[aidenybai]

Why

A state updater can safely replace entries in a local record when a flag consistently tracks whether that record has been copied. The previous check missed the correlation between a fresh-or-borrowed initializer, each guarded copy, the replacement, and the following flag commit.

What changed

• Recognize the closed mixed-initializer copy pattern while preserving warnings for borrowed-child mutations, escaped aliases, captures, and incomplete write sequences.
• Reuse the shared runtime-value binding resolver so TypeScript-only interfaces cannot hide the copy flag, React hook, or setter. The authored copy-proof helper, its 24 boundary cases, and its two corpus fixtures remain unchanged during review.
• Add focused binding regressions, a synthetic erased-copy-flag pass fixture, and one generator with an unsafe activation control.

Test plan

• 267 focused tests across seven files; package typecheck passed.
• Full suite: 34,215 passed, 1,118 skipped. Uncached 12-task test and 10-task type graphs, fresh five-task build, lint, format, registry, fuzz smoke, and JSON smoke passed.
• Strict target fuzz: one run with 500 configured iterations, seed 42, and require-fire enabled. Numeric execution/fire counters were not emitted; no statistics-only rerun.
• Compiled native and four actual API/CLI profiles replayed 37 source contexts. Submitted-head → reviewed target diagnostics: 58 → 56, with six removals across three witnesses of one copy-flag false-positive class and four restored warnings across two unsafe binding contexts. All retained complete objects, ordering, multiplicity, locations, and CLI identities matched. Three unrelated default diagnostics remained exact; target-only profiles had none. Public project metadata used React 19.2.6; native settings remain separately qualified.
• All native inputs were strict-parser valid. Three actual corpus files and the actual generator/control passed their selected-rule checks. Ten changed native diagnostic ranges matched whole assignment nodes.
• The staged local CLI scan covered 11 files with zero diagnostics. Its framework was unknown and React metadata absent, so this does not establish target activation.

These are finite synthetic controls, not exhaustive-state, CPU-performance, or real-repository parity evidence. Local RDE is blocked by the absent sister checkout and an empty repository cache. Remote Vercel parity requires authentication that is unavailable; the pushed-head preflight at 044afb5a confirms that blocker.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@2124

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@2124

npm i https://pkg.pr.new/react-doctor@2124

commit: 044afb5

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at 044afb5 in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence