@hominis/fireforge 0.49.1 → 0.50.0

package/dist/src/commands/status.js

@@ -8,17 +8,17 @@ import { collectFurnaceManagedPrefixes } from '../core/furnace-config.js';
 import { getHead, getStatusWithCodes, isGitRepository, isMissingHeadError } from '../core/git.js';
 import { listUntrackedFilesInDirs, resolveMaxUntrackedFilesPerDir } from '../core/git-status.js';
 import { renderOwnershipTable } from '../core/ownership-table.js';
-import { loadPatchesManifest } from '../core/patch-manifest.js';
 import { readProcessCpuSeconds } from '../core/process-cpu-time.js';
 import { classifyFiles } from '../core/status-classify.js';
 import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { FIREFORGE_TMP_PATH_PATTERN, pathExists } from '../utils/fs.js';
 import { info, intro, isMachineOutputMode, outro, setMachineOutputMode, warn, } from '../utils/logger.js';
 import { emitMachineError } from '../utils/machine-output.js';
-import { resolveStatusCheckPolicy, runStatusCheck, } from './status-check.js';
+import { policyNeedsOwnership, resolveStatusCheckPolicy, runStatusCheck, } from './status-check.js';
 import { renderJsonStatus, renderJsonSummaryStatus } from './status-json.js';
 import { renderDefaultStatus, renderTestCoverageStatus, renderUnmanagedOnly, } from './status-output.js';
-import { buildOwnershipJsonBlock, collectOwnershipRows, summarizeOwnership, } from './status-ownership.js';
+import { buildOwnershipJsonBlock, summarizeOwnership } from './status-ownership.js';
+import { collectScopedOwnershipRows, ownershipConflictPaths, resolveStatusScope, scopeClassified, } from './status-scope.js';
 /**
  * Renders raw worktree status as machine-parseable porcelain-style output.
  * Each line is: STATUS<tab>FILE
@@ -121,26 +121,47 @@ async function scanEngineStatusFiles(engineDir, requireGitRepository) {
  * policy, which stays the only exit driver on this path.
  *
  * `--include-ownership` is a modifier rather than a mode: it appends an
- * ownership block without touching exit semantics, so an ownership
- * conflict still fails only the human `--ownership` mode.
+ * ownership block without touching exit semantics. Ownership conflicts
+ * fail this path only when the policy names `ownership-conflict` (or
+ * leaves it unnamed under `--fail-on-unknown`).
  *
- * @param classified - Classified worktree entries
+ * @param classified - Classified worktree entries, unscoped
  * @param files - The same entries pre-classification, for ownership rows
  * @param paths - Resolved project paths
  * @param options - Status display options
  * @param checkPolicy - Resolved `--check`/`--fail-on` policy
+ * @param scope - The `--patches` scope, when given
  */
-async function renderJsonMode(classified, files, paths, options, checkPolicy) {
-    const ownership = options.includeOwnership === true
-        ? buildOwnershipJsonBlock(await collectOwnershipRows(paths.patches, (await loadPatchesManifest(paths.patches))?.patches ?? [], files, classified))
-        : undefined;
+async function renderJsonMode(classified, files, paths, options, checkPolicy, scope) {
+    const rows = options.includeOwnership === true || policyNeedsOwnership(checkPolicy)
+        ? await collectScopedOwnershipRows(paths.patches, files, classified, scope)
+        : [];
+    const context = {
+        policy: checkPolicy,
+        ownershipConflicts: ownershipConflictPaths(rows),
+        ownership: options.includeOwnership === true ? buildOwnershipJsonBlock(rows) : undefined,
+        scope,
+    };
+    const scoped = scopeClassified(classified, scope);
     if (options.summary === true) {
-        renderJsonSummaryStatus(classified, checkPolicy, ownership);
+        renderJsonSummaryStatus(scoped, context);
     }
     else {
-        renderJsonStatus(classified, ownership);
+        renderJsonStatus(scoped, context);
     }
-    runStatusCheck(classified, checkPolicy);
+    runStatusCheck(scoped, checkPolicy, context.ownershipConflicts);
+}
+/**
+ * Applies the `--check` policy to the human default view. Builds the
+ * ownership rows only when the policy can fail on `ownership-conflict`,
+ * which it can on a clean tree too (two patches claiming one path need no
+ * worktree change).
+ */
+async function runHumanStatusCheck(classified, files, paths, checkPolicy, scope) {
+    const conflicts = policyNeedsOwnership(checkPolicy)
+        ? ownershipConflictPaths(await collectScopedOwnershipRows(paths.patches, files, classified, scope))
+        : [];
+    runStatusCheck(scopeClassified(classified, scope), checkPolicy, conflicts);
 }
 /**
  * Detects the "unborn HEAD" aftermath of an interrupted `fireforge download`:
@@ -200,8 +221,12 @@ export async function statusCommand(projectRoot, options = {}) {
         setMachineOutputMode(previousMachineOutputMode);
     }
 }
-/** The status body proper. The machine-mode lifecycle lives in {@link statusCommand}. */
-async function runStatusCommandBody(projectRoot, options) {
+/**
+ * Refuses flag combinations no view can honour, before any output: one
+ * mode at most, and the JSON-only and scope modifiers only where they mean
+ * something.
+ */
+function assertStatusFlagCombination(options) {
     const modeCount = [
         options.raw,
         options.unmanaged,
@@ -224,6 +249,18 @@ async function runStatusCommandBody(projectRoot, options) {
     if (options.includeOwnership === true && options.json !== true) {
         throw new InvalidArgumentError('--include-ownership requires --json. Use --ownership for the human table.', '--include-ownership');
     }
+    // --patches scopes the classifying views and the ownership table only.
+    if (options.patches !== undefined &&
+        (options.raw === true ||
+            options.unmanaged === true ||
+            options.testCoverage === true ||
+            options.lock === true)) {
+        throw new InvalidArgumentError('--patches cannot be combined with --raw, --unmanaged, --test-coverage, or --lock.', '--patches');
+    }
+}
+/** The status body proper. The machine-mode lifecycle lives in {@link statusCommand}. */
+async function runStatusCommandBody(projectRoot, options) {
+    assertStatusFlagCombination(options);
     // --check / --fail-on enforcement policy. Applies only
     // where classification runs (the default view and --json).
     const checkPolicy = resolveStatusCheckPolicy(options);
@@ -253,6 +290,7 @@ async function runStatusCommandBody(projectRoot, options) {
     }
     const paths = getProjectPaths(projectRoot);
     const config = await loadConfig(projectRoot);
+    const scope = await resolveStatusScope(paths.patches, options.patches);
     // Shared envelope: see src/utils/machine-output.ts and
     // docs/machine-output.md. `status` was the only command that had one.
     // Ownership mode is a flat file→patch table. Sources are the manifest's
@@ -265,13 +303,12 @@ async function runStatusCommandBody(projectRoot, options) {
         // Rung 1 only. See the note below on why this branch does not take the
         // full assertEngineGitReady ladder.
         await assertEngineExists(paths.engine);
-        const manifest = await loadPatchesManifest(paths.patches);
         // The same scan and the same classification pass as every other mode.
         // This branch keeps its historical guard shape on purpose:
         // no baseline-commit assertion, and a non-git engine degrades to an
         // empty table rather than the recovery banner.
         const rawFilesOwnership = await scanEngineStatusFiles(paths.engine, false);
-        const rows = await collectOwnershipRows(paths.patches, manifest?.patches ?? [], rawFilesOwnership, await classifyStatusFiles(rawFilesOwnership, paths, projectRoot, config.binaryName));
+        const rows = await collectScopedOwnershipRows(paths.patches, rawFilesOwnership, await classifyStatusFiles(rawFilesOwnership, paths, projectRoot, config.binaryName), scope);
         renderOwnershipTable(rows);
         const { managed, unmanaged, conflicts } = summarizeOwnership(rows);
         const parts = [`${managed} managed`];
@@ -313,7 +350,7 @@ async function runStatusCommandBody(projectRoot, options) {
     // `[]` here and return before the human fallback.
     if (options.json) {
         const classified = await classifyStatusFiles(files, paths, projectRoot, config.binaryName);
-        await renderJsonMode(classified, files, paths, options, checkPolicy);
+        await renderJsonMode(classified, files, paths, options, checkPolicy, scope);
         return;
     }
     // `--raw` consumers parse the native `git status --porcelain` output
@@ -326,6 +363,7 @@ async function runStatusCommandBody(projectRoot, options) {
     if (files.length === 0) {
         info('No modified files');
         outro('Working tree clean');
+        await runHumanStatusCheck([], files, paths, checkPolicy, scope);
         return;
     }
     // Raw mode: existing behavior
@@ -333,8 +371,10 @@ async function runStatusCommandBody(projectRoot, options) {
         renderRawStatus(files);
         return;
     }
-    // Patch-aware classification
-    const classified = await classifyStatusFiles(files, paths, projectRoot, config.binaryName);
+    // Patch-aware classification. The full scan is classified (claims need
+    // every file) and the buckets show only what the scope covers.
+    const allClassified = await classifyStatusFiles(files, paths, projectRoot, config.binaryName);
+    const classified = scopeClassified(allClassified, scope);
     const buckets = {
         conflict: classified.filter((f) => f.classification === 'conflict'),
         unmanaged: classified.filter((f) => f.classification === 'unmanaged'),
@@ -349,8 +389,8 @@ async function runStatusCommandBody(projectRoot, options) {
         await renderUnmanagedOnly(buckets.unmanaged, files.length, projectRoot, config.binaryName);
         return;
     }
-    await renderDefaultStatus(files.length, buckets, projectRoot, config.binaryName);
-    runStatusCheck(classified, checkPolicy);
+    await renderDefaultStatus(scope ? classified.length : files.length, buckets, projectRoot, config.binaryName);
+    await runHumanStatusCheck(allClassified, files, paths, checkPolicy, scope);
 }
 /** Registers the status command on the CLI program. */
 export function registerStatus(program, { getProjectRoot, withErrorHandling }) {
@@ -366,7 +406,10 @@ export function registerStatus(program, { getProjectRoot, withErrorHandling }) {
         .option('--summary', 'With --json: emit only summary counts (plus offending files when --check/--fail-on is active), omitting the per-file files[] payload')
         .option('--include-ownership', 'With --json (composes with --summary): append an ownership block (path->owning-patch rows plus managed/unmanaged/conflict counts) to the payload, so one scan serves the classification, ownership, and check views. Does not change exit semantics.')
         .option('--check', 'Exit non-zero when any unmanaged, patch-owned-drift, or conflict file exists (composes with --json; combine with --fail-on for finer policy)')
-        .option('--fail-on <classifications>', 'Comma-separated classification list that fails --check, replacing the default set (implies --check). Valid: patch-backed, patch-owned-drift, unmanaged, branding, furnace, conflict, binary-unsupported')
+        .option('--fail-on <classifications>', 'Comma-separated classification list that fails --check, replacing the default set (implies --check). Valid: patch-backed, patch-owned-drift, unmanaged, branding, furnace, conflict, binary-unsupported, ownership-conflict (a path claimed by more than one patch)')
+        .option('--allow <classifications>', 'Comma-separated classification list that never fails --check, removed from the fail set (implies --check; same values as --fail-on)')
+        .option('--fail-on-unknown', 'With --allow: also fail on every present classification that neither --fail-on nor --allow names, so a classification added in a later FireForge fails closed (implies --check)')
+        .option('--patches <names...>', 'Judge only the named patches: keeps the files each owns or claims and the ownership rows naming it (filename, stem, order number, manifest name, or slug; repeat or comma-separate). Unmanaged files belong to no patch and drop out. Default view, --json and --ownership only')
         .action(withErrorHandling(async (options) => {
         await statusCommand(getProjectRoot(), options);
     }));

package/dist/src/commands/test-browser-preflight.js

@@ -1,9 +1,10 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { join } from 'node:path';
 import { reportOrphanedHarnessProcesses } from '../core/harness-orphans.js';
-import { assertMarionettePortAvailable, ensureLaunchableBrowserNotRunning, ensureMarionettePortAvailable, extractForwardedMarionettePort, forwardedMachArgsIncludeMarionetteClient, shouldAutoForwardMarionettePortToMach, } from '../core/marionette-port.js';
+import { deferBusyPortToHarness, resolveAutoPorts } from '../core/harness-port-fallback.js';
+import { assertMarionettePortAvailable, DEFAULT_MARIONETTE_PORT, ensureLaunchableBrowserNotRunning, ensureMarionettePortAvailable, extractForwardedMarionettePort, forwardedMachArgsIncludeMarionetteClient, shouldAutoForwardMarionettePortToMach, } from '../core/marionette-port.js';
 import { formatMarionettePreflightLine, reportMarionettePreflight, runMarionettePreflight, } from '../core/marionette-preflight.js';
-import { ensureMochitestServerPortAvailable } from '../core/mochitest-server-port.js';
+import { DEFAULT_MOCHITEST_SERVER_PORT, ensureMochitestServerPortAvailable, } from '../core/mochitest-server-port.js';
 import { waitForPreflight } from '../core/preflight-wait.js';
 import { GeneralError } from '../errors/base.js';
 import { info, outro, verbose } from '../utils/logger.js';
@@ -153,7 +154,15 @@ export async function ensureTestBrowserEnvironment(engineDir, launchablePath, xp
     // browser connect to a server that cannot serve this run's manifest,
     // which surfaces as a 370s "Ran 0 checks" stall naming nothing. xpcshell
     // does not use the httpd, so an xpcshell-only run is never blocked by it.
-    if (!xpcshellOnly) {
+    // Auto ports (opt-in) step aside for a peer's listener and let the
+    // harness's own busy-port fallback move this run; see
+    // src/core/harness-port-fallback.ts.
+    const autoPorts = xpcshellOnly
+        ? undefined
+        : await resolveAutoPorts(engineDir, options, projectConfig);
+    if (!xpcshellOnly &&
+        !(autoPorts?.serverPorts === true &&
+            (await deferBusyPortToHarness(DEFAULT_MOCHITEST_SERVER_PORT, 'Mochitest server', engineDir)))) {
         await waitForPreflight(() => ensureMochitestServerPortAvailable(undefined, {
             engineDir,
             killStaleServer: options.killStaleMarionette === true,
@@ -173,6 +182,13 @@ export async function ensureTestBrowserEnvironment(engineDir, launchablePath, xp
         ? extractForwardedMarionettePort(options.machArg)
         : undefined;
     const effectivePort = options.marionettePort ?? forwardedPort;
+    // Never under --doctor: its handshake launches a browser on this port
+    // itself and would talk to the peer's browser instead.
+    if (autoPorts?.marionettePort === true &&
+        options.doctor !== true &&
+        (await deferBusyPortToHarness(effectivePort ?? DEFAULT_MARIONETTE_PORT, 'Marionette', engineDir))) {
+        return { forwardedPort, effectivePort };
+    }
     await waitForPreflight(() => ensureTestMarionettePortAvailable(effectivePort, projectConfig.binaryName, options, {
         xpcshellOnly,
         doctor: options.doctor === true,

package/dist/src/commands/test-build-furnace.d.ts

@@ -0,0 +1,21 @@
+/**
+ * What a pre-test build did with Furnace components. `prepareBuildEnvironment`
+ * runs `furnace apply` over the whole `components/` tree, so a
+ * `fireforge test --build` meant to capture the committed behaviour could
+ * silently ship component edits nobody had deployed yet (another session's
+ * included), and nothing in the test output said so. The applied names now
+ * ride the verdict line, and `--no-furnace-apply` packages `engine/` as it
+ * stands, naming the undeployed edits it left out.
+ */
+import type { BuildPreparation } from '../core/build-prepare.js';
+/**
+ * Reports the pre-test build's Furnace step: the components it deployed
+ * (notice plus `furnace-applied=<names>` on the verdict line), or, when the
+ * apply was skipped, the components whose undeployed edits this build
+ * leaves out (`furnace-apply=skipped`).
+ *
+ * @param projectRoot - Root directory of the project
+ * @param preparation - Result of `prepareBuildEnvironment`
+ * @param skipped - True under `--no-furnace-apply`
+ */
+export declare function reportPreTestFurnace(projectRoot: string, preparation: BuildPreparation, skipped: boolean): Promise<void>;

package/dist/src/commands/test-build-furnace.js

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: EUPL-1.2
+/**
+ * What a pre-test build did with Furnace components. `prepareBuildEnvironment`
+ * runs `furnace apply` over the whole `components/` tree, so a
+ * `fireforge test --build` meant to capture the committed behaviour could
+ * silently ship component edits nobody had deployed yet (another session's
+ * included), and nothing in the test output said so. The applied names now
+ * ride the verdict line, and `--no-furnace-apply` packages `engine/` as it
+ * stands, naming the undeployed edits it left out.
+ */
+import { listStaleFurnaceComponents } from '../core/furnace-staleness.js';
+import { toError } from '../utils/errors.js';
+import { notice, verbose } from '../utils/logger.js';
+import { setVerdictRunAttribute } from './test-verdict.js';
+/**
+ * Reports the pre-test build's Furnace step: the components it deployed
+ * (notice plus `furnace-applied=<names>` on the verdict line), or, when the
+ * apply was skipped, the components whose undeployed edits this build
+ * leaves out (`furnace-apply=skipped`).
+ *
+ * @param projectRoot - Root directory of the project
+ * @param preparation - Result of `prepareBuildEnvironment`
+ * @param skipped - True under `--no-furnace-apply`
+ */
+export async function reportPreTestFurnace(projectRoot, preparation, skipped) {
+    if (skipped) {
+        setVerdictRunAttribute('furnace-apply', 'skipped');
+        let pending = [];
+        try {
+            pending = await listStaleFurnaceComponents(projectRoot);
+        }
+        catch (error) {
+            verbose(`Furnace pending-edit probe failed: ${toError(error).message}`);
+        }
+        notice(pending.length > 0
+            ? `Furnace apply skipped (--no-furnace-apply): engine/ is packaged as it stands. ${pending.length} component(s) with undeployed components/ edits are NOT in this build: ${pending.join(', ')}.`
+            : 'Furnace apply skipped (--no-furnace-apply): engine/ is packaged as it stands.');
+        return;
+    }
+    const applied = preparation.furnaceAppliedNames ?? [];
+    if (applied.length === 0)
+        return;
+    setVerdictRunAttribute('furnace-applied', applied.join(','));
+    notice(`This pre-test build deployed ${applied.length} Furnace component(s) whose components/ source ` +
+        `changed since their last deploy: ${applied.join(', ')}. Those edits (another session's ` +
+        'undeployed edits included) are in the runtime under test. Pass --no-furnace-apply to ' +
+        'package engine/ as it stands, for example for a before-capture.');
+}

package/dist/src/commands/test-build-phase.js

@@ -6,7 +6,7 @@
  */
 import { readBuildBaseline, writeBuildBaseline } from '../core/build-baseline.js';
 import { prepareBuildEnvironment } from '../core/build-prepare.js';
-import { checkExtendCoverageAnchor, checkExtendMozconfigAnchor, formatExtendCoverageRefusal, unionTestPackagingCoverage, } from '../core/coverage-extend.js';
+import { applyMozconfigAnchor, formatCoverageRetentionNotice, formatExtendCoverageRefusal, planCoverageRetention, recordScopedCoverage, } from '../core/coverage-extend.js';
 import { hasBuildArtifacts } from '../core/mach.js';
 import { runProtectedMachBuild, withBuildLock } from '../core/mach.js';
 import { assertHealthyPartialConfig, pruneDanglingTestLinks } from '../core/objdir-maintenance.js';
@@ -15,7 +15,7 @@ import { GeneralError, InvalidArgumentError } from '../errors/base.js';
 import { BuildError } from '../errors/build.js';
 import { toError } from '../utils/errors.js';
 import { info, notice, spinner, verbose } from '../utils/logger.js';
-import { checkRequestedTestTypes } from './test-checkjs.js';
+import { reportPreTestFurnace } from './test-build-furnace.js';
 import { reportBuildOnlyCompletion } from './test-modes.js';
 import { enforceStaleBuildGate, enforceStaticComponentsGate } from './test-stale-gate.js';
 import { emitPassVerdict } from './test-verdict.js';
@@ -26,7 +26,7 @@ import { emitPassVerdict } from './test-verdict.js';
  * @param options - See {@link RunPreTestBuildOptions}
  */
 async function runPreTestBuild(options) {
-    const { projectRoot, paths, projectConfig, harnessRetries, testPackagingCoverage, refuseUnexportedDrift, extend, } = options;
+    const { projectRoot, paths, projectConfig, harnessRetries, testPackagingCoverage, refuseUnexportedDrift, extend, skipFurnaceApply, } = options;
     await withBuildLock(projectRoot, async () => {
         // Pass the previous baseline exactly like `fireforge build` does, so
         // auto-configure runs under the same conditions on both paths. The
@@ -41,32 +41,28 @@ async function runPreTestBuild(options) {
             if (pruned > 0)
                 notice(`Pruned ${pruned} dangling _tests symlink(s).`);
         }
-        await checkRequestedTestTypes(paths, projectConfig, testPackagingCoverage === 'full' ? [] : testPackagingCoverage);
+        // The named-file checkJs pass runs before the engine lock is even
+        // requested (test-prelock.ts), so a type error refuses without a wait.
         const preparation = await prepareBuildEnvironment(projectRoot, paths, projectConfig, {
             previousBaseline,
             refuseUnexportedDrift,
+            skipFurnaceApply,
         });
-        // The mozconfig half of the --extend-coverage anchor can
-        // only be checked once prepareBuildEnvironment has regenerated
-        // engine/mozconfig (the file this build will configure with), and must
-        // still be checked before mach, so a refusal costs no build.
-        let retainCoverage = false;
-        if (testPackagingCoverage !== 'full' && previousBaseline) {
-            const anchor = await checkExtendCoverageAnchor(paths.engine, previousBaseline, testPackagingCoverage);
-            const mozconfigAnchor = await checkExtendMozconfigAnchor(paths.engine, previousBaseline);
-            retainCoverage =
-                anchor.ok && mozconfigAnchor.ok && previousBaseline.testInputFingerprints !== undefined;
-            if (extend !== undefined && (!anchor.ok || !mozconfigAnchor.ok)) {
-                throw new GeneralError(formatExtendCoverageRefusal(!anchor.ok ? anchor : mozconfigAnchor));
-            }
-            if (!retainCoverage) {
-                const old = previousBaseline.testPackagingCoverage;
-                const dropped = old === undefined || old === 'full'
-                    ? ['full coverage outside this scope']
-                    : old.filter((file) => !testPackagingCoverage.includes(file));
-                if (dropped.length)
-                    notice(`Scoped build drops previous packaging coverage: ${dropped.join(', ')}. Earlier staging inputs changed or have no complete fingerprint anchor; rebuild those paths together to retain them.`);
+        await reportPreTestFurnace(projectRoot, preparation, skipFurnaceApply);
+        // Which earlier claims this scoped build keeps, per staged path. The
+        // mozconfig half can only be checked once prepareBuildEnvironment has
+        // regenerated engine/mozconfig (the file this build will configure
+        // with), and must still be checked before mach, so a refusal costs no
+        // build.
+        let plan;
+        if (testPackagingCoverage !== 'full') {
+            plan = await applyMozconfigAnchor(paths.engine, await planCoverageRetention(paths.engine, previousBaseline, testPackagingCoverage));
+            if (extend !== undefined && plan.dropped.length > 0) {
+                throw new GeneralError(formatExtendCoverageRefusal(plan.dropped));
             }
+            const retentionNotice = formatCoverageRetentionNotice(plan);
+            if (retentionNotice !== undefined)
+                notice(retentionNotice);
         }
         const buildKind = preparation.fullBuildRequired ? 'full' : 'faster';
         if (preparation.fullBuildRequired) {
@@ -103,24 +99,24 @@ async function runPreTestBuild(options) {
             // carries the static-components anchor forward, since `mach build
             // faster` does not rebake components.conf into the compiled table.
             try {
-                // Under --extend-coverage the claim is the union of the previous
-                // record and this build's paths, and the static-components anchor
-                // is always carried forward: that union can evaluate to 'full'
-                // while the build behind it was a scoped `mach build faster` that
+                // A scoped claim records this build's paths plus every earlier path
+                // the plan kept, each with its own staging-input anchor. When it
+                // kept anything the static-components anchor is carried forward
+                // explicitly: a kept full claim is still a `mach build faster` that
                 // did not rebake the compiled table.
-                const recordedCoverage = retainCoverage
-                    ? unionTestPackagingCoverage(previousBaseline?.testPackagingCoverage, testPackagingCoverage === 'full' ? [] : testPackagingCoverage)
-                    : testPackagingCoverage;
+                const recorded = plan === undefined || testPackagingCoverage === 'full'
+                    ? { testPackagingCoverage }
+                    : await recordScopedCoverage(paths.engine, plan, testPackagingCoverage);
                 await writeBuildBaseline({
                     projectRoot,
                     engineDir: paths.engine,
                     binaryName: projectConfig.binaryName,
-                    testPackagingCoverage: recordedCoverage,
+                    ...recorded,
                     previousBaseline,
                     recordedBy: describeBuildInvocation(extend !== undefined, testPackagingCoverage),
                     staticComponentsHandling: preparation.fullBuildRequired
                         ? 'refresh'
-                        : retainCoverage
+                        : plan !== undefined && (plan.keepFull || Object.keys(plan.retained).length > 0)
                             ? 'carry-forward'
                             : 'auto',
                     buildKind,
@@ -138,15 +134,15 @@ async function runPreTestBuild(options) {
     });
 }
 /**
- * `--extend-coverage` only means something for a scoped build: it unions
- * this build's paths onto the recorded claim. Without `--build`/
+ * `--extend-coverage` only means something for a scoped build: it refuses
+ * a build that would drop an earlier claim. Without `--build`/
  * `--build-only` there is no build to extend from, and a path-less build
  * records `'full'`, which already covers everything. Refusing both is more
  * honest than silently ignoring the flag.
  */
 function assertExtendCoverageUsage(options, normalizedPaths) {
     if (options.build !== true && options.buildOnly !== true) {
-        throw new InvalidArgumentError('--extend-coverage requires --build or --build-only: it unions the paths a build packages onto the recorded coverage claim.', '--extend-coverage');
+        throw new InvalidArgumentError('--extend-coverage requires --build or --build-only: it guards the coverage claim a build records.', '--extend-coverage');
     }
     if (normalizedPaths.length === 0) {
         throw new InvalidArgumentError('--extend-coverage requires explicit test paths: a path-less build records full coverage, which already covers every path.', '--extend-coverage');
@@ -165,6 +161,14 @@ function assertRefuseUnexportedDriftUsage(options) {
         return;
     throw new InvalidArgumentError('--refuse-unexported-drift requires --build or --build-only: it guards the pre-test build, and this run dispatches none.', '--refuse-unexported-drift');
 }
+/** Refuses `--no-furnace-apply` on a run that dispatches no build, for the same reason. */
+function assertNoFurnaceApplyUsage(options) {
+    if (options.furnaceApply !== false)
+        return;
+    if (options.build === true || options.buildOnly === true)
+        return;
+    throw new InvalidArgumentError("--no-furnace-apply requires --build or --build-only: it skips the pre-test build's Furnace apply, and this run dispatches no build.", '--no-furnace-apply');
+}
 /** Renders the `recordedBy` invocation string surfaced by `status --test-coverage`. */
 function describeBuildInvocation(extending, coverage) {
     const extendFlag = extending ? ' --extend-coverage' : '';
@@ -186,6 +190,7 @@ export async function runTestBuildPhase(projectRoot, paths, projectConfig, harne
         assertExtendCoverageUsage(options, normalizedPaths);
     }
     assertRefuseUnexportedDriftUsage(options);
+    assertNoFurnaceApplyUsage(options);
     if (options.build || options.buildOnly) {
         // A path-less `test --build` runs (and packages for) the full suite.
         // A scoped invocation only vouches for the requested paths. A scoped
@@ -197,11 +202,11 @@ export async function runTestBuildPhase(projectRoot, paths, projectConfig, harne
             const previousBaseline = await readBuildBaseline(projectRoot);
             await enforceStaticComponentsGate(paths.engine, previousBaseline, options);
             if (extending) {
-                // Head/fingerprint half of the anchor, before the build lock: a
-                // refusal here costs neither build time nor the lock.
-                const anchor = await checkExtendCoverageAnchor(paths.engine, previousBaseline, normalizedPaths);
-                if (!anchor.ok) {
-                    throw new GeneralError(formatExtendCoverageRefusal(anchor));
+                // Staging-input half of the plan, before the build lock: a refusal
+                // here costs neither build time nor the lock.
+                const plan = await planCoverageRetention(paths.engine, previousBaseline, normalizedPaths);
+                if (plan.dropped.length > 0) {
+                    throw new GeneralError(formatExtendCoverageRefusal(plan.dropped));
                 }
             }
         }
@@ -213,6 +218,7 @@ export async function runTestBuildPhase(projectRoot, paths, projectConfig, harne
             testPackagingCoverage: coverage,
             refuseUnexportedDrift: options.refuseUnexportedDrift === true,
             extend: extending ? { requestedPaths: normalizedPaths } : undefined,
+            skipFurnaceApply: options.furnaceApply === false,
         });
         info('');
         if (options.buildOnly) {

package/dist/src/commands/test-checkjs.js

@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: EUPL-1.2
+import { findUnownedSupportHeads, formatUnownedSupportHeadNotice, } from '../core/checkjs-support-heads.js';
 import { runCheckJsTestFilesGrouped } from '../core/patch-lint-checkjs.js';
 import { isTestScriptFile } from '../core/patch-lint-ownership.js';
 import { loadPatchesManifest } from '../core/patch-manifest.js';
@@ -17,6 +18,12 @@ export async function checkRequestedTestTypes(paths, config, requested) {
     const selected = new Set(scopes.flatMap((scope) => scope.dispatchPaths.filter(isTestScriptFile)));
     for (const file of selected)
         owned.add(file);
+    // A support head a named test brings into scope joins the pass even
+    // before any patch owns it, or every name it declares reads as undefined.
+    for (const head of await findUnownedSupportHeads(paths.engine, selected, owned)) {
+        owned.add(head.file);
+        notice(`Pre-build checkJs: ${formatUnownedSupportHeadNotice(head)}`);
+    }
     const result = await runCheckJsTestFilesGrouped(paths.engine, owned, config.patchLint, paths.root, selected);
     const issues = [...result.global, ...[...result.byFile.values()].flat()];
     for (const issue of issues)

package/dist/src/commands/test-diagnose.js

@@ -11,6 +11,7 @@ import { getActiveRunLogPath } from '../core/run-log.js';
 import { describeChangedPrefNoise } from '../core/test-changed-prefs.js';
 import { buildGreenSummaryRejectedMessage, buildHarnessCrashMessage, buildNoTestsRanMessage, buildSilentSegfaultMessage, headedNoOutputTimeoutHint, isSilentSegfault, } from '../core/test-harness-crash.js';
 import { buildHarnessEarlyExitMessage, classifyHarnessEarlyExit, completePostRebuildFailureContext, prependPostRebuildFailureContext, } from '../core/test-harness-output.js';
+import { buildIncompleteRunMessage } from '../core/test-run-completeness.js';
 import { GeneralError } from '../errors/base.js';
 import { TestFailureError } from '../errors/build.js';
 import { toError } from '../utils/errors.js';
@@ -249,6 +250,9 @@ function applySingleRunOutcome(outcome, normalizedPaths, binaryName, postRebuild
         }
         return;
     }
+    if (outcome.verdict.incomplete !== undefined) {
+        throw new TestFailureError(buildIncompleteRunMessage(outcome.verdict.incomplete), 'mach test', formatFailureBlocks(outcome.verdict.realFailureBlocks), getActiveRunLogPath());
+    }
     if (outcome.verdict.kind === 'no-tests' && outcome.result.exitCode === 0) {
         // The silent false green: exit 0 plus a "Passed: 0"-style summary with
         // zero TEST-START lines must fail rather than pass.
@@ -282,6 +286,9 @@ export function diagnoseShardOutcome(outcome, path, binaryName, postRebuildConte
     if (outcome.verdict.kind === 'no-tests' && outcome.result.exitCode === 0) {
         return buildNoTestsRanMessage(0, [path]);
     }
+    if (outcome.verdict.incomplete !== undefined) {
+        return buildIncompleteRunMessage(outcome.verdict.incomplete);
+    }
     if (outcome.verdict.greenSummaryRejected) {
         return buildGreenSummaryRejectedMessage(outcome.verdict.greenSummaryRejected, outcome.result.exitCode);
     }

package/dist/src/commands/test-modes.d.ts

@@ -1,6 +1,6 @@
 import type { TestOptions } from '../types/commands/index.js';
 import type { FireForgeConfig } from '../types/config.js';
-import type { TestRunOutcome } from './test-run.js';
+import type { TestRunOutcome, TestSuite } from './test-run.js';
 /** Rejects pathless `fireforge test` unless the operator selected a pathless mode. */
 export declare function assertPathlessTestMode(testPaths: readonly string[], options: TestOptions): void;
 /** Rejects invalid combinations for mode-like `fireforge test` options. */
@@ -16,6 +16,8 @@ export interface HarnessClassification {
     xpcshell: string[];
     nonXpcshell: string[];
 }
+/** Buckets normalized request paths by the harness their nearest manifest selects. */
+export declare function classifyTestHarnesses(engineDir: string, normalizedPaths: readonly string[]): Promise<HarnessClassification>;
 /**
  * Harness classification is a pure path→manifest lookup and must precede
  * the build dispatch: a mixed xpcshell+mochitest request can never
@@ -40,3 +42,16 @@ export declare function classifyBeforeDispatch(engineDir: string, normalizedPath
  * run build-less without tripping the stale/coverage gate.
  */
 export declare function reportBuildOnlyCompletion(classification: HarnessClassification, normalizedPaths: readonly string[]): void;
+/**
+ * The mach args `--restart-between-tests` forwards: mochitest's own flag,
+ * which restarts the browser between test files (the run shape a
+ * `standalone` manifest key asks for). Mochitest-only, refused otherwise
+ * for the reason `--shuffle` is: xpcshell has no such flag and generic
+ * `mach test` would hand it to every suite. Not duplicated when
+ * `--mach-arg` already forwards it.
+ *
+ * @param options - Parsed test options
+ * @param suite - The resolved dispatch target
+ * @param forwardedMachArgs - `--mach-arg` values after filtering
+ */
+export declare function restartBetweenTestsArgs(options: TestOptions, suite: TestSuite, forwardedMachArgs: readonly string[]): string[];

package/dist/src/commands/test-modes.js

@@ -72,7 +72,8 @@ function buildPathlessTestMessage() {
         '  - `fireforge test --doctor` to run the Marionette preflight only\n' +
         '  - `fireforge test --canary` to run the configured short harness canary');
 }
-async function classifyTestHarnesses(engineDir, normalizedPaths) {
+/** Buckets normalized request paths by the harness their nearest manifest selects. */
+export async function classifyTestHarnesses(engineDir, normalizedPaths) {
     const result = { xpcshell: [], nonXpcshell: [] };
     for (const testPath of normalizedPaths) {
         const manifest = await findNearestXpcshellManifest(engineDir, testPath);
@@ -133,3 +134,25 @@ export function reportBuildOnlyCompletion(classification, normalizedPaths) {
         info(`Run: fireforge test ${normalizedPaths.join(' ')}`);
     }
 }
+/**
+ * The mach args `--restart-between-tests` forwards: mochitest's own flag,
+ * which restarts the browser between test files (the run shape a
+ * `standalone` manifest key asks for). Mochitest-only, refused otherwise
+ * for the reason `--shuffle` is: xpcshell has no such flag and generic
+ * `mach test` would hand it to every suite. Not duplicated when
+ * `--mach-arg` already forwards it.
+ *
+ * @param options - Parsed test options
+ * @param suite - The resolved dispatch target
+ * @param forwardedMachArgs - `--mach-arg` values after filtering
+ */
+export function restartBetweenTestsArgs(options, suite, forwardedMachArgs) {
+    if (options.restartBetweenTests !== true)
+        return [];
+    if (suite !== 'mochitest') {
+        throw new GeneralError("--restart-between-tests forwards the mochitest harness's per-file browser restart; the " +
+            'xpcshell harness has none, and generic `mach test` dispatch would hand it to every ' +
+            'suite. Narrow the paths to browser-chrome/mochitest files (and drop --generic-mach-test).');
+    }
+    return forwardedMachArgs.includes('--restart-between-tests') ? [] : ['--restart-between-tests'];
+}