@hominis/fireforge 0.43.1 → 0.44.1

package/dist/src/commands/export-shared.d.ts

@@ -3,26 +3,26 @@ import type { ExportOptions, PatchCategory } from '../types/commands/index.js';
 import type { FireForgeConfig } from '../types/config.js';
 import type { SpinnerHandle } from '../utils/logger.js';
 /**
- * Runs the full patch lint pipeline and reports results.
- * Warnings are always displayed. Errors block the export unless skipLint is true.
+ * Runs the full patch lint pipeline and reports results. Warnings are always
+ * displayed. Errors block the export unless skipLint is true.
  *
  * @param engineDir - Engine root directory
  * @param filesAffected - Files touched by the patch
  * @param diffContent - Raw unified diff string
  * @param config - Project configuration
  * @param skipLint - If true, downgrade errors to warnings
- * @param patchQueueCtx - Optional cross-patch context for ownership resolution
+ * @param patchQueueCtx - Optional cross-patch context for ownership
+ *   resolution
  * @param ignoreChecks - Optional per-patch set of `check` IDs to suppress
  *   (threaded from `PatchMetadata.lintIgnore`). Surgical alternative to
  *   `--skip-lint` when exactly one advisory rule does not apply to a
- *   specific patch — e.g. `large-patch-lines` on a cohesive branding
- *   bundle that genuinely cannot be split.
+ *   specific patch — e.g. `large-patch-lines` on a cohesive branding bundle
+ *   that genuinely cannot be split.
  * @param patchTier - Optional explicit tier override (threaded from
- *   `PatchMetadata.tier`). Forces the branding-tier thresholds when
- *   set, independent of the auto-detect allowlist. When the branding
- *   tier is applied (either via this opt-in or the auto-detect), a
- *   single `info()` line surfaces the choice so the tier decision is
- *   visible rather than silent.
+ *   `PatchMetadata.tier`). Forces the branding-tier thresholds when set,
+ *   independent of the auto-detect allowlist. When the branding tier is
+ *   applied, a single `info()` line surfaces the choice so the tier decision
+ *   is visible rather than silent.
  */
 export declare function runPatchLint(engineDir: string, filesAffected: string[], diffContent: string, config: FireForgeConfig, skipLint?: boolean, patchQueueCtx?: import('../core/patch-lint-cross.js').PatchQueueContext, ignoreChecks?: ReadonlySet<string>, patchTier?: 'branding'): Promise<void>;
 /**
@@ -55,18 +55,18 @@ export declare function confirmSupersedePatches(patchesDir: string, filesAffecte
 /**
  * Detects new files missing license headers and offers to add them.
  *
- * In interactive mode the user is prompted before any files are modified.
- * In non-interactive mode the function is a no-op — the existing lint error
- * will block the export instead.
+ * In interactive mode the user is prompted before any files are modified. In
+ * non-interactive mode the function is a no-op — the existing lint error
+ * blocks the export instead.
  *
  * @param engineDir - Absolute path to engine directory
  * @param diffContent - Current unified diff
  * @param config - Project configuration
  * @param isInteractive - Whether interactive prompts are available
  * @param dryRun - When true, only REPORT missing headers, never prompt or
- *   write. Dry-run must stay read-only: before this flag existed, an
- *   interactive `export --dry-run` prompted (default Yes) and wrote license
- *   headers into engine/ files, then closed with "no changes made".
+ *   write. Dry-run must stay read-only: without this flag an interactive
+ *   `export --dry-run` prompts (default Yes), writes license headers into
+ *   engine/ files, and then closes with "no changes made".
  * @returns true if files were modified on disk (caller must regenerate diff)
  */
 export declare function autoFixLicenseHeaders(engineDir: string, diffContent: string, config: FireForgeConfig, isInteractive: boolean, dryRun?: boolean): Promise<boolean>;
@@ -83,19 +83,17 @@ export declare function autoFixLicenseHeaders(engineDir: string, diffContent: st
 export declare function findPartialOwnershipOverlap(manifest: PatchesManifest, filesAffected: string[], excludeFilenames: ReadonlySet<string>): Map<string, string[]>;
 /**
  * Gate that refuses the default export path when the new patch would
- * silently claim files that are already tracked by other non-superseded
- * patches. `findAllPatchesForFiles` already catches the full-coverage
- * supersede case — this helper fills the gap for partial overlap, which
- * was the eval finding #12 scenario (two patches both claiming
- * `browser/themes/shared/jar.inc.mn` after a second export with
- * `--before`).
+ * silently claim files already tracked by other non-superseded patches.
+ * `findAllPatchesForFiles` catches the full-coverage supersede case; this
+ * fills the gap for PARTIAL overlap — two patches both claiming e.g.
+ * `browser/themes/shared/jar.inc.mn` after a second export with `--before`.
  *
  * Proceeds silently when there is no overlap, or when the caller passed
  * `--allow-overlap`. In interactive mode the caller is prompted to
  * acknowledge the overlap (the proper fix path is `re-export --files` to
  * repartition ownership, so the prompt surfaces that pointer). In
- * non-interactive mode the function throws — better to fail fast than
- * let the queue fall out of sync with verify.
+ * non-interactive mode it throws — better to fail fast than let the queue
+ * fall out of sync with verify.
  */
 export declare function guardOwnershipOverlap(args: {
     patchesDir: string;
@@ -107,13 +105,12 @@ export declare function guardOwnershipOverlap(args: {
 }): Promise<boolean>;
 /**
  * Runs the two pre-commit gates shared by `export` and `export-all` in
- * order: the supersede confirmation, then the cross-patch ownership
- * overlap guard. The overlap guard receives the filenames of the patches
- * the export would fully supersede so it does not flag a file claimed by
- * a patch that is about to be removed (pre-0.16.0 `export` only caught
- * FULL-coverage supersedes, so a second export targeting a shared file
- * like `browser/themes/shared/jar.inc.mn` created a queue where two
- * patches both claimed the file and `verify` failed immediately).
+ * order: the supersede confirmation, then the cross-patch ownership overlap
+ * guard. The overlap guard receives the filenames of the patches the export
+ * would fully supersede so it does not flag a file claimed by a patch that
+ * is about to be removed. Catching only FULL-coverage supersedes leaves a
+ * second export targeting a shared file creating a queue where two patches
+ * both claim it and `verify` fails immediately.
  *
  * @param args - Gate inputs shared by both export commands
  * @param args.patchesDir - Absolute path of the patches directory
@@ -122,8 +119,8 @@ export declare function guardOwnershipOverlap(args: {
  * @param args.allowOverlap - The command's `--allow-overlap` flag
  * @param args.isInteractive - Whether prompting the operator is possible
  * @param args.s - Active spinner, stopped before any prompt
- * @returns `true` when both gates passed; `false` when the operator
- *   declined (the caller returns without committing)
+ * @returns `true` when both gates passed; `false` when the operator declined
+ *   (the caller returns without committing)
  */
 export declare function runSupersedeAndOverlapGates(args: {
     patchesDir: string;

package/dist/src/commands/export-shared.js

@@ -10,36 +10,36 @@ import { getPatchPolicyCategories, isCategoryAllowedByConfig } from '../core/pat
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { pathExists, readText } from '../utils/fs.js';
 import { cancel, info, isCancel, warn } from '../utils/logger.js';
-import { normalizePatchDisplayName, PATCH_CATEGORIES, validatePatchName, } from '../utils/validation.js';
+import { describePatchNameProblem, normalizePatchDisplayName, PATCH_CATEGORIES, } from '../utils/validation.js';
 /**
- * Runs the full patch lint pipeline and reports results.
- * Warnings are always displayed. Errors block the export unless skipLint is true.
+ * Runs the full patch lint pipeline and reports results. Warnings are always
+ * displayed. Errors block the export unless skipLint is true.
  *
  * @param engineDir - Engine root directory
  * @param filesAffected - Files touched by the patch
  * @param diffContent - Raw unified diff string
  * @param config - Project configuration
  * @param skipLint - If true, downgrade errors to warnings
- * @param patchQueueCtx - Optional cross-patch context for ownership resolution
+ * @param patchQueueCtx - Optional cross-patch context for ownership
+ *   resolution
  * @param ignoreChecks - Optional per-patch set of `check` IDs to suppress
  *   (threaded from `PatchMetadata.lintIgnore`). Surgical alternative to
  *   `--skip-lint` when exactly one advisory rule does not apply to a
- *   specific patch — e.g. `large-patch-lines` on a cohesive branding
- *   bundle that genuinely cannot be split.
+ *   specific patch — e.g. `large-patch-lines` on a cohesive branding bundle
+ *   that genuinely cannot be split.
  * @param patchTier - Optional explicit tier override (threaded from
- *   `PatchMetadata.tier`). Forces the branding-tier thresholds when
- *   set, independent of the auto-detect allowlist. When the branding
- *   tier is applied (either via this opt-in or the auto-detect), a
- *   single `info()` line surfaces the choice so the tier decision is
- *   visible rather than silent.
+ *   `PatchMetadata.tier`). Forces the branding-tier thresholds when set,
+ *   independent of the auto-detect allowlist. When the branding tier is
+ *   applied, a single `info()` line surfaces the choice so the tier decision
+ *   is visible rather than silent.
  */
 export async function runPatchLint(engineDir, filesAffected, diffContent, config, skipLint, patchQueueCtx, ignoreChecks, patchTier) {
-    // Compute the tier decision independently of the lint pipeline so the
-    // decision can be surfaced even when the rule body emitted no issues
-    // (e.g. a branding patch under the soft threshold still benefits from
-    // operators knowing which tier governed the run). The same helper is
-    // reused inside `lintPatchSize`, so the surfaced tier and the tier
-    // that actually drove the thresholds never drift.
+    // Compute the tier decision independently of the lint pipeline so it can
+    // be surfaced even when the rule body emitted no issues — a branding patch
+    // under the soft threshold still benefits from operators knowing which
+    // tier governed the run. The same helper is reused inside `lintPatchSize`,
+    // so the surfaced tier and the tier that actually drove the thresholds
+    // never drift.
     const tierDecision = resolvePatchSizeTier(filesAffected, patchTier);
     if (tierDecision.tier === 'branding') {
         info(tierDecision.source === 'explicit'
@@ -54,7 +54,12 @@ export async function runPatchLint(engineDir, filesAffected, diffContent, config
     const checkJsReportScope = patchQueueCtx
         ? resolvePatchOwnedSysMjs(detectNewFilesInDiff(diffContent))
         : undefined;
-    const issues = await lintExportedPatch(engineDir, filesAffected, diffContent, config, patchQueueCtx, ignoreChecks, patchTier, checkJsReportScope ? { checkJsReportScope } : undefined);
+    const issues = await lintExportedPatch(engineDir, filesAffected, diffContent, config, {
+        ...(patchQueueCtx ? { patchQueueCtx } : {}),
+        ...(ignoreChecks ? { ignoreChecks } : {}),
+        ...(patchTier ? { patchTier } : {}),
+        ...(checkJsReportScope ? { checkJsReportScope } : {}),
+    });
     reportPatchLintOutcome(issues, skipLint);
 }
 /**
@@ -115,7 +120,7 @@ export async function promptExportPatchMetadata(options, isInteractive, commandN
     // both name shapes.
     let patchName = options.name?.trim().replace(/\.patch$/i, '');
     if (patchName) {
-        const validationError = validatePatchName(patchName);
+        const validationError = describePatchNameProblem(patchName);
         if (validationError) {
             throw new InvalidArgumentError(validationError, '--name');
         }
@@ -127,7 +132,7 @@ export async function promptExportPatchMetadata(options, isInteractive, commandN
         const nameResult = await text({
             message: 'Enter a name for this patch:',
             placeholder: commandName === 'export' ? 'my-change' : 'my-changes',
-            validate: (value) => validatePatchName((value ?? '').trim()),
+            validate: (value) => describePatchNameProblem((value ?? '').trim()),
         });
         if (isCancel(nameResult)) {
             cancel('Export cancelled');
@@ -217,18 +222,18 @@ export async function confirmSupersedePatches(patchesDir, filesAffected, superse
 /**
  * Detects new files missing license headers and offers to add them.
  *
- * In interactive mode the user is prompted before any files are modified.
- * In non-interactive mode the function is a no-op — the existing lint error
- * will block the export instead.
+ * In interactive mode the user is prompted before any files are modified. In
+ * non-interactive mode the function is a no-op — the existing lint error
+ * blocks the export instead.
  *
  * @param engineDir - Absolute path to engine directory
  * @param diffContent - Current unified diff
  * @param config - Project configuration
  * @param isInteractive - Whether interactive prompts are available
  * @param dryRun - When true, only REPORT missing headers, never prompt or
- *   write. Dry-run must stay read-only: before this flag existed, an
- *   interactive `export --dry-run` prompted (default Yes) and wrote license
- *   headers into engine/ files, then closed with "no changes made".
+ *   write. Dry-run must stay read-only: without this flag an interactive
+ *   `export --dry-run` prompts (default Yes), writes license headers into
+ *   engine/ files, and then closes with "no changes made".
  * @returns true if files were modified on disk (caller must regenerate diff)
  */
 export async function autoFixLicenseHeaders(engineDir, diffContent, config, isInteractive, dryRun = false) {
@@ -324,19 +329,17 @@ export function findPartialOwnershipOverlap(manifest, filesAffected, excludeFile
 }
 /**
  * Gate that refuses the default export path when the new patch would
- * silently claim files that are already tracked by other non-superseded
- * patches. `findAllPatchesForFiles` already catches the full-coverage
- * supersede case — this helper fills the gap for partial overlap, which
- * was the eval finding #12 scenario (two patches both claiming
- * `browser/themes/shared/jar.inc.mn` after a second export with
- * `--before`).
+ * silently claim files already tracked by other non-superseded patches.
+ * `findAllPatchesForFiles` catches the full-coverage supersede case; this
+ * fills the gap for PARTIAL overlap — two patches both claiming e.g.
+ * `browser/themes/shared/jar.inc.mn` after a second export with `--before`.
  *
  * Proceeds silently when there is no overlap, or when the caller passed
  * `--allow-overlap`. In interactive mode the caller is prompted to
  * acknowledge the overlap (the proper fix path is `re-export --files` to
  * repartition ownership, so the prompt surfaces that pointer). In
- * non-interactive mode the function throws — better to fail fast than
- * let the queue fall out of sync with verify.
+ * non-interactive mode it throws — better to fail fast than let the queue
+ * fall out of sync with verify.
  */
 export async function guardOwnershipOverlap(args) {
     const { patchesDir, filesAffected, supersedingFilenames, allowOverlap, isInteractive, s } = args;
@@ -373,13 +376,12 @@ export async function guardOwnershipOverlap(args) {
 }
 /**
  * Runs the two pre-commit gates shared by `export` and `export-all` in
- * order: the supersede confirmation, then the cross-patch ownership
- * overlap guard. The overlap guard receives the filenames of the patches
- * the export would fully supersede so it does not flag a file claimed by
- * a patch that is about to be removed (pre-0.16.0 `export` only caught
- * FULL-coverage supersedes, so a second export targeting a shared file
- * like `browser/themes/shared/jar.inc.mn` created a queue where two
- * patches both claimed the file and `verify` failed immediately).
+ * order: the supersede confirmation, then the cross-patch ownership overlap
+ * guard. The overlap guard receives the filenames of the patches the export
+ * would fully supersede so it does not flag a file claimed by a patch that
+ * is about to be removed. Catching only FULL-coverage supersedes leaves a
+ * second export targeting a shared file creating a queue where two patches
+ * both claim it and `verify` fails immediately.
  *
  * @param args - Gate inputs shared by both export commands
  * @param args.patchesDir - Absolute path of the patches directory
@@ -388,8 +390,8 @@ export async function guardOwnershipOverlap(args) {
  * @param args.allowOverlap - The command's `--allow-overlap` flag
  * @param args.isInteractive - Whether prompting the operator is possible
  * @param args.s - Active spinner, stopped before any prompt
- * @returns `true` when both gates passed; `false` when the operator
- *   declined (the caller returns without committing)
+ * @returns `true` when both gates passed; `false` when the operator declined
+ *   (the caller returns without committing)
  */
 export async function runSupersedeAndOverlapGates(args) {
     const { patchesDir, filesAffected, supersede, allowOverlap, isInteractive, s } = args;

package/dist/src/commands/export.js

@@ -3,11 +3,12 @@ import { stat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { Command, Option } from 'commander';
 import { getProjectPaths, loadConfig } from '../core/config.js';
-import { appendHistory } from '../core/destructive.js';
+import { appendHistory, stdioIsInteractive } from '../core/destructive.js';
+import { assertEngineGitReady } from '../core/engine-precondition.js';
 import { withEngineSessionLock } from '../core/engine-session-lock.js';
 import { collectFurnaceManagedPrefixes } from '../core/furnace-config.js';
 import { enforceFreshFurnaceSources } from '../core/furnace-stale-export.js';
-import { getStatusWithCodes, isGitRepository } from '../core/git.js';
+import { getStatusWithCodes } from '../core/git.js';
 import { generateBinaryFilePatch, generateFullFilePatch } from '../core/git-diff.js';
 import { isBinaryFile } from '../core/git-file-ops.js';
 import { getModifiedFilesInDir, getUntrackedFiles, getUntrackedFilesInDir, } from '../core/git-status.js';
@@ -33,11 +34,10 @@ async function collectExportFiles(paths, files) {
     let untrackedFiles;
     // Accept both repo-root-relative (`engine/browser/...`) and engine-relative
     // (`browser/...`) paths for every input, matching `register`/`test`/`lint`.
-    // Previously, an `engine/`-prefixed path fell through to
-    // `File "engine/..." has no changes to export.` because the status lookup
-    // sees paths relative to `paths.engine` and the explicit prefix double-
-    // rooted the candidate. `stripEnginePrefix` makes that user-facing form
-    // a no-op for the lookup pipeline.
+    // Without the strip, an `engine/`-prefixed path falls through to
+    // `File "engine/..." has no changes to export.`: the status lookup sees
+    // paths relative to `paths.engine`, so the explicit prefix double-roots the
+    // candidate.
     for (const rawInputPath of files) {
         const inputPath = stripEnginePrefix(rawInputPath);
         const fullInputPath = join(paths.engine, inputPath);
@@ -88,13 +88,14 @@ async function collectExportFiles(paths, files) {
     return { files: [...collectedFiles].sort(), fromDirectory };
 }
 /**
- * Auto-excludes directory-derived files already owned by OTHER patches
- * (0.34.0 field report): a directory export used to plan files owned by
- * earlier patches into the new patch, and the duplicate-new-file-creation
- * refusal surfaced only at placement lint, suggesting --force-unsafe —
- * the wrong tool for "leave that file with its owner". Explicitly named
- * files are never excluded (the overlap gates still confront the operator
- * with those). Prints one notice per exclusion.
+ * Auto-excludes directory-derived files already owned by OTHER patches.
+ *
+ * A directory export otherwise plans files owned by earlier patches into the
+ * new patch, and the duplicate-new-file-creation refusal surfaces only at
+ * placement lint, suggesting `--force-unsafe` — the wrong tool for "leave
+ * that file with its owner". Explicitly named files are never excluded (the
+ * overlap gates still confront the operator with those). Prints one notice
+ * per exclusion.
  */
 async function excludeFilesOwnedByOtherPatches(patchesDir, collected) {
     if (collected.fromDirectory.size === 0)
@@ -169,14 +170,7 @@ async function prepareExport(projectRoot, files, options) {
         throw new InvalidArgumentError('--order, --before, and --after are mutually exclusive.', 'export placement');
     }
     const paths = getProjectPaths(projectRoot);
-    // Check if engine exists
-    if (!(await pathExists(paths.engine))) {
-        throw new GeneralError('Firefox source not found. Run "fireforge download" first.');
-    }
-    // Check if it's a git repository
-    if (!(await isGitRepository(paths.engine))) {
-        throw new GeneralError('Engine directory is not a git repository. Run "fireforge download" to initialize.');
-    }
+    await assertEngineGitReady(paths.engine);
     const collected = await collectExportFiles(paths, files);
     let allFiles = await excludeFilesOwnedByOtherPatches(paths.patches, collected);
     const ownershipExclusions = collected.files.length - allFiles.length;
@@ -202,10 +196,10 @@ async function prepareExport(projectRoot, files, options) {
         throw new GeneralError(`Paths "${pathList}" have no changes to export.\n\n` +
             'Run "fireforge status" to see modified files.');
     }
-    // Stale-furnace-source gate (0.37.0 item 4): the export captures deployed
-    // engine copies; refuse (or warn under --allow-stale-furnace) when a
-    // covered component's source changed since the last furnace apply. Runs
-    // after --exclude-furnace so excluded furnace files never trigger it.
+    // Stale-furnace-source gate: the export captures deployed engine copies,
+    // so refuse (or warn under --allow-stale-furnace) when a covered
+    // component's source changed since the last furnace apply. Runs after
+    // --exclude-furnace so excluded furnace files never trigger it.
     await enforceFreshFurnaceSources(projectRoot, allFiles, options.allowStaleFurnace === true, 'export');
     let diff = await generatePatchDiff(paths.engine, allFiles);
     if (!diff.trim()) {
@@ -222,7 +216,7 @@ async function prepareExport(projectRoot, files, options) {
         await ensureDir(paths.patches);
     }
     const config = await loadConfig(projectRoot);
-    const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
+    const isInteractive = stdioIsInteractive();
     // Auto-fix missing license headers on new files (interactive only;
     // report-only under --dry-run so the preview never mutates engine/)
     const headersAdded = await autoFixLicenseHeaders(paths.engine, diff, config, isInteractive, options.dryRun ?? false);

package/dist/src/commands/furnace/apply.js

@@ -1,11 +1,12 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { watch as fsWatch } from 'node:fs';
-import { getProjectPaths, loadConfig } from '../../core/config.js';
+import { loadConfig } from '../../core/config.js';
 import { applyAllComponents, computeComponentChecksums } from '../../core/furnace-apply.js';
 import { logApplyResult } from '../../core/furnace-apply-output.js';
-import { furnaceConfigExists, getFurnacePaths, loadFurnaceConfig, } from '../../core/furnace-config.js';
+import { getFurnacePaths } from '../../core/furnace-config.js';
 import { isComponentSourceFile } from '../../core/furnace-constants.js';
 import { runFurnaceMutation } from '../../core/furnace-operation.js';
+import { assertFurnaceReady } from '../../core/furnace-precondition.js';
 import { getPersistableAppliedEntry, persistSingleComponentState, shouldPersistSingleComponentState, } from '../../core/furnace-state-persist.js';
 import { countEntriesWithBlockingStepErrors } from '../../core/furnace-step-errors.js';
 import { findOverrideBaseVersionDrift, formatOverrideBaseVersionDriftError, formatOverrideBaseVersionDriftWarning, } from '../../core/furnace-version-drift.js';
@@ -74,11 +75,10 @@ function classifyWatchApplyError(err) {
 async function runWatchLoop(projectRoot) {
     const furnacePaths = getFurnacePaths(projectRoot);
     // Both categories are eligible targets. The set is fixed; only existence
-    // varies over time — a component dir created AFTER watch started (e.g.
-    // the user runs `furnace create` in another terminal) must be picked up
-    // without restarting watch. The prior one-shot `pathExists` check at
-    // startup captured only the dirs that existed then, leaving any later
-    // creation invisible.
+    // varies over time — a component dir created AFTER watch started (the user
+    // running `furnace create` in another terminal) must be picked up without
+    // restarting watch. A one-shot `pathExists` check at startup captures only
+    // the dirs that existed then, leaving any later creation invisible.
     const candidateDirs = [furnacePaths.overridesDir, furnacePaths.customDir];
     const watchDirs = [];
     const watchers = new Map();
@@ -253,16 +253,7 @@ async function runWatchLoop(projectRoot) {
  */
 export async function furnaceApplyCommand(projectRoot, name, options = {}) {
     intro(name ? `Furnace Apply (${name})` : 'Furnace Apply');
-    // Verify engine exists
-    const paths = getProjectPaths(projectRoot);
-    if (!(await pathExists(paths.engine))) {
-        throw new FurnaceError('Engine directory not found. Run "fireforge download" first.');
-    }
-    // Load furnace config
-    if (!(await furnaceConfigExists(projectRoot))) {
-        throw new FurnaceError('No furnace.json found. Run "fireforge furnace create" or "fireforge furnace override" to get started.');
-    }
-    const config = await loadFurnaceConfig(projectRoot);
+    const { config } = await assertFurnaceReady(projectRoot);
     const overrideCount = Object.keys(config.overrides).length;
     const customCount = Object.keys(config.custom).length;
     if (overrideCount === 0 && customCount === 0) {
@@ -289,12 +280,12 @@ export async function furnaceApplyCommand(projectRoot, name, options = {}) {
         // `persistState: false` for a NAMED apply is load-bearing: the batch
         // persist path replaces `appliedChecksums` wholesale with only this
         // run's entries, and the batch loops filter to the named component —
-        // so routing a named apply through it persisted a state file
-        // containing ONLY that component, wiping every other component's
-        // checksums. Orphan detection and deleted-file undeploy both key on
-        // that state, so the wiped components' stale engine files became
-        // invisible to apply AND to `furnace validate`. Named apply merges
-        // per-component state below, exactly like `furnace deploy <name>`.
