feat: add source-patched native Oxlint path - #1664

Add an experimental react-doctor-rust launcher backed by a source-patched Oxlint 1.79.0 binding. The build overlays native rules onto one pinned Oxc commit. The existing TypeScript CLI supplies project discovery, configuration, suppression, and reporting.

Production CLI comparisons exposed missing and extra diagnostics despite complete rule registration. This change restores canonical callback, ref, memo, cleanup, asynchronous control-flow, dependency, and cross-file resolution behavior. Required-native execution rejects missing, incompatible, malformed, and failed analysis instead of silently falling back. Package assembly checks binary hashes and native source fingerprints before accepting artifacts.

Latest corrections

• no-pass-data-to-parent distinguishes inline callback parameters from local aliases and ordinary prop member receivers, preserves named-wrapper and debounce alias behavior, follows nested ref calls, and handles callbacks returned by useMemo while ignoring type-only parameter references.
• js-set-map-lookups reuses the existing binding initializer resolver so string defaults and destructured sources retain their canonical behavior.
• no-adjust-state-on-prop-change handles destructured state setters, state snapshot refs used as guards, deferred initializer callbacks, and the canonical uppercase callback-binding boundary.
• Installed-package smoke requires a complete, nonblocking v3 success report with native AST, graph, and security diagnostics. Six failure injections verify missing packages, mismatched versions, missing exports, and malformed security, graph, and duplicate JSX results. Runtime failures must exit 1 and report the expected incomplete public analysis check.

New regression and firing seeds are handwritten. Benchmark source is not copied into the fuzz corpus. Existing fixtures and fuzz invariants remain intact.

Main synchronization and canonical differences

The branch includes main through ff7dd679e8b9939a7dd8f828a530559a275836f7, including owned cleanup paths, cancellation guards, per-call GET helper safety, magic-link mutation exemptions, and compiler opt-out handling.

Canonical TypeScript still intentionally differs from that revision in seven detector files across four changes:

• Guard memo() with no argument against a crash while retaining its diagnostic (3ced1c98d).
• Bound hydration parameter resolution across execution contexts to stop argument cycles (82a4d2645).
• Support Windows filename separators in four React Router rules (b404f030e).
• Limit synchronous arithmetic/update warnings in rerender-functional-setstate to another same-setter call that reads state, ignoring nested function calls (72fd97b2a).

Dedicated regression tests cover all four groups. Shared canonical AST/provenance helper implementations are unchanged from main; shared rule metadata marks five already disabled rules as retired. Core native dispatch, normalization, caching, analysis, and failure gating also differ. This is not a claim that the TypeScript engine is identical to main apart from crash guards.

Coverage and verified local checks

Coverage remains 906 canonical rules: all 864 AST rules and 41 of 42 scan rules are native-backed, representing 905/906 canonical behaviors and 55/56 Security rules, with 1,734 generated Oxc implementations. The sole deliberate exclusion is local-rpc-native-bridge-risk. postmessage-origin-risk retains its canonical WebSocket, Worker, MessagePort, BroadcastChannel, and EventSource suppressions.

Final optimized release validation at 56f576b82c7b03d173350ee95827c58527a80b6c uses native source fingerprint 5bccdfec928a551e219b962eba0eb0202601b2cb73479fd1bc34706f2f223c95 and binding SHA-256 17890718768463e43173b0b98d8d8134bc521d36873ad90d69a4e811f1e8c25f.

The final installed smoke used private 0.0.0 native packages and the real CLI/plugin packages. Its artifacts are in tmp/native-smoke-hardening/local-darwin-Y9DEey; the release validation manifest is tmp/native-full-parity-2f4568744/final-release-validation.json. This validates the local Darwin package; it does not substitute for all-target assembly or the eight CI installation smokes.

Retained failures and evidence limits

The final production CLI run at 56f576b82 completed all 48 repositories: 44 repositories / 197 projects matched exactly, with zero diagnostic differences among complete reports; four repositories returned incomplete reports in both engines. The five previously differing repositories now all pass, including Supabase's 13 projects and 4,346 full diagnostic objects. Source, binding, and built CLI fingerprints remained unchanged throughout the run. Runtime coverage passed: all 41 retained scan rules were requested, 366 native AST spawns and 145 native duplicate JSX calls were observed, and a separate graph-enabled CLI scenario fired all six graph rules exactly through the native project worker.

The four completeness failures are retained: Leemons has an invalid settings.react.version; Reactide exceeds the one-million-character source limit; Twenty exceeds the 5,000-file and source-length limits; Next.js exceeds those limits and contains an invalid UTF-8 fixture. The incomplete reports contain identical diagnostic objects and multiplicities too (7, 91, 2,318, and 3,279 respectively), but remain failed completeness checks. The report validator and analysis limits were not weakened. Evidence: tmp/native-full-parity-56f576b82/integrated-2026-09-06T02-54-22.375Z/summary.json and incomplete-diagnostic-audit.json.

Historical confirmed totals remain 181,665 integrated diagnostics and 522,000 strict required-fire fuzz mutations. These are historical evidence, not totals for the pending final-head run. Later focused checks and changed corpus selections do not replace them or establish updated performance claims.

The canonical cleanup invariant at seed 1000234, iteration 231 remains unfixed, with its failure artifact and reproducer preserved. Extracting stored-observer cleanup into a local helper changes both engines from zero diagnostics to one. The canonical cleanup detector is unchanged from main at ff7dd679e. A green fuzz run after corpus additions can select different mutations and does not erase this failure or weaken the invariant.

Independent Daytona comparison between main at ff7dd679e and final head 56f576b82 matched 128,776 diagnostic identities per lane across 43 validated, unredacted repositories: zero additions and zero removals, with matching repository pins, evaluator/configuration contracts, and project coverage. This is a separate TypeScript main-versus-PR check; local same-revision TypeScript-versus-native evidence is reported above.

The complete remote 48-repository verdict remains unavailable. Baseline Supabase Studio hit the canonical hydration argument-cycle stack overflow; the candidate produced a valid Supabase report, but its saved strings were sanitized and cannot support exact comparison. Cal.com, Outline, and Twenty were sanitized in both lanes and are excluded too. Next.js failed in both lanes; candidate attempts retained two invalid-UTF-8 validator rejections and two command timeouts. Baseline and candidate had zero malformed rows, but both lanes remain incomplete under the unchanged validator. The two reported task-owned sandbox cleanup timeouts and the run's snapshot were subsequently confirmed absent. Evidence: tmp/parity-independent-recovery/independent-valid-comparison-56f576b82.json and independent-final-attribution-56f576b82.json.

At the previous pushed head 2f4568744, all five native platform builds and parity checks passed, but the Intel artifact upload failed on DNS and a Windows eval worktree test hit its unrelated five-second timeout. These observations do not validate the final commit or imply that the entire earlier CI run passed.

Final-head work still pending

This remains a draft PR. This private native and internal validation work adds no Changeset. No merge, publication, release tag, or package release is performed.