@hominis/fireforge 0.43.1 → 0.44.0

package/dist/src/core/patch-manifest-validate.d.ts

@@ -2,7 +2,12 @@
  * Schema validation for patches.json manifest data.
  */
 import type { PatchCategory, PatchesManifest } from '../types/commands/index.js';
-/** Validates raw patches.json data and returns the typed manifest shape. */
+/**
+ * Validates raw patches.json data and returns the typed manifest shape.
+ *
+ * @param data - Parsed patches.json content
+ * @returns The validated manifest
+ */
 export declare function validatePatchesManifest(data: unknown): PatchesManifest;
 /**
  * Infers patch metadata from a filename pattern.

package/dist/src/core/patch-manifest-validate.js

@@ -4,6 +4,7 @@
  */
 import { parseObject } from '../utils/parse.js';
 import { isArray, isObject, isValidFirefoxProduct, isValidFirefoxVersion, PATCH_CATEGORIES, } from '../utils/validation.js';
+import { checkDocumentVersion, describeNewerDocument } from './state-file.js';
 function parseForwardImports(data, label) {
     if (!isArray(data)) {
         throw new Error(`${label} must be an array`);
@@ -91,16 +92,13 @@ function validatePatchMetadata(data, index) {
         throw new Error(`patches[${index}].sourceEsrVersion must be a valid Firefox version string`);
     }
     const filesAffected = rec.stringArray('filesAffected');
-    // Optional fields. These were silently stripped before the 0.17.0
-    // branding-tier work reached in and audited the loader — the 0.16.0
-    // `lintIgnore` escape hatch demonstrably round-tripped only through
-    // test fixtures that mocked `loadPatchesManifest` directly. Real
-    // operator edits to `patches.json` were dropped on every subsequent
-    // load, so any patch that relied on `lintIgnore` to suppress a
-    // specific lint rule was quietly re-tripped the next time the
-    // manifest validated. Preserve both the pre-existing `lintIgnore`
-    // and the new `tier` field here so future-added optional fields
-    // have a ready template to follow.
+    // Optional fields. These are easy to strip silently — an escape hatch
+    // that round-trips only through test fixtures mocking
+    // `loadPatchesManifest` looks fine while real operator edits to
+    // `patches.json` are dropped on every load, so a patch relying on
+    // `lintIgnore` to suppress a rule is quietly re-tripped the next time the
+    // manifest validates. Preserve both `lintIgnore` and `tier` here; future
+    // optional fields follow the same template.
     const lintIgnore = rec.optionalStringArray('lintIgnore');
     const rawTier = rec.raw('tier');
     let tier;
@@ -133,13 +131,27 @@ function validatePatchMetadata(data, index) {
     }
     return result;
 }
-/** Validates raw patches.json data and returns the typed manifest shape. */
+/** Manifest schema version this build writes and understands. */
+const PATCHES_MANIFEST_VERSION = 1;
+/**
+ * Validates raw patches.json data and returns the typed manifest shape.
+ *
+ * @param data - Parsed patches.json content
+ * @returns The validated manifest
+ */
 export function validatePatchesManifest(data) {
     if (!isObject(data)) {
         throw new Error('patches.json must be a JSON object');
     }
-    if (data['version'] !== 1) {
-        throw new Error('patches.json version must be 1');
+    // A manifest from a NEWER FireForge is not corrupt. The bare "version must
+    // be 1" this replaced sent the operator looking for damage in a file that
+    // only needed a newer build to read it.
+    const version = checkDocumentVersion(data, 'version', PATCHES_MANIFEST_VERSION);
+    if (version.kind === 'newer') {
+        throw new Error(describeNewerDocument('patches manifest', version.found, PATCHES_MANIFEST_VERSION));
+    }
+    if (version.kind !== 'current') {
+        throw new Error(`patches.json version must be ${PATCHES_MANIFEST_VERSION}`);
     }
     if (!isArray(data['patches'])) {
         throw new Error('patches.json field "patches" must be an array');

