@hominis/fireforge 0.43.0 → 0.44.0

package/dist/src/commands/rebase/abort.js

@@ -16,9 +16,9 @@ export async function handleAbort(projectRoot, yes) {
     intro('FireForge Rebase — Abort');
     // Abort is the escape hatch, so it deliberately does NOT require a *valid*
     // session — only that one is present. Nothing below reads the session
-    // object (the restore works off `paths.engine` and `resetChanges`), and the
-    // pre-0.41.0 `if (!session) throw` refused to run against a corrupt file,
-    // which was the only command that could have cleared it.
+    // object (the restore works off `paths.engine` and `resetChanges`), and an
+    // `if (!session) throw` would refuse to run against a corrupt file, which
+    // is the only thing that could have cleared it.
     const read = await readRebaseSession(projectRoot);
     if (!read.present)
         throw new NoRebaseSessionError();

package/dist/src/commands/rebase/confirm.js

@@ -3,6 +3,7 @@
  * Dirty-engine confirmation/reset flow.
  */
 import { confirm } from '@clack/prompts';
+import { stdioIsInteractive } from '../../core/destructive.js';
 import { hasChanges } from '../../core/git.js';
 import { InvalidArgumentError } from '../../errors/base.js';
 import { cancel, isCancel, warn } from '../../utils/logger.js';
@@ -15,7 +16,7 @@ export async function confirmDirtyEngineReset({ engineDir, yes, nonInteractiveCo
     if (!(await hasChanges(engineDir)) || yes) {
         return true;
     }
-    const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
+    const isInteractive = stdioIsInteractive();
     if (!isInteractive) {
         throw new InvalidArgumentError(`Engine has uncommitted changes and interactive confirmation is not available. Run: ${nonInteractiveCommand}`, argumentName);
     }

package/dist/src/commands/rebase/continue.d.ts

@@ -4,4 +4,4 @@
 /**
  * Handles `fireforge rebase --continue`.
  */
-export declare function handleContinue(projectRoot: string, maxFuzz: number): Promise<void>;
+export declare function handleContinue(projectRoot: string, maxFuzz: number, waitLockSeconds?: number): Promise<void>;

package/dist/src/commands/rebase/continue.js

@@ -18,7 +18,7 @@ import { runPatchLoop } from './patch-loop.js';
 /**
  * Handles `fireforge rebase --continue`.
  */
-export async function handleContinue(projectRoot, maxFuzz) {
+export async function handleContinue(projectRoot, maxFuzz, waitLockSeconds) {
     intro('FireForge Rebase — Continue');
     // A present-but-unreadable session is NOT "no session in progress" — that
     // conflation is what made a corrupt file unrecoverable. Name the file and
@@ -39,7 +39,7 @@ export async function handleContinue(projectRoot, maxFuzz) {
     // there is no failed patch to resolve, but the session is still active.
     if (session.currentIndex >= session.patches.length) {
         info('All patches already applied; retrying post-apply re-export and version stamping.');
-        await runPatchLoop(projectRoot, session, paths, maxFuzz);
+        await runPatchLoop(projectRoot, session, paths, maxFuzz, waitLockSeconds);
         return;
     }
     // The current patch should be in 'failed' state
@@ -73,11 +73,10 @@ export async function handleContinue(projectRoot, maxFuzz) {
             return;
         }
         // Write the patch body and the manifest metadata atomically under the
-        // shared patch-directory lock. The previous lock-free sequence of
-        // updatePatch + updatePatchMetadata could interleave with a concurrent
-        // export / re-export / patch reorder / patch compact and leave the
-        // manifest disagreeing with the freshly-written patch body. Mirrors the
-        // v0.14.0 resolve.ts fix.
+        // shared patch-directory lock. A lock-free updatePatch +
+        // updatePatchMetadata sequence can interleave with a concurrent export /
+        // re-export / patch reorder / patch compact and leave the manifest
+        // disagreeing with the freshly-written patch body. Mirrors resolve.ts.
         await updatePatchAndMetadata(paths.patches, currentPatch.filename, diffContent, {
             sourceEsrVersion: session.toVersion,
             sourceVersion: session.toVersion,
@@ -94,7 +93,13 @@ export async function handleContinue(projectRoot, maxFuzz) {
     // clear is held until both writes land, matching the guarantee the apply
     // loop in patch-loop.ts provides.
     await runInSignalCriticalSection(`rebase-continue:${currentPatch.filename}`, async () => {
-        currentPatch.status = 'resolved';
+        // Replaced, not mutated: flipping `status` in place leaves the
+        // failure's `error` and `conflictingFiles` on a now-resolved entry, and
+        // persist that to the session file. The union makes it impossible.
+        session.patches[session.currentIndex] = {
+            filename: currentPatch.filename,
+            status: 'resolved',
+        };
         session.currentIndex++;
         await saveRebaseSession(projectRoot, session);
         // Clear pending resolution transactionally so concurrent state-file
@@ -109,5 +114,5 @@ export async function handleContinue(projectRoot, maxFuzz) {
     });
     success(`Resolved ${currentPatch.filename}`);
     // Continue applying remaining patches
-    await runPatchLoop(projectRoot, session, paths, maxFuzz);
+    await runPatchLoop(projectRoot, session, paths, maxFuzz, waitLockSeconds);
 }

package/dist/src/commands/rebase/index.js

@@ -22,7 +22,7 @@ import { getRebaseSessionPath, readRebaseSession, saveRebaseSession, } from '../
 import { GeneralError } from '../../errors/base.js';
 import { CorruptRebaseSessionError, RebaseSessionExistsError } from '../../errors/rebase.js';
 import { info, intro, outro, spinner } from '../../utils/logger.js';
-import { commanderArgParser, pickDefined } from '../../utils/options.js';
+import { addWaitLockOption, commanderArgParser, pickDefined, resolveWaitLockSeconds, } from '../../utils/options.js';
 import { parsePositiveIntegerFlag } from '../../utils/validation.js';
 import { handleAbort } from './abort.js';
 import { confirmDirtyEngineReset } from './confirm.js';
@@ -39,17 +39,17 @@ async function handleFreshStart(projectRoot, options) {
     const existing = await readRebaseSession(projectRoot);
     if (existing.present) {
         // A corrupt session must not be reported as "already in progress": that
-        // message tells the operator to run --continue or --abort, and before
-        // 0.41.0 both of those then reported "no rebase session in progress".
+        // message tells the operator to run --continue or --abort, and both of
+        // those then report "no rebase session in progress".
         if (!existing.valid) {
             throw new CorruptRebaseSessionError(getRebaseSessionPath(projectRoot), existing.reason);
         }
         throw new RebaseSessionExistsError();
     }
     const paths = getProjectPaths(projectRoot);
-    // Keeps the rebase-specific tail on the unborn-HEAD remediation (2026-04-24
-    // eval Finding 11: --dry-run used to skip this check entirely, so the real
-    // run then failed on `git rev-parse HEAD`).
+    // Keeps the rebase-specific tail on the unborn-HEAD remediation. Skipping
+    // this check in --dry-run leaves the real run to fail on
+    // `git rev-parse HEAD`.
     await assertEngineGitReady(paths.engine, { unbornHeadSuffix: ', then retry the rebase.' });
     const config = await loadConfig(projectRoot);
     const currentVersion = config.firefox.version;
@@ -112,7 +112,7 @@ async function handleFreshStart(projectRoot, options) {
     };
     await saveRebaseSession(projectRoot, session);
     // Run the patch loop
-    await runPatchLoop(projectRoot, session, paths, maxFuzz);
+    await runPatchLoop(projectRoot, session, paths, maxFuzz, resolveWaitLockSeconds(options.waitLock));
 }
 // ── Public API ──
 /**
@@ -125,21 +125,21 @@ export async function rebaseCommand(projectRoot, options = {}) {
         return handleAbort(projectRoot, options.yes);
     }
     if (options.continue) {
-        return handleContinue(projectRoot, options.maxFuzz ?? 3);
+        return handleContinue(projectRoot, options.maxFuzz ?? 3, resolveWaitLockSeconds(options.waitLock));
     }
     return handleFreshStart(projectRoot, options);
 }
 /** Registers the rebase command on the CLI program. */
 export function registerRebase(program, { getProjectRoot, withErrorHandling }) {
-    program
+    const command = program
         .command('rebase')
         .description('Semi-automated Firefox source version upgrade — apply patches with drift tolerance and re-export')
         .option('--continue', 'Resume after manually resolving a failed patch')
         .option('--abort', 'Cancel the rebase and restore engine to pre-rebase state')
         .option('--dry-run', 'Show what would happen without modifying anything')
         .option('--max-fuzz <n>', 'Maximum context-reduction steps for git apply -C<n> (fuzz-like drift tolerance; default: 3)', commanderArgParser((v) => parsePositiveIntegerFlag('--max-fuzz', v)))
-        .option('-y, --yes', 'Skip dirty-tree confirmation prompt')
-        .action(withErrorHandling(async (options) => {
+        .option('-y, --yes', 'Skip dirty-tree confirmation prompt');
+    addWaitLockOption(command).action(withErrorHandling(async (options) => {
         await rebaseCommand(getProjectRoot(), pickDefined(options));
     }));
 }

package/dist/src/commands/rebase/patch-loop.d.ts

@@ -5,5 +5,11 @@ import type { getProjectPaths } from '../../core/config.js';
 import type { RebaseSession } from '../../core/rebase-session.js';
 /**
  * Runs the patch application loop, re-exports applied patches, and stamps versions.
+ *
+ * @param projectRoot - Project root directory
+ * @param session - The active rebase session, mutated and persisted as it runs
+ * @param paths - Resolved project paths
+ * @param maxFuzz - Maximum context-reduction steps for `git apply -C<n>`
+ * @param waitLockSeconds - `--wait-lock` budget for the patch-directory lock
  */
-export declare function runPatchLoop(projectRoot: string, session: RebaseSession, paths: ReturnType<typeof getProjectPaths>, maxFuzz: number): Promise<void>;
+export declare function runPatchLoop(projectRoot: string, session: RebaseSession, paths: ReturnType<typeof getProjectPaths>, maxFuzz: number, waitLockSeconds?: number): Promise<void>;

package/dist/src/commands/rebase/patch-loop.js

@@ -12,7 +12,7 @@ import { discoverPatches } from '../../core/patch-files.js';
 import { withPatchDirectoryLock } from '../../core/patch-lock.js';
 import { loadPatchesManifest, stampPatchVersions } from '../../core/patch-manifest.js';
 import { extractConflictingFiles } from '../../core/patch-parse.js';
-import { clearRebaseSession, saveRebaseSession } from '../../core/rebase-session.js';
+import { clearRebaseSession, saveRebaseSession, } from '../../core/rebase-session.js';
 import { runInSignalCriticalSection } from '../../core/signal-critical.js';
 import { RebaseError } from '../../errors/rebase.js';
 import { elapsedSince } from '../../utils/elapsed.js';
@@ -22,10 +22,42 @@ import { error, info, outro, spinner, success, warn } from '../../utils/logger.j
 import { isValidFirefoxVersion } from '../../utils/validation.js';
 import { buildRebaseConflictSummary } from './conflict-summary.js';
 import { printSummary } from './summary.js';
+/**
+ * Builds the session entry for a patch-apply outcome.
+ *
+ * Constructing a whole entry rather than assigning fields is what the
+ * discriminated union buys: a status can never be flipped while the previous
+ * status's payload stays behind, which is how
+ * `{ status: 'resolved', error, conflictingFiles }` reaches the session file.
+ *
+ * @param filename - Patch filename the entry describes
+ * @param applyResult - Outcome from `applyPatchWithFuzz`
+ * @returns The entry to store at this patch's index
+ */
+function entryForApplyResult(filename, applyResult) {
+    if (!applyResult.success) {
+        return {
+            filename,
+            status: 'failed',
+            ...(applyResult.error !== undefined ? { error: applyResult.error } : {}),
+            conflictingFiles: extractConflictingFiles(applyResult.error),
+        };
+    }
+    if (applyResult.fuzzFactor === 0 || applyResult.fuzzFactor === undefined) {
+        return { filename, status: 'applied-clean' };
+    }
+    return { filename, status: 'applied-fuzz', fuzzFactor: applyResult.fuzzFactor };
+}
 /**
  * Runs the patch application loop, re-exports applied patches, and stamps versions.
+ *
+ * @param projectRoot - Project root directory
+ * @param session - The active rebase session, mutated and persisted as it runs
+ * @param paths - Resolved project paths
+ * @param maxFuzz - Maximum context-reduction steps for `git apply -C<n>`
+ * @param waitLockSeconds - `--wait-lock` budget for the patch-directory lock
  */
-export async function runPatchLoop(projectRoot, session, paths, maxFuzz) {
+export async function runPatchLoop(projectRoot, session, paths, maxFuzz, waitLockSeconds) {
     const allPatches = await discoverPatches(paths.patches);
     const s = spinner('Applying patches...');
     for (let i = session.currentIndex; i < session.patches.length; i++) {
@@ -35,7 +67,10 @@ export async function runPatchLoop(projectRoot, session, paths, maxFuzz) {
         const patchFile = allPatches.find((p) => p.filename === entry.filename);
         if (!patchFile) {
             warn(`Patch file not found for ${entry.filename}, skipping.`);
-            entry.status = 'skipped';
+            // Replaced, not mutated: the entry is a discriminated union, so a status
+            // change is a new value rather than a field assignment. That is what
+            // stops a status flip stranding the previous status's payload.
+            session.patches[i] = { filename: entry.filename, status: 'skipped' };
             session.currentIndex = i + 1;
             await saveRebaseSession(projectRoot, session);
             continue;
@@ -50,26 +85,9 @@ export async function runPatchLoop(projectRoot, session, paths, maxFuzz) {
         // divergent results).
         const result = await runInSignalCriticalSection(`rebase-apply:${entry.filename}`, async () => {
             const applyResult = await applyPatchWithFuzz(patchFile.path, paths.engine, maxFuzz);
-            if (applyResult.success) {
-                if (applyResult.fuzzFactor === 0) {
-                    entry.status = 'applied-clean';
-                }
-                else {
-                    entry.status = 'applied-fuzz';
-                    entry.fuzzFactor = applyResult.fuzzFactor;
-                }
-                session.currentIndex = i + 1;
-                await saveRebaseSession(projectRoot, session);
-            }
-            else {
-                entry.status = 'failed';
-                if (applyResult.error) {
-                    entry.error = applyResult.error;
-                }
-                entry.conflictingFiles = extractConflictingFiles(applyResult.error);
-                session.currentIndex = i;
-                await saveRebaseSession(projectRoot, session);
-            }
+            session.patches[i] = entryForApplyResult(entry.filename, applyResult);
+            session.currentIndex = applyResult.success ? i + 1 : i;
+            await saveRebaseSession(projectRoot, session);
             return applyResult;
         });
         if (result.success) {
@@ -130,7 +148,7 @@ export async function runPatchLoop(projectRoot, session, paths, maxFuzz) {
     // patch was tested against if we proceeded to stamp. Refuse to claim
     // success and leave the session in place so the user can recover via
     // `fireforge rebase --continue` after fixing the underlying cause.
-    const { failures: reExportFailures, overlapSkipped } = await reExportAppliedPatches(session, paths);
+    const { failures: reExportFailures, overlapSkipped } = await reExportAppliedPatches(session, paths, waitLockSeconds);
     if (reExportFailures.length > 0) {
         for (const f of reExportFailures) {
             error(`  ${f.filename}: ${f.error}`);
@@ -157,21 +175,21 @@ export async function runPatchLoop(projectRoot, session, paths, maxFuzz) {
         await stampPatchVersions(paths.patches, appliedFilenames, session.toVersion, session.toProduct);
     }
     // Stamp every Furnace override's `baseVersion` to match the rebased
-    // Firefox source version. Before this stamp, a successful source bump left
-    // overrides in a doctor-failing drift state (each override still
-    // claimed the pre-rebase source as its baseline) and every subsequent
-    // `fireforge doctor` failed `Furnace component validation`. The
-    // stamp is unconditional per the helper's contract: rebase already
-    // succeeded on the patch side, so the operator is committing to the
-    // new source baseline; per-component health checking stays with
+    // Firefox source version. Without it, a successful source bump leaves
+    // overrides in a doctor-failing drift state — each still claiming the
+    // pre-rebase source as its baseline — and every subsequent
+    // `fireforge doctor` fails `Furnace component validation`. The stamp is
+    // unconditional per the helper's contract: rebase already succeeded on
+    // the patch side, so the operator is committing to the new source
+    // baseline; per-component health checking stays with
     // `fireforge furnace validate` / `doctor --repair-furnace`.
     //
-    // "Unconditional" means unconditional on component health, not on the value:
-    // `stampFurnaceOverrideBaseVersions` assigns and persists whatever string it
-    // is handed, so a session whose `toVersion` is not a real Firefox version
-    // would rewrite every override's baseline to that value. `isValidSession`
-    // now rejects such a session at read time; this refuses to persist it even
-    // if a future caller reaches here another way.
+    // "Unconditional" means unconditional on component health, not on the
+    // value: `stampFurnaceOverrideBaseVersions` assigns and persists whatever
+    // string it is handed, so a session whose `toVersion` is not a real
+    // Firefox version would rewrite every override's baseline to that value.
+    // `isValidSession` rejects such a session at read time; this refuses to
+    // persist it even if a future caller reaches here another way.
     if (!isValidFirefoxVersion(session.toVersion)) {
         throw new RebaseError(`Refusing to stamp Furnace override baseVersion(s): the rebase session's target version ` +
             `("${session.toVersion}") is not a valid Firefox version.`);
@@ -201,7 +219,7 @@ export async function runPatchLoop(projectRoot, session, paths, maxFuzz) {
     success(`All patches re-exported with sourceVersion=${session.toVersion}`);
     outro('Rebase complete!');
 }
-async function reExportAppliedPatches(session, paths) {
+async function reExportAppliedPatches(session, paths, waitLockSeconds) {
     const failures = [];
     const overlapSkipped = [];
     const manifest = await loadPatchesManifest(paths.patches);
@@ -253,7 +271,10 @@ async function reExportAppliedPatches(session, paths) {
                 // Rebase sessions are serialized against each other by
                 // `rebase-session.ts`, so this lock is only defending against other
                 // command classes, not peer rebases.
-                await withPatchDirectoryLock(paths.patches, () => updatePatch(patchPath, diffContent));
+                await withPatchDirectoryLock(paths.patches, () => updatePatch(patchPath, diffContent), {
+                    waitLockSeconds,
+                    command: 'rebase',
+                });
             }
         }
         catch (err) {

package/dist/src/commands/rebase/summary.js

@@ -34,7 +34,7 @@ export function printSummary(session) {
     info(`Source Rebase Summary: ${from} → ${to}`);
     info('='.repeat(55));
     for (const patch of session.patches) {
-        const label = statusLabel(patch.status, patch.fuzzFactor);
+        const label = statusLabel(patch.status, patch.status === 'applied-fuzz' ? patch.fuzzFactor : undefined);
         info(`  ${patch.filename} ${'·'.repeat(Math.max(1, 45 - patch.filename.length - label.length))} ${label}`);
     }
     const clean = session.patches.filter((p) => p.status === 'applied-clean').length;

package/dist/src/commands/register.js

@@ -2,7 +2,7 @@
 import { join } from 'node:path';
 import { Command } from 'commander';
 import { getProjectPaths } from '../core/config.js';
-import { registerFile } from '../core/manifest-rules.js';
+import { registerFile } from '../core/moz-manifest-rules.js';
 import { InvalidArgumentError } from '../errors/base.js';
 import { pathExists } from '../utils/fs.js';
 import { info, intro, outro, success, warn } from '../utils/logger.js';
@@ -48,12 +48,10 @@ export async function registerCommand(projectRoot, filePath, options = {}) {
         ...(options.createManifest !== undefined ? { createManifest: options.createManifest } : {}),
     });
     if (options.dryRun) {
-        // 2026-04-21 eval (Finding #8): dry-run always said "Would
-        // register" even when the rule's idempotency check already knew
-        // the entry was present, so automation read the plan as "work to
-        // do" and the following real run then reported "Already
-        // registered". Surface the idempotency decision in dry-run too so
-        // the plan mirrors the real command's outcome.
+        // Dry-run must surface the idempotency decision too. Always saying
+        // "Would register" — even when the rule already knows the entry is
+        // present — makes automation read the plan as "work to do" while the
+        // following real run reports "Already registered".
         if (result.skipped) {
             info(`[dry-run] Already registered: ${engineRelativePath} in ${result.manifest}`);
             outro('Dry run complete');

package/dist/src/commands/reset.js

@@ -2,6 +2,7 @@
 import { confirm } from '@clack/prompts';
 import { Command } from 'commander';
 import { getProjectPaths } from '../core/config.js';
+import { stdioIsInteractive } from '../core/destructive.js';
 import { assertEngineGitReady } from '../core/engine-precondition.js';
 import { clearAppliedFurnaceState } from '../core/furnace-config.js';
 import { hasChanges, resetChanges } from '../core/git.js';
@@ -40,7 +41,7 @@ export async function resetCommand(projectRoot, options) {
     // Confirm reset unless --yes is specified
     if (!options.yes) {
         // Check for non-interactive mode
-        const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
+        const isInteractive = stdioIsInteractive();
         if (!isInteractive) {
             throw new InvalidArgumentError('Interactive confirmation not available. Use --yes flag to reset without confirmation.', 'Use: fireforge reset --yes');
         }

package/dist/src/commands/resolve.d.ts

@@ -5,23 +5,26 @@ import type { CommandContext } from '../types/cli.js';
  */
 export interface ResolveCommandOptions {
     /**
-     * Skip the interactive "Have you finished fixing the files?"
-     * confirmation prompt and treat the resolution as complete.
+     * Skip the interactive "Have you finished fixing the files?" confirmation
+     * prompt and treat the resolution as complete.
      *
-     * Motivating case (2026-04-21 eval, Finding #18): a scripted or
-     * CI-assisted recovery flow that has already completed the manual
-     * merge step cannot advance through `fireforge resolve` because the
-     * TTY guard refuses non-interactive invocations outright. `--yes`
-     * is the explicit opt-in for those flows: the operator is asserting
-     * they have already done the merge, and the command proceeds
-     * straight to the patch-refresh + state-clear path.
+     * A scripted or CI-assisted recovery flow that has already completed the
+     * manual merge step cannot otherwise advance through `fireforge resolve`,
+     * because the TTY guard refuses non-interactive invocations outright.
+     * `--yes` is the explicit opt-in: the operator asserts the merge is done,
+     * and the command proceeds straight to the patch-refresh + state-clear
+     * path.
      *
-     * The guard without `--yes` is preserved — running `resolve` with
-     * no TTY and no `--yes` still refuses so an accidental pipe-into
-     * invocation doesn't silently commit whatever the engine happens
-     * to contain.
+     * The guard without `--yes` is preserved — running `resolve` with no TTY
+     * and no `--yes` still refuses, so an accidental pipe-into invocation does
+     * not silently commit whatever the engine happens to contain.
      */
     yes?: boolean;
+    /**
+     * Seconds to wait for the patch directory lock. `resolve` rewrites a patch
+     * body and its metadata under that lock.
+     */
+    waitLock?: number | boolean;
 }
 /**
  * Runs the resolve command to fix broken patches.

package/dist/src/commands/resolve.js

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { confirm } from '@clack/prompts';
 import { Command } from 'commander';
 import { getProjectPaths, loadConfig, loadState, updateState } from '../core/config.js';
+import { stdioIsInteractive } from '../core/destructive.js';
 import { assertEngineGitReady } from '../core/engine-precondition.js';
 import { getStagedDiffForFiles } from '../core/git-diff.js';
 import { stageFiles, unstageFiles } from '../core/git-file-ops.js';
@@ -14,6 +15,7 @@ import { GeneralError, ResolutionError } from '../errors/base.js';
 import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
 import { error as logError, info, intro, isCancel, outro, spinner, success, } from '../utils/logger.js';
+import { addWaitLockOption, resolveWaitLockSeconds } from '../utils/options.js';
 /**
  * Runs the resolve command to fix broken patches.
  * @param projectRoot - Root directory of the project
@@ -31,13 +33,12 @@ export async function resolveCommand(projectRoot, options = {}) {
     const { patchFilename } = state.pendingResolution;
     info(`Resolving conflict for patch: ${patchFilename}`);
     await assertEngineGitReady(paths.engine);
-    // Non-interactive mode requires an explicit `--yes` to proceed: the
-    // operator is asserting the manual merge is complete and the
-    // refreshed diff is the one to record. Without `--yes`, an accidental
-    // pipe / CI shell could otherwise commit whatever the engine
-    // currently contains. 2026-04-21 eval (Finding #18): a scripted
-    // recovery flow was dead-ended by the unconditional TTY refusal.
-    if (!(process.stdin.isTTY && process.stdout.isTTY) && !options.yes) {
+    // Non-interactive mode requires an explicit `--yes`: the operator is
+    // asserting the manual merge is complete and the refreshed diff is the one
+    // to record. Without it, an accidental pipe or CI shell could commit
+    // whatever the engine currently contains — but an unconditional TTY
+    // refusal dead-ends a scripted recovery flow.
+    if (!stdioIsInteractive() && !options.yes) {
         throw new GeneralError('Cannot run "fireforge resolve" in non-interactive mode. Use a terminal with TTY support, or pass "--yes" to skip the interactive confirmation once the manual merge is complete.');
     }
     if (!options.yes) {
@@ -106,35 +107,31 @@ export async function resolveCommand(projectRoot, options = {}) {
             return;
         }
         // Atomically write the patch body and the metadata update under the
-        // shared patch-directory lock. Replaces the previous lock-free
-        // sequence of updatePatch + updatePatchMetadata, which a concurrent
-        // import / export / re-export / patch reorder / patch compact could
-        // interleave with and leave the manifest disagreeing with the
-        // freshly-written patch body.
+        // shared patch-directory lock. A lock-free updatePatch +
+        // updatePatchMetadata sequence can be interleaved by a concurrent
+        // import / export / re-export / patch reorder / patch compact, leaving
+        // the manifest disagreeing with the freshly-written patch body.
         //
-        // Always recompute `filesAffected` from the diff content itself. The
-        // eval finding #16 scenario: the user's manual fix removed every
-        // hunk for one file while the file still existed on disk, so the
-        // pre-0.16.0 gate of "update filesAffected only when files were
-        // deleted from disk" left the manifest claiming a file the patch
-        // body no longer targeted. The next `fireforge import` then failed
-        // the patch-manifest consistency check even though resolve reported
-        // success. `extractAffectedFiles` already owns the canonical
-        // "parse a diff, return its target paths" logic used by export and
-        // consistency — using it here keeps resolve in agreement with every
-        // other writer.
+        // Always recompute `filesAffected` from the diff content itself. When a
+        // manual fix removes every hunk for one file while the file still exists
+        // on disk, a gate of "update filesAffected only when files were deleted
+        // from disk" leaves the manifest claiming a file the patch body no longer
+        // targets, and the next `fireforge import` fails the patch-manifest
+        // consistency check even though resolve reported success.
+        // `extractAffectedFiles` already owns the canonical "parse a diff, return
+        // its target paths" logic used by export and consistency, so using it
+        // here keeps resolve in agreement with every other writer.
         const diffFilesAffected = extractAffectedFiles(diffContent);
         const config = await loadConfig(projectRoot);
         await updatePatchAndMetadata(paths.patches, patchFilename, diffContent, {
             filesAffected: diffFilesAffected,
             ...buildPatchSourceMetadata(config.firefox),
-        });
-        // Cleanup: Clear pendingResolution from state.json transactionally so
-        // we don't clobber concurrent updates to unrelated keys (e.g. another
-        // command writing buildMode or baseCommit between our loadState and
-        // saveState). The updater function runs inside the state-file lock
-        // with the freshest on-disk state, so only pendingResolution is
-        // affected.
+        }, undefined, undefined, { waitLockSeconds: resolveWaitLockSeconds(options.waitLock), command: 'resolve' });
+        // Clear pendingResolution from state.json transactionally so a
+        // concurrent update to unrelated keys (another command writing buildMode
+        // or baseCommit between our load and save) is not clobbered. The updater
+        // runs inside the state-file lock with the freshest on-disk state, so
+        // only pendingResolution is affected.
         await updateState(projectRoot, (current) => {
             const next = { ...current };
             delete next.pendingResolution;
@@ -153,11 +150,11 @@ export async function resolveCommand(projectRoot, options = {}) {
 }
 /** Registers the resolve command on the CLI program. */
 export function registerResolve(program, { getProjectRoot, withErrorHandling }) {
-    program
+    const command = program
         .command('resolve')
         .description('Update a broken patch with manual fixes (then run "fireforge import" to resume the queue)')
-        .option('-y, --yes', 'Skip the interactive confirmation prompt. Use for non-interactive automation flows (CI, scripted recovery) after the manual merge is complete.')
-        .action(withErrorHandling(async (options) => {
+        .option('-y, --yes', 'Skip the interactive confirmation prompt. Use for non-interactive automation flows (CI, scripted recovery) after the manual merge is complete.');
+    addWaitLockOption(command).action(withErrorHandling(async (options) => {
         await resolveCommand(getProjectRoot(), options);
     }));
 }