@hominis/fireforge 0.49.2 → 0.51.0

package/dist/src/commands/furnace/validate.js

@@ -6,11 +6,13 @@ import { getFurnacePaths, loadFurnaceConfig } from '../../core/furnace-config.js
 import { assertFurnaceReady } from '../../core/furnace-precondition.js';
 import { addCustomElementRegistration, addJarMnEntries, pruneStaleJarMnEntries, } from '../../core/furnace-registration.js';
 import { validateAllComponents, validateComponent } from '../../core/furnace-validate.js';
+import { applyValidationExceptions, } from '../../core/furnace-validate-exceptions.js';
+import { createIssue } from '../../core/furnace-validate-helpers.js';
 import { FurnaceError } from '../../errors/furnace.js';
 import { toError } from '../../utils/errors.js';
 import { pathExists } from '../../utils/fs.js';
-import { info, intro, note, outro, success, warn } from '../../utils/logger.js';
-import { displayValidationIssues } from './validation-output.js';
+import { info, intro, isMachineOutputMode, note, outro, setMachineOutputMode, warn, } from '../../utils/logger.js';
+import { judgeValidateReport, renderValidateHuman, renderValidateJson } from './validate-report.js';
 /** Checks that auto-fix can correct. */
 const FIXABLE_CHECKS = new Set([
     'missing-jar-mn-mjs',
@@ -114,133 +116,176 @@ async function autoFixIssues(projectRoot, issues) {
     }
     return fixed;
 }
+/**
+ * Resolves the named component's type and directory.
+ * @returns undefined for a stock component (nothing local to validate)
+ */
+function resolveNamedComponent(name, config, furnacePaths) {
+    if (name in config.overrides) {
+        return { type: 'override', componentDir: join(furnacePaths.overridesDir, name) };
+    }
+    if (name in config.custom) {
+        return { type: 'custom', componentDir: join(furnacePaths.customDir, name) };
+    }
+    if (config.stock.includes(name))
+        return undefined;
+    throw new FurnaceError(`Component "${name}" not found in furnace.json.`, name);
+}
+/**
+ * Runs the first validation pass: one named component, or every override
+ * and custom component. Returns undefined when there is nothing local to
+ * validate (a stock component, or no components at all), after saying so.
+ */
+async function runValidationPass(projectRoot, name, config, furnacePaths) {
+    if (name) {
+        const target = resolveNamedComponent(name, config, furnacePaths);
+        if (target === undefined) {
+            info(`"${name}" is a stock component. Stock components are not validated locally.`);
+            return undefined;
+        }
+        if (!(await pathExists(target.componentDir))) {
+            throw new FurnaceError(`Component directory not found for "${name}".`, name);
+        }
+        const issues = await validateComponent(target.componentDir, name, target.type, config, projectRoot);
+        return { results: new Map([[name, issues]]), judged: (component) => component === name };
+    }
+    if (Object.keys(config.overrides).length === 0 && Object.keys(config.custom).length === 0) {
+        info('No components to validate.');
+        return undefined;
+    }
+    if (config.stock.length > 0) {
+        info(`Skipping ${config.stock.length} stock component(s) (no local files to validate).`);
+    }
+    return { results: await validateAllComponents(projectRoot), judged: () => true };
+}
+/**
+ * Runs `--fix` over the fixable findings, then re-validates the affected
+ * components and swaps their findings in, so the summary and the JSON
+ * report what auto-fix actually accomplished. The counter `autoFixIssues`
+ * returns only counts calls that did not throw, so a write that succeeded
+ * but did not resolve the finding would otherwise still be reported fixed.
