@rdjperron/lint 0.2.0 → 0.5.0

package/README.md

@@ -1,46 +1,40 @@
 # @rdjperron/lint
 
-One Oxlint JS plugin, `rdj`, with twenty rules against low-evidence code, the config data a
+One Oxlint JS plugin, `rdjperron`, with twenty rules against low-evidence code, the config data a
 project spreads into its own `vite.config.ts`, and the check that proves every rule still fires.
 
-| Entry                        | What it gives you                                                                    |
-| ---------------------------- | ------------------------------------------------------------------------------------ |
-| `@rdjperron/lint`            | The plugin. One `jsPlugins` entry, one prefix, twenty rules.                         |
-| `@rdjperron/lint/config`     | `recommended`, the override builders, and the `fmt`, `ignore` and `staged` blocks.   |
-| `@rdjperron/lint/verify`     | `verifySuites`, `packageSuite`, `verifyPluginApiPin`, and the `rdj-lint-verify` bin. |
-| `@rdjperron/lint/fixtures/*` | One deliberately violating file per rule, the input the verify command lints.        |
+| Entry                    | What it gives you                                                                  |
+| ------------------------ | ---------------------------------------------------------------------------------- |
+| `@rdjperron/lint`        | The plugin. One `jsPlugins` entry, one prefix, twenty rules.                       |
+| `@rdjperron/lint/config` | `recommended`, the override builders, and the `fmt`, `ignore` and `staged` blocks. |
+| `rdjperron-lint-verify`  | The command that proves every rule still fires. No config, no arguments.           |
 
 Seventeen of the rules are a copy of [dmmulroy/anti-slop](https://github.com/dmmulroy/anti-slop),
-owned and edited here (`src/anti-slop/VENDORED.md` in the source repo records the commit). The
+owned and edited here (`src/anti-slop/VENDORED.md` in this repository records the commit). The
 other three are written here.
 
-Tested on vite-plus 0.3.1, oxlint 1.81.0 and `@oxlint/plugins` 1.79.0 (2026-09-17).
+Measured on vite-plus 0.3.0, 0.3.1, 0.3.2 and 0.3.3, which is oxlint 1.79.0 through 1.83.0
+(2026-09-19). All twenty rules fired on all four.
 
 ## Install
 
 ```bash
-npm install --save-dev --save-exact @rdjperron/lint @oxlint/plugins@<version>
+npm install --save-dev --save-exact @rdjperron/lint
 ```
 
-The rules import `defineRule` and the AST types from `@oxlint/plugins`, a peer dependency. Its
-version has to match the plugin API of the linter that loads the rules. Under Vite+ that linter
-is inside the `vp` binary, and the authority is the version `vite-plus` declares, not npm latest
-and not the bundled oxlint version:
+That is the whole installation. `@oxlint/plugins`, which the rules import `defineRule` and the AST
+types from, is an ordinary dependency here and arrives with the package; there is no version of it
+for you to pin or to move.
 
-```bash
-vp why @oxlint/plugins
-# or: node -p "require('vite-plus/package.json').dependencies['@oxlint/plugins']"
-```
-
-Pin `@oxlint/plugins` exactly to that number. The peer range here is a caret, so an exact pin
-anywhere in the same major satisfies it. Move the pin every time `vp` moves; `rdj-lint-verify`
-fails when the two drift apart.
+`vite-plus` is an optional peer, `>=0.3.0`, so a project on plain oxlint can still load the plugin.
+The floor is `react()`, not the rules: oxlint 1.77.0, which vite-plus 0.2.9 declares, has no
+`react/immutability`, `react/purity` or `react/refs`, and refuses to build a config that names them.
 
