v4.8.1 — staticcheck reads Go 1.27.2 again

Staticcheck caught up with the Go pin, so the gate v4.8.0 waived is back everywhere it was waived. And the review v4.8.0 shipped without, of its eighth round's fixes, ran here.

Staticcheck 2026.2.2 reads Go 1.27.2. v4.8.0 pinned Go 1.27.2, whose compiler writes export data V5. Staticcheck 2026.2.1 could not read it (dominikh/go-tools#1832), so operations/ci.md ruled that a project takes its staticcheck line out under a dated README waiver until a release reads it. The fix landed on master on 2026-10-09 — v4.8.0's page, published the next morning, still called the issue open — and shipped in 2026.2.2 (v0.8.2) on 2026-10-12: "Staticcheck now supports the updated export data format used by Go 1.27.2." Under 1.27.2 it runs clean on the reference, where 2026.2.1 still fails.

How to tell the fix has shipped. ci.md said to put the line back "once it runs", which nobody could test. A staticcheck that cannot read the pin still checks the packages that import nothing, and the fixed release exits 1 on any finding too. The bullet now says to judge by the export-data error, under the pin. Then fix what the returning line reports, one commit per commit type, and put the line back, deleting the waiver, in a commit of its own.

Round eight, reviewed. v4.8.0 shipped its eighth round's eleven fixes unread, and Owed kept them for the next run. This was it. Four rounds of two adversarial passes read all ten that remain in the rules and executed their claims against Go 1.27.2, with toy modules, file:// proxies and bare remotes. They found 5, 5, 7 and 6 distinct defects, three of the first five in a draft of this release's own record and nearly all the rest in the shell mechanics of operations/ci.md and operations/cli-release.md. The ones that mattered most:

• The release check could empty the module cache. Its cleanup line read the d the line before set. Run alone in a fresh shell, the way an agent's shell tool runs it, it emptied this machine's own cache; in an interactive zsh with oh-my-zsh, d already names a directory. The check is now one subshell: mktemp succeeds or nothing runs, a trap on EXIT, INT, TERM and HUP cleans up, and d dies with the parentheses.
• A failed check read as a pass. The block exited with its cleanup's status, and pasted whole after a red make ci it still asked the proxy for the untagged version, which can delay the real check by up to 30 minutes. The tag-and-push line now stands alone. The check runs only once git ls-remote shows the tag landed, and it exits with its own status.
• Past v1, the check failed for every correct release. The install path needs the module's /vN, and on the bare path @latest stays on the v1 line. The channel line, the check, the version bump and the CLI checklist now say so.
• A put-back that held nothing. After go get raises the go line, go.mod already names the version that asked, so -require=<dep>@<current> held that very version; and the update section said to commit before it reached the go line. The holds now name the version from before the update, which git show HEAD:go.mod names until you commit, and the line is read before the commit.
• A tag on the wrong commit. The push names HEAD:main, so a tag made on a branch cannot go out on a commit main lacks.

This release does not meet the gate's first condition. After the third round, Andy chose one more and then the tag. Round four's seven fixes, aafa39f, went through the reference but no review pass, and VERIFICATION.md keeps them owed to the next run. Round eight's entry leaves Owed: its fixes have now been read and executed.

Not in this release. The child-process pattern sat out of this tag as it sat out of v4.8.0, and it is back on main in the commit after, still owed a run with round five's ten findings open. The canonical Go snippets were not re-run through 2026.2.2; v4.8.0 checked them with a rebuilt v0.8.1. No Last verified: date moved: the run read the sections it changed, not the documents whole. VERSIONS.md keeps its 2026-09-08 date: htmx 2.0.11 and modernc.org/sqlite v1.60.1 still wait for a ruling, and so does the exact modernc.org/libc the driver names, which go get -u ./... moves.

Budgets: library and web-application floors and change paths are unchanged. cli-tool's grew by the install box's 7: change path 5,311 → 5,318, floor 11,575 → 11,582. Reach grew with operations/: cli-tool 41,864 → 42,441, library 29,172 → 29,742, web-application 103,449 → 103,676.

Reference: baseline-reference v4.8.1, pinning aafa39f: ./verify.sh exits 0 over 79 gates, staticcheck among them, and make ci is green, both under Go 1.27.2.