[aidenybai]

Why

A readonly local callback passed to window.addEventListener("message", receive) can read an unchecked cross-window payload. Inline callbacks were covered, but the named callback route was missed.

What changed

• Resolve supported readonly local callbacks and direct payload acquisitions, including event destructuring. Preserve sender guards, runtime shadows, writes, and unsupported identities.
• Keep erased-only TypeScript names from hiding the actual callback or global window. Runtime and ambient value contracts decline the new proof, including unindexed ambient function declarations.
• Add focused boundary tests, synthetic corpus fixtures and generator coverage, and patch changesets.

Test plan

• Fresh local build, full tests, typecheck, lint, formatting, generated registry check and JSON report smoke passed. The full test graph ran all 12 tasks with zero cached tasks.
• Strict target fuzzing passed with 500 configured iterations, seed 42 and require-fire enabled. Numeric iteration and activation statistics were not printed.
• Separate built API and CLI scans covered all 58 synthetic files in both an explicit target configuration and the default configuration, with no skipped checks. Review repairs add two intended target warnings (8 → 10); every retained diagnostic and every other-rule diagnostic retains its content and order. The actual base emits zero target warnings on these inputs.
• Source review and tests cover erased names, runtime companions, provider replacement, constructor defaults and ambient callback identities. These checks do not establish arbitrary heap integrity or real React mount behavior.

Remote pull request parity could not run because DAYTONA_API_KEY is unavailable. No open-source parity or performance result is claimed. This PR is prepared for review and merge; it has not been merged.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@2148

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@2148

npm i https://pkg.pr.new/react-doctor@2148

commit: 8c8ce9a

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at 8c8ce9a in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence