@hominis/fireforge 0.39.0 → 0.41.0

package/dist/src/core/patch-lint-jsdoc.d.ts

@@ -9,7 +9,9 @@
 import type * as acorn from 'acorn';
 import type { ClassDeclaration, FunctionDeclaration } from 'estree';
 import type { AcornESTreeNode } from './ast-utils.js';
-export type JsDocCheck = 'missing-jsdoc' | 'jsdoc-param-mismatch' | 'jsdoc-missing-returns' | 'missing-jsdoc-class-method' | 'jsdoc-class-method-param-mismatch' | 'jsdoc-class-method-missing-returns';
+export type JsDocCheck = 
+/** The source could not be parsed, so no JSDoc rule could run on it. */
+'jsdoc-unparseable-source' | 'missing-jsdoc' | 'jsdoc-param-mismatch' | 'jsdoc-missing-returns' | 'missing-jsdoc-class-method' | 'jsdoc-class-method-param-mismatch' | 'jsdoc-class-method-missing-returns';
 export interface JsDocIssue {
     line: number;
     check: JsDocCheck;

package/dist/src/core/patch-lint-jsdoc.js

@@ -7,7 +7,8 @@
  * Separated from `patch-lint.ts` to keep both files within the
  * project's per-file line budget.
  */
-import { parseModule } from './ast-utils.js';
+import { toError } from '../utils/errors.js';
+import { asEstree, parseModule } from './ast-utils.js';
 // ---------------------------------------------------------------------------
 // JSDoc comment helpers
 // ---------------------------------------------------------------------------
@@ -339,7 +340,7 @@ export function validateClassMethods(cls, comments, source, issues, severity) {
     for (const member of cls.body.body) {
         if (member.type !== 'MethodDefinition')
             continue;
-        const method = member;
+        const method = asEstree(member);
         if (isPrivateMethodKey(method))
             continue;
         const name = staticMethodName(method);
@@ -369,7 +370,7 @@ export function validateClassMethods(cls, comments, source, issues, severity) {
             continue;
         }
         const skipReturns = method.kind === 'constructor' || method.kind === 'set';
-        validateParamsAndReturns(method.value, jsDoc, issues, {
+        validateParamsAndReturns(asEstree(method.value), jsDoc, issues, {
             label,
             line,
             paramCheck: 'jsdoc-class-method-param-mismatch',
@@ -396,8 +397,17 @@ export function validateExportJsDoc(source, options) {
     try {
         ast = parseModule(source, comments);
     }
-    catch {
-        return [];
+    catch (error) {
+        // An unparseable source is NOT a clean file. Returning `[]` here was the
+        // same value as "fully documented", so a syntax error silently cleared
+        // every rule this module enforces. Report it instead.
+        return [
+            {
+                line: 1,
+                check: 'jsdoc-unparseable-source',
+                message: `Source could not be parsed for JSDoc analysis: ${toError(error).message}`,
+            },
+        ];
     }
     const issues = [];
     const body = ast.body;

package/dist/src/core/patch-lint-module-registration.d.ts

@@ -0,0 +1,15 @@
+import type { PatchLintIssue } from '../types/commands/index.js';
+interface ModuleRegistrationQueueEntry {
+    filename: string;
+    newFiles: ReadonlyMap<string, string>;
+    modifiedFileAdditions: ReadonlyMap<string, string>;
+}
+interface ModuleRegistrationQueueContext {
+    entries: readonly ModuleRegistrationQueueEntry[];
+}
+/**
+ * Flags a new `.sys.mjs` imported through a Firefox resource URL when the
+ * projected queue never adds it to a moz.build list.
+ */
+export declare function lintPatchQueueModuleRegistrations(ctx: ModuleRegistrationQueueContext): PatchLintIssue[];
+export {};

package/dist/src/core/patch-lint-module-registration.js

@@ -0,0 +1,88 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Queue-wide registration lint for newly-created Firefox system modules.
+ */
+import { basename } from 'node:path';
+import { escapeRegex, stripJsComments } from '../utils/regex.js';
+const IMPORTABLE_EXTENSIONS = ['.mjs', '.sys.mjs', '.js', '.jsm'];
+/** Maps Firefox's common system-module resource URLs to their source suffix. */
+function moduleSourceSuffix(specifier) {
+    const cleaned = specifier.split(/[?#]/)[0] ?? specifier;
+    for (const prefix of ['resource:///modules/', 'resource://gre/modules/']) {
+        if (cleaned.startsWith(prefix))
+            return `/modules/${cleaned.slice(prefix.length)}`;
+    }
+    return undefined;
+}
+/** Resource-module strings in actual code (comments removed), de-duplicated. */
+function extractResourceModuleSpecifiers(content) {
+    const stripped = stripJsComments(content);
+    const found = new Set();
+    const pattern = /["'](resource:\/\/(?:\/|gre\/)modules\/[^"']+\.sys\.mjs(?:[?#][^"']*)?)["']/g;
+    for (const match of stripped.matchAll(pattern)) {
+        if (match[1] !== undefined)
+            found.add(match[1]);
+    }
+    return [...found];
+}
+/** True when some patch in the projected queue adds the module to moz.build. */
+function queueRegistersModule(ctx, leaf) {
+    const escaped = escapeRegex(leaf);
+    const quotedLeaf = new RegExp(`["']${escaped}["']`);
+    for (const entry of ctx.entries) {
+        for (const [path, content] of [...entry.newFiles, ...entry.modifiedFileAdditions]) {
+            if ((path === 'moz.build' || path.endsWith('/moz.build')) && quotedLeaf.test(content)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Flags a new `.sys.mjs` imported through a Firefox resource URL when the
+ * projected queue never adds it to a moz.build list.
+ */
+export function lintPatchQueueModuleRegistrations(ctx) {
+    const imported = new Map();
+    const collect = (entry, path, content) => {
+        if (!IMPORTABLE_EXTENSIONS.some((extension) => path.endsWith(extension)))
+            return;
+        for (const specifier of extractResourceModuleSpecifiers(content)) {
+            const suffix = moduleSourceSuffix(specifier);
+            if (suffix === undefined)
+                continue;
+            const importers = imported.get(suffix) ?? new Set();
+            importers.add(entry.filename);
+            imported.set(suffix, importers);
+        }
+    };
+    for (const entry of ctx.entries) {
+        for (const [path, content] of entry.newFiles)
+            collect(entry, path, content);
+        for (const [path, content] of entry.modifiedFileAdditions)
+            collect(entry, path, content);
+    }
+    const issues = [];
+    for (const entry of ctx.entries) {
+        for (const path of entry.newFiles.keys()) {
+            if (!path.endsWith('.sys.mjs'))
+                continue;
+            const matched = [...imported.entries()].find(([suffix]) => path.endsWith(suffix));
+            if (!matched || queueRegistersModule(ctx, basename(path)))
+                continue;
+            const [suffix, importers] = matched;
+            issues.push({
+                file: path,
+                check: 'unregistered-system-module',
+                patches: [...new Set([entry.filename, ...importers])],
+                fingerprint: `unregistered-system-module|${path}|${suffix}`,
+                message: `${path} is newly created and imported as a resource module, but no patch adds ` +
+                    `${basename(path)} to a moz.build list. Register it in EXTRA_JS_MODULES (or the ` +
+                    'appropriate namespaced list) before export; source-level typechecks can resolve the ' +
+                    'file even though the packaged browser cannot.',
+                severity: 'error',
+            });
+        }
+    }
+    return issues;
+}

