[sergo] Sergo Report: Resourcetracker Fix Confirmation + Paren Gap - 2026-10-13

[github-actions[bot]]

Executive Summary

Run 95 for Sergo. The registry is stable at 80 analyzers (no new linter since R94/walkdirignoredeerror). Reconcile confirmed both findings filed last run (sg94a1, sg94a2) genuinely landed in code, while the long-standing contextcancelnotdeferred wasm-CI omission (lineage #55932 to #65753) auto-expired not_planned for a third time without being fixed and was refiled. Cached-vein follow-up on last runs own suggested probe (fileclosenotdeferred/manualmutexunlock for the ExprStmt paren-unwrap shape) led to pkg/linters/internal/resourcetracker/resourcetracker.go, the shared framework behind three linters at once. There, the previously-filed branch_state_merge bug (11 prior reverse-phantom cycles) is now confirmed genuinely fixed, and a new paren-unwrap gap was found in the same file affecting manualmutexunlock, fileclosenotdeferred, and contextcancelnotdeferred simultaneously.

Tool Updates

Serena: 24 tools, stable, activate_project confirmed working for go/typescript/bash with no approval prompt. Registry detector (Grep count of Analyzer lines in pkg/linters/registry.go): 80, unchanged since R94.

Strategy Split (50/50)

Cached reuse (50 percent): Reconcile open sergo-labeled issues against current code, the proven highest-value step every run since it routinely catches landed-but-open fixes and reverse-phantom auto-expirations. This run, a fresh gh api query returned zero open sergo issues outright, meaning the whole prior backlog (65753, sg94a1, sg94a2) had already resolved one way or another by the time this run started.

New exploration (50 percent): Rather than picking an arbitrary fresh target, followed R94s own recorded next step precisely: probe fileclosenotdeferred and manualmutexunlock for the ExprStmt paren-unwrap shape already found several times elsewhere. That probe led upstream into their shared dependency, pkg/linters/internal/resourcetracker, which had not been read in full since R81 and turned out to hold both a confirmed fix and a fresh bug.

Findings

Confirmed fixed (no refile needed):

• sg94a1 (doc.go and README.md missing 80th linter (walkdirignoredeerror) - breaks doc-sync parity tests #67865): doc.go and README were missing the 80th linter. Verified fixed: doc.go now lists walkdirignoredeerror.
• sg94a2 (ExprStmt branch skips ParenExpr unwrap in MatchDiscardedErrorCall, walkdirignoredeerror, and closeerrorunchecked #67866): ExprStmt branch of astutil.MatchDiscardedErrorCall skipped ParenExpr unwrapping. Verified fixed: both the AssignStmt and ExprStmt branches now call UnwrapParenExpr.
• resourcetracker.go branch_state_merge (resourcetracker: manual cleanup in one branch is masked by defer in a sibling branch #62304 lineage, 11 prior reverse-phantom cycles): verified genuinely fixed. walk() now clones tracked state into separate then/else branches before descending into If/Else bodies, then merges with hasManual as a logical OR and hasDefer as a logical AND, correctly flagging a manual-close arm even when a sibling arm defers the same resource.

New issues filed:

1. contextcancelnotdeferred wasm CI omission (sg95a1) - still unfixed in cgo.yml after a third auto-expire of the same underlying bug (contextcancelnotdeferred is enforced on native CI but absent from wasm LINTER_FLAGS - the registry-drift guard cannot detect it #55932 to contextcancelnotdeferred still enforced on native CI only - wasm LINTER_FLAGS omission unfixed (issue 55932 auto-expired, 2nd oc #65753 to now). The wasm custom-linters step omits the flag for this analyzer while the native step includes it, leaving the wasm-built packages (console, parser, styles, tty, workflow) unchecked.
2. resourcetracker manual-cleanup paren gap (sg95a2) - the shared framework behind manualmutexunlock, fileclosenotdeferred, and contextcancelnotdeferred does bare CallExpr assertions with no ParenExpr unwrapping in its manual-cleanup detection branches. A parenthesized manual cleanup call escapes detection, producing a false negative (a real resource leak goes unreported) rather than the usual false-positive-escape shape. One small fix in this shared file resolves it for all three linters at once.

Generated Tasks

1. Add the missing flag to the wasm LINTER_FLAGS string in cgo.yml (effort: small, one-line CI config change).
2. Import astutil in resourcetracker.go and wrap the relevant expressions with astutil.UnwrapParenExpr before the CallExpr type assertion, plus add testdata covering a parenthesized manual cleanup call (effort: small, two-line fix plus test coverage).

Metrics

Findings this run: 4 (2 fix confirmations, 1 reverse-phantom refile, 1 new shared-framework bug). Tasks generated: 2. Issues created: 2 of a possible 3, both non-overlapping and code-verified. Success score: 9 out of 10, consistent with the depth-over-padding pattern this project has favored across prior runs (average success score 8.72 over 95 runs).

Historical Context

This is the first confirmed genuine fix of the branch_state_merge lineage in resourcetracker.go after 11 consecutive reverse-phantom refiles since R73, a meaningful signal that longer-standing structural issues are now being addressed rather than only individual instances. The paren_unwrap_gap pattern class continues to be the most frequently recurring bug shape found across this project, reinforcing that any linter or shared framework doing a bare type assertion on an expression without first unwrapping parentheses is a standing day-one audit target.

Recommendations

Given the shared-framework fix now confirmed working for branch state, it is worth treating pkg/linters/internal/resourcetracker and pkg/linters/internal/astutil as first-class audit targets going forward, since a single fix there has three to five times the leverage of a per-linter fix. The ci_target_asymmetry class (native versus wasm LINTER_FLAGS drift) remains structurally undetectable by the existing doc-sync test guard, which unions both lists before checking membership; a dedicated parity test comparing the two LINTER_FLAGS strings directly would close this gap permanently instead of relying on manual reconcile catching it every few runs.

Next-Run Focus

Verify sg95a1 and sg95a2 landed. If the registry grows to 81, audit the new linter fresh. Otherwise, continue probing manualmutexunlock.go, fileclosenotdeferred.go, and contextcancelnotdeferred.go for bug classes in their own per-linter implementations, which have not been individually re-audited in several runs.

References: Run 38344311609

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 221.9 AIC · ⊞ 5.2K · ◷

• expires on Oct 13, 2026, 8:10 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #68592.