-time behavior was an artifact of the getter shapes being missed.
+- **`patch move-files <from> <to>` into an EXISTING patch is now a real transaction** (FORGE F4, feature — the preview-only flow printed two `re-export --files` commands in the WRONG order (grow first) and without the `--allow-shrink`/`--yes` flags the real execution then demanded, costing three refusals per move): the two-positional form now performs the shrink→grow as one operation under the patch-directory lock with rollback, mirroring `patch split`/`--create`: both bodies are regenerated from the worktree, per-patch linted with each patch's own `lintIgnore`/`tier`, cross-patch linted as a projection (only regressions the move itself introduces refuse; `--force-unsafe` overrides), staged-dependency owners re-point to the target, and forward edges the move introduces are auto-declared. `--dry-run` previews without writing; `-y/--yes` covers non-TTY. The equivalent manual `re-export` commands are still printed — now in EXECUTABLE order (shrink first, flags included) with a note that the shrink must land first.
+- **`lint --per-patch --max-warnings 0` on the cache-hit path: claim REFUTED; two warm-run gaps hardened** (FORGE F5 — the reported 0-exit-despite-warnings was observed once on a 0.37-line host and does not reproduce on 0.38.0+: cached issues flow through the same `--max-warnings` comparison as fresh ones, pinned since 0.38.0 by the "cached warnings still fail per-patch lint" test; the cache key hashes every affected engine file plus the engine HEAD SHA, so an engine-side revert that would empty a patch's diff always misses the cache — now pinned explicitly). One REAL warm-run gap is fixed: an all-cache-hit run previously dropped run-level checkJs errors entirely (e.g. "typescript not installed", unreadable extra shim), letting a warm run report fewer errors than a cold one; global checkJs findings are now emitted whenever checkJs is configured, building the queue-wide program lazily on demand.
+- **`patch lint-ignore --add` warns that the waiver is subject to the project's patch-policy review process** (FORGE F6, message-only — a size-only waiver turned per-patch lint green and then failed a downstream policy audit as `lint-ignore-unreviewed`, a discovery costing a full multi-minute gate run): every `--add` that lands a new check id (including `--dry-run`) prints: "This lint waiver is subject to the project's patch-policy review process. Downstream policy audits that mirror lintIgnore lists in a reviewed allow-map will refuse this patch until the map is updated to include the new ID(s)." No warning on `--remove`, `--clear`, or a no-op add. (Per the upstream adjudication, the audit demanding the patch's WHOLE lintIgnore list in the review map remains intentional; this is the write-time warning only.)
+- **The mixed-harness refusal runs BEFORE the pre-test build** (FORGE F7, inefficiency — `fireforge test <xpcshell file> <browser file> --build` spent the full build before reporting "cannot run xpcshell and browser/mochitest paths in the same mach invocation"): harness classification is a pure path→manifest lookup and now runs immediately after path normalization, ahead of the `--build` dispatch and the stale/coverage gates; a mixed request refuses in milliseconds and `runProtectedMachBuild` is never invoked (pinned by test). Stale/coverage refusals still take precedence over missing-path errors.
+- **`token add --mode override` also writes existing `:root[data-theme="dark"]` / `:root[data-theme="light"]` blocks** (FORGE F8, bug — an override add wrote `:root` and the `@media (prefers-color-scheme: dark)` block but not the explicit theme-attribute blocks, so on scaffolds requiring identical token sets across all themed lists every override add was a guaranteed half-finished edit failing the downstream invariants audit): when the tokens CSS carries top-level `:root[data-theme="dark"]`/`:root[data-theme="light"]` blocks, the dark value is mirrored into the dark block and the base value into the light block (idempotent per block; files without those blocks are unchanged), with an info line naming the blocks written. The report's claim that the FireForge-generated file header documents the CLI "cannot write" those blocks did not match this repo — no such text exists in FireForge's scaffold (it is consumer-authored); nothing to drop here.
+- **A `.patch` extension on a patch-name argument no longer double-suffixes, and `patch rename` explains its no-ops** (FORGE F9, bug + partial refutation — `patch move-files <from> 348-ui-editor-panels.patch --create` produced `348-ui-editor-panels-patch.patch`, and the repair `rename --to 348-ui-editor-panels.patch` reported "Patch rename (no-op)"): `patchNameSlug` now strips one trailing `.patch` (case-insensitive) before sanitisation, converging `export --name`, `patch split --name`, `move-files --create`, and `rename --to` — so the double-suffix never forms and the repair rename is a REAL rename. A true no-op now says why (`nothing to change — filename already "…" (slug of "X" is "Y"), name already "…"`). The claimed positional `<from> <to>` usage string on `rename` was REFUTED: registration is `rename <name>` with a required `--to` flag on 0.38.0.
+- **xpcshell-only runs skip the Marionette port preflight and the mochitest client flags** (FORGE F10, bug — `fireforge test` probed port 2828 even for xpcshell path sets, so a developer's interactive browser holding the port killed xpcshell runs, and `--marionette-port <n>` alone then failed the dispatch because the mochitest-only client flags were forwarded to mach; the only working incantation was the `--mach-arg --flavor=xpcshell` crutch): when manifest classification shows every requested path is xpcshell, the stale-port preflight is skipped (with an explanatory line when `--marionette-port`/`--kill-stale-marionette` were passed) and neither `--setpref=marionette.port` nor `--marionette=127.0.0.1:<n>` is forwarded — the crutch is unnecessary. Pathless runs and `--doctor` (whose probe launches a Marionette browser regardless) keep the preflight.
+- **New read-only coverage reporter: `fireforge status --test-coverage`** (FORGE F11, feature — with concurrent sessions sharing one engine tree, the only way to learn the current recorded test-packaging coverage was to trip the out-of-coverage refusal on a real run): prints the last build baseline's coverage (`full`, or the scoped path list with the refusal implication), `builtAt`, `binaryName`, engine HEAD, and the new `recordedBy` field (`fireforge build`, `fireforge build --ui`, `fireforge test --build <paths>`) that 0.39.0 baselines now record — older baselines render `Recorded by: unknown` and `full (implicit — baseline predates coverage recording)`. Needs only the project root (no engine/git); mutually exclusive with the other status modes. Per the upstream adjudication, coverage REPLACES — no union model; this is strictly a reporter.
+- **`typecheck` and the checkJs lint pass no longer silently suppress undefined free identifiers (TS2304/TS2552)** (FORGE F12, bug — a deployed module referencing `EditorState.create(...)` with no import typechecked as "0 errors across all three projects" because the codes were unconditionally suppressed as globals-shim noise; the failure surfaced as a runtime `ReferenceError` manifesting as a hung suite): both flows now report undefined identifiers at a configurable severity — default `warning` (visible without breaking gates; blocking under `--max-warnings 0`), `error` to make them hard failures, `off` to restore the historical suppression — via `typecheck.undefinedIdentifiers` and `patchLint.undefinedIdentifiers` in fireforge.json. Shim-covered Firefox globals stay clean; reported diagnostics append a hint naming the extra-shim and config remedies. The other module-resolution suppressions (TS2307/2306/2305/2792/2580/7016) are unchanged.
+- **`reset` and `import` warn at completion when `components.conf` diverged from the last full build** (FORGE F13, message — after a `reset` + `import` revert train, the next gate run's unit sweep refused on the stale compiled StaticComponents table one full rebuild too late): both commands now run the existing static-components probe after a successful mutation and print: "components.conf changed relative to the last full \"fireforge build\": <paths>. The compiled StaticComponents table in obj-\* no longer matches the tree, so the next \"fireforge test\" will require a full \"fireforge build\" first — a scoped \"fireforge test --build\" cannot regenerate the compiled table." Advisory only (never throws, silent without a baseline); dry-run/cancelled/failed paths skip it.
+- **The forward-import "Closest legal ordinal" hint is suppressed when no legal ordinal exists in the importing patch's category range** (FORGE F14, message bug — the hint suggested ordinal 388 for a dependency that no reorder could satisfy, sending the operator into a `patch reorder` the category-range policy then refused): when `patchPolicy` is configured and the computed ordinal falls outside the importing patch's category range, the sentence becomes "No legal ordinal in the <category> category range (<from-to>) lands after the creating patch(es); declaring the staged dependency is the recommended remedy." Fingerprints are unchanged across both variants; without a policy the hint prints as before.
+- **`export` never offers to prepend the project license header onto a vendored third-party file** (FORGE F15, bug — the header auto-fix offered EUPL-1.2 headers for three byte-identity-pinned MIT xterm bundles; accepting (or `-y`) would have mislicensed upstream code): new-file candidates carrying a recognized third-party permissive banner (MIT, ISC, BSD-2/3-Clause, Apache-2.0 — by license text markers or a bare `SPDX-License-Identifier`) are excluded from the offer and the dry-run fix list and reported separately: "N new file(s) carry a third-party permissive license banner and were left untouched (vendored); if the missing-license-header lint check flags them, waive it with --lint-ignore missing-license-header". The lint check itself still fires — the reviewed waiver (expressible at creation since 0.38.0's `export --lint-ignore`) remains the sanctioned path.
+- **Signal-shaped configure/build exits are labeled as external interruptions** (FORGE F16 — the reported `--headless`→configure exit-144 mechanism was REFUTED: `--headless` only ever lands in mach TEST args and `mach configure` receives no environment from the test path, so no plausible interaction exists): configure and build failures with exit codes in the 128+N signal convention now append e.g. "Exit 144 is signal-shaped (144 - 128 = 16, SIGURG on this host): the process was likely interrupted externally (OOM-killer, terminal disconnect, display/session teardown) rather than failing on its own, and the log may be truncated mid-step", using the host's real signal table — so the next occurrence is self-describing.
+- **Headed macOS no-output timeouts hint at display sleep and `caffeinate`** (FORGE F17, message-only — a headed single-file run with no `caffeinate` wrapper timed out at 370 s before the first TEST-START; every subsequent `caffeinate -dimsu`-wrapped run passed): when a harness crash with the no-output-timeout shape came from a HEADED run on macOS, the failure message appends: "Hint: this was a HEADED run on macOS that died at the no-output timeout. A common cause is the display going to sleep mid-run, which freezes the headed browser before any test starts. Wrap headed runs in `caffeinate -dimsu <command>` to keep the display awake, or pass --headless." Auto-wrapping dispatches in `caffeinate` was evaluated and DEFERRED — the message half is the clearly-correct, cheap half.
+
 ## 0.38.0
 