+ */
+async function applyAutoFix(projectRoot, config, furnacePaths, run, countedIssues) {
+    const fixableIssues = countedIssues.filter((issue) => FIXABLE_CHECKS.has(issue.check));
+    if (fixableIssues.length === 0) {
+        info('\nNo auto-fixable issues found. Remaining issues require manual resolution.');
+        return;
+    }
+    await autoFixIssues(projectRoot, fixableIssues);
+    const reValidated = await reValidateComponents(projectRoot, config, furnacePaths, new Set(fixableIssues.map((issue) => issue.component)));
+    for (const [component, issues] of reValidated)
+        run.results.set(component, issues);
+    const fixableAfter = [...reValidated.values()]
+        .flat()
+        .filter((issue) => FIXABLE_CHECKS.has(issue.check)).length;
+    const actuallyFixed = Math.max(0, fixableIssues.length - fixableAfter);
+    if (actuallyFixed > 0) {
+        info(`\nAuto-fixed ${actuallyFixed} issue(s).`);
+    }
+    if (fixableAfter > 0) {
+        warn(`${fixableAfter} fixable issue(s) remain after auto-fix — investigate manually.`);
+    }
+}
+/** Applies `validationExceptions` to every finding of the run. */
+function exceptRun(run, config) {
+    return applyValidationExceptions([...run.results.values()].flat(), config.validationExceptions, run.judged);
+}
+/**
+ * The `furnace.json#minComponents` floor of a full run: an error when it
+ * judged fewer components, so a run over an emptied or moved components
+ * tree cannot pass by validating nothing. A run naming one component is
+ * not judged against it.
+ */
+function componentFloorIssue(config, name, judged) {
+    if (name !== undefined || config.minComponents === undefined)
+        return undefined;
+    if (judged >= config.minComponents)
+        return undefined;
+    return createIssue('furnace.json', 'error', 'component-floor', `Validated ${judged} component(s), under furnace.json minComponents ${config.minComponents}. ` +
+        'Check that the components tree is where furnace.json says, or lower the floor.');
+}
 /**
  * Runs the furnace validate command to perform static analysis on components.
  * @param projectRoot - Root directory of the project
  * @param name - Optional component name to validate (validates all if omitted)
- * @param options - Optional command options (e.g. --fix)
+ * @param options - Optional command options (`--fix`, `--json`, `--max-warnings`)
  */
 export async function furnaceValidateCommand(projectRoot, name, options = {}) {
+    const previousMachineOutputMode = isMachineOutputMode();
+    // `--json` owns stdout: every diagnostic routes to stderr from here on.
+    // On a throw the mode stays engaged and withErrorHandling resets it, so
+    // the refusal cannot land on stdout after the payload.
+    if (options.json === true)
+        setMachineOutputMode(true);
+    await runFurnaceValidate(projectRoot, name, options);
+    if (isMachineOutputMode() !== previousMachineOutputMode) {
+        setMachineOutputMode(previousMachineOutputMode);
+    }
+}
+async function runFurnaceValidate(projectRoot, name, options) {
     intro('Furnace Validate');
     // Gains the engine rung here: this was the one site in the family that
     // checked furnace.json alone, so a validate against a missing engine
     // produced downstream noise instead of the shared precondition refusal.
     const { config } = await assertFurnaceReady(projectRoot);
     const furnacePaths = getFurnacePaths(projectRoot);
-    let totalErrors = 0;
-    let totalWarnings = 0;
-    let componentCount;
-    let allIssues = [];
-    if (name) {
-        // --- Single component validation ---
-        let type;
-        let componentDir;
-        if (name in config.overrides) {
-            type = 'override';
-            componentDir = join(furnacePaths.overridesDir, name);
-        }
-        else if (name in config.custom) {
-            type = 'custom';
-            componentDir = join(furnacePaths.customDir, name);
-        }
-        else if (config.stock.includes(name)) {
-            info(`"${name}" is a stock component. Stock components are not validated locally.`);
-            outro('Validation complete');
-            return;
-        }
-        else {
-            throw new FurnaceError(`Component "${name}" not found in furnace.json.`, name);
-        }
-        if (!(await pathExists(componentDir))) {
-            throw new FurnaceError(`Component directory not found for "${name}".`, name);
-        }
-        const issues = await validateComponent(componentDir, name, type, config, projectRoot);
-        componentCount = 1;
-        allIssues = issues;
-        if (issues.length === 0) {
-            success(`${name} — all checks passed`);
-        }
-        else {
-            const [e, w] = displayValidationIssues(issues);
-            totalErrors += e;
-            totalWarnings += w;
-        }
-    }
-    else {
-        // --- Validate all components ---
-        const overrideCount = Object.keys(config.overrides).length;
-        const customCount = Object.keys(config.custom).length;
-        if (overrideCount === 0 && customCount === 0) {
-            info('No components to validate.');
-            outro('Done');
-            return;
-        }
-        if (config.stock.length > 0) {
-            info(`Skipping ${config.stock.length} stock component(s) (no local files to validate).`);
+    const run = await runValidationPass(projectRoot, name, config, furnacePaths);
+    if (run === undefined) {
+        const floor = componentFloorIssue(config, name, 0);
+        if (options.json === true) {
+            renderValidateJson({
+                components: [],
+                outcome: { issues: floor ? [floor] : [], excepted: [], stale: [] },
+                maxWarnings: options.maxWarnings,
+            });
         }
-        const results = await validateAllComponents(projectRoot);
-        componentCount = results.size;
-        for (const [componentName, issues] of results) {
-            allIssues.push(...issues);
-            if (issues.length === 0) {
-                success(`${componentName} — all checks passed`);
-            }
-            else {
-                const [e, w] = displayValidationIssues(issues);
-                totalErrors += e;
-                totalWarnings += w;
-            }
+        if (floor !== undefined) {
+            renderValidateHuman([], [floor]);
+            throw new FurnaceError('Validation failed with 1 error(s).');
         }
+        outro(name ? 'Validation complete' : 'Done');
+        return;
     }
-    // Auto-fix fixable issues when --fix is passed. The counter returned by
-    // `autoFixIssues` only counts function calls that did not throw, so a
-    // write that succeeded but did not actually resolve the issue
-    // (addJarMnEntries appending to a file mach later ignores) would still
-    // bump it. Re-validate the affected components and compute the real drop
-    // in fixable issues so the reported number is honest.
-    if (options.fix && allIssues.length > 0) {
-        const fixableIssues = allIssues.filter((issue) => FIXABLE_CHECKS.has(issue.check));
-        if (fixableIssues.length > 0) {
-            await autoFixIssues(projectRoot, fixableIssues);
-            const reValidated = await reValidateComponents(projectRoot, config, furnacePaths, new Set(fixableIssues.map((issue) => issue.component)));
-            const fixableBefore = fixableIssues.length;
-            const fixableAfter = reValidated.issues.filter((issue) => FIXABLE_CHECKS.has(issue.check)).length;
-            const actuallyFixed = Math.max(0, fixableBefore - fixableAfter);
-            // Replace the pre-fix issue totals with the post-fix view so the
-            // summary reflects current reality. Issues that auto-fix could not
-            // address still count toward totalErrors / totalWarnings.
-            totalErrors = reValidated.totalErrors;
-            totalWarnings = reValidated.totalWarnings;
-            if (actuallyFixed > 0) {
-                info(`\nAuto-fixed ${actuallyFixed} issue(s).`);
-            }
-            if (fixableAfter > 0) {
-                warn(`${fixableAfter} fixable issue(s) remain after auto-fix — investigate manually.`);
-            }
-        }
-        else {
-            info('\nNo auto-fixable issues found. Remaining issues require manual resolution.');
-        }
+    const floor = componentFloorIssue(config, name, run.results.size);
+    const firstPass = exceptRun(run, config);
+    if (floor !== undefined)
+        firstPass.issues.push(floor);
+    renderValidateHuman([...run.results.keys()], firstPass.issues);
+    let outcome = firstPass;
+    if (options.fix && firstPass.issues.length > 0) {
+        await applyAutoFix(projectRoot, config, furnacePaths, run, firstPass.issues);
+        outcome = exceptRun(run, config);
+        if (floor !== undefined)
+            outcome.issues.push(floor);
     }
-    // Summary
-    note(`${totalErrors} error(s), ${totalWarnings} warning(s) across ${componentCount} component(s)`, 'Validation Summary');
-    if (totalErrors > 0) {
+    const report = {
+        components: [...run.results.keys()],
+        outcome,
+        maxWarnings: options.maxWarnings,
+    };
+    const verdict = judgeValidateReport(report);
+    const excepted = outcome.excepted.length > 0 ? `, ${outcome.excepted.length} excepted` : '';
+    note(`${verdict.errors} error(s), ${verdict.warnings} warning(s)${excepted} across ${report.components.length} component(s)`, 'Validation Summary');
+    if (options.json === true)
+        renderValidateJson(report);
+    if (verdict.errors > 0) {
         const fixHint = options.fix ? '' : ' Use --fix to auto-correct registration issues.';
         info(`Fix the errors above and run "fireforge furnace validate" again.${fixHint}`);
-        throw new FurnaceError(`Validation failed with ${totalErrors} error(s).`);
+        throw new FurnaceError(`Validation failed with ${verdict.errors} error(s).`);
+    }
+    if (verdict.warningBudgetExceeded) {
+        throw new FurnaceError(`Validation failed: ${verdict.warnings} warning(s) exceed --max-warnings ${String(options.maxWarnings)}. ` +
+            'Fix them, or record a reviewed finding in furnace.json validationExceptions.');
     }
     outro('Validation passed');
 }
 /**
  * Re-validates a specific set of components after an auto-fix pass and
- * returns the post-fix issue list with the recomputed error / warning
- * totals. Used by the `--fix` path to honestly report what auto-fix
- * actually accomplished.
+ * returns each one's post-fix findings. Used by the `--fix` path to
+ * honestly report what auto-fix actually accomplished.
  */
 async function reValidateComponents(projectRoot, config, furnacePaths, componentNames) {
-    const issues = [];
-    let totalErrors = 0;
-    let totalWarnings = 0;
+    const results = new Map();
     for (const componentName of componentNames) {
         let type;
         let componentDir;
@@ -258,14 +303,7 @@ async function reValidateComponents(projectRoot, config, furnacePaths, component
         }
         if (!(await pathExists(componentDir)))
             continue;
-        const componentIssues = await validateComponent(componentDir, componentName, type, config, projectRoot);
-        issues.push(...componentIssues);
-        for (const issue of componentIssues) {
-            if (issue.severity === 'error')
-                totalErrors += 1;
-            else
-                totalWarnings += 1;
-        }
+        results.set(componentName, await validateComponent(componentDir, componentName, type, config, projectRoot));
     }
-    return { issues, totalErrors, totalWarnings };
+    return results;
 }

package/dist/src/commands/furnace/validation-output.js

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: EUPL-1.2
 import { join } from 'node:path';
 import { validateAllComponents, validateComponent } from '../../core/furnace-validate.js';
+import { applyValidationExceptions } from '../../core/furnace-validate-exceptions.js';
 import { FurnaceError } from '../../errors/furnace.js';
 import { pathExists } from '../../utils/fs.js';
 import { error, info, outro, success, warn } from '../../utils/logger.js';
@@ -36,6 +37,14 @@ function filterProjectedDryRunIssues(issues, actions) {
         return true;
     });
 }
+/**
+ * Drops the findings `furnace.json#validationExceptions` records as
+ * reviewed, so a deploy does not fail on a finding `furnace validate`
+ * accepts. Staleness is `furnace validate`'s report, not a deploy's.
+ */
+function withoutExceptedIssues(issues, config) {
+    return applyValidationExceptions(issues, config.validationExceptions, () => false).issues;
+}
 function resolveNamedValidationTarget(name, config, furnacePaths) {
     if (name in config.overrides) {
         return {
@@ -67,7 +76,8 @@ async function validateNamedTarget(args) {
         throw new FurnaceError(`Component directory not found for "${name}".`, name);
     }
     const rawIssues = await validateComponent(target.componentDir, name, target.type, config, projectRoot);
-    const issues = isDryRun ? filterProjectedDryRunIssues(rawIssues, dryRunActions) : rawIssues;
+    const counted = withoutExceptedIssues(rawIssues, config);
+    const issues = isDryRun ? filterProjectedDryRunIssues(counted, dryRunActions) : counted;
     if (issues.length === 0) {
         success(`${name} — all checks passed`);
         return [0, 0];
@@ -130,9 +140,10 @@ export async function runDeployValidation(options) {
                 continue;
             }
             componentCount++;
+            const counted = withoutExceptedIssues(issues, config);
             const projectedIssues = isDryRun
-                ? filterProjectedDryRunIssues(issues, dryRunActions)
-                : issues;
+                ? filterProjectedDryRunIssues(counted, dryRunActions)
+                : counted;
             if (projectedIssues.length === 0) {
                 success(`${componentName} — all checks passed`);
             }

package/dist/src/commands/lint-per-patch.js

@@ -3,10 +3,13 @@ import { join } from 'node:path';
 import { loadConfig } from '../core/config.js';
 import { getDiffForFilesAgainstHead } from '../core/git-diff.js';
 import { withPrivateGitIndex } from '../core/git-readonly-index.js';
-import { buildPatchQueueContext, countNonBinaryDiffLines, formatPatchLintIssue, lintExportedPatch, lintPatchQueue, resolvePatchSizeTier, } from '../core/patch-lint.js';
+import { buildPatchQueueContext, formatPatchLintIssue, lintExportedPatch, lintPatchQueue, measurePatchSize, resolvePatchSizeTier, } from '../core/patch-lint.js';
 import { buildPerPatchLintCacheKey, getCachedPerPatchLintIssues, getPerPatchLintCacheHeadSha, loadPerPatchLintCache, savePerPatchLintCache, setCachedPerPatchLintIssues, } from '../core/patch-lint-cache.js';
+import { buildLintIgnoreChecks, evaluateLintIgnoreCeilings, formatLintIgnoreEntry, isLintIgnoreCeiling, lintIgnoreCacheTokens, removableCeilingIssues, } from '../core/patch-lint-ignore.js';
 import { loadPatchesManifest } from '../core/patch-manifest.js';
 import { evaluatePatchPolicy } from '../core/patch-policy.js';
+import { evaluatePatchPolicyContent } from '../core/patch-policy-content.js';
+import { selectPatchSubset } from '../core/patch-subset.js';
 import { GeneralError } from '../errors/base.js';
 import { mapWithConcurrency } from '../utils/concurrency.js';
 import { pathExists } from '../utils/fs.js';
@@ -47,7 +50,7 @@ async function lintQueuedPatch(patch, lintCtx) {
             usedCheckJs: false,
         };
     }
-    const ignore = patch.lintIgnore?.length ? new Set(patch.lintIgnore) : undefined;
+    const ignore = buildLintIgnoreChecks(patch.lintIgnore);
     let cacheKey;
     if (cache) {
         cacheKey = await buildPerPatchLintCacheKey({
@@ -60,7 +63,7 @@ async function lintQueuedPatch(patch, lintCtx) {
             queueContext: ctx,
             ...(engineHeadSha === undefined ? {} : { engineHeadSha }),
         });
-        const cached = getCachedPerPatchLintIssues(cache, patch.filename, cacheKey, ignore);
+        const cached = getCachedPerPatchLintIssues(cache, patch.filename, cacheKey, lintIgnoreCacheTokens(ignore));
         if (cached) {
             // Returning before the empty-diff probe below is safe: the cache key
             // hashes every affected engine file's content plus engineHeadSha, so
@@ -106,8 +109,13 @@ async function lintQueuedPatch(patch, lintCtx) {
         }
         lintOptions.precomputedCheckJs = precomputedCheckJs;
     }
+    // Measured from the working tree, like every other rule here: the files
+    // on disk are the would-be export, so a size tier fires mid-edit rather
+    // than first at the re-export.
+    const patchSize = await measurePatchSize(paths.engine, diff, existing, config);
     const patchIssues = await lintExportedPatch(paths.engine, existing, diff, config, {
         ...lintOptions,
+        patchSizeMeasurement: patchSize,
         patchQueueCtx: ctx,
         ...(ignore ? { ignoreChecks: ignore } : {}),
         ...(patch.tier ? { patchTier: patch.tier } : {}),
@@ -117,11 +125,11 @@ async function lintQueuedPatch(patch, lintCtx) {
         existingFiles: existing,
         rawIssues: patchIssues,
         suppressedIssues,
-        lineCount: countNonBinaryDiffLines(diff).textLines,
+        lineCount: patchSize.lines,
         usedCheckJs,
     };
     if (cache && cacheKey) {
-        result.cacheWrite = { key: cacheKey, lintIgnore: [...(ignore ?? [])] };
+        result.cacheWrite = { key: cacheKey, lintIgnore: lintIgnoreCacheTokens(ignore) };
     }
     return result;
 }
@@ -183,6 +191,9 @@ async function applyPerPatchResults(subset, results, issues, checkJs, cache, hel
         for (const issue of result.rawIssues) {
             issues.push({ ...issue, file: `${patch.filename} :: ${issue.file}` });
         }
+        // A ceiling the patch no longer needs is reported as a notice naming
+        // the command that drops it.
+        issues.push(...removableCeilingIssues(patch.filename, evaluateLintIgnoreCeilings(patch.lintIgnore, [...result.rawIssues, ...result.suppressedIssues], { lines: result.lineCount, files: patch.filesAffected.length })));
         // A waived size finding still reports its measurement: the finding stays
         // suppressed (no exit-code / --max-warnings effect) but the current count
         // is readable from the tool that enforces it, so a waiver's cited size
@@ -194,7 +205,10 @@ async function applyPerPatchResults(subset, results, issues, checkJs, cache, hel
                 heldNotices.push({ check: suppressedIssue.check, patch: patch.filename, suppressed: true });
                 continue;
             }
-            info(`NOTICE [${suppressedIssue.check}] ${patch.filename}: suppressed by lintIgnore — ${suppressedIssue.message}`);
+            const ceilings = (patch.lintIgnore ?? []).filter((entry) => isLintIgnoreCeiling(entry) && entry.rule === suppressedIssue.check);
+            const ceiling = ceilings.find((entry) => isLintIgnoreCeiling(entry) && entry.share === suppressedIssue.share) ?? ceilings[0];
+            const waiver = ceiling === undefined ? 'lintIgnore' : `lintIgnore (${formatLintIgnoreEntry(ceiling)})`;
+            info(`NOTICE [${suppressedIssue.check}] ${patch.filename}: suppressed by ${waiver} — ${suppressedIssue.message}`);
         }
         totals.suppressed += result.suppressedIssues.length;
         if (result.status === 'cached')
@@ -309,57 +323,9 @@ function reportNoticeSummary(heldNotices, issues) {
         info(`NOTICE [${check}]: ${entry.count} across ${entry.patches.size} patch(es)${suppressed} (see --report)`);
     }
 }
-/**
- * Resolves the `--patches <name…>` subset filter against the manifest,
- * matching each requested name tolerantly (exact filename, filename ±
- * `.patch`, the bare order number, or the manifest `name` field). Throws listing the available
- * patches when a requested name matches none, so a typo fails loud rather
- * than silently linting nothing.
- */
-function selectPatchSubset(manifest, requested) {
-    const normalizedRequests = requested
-        .flatMap((entry) => entry.split(','))
-        .map((entry) => entry.trim())
-        .filter((entry) => entry.length > 0);
-    const patchAliases = (p) => {
-        const aliases = new Set([p.filename, p.filename.replace(/\.patch$/, ''), p.name]);
-        // The bare order number, both as the manifest records it and as the
-        // filename spells it (`2` and `002`). The refusal message offers stems,
-        // and an operator reading `102-ui-canvas-tiles.patch` in a lint finding
-        // reaches for `102` first.
-        aliases.add(String(p.order));
-        const match = /^(\d+)-([a-z]+)-(.+)\.patch$/.exec(p.filename);
-        if (match?.[1])
-            aliases.add(match[1]);
-        if (match?.[2] && match[3]) {
-            aliases.add(`${match[2]}-${match[3]}`);
-            aliases.add(match[3]);
-        }
-        return aliases;
-    };
-    const matches = (p, name) => {
-        const stem = name.replace(/\.patch$/, '');
-        return (patchAliases(p).has(name) || patchAliases(p).has(stem) || patchAliases(p).has(`${stem}.patch`));
-    };
-    const selected = [];
-    const seen = new Set();
-    for (const name of normalizedRequests) {
-        const found = manifest.patches.filter((p) => matches(p, name));
-        if (found.length === 0) {
-            const available = manifest.patches.map((p) => p.filename).join(', ');
-            throw new GeneralError(`No patch in the queue matches "${name}". In --per-patch mode, positional arguments ` +
-                `and --patches select patches (filename, stem, order number, manifest name, or slug) — not engine ` +
-                `files; drop --per-patch to lint engine paths. Available patches: ${available}`);
-        }
-        for (const p of found) {
-            if (!seen.has(p.filename)) {
-                seen.add(p.filename);
-                selected.push(p);
-            }
-        }
-    }
-    return selected;
-}
+/** The refusal sentence `selectPatchSubset` adds for a `lint --per-patch` miss. */
+const PER_PATCH_SUBSET_HINT = 'In --per-patch mode, positional arguments and --patches select patches (filename, stem, ' +
+    'order number, manifest name, or slug) — not engine files; drop --per-patch to lint engine paths.';
 /**
  * Lints each patch in the queue as its own isolated diff, honouring
  * per-patch `lintIgnore` entries. Cross-patch rules still run once over
@@ -382,7 +348,7 @@ async function lintPerPatchInner(projectRoot, paths, options = {}) {
         return;
     }
