[aidenybai]

Why

A directly imported helper can assign a browser cookie inside a state updater. React may replay that updater, but the existing call classification missed the imported write.

What changed

Certify the bounded readonly exported arrow and its single cookie assignment with supported string data. Independent review closed dynamic provider replacement and CommonJS export replacement paths, preserved erased TypeScript name handling, and declined ambient or unsupported runtime providers. The caller and foreign module retain separate export-closure requirements.

Added focused provider controls, synthetic fuzz regressions, generator controls, and patch Changesets for published behavior. Existing author fixture and snippet literal values and order remain intact.

Validation

• Fresh full tests: 34,271 passed, 1,118 skipped; 12 tasks, none cached. All 83 focused tests and all 13 corpus-oracle tests passed.
• Lint, full typecheck (10 tasks, none cached), formatting, registry generation, fresh five-package build (none cached), and JSON report smoke check passed.
• Strict target fuzz passed once with seed 42, 500 configured iterations, and target activation required. Numeric execution and fire counts were not emitted.
• Fresh compiled native/API/CLI comparisons on 56 synthetic source files changed exact-base target warnings zero to ten. Compared with the original head, nine changed to ten: three erased-provider cases now report, two ambiguous provider cases decline, and seven complete target objects remain exact. Default profiles contain no unrelated diagnostics.
• Separate custom-global fresh-getter controls changed three false warnings to zero across six files. Two valid .cts export-replacement controls changed two false warnings to zero. Isolated VM checks using replaceable custom JavaScript globals confirmed that these exported helpers did not call the controlled cookie setter; a nominal helper still called it. These checks do not exercise replacement of native Window.document, a browser, or React mounting.
• An eight-file ambient-provider suite changed two warnings to zero. Ambient and shared-object replacement removals are conservative proof-frontier declines, without whole-rule false-positive credit.
• Every public profile analyzed every fixture without skipped checks. Retained complete CLI identities, all 175 runtime artifacts, archived copies, source inputs, and four actual own-package resolution edges were verified. Original-head supplemental runs used its immutable original build archive.

Remote parity is blocked by missing Vercel Sandbox authentication, team/org, and project environment variables. No remote corpus or performance result is claimed.

Shared diagnostic evidence performance repair

Merged shared lazy evidence commit adcd927. The cookie detector is unchanged relative to reviewed head 9e33830; raw UTF-8 byte spans, CRLF handling, fingerprints, options and filesystem failure behavior remain covered. TypeScript AST construction is deferred until forwarded-handler evidence needs it.

All nine new local validation commands passed: fresh five-package build, 62 focused evidence/cache tests, full workspace tests, lint, typecheck, format, generation, rebuilt packages and JSON smoke. The strict intermediate artifact audit remains failed for the independently reviewed one-line DeadCodeOverlap declaration union ordering; all other 174 artifacts and JavaScript matched, and the final build restored the bootstrap map. The clean committed fresh build has 175 verified artifacts and five owned runtime edges, including the actual CLI bootstrap, in both the worktree and archive.

Finite CLI comparisons cover all nine corrected cookie-provider graphs, the valid alias graph, and General128. All 368 reports preserve complete selected-file coverage, full diagnostic objects and five-field framework context. Three positive graphs retain one cookie warning each; seven controls retain zero. General128 retains 256 full objects across 11 files. The original misplaced extraction graphs remain quarantined.

All 22 cold/hot comparisons qualified as measured and stable under the repository's material-change threshold, with no CPU +10% or RSS +20% review flags. Corrected case 1 cold median is 415.141→337.122 ms (CPU 0.67→0.57 s); case 3 is 421.547→330.723 ms (CPU 0.68→0.57 s). Signed fluctuations in quiet controls remain recorded. Dedicated captures retain all 39,681 CPU samples with no nonpositive offsets; cold primary rows are available in both revisions of all ten target graphs. Hot primary rows are unavailable, so attribution stays partial. These are finite local observations, not a universal performance guarantee.

Hosted parity and RDE were not run because the required credentials are unavailable. Exact-head CI and a new natural ready-for-review React Doctor run are tracked separately.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@2142

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@2142

npm i https://pkg.pr.new/react-doctor@2142

commit: 9e33830

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at a1b53f7 in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit a1b53f7.}