From 2461a43b1d1b4e2d14cd2fd2d2239f978365ded1 Mon Sep 17 00:00:00 2001
From: oekazuma <koneko0604@gmail.com>
Date: Sun, 9 Aug 2026 01:53:07 +0900
Subject: [PATCH 1/3] fix(core): stop effect-as-onmount flagging member-read
 reactivity; align effect-rule docs

---
 .changeset/effect-rules-validity.md           | 23 ++++++++++
 .../ja/rules/correctness/effect-as-derived.md | 26 ++++++++++-
 .../ja/rules/correctness/effect-as-onmount.md | 13 ++++--
 .../docs/ja/rules/correctness/index.mdx       |  2 +-
 .../correctness/instance-browser-global.md    | 18 +++++++-
 .../correctness/server-browser-global.md      |  8 ++--
 docs/src/content/docs/ja/rules/index.mdx      |  2 +-
 .../rules/correctness/effect-as-derived.md    | 28 +++++++++++-
 .../rules/correctness/effect-as-onmount.md    | 13 ++++--
 .../content/docs/rules/correctness/index.mdx  |  2 +-
 .../correctness/instance-browser-global.md    | 18 +++++++-
 .../correctness/server-browser-global.md      |  8 ++--
 docs/src/content/docs/rules/index.mdx         |  2 +-
 ...-02-correct003-effect-as-onmount-design.md | 16 +++++++
 packages/core/src/component-parse.ts          | 44 ++++++++++++++++++-
 .../rules/correctness/effect-as-onmount.ts    | 10 +++--
 packages/core/test/component-parse.test.ts    | 32 ++++++++++++++
 packages/core/test/correctness-rules.test.ts  | 10 +++++
 18 files changed, 247 insertions(+), 28 deletions(-)
 create mode 100644 .changeset/effect-rules-validity.md

diff --git a/.changeset/effect-rules-validity.md b/.changeset/effect-rules-validity.md
new file mode 100644
index 000000000..b5ed5faf9
--- /dev/null
+++ b/.changeset/effect-rules-validity.md
@@ -0,0 +1,23 @@
+---
+'@svelte-vitals/core': patch
+---
+
+Two `correctness/effect-*` rule content fixes from the v1.0 rule-validity review:
+
+- `correctness/effect-as-onmount` no longer flags an `$effect` that reads a reactive value through
+  a member expression on an imported binding or a `new`-ed local — a class instance with `$state`
+  fields, a `SvelteMap`/`SvelteSet`, an imported runes-module state object, and
+  `svelte/reactivity/window` were all indistinguishable from the true mount-only positive, and the
+  rule's "use `onMount` instead" advice would have converted a re-running effect into run-once. The
+  change is strictly narrowing (only removes findings, never adds one); the rule's message,
+  recommendation, and docs now name `{@attach}` and event handlers alongside `onMount` instead of
+  presenting `onMount` as the sole fix, and the docs admit the one remaining blind spot (a reactive
+  value reached only through a plain function's return value).
+- The documented fix snippets for `correctness/server-browser-global` and
+  `correctness/instance-browser-global` now use `onMount` (and, for the latter,
+  `svelte/reactivity/window` as the preferred modern form) instead of an `$effect` that assigns a
+  browser global to `$state` — that snippet was itself flagged by `correctness/effect-as-derived`,
+  whose "use `$derived`" advice would reintroduce the SSR `ReferenceError` those two rules exist to
+  prevent. `correctness/effect-as-derived`'s docs gain this as a second known limitation, and drop
+  an inaccurate "$derived updates synchronously" claim in favor of describing its actual push-pull,
+  lazy-recompute behavior.
diff --git a/docs/src/content/docs/ja/rules/correctness/effect-as-derived.md b/docs/src/content/docs/ja/rules/correctness/effect-as-derived.md
index b5a0c39a4..4aa55ca78 100644
--- a/docs/src/content/docs/ja/rules/correctness/effect-as-derived.md
+++ b/docs/src/content/docs/ja/rules/correctness/effect-as-derived.md
@@ -11,7 +11,7 @@ description: 状態を代入するだけの $effect は $derived に置き換え
 
 ## なぜ重要か
 
-`$effect` で状態を同期する書き方（React の useEffect の習慣の持ち込み）は、レンダリング後に実行されるため、余計なレンダリングパスやループを招きます。`$derived` は同じ依存関係を宣言的に表し、同期的に更新されます。
+`$effect` で状態を同期する書き方（React の useEffect の習慣の持ち込み）は、レンダリング後に実行されるため、余計なレンダリングパスやループを招きます。`$derived` は同じ依存関係を宣言的に表します — 個別の effect 実行をスケジュールするのではなく、次に読み取られたタイミングで遅延評価されます。
 
 ## 修正方法
 
@@ -40,4 +40,26 @@ description: 状態を代入するだけの $effect は $derived に置き換え
 </script>
 ```
 
-`$derived` は hydration 中も含めて即座に評価されますが、`$effect` は mount の1ティック後に実行されます。それがこのパターンの狙いです。この形を `$derived` に置き換えるのは `$effect` が防いでいたバグの再発なので、「修正」せず [`svelte-vitals-disable-next-line`](/ja/guides/cli#特定の指摘だけをインラインで抑制する) コメントで抑制してください。
+`$derived` は hydration 中も含めて次に読まれたタイミングで再計算されますが、`$effect` は mount の1ティック後に実行されます。それがこのパターンの狙いです。この形を `$derived` に置き換えるのは `$effect` が防いでいたバグの再発なので、「修正」せず [`svelte-vitals-disable-next-line`](/ja/guides/cli#特定の指摘だけをインラインで抑制する) コメントで抑制してください。
+
+## 既知の制限: browser global の捕捉
+
+同じ構造的な死角は、[correctness/server-browser-global](/ja/rules/correctness/server-browser-global) と
+[correctness/instance-browser-global](/ja/rules/correctness/instance-browser-global) が示している修正例
+—— browser 専用の global を読んで `$state` に代入する `$effect` —— も検出してしまいます:
+
+```svelte
+<script>
+  let stored = $state(null);
+  $effect(() => {
+    stored = localStorage.getItem('filters'); // ここで検出されるが「修正」してはいけない
+  });
+</script>
+```
+
+これを `$derived(localStorage.getItem('filters'))` に置き換えると、その式は SSR 中にも評価されてしまい、
+この2つのルールが防ごうとしている `ReferenceError: localStorage is not defined` を再発させます。
+`localStorage`/`window` などは、まさに `$derived` が安全に読めない値です —— derived の式はサーバーサイド
+レンダリング中にも実行され得るからです。`onMount`、あるいは `window` のプロパティなら
+[`svelte/reactivity/window`](https://svelte.dev/docs/svelte/svelte-reactivity-window) を使ってください
+（修正方法はこの2つのルールのドキュメントを参照）。`$derived` に切り替えるのではなく、この指摘は抑制してください。
diff --git a/docs/src/content/docs/ja/rules/correctness/effect-as-onmount.md b/docs/src/content/docs/ja/rules/correctness/effect-as-onmount.md
index c7c90b64b..a5e49a42d 100644
--- a/docs/src/content/docs/ja/rules/correctness/effect-as-onmount.md
+++ b/docs/src/content/docs/ja/rules/correctness/effect-as-onmount.md
@@ -1,17 +1,17 @@
 ---
 title: correctness/effect-as-onmount · onMount 代わりの $effect
-description: リアクティブな値を読まない $effect は、onMount で十分です。
+description: reactive 値を読まない $effect は、イベントハンドラ、{@attach}、onMount のいずれかで書くべきです。
 ---
 
 **重大度:** warning · **カテゴリ:** correctness
 
 ## チェック内容
 
-本体が空ではないのに reactive 値を一切読まない `$effect` / `$effect.pre` を検出します。`$state`、`$derived`、`$props` の参照、store 購読、裸の関数呼び出し（`foo()`）のいずれもないものです。そのような effect はマウント後に一度だけ実行され、再実行されません。コンポーネントのインスタンススクリプトを静的（CLI）解析します。
+本体が空ではないのに、このチェックから見える reactive 値を一切読まない `$effect` / `$effect.pre` を検出します。`$state`、`$derived`、`$props`、import されたバインディング、`new` で初期化されたローカル変数、store 購読のいずれもなく、裸の関数呼び出し（`foo()`）もないものです。そのような effect はマウント後に一度だけ実行され、このチェックが追跡できる範囲では再実行されません。コンポーネントのインスタンススクリプトを静的（CLI）解析します。
 
 ## なぜ重要か
 
-何にも反応しない `$effect` は実質 `onMount` です。`$effect` で書くとその意図が読み取りにくくなるうえ、リアクティビティの仕組みの誤用でもあります。`onMount` なら「マウント時に一度だけ実行する」という意図をそのまま表現できます。
+何にも反応しない `$effect` は、多くの場合イベントハンドラ、`{@attach}`、`onMount` の代わりとして遠回りなだけです。`$effect` で書くとその意図が読み取りにくくなるうえ、リアクティビティの仕組みの誤用でもあります。
 
 ## 修正方法
 
@@ -24,3 +24,10 @@ description: リアクティブな値を読まない $effect は、onMount で
   });
 </script>
 ```
+
+ユーザー操作への応答として実行しているなら、`$effect` よりイベントハンドラを優先してください。外部ライブラリ（チャートやツールチップなど）と要素を同期しているなら、[`{@attach ...}`](https://svelte.dev/docs/svelte/@attach) を優先してください — `$effect` や `onMount` より現在推奨されている DOM/ライブラリ同期の方法です。
+
+## 既知の制限: 素の関数呼び出しの戻り値経由のリアクティビティ
+
+このチェックは、rune の宣言（`$state`/`$derived`/`$props`）、import されたバインディング、`new …()` で初期化されたローカル変数など、たどれる名前を経由した reactive 読み取りを認識します — これはクラスの `$state` フィールド、`SvelteMap`/`SvelteSet`、import された runes モジュールの状態オブジェクト、`svelte/reactivity/window` をカバーします。素の関数の戻り値（`const c = createCounter()`）経由でしか到達できない reactive な値には、たどれる名前がないため、そのように書かれた本物の reactive な effect でも検出されてしまうことがあります。該当する場合は、動作しているコードを `onMount` に移すのではなく、
+[`svelte-vitals-disable-next-line`](/ja/guides/cli#特定の指摘だけをインラインで抑制する) コメントで抑制してください。
diff --git a/docs/src/content/docs/ja/rules/correctness/index.mdx b/docs/src/content/docs/ja/rules/correctness/index.mdx
index 56dd0a7ba..fc2e897dd 100644
--- a/docs/src/content/docs/ja/rules/correctness/index.mdx
+++ b/docs/src/content/docs/ja/rules/correctness/index.mdx
@@ -17,7 +17,7 @@ description: svelte-vitals の Correctness ルール一覧。
 | [`correctness/each-index-key`](/ja/rules/correctness/each-index-key)                       | 🟡 warning  | &#123;#each&#125; のキーに index を使うと、要素の同一性が位置で決まります。キーを付けないのと同じバグが、見えにくい形で起こります。                         |
 | [`correctness/each-key`](/ja/rules/correctness/each-key)                                   | 🟡 warning  | 動的なデータを回す &#123;#each&#125; にはキーを付けましょう。                                                                                               |
 | [`correctness/effect-as-derived`](/ja/rules/correctness/effect-as-derived)                 | 🟡 warning  | 状態を代入するだけの $effect は $derived に置き換えましょう。                                                                                               |
-| [`correctness/effect-as-onmount`](/ja/rules/correctness/effect-as-onmount)                 | 🟡 warning  | リアクティブな値を読まない $effect は、onMount で十分です。                                                                                                 |
+| [`correctness/effect-as-onmount`](/ja/rules/correctness/effect-as-onmount)                 | 🟡 warning  | reactive 値を読まない $effect は、イベントハンドラ、&#123;@attach&#125;、onMount のいずれかで書くべきです。                                                 |
 | [`correctness/instance-browser-global`](/ja/rules/correctness/instance-browser-global)     | 🟡 warning  | インスタンススクリプトは SSR 時にサーバーでも実行されるため、トップレベルで window や document を参照するとレンダリングが落ちます。                         |
 | [`correctness/nonreactive-builtin-state`](/ja/rules/correctness/nonreactive-builtin-state) | 🟡 warning  | $state に入れた素の Map・Set・Date・URL・URLSearchParams はプロキシされないため、中身を変えても検知されず、気づかないうちに UI が更新されなくなります。     |
 | [`correctness/prop-mutation`](/ja/rules/correctness/prop-mutation)                         | 🟡 warning  | $bindable を宣言していない $props() の値は書き換えないでください。                                                                                          |
diff --git a/docs/src/content/docs/ja/rules/correctness/instance-browser-global.md b/docs/src/content/docs/ja/rules/correctness/instance-browser-global.md
index d6a2310d8..1b0bea23a 100644
--- a/docs/src/content/docs/ja/rules/correctness/instance-browser-global.md
+++ b/docs/src/content/docs/ja/rules/correctness/instance-browser-global.md
@@ -19,13 +19,27 @@ description: インスタンススクリプトは SSR 時にサーバーでも
 
 ## 修正方法
 
+`window` のプロパティなら、[`svelte/reactivity/window`](https://svelte.dev/docs/svelte/svelte-reactivity-window)（5.11.0 以降）が現在推奨される形です — ガード不要で、サーバーでは `undefined`、クライアントではリアクティブになります:
+
 ```svelte
 <script>
   const width = window.innerWidth; // ❌ SSR がクラッシュ
 
+  import { innerWidth } from 'svelte/reactivity/window';
+</script>
+
+<p>{innerWidth.current}</p>
+```
+
+`svelte/reactivity/window` がカバーしない場合は、`onMount` の中で読んでください — `onMount` はサーバーでは実行されません:
+
+```svelte
+<script>
+  import { onMount } from 'svelte';
+
   let width2 = $state(0);
-  $effect(() => {
-    width2 = window.innerWidth; // ✅ クライアント専用
+  onMount(() => {
+    width2 = window.innerWidth; // ✅ onMount はサーバーでは実行されない
   });
 </script>
 ```
diff --git a/docs/src/content/docs/ja/rules/correctness/server-browser-global.md b/docs/src/content/docs/ja/rules/correctness/server-browser-global.md
index 4c1e13558..e524aa7a1 100644
--- a/docs/src/content/docs/ja/rules/correctness/server-browser-global.md
+++ b/docs/src/content/docs/ja/rules/correctness/server-browser-global.md
@@ -36,14 +36,16 @@ export function load() {
 }
 ```
 
-ブラウザアクセスをクライアント側へ移します:
+ブラウザアクセスをクライアント側、`onMount` の中へ移します — `onMount` はサーバーでは実行されません:
 
 ```svelte
 <!-- +page.svelte -->
 <script>
+  import { onMount } from 'svelte';
+
   let stored = $state(null);
-  $effect(() => {
-    stored = localStorage.getItem('filters'); // ✅ effect はサーバーでは実行されない
+  onMount(() => {
+    stored = localStorage.getItem('filters'); // ✅ onMount はサーバーでは実行されない
   });
 </script>
 ```
diff --git a/docs/src/content/docs/ja/rules/index.mdx b/docs/src/content/docs/ja/rules/index.mdx
index 83fe45ee8..0414af436 100644
--- a/docs/src/content/docs/ja/rules/index.mdx
+++ b/docs/src/content/docs/ja/rules/index.mdx
@@ -95,7 +95,7 @@ svelte-vitals が報告するルールをカテゴリ別にまとめました。
 | [`correctness/each-index-key`](/ja/rules/correctness/each-index-key)                       | 🟡 warning  | &#123;#each&#125; のキーに index を使うと、要素の同一性が位置で決まります。キーを付けないのと同じバグが、見えにくい形で起こります。                         |
 | [`correctness/each-key`](/ja/rules/correctness/each-key)                                   | 🟡 warning  | 動的なデータを回す &#123;#each&#125; にはキーを付けましょう。                                                                                               |
 | [`correctness/effect-as-derived`](/ja/rules/correctness/effect-as-derived)                 | 🟡 warning  | 状態を代入するだけの $effect は $derived に置き換えましょう。                                                                                               |
-| [`correctness/effect-as-onmount`](/ja/rules/correctness/effect-as-onmount)                 | 🟡 warning  | リアクティブな値を読まない $effect は、onMount で十分です。                                                                                                 |
+| [`correctness/effect-as-onmount`](/ja/rules/correctness/effect-as-onmount)                 | 🟡 warning  | reactive 値を読まない $effect は、イベントハンドラ、&#123;@attach&#125;、onMount のいずれかで書くべきです。                                                 |
 | [`correctness/instance-browser-global`](/ja/rules/correctness/instance-browser-global)     | 🟡 warning  | インスタンススクリプトは SSR 時にサーバーでも実行されるため、トップレベルで window や document を参照するとレンダリングが落ちます。                         |
 | [`correctness/nonreactive-builtin-state`](/ja/rules/correctness/nonreactive-builtin-state) | 🟡 warning  | $state に入れた素の Map・Set・Date・URL・URLSearchParams はプロキシされないため、中身を変えても検知されず、気づかないうちに UI が更新されなくなります。     |
 | [`correctness/prop-mutation`](/ja/rules/correctness/prop-mutation)                         | 🟡 warning  | $bindable を宣言していない $props() の値は書き換えないでください。                                                                                          |
diff --git a/docs/src/content/docs/rules/correctness/effect-as-derived.md b/docs/src/content/docs/rules/correctness/effect-as-derived.md
index 27f53518d..7d87f1cad 100644
--- a/docs/src/content/docs/rules/correctness/effect-as-derived.md
+++ b/docs/src/content/docs/rules/correctness/effect-as-derived.md
@@ -11,7 +11,7 @@ Flags an `$effect` whose body only assigns to `$state` variables. Checked by sta
 
 ## Why it matters
 
-Synchronising state with an `$effect` (the "useEffect → $effect" habit from React) runs after render and can trigger extra render passes or loops. A `$derived` value expresses the same dependency declaratively and updates synchronously.
+Synchronising state with an `$effect` (the "useEffect → $effect" habit from React) runs after render and can trigger extra render passes or loops. A `$derived` value expresses the same dependency declaratively — Svelte recomputes it lazily, the next time it's read, rather than scheduling a separate effect run.
 
 ## How to fix
 
@@ -42,8 +42,32 @@ the "mount signal" idiom used to avoid SSR/prerender ↔ hydration mismatches:
 </script>
 ```
 
-`$derived` evaluates eagerly, including during hydration; `$effect` runs one tick after mount,
+`$derived` recomputes on next read, including during hydration; `$effect` runs one tick after mount,
 which is the whole point here. Converting this shape to `$derived` reintroduces the bug the
 `$effect` was added to prevent — so suppress it with a
 [`svelte-vitals-disable-next-line`](/guides/cli#suppressing-a-single-finding-inline) comment
 rather than "fixing" it.
+
+## Known limitation: browser-global capture
+
+The same structural blind spot also catches the documented fix for
+[correctness/server-browser-global](/rules/correctness/server-browser-global) and
+[correctness/instance-browser-global](/rules/correctness/instance-browser-global) — an `$effect` that
+reads a browser-only global and assigns it to `$state`:
+
+```svelte
+<script>
+  let stored = $state(null);
+  $effect(() => {
+    stored = localStorage.getItem('filters'); // flagged here, but don't "fix" it
+  });
+</script>
+```
+
+Converting this to `$derived(localStorage.getItem('filters'))` would evaluate the expression during
+SSR — reintroducing the exact `ReferenceError: localStorage is not defined` those two rules exist to
+prevent. `localStorage`/`window`/etc. are exactly the values `$derived` cannot safely read, since a
+derived expression can run during server-side rendering. Prefer `onMount`, or
+[`svelte/reactivity/window`](https://svelte.dev/docs/svelte/svelte-reactivity-window) for `window`
+properties — see those two rules' docs for the fix — and suppress this finding rather than switching to
+`$derived`.
diff --git a/docs/src/content/docs/rules/correctness/effect-as-onmount.md b/docs/src/content/docs/rules/correctness/effect-as-onmount.md
index bbb86bd1e..fe70e3732 100644
--- a/docs/src/content/docs/rules/correctness/effect-as-onmount.md
+++ b/docs/src/content/docs/rules/correctness/effect-as-onmount.md
@@ -1,17 +1,17 @@
 ---
 title: correctness/effect-as-onmount · Effect used as onMount
-description: Use onMount for an $effect that reads no reactive value.
+description: An $effect that reads no reactive value belongs in an event handler, {@attach}, or onMount instead.
 ---
 
 **Severity:** warning · **Category:** correctness
 
 ## What it checks
 
-Flags an `$effect` / `$effect.pre` whose non-empty body reads no reactive value — no `$state`, `$derived`, or `$props`, no store subscription, and no bare function call (`foo()`). Such an effect runs once after mount and never re-runs. Checked by static (CLI) analysis of component instance scripts.
+Flags an `$effect` / `$effect.pre` whose non-empty body reads no reactive value that this analysis can see — no `$state`, `$derived`, `$props`, imported binding, `new`-ed local, or store subscription, and no bare function call (`foo()`). Such an effect runs once after mount and never re-runs on the paths this check can follow. Checked by static (CLI) analysis of component instance scripts.
 
 ## Why it matters
 
-An `$effect` that never reacts to anything is an `onMount` in disguise. Using `$effect` obscures that intent and misuses the reactivity system; `onMount` says "run this once when the component mounts" directly.
+An `$effect` that never reacts to anything is usually a slower, less direct stand-in for an event handler, `{@attach}`, or `onMount`. Using `$effect` for it obscures intent and misuses the reactivity system.
 
 ## How to fix
 
@@ -24,3 +24,10 @@ An `$effect` that never reacts to anything is an `onMount` in disguise. Using `$
   });
 </script>
 ```
+
+If the effect runs in response to a user interaction, prefer an event handler over `$effect`. If it syncs an element with an external library (e.g. a chart or a tooltip), prefer [`{@attach ...}`](https://svelte.dev/docs/svelte/@attach) instead — it's the current recommended way to do DOM/library sync, ahead of both `$effect` and `onMount`.
+
+## Known limitation: reactivity reached through a plain function call
+
+This check recognizes a reactive read through a name it can trace back to a rune declarator (`$state`/`$derived`/`$props`), an imported binding, or a local initialized with `new …()` — which covers class `$state` fields, `SvelteMap`/`SvelteSet`, an imported runes-module state object, and `svelte/reactivity/window`. A reactive value reached only through a plain function's return value (`const c = createCounter()`) has no such name to trace, so a genuinely reactive effect built that way can still be flagged. If that's your case, suppress it with a
+[`svelte-vitals-disable-next-line`](/guides/cli#suppressing-a-single-finding-inline) comment rather than moving working code into `onMount`.
diff --git a/docs/src/content/docs/rules/correctness/index.mdx b/docs/src/content/docs/rules/correctness/index.mdx
index 012f3fbec..20f4200f7 100644
--- a/docs/src/content/docs/rules/correctness/index.mdx
+++ b/docs/src/content/docs/rules/correctness/index.mdx
@@ -17,7 +17,7 @@ Svelte 5 runes and lifecycle misuse — code that compiles but behaves wrong.
 | [`correctness/each-index-key`](/rules/correctness/each-index-key)                       | 🟡 warning  | Keying an &#123;#each&#125; block by its index gives items position-based identity — the same bug as no key, masked.                                           |
 | [`correctness/each-key`](/rules/correctness/each-key)                                   | 🟡 warning  | An &#123;#each&#125; block over dynamic data should have a key.                                                                                                |
 | [`correctness/effect-as-derived`](/rules/correctness/effect-as-derived)                 | 🟡 warning  | Use $derived instead of an $effect that only assigns state.                                                                                                    |
-| [`correctness/effect-as-onmount`](/rules/correctness/effect-as-onmount)                 | 🟡 warning  | Use onMount for an $effect that reads no reactive value.                                                                                                       |
+| [`correctness/effect-as-onmount`](/rules/correctness/effect-as-onmount)                 | 🟡 warning  | An $effect that reads no reactive value belongs in an event handler, &#123;@attach&#125;, or onMount instead.                                                  |
 | [`correctness/instance-browser-global`](/rules/correctness/instance-browser-global)     | 🟡 warning  | A component's instance script runs on the server during SSR — window/document reads at its top level crash the render.                                         |
 | [`correctness/nonreactive-builtin-state`](/rules/correctness/nonreactive-builtin-state) | 🟡 warning  | A plain Map, Set, Date, URL, or URLSearchParams in $state is not proxied — its mutations are invisible to reactivity, and the UI silently stops updating.      |
 | [`correctness/prop-mutation`](/rules/correctness/prop-mutation)                         | 🟡 warning  | Don't mutate a prop from $props() unless it is declared $bindable.                                                                                             |
diff --git a/docs/src/content/docs/rules/correctness/instance-browser-global.md b/docs/src/content/docs/rules/correctness/instance-browser-global.md
index 6340c91c3..621d41fa3 100644
--- a/docs/src/content/docs/rules/correctness/instance-browser-global.md
+++ b/docs/src/content/docs/rules/correctness/instance-browser-global.md
@@ -19,13 +19,27 @@ A browser global used only as a `$props()` destructuring default (`let { width =
 
 ## How to fix
 
+The preferred modern form for a `window` property is [`svelte/reactivity/window`](https://svelte.dev/docs/svelte/svelte-reactivity-window) (5.11.0+) — no guard needed, `undefined` on the server, reactive on the client:
+
 ```svelte
 <script>
   const width = window.innerWidth; // ❌ crashes SSR
 
+  import { innerWidth } from 'svelte/reactivity/window';
+</script>
+
+<p>{innerWidth.current}</p>
+```
+
+For anything `svelte/reactivity/window` doesn't cover, read the global in `onMount` — it never runs on the server:
+
+```svelte
+<script>
+  import { onMount } from 'svelte';
+
   let width2 = $state(0);
-  $effect(() => {
-    width2 = window.innerWidth; // ✅ client-only
+  onMount(() => {
+    width2 = window.innerWidth; // ✅ onMount never runs on the server
   });
 </script>
 ```
diff --git a/docs/src/content/docs/rules/correctness/server-browser-global.md b/docs/src/content/docs/rules/correctness/server-browser-global.md
index adc091bfb..7b5c5819f 100644
--- a/docs/src/content/docs/rules/correctness/server-browser-global.md
+++ b/docs/src/content/docs/rules/correctness/server-browser-global.md
@@ -36,14 +36,16 @@ export function load() {
 }
 ```
 
