@hominis/fireforge 0.40.0 → 0.42.0

package/dist/src/commands/re-export.js

@@ -1,230 +1,20 @@
 // SPDX-License-Identifier: EUPL-1.2
-/* eslint-disable max-lines -- Re-export is at the guardrail; splitting register plumbing is unrelated to this fix. */
 import { multiselect } from '@clack/prompts';
-import { Command, Option } from 'commander';
 import { getProjectPaths, loadConfig } from '../core/config.js';
-import { withEngineSessionLock } from '../core/engine-session-lock.js';
 import { collectFurnaceManagedPrefixes } from '../core/furnace-config.js';
-import { enforceFreshFurnaceSources } from '../core/furnace-stale-export.js';
 import { isGitRepository } from '../core/git.js';
-import { getDiffForFilesAgainstHead } from '../core/git-diff.js';
-import { updatePatchAndMetadata } from '../core/patch-export.js';
-import { buildPatchQueueContext } from '../core/patch-lint.js';
 import { loadPatchesManifest, resolvePatchIdentifier, stampPatchVersions, } from '../core/patch-manifest.js';
-import { buildProjectedManifest, enforcePatchPolicy } from '../core/patch-policy.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
-import { isGitIndexLockConflict } from '../errors/git.js';
 import { elapsedSince } from '../utils/elapsed.js';
 import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
 import { cancel, info, intro, isCancel, outro, spinner, success, warn } from '../utils/logger.js';
-import { addWaitLockOption, pickDefined, resolveWaitLockSeconds } from '../utils/options.js';
-import { runPatchLint } from './export-shared.js';
-import { findMissingFiles, reportAdjacentUnmanagedFiles } from './re-export-adjacent.js';
-import { loadScanFilesAssignments, withDryRunReExportLock } from './re-export-bulk-scan.js';
+import { loadScanFilesAssignments, withDryRunPurityGuard, withDryRunReExportLock, } from './re-export-bulk-scan.js';
 import { reExportFilesInPlace } from './re-export-files.js';
+import { buildReExportLintContext, finishReExportLint } from './re-export-lint.js';
 import { applyReExportFilesPositionalFolding, validateReExportOptionCombinations, } from './re-export-options.js';
-import { assertScanAdoptionsHaveNoForwardImports, assertScanFileAdditionsHaveDiffHunks, confirmBroadScanAdditions, normalizeScanFiles, scanPatchFilesForReExport, } from './re-export-scan.js';
-const GIT_INDEX_LOCK_RETRY_MS = 300;
-/**
- * Retries a single patch re-export exactly once when the failure is
- * transient git `index.lock` contention (an external git process holding
- * the engine repo's index). The retry re-enters `reExportSinglePatch`
- * from the top, so it re-reads clean state; a second lock failure
- * propagates to the loop's honest "N of M" accounting.
- */
-async function reExportSinglePatchWithIndexLockRetry(patch, paths, manifest, options, isDryRun, config, adjacentCtx) {
-    try {
-        return await reExportSinglePatch(patch, paths, manifest, options, isDryRun, config, adjacentCtx);
-    }
-    catch (error) {
-        if (!isGitIndexLockConflict(error)) {
-            throw error;
-        }
-        warn(`${patch.filename}: git index.lock contention detected — retrying once after ${String(GIT_INDEX_LOCK_RETRY_MS)} ms...`);
-        await new Promise((resolve) => setTimeout(resolve, GIT_INDEX_LOCK_RETRY_MS));
-        return await reExportSinglePatch(patch, paths, manifest, options, isDryRun, config, adjacentCtx);
-    }
-}
-async function reExportSinglePatch(patch, paths, manifest, options, isDryRun, config, adjacentCtx) {
-    let currentFilesAffected = [...patch.filesAffected];
-    // --- Scan for new/removed files ---
-    if (options.scan) {
-        const scanResult = await scanPatchFilesForReExport({
-            currentFilesAffected,
-            engineDir: paths.engine,
-            manifest,
-            patchFilename: patch.filename,
-            isDryRun,
-            ...(options.scanFiles !== undefined ? { scanFiles: options.scanFiles } : {}),
-        });
-        // Forward-import gate at adoption time (runs in dry-run too): refuse
-        // to adopt unmanaged files that import modules created by LATER
-        // patches — the after-the-fact lint failure this leaves behind is the
-        // field-reported footgun. Applies to broad --scan, --scan-file, and
-        // the --scan-files bulk assignments alike.
-        await assertScanAdoptionsHaveNoForwardImports({
-            patchesDir: paths.patches,
-            engineDir: paths.engine,
-            patchFilename: patch.filename,
-            added: scanResult.added,
-        });
-        if (options.scanFiles === undefined) {
-            const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
-            const proceed = await confirmBroadScanAdditions({
-                patchFilename: patch.filename,
-                added: scanResult.added,
-                isDryRun,
-                yes: options.yes === true,
-                isInteractive,
-            });
-            if (!proceed) {
-                return false;
-            }
-        }
-        currentFilesAffected = scanResult.updated;
-    }
-    else if (options.files === undefined) {
-        // Finding #16: when neither `--scan` nor `--files` is set and some
-        // of the manifest's claimed files no longer exist on disk, the
-        // re-export silently writes a refreshed body whose filesAffected
-        // still names the vanished paths. That is the documented contract,
-        // but it is also a footgun — a later `verify` then fails on
-        // manifest-consistency with no obvious trigger. Emit one advisory
-        // warning up-front when we can detect the drift cheaply, so the
-        // operator has a chance to re-run with `--scan` or `--files`
-        // before the stale filesAffected lands in patches.json.
-        const args = { patch, paths, manifest, currentFilesAffected, ctx: adjacentCtx };
-        if (await reportAdjacentUnmanagedFiles(args))
-            return false;
-    }
-    // --- Explicit file-subset path ---
-    // When --files is given, the target filesAffected is authoritative — drop
-    // anything not in the list, add anything new. This is the surgical repair
-    // primitive that replaces hand-editing patches.json; the user has already
-    // acknowledged via confirmDestructive (done in the caller) that any drop
-    // is intentional.
-    if (options.files !== undefined) {
-        const requested = [...new Set(options.files)].sort();
-        currentFilesAffected = requested;
-        const removed = patch.filesAffected.filter((f) => !requested.includes(f));
-        const added = requested.filter((f) => !patch.filesAffected.includes(f));
-        for (const f of added)
-            info(`  + ${f}`);
-        for (const f of removed)
-            info(`  - ${f}`);
-    }
-    // Stale-furnace-source gate (0.37.0 item 4): re-export captures deployed
-    // engine copies, so a component source edited after the last furnace
-    // apply would land in the patch as its OLD deployed content. Refuse (or
-    // warn under --allow-stale-furnace) before diffing. Runs in dry-run too
-    // so the failure surfaces early.
-    await enforceFreshFurnaceSources(paths.root, currentFilesAffected, options.allowStaleFurnace === true, 're-export');
-    const missingFiles = await findMissingFiles(paths.engine, currentFilesAffected);
-    if (missingFiles.length === currentFilesAffected.length) {
-        warn(`Skipped ${patch.filename}: all affected files missing`);
-        warn(`Missing files: ${missingFiles.join(', ')}`);
-        return false;
-    }
-    if (missingFiles.length > 0) {
-        warn(`${patch.filename}: missing files will be skipped: ${missingFiles.join(', ')}`);
-    }
-    const missingSet = new Set(missingFiles);
-    const existingFiles = currentFilesAffected.filter((f) => !missingSet.has(f));
-    const diffContent = await getDiffForFilesAgainstHead(paths.engine, existingFiles);
-    assertScanFileAdditionsHaveDiffHunks({
-        diffContent,
-        patchFilename: patch.filename,
-        previousFilesAffected: patch.filesAffected,
-        scanFiles: options.scanFiles,
-    });
-    if (!diffContent.trim()) {
-        warn(`Skipped ${patch.filename}: no changes (files unchanged from HEAD)`);
-        return false;
-    }
-    // Thread the patch's own `lintIgnore` list through so the per-patch
-    // suppression honoured by export/export-all is also honoured here.
-    // Without this, `re-export` could not refresh an advisory-noisy but
-    // intentional patch (a cohesive branding bundle, a localised-resource
-    // pack) without either `--skip-lint` (too blunt) or falling through to
-    // the full `rebase` flow (which internally skips the lint pipeline).
-    // The paired `patch.tier` threads the explicit branding-threshold
-    // opt-in the same way, for the branding patch that also touches a
-    // non-allowlisted registration sibling.
-    //
-    // The CLI flags `--tier` and `--lint-ignore` participate too, with
-    // append/union semantics on the lint-ignore list (the operator's
-    // intuition for "I want this patch to also suppress X" — explicit
-    // removal lives on the `fireforge patch lint-ignore` subcommand).
-    // Computed before the lint pass so the new intent takes effect on
-    // this invocation, not the next one.
-    const existingIgnoreSet = new Set(patch.lintIgnore ?? []);
-    const flagIgnoreSet = new Set(options.lintIgnore ?? []);
-    const mergedIgnoreSet = new Set([...existingIgnoreSet, ...flagIgnoreSet]);
-    const effectiveLintIgnore = mergedIgnoreSet.size > 0 ? [...mergedIgnoreSet] : undefined;
-    const ignoreChecks = effectiveLintIgnore ? new Set(effectiveLintIgnore) : undefined;
-    const effectiveTier = options.tier ?? patch.tier;
-    const updates = {
-        filesAffected: currentFilesAffected,
-    };
-    if (options.tier !== undefined) {
-        updates.tier = options.tier;
-    }
-    if (effectiveLintIgnore !== undefined && flagIgnoreSet.size > 0) {
-        updates.lintIgnore = effectiveLintIgnore;
-    }
-    enforcePatchPolicy({
-        config,
-        manifest: buildProjectedManifest(manifest, manifest.patches.map((entry) => entry.filename === patch.filename ? { ...entry, ...updates } : entry)),
-        command: 're-export',
-        forceUnsafe: options.forceUnsafe === true,
-    });
-    // Pass the whole-queue context so checkJs resolves cross-patch
-    // `resource:///` imports against the real owning sources (report scope
-    // stays this patch — see runPatchLint).
-    const patchQueueCtx = (await pathExists(paths.patches))
-        ? await buildPatchQueueContext(paths.patches)
-        : undefined;
-    await runPatchLint(paths.engine, existingFiles, diffContent, config, options.skipLint, patchQueueCtx, ignoreChecks, effectiveTier);
-    if (isDryRun) {
-        info(`[dry-run] ${patch.filename}: ${existingFiles.length} file(s)`);
-        if (effectiveTier !== undefined && effectiveTier !== patch.tier) {
-            info(`[dry-run] ${patch.filename}: tier would become ${effectiveTier}`);
-        }
-        const addedIgnores = [...flagIgnoreSet].filter((id) => !existingIgnoreSet.has(id));
-        if (addedIgnores.length > 0) {
-            info(`[dry-run] ${patch.filename}: lintIgnore would gain ${addedIgnores.join(', ')}`);
-        }
-    }
-    else {
-        // Atomic body + manifest update under a single patch-directory lock.
-        // A split `updatePatch` (lock-free) + `updatePatchMetadata` (lock-guarded)
-        // sequence allows a concurrent `resolve` / `rebase --continue` / `patch
-        // compact` / `patch reorder` to rewrite the manifest between the two
-        // writes and leave patch body and `filesAffected` disagreeing.
-        await updatePatchAndMetadata(paths.patches, patch.filename, diffContent, updates, undefined, {
-            config,
-            command: 're-export',
-            forceUnsafe: options.forceUnsafe === true,
-        });
-        // Keep the in-memory manifest in sync so subsequent iterations (notably
-        // `--all --scan`, where `getClaimedFiles` reads from this manifest) see
-        // the just-written `filesAffected`. The on-disk write above is the
-        // authority; this is a cache update.
-        const patchIndex = manifest.patches.findIndex((pm) => pm.filename === patch.filename);
-        if (patchIndex !== -1) {
-            const existingEntry = manifest.patches[patchIndex];
-            if (existingEntry) {
-                manifest.patches[patchIndex] = {
-                    ...existingEntry,
-                    ...updates,
-                };
-            }
-        }
-        success(`Re-exported ${patch.filename}`);
-    }
-    return true;
-}
+import { normalizeEngineRelativeInput, normalizeScanFiles } from './re-export-scan.js';
+import { reExportSinglePatchWithIndexLockRetry } from './re-export-single.js';
 async function resolveSelectedPatches(patches, options, manifest) {
     if (options.all) {
         return [...manifest.patches];
@@ -328,7 +118,7 @@ export async function reExportCommand(projectRoot, patches, options) {
     // we write anything.
     if (options.files !== undefined) {
         const filesConfig = await loadConfig(projectRoot);
-        await withDryRunReExportLock(paths.fireforgeDir, isDryRun, () => reExportFilesInPlace(paths, selectedPatches, options, filesConfig));
+        await withDryRunReExportLock(paths.fireforgeDir, isDryRun, () => withDryRunPurityGuard(paths.engine, paths.patches, isDryRun, () => reExportFilesInPlace(paths, selectedPatches, options, filesConfig)));
         return;
     }
     const config = await loadConfig(projectRoot);
@@ -340,35 +130,37 @@ export async function reExportCommand(projectRoot, patches, options) {
         refuseAdjacentUnmanaged: options.refuseAdjacentUnmanaged === true,
         refusals: [],
     };
+    const driftCtx = buildForeignDriftContext(options);
+    // Hoisted lint context, one per run (FORGE J1): queue context + checkJs
+    // program + per-patch result cache, shared across every loop iteration.
+    const lintCtx = await buildReExportLintContext(projectRoot, paths, config, options.noCache === true);
     let reExported = 0;
     const reExportedFilenames = [];
+    const failedFilenames = [];
     const progress = spinner('Preparing re-export...');
     const startedAt = Date.now();
-    await withDryRunReExportLock(paths.fireforgeDir, isDryRun, async () => {
+    await withDryRunReExportLock(paths.fireforgeDir, isDryRun, async () => withDryRunPurityGuard(paths.engine, paths.patches, isDryRun, async () => {
         for (const [index, patch] of selectedPatches.entries()) {
             const assignedScanFiles = scanFilesByPatch?.get(patch.filename);
             const patchOptions = assignedScanFiles !== undefined ? { ...options, scanFiles: assignedScanFiles } : options;
             progress.message(`Re-exporting ${index + 1}/${selectedPatches.length}: ${patch.filename} (${patch.filesAffected.length} file(s), ${elapsedSince(startedAt)} elapsed)...`);
             try {
-                const exported = await reExportSinglePatchWithIndexLockRetry(patch, paths, manifest, patchOptions, isDryRun, config, adjacentCtx);
+                const exported = await reExportSinglePatchWithIndexLockRetry(patch, paths, manifest, patchOptions, isDryRun, config, adjacentCtx, driftCtx, lintCtx);
                 if (exported) {
                     reExported++;
                     reExportedFilenames.push(patch.filename);
                 }
             }
             catch (error) {
+                failedFilenames.push(patch.filename);
                 warn(`Failed to re-export ${patch.filename}`);
                 warn(toError(error).message);
             }
         }
-    });
-    if (adjacentCtx.refusals.length > 0) {
-        progress.error('Re-export refused');
-        const names = adjacentCtx.refusals.map((r) => r.patchFilename).join(', ');
-        throw new GeneralError(`Refused ${String(adjacentCtx.refusals.length)} patch(es) with adjacent unmanaged files ` +
-            `(--refuse-adjacent-unmanaged): ${names}. Adopt reviewed files with --scan --scan-file, ` +
-            `or export them as a new patch.`);
-    }
+    }));
+    await finishReExportLint(lintCtx);
+    warnUnseenExpectedDrift(driftCtx);
+    throwRunLevelRefusals(adjacentCtx, driftCtx, progress);
     if (reExported === 0 && selectedPatches.length > 0) {
         progress.error('Re-export failed');
         throw new GeneralError('All selected patches failed to re-export. Check the errors above.');
@@ -384,60 +176,113 @@ export async function reExportCommand(projectRoot, patches, options) {
     if (shouldStamp) {
         await stampPatchVersions(paths.patches, reExportedFilenames, config.firefox.version, config.firefox.product);
     }
+    reportReExportOutcome({
+        isDryRun,
+        reExported,
+        selectedCount: selectedPatches.length,
+        reExportedFilenames,
+        failedFilenames,
+        shouldStamp,
+        stampRequested: options.stamp === true,
+        config,
+        progress,
+    });
+}
+/**
+ * Foreign-drift guard context, one per run (FORGE J2). `--expect` paths
+ * (FORGE L6) are normalized once here so the per-patch comparison matches
+ * them against engine-relative diff-section paths.
+ */
+function buildForeignDriftContext(options) {
+    return {
+        refuseForeignDrift: options.refuseForeignDrift === true,
+        expectedDriftFiles: new Set((options.expect ?? []).map((file) => normalizeEngineRelativeInput(file, '--expect'))),
+        expectedSeen: new Set(),
+        evaluationRuns: 0,
+        refusals: [],
+    };
+}
+/**
+ * Names `--expect` paths that never drifted this run (FORGE L6). A typo'd
+ * `--expect` path silently degrades the flag back to refusing the slice it
+ * was meant to admit, so surface the mismatch — but only as a warning: an
+ * expected file legitimately shows no drift when the slice was already
+ * captured by an earlier export.
+ */
+function warnUnseenExpectedDrift(driftCtx) {
+    const unseen = [...driftCtx.expectedDriftFiles].filter((file) => !driftCtx.expectedSeen.has(file));
+    if (unseen.length === 0)
+        return;
+    if (driftCtx.evaluationRuns === 0) {
+        warn(`--expect path(s) were not evaluated because no selected patch reached the drift check (for example, an earlier refusal): ${unseen.join(', ')}`);
+        return;
+    }
+    warn(`--expect path(s) showed no drift this run (typo, or already captured?): ${unseen.join(', ')}`);
+}
+/**
+ * Turns the run's collected `--refuse-adjacent-unmanaged` (FORGE G2) and
+ * `--refuse-foreign-drift` (FORGE J2) refusals into the non-zero exit,
+ * naming every refused patch and the remedy.
+ */
+function throwRunLevelRefusals(adjacentCtx, driftCtx, progress) {
+    if (adjacentCtx.refusals.length > 0) {
+        progress.error('Re-export refused');
+        const names = adjacentCtx.refusals.map((r) => r.patchFilename).join(', ');
+        throw new GeneralError(`Refused ${String(adjacentCtx.refusals.length)} patch(es) with adjacent unmanaged files ` +
+            `(--refuse-adjacent-unmanaged): ${names}. Adopt reviewed files with --scan --scan-file, ` +
+            `or export them as a new patch.`);
+    }
+    if (driftCtx.refusals.length > 0) {
+        progress.error('Re-export refused');
+        const names = driftCtx.refusals.map((r) => r.patchFilename).join(', ');
+        const unreadable = driftCtx.refusals.filter((r) => r.reason === 'baseline-unreadable');
+        const unreadablePart = unreadable.length > 0
+            ? ` ${String(unreadable.length)} of these refused because the old patch body was missing or unreadable, so the drift comparison could not run (fail-closed).`
+            : '';
+        throw new GeneralError(`Refused ${String(driftCtx.refusals.length)} patch(es) whose refreshed body would absorb ` +
+            `engine edits not present in the old patch body (--refuse-foreign-drift): ${names}.${unreadablePart} ` +
+            `Commit or stash the foreign edits (another session may own them), name the slice's ` +
+            `intended files with --expect <path>, or re-run without the flag to capture them intentionally.`);
+    }
+}
+/**
+ * Prints the end-of-run summary and enforces the FORGE H8 exit contract:
+ * a partial run exits non-zero BY DEFAULT (adjudicated for 0.41.0, per the
+ * follow-up 0.40.0's G7 recorded). "Re-exported 2 of 3" used to print and
+ * exit 0, letting a partial refresh ride an `&&` chain as success. The
+ * summary still prints first so the honest "N of M" accounting stays
+ * visible; the throw then carries the failed/skipped breakdown. Dry-run
+ * included: a preview reporting that the real run would partially fail
+ * must not read as a passing preview in scripts.
+ */
+function reportReExportOutcome(args) {
+    const { isDryRun, reExported, selectedCount, config, progress } = args;
     if (isDryRun) {
         progress.stop('Dry run complete');
-        success(`[dry-run] Would re-export ${reExported} of ${selectedPatches.length} patch(es)`);
-        if (options.stamp === true) {
+        success(`[dry-run] Would re-export ${reExported} of ${selectedCount} patch(es)`);
+        if (args.stampRequested) {
             info(`[dry-run] Would stamp sourceVersion=${config.firefox.version} (${config.firefox.product}) on ${reExported} patch(es)`);
         }
         outro('Dry run complete');
     }
     else {
         progress.stop('Re-export complete');
-        success(`Re-exported ${reExported} of ${selectedPatches.length} patch(es)`);
-        if (shouldStamp) {
-            success(`Stamped sourceVersion=${config.firefox.version} (${config.firefox.product}) on ${reExportedFilenames.length} patch(es)`);
+        success(`Re-exported ${reExported} of ${selectedCount} patch(es)`);
+        if (args.shouldStamp) {
+            success(`Stamped sourceVersion=${config.firefox.version} (${config.firefox.product}) on ${args.reExportedFilenames.length} patch(es)`);
         }
-        else if (options.stamp === true && reExported !== selectedPatches.length) {
+        else if (args.stampRequested && reExported !== selectedCount) {
             warn('--stamp was requested but some patches failed or were skipped; refusing to stamp a partial set.');
         }
         outro('Re-export complete');
     }
-}
-/** Registers the re-export command on the CLI program. */
-export function registerReExport(program, { getProjectRoot, withErrorHandling }) {
-    const reExport = program
-        .command('re-export [patches...]')
-        .description('Refresh existing patch bodies (and filesAffected with --scan) from the current engine ' +
-        'state. Does NOT change sourceVersion/sourceProduct by default — use --stamp or run ' +
-        'rebase for source metadata stamping.')