 - **`status --ownership` reports a furnace-deployed file whose owning patch body went stale as drift** (friction-log item 1, bug — after `furnace deploy` refreshed 12 deployed widget copies, the pre-export "consult ownership" step read clean while the composed gate caught the staleness later on the re-export path): the classifier no longer short-circuits every furnace-prefixed path into the `furnace` bucket — a furnace path claimed by exactly ONE patch now runs the same expected-content comparison as any patch-owned file (`computePatchedContent` vs the deployed copy, deletion and error branches included), classifying as `patch-owned-drift` on divergence and staying `furnace` on a match. Multi-owner and unowned furnace paths keep the old bucket (cross-patch conflicts are already surfaced independently), so the only behavioral change is that stale widget patches now show as drift in the table and in `--json` (machine consumers see those paths move from `"furnace"` to `"patch-owned-drift"`). An integration test pins the exact observed sequence: deploy, export the patch, edit the component source, deploy again, and `status --ownership` reports the owning patch drifted.

package/README.md

@@ -131,7 +131,31 @@ contaminates the console capture (headed non-CI launches print a warning saying
 Per-patch lint type-checks plain Firefox JS against a built-in Firefox-globals shim that
 tracks upstream WebIDL additions per release; a project's `patchLint.checkJsExtraShim` can
 add members to the structured shim globals via TypeScript interface merging (e.g.
-`interface ChromeUtilsShim { newApi(): any }`).
+`interface ChromeUtilsShim { newApi(): any }`). Opting into
+`patchLint.checkJsTestFiles: true` extends the pass to patch-owned test `.js` files
+(`browser_*`/`test_*`/`xpcshell_*` and `/test/` paths), each checked as its own small
+script-scope program against a loose built-in harness shim; `patchLint.checkJsTestShim`
+points at a project `.d.ts` whose typed declarations (e.g. a real `TestUtils` interface)
+override the loose baseline so calls to nonexistent harness members fail at export time.
+
+For CI enforcement, `fireforge status --check` exits non-zero when any unmanaged,
+drifted, or conflicted file exists (`--fail-on <class,...>` tunes the policy set, and
+`--json` composes — the JSON stays parseable and its `files[]` entries name the owning
+`patch`). `lint --per-patch --report <path>` writes a machine-readable JSON report with
+each patch's line count, tier, active size thresholds, issues, and lintIgnore-suppressed
+issues; the size metrics (`countNonBinaryDiffLines`, `resolvePatchSizeTier`,
+`getPatchSizeThresholds`) are also exported on the programmatic API.
+
+For concurrent read-mostly verification beside a busy primary checkout,
+`fireforge tree create <name>` snapshots the project — applied engine tree included,
+`obj-*` excluded — into `.fireforge/trees/<name>` using filesystem copy-on-write (APFS
+clonefile / btrfs-XFS reflink; ~3 s for a 156 MB applied browser tree). Inside a tree,
+`status`, `lint`, `typecheck`, `verify`, `doctor`, and `export --dry-run` work unmodified
+with their own locks, while every mutating command is refused — patches and exports stay
+strictly serial in the primary tree. `tree list` reports staleness, `tree remove` deletes
+(refusing while a live process holds a tree lock), and `tree exec <name> -- <cmd>` runs a
+command inside a tree. Filesystems without CoW support refuse unless `--force-copy`
+explicitly accepts a full physical copy.
 
 ## Rebasing Firefox Source
 

package/dist/src/cli.js

@@ -3,6 +3,7 @@ import { existsSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { Command, Help } from 'commander';
 import { COMMAND_MANIFEST } from './commands/manifest.js';
+import { runTreeGuardHook } from './core/tree-guard.js';
 import { CancellationError, CommandError, FireForgeError } from './errors/base.js';
 import { ExitCode } from './errors/codes.js';
 import { ConfigNotFoundError } from './errors/config.js';
@@ -250,6 +251,12 @@ export function createProgram() {
         if (opts['verbose']) {
             setVerbose(true);
         }
+    })
+        // Verification-tree guard (FORGE G15): when the cwd resolves into a
+        // tree snapshot, refuse mutating commands before their action runs —
+        // one hook covers every command regardless of how the cwd got there.
+        .hook('preAction', async (thisCommand, actionCommand) => {
+        await runTreeGuardHook(thisCommand.name(), actionCommand);
     });
     const groupedFormatter = buildGroupedHelpFormatter(COMMAND_MANIFEST);
     program.configureHelp({

package/dist/src/commands/build.js

@@ -3,7 +3,7 @@ import { Command, InvalidArgumentError as CommanderInvalidArgumentError } from '
 import { validateBrandOverride } from '../core/brand-validation.js';
 import { auditBuildArtifacts } from '../core/build-audit.js';
 import { readBuildBaseline, writeBuildBaseline } from '../core/build-baseline.js';
-import { prepareBuildEnvironment } from '../core/build-prepare.js';
+import { describeSignalShapedExit, prepareBuildEnvironment } from '../core/build-prepare.js';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { withEngineSessionLock } from '../core/engine-session-lock.js';
 import { attemptMozinfoRewrite, build, buildArtifactMismatchMessage, buildUI, hasBuildArtifacts, hasRunnableBundle, runMach, withBuildLock, } from '../core/mach.js';
@@ -147,6 +147,7 @@ function buildFailureDiagnostics(result, engineDir, objDir, machCommand) {
         : `cd ${engineDir} && ./mach build -v`;
     return [
         `Build failed with exit code ${result.exitCode}.`,
+        describeSignalShapedExit(result.exitCode),
         `Mach phase: ${machCommand}`,
         makeError ? `Last make error: ${makeError}` : undefined,
         makeContext ? `Recent make context:\n${makeContext}` : undefined,
@@ -326,13 +327,17 @@ export async function buildCommand(projectRoot, options) {
     // Record a fresh baseline only on clean success so the next run audits
     // against this build's HEAD. A failed build keeps the prior baseline so
     // the next attempt still catches long-standing packaging drops.
+    await recordFullBuildBaseline(projectRoot, paths.engine, config.binaryName, options.ui === true);
+    outro(`Build completed in ${timeStr}!`);
+}
+/** Persists the full-coverage baseline; a failed write never fails the build. */
+async function recordFullBuildBaseline(projectRoot, engineDir, binaryName, ui) {
     try {
-        await writeBuildBaseline(projectRoot, paths.engine, config.binaryName, 'full');
+        await writeBuildBaseline(projectRoot, engineDir, binaryName, 'full', undefined, ui ? 'fireforge build --ui' : 'fireforge build');
     }
     catch (baselineError) {
         verbose(`Could not persist build baseline: ${toError(baselineError).message}`);
     }
-    outro(`Build completed in ${timeStr}!`);
 }
 /** Registers the build command on the CLI program. */
 export function registerBuild(program, { getProjectRoot, withErrorHandling }) {

package/dist/src/commands/discard.js

@@ -2,9 +2,9 @@
 import { confirm } from '@clack/prompts';
 import { Command } from 'commander';
 import { getProjectPaths } from '../core/config.js';
+import { applyDiscardBaseline, describeConflictWarning, describeDiscardBaseline, describeDiscardOutcome, planDiscardBaselines, planUpstreamDiscards, summarizeDiscardBaselines, } from '../core/discard-baseline.js';
 import { collectFurnaceManagedPrefixes } from '../core/furnace-config.js';
 import { getHead, isGitRepository, isMissingHeadError } from '../core/git.js';
-import { discardStatusEntry } from '../core/git-file-ops.js';
 import { expandUntrackedDirectoryEntries, getWorkingTreeStatus } from '../core/git-status.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { GitError } from '../errors/git.js';
@@ -12,6 +12,42 @@ import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
 import { info, intro, isCancel, outro, spinner, warn } from '../utils/logger.js';
 import { pickDefined } from '../utils/options.js';
+/**
+ * Shared interactive confirmation for the single-file and directory paths.
+ * Returns false when the operator cancelled (the caller printed the outro).
+ */
+async function confirmDiscard(message, hint, options) {
+    if (options.yes || options.dryRun)
+        return true;
+    const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
+    if (!isInteractive) {
+        throw new InvalidArgumentError('Interactive confirmation not available. Use --yes flag to discard without confirmation.', hint);
+    }
+    const confirmed = await confirm({ message, initialValue: false });
+    if (isCancel(confirmed) || !confirmed) {
+        outro('Discard cancelled');
+        return false;
+    }
+    return true;
+}
+/**
+ * Plans the restore baseline for `entries`: the patch-applied baseline for
+ * patch-claimed paths (FORGE F1), or pristine HEAD when `--to-upstream`
+ * explicitly requests the legacy semantics.
+ */
+async function planDiscards(patchesDir, engineDir, entries, options) {
+    if (options.toUpstream)
+        return planUpstreamDiscards(entries);
+    return planDiscardBaselines(patchesDir, engineDir, entries);
+}
+/** Dry-run label including the rename pair and the restore-baseline suffix. */
+function dryRunLabel(plan) {
+    const { entry } = plan;
+    const target = entry.originalPath && entry.originalPath !== entry.file
+        ? `${entry.originalPath} -> ${entry.file}`
+        : entry.file;
+    return `${target} (${describeDiscardBaseline(plan)})`;
+}
 /**
  * Discards every status entry whose path lives under `dirPath`. Used by
  * `discardCommand` as a directory-recursion fallback when the operator
@@ -23,28 +59,15 @@ import { pickDefined } from '../utils/options.js';
  * discard runs sequentially under its own try/catch so a failure on one
  * file is reported but does not block the remaining files in the batch.
  */
-async function discardDirectoryEntries(projectRoot, engineDir, dirPath, entries, options) {
-    if (!options.yes && !options.dryRun) {
-        const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
-        if (!isInteractive) {
-            throw new InvalidArgumentError('Interactive confirmation not available. Use --yes flag to discard without confirmation.', 'Use: fireforge discard <directory> --yes');
-        }
-        const confirmed = await confirm({
-            message: `Discard changes to ${entries.length} file${entries.length === 1 ? '' : 's'} under ${dirPath}/?`,
-            initialValue: false,
-        });
-        if (isCancel(confirmed) || !confirmed) {
-            outro('Discard cancelled');
-            return;
-        }
-    }
+async function discardDirectoryEntries(projectRoot, engineDir, patchesDir, dirPath, entries, options) {
+    const proceed = await confirmDiscard(`Discard changes to ${entries.length} file${entries.length === 1 ? '' : 's'} under ${dirPath}/?`, 'Use: fireforge discard <directory> --yes', options);
+    if (!proceed)
+        return;
+    const plans = await planDiscards(patchesDir, engineDir, entries, options);
     if (options.dryRun) {
         info(`Would discard changes to ${entries.length} file(s) under ${dirPath}/:`);
-        for (const entry of entries) {
-            const target = entry.originalPath && entry.originalPath !== entry.file
-                ? `${entry.originalPath} -> ${entry.file}`
-                : entry.file;
-            info(`  ${target}`);
+        for (const plan of plans) {
+            info(`  ${dryRunLabel(plan)}`);
         }
         outro('Dry run complete — no changes made');
         return;
@@ -52,20 +75,26 @@ async function discardDirectoryEntries(projectRoot, engineDir, dirPath, entries,
     const s = spinner(`Discarding ${entries.length} file(s) under ${dirPath}/...`);
     let succeeded = 0;
     const failures = [];
+    const appliedPlans = [];
     try {
-        for (const entry of entries) {
+        for (const plan of plans) {
             try {
-                await discardStatusEntry(engineDir, entry);
+                await applyDiscardBaseline(engineDir, plan);
+                appliedPlans.push(plan);
                 succeeded += 1;
             }
             catch (error) {
-                failures.push(`${entry.file}: ${toError(error).message}`);
+                failures.push(`${plan.entry.file}: ${toError(error).message}`);
             }
         }
         s.stop(`Discarded ${succeeded} of ${entries.length} file(s) under ${dirPath}/${failures.length > 0 ? ` (${failures.length} failed)` : ''}`);
         for (const failure of failures) {
             warn(`  ${failure}`);
         }
+        for (const plan of appliedPlans) {
+            if (plan.conflicted)
+                warn(describeConflictWarning(plan));
+        }
         try {
             const furnacePrefixes = await collectFurnaceManagedPrefixes(projectRoot);
             const dirIsFurnace = [...furnacePrefixes].some((prefix) => `${dirPath}/`.startsWith(prefix) || prefix.startsWith(`${dirPath}/`));
@@ -79,7 +108,7 @@ async function discardDirectoryEntries(projectRoot, engineDir, dirPath, entries,
         if (failures.length > 0) {
             throw new GeneralError(`Failed to discard ${failures.length} file(s) under ${dirPath}/. See warnings above.`);
         }
-        outro(`${succeeded} file(s) restored to original state`);
+        outro(summarizeDiscardBaselines(appliedPlans, succeeded));
     }
     catch (error) {
         if (!(error instanceof GeneralError)) {
@@ -138,40 +167,33 @@ export async function discardCommand(projectRoot, file, options = {}) {
         const dirPrefix = `${dirPath}/`;
         const dirEntries = statusEntries.filter((entry) => entry.file.startsWith(dirPrefix) || entry.originalPath?.startsWith(dirPrefix));
         if (dirEntries.length > 0) {
-            await discardDirectoryEntries(projectRoot, paths.engine, dirPath, dirEntries, options);
+            await discardDirectoryEntries(projectRoot, paths.engine, paths.patches, dirPath, dirEntries, options);
             return;
         }
         throw new GeneralError(`File "${file}" has no changes to discard.`);
     }
-    if (!options.yes && !options.dryRun) {
-        const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
-        if (!isInteractive) {
-            throw new InvalidArgumentError('Interactive confirmation not available. Use --yes flag to discard without confirmation.', 'Use: fireforge discard <file> --yes');
-        }
-        const confirmed = await confirm({
-            message: `Discard all changes to ${statusEntry.file}?`,
-            initialValue: false,
-        });
-        if (isCancel(confirmed) || !confirmed) {
-            outro('Discard cancelled');
-            return;
-        }
+    const proceed = await confirmDiscard(`Discard all changes to ${statusEntry.file}?`, 'Use: fireforge discard <file> --yes', options);
+    if (!proceed)
+        return;
+    const [plan] = await planDiscards(paths.patches, paths.engine, [statusEntry], options);
+    if (!plan) {
+        throw new GeneralError(`File "${file}" has no changes to discard.`);
     }
     if (options.dryRun) {
         // Show the rename pair regardless of which side the operator passed —
         // passing the NEW path of a rename used to hide that discarding also
         // resurrects the old path, exactly when the full picture matters most.
-        const target = statusEntry.originalPath
-            ? `${statusEntry.originalPath} -> ${statusEntry.file}`
-            : statusEntry.file;
-        info(`Would discard changes to: ${target}`);
+        info(`Would discard changes to: ${dryRunLabel(plan)}`);
         outro('Dry run complete — no changes made');
         return;
     }
     const s = spinner(`Discarding changes to ${file}...`);
     try {
-        await discardStatusEntry(paths.engine, statusEntry);
+        await applyDiscardBaseline(paths.engine, plan);
         s.stop(`Discarded changes to ${file}`);
+        if (plan.conflicted) {
+            warn(describeConflictWarning(plan));
+        }
         // Warn when the discarded file is managed by Furnace so the user knows
         // to re-apply if they want the component's deployed state back.
         try {
@@ -183,16 +205,18 @@ export async function discardCommand(projectRoot, file, options = {}) {
         catch {
             // Furnace config may not exist — skip silently
         }
-        outro('File restored to original state');
+        outro(describeDiscardOutcome(plan, options.toUpstream === true));
     }
     catch (error) {
         s.error('Discard failed');
-        if (error instanceof GitError) {
+        if (error instanceof GitError || error instanceof GeneralError) {
             throw error;
         }
-        throw new GitError(`Failed to discard ${file}`, statusEntry.isUntracked
-            ? `rm ${statusEntry.file}`
-            : `restore --source HEAD --staged --worktree -- ${statusEntry.file}`, 
+        throw new GitError(`Failed to discard ${file}`, plan.kind === 'unmanaged'
+            ? statusEntry.isUntracked
+                ? `rm ${statusEntry.file}`
+                : `restore --source HEAD --staged --worktree -- ${statusEntry.file}`
+            : `write patch baseline for ${statusEntry.file}`, 
         // Always attach the cause via toError so thrown primitives (strings,
         // numbers) produced by poorly-behaved utilities still propagate as
         // an Error, preserving stack traces for verbose-mode triage.
@@ -203,8 +227,9 @@ export async function discardCommand(projectRoot, file, options = {}) {
 export function registerDiscard(program, { getProjectRoot, withErrorHandling }) {
     program
         .command('discard <file>')
-        .description('Discard changes to a specific file (deletes untracked files). Pass a directory path to discard every modified or untracked file beneath it; the operation walks the status output and reverts each match individually.')
+        .description('Discard changes to a specific file, restoring patch-claimed paths to their patch-applied baseline (unmanaged untracked files are deleted). Pass a directory path to discard every modified or untracked file beneath it; the operation walks the status output and reverts each match individually.')
         .option('--dry-run', 'Show what would be discarded without doing it')
+        .option('--to-upstream', 'Restore to pristine upstream (HEAD) instead of the patch-applied baseline; deletes patch-created files')
         .option('-y, --yes', 'Skip confirmation prompt')
         .action(withErrorHandling(async (file, options) => {
         await discardCommand(getProjectRoot(), file, pickDefined(options));

