@hominis/fireforge 0.39.0 → 0.40.0

package/dist/src/commands/patch/staged-dependency.js

@@ -10,35 +10,46 @@ import { GeneralError, InvalidArgumentError } from '../../errors/base.js';
 import { toError } from '../../utils/errors.js';
 import { info, intro, outro, warn } from '../../utils/logger.js';
 import { requirePatchQueue, requirePatchTarget } from './patch-context.js';
+/** Joins the names of the missing flags for error attribution (FORGE G12). */
+function missingFlagList(pairs) {
+    return pairs
+        .filter(([, value]) => value === undefined || value === '')
+        .map(([flag]) => flag)
+        .join(', ');
+}
 function modeFromOptions(options) {
     const adding = options.add === true;
     const removing = options.remove === true;
     const clearing = options.clear === true;
     const modeCount = [adding, removing, clearing].filter(Boolean).length;
     if (modeCount > 1) {
-        throw new InvalidArgumentError('--add, --remove, and --clear are mutually exclusive. Pick one mode per invocation.', 'patch staged-dependency');
+        throw new InvalidArgumentError('--add, --remove, and --clear are mutually exclusive. Pick one mode per invocation.', '--add/--remove/--clear');
     }
     if (modeCount === 0) {
-        throw new InvalidArgumentError('Specify --add, --remove, or --clear.', 'patch staged-dependency');
+        throw new InvalidArgumentError('Specify --add, --remove, or --clear.', '--add/--remove/--clear');
     }
     return adding ? 'add' : removing ? 'remove' : 'clear';
 }
 function kindFromOptions(options) {
     const kind = options.kind ?? 'import';
     if (kind !== 'import' && kind !== 'registration') {
-        throw new InvalidArgumentError(`--kind must be "import" or "registration" (got "${kind}").`, 'patch staged-dependency');
+        throw new InvalidArgumentError(`--kind must be "import" or "registration" (got "${kind}").`, '--kind');
     }
     if (kind === 'import' && options.line !== undefined) {
-        throw new InvalidArgumentError('--line only applies to --kind registration; import declarations use --specifier.', 'patch staged-dependency');
+        throw new InvalidArgumentError('--line only applies to --kind registration; import declarations use --specifier.', '--line');
     }
     if (kind === 'registration' && options.specifier !== undefined) {
-        throw new InvalidArgumentError('--specifier only applies to --kind import; registration declarations use --line.', 'patch staged-dependency');
+        throw new InvalidArgumentError('--specifier only applies to --kind import; registration declarations use --line.', '--specifier');
     }
     return kind;
 }
-function requireForwardImportOptions(options, mode) {
+function requireForwardImportOptions(options) {
     if (!options.file || !options.specifier || !options.creates) {
-        throw new InvalidArgumentError(`--${mode} requires --file, --specifier, and --creates.`, 'patch staged-dependency');
+        throw new InvalidArgumentError('--add requires --file, --specifier, and --creates.', missingFlagList([
+            ['--file', options.file],
+            ['--specifier', options.specifier],
+            ['--creates', options.creates],
+        ]));
     }
     const dependency = {
         file: options.file,
@@ -51,9 +62,13 @@ function requireForwardImportOptions(options, mode) {
         dependency.reason = options.reason;
     return dependency;
 }
-function requireRegistrationOptions(options, mode) {
+function requireRegistrationOptions(options) {
     if (!options.file || !options.line || !options.creates) {
-        throw new InvalidArgumentError(`--${mode} --kind registration requires --file, --line, and --creates.`, 'patch staged-dependency');
+        throw new InvalidArgumentError('--add --kind registration requires --file, --line, and --creates.', missingFlagList([
+            ['--file', options.file],
+            ['--line', options.line],
+            ['--creates', options.creates],
+        ]));
     }
     const dependency = {
         file: options.file,
@@ -66,6 +81,70 @@ function requireRegistrationOptions(options, mode) {
         dependency.reason = options.reason;
     return dependency;
 }
+/**
+ * Resolves the `--remove` target for forward-imports (FORGE G12):
+ * `--file` + `--specifier` suffice when they identify at most one staged
+ * entry — `--creates` is inferred from a unique match, an ambiguous match
+ * refuses with the candidate list, and no match falls through to the
+ * honest "no staged forward-import matched" summary.
