@hominis/fireforge 0.44.0 → 0.44.2

package/dist/src/commands/doctor.js

@@ -6,17 +6,19 @@ import { getCurrentBranch, getHead, isGitRepository, isMissingHeadError } from '
 import { ensureGit } from '../core/git-base.js';
 import { ensureMach, ensurePython } from '../core/mach.js';
 import { countPatches } from '../core/patch-apply.js';
-import { rebuildPatchesManifest, validatePatchesManifestConsistency, validatePatchIntegrity, } from '../core/patch-manifest.js';
+import { validatePatchIntegrity } from '../core/patch-manifest.js';
+import { InvalidArgumentError } from '../errors/base.js';
 import { ExitCode } from '../errors/codes.js';
 import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
 import { error, info, intro, outro, success, warn } from '../utils/logger.js';
-import { addWaitLockOption, resolveWaitLockSeconds } from '../utils/options.js';
+import { addWaitLockOption } from '../utils/options.js';
 import { findExecutable } from '../utils/process.js';
 import { failure, ok, resolveDoctorSeverity, warning } from './doctor-check-core.js';
 import { EXTERNAL_TOOLCHAIN_DOCTOR_CHECK } from './doctor-external-toolchains.js';
 import { FURNACE_DOCTOR_CHECKS } from './doctor-furnace.js';
 import { ORPHANED_HARNESS_DOCTOR_CHECK } from './doctor-orphaned-harness.js';
+import { PATCH_MANIFEST_CONSISTENCY_CHECK } from './doctor-patch-manifest.js';
 import { POST_REBASE_AUDIT_CHECK } from './doctor-post-rebase-audit.js';
 import { inspectEngineWorkingTree } from './doctor-working-tree.js';
 import { collectPatchQueueHealth } from './verify.js';
@@ -274,63 +276,7 @@ const DOCTOR_CHECKS = [
             return ok('Patches found', `${patchCount} patch${patchCount === 1 ? '' : 'es'} found`);
         },
     },
-    {
-        name: 'Patch manifest consistency',
-        dependsOn: ['fireforge.json is valid'],
-        run: async (ctx) => {
-            if (!(await pathExists(ctx.paths.patches))) {
-                return [];
-            }
-            const manifestConsistencyIssues = await validatePatchesManifestConsistency(ctx.paths.patches);
-            if (manifestConsistencyIssues.length === 0) {
-                return ok('Patch manifest consistency');
-            }
-            if (!ctx.options.repairPatchesManifest) {
-                return failure('Patch manifest consistency', manifestConsistencyIssues.map((issue) => issue.message).join(' '), 'Run "fireforge doctor --repair-patches-manifest" to rebuild patches.json from patch files.');
-            }
-            // Repair stamps sourceEsrVersion into every recovered entry. If the
-            // earlier "fireforge.json is valid" check failed, ctx.config is
-            // undefined and we must refuse rather than fabricate a fallback —
-            // persisting 'unknown' into manifest metadata is hard to reverse
-            // and would mislead every later command that reads it.
-            if (!ctx.config) {
-                return failure('Patch manifest consistency', 'Cannot repair patches.json: fireforge.json could not be loaded, so the Firefox version to stamp into recovered manifest entries is unknown.', 'Fix the fireforge.json errors reported above and re-run "fireforge doctor --repair-patches-manifest".');
-            }
-            try {
-                const repaired = await rebuildPatchesManifest(ctx.paths.patches, ctx.config.firefox.version, {
-                    waitLockSeconds: resolveWaitLockSeconds(ctx.options.waitLock),
-                    command: 'doctor --repair-patches-manifest',
-                });
-                // The repair path must not silently overwrite human-written
-                // descriptions on recovered entries, which leaves the queue less
-                // trustworthy as an audit trail. The rebuilder returns the list of
-                // filenames whose metadata was entirely invented, named explicitly
-                // here so the operator knows which patches to review. Entries that
-                // WERE preserved (only `filesAffected` / ordering drifted) are not
-                // flagged.
-                if (repaired.recoveredFilenames.length > 0) {
-                    for (const filename of repaired.recoveredFilenames) {
-                        // Telling the operator to hand-edit patches.json contradicts the
-                        // README and downstream docs, which treat the manifest as
-                        // FireForge-owned. Point at the existing `re-export` / `export`
-                        // workflow so the fix stays inside the tool: re-exporting the
-                        // same files with an explicit `--description` overwrites the
-                        // recovered entry with operator-supplied metadata and supersedes
-                        // the mtime-based createdAt stamp.
-                        warn(`Recovered manifest entry for ${filename} with generic description and mtime-based createdAt. ` +
-                            'Re-export the affected files with `fireforge re-export <filename> --description "<your description>"` ' +
-                            '(or `fireforge export <paths...> --name <name> --category <category> --description "<your description>"`) ' +
-                            'to overwrite the reconstructed metadata, or accept the generic description if the original text is not recoverable. ' +
-                            'Avoid hand-editing patches.json — FireForge owns that file and will regenerate it on the next manifest consistency pass.');
-                    }
-                }
-                return warning('Patch manifest consistency', `Rebuilt patches.json from ${repaired.manifest.patches.length} patch${repaired.manifest.patches.length === 1 ? '' : 'es'}${repaired.recoveredFilenames.length > 0 ? ` (${repaired.recoveredFilenames.length} with reconstructed metadata — see warnings above)` : ''}. Review recovered metadata before release.`);
-            }
-            catch (err) {
-                return failure('Patch manifest consistency', toError(err).message, 'Repair failed. Fix the underlying patch metadata issue and retry the doctor command.');
-            }
-        },
-    },
+    PATCH_MANIFEST_CONSISTENCY_CHECK,
     {
         name: 'Patch integrity',
         skipIf: (ctx) => !ctx.engineExists,
@@ -382,7 +328,7 @@ export const DOCTOR_CHECK_ORDER = DOCTOR_CHECKS.map((check) => check.name);
  * @param checks - The check results to display
  * @returns The exit code reflecting the overall result
  */
-export function reportDoctorResults(checks) {
+export function reportDoctorResults(checks, mutations = []) {
     info('');
     let passedCount = 0;
     let warningCount = 0;
@@ -409,6 +355,16 @@ export function reportDoctorResults(checks) {
         }
     }
     info('');
+    // Printed in every branch, including the failing one: a repair that wrote
+    // and then met an unrelated failing check must not be reported as a run
+    // where nothing happened.
+    if (mutations.length > 0) {
+        warn('Repairs applied this run:');
+        for (const mutation of mutations) {
+            warn(`  ${mutation}`);
+        }
+        info('');
+    }
     if (failedCount === 0 && warningCount === 0) {
         outro(`All ${passedCount} checks passed!`);
     }
@@ -421,12 +377,38 @@ export function reportDoctorResults(checks) {
     }
     return ExitCode.SUCCESS;
 }
+/**
+ * Rejects repair-flag combinations that cannot mean what they say.
+ *
+ * The two manifest repairs are different operations on the same file, and
+ * `--dry-run` with nothing to project is a flag that silently does nothing —
+ * the shape most likely to be mistaken for a preview that reported "no
+ * changes".
+ */
+function assertRepairOptions(options) {
+    if (options.repairPatchesManifest === true && options.repairFilesAffected === true) {
+        throw new InvalidArgumentError('--repair-patches-manifest and --repair-files-affected are mutually exclusive. ' +
+            'Use --repair-files-affected for filesAffected drift; use --repair-patches-manifest ' +
+            'when rows are missing, untracked or duplicated.', '--repair-files-affected');
+    }
+    if (options.allowMetadataLoss === true && options.repairPatchesManifest !== true) {
+        throw new InvalidArgumentError('--allow-metadata-loss only applies to --repair-patches-manifest.', '--allow-metadata-loss');
+    }
+    if (options.dryRun === true &&
+        options.repairPatchesManifest !== true &&
+        options.repairFilesAffected !== true) {
+        throw new InvalidArgumentError('--dry-run needs a manifest repair to project. Pass it with ' +
+            '--repair-patches-manifest or --repair-files-affected. ' +
+            '(--repair-furnace has no dry-run: it reconciles engine state, not a manifest.)', '--dry-run');
+    }
+}
 /**
  * Runs the doctor command to diagnose issues.
  * @param projectRoot - Root directory of the project
  */
 export async function doctorCommand(projectRoot, options = {}) {
     intro('FireForge Doctor');
+    assertRepairOptions(options);
     const paths = getProjectPaths(projectRoot);
     const state = await loadState(projectRoot);
     const engineExists = await pathExists(paths.engine);
@@ -440,12 +422,13 @@ export async function doctorCommand(projectRoot, options = {}) {
         config: undefined,
         furnaceConfigExists: furnaceConfigExistsFlag,
         furnaceConfig: undefined,
+        mutations: [],
     };
     const checks = [];
     for (const definition of DOCTOR_CHECKS) {
         checks.push(...(await executeCheck(definition, ctx)));
     }
-    const exitCode = reportDoctorResults(checks);
+    const exitCode = reportDoctorResults(checks, ctx.mutations);
     return { checks, exitCode };
 }
 /** Registers the doctor command on the CLI program. */
@@ -453,7 +436,10 @@ export function registerDoctor(program, { getProjectRoot, withErrorHandling }) {
     const command = program
         .command('doctor')
         .description('Diagnose project issues')
-        .option('--repair-patches-manifest', 'Rebuild patches/patches.json from the current patch files before reporting results')
+        .option('--repair-patches-manifest', 'Rebuild patches/patches.json from the current patch files before reporting results. Only filesAffected and order are recomputed; every other field on an existing entry is preserved')
+        .option('--repair-files-affected', 'Repair only the filesAffected lists that disagree with their patch body, leaving every other manifest field untouched')
+        .option('--allow-metadata-loss', 'With --repair-patches-manifest, rebuild even when patches.json cannot be parsed — every descriptive field on every entry is then reinvented')
+        .option('--dry-run', 'Show what a requested repair would change without writing anything')
         .option('--repair-furnace', 'Reconcile furnace state: clear stale furnace-state.json entries, re-run furnace apply to fix engine drift, and clear the pending-repair marker set by a failed preview teardown')
         .option('--clear-resolution', 'Clear stale pendingResolution state after the patch queue health check reports no errors')
         .option('--post-rebase-audit', 'Check common registration surfaces after a Firefox source rebase');

package/dist/src/commands/furnace/apply.js

@@ -5,7 +5,7 @@ import { applyAllComponents, computeComponentChecksums } from '../../core/furnac
 import { logApplyResult } from '../../core/furnace-apply-output.js';
 import { getFurnacePaths } from '../../core/furnace-config.js';
 import { isComponentSourceFile } from '../../core/furnace-constants.js';
-import { runFurnaceMutation } from '../../core/furnace-operation.js';
+import { runFurnaceMutation, waitLockMutationOptions } from '../../core/furnace-operation.js';
 import { assertFurnaceReady } from '../../core/furnace-precondition.js';
 import { getPersistableAppliedEntry, persistSingleComponentState, shouldPersistSingleComponentState, } from '../../core/furnace-state-persist.js';
 import { countEntriesWithBlockingStepErrors } from '../../core/furnace-step-errors.js';
@@ -294,7 +294,7 @@ export async function furnaceApplyCommand(projectRoot, name, options = {}) {
             await persistSingleComponentState(projectRoot, getPersistableAppliedEntry('Apply', name, applyResult.applied[0]), getFurnacePaths(projectRoot));
         }
         return applyResult;
-    }, { dryRun });
+    }, { dryRun, ...waitLockMutationOptions(options.waitLockSeconds) });
     if (applySpinner) {
         applySpinner.stop('Components applied');
     }

package/dist/src/commands/furnace/deploy.js

@@ -4,7 +4,7 @@ import { applyAllComponents } from '../../core/furnace-apply.js';
 import { logApplyResult } from '../../core/furnace-apply-output.js';
 import { getFurnacePaths, loadFurnaceConfig } from '../../core/furnace-config.js';
 import { reportJsconfigPathsSync } from '../../core/furnace-jsconfig.js';
-import { runFurnaceMutation } from '../../core/furnace-operation.js';
+import { runFurnaceMutation, waitLockMutationOptions, } from '../../core/furnace-operation.js';
 import { assertFurnaceReady } from '../../core/furnace-precondition.js';
 import { getPersistableAppliedEntry, getStepFailureCount, persistSingleComponentState, shouldPersistSingleComponentState, } from '../../core/furnace-state-persist.js';
 import { hasBlockingStepErrors } from '../../core/furnace-step-errors.js';
@@ -177,7 +177,7 @@ export async function furnaceDeployCommand(projectRoot, name, options = {}) {
             operationContext: ctx,
         });
         return { kind: 'result', result: allResult };
-    }, { dryRun: isDryRun });
+    }, { dryRun: isDryRun, ...waitLockMutationOptions(options.waitLockSeconds) });
     if (applyOutcome.kind === 'stock') {
         applySpinner.stop('Apply skipped');
         warn(`"${name}" is a stock component. Stock components are not applied locally.`);

package/dist/src/commands/furnace/diff.js

@@ -11,6 +11,7 @@ import { FurnaceError } from '../../errors/furnace.js';
 import { toError } from '../../utils/errors.js';
 import { pathExists, readText } from '../../utils/fs.js';
 import { formatErrorText, formatSuccessText, info, intro, outro } from '../../utils/logger.js';
+import { normalizePathSlashes } from '../../utils/paths.js';
 /**
  * Renders a multi-hunk unified diff between the two strings and returns a
  * flat list of display-ready lines. Each line has already had its marker
@@ -64,7 +65,11 @@ async function diffOverride(name, projectRoot, config) {
         if (!isComponentSourceFile(entry.name))
             continue;
         // git show takes a repo-relative path. paths.engine IS the repo root.
-        const enginePath = getOverrideEngineTargetPath(paths.engine, overrideConfig, entry.name, ftlDir).slice(paths.engine.length + 1);
+        // The slice leaves the host's separators behind, and `git show <ref>:<path>`
+        // only understands forward slashes — on Windows the unnormalized form makes
+        // every baseline read miss, so every overridden file is reported as a new
+        // file and `furnace diff` shows nothing.
+        const enginePath = normalizePathSlashes(getOverrideEngineTargetPath(paths.engine, overrideConfig, entry.name, ftlDir).slice(paths.engine.length + 1));
         const modifiedPath = join(overrideDir, entry.name);
         const baselineDisplayPath = enginePath;
         let originalContent;

package/dist/src/commands/furnace/index.js

@@ -35,13 +35,17 @@ function registerFurnaceApplyCommand(furnace, context) {
         .option('-w, --watch', 'Watch component directories and re-apply on changes');
     addWaitLockOption(apply).action(withErrorHandling(async (name, options) => {
         const { waitLock, ...rest } = options ?? {};
-        const parsed = pickDefined(rest);
+        // Resolved ONCE and used twice: the engine session lock below, and
+        // the furnace lock the mutation takes inside it. Resolving twice
+        // would be the same value today and a drift risk tomorrow.
+        const waitLockSeconds = resolveWaitLockSeconds(waitLock);
+        const parsed = pickDefined({ ...rest, waitLockSeconds });
         const run = (projectRoot) => furnaceApplyCommand(projectRoot, name, parsed);
         if (parsed.dryRun === true) {
             await run(getProjectRoot());
             return;
         }
-        await runEngineLockedFurnaceCommand(context, 'furnace apply', run, resolveWaitLockSeconds(waitLock));
+        await runEngineLockedFurnaceCommand(context, 'furnace apply', run, waitLockSeconds);
     }));
 }
 function registerFurnaceDeployCommand(furnace, context) {
@@ -54,13 +58,14 @@ function registerFurnaceDeployCommand(furnace, context) {
         .option('--skip-validate', 'Skip the validation step (apply only)');
     addWaitLockOption(deploy).action(withErrorHandling(async (name, options) => {
         const { waitLock, ...rest } = options ?? {};
-        const parsed = pickDefined(rest);
+        const waitLockSeconds = resolveWaitLockSeconds(waitLock);
+        const parsed = pickDefined({ ...rest, waitLockSeconds });
         const run = (projectRoot) => furnaceDeployCommand(projectRoot, name, parsed);
         if (parsed.dryRun === true) {
             await run(getProjectRoot());
             return;
         }
-        await runEngineLockedFurnaceCommand(context, 'furnace deploy', run, resolveWaitLockSeconds(waitLock));
+        await runEngineLockedFurnaceCommand(context, 'furnace deploy', run, waitLockSeconds);
     }));
 }
 function registerFurnaceSyncCommand(furnace, context) {
@@ -72,13 +77,14 @@ function registerFurnaceSyncCommand(furnace, context) {
         .addOption(new Option('-s, --strategy <strategy>', 'Auto-resolve merge conflicts (ours = keep local, theirs = accept upstream)').choices(['ours', 'theirs']));
     addWaitLockOption(sync).action(withErrorHandling(async (options) => {
         const { waitLock, ...rest } = options;
-        const parsed = pickDefined(rest);
+        const waitLockSeconds = resolveWaitLockSeconds(waitLock);
+        const parsed = pickDefined({ ...rest, waitLockSeconds });
         const run = (projectRoot) => furnaceSyncCommand(projectRoot, parsed);
         if (parsed.dryRun === true) {
             await run(getProjectRoot());
             return;
         }
-        await runEngineLockedFurnaceCommand(context, 'furnace sync', run, resolveWaitLockSeconds(waitLock));
+        await runEngineLockedFurnaceCommand(context, 'furnace sync', run, waitLockSeconds);
     }));
 }
 /**

package/dist/src/commands/furnace/init.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { stat } from 'node:fs/promises';
-import { basename, dirname, isAbsolute, join, normalize } from 'node:path';
+import { basename, dirname, isAbsolute, join, posix } from 'node:path';
 import { text } from '@clack/prompts';
 import { getProjectPaths, loadConfig, mutateConfig, writeConfig } from '../../core/config.js';
 import { stdioIsInteractive } from '../../core/destructive.js';
@@ -61,7 +61,10 @@ async function validateFtlBasePath(value, engineDir) {
     if (isAbsolute(value) || /^[a-zA-Z]:[\\/]/.test(value)) {
         throw new FurnaceError(`ftlBasePath "${value}" must be a relative path inside the engine checkout, not absolute.`);
     }
-    const normalized = normalize(value.replace(/\\/g, '/'));
+    // Normalize with the POSIX rules regardless of host: `normalize` on Windows
+    // emits backslashes, so a `../`-prefix test against the platform `normalize`
+    // silently passes every traversal attempt there.
+    const normalized = posix.normalize(value.replace(/\\/g, '/'));
     if (normalized === '..' || normalized.startsWith('../')) {
         throw new FurnaceError(`ftlBasePath "${value}" must not escape the engine checkout via parent-directory segments.`);
     }

package/dist/src/commands/furnace/remove-mutations.js

@@ -23,6 +23,7 @@ import { isGitRepository } from '../../core/git.js';
 import { FurnaceError } from '../../errors/furnace.js';
 import { pathExists, removeDir, removeFile } from '../../utils/fs.js';
 import { info } from '../../utils/logger.js';
+import { normalizePathSlashes } from '../../utils/paths.js';
 import { removeDeployedCustomFiles } from './remove-state.js';
 /**
  * Restores every override-deployed file in `engine/` to its pristine HEAD
@@ -153,7 +154,10 @@ export async function performCustomRemovalMutations(args) {
         if (await pathExists(ftlPath)) {
             await snapshotFile(journal, ftlPath);
             await removeFile(ftlPath);
-            info(`Deleted localized file engine/${ftlRel}`);
+            // `ftlRel` is a native join, so on Windows an interpolated
+            // `engine/${ftlRel}` renders as `engine/toolkit\locales\...` — one
+            // message with both separators. Print the engine-relative form.
+            info(`Deleted localized file engine/${normalizePathSlashes(ftlRel)}`);
         }
         // Drop the locale jar.mn chrome registration that `applyCustomFtlFile`
         // wrote during deploy — otherwise the engine is left with a

package/dist/src/commands/furnace/sync.js

@@ -6,7 +6,7 @@ import { applyAllComponents } from '../../core/furnace-apply.js';
 import { logApplyResult } from '../../core/furnace-apply-output.js';
 import { getFurnacePaths, loadFurnaceConfig } from '../../core/furnace-config.js';
 import { reportJsconfigPathsSync } from '../../core/furnace-jsconfig.js';
-import { runFurnaceMutation } from '../../core/furnace-operation.js';
+import { runFurnaceMutation, waitLockMutationOptions } from '../../core/furnace-operation.js';
 import { assertFurnaceReady } from '../../core/furnace-precondition.js';
 import { countEntriesWithBlockingStepErrors } from '../../core/furnace-step-errors.js';
 import { containsMergeConflictMarkers } from '../../core/furnace-validate-structure.js';
@@ -127,7 +127,7 @@ export async function furnaceSyncCommand(projectRoot, options = {}) {
     if (!options.dryRun) {
         info('\nApplying all components to engine...');
         const applySpinner = spinner('Applying components...');
-        const result = await runFurnaceMutation(projectRoot, 'apply-rollback', (ctx) => applyAllComponents(projectRoot, false, { operationContext: ctx }), { dryRun: false });
+        const result = await runFurnaceMutation(projectRoot, 'apply-rollback', (ctx) => applyAllComponents(projectRoot, false, { operationContext: ctx }), { dryRun: false, ...waitLockMutationOptions(options.waitLockSeconds) });
         applySpinner.stop('Components applied');
         logApplyResult(result, false);
         const appliedWithStepErrorsCount = countEntriesWithBlockingStepErrors(result.applied);

package/dist/src/commands/import.js

@@ -8,7 +8,7 @@ import { assertEngineExists } from '../core/engine-precondition.js';
 import { getHead } from '../core/git.js';
 import { getDirtyFiles } from '../core/git-status.js';
 import { applyPatchesWithContinue, countPatches, createPatchedContentContext, discoverPatches, extractAffectedFiles, matchesUntilFilename, PatchError, } from '../core/patch-apply.js';
-import { checkVersionCompatibility, loadPatchesManifest, validatePatchesManifestConsistency, validatePatchIntegrity, } from '../core/patch-manifest.js';
+import { checkVersionCompatibility, loadPatchesManifest, recommendManifestRepair, validatePatchesManifestConsistency, validatePatchIntegrity, } from '../core/patch-manifest.js';
 import { getPatchSourceVersion } from '../core/patch-source-metadata.js';
 import { warnIfStaticComponentsStale } from '../core/test-stale-check.js';
 import { GeneralError } from '../errors/base.js';
@@ -239,7 +239,11 @@ async function assertScopedManifestConsistency(patchesDir, untilFilenameSet, unt
         const issueSummary = scopedManifestIssues.map((issue) => issue.message).join('\n  ');
         throw new GeneralError('Patch manifest consistency check failed. Repair patches/patches.json before importing.\n' +
             `  ${issueSummary}\n\n` +
-            'Run "fireforge doctor --repair-patches-manifest" to rebuild the manifest from on-disk patch files.');
+            // Naming the whole-manifest rebuild for drift that is only in
+            // `filesAffected` puts the operator one keystroke from rewriting every
+            // row to correct one derived list. The narrow repair is the remedy the
+            // failure actually calls for.
+            recommendManifestRepair(scopedManifestIssues));
     }
 }
 /**

package/dist/src/commands/re-export-files.js

@@ -4,6 +4,7 @@ import { getProjectPaths } from '../core/config.js';
 import { appendHistory, confirmDestructive, } from '../core/destructive.js';
 import { enforceFreshFurnaceSources } from '../core/furnace-stale-export.js';
 import { getDiffForFilesAgainstHead } from '../core/git-diff.js';
+import { listTrackedInHead } from '../core/git-file-ops.js';
 import { extractAffectedFiles } from '../core/patch-apply.js';
 import { updatePatchAndMetadata } from '../core/patch-export.js';
 import { buildModifiedFileAdditionsFromDiff, buildPatchQueueContext, detectNewFilesInDiff, formatPatchLintIssue, lintPatchQueue, } from '../core/patch-lint.js';
@@ -88,7 +89,7 @@ function buildFilesModeMetadataUpdates(actualProjectedFiles, options, effectiveL
     return updates;
 }
 async function confirmFilesModeProjection(args) {
-    const { target, retained, removed, added, actualProjectedFiles, missingFiles, options, conflicts, } = args;
+    const { target, retained, removed, added, actualProjectedFiles, deletedFiles, options, conflicts, } = args;
     const isDryRun = options.dryRun === true;
     const summary = [
         `re-export ${target.filename} with --files scope`,
@@ -102,8 +103,8 @@ async function confirmFilesModeProjection(args) {
     if (added.length > 0) {
         summary.push(`newly included files (${added.length}): ${added.join(', ')}`);
     }
-    if (missingFiles.length > 0) {
-        summary.push(`missing on disk (will be dropped): ${missingFiles.join(', ')}`);
+    if (deletedFiles.length > 0) {
+        summary.push(`deleted on disk (captured as deletions the patch will replay): ${deletedFiles.join(', ')}`);
     }
     if (!isDryRun && removed.length > 0 && options.allowShrink !== true) {
         warn(`Refusing to shrink ${target.filename} without --allow-shrink.`);
@@ -118,12 +119,60 @@ async function confirmFilesModeProjection(args) {
         operation: 're-export-files',
         title: `Re-export ${target.filename} with --files`,
         summary,
-        yes: removed.length === 0 && missingFiles.length === 0 ? true : options.yes === true,
+        // A captured deletion still needs the confirmation: the patch will now
+        // REMOVE those files wherever it is applied, which is the same class of
+        // consequence as shrinking the scope.
+        yes: removed.length === 0 && deletedFiles.length === 0 ? true : options.yes === true,
         dryRun: isDryRun,
         unsafeOverride: options.forceUnsafe === true,
         conflicts,
     });
 }
+/**
+ * Splits the requested paths into what can be diffed and what is a deletion.
+ *
+ * A path absent from disk is one of two very different things, and
+ * collapsing them is what made a DELETION impossible to capture.
+ *
+ * Tracked in HEAD: a deletion. `git diff HEAD -- <path>` renders it as a
+ * proper `deleted file mode` section, so it STAYS in the diff scope. (The
+ * comment this replaces claimed the diff "would fail" on any missing path —
+ * true only for the never-tracked case.) Dropping these produced the
+ * dangerous shape: a re-export that reported success while writing a patch
+ * whose own file list claimed a path it did not restore, so a fresh clone
+ * would apply it and resurrect exactly what the change meant to remove.
+ *
+ * Never tracked in HEAD: nothing on disk and nothing to diff against, so
+ * there is no hunk to be had. Refused rather than warned about, because the
+ * patch cannot express it either way.
+ *
+ * @param requested - The `--files` scope
+ * @param engineDir - Absolute path to the engine checkout
+ * @param patchFilename - Target patch, for the refusal message
+ * @returns The diffable scope and the subset captured as deletions
+ */
+async function classifyRequestedPaths(requested, engineDir, patchFilename) {
+    const absentFiles = [];
+    for (const file of requested) {
+        if (!(await pathExists(join(engineDir, file)))) {
+            absentFiles.push(file);
+        }
+    }
+    const trackedAbsent = await listTrackedInHead(engineDir, absentFiles);
+    const untrackedAbsent = absentFiles.filter((f) => !trackedAbsent.has(f));
+    const deletedFiles = absentFiles.filter((f) => trackedAbsent.has(f));
+    if (untrackedAbsent.length > 0) {
+        throw new InvalidArgumentError(`Refusing to re-export ${patchFilename} with --files because ${untrackedAbsent.length} requested path${untrackedAbsent.length === 1 ? ' is' : 's are'} ` +
+            `neither on disk nor tracked in engine HEAD (${untrackedAbsent.join(', ')}). ` +
+            'There is no content to diff and no deletion to record, so the patch could not ' +
+            'honour the file list it would claim. Remove those paths from --files.', '--files');
+    }
+    for (const file of deletedFiles) {
+        info(`${patchFilename}: capturing deletion of ${file}`);
+    }
+    const untrackedSet = new Set(untrackedAbsent);
+    return { diffableFiles: requested.filter((f) => !untrackedSet.has(f)), deletedFiles };
+}
 /**
  * Handles `re-export --files` end-to-end: computes the projected diff, runs
  * the per-patch and cross-patch lint against a context in which the target
@@ -152,22 +201,7 @@ export async function reExportFilesInPlace(paths, selectedPatches, options, conf
     const removed = target.filesAffected.filter((f) => !requested.includes(f));
     const added = requested.filter((f) => !target.filesAffected.includes(f));
     const retained = target.filesAffected.filter((f) => requested.includes(f));
-    // Filter out paths that no longer exist on disk; we cannot include
-    // them in the new diff because getDiffForFilesAgainstHead would fail.
-    // Missing files are still dropped from the manifest so the resulting
-    // filesAffected reflects reality.
-    const missingFiles = [];
-    for (const file of requested) {
-        const filePath = join(paths.engine, file);
-        if (!(await pathExists(filePath))) {
-            missingFiles.push(file);
-        }
-    }
-    const missingSet = new Set(missingFiles);
-    const diffableFiles = requested.filter((f) => !missingSet.has(f));
-    for (const file of missingFiles) {
-        warn(`${target.filename}: requested file is missing on disk and will be dropped: ${file}`);
-    }
+    const { diffableFiles, deletedFiles } = await classifyRequestedPaths(requested, paths.engine, target.filename);
     // Compute the projected diff up front. This is the same diff the real
     // write would produce, so we get an exact preview through the lint
     // gate and avoid computing it twice.
@@ -179,7 +213,13 @@ export async function reExportFilesInPlace(paths, selectedPatches, options, conf
     }
     const actualProjectedFiles = extractAffectedFiles(projectedDiff);
     const actualProjectedSet = new Set(actualProjectedFiles);
-    const noDiffFiles = diffableFiles.filter((file) => !actualProjectedSet.has(file));
+    // Domain is the FULL requested list, not the diffable subset. When the
+    // subset was used, any path filtered out upstream was invisible to this
+    // check by construction — which is exactly how a dropped deletion slipped
+    // through while the run reported success. A patch that does not do what
+    // its own file list claims is the one property a manifest must never get
+    // wrong, so an explicitly named path that produced no hunk is a refusal.
+    const noDiffFiles = requested.filter((file) => !actualProjectedSet.has(file));
     if (noDiffFiles.length > 0) {
         throw new InvalidArgumentError(`Refusing to re-export ${target.filename} with --files because ${noDiffFiles.length} requested path${noDiffFiles.length === 1 ? '' : 's'} produced no diff hunks (${noDiffFiles.join(', ')}). ` +
             'Keeping them in filesAffected would desync patches.json from the patch body. ' +
@@ -216,7 +256,7 @@ export async function reExportFilesInPlace(paths, selectedPatches, options, conf
         removed,
         added,
         actualProjectedFiles,
-        missingFiles,
+        deletedFiles,
         options,
         conflicts,
     });
@@ -243,7 +283,7 @@ export async function reExportFilesInPlace(paths, selectedPatches, options, conf
                 filename: target.filename,
                 files: actualProjectedFiles,
                 previousFiles: target.filesAffected,
-                missingFilesDropped: missingFiles,
+                deletionsCaptured: deletedFiles,
             },
             ...(options.yes === true ? { yes: true } : {}),
             ...(options.forceUnsafe === true ? { unsafeOverride: true } : {}),

package/dist/src/commands/re-export-scan.js

@@ -2,6 +2,7 @@
 import { dirname, join } from 'node:path';
 import { confirm } from '@clack/prompts';
 import { getDiffForFilesAgainstHead } from '../core/git-diff.js';
+import { listTrackedInHead } from '../core/git-file-ops.js';
 import { getModifiedFilesInDir, getUntrackedFilesInDir } from '../core/git-status.js';
 import { extractAffectedFiles } from '../core/patch-apply.js';
 import { buildModifiedFileAdditionsFromDiff, buildPatchQueueContext, detectNewFilesInDiff, lintPatchQueue, } from '../core/patch-lint.js';
@@ -85,7 +86,10 @@ async function scanPatchFilesTargeted(args) {
     const exists = await mapWithConcurrency(scanFiles, PATH_PROBE_CONCURRENCY, (file) => pathExists(join(engineDir, file)));
     for (const [index, file] of scanFiles.entries()) {
         if (exists[index] !== true) {
-            throw new InvalidArgumentError(`--scan-file path not found in engine/: ${file}`, '--scan-file');
+            throw new InvalidArgumentError(`--scan-file path not found in engine/: ${file}. ` +
+                '--scan-file brings a path INTO patch ownership, which needs content to diff. ' +
+                'If the path was deleted and the patch already owns it, a plain re-export now ' +
+                'captures the deletion — no scan flag is needed.', '--scan-file');
         }
         if (!currentSet.has(file))
             added.push(file);
@@ -93,9 +97,21 @@ async function scanPatchFilesTargeted(args) {
     const removed = await findRemovedFiles(currentFilesAffected, engineDir);
     return reportScanResult(currentFilesAffected, patchFilename, isDryRun, added.sort(), removed);
 }
+/**
+ * Paths that have genuinely left the patch's ownership: absent from disk AND
+ * untracked in engine HEAD.
+ *
+ * An absent path that IS tracked in HEAD is a DELETION, not a de-ownership.
+ * The diff carries it as a `deleted file mode` section, so it must stay in
+ * `filesAffected` — pruning it desynchronises the manifest from the patch
+ * body in the direction that hurts: the body says "delete this file", the
+ * file list says the patch has nothing to do with it.
+ */
 async function findRemovedFiles(files, engineDir) {
     const exists = await mapWithConcurrency(files, PATH_PROBE_CONCURRENCY, (file) => pathExists(join(engineDir, file)));
-    return files.filter((_, index) => exists[index] !== true).sort();
+    const absent = files.filter((_, index) => exists[index] !== true);
+    const trackedAbsent = await listTrackedInHead(engineDir, absent);
+    return absent.filter((file) => !trackedAbsent.has(file)).sort();
 }
 function reportScanResult(currentFilesAffected, patchFilename, isDryRun, added, removed) {
     for (const f of added)

package/dist/src/commands/re-export-single.js

@@ -9,6 +9,7 @@ import { getProjectPaths } from '../core/config.js';
 import { stdioIsInteractive } from '../core/destructive.js';
 import { enforceFreshFurnaceSources } from '../core/furnace-stale-export.js';
 import { getDiffForFilesAgainstHead } from '../core/git-diff.js';
+import { listTrackedInHead } from '../core/git-file-ops.js';
 import { updatePatchAndMetadata } from '../core/patch-export.js';
 import { buildProjectedManifest, enforcePatchPolicy } from '../core/patch-policy.js';
 import { isGitIndexLockConflict } from '../errors/git.js';
@@ -111,17 +112,28 @@ async function reExportSinglePatch(patch, paths, manifest, options, isDryRun, co
     // --allow-stale-furnace) before diffing. Runs in dry-run too so the failure
     // surfaces early.
     await enforceFreshFurnaceSources(paths.root, currentFilesAffected, options.allowStaleFurnace === true, 're-export');
-    const missingFiles = await findMissingFiles(paths.engine, currentFilesAffected);
-    if (missingFiles.length === currentFilesAffected.length) {
+    const absentFiles = await findMissingFiles(paths.engine, currentFilesAffected);
+    // A path absent from disk but tracked in engine HEAD is a DELETION, and
+    // `git diff HEAD` renders it as a real `deleted file mode` section. Only
+    // a never-tracked path has nothing to diff. Skipping both alike meant a
+    // retired file quietly left the patch body while staying in its file
+    // list — the patch then claimed a file it could not restore.
+    const trackedAbsent = await listTrackedInHead(paths.engine, absentFiles);
+    const deletedFiles = absentFiles.filter((f) => trackedAbsent.has(f));
+    const untrackedAbsent = absentFiles.filter((f) => !trackedAbsent.has(f));
+    if (untrackedAbsent.length === currentFilesAffected.length) {
         warn(`Skipped ${patch.filename}: all affected files missing`);
-        warn(`Missing files: ${missingFiles.join(', ')}`);
+        warn(`Missing files: ${untrackedAbsent.join(', ')}`);
         return false;
     }
-    if (missingFiles.length > 0) {
-        warn(`${patch.filename}: missing files will be skipped: ${missingFiles.join(', ')}`);
+    if (untrackedAbsent.length > 0) {
+        warn(`${patch.filename}: missing files will be skipped: ${untrackedAbsent.join(', ')}`);
     }
-    const missingSet = new Set(missingFiles);
-    const existingFiles = currentFilesAffected.filter((f) => !missingSet.has(f));
+    if (deletedFiles.length > 0) {
+        info(`${patch.filename}: capturing deletion of ${deletedFiles.join(', ')}`);
+    }
+    const untrackedSet = new Set(untrackedAbsent);
+    const existingFiles = currentFilesAffected.filter((f) => !untrackedSet.has(f));
     const diffContent = await getDiffForFilesAgainstHead(paths.engine, existingFiles);
     assertScanFileAdditionsHaveDiffHunks({
         diffContent,

package/dist/src/commands/test-register.js

@@ -29,7 +29,10 @@ const TEST_HELP_TEXT = [
     '--doctor) ends with exactly one raw stdout line',
     '  FIREFORGE-VERDICT: PASS|FAIL [reason=crash|test-failures|',
     '  no-tests|preflight|inconclusive|lock-timeout] [checks=<n>]',
-    '  [unexpected=<n>] [shards=<p>/<t>] [(<note>)]',
+    '  [unexpected=<n>] [shards=<p>/<t>] [(<note>)] [log=<path>]',
+    "log=<path> names this run's complete output, written to",
+    '.fireforge/logs/ as the run streams, so a piped or truncated run',
+    'still leaves a re-readable artifact.',
     'The status follows the harness classifier, not the raw exit code:',
     'a crash-classified run says FAIL reason=crash even at exit 0, and',
     'a green-summary-override pass says PASS despite a non-zero mach',
@@ -55,6 +58,7 @@ export function registerTest(program, { getProjectRoot, withErrorHandling }) {
         .command('test [paths...]')
         .description('Run tests via mach test')
         .option('--headless', 'Run tests in headless mode')
+        .option('--full-output', "Pass mozbuild's full verbosity through for the TEST phase. mozbuild quiets terminal output to warnings and errors when it detects a coding agent, which removes TEST_START and console INFO — the lines a hang or stall diagnosis needs. This unsets that detection for test dispatches only; the build phase stays quiet.")
         .option('--build', 'Run incremental UI build before testing')
         .option('--build-only', 'Run the scoped pre-test build (packaging exactly [paths...], mixed harnesses allowed) and exit without dispatching tests — one build covers both harness halves, then run each half without --build')
         .option('--extend-coverage', 'With --build/--build-only and explicit paths, union those paths into the recorded test-packaging coverage instead of replacing it, so an earlier scoped build stays covered. Refused when the build anchor moved (engine HEAD, mozconfig, or a previously fingerprinted packageable file changed).')