package/dist/src/core/patch-lint-mozbuild.js

@@ -31,40 +31,128 @@ const STRICT_ORDERED_MOZBUILD_LISTS = [
     'XPIDL_SOURCES',
 ];
 const LIST_OPENER = new RegExp(`^\\s*((?:${STRICT_ORDERED_MOZBUILD_LISTS.join('|')})(?:\\.[A-Za-z_][A-Za-z0-9_]*)*)\\s*\\+?=\\s*\\[`);
-/** Extracts every strict-ordered list (with items in file order) from moz.build content. */
+/**
+ * Strips a Python trailing comment from a moz.build line.
+ *
+ * `#` inside a quoted string is not a comment, so the scan tracks quote state
+ * rather than using `indexOf('#')`.
+ */
+/**
+ * True when `line` contains a `]` outside any quoted span. A bracket inside an
+ * item (`"icons[2x].png"`) is filename text, not the list's close — reading it
+ * as one truncated the item set and left every later item unchecked.
+ */
+function hasUnquotedCloseBracket(line) {
+    let quote;
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (quote !== undefined) {
+            if (ch === '\\')
+                i += 1;
+            else if (ch === quote)
+                quote = undefined;
+        }
+        else if (ch === '"' || ch === "'") {
+            quote = ch;
+        }
+        else if (ch === ']') {
+            return true;
+        }
+    }
+    return false;
+}
+function stripMozBuildComment(line) {
+    let quote;
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (quote !== undefined) {
+            if (ch === '\\')
+                i += 1;
+            else if (ch === quote)
+                quote = undefined;
+        }
+        else if (ch === '"' || ch === "'") {
+            quote = ch;
+        }
+        else if (ch === '#') {
+            return line.slice(0, i);
+        }
+    }
+    return line;
+}
+/**
+ * Extracts every strict-ordered list (with items in file order) from moz.build
+ * content.
+ *
+ * Comments are stripped before both the item scan and the close-bracket test.
+ * moz.build is Python, and before 0.41.0 neither step knew that:
+ *
+ * - a quoted string in a trailing comment was scraped in as a phantom list
+ *   item (`"Zeta.cpp",  # replaces "Beta.cpp"` yielded a `Beta.cpp` entry), so
+ *   the sort check reported an unsorted list naming a file that is not in it —
+ *   with a fingerprint that could never stabilise, because the item does not
+ *   exist to be moved;
+ * - a `]` anywhere in a comment (`# see foo[0]`) closed the list early and
+ *   silently truncated the item set.
+ *
+ * The scan also no longer advances the caller's loop counter: an unterminated
+ * list used to consume the rest of the file, so every *later* list in it was
+ * skipped entirely.
+ *
+ * Nor does an unterminated list borrow the NEXT list's bracket. The forward
+ * scan stops at the next list opener rather than reading through it: without
+ * that, an unclosed `EXTRA_COMPONENTS` swallowed the following
+ * `EXTRA_JS_MODULES` — its items merged into the first list's item set and its
+ * `]` accepted as the first list's close — reporting a sorting error against a
+ * variable that never contained those items, and skipping the second list.
+ */
 function collectStrictOrderedLists(content) {
     const lines = content.split('\n');
     const occurrences = [];
     for (let i = 0; i < lines.length; i++) {
-        const line = lines[i] ?? '';
-        const opener = LIST_OPENER.exec(line);
+        const opener = LIST_OPENER.exec(lines[i] ?? '');
         if (!opener)
             continue;
         const varName = opener[1] ?? '';
         const items = [];
         // Items may start on the opener line (`VAR += ["a", "b"]`) or span
         // following lines until the closing bracket.
-        let rest = line.slice(opener[0].length);
+        let rest = stripMozBuildComment((lines[i] ?? '').slice(opener[0].length));
         let closed = false;
+        // Scan ahead on a local cursor so an unterminated list costs only itself.
+        let cursor = i;
         for (;;) {
-            for (const quoted of rest.matchAll(/["']([^"']+)["']/g)) {
-                items.push(quoted[1] ?? '');
+            // Quote types are matched pairwise so an apostrophe inside a
+            // double-quoted item ("don't.cpp") cannot terminate the match early and
+            // scrape in a phantom item.
+            for (const quoted of rest.matchAll(/"([^"]+)"|'([^']+)'/g)) {
+                items.push(quoted[1] ?? quoted[2] ?? '');
             }
-            if (/\]/.test(rest)) {
+            if (hasUnquotedCloseBracket(rest)) {
                 closed = true;
                 break;
             }
-            i += 1;
-            if (i >= lines.length)
+            cursor += 1;
+            if (cursor >= lines.length)
                 break;
-            rest = lines[i] ?? '';
+            rest = stripMozBuildComment(lines[cursor] ?? '');
+            if (LIST_OPENER.test(rest)) {
+                // A new list starts here, so the previous one never closed. Rewind so
+                // the outer loop examines this line as its own opener.
+                cursor -= 1;
+                break;
+            }
             if (/^\s*\]/.test(rest)) {
                 closed = true;
                 break;
             }
         }
-        if (closed)
+        if (closed) {
             occurrences.push({ varName, items });
+            // Resume after the list we just consumed; a list that never closed
+            // leaves `i` untouched so the next line is still examined.
+            i = cursor;
+        }
     }
     return occurrences;
 }