-Move the browser access to the client side:
+Move the browser access to the client side, in `onMount` — it never runs on the server:
 
 ```svelte
 <!-- +page.svelte -->
 <script>
+  import { onMount } from 'svelte';
+
   let stored = $state(null);
-  $effect(() => {
-    stored = localStorage.getItem('filters'); // ✅ effects never run on the server
+  onMount(() => {
+    stored = localStorage.getItem('filters'); // ✅ onMount never runs on the server
   });
 </script>
 ```
diff --git a/docs/src/content/docs/rules/index.mdx b/docs/src/content/docs/rules/index.mdx
index 4dd9c69e9..d4e6fcf61 100644
--- a/docs/src/content/docs/rules/index.mdx
+++ b/docs/src/content/docs/rules/index.mdx
@@ -95,7 +95,7 @@ The severities below are the defaults — see [Configuration](/guides/configurat
 | [`correctness/each-index-key`](/rules/correctness/each-index-key)                       | 🟡 warning  | Keying an &#123;#each&#125; block by its index gives items position-based identity — the same bug as no key, masked.                                           |
 | [`correctness/each-key`](/rules/correctness/each-key)                                   | 🟡 warning  | An &#123;#each&#125; block over dynamic data should have a key.                                                                                                |
 | [`correctness/effect-as-derived`](/rules/correctness/effect-as-derived)                 | 🟡 warning  | Use $derived instead of an $effect that only assigns state.                                                                                                    |
-| [`correctness/effect-as-onmount`](/rules/correctness/effect-as-onmount)                 | 🟡 warning  | Use onMount for an $effect that reads no reactive value.                                                                                                       |
+| [`correctness/effect-as-onmount`](/rules/correctness/effect-as-onmount)                 | 🟡 warning  | An $effect that reads no reactive value belongs in an event handler, &#123;@attach&#125;, or onMount instead.                                                  |
 | [`correctness/instance-browser-global`](/rules/correctness/instance-browser-global)     | 🟡 warning  | A component's instance script runs on the server during SSR — window/document reads at its top level crash the render.                                         |
 | [`correctness/nonreactive-builtin-state`](/rules/correctness/nonreactive-builtin-state) | 🟡 warning  | A plain Map, Set, Date, URL, or URLSearchParams in $state is not proxied — its mutations are invisible to reactivity, and the UI silently stops updating.      |
 | [`correctness/prop-mutation`](/rules/correctness/prop-mutation)                         | 🟡 warning  | Don't mutate a prop from $props() unless it is declared $bindable.                                                                                             |
diff --git a/docs/superpowers/specs/2026-07-02-correct003-effect-as-onmount-design.md b/docs/superpowers/specs/2026-07-02-correct003-effect-as-onmount-design.md
index f26d6d248..6b9b2d3c4 100644
--- a/docs/superpowers/specs/2026-07-02-correct003-effect-as-onmount-design.md
+++ b/docs/superpowers/specs/2026-07-02-correct003-effect-as-onmount-design.md
@@ -158,3 +158,19 @@ PERF010; the rule is CLI/static-only and no-ops in rendered mode, so not
   suppressed instead (conservative).
 - Reactive sources beyond `$state`/`$derived`/`$props`/stores.
 - Merging with CORRECT002's derive-smell detection (distinct signal).
+
+## 2026-08-09 addendum
+
+The "conservative — no false positives" claim in §1 was refuted by the 2026-08-09 v1.0
+rule-validity review (`docs/superpowers/specs/2026-08-09-v1-rule-validity-review.md`,
+Priority 1 #1): `reactiveNames` only ever held same-file rune declarators, so a member read on
+a class instance (`new Counter()`, `$state` fields), a `SvelteMap`/`SvelteSet`, an imported
+runes-module state object, or `svelte/reactivity/window` was indistinguishable from the true
+positive — all four yielded `mountOnly: true`, and the rule's advice to switch to `onMount`
+would have frozen working reactive code. Fixed by narrowing detection: `bodyReadsReactive` now
+also treats a member read on any imported binding or any local initialized with `new …()` as
+reactive (`collectImportedLocalNames`/`collectNewExprLocalNames` in `component-parse.ts`),
+folded into the same `reactiveNames` set. This is strictly narrower — it only ever suppresses a
+finding, never adds one — and does not close the remaining gap: a reactive value reached only
+through a plain function's return value still has no traceable name and can still be flagged
+(documented as a known limitation in the rule's docs page instead of silently claimed away).
diff --git a/packages/core/src/component-parse.ts b/packages/core/src/component-parse.ts
index 56eff12f9..f28697427 100644
--- a/packages/core/src/component-parse.ts
+++ b/packages/core/src/component-parse.ts
@@ -921,9 +921,45 @@ function collectDirectiveEscapes(node: Node, names: Set<string>, acc: Set<string
 
 const RUNE_NAMES = new Set(['$state', '$derived', '$effect', '$props', '$bindable', '$inspect', '$host']);
 
+/**
+ * Local names bound by any non-type-only import specifier (default, named, or namespace),
+ * anywhere in a program (correctness/effect-as-onmount). An imported binding is opaque to this
+ * analysis — it may be a runes-module state object, a `svelte/reactivity`/`svelte/reactivity/window`
+ * constructor or live binding, or anything else carrying hidden reactivity — so member reads on
+ * it are folded into `reactiveNames` rather than risk telling someone to replace a live effect
+ * with `onMount`.
+ */
+function collectImportedLocalNames(program: Node, acc: Set<string>): void {
+  for (const stmt of program?.body ?? []) {
+    if (stmt?.type !== 'ImportDeclaration' || stmt.importKind === 'type') continue;
+    for (const s of stmt.specifiers ?? []) {
+      if (s?.importKind === 'type' || s?.local?.type !== 'Identifier') continue;
+      acc.add(s.local.name);
+    }
+  }
+}
+
+/**
+ * Local names initialized with a `new …()` expression, anywhere in a program
+ * (correctness/effect-as-onmount). A class instance is opaque the same way an import is — it may
+ * carry `$state` fields — so it's folded into `reactiveNames` alongside imports.
+ */
+function collectNewExprLocalNames(program: Node, acc: Set<string>): void {
+  walkEstree(program, (n) => {
+    if (n.type !== 'VariableDeclarator' || n.id?.type !== 'Identifier' || !n.init) return;
+    if (unwrapTs(n.init).type === 'NewExpression') acc.add(n.id.name);
+  });
+}
+
 /**
  * Whether an $effect callback body reads a reactive value (correctness/effect-as-onmount, conservative):
- * a reactive name, a `$`-prefixed store subscription, or any bare-identifier call.
+ * a reactive name (rune declarator, imported binding, or `new`-ed local — see
+ * `collectImportedLocalNames`/`collectNewExprLocalNames`), a `$`-prefixed store subscription, or
+ * any bare-identifier call. Still blind to a reactive value reached only through a plain function
+ * call's return value (`const c = createCounter()`) or a prop-drilled/destructured member of one
+ * of the above — narrower than "any" reactive read, deliberately: those shapes have no
+ * syntactic marker to key off, so treating them as reactive by default would give up detection
+ * entirely rather than narrow it.
  */
 function bodyReadsReactive(fn: Node, reactiveNames: Set<string>): boolean {
   let reads = false;
@@ -2116,6 +2152,12 @@ export function parseComponentFacts(source: string, filename: string): ParsedFac
     }
     const stateNames = new Set<string>();
     const reactiveNames = new Set<string>();
+    collectImportedLocalNames(program, reactiveNames);
+    collectNewExprLocalNames(program, reactiveNames);
+    if (moduleProgram) {
+      collectImportedLocalNames(moduleProgram, reactiveNames);
+      collectNewExprLocalNames(moduleProgram, reactiveNames);
+    }
     const stateDecls: { name: string; line: number }[] = [];
     walkEstree(program, (n) => {
       if (n.type !== 'VariableDeclarator' || !n.init) return;
diff --git a/packages/core/src/rules/correctness/effect-as-onmount.ts b/packages/core/src/rules/correctness/effect-as-onmount.ts
index b7626c095..bd0a6079e 100644
--- a/packages/core/src/rules/correctness/effect-as-onmount.ts
+++ b/packages/core/src/rules/correctness/effect-as-onmount.ts
@@ -6,12 +6,16 @@ export const correctnessEffectAsOnMount = componentRule({
   category: 'correctness',
   label: '$effect usage',
   recommendation:
-    "Move mount-time side effects to onMount (import { onMount } from 'svelte'); reserve $effect for logic that reacts to $state/$derived/$props.",
+    "If this runs in response to a user interaction, use an event handler; to sync an element with an external library, use {@attach} instead. For genuine one-time mount work, use onMount (import { onMount } from 'svelte'). Reserve $effect for logic that reacts to $state/$derived/$props.",
   rationale:
-    'An $effect that reads no reactive value runs once after mount and never re-runs — it is an onMount in disguise, which obscures intent and misuses the reactivity system.',
+    "An $effect whose body reads no reactive value visible to this analysis runs once after mount and never re-runs on the paths it can see — usually a sign the code belongs in an event handler, {@attach}, or onMount instead of $effect. This can't see a reactive value reached only through a plain function's return value, so a genuinely reactive effect built that way can still be flagged.",
   applies: (c) => c.effects.length > 0,
   bad: (c) =>
     c.effects
       .filter((e) => e.mountOnly)
-      .map((e) => ({ line: e.line, message: '$effect reads no reactive value — use onMount instead' }))
+      .map((e) => ({
+        line: e.line,
+        message:
+          '$effect reads no reactive value this analysis can see — consider an event handler, {@attach}, or onMount instead'
+      }))
 });
diff --git a/packages/core/test/component-parse.test.ts b/packages/core/test/component-parse.test.ts
index 7a3a522c7..7fac95eb1 100644
--- a/packages/core/test/component-parse.test.ts
+++ b/packages/core/test/component-parse.test.ts
@@ -313,6 +313,38 @@ describe('parseComponentFacts — mount-only $effect (correctness/effect-as-onmo
   it('covers $effect.pre', () => {
     expect(facts('$effect.pre(() => { el.focus(); });')[0]!.mountOnly).toBe(true);
   });
+
+  // 2026-08-09 v1.0 rule-validity review, Priority 1 #1: these four idioms are all officially
+  // documented ways to hold reactive state, but `reactiveNames` (rune declarators only) couldn't
+  // see any of them, so all four used to yield `mountOnly: true` — the rule's "use onMount"
+  // advice would have frozen working reactive code. Confirmed pre-fix: every one of these
+  // failed (mountOnly: true) before `collectImportedLocalNames`/`collectNewExprLocalNames` were
+  // added and folded into `reactiveNames`.
+  it('is not mountOnly for a class-instance member read ($state fields via `new`)', () => {
+    expect(
+      facts('class Counter { n = $state(0); } const c = new Counter(); $effect(() => { c.n; });')[0]!.mountOnly
+    ).toBe(false);
+  });
+  it('is not mountOnly for a SvelteMap/SvelteSet member read', () => {
+    expect(
+      facts("import { SvelteMap } from 'svelte/reactivity'; const m = new SvelteMap(); $effect(() => { m.size; });")[0]!
+        .mountOnly
+    ).toBe(false);
+  });
+  it('is not mountOnly for an imported runes-module state object member read', () => {
+    expect(
+      facts("import { counterState } from './state.svelte.js'; $effect(() => { counterState.count; });")[0]!.mountOnly
+    ).toBe(false);
+  });
+  it('is not mountOnly for a svelte/reactivity/window live binding read', () => {
+    expect(
+      facts("import { innerWidth } from 'svelte/reactivity/window'; $effect(() => { innerWidth.current; });")[0]!
+        .mountOnly
+    ).toBe(false);
+  });
+  it('is still mountOnly for the true positive: a member call on a plain, non-reactive local', () => {
+    expect(facts('let el; $effect(() => { el.focus(); });')[0]!.mountOnly).toBe(true);
+  });
 });
 
 describe('parseComponentFacts — constable $state (correctness/unmutated-state)', () => {
diff --git a/packages/core/test/correctness-rules.test.ts b/packages/core/test/correctness-rules.test.ts
index 709b92704..802af6363 100644
--- a/packages/core/test/correctness-rules.test.ts
+++ b/packages/core/test/correctness-rules.test.ts
@@ -134,6 +134,16 @@ describe('correctness/effect-as-onmount effect used as onMount', () => {
     const rs = await correctnessEffectAsOnMount.check(ctx([comp({ effects: [] })]));
     expect(rs).toHaveLength(0);
   });
+  it('end-to-end: a SvelteMap-reading effect is not flagged (2026-08-09 review — was a false positive)', async () => {
+    const src = `<script>
+      import { SvelteMap } from 'svelte/reactivity';
+      const m = new SvelteMap();
+      $effect(() => { m.size; });
+    </script>`;
+    const facts = parseComponentFacts(src, 'src/lib/C.svelte');
+    const rs = await correctnessEffectAsOnMount.check(ctx([{ file: 'src/lib/C.svelte', ...facts }]));
+    expect(fails(rs)).toHaveLength(0);
+  });
 });
 
 describe('correctness/unmutated-state unmutated $state', () => {

From dee9ea00abe18ffa79f375bf8a22dd067b144896 Mon Sep 17 00:00:00 2001
From: oekazuma <koneko0604@gmail.com>
Date: Sun, 9 Aug 2026 03:00:38 +0900
Subject: [PATCH 2/3] =?UTF-8?q?fix(core):=20address=20review=20notes=20on?=
 =?UTF-8?q?=20effect-as-onmount=20=E2=80=94=20declarator-init=20wording,?=
 =?UTF-8?q?=20module-script=20test,=20{@attach}=20version=20gate?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tightens "new-ed local" phrasing to "declared with a new …() initializer" everywhere it
appears (assignment-form `let m; m = new SvelteMap();` is still undetected, now documented
as a second known limitation instead of implied covered). Adds a fact-level test pinning the
<script module> import-folding path (mutation-confirmed: fails when the moduleProgram
collectImportedLocalNames/collectNewExprLocalNames calls are removed). Adds the {@attach}
5.29+ version gate to the docs, matching the sibling reactivity/window 5.11.0+ note.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .changeset/effect-rules-validity.md           | 17 +++++++-------
 .../ja/rules/correctness/effect-as-onmount.md | 13 +++++++----
 .../rules/correctness/effect-as-onmount.md    | 13 +++++++----
 ...-02-correct003-effect-as-onmount-design.md | 14 ++++++-----
 packages/core/src/component-parse.ts          | 23 +++++++++++--------
 packages/core/test/component-parse.test.ts    |  6 +++++
 6 files changed, 54 insertions(+), 32 deletions(-)

diff --git a/.changeset/effect-rules-validity.md b/.changeset/effect-rules-validity.md
index b5ed5faf9..659cc0ce1 100644
--- a/.changeset/effect-rules-validity.md
+++ b/.changeset/effect-rules-validity.md
@@ -5,14 +5,15 @@
 Two `correctness/effect-*` rule content fixes from the v1.0 rule-validity review:
 
 - `correctness/effect-as-onmount` no longer flags an `$effect` that reads a reactive value through
-  a member expression on an imported binding or a `new`-ed local — a class instance with `$state`
-  fields, a `SvelteMap`/`SvelteSet`, an imported runes-module state object, and
-  `svelte/reactivity/window` were all indistinguishable from the true mount-only positive, and the
-  rule's "use `onMount` instead" advice would have converted a re-running effect into run-once. The
-  change is strictly narrowing (only removes findings, never adds one); the rule's message,
-  recommendation, and docs now name `{@attach}` and event handlers alongside `onMount` instead of
-  presenting `onMount` as the sole fix, and the docs admit the one remaining blind spot (a reactive
-  value reached only through a plain function's return value).
+  a member expression on an imported binding or a local declared with a `new …()` initializer — a
+  class instance with `$state` fields, a `SvelteMap`/`SvelteSet`, an imported runes-module state
+  object, and `svelte/reactivity/window` were all indistinguishable from the true mount-only
+  positive, and the rule's "use `onMount` instead" advice would have converted a re-running effect
+  into run-once. The change is strictly narrowing (only removes findings, never adds one); the
+  rule's message, recommendation, and docs now name `{@attach}` and event handlers alongside
+  `onMount` instead of presenting `onMount` as the sole fix, and the docs admit the remaining blind
+  spots (a reactive value reached only through a plain function's return value, or through a local
+  assigned `new …()` after its declaration instead of at it).
 - The documented fix snippets for `correctness/server-browser-global` and
   `correctness/instance-browser-global` now use `onMount` (and, for the latter,
   `svelte/reactivity/window` as the preferred modern form) instead of an `$effect` that assigns a
diff --git a/docs/src/content/docs/ja/rules/correctness/effect-as-onmount.md b/docs/src/content/docs/ja/rules/correctness/effect-as-onmount.md
index a5e49a42d..14063d827 100644
--- a/docs/src/content/docs/ja/rules/correctness/effect-as-onmount.md
+++ b/docs/src/content/docs/ja/rules/correctness/effect-as-onmount.md
@@ -7,7 +7,7 @@ description: reactive 値を読まない $effect は、イベントハンドラ
 