+ */
+function resolveImportRemovalTarget(options, staged) {
+    if (!options.file || !options.specifier) {
+        throw new InvalidArgumentError('--remove requires --file and --specifier; --creates is only needed to disambiguate when several staged entries share them.', missingFlagList([
+            ['--file', options.file],
+            ['--specifier', options.specifier],
+        ]));
+    }
+    if (options.creates) {
+        return requireForwardImportOptions(options);
+    }
+    const { file, specifier } = options;
+    const candidates = (staged?.forwardImports ?? []).filter((entry) => entry.file === file &&
+        entry.specifier === specifier &&
+        (options.owner === undefined || entry.owner === options.owner));
+    const single = candidates.length === 1 ? candidates[0] : undefined;
+    if (single !== undefined) {
+        info(`Inferred --creates ${single.creates} from the single matching staged entry.`);
+        return { ...single };
+    }
+    if (candidates.length > 1) {
+        const list = candidates
+            .map((entry) => `  - ${dependencyLabel('import', importView(entry))}`)
+            .join('\n');
+        throw new GeneralError(`--remove matches ${String(candidates.length)} staged forward-imports on this patch; ` +
+            `pass --creates to pick one:\n${list}`);
+    }
+    return { file, specifier, creates: '(no match)' };
+}
+/** Registration twin of {@link resolveImportRemovalTarget}, keyed on `--line`. */
+function resolveRegistrationRemovalTarget(options, staged) {
+    if (!options.file || !options.line) {
+        throw new InvalidArgumentError('--remove --kind registration requires --file and --line; --creates is only needed to disambiguate when several staged entries share them.', missingFlagList([
+            ['--file', options.file],
+            ['--line', options.line],
+        ]));
+    }
+    if (options.creates) {
+        return requireRegistrationOptions(options);
+    }
+    const { file, line } = options;
+    const candidates = (staged?.registrations ?? []).filter((entry) => entry.file === file &&
+        entry.line === line &&
+        (options.owner === undefined || entry.owner === options.owner));
+    const single = candidates.length === 1 ? candidates[0] : undefined;
+    if (single !== undefined) {
+        info(`Inferred --creates ${single.creates} from the single matching staged entry.`);
+        return { ...single };
+    }
+    if (candidates.length > 1) {
+        const list = candidates
+            .map((entry) => `  - ${dependencyLabel('registration', registrationView(entry))}`)
+            .join('\n');
+        throw new GeneralError(`--remove matches ${String(candidates.length)} staged registrations on this patch; ` +
+            `pass --creates to pick one:\n${list}`);
+    }
+    return { file, line, creates: '(no match)' };
+}
 function importView(dependency) {
     return { ...dependency, matcher: dependency.specifier };
 }
@@ -137,17 +216,26 @@ export async function patchStagedDependencyCommand(projectRoot, identifier, opti
     intro(isDryRun ? 'FireForge patch staged-dependency (dry run)' : 'FireForge patch staged-dependency');
     const mode = modeFromOptions(options);
     const kind = kindFromOptions(options);
-    const importDependency = mode === 'clear' || kind !== 'import' ? undefined : requireForwardImportOptions(options, mode);
+    // The patch queue loads BEFORE the declaration fields resolve so
+    // `--remove` can infer `--creates` from the target patch's staged
+    // entries (FORGE G12).
+    const { paths, manifest } = await requirePatchQueue(projectRoot);
+    const targetPatch = requirePatchTarget(identifier, manifest.patches);
+    const importDependency = mode === 'clear' || kind !== 'import'
+        ? undefined
+        : mode === 'add'
+            ? requireForwardImportOptions(options)
+            : resolveImportRemovalTarget(options, targetPatch.stagedDependencies);
     const registrationDependency = mode === 'clear' || kind !== 'registration'
         ? undefined
-        : requireRegistrationOptions(options, mode);
+        : mode === 'add'
+            ? requireRegistrationOptions(options)
+            : resolveRegistrationRemovalTarget(options, targetPatch.stagedDependencies);
     const target = importDependency !== undefined
         ? importView(importDependency)
         : registrationDependency !== undefined
             ? registrationView(registrationDependency)
             : undefined;
-    const { paths, manifest } = await requirePatchQueue(projectRoot);
-    const targetPatch = requirePatchTarget(identifier, manifest.patches);
     const applyToStaged = (staged) => {
         if (mode === 'clear')
             return {};
@@ -219,7 +307,7 @@ export function registerPatchStagedDependency(parent, context) {
         .option('--owner <patch>', 'Exact later patch filename expected to create --creates')
         .option('--reason <text>', 'Human-readable rationale stored with the declaration')
         .option('--dry-run', 'Show what would change without writing')
-        .option('-y, --yes', 'Skip confirmation prompt (required for non-TTY)')
+        .option('-y, --yes', 'Record scripted consent in the destructive-operation history log. This command never prompts; the flag exists for workflow uniformity with commands that do.')
         .action(withErrorHandling(async (name, options) => {
         await patchStagedDependencyCommand(getProjectRoot(), name, options);
     }));

package/dist/src/commands/re-export-adjacent.d.ts

@@ -0,0 +1,34 @@
+import type { getProjectPaths } from '../core/config.js';
+import type { PatchesManifest, PatchMetadata } from '../types/commands/index.js';
+/**
+ * Shared per-run context for the adjacency advisory: the classification
+ * inputs computed once by `reExportCommand`, plus the collection of
+ * patches refused under `--refuse-adjacent-unmanaged` (collected across
+ * the loop so a multi-patch run reports every offender in one refusal).
+ */
+export interface AdjacentUnmanagedContext {
+    binaryName: string;
+    furnacePrefixes: ReadonlySet<string>;
+    refuseAdjacentUnmanaged: boolean;
+    refusals: {
+        patchFilename: string;
+        files: string[];
+    }[];
+}
+/** Returns the subset of `files` that no longer exist under `engineDir`. */
+export declare function findMissingFiles(engineDir: string, files: readonly string[]): Promise<string[]>;
+/**
+ * Emits the scan-less advisory for one patch: missing manifest files and
+ * unmanaged files adjacent to the patch's ownership. When
+ * `--refuse-adjacent-unmanaged` is set and any unmanaged adjacent file
+ * exists, records the patch into `ctx.refusals` and returns true — the
+ * caller then skips the write for this patch and converts the collection
+ * into one run-level non-zero refusal after the loop.
+ */
+export declare function reportAdjacentUnmanagedFiles(args: {
+    patch: PatchMetadata;
+    paths: ReturnType<typeof getProjectPaths>;
+    manifest: PatchesManifest;
+    currentFilesAffected: readonly string[];
+    ctx: AdjacentUnmanagedContext;
+}): Promise<boolean>;

package/dist/src/commands/re-export-adjacent.js

@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Scan-less re-export adjacency advisory (FORGE G2). A plain `re-export`
+ * keeps the manifest's filesAffected unchanged, so a brand-new file an
+ * author just created beside a patch's owned files is silently left out
+ * of the refreshed body. This module detects such adjacent files, filters
+ * out tool-managed paths (branding, furnace) so the notice names only
+ * genuinely unmanaged candidates, and — under
+ * `--refuse-adjacent-unmanaged` — lets the caller turn the notice into a
+ * non-zero refusal.
+ *
+ * Split out of re-export.ts to keep that file inside the max-lines
+ * budget; exports helpers consumed by re-export.ts, no registrar.
+ */
+import { dirname, join } from 'node:path';
+import { isBrandingManagedPath } from '../core/branding.js';
+import { getModifiedFilesInDir, getUntrackedFilesInDir } from '../core/git-status.js';
+import { getClaimedFiles } from '../core/patch-manifest.js';
+import { isGeneratedBrandingPath } from '../core/status-classify.js';
+import { pathExists } from '../utils/fs.js';
+import { info, warn } from '../utils/logger.js';
+/** Returns the subset of `files` that no longer exist under `engineDir`. */
+export async function findMissingFiles(engineDir, files) {
+    const missingFiles = [];
+    for (const file of files) {
+        if (!(await pathExists(join(engineDir, file))))
+            missingFiles.push(file);
+    }
+    return missingFiles;
+}
+function isToolManagedPath(file, isNewFile, ctx) {
+    // Mirrors status-classify: a generated branding path is tool-managed
+    // outright; a brand-new unowned file under the branding root is still a
+    // patch candidate (the Assets.car precedent) and must stay listed.
+    if (isBrandingManagedPath(file, ctx.binaryName) &&
+        (!isNewFile || isGeneratedBrandingPath(file, ctx.binaryName))) {
+        return true;
+    }
+    for (const prefix of ctx.furnacePrefixes) {
+        if (file.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
+async function findAdjacentUnmanagedFiles(args) {
+    const { currentFilesAffected, engineDir, manifest, patchFilename, ctx } = args;
+    const parentDirs = [...new Set(currentFilesAffected.map((file) => dirname(file)))];
+    const currentSet = new Set(currentFilesAffected);
+    const claimedByOthers = getClaimedFiles(manifest, patchFilename);
+    const candidates = new Set();
+    for (const dir of parentDirs) {
+        const [modifiedFiles, untrackedFiles] = await Promise.all([
+            getModifiedFilesInDir(engineDir, dir),
+            getUntrackedFilesInDir(engineDir, dir),
+        ]);
+        const untrackedSet = new Set(untrackedFiles);
+        for (const file of [...modifiedFiles, ...untrackedFiles]) {
+            if (currentSet.has(file) || claimedByOthers.has(file))
+                continue;
+            if (isToolManagedPath(file, untrackedSet.has(file), ctx))
+                continue;
+            candidates.add(file);
+        }
+    }
+    return [...candidates].sort();
+}
+/**
+ * Emits the scan-less advisory for one patch: missing manifest files and
+ * unmanaged files adjacent to the patch's ownership. When
+ * `--refuse-adjacent-unmanaged` is set and any unmanaged adjacent file
+ * exists, records the patch into `ctx.refusals` and returns true — the
+ * caller then skips the write for this patch and converts the collection
+ * into one run-level non-zero refusal after the loop.
+ */
+export async function reportAdjacentUnmanagedFiles(args) {
+    const { patch, paths, manifest, currentFilesAffected, ctx } = args;
+    const missingFiles = await findMissingFiles(paths.engine, currentFilesAffected);
+    if (missingFiles.length > 0) {
+        warn(`${patch.filename}: some files in patches.json no longer exist on disk ` +
+            `(${missingFiles.join(', ')}). Without --scan, re-export keeps the manifest's ` +
+            `filesAffected unchanged and the missing entries will be preserved — ` +
+            `\`fireforge verify\` may flag manifest inconsistency after this run.\n` +
+            `  Re-run with --scan to reconcile filesAffected with the current worktree, ` +
+            `or pass --files <paths> to set the list explicitly.`);
+    }
+    const unmanagedFiles = await findAdjacentUnmanagedFiles({
+        currentFilesAffected,
+        engineDir: paths.engine,
+        manifest,
+        patchFilename: patch.filename,
+        ctx,
+    });
+    if (unmanagedFiles.length === 0)
+        return false;
+    const firstFew = unmanagedFiles.slice(0, 3).join(', ');
+    const more = unmanagedFiles.length > 3 ? `, +${String(unmanagedFiles.length - 3)} more` : '';
+    warn(`${patch.filename}: found ${String(unmanagedFiles.length)} unmanaged file(s) adjacent to this patch's ownership (${firstFew}${more}); plain re-export keeps filesAffected unchanged — use --scan-file to include reviewed files.`);
+    for (const file of unmanagedFiles) {
+        info(`  ${file} — fireforge re-export ${patch.filename} --scan --scan-file ${file}`);
+    }
+    if (ctx.refuseAdjacentUnmanaged) {
+        ctx.refusals.push({ patchFilename: patch.filename, files: unmanagedFiles });
+        return true;
+    }
+    return false;
+}

package/dist/src/commands/re-export-options.js

@@ -77,6 +77,9 @@ export function validateReExportOptionCombinations(patches, options) {
             throw new InvalidArgumentError('--scan-files selects patches from its manifest and cannot be combined with positional patches or --all.', '--scan-files');
         }
     }
+    if (options.refuseAdjacentUnmanaged === true && (options.scan || options.files !== undefined)) {
+        throw new InvalidArgumentError('--refuse-adjacent-unmanaged applies to the scan-less path only and cannot be combined with --scan or --files (those set filesAffected explicitly).', '--refuse-adjacent-unmanaged');
+    }
     const usingTierFlag = options.tier !== undefined;
     const usingLintIgnoreFlag = options.lintIgnore !== undefined && options.lintIgnore.length > 0;
     if (options.all && (usingTierFlag || usingLintIgnoreFlag)) {

package/dist/src/commands/re-export.js

@@ -1,81 +1,52 @@
 // SPDX-License-Identifier: EUPL-1.2
 /* eslint-disable max-lines -- Re-export is at the guardrail; splitting register plumbing is unrelated to this fix. */
-import { dirname, join } from 'node:path';
 import { multiselect } from '@clack/prompts';
 import { Command, Option } from 'commander';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { withEngineSessionLock } from '../core/engine-session-lock.js';
+import { collectFurnaceManagedPrefixes } from '../core/furnace-config.js';
 import { enforceFreshFurnaceSources } from '../core/furnace-stale-export.js';
 import { isGitRepository } from '../core/git.js';
 import { getDiffForFilesAgainstHead } from '../core/git-diff.js';
-import { getModifiedFilesInDir, getUntrackedFilesInDir } from '../core/git-status.js';
 import { updatePatchAndMetadata } from '../core/patch-export.js';
 import { buildPatchQueueContext } from '../core/patch-lint.js';
-import { getClaimedFiles, loadPatchesManifest, resolvePatchIdentifier, stampPatchVersions, } from '../core/patch-manifest.js';
+import { loadPatchesManifest, resolvePatchIdentifier, stampPatchVersions, } from '../core/patch-manifest.js';
 import { buildProjectedManifest, enforcePatchPolicy } from '../core/patch-policy.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
+import { isGitIndexLockConflict } from '../errors/git.js';
 import { elapsedSince } from '../utils/elapsed.js';
 import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
 import { cancel, info, intro, isCancel, outro, spinner, success, warn } from '../utils/logger.js';
 import { addWaitLockOption, pickDefined, resolveWaitLockSeconds } from '../utils/options.js';
 import { runPatchLint } from './export-shared.js';
+import { findMissingFiles, reportAdjacentUnmanagedFiles } from './re-export-adjacent.js';
 import { loadScanFilesAssignments, withDryRunReExportLock } from './re-export-bulk-scan.js';
 import { reExportFilesInPlace } from './re-export-files.js';
 import { applyReExportFilesPositionalFolding, validateReExportOptionCombinations, } from './re-export-options.js';
 import { assertScanAdoptionsHaveNoForwardImports, assertScanFileAdditionsHaveDiffHunks, confirmBroadScanAdditions, normalizeScanFiles, scanPatchFilesForReExport, } from './re-export-scan.js';
-async function findMissingFiles(engineDir, files) {
-    const missingFiles = [];
-    for (const file of files) {
-        if (!(await pathExists(join(engineDir, file))))
-            missingFiles.push(file);
+const GIT_INDEX_LOCK_RETRY_MS = 300;
+/**
+ * Retries a single patch re-export exactly once when the failure is
+ * transient git `index.lock` contention (an external git process holding
+ * the engine repo's index). The retry re-enters `reExportSinglePatch`
+ * from the top, so it re-reads clean state; a second lock failure
+ * propagates to the loop's honest "N of M" accounting.
+ */
+async function reExportSinglePatchWithIndexLockRetry(patch, paths, manifest, options, isDryRun, config, adjacentCtx) {
+    try {
+        return await reExportSinglePatch(patch, paths, manifest, options, isDryRun, config, adjacentCtx);
     }
-    return missingFiles;
-}
-async function findLikelyNewSiblingFiles(args) {
-    const { currentFilesAffected, engineDir, manifest, patchFilename } = args;
-    const parentDirs = [...new Set(currentFilesAffected.map((file) => dirname(file)))];
-    const currentSet = new Set(currentFilesAffected);
-    const claimedByOthers = getClaimedFiles(manifest, patchFilename);
-    const candidates = new Set();
-    for (const dir of parentDirs) {
-        const [modifiedFiles, untrackedFiles] = await Promise.all([
-            getModifiedFilesInDir(engineDir, dir),
-            getUntrackedFilesInDir(engineDir, dir),
-        ]);
-        for (const file of [...modifiedFiles, ...untrackedFiles]) {
-            if (currentSet.has(file) || claimedByOthers.has(file))
-                continue;
-            candidates.add(file);
+    catch (error) {
+        if (!isGitIndexLockConflict(error)) {
+            throw error;
         }
+        warn(`${patch.filename}: git index.lock contention detected — retrying once after ${String(GIT_INDEX_LOCK_RETRY_MS)} ms...`);
+        await new Promise((resolve) => setTimeout(resolve, GIT_INDEX_LOCK_RETRY_MS));
+        return await reExportSinglePatch(patch, paths, manifest, options, isDryRun, config, adjacentCtx);
     }
-    return [...candidates].sort();
 }
-async function warnPlainReExportFileDrift(args) {
-    const { patch, paths, manifest, currentFilesAffected } = args;
-    const missingFiles = await findMissingFiles(paths.engine, currentFilesAffected);
-    if (missingFiles.length > 0) {
-        warn(`${patch.filename}: some files in patches.json no longer exist on disk ` +
-            `(${missingFiles.join(', ')}). Without --scan, re-export keeps the manifest's ` +
-            `filesAffected unchanged and the missing entries will be preserved — ` +
-            `\`fireforge verify\` may flag manifest inconsistency after this run.\n` +
-            `  Re-run with --scan to reconcile filesAffected with the current worktree, ` +
-            `or pass --files <paths> to set the list explicitly.`);
-    }
-    const likelyNewFiles = await findLikelyNewSiblingFiles({
-        currentFilesAffected,
-        engineDir: paths.engine,
-        manifest,
-        patchFilename: patch.filename,
-    });
-    if (likelyNewFiles.length === 0)
-        return;
-    warn(`${patch.filename}: found ${likelyNewFiles.length} unowned changed sibling file${likelyNewFiles.length === 1 ? '' : 's'} near this patch. Plain re-export keeps filesAffected unchanged; add reviewed files explicitly with --scan-file.`);
-    for (const file of likelyNewFiles) {
-        info(`  ${file} — fireforge re-export ${patch.filename} --scan --scan-file ${file}`);
-    }
-}
-async function reExportSinglePatch(patch, paths, manifest, options, isDryRun, config) {
+async function reExportSinglePatch(patch, paths, manifest, options, isDryRun, config, adjacentCtx) {
     let currentFilesAffected = [...patch.filesAffected];
     // --- Scan for new/removed files ---
     if (options.scan) {
@@ -123,7 +94,9 @@ async function reExportSinglePatch(patch, paths, manifest, options, isDryRun, co
         // warning up-front when we can detect the drift cheaply, so the
         // operator has a chance to re-run with `--scan` or `--files`
         // before the stale filesAffected lands in patches.json.
-        await warnPlainReExportFileDrift({ patch, paths, manifest, currentFilesAffected });
+        const args = { patch, paths, manifest, currentFilesAffected, ctx: adjacentCtx };
+        if (await reportAdjacentUnmanagedFiles(args))
+            return false;
     }
     // --- Explicit file-subset path ---
     // When --files is given, the target filesAffected is authoritative — drop
@@ -359,6 +332,14 @@ export async function reExportCommand(projectRoot, patches, options) {
         return;
     }
     const config = await loadConfig(projectRoot);
+    // Classification inputs for the scan-less adjacency advisory, computed
+    // once for the whole run (FORGE G2).
+    const adjacentCtx = {
+        binaryName: config.binaryName,
+        furnacePrefixes: await collectFurnaceManagedPrefixes(paths.root),
+        refuseAdjacentUnmanaged: options.refuseAdjacentUnmanaged === true,
+        refusals: [],
+    };
     let reExported = 0;
     const reExportedFilenames = [];
     const progress = spinner('Preparing re-export...');
@@ -369,7 +350,7 @@ export async function reExportCommand(projectRoot, patches, options) {
             const patchOptions = assignedScanFiles !== undefined ? { ...options, scanFiles: assignedScanFiles } : options;
             progress.message(`Re-exporting ${index + 1}/${selectedPatches.length}: ${patch.filename} (${patch.filesAffected.length} file(s), ${elapsedSince(startedAt)} elapsed)...`);
             try {
-                const exported = await reExportSinglePatch(patch, paths, manifest, patchOptions, isDryRun, config);
+                const exported = await reExportSinglePatchWithIndexLockRetry(patch, paths, manifest, patchOptions, isDryRun, config, adjacentCtx);
                 if (exported) {
                     reExported++;
                     reExportedFilenames.push(patch.filename);
@@ -381,6 +362,13 @@ export async function reExportCommand(projectRoot, patches, options) {
             }
         }
     });
+    if (adjacentCtx.refusals.length > 0) {
+        progress.error('Re-export refused');
+        const names = adjacentCtx.refusals.map((r) => r.patchFilename).join(', ');
+        throw new GeneralError(`Refused ${String(adjacentCtx.refusals.length)} patch(es) with adjacent unmanaged files ` +
+            `(--refuse-adjacent-unmanaged): ${names}. Adopt reviewed files with --scan --scan-file, ` +
+            `or export them as a new patch.`);
+    }
     if (reExported === 0 && selectedPatches.length > 0) {
         progress.error('Re-export failed');
         throw new GeneralError('All selected patches failed to re-export. Check the errors above.');
@@ -431,6 +419,7 @@ export function registerReExport(program, { getProjectRoot, withErrorHandling })
         .split(',')
         .map((v) => v.trim())
         .filter((v) => v.length > 0))
+        .option('--refuse-adjacent-unmanaged', 'Refuse a scan-less re-export (non-zero exit, patch not written) when unmanaged files exist adjacent to the patch ownership, instead of warning. Mutually exclusive with --scan and --files.')
         .option('--dry-run', 'Show what would change without writing')
         .option('--skip-lint', 'Skip patch lint checks (downgrade errors to warnings)')
         .option('--allow-stale-furnace', 'Export the deployed engine copy even when the components/ source changed since the last furnace apply')

package/dist/src/commands/run.js

@@ -6,7 +6,7 @@ import { Command } from 'commander';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { warnIfFurnaceStale } from '../core/furnace-staleness.js';
 import { buildArtifactMismatchMessage, hasBuildArtifacts, hasRunnableBundle, run, runMachSmoke, } from '../core/mach.js';
-import { compileAllowlistFromFile, compileAllowlistFromStrings, matchesAllowlist, matchesSmokeError, } from '../core/smoke-patterns.js';
+import { compileAllowlistFromFile, compileAllowlistFromStrings, matchAllowlist, matchesSmokeError, } from '../core/smoke-patterns.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { AmbiguousBuildArtifactsError, BuildError } from '../errors/build.js';
 import { ExitCode } from '../errors/codes.js';
@@ -186,6 +186,7 @@ async function runSmokeExit(engineDir, options) {
     const findings = [];
     let allowlistedErrorHits = 0;
     let allowlistedTotalHits = 0;
+    const allowlistHits = new Array(allowlist.length).fill(0);
     const handleLine = (stream, line) => {
         // Mirror raw output to the terminal so operators watching the smoke
         // run still see what the browser is printing. Stream selection on the
@@ -201,9 +202,11 @@ async function runSmokeExit(engineDir, options) {
         // total set of allowlisted lines (what the operator sees in the
         // console) and the subset that were error-class (what the smoke
         // exit contract cares about). The exit contract itself is unchanged.
