@hominis/fireforge 0.46.2 → 0.47.1

package/dist/src/commands/test-run.js

@@ -10,8 +10,10 @@
  * cost startup time but make results reproducible. The combined invocation
  * stays available via `--no-shard`.
  */
+import { join } from 'node:path';
 import { probeDisplaySleepState } from '../core/display-state.js';
 import { runMachTestSuite } from '../core/mach.js';
+import { parentExited } from '../core/parent-exit-watchdog.js';
 import { getActiveRunLogPath } from '../core/run-log.js';
 import { changedPrefNoiseVerdictNote } from '../core/test-changed-prefs.js';
 import { buildHarnessCrashMessage, classifyHarnessRun, headedDisplayAsleepVerdictNote, headedNoOutputTimeoutHint, } from '../core/test-harness-crash.js';
@@ -21,6 +23,7 @@ import { TestFailureError } from '../errors/build.js';
 import { info, note, warn } from '../utils/logger.js';
 import { getPlatform } from '../utils/platform.js';
 import { maybeInjectAppdirArg } from './test-appdir.js';
+import { createHarnessTeardown } from './test-harness-teardown.js';
 import { emitHarnessVerdict } from './test-verdict.js';
 /** Default bounded retry budget for recognized harness crashes. */
 export const DEFAULT_HARNESS_RETRIES = 2;
@@ -61,13 +64,14 @@ async function runTestsWithRetriesInner(ctx, paths, env) {
     let verdict;
     for (;;) {
         attempts += 1;
-        result = await runMachTestSuite(kind, {
-            engineDir: ctx.engineDir,
-            testPaths: paths,
-            args: extraArgs,
-            env,
-            fullOutput: ctx.fullOutput,
-        });
+        result = await runTrackedMachTestSuite(ctx, kind, paths, extraArgs, env);
+        // The parent that was reading this run is gone and the watchdog has
+        // already killed the harness. Classifying the corpse would call it a
+        // harness crash and retry it under nobody's supervision.
+        if (parentExited()) {
+            throw new TestFailureError('The parent process exited while the harness was running; the harness tree was ' +
+                'terminated and the run ended without a result.', `mach ${kind}`, undefined, getActiveRunLogPath());
+        }
         result = await retryAfterXpcshellSymlinkRepair({
             engineDir: ctx.engineDir,
             objDir: ctx.objDir,
@@ -107,6 +111,31 @@ async function runTestsWithRetriesInner(ctx, paths, env) {
     }
     return { result, verdict, attempts, appdirInjectionAttempted, displayState };
 }
+/**
+ * One mach dispatch with its kill path attached: helper-pid tracking and
+ * post-close reaping, the process-group announcement, and the parent-exit
+ * watchdog for exactly as long as mach runs.
+ */
+async function runTrackedMachTestSuite(ctx, kind, paths, extraArgs, env) {
+    const teardown = createHarnessTeardown({
+        objDir: ctx.objDir === undefined ? undefined : join(ctx.engineDir, ctx.objDir),
+        pgidFile: ctx.pgidFile,
+    });
+    try {
+        await teardown.prepare();
+        return await runMachTestSuite(kind, {
+            engineDir: ctx.engineDir,
+            testPaths: paths,
+            args: extraArgs,
+            env,
+            fullOutput: ctx.fullOutput,
+            teardown: teardown.hooks,
+        });
+    }
+    finally {
+        teardown.dispose();
+    }
+}
 /**
  * Probes the display's power state for a headed no-output stall, and only for
  * that shape. Every other outcome (a passing run, a real test failure, a

package/dist/src/commands/test-verdict.d.ts

@@ -12,6 +12,16 @@ import type { HarnessRunVerdict } from '../core/test-harness-crash.js';
  * of the others.
  */
 export type FireforgeVerdictReason = 'crash' | 'no-tests' | 'test-failures' | 'preflight' | 'inconclusive' | 'lock-timeout' | 'killed';
+/** Additive keys a run can stamp on its verdict line. */
+export type VerdictRunAttributeKey = 'shuffle' | 'orphans-reaped';
+/** Records an additive attribute for this run's verdict line. */
+export declare function setVerdictRunAttribute(key: VerdictRunAttributeKey, value: string): void;
+/**
+ * Adds to a counting attribute. The key appears only once the total is
+ * positive, so a run that reaped nothing prints the line it always did.
+ * Sums across the preflight census, every retry attempt and every shard.
+ */
+export declare function addVerdictRunCount(key: 'orphans-reaped', count: number): void;
 /**
  * Re-arms the verdict sink for a new run. Called at `testCommand` entry so
  * repeated programmatic invocations (and tests) each get their own
@@ -34,7 +44,7 @@ export declare function emitPassVerdict(): void;
  * Emits a FAIL verdict carrying an emission-layer reason code, and
  * optionally the refusal class that produced it.
  *
- * `note=` is additive, like the `log=`, `signal=` and `shards=` keys already
+ * `note=` is additive, like the `log=`, `signal=`, `shards=` and `shuffle=` keys already
  * on this line: `reason=` is unchanged and still comes from the closed set
  * in `docs/machine-output.md`, so a consumer that tokenises `key=value`
  * pairs is unaffected. It exists because `reason=preflight` covers every
@@ -47,7 +57,14 @@ export declare function emitPassVerdict(): void;
  */
 export declare function emitFailVerdict(reason: FireforgeVerdictReason, note?: string): void;
 /**
- * Emits the terminal verdict for a run killed by a signal.
+ * What ended a killed run: a signal FireForge received, or `parent-exit`,
+ * the parent-death watchdog's finding that the process above FireForge
+ * vanished (typically SIGKILLed by a supervisor) while a harness ran.
+ */
+export type KilledVerdictCause = NodeJS.Signals | 'parent-exit';
+/**
+ * Emits the terminal verdict for a run killed by a signal, or ended by
+ * FireForge itself because its parent died.
  *
  * Without it a killed run wrote no terminal line, so a log tail could not
  * distinguish "killed" from "still running" from "never started". Recovery
@@ -57,7 +74,7 @@ export declare function emitFailVerdict(reason: FireforgeVerdictReason, note?: s
  * line asserts a test run happened, and an interrupted `status` did not
  * have one.
  *
- * @param signal - The signal that terminated the run
+ * @param signal - The signal that terminated the run, or `parent-exit`
  * @returns True when a line was written
  */
-export declare function emitKilledVerdict(signal: NodeJS.Signals): boolean;
+export declare function emitKilledVerdict(signal: KilledVerdictCause): boolean;

package/dist/src/commands/test-verdict.js

@@ -3,6 +3,36 @@ import { getActiveRunLogPath } from '../core/run-log.js';
 import { formatFireforgeVerdictLine } from '../core/test-harness-crash.js';
 import { setStdoutSealed } from '../utils/logger.js';
 let emitted = false;
+/**
+ * Additive `key=value` attributes of the run in flight, appended to
+ * whichever verdict line ends it. `shuffle` is the seed a `--shuffle` run
+ * exported to the harness, so a red found by shuffling carries its own
+ * reproduction on the one line an unattended reader keeps. `orphans-reaped`
+ * is how many harness processes FireForge had to terminate itself, at
+ * preflight (survivors of an earlier run) or at teardown (helpers this run
+ * launched that outlived mach): a green after a reap is not the same
+ * finding as a green on a quiet machine. Cleared by
+ * {@link resetVerdictEmission}, so a later run in the same process cannot
+ * inherit them.
+ */
+const runAttributes = new Map();
+/** Records an additive attribute for this run's verdict line. */
+export function setVerdictRunAttribute(key, value) {
+    runAttributes.set(key, value);
+}
+/**
+ * Adds to a counting attribute. The key appears only once the total is
+ * positive, so a run that reaped nothing prints the line it always did.
+ * Sums across the preflight census, every retry attempt and every shard.
+ */
+export function addVerdictRunCount(key, count) {
+    // Written as a negated `> 0` so a NaN (a stubbed census, a bad parse) is
+    // dropped rather than stamped on the line as `orphans-reaped=NaN`.
+    if (!(count > 0))
+        return;
+    const current = Number(runAttributes.get(key) ?? '0');
+    runAttributes.set(key, String(current + count));
+}
 /**
  * True once a test run has begun in this process.
  *
@@ -20,6 +50,7 @@ let armed = false;
 export function resetVerdictEmission() {
     emitted = false;
     armed = true;
+    runAttributes.clear();
     setStdoutSealed(false);
 }
 /** True once this run has written its `FIREFORGE-VERDICT:` line. */
@@ -45,9 +76,10 @@ function writeVerdictLine(line) {
     // break that contract, and one before it is the first thing a `tail` cuts.
     // Appended as an additive `key=value`, so consumers that tokenize the line
     // are unaffected and a truncated tail still says where the full output is.
+    const attributes = [...runAttributes].map(([key, value]) => ` ${key}=${value}`).join('');
     const logPath = getActiveRunLogPath();
     const suffix = logPath === undefined ? '' : ` log=${logPath}`;
-    process.stdout.write(`${line}${suffix}\n`);
+    process.stdout.write(`${line}${attributes}${suffix}\n`);
     setStdoutSealed(true);
 }
 /**
@@ -65,7 +97,7 @@ export function emitPassVerdict() {
  * Emits a FAIL verdict carrying an emission-layer reason code, and
  * optionally the refusal class that produced it.
  *
- * `note=` is additive, like the `log=`, `signal=` and `shards=` keys already
+ * `note=` is additive, like the `log=`, `signal=`, `shards=` and `shuffle=` keys already
  * on this line: `reason=` is unchanged and still comes from the closed set
  * in `docs/machine-output.md`, so a consumer that tokenises `key=value`
  * pairs is unaffected. It exists because `reason=preflight` covers every
@@ -81,7 +113,8 @@ export function emitFailVerdict(reason, note) {
     writeVerdictLine(`FIREFORGE-VERDICT: FAIL reason=${reason}${suffix}`);
 }
 /**
- * Emits the terminal verdict for a run killed by a signal.
+ * Emits the terminal verdict for a run killed by a signal, or ended by
+ * FireForge itself because its parent died.
  *
  * Without it a killed run wrote no terminal line, so a log tail could not
  * distinguish "killed" from "still running" from "never started". Recovery
@@ -91,7 +124,7 @@ export function emitFailVerdict(reason, note) {
  * line asserts a test run happened, and an interrupted `status` did not
  * have one.
  *
- * @param signal - The signal that terminated the run
+ * @param signal - The signal that terminated the run, or `parent-exit`
  * @returns True when a line was written
  */
 export function emitKilledVerdict(signal) {

package/dist/src/commands/test.js

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: EUPL-1.2
-import { join, resolve } from 'node:path';
+import { join } from 'node:path';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { assertEngineExists } from '../core/engine-precondition.js';
 import { assertEngineGenerationUnchanged, snapshotEngineGeneration, } from '../core/engine-session-lock.js';
@@ -21,9 +21,11 @@ import { info, intro, notice, outro, verbose } from '../utils/logger.js';
 import { stripEnginePrefix } from '../utils/paths.js';
 import { runTestBuildPhase } from './test-build-phase.js';
 import { diagnoseShardOutcome, finalizeSingleRunOutcome } from './test-diagnose.js';
+import { buildPerfSampleEnv, mergeHarnessEnv, resolveShuffleSeed } from './test-harness-env.js';
+import { removePgidFile, setActivePgidFile } from './test-harness-teardown.js';
 import { assertPathlessTestMode, assertTestModeCombinations, canaryTimeoutSeconds, classifyBeforeDispatch, reportCanaryOutcome, resolveCanaryPath, } from './test-modes.js';
 import { DEFAULT_HARNESS_RETRIES, finalizeShardedOutcome, runShardedTests, runTestsWithRetries, } from './test-run.js';
-import { emitFailVerdict, emitPassVerdict, resetVerdictEmission, verdictEmitted, } from './test-verdict.js';
+import { addVerdictRunCount, emitFailVerdict, emitPassVerdict, resetVerdictEmission, verdictEmitted, } from './test-verdict.js';
 async function assertTestPathsExist(engineDir, testPaths) {
     const missingPaths = [];
     for (const testPath of testPaths) {
@@ -226,7 +228,7 @@ async function ensureTestMarionettePortAvailable(port, binaryName, options, skip
     }
     await assertMarionettePortAvailable(port, { binaryName });
 }
-async function ensureTestBrowserEnvironment(engineDir, launchablePath, xpcshellOnly, binaryName, options, objDir) {
+async function ensureTestBrowserEnvironment(engineDir, launchablePath, xpcshellOnly, projectConfig, options, objDir) {
     // A timed-out mochitest can leave the built app alive after its Marionette
     // listener has disappeared. The port probe cannot see that case, but the
     // survivor can still steal focus and wedge every later headed run.
@@ -241,20 +243,25 @@ async function ensureTestBrowserEnvironment(engineDir, launchablePath, xpcshellO
     // does not use the httpd, so an xpcshell-only run is never blocked by it.
     if (!xpcshellOnly) {
         await ensureMochitestServerPortAvailable(undefined, {
+            engineDir,
             killStaleServer: options.killStaleMarionette === true,
         });
     }
     // Helpers that outlived an earlier run (httpd, pywebsocket, ssltunnel,
     // moz-http2) slow every later run without appearing in its output. Both
     // harnesses are affected, so this census is not gated on xpcshellOnly.
-    await reportOrphanedHarnessProcesses(objDir, {
-        reap: options.reapOrphans === true,
+    // Reaping is opt-in per invocation (--reap-orphans) or per repo
+    // (test.reapOrphans: "reap"); a reap is stamped on the verdict line so a
+    // green after one is not mistaken for a green on a quiet machine.
+    const census = await reportOrphanedHarnessProcesses(objDir, {
+        reap: options.reapOrphans === true || projectConfig.test?.reapOrphans === 'reap',
     });
+    addVerdictRunCount('orphans-reaped', census.reaped);
     const forwardedPort = options.machArg
         ? extractForwardedMarionettePort(options.machArg)
         : undefined;
     const effectivePort = options.marionettePort ?? forwardedPort;
-    await ensureTestMarionettePortAvailable(effectivePort, binaryName, options, {
+    await ensureTestMarionettePortAvailable(effectivePort, projectConfig.binaryName, options, {
         xpcshellOnly,
         doctor: options.doctor === true,
     });
@@ -289,6 +296,7 @@ export async function testCommand(projectRoot, testPaths, options = {}) {
     // exactly the runs whose only output a `tail` throws away. Closed in
     // `finally`, after the verdict line has already read the path.
     setActiveRunLog(await openRunLog(projectRoot, 'test'));
+    setActivePgidFile(options.pgidFile);
     try {
         await runTestCommandBody(projectRoot, testPaths, options);
     }
@@ -300,6 +308,9 @@ export async function testCommand(projectRoot, testPaths, options = {}) {
         throw error;
     }
     finally {
+        // A run that ends under FireForge's control owns no harness group any
+        // more; the file only outlives FireForge when FireForge was killed.
+        await removePgidFile(options.pgidFile);
         await closeActiveRunLog();
     }
 }
@@ -403,7 +414,7 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
     // documented `--mach-arg --marionette-port=NNNN` route still hits the
     // wrapper preflight refusing on 2828 before the forwarded arg reaches
     // mach.
-    const { forwardedPort, effectivePort } = await ensureTestBrowserEnvironment(paths.engine, launchablePath, xpcshellOnly, projectConfig.binaryName, options, buildCheck.objDir);
+    const { forwardedPort, effectivePort } = await ensureTestBrowserEnvironment(paths.engine, launchablePath, xpcshellOnly, projectConfig, options, buildCheck.objDir);
     if (options.doctor) {
         const doctorOutcome = await runDoctorPreflight({
             engineDir: paths.engine,
@@ -418,6 +429,7 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
     }
     await assertTestPathsExist(paths.engine, normalizedPaths);
     const suite = resolveTestSuite(classification, options.genericMachTest === true);
+    const shuffleSeed = resolveShuffleSeed(options.shuffle, suite);
     const forwardedMachArgs = options.machArg && options.machArg.length > 0
         ? filterRedundantXpcshellFlavorArgs(options.machArg, classification)
         : [];
@@ -425,20 +437,21 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
     if (options.headless) {
         extraArgs.push('--headless');
     }
+    if (shuffleSeed !== undefined) {
+        extraArgs.push('--shuffle');
+    }
     if (options.auto === true) {
         extraArgs.push('--auto');
     }
-    if (canaryPath !== undefined) {
+    if (canaryPath !== undefined)
         extraArgs.push(`--timeout=${canaryTimeoutSeconds(projectConfig)}`);
-    }
     // --mach-arg is a verbatim passthrough for upstream mach/xpcshell/mochitest
     // flags FireForge does not model directly (see the xpcshell appdir hint
     // above for why). Appended after --headless so mach sees
     // the FireForge-managed flags first and the escape-valve ones last, which
     // keeps the override precedence predictable.
-    if (forwardedMachArgs.length > 0) {
+    if (forwardedMachArgs.length > 0)
         extraArgs.push(...forwardedMachArgs);
-    }
     appendMarionetteForwardingArgs(extraArgs, options, forwardedPort, xpcshellOnly);
     // Directory arguments mean exactly that directory: mozbuild's test
     // resolver matches paths by string prefix, so a bare directory arg
@@ -465,7 +478,7 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
     // the manifest for each file individually. See src/core/xpcshell-appdir.ts
     // for the full motivation.
     logTestSelection(scopes);
-    const perfSampleEnv = buildPerfSampleEnv(projectRoot, projectConfig.binaryName, options.perfSamples);
+    const harnessEnv = mergeHarnessEnv(buildPerfSampleEnv(projectRoot, projectConfig.binaryName, options.perfSamples), shuffleSeed === undefined ? undefined : { FIREFORGE_SHUFFLE_SEED: String(shuffleSeed) });
     const runCtx = {
         engineDir: paths.engine,
         objDir: buildCheck.objDir,
@@ -475,7 +488,8 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
         harnessRetries,
         headless: options.headless === true,
         ...(options.fullOutput === true ? { fullOutput: true } : {}),
-        ...(perfSampleEnv ? { env: perfSampleEnv } : {}),
+        ...(harnessEnv ? { env: harnessEnv } : {}),
+        pgidFile: options.pgidFile,
     };
     const postRebuildContext = options.build
         ? createPostRebuildFailureContext('fireforge test --build', normalizedPaths)
@@ -527,16 +541,3 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
     }
     finalizeSingleRunOutcome(outcome, normalizedPaths, projectConfig.binaryName, postRebuildContext, options.headless === true);
 }
-/**
- * Builds the perf-sample env contract for the harness run:
- * `--perf-samples <path>` exports `<BINARYNAME>_PERF_SAMPLE_JSON` naming the
- * artifact file a budget checker consumes after the run.
- */
-function buildPerfSampleEnv(projectRoot, binaryName, perfSamples) {
-    if (!perfSamples)
-        return undefined;
-    const envName = `${binaryName.toUpperCase().replace(/[^A-Z0-9]/g, '_')}_PERF_SAMPLE_JSON`;
-    const artifactPath = resolve(projectRoot, perfSamples);
-    info(`Perf sample contract: ${envName}=${artifactPath}`);
-    return { [envName]: artifactPath };
-}

package/dist/src/core/build-jar-escalation.d.ts

@@ -28,7 +28,6 @@
  * parse a manifest escalates: this narrows a conservative rule, so its
  * error direction stays the slow-but-correct one.
  */
-import type { BuildBaseline } from './build-baseline-types.js';
 /** Why one changed `jar.mn` still forces a full build. */
 export interface JarEscalationCause {
     /** Engine-relative manifest path. */
@@ -51,11 +50,9 @@ export interface JarEscalationDecision {
  * @param engineDir - Absolute engine directory
  * @param changedPaths - Engine-relative paths changed since the last
  *   successful build (non-`jar.mn` entries are ignored)
- * @param baseline - Last successful build's baseline (reserved: the
- *   fingerprint map already gated which paths reach here)
  * @returns The escalation decision with per-manifest causes
  */
-export declare function evaluateJarManifestEscalation(engineDir: string, changedPaths: readonly string[], baseline: BuildBaseline | undefined): Promise<JarEscalationDecision>;
+export declare function evaluateJarManifestEscalation(engineDir: string, changedPaths: readonly string[]): Promise<JarEscalationDecision>;
 /**
  * Renders the operator-facing escalation notice. Names the manifest and the
  * reason: "a jar.mn changed" is the sentence that made the previous rule

package/dist/src/core/build-jar-escalation.js

@@ -68,12 +68,9 @@ async function isNewJarManifest(engineDir, path) {
  * @param engineDir - Absolute engine directory
  * @param changedPaths - Engine-relative paths changed since the last
  *   successful build (non-`jar.mn` entries are ignored)
- * @param baseline - Last successful build's baseline (reserved: the
- *   fingerprint map already gated which paths reach here)
  * @returns The escalation decision with per-manifest causes
  */
-export async function evaluateJarManifestEscalation(engineDir, changedPaths, baseline) {
-    void baseline;
+export async function evaluateJarManifestEscalation(engineDir, changedPaths) {
     const causes = [];
     const cleared = [];
     for (const path of changedPaths.filter(isJarManifestPath)) {

package/dist/src/core/build-prepare.js

@@ -16,6 +16,7 @@ import { evaluateJarManifestEscalation, formatJarEscalationNotice, } from './bui
 import { findUnexportedDriftAtRisk, formatUnexportedDriftWarning, } from './build-overwrite-guard.js';
 import { collectChangedEnginePaths, dropPathsMatchingFingerprints } from './engine-changes.js';
 import { applyAllComponents } from './furnace-apply.js';
+import { logApplyWarnings } from './furnace-apply-output.js';
 import { furnaceConfigExists, getFurnacePaths, loadFurnaceConfig, loadFurnaceState, } from './furnace-config.js';
 import { runFurnaceMutation } from './furnace-operation.js';
 import { countEntriesWithBlockingStepErrors } from './furnace-step-errors.js';
@@ -114,15 +115,14 @@ function buildConfigureFailureError(captured) {
  *
  * @param engineDir - Absolute engine directory
  * @param changed - Build inputs changed since the last successful build
- * @param baseline - Last successful build's baseline
  */
-async function decideJarEscalation(engineDir, changed, baseline) {
+async function decideJarEscalation(engineDir, changed) {
     // Packaging manifests whose graph/destination directories may need a full
     // build. Path-shape only: `evaluateJarManifestEscalation` decides whether a
     // given changed manifest actually forces one (a new manifest, or one that
     // redirects its install base directory), so an entry added to an existing
     // `dist/bin` manifest no longer costs a ~10-minute build.
-    const decision = await evaluateJarManifestEscalation(engineDir, changed.filter(isJarManifestPath), baseline);
+    const decision = await evaluateJarManifestEscalation(engineDir, changed.filter(isJarManifestPath));
     if (decision.cleared.length > 0) {
         verbose(`jar escalation: ${decision.cleared.length} changed jar.mn add entries to an existing dist/bin manifest; not escalating for ${decision.cleared.join(', ')}.`);
     }
@@ -164,6 +164,73 @@ async function reportUnexportedDriftBeforeOverwrite(projectRoot, config, options
     }
     notice(message);
 }
+/**
+ * Applies Furnace components before the build when `furnace.json` exists.
+ * Prints every warning the apply computed, then the loud sync banner.
+ *
+ * @param projectRoot - Project root
+ * @returns Number of components written to engine/
+ */
+async function applyFurnaceBeforeBuild(projectRoot) {
+    if (!(await furnaceConfigExists(projectRoot)))
+        return 0;
+    const furnaceConfig = await loadFurnaceConfig(projectRoot);
+    const hasComponents = Object.keys(furnaceConfig.overrides).length > 0 || Object.keys(furnaceConfig.custom).length > 0;
+    if (!hasComponents)
+        return 0;
+    const furnaceSpinner = spinner('Applying Furnace components...');
+    let result;
+    try {
+        result = await runFurnaceMutation(projectRoot, 'apply-rollback', (ctx) => applyAllComponents(projectRoot, false, { operationContext: ctx }));
+    }
+    catch (error) {
+        furnaceSpinner.error('Failed to apply Furnace components');
+        throw error;
+    }
+    const furnaceApplied = result.applied.length;
+    // Count entries that were "applied" but recorded step-level errors
+    // mid-apply (e.g. a post-step failure after file writes succeeded).
+    // These are distinct from `result.errors`, which captures
+    // components that failed before reaching the applied list at all.
+    // The sum of the two is the total count of failed components.
+    const appliedWithStepErrorsCount = countEntriesWithBlockingStepErrors(result.applied);
+    const totalApplyFailures = result.errors.length + appliedWithStepErrorsCount;
+    if (totalApplyFailures > 0) {
+        furnaceSpinner.error('Failed to apply Furnace components');
+        for (const err of result.errors) {
+            warn(`Furnace: ${err.name} — ${err.error}`);
+        }
+        for (const applied of result.applied) {
+            if (applied.stepErrors && applied.stepErrors.length > 0) {
+                for (const stepErr of applied.stepErrors) {
+                    warn(`Furnace: ${applied.name} [${stepErr.step}] ${stepErr.error}`);
+                }
+            }
+        }
+        throw new FurnaceError(`${totalApplyFailures} component${totalApplyFailures === 1 ? '' : 's'} failed to apply cleanly`);
+    }
+    // The apply computed these (patch-owned engine files whose content
+    // differed from components/ and were replaced). `furnace apply`
+    // prints them; this path used to drop them, so a negative control
+    // that edited a deployed Furnace file ran against the shipped code
+    // with a green result and only a checksum could tell.
+    const overwriteCount = logApplyWarnings(result.warnings);
+    if (overwriteCount > 0) {
+        notice(`Furnace: ${overwriteCount} Furnace-managed engine file${overwriteCount === 1 ? '' : 's'} differed from components/ and ${overwriteCount === 1 ? 'was' : 'were'} REPLACED before this build. An engine-side edit to a Furnace-managed file (for example a negative control) did not run; edit the component source under components/ instead, or restore the edit after the build.`);
+    }
+    if (furnaceApplied > 0) {
+        const appliedNames = result.applied.map((entry) => entry.name).join(', ');
+        furnaceSpinner.stop(`Applied ${furnaceApplied} component${furnaceApplied === 1 ? '' : 's'}`);
+        // Loud banner: the build operator needs to see that engine/ was
+        // updated before this build, otherwise a silent re-apply is
+        // indistinguishable from a build that shipped stale components.
+        notice(`Furnace: source → engine sync wrote ${furnaceApplied} component${furnaceApplied === 1 ? '' : 's'} before build (${appliedNames}). engine/ now matches components/.`);
+    }
+    else {
+        furnaceSpinner.stop('Components up to date');
+    }
+    return furnaceApplied;
+}
 /**
  * Runs the shared pre-flight steps for build and package commands:
  * 1. Warns (or refuses) about unexported engine drift the writes below
@@ -202,7 +269,7 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
     if (options.previousBaseline) {
         const changed = await collectChangedBuildInputs(paths.engine, options.previousBaseline);
         const invalidating = changed.filter(isBackendInvalidatingFile);
-        const jarEscalation = await decideJarEscalation(paths.engine, changed, options.previousBaseline);
+        const jarEscalation = await decideJarEscalation(paths.engine, changed);
         fullBuildRequired = jarEscalation !== undefined;
         fullBuildReason = jarEscalation;
         if (invalidating.length > 0) {
@@ -263,57 +330,7 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
             throw error;
         }
     }
-    // Apply Furnace components if furnace.json exists
-    let furnaceApplied = 0;
-    if (await furnaceConfigExists(projectRoot)) {
-        const furnaceConfig = await loadFurnaceConfig(projectRoot);
-        const hasComponents = Object.keys(furnaceConfig.overrides).length > 0 ||
-            Object.keys(furnaceConfig.custom).length > 0;
-        if (hasComponents) {
-            const furnaceSpinner = spinner('Applying Furnace components...');
-            let result;
-            try {
-                result = await runFurnaceMutation(projectRoot, 'apply-rollback', (ctx) => applyAllComponents(projectRoot, false, { operationContext: ctx }));
-            }
-            catch (error) {
-                furnaceSpinner.error('Failed to apply Furnace components');
-                throw error;
-            }
-            furnaceApplied = result.applied.length;
-            // Count entries that were "applied" but recorded step-level errors
-            // mid-apply (e.g. a post-step failure after file writes succeeded).
-            // These are distinct from `result.errors`, which captures
-            // components that failed before reaching the applied list at all.
-            // The sum of the two is the total count of failed components.
-            const appliedWithStepErrorsCount = countEntriesWithBlockingStepErrors(result.applied);
-            const totalApplyFailures = result.errors.length + appliedWithStepErrorsCount;
-            if (totalApplyFailures > 0) {
-                furnaceSpinner.error('Failed to apply Furnace components');
-                for (const err of result.errors) {
-                    warn(`Furnace: ${err.name} — ${err.error}`);
-                }
-                for (const applied of result.applied) {
-                    if (applied.stepErrors && applied.stepErrors.length > 0) {
-                        for (const stepErr of applied.stepErrors) {
-                            warn(`Furnace: ${applied.name} [${stepErr.step}] ${stepErr.error}`);
-                        }
-                    }
-                }
-                throw new FurnaceError(`${totalApplyFailures} component${totalApplyFailures === 1 ? '' : 's'} failed to apply cleanly`);
-            }
-            if (furnaceApplied > 0) {
-                const appliedNames = result.applied.map((entry) => entry.name).join(', ');
-                furnaceSpinner.stop(`Applied ${furnaceApplied} component${furnaceApplied === 1 ? '' : 's'}`);
-                // Loud banner: the build operator needs to see that engine/ was
-                // updated before this build, otherwise a silent re-apply is
-                // indistinguishable from a build that shipped stale components.
-                notice(`Furnace: source → engine sync wrote ${furnaceApplied} component${furnaceApplied === 1 ? '' : 's'} before build (${appliedNames}). engine/ now matches components/.`);
-            }
-            else {
-                furnaceSpinner.stop('Components up to date');
-            }
-        }
-    }
+    const furnaceApplied = await applyFurnaceBeforeBuild(projectRoot);
     // Generate mozconfig
     const mozconfigSpinner = spinner('Generating mozconfig...');
     try {

package/dist/src/core/config-paths.d.ts

@@ -7,7 +7,7 @@ export declare const FIREFORGE_DIR = ".fireforge";
 /** Supported top-level fireforge.json keys backed by the current schema. */
 export declare const SUPPORTED_CONFIG_ROOT_KEYS: readonly ["name", "vendor", "appId", "binaryName", "firefox", "build", "buildAudit", "test", "externalToolchains", "license", "wire", "patchLint", "patchPolicy", "typecheck", "markerComment"];
 /** Supported config paths that can be read or set without --force. */
-export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "firefox.candidate", "firefox.allowUnverifiedDownload", "build", "build.jobs", "test", "test.canaryPath", "test.canaryTimeoutSeconds", "externalToolchains", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.checkJsTestFiles", "patchLint.checkJsTestShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "patchPolicy", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment"];
+export declare const SUPPORTED_CONFIG_PATHS: readonly ["name", "vendor", "appId", "binaryName", "license", "firefox", "firefox.version", "firefox.product", "firefox.sha256", "firefox.candidate", "firefox.allowUnverifiedDownload", "build", "build.jobs", "test", "test.canaryPath", "test.canaryTimeoutSeconds", "test.reapOrphans", "externalToolchains", "wire", "wire.subscriptDir", "patchLint", "patchLint.checkJs", "patchLint.checkJsStrict", "patchLint.checkJsCompilerOptions", "patchLint.checkJsExtraShim", "patchLint.checkJsTestFiles", "patchLint.checkJsTestShim", "patchLint.rawColorAllowlist", "patchLint.jsdocClassMethods", "patchLint.testAssertionFloor", "patchLint.chromeScriptJsDoc", "patchPolicy", "typecheck", "typecheck.projects", "typecheck.extraShim", "markerComment"];
 /**
  * Gets all project paths based on a root directory.
  * @param root - Root directory of the project

package/dist/src/core/config-paths.js

@@ -53,6 +53,7 @@ export const SUPPORTED_CONFIG_PATHS = [
     'test',
     'test.canaryPath',
     'test.canaryTimeoutSeconds',
+    'test.reapOrphans',
     'externalToolchains',
     'wire',
     'wire.subscriptDir',

package/dist/src/core/config-validate-test-toolchains.js

@@ -45,6 +45,13 @@ export function parseTestBlock(rec, config) {
         }
         out.canaryTimeoutSeconds = canaryTimeout;
     }
+    const reapOrphans = testRec.raw('reapOrphans');
+    if (reapOrphans !== undefined) {
+        if (reapOrphans !== 'report' && reapOrphans !== 'reap') {
+            throw new ConfigError('Config field "test.reapOrphans" must be "report" or "reap"');
+        }
+        out.reapOrphans = reapOrphans;
+    }
     config.test = out;
 }
 /** Parses optional project-specific external toolchain doctor probes. */

package/dist/src/core/file-lock.js

@@ -433,15 +433,13 @@ export async function withFileLock(lockPath, operation, options = {}) {
                         continue;
                     }
                 }
-                if (Date.now() >= deadline) {
-                    // The queue is read here, not carried over from the last progress
-                    // probe: the position the wait reached is the one number that says
-                    // whether a larger budget would have helped, and it must not depend
-                    // on a probe having happened to land inside the budget. We are still
-                    // registered at this point. `deregisterWaiter` runs in the `finally`
-                    // below, which is only entered once this refusal has been built.
-                    throw await buildLockTimeoutError(lockPath, options.onTimeoutMessage, error, await readLockQueue(lockPath, startedAt));
-                }
+                // The probe runs before the deadline check, so a due progress line is
+                // written before the refusal that follows it, never lost to it. On a
+                // slow host (a cold Windows CI runner) the first iteration alone, with
+                // its waiter registration and stale probe, can outlast a short budget;
+                // checked the other way round, the wait timed out having reported
+                // nothing, and an advance that probe would have seen could not extend
+                // the deadline it was about to miss.
                 if (probeWanted && Date.now() - lastProbeAt >= probeIntervalMs) {
                     lastProbeAt = Date.now();
                     // Report the budget that is currently in force, not the one
@@ -473,6 +471,15 @@ export async function withFileLock(lockPath, operation, options = {}) {
                         }
                     }
                 }
+                if (Date.now() >= deadline) {
+                    // The queue is read here, not carried over from the last progress
+                    // probe: the position the wait reached is the one number that says
+                    // whether a larger budget would have helped, and it must not depend
+                    // on a probe having happened to land inside the budget. We are still
+                    // registered at this point. `deregisterWaiter` runs in the `finally`
+                    // below, which is only entered once this refusal has been built.
+                    throw await buildLockTimeoutError(lockPath, options.onTimeoutMessage, error, await readLockQueue(lockPath, startedAt));
+                }
                 await sleep(currentPollMs);
                 if (options.pollMaxMs !== undefined) {
                     currentPollMs = Math.min(currentPollMs * 2, options.pollMaxMs);