package/dist/src/core/patch-lint-ownership.d.ts

@@ -41,3 +41,24 @@ export declare function resolvePatchOwnedSysMjs(currentNewFiles: Set<string>, pa
  * @returns Set of patch-owned chrome-subscript file paths
  */
 export declare function resolvePatchOwnedChromeScripts(currentNewFiles: Set<string>, patchQueueCtx?: PatchQueueContext): Set<string>;
+/**
+ * Test-script predicate for the `checkJsTestFiles` pass (FORGE G5):
+ * plain `.js` files (not `.sys.mjs` modules) that live under a `/test/`
+ * path or carry a `browser_` / `test_` / `xpcshell_` basename. Duplicates
+ * `patch-lint.ts`'s `isTestFile` shape rather than importing it —
+ * patch-lint.ts imports this module, so the reverse edge would create an
+ * import cycle (dpdm gate). The agreement is pinned by
+ * `patch-lint-ownership.test.ts`.
+ */
+export declare function isTestScriptFile(file: string): boolean;
+/**
+ * Returns the set of patch-owned test `.js` files (FORGE G5). Same
+ * ownership semantics as {@link resolvePatchOwnedSysMjs}; consumed by the
+ * `patchLint.checkJsTestFiles` pass, which checks each as its own small
+ * script-scope program.
+ *
+ * @param currentNewFiles - Files newly created in the current diff
+ * @param patchQueueCtx - Optional cross-patch context for queue-wide ownership
+ * @returns Set of patch-owned test-script file paths
+ */
+export declare function resolvePatchOwnedTestScripts(currentNewFiles: Set<string>, patchQueueCtx?: PatchQueueContext): Set<string>;

package/dist/src/core/patch-lint-ownership.js

@@ -67,3 +67,33 @@ export function resolvePatchOwnedSysMjs(currentNewFiles, patchQueueCtx) {
 export function resolvePatchOwnedChromeScripts(currentNewFiles, patchQueueCtx) {
     return resolveOwned(currentNewFiles, patchQueueCtx, (file) => file.endsWith('.js') && !file.endsWith('.sys.mjs'));
 }
+/**
+ * Test-script predicate for the `checkJsTestFiles` pass (FORGE G5):
+ * plain `.js` files (not `.sys.mjs` modules) that live under a `/test/`
+ * path or carry a `browser_` / `test_` / `xpcshell_` basename. Duplicates
+ * `patch-lint.ts`'s `isTestFile` shape rather than importing it —
+ * patch-lint.ts imports this module, so the reverse edge would create an
+ * import cycle (dpdm gate). The agreement is pinned by
+ * `patch-lint-ownership.test.ts`.
+ */
+export function isTestScriptFile(file) {
+    if (!file.endsWith('.js') || file.endsWith('.sys.mjs'))
+        return false;
+    if (file.includes('/test/'))
+        return true;
+    const basename = file.split('/').pop() ?? '';
+    return /^(?:browser_|test_|xpcshell_).*\.js$/.test(basename);
+}
+/**
+ * Returns the set of patch-owned test `.js` files (FORGE G5). Same
+ * ownership semantics as {@link resolvePatchOwnedSysMjs}; consumed by the
+ * `patchLint.checkJsTestFiles` pass, which checks each as its own small
+ * script-scope program.
+ *
+ * @param currentNewFiles - Files newly created in the current diff
+ * @param patchQueueCtx - Optional cross-patch context for queue-wide ownership
+ * @returns Set of patch-owned test-script file paths
+ */
+export function resolvePatchOwnedTestScripts(currentNewFiles, patchQueueCtx) {
+    return resolveOwned(currentNewFiles, patchQueueCtx, isTestScriptFile);
+}