     const subset = options.patches && options.patches.length > 0
-        ? selectPatchSubset(manifest, options.patches)
+        ? selectPatchSubset(manifest, options.patches, PER_PATCH_SUBSET_HINT)
         : manifest.patches;
     const subsetNames = new Set(subset.map((p) => p.filename));
     const isSubset = subset.length !== manifest.patches.length;
@@ -405,7 +371,11 @@ async function lintPerPatchInner(projectRoot, paths, options = {}) {
     const cache = options.noCache === true ? undefined : await loadPerPatchLintCache(projectRoot);
     const engineHeadSha = cache ? await getPerPatchLintCacheHeadSha(paths.engine) : undefined;
     const issues = [];
-    for (const issue of evaluatePatchPolicy(config, manifest)) {
+    const policyIssues = [
+        ...evaluatePatchPolicy(config, manifest),
+        ...(await evaluatePatchPolicyContent(config, projectRoot, manifest, ctx.entries)),
+    ];
+    for (const issue of policyIssues) {
         if (isSubset && !subsetNames.has(issue.filename))
             continue;
         issues.push({
@@ -433,10 +403,15 @@ async function lintPerPatchInner(projectRoot, paths, options = {}) {
     });
     const heldNotices = options.notices === 'summary' ? [] : undefined;
     const { linted, skipped, cacheDirty, reusedCacheEntries, suppressed } = await applyPerPatchResults(subset, results, issues, checkJs, cache, heldNotices);
+    const queueIssues = [];
     for (const issue of lintPatchQueue(ctx)) {
-        if (isSubset && !subsetTouchedFiles.has(issue.file))
+        // A finding that names a subset patch stays in scope even when its file
+        // is one the patch no longer touches (a stale staged declaration).
+        const namesSubset = issue.patches?.some((name) => subsetNames.has(name)) === true;
+        if (isSubset && !namesSubset && !subsetTouchedFiles.has(issue.file))
             continue;
         issues.push(issue);
+        queueIssues.push(issue);
     }
     if (cache && cacheDirty)
         await savePerPatchLintCache(projectRoot, cache);
@@ -447,7 +422,7 @@ async function lintPerPatchInner(projectRoot, paths, options = {}) {
         info(`Suppressed ${suppressed} issue(s) via per-patch lintIgnore.`);
     }
     if (options.report !== undefined) {
-        await writePerPatchLintReport(options.report, subset, results);
+        await writePerPatchLintReport(options.report, subset, results, config, queueIssues);
     }
     reportPerPatchOutcome(issues, linted, skipped, options, heldNotices);
 }

package/dist/src/commands/lint-per-run-checkjs.js

@@ -21,7 +21,7 @@
  *   cold" via `probeCheckJsGlobalIssues` instead of building anything.
  */
 import { invokePatchLintCheckJsGrouped, probeCheckJsGlobalIssues, runCheckJsTestFilesGrouped, } from '../core/patch-lint-checkjs.js';
-import { isTestScriptFile, resolvePatchOwnedSysMjs, resolvePatchOwnedTestScripts, } from '../core/patch-lint-ownership.js';
+import { isTestScriptFile, resolvableModulesForTests, resolvePatchOwnedSysMjs, resolvePatchOwnedTestScripts, } from '../core/patch-lint-ownership.js';
 /**
  * Builds the per-run checkJs program controller when `patchLint.checkJs` is
  * enabled, or returns undefined. With `rootScopePatches` set (the
@@ -69,7 +69,7 @@ export function buildPerRunCheckJs(projectRoot, paths, config, ctx, rootScopePat
         const sys = await invokePatchLintCheckJsGrouped(paths.engine, resolvePatchOwnedSysMjs(new Set(), ctx), patchLint, projectRoot, scopedRoots);
         if (!testFilesEnabled)
             return sys;
-        const tests = await runCheckJsTestFilesGrouped(paths.engine, resolvePatchOwnedTestScripts(new Set(), ctx), patchLint, projectRoot, scopedRoots);
+        const tests = await runCheckJsTestFilesGrouped(paths.engine, resolvePatchOwnedTestScripts(new Set(), ctx), patchLint, projectRoot, scopedRoots, resolvableModulesForTests(ctx));
         const byFile = new Map(sys.byFile);
         for (const [rel, list] of tests.byFile) {
             byFile.set(rel, [...(byFile.get(rel) ?? []), ...list]);

package/dist/src/commands/lint-report.d.ts

@@ -1,4 +1,5 @@
 import type { PatchLintIssue, PatchMetadata } from '../types/commands/index.js';
+import type { FireForgeConfig } from '../types/config.js';
 /**
  * Structural view of one per-patch lint outcome. Mirrors the relevant
  * fields of lint-per-patch's QueuedPatchResult without importing it:
@@ -14,8 +15,11 @@ export interface PerPatchReportResult {
 }
 /**
  * Writes the per-patch lint report JSON. Called after the per-patch
- * results are assembled in patch order. Queue-level and policy findings
- * are patch-attributed by their `file`/`filename` fields upstream and
- * are not duplicated here. The report is the per-patch view.
+ * results are assembled in patch order. Policy findings are
+ * patch-attributed by their `filename` field upstream and are not
+ * duplicated here. Cross-patch findings (`forward-import`,
+ * `forward-registration`, …) go in `queueIssues`, with the
+ * `stagedDeclarations` that discharge them, so the report can be handed to
+ * `patch staged-dependency --from` as is.
  */
-export declare function writePerPatchLintReport(reportPath: string, subset: readonly PatchMetadata[], results: readonly PerPatchReportResult[]): Promise<void>;
+export declare function writePerPatchLintReport(reportPath: string, subset: readonly PatchMetadata[], results: readonly PerPatchReportResult[], config: Pick<FireForgeConfig, 'patchLint'>, queueIssues?: readonly PatchLintIssue[]): Promise<void>;

package/dist/src/commands/lint-report.js

@@ -10,16 +10,21 @@
  * none is wanted.
  */
 import { getPatchSizeThresholds, resolvePatchSizeTier, } from '../core/patch-lint.js';
+import { evaluateLintIgnoreCeilings, evaluateLintIgnoreWaivers, } from '../core/patch-lint-ignore.js';
 import { writeJson } from '../utils/fs.js';
 import { info } from '../utils/logger.js';
 const LINT_REPORT_SCHEMA_VERSION = 1;
 /**
  * Writes the per-patch lint report JSON. Called after the per-patch
- * results are assembled in patch order. Queue-level and policy findings
- * are patch-attributed by their `file`/`filename` fields upstream and
- * are not duplicated here. The report is the per-patch view.
+ * results are assembled in patch order. Policy findings are
+ * patch-attributed by their `filename` field upstream and are not
+ * duplicated here. Cross-patch findings (`forward-import`,
+ * `forward-registration`, …) go in `queueIssues`, with the
+ * `stagedDeclarations` that discharge them, so the report can be handed to
+ * `patch staged-dependency --from` as is.
  */
-export async function writePerPatchLintReport(reportPath, subset, results) {
+export async function writePerPatchLintReport(reportPath, subset, results, config, queueIssues = []) {
+    const metric = config.patchLint?.patchSizeMetric ?? 'diff';
     const patches = [];
     let errors = 0;
     let warnings = 0;
@@ -32,16 +37,25 @@ export async function writePerPatchLintReport(reportPath, subset, results) {
         if (!patch || !result)
             continue;
         const tier = resolvePatchSizeTier(result.existingFiles, patch.tier);
+        const findings = [...result.rawIssues, ...result.suppressedIssues];
+        const measurements = { lines: result.lineCount, files: patch.filesAffected.length };
         patches.push({
             filename: patch.filename,
             name: patch.name,
             status: result.status,
+            metric,
             lineCount: result.lineCount,
             filesAffected: patch.filesAffected.length,
             tier,
-            thresholds: getPatchSizeThresholds(tier.tier),
+            thresholds: getPatchSizeThresholds(tier.tier, config),
             issues: result.rawIssues,
             suppressedIssues: result.suppressedIssues,
+            lintIgnoreCeilings: result.status === 'skipped'
+                ? []
+                : evaluateLintIgnoreCeilings(patch.lintIgnore, findings, measurements),
+            lintIgnoreWaivers: result.status === 'skipped'
+                ? []
+                : evaluateLintIgnoreWaivers(patch.lintIgnore, findings, measurements),
         });
         if (result.status === 'skipped')
             skipped++;
@@ -55,6 +69,7 @@ export async function writePerPatchLintReport(reportPath, subset, results) {
         schemaVersion: LINT_REPORT_SCHEMA_VERSION,
         generatedAt: new Date().toISOString(),
         patches,
+        queueIssues,
         totals: { linted, skipped, errors, warnings, suppressed },
     });
     info(`Per-patch lint report written to ${reportPath}.`);