@hominis/fireforge 0.40.0 → 0.41.0

package/dist/src/core/furnace-apply-helpers.d.ts

@@ -1,5 +1,16 @@
 import type { CustomComponentConfig, DryRunAction, OverrideComponentConfig, StepError } from '../types/furnace.js';
 import { type RollbackJournal } from './furnace-rollback.js';
+interface DirectoryEntry {
+    isFile(): boolean;
+    isSymbolicLink?(): boolean;
+    name: string;
+}
+/**
+ * True for a plain-file directory entry — symlinks and directories are
+ * never copy candidates. Exported for the patch-owned overwrite probe
+ * (FORGE J6), which walks the same override copy-candidate set as apply.
+ */
+export declare function isRegularFile(entry: DirectoryEntry): boolean;
 /**
  * Filter deciding which files in an override workspace directory are candidates
  * for copying into the engine. Exported so `furnace remove` can invert apply
@@ -62,7 +73,7 @@ export declare function undeployOverrideFiles(engineDir: string, config: Overrid
     removed: string[];
 }>;
 /** Compares current component file checksums against the previously recorded state. */
-export declare function hasComponentChanged(componentDir: string, previousChecksums: Record<string, string>): Promise<boolean>;
+export declare function hasComponentChanged(componentDir: string, previousChecksums: Record<string, string>, currentChecksums?: Record<string, string>): Promise<boolean>;
 /**
  * Detects whether an override component's deployed files are missing from the
  * engine or differ from the source. Used as a guard before skipping apply on a

package/dist/src/core/furnace-apply-helpers.js

@@ -15,7 +15,12 @@ import { recordCreatedDir, snapshotFile } from './furnace-rollback.js';
 import { checkRegistrationConsistency } from './furnace-validate-registration.js';
 import { isGitRepository } from './git.js';
 import { fileExistsInHead, restoreTrackedPath } from './git-file-ops.js';
-function isRegularFile(entry) {
+/**
+ * True for a plain-file directory entry — symlinks and directories are
+ * never copy candidates. Exported for the patch-owned overwrite probe
+ * (FORGE J6), which walks the same override copy-candidate set as apply.
+ */
+export function isRegularFile(entry) {
     if (!entry.isFile())
         return false;
     if (typeof entry.isSymbolicLink === 'function' && entry.isSymbolicLink())
@@ -177,8 +182,12 @@ export async function undeployOverrideFiles(engineDir, config, deletedFiles, ftl
     return { restored, removed };
 }
 /** Compares current component file checksums against the previously recorded state. */
-export async function hasComponentChanged(componentDir, previousChecksums) {
-    const current = await computeComponentChecksums(componentDir);
+export async function hasComponentChanged(componentDir, previousChecksums, currentChecksums) {
+    const current = currentChecksums ?? (await computeComponentChecksums(componentDir));
+    return componentChecksumsChanged(current, previousChecksums);
+}
+/** Pure checksum-map comparison used when the caller already walked the component. */
+function componentChecksumsChanged(current, previousChecksums) {
     const currentKeys = Object.keys(current);
     const previousKeys = Object.keys(previousChecksums);
     if (currentKeys.length !== previousKeys.length) {

package/dist/src/core/furnace-apply-output.js

@@ -51,6 +51,15 @@ export function logApplyResult(result, isDryRun) {
             }
         }
     }
+    // Patch-owned overwrite warnings (FORGE J6) print on every non-dry-run
+    // outcome — including the rolled-back branch, where the overwrite
+    // happened before the rollback restored it and the operator still needs
+    // to know the deployed copy was momentarily replaced.
+    if (!isDryRun && result.warnings !== undefined) {
+        for (const line of result.warnings) {
+            warn(line);
+        }
+    }
     for (const err of result.errors) {
         error(`${err.name} — ${err.error}`);
     }

package/dist/src/core/furnace-apply-overwrite-warn.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Patch-owned overwrite warnings for `furnace apply` (FORGE J6).
+ *
+ * For Furnace-managed components, apply OVERWRITES the deployed engine
+ * copies with the `components/` sources. A fix made directly in `engine/`
+ * and exported into a patch — but never back-ported to the component
+ * source — is silently undone by the next apply, and the only prior
+ * signal was a drift line that read like "someone's uncommitted work".
+ * This module detects that exact case BEFORE the copy: the deployed
+ * bytes differ from the component source AND the file is patch-owned,
+ * and produces a loud per-file warning naming the file, the owning
+ * patch, and the consequence.
+ *
+ * The per-file byte comparison already exists —
+ * `checkRegistrationConsistency` for custom components (fragment- and
+ * ftl-aware) and the copy-candidate walk for overrides — this module
+ * only surfaces what was previously computed and thrown away.
+ */
+import type { CustomComponentConfig, OverrideComponentConfig } from '../types/furnace.js';
+/** One deployed, patch-owned file about to be overwritten with different bytes. */
+export interface PatchOwnedOverwriteWarning {
+    component: string;
+    /** Engine-relative path of the deployed file being replaced. */
+    file: string;
+    /** Patch filenames claiming the path in patches.json. */
+    owners: string[];
+}
+/**
+ * Loads the file → owning-patch map for the overwrite warning (FORGE J6).
+ * A missing or unreadable patches manifest degrades to an empty map — the
+ * warning is advisory and must never block an apply.
+ */
+export declare function loadPatchClaimsForApply(root: string): Promise<ReadonlyMap<string, readonly string[]>>;
+/** Appends formatted overwrite warnings onto the run's result. */
+export declare function recordOverwriteWarnings(result: {
+    warnings?: string[];
+}, warnings: readonly PatchOwnedOverwriteWarning[]): void;
+/** Renders the operator-facing warning line for one overwrite. */
+export declare function formatPatchOwnedOverwriteWarning(warning: PatchOwnedOverwriteWarning): string;
+/** Inputs for {@link findPatchOwnedOverwrites}, discriminated by component type. */
+export type PatchOwnedOverwriteProbe = {
+    type: 'custom';
+    root: string;
+    name: string;
+    config: CustomComponentConfig;
+    ftlDir: string;
+    patchClaims: ReadonlyMap<string, readonly string[]>;
+} | {
+    type: 'override';
+    engineDir: string;
+    name: string;
+    componentDir: string;
+    config: OverrideComponentConfig;
+    ftlDir: string;
+    patchClaims: ReadonlyMap<string, readonly string[]>;
+};
+/**
+ * Finds deployed files this component's apply is about to overwrite whose
+ * engine bytes differ from the component source AND that are patch-owned.
+ * Probe failures degrade to a verbose line and an empty list — the apply
+ * itself must not fail because the warning probe could not run.
+ */
+export declare function findPatchOwnedOverwrites(args: PatchOwnedOverwriteProbe): Promise<PatchOwnedOverwriteWarning[]>;

package/dist/src/core/furnace-apply-overwrite-warn.js

@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Patch-owned overwrite warnings for `furnace apply` (FORGE J6).
+ *
+ * For Furnace-managed components, apply OVERWRITES the deployed engine
+ * copies with the `components/` sources. A fix made directly in `engine/`
+ * and exported into a patch — but never back-ported to the component
+ * source — is silently undone by the next apply, and the only prior
+ * signal was a drift line that read like "someone's uncommitted work".
+ * This module detects that exact case BEFORE the copy: the deployed
+ * bytes differ from the component source AND the file is patch-owned,
+ * and produces a loud per-file warning naming the file, the owning
+ * patch, and the consequence.
+ *
+ * The per-file byte comparison already exists —
+ * `checkRegistrationConsistency` for custom components (fragment- and
+ * ftl-aware) and the copy-candidate walk for overrides — this module
+ * only surfaces what was previously computed and thrown away.
+ */
+import { readdir } from 'node:fs/promises';
+import { join, relative } from 'node:path';
+import { toError } from '../utils/errors.js';
+import { pathExists, readText } from '../utils/fs.js';
+import { verbose } from '../utils/logger.js';
+import { getProjectPaths } from './config.js';
+import { getOverrideEngineTargetPath, isOverrideCopyCandidate, isRegularFile, } from './furnace-apply-helpers.js';
+import { FTL_DIR } from './furnace-constants.js';
+import { checkRegistrationConsistency } from './furnace-validate-registration.js';
+import { loadPatchesManifest } from './patch-manifest.js';
+import { buildPatchClaims } from './status-classify.js';
+/**
+ * Loads the file → owning-patch map for the overwrite warning (FORGE J6).
+ * A missing or unreadable patches manifest degrades to an empty map — the
+ * warning is advisory and must never block an apply.
+ */
+export async function loadPatchClaimsForApply(root) {
+    try {
+        const manifest = await loadPatchesManifest(getProjectPaths(root).patches);
+        return manifest ? buildPatchClaims(manifest.patches) : new Map();
+    }
+    catch {
+        return new Map();
+    }
+}
+/** Appends formatted overwrite warnings onto the run's result. */
+export function recordOverwriteWarnings(result, warnings) {
+    if (warnings.length === 0)
+        return;
+    result.warnings ??= [];
+    result.warnings.push(...warnings.map(formatPatchOwnedOverwriteWarning));
+}
+/** Renders the operator-facing warning line for one overwrite. */
+export function formatPatchOwnedOverwriteWarning(warning) {
+    const owners = warning.owners.join(', ');
+    return (`${warning.component}: overwriting deployed ${warning.file} — its engine content differs ` +
+        `from the components/ source, and the path is owned by patch ${owners}. If the engine ` +
+        `edit was an intentional shipped fix, port it into the component source and re-export ` +
+        `the patch — the deployed copy is being replaced now.`);
+}
+/** Custom components: reuse the validate oracle's drifted-file list. */
+async function findCustomOverwrites(args) {
+    const { root, name, config, ftlDir, patchClaims } = args;
+    const status = await checkRegistrationConsistency(root, name, config, ftlDir);
+    const warnings = [];
+    for (const entryName of status.driftedFiles) {
+        const engineRel = entryName.endsWith('.ftl')
+            ? `${ftlDir || FTL_DIR}/${entryName}`
+            : `${config.targetPath}/${entryName}`;
+        const owners = patchClaims.get(engineRel);
+        if (owners !== undefined && owners.length > 0) {
+            warnings.push({ component: name, file: engineRel, owners: [...owners] });
+        }
+    }
+    return warnings;
+}
+/** Override components: byte-compare each copy candidate against its engine target. */
+async function findOverrideOverwrites(args) {
+    const { engineDir, name, componentDir, config, ftlDir, patchClaims } = args;
+    const warnings = [];
+    const entries = await readdir(componentDir, { withFileTypes: true, encoding: 'utf8' });
+    for (const entry of entries) {
+        if (!isRegularFile(entry))
+            continue;
+        if (!isOverrideCopyCandidate(entry.name, config.type))
+            continue;
+        const enginePath = getOverrideEngineTargetPath(engineDir, config, entry.name, ftlDir);
+        // A missing target is a fresh deploy, not a lost engine edit.
+        if (!(await pathExists(enginePath)))
+            continue;
+        const engineRel = relative(engineDir, enginePath).replace(/\\/g, '/');
+        const owners = patchClaims.get(engineRel);
+        if (owners === undefined || owners.length === 0)
+            continue;
+        const [engineContent, sourceContent] = await Promise.all([
+            readText(enginePath),
+            readText(join(componentDir, entry.name)),
+        ]);
+        if (engineContent !== sourceContent) {
+            warnings.push({ component: name, file: engineRel, owners: [...owners] });
+        }
+    }
+    return warnings;
+}
+/**
+ * Finds deployed files this component's apply is about to overwrite whose
+ * engine bytes differ from the component source AND that are patch-owned.
+ * Probe failures degrade to a verbose line and an empty list — the apply
+ * itself must not fail because the warning probe could not run.
+ */
+export async function findPatchOwnedOverwrites(args) {
+    if (args.patchClaims.size === 0)
+        return [];
+    try {
+        if (args.type === 'custom') {
+            return await findCustomOverwrites(args);
+        }
+        return await findOverrideOverwrites(args);
+    }
+    catch (error) {
+        verbose(`Skipping patch-owned overwrite probe for ${args.name}: ${toError(error).message}`);
+        return [];
+    }
+}

package/dist/src/core/furnace-apply-undeploy-actions.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Dry-run action builders for files deleted from a component workspace
+ * since the last apply. Split out of `furnace-apply.ts` (at the per-file
+ * line budget after the FORGE J6 overwrite-warning wiring); the real
+ * undeploy paths stay in `furnace-apply-helpers.ts`.
+ */
+import type { CustomComponentConfig, DryRunAction, OverrideComponentConfig } from '../types/furnace.js';
+/** Plans the engine-restore actions for deleted override workspace files. */
+export declare function buildOverrideUndeployActions(name: string, config: OverrideComponentConfig, engineDir: string, deletedFiles: string[], ftlDir: string): DryRunAction[];
+/** Plans the engine-removal + deregistration actions for deleted custom workspace files. */
+export declare function buildCustomUndeployActions(name: string, config: CustomComponentConfig, engineDir: string, deletedFiles: string[], ftlDir: string): DryRunAction[];

package/dist/src/core/furnace-apply-undeploy-actions.js

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Dry-run action builders for files deleted from a component workspace
+ * since the last apply. Split out of `furnace-apply.ts` (at the per-file
+ * line budget after the FORGE J6 overwrite-warning wiring); the real
+ * undeploy paths stay in `furnace-apply-helpers.ts`.
+ */
+import { join } from 'node:path';
+import { getOverrideEngineTargetPath } from './furnace-apply-helpers.js';
+/** Plans the engine-restore actions for deleted override workspace files. */
+export function buildOverrideUndeployActions(name, config, engineDir, deletedFiles, ftlDir) {
+    return deletedFiles.map((fileName) => ({
+        component: name,
+        action: 'undeploy-restore',
+        target: getOverrideEngineTargetPath(engineDir, config, fileName, ftlDir),
+        description: `Restore engine/${fileName.endsWith('.ftl') ? `${ftlDir}/${fileName}` : `${config.basePath}/${fileName}`} to Firefox baseline`,
+    }));
+}
+/** Plans the engine-removal + deregistration actions for deleted custom workspace files. */
+export function buildCustomUndeployActions(name, config, engineDir, deletedFiles, ftlDir) {
+    const actions = [];
+    for (const fileName of deletedFiles) {
+        const enginePath = fileName.endsWith('.ftl')
+            ? join(engineDir, ftlDir, fileName)
+            : join(engineDir, config.targetPath, fileName);
+        actions.push({
+            component: name,
+            action: 'undeploy-remove',
+            target: enginePath,
+            description: `Remove orphaned ${fileName} from engine`,
+        });
+    }
+    // jar.mn re-sync planned for any custom-file deletion when registered.
+    if (config.register && deletedFiles.some((f) => f.endsWith('.mjs') || f.endsWith('.css'))) {
+        actions.push({
+            component: name,
+            action: 'unregister-jar',
+            description: `Re-sync ${name} jar.mn entries to drop deleted files`,
+        });
+    }
+    if (config.register && deletedFiles.some((f) => f === `${name}.mjs`)) {
+        actions.push({
+            component: name,
+            action: 'unregister-ce',
+            description: `Deregister ${name} from customElements.js (.mjs deleted)`,
+        });
+    }
+    return actions;
+}

package/dist/src/core/furnace-apply.d.ts

@@ -2,6 +2,21 @@ import type { ApplyResult, DryRunAction } from '../types/furnace.js';
 import { type FurnaceOperationContext } from './furnace-operation.js';
 import { type RollbackJournal } from './furnace-rollback.js';
 export { computeComponentChecksums, extractComponentChecksums, hasComponentChanged, hasCustomEngineDrift, hasOverrideEngineDrift, prefixChecksums, } from './furnace-apply-helpers.js';
+/**
+ * Result of {@link applyAllComponents}.
+ *
+ * Named because the anonymous intersection this replaced forced eight
+ * `Awaited<ReturnType<typeof applyAllComponents>>` indirections across
+ * `furnace/deploy.ts`, `furnace/preview.ts`, `furnace-state-persist.ts` and
+ * `build-prepare.ts` — none of which could be read without opening this file.
+ *
+ * `actions` is populated only on a dry run; `rollbackJournal` only when
+ * `persistState: false` hands journal ownership back to the caller.
+ */
+export type ApplyAllComponentsResult = ApplyResult & {
+    actions?: DryRunAction[];
+    rollbackJournal?: RollbackJournal;
+};
 /**
  * Applies all override and custom components to the engine source tree.
  *
@@ -28,10 +43,7 @@ export declare function applyAllComponents(root: string, dryRun?: boolean, optio
     persistState?: boolean;
     operationContext?: FurnaceOperationContext;
     componentName?: string;
-}): Promise<ApplyResult & {
-    actions?: DryRunAction[];
-    rollbackJournal?: RollbackJournal;
-}>; /**
+}): Promise<ApplyAllComponentsResult>; /**
  * Shared context threaded through the batch apply loops. Bundles the state
  * both loops mutate (result/actions/checksums) with the immutable run
  * parameters — the previous 12–13 positional parameters let call sites

package/dist/src/core/furnace-apply.js

@@ -5,7 +5,9 @@ import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
 import { info } from '../utils/logger.js';
 import { getProjectPaths, loadConfig } from './config.js';
-import { applyCustomComponent, applyOverrideComponent, computeComponentChecksums, diffDeletedFiles, extractComponentChecksums, getOverrideEngineTargetPath, hasComponentChanged, hasCustomEngineDrift, hasOverrideEngineDrift, prefixChecksums, undeployCustomFiles, undeployOverrideFiles, } from './furnace-apply-helpers.js';
+import { applyCustomComponent, applyOverrideComponent, computeComponentChecksums, diffDeletedFiles, extractComponentChecksums, hasComponentChanged, hasCustomEngineDrift, hasOverrideEngineDrift, prefixChecksums, undeployCustomFiles, undeployOverrideFiles, } from './furnace-apply-helpers.js';
+import { findPatchOwnedOverwrites, loadPatchClaimsForApply, recordOverwriteWarnings, } from './furnace-apply-overwrite-warn.js';
+import { buildCustomUndeployActions, buildOverrideUndeployActions, } from './furnace-apply-undeploy-actions.js';
 import { getFurnacePaths, loadFurnaceConfig, loadFurnaceState, updateFurnaceState, } from './furnace-config.js';
 import { CUSTOM_ELEMENTS_JS, JAR_MN, resolveFtlDir } from './furnace-constants.js';
 import { topologicalSortCustom } from './furnace-graph-utils.js';
@@ -22,14 +24,6 @@ function addMissingComponentError(result, name, directoryPath) {
         error: `Component directory not found: ${directoryPath}`,
     });
 }
-function buildOverrideUndeployActions(name, config, engineDir, deletedFiles, ftlDir) {
-    return deletedFiles.map((fileName) => ({
-        component: name,
-        action: 'undeploy-restore',
-        target: getOverrideEngineTargetPath(engineDir, config, fileName, ftlDir),
-        description: `Restore engine/${fileName.endsWith('.ftl') ? `${ftlDir}/${fileName}` : `${config.basePath}/${fileName}`} to Firefox baseline`,
-    }));
-}
 async function applyOverrideBatch(ctx) {
     const { config, furnacePaths, state, engineDir, ftlDir, dryRun } = ctx;
     const { result, allActions, newChecksums, rollbackJournal, componentName } = ctx;
@@ -47,8 +41,9 @@ async function applyOverrideBatch(ctx) {
             continue;
         }
         const previous = extractComponentChecksums(state.appliedChecksums, 'override', name);
+        const currentChecksums = await computeComponentChecksums(componentDir);
         if (!dryRun) {
-            const changed = await hasComponentChanged(componentDir, previous);
+            const changed = await hasComponentChanged(componentDir, previous, currentChecksums);
             if (!changed) {
                 // Fast path holds only if the engine still reflects what we deployed.
                 // reset/download/manual edits can silently erase engine files; the
@@ -67,7 +62,6 @@ async function applyOverrideBatch(ctx) {
             // Compute which files (if any) were removed from the workspace since
             // the last apply. We do this for both dry-run and real runs so the
             // planned-actions output stays honest.
-            const currentChecksums = await computeComponentChecksums(componentDir);
             const deletedFiles = diffDeletedFiles(previous, currentChecksums);
             if (dryRun) {
                 if (deletedFiles.length > 0) {
@@ -78,6 +72,20 @@ async function applyOverrideBatch(ctx) {
                 const { restored, removed } = await undeployOverrideFiles(engineDir, overrideConfig, deletedFiles, ftlDir, rollbackJournal);
                 filesAffectedTotal.push(...restored, ...removed);
             }
+            if (!dryRun) {
+                // Runs unconditionally — including when the component source
+                // changed — because the lost-work case is precisely a deployed
+                // engine edit that the incoming copy is about to replace (J6).
+                recordOverwriteWarnings(result, await findPatchOwnedOverwrites({
+                    type: 'override',
+                    engineDir,
+                    name,
+                    componentDir,
+                    config: overrideConfig,
+                    ftlDir,
+                    patchClaims: ctx.patchClaims,
+                }));
+            }
             const { affectedPaths: filesAffected, actions } = await applyOverrideComponent(engineDir, name, componentDir, overrideConfig, ftlDir, dryRun, rollbackJournal);
             if (dryRun && actions) {
                 allActions.push(...actions);
@@ -96,36 +104,6 @@ async function applyOverrideBatch(ctx) {
         }
     }
 }