package/dist/src/core/patch-parse.d.ts

@@ -1,15 +1,13 @@
 /**
- * Pure parsing functions for extracting information from patch files.
- * All functions are synchronous and operate on string content.
+ * Pure parsing functions for extracting information from patch files. All
+ * functions are synchronous and operate on string content.
  *
- * This module is the ONE unified-diff walker in the codebase. Before
- * {@link parseDiffSections} existed, six hand-rolled `diff --git` walkers
- * lived across patch-parse, patch-lint-diff, patch-registration-refs, and
- * patch-transform — with divergent CRLF handling (a CRLF-saved patch file
- * silently failed target-file matching and `\ No newline` detection on
- * Windows), no quoted-path support, and greedy path captures that
- * mis-split any path containing ` b/`. New diff-shaped parsing must build
- * on {@link parseDiffSections} rather than re-walking lines.
+ * This module is the ONE unified-diff walker in the codebase. Hand-rolled
+ * `diff --git` walkers diverge in ways that matter: CRLF handling (a
+ * CRLF-saved patch file silently fails target-file matching and
+ * `\ No newline` detection on Windows), quoted-path support, and greedy path
+ * captures that mis-split any path containing ` b/`. New diff-shaped parsing
+ * must build on {@link parseDiffSections} rather than re-walking lines.
  */
 /**
  * Extracts the order number from a patch filename.
@@ -53,9 +51,9 @@ export interface DiffGitHeader {
  * (`diff --git "a/x y" "b/x y"`), and disambiguates the unquoted form for
  * paths that themselves contain ` b/`: for the overwhelmingly common
  * non-rename case the two paths are identical, so a symmetric split
- * (`a/<p> b/<p>`) is tried first — the previous greedy regex
- * (`a\/.+ b\/(.+)$`) split such lines at the LAST ` b/` and returned a
- * truncated path. Falls back to a non-greedy split for renames.
+ * (`a/<p> b/<p>`) is tried first — a greedy `a\/.+ b\/(.+)$` splits such
+ * lines at the LAST ` b/` and returns a truncated path. Falls back to a
+ * non-greedy split for renames.
  *
  * @returns null when the line is not a diff --git header.
  */
@@ -78,6 +76,19 @@ export interface DiffSection {
      * refuse them rather than treat base85 lines starting with `+` as content.
      */
     isBinary: boolean;
+    /**
+     * True ONLY for `GIT binary patch` sections — the body carries a
+     * reconstructable literal/delta payload. False for `Binary files … differ`,
+     * which records THAT the bytes changed but carries none of them and cannot
+     * be replayed by `git apply`.
+     *
+     * The distinction is not cosmetic: the stub form still carries a correct
+     * `index <old>..<new>` line, so identity checks keyed on {@link indexNewHash}
+     * alone happily conclude "the recorded bytes match the live file" for a body
+     * that can no longer produce those bytes. Consumers deciding whether a patch
+     * can RECREATE a file must read this flag, never `isBinary` plus a hash.
+     */
+    hasBinaryDelta: boolean;
     /**
      * Old-side blob hash from the section's `index <old>..<new>` line
      * (possibly abbreviated). Undefined when the metadata zone carries no

package/dist/src/core/patch-parse.js

@@ -1,17 +1,15 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { assert } from '../utils/assert.js';
 /**
- * Pure parsing functions for extracting information from patch files.
- * All functions are synchronous and operate on string content.
+ * Pure parsing functions for extracting information from patch files. All
+ * functions are synchronous and operate on string content.
  *
- * This module is the ONE unified-diff walker in the codebase. Before
- * {@link parseDiffSections} existed, six hand-rolled `diff --git` walkers
- * lived across patch-parse, patch-lint-diff, patch-registration-refs, and
- * patch-transform — with divergent CRLF handling (a CRLF-saved patch file
- * silently failed target-file matching and `\ No newline` detection on
- * Windows), no quoted-path support, and greedy path captures that
- * mis-split any path containing ` b/`. New diff-shaped parsing must build
- * on {@link parseDiffSections} rather than re-walking lines.
+ * This module is the ONE unified-diff walker in the codebase. Hand-rolled
+ * `diff --git` walkers diverge in ways that matter: CRLF handling (a
+ * CRLF-saved patch file silently fails target-file matching and
+ * `\ No newline` detection on Windows), quoted-path support, and greedy path
+ * captures that mis-split any path containing ` b/`. New diff-shaped parsing
+ * must build on {@link parseDiffSections} rather than re-walking lines.
  */
 /**
  * Extracts the order number from a patch filename.
@@ -89,9 +87,9 @@ function unquoteGitPath(quoted) {
  * (`diff --git "a/x y" "b/x y"`), and disambiguates the unquoted form for
  * paths that themselves contain ` b/`: for the overwhelmingly common
  * non-rename case the two paths are identical, so a symmetric split
- * (`a/<p> b/<p>`) is tried first — the previous greedy regex
- * (`a\/.+ b\/(.+)$`) split such lines at the LAST ` b/` and returned a
- * truncated path. Falls back to a non-greedy split for renames.
+ * (`a/<p> b/<p>`) is tried first — a greedy `a\/.+ b\/(.+)$` splits such
+ * lines at the LAST ` b/` and returns a truncated path. Falls back to a
+ * non-greedy split for renames.
  *
  * @returns null when the line is not a diff --git header.
  */
@@ -171,6 +169,7 @@ export function parseDiffSections(diffContent) {
                 isNewFile: false,
                 isDeletedFile: false,
                 isBinary: false,
+                hasBinaryDelta: false,
                 hunks: [],
             };
             sections.push(current);
@@ -188,7 +187,13 @@ export function parseDiffSections(diffContent) {
                 current.isDeletedFile = true;
                 continue;
             }
-            if (line === 'GIT binary patch' || /^Binary files .* differ$/.test(line)) {
+            if (line === 'GIT binary patch') {
+                current.isBinary = true;
+                current.hasBinaryDelta = true;
+                continue;
+            }
+            if (/^Binary files .* differ$/.test(line)) {
+                // Informational form: binary, but with no payload to apply.
                 current.isBinary = true;
                 continue;
             }

package/dist/src/core/patch-policy.d.ts

@@ -43,8 +43,8 @@ export declare function isCategoryAllowedByConfig(config: FireForgeConfig, categ
 export declare function categoryRangeLabel(ranges: readonly PatchPolicyRange[], category: string): string;
 /**
  * Returns the configured range that contains `order` for `category`, or
- * null when no such range exists. Exported for the forward-import hint
- *, which suppresses ordinal suggestions the reorder policy
+ * null when no such range exists. Exported for the forward-import hint,
+ * which suppresses ordinal suggestions the reorder policy
  * would refuse.
  */
 export declare function categoryRangeForOrder(cfg: PatchPolicyConfig, category: string, order: number): PatchPolicyRange | null;

package/dist/src/core/patch-policy.js

@@ -61,8 +61,8 @@ function reservedRangeForOrder(cfg, order) {
 }
 /**
  * Returns the configured range that contains `order` for `category`, or
- * null when no such range exists. Exported for the forward-import hint
- *, which suppresses ordinal suggestions the reorder policy
+ * null when no such range exists. Exported for the forward-import hint,
+ * which suppresses ordinal suggestions the reorder policy
  * would refuse.
  */
 export function categoryRangeForOrder(cfg, category, order) {

package/dist/src/core/patch-registration-refs.d.ts

@@ -1,17 +1,16 @@
 /**
  * Extracts furnace-shaped registration references from a patch body.
  *
- * 2026-04-24 eval Finding 1: `export-all --exclude-furnace` can land a
- * patch that registers a furnace component (via edits to
- * `toolkit/content/customElements.js`, `toolkit/content/jar.mn`, or
- * `toolkit/locales/jar.mn`) without including the component's source
- * files in the patch. `fireforge verify` then reports "Verify clean" for
- * the broken queue. This module provides a pattern-scoped scan so
+ * `export-all --exclude-furnace` can land a patch that registers a furnace
+ * component (via edits to `toolkit/content/customElements.js`,
+ * `toolkit/content/jar.mn`, or `toolkit/locales/jar.mn`) without including
+ * the component's source files, and `fireforge verify` then reports "Verify
+ * clean" for the broken queue. This module provides a pattern-scoped scan so
  * `verify` can cross-check registrations against available file bodies.
  *
  * The scan is deliberately narrow: it only matches component-shaped
- * references (widget tag names, locale fluent names). Unrelated jar.mn
- * or customElements.js edits pass through without spurious warnings.
+ * references (widget tag names, locale fluent names). Unrelated jar.mn or
+ * customElements.js edits pass through without spurious warnings.
  */
 /**
  * A referenced engine path extracted from a registration hunk, together

package/dist/src/core/patch-registration-refs.js

@@ -2,18 +2,18 @@
 /**
  * Extracts furnace-shaped registration references from a patch body.
  *
- * 2026-04-24 eval Finding 1: `export-all --exclude-furnace` can land a
- * patch that registers a furnace component (via edits to
- * `toolkit/content/customElements.js`, `toolkit/content/jar.mn`, or
- * `toolkit/locales/jar.mn`) without including the component's source
- * files in the patch. `fireforge verify` then reports "Verify clean" for
- * the broken queue. This module provides a pattern-scoped scan so
+ * `export-all --exclude-furnace` can land a patch that registers a furnace
+ * component (via edits to `toolkit/content/customElements.js`,
+ * `toolkit/content/jar.mn`, or `toolkit/locales/jar.mn`) without including
+ * the component's source files, and `fireforge verify` then reports "Verify
+ * clean" for the broken queue. This module provides a pattern-scoped scan so
  * `verify` can cross-check registrations against available file bodies.
  *
  * The scan is deliberately narrow: it only matches component-shaped
- * references (widget tag names, locale fluent names). Unrelated jar.mn
- * or customElements.js edits pass through without spurious warnings.
+ * references (widget tag names, locale fluent names). Unrelated jar.mn or
+ * customElements.js edits pass through without spurious warnings.
  */
+import { WIDGETS_DIR } from './furnace-constants.js';
 import { parseDiffSections } from './patch-parse.js';
 /** Canonical file paths that registration-shaped diffs touch. */
 const REGISTRATION_FILE_PATHS = new Set([
@@ -99,7 +99,7 @@ function extractTargetPathsFromRegistrationLine(sourceFile, added) {
         if (elementMatch?.[1] && elementMatch[2]) {
             const tag = elementMatch[1];
             const fileStem = elementMatch[2];
-            return [`toolkit/content/widgets/${tag}/${fileStem}.mjs`];
+            return [`${WIDGETS_DIR}/${tag}/${fileStem}.mjs`];
         }
         return [];
     }

package/dist/src/core/process-cpu-time.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Reads a process's accumulated CPU seconds.
+ *
+ * Best-effort: a missing `ps`, an exited process, or an unparseable field
+ * yields `undefined`, which callers must render as "unknown" rather than as
+ * zero — reporting a live build as having used no CPU would invert the very
+ * diagnosis this exists for.
+ *
+ * @param pid - Process to inspect
+ * @returns Accumulated CPU seconds, or `undefined` when unmeasurable
+ */
+export declare function readProcessCpuSeconds(pid: number): Promise<number | undefined>;

package/dist/src/core/process-cpu-time.js

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Accumulated-CPU-time probe for a single PID.
+ *
+ * Exists to answer the one question `kill(pid, 0)` cannot: a lock holder
+ * that EXISTS may still be wedged. A downstream fork running five concurrent
+ * sessions on one checkout diagnosed exactly this by hand — "a holder at
+ * near-zero CPU is hung, not working" — after a queue stalled behind a
+ * command that had consumed 0.3 s of CPU in eleven minutes.
+ *
+ * It is reported as EVIDENCE, never as a verdict. A legitimately slow holder
+ * can also sit at low CPU while blocked on I/O or on a child process, so
+ * nothing keys a refusal, a kill, or a lock steal off this number.
+ */
+import { exec } from '../utils/process.js';
+import { parsePsDuration } from '../utils/ps-duration.js';
+/**
+ * Reads a process's accumulated CPU seconds.
+ *
+ * Best-effort: a missing `ps`, an exited process, or an unparseable field
+ * yields `undefined`, which callers must render as "unknown" rather than as
+ * zero — reporting a live build as having used no CPU would invert the very
+ * diagnosis this exists for.
+ *
+ * @param pid - Process to inspect
+ * @returns Accumulated CPU seconds, or `undefined` when unmeasurable
+ */
+export async function readProcessCpuSeconds(pid) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return undefined;
+    try {
+        if (process.platform === 'win32') {
+            const result = await exec('powershell.exe', [
+                '-NoProfile',
+                '-NonInteractive',
+                '-Command',
+                `(Get-Process -Id ${String(pid)} -ErrorAction SilentlyContinue).CPU`,
+            ]);
+            const seconds = Number.parseFloat(result.stdout.trim());
+            return Number.isFinite(seconds) ? seconds : undefined;
+        }
+        const result = await exec('ps', ['-p', String(pid), '-o', 'time=']);
+        const field = result.stdout.split(/\r?\n/).find((line) => line.trim().length > 0);
+        if (field === undefined)
+            return undefined;
+        const seconds = parsePsDuration(field);
+        return Number.isNaN(seconds) ? undefined : seconds;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/src/core/rebase-session.d.ts

@@ -6,16 +6,34 @@
  */
 import type { FirefoxProduct } from '../types/config.js';
 export type RebasePatchStatus = 'pending' | 'applied-clean' | 'applied-fuzz' | 'failed' | 'resolved' | 'skipped';
-export interface RebasePatchEntry {
+/**
+ * One patch's outcome in a rebase session.
+ *
+ * A discriminated union on `status`, so a payload can only be present on the
+ * status it belongs to. A flat-optionals shape makes
+ * `{ status: 'resolved', error, conflictingFiles }` representable, and
+ * `rebase --continue` will write it — flipping the status without clearing
+ * the failure payload, then persisting that to the session file.
+ *
+ * The on-disk validator (`isValidPatchEntry`) is deliberately NOT tightened
+ * to match. The session file carries no schema version, so a stricter
+ * validator would reject an older file mid-rebase, where the only remedies
+ * discard the operator's in-progress conflict resolution. Instead
+ * {@link normalizeEntry} drops payload that does not belong to the status on
+ * read, so an older file loads and is corrected rather than refused.
+ */
+export type RebasePatchEntry = {
     filename: string;
-    status: RebasePatchStatus;
-    /** Fuzz factor used when status is `applied-fuzz`. */
-    fuzzFactor?: number;
-    /** Error message when status is `failed`. */
+} & ({
+    status: 'pending' | 'applied-clean' | 'skipped' | 'resolved';
+} | {
+    status: 'applied-fuzz';
