@hominis/fireforge 0.42.0 → 0.43.0

package/dist/src/commands/test-build-phase.js

@@ -2,7 +2,7 @@
 /**
  * Pre-test build phase for `fireforge test`, split out of `test.ts` (at
  * the per-file line budget): the incremental protected mach build with
- * its baseline write, and the FORGE J9 `--build-only` union-build shape.
+ * its baseline write, and the `--build-only` union-build shape.
  */
 import { readBuildBaseline, writeBuildBaseline } from '../core/build-baseline.js';
 import { prepareBuildEnvironment } from '../core/build-prepare.js';
@@ -12,7 +12,7 @@ import { buildHarnessCrashMessage } from '../core/test-harness-crash.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { BuildError } from '../errors/build.js';
 import { toError } from '../utils/errors.js';
-import { info, spinner, verbose } from '../utils/logger.js';
+import { info, notice, spinner, verbose } from '../utils/logger.js';
 import { reportBuildOnlyCompletion } from './test-modes.js';
 import { enforceStaleBuildGate, enforceStaticComponentsGate } from './test-stale-gate.js';
 import { emitPassVerdict } from './test-verdict.js';
@@ -28,7 +28,7 @@ async function runPreTestBuild(projectRoot, paths, projectConfig, harnessRetries
         const preparation = await prepareBuildEnvironment(projectRoot, paths, projectConfig, {
             previousBaseline,
         });
-        // The mozconfig half of the --extend-coverage anchor (FORGE L1) can
+        // The mozconfig half of the --extend-coverage anchor can
         // only be checked once prepareBuildEnvironment has regenerated
         // engine/mozconfig — that is the file this build will configure with —
         // and must still be checked before mach, so a refusal costs no build.
@@ -40,7 +40,10 @@ async function runPreTestBuild(projectRoot, paths, projectConfig, harnessRetries
         }
         const buildKind = preparation.fullBuildRequired ? 'full' : 'faster';
         if (preparation.fullBuildRequired) {
-            info('A jar.mn registration changed since the last successful build; escalating this pre-test build to a full mach build so new install-manifest destinations are created.');
+            // Warning severity, not info: agent-facing output filters
+            // keep warnings and errors only, and this is the line that explains an
+            // otherwise unexplained multi-minute build.
+            notice('A jar.mn registration changed since the last successful build; escalating this pre-test build to a full mach build so new install-manifest destinations are created.');
         }
         const s = spinner(preparation.fullBuildRequired
             ? 'Running required full build...'
@@ -120,7 +123,7 @@ function describeBuildInvocation(extending, coverage) {
 /**
  * Runs the pre-test build (or the stale-build gate when no build was
  * requested). Returns `true` when the run is COMPLETE — the `--build-only`
- * union-build shape (FORGE J9), which packages every requested path
+ * union-build shape, which packages every requested path
  * (mixed harnesses legal, nothing dispatches), prints the per-harness
  * next steps, and emits the run's single `PASS` verdict.
  */
@@ -152,7 +155,7 @@ export async function runTestBuildPhase(projectRoot, paths, projectConfig, harne
         await runPreTestBuild(projectRoot, paths, projectConfig, harnessRetries, coverage, extending ? { requestedPaths: normalizedPaths } : undefined);
         info('');
         if (options.buildOnly) {
-            // Union build for mixed harnesses (FORGE J9): the coverage claim
+            // Union build for mixed harnesses: the coverage claim
             // above lists every requested path, so each harness half can run
             // build-less against this packaging. Nothing dispatches here; the
             // run still ends with exactly one verdict line.

package/dist/src/commands/test-diagnose.js

@@ -7,7 +7,7 @@
  * `test-harness-crash.ts` for single and sharded invocations. Split out of
  * `test.ts` to keep both files within the per-file line budget.
  */
-import { buildGreenSummaryRejectedMessage, buildHarnessCrashMessage, buildNoTestsRanMessage, headedNoOutputTimeoutHint, } from '../core/test-harness-crash.js';
+import { buildGreenSummaryRejectedMessage, buildHarnessCrashMessage, buildNoTestsRanMessage, buildSilentSegfaultMessage, headedNoOutputTimeoutHint, isSilentSegfault, } from '../core/test-harness-crash.js';
 import { buildHarnessEarlyExitMessage, classifyHarnessEarlyExit, completePostRebuildFailureContext, prependPostRebuildFailureContext, } from '../core/test-harness-output.js';
 import { GeneralError } from '../errors/base.js';
 import { BuildError } from '../errors/build.js';
@@ -144,6 +144,12 @@ function handleNonZeroTestExit(result, normalizedPaths, appdirInjectionAttempted
     const throwGeneral = (message) => {
         throw new GeneralError(withContext(message));
     };
+    // First, because there is nothing else to go on: a SIGSEGV with zero
+    // output has exactly one known cause and no other evidence.
+    // Every branch below keys on output text this shape does not have.
+    if (isSilentSegfault(result.exitCode, combinedOutput)) {
+        throwGeneral(buildSilentSegfaultMessage(result.exitCode, normalizedPaths));
+    }
     if (/UNKNOWN TEST\b/i.test(combinedOutput)) {
         throwGeneral(buildUnknownTestMessage(normalizedPaths));
     }
@@ -214,6 +220,7 @@ function applySingleRunOutcome(outcome, normalizedPaths, binaryName, postRebuild
         const hint = headedNoOutputTimeoutHint(outcome.verdict.signature, {
             headless,
             platform: getPlatform(),
+            ...(outcome.displayState !== undefined ? { displayState: outcome.displayState } : {}),
         });
         throw new GeneralError(hint ? `${base}\n\n${hint}` : base);
     }

package/dist/src/commands/test-modes.d.ts

@@ -21,13 +21,13 @@ export interface HarnessClassification {
  * Harness classification is a pure path→manifest lookup and must precede
  * the build dispatch: a mixed xpcshell+mochitest request can never
  * dispatch, so refusing it before spending minutes in a pre-test build
- * is strictly better (FORGE F7). A nonexistent path classifies as
+ * is strictly better. A nonexistent path classifies as
  * nonXpcshell (findNearestXpcshellManifest returns null), so classifying
  * before assertTestPathsExist is harmless — existence is still asserted
  * after the stale/coverage gates, preserving their precedence over
  * missing-path errors. `xpcshellOnly` (non-empty request, zero
  * nonXpcshell paths) gates the Marionette preflight and the mochitest
- * client flags (FORGE F10); pathless runs keep the full-suite behavior.
+ * client flags; pathless runs keep the full-suite behavior.
  */
 export declare function classifyBeforeDispatch(engineDir: string, normalizedPaths: string[], options?: {
     allowMixed?: boolean;

package/dist/src/commands/test-modes.js

@@ -96,19 +96,19 @@ function buildMixedHarnessMessage(classification) {
  * Harness classification is a pure path→manifest lookup and must precede
  * the build dispatch: a mixed xpcshell+mochitest request can never
  * dispatch, so refusing it before spending minutes in a pre-test build
- * is strictly better (FORGE F7). A nonexistent path classifies as
+ * is strictly better. A nonexistent path classifies as
  * nonXpcshell (findNearestXpcshellManifest returns null), so classifying
  * before assertTestPathsExist is harmless — existence is still asserted
  * after the stale/coverage gates, preserving their precedence over
  * missing-path errors. `xpcshellOnly` (non-empty request, zero
  * nonXpcshell paths) gates the Marionette preflight and the mochitest
- * client flags (FORGE F10); pathless runs keep the full-suite behavior.
+ * client flags; pathless runs keep the full-suite behavior.
  */
 export async function classifyBeforeDispatch(engineDir, normalizedPaths, options) {
     const classification = await classifyTestHarnesses(engineDir, normalizedPaths);
     if (classification.xpcshell.length > 0 && classification.nonXpcshell.length > 0) {
         // `--build-only` never dispatches, so a mixed request is legal there —
-        // packaging the union is the whole point (FORGE J9).
+        // packaging the union is the whole point.
         if (options?.allowMixed !== true) {
             throw new GeneralError(buildMixedHarnessMessage(classification));
         }

package/dist/src/commands/test-register.js

@@ -29,7 +29,7 @@ const TEST_HELP_TEXT = [
     '--doctor) ends with exactly one raw stdout line',
     '  FIREFORGE-VERDICT: PASS|FAIL [reason=crash|test-failures|',
     '  no-tests|preflight|inconclusive|lock-timeout] [checks=<n>]',
-    '  [unexpected=<n>] [shards=<p>/<t>]',
+    '  [unexpected=<n>] [shards=<p>/<t>] [(<note>)]',
     'The status follows the harness classifier, not the raw exit code:',
     'a crash-classified run says FAIL reason=crash even at exit 0, and',
     'a green-summary-override pass says PASS despite a non-zero mach',
@@ -41,7 +41,12 @@ const TEST_HELP_TEXT = [
     'engine-mutating command held the lock past the wait budget. A sharded',
     'aggregate reason is the most structural failing shard (crash,',
     'then no-tests, then test-failures). Count keys are omitted when',
-    'the embedded summary did not print them. Key on this line',
+    'the embedded summary did not print them. A trailing parenthetical',
+    'is an advisory note, never part of the status: "(harness teardown',
+    'noise ignored)" marks a clean suite whose only residue was the',
+    'recognized upstream mozsystemmonitor teardown traceback, and',
+    '"(headed run stalled with the display asleep)" marks a no-output',
+    'stall whose display was measured asleep. Key on this line',
     'instead of mach internals.',
 ].join('\n');
 /** Registers the test command on the CLI program. */