package/dist/src/core/patch-lint-reexports.d.ts

@@ -2,5 +2,6 @@
  * Public re-exports for {@link ./patch-lint.ts}. Split out so the
  * orchestrator stays within the ESLint `max-lines` budget.
  */
-export { buildPatchQueueContext, collectForwardImportEdges, collectNewFileCreatorsByPath, extractImportSpecifiers, extractImportSpecifiersWithLines, findForwardImportIgnoreLines, FORWARD_IMPORT_IGNORE_MARKER, type ForwardImportEdge, isForwardImportableFile, lintPatchQueue, lintPatchQueueDuplicateCreations, lintPatchQueueForwardImports, type PatchQueueContext, type PatchQueueEntry, } from './patch-lint-cross.js';
+export { buildPatchQueueContext, collectForwardImportEdges, collectNewFileCreatorsByPath, extractImportSpecifiers, extractImportSpecifiersWithLines, findForwardImportIgnoreLines, FORWARD_IMPORT_IGNORE_MARKER, isForwardImportableFile, lintPatchQueue, lintPatchQueueDuplicateCreations, lintPatchQueueForwardImports, type PatchQueueContext, type PatchQueueEntry, } from './patch-lint-cross.js';
 export { buildModifiedFileAdditionsFromDiff, detectNewFilesInDiff } from './patch-lint-diff.js';
+export { lintPatchQueueModuleRegistrations } from './patch-lint-module-registration.js';

package/dist/src/core/patch-lint-reexports.js

@@ -5,3 +5,4 @@
  */
 export { buildPatchQueueContext, collectForwardImportEdges, collectNewFileCreatorsByPath, extractImportSpecifiers, extractImportSpecifiersWithLines, findForwardImportIgnoreLines, FORWARD_IMPORT_IGNORE_MARKER, isForwardImportableFile, lintPatchQueue, lintPatchQueueDuplicateCreations, lintPatchQueueForwardImports, } from './patch-lint-cross.js';
 export { buildModifiedFileAdditionsFromDiff, detectNewFilesInDiff } from './patch-lint-diff.js';
+export { lintPatchQueueModuleRegistrations } from './patch-lint-module-registration.js';

package/dist/src/core/patch-lint.d.ts

@@ -4,6 +4,12 @@ import { type CommentStyle } from './license-headers.js';
 import { lintPatchedCss } from './patch-lint-css.js';
 export * from './patch-lint-reexports.js';
 export { lintPatchedCss };
+/**
+ * Canonical `[check] file: message` rendering of a patch-lint issue — the
+ * one string shape every reporter and refusal message uses, so operators
+ * can grep one format across lint output and refusal details.
+ */
+export declare function formatPatchLintIssue(issue: Pick<PatchLintIssue, 'check' | 'file' | 'message'>): string;
 /**
  * Counts the total lines in a unified diff and the number of non-binary
  * text lines, so binary hunks do not inflate patch size checks.
@@ -24,6 +30,8 @@ export declare function countNonBinaryDiffLines(diffContent: string): {
  * `browser_`, `test_`, or `xpcshell_` (all `.js`).
  */
 export declare function isTestFile(file: string): boolean;
+/** True when `strippedContent` contains at least one assertion call. */
+export declare function hasBrowserChromeAssertion(strippedContent: string): boolean;
 /**
  * Detects comment style from file extension for license header checks.
  */
@@ -128,6 +136,21 @@ export type PatchSizeTierDecision = {
  * defensive-for-tests choice.
  */
 export declare function resolvePatchSizeTier(filesAffected: ReadonlyArray<string>, patchTier?: 'branding'): PatchSizeTierDecision;
+/**
+ * Read-only view of the size thresholds a tier enforces (FORGE G9).
+ * Public-API companion to {@link resolvePatchSizeTier} /
+ * {@link countNonBinaryDiffLines} so consumers can build waiver-freshness
+ * checks against the SAME numbers `large-patch-lines` /
+ * `large-patch-files` fire on instead of mirroring them.
+ */
+export declare function getPatchSizeThresholds(tier: 'general' | 'test' | 'branding'): {
+    lines: {
+        notice: number;
+        warning: number;
+        error: number;
+    };
+    maxFiles: number;
+};
 /**
  * Checks patch size and emits advisory warnings.
  *
@@ -179,6 +202,14 @@ export interface LintExportedPatchOptions {
      * attributes findings per patch instead of rebuilding per patch.
      */
     precomputedCheckJs?: readonly PatchLintIssue[];
+    /**
+     * Invoked with the issues DROPPED by the `ignoreChecks` waiver filter,
+     * when any were (FORGE G10). Suppression semantics are unchanged — the
+     * returned issue list still excludes them — but the caller can report
+     * the measurement a waived size finding carried (per-patch NOTICE lines
+     * and the `--report` JSON) instead of losing it entirely.
+     */
+    onSuppressed?: (suppressed: PatchLintIssue[]) => void;
 }
 /**
  * Runs all patch lint checks and returns combined issues.

