[aidenybai]

Why

Chart.js supports updating instance options in place before update("none"). A closed construction → state feed → guarded update pattern should not be reported as ordinary React state mutation. The exception is limited to the supported color paths, actual React/Chart bindings, configuration coverage, and closed cleanup/reference roles. Chart.js update contract.

What changed

• Recognize the finite Chart options update role while retaining reports for unsupported writes, runtime shadows, type-only providers, global hazards, and ambiguous constructions.
• Resolve runtime bindings across erased TypeScript declarations. Cover interfaces/type aliases and local values named Proxy, Function, or require with synthetic regressions.
• Cache the assignment certificate by scope analysis, state symbol, and effect, retaining declarator/component identity guards and checks for the current profile and selected assignment.
• Add correctness, bounded work-count, context, API/CLI and fuzz controls. Retain patch changesets for the three published packages.

Validation

Current head: 5db34b9.

• 176 focused tests across seven modules passed. The full suite passed all 12 test tasks: 34,247 tests passed and 1,118 skipped. All 10 typecheck tasks and five build tasks passed without cached tasks. Lint, formatting, generated-registry and JSON-report smoke checks passed.
• The 57-source comparison against the preceding implementation removes 14 target findings, 43 → 29, across default and targeted API/CLI profiles. All 222 prior default non-target diagnostic objects remain exact. Six existing-rule findings are restored where an erased interface previously hid the runtime useEffect binding. The default CLI retains its expected diagnostic-policy exit 1.
• Two separate whole-source rule checks against cached base results changed 8 → 0 and 12 → 0, with no parse errors. These checks parse source as data; they do not execute the applications.
• A fresh revision-local sample against 84ad0c8 completed 20 roots across six repositories and 1,721 analyzed files. All 3,308 diagnostic objects are unchanged: zero added or removed. This is a finite sample, not full-corpus parity or a performance result.
• Strict fuzzing ran once with 500 configured iterations, seed 42 and positive-fire requirement enabled. Numeric execution/fire totals were not emitted; no branch-coverage count is claimed.

Standard lint retains 35 warnings on owned synthetic fixtures and zero owned production warnings. Seven unused fixture parameters are being cleaned up separately; collision-test declaration names and behavioral regression inputs remain intentional. A separate staged scan retained seven static-import advisories on synthetic provider fixtures under an unknown React profile; those advisories do not establish target activation.

The work-count tests provide bounded operation-count evidence. Synthetic profiles and the finite repository sample do not certify arbitrary Chart mutations, installed versions, whole-rule complexity or application runtime behavior.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@2110

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@2110

npm i https://pkg.pr.new/react-doctor@2110

commit: 5db34b9

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at 5db34b9 in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence