[aidenybai]

Why

Security words in an unrelated Error message should not make a sibling class's generic Math.random field look security-sensitive. The exception must preserve supported erased TypeScript names and keep warnings when the runtime provider is replaced or ambiguous.

What changed

• Keep the prose exception within its supported class, source-line and provider boundaries, with focused tests and synthetic regression coverage.
• Index string literals once and cache pure scope/name and symbol proofs, removing repeated scans found during review. Deterministic tests and native work probes cover positive and negative cache results and 32/128/512 input sizes.
• Reuse the lazy diagnostic-evidence fix from FPFNFIXAPEX: defer unused diagnostic evidence parsing #2177 so CLI evidence reads avoid loading TypeScript until syntax-aware evidence is needed. Patch changesets cover the changes.

Test plan

• Focused tests, full workspace tests, lint, typecheck, formatting, generated registry checks, a fresh five-package build and JSON smoke passed. The strict artifact audit recorded only the existing core declaration union-order variation; runtime JavaScript and the other 174 artifacts were unchanged, and the final artifact set was restored.
• Strict rule fuzzing passed with 500 configured iterations, seed 42 and require-fire enabled on the unchanged rule postimages. The final CLI evidence integration also passed its focused tests.
• Eight built CLI comparisons retained all 288 raw reports and exact diagnostic objects and framework context for each revision. The 87-file authored workload changes from 87 to 77 diagnostics against main; the repaired candidate preserves the prior repaired commit's objects. General controls retain 256 diagnostics across 11 analyzed files. Four 32/128 input controls retain zero crypto findings.
• All 16 local wall-time cohorts qualified, with no CPU or RSS regression flags. Against main, authored cold CPU changed from 0.98 to 0.87 seconds and hot CPU remained 0.67 seconds; general cold/hot CPU also decreased. These finite measurements replace neither the preserved earlier results nor broader runtime or performance guarantees. The scan-only crypto rule has no plugin-rule timing rows, so complete primary CPU attribution is not claimed.

Independent readback verified every retained report and CPU artifact. One signed sampling offset remains preserved; no complete measured CPU attribution is claimed.

Daytona parity was unavailable because DAYTONA_API_KEY is absent. No open-source parity, SDK execution or benchmark-wide performance result is claimed. This PR has not been merged.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@2152

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@2152

npm i https://pkg.pr.new/react-doctor@2152

commit: eee5d72

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at ca6b091 in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit ca6b091.}