 ## Use it
 
 ```ts
 // vite.config.ts
-import { fixtures, fmt, ignore, react, recommended, staged, tests } from "@rdjperron/lint/config";
+import { fmt, ignore, react, recommended, staged, tests } from "@rdjperron/lint/config";
 import { defineConfig } from "vite-plus";
 
 export default defineConfig({
@@ -48,26 +42,25 @@ export default defineConfig({
   fmt: { ...fmt, ignorePatterns: ignore },
   lint: {
     extends: [recommended],
-    plugins: ["typescript", "unicorn", "oxc", "import", "promise", "node"],
-    categories: { correctness: "error", suspicious: "warn", perf: "warn" },
     env: { builtin: true, node: true },
     overrides: [
       ...react(["app/**"], { useEffectAllowedIn: "hooks/use-mount-effect.ts" }),
       ...tests(["**/*.test.ts", "**/*.test.tsx"]),
-      ...fixtures(),
     ],
-    options: { typeAware: true, typeCheck: true },
+    options: { typeCheck: true },
     ignorePatterns: ignore,
   },
 });
 ```
 
-`jsPlugins` needs no entry: `recommended` carries it. Registering by hand works too, in either
-form, because the plugin declares its own `meta.name`:
+`jsPlugins`, `plugins`, `categories` and `options.typeAware` need no entry of their own:
+`recommended` carries all four, and they come through `extends`. `options` merges key by key, so
+writing `options: { typeCheck: false }` keeps the inherited `typeAware`. Registering the plugin by
+hand works too, in either form, because it declares its own `meta.name`:
 
 ```ts
 jsPlugins: ["@rdjperron/lint"];
-jsPlugins: [{ name: "rdj", specifier: "@rdjperron/lint" }];
+jsPlugins: [{ name: "rdjperron", specifier: "@rdjperron/lint" }];
 ```
 
 ### What `extends` carries, and what it does not
@@ -80,98 +73,222 @@ Measured on vite-plus 0.3.1 and oxlint 1.81.0 (2026-09-17), with a base config o
 | `jsPlugins`, `rules`, `overrides`, `plugins`, `categories`, `options` | yes, and the consumer's own entries win |
 | `env`, `settings`, `ignorePatterns`                                   | no, the consumer writes its own         |
 
-So `recommended` carries a plugin entry and rules, nothing else. Write `plugins`, `categories`,
-`env`, `options` and `ignorePatterns` in your own config; `ignore` is an array you spread into
-`ignorePatterns`, not a field you inherit.
+So `recommended` carries everything on the inherited side: the plugin entry, the rules, the plugin
+set, the categories and `options.typeAware`. What is left to you is `env` and `ignorePatterns`;
+`ignore` is an array you spread into `ignorePatterns`, not a field you inherit.
+
+`options` is the one field that could read either way, so it was measured on its own (2026-09-19):
+it merges key by key. A base carrying `{ typeAware: true }` and a consumer writing
+`{ typeCheck: false }` leaves `typeAware` on. Only naming `typeAware` yourself overrides it.
 
-Two more things oxlint does quietly. An override that changes a built-in plugin's rule must
-repeat that plugin in its own `plugins`, even when an earlier override already listed it, or the
-entry is dropped with no error. And a relative plugin specifier inside an `extends` object is
-refused; a package name is what works.
+Two more things oxlint does quietly. An override that names a rule of a plugin the config does not
+enable has to add that plugin in its own `plugins`, or the entry is dropped with no error; a plugin
+already in the top-level set needs no repeating, and an override's `plugins` adds to that set rather
+than replacing it (measured on vite-plus 0.3.1 and oxlint 1.81.0, 2026-09-19). And a relative plugin
+specifier inside an `extends` object is refused; a package name is what works.
 
 ### The config exports
 
-| Export                   | What it is                                                                                                                                                                                                |
-| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `plugin`                 | `{ name: "rdj", specifier: "@rdjperron/lint" }`.                                                                                                                                                          |
-| `RULE_IDS`, `RuleId`     | The twenty prefixed ids, as a readonly tuple and as a type.                                                                                                                                               |
-| `recommended`            | The config object for `lint.extends`: the plugin entry, the rules below, and the built-in choices.                                                                                                        |
-| `react(files, options?)` | Browser globals, the hooks rules and the compiler's rules. `options.useEffectAllowedIn` names the one file allowed to call `useEffect`, puts its name in every finding, and switches the rule off for it. |
-| `i18n(files, options?)`  | `rdj/no-hardcoded-jsx-text` at error. `options.pattern` sets the word pattern.                                                                                                                            |
-| `expo(files)`            | `rdj/static-public-env` at error.                                                                                                                                                                         |
-| `tests(files)`           | `any`, `!`, `no-runtime-typeof` and the safety-comment rule off, with the reason on each.                                                                                                                 |
-| `fixtures(view?)`        | Every rule at error on the verify view, `scripts/.lint-fixtures/**` by default.                                                                                                                           |
-| `fmt`                    | `printWidth` 100, double quotes, semicolons, two spaces.                                                                                                                                                  |
-| `ignore`                 | Dependencies, build output, the AI agent directories and the Vitest JSON report.                                                                                                                          |
-| `staged`                 | `vp check --fix` on JS and TS sources.                                                                                                                                                                    |
+| Export                      | What it is                                                                                                                                                                                                                                                                                                                                                                   |
+| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `plugin`                    | `{ name: "rdjperron", specifier: "@rdjperron/lint" }`.                                                                                                                                                                                                                                                                                                                       |
+| `RULE_IDS`, `RuleId`        | The twenty prefixed ids, as a readonly tuple and as a type.                                                                                                                                                                                                                                                                                                                  |
+| `recommended`               | The config object for `lint.extends`: the plugin entry, the rules below, the built-in choices, the plugin set, the categories and `options.typeAware`.                                                                                                                                                                                                                       |
+| `react(files, options?)`    | The hooks rules, the compiler's rules and the globals. `options.env` is the environment those files run in, `{ browser: true }` by default, so a React Native consumer names its own. `options.useEffectAllowedIn` names the one file allowed to call `useEffect`, puts its name in every finding, and switches both `no-use-effect` and `react/exhaustive-deps` off for it. |
+| `i18n(files, options?)`     | `rdjperron/no-hardcoded-jsx-text` at error. `options.pattern` sets the word pattern.                                                                                                                                                                                                                                                                                         |
+| `expo(files, options?)`     | The React Native facts: `static-public-env` at error, `typescript/no-require-imports` relaxed for asset extensions, `unicorn/no-array-sort` off. `options.assetExts` adds your `metro.config.js` extensions, `options.reactFiles` adds the two `react/*` rules an Expo app needs.                                                                                            |
+| `restrictedImports(…)`      | One `no-restricted-imports` override per file set, expanded from one declaration. See below.                                                                                                                                                                                                                                                                                 |
+| `tests(files)`              | `any`, `!`, `no-runtime-typeof` and the safety-comment rule off, with the reason on each.                                                                                                                                                                                                                                                                                    |
+| `decoders(files, options?)` | `no-runtime-typeof` and `no-unknown-parameters` at error everywhere, each hinting at the files in `files`, and `no-runtime-typeof` off inside them. `options.hint` replaces the generated sentence.                                                                                                                                                                          |
+| `fmt`                       | `printWidth` 100, double quotes, semicolons, two spaces.                                                                                                                                                                                                                                                                                                                     |
+| `ignore`                    | Dependencies, build output, the AI agent directories and the Vitest JSON report.                                                                                                                                                                                                                                                                                             |
+| `staged`                    | `vp check --fix` on JS and TS sources.                                                                                                                                                                                                                                                                                                                                       |
 
 `recommended` puts every rule at `error` except `no-hardcoded-jsx-text` and `static-public-env`,
 which belong to a translated app and to an Expo app and are left to `i18n()` and `expo()`. The
 measurements behind those severities are in the comments beside them.
 
+### `restrictedImports`, one declaration for every file set
+
+Two overrides matching one file do not merge. The later one replaces the rule's whole entry, so
+every file set needs `no-restricted-imports` written out in full. A repo with ten file sets
+restates the same list ten times, and a new ban has to be added to all ten. Forget one and that
+file set silently keeps importing what the others may not.
+
+Here each entry is named once and each scope says which scope it starts `from`, what it `add`s and
+what it `drop`s. Nothing is matched by glob and nothing is guessed: one override comes out per
+scope, in the order you declared them, so you declare broad to narrow.
+
+```ts
+const RN_TEXT = { name: "react-native", importNames: ["Text"], message: "Text goes through <T role>." };
+const RN_ALERT = { name: "react-native", importNames: ["Alert"], message: "lib/alert.ts answers on both targets." };
+const SCHEMA = { group: ["**/convex/schema"], message: "convex/validators.ts is what the client reads." };
+
+...restrictedImports({
+  paths: { RN_TEXT, RN_ALERT },
+  patterns: { SCHEMA },
+  scopes: {
+    all: { files: ["**"], use: ["RN_TEXT", "RN_ALERT", "SCHEMA"] },
+    kit: { files: ["components/ui/**"], from: "all", drop: ["RN_TEXT"] },
+  },
+}),
+```
+
+That returns two overrides. The first bans all three everywhere, the second bans `RN_ALERT` and
+`SCHEMA` under `components/ui/`, which is where `Text` is wrapped. A ban added to `paths` and to
+`all` reaches every scope that descends from it, and `components/ui/` keeps its one exemption.
+
+The broadest scope is an override on `files: ["**"]` rather than a top-level rule. Measured on
+vite-plus 0.3.1 and oxlint 1.81.0, 2026-09-19: the two behave the same, files matched by no other
+override included, so the whole list reads in one place.
+
+Severity is `error`, always. Every message is yours.
+
+TypeScript rejects four mistakes on the spot:
+
+- a name in `use`, `add` or `drop` that is no key of `paths` or `patterns`,
+- a `from` naming a scope that does not exist,
+- `use` and `from` on the same scope,
+- a scope with neither.
+
+Three more depend on the order scopes resolve in, so they throw when the config loads, naming the
+scope and the entry:
+
+- a `from` naming a scope declared after this one,
+- a `drop` of a name the parent does not restrict,
+- an `add` of a name the parent already restricts.
+
+The last two exist because both are a claim about the parent that is false, and a config that
+states something false about its parent is one rename away from lifting a ban.
+
 ## Prove the rules still fire
 
 ```bash
-npx rdj-lint-verify
+npx rdjperron-lint-verify
 ```
 
-The fixtures ship in the package: `fixtures/<rule>.fixture.ts(x)` is one deliberately violating
-file per rule. The command lints them through your own `vp lint` and asserts a positive, that
-every rule fired on the file named after it, then checks the `@oxlint/plugins` pin. A rule can
-go silently dead after a linter upgrade or a plugin API skew, and "reports nothing" looks exactly
-like "no violations". Nothing else notices.
+No configuration and no arguments. A rule can go silently dead after a linter upgrade, and "reports
+nothing" looks exactly like "no violations", so nothing else in a repo notices. This asserts a
+positive: every rule fired, each on the file named after it. It prints a table and exits non-zero on
+the first rule that stayed quiet.
 
-Your config has to carry `fixtures()` in its overrides, on the view path the command uses
-(`scripts/.lint-fixtures/rdj` sits under the default `scripts/.lint-fixtures/**`). This is not a
-convenience: `-A`, `-W` and `-D` reach built-in rules only and cannot switch a JS plugin rule on,
-so the override is the only way the rules you leave off on your own code get proven.
+The fixtures ship in the package, one deliberately violating `fixtures/<rule>.fixture.ts(x)` per
+rule. The command copies them into a throwaway project under your system temp directory, beside a
+generated config that puts every rule at error, with your `node_modules` symlinked in, and removes
+the whole directory afterwards whether the run passed or failed. Your own config, your ignore
+patterns and your severities take no part.
 
-Two things not to do. Do not gitignore the view: oxlint honours `.gitignore`, so an ignored view
-reports zero files instead of a dead rule. And do not delete the fixtures.
+The linter it runs is the oxlint your local `vite-plus` depends on, so the run that matters is the
+one right after you move `vite-plus`, and in CI.
 
