@hominis/fireforge 0.48.0 → 0.49.1

package/dist/src/commands/test.js

@@ -3,29 +3,30 @@ import { join } from 'node:path';
 import { getProjectPaths, loadConfig } from '../core/config.js';
 import { assertEngineExists } from '../core/engine-precondition.js';
 import { assertEngineGenerationUnchanged, snapshotEngineGeneration, } from '../core/engine-session-lock.js';
-import { reportOrphanedHarnessProcesses } from '../core/harness-orphans.js';
 import { hasBuildArtifacts, hasRunnableBundle } from '../core/mach.js';
 import { assertBuildArtifacts } from '../core/mach-build-artifacts.js';
-import { assertMarionettePortAvailable, ensureLaunchableBrowserNotRunning, ensureMarionettePortAvailable, extractForwardedMarionettePort, forwardedMachArgsIncludeMarionetteClient, shouldAutoForwardMarionettePortToMach, } from '../core/marionette-port.js';
-import { formatMarionettePreflightLine, reportMarionettePreflight, runMarionettePreflight, } from '../core/marionette-preflight.js';
-import { ensureMochitestServerPortAvailable } from '../core/mochitest-server-port.js';
+import { ensureLaunchableBrowserNotRunning } from '../core/marionette-port.js';
+import { waitForPreflight } from '../core/preflight-wait.js';
 import { closeActiveRunLog, openRunLog, setActiveRunLog, writeToActiveRunLog, } from '../core/run-log.js';
 import { createPostRebuildFailureContext } from '../core/test-harness-output.js';
 import { analyzeTestPathScopes, formatScopeNotice, } from '../core/test-path-scope.js';
+import { cleanupProfileFiles, stageProfileFiles, } from '../core/test-profile-files.js';
 import { assertObjdirMatchesTreeMarker } from '../core/tree-store.js';
 import { FireForgeError, GeneralError, PreflightRefusalError } from '../errors/base.js';
 import { BuildError } from '../errors/build.js';
 import { toError } from '../utils/errors.js';
 import { pathExists } from '../utils/fs.js';
-import { info, intro, notice, outro, verbose } from '../utils/logger.js';
+import { info, intro, notice, warn } from '../utils/logger.js';
+import { resolveWaitLockSeconds } from '../utils/options.js';
 import { stripEnginePrefix } from '../utils/paths.js';
+import { appendMarionetteForwardingArgs, ensureTestBrowserEnvironment, runDoctorPreflight, } from './test-browser-preflight.js';
 import { runTestBuildPhase } from './test-build-phase.js';
 import { diagnoseShardOutcome, finalizeSingleRunOutcome } from './test-diagnose.js';
-import { buildPerfSampleEnv, mergeHarnessEnv, resolveShuffleSeed } from './test-harness-env.js';
+import { buildPerfSampleEnv, mergeHarnessEnv, resolveShuffleSeed, shuffleTestGroups, } from './test-harness-env.js';
 import { removePgidFile, setActivePgidFile } from './test-harness-teardown.js';
 import { assertPathlessTestMode, assertTestModeCombinations, canaryTimeoutSeconds, classifyBeforeDispatch, reportCanaryOutcome, resolveCanaryPath, } from './test-modes.js';
 import { DEFAULT_HARNESS_RETRIES, finalizeShardedOutcome, runShardedTests, runTestsWithRetries, } from './test-run.js';
-import { addVerdictRunCount, emitFailVerdict, emitPassVerdict, resetVerdictEmission, verdictEmitted, } from './test-verdict.js';
+import { emitFailVerdict, resetVerdictEmission, verdictEmitted } from './test-verdict.js';
 async function assertTestPathsExist(engineDir, testPaths) {
     const missingPaths = [];
     for (const testPath of testPaths) {
@@ -102,171 +103,6 @@ function logTestSelection(scopes) {
     }
     info('');
 }
-/**
- * Runs the `--doctor` marionette handshake probe. With no test paths the
- * probe is the entire command (returns `'stop'` after reporting). With
- * paths it gates the mach invocation, where a FAIL throws before mach runs.
- */
-async function runDoctorPreflight(args) {
-    const { engineDir, effectivePort, hasTestPaths, objDir, binaryName, launchablePath } = args;
-    // Non-TTY captures need the banner even if clack's renderer defers output
-    // in pipe mode. TTY users need the clack framing. Gated rather than
-    // written twice: the unconditional pair printed the same line twice on a
-    // terminal.
-    if (process.stdout.isTTY) {
-        info('Running marionette preflight...');
-    }
-    else {
-        process.stdout.write('Running marionette preflight...\n');
-    }
-    const preflight = effectivePort !== undefined
-        ? await runMarionettePreflight(engineDir, { port: effectivePort })
-        : await runMarionettePreflight(engineDir);
-    // The authoritative PASS/FAIL line is written with `process.stdout.write`
-    // as the first output after the probe returns, because clack's renderer
-    // can drop the summary under non-TTY capture.
-    //
-    // Gated on non-TTY: unconditional, it stacks with the two clack renderings
-    // below and the same line appears three times on a terminal. Captured
-    // streams are exactly where this branch still fires.
-    const directLine = formatMarionettePreflightLine(preflight);
-    if (!process.stdout.isTTY) {
-        process.stdout.write(`${directLine}\n`);
-    }
-    process.stdout.write(`Marionette preflight environment: objdir=${objDir ?? '(none)'}; binary=${binaryName}; app=${launchablePath ? `engine/${launchablePath}` : '(unknown)'}; port=${effectivePort ?? 2828}; elapsed=${preflight.durationMs}ms\n`);
-    reportMarionettePreflight(preflight);
-    if (!hasTestPaths) {
-        if (!preflight.ok) {
-            emitFailVerdict('preflight');
-            throw new GeneralError('Marionette preflight reported FAIL — see output above.');
-        }
-        // Doctor-only runs end here, so they carry their own verdict line
-        // (reason=preflight on failure). With test paths the verdict comes
-        // from the actual harness run downstream.
-        emitPassVerdict();
-        outro('Test completed');
-        return 'stop';
-    }
-    if (!preflight.ok) {
-        emitFailVerdict('preflight');
-        throw new GeneralError('Marionette preflight reported FAIL — see output above. Aborting before mach test runs.');
-    }
-    return 'continue';
-}
-/**
- * Auto-forwards `--marionette-port` to mach (`--setpref=marionette.port`
- * for the listener, `--marionette=127.0.0.1:<n>` for the mochitest
- * client), skipping each piece the operator already forwarded via
- * `--mach-arg` and the xpcshell flavor that ignores the pref entirely.
- * Mutates `extraArgs` in place.
- */
-function appendMarionetteForwardingArgs(extraArgs, options, forwardedPort, xpcshellOnly = false) {
-    // Auto-forward the Marionette port to mach when `--marionette-port` is set.
-    // `--setpref=marionette.port=<n>` configures where the browser listener
-    // binds. `--marionette=127.0.0.1:<n>` tells the mochitest harness client to
-    // connect there (default client is 127.0.0.1:2828). xpcshell ignores both
-    // for browser Marionette.
-    //
-    // Skip setpref forwarding when the operator already supplied an equivalent
-    // arg via `--mach-arg`: duplicates would confuse without changing
-    // semantics. Skip when mach args explicitly request `--flavor=xpcshell` (or
-    // `xpcshell-tests`): the preflight still honours `--marionette-port`, but
-    // mach does not use the marionette.port pref on that harness. Any other arg
-    // shape still forwards so toolkit widget paths and mixed suites stay
-    // aligned with the probe without duplicate `--mach-arg` flags.
-    //
-    // Skip auto `--marionette=...` when `--mach-arg` already includes a client
-    // `--marionette=...` (or two-token `--marionette host:port`).
-    if (options.marionettePort === undefined)
-        return;
-    if (xpcshellOnly) {
-        // Manifest classification says every requested path is xpcshell.
-        // xpcshell ignores the browser Marionette path entirely, and forwarding
-        // the mochitest client flags here makes mach reject the dispatch.
-        info(`--marionette-port=${options.marionettePort} applied to the preflight probe only: the requested paths are xpcshell-only, and xpcshell ignores the browser Marionette port. Not forwarding --setpref=marionette.port or --marionette to mach.`);
-        return;
-    }
-    {
-        const operatorAlreadyForwarded = forwardedPort !== undefined;
-        const machArgs = options.machArg ?? [];
-        if (operatorAlreadyForwarded) {
-            info(`--marionette-port=${options.marionettePort} set, but the same port is already forwarded via --mach-arg; skipping auto-forward.`);
-        }
-        else if (shouldAutoForwardMarionettePortToMach(machArgs)) {
-            extraArgs.push(`--setpref=marionette.port=${options.marionettePort}`);
-        }
-        else {
-            info(`--marionette-port=${options.marionettePort} applied to the preflight probe, but --flavor=xpcshell is set — mach is not auto-configured with --setpref=marionette.port or --marionette (xpcshell ignores the browser Marionette path). Pass --mach-arg --setpref=marionette.port=${options.marionettePort} explicitly if you still need mach to see the port.`);
-        }
-        if (shouldAutoForwardMarionettePortToMach(machArgs) &&
-            !forwardedMachArgsIncludeMarionetteClient(machArgs)) {
-            extraArgs.push(`--marionette=127.0.0.1:${options.marionettePort}`);
-        }
-    }
-}
-async function ensureTestMarionettePortAvailable(port, binaryName, options, skip) {
-    // Refuse a stale listener before mach surfaces a generic bind failure.
-    // This also recognizes a fork-branded browser via binaryName.
-    if (skip.xpcshellOnly && !skip.doctor) {
-        // xpcshell does not bind the browser Marionette port, so a developer's
-        // interactive browser holding 2828 must not kill an xpcshell run.
-        // --doctor keeps the preflight: its probe launches a
-        // Marionette browser regardless of the requested harness.
-        const message = 'Skipping the Marionette stale-port preflight: all requested paths are xpcshell ' +
-            '(xpcshell does not bind the browser Marionette port).';
-        if (options.marionettePort !== undefined || options.killStaleMarionette === true) {
-            info(message);
-        }
-        else {
-            verbose(message);
-        }
-        return;
-    }
-    if (options.killStaleMarionette === true) {
-        await ensureMarionettePortAvailable(port, { binaryName, killStaleBrowser: true });
-        return;
-    }
-    await assertMarionettePortAvailable(port, { binaryName });
-}
-async function ensureTestBrowserEnvironment(engineDir, launchablePath, xpcshellOnly, projectConfig, options, objDir) {
-    // A timed-out mochitest can leave the built app alive after its Marionette
-    // listener has disappeared. The port probe cannot see that case, but the
-    // survivor can still steal focus and wedge every later headed run.
-    if (!xpcshellOnly && launchablePath) {
-        await ensureLaunchableBrowserNotRunning(join(engineDir, launchablePath), {
-            killStaleBrowser: options.killStaleMarionette === true,
-        });
-    }
-    // A zombie mochitest httpd squatting the server port makes a fresh
-    // browser connect to a server that cannot serve this run's manifest,
-    // which surfaces as a 370s "Ran 0 checks" stall naming nothing. xpcshell
-    // does not use the httpd, so an xpcshell-only run is never blocked by it.
-    if (!xpcshellOnly) {
-        await ensureMochitestServerPortAvailable(undefined, {
-            engineDir,
-            killStaleServer: options.killStaleMarionette === true,
-        });
-    }
-    // Helpers that outlived an earlier run (httpd, pywebsocket, ssltunnel,
-    // moz-http2) slow every later run without appearing in its output. Both
-    // harnesses are affected, so this census is not gated on xpcshellOnly.
-    // Reaping is opt-in per invocation (--reap-orphans) or per repo
-    // (test.reapOrphans: "reap"); a reap is stamped on the verdict line so a
-    // green after one is not mistaken for a green on a quiet machine.
-    const census = await reportOrphanedHarnessProcesses(objDir, {
-        reap: options.reapOrphans === true || projectConfig.test?.reapOrphans === 'reap',
-    });
-    addVerdictRunCount('orphans-reaped', census.reaped);
-    const forwardedPort = options.machArg
-        ? extractForwardedMarionettePort(options.machArg)
-        : undefined;
-    const effectivePort = options.marionettePort ?? forwardedPort;
-    await ensureTestMarionettePortAvailable(effectivePort, projectConfig.binaryName, options, {
-        xpcshellOnly,
-        doctor: options.doctor === true,
-    });
-    return { forwardedPort, effectivePort };
-}
 /** Build-artifact preflight wording for `fireforge test`. */
 const TEST_BUILD_PREFLIGHT = {
     label: 'Tests',
@@ -297,8 +133,13 @@ export async function testCommand(projectRoot, testPaths, options = {}) {
     // `finally`, after the verdict line has already read the path.
     setActiveRunLog(await openRunLog(projectRoot, 'test'));
     setActivePgidFile(options.pgidFile);
+    let staged;
     try {
-        await runTestCommandBody(projectRoot, testPaths, options);
+        if (options.profileFile?.length) {
+            staged = await stageProfileFiles(projectRoot, options.profileFile);
+            options = { ...options, machArg: [...(options.machArg ?? []), ...staged.args] };
+        }
+        await runTestCommandBody(projectRoot, testPaths, options, staged?.env);
     }
     catch (error) {
         if (!verdictEmitted()) {
@@ -310,8 +151,20 @@ export async function testCommand(projectRoot, testPaths, options = {}) {
     finally {
         // A run that ends under FireForge's control owns no harness group any
         // more; the file only outlives FireForge when FireForge was killed.
-        await removePgidFile(options.pgidFile);
-        await closeActiveRunLog();
+        const stagedRoot = staged?.root;
+        const cleanups = [
+            ...(stagedRoot === undefined ? [] : [() => cleanupProfileFiles(stagedRoot)]),
+            () => removePgidFile(options.pgidFile),
+            () => closeActiveRunLog(),
+        ];
+        for (const cleanup of cleanups) {
+            try {
+                await cleanup();
+            }
+            catch (error) {
+                warn(`Test cleanup failed: ${toError(error).message}`);
+            }
+        }
     }
 }
 /** The refusal class a preflight gate named, when it named one. */
@@ -355,16 +208,56 @@ function renderPreflightRefusal(error) {
  * misdescribe a run whose harness already executed). It is emitted here so the
  * guard's throw can never leave a stale or missing verdict line behind.
  */
-async function verifyEngineGenerationOrEmitInconclusive(engineDir, before) {
+async function verifyEngineGenerationOrEmitInconclusive(engineDir, before, powerChanged = false) {
     try {
         await assertEngineGenerationUnchanged(engineDir, before);
+        if (powerChanged)
+            throw new GeneralError('Perf power source changed during the run; repeat this sitting on a stable power source.');
     }
     catch (error) {
         emitFailVerdict('inconclusive');
         throw error;
     }
 }
-async function runTestCommandBody(projectRoot, testPaths, options = {}) {
+async function guardBuildBrowser(engineDir, launchablePath, options) {
+    if ((options.build || options.buildOnly) && launchablePath) {
+        await waitForPreflight(() => ensureLaunchableBrowserNotRunning(join(engineDir, launchablePath), {
+            killStaleBrowser: options.killStaleMarionette === true,
+        }), options.waitBrowser === undefined ? undefined : resolveWaitLockSeconds(options.waitBrowser));
+    }
+}
+function prepareExtraMachArgs(options, shuffleSeed, canaryPath, projectConfig, forwardedMachArgs) {
+    const extraArgs = [];
+    if (options.headless) {
+        extraArgs.push('--headless');
+    }
+    if (shuffleSeed !== undefined) {
+        extraArgs.push('--shuffle');
+    }
+    if (options.auto === true) {
+        extraArgs.push('--auto');
+    }
+    if (canaryPath !== undefined)
+        extraArgs.push(`--timeout=${canaryTimeoutSeconds(projectConfig)}`);
+    // --mach-arg is a verbatim passthrough for upstream mach/xpcshell/mochitest
+    // flags FireForge does not model directly (see the xpcshell appdir hint
+    // above for why). Appended after --headless so mach sees
+    // the FireForge-managed flags first and the escape-valve ones last, which
+    // keeps the override precedence predictable.
+    if (forwardedMachArgs.length > 0)
+        extraArgs.push(...forwardedMachArgs);
+    return extraArgs;
+}
+function prepareDispatchArguments(classification, options, canaryPath, projectConfig) {
+    const suite = resolveTestSuite(classification, options.genericMachTest === true);
+    const shuffleSeed = resolveShuffleSeed(options.shuffle, suite);
+    const forwardedMachArgs = options.machArg && options.machArg.length > 0
+        ? filterRedundantXpcshellFlavorArgs(options.machArg, classification)
+        : [];
+    const extraArgs = prepareExtraMachArgs(options, shuffleSeed, canaryPath, projectConfig, forwardedMachArgs);
+    return { suite, shuffleSeed, extraArgs };
+}
+async function runTestCommandBody(projectRoot, testPaths, options = {}, profileEnv) {
     const paths = getProjectPaths(projectRoot);
     // Check if engine exists
     await assertEngineExists(paths.engine);
@@ -398,12 +291,7 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
     const requestedPaths = canaryPath !== undefined ? [canaryPath] : testPaths;
     const normalizedPaths = requestedPaths.map((p) => stripEnginePrefix(p).trim());
     const { classification, xpcshellOnly } = await classifyBeforeDispatch(paths.engine, normalizedPaths, { allowMixed: options.buildOnly === true });
-    if (await runTestBuildPhase(projectRoot, paths, projectConfig, harnessRetries, options, {
-        classification,
-        normalizedPaths,
-    })) {
-        return;
-    }
+    await guardBuildBrowser(paths.engine, launchablePath, options);
     // Resolve the effective Marionette port. Operator precedence:
     //   1. `--marionette-port` (first-class option, parsed at the CLI layer)
     //   2. forwarded `--mach-arg --marionette-port=NNNN` /
@@ -414,6 +302,12 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
     // documented `--mach-arg --marionette-port=NNNN` route still hits the
     // wrapper preflight refusing on 2828 before the forwarded arg reaches
     // mach.
+    if (await runTestBuildPhase(projectRoot, paths, projectConfig, harnessRetries, options, {
+        classification,
+        normalizedPaths,
+    })) {
+        return;
+    }
     const { forwardedPort, effectivePort } = await ensureTestBrowserEnvironment(paths.engine, launchablePath, xpcshellOnly, projectConfig, options, buildCheck.objDir);
     if (options.doctor) {
         const doctorOutcome = await runDoctorPreflight({
@@ -428,30 +322,7 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
             return;
     }
     await assertTestPathsExist(paths.engine, normalizedPaths);
-    const suite = resolveTestSuite(classification, options.genericMachTest === true);
-    const shuffleSeed = resolveShuffleSeed(options.shuffle, suite);
-    const forwardedMachArgs = options.machArg && options.machArg.length > 0
-        ? filterRedundantXpcshellFlavorArgs(options.machArg, classification)
-        : [];
-    const extraArgs = [];
-    if (options.headless) {
-        extraArgs.push('--headless');
-    }
-    if (shuffleSeed !== undefined) {
-        extraArgs.push('--shuffle');
-    }
-    if (options.auto === true) {
-        extraArgs.push('--auto');
-    }
-    if (canaryPath !== undefined)
-        extraArgs.push(`--timeout=${canaryTimeoutSeconds(projectConfig)}`);
-    // --mach-arg is a verbatim passthrough for upstream mach/xpcshell/mochitest
-    // flags FireForge does not model directly (see the xpcshell appdir hint
-    // above for why). Appended after --headless so mach sees
-    // the FireForge-managed flags first and the escape-valve ones last, which
-    // keeps the override precedence predictable.
-    if (forwardedMachArgs.length > 0)
-        extraArgs.push(...forwardedMachArgs);
+    const { suite, shuffleSeed, extraArgs } = prepareDispatchArguments(classification, options, canaryPath, projectConfig);
     appendMarionetteForwardingArgs(extraArgs, options, forwardedPort, xpcshellOnly);
     // Directory arguments mean exactly that directory: mozbuild's test
     // resolver matches paths by string prefix, so a bare directory arg
@@ -478,7 +349,7 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
     // the manifest for each file individually. See src/core/xpcshell-appdir.ts
     // for the full motivation.
     logTestSelection(scopes);
-    const harnessEnv = mergeHarnessEnv(buildPerfSampleEnv(projectRoot, projectConfig.binaryName, options.perfSamples), shuffleSeed === undefined ? undefined : { FIREFORGE_SHUFFLE_SEED: String(shuffleSeed) });
+    const harnessEnv = mergeHarnessEnv(buildPerfSampleEnv(projectRoot, projectConfig.binaryName, options.perfSamples), profileEnv, shuffleSeed === undefined ? undefined : { FIREFORGE_SHUFFLE_SEED: String(shuffleSeed) });
     const runCtx = {
         engineDir: paths.engine,
         objDir: buildCheck.objDir,
@@ -511,14 +382,15 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
         const generationBefore = await snapshotEngineGeneration(paths.engine);
         let summary;
         try {
-            summary = await runShardedTests(runCtx, dispatchGroups, (outcome, label) => diagnoseShardOutcome(outcome, label, projectConfig.binaryName, postRebuildContext));
+            const orderedGroups = shuffleSeed === undefined ? dispatchGroups : shuffleTestGroups(dispatchGroups, shuffleSeed);
+            summary = await runShardedTests(runCtx, orderedGroups, (outcome, label) => diagnoseShardOutcome(outcome, label, projectConfig.binaryName, postRebuildContext));
         }
         finally {
             // Runs before the aggregate verdict below: a mutated engine/ emits
             // `FAIL reason=inconclusive` and throws, so an invalidated run can
             // never print `PASS shards=N/N` first. (A throw here masks an
             // in-flight shard error, as the plain assert always did.)
-            await verifyEngineGenerationOrEmitInconclusive(paths.engine, generationBefore);
+            await verifyEngineGenerationOrEmitInconclusive(paths.engine, generationBefore, runCtx.powerChanged);
         }
         finalizeShardedOutcome(summary);
         return;
@@ -533,7 +405,7 @@ async function runTestCommandBody(projectRoot, testPaths, options = {}) {
         throw new BuildError('Test process failed to start', 'mach test', error instanceof Error ? error : undefined);
     }
     finally {
-        await verifyEngineGenerationOrEmitInconclusive(paths.engine, generationBefore);
+        await verifyEngineGenerationOrEmitInconclusive(paths.engine, generationBefore, runCtx.powerChanged);
     }
     if (canaryPath !== undefined) {
         reportCanaryOutcome(outcome);

package/dist/src/core/build-baseline-types.d.ts

@@ -35,6 +35,12 @@ export interface BuildBaseline {
      * a tracked deletion.
      */
     packageableFingerprints?: Record<string, string>;
+    /**
+     * All dirty staging inputs, including plain test scripts and support fixtures.
+     * Omitted when any input could not be fingerprinted; a partial map cannot
+     * anchor retained coverage.
+     */
+    testInputFingerprints?: Record<string, string>;
     /**
      * Content hash per build-input manifest (`jar.mn`, `moz.build`,
      * `moz.configure`, `Makefile.in`, `mozbuild.in`) that was dirty
@@ -83,20 +89,12 @@ export interface BuildBaseline {
      * checkouts are refused up-front (`AmbiguousBuildArtifactsError`), so at
      * most one obj dir exists per project.
      *
-     * Union/"shared coverage" across successive scoped builds is unsound in
-     * general: every baseline write refreshes `packageableFingerprints` for
-     * all dirty packageable paths, so a blind union would whitewash an
-     * earlier scope's edited fixtures while `obj-*`/`_tests/` still holds its
-     * stale staging. Coverage therefore replaces by default.
-     *
-     * The one exception is `test --build --extend-coverage`, which unions only
-     * after proving the previous record's anchor still holds: same engine
-     * HEAD, same {@link BuildBaseline.mozconfigHash}, and every previously
-     * fingerprinted path byte-identical, i.e. the wholesale fingerprint
-     * refresh is a no-op for everything the earlier scope's staging depended
-     * on. Any divergence refuses fail-closed. See `src/core/coverage-extend.ts`
-     * for the one boundary that guard does not cover (dirty non-packageable
-     * fixtures).
+     * Successive scoped builds retain the previous claim only when HEAD,
+     * mozconfig and complete testInputFingerprints outside the rebuilt scope
+     * remain anchored. Explicitly rebuilt paths may change. A failed anchor
+     * replaces coverage with a dropped-path notice, or refuses when the caller
+     * required --extend-coverage. Legacy packageable-only anchors cannot retain
+     * coverage because they cannot prove test scripts and fixtures unchanged.
      */
     testPackagingCoverage?: TestPackagingCoverage;
     /**

package/dist/src/core/build-baseline-validate.d.ts

@@ -0,0 +1,3 @@
+import { type BuildBaseline } from './build-baseline-types.js';
+/** Validates persisted fields without converting malformed coverage into a full claim. */
+export declare function isBuildBaseline(value: unknown): value is BuildBaseline;

package/dist/src/core/build-baseline-validate.js

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: EUPL-1.2
+import { isObject } from '../utils/validation.js';
+import { DELETED_FILE_FINGERPRINT } from './build-baseline-types.js';
+/** Baseline paths are engine-relative POSIX identifiers, never filesystem escapes. */
+function isBaselinePath(value) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        !value.includes('\0') &&
+        !value.includes('\\') &&
+        !value.includes(':') &&
+        value.split('/').every((part) => part.length > 0 && part !== '.' && part !== '..'));
+}
+function isFingerprint(value) {
+    return (typeof value === 'string' &&
+        (/^[a-f0-9]{64}$/i.test(value) || value === DELETED_FILE_FINGERPRINT));
+}
+function isFingerprintMap(value) {
+    return (isObject(value) &&
+        Object.entries(value).every(([path, fingerprint]) => isBaselinePath(path) && isFingerprint(fingerprint)));
+}
+/** Validates persisted fields without converting malformed coverage into a full claim. */
+export function isBuildBaseline(value) {
+    if (!isObject(value))
+        return false;
+    if (typeof value['engineHeadSha'] !== 'string' ||
+        typeof value['builtAt'] !== 'string' ||
+        !Number.isFinite(Date.parse(value['builtAt'])) ||
+        typeof value['binaryName'] !== 'string' ||
+        !/^[a-z][a-z0-9-]*$/.test(value['binaryName']))
+        return false;
+    for (const field of [
+        'packageableFingerprints',
+        'testInputFingerprints',
+        'buildInputFingerprints',
+    ]) {
+        if (value[field] !== undefined && !isFingerprintMap(value[field]))
+            return false;
+    }
+    const coverage = value['testPackagingCoverage'];
+    if (coverage !== undefined &&
+        coverage !== 'full' &&
+        !(Array.isArray(coverage) && coverage.every(isBaselinePath)))
+        return false;
+    if (value['mozconfigHash'] !== undefined && !isFingerprint(value['mozconfigHash']))
+        return false;
+    if (value['recordedBy'] !== undefined && typeof value['recordedBy'] !== 'string')
+        return false;
+    const components = value['staticComponentsBaseline'];
+    return (components === undefined ||
+        (isObject(components) &&
+            typeof components['engineHeadSha'] === 'string' &&
+            isFingerprintMap(components['fingerprints'])));
+}

package/dist/src/core/build-baseline.d.ts

@@ -33,11 +33,12 @@ export type BaselineBuildKind = 'full' | 'faster';
 export declare function getBuildBaselinePath(projectRoot: string): string;
 /**
  * Reads the last-build baseline if present. Returns undefined when no
- * previous successful build has been recorded. Callers must tolerate that
- * path (first build, cleaned workspace).
+ * previous successful build has been recorded. Builds can replace invalid
+ * markers; dispatch preflights pass `refuse` so invalid coverage never
+ * becomes the legacy implicit full claim.
  * @param projectRoot - Root directory of the project
  */
-export declare function readBuildBaseline(projectRoot: string): Promise<BuildBaseline | undefined>;
+export declare function readBuildBaseline(projectRoot: string, invalid?: 'ignore' | 'refuse'): Promise<BuildBaseline | undefined>;
 export interface WriteBuildBaselineOptions {
     /** Root directory of the project. */
     projectRoot: string;

package/dist/src/core/build-baseline.js

@@ -18,13 +18,15 @@
  */
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { PreflightRefusalError } from '../errors/base.js';
 import { mapWithConcurrency } from '../utils/concurrency.js';
 import { getNodeErrorCode, toError } from '../utils/errors.js';
-import { pathExists, readJson, writeJson } from '../utils/fs.js';
+import { readJson, writeJson } from '../utils/fs.js';
 import { sha256Hex } from '../utils/hash.js';
 import { verbose } from '../utils/logger.js';
 import { isBuildInputPath, isJarManifestPath, isPackageablePath, isXpcomManifestPath, } from './build-audit.js';
 import { DELETED_FILE_FINGERPRINT, } from './build-baseline-types.js';
+import { isBuildBaseline } from './build-baseline-validate.js';
 import { FIREFORGE_DIR } from './config-paths.js';
 import { hashEngineFile } from './coverage-extend.js';
 import { getHead, hasChanges, isMissingHeadError } from './git.js';
@@ -47,21 +49,26 @@ export function getBuildBaselinePath(projectRoot) {
 }
 /**
  * Reads the last-build baseline if present. Returns undefined when no
- * previous successful build has been recorded. Callers must tolerate that
- * path (first build, cleaned workspace).
+ * previous successful build has been recorded. Builds can replace invalid
+ * markers; dispatch preflights pass `refuse` so invalid coverage never
+ * becomes the legacy implicit full claim.
  * @param projectRoot - Root directory of the project
  */
-export async function readBuildBaseline(projectRoot) {
+export async function readBuildBaseline(projectRoot, invalid = 'ignore') {
     const path = getBuildBaselinePath(projectRoot);
-    if (!(await pathExists(path))) {
-        return undefined;
-    }
     try {
-        return await readJson(path);
+        const value = await readJson(path);
+        if (!isBuildBaseline(value))
+            throw new Error('invalid baseline fields');
+        return value;
     }
-    catch {
-        // A corrupt marker is equivalent to no marker: the audit/auto-configure
-        // will treat it as "first build" rather than block on the inconsistency.
+    catch (error) {
+        if (getNodeErrorCode(error) === 'ENOENT')
+            return undefined;
+        if (invalid === 'refuse') {
+            throw new PreflightRefusalError(`Build baseline ${path} is invalid: ${toError(error).message}. Run "fireforge build" to record a fresh baseline before dispatching tests.`, 'invalid-build-baseline');
+        }
+        verbose(`Ignoring invalid build baseline ${path}: ${toError(error).message}`);
         return undefined;
     }
 }
@@ -89,6 +96,7 @@ export async function writeBuildBaseline(options) {
         }
     }
     const packageableFingerprints = await collectPackageableFingerprints(engineDir);
+    const testInputFingerprints = await collectDirtyFingerprints(engineDir, () => true, 'test staging fingerprint');
     const buildInputFingerprints = await collectBuildInputFingerprints(engineDir, previousBaseline, buildKind);
     // A full-coverage write (and the legacy no-claim `fireforge build` shape)
     // just recompiled the StaticComponents table, so it anchors the table to
@@ -105,6 +113,7 @@ export async function writeBuildBaseline(options) {
         builtAt: new Date().toISOString(),
         binaryName,
         ...(packageableFingerprints !== undefined ? { packageableFingerprints } : {}),
+        ...(testInputFingerprints !== undefined ? { testInputFingerprints } : {}),
         ...(buildInputFingerprints !== undefined ? { buildInputFingerprints } : {}),
         ...(testPackagingCoverage !== undefined ? { testPackagingCoverage } : {}),
         ...(mozconfigHash !== undefined ? { mozconfigHash } : {}),
@@ -218,6 +227,9 @@ async function collectDirtyFingerprints(engineDir, includePath, contextLabel) {
             }
         });
         const fingerprints = {};
+        // Incomplete maps cannot prove retained test inputs unchanged.
+        if (entries.some((entry) => entry === undefined))
+            return undefined;
         for (const entry of entries) {
             if (entry !== undefined)
                 fingerprints[entry[0]] = entry[1];

package/dist/src/core/component-source-guard.d.ts

@@ -0,0 +1,20 @@
+import type { FurnaceConfig } from '../types/furnace.js';
+import type { FurnacePaths } from './furnace-config.js';
+/** Records authored bytes without following directory aliases or writing to source directories. */
+export declare function snapshotComponentSources(roots: readonly string[]): Promise<Map<string, string>>;
+/** Detects reverted, removed or added source files before deployment can be committed. */
+export declare function changedComponentSources(roots: readonly string[], before: ReadonlyMap<string, string>): Promise<string[]>;
+interface ComponentSourceSnapshot {
+    roots: string[];
+    files: Map<string, string>;
+}
+/** Captures only configured inputs for a real deploy, plus shared CSS fragments. */
+export declare function captureComponentSources(paths: FurnacePaths, config: FurnaceConfig, dryRun: boolean, options?: {
+    componentName?: string;
+}): Promise<ComponentSourceSnapshot | undefined>;
+/** Produces a blocking apply error before the journal or ownership state is committed. */
+export declare function componentSourceErrors(snapshot: ComponentSourceSnapshot | undefined): Promise<Array<{
+    name: string;
+    error: string;
+}>>;
+export {};