package/dist/src/core/patch-lint.js

@@ -3,7 +3,7 @@ import { dirname, join } from 'node:path';
 import { pathExists, readText } from '../utils/fs.js';
 import { stripJsComments } from '../utils/regex.js';
 import { containsUpstreamLicenseText, getLicenseHeader, hasAnyLicenseHeader, hasAnyLicenseHeaderAnyStyle, hasUpstreamMplBlockHeader, } from './license-headers.js';
-import { invokePatchLintCheckJs } from './patch-lint-checkjs.js';
+import { invokePatchLintCheckJs, runCheckJsTestFilesGrouped } from './patch-lint-checkjs.js';
 import { lintChromeScriptJsDocForFile } from './patch-lint-chrome-jsdoc.js';
 import { lintPatchedCss } from './patch-lint-css.js';
 import { detectNewFilesInDiff, extractAddedLinesPerFile } from './patch-lint-diff.js';
@@ -12,7 +12,7 @@ import { hasRelativeImport } from './patch-lint-imports.js';
 import { validateExportJsDoc } from './patch-lint-jsdoc.js';
 import { lintMozBuildSortedLists } from './patch-lint-mozbuild.js';
 import { lintObserverTopics } from './patch-lint-observer.js';
-import { resolvePatchOwnedChromeScripts, resolvePatchOwnedSysMjs } from './patch-lint-ownership.js';
+import { resolvePatchOwnedChromeScripts, resolvePatchOwnedSysMjs, resolvePatchOwnedTestScripts, } from './patch-lint-ownership.js';
 // ---------------------------------------------------------------------------
 // Cross-patch lint re-exports
 // ---------------------------------------------------------------------------
@@ -49,6 +49,14 @@ function countContentLines(content) {
         lines.pop();
     return lines.length;
 }
+/**
+ * Canonical `[check] file: message` rendering of a patch-lint issue — the
+ * one string shape every reporter and refusal message uses, so operators
+ * can grep one format across lint output and refusal details.
+ */
+export function formatPatchLintIssue(issue) {
+    return `[${issue.check}] ${issue.file}: ${issue.message}`;
+}
 /**
  * Counts the total lines in a unified diff and the number of non-binary
  * text lines, so binary hunks do not inflate patch size checks.
@@ -136,6 +144,16 @@ const PATCH_FILES_THRESHOLDS = {
     test: 5,
     branding: 60,
 };
+/**
+ * Shared remedy sentence for the over-budget findings (FORGE H4): the two
+ * places an operator stands when a patch outgrows its budget must name the
+ * sanctioned one-transaction way out, or they reach for the wrong tools
+ * first (the field report tried two before finding it). One constant, four
+ * emission sites — the wording cannot drift.
+ */
+const SPLIT_HINT = 'Consider splitting into smaller, focused patches — ' +
+    '"fireforge patch move-files <from> <to> --file <path> --create --order <n>" ' +
+    'moves files into a new patch in one transaction.';
 /**
  * Fixed allowlist of non-branding sibling paths that real-world Firefox
  * branding patches legitimately need to touch to register the new
@@ -214,6 +232,67 @@ function isBrowserChromeTestFile(file) {
         return false;
     return basename.startsWith('browser_');
 }
+/**
+ * Bare assertion-call detection for the `test-needs-assertion` floor.
+ *
+ * Each alternative must sit at a call boundary: preceded by something that is
+ * not an identifier character, `.`, `#`, or `-`. Until 0.41.0 this was a plain
+ * `strippedContent.includes(tok)` over the tokens `Assert.`, `ok(`, `is(`,
+ * `isnot(`, `isDeeply(`, so any identifier merely *ending* in one satisfied
+ * the gate — `this.axis(3)` contains `is(`, `book(` contains `ok(`,
+ * `promiseIsDeeply(` contains `isDeeply(`. An assertion-free smoke test using
+ * any such call passed the floor, which is exactly what the rule exists to
+ * catch.
+ *
