[sergo] Sergo Report: DELTA-80to81-newlinter-audit(goroutineresourceleak) - 2026-10-14

[github-actions[bot]]

🔬 Sergo Report: DELTA-80to81-newlinter-audit(goroutineresourceleak) + reconcile - 2026-10-14

Date: 2026-10-14
Strategy: DELTA-80to81-newlinter-audit(goroutineresourceleak:paren_unwrap_gap-6-sites) + reconcile(sg95a1-still-open-accurate, sg95a2-CONFIRMED-genuinely-fixed) + cached-vein(resourcetracker-Acquisitions-callbacks-share-the-acquisition-side-mirror-of-sg95a2)
Success Score: 9/10

Executive Summary

Run R96. The custom-linter registry grew from 80 to 81 analyzers (goroutineresourceleak, PR #68502, merged 2026-10-13). Reconcile confirmed one prior fix landed genuinely and one prior finding remains open and accurate. New-explore on the freshly-merged linter, plus a cached-vein follow-up on the three resourcetracker-based linters, both surfaced genuine, high-confidence bugs in the same well-established paren_unwrap_gap pattern class. 2 issues filed.

🛠️ Serena Tools Update

24 tools, stable (activate_project, find_symbol, search_for_pattern, etc, no change vs prior runs). activate_project on the repo root succeeded (go/typescript/bash language servers).

📊 Strategy Selection (50/50 split)

• Cached (50%): Reconcile the 2 open findings from R95 against current gh issue state, then verify the shared resourcetracker.go fix and probe its three dependent linters (manualmutexunlock, fileclosenotdeferred, contextcancelnotdeferred) for bug classes beyond the one just fixed - this was R95 own suggested next step.
• New (50%): Audit the newly-registered 81st linter (goroutineresourceleak) end to end, since new linters have historically shipped day-one bugs in more than half of the recent runs where the registry grew.

🔍 Analysis Execution

Reconcile: issue #68309 (sg95a1, contextcancelnotdeferred wasm-flag omission, lineage #55932->65753->68309) still open - re-confirmed accurate via cgo.yml diff (native has the flag, wasm omits it). Issue #68310 (sg95a2, resourcetracker cleanup-side paren gap) was closed completed - spot-verified genuinely fixed: resourcetracker.go lines 213 and 218 now both call astutil.UnwrapParenExpr before the CallExpr assertion.

Cached-vein: Re-read manualmutexunlock.go, fileclosenotdeferred.go, contextcancelnotdeferred.go in full. The shared framework own Acquisitions callback is invoked with the raw, non-unwrapped AST node (resourcetracker.go:188), and all three linters own Acquisitions implementations do a bare CallExpr assertion with no UnwrapParenExpr call - the exact mirror, on the acquisition side, of the bug just fixed on the cleanup side. A parenthesized acquisition such as a wrapped Lock call or a wrapped context.WithCancel call is never entered into tracked state, so the whole leak check silently never engages for that resource - a stronger miss than a false negative on cleanup detection.

New-explore: First-ever audit of goroutineresourceleak (does not reuse resourcetracker; reimplements lock/unlock, context-cancel, and channel detection independently). Found the same paren_unwrap_gap class at 6 call sites in one file (contextCancelAcquisition, isDeferredCancel, mutexLockAcquisition, isDeferredUnlock, and 3 sites in markChannelUsage) - notably the same file correctly unwraps parens for the goroutine literal itself at line 75, so this is an internal inconsistency rather than a missing dependency. Not yet wired into cgo.yml, so currently latent.

Also noted: the companion ADR under docs/adr describes a stale, pre-refactor version of the linter behavior (claims no nested-block or loop-WaitGroup checks, both of which the shipped code actually has). Flagged for awareness only - out of scope for this Go-files-only audit.

✅ Improvement Tasks Generated

1. [sg96a1] Fix the acquisition-side ParenExpr unwrap gap in manualmutexunlock.go / fileclosenotdeferred.go / contextcancelnotdeferred.go Acquisitions callbacks (one shared root cause, three call sites) - Small effort.
2. [sg96a2] Fix the 6-site ParenExpr unwrap gap in the brand-new goroutineresourceleak.go (lock/cancel/channel detection) - Medium effort.

📈 Success Metrics

• Findings: 4 (2 reconcile confirmations + 2 new bugs)
• Tasks created: 2
• Issues filed: 2 of 3 budget (chose depth over padding with weaker findings)
• Success score: 9/10

🎯 Recommendations

• Prioritize sg96a1: it affects 3 CI-relevant linters at once and is a direct, surgical one-line-per-file fix mirroring a fix that already landed on the opposite side of the same state machine.
• sg96a2 should get testdata coverage for parenthesized forms before goroutineresourceleak is added to cgo.yml LINTER_FLAGS, to avoid shipping an enforced linter with a known day-one gap.

🔄 Next Run Preview

Verify sg96a1/sg96a2 landed; expect 3 opens (#68309 plus the two new issues) unless bulk-closed. If the registry grows to 82, audit the new linter fresh. Otherwise, probe goroutineresourceleak checkCancelLeak/checkMutexLeak immediate-next-statement-only adjacency requirement (any intervening non-exiting statement between acquisition and defer currently triggers a report, even though the defer still runs) for a possible false-positive class - flagged this run but not yet confirmed against live repo code.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 375.9 AIC · ⊞ 5.2K · ◷

• expires on Oct 14, 2026, 8:01 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #68946.