-        .option('-a, --all', 'Re-export all patches')
-        .option('-s, --scan', 'Scan directories for new/removed files and update filesAffected')
-        .option('--scan-file <path>', 'With --scan, add this explicit engine-relative file to one target patch without collecting adjacent files. Repeatable.', (value, prev) => [...prev, value], [])
-        .option('--scan-files <manifest>', 'With --scan, bulk-assign generated files from a JSON manifest: {"assignments":[{"patch":"002-name.patch","files":["path"]}]}. Selects patches from the manifest.')
-        .option('--files <paths>', 'Restrict the re-exported filesAffected to this comma-separated list (single target patch only)', (value) => value
-        .split(',')
-        .map((v) => v.trim())
-        .filter((v) => v.length > 0))
-        .option('--refuse-adjacent-unmanaged', 'Refuse a scan-less re-export (non-zero exit, patch not written) when unmanaged files exist adjacent to the patch ownership, instead of warning. Mutually exclusive with --scan and --files.')
-        .option('--dry-run', 'Show what would change without writing')
-        .option('--skip-lint', 'Skip patch lint checks (downgrade errors to warnings)')
-        .option('--allow-stale-furnace', 'Export the deployed engine copy even when the components/ source changed since the last furnace apply')
-        .option('--allow-shrink', 'Allow --files to remove paths currently owned by the patch. Required before --yes can bypass the shrink confirmation.')
-        .option('-y, --yes', 'Skip confirmation prompts (required for non-TTY destructive writes)')
-        .option('--force-unsafe', 'Bypass cross-patch lint refusal when --files shrinks a patch')
-        .option('--stamp', "After every selected patch refreshes cleanly, stamp each re-exported patch's sourceVersion/sourceProduct in patches.json to firefox.version/firefox.product from fireforge.json. No effect on a partial run.")
-        .addOption(new Option('--tier <tier>', 'Force a tier override on the selected patch (only "branding" recognised). Mutually exclusive with --all.').choices(['branding']))
-        .option('--lint-ignore <check-id>', 'Append a lint check ID to the patch\'s PatchMetadata.lintIgnore (union, de-duped, repeatable). Mutually exclusive with --all. Use "fireforge patch lint-ignore" for --remove / --clear.', (value, prev) => [...prev, value], []);
-    addWaitLockOption(reExport).action(withErrorHandling(async (patches, options) => {
-        const { tier, lintIgnore, scanFile, scanFiles, ...rest } = options;
-        const projectRoot = getProjectRoot();
-        await withEngineSessionLock(projectRoot, 're-export', () => reExportCommand(projectRoot, patches, {
-            ...pickDefined(rest),
-            ...(scanFile !== undefined && scanFile.length > 0 ? { scanFiles: scanFile } : {}),
-            ...(scanFiles !== undefined ? { scanFilesManifest: scanFiles } : {}),
-            ...(tier !== undefined ? { tier: tier } : {}),
-            ...(lintIgnore !== undefined && lintIgnore.length > 0 ? { lintIgnore } : {}),
-        }), { waitLockSeconds: resolveWaitLockSeconds(options.waitLock) });
-    }));
+    if (reExported < selectedCount) {
+        const skippedCount = selectedCount - reExported - args.failedFilenames.length;
+        const failedPart = args.failedFilenames.length > 0 ? ` Failed: ${args.failedFilenames.join(', ')}.` : '';
+        const skippedPart = skippedCount > 0 ? ` Skipped: ${String(skippedCount)} patch(es) (see warnings above).` : '';
+        throw new GeneralError(`${isDryRun ? '[dry-run] Would re-export' : 'Re-exported'} only ${String(reExported)} of ` +
+            `${String(selectedCount)} selected patch(es).${failedPart}${skippedPart} ` +
+            'Partial re-export exits non-zero so it cannot pass as success in scripts; ' +
+            'the per-patch errors are listed above.');
+    }
 }

package/dist/src/commands/rebase/abort.js

@@ -5,18 +5,27 @@
 import { getProjectPaths, updateState } from '../../core/config.js';
 import { clearAppliedFurnaceState } from '../../core/furnace-config.js';
 import { resetChanges } from '../../core/git.js';
-import { clearRebaseSession, loadRebaseSession } from '../../core/rebase-session.js';
+import { clearRebaseSession, getRebaseSessionPath, readRebaseSession, } from '../../core/rebase-session.js';
 import { NoRebaseSessionError } from '../../errors/rebase.js';
-import { intro, outro, spinner, success } from '../../utils/logger.js';
+import { intro, outro, spinner, success, warn } from '../../utils/logger.js';
 import { confirmDirtyEngineReset } from './confirm.js';
 /**
  * Handles `fireforge rebase --abort`.
  */
 export async function handleAbort(projectRoot, yes) {
     intro('FireForge Rebase — Abort');
-    const session = await loadRebaseSession(projectRoot);
-    if (!session)
+    // Abort is the escape hatch, so it deliberately does NOT require a *valid*
+    // session — only that one is present. Nothing below reads the session
+    // object (the restore works off `paths.engine` and `resetChanges`), and the
+    // pre-0.41.0 `if (!session) throw` refused to run against a corrupt file,
+    // which was the only command that could have cleared it.
+    const read = await readRebaseSession(projectRoot);
+    if (!read.present)
         throw new NoRebaseSessionError();
+    if (!read.valid) {
+        warn(`The rebase session at ${getRebaseSessionPath(projectRoot)} is unreadable ` +
+            `(${read.reason}). Aborting anyway: the engine will be restored and the session cleared.`);
+    }
     const paths = getProjectPaths(projectRoot);
     if (!(await confirmDirtyEngineReset({
         engineDir: paths.engine,

package/dist/src/commands/rebase/continue.js

@@ -8,10 +8,10 @@ import { getStagedDiffForFiles } from '../../core/git-diff.js';
 import { stageFiles, unstageFiles } from '../../core/git-file-ops.js';
 import { updatePatchAndMetadata } from '../../core/patch-export.js';
 import { loadPatchesManifest } from '../../core/patch-manifest.js';
-import { loadRebaseSession, saveRebaseSession } from '../../core/rebase-session.js';
+import { getRebaseSessionPath, readRebaseSession, saveRebaseSession, } from '../../core/rebase-session.js';
 import { runInSignalCriticalSection } from '../../core/signal-critical.js';
 import { GeneralError } from '../../errors/base.js';
-import { NoRebaseSessionError, RebaseError } from '../../errors/rebase.js';
+import { CorruptRebaseSessionError, NoRebaseSessionError, RebaseError, } from '../../errors/rebase.js';
 import { pathExists } from '../../utils/fs.js';
 import { info, intro, success, warn } from '../../utils/logger.js';
 import { runPatchLoop } from './patch-loop.js';
@@ -20,9 +20,16 @@ import { runPatchLoop } from './patch-loop.js';
  */
 export async function handleContinue(projectRoot, maxFuzz) {
     intro('FireForge Rebase — Continue');
-    const session = await loadRebaseSession(projectRoot);
-    if (!session)
+    // A present-but-unreadable session is NOT "no session in progress" — that
+    // conflation is what made a corrupt file unrecoverable. Name the file and
+    // point at --abort, which can now clear it.
+    const read = await readRebaseSession(projectRoot);
+    if (!read.present)
         throw new NoRebaseSessionError();
+    if (!read.valid) {
+        throw new CorruptRebaseSessionError(getRebaseSessionPath(projectRoot), read.reason);
+    }
+    const session = read.session;
     const paths = getProjectPaths(projectRoot);
     // Special case: every patch has already applied but a previous run failed
     // somewhere in the post-apply work (re-export, version stamping). In that

package/dist/src/commands/rebase/index.js

@@ -12,15 +12,15 @@
  */
 import { Command } from 'commander';
 import { getProjectPaths, loadConfig } from '../../core/config.js';
+import { assertEngineGitReady } from '../../core/engine-precondition.js';
 import { clearAppliedFurnaceState } from '../../core/furnace-config.js';
-import { getHead, isGitRepository, isMissingHeadError, resetChanges } from '../../core/git.js';
+import { getHead, resetChanges } from '../../core/git.js';
 import { discoverPatches } from '../../core/patch-files.js';
 import { loadPatchesManifest } from '../../core/patch-manifest.js';
 import { getPatchSourceProduct, getPatchSourceVersion } from '../../core/patch-source-metadata.js';
-import { hasActiveRebaseSession, saveRebaseSession } from '../../core/rebase-session.js';
+import { getRebaseSessionPath, readRebaseSession, saveRebaseSession, } from '../../core/rebase-session.js';
 import { GeneralError } from '../../errors/base.js';
-import { RebaseSessionExistsError } from '../../errors/rebase.js';
-import { pathExists } from '../../utils/fs.js';
+import { CorruptRebaseSessionError, RebaseSessionExistsError } from '../../errors/rebase.js';
 import { info, intro, outro, spinner } from '../../utils/logger.js';
 import { commanderArgParser, pickDefined } from '../../utils/options.js';
 import { parsePositiveIntegerFlag } from '../../utils/validation.js';
@@ -33,34 +33,24 @@ async function handleFreshStart(projectRoot, options) {
     const isDryRun = options.dryRun === true;
     const maxFuzz = options.maxFuzz ?? 3;
     intro(isDryRun ? 'FireForge Rebase (dry run)' : 'FireForge Rebase');
-    if (await hasActiveRebaseSession(projectRoot)) {
+    // One read decides liveness AND validity: a pathExists pre-probe here left
+    // a window where the file vanished between probe and read, reporting
+    // "already in progress" with no session on disk.