+ * The namespaced arm must name a member and a call. Matching the namespace and
+ * its dot alone — as `(?:Assert|SimpleTest)\.` did — re-opened the same hole
+ * from the other side: `SimpleTest` is mostly *harness* API, so
+ * `SimpleTest.finish()`, `SimpleTest.waitForExplicitFinish()` and
+ * `SimpleTest.requestCompleteLog()` each cleared the floor on their own. Those
+ * are the exact calls an assertion-free smoke test contains. The enumeration
+ * below is the mochitest/xpcshell assertion surface both namespaces share, and
+ * it is what the user-facing message already names.
+ *
+ * Two qualified spellings of the bare four still count: `window.ok(...)` (the
+ * globals ARE window properties) and an optional-chained `win?.ok(...)`.
+ * Blocking those flagged tests whose only assertions are real as
+ * assertion-free. `SpecialPowers.ok(` stays excluded — that is API surface,
+ * not an assertion.
+ *
+ * Deliberately still textual, not AST-based: this runs over patch bodies
+ * rather than resolvable sources, and the surrounding rule is a floor, not a
+ * proof.
+ */
+const ASSERTION_MEMBERS = [
+    'ok',
+    'is',
+    'isnot',
+    'isDeeply',
+    'equal',
+    'notEqual',
+    'deepEqual',
+    'notDeepEqual',
+    'strictEqual',
+    'notStrictEqual',
+    'greater',
+    'greaterOrEqual',
+    'less',
+    'lessOrEqual',
+    'stringMatches',
+    'stringContains',
+    'throws',
+    'rejects',
+    // `todo`, `todo_is`, `todo_isnot`, `info`-free — todo* record an expected
+    // failure, which is still a recorded assertion outcome.
+    'todo',
+    'todo_is',
+    'todo_isnot',
+].join('|');
+const BROWSER_CHROME_ASSERTION = new RegExp(`(?<![\\w.#$-])(?:(?:Assert|SimpleTest)\\.(?:${ASSERTION_MEMBERS})\\s*\\(|(?:window\\.|[\\w$]+\\?\\.)?(?:ok|is|isnot|isDeeply)\\s*\\()`);
+/** True when `strippedContent` contains at least one assertion call. */
+export function hasBrowserChromeAssertion(strippedContent) {
+    return BROWSER_CHROME_ASSERTION.test(strippedContent);
+}
 /**
  * Detects comment style from file extension for license header checks.
  */
@@ -406,8 +485,7 @@ export async function lintPatchedJs(repoDir, affectedFiles, newFiles, config, pa
         // browser_*.js silently passed under the old `isNew` gate).
         const assertionFloor = config.patchLint?.testAssertionFloor;
         if (assertionFloor && assertionFloor !== 'off' && isBrowserChromeTestFile(file)) {
-            const ASSERTION_TOKENS = ['Assert.', 'ok(', 'is(', 'isnot(', 'isDeeply('];
-            const hasAssertion = ASSERTION_TOKENS.some((tok) => strippedContent.includes(tok));
+            const hasAssertion = hasBrowserChromeAssertion(strippedContent);
             if (!hasAssertion) {
                 issues.push({
                     file,
@@ -481,6 +559,19 @@ export function resolvePatchSizeTier(filesAffected, patchTier) {
         return { tier: 'branding', source: 'auto' };
     return { tier: 'general' };
 }
+/**
+ * Read-only view of the size thresholds a tier enforces (FORGE G9).
+ * Public-API companion to {@link resolvePatchSizeTier} /
+ * {@link countNonBinaryDiffLines} so consumers can build waiver-freshness
+ * checks against the SAME numbers `large-patch-lines` /
+ * `large-patch-files` fire on instead of mirroring them.
+ */
+export function getPatchSizeThresholds(tier) {
+    return {
+        lines: { ...PATCH_LINE_THRESHOLDS[tier] },
+        maxFiles: PATCH_FILES_THRESHOLDS[tier],
+    };
+}
 /**
  * Checks patch size and emits advisory warnings.
  *
@@ -522,7 +613,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
         issues.push({