-A repo with a second plugin to check imports `verifySuites` and describes both suites itself; the
-source repo's `scripts/verify-lint-fixtures.mjs` is the example.
+One thing not to do: do not delete the fixtures. They are the only thing that catches a rule going
+dead.
 
 ## The rules
 
-Each page explains what the rule rejects, what to write instead, and what it deliberately allows.
-
-| Rule                                                                                                       | What it rejects                                                           |
-| ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
-| [`rdj/no-array-filter-map`](docs/rules/no-array-filter-map.md)                                             | `filter().map()`, two passes and an intermediate array.                   |
-| [`rdj/no-chained-type-assertions`](docs/rules/no-chained-type-assertions.md)                               | `x as unknown as T`, an assertion laundered through a second one.         |
-| [`rdj/no-conditional-empty-object-spread`](docs/rules/no-conditional-empty-object-spread.md)               | `...(cond ? { a } : {})`, omission hidden behind an empty object.         |
-| [`rdj/no-hardcoded-jsx-text`](docs/rules/no-hardcoded-jsx-text.md)                                         | Words written straight into JSX children.                                 |
-| [`rdj/no-known-value-widening`](docs/rules/no-known-value-widening.md)                                     | An annotation that throws away what inference already knew.               |
-| [`rdj/no-module-mocking`](docs/rules/no-module-mocking.md)                                                 | `vi.mock` and friends, a test of the mock rather than the module.         |
-| [`rdj/no-object-parameters`](docs/rules/no-object-parameters.md)                                           | The bare `object` type on a function input.                               |
-| [`rdj/no-reduce-accumulator-copy`](docs/rules/no-reduce-accumulator-copy.md)                               | Spreading the accumulator inside `reduce`, quadratic by construction.     |
-| [`rdj/no-reflect-apply`](docs/rules/no-reflect-apply.md)                                                   | `Reflect.apply`, a call the types cannot follow.                          |
-| [`rdj/no-reflect-get`](docs/rules/no-reflect-get.md)                                                       | `Reflect.get`, a property read the types cannot follow.                   |
-| [`rdj/no-runtime-typeof`](docs/rules/no-runtime-typeof.md)                                                 | `typeof` as a substitute for parsing input at its boundary.               |
-| [`rdj/no-shape-in-symbol-names`](docs/rules/no-shape-in-symbol-names.md)                                   | "shape" in a symbol name, structure in place of a domain role.            |
-| [`rdj/no-unknown-parameters`](docs/rules/no-unknown-parameters.md)                                         | `unknown` on a function input.                                            |
-| [`rdj/no-unknown-returns`](docs/rules/no-unknown-returns.md)                                               | `unknown` on a function output.                                           |
-| [`rdj/no-unknown-type-aliases`](docs/rules/no-unknown-type-aliases.md)                                     | A type alias that resolves to `unknown`.                                  |
-| [`rdj/no-unsafe-dictionary-type`](docs/rules/no-unsafe-dictionary-type.md)                                 | A dictionary whose values are `unknown`, `any` or `object`.               |
-| [`rdj/no-use-effect`](docs/rules/no-use-effect.md)                                                         | Every `useEffect` and `useLayoutEffect` call or import.                   |
-| [`rdj/no-widen-then-assert`](docs/rules/no-widen-then-assert.md)                                           | Widening a value and asserting it back.                                   |
-| [`rdj/require-safety-comment-for-type-assertion`](docs/rules/require-safety-comment-for-type-assertion.md) | An assertion with no `SAFETY:` line naming the invariant.                 |
-| [`rdj/static-public-env`](docs/rules/static-public-env.md)                                                 | Any `process.env` read but `process.env.NAME`, the one form Expo inlines. |
+Each rule file opens with the reason the rule exists and the case where it is legitimate to
+scope it off; the messages, the options and the cases are in the rule and its tests.
+
+| Rule                                                  | What it rejects                                                       |
+| ----------------------------------------------------- | --------------------------------------------------------------------- |
+| `rdjperron/no-array-filter-map`                       | `filter().map()`, two passes and an intermediate array.               |
+| `rdjperron/no-chained-type-assertions`                | `x as unknown as T`, an assertion laundered through a second one.     |
+| `rdjperron/no-conditional-empty-object-spread`        | `...(cond ? { a } : {})`, omission hidden behind an empty object.     |
+| `rdjperron/no-hardcoded-jsx-text`                     | Words written straight into JSX children.                             |
+| `rdjperron/no-known-value-widening`                   | An annotation that throws away what inference already knew.           |
+| `rdjperron/no-module-mocking`                         | `vi.mock` and friends, a test of the mock rather than the module.     |
+| `rdjperron/no-object-parameters`                      | The bare `object` type on a function input.                           |
+| `rdjperron/no-reduce-accumulator-copy`                | Spreading the accumulator inside `reduce`, quadratic by construction. |
+| `rdjperron/no-reflect-apply`                          | `Reflect.apply`, a call the types cannot follow.                      |
+| `rdjperron/no-reflect-get`                            | `Reflect.get`, a property read the types cannot follow.               |
+| `rdjperron/no-runtime-typeof`                         | `typeof` as a substitute for parsing input at its boundary.           |
+| `rdjperron/no-shape-in-symbol-names`                  | The word "shape" in a symbol name, structure in place of a role.      |
+| `rdjperron/no-unknown-parameters`                     | `unknown` on a function input.                                        |
+| `rdjperron/no-unknown-returns`                        | `unknown` on a function output.                                       |
+| `rdjperron/no-unknown-type-aliases`                   | A type alias that resolves to `unknown`.                              |
+| `rdjperron/no-unsafe-dictionary-type`                 | A dictionary whose values are `unknown`, `any` or `object`.           |
+| `rdjperron/no-use-effect`                             | Every `useEffect` and `useLayoutEffect` call or import.               |
+| `rdjperron/no-widen-then-assert`                      | Widening a value and asserting it back.                               |
+| `rdjperron/require-safety-comment-for-type-assertion` | An assertion with no `SAFETY:` line naming the invariant.             |
+| `rdjperron/static-public-env`                         | A `process.env` read Expo's bundler does not replace at build time.   |
 
 ### Options
 
-- `rdj/no-use-effect` takes `{ hint?: string }`, appended to every finding, so a project can name
+- `rdjperron/no-use-effect` takes `{ hint?: string }`, appended to every finding, so a project can name
   its one sanctioned wrapper. `react(files, { useEffectAllowedIn })` sets it and exempts that file.
-- `rdj/no-hardcoded-jsx-text` takes `{ pattern?: string }`, a regex source compiled with `u`. The
+- `rdjperron/no-hardcoded-jsx-text` takes `{ pattern?: string }`, a regex source compiled with `u`. The
   default `\p{L}{3,}` says three letters in a row is a word; digits, separators and bullets are
   not. It looks at JSX text and at string literals placed as children, never at attribute values.
-- `rdj/no-runtime-typeof` takes `{ allowInTypeGuards?: boolean }`. `recommended` turns it on: a
-  `typeof` inside a type predicate is the decode the rule asks for, named and reusable.
-- `rdj/static-public-env` has no options.
+- `rdjperron/no-runtime-typeof` takes `{ allowInTypeGuards?: boolean, hint?: string }`. `recommended`
+  turns the first on: a `typeof` inside a type predicate is the decode the rule asks for, named and
+  reusable. The hint is appended to every finding; `decoders(files)` sets it.
+- `rdjperron/no-unknown-parameters` takes `{ hint?: string }`, appended to every finding, so a project
+  can name the modules where the parse belongs. `decoders(files)` sets it.
+- `rdjperron/static-public-env` has no options.
+
+## Name the file that holds the fix
+
+A rule tells a reader what is wrong. When the fix is the same every time, the finding can tell them
+where to go as well, which is what `useEffectAllowedIn` and `decoders(files)` are for: they put a
+sentence naming the sanctioned file in every finding of the rule that will send someone there.
+`decoders(["lib/api-error.ts", "convex/lib/json.ts"])` reads:
+
+```
+Parameter `body` leaves input unparsed. Accept a named domain type; run the expected schema or
+parser at the I/O boundary before calling this function. Decode the value in lib/api-error.ts or
+convex/lib/json.ts, then call that decoder from here.
+```
+
+The same sentence lands on `no-runtime-typeof`, and inside those files that rule is off, because a
+`typeof` there is the parse rather than a narrowing in place of one.
 
 ## Severities are measurements
 
 Land a new rule at `warn`, fix or scope what fires, then promote it. When a rule fires, fix the
 code or add a narrowly scoped override with the measurement that justifies it. Never weaken the
 rule, add a cast, or rename a symbol to dodge the check.
+
+## Moving from 0.4
+
+Nothing is removed. One builder changed what it does, and three are new.
+
+`expo(files)` used to set `static-public-env` and nothing else. It now also puts
+`typescript/no-require-imports` at error with the asset extensions allowed, and turns
+`unicorn/no-array-sort` off. If your config carries either by hand, delete it, and pass
+`assetExts` for what your `metro.config.js` adds. An asset `require()` is now allowed only in the
+files you hand to `expo()`. If you allowed it everywhere before, a `require()` of an asset outside
+those files reports.
+
+| You write by hand today                                                  | 0.5.0 gives you                                     |
+| ------------------------------------------------------------------------ | --------------------------------------------------- |
+| The same `no-restricted-imports` list in every override, minus one entry | `restrictedImports({ paths, patterns, scopes })`    |
+| `no-runtime-typeof` off for your decoder modules                         | `decoders(files)`, which also names them in the fix |
+| `react/capitalized-calls` off, `react/style-prop-object` for `StatusBar` | `expo(files, { reactFiles })`                       |
+| `react/exhaustive-deps` off for the `useEffectAllowedIn` file            | `react()` does it                                   |
+
+Measured on rummy, 2026-09-19: `vite.config.ts` went from 447 lines to 366. 132 planted findings
+across ten import scopes came out identical, position for position, before and after. The one
+difference is the asset rule, which moved from warn to error and stopped allowing assets outside
+the phone's files.
+
+## Moving from 0.3
+
+0.4.0 moved the rules' health out of the consumer. Everything below is something you delete, and
+nothing replaces it.
+
+| Delete                                                        | Why it is gone                                                                                 |
+| ------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
+| `@oxlint/plugins` from your `package.json`                    | An ordinary dependency here now. Nothing left to pin, and nothing to move on a `vp` upgrade.   |
+| `plugins: [...]` from `lint`                                  | `recommended` carries the set its rules need. Keep yours only if you add a plugin of your own. |
+| `categories: {...}` from `lint`                               | `recommended` carries `correctness: "error"`, `suspicious: "warn"`, `perf: "warn"`.            |
+| `typeAware: true` from `lint.options`                         | `recommended` carries it, and `options` merges key by key, so your `typeCheck` still applies.  |
+| `fixtures()` from your imports and your overrides             | The verify command writes its own config now. The builder no longer exists.                    |
+| Any comment about keeping `scripts/.lint-fixtures` un-ignored | The check runs under your system temp directory, where nothing is ignored.                     |
+| Your `verify:lint-fixtures` script, if it passed arguments    | `rdjperron-lint-verify` takes none.                                                            |
+
+Two exports also went: `@rdjperron/lint/verify` (`verifySuites`, `packageSuite`,
+`verifyPluginApiPin`) and `@rdjperron/lint/fixtures/*`. The fixtures still ship, the bin reads them
+itself, and a repo with a second plugin to check now runs that plugin's own command beside this one.
+
+New in 0.4.0: `oxc/no-accumulating-spread` at error, measured at zero hits on three repos. If it
+fires on yours, that reducer is quadratic.