 ## チェック内容
 
-本体が空ではないのに、このチェックから見える reactive 値を一切読まない `$effect` / `$effect.pre` を検出します。`$state`、`$derived`、`$props`、import されたバインディング、`new` で初期化されたローカル変数、store 購読のいずれもなく、裸の関数呼び出し（`foo()`）もないものです。そのような effect はマウント後に一度だけ実行され、このチェックが追跡できる範囲では再実行されません。コンポーネントのインスタンススクリプトを静的（CLI）解析します。
+本体が空ではないのに、このチェックから見える reactive 値を一切読まない `$effect` / `$effect.pre` を検出します。`$state`、`$derived`、`$props`、import されたバインディング、`new …()` を初期化子として宣言されたローカル変数、store 購読のいずれもなく、裸の関数呼び出し（`foo()`）もないものです。そのような effect はマウント後に一度だけ実行され、このチェックが追跡できる範囲では再実行されません。コンポーネントのインスタンススクリプトを静的（CLI）解析します。
 
 ## なぜ重要か
 
@@ -25,9 +25,14 @@ description: reactive 値を読まない $effect は、イベントハンドラ
 </script>
 ```
 
-ユーザー操作への応答として実行しているなら、`$effect` よりイベントハンドラを優先してください。外部ライブラリ（チャートやツールチップなど）と要素を同期しているなら、[`{@attach ...}`](https://svelte.dev/docs/svelte/@attach) を優先してください — `$effect` や `onMount` より現在推奨されている DOM/ライブラリ同期の方法です。
+ユーザー操作への応答として実行しているなら、`$effect` よりイベントハンドラを優先してください。外部ライブラリ（チャートやツールチップなど）と要素を同期しているなら、[`{@attach ...}`](https://svelte.dev/docs/svelte/@attach)（5.29 以降）を優先してください — `$effect` や `onMount` より現在推奨されている DOM/ライブラリ同期の方法です。
 
-## 既知の制限: 素の関数呼び出しの戻り値経由のリアクティビティ
+## 既知の制限
 
-このチェックは、rune の宣言（`$state`/`$derived`/`$props`）、import されたバインディング、`new …()` で初期化されたローカル変数など、たどれる名前を経由した reactive 読み取りを認識します — これはクラスの `$state` フィールド、`SvelteMap`/`SvelteSet`、import された runes モジュールの状態オブジェクト、`svelte/reactivity/window` をカバーします。素の関数の戻り値（`const c = createCounter()`）経由でしか到達できない reactive な値には、たどれる名前がないため、そのように書かれた本物の reactive な effect でも検出されてしまうことがあります。該当する場合は、動作しているコードを `onMount` に移すのではなく、
+このチェックは、rune の宣言（`$state`/`$derived`/`$props`）、import されたバインディング、`new …()` を初期化子として宣言されたローカル変数（`const x = new Foo()`）など、たどれる名前を経由した reactive 読み取りを認識します — これはクラスの `$state` フィールド、`SvelteMap`/`SvelteSet`、import された runes モジュールの状態オブジェクト、`svelte/reactivity/window` をカバーします。以下の2つの形はたどれる名前がないため、そのように書かれた本物の reactive な effect でも検出されてしまうことがあります:
+
+- 素の関数の戻り値（`const c = createCounter()`）経由でしか到達できない reactive な値。
+- 宣言時ではなく宣言後に `new …()` を代入したローカル変数（`let m; m = new SvelteMap();`）— 初期化子として宣言された形のみ認識されます。
+
+該当する場合は、動作しているコードを `onMount` に移すのではなく、
 [`svelte-vitals-disable-next-line`](/ja/guides/cli#特定の指摘だけをインラインで抑制する) コメントで抑制してください。
diff --git a/docs/src/content/docs/rules/correctness/effect-as-onmount.md b/docs/src/content/docs/rules/correctness/effect-as-onmount.md
index fe70e3732..134c33798 100644
--- a/docs/src/content/docs/rules/correctness/effect-as-onmount.md
+++ b/docs/src/content/docs/rules/correctness/effect-as-onmount.md
@@ -7,7 +7,7 @@ description: An $effect that reads no reactive value belongs in an event handler
 
 ## What it checks
 
-Flags an `$effect` / `$effect.pre` whose non-empty body reads no reactive value that this analysis can see — no `$state`, `$derived`, `$props`, imported binding, `new`-ed local, or store subscription, and no bare function call (`foo()`). Such an effect runs once after mount and never re-runs on the paths this check can follow. Checked by static (CLI) analysis of component instance scripts.
+Flags an `$effect` / `$effect.pre` whose non-empty body reads no reactive value that this analysis can see — no `$state`, `$derived`, `$props`, imported binding, local declared with a `new …()` initializer, or store subscription, and no bare function call (`foo()`). Such an effect runs once after mount and never re-runs on the paths this check can follow. Checked by static (CLI) analysis of component instance scripts.
 
 ## Why it matters
 
@@ -25,9 +25,14 @@ An `$effect` that never reacts to anything is usually a slower, less direct stan
 </script>
 ```
 
-If the effect runs in response to a user interaction, prefer an event handler over `$effect`. If it syncs an element with an external library (e.g. a chart or a tooltip), prefer [`{@attach ...}`](https://svelte.dev/docs/svelte/@attach) instead — it's the current recommended way to do DOM/library sync, ahead of both `$effect` and `onMount`.
+If the effect runs in response to a user interaction, prefer an event handler over `$effect`. If it syncs an element with an external library (e.g. a chart or a tooltip), prefer [`{@attach ...}`](https://svelte.dev/docs/svelte/@attach) (5.29+) instead — it's the current recommended way to do DOM/library sync, ahead of both `$effect` and `onMount`.
 
-## Known limitation: reactivity reached through a plain function call
+## Known limitations
 
-This check recognizes a reactive read through a name it can trace back to a rune declarator (`$state`/`$derived`/`$props`), an imported binding, or a local initialized with `new …()` — which covers class `$state` fields, `SvelteMap`/`SvelteSet`, an imported runes-module state object, and `svelte/reactivity/window`. A reactive value reached only through a plain function's return value (`const c = createCounter()`) has no such name to trace, so a genuinely reactive effect built that way can still be flagged. If that's your case, suppress it with a
+This check recognizes a reactive read through a name it can trace back to a rune declarator (`$state`/`$derived`/`$props`), an imported binding, or a local declared with a `new …()` initializer (`const x = new Foo()`) — which covers class `$state` fields, `SvelteMap`/`SvelteSet`, an imported runes-module state object, and `svelte/reactivity/window`. Two shapes have no such name to trace, so a genuinely reactive effect built either way can still be flagged:
+
+- A reactive value reached only through a plain function's return value (`const c = createCounter()`).
+- A local assigned `new …()` after its declaration instead of at it (`let m; m = new SvelteMap();`) — only the declarator-init form is recognized.
+
+If that's your case, suppress it with a
 [`svelte-vitals-disable-next-line`](/guides/cli#suppressing-a-single-finding-inline) comment rather than moving working code into `onMount`.
diff --git a/docs/superpowers/specs/2026-07-02-correct003-effect-as-onmount-design.md b/docs/superpowers/specs/2026-07-02-correct003-effect-as-onmount-design.md
index 6b9b2d3c4..ec4d854b6 100644
--- a/docs/superpowers/specs/2026-07-02-correct003-effect-as-onmount-design.md
+++ b/docs/superpowers/specs/2026-07-02-correct003-effect-as-onmount-design.md
@@ -168,9 +168,11 @@ a class instance (`new Counter()`, `$state` fields), a `SvelteMap`/`SvelteSet`,
 runes-module state object, or `svelte/reactivity/window` was indistinguishable from the true
 positive — all four yielded `mountOnly: true`, and the rule's advice to switch to `onMount`
 would have frozen working reactive code. Fixed by narrowing detection: `bodyReadsReactive` now
-also treats a member read on any imported binding or any local initialized with `new …()` as
-reactive (`collectImportedLocalNames`/`collectNewExprLocalNames` in `component-parse.ts`),
-folded into the same `reactiveNames` set. This is strictly narrower — it only ever suppresses a
-finding, never adds one — and does not close the remaining gap: a reactive value reached only
-through a plain function's return value still has no traceable name and can still be flagged
-(documented as a known limitation in the rule's docs page instead of silently claimed away).
+also treats a member read on any imported binding or any local declared with a `new …()`
+initializer as reactive (`collectImportedLocalNames`/`collectNewExprLocalNames` in
+`component-parse.ts`), folded into the same `reactiveNames` set. This is strictly narrower — it
+only ever suppresses a finding, never adds one — and does not close the remaining gaps: a
+reactive value reached only through a plain function's return value still has no traceable name
+and can still be flagged, and neither does one assigned `new …()` after its declaration
+(`let m; m = new SvelteMap();` — declarator-init only, by design; see the rule's docs page for
+both, instead of silently claiming zero false positives away).
diff --git a/packages/core/src/component-parse.ts b/packages/core/src/component-parse.ts
index f28697427..bc4efc396 100644
--- a/packages/core/src/component-parse.ts
+++ b/packages/core/src/component-parse.ts
@@ -940,9 +940,12 @@ function collectImportedLocalNames(program: Node, acc: Set<string>): void {
 }
 
