@hominis/fireforge 0.44.3 → 0.45.0

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 0.45.0
+
+### Patch bodies
+
+- **A NEW binary file could not be vendored into a patch at all.** Adopting eight WOFF2 faces through `re-export --scan --scan-file` failed, after a clean lint pass, with `Cannot extract text content from binary patch section for …` — and the faces stayed unmanaged, so a `fireforge reset` left the patch's `@font-face` and `jar.inc.mn` lines pointing at missing files. The export half was never at fault: `generateBinaryFilePatch` wrote a correct, replayable `GIT binary patch`. The refusal came from the FORWARD-IMPORT PROJECTION downstream of it. `detectNewFilesInDiff` keys purely on `new file mode`, so binaries entered the loop, and every one of the five projection sites then handed each detected new file to `extractNewFileContentFromDiff`, which refuses binary sections — correctly, since the base85 alphabet includes `+` and "extract the + lines" would write garbage over a binary target.
+  The projection never needed the bytes. It feeds one rule, which scans content for import statements, and a binary blob authors none — so skipping a binary contributes exactly what including it would. The asymmetry was the tell: `buildPatchQueueContext` already tolerated binary new files for REAL queue entries (a per-file try/catch), and only the projections did not. The five duplicated loops are now one `buildNewFileTextProjection`, which skips binary sections and parses the diff once instead of once per new file. `extractNewFileContentFromDiff` still refuses a binary section named explicitly: a caller that asked for THIS file's text must be told no, not silently handed nothing. Nothing is given up by skipping — binary bodies are covered independently by the `binary-body-not-reconstructable` queue lint.
+  Worth recording that the reported symptom was narrower than stated in one direction and wider in another. Plain `fireforge export` of a new binary always worked; the export half fails only behind a placement flag (`--order`/`--before`/`--after`), which is what routes it through `projectPlacementForLint`. But the same projection sits under `patch move-files-into` and `patch split`, so a binary could not be moved between patches or split out either.
+- **The new-file conflict recovery could not handle a binary target, and restored text where it should have restored bytes.** When `git apply` fails because a patch creates a file that is already on disk, FireForge resolves the conflict by putting the patch's intended content in place and retrying. For a binary there is nothing to extract — but nothing needs to be: `git apply` decodes the payload itself, so the resolution is to REMOVE the blocking file and let the retry create it. A `Binary files … differ` body, which records that the bytes changed and carries none of them, is refused instead of deleted, because nothing could put the file back. The saved originals are now raw `Buffer`s rather than utf-8 text, which also closes a latent corruption on the pre-existing path: a binary file overwritten by this recovery was previously restored through a `readText`/`writeText` round-trip that mangles it.
+
+### Refusals
+
+- **`--expect <path>` warned "showed no drift" over a path that did drift and was captured.** The notice was the only feedback that the belt looked at the right files, and none of the causes it named held; the reporter's workaround was `grep -c` on the written body. The measurement was never stated, and stating it is the diagnosis: the comparison is CONTENT, per patch, on the body about to be written and never against post-write state — and it is ONE-DIRECTIONAL, reporting only the payload lines the refreshed body carries that the old body did not. Removing a line from an engine file makes the refreshed body DROP that file's `+` line, so nothing is absorbed and by design there is no drift to see. The notice now says what it compares and when, leads with that one-directional cause, and adds the `--scan-file` adoption case as a named cause (adopting a file also captures that patch's other drifted files, so a scripted scan-less re-export afterwards legitimately sees nothing left — informational at exit 0, and a chain treating the warning as an error will false-red on it). Widening the comparison was considered and rejected: it would turn every ordinary line removal into a refusal, and the belt exists to catch a concurrent session's edits being swallowed INTO a body.
+- **The coverage refusal left its own triage step to the reader.** Adding a test to `xpcshell.toml` while the packaged runtime came from a browser-chrome `test --build` was refused correctly, naming the covered paths, the requested paths, the rebuild command and `--extend-coverage`. What it did not say is WHY this run needed new coverage: a MANIFEST gained an entry, and a browser-chrome build claim never covers xpcshell. FireForge can see both facts. The refusal now names the test manifests changed since the recorded build that sit in an uncovered request path's directory. Behaviour is unchanged; the probe is best-effort and a failure renders exactly the previous text.
+- **`--refuse-adjacent-unmanaged` was all-or-nothing against a recorded exception.** A project with a reviewed, deliberately unmanaged path beside a patch's ownership had no way to say so, so every re-export of every adjacent patch had to drop the flag entirely and substitute a hand-read of the notice — a weaker belt than the one being disarmed, recurring on every touch. `--expect-unmanaged <path>` (repeatable, requires `--refuse-adjacent-unmanaged`) names an approved exception: the belt stays armed for everything else. Approved paths are still LISTED, as an explicit note that they were admitted rather than dropped, because a carve-out nobody can see is how one quietly widens. A path that is never met is reported at the end of the run, for the same reason `--expect` reports its unseen entries: a typo'd carve-out silently leaves the refusal armed for the path it was meant to admit, while reading as an approval that is in force. Deliberately a flag and not a config list — a standing exception nobody re-reads is exactly what this refusal exists to prevent.
+
+### Diagnostics
+
+- **`run --smoke-exit` gave a clean window over the one line that predicts a crash under automation.** The 0.44.1 discriminator (`run --smoke-exit 60 --headless --capture-console <file>`) was run against a build whose startpage pointed at a nonexistent `chrome://` image. It exited 0 with `Unallowed errors: 0` — the "startup is healthy" answer — for a build that hung EVERY browser-chrome run at "Waiting for browser…", while the capture it wrote held the discriminating line: `Missing chrome or resource URL: chrome://…`. That is Gecko's non-automation spelling (`printf_stderr` in `CheckForBrokenChromeURL`, `netwerk/base/nsNetUtil.cpp`); under `xpc::IsInAutomation()` the identical condition is `MOZ_CRASH_UNSAFE_PRINTF("Missing chrome or resource URLs: %s")`. So the probe did discriminate — but only for a reader who grepped the capture, and the exit code said the opposite. `^Missing chrome or resource URLs?:` is now a smoke error pattern, allowlistable through `--console-allow` like any other.
+- **The no-output-stall triage told operators to read a log that structurally cannot carry the evidence.** Cause (3) was recorded as an un-root-caused correlation with a broken `chrome://` image URI. It is now root-caused, and the mechanism explains why the log is empty: under automation the `MOZ_CRASH` lands in whichever process opened the channel, and in the downstream reproduction that was a CONTENT process (`plugin-container`) with the crash reporter compiled out — so the harness log carried neither the message nor a crash line, only the 370 s timeout, `Ran 0 checks`, and mochitest's "Can't trigger Breakpad, just killing process". The only artefact was `~/Library/Logs/DiagnosticReports/plugin-container-*.ips`, faulting frame `CheckForBrokenChromeURL`, which is the symbolicated diagnosis the census bar asks for. The census now names that artefact and the smoke probe together, and states that the log naming nothing is the expected shape rather than an absence of evidence. Detection by log line is still deliberately not specified, and the module doc now records why.
+- **The green-suite teardown belt could reject a run without saying which condition rejected it.** On a composed gate's tiles step: exit 1, 201 `TEST_END`, zero `Test FAIL`, zero `TEST-UNEXPECTED`, only the recognized `mozsystemmonitor` teardown traceback in the tail, FireForge's own "Known upstream …" note printed — and `FIREFORGE-VERDICT: FAIL reason=test-failures … unexpected=0`. The re-run was green and the log had rotated. Every condition in the belt is all-or-nothing, so from outside the failing verdict looks identical whichever one rejected it, and diagnosis reduced to guessing. A rejected run that DID carry the recognized teardown noise now names the first failing condition on the verdict line — `green-teardown override rejected: 2 matched failure line(s), first: …`. A run with no teardown noise was never a candidate for the belt and says nothing, because naming a rejecting condition there would be pure noise. Advisory only: the status and `reason` keys the verdict contract's consumers parse are unchanged.
+- **The undefined-identifier hint named the shim when the cause was an unmanaged companion — and taking the hint would have masked a real bug.** Hoisting duplicated test helpers into a new `head_settings.js` that a managed `head.js` loads via `loadSubScript` leaves the companion owned by no patch until export, so the per-patch program reports every helper use as `Cannot find name` (157 warnings, in the reported case) with a hint offering to add the globals to the extra shim. That remedy makes all 157 disappear AND makes a genuinely missing helper undetectable forever after; the actual fix, `re-export <patch> --scan --scan-file <file>`, the hint never mentioned. When EVERY undefined name in a file is declared at the top level of an unmanaged file that a managed head loads, the hint now names that file, its loader and the adoption command, and rules the shim out explicitly. One unresolved name and the generic hint stays — the file may genuinely be missing a helper, which is the bug this detection exists not to hide.
+- **A test-suite red rendered a build-shaped remedy list.** A failing assertion exited through `BuildError`, so the operator was told to "check the build output above", run `fireforge bootstrap`, and delete `obj-*` directories. None of the three applies to a failing test, and the first points at the wrong half of the log — the half a `tail` keeps. `TestFailureError` now carries remedies that name the failing tests (the `TEST-UNEXPECTED-*` blocks the verdict already collected and, until now, only logged), the `FIREFORGE-VERDICT:` line as ground truth, and the run log path, which is the one artifact that survives the pipe that caused the confusion. It subclasses `BuildError` and **keeps exit 5** deliberately: `docs/exit-codes.md` documents 5 as "a suite that FAILED" and consumers key CI on it, so only the message changes. The `--json` error code does move, from `build` to `test-failure`, because `machineErrorCode` derives it from the class name. `'Test process failed to start'` stays a `BuildError` — a harness that never spawned genuinely can be a build or environment problem, and the build remedies are apt there.
+- **The known-teardown-noise filter covered the test path and not the build path — and could not simply be extended to it.** The `SystemResourceMonitor` `AttributeError` at teardown is recognized, documented upstream noise, and `mach build` surfaced it unannotated, where it reached one consumer as an unexplained build-log traceback during a 153.2.0esr drill. Threading the existing `annotateKnownTeardownNoise` option through the protected build dispatch was the obvious fix and is the wrong one, twice over. It would be a silent NO-OP: recognition requires a previously-seen `SUITE_END`, and a build never prints one. And relaxing that gate would be wrong on its own terms — the marker is what separates teardown from work still in progress, a build has no equivalent boundary, so FireForge cannot tell the known-cosmetic case from a real build-time traceback and must not withhold the block. Separately, the inherit path has no per-chunk hook, only a mirror that feeds the terminal and the run log the same string, so filtering there would strip the traceback from the raw log — the opposite of the "raw into the log, filtered into the echo" invariant the filter was built around.
+  So the build path RECOGNIZES rather than collapses: the traceback prints verbatim and one labeled line names it, using the same closed allowlist (two attributes, plus a `resourcemonitor.py` frame). A novel attribute stays unannotated, because it is a new upstream defect. The filter's module doc now states the test-only scope and both reasons for it, `MachOptions.annotateKnownTeardownNoise` documents that the inherit path ignores it (it type-checked and did nothing, which is how this reads as an oversight from outside), and the signature is documented in `docs/testing.md` — resolving the annotation's dangling "See FireForge docs.", which pointed at documentation that did not exist.
+- **`fireforge source set` wrote a pin that a routine revert silently lost.** The pin lands in `fireforge.json` beside hand-maintained policy sections, so `git checkout -- fireforge.json` — undoing an accidental whole-file reformat, say — also reverts an uncommitted pin, and nothing afterwards reported that the pin and the engine checkout had diverged. The field tell was a gate flipping green with no change that should have made it green. `fireforge doctor` now reports the configured pin beside what the checkout actually is — the engine's own `browser/config/version.txt` and the version the last download recorded into state — and warns when they disagree. A report, not a lock and not a new refusal: a tree may legitimately be mid-migration, and the only thing missing was visibility. Scope is limited by what is actually recorded: `product`, `sha256` and `candidate` have no counterpart on disk (state holds only `downloadedVersion` and `baseCommit`), so the check says nothing about them rather than implying it verified them. A blank or whitespace-only `version.txt` — a truncated write, a partial extraction — reads as absent rather than as a mismatch against the empty string. The check reuses `getFirefoxVersion`, which had been sitting in `firefox-extract.ts` with no production caller.
+
+### Builds
+
+- **The jar-only full-build escalation was over-broad.** `requiresFullBuildForIncrementalTest` was exactly `isJarManifestPath`, so ANY changed jar manifest escalated the pre-test build to a full `mach build` — ~10 minutes against ~20 s for a chrome-only slice, paid twice per green/no-change pair on a Furnace-touching slice. A downstream experiment (two clean runs against 0.44.4) settled the common case: a jar-only registration of a NEW content file added to an EXISTING `dist/bin` manifest was installed by a plain `fireforge build --ui` both times — `faster/install_dist_bin_browser` named the destination, the file landed in `dist/bin/…/content/browser/` and in the `.app` bundle, and a plain `fireforge test` fetched it over `chrome://` at runtime. Neither run escalated. The escalation is now narrowed to the two halves nobody has run: a NEW `jar.mn` (untracked in the engine repo — no install manifest exists for it yet) and a manifest whose jar declaration carries a bracketed base-directory prefix, which redirects the install destination away from the default chrome root. Every probe failure still escalates, so the error direction stays slow-but-correct, and the notice now names the manifest AND the reason instead of saying "a jar.mn registration changed".
+- **Post-build packaging notices could not be triaged on a shared checkout.** The missing-artifact notice keys on "was touched", which on a checkout several sessions share means any of their dirty files — so an operator got a registration-shaped warning about a file they never edited and had to census ownership by hand to dismiss it. Each notice now carries the owning patch, or an explicit `unmanaged` mark. Resolution is best-effort and shares `status --ownership`'s source (the manifest's `filesAffected`); with no queue or an unreadable manifest the notice renders exactly as before, because "unmanaged" has to mean "checked and unowned" rather than "could not check".
+
+### Test harness
+
+- **Nothing could see or reap orphaned harness processes.** Stopping a 45-minute tiles run mid-flight left `xpcshell` (the harness httpd, pegged at 100% CPU), `pywebsocket`, `ssltunnel` and `moz-http2` alive for an hour. Later runs crawled — a three-second suite took six minutes of wall clock, audio-start waits timed out — and nothing in the output connected the slowness to the survivors; the hour went into mis-attributing it to the change under test. Every `fireforge test` dispatch now runs a census of harness helper processes anchored to this project's objdir, naming each with its elapsed time and the `kill` command. It runs at PREFLIGHT, before this run spawns anything, so every hit is by construction a survivor and no age heuristic is needed. A match must be objdir-anchored: `xpcshell` and `server.js` are far too generic to report on their own, the same rule the mochitest server-port preflight already applies. Report-only by default; `--reap-orphans` opts into terminating them. It never refuses a run — a survivor degrades performance rather than making the run dispatch against the wrong server, so the right response is to say so loudly, not to stop.
+
+### Patch lint
+
+- **Per-patch lint ran no Prettier on `.sys.mjs`, so module formatting drift was invisible to every gate** — which is how it survived to a human reviewer. `patchLint.prettier` (`'off'` by default) runs the project's configured Prettier over patch-owned `.sys.mjs` modules. It runs with `cwd` set to `engine/`, which is the half that matters: a fork's ROOT `.prettierignore` typically excludes `engine/`, so the same `prettier --check --config engine/.prettierrc.js <engine files>` run from the repo root reports "all files use Prettier code style" for files that fail the identical check from inside `engine/` — a root-level spot-check falsely refuted a correct reviewer finding on exactly this. Prettier is resolved from `engine/node_modules` first, then the project's, then `npx --no-install`. Exit 2 is reported as prettier failing rather than as formatting drift, since `--write` cannot fix it. Left off, formatting is explicitly out of scope for the per-patch tier — that is now the stated contract rather than an accident.
+- **The `file-too-large` thresholds were module constants, and the soft tier was effectively hard.** Nothing in `fireforge.json` could move `500/750/900` (general) or `1200/1400/1600` (test), and because the recommended gate posture is `--max-warnings 0`, the 750 "soft limit" is a hard failure — a controller sitting at 751 lines failed a gate with a message calling 750 soft, at exactly the moment someone is deciding whether to restructure a file. `patchLint.fileSizeThresholds.{general,test}.{notice,warning,error}` now tunes them (each field optional, merged over the defaults, validated as positive integers ordered `notice <= warning <= error` against the MERGED triple). The message drops the soft/hard vocabulary for what the band actually is — a warning — and names the consequence: a gate running `--max-warnings 0` treats it as a failure. The patch-SIZE thresholds keep their existing wording; only the file-size rule was reported.
+
 ## 0.44.0
 
 ### Gates
@@ -86,6 +126,8 @@
 - **`token add --variant` required a flag that described nothing, rejected its companion, and reported a no-op as success.** Three separate frictions, all in the variant path. `--category` was an unconditional `requiredOption` that had to name a REAL category even under `--variant`, where the declaration is routed into a `:root<selector>` block and never into a category section — the requirement existed so the argument would not be "silently discarded", a fair goal whose effect was a mandatory argument saying nothing about where the token lands. It is now optional there (still validated when supplied, so a typo is not accepted just because the flag is inert), and its absence on a BASE declaration is refused with the REASON stated rather than commander's bare "required option not specified".
   `--create-category` is still rejected with `--variant` — the two really are incompatible — but the working create-then-variant order (author the category with the base token, then add each variant) was discoverable only by failing twice. It is now in both the error and `--variant`'s help text.
   And a token already present in the target variant block was skipped with a bare `{ added: false }`, so a re-run intending to CHANGE a value exited 0 having changed nothing, while the base path had been reporting the category and line for the same situation all along. The variant path now returns the location too, and the skip reads `already exists in :root[…] (line N), unchanged` — the block being the location, since a variant declaration has no category to name.
+- **The CC0 public-domain dedication Mozilla puts on its test files was not a recognized license header.** `containsUpstreamLicenseText` knew MPL, Apache, MIT, GPL and a bare SPDX tag; nothing knew `Any copyright is dedicated to the Public Domain. http://creativecommons.org/publicdomain/zero/1.0/`. A modified upstream test whose notice was UNCHANGED therefore warned `modified-file-missing-header`, and the downstream workaround — two identifier-only edits, an `SPDX-License-Identifier: CC0-1.0` line above each untouched notice on patch 905 — was editing Mozilla's notice to satisfy FireForge's recognizer. Worse than filed: `hasThirdPartyPermissiveBanner` did not know it either, so a NEW file copied from the upstream test tree was neither "acceptable" nor "vendored", and `export -y` would have prepended the PROJECT's license header onto code Mozilla dedicated to the public domain — precisely the mislicensing the vendored carve-out (0.38.0) exists to prevent.
+  Both predicates now recognize the dedication in every spelling the tree carries — the prose, the `creativecommons.org/publicdomain/zero/1.0/` URL with either scheme, and the `CC0-1.0` SPDX identifier — through one shared matcher, so the two cannot drift. Deliberately narrow, with the negative controls pinned: a different Creative Commons license (`licenses/by/4.0/`, `CC-BY-4.0`), a made-up `publicdomain/zero/2.0/`, a bare "public domain" mention, and a dedication below the scanned head are all still refused.
 
 ### Security
 
@@ -108,6 +150,10 @@
 ### Performance
 
 - **`getAllDiff` spawned one `git hash-object` per untracked file, uncapped.** Its sibling `getDiffForFilesAgainstHead` was reshaped into classify → one batched hash → render for exactly this reason; this path kept the per-file form, and it is the only path behind `tree create`, `tree list`, `tree remove --all`, `lint` and `export-all` — against a Firefox tree where "untracked" can mean a very large number of files. Now batched. Everything observable is deliberately unchanged (renames, `ls-files` ordering, tracked-block-first emission, the `'\n'` empty sentinel) because this output is SHA-256'd into every tree fingerprint and written verbatim into `.patch` files; a new real-git test pins those bytes, which nothing did before.
+- **A dirty `jar.mn` escalated EVERY `test --build` to a full `mach build`, and a dirty `moz.build` re-ran `mach configure` every time — including immediately after the full build that had consumed exactly that content.** A downstream session measured it: 15:00 for the first full build, 14:03 for the next `test --build` because "`jar.mn` changed relative to its own successful-build record", and 17 s for the CSS-only fix that followed. Two of those three builds were the same work twice.
+  The cause is what "changed" meant. `collectChangedEnginePaths` unions the baseline-to-HEAD diff with every WORKTREE modification, and a fork's worktree is permanently dirty — imported patches plus Furnace-applied components are a standing diff against HEAD — so a patch-touched `jar.mn` was "changed" on every run for as long as the patch existed. The baseline already solved this for packageable files (`packageableFingerprints`, 0.40.0) and for `components.conf` (the static-components anchor), and both consumers compare content, not dirtiness; the build inputs were the one family with no fingerprint, because `isPackageablePath` excludes them by design and nothing else recorded them.
+  `last-build.json` now carries `buildInputFingerprints` — a content hash per dirty `jar.mn` / `moz.build` / `moz.configure` / `Makefile.in` / `mozbuild.in` — and `build-prepare` drops any input whose live hash still matches before deciding either escalation. The two halves refresh on different rules, and the difference is load-bearing: backend inputs are refreshed on every successful write, because every baseline-writing path ran the auto-configure preflight against the previous record first; `jar.mn` entries are refreshed only by a FULL build and carried forward verbatim on a `faster` one, because `fireforge build --ui` is a `mach build faster` that never escalates, and recording a `jar.mn` no full build has installed would silence the next escalation. `build --ui` therefore now says which kind of build it was (`writeBuildBaseline`'s new `buildKind`), and passes the previous baseline it was already holding. An unreadable file, a missing entry, or a marker written before the field existed all count as changed — "cannot prove unchanged" never becomes "unchanged". The stale-build preflight's hash loop became the shared `dropPathsMatchingFingerprints` so both consumers compare the same way.
+  **On the escalation itself** — the downstream ask was a scoped install-manifest refresh for jar-only registrations, or a reason full compilation is necessary. Read against mozbuild: every `mach build`, `faster` included, first runs `backend_out_of_date` and regenerates the backend through `config.status` when any `backend.*Backend.in` dependency is newer, and `jar.mn` files are such dependencies; the FasterMake backend consumes `JARManifest` objects for `dist/bin` targets into its own install manifests. So for an entry added to an EXISTING `jar.mn` under `dist/bin` — the Furnace widget case — a `faster` build likely installs the destination, and the 0.41.0 rule ("full build for new `jar.mn` registrations") looks over-broad. It is NOT relaxed here: the rule came from an observed failure whose specifics were not recorded, and the claim needs a real objdir to prove, which a source reading is not. The seam is already available to prove it with: `fireforge build --ui` never escalates, so a jar-only registration followed by `build --ui`, a check that `obj-*/faster/install_dist_bin` names the new destination and the file landed under `dist/bin`, then a plain `fireforge test`, is the experiment; two clean runs of it make narrowing the escalation (to new `jar.mn` files and non-`dist/bin` targets) a safe change. Recorded in `docs/testing.md` so the next reader inherits the analysis rather than the guess. Also recorded, not fixed: `build --ui` ignores `fullBuildRequired` and `package` runs `prepareBuildEnvironment` with no baseline at all, so neither auto-configures nor escalates.
 
 ### Drift collapsed
 
@@ -161,6 +207,7 @@
 - `RebasePatchEntry` became a discriminated union on `status`, so a status flip can no longer strand the previous status's payload — which `rebase --continue` did, persisting `{ status: 'resolved', error, conflictingFiles }` to the session file. The on-disk validator is deliberately NOT tightened to match: the session file carries no schema version, so a stricter validator would refuse a 0.43.x file mid-rebase, where the only remedies discard the operator's conflict resolution. Entries are normalized on read instead, and two tests pin that an older session still loads.
 - **A `patches.json` from a newer FireForge was reported as malformed.** `patches.json version must be 1` sent the operator looking for damage in a file that only needed a newer build to read it, and the manifest had no migration hook at all. It now refuses by name — naming the found and supported schema versions and telling the operator not to delete the file — while a version below 1 or non-integer keeps the plain malformed message, because that one really is malformed.
 - The three JSDoc walkers in `patch-lint-jsdoc.ts` return their issues instead of pushing into an out-param, matching the ~30 other patch-lint entry points. The new `jsdoc/check-param-names` rule immediately caught the stale `@param issues` the change left behind — which is the point of enabling it.
+- **`furnace create --test-dir` was honoured by the scaffolder and ignored by everything that told the operator where the files went.** `create.ts` resolved the override once and passed it to the scaffolders, but `formatDryRunPlan` and `formatSuccessNote` received only `binaryName` and recomputed the DEFAULT from it — so `--dry-run` planned `test/hominis/` plus `hominis/browser.toml` in `moz.build` for a command that would write to `test/hominis-tiles/`, and the success note after the real run named `hominis/` while the files sat in `hominis-tiles/`. The one message an operator gets as confirmation was the one thing that could not be trusted. Both formatters now take the resolved directory, and the default lives in one place: `resolveBrowserChromeTestDir` / `resolveXpcshellTestDir` in `furnace-constants.ts`, called by the scaffolders AND the formatters, so the two cannot disagree again. The moz.build registration line follows the override too (it is the path below `browser/base/content/test/`, which under `--test-dir` is not the binary name), and a test scaffolds for real and asserts the printed directory is the one on disk — default and overridden, browser-chrome and xpcshell.
 
 ### Windows
 

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "version": "0.44.3",
-  "commit": "760172104f6bfe523f63adfe08b8c6e63fd5d1f0",
-  "shortCommit": "760172104f6b",
+  "version": "0.45.0",
+  "commit": "19d461eb43b89962970510f9a2e655704e9fb952",
+  "shortCommit": "19d461eb43b8",
   "dirty": false,
   "dirtyHash": null,
-  "buildTime": "2026-08-28T15:34:58.794Z"
+  "buildTime": "2026-09-01T10:47:47.465Z"
 }

package/dist/src/commands/build.js

@@ -342,13 +342,18 @@ async function runBuildCommandBody(projectRoot, options) {
     // Record a fresh baseline only on clean success so the next run audits
     // against this build's HEAD. A failed build keeps the prior baseline so
     // the next attempt still catches long-standing packaging drops.
-    await recordFullBuildBaseline(projectRoot, paths.engine, config.binaryName, options.ui === true);
+    await recordFullBuildBaseline(projectRoot, paths.engine, config.binaryName, options.ui === true, previousBaseline);
     outro(`Build completed in ${timeStr}!`);
 }
-/** Persists the full-coverage baseline; a failed write never fails the build. */
-async function recordFullBuildBaseline(projectRoot, engineDir, binaryName, ui) {
+/**
+ * Persists the full-coverage baseline; a failed write never fails the build.
+ * `--ui` is a `mach build faster`, so it is recorded as such: its `jar.mn`
+ * fingerprints are carried forward from the previous baseline rather than
+ * refreshed, which is why that baseline is threaded through.
+ */
+async function recordFullBuildBaseline(projectRoot, engineDir, binaryName, ui, previousBaseline) {
     try {
-        await writeBuildBaseline(projectRoot, engineDir, binaryName, 'full', undefined, ui ? 'fireforge build --ui' : 'fireforge build');
+        await writeBuildBaseline(projectRoot, engineDir, binaryName, 'full', previousBaseline, ui ? 'fireforge build --ui' : 'fireforge build', 'auto', ui ? 'faster' : 'full');
     }
     catch (baselineError) {
         verbose(`Could not persist build baseline: ${toError(baselineError).message}`);

package/dist/src/commands/doctor-source-pin.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Doctor check comparing the CONFIGURED Firefox source pin against what the
+ * engine checkout actually is.
+ *
+ * `fireforge source set` lands `firefox.version` inside `fireforge.json`,
+ * beside hand-maintained policy sections. That is convenient and it is also
+ * the whole problem: a routine `git checkout -- fireforge.json` — undoing an
+ * accidental reformat, say — silently reverts an uncommitted pin along with
+ * it, and nothing afterwards reports that the pin and the checkout have
+ * diverged. The tell in the field was a gate flipping green with no change
+ * that should have made it green.
+ *
+ * This is deliberately not a lock and not a refusal: a tree may legitimately
+ * be mid-migration between two versions. It only makes a mismatched tree
+ * VISIBLE, which is all that was missing.
+ *
+ * Scope is limited by what is actually recorded. `firefox.product`,
+ * `firefox.sha256` and `firefox.candidate` have NO counterpart anywhere on
+ * disk — `.fireforge/state.json` records only `downloadedVersion` and
+ * `baseCommit` — so there is nothing to compare them against and the check
+ * says nothing about them rather than implying it verified them.
+ */
+import type { DoctorCheckDefinition } from './doctor-check-core.js';
+/**
+ * Pin-vs-checkout reporting. Needs the loaded config, so it declares the
+ * dependency on the config check that populates `ctx.config`; skipped
+ * entirely without an engine, where there is nothing to compare.
+ */
+export declare const SOURCE_PIN_DOCTOR_CHECK: DoctorCheckDefinition;

package/dist/src/commands/doctor-source-pin.js

@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Doctor check comparing the CONFIGURED Firefox source pin against what the
+ * engine checkout actually is.
+ *
+ * `fireforge source set` lands `firefox.version` inside `fireforge.json`,
+ * beside hand-maintained policy sections. That is convenient and it is also
+ * the whole problem: a routine `git checkout -- fireforge.json` — undoing an
+ * accidental reformat, say — silently reverts an uncommitted pin along with
+ * it, and nothing afterwards reports that the pin and the checkout have
+ * diverged. The tell in the field was a gate flipping green with no change
+ * that should have made it green.
+ *
+ * This is deliberately not a lock and not a refusal: a tree may legitimately
+ * be mid-migration between two versions. It only makes a mismatched tree
+ * VISIBLE, which is all that was missing.
+ *
+ * Scope is limited by what is actually recorded. `firefox.product`,
+ * `firefox.sha256` and `firefox.candidate` have NO counterpart anywhere on
+ * disk — `.fireforge/state.json` records only `downloadedVersion` and
+ * `baseCommit` — so there is nothing to compare them against and the check
+ * says nothing about them rather than implying it verified them.
+ */
+import { getFirefoxVersion } from '../core/firefox.js';
+import { toError } from '../utils/errors.js';
+import { ok, warning } from './doctor-check-core.js';
+const CHECK_NAME = 'Source pin matches engine';
+/**
+ * Reports the configured pin beside the two facts that can contradict it:
+ * the engine's own `browser/config/version.txt`, and the version the last
+ * download recorded into state.
+ */
+async function runSourcePinCheck(ctx) {
+    const pinned = ctx.config?.firefox.version;
+    if (pinned === undefined) {
+        // The config failed to load (its own check already reported that), so
+        // there is no pin to compare. Silence beats a second complaint.
+        return ok(CHECK_NAME, 'Skipped: no configured source version');
+    }
+    let actual;
+    try {
+        // A blank or whitespace-only version.txt (a truncated write, a partial
+        // extraction) carries no version to compare — treat it as absent rather
+        // than reporting the engine as being at version "".
+        actual = (await getFirefoxVersion(ctx.paths.engine))?.trim() || undefined;
+    }
+    catch (error) {
+        // Best-effort: an unreadable version.txt is not a pin mismatch, and a
+        // diagnostic must never turn into a failure of its own.
+        return ok(CHECK_NAME, `Configured ${pinned}; engine version could not be read (${toError(error).message})`);
+    }
+    const downloaded = ctx.state.downloadedVersion;
+    const mismatches = [];
+    if (actual !== undefined && actual !== pinned) {
+        mismatches.push(`engine/browser/config/version.txt reads ${actual}`);
+    }
+    if (downloaded !== undefined && downloaded !== pinned) {
+        mismatches.push(`the last download recorded ${downloaded}`);
+    }
+    if (mismatches.length === 0) {
+        const observed = actual ?? downloaded;
+        return ok(CHECK_NAME, observed === undefined
+            ? `Configured ${pinned}; no engine version to compare against yet`
+            : `Configured ${pinned}, engine ${observed}`);
+    }
+    return warning(CHECK_NAME, `fireforge.json pins Firefox ${pinned}, but ${mismatches.join(' and ')}.`, 'If the pin is right, run "fireforge download" to bring the checkout to it. If the ' +
+        'CHECKOUT is right, run "fireforge source set --version <version>" to record it — a ' +
+        'pin set but not committed is lost by any revert of fireforge.json, which is the most ' +
+        'common way these diverge.');
+}
+/**
+ * Pin-vs-checkout reporting. Needs the loaded config, so it declares the
+ * dependency on the config check that populates `ctx.config`; skipped
+ * entirely without an engine, where there is nothing to compare.
+ */
+export const SOURCE_PIN_DOCTOR_CHECK = {
+    name: CHECK_NAME,
+    skipIf: (ctx) => !ctx.engineExists,
+    dependsOn: ['fireforge.json is valid'],
+    run: runSourcePinCheck,
+};

package/dist/src/commands/doctor.js

@@ -20,6 +20,7 @@ import { FURNACE_DOCTOR_CHECKS } from './doctor-furnace.js';
 import { ORPHANED_HARNESS_DOCTOR_CHECK } from './doctor-orphaned-harness.js';
 import { PATCH_MANIFEST_CONSISTENCY_CHECK } from './doctor-patch-manifest.js';
 import { POST_REBASE_AUDIT_CHECK } from './doctor-post-rebase-audit.js';
+import { SOURCE_PIN_DOCTOR_CHECK } from './doctor-source-pin.js';
 import { inspectEngineWorkingTree } from './doctor-working-tree.js';
 import { collectPatchQueueHealth } from './verify.js';
 /**
@@ -211,6 +212,7 @@ const DOCTOR_CHECKS = [
             return failure('Pending Resolution', `You are currently resolving a conflict for patch ${patchFilename}.`, 'Build and Export commands may behave unexpectedly until "fireforge resolve" is completed. If the queue now verifies cleanly, run "fireforge doctor --clear-resolution" to discard the stale marker.');
         },
     },
+    SOURCE_PIN_DOCTOR_CHECK,
     {
         name: 'Engine is git repository',
         skipIf: (ctx) => !ctx.engineExists,

package/dist/src/commands/export-flow.js

@@ -12,12 +12,12 @@ import {} from '../core/destructive.js';
 import { detectMovedCodeOverlaps, formatAdoptThenSplitRemedy, } from '../core/export-moved-code-shape.js';
 import { normalizePatchArtifact } from '../core/patch-artifact-normalize.js';
 import { findAllPatchesForFilesWithDetails, patchNameSlug, planExport, } from '../core/patch-export.js';
-import { buildModifiedFileAdditionsFromDiff, buildPatchQueueContext, detectNewFilesInDiff, lintPatchQueue, } from '../core/patch-lint.js';
+import { buildModifiedFileAdditionsFromDiff, buildPatchQueueContext, lintPatchQueue, } from '../core/patch-lint.js';
 import { withPatchDirectoryLock } from '../core/patch-lock.js';
 import { addPatchToManifest, loadPatchesManifest, loadPatchesManifestForWrite, renumberPatchesInManifest, resolvePatchIdentifier, savePatchesManifest, } from '../core/patch-manifest.js';
 import { requirePatchOrder } from '../core/patch-parse.js';
 import { applyRenameMapToManifest, buildProjectedManifest, enforcePatchPolicy, } from '../core/patch-policy.js';
-import { extractNewFileContentFromDiff } from '../core/patch-transform.js';
+import { buildNewFileTextProjection } from '../core/patch-transform.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { toError } from '../utils/errors.js';
 import { pathExists, readText, removeFile, writeText } from '../utils/fs.js';
@@ -166,21 +166,6 @@ export async function resolvePlacementPlan(patchesDir, options, category, name,
     assertPlacementAvoidsReservedRanges(plan, existingPatches, config);
     return plan;
 }
-/**
- * Extracts the newly-created files a diff would produce and builds the
- * `newFiles` map in the shape expected by {@link PatchQueueEntry}. Used
- * to build a faithful synthetic entry for the pending patch when
- * projecting through cross-patch lint — without this the forward-import
- * rule cannot see imports authored by the new patch itself.
- */
-function buildNewFilesFromDiff(diff) {
-    const newFiles = new Map();
-    const newFilePaths = detectNewFilesInDiff(diff);
-    for (const path of newFilePaths) {
-        newFiles.set(path, extractNewFileContentFromDiff(diff, path));
-    }
-    return newFiles;
-}
 /**
  * Projects the placement through cross-patch lint to detect forward-imports
  * the renumber would introduce *or* that the new patch itself would
@@ -206,7 +191,7 @@ export async function projectPlacementForLint(patchesDir, plan, diff, config) {
         order: plan.insertionOrder,
         metadata: null,
         diff,
-        newFiles: buildNewFilesFromDiff(diff),
+        newFiles: buildNewFileTextProjection(diff),
         modifiedFileAdditions: buildModifiedFileAdditionsFromDiff(diff),
     });
     projectedEntries.sort((a, b) => a.order - b.order || a.filename.localeCompare(b.filename));

package/dist/src/commands/furnace/create-browser-test.d.ts

@@ -14,6 +14,15 @@ import type { ResolvedTestStyle } from '../../types/furnace.js';
  * tree, so a redirect makes no sense there.
  */
 export declare function resolveValidatedTestDir(rawTestDir: string | undefined, testStyle: ResolvedTestStyle): string | undefined;
+/**
+ * Scaffolds browser mochitest files for a newly created custom component.
+ * @param componentName - Custom element tag name
+ * @param license - Project license used for generated headers
+ * @param forgeConfig - Project config fields needed for test naming
+ * @param paths - Resolved project paths used to place test files
+ * @param journal - Optional rollback journal that snapshots files before writes
+ * @returns Relative test filenames created or updated for the component
+ */
 /**
  * Normalizes and validates a `--test-dir` override: engine-relative,
  * under `browser/base/content/test/` (so manifest registration keeps

package/dist/src/commands/furnace/create-browser-test.js

@@ -7,6 +7,7 @@
  * the per-file line budget.
  */
 import { join } from 'node:path';
+import { BROWSER_TEST_SCAFFOLD_ROOT, resolveBrowserChromeTestDir, } from '../../core/furnace-constants.js';
 import { recordCreatedDir, snapshotFile, } from '../../core/furnace-rollback.js';
 import { getLicenseHeader } from '../../core/license-headers.js';
 import { registerTestManifest } from '../../core/moz-manifest-register.js';
@@ -40,7 +41,6 @@ export function resolveValidatedTestDir(rawTestDir, testStyle) {
  * @param journal - Optional rollback journal that snapshots files before writes
  * @returns Relative test filenames created or updated for the component
  */
-const TEST_SCAFFOLD_ROOT = 'browser/base/content/test/';
 /**
  * Normalizes and validates a `--test-dir` override: engine-relative,
  * under `browser/base/content/test/` (so manifest registration keeps
@@ -48,9 +48,9 @@ const TEST_SCAFFOLD_ROOT = 'browser/base/content/test/';
  */
 export function resolveTestDirOverride(raw) {
     const normalized = stripEnginePrefix(raw).replace(/\/+$/, '');
-    if (!normalized.startsWith(TEST_SCAFFOLD_ROOT) ||
-        normalized === TEST_SCAFFOLD_ROOT.slice(0, -1)) {
-        throw new InvalidArgumentError(`--test-dir must be an engine-relative directory under ${TEST_SCAFFOLD_ROOT} (got "${raw}").`, 'testDir');
+    if (!normalized.startsWith(BROWSER_TEST_SCAFFOLD_ROOT) ||
+        normalized === BROWSER_TEST_SCAFFOLD_ROOT.slice(0, -1)) {
+        throw new InvalidArgumentError(`--test-dir must be an engine-relative directory under ${BROWSER_TEST_SCAFFOLD_ROOT} (got "${raw}").`, 'testDir');
     }
     return normalized;
 }
@@ -78,8 +78,8 @@ export async function scaffoldTestFiles(componentName, license, forgeConfig, pat
     // `.../test/<binaryName>/` target can collide with a test suite owned by a
     // different patch. The manifest-registration name is the path below
     // browser/base/content/test/ (nested manifests are supported).
-    const testDirRel = testDirOverride ?? `${TEST_SCAFFOLD_ROOT}${binaryName}`;
-    const testDirName = testDirRel.slice(TEST_SCAFFOLD_ROOT.length);
+    const testDirRel = resolveBrowserChromeTestDir(binaryName, testDirOverride);
+    const testDirName = testDirRel.slice(BROWSER_TEST_SCAFFOLD_ROOT.length);
     const testDir = join(paths.engine, testDirRel);
     if (journal && !(await pathExists(testDir))) {
         recordCreatedDir(journal, testDir);

package/dist/src/commands/furnace/create-dry-run.d.ts

@@ -15,6 +15,14 @@ export interface DryRunPlanInput {
     testStyle: ResolvedTestStyle;
     description: string;
     binaryName: string;
+    /**
+     * Resolved `--test-dir` override (engine-relative, already validated by
+     * `resolveValidatedTestDir`). Omit for the default `<binaryName>`-derived
+     * scaffold directory. The formatters MUST receive the same value the
+     * scaffolders get — the plan used to recompute the default from
+     * `binaryName` and named a directory the real run never wrote to.
+     */
+    testDir?: string;
 }
 /**
  * Builds the success-note body printed after `furnace create` has applied
@@ -27,6 +35,8 @@ export declare function formatSuccessNote(args: {
     testFiles: string[];
     testStyle: ResolvedTestStyle;
     binaryName: string;
+    /** Resolved `--test-dir` override; see {@link DryRunPlanInput.testDir}. */
+    testDir?: string | undefined;
 }): string;
 /**
  * Builds the planned component + test file list for a dry-run preview.

package/dist/src/commands/furnace/create-dry-run.js

@@ -7,6 +7,7 @@
  * resolved by the command's validation phase — so it can be exercised
  * independently of the mutation plumbing.
  */
+import { BROWSER_TEST_SCAFFOLD_ROOT, resolveBrowserChromeTestDir, resolveXpcshellTestDir, } from '../../core/furnace-constants.js';
 /**
  * Builds the test-section fragment of the dry-run plan for a given
  * harness choice. Kept separate from the top-level formatter so the
@@ -14,7 +15,7 @@
  * complexity budget.
  */
 function formatTestSection(args) {
-    const { testStyle, componentName, binaryName } = args;
+    const { testStyle, componentName, binaryName, testDir } = args;
     if (testStyle === 'none')
         return '';
     const strippedName = componentName.startsWith('moz-') ? componentName.slice(4) : componentName;
@@ -23,14 +24,18 @@ function formatTestSection(args) {
         : strippedName;
     const underscored = withoutBinaryPrefix.replace(/-/g, '_');
     if (testStyle === 'browser-chrome') {
-        const testRoot = `engine/browser/base/content/test/${binaryName}/`;
-        return (`\n\nWould create test files in ${testRoot}:\n` +
+        // Same resolver as scaffoldTestFiles: the registration name is the
+        // path below browser/base/content/test/, which under --test-dir is
+        // NOT the binary name.
+        const testDirRel = resolveBrowserChromeTestDir(binaryName, testDir);
+        const manifestName = testDirRel.slice(BROWSER_TEST_SCAFFOLD_ROOT.length);
+        return (`\n\nWould create test files in engine/${testDirRel}/:\n` +
             `  browser.toml\n  head.js\n  browser_${binaryName}_${underscored}.js` +
-            `\n\nWould register ${binaryName}/browser.toml in engine/browser/base/moz.build`);
+            `\n\nWould register ${manifestName}/browser.toml in engine/browser/base/moz.build`);
     }
     if (testStyle === 'xpcshell') {
-        const testRoot = `engine/browser/base/content/test/${binaryName}-xpcshell/${componentName}/`;
-        return `\n\nWould create xpcshell test files in ${testRoot}`;
+        const testDirRel = resolveXpcshellTestDir(binaryName, componentName, testDir);
+        return `\n\nWould create xpcshell test files in engine/${testDirRel}/`;
     }
     // testStyle === 'mochikit' (last remaining branch in ResolvedTestStyle).
     const testRoot = 'engine/toolkit/content/tests/widgets/';
@@ -42,19 +47,19 @@ function formatTestSection(args) {
  * stay in lock-step when the scaffolded layout changes.
  */
 export function formatSuccessNote(args) {
-    const { componentName, files, testFiles, testStyle, binaryName } = args;
+    const { componentName, files, testFiles, testStyle, binaryName, testDir } = args;
     let note = `Files created in components/custom/${componentName}/:\n` +
         files.map((f) => `  ${f}`).join('\n');
     if (testFiles.length > 0) {
         let testRoot;
         if (testStyle === 'xpcshell') {
-            testRoot = `engine/browser/base/content/test/${binaryName}-xpcshell/${componentName}/`;
+            testRoot = `engine/${resolveXpcshellTestDir(binaryName, componentName, testDir)}/`;
         }
         else if (testStyle === 'mochikit') {
             testRoot = 'engine/toolkit/content/tests/widgets/';
         }
         else {
-            testRoot = `engine/browser/base/content/test/${binaryName}/`;
+            testRoot = `engine/${resolveBrowserChromeTestDir(binaryName, testDir)}/`;
         }
         note += `\n\nTest files in ${testRoot}:\n` + testFiles.map((f) => `  ${f}`).join('\n');
     }
@@ -75,7 +80,7 @@ export function formatSuccessNote(args) {
  * `components/custom/` to match the wording of the real success note.
  */
 export function formatDryRunPlan(args) {
-    const { componentName, localized, register, composes, stockAdditions, sharedFtl, testStyle, description, binaryName, } = args;
+    const { componentName, localized, register, composes, stockAdditions, sharedFtl, testStyle, description, binaryName, testDir, } = args;
     const componentFiles = [`${componentName}.mjs`, `${componentName}.css`];
     // A per-component .ftl is scaffolded only when the component does NOT
     // opt into a shared feature-scoped bundle. Mirrors writeComponentFiles.
@@ -83,7 +88,7 @@ export function formatDryRunPlan(args) {
         componentFiles.push(`${componentName}.ftl`);
     let plan = `Would create files in components/custom/${componentName}/:\n` +
         componentFiles.map((f) => `  ${f}`).join('\n');
-    plan += formatTestSection({ testStyle, componentName, binaryName });
+    plan += formatTestSection({ testStyle, componentName, binaryName, testDir });
     plan += `\n\nWould add custom entry to furnace.json:`;
     plan += `\n  name: ${componentName}`;
     plan += `\n  description: ${description || '(empty)'}`;

package/dist/src/commands/furnace/create-xpcshell.js

@@ -5,7 +5,7 @@
  * per-file LOC budget and the scaffolder is unit-testable in isolation.
  */
 import { join } from 'node:path';
-import { xpcshellTestParentDir } from '../../core/furnace-constants.js';
+import { resolveXpcshellTestDir, xpcshellTestParentDir } from '../../core/furnace-constants.js';
 import { recordCreatedDir, snapshotFile, } from '../../core/furnace-rollback.js';
 import { getLicenseHeader } from '../../core/license-headers.js';
 import { ensureDir, pathExists, readText, writeText } from '../../utils/fs.js';
@@ -31,7 +31,7 @@ export async function scaffoldXpcshellTestFiles(componentName, license, forgeCon
     const parentDirName = parentRelDir.split('/').slice(-1)[0] ?? `${forgeConfig.binaryName}-xpcshell`;
     // --test-dir names the FINAL directory (no per-component segment is
     // appended) so the operator controls the exact scaffold target.
-    const testDirRel = testDirOverride ?? `${parentRelDir}/${componentName}`;
+    const testDirRel = resolveXpcshellTestDir(forgeConfig.binaryName, componentName, testDirOverride);
     const testDir = join(paths.engine, testDirRel);
     if (journal && !(await pathExists(testDir))) {
         recordCreatedDir(journal, testDir);

package/dist/src/commands/furnace/create.js

@@ -356,6 +356,10 @@ export async function furnaceCreateCommand(projectRoot, name, options = {}) {
             testStyle,
             description,
             binaryName: forgeConfig.binaryName,
+            // The plan must name the directory the scaffolder will actually use:
+            // an omitted override here is how the printed path came to disagree
+            // with the files a real run wrote.
+            ...(testDir !== undefined ? { testDir } : {}),
         });
         note(plan, componentName);
         outro('Dry run complete (no files modified)');
@@ -391,6 +395,7 @@ export async function furnaceCreateCommand(projectRoot, name, options = {}) {
         testFiles,
         testStyle,
         binaryName: forgeConfig.binaryName,
+        ...(testDir !== undefined ? { testDir } : {}),
     }), componentName);
     outro('Component created');
 }

package/dist/src/commands/patch/move-files-into.js

@@ -17,11 +17,11 @@
 import { join } from 'node:path';
 import { appendHistory, assertConfirmationAvailable, confirmDestructive, } from '../../core/destructive.js';
 import { normalizePatchArtifact } from '../../core/patch-artifact-normalize.js';
-import { buildModifiedFileAdditionsFromDiff, buildPatchQueueContext, collectForwardImportEdges, detectNewFilesInDiff, formatPatchLintIssue, lintPatchQueue, } from '../../core/patch-lint.js';
+import { buildModifiedFileAdditionsFromDiff, buildPatchQueueContext, collectForwardImportEdges, formatPatchLintIssue, lintPatchQueue, } from '../../core/patch-lint.js';
 import { computeProjectedLintRegressions } from '../../core/patch-lint-projection.js';
 import { withPatchDirectoryLock } from '../../core/patch-lock.js';
 import { loadPatchesManifest, savePatchesManifest, validatePatchesManifest, } from '../../core/patch-manifest.js';
-import { extractNewFileContentFromDiff } from '../../core/patch-transform.js';
+import { buildNewFileTextProjection } from '../../core/patch-transform.js';
 import { GeneralError, InvalidArgumentError } from '../../errors/base.js';
 import { toError } from '../../utils/errors.js';
 import { readText, writeText } from '../../utils/fs.js';
@@ -30,10 +30,7 @@ import { resolveWaitLockSeconds } from '../../utils/options.js';
 import { runPatchLint } from '../export-shared.js';
 import { buildSplitDiff, findOwnerRewriteHolders, mergeStagedForwardImports, rewriteSplitOwners, } from './split-plan.js';
 function projectEntryBody(diff) {
-    const newFiles = new Map();
-    for (const path of detectNewFilesInDiff(diff)) {
-        newFiles.set(path, extractNewFileContentFromDiff(diff, path));
-    }
+    const newFiles = buildNewFileTextProjection(diff);
     return { diff, newFiles, modifiedFileAdditions: buildModifiedFileAdditionsFromDiff(diff) };
 }
 /**

package/dist/src/commands/patch/split-plan.js

@@ -10,12 +10,12 @@ import { join } from 'node:path';
 import {} from '../../core/destructive.js';
 import { getDiffForFilesAgainstHead } from '../../core/git-diff.js';
 import { extractAffectedFiles } from '../../core/patch-apply.js';
-import { buildModifiedFileAdditionsFromDiff, buildPatchQueueContext, collectForwardImportEdges, detectNewFilesInDiff, formatPatchLintIssue, lintPatchQueue, } from '../../core/patch-lint.js';
+import { buildModifiedFileAdditionsFromDiff, buildPatchQueueContext, collectForwardImportEdges, formatPatchLintIssue, lintPatchQueue, } from '../../core/patch-lint.js';
 import { computeProjectedLintRegressions } from '../../core/patch-lint-projection.js';
 import { rewriteStagedDependencyOwners } from '../../core/patch-manifest.js';
 import { applyRenameMapToManifest, buildProjectedManifest } from '../../core/patch-policy.js';
 import { buildPatchSourceMetadata } from '../../core/patch-source-metadata.js';
-import { extractNewFileContentFromDiff } from '../../core/patch-transform.js';
+import { buildNewFileTextProjection } from '../../core/patch-transform.js';
 import { GeneralError, InvalidArgumentError } from '../../errors/base.js';
 import { pathExists } from '../../utils/fs.js';
 import { warn } from '../../utils/logger.js';
@@ -82,10 +82,7 @@ export function rewriteSplitOwners(patch, sourceFilename, movedSet, newFilename)
     };
 }
 function buildEntryProjection(diff) {
-    const newFiles = new Map();
-    for (const path of detectNewFilesInDiff(diff)) {
-        newFiles.set(path, extractNewFileContentFromDiff(diff, path));
-    }
+    const newFiles = buildNewFileTextProjection(diff);
     return { diff, newFiles, modifiedFileAdditions: buildModifiedFileAdditionsFromDiff(diff) };
 }
 /** Builds the projected post-split queue entries (renumber + shrunken source + new patch). */

package/dist/src/commands/re-export-adjacent.d.ts

@@ -10,6 +10,14 @@ export interface AdjacentUnmanagedContext {
     binaryName: string;
     furnacePrefixes: ReadonlySet<string>;
     refuseAdjacentUnmanaged: boolean;
+    /**
+     * Engine-relative paths named by `--expect-unmanaged`: reviewed, recorded
+     * exceptions that are reported but never refuse. Normalized once by the
+     * caller so the comparison matches git's engine-relative output.
+     */
+    approvedUnmanaged: ReadonlySet<string>;
+    /** Approved paths actually met this run, so unused ones can be surfaced. */
+    approvedSeen: Set<string>;
     refusals: {
         patchFilename: string;
         files: string[];