@hominis/fireforge 0.49.2 → 0.50.0

package/dist/src/commands/verify.js

@@ -25,12 +25,14 @@ import { findUnresolvedSystemModuleImports, formatUnresolvedSystemModuleImports,
 import { buildPatchQueueContext, formatPatchLintIssue, lintPatchQueue, } from '../core/patch-lint.js';
 import { loadPatchesManifest, validatePatchesManifestConsistency } from '../core/patch-manifest.js';
 import { evaluatePatchPolicy } from '../core/patch-policy.js';
+import { evaluatePatchPolicyContentForQueue } from '../core/patch-policy-content.js';
 import { collectPatchRegistrationReferences } from '../core/patch-registration-refs.js';
 import { buildPatchClaims } from '../core/status-classify.js';
 import { classifyFiles } from '../core/status-classify.js';
 import { GeneralError } from '../errors/base.js';
 import { pathExists, readText } from '../utils/fs.js';
 import { info, intro, outro, success, warn } from '../utils/logger.js';
+import { anyPatchInScope, isFilenameInScope, resolveVerifyScope, scopeLintIssues, scopePatches, } from './verify-scope.js';
 /**
  * Walks each patch body in the manifest, extracts the set of
  * component-shaped registration references it adds (widget paths
@@ -41,7 +43,7 @@ import { info, intro, outro, success, warn } from '../utils/logger.js';
  * registers a file that nothing in the world supplies, which fails at
  * install time.
  */
-async function detectDanglingRegistrations(patchesDir, engineDir, patches) {
+async function detectDanglingRegistrations(patchesDir, engineDir, patches, scope) {
     // Aggregate the set of all paths any patch in the queue is responsible for
     // (per `filesAffected`). Individual patch bodies are deliberately not
     // parsed for new-file creations here: `filesAffected` is already the
@@ -54,8 +56,9 @@ async function detectDanglingRegistrations(patchesDir, engineDir, patches) {
             coveredByPatches.add(file);
         }
     }
+    // Every patch supplies targets; only the scoped ones are judged.
     const issues = [];
-    for (const patch of patches) {
+    for (const patch of scopePatches(patches, scope)) {
         const patchPath = join(patchesDir, patch.filename);
         if (!(await pathExists(patchPath)))
             continue;
@@ -100,7 +103,7 @@ function detectCrossPatchFileClaims(manifestPatches) {
     }
     return results;
 }
-async function detectWorktreeOwnershipDrift(projectRoot, engineDir, patchesDir, binaryName) {
+async function detectWorktreeOwnershipDrift(projectRoot, engineDir, patchesDir, binaryName, scope) {
     if (!(await pathExists(engineDir)) || !(await isGitRepository(engineDir))) {
         return { unowned: [], patchOwnedDrift: [] };
     }
@@ -108,24 +111,51 @@ async function detectWorktreeOwnershipDrift(projectRoot, engineDir, patchesDir,
     const furnacePrefixes = await collectFurnaceManagedPrefixes(projectRoot);
     const classified = await classifyFiles(entries, engineDir, patchesDir, binaryName, furnacePrefixes);
     return {
+        // An unowned change belongs to no patch, so no --patches scope covers it.
         unowned: [
             ...new Set(classified
-                .filter((entry) => entry.classification === 'unmanaged')
+                .filter((entry) => scope === undefined && entry.classification === 'unmanaged')
                 .map((entry) => entry.file)),
         ].sort(),
         patchOwnedDrift: [
             ...new Set(classified
-                .filter((entry) => entry.classification === 'patch-owned-drift')
+                .filter((entry) => entry.classification === 'patch-owned-drift' &&
+                anyPatchInScope(scope, entry.owner === undefined ? [] : [entry.owner]))
                 .map((entry) => entry.file)),
         ].sort(),
     };
 }
+/** The warning groups for unowned changes and patch-owned drift. */
+function buildWorktreeDriftGroups(drift) {
+    const groups = [];
+    if (drift.unowned.length > 0) {
+        groups.push({
+            title: `Unowned worktree changes (${drift.unowned.length})`,
+            issues: drift.unowned.map((file) => `${file} is changed in engine/ but is not listed in any patch filesAffected entry`),
+            errorCount: 0,
+            warningCount: drift.unowned.length,
+        });
+    }
+    if (drift.patchOwnedDrift.length > 0) {
+        groups.push({
+            title: `Patch-owned worktree drift (${drift.patchOwnedDrift.length})`,
+            issues: drift.patchOwnedDrift.map((file) => `${file} is claimed by exactly one patch, but engine/ no longer matches that patch output`),
+            errorCount: 0,
+            warningCount: drift.patchOwnedDrift.length,
+        });
+    }
+    return groups;
+}
 /**
  * Collects the same queue-health findings reported by `fireforge verify`
  * without printing. Used by doctor recovery paths that need a read-only
  * "is this queue healthy?" decision before clearing stale state.
+ *
+ * @param projectRoot - Project root directory
+ * @param scope - `verify --patches`: keep only the findings that name these
+ *   patches (see verify-scope.ts). Omitted, every finding counts.
  */
-export async function collectPatchQueueHealth(projectRoot) {
+export async function collectPatchQueueHealth(projectRoot, scope) {
     const paths = getProjectPaths(projectRoot);
     const config = await loadConfig(projectRoot);
     if (!(await pathExists(paths.patches))) {
@@ -139,7 +169,7 @@ export async function collectPatchQueueHealth(projectRoot) {
     const groups = [];
     let errorCount = 0;
     let warningCount = 0;
-    const consistencyIssues = await validatePatchesManifestConsistency(paths.patches);
+    const consistencyIssues = (await validatePatchesManifestConsistency(paths.patches)).filter((issue) => isFilenameInScope(scope, issue.filename));
     if (consistencyIssues.length > 0) {
         const issues = consistencyIssues.map((issue) => `[${issue.code}] ${issue.message}`);
         groups.push({
@@ -152,7 +182,10 @@ export async function collectPatchQueueHealth(projectRoot) {
     }
     const manifest = await loadPatchesManifest(paths.patches);
     if (manifest) {
-        const policyIssues = evaluatePatchPolicy(config, manifest);
+        const policyIssues = [
+            ...evaluatePatchPolicy(config, manifest),
+            ...(await evaluatePatchPolicyContentForQueue(config, projectRoot, paths.patches, manifest)),
+        ].filter((issue) => isFilenameInScope(scope, issue.filename));
         if (policyIssues.length > 0) {
             const policyErrors = policyIssues.filter((issue) => issue.severity === 'error').length;
             const policyWarnings = policyIssues.length - policyErrors;
@@ -174,7 +207,7 @@ export async function collectPatchQueueHealth(projectRoot) {
         // to an existing module is named as text instead of surfacing later as a
         // bare `xpcshell return code: -11` with zero output.
         if (await pathExists(paths.engine)) {
-            const unresolved = await findUnresolvedSystemModuleImports(paths.engine, manifest.patches.flatMap((patch) => patch.filesAffected));
+            const unresolved = await findUnresolvedSystemModuleImports(paths.engine, scopePatches(manifest.patches, scope).flatMap((patch) => patch.filesAffected));
             if (unresolved.length > 0) {
                 groups.push({
                     title: `Unresolvable system-module imports (${unresolved.length})`,
@@ -185,7 +218,7 @@ export async function collectPatchQueueHealth(projectRoot) {
                 errorCount += unresolved.length;
             }
         }
-        const crossClaims = detectCrossPatchFileClaims(manifest.patches);
+        const crossClaims = detectCrossPatchFileClaims(manifest.patches).filter((claim) => anyPatchInScope(scope, claim.filenames));
         if (crossClaims.length > 0) {
             groups.push({
                 title: `Cross-patch filesAffected conflicts (${crossClaims.length})`,
@@ -197,7 +230,7 @@ export async function collectPatchQueueHealth(projectRoot) {
         }
     }
     const ctx = await buildPatchQueueContext(paths.patches);
-    const lintIssues = lintPatchQueue(ctx);
+    const lintIssues = scopeLintIssues(lintPatchQueue(ctx), scope);
     if (lintIssues.length > 0) {
         const lintErrors = lintIssues.filter((issue) => issue.severity === 'error').length;
         const lintWarnings = lintIssues.filter((issue) => issue.severity === 'warning').length;
@@ -214,26 +247,11 @@ export async function collectPatchQueueHealth(projectRoot) {
         warningCount += lintWarnings;
     }
     if (manifest) {
-        const worktreeDrift = await detectWorktreeOwnershipDrift(projectRoot, paths.engine, paths.patches, config.binaryName);
-        if (worktreeDrift.unowned.length > 0) {
-            groups.push({
-                title: `Unowned worktree changes (${worktreeDrift.unowned.length})`,
-                issues: worktreeDrift.unowned.map((file) => `${file} is changed in engine/ but is not listed in any patch filesAffected entry`),
-                errorCount: 0,
-                warningCount: worktreeDrift.unowned.length,
-            });
-            warningCount += worktreeDrift.unowned.length;
-        }
-        if (worktreeDrift.patchOwnedDrift.length > 0) {
-            groups.push({
-                title: `Patch-owned worktree drift (${worktreeDrift.patchOwnedDrift.length})`,
-                issues: worktreeDrift.patchOwnedDrift.map((file) => `${file} is claimed by exactly one patch, but engine/ no longer matches that patch output`),
-                errorCount: 0,
-                warningCount: worktreeDrift.patchOwnedDrift.length,
-            });
-            warningCount += worktreeDrift.patchOwnedDrift.length;
-        }
-        const registrationIssues = await detectDanglingRegistrations(paths.patches, paths.engine, manifest.patches);
+        const worktreeDrift = await detectWorktreeOwnershipDrift(projectRoot, paths.engine, paths.patches, config.binaryName, scope);
+        const driftGroups = buildWorktreeDriftGroups(worktreeDrift);
+        groups.push(...driftGroups);
+        warningCount += driftGroups.reduce((sum, group) => sum + group.warningCount, 0);
+        const registrationIssues = await detectDanglingRegistrations(paths.patches, paths.engine, manifest.patches, scope);
         if (registrationIssues.length > 0) {
             groups.push({
                 title: `Dangling registration references (${registrationIssues.length})`,
@@ -256,15 +274,20 @@ export async function collectPatchQueueHealth(projectRoot) {
  * Read-only. Exits non-zero on any error-severity finding.
  *
  * @param projectRoot - Project root directory
+ * @param options - `patches`: the raw `--patches` values
  */
-export async function verifyCommand(projectRoot) {
+export async function verifyCommand(projectRoot, options = {}) {
     intro('FireForge Verify');
+    const scope = await resolveVerifyScope(getProjectPaths(projectRoot).patches, options.patches);
+    if (scope !== undefined) {
+        info(`Judging only: ${[...scope.patches].join(', ')}`);
+    }
     // `verify` is read-only to the OPERATOR but not to git: the working-tree
     // status probe refreshes (and rewrites) `engine/.git/index`, making this
     // command a second writer of the primary checkout and invalidating a
     // concurrent `fireforge test`'s engine fingerprint. A private index keeps
     // every refresh off the primary checkout.
-    const health = await withPrivateGitIndex(getProjectPaths(projectRoot).engine, () => collectPatchQueueHealth(projectRoot));
+    const health = await withPrivateGitIndex(getProjectPaths(projectRoot).engine, () => collectPatchQueueHealth(projectRoot, scope));
     if (!health.hasPatchesDirectory) {
         info('No patches directory. Nothing to verify.');
         outro('Verify clean');
@@ -298,7 +321,8 @@ export function registerVerify(program, { getProjectRoot, withErrorHandling }) {
     program
         .command('verify')
         .description('Read-only fsck for the patch queue (manifest + cross-patch lint)')
-        .action(withErrorHandling(async () => {
-        await verifyCommand(getProjectRoot());
+        .option('--patches <names...>', 'Judge only findings that name these patches (filename, stem, order number, manifest name, or slug; repeat or comma-separate). Queue-wide findings stay; unowned worktree changes drop out')
+        .action(withErrorHandling(async (options) => {
+        await verifyCommand(getProjectRoot(), options);
     }));
 }