-function buildCustomUndeployActions(name, config, engineDir, deletedFiles, ftlDir) {
-    const actions = [];
-    for (const fileName of deletedFiles) {
-        const enginePath = fileName.endsWith('.ftl')
-            ? join(engineDir, ftlDir, fileName)
-            : join(engineDir, config.targetPath, fileName);
-        actions.push({
-            component: name,
-            action: 'undeploy-remove',
-            target: enginePath,
-            description: `Remove orphaned ${fileName} from engine`,
-        });
-    }
-    // jar.mn re-sync planned for any custom-file deletion when registered.
-    if (config.register && deletedFiles.some((f) => f.endsWith('.mjs') || f.endsWith('.css'))) {
-        actions.push({
-            component: name,
-            action: 'unregister-jar',
-            description: `Re-sync ${name} jar.mn entries to drop deleted files`,
-        });
-    }
-    if (config.register && deletedFiles.some((f) => f === `${name}.mjs`)) {
-        actions.push({
-            component: name,
-            action: 'unregister-ce',
-            description: `Deregister ${name} from customElements.js (.mjs deleted)`,
-        });
-    }
-    return actions;
-}
 /**
  * After undeploying deleted files, the in-engine jar.mn and
  * customElements.js still carry entries for the removed files. Re-sync them
@@ -222,8 +200,9 @@ async function applyCustomBatch(ctx, root, markerComment) {
             continue;
         }
         const previous = extractComponentChecksums(state.appliedChecksums, 'custom', name);
+        const currentChecksums = await computeComponentChecksums(componentDir);
         if (!dryRun) {
-            const changed = await hasComponentChanged(componentDir, previous);
+            const changed = await hasComponentChanged(componentDir, previous, currentChecksums);
             if (!changed) {
                 // As with overrides, the checksum record is not sufficient on its
                 // own: a reset/download that cleared the engine must trigger a
@@ -241,7 +220,6 @@ async function applyCustomBatch(ctx, root, markerComment) {
             // Diff against previous to find files the developer has deleted from
             // the workspace since last apply. Run for both dry-run and real apply
             // so plan output and execution stay aligned.
-            const currentChecksums = await computeComponentChecksums(componentDir);
             const deletedFiles = diffDeletedFiles(previous, currentChecksums);
             if (dryRun) {
                 if (deletedFiles.length > 0) {
@@ -252,6 +230,19 @@ async function applyCustomBatch(ctx, root, markerComment) {
                 const removed = await undeployCustomFiles(engineDir, customConfig, deletedFiles, ftlDir, rollbackJournal);
                 filesAffectedTotal.push(...removed);
             }
+            if (!dryRun) {
+                // Runs unconditionally — the `changed === true` path used to skip
+                // drift detection entirely, which is exactly when a deployed
+                // engine-only fix gets silently replaced (J6).
+                recordOverwriteWarnings(result, await findPatchOwnedOverwrites({
+                    type: 'custom',
+                    root,
+                    name,
+                    config: customConfig,
+                    ftlDir,
+                    patchClaims: ctx.patchClaims,
+                }));
+            }
             const { affectedPaths: filesAffected, stepErrors, actions, } = await applyCustomComponent(engineDir, name, componentDir, customConfig, ftlDir, dryRun, rollbackJournal, markerComment !== undefined ? { markerComment } : {});
             if (dryRun && actions) {
                 allActions.push(...actions);
@@ -345,6 +336,10 @@ export async function applyAllComponents(root, dryRun = false, options) {
             throw new FurnaceError(`Component "${componentName}" not found in furnace.json. Run "fireforge furnace list" to see registered components.`, componentName);
         }
     }
+    // Patch-claim map for the overwrite warning (FORGE J6): loaded once per
+    // apply. A missing/unreadable manifest degrades to an empty map — the
+    // warning is advisory and must never block the apply.
+    const patchClaims = await loadPatchClaimsForApply(root);
     const batchContext = {
         config,
         furnacePaths,
@@ -357,6 +352,7 @@ export async function applyAllComponents(root, dryRun = false, options) {
         newChecksums,
         rollbackJournal,
         componentName,
+        patchClaims,
     };
     await applyOverrideBatch(batchContext);
     await applyCustomBatch(batchContext, root, markerComment);