package/dist/src/commands/export-flow.d.ts

@@ -51,7 +51,7 @@ export declare function resolvePlacementPlan(patchesDir: string, options: Export
  * introduce by landing earlier than one of its dependencies. Returns null
  * when the projection is clean.
  */
-export declare function projectPlacementForLint(patchesDir: string, plan: PlacementPlan, diff: string): Promise<ConflictReport | null>;
+export declare function projectPlacementForLint(patchesDir: string, plan: PlacementPlan, diff: string, config?: FireForgeConfig): Promise<ConflictReport | null>;
 /**
  * Builds the change-summary lines printed by the placement confirmation.
  */

package/dist/src/commands/export-flow.js

@@ -74,14 +74,22 @@ export function computePlacementPlan(manifestPatches, newPatchCategory, newPatch
     const sorted = [...manifestPatches].sort((a, b) => a.order - b.order);
     const renameMap = new Map();
     const prefixWidth = prefixWidthForPatches(sorted, requestedOrder);
-    // Every existing patch at requestedOrder or later shifts up by one.
+    // Patches at requestedOrder or later shift up by one, but only until the
+    // cascade reaches a free ordinal — a gap absorbs the insert, so the tail
+    // beyond it (including any reserved block) keeps its numbering.
+    let cursor = requestedOrder;
     for (const patch of sorted) {
-        if (patch.order >= requestedOrder) {
-            const newOrder = patch.order + 1;
-            const currentRest = patch.filename.replace(/^\d+-/, '');
-            const newFilename = `${String(newOrder).padStart(prefixWidth, '0')}-${currentRest}`;
-            renameMap.set(patch.filename, { newOrder, newFilename });
+        if (patch.order < requestedOrder) {
+            continue;
         }
+        if (patch.order > cursor) {
+            break;
+        }
+        const newOrder = cursor + 1;
+        const currentRest = patch.filename.replace(/^\d+-/, '');
+        const newFilename = `${String(newOrder).padStart(prefixWidth, '0')}-${currentRest}`;
+        renameMap.set(patch.filename, { newOrder, newFilename });
+        cursor = newOrder;
     }
     const newFilename = buildFilenameForPlacement(newPatchCategory, newPatchName, requestedOrder, prefixWidth);
     return {
@@ -176,8 +184,8 @@ function buildNewFilesFromDiff(diff) {
  * introduce by landing earlier than one of its dependencies. Returns null
  * when the projection is clean.
  */
-export async function projectPlacementForLint(patchesDir, plan, diff) {
-    const baseCtx = await buildPatchQueueContext(patchesDir);
+export async function projectPlacementForLint(patchesDir, plan, diff, config) {
+    const baseCtx = await buildPatchQueueContext(patchesDir, config);
     const projectedEntries = baseCtx.entries.map((entry) => {
         const rename = plan.renameMap.get(entry.filename);
         if (!rename)
@@ -199,7 +207,10 @@ export async function projectPlacementForLint(patchesDir, plan, diff) {
         modifiedFileAdditions: buildModifiedFileAdditionsFromDiff(diff),
     });
     projectedEntries.sort((a, b) => a.order - b.order || a.filename.localeCompare(b.filename));
-    const projectedIssues = lintPatchQueue({ entries: projectedEntries }).filter((i) => i.severity === 'error');
+    const projectedIssues = lintPatchQueue({
+        entries: projectedEntries,
+        ...(baseCtx.patchPolicy ? { patchPolicy: baseCtx.patchPolicy } : {}),
+    }).filter((i) => i.severity === 'error');
     if (projectedIssues.length === 0)
         return null;
     return {
@@ -235,7 +246,7 @@ export async function commitPlacementExport(input) {
         if (!placementPlansEqual(currentPlan, input.expectedPlan)) {
             throw new InvalidArgumentError('Patch queue changed while waiting for export confirmation. Re-run the command to recompute placement.', 'export placement');
         }
-        const conflicts = await projectPlacementForLint(input.patchesDir, currentPlan, input.diff);
+        const conflicts = await projectPlacementForLint(input.patchesDir, currentPlan, input.diff, input.config);
         if (conflicts && input.unsafeOverride !== true) {
             throw new InvalidArgumentError(`Refusing to run export: ${conflicts.reason}. ` +
                 'If the conflict names files owned by another patch (e.g. duplicate-new-file-creation), ' +

package/dist/src/commands/export-placement-gate.js

@@ -44,7 +44,7 @@ export async function gatePlacementPlan(args) {
     // is passed — one up-front error per run instead of per-patch findings.
     const placementPlan = await resolvePlacementPlan(patchesDir, options, selectedCategory, patchName, config);
     const currentManifest = await loadPatchesManifest(patchesDir);
-    const conflicts = await projectPlacementForLint(patchesDir, placementPlan, diff);
+    const conflicts = await projectPlacementForLint(patchesDir, placementPlan, diff, config);
     const renamed = currentManifest !== null
         ? applyRenameMapToManifest(currentManifest, placementPlan.renameMap)
         : buildProjectedManifest(null, []);