             file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-files',
-            message: `Patch affects ${filesAffected.length} files (recommended: ≤${fileThreshold}). Consider splitting into smaller, focused patches.`,
+            message: `Patch affects ${filesAffected.length} files (recommended: ≤${fileThreshold}). ${SPLIT_HINT}`,
             severity: 'warning',
         });
     }
@@ -530,7 +621,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
         issues.push({
             file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-lines',
-            message: `Patch is ${lineCount} lines (hard limit: ${lineThresholds.error}). Consider splitting into smaller, focused patches.`,
+            message: `Patch is ${lineCount} lines (hard limit: ${lineThresholds.error}). ${SPLIT_HINT}`,
             severity: 'error',
         });
     }
@@ -538,7 +629,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
         issues.push({
             file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-lines',
-            message: `Patch is ${lineCount} lines (soft limit: ${lineThresholds.warning}, hard limit: ${lineThresholds.error}). Consider splitting into smaller, focused patches.`,
+            message: `Patch is ${lineCount} lines (soft limit: ${lineThresholds.warning}, hard limit: ${lineThresholds.error}). ${SPLIT_HINT}`,
             severity: 'warning',
         });
     }
@@ -546,7 +637,7 @@ export function lintPatchSize(filesAffected, lineCount, patchTier) {
         issues.push({
             file: AGGREGATE_PATCH_FILE,
             check: 'large-patch-lines',
-            message: `Patch is ${lineCount} lines (soft limit: ${lineThresholds.warning}, hard limit: ${lineThresholds.error}). Consider splitting into smaller, focused patches.`,
+            message: `Patch is ${lineCount} lines (soft limit: ${lineThresholds.warning}, hard limit: ${lineThresholds.error}). ${SPLIT_HINT}`,
             severity: 'notice',
         });
     }
@@ -644,6 +735,17 @@ export async function lintExportedPatch(repoDir, affectedFiles, diffContent, con
     }
     else if (config.patchLint?.checkJs) {
         issues.push(...(await invokePatchLintCheckJs(repoDir, patchOwnedFiles, config.patchLint, dirname(repoDir), options?.checkJsReportScope)));
+        // Export-time twin of per-patch lint's test-file pass (FORGE G5), so
+        // export/re-export and `lint --per-patch` agree on the checked surface.
+        if (config.patchLint.checkJsTestFiles === true) {
+            const testGrouped = await runCheckJsTestFilesGrouped(repoDir, resolvePatchOwnedTestScripts(newFiles, patchQueueCtx), config.patchLint, dirname(repoDir));
+            issues.push(...testGrouped.global);
+            for (const [rel, list] of testGrouped.byFile) {
+                if (options?.checkJsReportScope && !options.checkJsReportScope.has(rel))
+                    continue;
+                issues.push(...list);
+            }
+        }
     }
     // Filter out ignored checks last so every rule still runs (keeps the
     // implementation uniform) but suppressed rules do not surface. We do not
@@ -651,6 +753,10 @@ export async function lintExportedPatch(repoDir, affectedFiles, diffContent, con
     // inline `fireforge-ignore: <check>` markers work in the CSS and
     // forward-import rules.
     if (ignoreChecks && ignoreChecks.size > 0) {
+        const suppressed = issues.filter((issue) => ignoreChecks.has(issue.check));
+        if (suppressed.length > 0) {
+            options?.onSuppressed?.(suppressed);
+        }
         return issues.filter((issue) => !ignoreChecks.has(issue.check));
     }
     return issues;