FPFNFIXAPEX fix: detect effect resources in function declarations

[aidenybai]

Catches effect resources created inside called function declarations when their enclosing and recursive bindings use different scope symbols.

Why

useEffect(() => { function start() { setInterval(tick, 1000); } start(); }, []) can miss a cleanup warning. The declaration and its external call resolve to different symbol IDs, so the effect traversal skips the helper body.

What changed

• Match function bindings by their exact declaration node in the effect traversal. Preserve shadowing, reassignment, and uncalled or generator helpers.
• Check synchronous helper releases and single-call ownership for returned timer handles and disposers. Wrong handles, discarded returns, conditional releases, and async cleanup still warn.
• Add 32 synthetic regression cases and two safe fuzz fixtures. Include patch changesets for the CLI and both rule plugins.

Validation limits

Full parity is blocked because five required pinned repositories return HTTP 404. Paired sample parity and all CI checks passed. The local RDE harness also stops on missing AXIOM_DATASET; no telemetry configuration was changed.

Two private exact-source project comparisons add three reviewed cleanup warnings and remove none. Private corpus source is not included in this PR.

Eval results

Check	Result
Projects compared	6 pinned projects from 6 repositories
Skipped projects	0 within the selected sample
Added / removed	0 / 0
Unchanged diagnostics	466
Project performance regressions	0
Aggregate performance gate	Not established: sample is below the 10-project minimum

This sample does not satisfy the full corpus parity gate.

Test plan

• Full workspace tests: 12 tasks passed, including 28,257 plugin tests.
• nr typecheck, nr lint, nr format:check, and nr smoke:json-report: passed.
• Focused tests: 32 new cleanup cases plus 10 existing fetch traversal cases passed.
• Strict fuzz, seed 42, 500 iterations: 2,352 programs executed, 544 fired, no findings.
• Strict seed 1 retains one observer-wrapper invariant failure. The same reproducer warns on unchanged main; this is an existing failure, not a clean full fuzz result.

Keep this PR unmerged until the remaining validation gates are resolved.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/eslint-plugin-react-doctor@1960

npm i https://pkg.pr.new/oxlint-plugin-react-doctor@1960

npm i https://pkg.pr.new/react-doctor@1960

commit: e8617d5

[github-actions]

Interactive terminal E2E

Terminal Control verified the built CLI at e8617d5 in a real PTY:

• selected a project interactively and observed Scanning... before the three-second Git delay completed
• waited for the clean result and exercised the compact report
• opened copy context and the GitHub Actions confirmation, then cancelled safely

Download the edited MP4 and PNG evidence