 /**
- * Local names initialized with a `new …()` expression, anywhere in a program
- * (correctness/effect-as-onmount). A class instance is opaque the same way an import is — it may
- * carry `$state` fields — so it's folded into `reactiveNames` alongside imports.
+ * Local names declared with a `new …()` initializer (`const x = new Foo()`), anywhere in a
+ * program (correctness/effect-as-onmount). A class instance is opaque the same way an import is —
+ * it may carry `$state` fields — so it's folded into `reactiveNames` alongside imports.
+ * Declarator-init only: `let x; x = new Foo();` is not seen (`VariableDeclarator.init` is unset,
+ * and the later `AssignmentExpression` isn't a declarator at all) — a rarer style, left
+ * undetected rather than adding an assignment-tracking pass for it.
  */
 function collectNewExprLocalNames(program: Node, acc: Set<string>): void {
   walkEstree(program, (n) => {
@@ -953,13 +956,13 @@ function collectNewExprLocalNames(program: Node, acc: Set<string>): void {
 
 /**
  * Whether an $effect callback body reads a reactive value (correctness/effect-as-onmount, conservative):
- * a reactive name (rune declarator, imported binding, or `new`-ed local — see
- * `collectImportedLocalNames`/`collectNewExprLocalNames`), a `$`-prefixed store subscription, or
- * any bare-identifier call. Still blind to a reactive value reached only through a plain function
- * call's return value (`const c = createCounter()`) or a prop-drilled/destructured member of one
- * of the above — narrower than "any" reactive read, deliberately: those shapes have no
- * syntactic marker to key off, so treating them as reactive by default would give up detection
- * entirely rather than narrow it.
+ * a reactive name (rune declarator, imported binding, or a local declared with a `new …()`
+ * initializer — see `collectImportedLocalNames`/`collectNewExprLocalNames`), a `$`-prefixed
+ * store subscription, or any bare-identifier call. Still blind to a reactive value reached only
+ * through a plain function call's return value (`const c = createCounter()`) or a
+ * prop-drilled/destructured member of one of the above — narrower than "any" reactive read,
+ * deliberately: those shapes have no syntactic marker to key off, so treating them as reactive by
+ * default would give up detection entirely rather than narrow it.
  */
 function bodyReadsReactive(fn: Node, reactiveNames: Set<string>): boolean {
   let reads = false;
diff --git a/packages/core/test/component-parse.test.ts b/packages/core/test/component-parse.test.ts
index 7fac95eb1..d48938f68 100644
--- a/packages/core/test/component-parse.test.ts
+++ b/packages/core/test/component-parse.test.ts
@@ -345,6 +345,12 @@ describe('parseComponentFacts — mount-only $effect (correctness/effect-as-onmo
   it('is still mountOnly for the true positive: a member call on a plain, non-reactive local', () => {
     expect(facts('let el; $effect(() => { el.focus(); });')[0]!.mountOnly).toBe(true);
   });
+  it('is not mountOnly for a member read on a binding imported in <script module> only', () => {
+    const src =
+      "<script module>import { counterState } from './state.svelte.js';</script>" +
+      '<script>$effect(() => { counterState.count; });</script>';
+    expect(parseComponentFacts(src, 'C.svelte').effects[0]!.mountOnly).toBe(false);
+  });
 });
 
 describe('parseComponentFacts — constable $state (correctness/unmutated-state)', () => {

From 824d695551fb0fbe5d83d5cc5dda17a1741a879e Mon Sep 17 00:00:00 2001
From: oekazuma <koneko0604@gmail.com>
Date: Sun, 9 Aug 2026 03:17:18 +0900
Subject: [PATCH 3/3] =?UTF-8?q?docs(core):=20fix=20CodeRabbit=20review=20n?=
 =?UTF-8?q?otes=20=E2=80=94=20SSR/timing=20precision,=20copyable=20fix=20b?=
 =?UTF-8?q?lock=20split,=20shadowing=20clause?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- effect-as-derived.md (en+ja): "$effect runs one tick after mount" -> "runs only after the
  component has mounted to the DOM" (matches the official docs' framing); "$derived evaluates
  during SSR" unconditional claim qualified to "evaluates when read, and a template read happens
  during SSR too" — same imprecision existed in both locales, both fixed.
- instance-browser-global.md (en+ja): the svelte/reactivity/window fix fence contained the ❌
  window.innerWidth line ahead of the ✅ import — a verbatim copy would still crash SSR. Split
  into a standalone ❌ example and a fix fence containing only the import + usage. Both
  autofixer-verified clean.
- 2026-07-02-correct003-effect-as-onmount-design.md: one-line inline pointer at the refuted
  "conservative — no false positives" claim; no other historical-section rewrites, per convention.
- effect-as-onmount.md (en+ja) + changeset: added the shadowing-granularity clause — matching is
  by identifier text, not lexical scope (same as the rule's pre-existing rune-name handling), so a
  callback-local binding that shadows an imported/new-declared name still reads as reactive; this
  can only suppress a finding, never wrongly flag one.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .changeset/effect-rules-validity.md           |  5 ++++-
 .../ja/rules/correctness/effect-as-derived.md | 12 +++++-----
 .../ja/rules/correctness/effect-as-onmount.md |  2 ++
 .../correctness/instance-browser-global.md    |  8 +++++--
 .../rules/correctness/effect-as-derived.md    | 22 ++++++++++---------
 .../rules/correctness/effect-as-onmount.md    |  2 ++
 .../correctness/instance-browser-global.md    |  8 +++++--
 ...-02-correct003-effect-as-onmount-design.md |  2 +-
 8 files changed, 40 insertions(+), 21 deletions(-)

diff --git a/.changeset/effect-rules-validity.md b/.changeset/effect-rules-validity.md
index 659cc0ce1..f3a09ac22 100644
--- a/.changeset/effect-rules-validity.md
+++ b/.changeset/effect-rules-validity.md
@@ -13,7 +13,10 @@ Two `correctness/effect-*` rule content fixes from the v1.0 rule-validity review
   rule's message, recommendation, and docs now name `{@attach}` and event handlers alongside
   `onMount` instead of presenting `onMount` as the sole fix, and the docs admit the remaining blind
   spots (a reactive value reached only through a plain function's return value, or through a local
-  assigned `new …()` after its declaration instead of at it).
+  assigned `new …()` after its declaration instead of at it) plus a pre-existing shadowing
+  granularity note: matching is by identifier text, not lexical scope, so a callback-local binding
+  that shadows an imported or `new`-declared name is still treated as reactive — that can only
+  suppress a finding, never wrongly flag one.
 - The documented fix snippets for `correctness/server-browser-global` and
   `correctness/instance-browser-global` now use `onMount` (and, for the latter,
   `svelte/reactivity/window` as the preferred modern form) instead of an `$effect` that assigns a
diff --git a/docs/src/content/docs/ja/rules/correctness/effect-as-derived.md b/docs/src/content/docs/ja/rules/correctness/effect-as-derived.md
index 4aa55ca78..b545bca36 100644
--- a/docs/src/content/docs/ja/rules/correctness/effect-as-derived.md
+++ b/docs/src/content/docs/ja/rules/correctness/effect-as-derived.md
@@ -40,7 +40,7 @@ description: 状態を代入するだけの $effect は $derived に置き換え
 </script>
 ```
 
-`$derived` は hydration 中も含めて次に読まれたタイミングで再計算されますが、`$effect` は mount の1ティック後に実行されます。それがこのパターンの狙いです。この形を `$derived` に置き換えるのは `$effect` が防いでいたバグの再発なので、「修正」せず [`svelte-vitals-disable-next-line`](/ja/guides/cli#特定の指摘だけをインラインで抑制する) コメントで抑制してください。
+`$derived` は hydration 中も含めて次に読まれたタイミングで再計算されますが、`$effect` はコンポーネントが DOM にマウントされた後にのみ実行されます。それがこのパターンの狙いです。この形を `$derived` に置き換えるのは `$effect` が防いでいたバグの再発なので、「修正」せず [`svelte-vitals-disable-next-line`](/ja/guides/cli#特定の指摘だけをインラインで抑制する) コメントで抑制してください。
 
 ## 既知の制限: browser global の捕捉
 
@@ -57,9 +57,11 @@ description: 状態を代入するだけの $effect は $derived に置き換え
 </script>
 ```
 
