[sergo] Sergo Report: New-Linter-Audit-at-Scale + Reverse-Phantom-Reconcile - 2026-10-03

[github-actions[bot]]

Executive Summary

Run R85 of 85 total. Registry grew 75->76 with fprintferrorunchecked (PR #65073, 2026-10-02), audited same-day and found to miss its single most common real-world call shape at a scale (938 live occurrences across 193 files) far exceeding any prior instance of this bug class. Reconcile also caught 3 more issues auto-expiring overnight; 2 of the 3 were re-verified unfixed and refiled. 3 issues filed this run (full budget), 0 duplicates skipped (none of the 3 overlapped any currently-open issue). Success score: 9/10.

Tool Updates

• Serena: 24 tools, not re-tested live this run (Read/Grep/gh api were sufficient for every step, consistent with most recent runs).
• Linter registry: 75 -> 76 analyzers (pkg/linters/registry.go). New: fprintferrorunchecked, already wired into CI (.github/workflows/cgo.yml LINTER_FLAGS, both native and wasm jobs, -test=false) from day one.

Strategy: 50/50 Cached-Reuse + New-Exploration

New-exploration (50%): first-ever full audit of fprintferrorunchecked, the newest registered analyzer. This is the proven highest-yield new-explore move (a fresh linter has had zero chance to inherit established fixes) and it paid off immediately.

Cached-reuse (50%): ran the standing gh-api reconcile step before any new analysis, re-querying live issue state rather than trusting the previous runs predicted post-reconcile list (a methodology fix adopted since R83). This surfaced 3 auto-expired issues from the paren_unwrap_gap vein; 2 were re-verified and refiled.

Findings

1. fprintferrorunchecked: AssignStmt-only filter misses 938 bare-statement call sites (new, #65225)

The linters entire nodeFilter is a single AssignStmt entry (fprintferrorunchecked.go:40), so it only recognizes _ = fmt.Fprintf(...) / _, _ = fmt.Fprintf(...). A bare statement call with no assignment at all -- fmt.Fprintf(w, text) -- is legal Go that silently discards both return values, exactly the failure mode the linter exists to catch, yet it never reaches the check logic since there is no AssignStmt node. Grep across pkg/ (excluding tests) found 938 such bare-statement call sites across 193 files -- vastly more common than the explicit-blank form this linter actually detects. Concrete examples: pkg/console/confirm.go:53-56 (writes to an io.Writer, e.g. os.Stdout) and pkg/workflow/workflow_errors.go:99. This is the established node_filter_too_narrow class (previously seen in globwalkignorederror/strconvparseignorederror), but at the largest scale yet observed for this class.

2. 4 library-scope linters still miss the pass.Pkg.Name main guard (4th reverse-phantom, #65226)

osexitinlibrary, rawloginlib, logfatallibrary, and panic-in-library-code all classify library-vs-main code by path substring only, with zero check of the actual package main declaration -- unlike sibling osgetenvlibrary, which correctly adds that check. Lineage: #59627 -> #61518 -> #63342 (auto-expired 2026-10-02) -> this refile. Live (if currently out-of-scope) examples: internal/tools/actions-build/main.go and internal/tools/generate-action-metadata/main.go, both declared as the main package outside a /main or /cmd/ path.

3. nilctxpassed isBuiltinNil still lacks ParenExpr unwrap (3rd occurrence, #65227)

isBuiltinNil (nilctxpassed.go:124-135) bare-asserts the argument as a plain identifier with no unwrap first, so a parenthesized nil passed as a context.Context argument escapes detection. Lineage: #61519 -> #63343 (auto-expired 2026-10-02) -> this refile. CI-enforced both native+wasm.

Not refiled this run (budget): timenowsub.go:50/103 (paren_unwrap_gap, lineage #63344, 2nd occurrence) was independently re-verified still unfixed but the 3-issue cap was already committed to the findings above. Flagged as the top priority for R86.

Generated Tasks (1:1 with filed issues)

1. Add an ExprStmt branch to fprintferrorunchecked nodeFilter/run(), reusing existing helper functions; add bare-statement testdata.
2. Add the missing main-package guard to all 4 library-scope linters; add a non-/main/-cmd/-path package-main testdata case.
3. Wrap the nil-identifier check in nilctxpassed.isBuiltinNil with the shared ParenExpr-unwrap helper; add a parenthesized-nil testdata case.

All three are small-to-trivial effort, code-verified with concrete repro locations, and independently non-overlapping.

Metrics

• Total runs: 85 | Total findings: 519 | Total tasks: 152 | Avg success score: 8.74
• This run: 5 findings investigated, 3 tasks generated, 3 issues filed, success score 9/10
• Open sergo-labeled issues after this run: 14 (11 carried over + 3 new)

Historical Context

The paren_unwrap_gap class (a bare AST type assertion missing a ParenExpr unwrap) remains the single highest-yield recurring bug class across 85 runs, now confirmed independently in closeerrorunchecked (R82) and typeassertionnil (R84) -- two brand-new linters authored with no shared code, meaning this is a systemic blind spot in how new linters get written, not a single unfixed helper. The node_filter_too_narrow class (AssignStmt-only, no ExprStmt) has now claimed its highest-impact instance yet in fprintferrorunchecked. Both classes are strong candidates for a repo-wide lint-authoring guideline rather than one-off per-linter fixes.

Recommendations

• Treat paren_unwrap_gap and node_filter_too_narrow as standing day-one checks for any newly-registered linter, not opportunistic finds -- both have now hit 3+ independent linters each.
• Consider documenting these two classes directly in whatever template/guide is used to author new linters, since both recur in code written with no awareness of prior instances.
• The reverse-phantom pattern (issues auto-expiring without the underlying bug being fixed) continues at a steady rate; several lineages are now on their 3rd-4th refile with zero code movement. These may need human triage rather than continued automated re-filing.

Next-Run Focus (R86)

1. Refile timenowsub (lineage timenowsub misses parenthesized time.Now() call: (time.Now()).Sub(t) escapes this CI-enforced linter #63344) -- now overdue by one run.
2. Verify sg85a1/a2/a3 landed as filed.
3. Re-tally open issues (expect 14: 11 carried + the 3 new from this run).
4. If the registry grows again (77th linter), audit it fresh with the paren_unwrap_gap + node_filter_too_narrow standing checks applied first.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 317.8 AIC · ⌖ 7.26 AIC · ⊞ 5.3K · ◷

• expires on Oct 3, 2026, 8:11 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #65500.