feat: add source-patched native Oxlint path

.changeset/functional-state-rust.md

@@ -0,0 +1,7 @@
+---
+"oxlint-plugin-react-doctor": patch
+"eslint-plugin-react-doctor": patch
+"react-doctor": patch
+---
+
+Run `rerender-functional-setstate` natively in the patched Oxlint binding and avoid reporting a synchronous state update when the only other call to the same setter does not read that state.

.changeset/tidy-oxen-compile.md

@@ -0,0 +1,5 @@
+---
+"react-doctor": patch
+---
+
+Add an opt-in, source-patched Oxlint binding path with native rule parity, cache isolation, provenance metadata, and reproducible cross-platform build tooling.

.gitattributes

@@ -1,2 +1,3 @@
 packages/fuzz/corpus/react-bench-0.9.7-audit/** -text whitespace=-trailing-space
 packages/fuzz/corpus/dummy-threejs-v14-audit/** -text whitespace=-trailing-space
+native/oxlint/*.patch -text whitespace=-trailing-space

.github/workflows/native-oxlint.yml

@@ -0,0 +1,165 @@
+name: Native Oxlint
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "LICENSE"
+      - "native/oxlint/**"
+      - "scripts/native/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "packages/api/**"
+      - "packages/core/**"
+      - "packages/oxlint-plugin-react-doctor/**"
+      - "packages/react-doctor/**"
+      - "skills/**"
+      - ".github/workflows/native-oxlint.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "LICENSE"
+      - "native/oxlint/**"
+      - "scripts/native/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "packages/api/**"
+      - "packages/core/**"
+      - "packages/oxlint-plugin-react-doctor/**"
+      - "packages/react-doctor/**"
+      - "skills/**"
+      - ".github/workflows/native-oxlint.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  verify-patch:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - run: node scripts/native/build-oxlint-binding.mjs --check-only
+      - run: node --test native/oxlint/npm/react-doctor-rust/tests/*.test.js
+
+  build:
+    needs: verify-patch
+    timeout-minutes: ${{ matrix.runner == 'macos-15-intel' && 120 || 60 }}
+    env:
+      CARGO_BUILD_JOBS: 1
+      CARGO_INCREMENTAL: 0
+      CARGO_TARGET_DIR: ${{ github.workspace }}/target/native-oxlint
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            container: quay.io/pypa/manylinux_2_28_x86_64
+          - runner: ubuntu-24.04-arm
+            container: quay.io/pypa/manylinux_2_28_aarch64
+          - runner: macos-15-intel
+          - runner: macos-15
+          - runner: windows-2025
+    runs-on: ${{ matrix.runner }}
+    container: ${{ matrix.container }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "22.18.0"
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --prefer-offline
+      - uses: dtolnay/rust-toolchain@1.97.1
+        with:
+          components: rustfmt
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: native-oxlint-${{ matrix.runner }}${{ matrix.container && '-manylinux-2-28' || '' }}
+      - run: pnpm native:oxlint:build -- --output dist/native-oxlint
+      - run: pnpm --filter oxlint-plugin-react-doctor build
+      - run: pnpm native:oxlint:parity -- --directory dist/native-oxlint
+      - run: pnpm native:oxlint:scan-parity
+      - run: pnpm native:oxlint:project-parity
+      - uses: actions/upload-artifact@v7
+        with:
+          name: native-oxlint-${{ matrix.runner }}
+          path: dist/native-oxlint/*
+          if-no-files-found: error
+
+  package:
+    needs: build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "22.18.0"
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --prefer-offline
+      - run: pnpm exec turbo run build --filter=react-doctor
+      - uses: actions/download-artifact@v8
+        with:
+          pattern: native-oxlint-*
+          path: dist/native-oxlint-all
+          merge-multiple: true
+      - run: pnpm native:rust:assemble -- --artifacts dist/native-oxlint-all
+      - run: pnpm native:rust:pack
+      - uses: actions/upload-artifact@v7
+        with:
+          name: react-doctor-rust-packages
+          path: dist/react-doctor-rust-tarballs/*
+          if-no-files-found: error
+
+  smoke:
+    needs: package
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            node-version: "20.19.0"
+          - runner: ubuntu-24.04
+            node-version: "22.18.0"
+          - runner: ubuntu-24.04-arm
+            node-version: "22.18.0"
+          - runner: ubuntu-24.04
+            node-version: "20.19.0"
+            container: quay.io/pypa/manylinux_2_28_x86_64
+          - runner: ubuntu-24.04-arm
+            node-version: "20.19.0"
+            container: quay.io/pypa/manylinux_2_28_aarch64
+          - runner: macos-15-intel
+            node-version: "22.18.0"
+          - runner: macos-15
+            node-version: "22.18.0"
+          - runner: windows-2025
+            node-version: "22.18.0"
+    runs-on: ${{ matrix.runner }}
+    container: ${{ matrix.container }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ matrix.node-version }}
+          package-manager-cache: false
+      - uses: actions/download-artifact@v8
+        with:
+          name: react-doctor-rust-packages
+          path: dist/react-doctor-rust-tarballs
+      - run: node scripts/native/smoke-react-doctor-rust-package.mjs

native/oxlint/README.md

@@ -0,0 +1,36 @@
+# Source-patched Oxlint
+
+This directory contains a patch against one exact Oxc commit. It adds a `react-doctor-native` plugin while leaving the stock Oxlint JavaScript launcher and all unported React Doctor rules unchanged.
+
+The native rule cohort is listed in `upstream.json`, with one Rust source file per rule in `rules/`. React Doctor enables those rules only when `REACT_DOCTOR_NATIVE_OXLINT_BINDING_PATH` points to a built `.node` binding. Without that environment variable, scans use the published Oxlint binding and JavaScript rules exactly as before.
+
+## Build and verify
+
+```sh
+nr native:oxlint:verify
+nr native:oxlint:check
+nr native:oxlint:build
+REACT_DOCTOR_NATIVE_OXLINT_BINDING_PATH=dist/native-oxlint/<binding>.node nr native:oxlint:parity
+REACT_DOCTOR_NATIVE_OXLINT_BINDING_PATH=dist/native-oxlint/<binding>.node nr native:oxlint:parity --benchmark
+REACT_DOCTOR_NATIVE_OXLINT_BINDING_PATH=dist/native-oxlint/<binding>.node nr native:oxlint:parity --corpus packages/fuzz/tmp/corpus-repos
+```
+
+Set `CARGO_BUILD_JOBS=1` and `CARGO_INCREMENTAL=0` for the compile-check and release build on memory-constrained builders.
+
+`native:oxlint:verify` clones the pinned tag, checks its commit, and proves the patch still applies. `native:oxlint:check` overlays every native rule, regenerates Oxc's rule registry, and compile-checks the linter. `native:oxlint:build` performs the same source assembly, compiles and loads the N-API binding, and writes the binding plus provenance and SHA-256 hashes to `dist/native-oxlint`.
+
+The parity check runs the JavaScript and native implementations over the same adversarial TypeScript fixture and compares normalized diagnostics. It also runs isolated cases from `fixtures/ast-parity-boundaries.json`, including multiple files in one process and cross-file parser limits. Each case pins the canonical diagnostic count and compares messages, severity, filenames, spans, and multiplicity; unexpected parser or plugin diagnostics fail the check. Pass `--corpus` with a directory of repositories to compare every repository independently. A native rule should not be added to `nativeRules` or `NATIVE_REACT_DOCTOR_RULE_IDS` until both checks pass.
+
+The workflow builds artifacts for Linux x64/arm64, macOS x64/arm64, and Windows x64. It does not publish them. Shipping or making the native patch the default should happen only after corpus parity shows no diagnostic drift and benchmarks show at least a 15% p50 lint improvement.
+
+## Experimental package
+
+`react-doctor-rust` is a separate launcher for the source-patched binding. It does not change the `react-doctor` package, fails before startup when the matching native package is missing or incompatible, and exits on native analysis failures instead of falling back to TypeScript.
+
+The native workflow builds, verifies, packages, and smoke-tests Linux glibc x64/arm64, macOS x64/arm64, and Windows x64 independently. Every platform runs exact fixture parity, native scan parity, and native project-analysis parity before its artifact can enter the package assembly job. The assembly job verifies the recorded binding and patch SHA-256 hashes and a fingerprint of the current native sources, upstream manifest, build generator, and native CI configuration. Stale artifacts require a rebuild, including artifacts created before source fingerprinting. The fingerprint normalizes checkout line endings across platforms. Assembly generates one optional platform package per target and emits packed tarballs plus `SHA256SUMS`. Each target then installs and scans with those exact tarballs on its native runner.
+
+Both Linux architectures build in official PyPA `manylinux_2_28` containers to target glibc 2.28. These images use AlmaLinux 8; see the [manylinux image documentation](https://github.com/pypa/manylinux#manylinux_2_28-almalinux-8-based). The eight tarball smoke jobs cover both architectures on this baseline with Node 20.19.0, current Ubuntu runners, both macOS architectures, and Windows x64. Linux Cargo caches are isolated from host builds so newer glibc artifacts cannot enter the baseline build through the cache.
+
+The package remains private and CI-only until a separately approved release workflow publishes it under the `experimental` npm tag. A release assembly must pass both `--version` and `--react-doctor-version`; that exact `react-doctor` version must already be published with required-native execution support. Publishing must remove `private` from the launcher and all platform packages, publish the five platform packages before the launcher, and preserve the shared version.
+
+The packed CI smoke installs explicit local tarballs to validate their contents. After publishing, run `nr native:rust:smoke -- --package react-doctor-rust@<exact-version>` on every supported runner. That mode installs only the registry launcher, proving npm selects its current platform binding and resolves the compatible `react-doctor` dependency. Do not promote the experimental tag until every postpublish smoke passes. Musl and other targets are unsupported until they have native build and install smoke lanes.