-これを `$derived(localStorage.getItem('filters'))` に置き換えると、その式は SSR 中にも評価されてしまい、
-この2つのルールが防ごうとしている `ReferenceError: localStorage is not defined` を再発させます。
-`localStorage`/`window` などは、まさに `$derived` が安全に読めない値です —— derived の式はサーバーサイド
-レンダリング中にも実行され得るからです。`onMount`、あるいは `window` のプロパティなら
+`$derived` は、その derived な値が何かに読まれた時点で初めて式を評価します —— ただ、この値は元々読まれる
+ため（典型的にはテンプレートから）に存在し、テンプレートからの読み取りは SSR 中にも起こります。これを
+`$derived(localStorage.getItem('filters'))` に置き換えると、サーバーサイドレンダリング中に誰かがそれを
+読んだ瞬間、この2つのルールが防ごうとしている `ReferenceError: localStorage is not defined` を再発させます。
+`localStorage`/`window` などは、まさに `$derived` が安全に読めない値です —— クライアント限定だと保証できる
+読み取りが存在しないからです。`onMount`、あるいは `window` のプロパティなら
 [`svelte/reactivity/window`](https://svelte.dev/docs/svelte/svelte-reactivity-window) を使ってください
 （修正方法はこの2つのルールのドキュメントを参照）。`$derived` に切り替えるのではなく、この指摘は抑制してください。
diff --git a/docs/src/content/docs/ja/rules/correctness/effect-as-onmount.md b/docs/src/content/docs/ja/rules/correctness/effect-as-onmount.md
index 14063d827..8aeb31b70 100644
--- a/docs/src/content/docs/ja/rules/correctness/effect-as-onmount.md
+++ b/docs/src/content/docs/ja/rules/correctness/effect-as-onmount.md
@@ -34,5 +34,7 @@ description: reactive 値を読まない $effect は、イベントハンドラ
 - 素の関数の戻り値（`const c = createCounter()`）経由でしか到達できない reactive な値。
 - 宣言時ではなく宣言後に `new …()` を代入したローカル変数（`let m; m = new SvelteMap();`）— 初期化子として宣言された形のみ認識されます。
 
+名前の照合は字句スコープではなく識別子のテキストで行われます —— これは rune 名に対してこのルールが元々使っている粒度と同じです。そのため、import または `new` で宣言された名前をシャドーするコールバックローカルな binding（例えば同じ名前を再利用するパラメータ）も reactive として扱われます。これは指摘を見逃す方向にしか働かず、誤って検出することはありません。
+
 該当する場合は、動作しているコードを `onMount` に移すのではなく、
 [`svelte-vitals-disable-next-line`](/ja/guides/cli#特定の指摘だけをインラインで抑制する) コメントで抑制してください。
diff --git a/docs/src/content/docs/ja/rules/correctness/instance-browser-global.md b/docs/src/content/docs/ja/rules/correctness/instance-browser-global.md
index 1b0bea23a..96678c7ed 100644
--- a/docs/src/content/docs/ja/rules/correctness/instance-browser-global.md
+++ b/docs/src/content/docs/ja/rules/correctness/instance-browser-global.md
@@ -19,12 +19,16 @@ description: インスタンススクリプトは SSR 時にサーバーでも
 
 ## 修正方法
 
-`window` のプロパティなら、[`svelte/reactivity/window`](https://svelte.dev/docs/svelte/svelte-reactivity-window)（5.11.0 以降）が現在推奨される形です — ガード不要で、サーバーでは `undefined`、クライアントではリアクティブになります:
-
 ```svelte
 <script>
   const width = window.innerWidth; // ❌ SSR がクラッシュ
+</script>
+```
 
+`window` のプロパティなら、[`svelte/reactivity/window`](https://svelte.dev/docs/svelte/svelte-reactivity-window)（5.11.0 以降）が現在推奨される形です — ガード不要で、サーバーでは `undefined`、クライアントではリアクティブになります:
+
+```svelte
+<script>
   import { innerWidth } from 'svelte/reactivity/window';
 </script>
 
diff --git a/docs/src/content/docs/rules/correctness/effect-as-derived.md b/docs/src/content/docs/rules/correctness/effect-as-derived.md
index 7d87f1cad..d4b146cda 100644
--- a/docs/src/content/docs/rules/correctness/effect-as-derived.md
+++ b/docs/src/content/docs/rules/correctness/effect-as-derived.md
@@ -42,9 +42,9 @@ the "mount signal" idiom used to avoid SSR/prerender ↔ hydration mismatches:
 </script>
 ```
 
-`$derived` recomputes on next read, including during hydration; `$effect` runs one tick after mount,
-which is the whole point here. Converting this shape to `$derived` reintroduces the bug the
-`$effect` was added to prevent — so suppress it with a
+`$derived` recomputes on next read, including during hydration; `$effect` runs only after the
+component has mounted to the DOM, which is the whole point here. Converting this shape to
+`$derived` reintroduces the bug the `$effect` was added to prevent — so suppress it with a
 [`svelte-vitals-disable-next-line`](/guides/cli#suppressing-a-single-finding-inline) comment
 rather than "fixing" it.
 
@@ -64,10 +64,12 @@ reads a browser-only global and assigns it to `$state`:
 </script>
 ```
 
-Converting this to `$derived(localStorage.getItem('filters'))` would evaluate the expression during
-SSR — reintroducing the exact `ReferenceError: localStorage is not defined` those two rules exist to
-prevent. `localStorage`/`window`/etc. are exactly the values `$derived` cannot safely read, since a
-derived expression can run during server-side rendering. Prefer `onMount`, or
-[`svelte/reactivity/window`](https://svelte.dev/docs/svelte/svelte-reactivity-window) for `window`
-properties — see those two rules' docs for the fix — and suppress this finding rather than switching to
-`$derived`.
+`$derived` only evaluates its expression when something reads the derived value — but a value like
+this exists to be read (typically from the template), and a template read happens during SSR too.
+Converting this to `$derived(localStorage.getItem('filters'))` would reintroduce the exact
+`ReferenceError: localStorage is not defined` those two rules exist to prevent, the moment
+something reads it during server-side rendering. `localStorage`/`window`/etc. are exactly the
+values `$derived` cannot safely read, because there is no read that is guaranteed client-only.
+Prefer `onMount`, or [`svelte/reactivity/window`](https://svelte.dev/docs/svelte/svelte-reactivity-window)
+for `window` properties — see those two rules' docs for the fix — and suppress this finding rather
+than switching to `$derived`.
diff --git a/docs/src/content/docs/rules/correctness/effect-as-onmount.md b/docs/src/content/docs/rules/correctness/effect-as-onmount.md
index 134c33798..a2efb7c01 100644
--- a/docs/src/content/docs/rules/correctness/effect-as-onmount.md
+++ b/docs/src/content/docs/rules/correctness/effect-as-onmount.md
@@ -34,5 +34,7 @@ This check recognizes a reactive read through a name it can trace back to a rune
 - A reactive value reached only through a plain function's return value (`const c = createCounter()`).
 - A local assigned `new …()` after its declaration instead of at it (`let m; m = new SvelteMap();`) — only the declarator-init form is recognized.
 
+Name matching is by identifier text, not lexical scope — the same granularity this rule has always used for rune names — so a callback-local binding that shadows an imported or `new`-declared name (e.g. a parameter reusing that name) is still treated as reactive. That can only suppress a finding, never wrongly flag one.
+
 If that's your case, suppress it with a
 [`svelte-vitals-disable-next-line`](/guides/cli#suppressing-a-single-finding-inline) comment rather than moving working code into `onMount`.
diff --git a/docs/src/content/docs/rules/correctness/instance-browser-global.md b/docs/src/content/docs/rules/correctness/instance-browser-global.md
index 621d41fa3..9ea0facb0 100644
--- a/docs/src/content/docs/rules/correctness/instance-browser-global.md
+++ b/docs/src/content/docs/rules/correctness/instance-browser-global.md
@@ -19,12 +19,16 @@ A browser global used only as a `$props()` destructuring default (`let { width =
 
 ## How to fix
 
-The preferred modern form for a `window` property is [`svelte/reactivity/window`](https://svelte.dev/docs/svelte/svelte-reactivity-window) (5.11.0+) — no guard needed, `undefined` on the server, reactive on the client:
-
 ```svelte
 <script>
   const width = window.innerWidth; // ❌ crashes SSR
+</script>
+```
 
+The preferred modern form for a `window` property is [`svelte/reactivity/window`](https://svelte.dev/docs/svelte/svelte-reactivity-window) (5.11.0+) — no guard needed, `undefined` on the server, reactive on the client:
+
+```svelte
+<script>
   import { innerWidth } from 'svelte/reactivity/window';
 </script>
 
diff --git a/docs/superpowers/specs/2026-07-02-correct003-effect-as-onmount-design.md b/docs/superpowers/specs/2026-07-02-correct003-effect-as-onmount-design.md
index ec4d854b6..d1c907680 100644
--- a/docs/superpowers/specs/2026-07-02-correct003-effect-as-onmount-design.md
+++ b/docs/superpowers/specs/2026-07-02-correct003-effect-as-onmount-design.md
@@ -29,7 +29,7 @@ assignsOnlyState: boolean }` (CORRECT002 uses `assignsOnlyState`).
 
 ## Design
 
-### 1. What counts as "reads a reactive value" (conservative — no false positives)
+### 1. What counts as "reads a reactive value" (conservative — no false positives) (refuted and revised — see the 2026-08-09 addendum below)
 
 An `$effect` body is treated as reading a reactive value (so it is **not**
 flagged) when it contains **any** of: