@hominis/fireforge 0.46.2 → 0.47.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.47.0
+
+### Test preflight
+
+- The mochitest httpd preflight no longer calls another checkout's live harness "debris from an interrupted run" and prints its `kill -9`. It recognized the harness by `server.js` plus any objdir path, never asking whose objdir; a peer's suite in a sibling worktree matched and both printed remedies would have killed it. The holder's command line is now classified against this project's engine directory: only a `server.js` under it is offered for termination or reached by `--kill-stale-marionette`. One from another checkout is refused with that checkout's objdir named and no kill hint at all.
+
+### Builds
+
+- The pre-build Furnace sync prints the patch-owned overwrite warnings it computes. `applyAllComponents` already recorded "overwriting deployed X, its engine content differs from the components/ source" on every apply, and `furnace apply` printed it, but `fireforge build` and `test --build` read only the applied and error lists, so an engine-side edit to a Furnace-managed file (a negative control, say) was replaced silently and the control passed against the shipped code. The warnings now print on both paths, followed by one NOTICE saying how many engine files were REPLACED before the build and that the edit did not run.
+
+### Patch queue
+
+- A plain `re-export` (unchanged file set, new content) projects the rewritten body through the cross-patch queue rules before writing and refuses on new errors, the way `--files` and `--scan` already did. An earlier owner that gained a forward import of a later patch's module used to re-export green and surface a slice later as `errors already present in the queue` at the next `export` placement. The refusal prints the same `patch staged-dependency --add` remedy as the scan gate; `--force-unsafe` downgrades it to a warning; `--dry-run` refuses identically. The `--all` loop's in-memory queue projection now also refreshes `createdFiles`, which it left stale.
+- `patch delete` under `patchPolicy.allowGaps: false` names the numeric gap it is about to open, in `--dry-run` and at the prompt, with both remedies: `export --order <n>` to refill or `patch compact` to renumber. It had the manifest and the policy in hand and reported nothing; the operator learned the consequence from the next unrelated command's `numeric-gap` error.
+
+### Smoke runs
+
+- `run --smoke-exit` honours a `# max-hits: N` comment directly above a `--console-allow-file` entry: an allowlisted shape that fires more often than its ceiling is reported next to its attribution row (`hits×/N`) and fails the run with exit 12 like an unallowed error. The allowlist was count-blind, so an allowlisted error firing a thousand times in one boot exited 0. A directive that no entry follows is refused rather than dropped.
+- For the record: `Missing chrome or resource URL:` has been a smoke error since 0.45.0.
+
+### Furnace
+
+- A targeted `furnace deploy <tag>` refreshes every other deployed includer of a shared CSS fragment the target expands, when their expansion is stale against the fragment source, and prints a NOTICE naming them. It used to refresh only the named component, so a fragment edit followed by a targeted deploy left the remaining includers carrying the old expansion with no output saying so, and a re-export at that point would have shipped it. An includer whose refresh fails is listed as still stale with the deploy-all remedy, and fails the deploy: the engine must end consistent. `furnace apply <name>` has the same gap and is not changed here.
+
+### Test harness
+
+- New `fireforge test --shuffle [seed]` runs a mochitest selection in a seeded random file order: it forwards mach's `--shuffle`, exports `FIREFORGE_SHUFFLE_SEED=<seed>` to the harness (a fresh seed when omitted), prints the seed, and stamps `shuffle=<seed>` on the `FIREFORGE-VERDICT` line as an additive key. Mach's own shuffle is an unseeded `Math.random` pass, so a red found by shuffling could not be replayed. Reordering tasks inside a file is harness code that reads the exported seed. Mochitest-only: an xpcshell-only or generic dispatch is refused.
+
 ## 0.46.0
 
 ### Packaging audit

package/dist/build-info.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
-  "version": "0.46.2",
-  "commit": "533adc217a82c2a17735e8b38e25d8f41f8bfad8",
-  "shortCommit": "533adc217a82",
+  "version": "0.47.0",
+  "commit": "2bffcb5fee31d398a521874851af09a62134ae10",
+  "shortCommit": "2bffcb5fee31",
   "dirty": false,
   "dirtyHash": null,
-  "buildTime": "2026-09-05T23:00:12.026Z"
+  "buildTime": "2026-09-12T14:05:35.561Z"
 }

package/dist/src/commands/config.js

@@ -56,8 +56,7 @@ function parseValue(value, key) {
         }
         return parsed;
     }
-    catch (error) {
-        void error;
+    catch {
         // Fall back to string
         return value;
     }

package/dist/src/commands/furnace/deploy-fragment-includers.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Includer follow-up for a targeted `furnace deploy <tag>`.
+ *
+ * When `<tag>` includes a shared CSS fragment that changed, every other
+ * deployed includer of that fragment still carries the old expansion after
+ * the targeted deploy. Deploy-all refreshes all of them as a side effect of
+ * deploying everything; the targeted form used to refresh exactly the named
+ * component and say nothing about the rest. This module refreshes the other
+ * stale includers through the same pipeline and reports them, so a stale
+ * expansion is never left behind silently.
+ */
+import { type ApplyAllComponentsResult } from '../../core/furnace-apply.js';
+import type { FurnacePaths } from '../../core/furnace-config.js';
+import { type StaleFragmentIncluder } from '../../core/furnace-fragment-includers.js';
+import type { FurnaceOperationContext } from '../../core/furnace-operation.js';
+import type { FurnaceConfig } from '../../types/furnace.js';
+/** Outcome of the includer follow-up. */
+export interface FragmentIncluderRefresh {
+    /** Fragments `<tag>` includes that other deployed includers had stale. */
+    fragments: string[];
+    /** Includers applied cleanly (dry-run: the includers that would be). */
+    refreshed: string[];
+    /** Includers whose refresh reported errors or step failures. */
+    failed: StaleFragmentIncluder[];
+    /** One apply result per includer attempted (empty in dry-run). */
+    results: ApplyAllComponentsResult[];
+}
+/**
+ * Refreshes the other deployed includers of the fragments `name` includes
+ * whose engine sheets are stale. Each includer is its own atomic unit:
+ * `applyAllComponents` restores its own journal on failure, and its state
+ * is persisted right after it succeeds, before the next includer starts.
+ * Must be called only after the primary component's state is persisted,
+ * so a signal mid-loop leaves every earlier unit committed and consistent.
+ *
+ * Dry-run computes the would-be set and applies nothing.
+ */
+export declare function refreshStaleFragmentIncluders(args: {
+    projectRoot: string;
+    name: string;
+    config: FurnaceConfig;
+    furnacePaths: FurnacePaths;
+    isDryRun: boolean;
+    operationContext: FurnaceOperationContext;
+}): Promise<FragmentIncluderRefresh>;
+/**
+ * Folds includer apply results into the primary result so the deploy
+ * summary, the jsconfig sync gate and the failed-component set all see
+ * them. An includer failure is a real apply error of this deploy: the
+ * operator asked for a consistent engine. `rolledBack` stays the
+ * primary's; an includer's rollback is already visible through its errors.
+ */
+export declare function mergeApplyResults(primary: ApplyAllComponentsResult, extras: readonly ApplyAllComponentsResult[]): ApplyAllComponentsResult;
+/**
+ * Operator-facing lines for the includer follow-up: zero, one or two.
+ * The second is the fallback for includers that could not be refreshed and
+ * names the command that refreshes everything.
+ */
+export declare function formatFragmentIncluderNotice(refresh: FragmentIncluderRefresh, isDryRun: boolean): string[];

package/dist/src/commands/furnace/deploy-fragment-includers.js

@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Includer follow-up for a targeted `furnace deploy <tag>`.
+ *
+ * When `<tag>` includes a shared CSS fragment that changed, every other
+ * deployed includer of that fragment still carries the old expansion after
+ * the targeted deploy. Deploy-all refreshes all of them as a side effect of
+ * deploying everything; the targeted form used to refresh exactly the named
+ * component and say nothing about the rest. This module refreshes the other
+ * stale includers through the same pipeline and reports them, so a stale
+ * expansion is never left behind silently.
+ */
+import { getProjectPaths } from '../../core/config.js';
+import { applyAllComponents } from '../../core/furnace-apply.js';
+import { findStaleIncludersOfTargetFragments, } from '../../core/furnace-fragment-includers.js';
+import { getPersistableAppliedEntry, persistSingleComponentState, shouldPersistSingleComponentState, } from '../../core/furnace-state-persist.js';
+const EMPTY_REFRESH = {
+    fragments: [],
+    refreshed: [],
+    failed: [],
+    results: [],
+};
+/**
+ * Refreshes the other deployed includers of the fragments `name` includes
+ * whose engine sheets are stale. Each includer is its own atomic unit:
+ * `applyAllComponents` restores its own journal on failure, and its state
+ * is persisted right after it succeeds, before the next includer starts.
+ * Must be called only after the primary component's state is persisted,
+ * so a signal mid-loop leaves every earlier unit committed and consistent.
+ *
+ * Dry-run computes the would-be set and applies nothing.
+ */
+export async function refreshStaleFragmentIncluders(args) {
+    const { projectRoot, name, config, furnacePaths, isDryRun, operationContext } = args;
+    if (!(name in config.custom))
+        return EMPTY_REFRESH;
+    const { stale } = await findStaleIncludersOfTargetFragments({
+        targetTag: name,
+        custom: config.custom,
+        furnacePaths,
+        engineDir: getProjectPaths(projectRoot).engine,
+    });
+    if (stale.length === 0)
+        return EMPTY_REFRESH;
+    const fragmentsWithStaleIncluders = [...new Set(stale.flatMap((s) => s.fragments))].sort();
+    if (isDryRun) {
+        return {
+            fragments: fragmentsWithStaleIncluders,
+            refreshed: stale.map((s) => s.tag),
+            failed: [],
+            results: [],
+        };
+    }
+    const refreshed = [];
+    const failed = [];
+    const results = [];
+    for (const includer of stale) {
+        const result = await applyAllComponents(projectRoot, false, {
+            componentName: includer.tag,
+            persistState: false,
+            operationContext,
+        });
+        results.push(result);
+        if (shouldPersistSingleComponentState(result, false)) {
+            await persistSingleComponentState(projectRoot, getPersistableAppliedEntry('Deploy', includer.tag, result.applied[0]), furnacePaths);
+            refreshed.push(includer.tag);
+        }
+        else {
+            failed.push(includer);
+        }
+    }
+    return { fragments: fragmentsWithStaleIncluders, refreshed, failed, results };
+}
+/**
+ * Folds includer apply results into the primary result so the deploy
+ * summary, the jsconfig sync gate and the failed-component set all see
+ * them. An includer failure is a real apply error of this deploy: the
+ * operator asked for a consistent engine. `rolledBack` stays the
+ * primary's; an includer's rollback is already visible through its errors.
+ */
+export function mergeApplyResults(primary, extras) {
+    if (extras.length === 0)
+        return primary;
+    const warnings = [primary, ...extras].flatMap((r) => r.warnings ?? []);
+    const actions = [primary, ...extras].flatMap((r) => r.actions ?? []);
+    const anyWarnings = [primary, ...extras].some((r) => r.warnings !== undefined);
+    const anyActions = [primary, ...extras].some((r) => r.actions !== undefined);
+    return {
+        ...primary,
+        applied: [...primary.applied, ...extras.flatMap((r) => r.applied)],
+        skipped: [...primary.skipped, ...extras.flatMap((r) => r.skipped)],
+        errors: [...primary.errors, ...extras.flatMap((r) => r.errors)],
+        ...(anyWarnings ? { warnings } : {}),
+        ...(anyActions ? { actions } : {}),
+    };
+}
+function quoteList(items) {
+    return items.map((item) => `"${item}"`).join(', ');
+}
+/**
+ * Operator-facing lines for the includer follow-up: zero, one or two.
+ * The second is the fallback for includers that could not be refreshed and
+ * names the command that refreshes everything.
+ */
+export function formatFragmentIncluderNotice(refresh, isDryRun) {
+    const lines = [];
+    if (refresh.refreshed.length > 0) {
+        const n = refresh.refreshed.length;
+        lines.push(`${isDryRun ? 'Would also refresh' : 'Also refreshed'} ${n} other includer${n === 1 ? '' : 's'} ` +
+            `of ${quoteList(refresh.fragments)}: ${refresh.refreshed.join(', ')}.`);
+    }
+    if (refresh.failed.length > 0) {
+        const n = refresh.failed.length;
+        const fragments = [...new Set(refresh.failed.flatMap((f) => f.fragments))].sort();
+        lines.push(`${n} other includer${n === 1 ? '' : 's'} of ${quoteList(fragments)} ` +
+            `remain stale: ${refresh.failed.map((f) => f.tag).join(', ')}. ` +
+            'Run `fireforge furnace deploy` (all).');
+    }
+    return lines;
+}

package/dist/src/commands/furnace/deploy.js

@@ -10,7 +10,8 @@ import { getPersistableAppliedEntry, getStepFailureCount, persistSingleComponent
 import { hasBlockingStepErrors } from '../../core/furnace-step-errors.js';
 import { findOverrideBaseVersionDrift, formatOverrideBaseVersionDriftError, formatOverrideBaseVersionDriftWarning, } from '../../core/furnace-version-drift.js';
 import { FurnaceError } from '../../errors/furnace.js';
-import { info, intro, note, outro, spinner, warn } from '../../utils/logger.js';
+import { info, intro, note, notice, outro, spinner, warn } from '../../utils/logger.js';
+import { formatFragmentIncluderNotice, mergeApplyResults, refreshStaleFragmentIncluders, } from './deploy-fragment-includers.js';
 import { runDeployValidation } from './validation-output.js';
 /**
  * Builds the final deploy failure summary from apply and validation error counts.
@@ -57,6 +58,13 @@ function getFailedComponentNames(result) {
  * site. Rollback on failure happens inside `applyAllComponents`. The journal
  * returned on success is ignored (the deploy keeps its files).
  *
+ * The caller then runs the fragment-includer follow-up
+ * ({@link refreshStaleFragmentIncluders}) ONLY after this component's state
+ * is persisted: each includer is applied and persisted as its own unit, so
+ * a signal mid-loop restores at most the includer in flight and leaves every
+ * earlier unit committed. Moving the persist after the includer loop would
+ * silently break that atomicity.
+ *
  * @param name - Component name to apply
  * @param config - Loaded Furnace configuration
  * @param isDryRun - Whether file writes should be skipped
@@ -168,10 +176,29 @@ export async function furnaceDeployCommand(projectRoot, name, options = {}) {
             // already restored the engine to its pre-deploy state, so persisting
             // partial checksums here would mis-report the next status/apply run
             // against a workspace that was never actually deployed.
-            if (shouldPersistSingleComponentState(namedApplyResult, isDryRun)) {
+            const primaryClean = shouldPersistSingleComponentState(namedApplyResult, isDryRun);
+            if (primaryClean) {
                 await persistSingleComponentState(projectRoot, getPersistableAppliedEntry('Deploy', name, namedApplyResult.applied[0]), furnacePaths);
             }
-            return { kind: 'result', result: namedApplyResult };
+            // Other deployed includers of a fragment this component includes
+            // would otherwise keep a stale expansion. Only after a clean,
+            // persisted primary apply (dry-run always previews).
+            if (!primaryClean && !isDryRun) {
+                return { kind: 'result', result: namedApplyResult };
+            }
+            const includers = await refreshStaleFragmentIncluders({
+                projectRoot,
+                name,
+                config,
+                furnacePaths,
+                isDryRun,
+                operationContext: ctx,
+            });
+            return {
+                kind: 'result',
+                result: mergeApplyResults(namedApplyResult, includers.results),
+                includers,
+            };
         }
         const allResult = await applyAllComponents(projectRoot, isDryRun, {
             operationContext: ctx,
@@ -187,6 +214,11 @@ export async function furnaceDeployCommand(projectRoot, name, options = {}) {
     const result = applyOutcome.result;
     applySpinner.stop(isDryRun ? 'Planned actions calculated' : 'Components applied');
     logApplyResult(result, isDryRun);
+    if (applyOutcome.includers) {
+        for (const line of formatFragmentIncluderNotice(applyOutcome.includers, isDryRun)) {
+            notice(line);
+        }
+    }
     // Keep the consumer jsconfig's chrome-module `paths` in step with the
     // deployed module set. Only after a clean apply: a rolled-back deploy
     // must not advance the typecheck mapping either.
@@ -212,6 +244,7 @@ export async function furnaceDeployCommand(projectRoot, name, options = {}) {
         isDryRun,
         projectRoot,
         dryRunActions: result.actions,
+        alsoValidate: applyOutcome.includers?.refreshed ?? [],
     });
     if (validation.done)
         return;

package/dist/src/commands/furnace/validation-output.d.ts

@@ -33,6 +33,11 @@ export interface RunDeployValidationOptions {
     projectRoot: string;
     /** Projected actions of a dry run, used to filter projected issues. */
     dryRunActions?: DryRunAction[] | undefined;
+    /**
+     * Extra components a named deploy also touched (fragment includers it
+     * refreshed). Validated alongside `name`; ignored when `name` is unset.
+     */
+    alsoValidate?: string[] | undefined;
 }
 /**
  * Runs the validation phase of a furnace deploy, checking all or a single component.

package/dist/src/commands/furnace/validation-output.js

@@ -54,13 +54,33 @@ function resolveNamedValidationTarget(name, config, furnacePaths) {
     }
     throw new FurnaceError(`Component "${name}" not found in furnace.json.`, name);
 }
+/**
+ * Validates one named target and prints its outcome.
+ * @returns `[errors, warnings]` for the target
+ */
+async function validateNamedTarget(args) {
+    const { name, config, furnacePaths, isDryRun, projectRoot, dryRunActions } = args;
+    const target = resolveNamedValidationTarget(name, config, furnacePaths);
+    if (target === 'stock')
+        return [0, 0];
+    if (!(await pathExists(target.componentDir))) {
+        throw new FurnaceError(`Component directory not found for "${name}".`, name);
+    }
+    const rawIssues = await validateComponent(target.componentDir, name, target.type, config, projectRoot);
+    const issues = isDryRun ? filterProjectedDryRunIssues(rawIssues, dryRunActions) : rawIssues;
+    if (issues.length === 0) {
+        success(`${name} — all checks passed`);
+        return [0, 0];
+    }
+    return displayValidationIssues(issues);
+}
 /**
  * Runs the validation phase of a furnace deploy, checking all or a single component.
  * @param options - See {@link RunDeployValidationOptions}
  * @returns Validation counts, or `done: true` if the caller should early-return
  */
 export async function runDeployValidation(options) {
-    const { validateSpinner, name, config, furnacePaths, failedComponents, isDryRun, projectRoot, dryRunActions, } = options;
+    const { validateSpinner, name, config, furnacePaths, failedComponents, isDryRun, projectRoot, dryRunActions, alsoValidate, } = options;
     let totalErrors = 0;
     let totalWarnings = 0;
     let componentCount = 0;
@@ -82,15 +102,21 @@ export async function runDeployValidation(options) {
             validateSpinner.stop('Validation failed');
             throw new FurnaceError(`Component directory not found for "${name}".`, name);
         }
-        const rawIssues = await validateComponent(target.componentDir, name, target.type, config, projectRoot);
-        const issues = isDryRun ? filterProjectedDryRunIssues(rawIssues, dryRunActions) : rawIssues;
-        componentCount = 1;
         validateSpinner.stop('Validation complete');
-        if (issues.length === 0) {
-            success(`${name} — all checks passed`);
-        }
-        else {
-            const [errors, warnings] = displayValidationIssues(issues);
+        // The named target first, then every includer the deploy refreshed on
+        // its behalf: those engine files changed in this deploy too, so this
+        // deploy's validation covers them.
+        const extra = (alsoValidate ?? []).filter((t) => t !== name && !failedComponents.has(t));
+        for (const tag of [name, ...extra]) {
+            const [errors, warnings] = await validateNamedTarget({
+                name: tag,
+                config,
+                furnacePaths,
+                isDryRun,
+                projectRoot,
+                dryRunActions,
+            });
+            componentCount++;
             totalErrors += errors;
             totalWarnings += warnings;
         }

package/dist/src/commands/patch/delete-gap-notice.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Projects the queue after a `patch delete` and names any numeric gap the
+ * removal opens under `patchPolicy.allowGaps: false`.
+ *
+ * The delete itself succeeds either way; the gap only surfaces on the next
+ * `lint --per-patch`, `re-export` or `verify`, which is the wrong moment to
+ * learn that the queue needs a refill or a `patch compact`. Diffing the
+ * policy evaluation of the current manifest against the projected one keeps
+ * the arithmetic in `evaluatePatchPolicy`, so this module never re-derives
+ * what counts as a gap.
+ */
+import type { PatchesManifest, PatchMetadata } from '../../types/commands/index.js';
+import type { FireForgeConfig } from '../../types/config.js';
+/**
+ * Describes each `numeric-gap` issue the queue would gain once `target` is
+ * removed. Returns one operator-facing line per newly gapped range, or an
+ * empty array when the policy allows gaps or the removal opens none (for
+ * example deleting the last patch of a range).
+ *
+ * @param config - Loaded project configuration
+ * @param manifest - Current patch manifest
+ * @param target - Patch about to be deleted
+ */
+export declare function describeProjectedGaps(config: FireForgeConfig, manifest: PatchesManifest, target: PatchMetadata): string[];

package/dist/src/commands/patch/delete-gap-notice.js

@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * Projects the queue after a `patch delete` and names any numeric gap the
+ * removal opens under `patchPolicy.allowGaps: false`.
+ *
+ * The delete itself succeeds either way; the gap only surfaces on the next
+ * `lint --per-patch`, `re-export` or `verify`, which is the wrong moment to
+ * learn that the queue needs a refill or a `patch compact`. Diffing the
+ * policy evaluation of the current manifest against the projected one keeps
+ * the arithmetic in `evaluatePatchPolicy`, so this module never re-derives
+ * what counts as a gap.
+ */
+import { buildProjectedManifest, evaluatePatchPolicy } from '../../core/patch-policy.js';
+const GAP_MESSAGE_PATTERN = /^(?<range>.+?) has numeric gap\(s\): (?<orders>[^.]+)\./;
+/**
+ * Describes each `numeric-gap` issue the queue would gain once `target` is
+ * removed. Returns one operator-facing line per newly gapped range, or an
+ * empty array when the policy allows gaps or the removal opens none (for
+ * example deleting the last patch of a range).
+ *
+ * @param config - Loaded project configuration
+ * @param manifest - Current patch manifest
+ * @param target - Patch about to be deleted
+ */
+export function describeProjectedGaps(config, manifest, target) {
+    if (config.patchPolicy?.allowGaps !== false)
+        return [];
+    const projected = buildProjectedManifest(manifest, manifest.patches.filter((patch) => patch.filename !== target.filename));
+    const gapKey = (issue) => `${issue.filename}|${issue.message}`;
+    const existing = new Set(evaluatePatchPolicy(config, manifest)
+        .filter((issue) => issue.code === 'numeric-gap')
+        .map(gapKey));
+    return evaluatePatchPolicy(config, projected)
+        .filter((issue) => issue.code === 'numeric-gap' && !existing.has(gapKey(issue)))
+        .map((issue) => formatGapNotice(target.filename, issue.message));
+}
+function formatGapNotice(targetFilename, message) {
+    const match = GAP_MESSAGE_PATTERN.exec(message);
+    const range = match?.groups?.['range'] ?? message;
+    const orders = match?.groups?.['orders'] ?? '';
+    const fill = orders.split(',')[0]?.trim() ?? '<n>';
+    const where = orders ? `a gap at ${orders}` : 'a numeric gap';
+    return (`deleting ${targetFilename} leaves ${range} with ${where}; the queue will fail ` +
+        'numeric-gap (patchPolicy.allowGaps is false) until ' +
+        `"fireforge export --order ${fill}" fills it or "fireforge patch compact" renumbers.`);
+}

package/dist/src/commands/patch/delete.js

@@ -9,6 +9,7 @@
  */
 import { basename } from 'node:path';
 import { Command } from 'commander';
+import { loadConfig } from '../../core/config.js';
 import { confirmDestructive } from '../../core/destructive.js';
 import { appendHistoryBestEffort } from '../../core/history-log.js';
 import { buildPatchQueueContext, extractImportSpecifiersWithLines, findForwardImportIgnoreLines, isForwardImportableFile, } from '../../core/patch-lint.js';
@@ -17,6 +18,7 @@ import { removePatchFileAndManifest } from '../../core/patch-manifest.js';
 import { info, intro, outro, warn } from '../../utils/logger.js';
 import { addWaitLockOption, pickDefined, resolveWaitLockSeconds } from '../../utils/options.js';
 import { proceedAfterDecision } from '../destructive-decision.js';
+import { describeProjectedGaps } from './delete-gap-notice.js';
 import { requirePatchQueue, requirePatchTarget } from './patch-context.js';
 /**
  * Runs the `patch delete` command: removes a patch file and its manifest
@@ -108,6 +110,14 @@ export async function patchDeleteCommand(projectRoot, identifier, options = {})
             `after the delete, update it via "fireforge patch staged-dependency ${holder.filename} --remove ..." ` +
             'or re-point the owner at the patch that will create the file.');
     }
+    // Under `patchPolicy.allowGaps: false` the removal can open a numeric gap
+    // that every later lint and re-export refuses on. Naming it here, in
+    // dry-run and at the prompt, puts the refill/compact choice in front of
+    // the operator before the gap exists rather than after the next command.
+    const gapNotices = describeProjectedGaps(await loadConfig(projectRoot), manifest, target);
+    for (const line of gapNotices) {
+        warn(line);
+    }
     const conflicts = dependents.length > 0
         ? {
             // The wording spells out the runtime impact: `git apply`
@@ -130,6 +140,7 @@ export async function patchDeleteCommand(projectRoot, identifier, options = {})
     for (const file of target.filesAffected) {
         summary.push(`  ${file}  → will become unmanaged`);
     }
+    summary.push(...gapNotices);
     const decision = await confirmDestructive({
         operation: 'patch-delete',
         title: `Delete ${target.filename}`,

package/dist/src/commands/re-export-lint.d.ts

@@ -41,6 +41,8 @@ export interface ReExportLintContext {
     reusedCacheEntries: number;
     /** Run-level checkJs globals are emitted once per invocation. */
     globalsEmitted: boolean;
+    /** The pre-existing-queue-errors note is printed once per invocation. */
+    queueBaselineWarned: boolean;
 }
 /** Builds the once-per-invocation lint context. */
 export declare function buildReExportLintContext(projectRoot: string, paths: ProjectPaths, config: FireForgeConfig, noCache: boolean): Promise<ReExportLintContext>;
@@ -85,10 +87,33 @@ export declare function lintReExportedPatch(args: {
  * {@link refreshQueueCtxEntry} first).
  */
 export declare function storeReExportLintResult(lintCtx: ReExportLintContext, patchFilename: string, projectedMetadata: PatchMetadata, existingFiles: string[], result: ReExportLintResult): Promise<void>;
+/**
+ * Projects the rewritten body into the hoisted queue context and refuses
+ * when the projection introduces error-severity cross-patch findings the
+ * current queue does not have (a forward import an earlier owner gained,
+ * say). Mirrors `re-export --files` (its projected-state conflict) and the
+ * `--scan` adoption gate, which only covered files a scan adopted: a plain
+ * re-export of an unchanged file set with new CONTENT used to pass, and the
+ * queue carried the error until the next `export` placement refused it.
+ *
+ * Runs in dry-run. `--force-unsafe` downgrades the refusal to warnings;
+ * `--skip-lint` does not bypass it, same as `--files`. The baseline is the
+ * hoisted context, which {@link refreshQueueCtxEntry} keeps equal to the
+ * on-disk queue across an `--all` loop, so patch N+1 is projected against
+ * the queue as it will exist.
+ */
+export declare function assertRefreshedBodyHasNoNewQueueErrors(args: {
+    lintCtx: ReExportLintContext;
+    patchFilename: string;
+    diffContent: string;
+    forceUnsafe: boolean;
+}): void;
 /**
  * Refreshes the in-memory queue entry for a just-rewritten patch so later
  * iterations (and later cache keys) lint against the new body instead of
- * the stale one. The on-disk write is the authority. This mirrors it.
+ * the stale one. The on-disk write is the authority. This mirrors it, via
+ * the same projection `buildPatchQueueContext` derives an entry from, so
+ * `createdFiles` and `modifiedFileAdditions` stay in step with a rebuild.
  */
 export declare function refreshQueueCtxEntry(lintCtx: ReExportLintContext, patchFilename: string, diffContent: string): void;
 /** Persists cache writes and reports reuse, once after the loop. */