package/dist/src/commands/test-run.d.ts

@@ -10,6 +10,7 @@
  * harness runs cost startup time but make results reproducible; the
  * combined invocation stays available via `--no-shard`.
  */
+import { type DisplaySleepState } from '../core/display-state.js';
 import { type MachCommandResult } from '../core/mach.js';
 import { type HarnessRunVerdict } from '../core/test-harness-crash.js';
 /** Default bounded retry budget for recognized harness crashes. */
@@ -48,6 +49,11 @@ export interface TestRunOutcome {
     attempts: number;
     /** Whether xpcshell appdir injection was attempted for this invocation. */
     appdirInjectionAttempted: boolean;
+    /**
+     * Display power state measured for a HEADED no-output stall;
+     * undefined when the shape did not apply and no probe ran.
+     */
+    displayState?: DisplaySleepState | undefined;
 }
 /**
  * Runs one mach test invocation for `paths`, retrying recognized harness

package/dist/src/commands/test-run.js

@@ -11,8 +11,9 @@
  * harness runs cost startup time but make results reproducible; the
  * combined invocation stays available via `--no-shard`.
  */
+import { probeDisplaySleepState } from '../core/display-state.js';
 import { mochitestWithOutput, testWithOutput, xpcshellTestWithOutput, } from '../core/mach.js';
-import { buildHarnessCrashMessage, classifyHarnessRun, headedNoOutputTimeoutHint, } from '../core/test-harness-crash.js';
+import { buildHarnessCrashMessage, classifyHarnessRun, headedDisplayAsleepVerdictNote, headedNoOutputTimeoutHint, } from '../core/test-harness-crash.js';
 import { retryAfterXpcshellSymlinkRepair } from '../core/test-xpcshell-retry.js';
 import { withXpcshellProfileDir } from '../core/xpcshell-profile-dir.js';
 import { BuildError } from '../errors/build.js';
@@ -37,7 +38,7 @@ function dispatchForSuite(suite) {
  */
 export async function runTestsWithRetries(ctx, paths) {
     // Pure mochitest dispatches keep their env byte-identical — the profile
-    // variable is xpcshell-harness-specific (FORGE G15b). Generic `mach
+    // variable is xpcshell-harness-specific. Generic `mach
     // test` runs may include xpcshell paths, so they get the isolation too.
     if (ctx.suite === 'mochitest') {
         return runTestsWithRetriesInner(ctx, paths, ctx.env);
@@ -71,7 +72,34 @@ async function runTestsWithRetriesInner(ctx, paths, env) {
             `${verdict.signature?.line ?? ''}\n` +
             `Retrying (attempt ${attempts + 1} of ${maxAttempts})...`);
     }
-    return { result, verdict, attempts, appdirInjectionAttempted };
+    const displayState = await probeDisplayStateForStall(verdict, ctx.headless);
+    if (displayState !== undefined) {
+        const note = headedDisplayAsleepVerdictNote(verdict.signature, {
+            headless: ctx.headless,
+            platform: getPlatform(),
+            displayState,
+        });
+        if (note !== undefined)
+            verdict = { ...verdict, note };
+    }
+    return { result, verdict, attempts, appdirInjectionAttempted, displayState };
+}
+/**
+ * Probes the display's power state for a HEADED no-output stall, and only
+ * for that shape. Every other outcome — a passing run, a real
+ * test failure, a headless run, any other crash shape — skips the probe
+ * entirely, so the common paths spawn nothing.
+ *
+ * @returns The measured state, or undefined when the shape does not apply
+ */
+async function probeDisplayStateForStall(verdict, headless) {
+    if (headless)
+        return undefined;
+    if (verdict.kind !== 'harness-crash')
+        return undefined;
+    if (!verdict.signature?.reason.includes('no-output timeout'))
+        return undefined;
+    return probeDisplaySleepState(getPlatform());
 }
 const SHARD_STATUS_LABEL = {
     'tests-ran-ok': 'PASS',
@@ -119,6 +147,7 @@ export async function runShardedTests(ctx, groups, diagnoseShardFailure) {
             const hint = headedNoOutputTimeoutHint(outcome.verdict.signature, {
                 headless: ctx.headless,
                 platform: getPlatform(),
+                ...(outcome.displayState !== undefined ? { displayState: outcome.displayState } : {}),
             });
             warn(hint ? `${base}\n\n${hint}` : base);
         }

package/dist/src/commands/test-stale-gate.js

@@ -44,8 +44,13 @@ export async function enforceStaleBuildGate(projectRoot, engineDir, options, nor
     await enforceStaticComponentsGate(engineDir, stale.baseline, options);
     const staleMessage = stale.stale
         ? `${formatStaleBuildWarning(stale)}\n\n` +
-            'Run `fireforge test --build` to refresh the packaged runtime first, or pass ' +
-            '`--allow-stale-build` if you intentionally rebuilt out-of-band and accept the risk.'
+            'Run `fireforge test --build` to refresh the packaged runtime first — that is almost ' +
+            'always the right move, because the usual cause is your own edit landing between the ' +
+            'last build and this run.\n\n' +
+            '`--allow-stale-build` is NOT the general escape hatch: it accepts a packaging that ' +
+            'predates the edit under test, so the run tests the OLD code. Pass it only when you ' +
+            'rebuilt out-of-band (outside FireForge) and know the packaged runtime already contains ' +
+            'the change.'
         : undefined;
     if (staleMessage !== undefined) {
         if (options.allowStaleBuild === true) {

package/dist/src/commands/test.js

@@ -12,7 +12,7 @@ import { assertObjdirMatchesTreeMarker } from '../core/tree-store.js';
 import { GeneralError } from '../errors/base.js';
 import { BuildError } from '../errors/build.js';
 import { pathExists } from '../utils/fs.js';
-import { info, intro, outro, success, verbose } from '../utils/logger.js';
+import { info, intro, notice, outro, success, verbose } from '../utils/logger.js';
 import { stripEnginePrefix } from '../utils/paths.js';
 import { runTestBuildPhase } from './test-build-phase.js';
 import { diagnoseShardOutcome, finalizeSingleRunOutcome } from './test-diagnose.js';
@@ -174,7 +174,7 @@ function appendMarionetteForwardingArgs(extraArgs, options, forwardedPort, xpcsh
         // Manifest classification says every requested path is xpcshell —
         // xpcshell ignores the browser Marionette path entirely, and the
         // mochitest client flags previously forwarded here made mach reject
-        // the dispatch (FORGE F10).
+        // the dispatch.
         info(`--marionette-port=${options.marionettePort} applied to the preflight probe only: the requested paths are xpcshell-only, and xpcshell ignores the browser Marionette port. Not forwarding --setpref=marionette.port or --marionette to mach.`);
         return;
     }
@@ -202,7 +202,7 @@ async function ensureTestMarionettePortAvailable(port, binaryName, options, skip
     if (skip.xpcshellOnly && !skip.doctor) {
         // xpcshell does not bind the browser Marionette port, so a developer's
         // interactive browser holding 2828 must not kill an xpcshell run
-        // (FORGE F10). --doctor keeps the preflight: its probe launches a
+        //. --doctor keeps the preflight: its probe launches a
         // Marionette browser regardless of the requested harness.
         const message = 'Skipping the Marionette stale-port preflight: all requested paths are xpcshell ' +
             '(xpcshell does not bind the browser Marionette port).';
@@ -431,7 +431,7 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
     // bug to an upstream headless regression), so a one-line notice states
     // what sharding does and does not exercise.
     if (canaryPath === undefined && dispatchGroups.length > 1 && options.shard !== false) {
-        info(`Sharding: running ${dispatchGroups.length} test path arguments in isolated browser instances ` +
+        notice(`Sharding: running ${dispatchGroups.length} test path arguments in isolated browser instances ` +
             '(one mach invocation per argument; a directory argument keeps its files in one instance). ' +
             'Cross-argument state is NOT exercised — pass --no-shard for a combined single-instance run.');
         const generationBefore = await snapshotEngineGeneration(paths.engine);

package/dist/src/commands/tree.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
- * `fireforge tree` — copy-on-write verification clones (FORGE G15).
+ * `fireforge tree` — copy-on-write verification clones.
  *
  * Trees enable concurrent READ-MOSTLY verification (lint, typecheck,
  * status, verify, doctor, export dry-runs) beside a busy primary tree.
@@ -263,7 +263,7 @@ async function treeExecCommand(projectRoot, name, args) {
             resolvePromise(code ?? 1);
         });
     }).finally(() => {
-        // FORGE L2: with `stdio: 'inherit'` the child owned stdout — including
+        // With `stdio: 'inherit'` the child owned stdout — including
         // any FIREFORGE-VERDICT line it emitted as its LAST stdout write. From
         // here on the parent must not write stdout again, or its own refusal
         // text (the GeneralError below rendered by withErrorHandling) would

package/dist/src/commands/typecheck.d.ts

@@ -16,6 +16,7 @@
  */
 import { Command } from 'commander';
 import type { CommandContext } from '../types/cli.js';
+import type { PatchLintIssue } from '../types/commands/index.js';
 import type { TypecheckConfig } from '../types/config.js';
 import type { TypecheckProjectResult } from '../types/typecheck.js';
 /** Command-line options Commander forwards from `fireforge typecheck`. */
@@ -45,7 +46,7 @@ export declare function typecheckCommand(projectRoot: string, options: Typecheck
  * throws on errors. Extracted so it can be exercised directly by
  * the CLI test without spawning a child process.
  */
-export declare function reportResults(projectRoot: string, results: ReadonlyArray<TypecheckProjectResult>): void;
+export declare function reportResults(projectRoot: string, results: ReadonlyArray<TypecheckProjectResult>, patchLintIssues?: ReadonlyArray<PatchLintIssue>): void;
 /**
  * Registers the `typecheck` command on the CLI program.
  */

package/dist/src/commands/typecheck.js

@@ -19,9 +19,13 @@ import { Command } from 'commander';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { furnaceConfigExists, loadFurnaceConfig } from '../core/furnace-config.js';
 import { findJsconfigPathsDrift, syncFurnaceJsconfigPaths } from '../core/furnace-jsconfig.js';
+import { withPrivateGitIndex } from '../core/git-readonly-index.js';
+import { buildPatchQueueContext } from '../core/patch-lint.js';
 import { relativeForDisplay, runTypecheck } from '../core/typecheck.js';
 import { GeneralError } from '../errors/base.js';
+import { pathExists } from '../utils/fs.js';
 import { info, intro, outro, success, warn } from '../utils/logger.js';
+import { buildPerRunCheckJs } from './lint-per-run-checkjs.js';
 /**
  * Resolves the project list to type-check. `--project` wins over
  * config; if neither is set, throws a clear error pointing at both
@@ -65,6 +69,13 @@ function formatIssue(projectRoot, issue) {
  */
 export async function typecheckCommand(projectRoot, options) {
     intro('FireForge typecheck');
+    // Read-only to the operator, an index WRITER to git without this scope
+    //: the Furnace jsconfig reconciler and the project resolution
+    // below touch `engine/`, and any git plumbing they reach would refresh
+    // the primary checkout's index under a concurrent `fireforge test`.
+    return withPrivateGitIndex(getProjectPaths(projectRoot).engine, () => runTypecheckCommandBody(projectRoot, options));
+}
+async function runTypecheckCommandBody(projectRoot, options) {
     // Validate project is initialised. `loadConfig` throws on missing
     // fireforge.json — withErrorHandling at the CLI layer renders the
     // resulting `ConfigNotFoundError` cleanly, so we don't need to
@@ -81,7 +92,38 @@ export async function typecheckCommand(projectRoot, options) {
     await regenerateStaleGeneratedJsconfig(projectRoot);
     info(`Running typecheck across ${String(cfg.projects.length)} project(s): ${cfg.projects.join(', ')}`);
     const results = await runTypecheck(projectRoot, cfg);
-    reportResults(projectRoot, results);
+    // Fold the EXPORT-TIME authority into this pass. Per-patch lint runs
+    // checkJs over the queue's patch-owned modules in relative isolation and
+    // resolves imported typedefs differently from the whole-project pass, so
+    // `typecheck` could report 0 errors across every
+    // project while the very next `export` failed per-patch lint with
+    // `checkjs-type-error` findings. Two authorities that disagree, with the
+    // stricter one speaking only at export time, is not a usable CI gate:
+    // running both here makes `typecheck` green MEAN export-clean types.
+    const patchIssues = await collectPatchLintCheckJsIssues(projectRoot);
+    reportResults(projectRoot, results, patchIssues);
+}
+/**
+ * Runs the per-patch-lint checkJs pass — the same program `export` and
+ * `lint --per-patch` use — and returns its findings.
+ *
+ * Returns an empty list when `patchLint.checkJs` is off or the project has
+ * no patch queue: there is no second authority to reconcile then.
+ */
+async function collectPatchLintCheckJsIssues(projectRoot) {
+    const paths = getProjectPaths(projectRoot);
+    const config = await loadConfig(projectRoot);
+    if (config.patchLint?.checkJs !== true)
+        return [];
+    if (!(await pathExists(paths.patches)))
+        return [];
+    const ctx = await buildPatchQueueContext(paths.patches, config);
+    const checkJs = buildPerRunCheckJs(projectRoot, paths, config, ctx);
+    if (checkJs === undefined)
+        return [];
+    info('Also running the per-patch checkJs pass (the authority `export` enforces).');
+    const grouped = await checkJs.getGrouped();
+    return [...grouped.global, ...[...grouped.byFile.values()].flat()];
 }
 /**
  * Staleness-checks and regenerates the Furnace-managed jsconfig
@@ -109,9 +151,19 @@ async function regenerateStaleGeneratedJsconfig(projectRoot) {
  * throws on errors. Extracted so it can be exercised directly by
  * the CLI test without spawning a child process.
  */
-export function reportResults(projectRoot, results) {
+export function reportResults(projectRoot, results, patchLintIssues = []) {
     let totalErrors = 0;
     let totalWarnings = 0;
+    // Per-patch checkJs findings are reported in the SAME tally:
+    // a split report would let an operator read "0 errors" off the project
+    // summary and still be refused at export.
+    for (const issue of patchLintIssues) {
+        if (issue.severity === 'error')
+            totalErrors += 1;
+        else
+            totalWarnings += 1;
+        warn(`[per-patch ${issue.check}] ${issue.file}: ${issue.message}`);
+    }
     for (const result of results) {
         const errors = result.issues.filter((i) => i.category === 'error');
         const warnings = result.issues.filter((i) => i.category === 'warning');
@@ -122,7 +174,11 @@ export function reportResults(projectRoot, results) {
         for (const issue of errors)
             warn(formatIssue(projectRoot, issue));
     }
-    const summary = `Typecheck: ${String(totalErrors)} error(s), ${String(totalWarnings)} warning(s) across ${String(results.length)} project(s)`;
+    const summary = `Typecheck: ${String(totalErrors)} error(s), ${String(totalWarnings)} warning(s) across ` +
+        `${String(results.length)} project(s)` +
+        (patchLintIssues.length > 0
+            ? ` (including ${String(patchLintIssues.length)} per-patch checkJs finding(s))`
+            : '');
     if (totalErrors === 0) {
         success(summary);
         outro(totalWarnings > 0 ? 'Typecheck passed with warnings' : 'Typecheck passed');

package/dist/src/commands/verify.js

@@ -19,7 +19,9 @@ import { Command } from 'commander';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { collectFurnaceManagedPrefixes } from '../core/furnace-config.js';
 import { isGitRepository } from '../core/git.js';
+import { withPrivateGitIndex } from '../core/git-readonly-index.js';
 import { expandUntrackedDirectoryEntries, getWorkingTreeStatus } from '../core/git-status.js';
+import { findUnresolvedSystemModuleImports, formatUnresolvedSystemModuleImports, } from '../core/module-resolution-preflight.js';
 import { buildPatchQueueContext, formatPatchLintIssue, lintPatchQueue, } from '../core/patch-lint.js';
 import { loadPatchesManifest, validatePatchesManifestConsistency } from '../core/patch-manifest.js';
 import { evaluatePatchPolicy } from '../core/patch-policy.js';
@@ -167,6 +169,24 @@ export async function collectPatchQueueHealth(projectRoot) {
             errorCount += policyErrors;
             warningCount += policyWarnings;
         }
+        // Engine-aware module-resolution preflight. The queue-level
+        // `unregistered-system-module` rule only sees modules a patch NEWLY
+        // CREATES; this asks the same question of the engine, so an import
+        // ADDED to an existing module — the shape that recurred and cost a
+        // rebuild cycle — is named as text instead of surfacing later as a
+        // bare `xpcshell return code: -11` with zero output.
+        if (await pathExists(paths.engine)) {
+            const unresolved = await findUnresolvedSystemModuleImports(paths.engine, manifest.patches.flatMap((patch) => patch.filesAffected));
+            if (unresolved.length > 0) {
+                groups.push({
+                    title: `Unresolvable system-module imports (${unresolved.length})`,
+                    issues: formatUnresolvedSystemModuleImports(unresolved),
+                    errorCount: unresolved.length,
+                    warningCount: 0,
+                });
+                errorCount += unresolved.length;
+            }
+        }
         const crossClaims = detectCrossPatchFileClaims(manifest.patches);
         if (crossClaims.length > 0) {
             groups.push({
@@ -241,7 +261,12 @@ export async function collectPatchQueueHealth(projectRoot) {
  */
 export async function verifyCommand(projectRoot) {
     intro('FireForge Verify');
-    const health = await collectPatchQueueHealth(projectRoot);
+    // `verify` is read-only to the OPERATOR but not to git: the working-tree
+    // status probe refreshes (and rewrites) `engine/.git/index`, making this
+    // command a second writer of the primary checkout and invalidating a
+    // concurrent `fireforge test`'s engine fingerprint. A private index keeps
+    // every refresh off the primary checkout.
+    const health = await withPrivateGitIndex(getProjectPaths(projectRoot).engine, () => collectPatchQueueHealth(projectRoot));
     if (!health.hasPatchesDirectory) {
         info('No patches directory. Nothing to verify.');
         outro('Verify clean');