package/dist/src/core/furnace-config.js

@@ -360,6 +360,8 @@ export async function writeFurnaceConfig(root, config) {
                 existing = raw;
         }
         catch {
+            // A missing or corrupt furnace.json means there is no prior document to
+            // preserve key order from; the writer falls back to canonical ordering.
             existing = undefined;
         }
     }

package/dist/src/core/furnace-css-fragments.js

@@ -194,6 +194,8 @@ export async function validateCssFragments(componentDir, tagName, sharedDir, eng
         entries = await readdir(componentDir);
     }
     catch {
+        // An unreadable component directory contributes no fragment issues; return
+        // what has been collected so far rather than failing validation.
         return issues;
     }
     for (const fileName of entries) {

package/dist/src/core/furnace-jsconfig.js

@@ -24,6 +24,7 @@ import { readdir } from 'node:fs/promises';
 import { dirname, join, relative, resolve } from 'node:path';
 import { applyEdits, modify, parse } from 'jsonc-parser';
 import { FurnaceError } from '../errors/furnace.js';
+import { toError } from '../utils/errors.js';
 import { pathExists, readText, writeTextIfChanged } from '../utils/fs.js';
 import { info } from '../utils/logger.js';
 import { normalizePathSlashes } from '../utils/paths.js';
@@ -32,8 +33,14 @@ import { getFurnacePaths } from './furnace-config.js';
 const CHROME_ELEMENTS_URL_PREFIX = 'chrome://global/content/elements/';
 /**
  * Computes the desired managed `paths` entries: one per `.mjs` file of
- * every registered custom component, keyed by its deployed chrome URL and
- * mapped to the workspace source relative to the jsconfig directory.
+ * every custom component — registered or not — keyed by its deployed
+ * chrome URL and mapped to the workspace source relative to the jsconfig
+ * directory. `register: false` components (notably `kind: "library"`
+ * base-class modules, which REQUIRE register: false) are included because
+ * deploy copies their files and writes jar.mn entries under
+ * `content/global/elements/` unconditionally — only the customElements.js
+ * registration is gated on `register` — so their chrome URLs are just as
+ * real as a registered component's.
  *
  * Workspace sources (not deployed engine copies) are the mapping target —
  * they are the files developers edit, and they exist even when the engine
@@ -42,9 +49,7 @@ const CHROME_ELEMENTS_URL_PREFIX = 'chrome://global/content/elements/';
 async function computeDesiredChromePathEntries(config, customDir, jsconfigAbsPath) {
     const jsconfigDir = dirname(jsconfigAbsPath);
     const entries = {};
-    for (const [name, customConfig] of Object.entries(config.custom)) {
-        if (!customConfig.register)
-            continue;
+    for (const name of Object.keys(config.custom)) {
         const componentDir = join(customDir, name);
         if (!(await pathExists(componentDir)))
             continue;
@@ -113,13 +118,15 @@ export async function syncFurnaceJsconfigPaths(root, config, options) {
     const parseErrors = [];
     let jsconfig;
     try {
+        // No cast: the target is declared `unknown` and is validated below, so
+        // an assertion here would be discarded on assignment anyway.
         jsconfig = parse(jsconfigText, parseErrors, {
             allowTrailingComma: true,
             disallowComments: false,
         });
     }
     catch (error) {
-        throw new FurnaceError(`Could not parse ${jsconfigRel} as JSONC: ${error instanceof Error ? error.message : String(error)}.`);
+        throw new FurnaceError(`Could not parse ${jsconfigRel} as JSONC: ${toError(error).message}.`);
     }
     if (parseErrors.length > 0 ||
         typeof jsconfig !== 'object' ||
@@ -151,7 +158,7 @@ export async function syncFurnaceJsconfigPaths(root, config, options) {
         // a hand-written `./` prefix) is not rewritten as "stale" on every run.
         // The existing value is kept verbatim when equivalent — no churn either
         // way; only a genuinely different target updates (to the `./` form).
-        if (!samePathValue(value[0] ?? '', want[0] ?? '')) {
+        if (!samePathValue(value[0], want[0] ?? '')) {
             result.updated.push(key);
             nextPaths[key] = want;
         }