+    fuzzFactor: number;
+} | {
+    status: 'failed';
     error?: string;
-    /** Files that caused conflicts. */
     conflictingFiles?: string[];
-}
+});
 export interface RebaseSession {
     /** ISO timestamp when the rebase started. */
     startedAt: string;
@@ -39,12 +57,11 @@ export interface RebaseSession {
  * discriminated-union form rather than collapsing three states into `null`.
  *
  * Distinguishing `present: false` from `present: true, valid: false` is
- * load-bearing. Before 0.41.0 both returned `null` while
- * {@link hasActiveRebaseSession} reported liveness from `pathExists` alone, so
- * an invalid session file wedged the operator in a closed cycle: `rebase` said
- * "already in progress — use --continue or --abort", and both of those said
- * "no rebase session in progress". No CLI path deleted the file and no message
- * named it, so the only escape was knowing to `rm` it by hand.
+ * load-bearing. Collapsing both to `null` while reporting liveness from
+ * `pathExists` alone wedges the operator in a closed cycle: `rebase` says
+ * "already in progress — use --continue or --abort", and both of those say
+ * "no rebase session in progress", with no CLI path deleting the file and no
+ * message naming it.
  */
 export type RebaseSessionRead = {
     present: false;
@@ -62,14 +79,15 @@ export declare function getRebaseSessionPath(projectRoot: string): string;
 /**
  * Reads the session file, reporting absent, valid, and corrupt as three
  * distinct outcomes. Never throws for a malformed file: `readJson` calls
- * `JSON.parse` with no guard of its own, so an interrupted write surfaced a
- * raw `SyntaxError` out of `--continue`/`--abort` before 0.41.0.
+ * `JSON.parse` with no guard of its own, so an interrupted write would
+ * otherwise surface a raw `SyntaxError` out of `--continue`/`--abort`.
  *
  * A single read determines liveness and validity: only ENOENT/ENOTDIR from
- * that read mean `absent`. A pathExists pre-probe both raced deletion (a file
- * removed between probe and read misreported an absent session as corrupt)
- * and swallowed EACCES (an unreadable `.fireforge/` misreported a session as
- * absent) — the same failure `readTreeMarkerState` fixed for tree markers.
+ * that read mean `absent`. A pathExists pre-probe both races deletion (a
+ * file removed between probe and read misreports an absent session as
+ * corrupt) and swallows EACCES (an unreadable `.fireforge/` misreports a
+ * session as absent) — the same failure `readTreeMarker` avoids for tree
+ * markers.
  */
 export declare function readRebaseSession(projectRoot: string): Promise<RebaseSessionRead>;
 /**
@@ -77,7 +95,7 @@ export declare function readRebaseSession(projectRoot: string): Promise<RebaseSe
  * file on disk is unusable. Callers that must tell those two apart — every
  * command that reports to an operator — should use {@link readRebaseSession}.
  */
-export declare function loadRebaseSession(projectRoot: string): Promise<RebaseSession | null>;
+export declare function tryReadRebaseSession(projectRoot: string): Promise<RebaseSession | null>;
 /**
  * Persists a rebase session atomically.
  */
@@ -86,9 +104,3 @@ export declare function saveRebaseSession(projectRoot: string, session: RebaseSe
  * Removes the rebase session file.
  */
 export declare function clearRebaseSession(projectRoot: string): Promise<void>;
-/**
- * Returns `true` when a rebase session file exists on disk, valid or not.
- * Test-facing convenience — production code reads `readRebaseSession` once
- * instead, so liveness and validity come from the same read.
- */
-export declare function hasActiveRebaseSession(projectRoot: string): Promise<boolean>;

package/dist/src/core/rebase-session.js

@@ -25,6 +25,31 @@ const REBASE_PATCH_STATUSES = [
     'skipped',
 ];
 /** Validates one `patches[]` element to its declared shape. */
+/**
+ * Drops payload that does not belong to an entry's status.
+ *
+ * Applied on read so a session written by an older FireForge — where
+ * `rebase --continue` left `error`/`conflictingFiles` on a now-`resolved`
+ * entry — loads cleanly and is corrected, instead of being refused by a
+ * stricter validator mid-rebase.
+ *
+ * @param entry - A structurally valid entry, possibly carrying stale payload
+ * @returns The entry with only the fields its status permits
+ */
+function normalizeEntry(entry) {
+    if (entry.status === 'applied-fuzz') {
+        return { filename: entry.filename, status: 'applied-fuzz', fuzzFactor: entry.fuzzFactor };
+    }
+    if (entry.status === 'failed') {
+        return {
+            filename: entry.filename,
+            status: 'failed',
+            ...(entry.error !== undefined ? { error: entry.error } : {}),
+            ...(entry.conflictingFiles !== undefined ? { conflictingFiles: entry.conflictingFiles } : {}),
+        };
+    }
+    return { filename: entry.filename, status: entry.status };
+}
 function isValidPatchEntry(value) {
     if (!isObject(value))
         return false;
@@ -50,19 +75,19 @@ function isValidOptionalProduct(value) {
  * Validates a session file against the shape the rebase commands actually
  * consume — not merely against broad field types.
  *
- * The looser predicate this replaces checked six `typeof`s and nothing else,
- * which admitted sessions the resume path then acted on. `patches: [null]`
- * reached `patch-loop.ts`, which reads `.filename` off each entry and hands it
- * to `stampPatchVersions`. A `currentIndex` of `NaN` (legal for
- * `typeof === 'number'`) made the resume loop run zero iterations and report
- * success; a negative one indexed out of range in `continue.ts`. `toVersion:
- * ""` passed `isString` and was stamped verbatim onto every Furnace override's
- * `baseVersion`. `fromProduct`/`toProduct` were not checked at all despite
- * being typed `FirefoxProduct`.
+ * A looser predicate that checks six `typeof`s and nothing else admits
+ * sessions the resume path then acts on. `patches: [null]` reaches
+ * `patch-loop.ts`, which reads `.filename` off each entry and hands it to
+ * `stampPatchVersions`. A `currentIndex` of `NaN` (legal for
+ * `typeof === 'number'`) makes the resume loop run zero iterations and
+ * report success; a negative one indexes out of range in `continue.ts`.
+ * `toVersion: ""` passes `isString` and is stamped verbatim onto every
+ * Furnace override's `baseVersion`. `fromProduct`/`toProduct` go unchecked
+ * despite being typed `FirefoxProduct`.
  *
- * The session file is written only by `rebase/index.ts` from validated CLI and
- * config values, so every one of these is a corrupt-file or hand-edit case —
- * which is exactly the case this predicate exists to catch.
+ * The session file is written only by `rebase/index.ts` from validated CLI
+ * and config values, so every one of these is a corrupt-file or hand-edit
+ * case — which is exactly what this predicate exists to catch.
  */
 function isValidSession(data) {
     if (!isObject(data))
@@ -98,14 +123,15 @@ export function getRebaseSessionPath(projectRoot) {
 /**
  * Reads the session file, reporting absent, valid, and corrupt as three
  * distinct outcomes. Never throws for a malformed file: `readJson` calls
- * `JSON.parse` with no guard of its own, so an interrupted write surfaced a
- * raw `SyntaxError` out of `--continue`/`--abort` before 0.41.0.
+ * `JSON.parse` with no guard of its own, so an interrupted write would
+ * otherwise surface a raw `SyntaxError` out of `--continue`/`--abort`.
  *
  * A single read determines liveness and validity: only ENOENT/ENOTDIR from
- * that read mean `absent`. A pathExists pre-probe both raced deletion (a file
- * removed between probe and read misreported an absent session as corrupt)
- * and swallowed EACCES (an unreadable `.fireforge/` misreported a session as
- * absent) — the same failure `readTreeMarkerState` fixed for tree markers.
+ * that read mean `absent`. A pathExists pre-probe both races deletion (a
+ * file removed between probe and read misreports an absent session as
+ * corrupt) and swallows EACCES (an unreadable `.fireforge/` misreports a
+ * session as absent) — the same failure `readTreeMarker` avoids for tree
+ * markers.
  */
 export async function readRebaseSession(projectRoot) {
     const path = sessionPath(projectRoot);
@@ -122,14 +148,23 @@ export async function readRebaseSession(projectRoot) {
     if (!isValidSession(data)) {
         return { present: true, valid: false, reason: 'the file is not a valid rebase session' };
     }
-    return { present: true, valid: true, session: data };
+    // Normalize on read: an older session can carry a failure's
+    // `error`/`conflictingFiles` on an entry whose status has since been
+    // flipped to `resolved`. Correcting it here is what lets the validator
+    // stay permissive, so an in-flight rebase from an older FireForge still
+    // loads.
+    return {
+        present: true,
+        valid: true,
+        session: { ...data, patches: data.patches.map(normalizeEntry) },
+    };
 }
 /**
  * Loads an existing rebase session, or returns `null` when none exists or the
  * file on disk is unusable. Callers that must tell those two apart — every
  * command that reports to an operator — should use {@link readRebaseSession}.
  */
-export async function loadRebaseSession(projectRoot) {
+export async function tryReadRebaseSession(projectRoot) {
     const result = await readRebaseSession(projectRoot);
     return result.present && result.valid ? result.session : null;
 }
@@ -151,11 +186,3 @@ export async function clearRebaseSession(projectRoot) {
         await removeFile(path);
     }
 }
-/**
- * Returns `true` when a rebase session file exists on disk, valid or not.
- * Test-facing convenience — production code reads `readRebaseSession` once
- * instead, so liveness and validity come from the same read.
- */
-export async function hasActiveRebaseSession(projectRoot) {
-    return pathExists(sessionPath(projectRoot));
-}