[aidenybai]

Why

A synchronous updater can copy an ordinary primitive array with previous.slice(), change one element on that fresh local copy, and return it without an external side effect. The bounded exception retains warnings when the copy/state escapes, the element or index is not proven primitive, or provider integrity is unsupported.

What changed

• Recognize only the finite three-statement slice/write/return shape; preserve the authored main detector and provider constants.
• Resolve real runtime bindings through inert TypeScript declarations using the existing shared classifier/resolver. Reject destructuring writes to primitive parameters while retaining computed index reads.
• Decline same-module or unknown runtime loader exposure of React and the selected imported producer. Preserve genuine local loaders, foreign module controls, and the existing ordinary imported named producer trust boundary.
• Cache immutable program/import-source and symbol proofs. Three independent 20/100-consumer work profiles are linear, including repeated imported producer calls; rejection controls retain their warnings.
• Keep patch changesets and add focused, fuzz and deterministic work regressions.

Validation

• Frozen-tree checks passed: 360 focused tests; all 12 test tasks (34283 passed/1118 skipped, uncached); all 10 typecheck tasks uncached; lint, format, registry freshness, build and JSON smoke.
• Strict fuzz: 500 iterations, seed 42, 2242 programs, 313 fires, no findings; fuzz smoke and all 3 recognized new regression fixtures pass.
• Independent 75-file API/CLI comparisons complete in default/targeted profiles: targets 43→52 (15 explained target changes, net +9); default profile adds only two independently reviewed shared-semantic corrections (state mutation/render setter), preserves every previous non-target object; targeted non-target objects unchanged.

The authored ambient-eval control is rejected by the native parser (Cannot assign to eval in strict mode); it is reported as a parser exclusion, not preserved detector behavior. The other 49 authored controls preserve their complete target-rule native diagnostics and locations. The 26 valid review controls have 15 intentional target changes: three false positives removed, eight visible provider-loader hazards and four primitive binding writes restored as warnings. Independent ownership/work controls also preserve complete native diagnostics.

The actual API/CLI comparison uses 75 valid synthetic files under both default and explicitly enabled target profiles. Native arrays and ordinary imported producer modules remain explicit trust boundaries. This is bounded synthetic validation, not an exhaustive-state or full-corpus parity claim. ECMAScript's slice algorithm uses species construction and property reads; constructor/prototype/reflection hazards therefore remain outside the admitted profile.

Fresh full sandbox parity could not run: this revision's run-parity skill requires Vercel token/OIDC plus team/org and project credentials, which are absent. The original Daytona credential is also absent.

Integration

Read-only overlap checks against the current updater siblings #1967, #1969 and #1972 preserve each detector change and this exemption, pairwise and together. Shared canonical files and changeset are byte-identical. No new merge-order dependency is implied; validate the eventual integrated branch.

The final Windows run exposed the existing HostedCart seven-scan integration test exceeding its 30-second allowance. This PR includes only the previously reviewed scoped 60-second test allowance, preserving all seven scans/assertions and all reviewed runtime hashes. The new tree passed fresh uncached 12-task tests/all 10 typechecks and all focused, lint/format/registry, strict 500 fuzz, native/API/CLI, build and JSON-smoke checks. Its two-file normal hook uses the validated local CLI without downloading a published fallback. This overlaps the timeout-bearing siblings: when combining with #2076, preserve its isolated scenarios rather than restoring the old seven-scan loop.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@2086

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@2086

npm i https://pkg.pr.new/react-doctor@2086

commit: cbfe782

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at cbfe782 in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit cbfe782.}