package/dist/src/core/build-baseline-types.d.ts

@@ -95,8 +95,28 @@ export interface BuildBaseline {
      * replaces coverage with a dropped-path notice, or refuses when the caller
      * required --extend-coverage. Legacy packageable-only anchors cannot retain
      * coverage because they cannot prove test scripts and fixtures unchanged.
+     *
+     * Since 0.50.0 retention is decided per staged path: see
+     * {@link BuildBaseline.testCoverageRecords} and
+     * {@link BuildBaseline.fullCoverageAnchor}.
      */
     testPackagingCoverage?: TestPackagingCoverage;
+    /**
+     * Per-path anchors of a scoped claim, keyed by the request path in
+     * {@link BuildBaseline.testPackagingCoverage}. Each record holds that
+     * path's own staging inputs and their content at the build that staged
+     * it, so a later scoped build keeps the path while those inputs are
+     * unchanged, whatever moved elsewhere in the engine. A listed path without
+     * a record falls back to the baseline-wide anchor. Absent on full claims.
+     */
+    testCoverageRecords?: Record<string, CoverageRecord>;
+    /**
+     * The anchor of the last full-coverage build, carried forward by scoped
+     * builds once something outside their scope moved. A request path outside
+     * the scoped list stays covered while its own staging inputs are unchanged
+     * against this anchor. The check runs at dispatch, per requested path.
+     */
+    fullCoverageAnchor?: CoverageAnchor;
     /**
      * Hex-encoded SHA-256 of `engine/mozconfig` as it stood for this build.
      * Recorded because the mozconfig is regenerated from project-side
@@ -141,5 +161,31 @@ export interface StaticComponentsBaseline {
      */
     fingerprints: Record<string, string>;
 }
+/**
+ * Content anchor of one packaging claim. A path's staged content is
+ * `fingerprints[path]` when recorded, otherwise its content at
+ * `engineHeadSha`.
+ */
+export interface CoverageAnchor {
+    /** Engine HEAD the staged content is relative to. */
+    engineHeadSha: string;
+    /** Hex SHA-256 of `engine/mozconfig` the claim was configured with. */
+    mozconfigHash: string;
+    /**
+     * Hex SHA-256 (or {@link DELETED_FILE_FINGERPRINT}) per engine-relative
+     * path whose staged content differs from `engineHeadSha`.
+     */
+    fingerprints: Record<string, string>;
+}
+/** Anchor of one staged request path. See {@link BuildBaseline.testCoverageRecords}. */
+export interface CoverageRecord extends CoverageAnchor {
+    /**
+     * Engine-relative paths (files or directories) whose content decides what
+     * the harness stages for the request path: its manifest directory plus
+     * whatever a manifest there names outside it. `fingerprints` is
+     * restricted to these.
+     */
+    inputs: string[];
+}
 /** Coverage claim of the packaged test runtime. See {@link BuildBaseline.testPackagingCoverage}. */
 export type TestPackagingCoverage = 'full' | string[];

package/dist/src/core/build-baseline-validate.js

@@ -18,6 +18,20 @@ function isFingerprintMap(value) {
     return (isObject(value) &&
         Object.entries(value).every(([path, fingerprint]) => isBaselinePath(path) && isFingerprint(fingerprint)));
 }
+function isCoverageAnchor(value) {
+    return (isObject(value) &&
+        typeof value['engineHeadSha'] === 'string' &&
+        isFingerprint(value['mozconfigHash']) &&
+        isFingerprintMap(value['fingerprints']));
+}
+function isCoverageRecordMap(value) {
+    return (isObject(value) &&
+        Object.entries(value).every(([path, record]) => isBaselinePath(path) &&
+            isCoverageAnchor(record) &&
+            isObject(record) &&
+            Array.isArray(record['inputs']) &&
+            record['inputs'].every(isBaselinePath)));
+}
 /** Validates persisted fields without converting malformed coverage into a full claim. */
 export function isBuildBaseline(value) {
     if (!isObject(value))
@@ -45,6 +59,11 @@ export function isBuildBaseline(value) {
         return false;
     if (value['recordedBy'] !== undefined && typeof value['recordedBy'] !== 'string')
         return false;
+    if (value['testCoverageRecords'] !== undefined &&
+        !isCoverageRecordMap(value['testCoverageRecords']))
+        return false;
+    if (value['fullCoverageAnchor'] !== undefined && !isCoverageAnchor(value['fullCoverageAnchor']))
+        return false;
     const components = value['staticComponentsBaseline'];
     return (components === undefined ||
         (isObject(components) &&