package/dist/src/core/ast-utils.js

@@ -1,6 +1,18 @@
 // SPDX-License-Identifier: EUPL-1.2
 import * as acorn from 'acorn';
 import { walk } from 'estree-walker';
+/**
+ * Bridges acorn's return type to the positioned ESTree program type.
+ * `acorn.parse` produces nodes that carry both the ESTree shape and
+ * `start`/`end` offsets at runtime, but its static `acorn.Program` type is
+ * nominally distinct from `estree.Program`, so the compiler cannot verify
+ * the conversion structurally — hence the double assertion. This helper is
+ * the single sanctioned crossing point between the two type worlds.
+ */
+function toPositionedProgram(program) {
+    // eslint-disable-next-line no-restricted-syntax -- the sanctioned acorn→estree bridge this rule's message points at
+    return program;
+}
 /**
  * Parse JavaScript source as a **script** (not an ES module).
  * All Mozilla chrome JS files (`browser-main.js`, `browser-init.js`,
@@ -17,7 +29,7 @@ export function parseScript(content, onComment) {
     };
     if (onComment)
         opts.onComment = onComment;
-    return acorn.parse(content, opts);
+    return toPositionedProgram(acorn.parse(content, opts));
 }
 /**
  * Parse JavaScript source as an **ES module**.
@@ -35,7 +47,7 @@ export function parseModule(content, onComment) {
     };
     if (onComment)
         opts.onComment = onComment;
-    return acorn.parse(content, opts);
+    return toPositionedProgram(acorn.parse(content, opts));
 }
 /**
  * Convenience cast from `acorn.Node` (or the generic ESTree union returned

package/dist/src/core/browser-wire.js

@@ -5,7 +5,7 @@ import { toError } from '../utils/errors.js';
 import { verbose } from '../utils/logger.js';
 import { toRootRelativePath } from '../utils/paths.js';
 import { getProjectPaths, loadConfig } from './config.js';
-import { createRollbackJournal, restoreRollbackJournal, snapshotFile } from './furnace-rollback.js';
+import { assertSnapshotted, createRollbackJournal, restoreRollbackJournal, snapshotFile, } from './furnace-rollback.js';
 import { registerBrowserContent } from './manifest-register.js';
 import { DEFAULT_DOM_TARGET } from './wire-dom-fragment.js';
 import { addDestroyToBrowserInit, addDomFragment, addInitToBrowserInit, addSubscriptToBrowserMain, } from './wire-targets.js';
@@ -82,15 +82,22 @@ export async function wireSubscript(root, name, options = {}) {
     }
     try {
         // 1. Add subscript to browser-main.js
+        assertSnapshotted(journal, join(engineDir, 'browser/base/content/browser-main.js'), 'browser wire');
         const subscriptAdded = await addSubscriptToBrowserMain(engineDir, name, marker);
         // 2. Add init expression to browser-init.js (if provided)
         let initAdded = false;
         if (options.init) {
+            // The snapshot above is taken when init or destroy is `!== undefined`
+            // while these writes fire on truthiness — close, but two separate
+            // conditions over the same file, which is exactly the pairing that
+            // drifts when a third writer is added later.
+            assertSnapshotted(journal, join(engineDir, 'browser/base/content/browser-init.js'), 'browser wire init');
             initAdded = await addInitToBrowserInit(engineDir, options.init, options.after, marker);
         }
         // 3. Add destroy expression to browser-init.js onUnload() (if provided)
         let destroyAdded = false;
         if (options.destroy) {
+            assertSnapshotted(journal, join(engineDir, 'browser/base/content/browser-init.js'), 'browser wire destroy');
             destroyAdded = await addDestroyToBrowserInit(engineDir, options.destroy, marker);
         }
         // 4. Add #include directive to the top-level chrome document (if provided)
@@ -99,6 +106,7 @@ export async function wireSubscript(root, name, options = {}) {
             domInserted = await addDomFragment(engineDir, toRootRelativePath(engineDir, options.domFilePath), options.domTargetPath);
         }
         // 5. Register in jar.mn
+        assertSnapshotted(journal, join(engineDir, 'browser/base/jar.mn'), 'browser wire jar.mn');
         const jarMnResult = await registerBrowserContent(engineDir, `${name}.js`, undefined, jarMnSourcePath);
         return {
             subscriptAdded,

package/dist/src/core/build-baseline-types.d.ts

@@ -64,7 +64,7 @@ export interface BuildBaseline {
      * earlier scope's edited fixtures while `obj-*`/`_tests/` still holds its
      * stale staging; coverage therefore REPLACES by default.
      *
-     * The one exception is `test --build --extend-coverage` (FORGE L1), which
+     * The one exception is `test --build --extend-coverage`, which
      * unions only after proving the previous record's anchor still holds:
      * same engine HEAD, same {@link BuildBaseline.mozconfigHash}, and every
      * previously fingerprinted path byte-identical — i.e. the wholesale

package/dist/src/core/build-baseline.d.ts

@@ -52,7 +52,7 @@ export declare function readBuildBaseline(projectRoot: string): Promise<BuildBas
  *   static-components anchor whenever the coverage claim is `'full'` or
  *   absent. `'refresh'` records it even for a scoped coverage claim whose
  *   implementation escalated to a full build. `'carry-forward'` always keeps the previous anchor: needed by
- *   `--extend-coverage` (FORGE L1), whose union can EVALUATE to `'full'`
+ * `--extend-coverage`, whose union can EVALUATE to `'full'`
  *   while the build that produced it was still a scoped `mach build
  *   faster` that did not rebake the compiled table.
  */

package/dist/src/core/build-baseline.js

@@ -86,7 +86,7 @@ export async function readBuildBaseline(projectRoot) {
  *   static-components anchor whenever the coverage claim is `'full'` or
  *   absent. `'refresh'` records it even for a scoped coverage claim whose
  *   implementation escalated to a full build. `'carry-forward'` always keeps the previous anchor: needed by
- *   `--extend-coverage` (FORGE L1), whose union can EVALUATE to `'full'`
+ * `--extend-coverage`, whose union can EVALUATE to `'full'`
  *   while the build that produced it was still a scoped `mach build
  *   faster` that did not rebake the compiled table.
  */

package/dist/src/core/build-overwrite-guard.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Loud guard against silently reverting UNEXPORTED engine drift.
+ *
+ * `build-prepare` rewrites engine files from FireForge-owned sources
+ * before every build: the branding tree, every Furnace-managed component,
+ * and `mozconfig`. On a multi-session checkout that is a silent
+ * destructive write. The recorded incident: one session edited a file in
+ * `engine/` while another held the engine lock; the lock-holder's build
+ * rewrote the file back to its patch baseline; the editing session's later
+ * `re-export --wait-lock` then captured a HYBRID file — and every gate
+ * passed on the hybrid capture. Only a hand-run grep of the patch body
+ * caught it.
+ *
+ * The `setupBranding` half of this class was closed in `31fdf744` (the
+ * branding writer preserves unmanaged lines). The general shape — any
+ * build-prepare overwrite destroying local drift that no patch records —
+ * stayed silent, and silence is what made the hybrid capture possible.
+ *
+ * This guard runs BEFORE the writes, classifies the engine's dirty files
+ * with the same classifier `fireforge status` uses, and reports the ones
+ * whose content is explained by neither a patch body nor the pristine
+ * baseline. Advisory by default (a warning naming every file), refusing
+ * under an explicit flag.
+ */
+import type { FireForgeConfig } from '../types/config.js';
+import { type ClassifiedFile } from './status-classify.js';
+/** One file whose unexported content a build-prepare overwrite would destroy. */
+export interface UnexportedDriftAtRisk {
+    file: string;
+    classification: ClassifiedFile['classification'];
+    owner?: string | undefined;
+}
+/**
+ * Finds engine files that build-prepare is about to overwrite and whose
+ * current content is recorded nowhere.
+ *
+ * Fail-open: any probe failure is reported verbosely and yields an empty
+ * list. A build must not fail because an advisory guard could not run.
+ *
+ * @param projectRoot - Project root
+ * @param config - Loaded FireForge config (reads `binaryName`)
+ * @returns At-risk files, sorted by path
+ */
+export declare function findUnexportedDriftAtRisk(projectRoot: string, config: FireForgeConfig): Promise<UnexportedDriftAtRisk[]>;
+/**
+ * Renders the operator-facing warning (or refusal body) naming every file
+ * whose unexported content the build is about to overwrite.
+ */
+export declare function formatUnexportedDriftWarning(files: readonly UnexportedDriftAtRisk[]): string;