+        // so routing a named apply through it persists a state file containing
+        // ONLY that component, wiping every other component's checksums.
+        // Orphan detection and deleted-file undeploy both key on that state,
+        // so the wiped components' stale engine files become invisible to
+        // apply AND to `furnace validate`. Named apply merges per-component
+        // state below, exactly like `furnace deploy <name>`.
         const applyResult = await applyAllComponents(projectRoot, dryRun, {
             operationContext: ctx,
             ...(name !== undefined ? { componentName: name, persistState: false } : {}),

package/dist/src/commands/furnace/chrome-doc-remove.js

@@ -7,10 +7,11 @@ import { readdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { confirm } from '@clack/prompts';
 import { loadConfig } from '../../core/config.js';
-import { recordFurnaceRollbackFailure, runFurnaceMutation, } from '../../core/furnace-operation.js';
-import { createRollbackJournal, restoreRollbackJournalOrThrow, snapshotDir, snapshotFile, } from '../../core/furnace-rollback.js';
+import { stdioIsInteractive } from '../../core/destructive.js';
+import { completeJournalRollback, runFurnaceMutation, } from '../../core/furnace-operation.js';
+import { assertFurnaceEngineReady } from '../../core/furnace-precondition.js';
+import { createRollbackJournal, snapshotDir, snapshotFile } from '../../core/furnace-rollback.js';
 import { FurnaceError } from '../../errors/furnace.js';
-import { toError } from '../../utils/errors.js';
 import { pathExists, readText, removeDir, removeFile, writeText } from '../../utils/fs.js';
 import { cancel, info, intro, isCancel, note, outro } from '../../utils/logger.js';
 import { buildChromeDocPlan, validateChromeDocName } from './chrome-doc.js';
@@ -87,20 +88,12 @@ async function performChromeDocRemoveMutations(args) {
         await removeEmptyDirIfPresent(join(args.engineDir, 'browser/base/content/test', `${args.binaryName}-xpcshell`), journal);
     }
     catch (error) {
-        // This body owns its rollback end to end, so tell the lifecycle wrapper
-        // not to restore the same journal again on the way out.
-        args.operationContext.markRolledBack();
-        try {
-            await restoreRollbackJournalOrThrow(journal, `Failed to remove chrome-doc "${args.name}"`);
-        }
-        catch (rollbackError) {
-            // Matches the seven sibling mutation sites: a failed rollback leaves the
-            // engine in an unknown state, so record the repair breadcrumb and let
-            // the rollback error win rather than discarding it.
-            await recordFurnaceRollbackFailure(args.projectRoot, 'chrome-doc-rollback', `chrome-doc "${args.name}": ${toError(rollbackError).message}`);
-            throw rollbackError;
-        }
-        throw error;
+        return await completeJournalRollback(args.operationContext, journal, error, {
+            projectRoot: args.projectRoot,
+            operation: 'chrome-doc-rollback',
+            failureMessage: `Failed to remove chrome-doc "${args.name}"`,
+            subject: `chrome-doc "${args.name}"`,
+        });
     }
     return { removedFiles, removedJarEntries, removedTestDir };
 }
@@ -110,9 +103,9 @@ export async function furnaceChromeDocRemoveCommand(projectRoot, name, options =
     validateChromeDocName(name);
     const forgeConfig = await loadConfig(projectRoot);
     const engineDir = join(projectRoot, 'engine');
-    if (!(await pathExists(engineDir))) {
-        throw new FurnaceError('Engine directory not found. Run "fireforge download" first before removing a chrome-doc.');
-    }
+    await assertFurnaceEngineReady(projectRoot, {
+        engineMissingSuffix: ' before removing a chrome-doc.',
+    });
     const plan = await buildChromeDocPlan({
         engineDir,
         name,
@@ -125,7 +118,7 @@ export async function furnaceChromeDocRemoveCommand(projectRoot, name, options =
         outro('Dry run complete');
         return;
     }
-    const isInteractive = process.stdin.isTTY && process.stdout.isTTY;
+    const isInteractive = stdioIsInteractive();
     if (!options.yes && !isInteractive) {
         throw new FurnaceError(`Cannot remove chrome-doc "${name}" in non-interactive mode without --yes flag.`, name);
     }

package/dist/src/commands/furnace/chrome-doc-templates.d.ts

@@ -41,23 +41,25 @@
  */
 export declare function generateChromeDocXhtml(name: string, withTitlebar: boolean, license: string): string;
 /**
- * browser.xhtml-like scaffold for the document that ships as the fork's
- * MAIN BROWSER WINDOW (0.34.0 field report): the generic dialog-shaped
- * `<window>` scaffold was wrong for the `tokenHostDocuments[0]` /
- * BROWSER_CHROME_URL target — platform C++ reads the root element BEFORE
- * any script runs, and expects the `browser.xhtml` shape:
+ * browser.xhtml-like scaffold for the document that ships as the fork's MAIN
+ * BROWSER WINDOW.
+ *
+ * The generic dialog-shaped `<window>` scaffold is wrong for the
+ * `tokenHostDocuments[0]` / BROWSER_CHROME_URL target: platform C++ reads
+ * the root element BEFORE any script runs, and expects the `browser.xhtml`
+ * shape:
  *
  * - `<html id="main-window">` root (not `<window id="<name>-window">`) —
  *   upstream code from nsXULWindow sizing to session restore looks up
  *   `main-window` by id;
  * - `windowtype="navigator:browser"`, `chromehidden=""` and the geometry
  *   `persist` allowlist declared as ROOT ATTRIBUTES so the platform's
- *   pre-script pass (window tracking, XULStore geometry, chrome flags)
- *   sees them;
+ *   pre-script pass (window tracking, XULStore geometry, chrome flags) sees
+ *   them;
  * - the same head/bootstrap wiring (customElements.js, per-doc subscript,
  *   CSS + Fluent links) and `data-furnace-chrome-doc` sentinel as the
- *   generic scaffold, so jar.mn registration and the platform-module
- *   guard pattern are unchanged.
+ *   generic scaffold, so jar.mn registration and the platform-module guard
+ *   pattern are unchanged.
  */
 export declare function generateBrowserWindowXhtml(name: string, license: string): string;
 /**
@@ -105,25 +107,23 @@ export declare function jarMnEntriesForChromeDoc(name: string): string[];
 /**
  * jar.inc.mn entry that registers the scoped CSS under `content/browser/`.
  *
- * The source path is `../shared/<name>-chrome.css` because `jar.inc.mn`
- * is included from each theme-specific manifest (`browser/themes/osx/jar.mn`,
- * `browser/themes/linux/jar.mn`, `browser/themes/windows/jar.mn`), and every
- * existing entry in those manifests resolves paths relative to the including
- * manifest's directory. A bare `(shared/…)` path produced
- * `obj-.../browser/themes/osx/shared/<name>-chrome.css` which does not exist;
- * `(../shared/…)` matches the upstream pattern and resolves under
- * `browser/themes/shared/`.
+ * The source path is `../shared/<name>-chrome.css` because `jar.inc.mn` is
+ * included from each theme-specific manifest (`browser/themes/osx/jar.mn`,
+ * `.../linux/`, `.../windows/`), and every existing entry in those manifests
+ * resolves paths relative to the INCLUDING manifest's directory. A bare
+ * `(shared/…)` path resolves to
+ * `obj-.../browser/themes/osx/shared/<name>-chrome.css`, which does not
+ * exist.
  */
 export declare function jarIncMnEntryForChromeDoc(name: string): string;
 /**
  * locales/jar.mn entry that registers the `.ftl` under the browser locale
  * bundle. The source path is resolved by mach-locale-jar relative to the
- * per-locale root (e.g. `engine/browser/locales/en-US/`), and the FTL
- * file is scaffolded at `browser/${name}.ftl` under that root — the `%`
- * prefix means "per-locale content" and the `browser/` subdirectory
- * matches the subdir the scaffolder writes into. Before this fix the
- * entry emitted `(%${name}.ftl)`, which pointed at `en-US/${name}.ftl`
- * and broke the first post-scaffold `fireforge build` with
+ * per-locale root (e.g. `engine/browser/locales/en-US/`), and the FTL file
+ * is scaffolded at `browser/${name}.ftl` under that root — the `%` prefix
+ * means "per-locale content" and the `browser/` subdirectory matches where
+ * the scaffolder writes. A bare `(%${name}.ftl)` points at
+ * `en-US/${name}.ftl` and breaks the first post-scaffold build with
  * "jar.mn: Cannot find ${name}.ftl".
  */
 export declare function localeJarMnEntryForChromeDoc(name: string): string;