[aidenybai]

Static array/object initializers that invoke a value-imported function must keep their render-time evaluation. The rule conservatively withholds module-scope hoist advice for a nonoptional bare imported call, including a closed readonly const alias chain.

This review fixes erased TypeScript declarations masking actual imported readers and destructuring assignments masking alias writes. Immutable readonly/origin caches avoid rescanning the same imported references and alias chains while preserving declaration order at every use and initializer link. Existing authored main-rule logic and source-presence exclusions remain intact.

The rule remains disabled by default. Pure or dead imported calls can deliberately withhold advice; imported-function purity is not inferred. Namespace/member/optional calls, constructors, tagged templates and type-only imports stay outside this route.

Validation on tested tree ea6611314429a25465e2a7734c716b1a617d0b4e:

• 257 focused assertions pass, including four cold-work controls and both cache visitation orders.
• Uncached whole graphs: 34,241 tests pass, 1,118 skip; all 12 test tasks, all 10 typecheck tasks and all 5 build tasks pass with zero cache hits. Lint, format, generated registry and built JSON smoke pass.
• Strict 500-iteration fuzzing, seed 42, passes with FUZZ_REQUIRE_FIRE=1. Numeric counters are not available from the test wrapper; this is the positive-liveness gate.
• All 34 authored cases and the two original corpus sources retain full native/API/CLI diagnostic objects. The 49-file exact-byte review union has only two approved additions and two removals, including the actual formatted regression seeds; unrelated diagnostics remain unchanged.
• Both actual API/CLI profiles explicitly enable this opt-in rule with customRulesOnly: false. The target-only and other-default-rules profiles complete all files; unconfigured-default behavior was not measured.
• All four final synthetic corpus files are recognized by the real loader and directly replayed. The original two missing verdict directives are preserved as review evidence and repaired.

Cold deterministic 20/100 probes retain quiet admission and warning controls: direct imported-reference visits fall from 400/10,000 to 20/100, and deep alias-reference visits from 780/19,900 to 39/199. These are work counts, not timing measurements.

Fresh full sandbox/corpus parity remains unavailable without credentials. The bounded synthetic comparisons do not establish full-corpus parity. Patch Changesets are included. No merge or release is requested.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@2099

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@2099

npm i https://pkg.pr.new/react-doctor@2099

commit: df93337

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at df93337 in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence