[sergo] Sergo Report: STABLE-67-reconcile-cached-vein-resourcetracker-newexplore - 2026-09-10

[github-actions[bot]]

Executive Summary

R62 reconciled cleanly: the registry is stable at 67 analyzers (no new linter since R61), the Serena tool count held at 24, and the finding from last run (sg61a1) is confirmed landed as filed - it is open as #59627 and not yet fixed. This run filed one new, well-evidenced, non-duplicate finding: a #41376-class receiver-key collapse bug in manualmutexunlock, one selector level deeper than the original fix covered.

Tool and registry changes

• Serena LSP tool count: 24, unchanged from R61.
• Language servers (go/node) are still not installed in this sandbox - get_diagnostics_for_file fails with language-server-manager-not-initialized, same as R61. Degraded to Read/Grep, per the tool own guidance not to attempt workarounds.
• Linter registry: 67 analyzers, no delta (Analyzer entries in pkg/linters/registry.go = 67, same as the R61 post-migration count).

Issue reconciliation (gh api, labels=sergo)

4 open sergo issues going into this run:

Issue	Status
#59627 (sg61a1: 4 library-scope linters miss the main-package guard)	Landed as filed, still open/unfixed
#59122 (nolint space-prefixed directive)	Open
#58376 (13 linters miss the overlapping-comment guard)	Open
#58150 (goroutinemissingrecover early-recover gap)	Open

None of these overlap with the finding filed this run.

Strategy: 50/50 split

Cached vein (proven pattern, reapplied): the distinct-receiver-instances-collapse-to-one-key bug class first found and fixed in manualmutexunlock as #41376 - re-probed for completeness rather than assumed closed.

New exploration: discovered that fileclosenotdeferred, contextcancelnotdeferred, and manualmutexunlock were refactored onto a previously-unseen shared framework, pkg/linters/internal/resourcetracker, that did not exist in prior memory snapshots. Audited the framework itself and all three call sites for regressions.

What the exploration found:

• The shared framework is well built: a single FuncDecl-only node filter, with explicit non-descent into function literals (avoiding the historical double-traversal-duplicate class entirely by construction), and both fileclosenotdeferred and contextcancelnotdeferred already use the canonical package-selector helper (confirming the earlier syntactic-match fix carried through the refactor). Audited clean.
• manualmutexunlock mutexKey correctly distinguishes a.mu vs b.mu (the one-level fix from manualmutexunlock false negative: distinct struct instances sharing a mutex field collapse to one tracking key (Selections.Obj() [Content truncated due to length] #41376), but its fallback for anything deeper than one selector hop (x.a.mu vs y.a.mu) collapses back to keying on the field object alone - silently reopening the exact bug class manualmutexunlock false negative: distinct struct instances sharing a mutex field collapse to one tracking key (Selections.Obj() [Content truncated due to length] #41376 was filed to fix, one level deeper. Untested by existing testdata, latent (no 2-level mutex chains found in pkg/ today) but a real false-negative-plus-misattribution bug the moment such code appears.

Findings and filed issue

sg62a1 (issue created this run): manualmutexunlock mutexKey collapses distinct receivers for 2+-level field selector chains.

• Location: pkg/linters/manualmutexunlock/manualmutexunlock.go, lines 96-113, fallback at lines 104-106.
• Evidence: testdata only covers one-level selectors (a.mu, b.mu, g.mu); no 2-level chain is tested. A grep of pkg/ found no current 2-level mutex chain in production, so this is latent, not live.
• Impact: given a lock on x.a.mu that is never deferred, followed by a lock on y.a.mu with the same collapsed key, the tracker silently drops the first violation instead of reporting it, then attributes both manual unlocks to the second lock position - a false negative plus a misattributed diagnostic.
• Recommendation: extend the nested-selector case in the key-building function to recurse through nested selectors so x.a.mu and y.a.mu key on the outermost identifiable receiver plus the full field path, reserving the field-object-only fallback for truly non-addressable bases such as a function-call receiver.
• Effort: small - one function branch plus one testdata case.

Metrics

• Findings this run: 4 (registry stable, 4 pre-existing issues reconciled, 1 new bug identified and filed, resourcetracker framework audited clean)
• Tasks generated: 1
• Issues created: 1 of 3 max - the other 3 open sergo issues were reconciled, not duplicated
• Success score: 8 out of 10

Historical context

• Total runs: 62. Total findings: 417. Total tasks: 111. Average success score: 8.75.
• Registry growth: 40 (R56) to 42 (R57-R59) to 43 (R60) to 67 (R61, registry file migration) to 67 (R62, stable).
• New pattern logged for future runs: nested-selector key collapse - probe any struct-field-keyed resource tracker for a non-identifier-base fallback that discards receiver identity beyond one selector hop.

Next-run focus (R63)

1. Verify sg62a1 landed.
2. Re-run the gh api reconciliation for the 4 currently-open issues.
3. Probe other struct-field-keyed ancestor-walk linters (deferinloop, panicinlibrarycode, timeafterleak, wgdonenotdeferred) for the same nested-selector collapse class.
4. Retest Serena LSP availability; if go/node remain uninstalled, continue with Read/Grep only.

References:

• Run 34434597791

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 282.7 AIC · ⌖ 6.66 AIC · ⊞ 6.8K · ◷

• expires on Sep 10, 2026, 8:00 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-11T04:00:03.982Z.

Closed by Workflow