package/dist/src/commands/export-shared.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { join } from 'node:path';
 import { confirm, select, text } from '@clack/prompts';
-import { addLicenseHeaderToFile } from '../core/license-headers.js';
+import { addLicenseHeaderToFile, hasThirdPartyPermissiveBanner } from '../core/license-headers.js';
 import { findAllPatchesForFiles } from '../core/patch-export.js';
 import { commentStyleForFile, detectNewFilesInDiff, isAcceptableNewFileHeader, lintExportedPatch, resolvePatchSizeTier, } from '../core/patch-lint.js';
 import { resolvePatchOwnedSysMjs } from '../core/patch-lint-ownership.js';
@@ -10,7 +10,7 @@ import { getPatchPolicyCategories, isCategoryAllowedByConfig } from '../core/pat
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { pathExists, readText } from '../utils/fs.js';
 import { cancel, info, isCancel, warn } from '../utils/logger.js';
-import { PATCH_CATEGORIES, validatePatchName } from '../utils/validation.js';
+import { normalizePatchDisplayName, PATCH_CATEGORIES, validatePatchName, } from '../utils/validation.js';
 /**
  * Runs the full patch lint pipeline and reports results.
  * Warnings are always displayed. Errors block the export unless skipLint is true.
@@ -101,7 +101,10 @@ export async function runPatchLint(engineDir, filesAffected, diffContent, config
  */
 export async function promptExportPatchMetadata(options, isInteractive, commandName, config) {
     const categories = config !== undefined ? getPatchPolicyCategories(config) : [...PATCH_CATEGORIES];
-    let patchName = options.name;
+    // A filename-shaped `--name foo.patch` must not die on the dot rule —
+    // strip the extension before validation so the one-step flow works for
+    // both name shapes (FORGE G13).
+    let patchName = options.name?.trim().replace(/\.patch$/i, '');
     if (patchName) {
         const validationError = validatePatchName(patchName);
         if (validationError) {
@@ -156,8 +159,16 @@ export async function promptExportPatchMetadata(options, isInteractive, commandN
             description = String(descResult);
         }
     }
+    // The filename slug pipeline strips redundant category prefixes; the
+    // manifest display name must agree, or every `export --name ui-foo`
+    // needs a follow-up `patch rename` to satisfy bare-slug naming policy
+    // (FORGE G13).
+    const normalized = normalizePatchDisplayName(patchName, category);
+    if (normalized !== patchName) {
+        info(`Patch name normalized: "${patchName}" → "${normalized}" (the filename carries the order and category prefix).`);
+    }
     return {
-        patchName,
+        patchName: normalized,
         selectedCategory: category,
         description,
     };
@@ -218,6 +229,7 @@ export async function autoFixLicenseHeaders(engineDir, diffContent, config, isIn
     if (newFiles.size === 0)
         return false;
     const filesToFix = [];
+    const vendoredFiles = [];
     for (const file of newFiles) {
         const style = commentStyleForFile(file);
         if (!style)
@@ -231,9 +243,23 @@ export async function autoFixLicenseHeaders(engineDir, diffContent, config, isIn
         // MPL block header on a derived JS/CSS file) would stack a second
         // header on top of a legitimate one.
         if (!isAcceptableNewFileHeader(file, content, style, license)) {
-            filesToFix.push(file);
+            // A recognized third-party permissive banner marks the file as
+            // vendored: prepending the project's own license header would break
+            // byte-identity pins and mislicense upstream code (FORGE F15).
+            if (hasThirdPartyPermissiveBanner(content)) {
+                vendoredFiles.push(file);
+            }
+            else {
+                filesToFix.push(file);
+            }
         }
     }
+    if (vendoredFiles.length > 0) {
+        const vendoredList = vendoredFiles.map((f) => `  - ${f}`).join('\n');
+        info(`${vendoredFiles.length} new file(s) carry a third-party permissive license banner and ` +
+            'were left untouched (vendored); if the missing-license-header lint check flags them, ' +
+            `waive it with --lint-ignore missing-license-header:\n${vendoredList}`);
+    }
     if (filesToFix.length === 0)
         return false;
     if (dryRun) {

package/dist/src/commands/import.js

@@ -8,6 +8,7 @@ import { getDirtyFiles } from '../core/git-status.js';
 import { applyPatchesWithContinue, countPatches, createPatchedContentComputer, discoverPatches, extractAffectedFiles, matchesUntilFilename, PatchError, } from '../core/patch-apply.js';
 import { checkVersionCompatibility, loadPatchesManifest, validatePatchesManifestConsistency, validatePatchIntegrity, } from '../core/patch-manifest.js';
 import { getPatchSourceVersion } from '../core/patch-source-metadata.js';
+import { warnIfStaticComponentsStale } from '../core/test-stale-check.js';
 import { GeneralError } from '../errors/base.js';
 import { toError } from '../utils/errors.js';
 import { pathExists, readText } from '../utils/fs.js';
@@ -419,6 +420,10 @@ export async function importCommand(projectRoot, options = {}) {
             const suffix = result.autoResolved ? ' (auto-resolved)' : '';
             success(`  ${result.patch.filename}${suffix}`);
         }
+        // The re-applied queue may have moved components.conf away from what
+        // the last full build compiled in — surface that now instead of at the
+        // next test refusal (FORGE F13).
+        await warnIfStaticComponentsStale(projectRoot, paths.engine);
         outro('All patches applied successfully!');
     }
     catch (error) {