-        const isAllowlisted = allowlist.length > 0 && matchesAllowlist(line, allowlist);
+        const matchIndex = allowlist.length > 0 ? matchAllowlist(line, allowlist) : -1;
+        const isAllowlisted = matchIndex !== -1;
         if (isAllowlisted) {
             allowlistedTotalHits += 1;
+            allowlistHits[matchIndex] = (allowlistHits[matchIndex] ?? 0) + 1;
         }
         if (!matchesSmokeError(line))
             return;
@@ -249,6 +252,8 @@ async function runSmokeExit(engineDir, options) {
         timedOut: result.timedOut,
         allowlistedErrorHits,
         allowlistedTotalHits,
+        allowlist,
+        allowlistHits,
         findings,
         exitCode: result.exitCode,
     });
@@ -314,6 +319,17 @@ function reportSmokeSummary(args) {
     info(`  Allowlisted error hits (suppressed): ${String(args.allowlistedErrorHits)}`);
     info(`  Allowlisted lines total: ${String(args.allowlistedTotalHits)}`);
     info(`  Child exit code:  ${String(args.exitCode)}`);
+    // Per-entry attribution (FORGE G8): first-match credit per line, with
+    // zero-hit entries always visible — an allowlist entry whose suppressed
+    // shape changed upstream is only detectable as a 0× row.
+    if (args.allowlist.length > 0) {
+        info('  Allowlist attribution (first matching entry per line):');
+        args.allowlist.forEach((entry, index) => {
+            const hits = args.allowlistHits[index] ?? 0;
+            const zeroSuffix = hits === 0 ? '  (never matched — candidate for removal)' : '';
+            info(`    ${String(hits)}×  ${entry.origin}  ${entry.source}${zeroSuffix}`);
+        });
+    }
     if (args.findings.length === 0)
         return;
     warn('');

package/dist/src/commands/status-check.d.ts

@@ -0,0 +1,35 @@
+/**
+ * `status --check` enforcement policy (FORGE G1). Turns the classified
+ * status view into a CI-enforceable non-zero exit: the default policy
+ * fails on any classification outside {patch-backed, branding, furnace},
+ * and `--fail-on <class,...>` replaces that set for finer control.
+ *
+ * Helper module consumed by status.ts (which sits at the max-lines
+ * budget); no top-level registrar is exported and none is wanted.
+ */
+import type { ClassifiedFile, FileClassification } from '../core/status-classify.js';
+/** Resolved `--check`/`--fail-on` policy for one status invocation. */
+export interface StatusCheckPolicy {
+    checkEnabled: boolean;
+    failOn: readonly FileClassification[];
+}
+/**
+ * Resolves the enforcement policy from the raw flags: `--fail-on` implies
+ * `--check` and replaces the default set; both are refused alongside the
+ * modes that skip (or elide) classification.
+ */
+export declare function resolveStatusCheckPolicy(options: {
+    check?: boolean;
+    failOn?: string;
+    raw?: boolean;
+    unmanaged?: boolean;
+    ownership?: boolean;
+    testCoverage?: boolean;
+}): StatusCheckPolicy;
+/**
+ * Throws a GeneralError (exit 1) when the policy is enabled and any of
+ * its classifications is non-empty, naming each offending classification
+ * with its first few files. A disabled policy or a fully tool-covered
+ * tree passes silently.
+ */
+export declare function runStatusCheck(classified: readonly ClassifiedFile[], policy: StatusCheckPolicy): void;