@hominis/fireforge 0.45.0 → 0.46.1

package/dist/src/commands/lint.js

@@ -21,16 +21,16 @@ import { lintPerPatch } from './lint-per-patch.js';
 /**
  * Resolves the diff the lint command should run against. Returns `null` when
  * there is nothing to lint (no matching files, clean tree, or empty diff
- * content) — callers treat that as the early-exit signal and stop.
+ * content). Callers treat that as the early-exit signal and stop.
  *
  * Extracted from {@link lintCommand} so that function stays under the
- * per-function LOC budget; the two file-mode and aggregate-mode branches
+ * per-function LOC budget. The two file-mode and aggregate-mode branches
  * share no state with the post-lint reporting pipeline.
  *
  * When `binaryName` is provided, the aggregate-mode branch (no explicit file
  * list) excludes paths under `browser/branding/<binaryName>/` from the diff.
- * `status` classifies those paths as `branding` — tool-managed material the
- * operator did not author directly — and without the exclusion
+ * `status` classifies those paths as `branding`, tool-managed material the
+ * operator did not author directly, and without the exclusion
  * `fireforge lint` on a fresh project immediately fails `large-patch-lines`
  * / `large-patch-files` / `missing-license-header` on the generated branding
  * tree. File-list mode (explicit paths) is unaffected: passing a branding
@@ -97,7 +97,7 @@ async function resolveLintDiff(engineDir, files, binaryName, furnacePrefixes) {
         return null;
     }
     // Aggregate-mode branding exclusion. A fresh-setup workspace carries a
-    // large tool-managed branding diff the operator did not author; running
+    // large tool-managed branding diff the operator did not author. Running
     // the default lint against it fires size and license-header rules on
     // content that was never intended to survive in the patch queue as-is. The
     // exclusion mirrors the `branding` bucket in `fireforge status` so the two
@@ -119,7 +119,7 @@ async function resolveLintDiff(engineDir, files, binaryName, furnacePrefixes) {
         // stories) that the operator did not author and never intended to land
         // on the patch queue. Without the carve-out, a post-`furnace preview`
         // aggregate `lint` fails with one `missing-license-header` error per
-        // generated story file — each is intentionally header-less because it is
+        // generated story file. Each is header-less on purpose because it is
         // re-generated from component metadata on every preview run.
         const filteredPaths = furnacePrefixes
             ? nonBrandingPaths.filter((path) => ![...furnacePrefixes].some((p) => path.startsWith(p)))
@@ -176,9 +176,9 @@ function buildMaxWarningsMessage(count, maxWarnings, scope) {
  * attribute via `issue.file`, which is the offending site and is owned by
  * some patch.
  *
- * Multiple owners: an issue is dropped if **any** owning patch waived the
- * rule. Conservative — never adds new findings, only drops already-waived
- * ones.
+ * Multiple owners: an issue is dropped if any owning patch waived the
+ * rule. This is conservative: it never adds new findings, only drops
+ * already-waived ones.
  *
  * @param issues - Issues collected from the aggregate lint run.
  * @param ctx - Patch queue context used to attribute file → patch.
@@ -208,7 +208,7 @@ export function applyAggregateLintIgnoreSuppression(issues, ctx) {
 }
 /**
  * Up-front flag validation for `lintCommand`: rejects `--only-introduced`
- * without `--since` and non-integer `--max-warnings` — each a
+ * without `--since` and non-integer `--max-warnings`, each a
  * misconfiguration that should fail loud rather than silently narrow the
  * result. Positional arguments in per-patch mode are patch selectors
  * and are validated downstream by `selectPatchSubset`.
@@ -216,7 +216,7 @@ export function applyAggregateLintIgnoreSuppression(issues, ctx) {
 function validateLintFlags(options) {
     // `--only-introduced` scopes the exit code to `--since`-tagged issues, so
     // without a revision to anchor the diff there is no "introduced" subset
-    // to scope to — reject the combination up-front so a misconfigured CI
+    // to scope to. Reject the combination up-front so a misconfigured CI
     // invocation fails loud instead of silently treating every error as
     // cumulative and passing.
     if (options.onlyIntroduced && !options.since) {
@@ -226,13 +226,13 @@ function validateLintFlags(options) {
         (!Number.isInteger(options.maxWarnings) || options.maxWarnings < 0)) {
         throw new InvalidArgumentError('--max-warnings must be a non-negative integer.', '--max-warnings');
     }
-    // `--patches` only means something in per-patch mode (it filters the
-    // queue); in aggregate/file-list mode there is no patch loop to narrow.
+    // `--patches` only means something in per-patch mode, where it filters
+    // the queue. In aggregate/file-list mode there is no patch loop to narrow.
     if (options.patches !== undefined && !options.perPatch) {
         throw new InvalidArgumentError('--patches requires --per-patch.', '--patches');
     }
     // The JSON report is a per-patch artifact (per-patch size metrics and
-    // suppressed issues); aggregate mode has no per-patch rows to report.
+    // suppressed issues). Aggregate mode has no per-patch rows to report.
     if (options.report !== undefined && !options.perPatch) {
         throw new InvalidArgumentError('--report requires --per-patch.', '--report');
     }
@@ -242,7 +242,7 @@ function validateLintFlags(options) {
  * applied patch summed (no explicit file scope, multi-patch queue), the
  * `large-patch-lines` / `large-patch-files` counts are an artefact of
  * aggregation rather than a property of any one patch. Surface the
- * `--per-patch` hint and downgrade those two rules to warnings; per-patch
+ * `--per-patch` hint and downgrade those two rules to warnings. Per-patch
  * mode keeps them as errors.
  */
 function downgradeAggregateSizeRules(issues, files, ctx) {
@@ -260,8 +260,8 @@ function downgradeAggregateSizeRules(issues, files, ctx) {
 }
 /**
  * Evaluates the patch-size rules (`large-patch-files` / `large-patch-lines`)
- * for an ad-hoc explicit-file-list lint, scoped to each file's **owning
- * patch** rather than the combined file list.
+ * for an ad-hoc explicit-file-list lint, scoped to each file's owning
+ * patch rather than the combined file list.
  *
  * Feeding every passed file to `lintExportedPatch` as one synthetic patch
  * makes a cross-patch selection of eight files belonging to four patches
@@ -269,7 +269,7 @@ function downgradeAggregateSizeRules(issues, files, ctx) {
  * oversized. This helper groups the affected files by their owning patch
  * (via the manifest's `filesAffected`), then runs `lintPatchSize` against
  * each owner's real file count + diff, honouring that owner's `tier` and
- * `lintIgnore` — so `lint <files>`, `lint --per-patch`, and
+ * `lintIgnore`, so `lint <files>`, `lint --per-patch`, and
  * `re-export --dry-run` agree on the same size findings for the same files.
  * Files no patch claims are evaluated together as one prospective new patch,
  * preserving the pre-export oversized-change warning.
@@ -338,9 +338,9 @@ async function lintOwningPatchSizes(engineDir, filesAffected, ctx) {
  */
 async function reportLintOutcome(engineDir, issues, options) {
     // Diff-scoping: tag each issue as introduced-in-current-task vs
-    // cumulative-pre-existing-drift. Never filters — full set still prints
-    // and exit code semantics are unchanged — but the per-line prefix and
-    // summary make triage trivial on a large patch series.
+    // cumulative-pre-existing-drift. Nothing is filtered (the full set still
+    // prints and exit code semantics are unchanged), but the per-line prefix
+    // and summary make triage easier on a large patch series.
     const sinceActive = Boolean(options.since);
     if (options.since) {
         const diffFiles = await collectDiffFilePaths(engineDir, options.since);
@@ -371,8 +371,8 @@ async function reportLintOutcome(engineDir, issues, options) {
     }
     // Exit-code scope: `--only-introduced` narrows the failure criterion to
     // issues tagged `introduced`. Cumulative errors still print so the
-    // operator sees the full queue state, but do not fail lint — the
-    // case this serves is a branch whose own diff is clean but whose repo
+    // operator sees the full queue state, but do not fail lint. The case
+    // this serves is a branch whose own diff is clean but whose repo
     // already carries pre-existing queue errors from older patches.
     const failingErrors = options.onlyIntroduced
         ? errors.filter((i) => i.tag === 'introduced')
@@ -388,7 +388,7 @@ async function reportLintOutcome(engineDir, issues, options) {
         outro('Lint failed');
         throw new GeneralError(buildMaxWarningsMessage(warnings.length, options.maxWarnings));
     }
-    // Notices are advisory and do not count as warnings — emitting "passed
+    // Notices are advisory and do not count as warnings: emitting "passed
     // with warnings" when only notices fired contradicts the preceding
     // `0 warning(s)` summary line and reads as a regression. Errors suppressed
     // by --only-introduced still warrant the "with warnings" outro: they print
@@ -417,10 +417,10 @@ export async function lintCommand(projectRoot, files, options = {}) {
     const paths = getProjectPaths(projectRoot);
     await assertEngineGitReady(paths.engine);
     if (options.perPatch) {
-        // Positional arguments in per-patch mode select PATCHES through the
-        // same alias resolution as --patches — a non-matching
-        // positional fails loud against the queue listing, so an engine path
-        // can never silently lint. Explicit --patches entries come first.
+        // Positional arguments in per-patch mode select patches through the
+        // same alias resolution as --patches. A non-matching positional fails
+        // loud against the queue listing, so an engine path can never silently
+        // lint. Explicit --patches entries come first.
         const perPatchOptions = files.length > 0 ? { ...options, patches: [...(options.patches ?? []), ...files] } : options;
         await lintPerPatch(projectRoot, paths, perPatchOptions);
         return;
@@ -429,7 +429,7 @@ export async function lintCommand(projectRoot, files, options = {}) {
     // into the aggregate-mode branding exclusion in `resolveLintDiff`.
     const config = await loadConfig(projectRoot);
     // Pull the Furnace-managed prefix set up-front so aggregate lint can
-    // mirror the branding exclusion for Furnace material — without it,
+    // mirror the branding exclusion for Furnace material. Without it,
     // preview-generated stories under `browser/components/storybook/
     // stories/furnace/` show up as license-header errors on every
     // post-preview lint run.
@@ -446,7 +446,7 @@ export async function lintCommand(projectRoot, files, options = {}) {
     }
     // Ad-hoc explicit-file-list mode evaluates the patch-size rules per
     // owning patch (see `lintOwningPatchSizes`), so suppress the synthetic
-    // combined-list size check in the shared pass — otherwise a cross-patch
+    // combined-list size check in the shared pass. Otherwise a cross-patch
     // selection synthesises a phantom oversized patch from the file count.
     const fileListMode = files.length > 0 && ctx !== undefined;
     let issues = [
@@ -459,15 +459,15 @@ export async function lintCommand(projectRoot, files, options = {}) {
         issues.push(...(await lintOwningPatchSizes(paths.engine, filesAffected, ctx)));
     }
     // Cross-patch rules operate over the whole queue, so run them whenever a
-    // patches directory exists — they surface duplicate /dev/null creations
+    // patches directory exists. They surface duplicate /dev/null creations
     // and forward-import chains that the per-patch orchestrator cannot see.
     if (ctx) {
         issues.push(...lintPatchQueue(ctx));
     }
     // Honor per-patch `lintIgnore` in aggregate mode by attributing each
     // issue's file to its owning patches via the manifest's `filesAffected`.
-    // Per-patch mode threads `lintIgnore` directly into `lintExportedPatch`;
-    // aggregate mode has no patch-level scope to consult, so a check an
+    // Per-patch mode threads `lintIgnore` directly into `lintExportedPatch`.
+    // Aggregate mode has no patch-level scope to consult, so a check an
     // operator explicitly waived in `patches.json` re-surfaces on every
     // `--since` run (the CI default).
     if (ctx) {
@@ -495,7 +495,7 @@ export function registerLint(program, { getProjectRoot, withErrorHandling }) {
         .option('--since <git-rev>', 'Tag issues as [introduced] or [cumulative] based on whether the file changed since <git-rev> (e.g. HEAD, a branch, a SHA)')
         .option('--only-introduced', 'Fail only on issues tagged [introduced] (requires --since). Cumulative errors still print but do not set a non-zero exit.')
         .option('--per-patch', "Lint each patch in the queue as its own isolated diff. Rescopes patch-size rules so they fire against individual patches rather than the aggregate. Honours each patch's `lintIgnore` entries.")
-        .option('--patches <names...>', 'With --per-patch, lint only the named patches. Accepts repeated flags, comma lists, full filenames/stems, manifest names, category-prefixed slugs, or bare slugs. Positional arguments after --per-patch are treated the same way.')
+        .option('--patches <names...>', 'With --per-patch, lint only the named patches. Accepts repeated flags, comma lists, full filenames/stems, bare order numbers, manifest names, category-prefixed slugs, or bare slugs. Positional arguments after --per-patch are treated the same way.')
         .option('--max-warnings <n>', 'Fail when lint reports more than <n> warning(s); use 0 for warning-clean release gates.')
         .option('--no-cache', 'Bypass per-patch lint result cache reads and writes.')
         .option('--report <path>', 'With --per-patch, write a machine-readable JSON report (per-patch size metrics, tier, thresholds, issues, and lintIgnore-suppressed issues) to <path>.')
@@ -533,8 +533,8 @@ export function registerLint(program, { getProjectRoot, withErrorHandling }) {
         .description('Manage the per-patch lint result cache')
         // Commander routes `fireforge lint cache` here even when the operator
         // meant to lint an engine directory literally named `cache`. A bare
-        // `lint cache` (no subcommand) used to silently do nothing — make the
-        // ambiguity explicit instead of doing the wrong operation quietly.
+        // `lint cache` (no subcommand) used to silently do nothing, so make
+        // the ambiguity explicit instead of doing the wrong operation quietly.
         .action(withErrorHandling(() => {
         info('Nothing to do: "lint cache" manages the lint result cache (try "lint cache clear"). ' +
             'To lint a directory named cache/, disambiguate with a trailing slash: "fireforge lint cache/".');

package/dist/src/commands/manifest.d.ts

@@ -8,8 +8,8 @@
  * of commands to enumerate.
  *
  * The order of entries in {@link COMMAND_MANIFEST} is the order commands
- * appear in `fireforge --help`; it is intentional, not alphabetical, and
- * groups related commands together.
+ * appear in `fireforge --help`. The order is chosen rather than
+ * alphabetical, and groups related commands together.
  */
 import type { CommandRegistrar } from '../types/cli.js';
 /**
@@ -18,9 +18,9 @@ import type { CommandRegistrar } from '../types/cli.js';
 export interface CommandManifestEntry {
     /**
      * Human-readable command name, matching the first token of the
-     * command line (e.g. `build`, `furnace`). Informational only — the
+     * command line (e.g. `build`, `furnace`). Informational only, since the
      * authoritative command string lives inside each registrar's
-     * `.command(...)` call — but useful for documentation, manifest
+     * `.command(...)` call, but useful for documentation, manifest
      * introspection, and test assertions.
      */
     name: string;

package/dist/src/commands/manifest.js

@@ -12,7 +12,7 @@ import { registerLint } from './lint.js';
 import { registerPackage } from './package.js';
 import { registerPatch } from './patch/index.js';
 import { registerReExport } from './re-export-register.js';
-import { registerRebase } from './rebase.js';
+import { registerRebase } from './rebase/index.js';
 import { registerRegister } from './register.js';
 import { registerReset } from './reset.js';
 import { registerResolve } from './resolve.js';

package/dist/src/commands/package.js

@@ -8,6 +8,7 @@ import { hasBuildArtifacts, machPackageCapture } from '../core/mach.js';
 import { assertBuildArtifacts } from '../core/mach-build-artifacts.js';
 import { explainMachError } from '../core/mach-error-hints.js';
 import { BuildError } from '../errors/build.js';
+import { elapsedSince } from '../utils/elapsed.js';
 import { error, info, intro, outro, verbose } from '../utils/logger.js';
 import { pickDefined } from '../utils/options.js';
 /**
@@ -44,8 +45,8 @@ export async function packageCommand(projectRoot, options) {
     const startTime = Date.now();
     let result;
     try {
-        // `machPackageCapture` streams output live AND captures the tail for
-        // post-run diagnostics; an inherit-only dispatch leaves the hint
+        // `machPackageCapture` streams output live and captures the tail for
+        // post-run diagnostics. An inherit-only dispatch leaves the hint
         // translator unable to see the failure text. The captured stderr is fed
         // through `explainMachError` below so recognised failure modes get an
         // actionable hint prepended to the raw mach output.
@@ -54,10 +55,7 @@ export async function packageCommand(projectRoot, options) {
     catch (error) {
         throw new BuildError('Package process failed to start', 'mach package', error instanceof Error ? error : undefined);
     }
-    const duration = Date.now() - startTime;
-    const minutes = Math.floor(duration / 60000);
-    const seconds = Math.floor((duration % 60000) / 1000);
-    const timeStr = minutes > 0 ? `${minutes}m ${seconds}s` : `${seconds}s`;
+    const timeStr = elapsedSince(startTime);
     if (result.exitCode !== 0) {
         error(`Packaging failed after ${timeStr}`);
         const combinedOutput = `${result.stdout}\n${result.stderr}`;

package/dist/src/commands/patch/compact.d.ts

@@ -1,10 +1,10 @@
 /**
- * `fireforge patch compact` — closes ordinal gaps in the patch queue.
+ * `fireforge patch compact`: closes ordinal gaps in the patch queue.
  *
  * After deletes or splits, patch ordinals may have gaps (e.g. 1, 3, 7).
  * This command renumbers patches to close those gaps in a single atomic
  * operation, preserving relative order. Without a patch policy the whole
- * queue is renumbered from 1; with `patchPolicy.ranges` configured the
+ * queue is renumbered from 1. With `patchPolicy.ranges` configured the
  * compaction is range-aware (each category range compacts independently,
  * reserved ranges and out-of-range strays are left untouched).
  */

package/dist/src/commands/patch/compact.js

@@ -1,24 +1,26 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
- * `fireforge patch compact` — closes ordinal gaps in the patch queue.
+ * `fireforge patch compact`: closes ordinal gaps in the patch queue.
  *
  * After deletes or splits, patch ordinals may have gaps (e.g. 1, 3, 7).
  * This command renumbers patches to close those gaps in a single atomic
  * operation, preserving relative order. Without a patch policy the whole
- * queue is renumbered from 1; with `patchPolicy.ranges` configured the
+ * queue is renumbered from 1. With `patchPolicy.ranges` configured the
  * compaction is range-aware (each category range compacts independently,
  * reserved ranges and out-of-range strays are left untouched).
  */
 import { Command } from 'commander';
 import { loadConfig } from '../../core/config.js';
-import { appendHistory, confirmDestructive } from '../../core/destructive.js';
+import { confirmDestructive } from '../../core/destructive.js';
+import { appendHistoryBestEffort } from '../../core/history-log.js';
 import { withPatchDirectoryLock } from '../../core/patch-lock.js';
 import { loadPatchesManifest, renumberPatchesInManifest, } from '../../core/patch-manifest.js';
 import { applyRenameMapToManifest, enforcePatchPolicy } from '../../core/patch-policy.js';
 import { GeneralError } from '../../errors/base.js';
-import { toError } from '../../utils/errors.js';
 import { info, intro, outro, warn } from '../../utils/logger.js';
 import { addWaitLockOption, pickDefined, resolveWaitLockSeconds } from '../../utils/options.js';
+import { proceedAfterDecision } from '../destructive-decision.js';
+import { renameMapsEqual } from '../patch-rename-map.js';
 import { requirePatchQueue } from './patch-context.js';
 import { rebuildFilenameForOrder } from './reorder.js';
 /** True when `order` falls inside a configured reserved range. */
@@ -30,9 +32,9 @@ function isReservedOrder(policyCfg, order) {
  *
  * Without a patch policy, all patches are renumbered to 1, 2, 3, … in
  * current sort order (historical behaviour). With `patchPolicy.ranges`
- * configured, compaction happens *within* each category range instead:
+ * configured, compaction happens within each category range instead:
  * each range's members are renumbered consecutively starting at the
- * range's first occupied ordinal, skipping reserved orders — mirroring
+ * range's first occupied ordinal, skipping reserved orders, mirroring
  * what `evaluateGaps` treats as gapless under `allowGaps: false`.
  * Reserved-range patches and patches outside their category's range are
  * never moved (a global renumber would project them across range
@@ -84,7 +86,7 @@ function computeCompactRenameMap(patches, policyCfg) {
 /**
  * Patches a range-aware compact leaves in place because they sit outside
  * their category's configured range (or outside all ranges) without a
- * reserved-range exception. They already violate `category-range`; moving
+ * reserved-range exception. They already violate `category-range`. Moving
  * them is a policy decision compact must not make silently.
  */
 function findCompactStrays(patches, policyCfg) {
@@ -139,14 +141,8 @@ export async function patchCompactCommand(projectRoot, options = {}) {
         dryRun: options.dryRun === true,
         unsafeOverride: options.forceUnsafe === true,
     });
-    if (decision === 'dry-run') {
-        outro('Dry run complete — no changes made');
+    if (!proceedAfterDecision(decision, 'Compact cancelled'))
         return;
-    }
-    if (decision === 'declined') {
-        outro('Compact cancelled');
-        return;
-    }
     await withPatchDirectoryLock(paths.patches, async () => {
         const currentManifest = await loadPatchesManifest(paths.patches);
         if (!currentManifest) {
@@ -157,6 +153,14 @@ export async function patchCompactCommand(projectRoot, options = {}) {
             info('Patch queue was compacted by another process. Nothing to do.');
             return;
         }
+        // The operator confirmed a specific plan. A queue that changed between
+        // the prompt and the lock (an export landing a new patch, a delete)
+        // yields a different plan whose renames were never shown, so refuse
+        // rather than commit them under a history entry that says "ok". This
+        // is the same gate `patch reorder` applies.
+        if (!renameMapsEqual(renameMap, currentRenameMap)) {
+            throw new GeneralError('Patch queue changed while waiting for confirmation. Re-run compact to recompute the rename plan.');
+        }
         enforcePatchPolicy({
             config,
             manifest: applyRenameMapToManifest(currentManifest, currentRenameMap),
@@ -179,12 +183,7 @@ export async function patchCompactCommand(projectRoot, options = {}) {
             ...(options.forceUnsafe === true ? { unsafeOverride: true } : {}),
             result: 'ok',
         };
-        try {
-            await appendHistory(paths.patches, historyEntry);
-        }
-        catch (historyError) {
-            warn(`History log append failed after patch compact committed: ${toError(historyError).message}`);
-        }
+        await appendHistoryBestEffort(paths.patches, historyEntry, `patch compact committed`);
     }, { waitLockSeconds: resolveWaitLockSeconds(options.waitLock), command: 'patch compact' });
     info(`Compacted ${renameMap.size} patch(es).`);
     outro('Compact complete');

package/dist/src/commands/patch/delete.d.ts

@@ -1,5 +1,5 @@
 /**
- * `fireforge patch delete <name>` — removes a patch from the queue.
+ * `fireforge patch delete <name>`: removes a patch from the queue.
  *
  * Destructive: refuses when a later patch imports a module owned by the
  * target (that would leave a dangling forward import), prompts for

package/dist/src/commands/patch/delete.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: EUPL-1.2
 /**
- * `fireforge patch delete <name>` — removes a patch from the queue.
+ * `fireforge patch delete <name>`: removes a patch from the queue.
  *
  * Destructive: refuses when a later patch imports a module owned by the
  * target (that would leave a dangling forward import), prompts for
@@ -9,13 +9,14 @@
  */
 import { basename } from 'node:path';
 import { Command } from 'commander';
-import { appendHistory, confirmDestructive } from '../../core/destructive.js';
+import { confirmDestructive } from '../../core/destructive.js';
+import { appendHistoryBestEffort } from '../../core/history-log.js';
 import { buildPatchQueueContext, extractImportSpecifiersWithLines, findForwardImportIgnoreLines, isForwardImportableFile, } from '../../core/patch-lint.js';
 import { withPatchDirectoryLock } from '../../core/patch-lock.js';
 import { removePatchFileAndManifest } from '../../core/patch-manifest.js';
-import { toError } from '../../utils/errors.js';
 import { info, intro, outro, warn } from '../../utils/logger.js';
 import { addWaitLockOption, pickDefined, resolveWaitLockSeconds } from '../../utils/options.js';
+import { proceedAfterDecision } from '../destructive-decision.js';
 import { requirePatchQueue, requirePatchTarget } from './patch-context.js';
 /**
  * Runs the `patch delete` command: removes a patch file and its manifest
@@ -35,7 +36,7 @@ export async function patchDeleteCommand(projectRoot, identifier, options = {})
     // Build the full queue context once so we can scan each patch's newFiles
     // without re-parsing for the dependency check below.
     const baseCtx = await buildPatchQueueContext(paths.patches);
-    // Hard refusal: an import owned by a LATER patch that points at any of
+    // Hard refusal: an import owned by a later patch that points at any of
     // the target's newly-created files is a dependency on the target. That
     // check is built directly from `baseCtx` rather than by diffing lint runs
     // over a projected state.
@@ -46,10 +47,10 @@ export async function patchDeleteCommand(projectRoot, identifier, options = {})
             targetNewFileLeaves.add(basename(fullPath));
         }
     }
-    // Scan every later patch's new files AND its added lines on pre-existing
+    // Scan every later patch's new files and its added lines on pre-existing
     // files for import specifiers that resolve to a leaf owned by the target.
     // Uses the shared specifier extractor so dynamic `import()` and
-    // `ChromeUtils.defineESModuleGetters` are picked up — the forward-import
+    // `ChromeUtils.defineESModuleGetters` are picked up: the forward-import
     // lint rule already covers those forms, and delete safety must match the
     // same set or it silently drops dependencies.
     //
@@ -109,14 +110,14 @@ export async function patchDeleteCommand(projectRoot, identifier, options = {})
     }
     const conflicts = dependents.length > 0
         ? {
-            // Wording deliberately clarifies the *runtime* impact: `git apply`
+            // The wording spells out the runtime impact: `git apply`
             // does not resolve imports and succeeds even when a later patch
             // imports a file the target created, so the queue re-imports
             // cleanly. The breakage surfaces at browser startup when
             // `ChromeUtils.importESModule` cannot locate the deleted module.
-            // Operators who deliberately plan to re-introduce the imported
-            // files (rename, refactor) need to know this is the impact model,
-            // not a patch-application failure.
+            // Operators who plan to re-introduce the imported files (rename,
+            // refactor) need to know this is the impact model rather than a
+            // patch-application failure.
             reason: `${dependents.length} later patch(es) contain import statements that reference files created by ${target.filename}. Patch application itself will still succeed, but runtime imports will fail at browser startup until those files are re-introduced.`,
             details: dependents,
         }
@@ -138,14 +139,8 @@ export async function patchDeleteCommand(projectRoot, identifier, options = {})
         unsafeOverride: options.forceUnsafe === true,
         conflicts,
     });
-    if (decision === 'dry-run') {
-        outro('Dry run complete — no changes made');
+    if (!proceedAfterDecision(decision, 'Delete cancelled'))
         return;
-    }
-    if (decision === 'declined') {
-        outro('Delete cancelled');
-        return;
-    }
     // Proceed: remove under the patch directory lock so concurrent exports
     // cannot race us into the same manifest row. The history append lives
     // inside the same lock so two concurrent deletes cannot interleave history
@@ -156,22 +151,17 @@ export async function patchDeleteCommand(projectRoot, identifier, options = {})
     // failure to the caller would mislead.
     await withPatchDirectoryLock(paths.patches, async () => {
         await removePatchFileAndManifest(paths.patches, target.filename);
-        try {
-            await appendHistory(paths.patches, {
-                operation: 'patch-delete',
-                args: {
-                    filename: target.filename,
-                    order: target.order,
-                    filesAffected: target.filesAffected,
-                },
-                ...(options.yes === true ? { yes: true } : {}),
-                ...(options.forceUnsafe === true ? { unsafeOverride: true } : {}),
-                result: 'ok',
-            });
-        }
-        catch (historyError) {
-            warn(`History log append failed after patch delete committed (${target.filename}): ${toError(historyError).message}`);
-        }
+        await appendHistoryBestEffort(paths.patches, {
+            operation: 'patch-delete',
+            args: {
+                filename: target.filename,
+                order: target.order,
+                filesAffected: target.filesAffected,
+            },
+            ...(options.yes === true ? { yes: true } : {}),
+            ...(options.forceUnsafe === true ? { unsafeOverride: true } : {}),
+            result: 'ok',
+        }, `patch delete committed (${target.filename})`);
     }, { waitLockSeconds: resolveWaitLockSeconds(options.waitLock), command: 'patch delete' });
     info(`Deleted ${target.filename}.`);
     outro('Delete complete');

package/dist/src/commands/patch/entry-projection.d.ts

@@ -0,0 +1,13 @@
+import type { PatchQueueEntry } from '../../core/patch-lint.js';
+/**
+ * Projects a rewritten patch body into the three fields cross-patch lint reads
+ * off a queue entry.
+ *
+ * `patch split` and `patch move-files` each had a byte-identical copy of this
+ * (`buildEntryProjection` / `projectEntryBody`). Both feed the same linter, so
+ * a change to what the projection carries has to reach both or the two
+ * commands start refusing different things for the same queue.
+ * @param diff - The rewritten patch body.
+ * @returns The diff plus its derived new-file and modified-file projections.
+ */
+export declare function projectEntryBody(diff: string): Pick<PatchQueueEntry, 'diff' | 'newFiles' | 'createdFiles' | 'modifiedFileAdditions'>;

package/dist/src/commands/patch/entry-projection.js

@@ -0,0 +1,24 @@
+import { buildModifiedFileAdditionsFromDiff } from '../../core/patch-lint.js';
+import { detectNewFilesInDiff } from '../../core/patch-lint-diff.js';
+import { buildNewFileTextProjection } from '../../core/patch-transform.js';
+/**
+ * Projects a rewritten patch body into the three fields cross-patch lint reads
+ * off a queue entry.
+ *
+ * `patch split` and `patch move-files` each had a byte-identical copy of this
+ * (`buildEntryProjection` / `projectEntryBody`). Both feed the same linter, so
+ * a change to what the projection carries has to reach both or the two
+ * commands start refusing different things for the same queue.
+ * @param diff - The rewritten patch body.
+ * @returns The diff plus its derived new-file and modified-file projections.
+ */
+export function projectEntryBody(diff) {
+    const newFiles = buildNewFileTextProjection(diff);
+    return {
+        diff,
+        newFiles,
+        // Body-kind agnostic: a binary creation is still a creation.
+        createdFiles: detectNewFilesInDiff(diff),
+        modifiedFileAdditions: buildModifiedFileAdditionsFromDiff(diff),
+    };
+}

package/dist/src/commands/patch/lint-ignore.d.ts

@@ -1,10 +1,9 @@
 /**
- * `fireforge patch lint-ignore <name>` — adds, removes, or clears entries
+ * `fireforge patch lint-ignore <name>`: adds, removes, or clears entries
  * in `PatchMetadata.lintIgnore` without rewriting the `.patch` file body.
  *
  * Companion to `fireforge re-export <name> --lint-ignore <id>` (which is
- * append-only). Existence is justified by the cases re-export cannot
- * express:
+ * append-only). It exists for the cases re-export cannot express:
  * - Removing a single entry without dropping the rest of the list.
  * - Clearing the entire list when the operator wants the rule(s) to
  *   start firing again.
@@ -15,19 +14,12 @@
  * `--clear` must be supplied per invocation. The read-modify-write
  * happens inside the patch directory lock via {@link mutatePatchMetadata}
  * so a concurrent writer cannot interleave between the read and the
- * write — important when an operator scripts repeated invocations or
+ * write, which matters when an operator scripts repeated invocations or
  * runs `--add` and `--remove` back-to-back.
  */
 import { Command } from 'commander';
 import type { CommandContext } from '../../types/cli.js';
 import type { PatchLintIgnoreOptions } from '../../types/commands/index.js';
-type LintIgnoreMode = 'add' | 'remove' | 'clear';
-/**
- * Renders a one-line summary of the planned change for use in
- * `info()` / dry-run / history args. Exported for unit-testing the
- * message format directly without mocking the logger transport.
- */
-export declare function describeChange(before: ReadonlyArray<string>, after: ReadonlyArray<string>, mode: LintIgnoreMode, values: ReadonlyArray<string>): string;
 /**
  * Runs the `patch lint-ignore` command: reads the patch's existing
  * `lintIgnore`, applies the requested mode, and writes the manifest.
@@ -44,4 +36,3 @@ export declare function patchLintIgnoreCommand(projectRoot: string, identifier:
  * @param context - Shared CLI registration context
  */
 export declare function registerPatchLintIgnore(parent: Command, context: CommandContext): void;
-export {};