package/dist/src/core/build-baseline.d.ts

@@ -15,7 +15,7 @@
  * on successful build completion. A failed build does not update it, so a
  * subsequent run still audits against the last known-good tree.
  */
-import { type BuildBaseline, type TestPackagingCoverage } from './build-baseline-types.js';
+import { type BuildBaseline, type CoverageAnchor, type CoverageRecord, type TestPackagingCoverage } from './build-baseline-types.js';
 /**
  * Which mach build produced the baseline being written. Decides whether
  * the `jar.mn` half of {@link BuildBaseline.buildInputFingerprints} is
@@ -52,6 +52,10 @@ export interface WriteBuildBaselineOptions {
      * Omitted → field left off the marker.
      */
     testPackagingCoverage?: TestPackagingCoverage | undefined;
+    /** Per-path anchors of a scoped claim. Omitted → field left off the marker. */
+    testCoverageRecords?: Record<string, CoverageRecord> | undefined;
+    /** Carried full-build anchor of a narrowed claim. Omitted → field left off. */
+    fullCoverageAnchor?: CoverageAnchor | undefined;
     /**
      * The baseline this write replaces, when the caller has it. A scoped
      * (non-`'full'`) write carries its `staticComponentsBaseline` forward

package/dist/src/core/build-baseline.js

@@ -81,7 +81,7 @@ export async function readBuildBaseline(projectRoot, invalid = 'ignore') {
  * @param options - See {@link WriteBuildBaselineOptions}
  */
 export async function writeBuildBaseline(options) {
-    const { projectRoot, engineDir, binaryName, testPackagingCoverage, previousBaseline, recordedBy, staticComponentsHandling = 'auto', buildKind = 'full', } = options;
+    const { projectRoot, engineDir, binaryName, testPackagingCoverage, testCoverageRecords, fullCoverageAnchor, previousBaseline, recordedBy, staticComponentsHandling = 'auto', buildKind = 'full', } = options;
     let engineHeadSha = '';
     try {
         engineHeadSha = await getHead(engineDir);
@@ -116,6 +116,8 @@ export async function writeBuildBaseline(options) {
         ...(testInputFingerprints !== undefined ? { testInputFingerprints } : {}),
         ...(buildInputFingerprints !== undefined ? { buildInputFingerprints } : {}),
         ...(testPackagingCoverage !== undefined ? { testPackagingCoverage } : {}),
+        ...(testCoverageRecords !== undefined ? { testCoverageRecords } : {}),
+        ...(fullCoverageAnchor !== undefined ? { fullCoverageAnchor } : {}),
         ...(mozconfigHash !== undefined ? { mozconfigHash } : {}),
         ...(staticComponentsBaseline !== undefined ? { staticComponentsBaseline } : {}),
         ...(recordedBy !== undefined ? { recordedBy } : {}),

package/dist/src/core/build-overwrite-guard.d.ts

@@ -14,8 +14,17 @@
  * whose content is explained by neither a patch body nor the pristine
  * baseline. Advisory by default (a warning naming every file), refusing
  * under an explicit flag.
+ *
+ * A deployed Furnace file is checked against its component source as well
+ * (`deployed-unexported`): when the engine copy equals the Furnace-composed
+ * current source, differs from it only inside generated fragment
+ * expansions, or is exactly Furnace's last recorded deployment, the
+ * overwrite destroys nothing that is not a component source, so it is safe
+ * even though no patch records it yet. Without this, peers' deployed but
+ * unexported widgets refused every belted build on a shared checkout.
  */
 import type { FireForgeConfig } from '../types/config.js';
+import { type DeployedSourceMatch } from './furnace-composed-source.js';
 import { type ClassifiedFile } from './status-classify.js';
 /** One file whose unexported content a build-prepare overwrite would destroy. */
 export interface UnexportedDriftAtRisk {
@@ -23,6 +32,24 @@ export interface UnexportedDriftAtRisk {
     classification: ClassifiedFile['classification'];
     owner?: string | undefined;
 }
+/**
+ * A deployed Furnace file no patch records yet whose content is its
+ * component source's (see {@link DeployedSourceMatch}), so the overwrite is
+ * safe. Its patch still owes a re-export.
+ */
+export interface DeployedUnexportedFile {
+    file: string;
+    classification: 'deployed-unexported';
+    match: DeployedSourceMatch;
+    owner?: string | undefined;
+}
+/** Outcome of {@link assessUnexportedDrift}. */
+export interface UnexportedDriftAssessment {
+    /** Files whose content the overwrite would destroy unrecorded. */
+    atRisk: UnexportedDriftAtRisk[];
+    /** Files the overwrite rewrites from their own component source. */
+    deployedUnexported: DeployedUnexportedFile[];
+}
 /**
  * Finds engine files that build-prepare is about to overwrite and whose
  * current content is recorded nowhere.
@@ -30,11 +57,34 @@ export interface UnexportedDriftAtRisk {
  * Fail-open: any probe failure is reported verbosely and yields an empty
  * list. A build must not fail because an advisory guard could not run.
  *
+ * @internal The at-risk half of {@link assessUnexportedDrift}, kept for the
+ * guard's tests; build-prepare consumes the full assessment.
+ *
  * @param projectRoot - Project root
  * @param config - Loaded FireForge config (reads `binaryName`)
  * @returns At-risk files, sorted by path
  */
 export declare function findUnexportedDriftAtRisk(projectRoot: string, config: FireForgeConfig): Promise<UnexportedDriftAtRisk[]>;
+/**
+ * Classifies the engine files build-prepare is about to overwrite into the
+ * ones whose content is recorded nowhere (`atRisk`) and the deployed
+ * Furnace files no patch records yet whose content is their component
+ * source's (`deployedUnexported`, safe to overwrite).
+ *
+ * Fail-open like {@link findUnexportedDriftAtRisk}: a probe failure yields
+ * an empty assessment.
+ *
+ * @param projectRoot - Project root
+ * @param config - Loaded FireForge config (reads `binaryName`)
+ * @returns Both lists, sorted by path
+ */
+export declare function assessUnexportedDrift(projectRoot: string, config: FireForgeConfig): Promise<UnexportedDriftAssessment>;
+/**
+ * Renders the informational note for deployed Furnace files the overwrite
+ * rewrites from their own component source: safe for this build, but their
+ * patches still owe a re-export.
+ */
+export declare function formatDeployedUnexportedNote(files: readonly DeployedUnexportedFile[]): string;
 /**
  * Renders the operator-facing warning (or refusal body) naming every file
  * whose unexported content the build is about to overwrite.

package/dist/src/core/build-overwrite-guard.js

@@ -15,10 +15,19 @@
  * whose content is explained by neither a patch body nor the pristine
  * baseline. Advisory by default (a warning naming every file), refusing
  * under an explicit flag.
+ *
+ * A deployed Furnace file is checked against its component source as well
+ * (`deployed-unexported`): when the engine copy equals the Furnace-composed
+ * current source, differs from it only inside generated fragment
+ * expansions, or is exactly Furnace's last recorded deployment, the
+ * overwrite destroys nothing that is not a component source, so it is safe
+ * even though no patch records it yet. Without this, peers' deployed but
+ * unexported widgets refused every belted build on a shared checkout.
  */
 import { toError } from '../utils/errors.js';
 import { verbose } from '../utils/logger.js';
 import { getProjectPaths } from './config.js';
+import { matchDeployedComponentFiles, } from './furnace-composed-source.js';
 import { collectFurnaceManagedPrefixes } from './furnace-config.js';
 import { expandUntrackedDirectoryEntries, getWorkingTreeStatus } from './git-status.js';
 import { classifyFiles } from './status-classify.js';
@@ -98,6 +107,40 @@ async function collectOverwrittenEntries(engineDir, status, binaryName, furnaceP
     return expanded.filter((entry) => !entry.file.endsWith('/') &&
         isOverwrittenByBuildPrepare(entry.file, binaryName, furnacePrefixes));
 }
+/**
+ * Splits classified at-risk files into the ones whose engine content is a
+ * Furnace deployment of their component source and the rest.
+ *
+ * Fail-closed: when the source comparison cannot run, every file stays at
+ * risk, exactly as before the comparison existed.
+ */
+async function separateDeployedUnexported(projectRoot, engineDir, atRisk) {
+    let matches;
+    try {
+        matches = await matchDeployedComponentFiles(projectRoot, engineDir, atRisk.map((entry) => entry.file));
+    }
+    catch (error) {
+        verbose(`Unexported-drift guard could not compare component sources: ${toError(error).message}`);
+        return { atRisk, deployedUnexported: [] };
+    }
+    const deployedUnexported = [];
+    const remaining = [];
+    for (const entry of atRisk) {
+        const match = matches.get(entry.file);
+        if (match === undefined) {
+            remaining.push(entry);
+        }
+        else {
+            deployedUnexported.push({
+                file: entry.file,
+                classification: 'deployed-unexported',
+                match,
+                owner: entry.owner,
+            });
+        }
+    }
+    return { atRisk: remaining, deployedUnexported };
+}
 /**
  * Finds engine files that build-prepare is about to overwrite and whose
  * current content is recorded nowhere.
@@ -105,22 +148,42 @@ async function collectOverwrittenEntries(engineDir, status, binaryName, furnaceP
  * Fail-open: any probe failure is reported verbosely and yields an empty
  * list. A build must not fail because an advisory guard could not run.
  *
+ * @internal The at-risk half of {@link assessUnexportedDrift}, kept for the
+ * guard's tests; build-prepare consumes the full assessment.
+ *
  * @param projectRoot - Project root
  * @param config - Loaded FireForge config (reads `binaryName`)
  * @returns At-risk files, sorted by path
  */
 export async function findUnexportedDriftAtRisk(projectRoot, config) {
+    return (await assessUnexportedDrift(projectRoot, config)).atRisk;
+}
+/**
+ * Classifies the engine files build-prepare is about to overwrite into the
+ * ones whose content is recorded nowhere (`atRisk`) and the deployed
+ * Furnace files no patch records yet whose content is their component
+ * source's (`deployedUnexported`, safe to overwrite).
+ *
+ * Fail-open like {@link findUnexportedDriftAtRisk}: a probe failure yields
+ * an empty assessment.
+ *
+ * @param projectRoot - Project root
+ * @param config - Loaded FireForge config (reads `binaryName`)
+ * @returns Both lists, sorted by path
+ */
+export async function assessUnexportedDrift(projectRoot, config) {
+    const empty = { atRisk: [], deployedUnexported: [] };
     const paths = getProjectPaths(projectRoot);
     try {
         const status = await getWorkingTreeStatus(paths.engine);
         if (status.length === 0)
-            return [];
+            return empty;
         const furnacePrefixes = await collectFurnaceManagedPrefixes(projectRoot);
         const candidates = await collectOverwrittenEntries(paths.engine, status, config.binaryName, furnacePrefixes);
         if (candidates.length === 0)
-            return [];
+            return empty;
         const classified = await classifyFiles(candidates, paths.engine, paths.patches, config.binaryName, furnacePrefixes);
-        return classified
+        const atRisk = classified
             .filter((entry) => AT_RISK_CLASSIFICATIONS.has(entry.classification))
             .map((entry) => ({
             file: entry.file,
@@ -128,12 +191,29 @@ export async function findUnexportedDriftAtRisk(projectRoot, config) {
             owner: entry.owner,
         }))
             .sort((a, b) => a.file.localeCompare(b.file));
+        if (atRisk.length === 0 || furnacePrefixes.size === 0)
+            return { ...empty, atRisk };
+        return await separateDeployedUnexported(projectRoot, paths.engine, atRisk);
     }
     catch (error) {
         verbose(`Unexported-drift guard could not run: ${toError(error).message}`);
-        return [];
+        return empty;
     }
 }
+/**
+ * Renders the informational note for deployed Furnace files the overwrite
+ * rewrites from their own component source: safe for this build, but their
+ * patches still owe a re-export.
+ */
+export function formatDeployedUnexportedNote(files) {
+    const rows = files.map((entry) => {
+        const owner = entry.owner !== undefined ? ` (owned by ${entry.owner})` : '';
+        return `  ${entry.file} [deployed-unexported: ${entry.match}]${owner}`;
+    });
+    return (`${files.length} deployed Furnace file(s) differ from their patch body but are a Furnace ` +
+        'deployment of their component source, so this overwrite loses nothing; re-export their ' +
+        `patches when the component work is done:\n${rows.join('\n')}`);
+}
 /**
  * Renders the operator-facing warning (or refusal body) naming every file
  * whose unexported content the build is about to overwrite.

package/dist/src/core/build-prepare.d.ts

@@ -10,6 +10,8 @@ import type { BuildBaseline } from './build-baseline-types.js';
 export interface BuildPreparation {
     /** Number of Furnace components applied (0 if none or no furnace.json) */
     furnaceApplied: number;
+    /** Names of the Furnace components applied, in apply order. */
+    furnaceAppliedNames?: string[];
     /** True when `mach configure` was auto-run to refresh a stale backend. */
     reconfigured: boolean;
     /** A changed packaging manifest cannot be safely handled by `mach build faster`. */
@@ -35,6 +37,11 @@ export interface PrepareBuildOptions {
      * Scripted gates want the stop. An interactive build wants the warning.
      */
     refuseUnexportedDrift?: boolean | undefined;
+    /**
+     * Skip the Furnace apply, so the build packages engine/ as it stands
+     * (`fireforge test --build --no-furnace-apply`).
+     */
+    skipFurnaceApply?: boolean | undefined;
 }
 /**
  * Describes an exit code in the shell's 128+N signal convention. Truncated

package/dist/src/core/build-prepare.js

@@ -13,7 +13,7 @@ import { info, notice, spinner, verbose, warn } from '../utils/logger.js';
 import { isBrandingSetup, setupBranding } from './branding.js';
 import { isBuildInputPath, isJarManifestPath } from './build-audit.js';
 import { evaluateJarManifestEscalation, formatJarEscalationNotice, } from './build-jar-escalation.js';
-import { findUnexportedDriftAtRisk, formatUnexportedDriftWarning, } from './build-overwrite-guard.js';
+import { assessUnexportedDrift, formatDeployedUnexportedNote, formatUnexportedDriftWarning, } from './build-overwrite-guard.js';
 import { hashEngineFile } from './coverage-extend.js';
 import { collectChangedEnginePaths, dropPathsMatchingFingerprints } from './engine-changes.js';
 import { applyAllComponents } from './furnace-apply.js';
@@ -156,7 +156,12 @@ export function isBackendInvalidatingFile(path) {
  * @throws GeneralError under `--refuse-unexported-drift`
  */
 async function reportUnexportedDriftBeforeOverwrite(projectRoot, config, options) {
-    const atRisk = await findUnexportedDriftAtRisk(projectRoot, config);
+    const { atRisk, deployedUnexported } = await assessUnexportedDrift(projectRoot, config);
+    // Deployed Furnace files that are their component source's own
+    // deployment never block: the overwrite loses nothing. Say so, since
+    // their patches still owe a re-export.
+    if (deployedUnexported.length > 0)
+        info(formatDeployedUnexportedNote(deployedUnexported));
     if (atRisk.length === 0)
         return;
     const message = formatUnexportedDriftWarning(atRisk);
@@ -170,15 +175,15 @@ async function reportUnexportedDriftBeforeOverwrite(projectRoot, config, options
  * Prints every warning the apply computed, then the loud sync banner.
  *
  * @param projectRoot - Project root
- * @returns Number of components written to engine/
+ * @returns Names of the components written to engine/
  */
 async function applyFurnaceBeforeBuild(projectRoot) {
     if (!(await furnaceConfigExists(projectRoot)))
-        return 0;
+        return [];
     const furnaceConfig = await loadFurnaceConfig(projectRoot);
     const hasComponents = Object.keys(furnaceConfig.overrides).length > 0 || Object.keys(furnaceConfig.custom).length > 0;
     if (!hasComponents)
-        return 0;
+        return [];
     const furnaceSpinner = spinner('Applying Furnace components...');
     let result;
     try {
@@ -230,7 +235,7 @@ async function applyFurnaceBeforeBuild(projectRoot) {
     else {
         furnaceSpinner.stop('Components up to date');
     }
-    return furnaceApplied;
+    return result.applied.map((entry) => entry.name);
 }
 /**
  * Runs the auto-configure step (`mach configure`) against the freshly
@@ -344,7 +349,7 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
             throw error;
         }
     }
-    const furnaceApplied = await applyFurnaceBeforeBuild(projectRoot);
+    const furnaceAppliedNames = options.skipFurnaceApply === true ? [] : await applyFurnaceBeforeBuild(projectRoot);
     // Generate mozconfig
     const mozconfigSpinner = spinner('Generating mozconfig...');
     let mozconfigWritten;
@@ -374,7 +379,8 @@ export async function prepareBuildEnvironment(projectRoot, paths, config, option
         reconfigured = true;
     }
     return {
-        furnaceApplied,
+        furnaceApplied: furnaceAppliedNames.length,
+        furnaceAppliedNames,
         reconfigured,
         fullBuildRequired,
         ...(fullBuildReason !== undefined ? { fullBuildReason } : {}),