[aidenybai]

An effect could finish an OIDC getUser().then(setUser) chain without a rejection handler, even though native browser storage can contain malformed user data. Recognize direct oidc-client UserManager reads backed by native local/session storage and one immutable local facade, while checking constructor imports, storage configuration, mutation paths and existing rejection handlers.

Cache manager-origin proofs by program, scope, root symbol and filename. Capture and replay module-resolution dependencies, invalidate on filesystem generations, and keep per-call syntax checks outside the cache. Regression tests cover warm probe replay and equal-size provider edits with restored timestamps; a growth test verifies one provider proof is reused across consumers. Stacked on #1994 at 898e6d3c6496f94a83b22f0956ce40419a950197, including the parser-reset prerequisite from #2158 and patch changesets.

Validation on the final committed source: full tests, lint, typecheck, formatting, registry checks, five fresh build tasks with no cached tasks, JSON schema smoke, and strict target fuzz with 500 configured iterations and seed 42 passed. Native cache/mutation controls and independent source review passed. The committed source and all 175 runtime artifacts match the checked build.

Public CLI comparisons against the actual stacked base covered 49 authored controls, accepted/refused 32- and 128-consumer workloads, and general128. Six intended authored warnings were added, unrelated diagnostic objects stayed identical, and general128 retained all 256 objects. New analysis work increased accepted cold time from 323.40→428.68ms at 32 consumers and 330.04→456.58ms at 128; user CPU was 0.49→0.65s and 0.50→0.72s. Hot times decreased. Native provider work is linear after the repair. All five cold/hot families met the existing wall thresholds, with no discarded CPU samples or noise retries. These finite measurements include the cost of newly enabled diagnostics; they do not establish universal performance parity. Remote parity credentials were unavailable, so remote parity was not run. No merge or release.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@2187

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@2187

npm i https://pkg.pr.new/react-doctor@2187

commit: dbf4cf5

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit dbf4cf5.}