+    const existing = await readRebaseSession(projectRoot);
+    if (existing.present) {
+        // A corrupt session must not be reported as "already in progress": that
+        // message tells the operator to run --continue or --abort, and before
+        // 0.41.0 both of those then reported "no rebase session in progress".
+        if (!existing.valid) {
+            throw new CorruptRebaseSessionError(getRebaseSessionPath(projectRoot), existing.reason);
+        }
         throw new RebaseSessionExistsError();
     }
     const paths = getProjectPaths(projectRoot);
-    if (!(await pathExists(paths.engine))) {
-        throw new GeneralError('Firefox source not found. Run "fireforge download" first.');
-    }
-    if (!(await isGitRepository(paths.engine))) {
-        throw new GeneralError('Engine directory is not a git repository. Run "fireforge download" to initialize.');
-    }
-    // 2026-04-24 eval Finding 11: `rebase --dry-run` used to print
-    // "Dry run complete" without validating that the engine had a valid
-    // HEAD. A previous `download --force` abort could leave `.git/`
-    // initialized but unborn (no baseline commit); the real rebase then
-    // failed immediately with `fatal: ambiguous argument 'HEAD'` on the
-    // first `git rev-parse HEAD` call. Replicate the same baseline check
-    // here so dry-run mirrors the real-run preconditions and operators
-    // cannot mistake a broken baseline for a ready-to-rebase tree.
-    try {
-        await getHead(paths.engine);
-    }
-    catch (err) {
-        if (isMissingHeadError(err)) {
-            throw new GeneralError('Engine repository has no baseline commit yet — a previous "fireforge download" was interrupted before git created the initial Firefox source commit. ' +
-                'Re-run "fireforge download --force" to recreate the baseline repository cleanly, then retry the rebase.');
-        }
-        throw err;
-    }
+    // Keeps the rebase-specific tail on the unborn-HEAD remediation (2026-04-24
+    // eval Finding 11: --dry-run used to skip this check entirely, so the real
+    // run then failed on `git rev-parse HEAD`).
+    await assertEngineGitReady(paths.engine, { unbornHeadSuffix: ', then retry the rebase.' });
     const config = await loadConfig(projectRoot);
     const currentVersion = config.firefox.version;
     const manifest = await loadPatchesManifest(paths.patches);

package/dist/src/commands/rebase/patch-loop.js

@@ -19,6 +19,7 @@ import { elapsedSince } from '../../utils/elapsed.js';
 import { toError } from '../../utils/errors.js';
 import { pathExists } from '../../utils/fs.js';
 import { error, info, outro, spinner, success, warn } from '../../utils/logger.js';
+import { isValidFirefoxVersion } from '../../utils/validation.js';
 import { buildRebaseConflictSummary } from './conflict-summary.js';
 import { printSummary } from './summary.js';
 /**
@@ -164,6 +165,17 @@ export async function runPatchLoop(projectRoot, session, paths, maxFuzz) {
     // succeeded on the patch side, so the operator is committing to the
     // new source baseline; per-component health checking stays with
     // `fireforge furnace validate` / `doctor --repair-furnace`.
+    //
+    // "Unconditional" means unconditional on component health, not on the value:
+    // `stampFurnaceOverrideBaseVersions` assigns and persists whatever string it
+    // is handed, so a session whose `toVersion` is not a real Firefox version
+    // would rewrite every override's baseline to that value. `isValidSession`
+    // now rejects such a session at read time; this refuses to persist it even
+    // if a future caller reaches here another way.
+    if (!isValidFirefoxVersion(session.toVersion)) {
+        throw new RebaseError(`Refusing to stamp Furnace override baseVersion(s): the rebase session's target version ` +
+            `("${session.toVersion}") is not a valid Firefox version.`);
+    }
     try {
         const overridesStamped = await stampFurnaceOverrideBaseVersions(projectRoot, session.toVersion);
         if (overridesStamped > 0) {