[sergo] Sergo Report: STABLE-77 reconcile + cached-verify + new-explore (coverage-gating) - 2026-10-08

[github-actions[bot]]

Executive Summary

R90: registry and Serena tool list both STABLE (77 analyzers, 24 Serena tools), reconcile matched the prior runs prediction exactly with zero reverse-phantom flips, and cached-issue verification confirmed all 3 open issues are still 100% accurate. New-explore found a genuinely new bug in a 15-linter shared framework, pkg/linters/internal/coverage, that had never been audited in 89 prior runs. Filed 1 new issue (sg90a1).

Tool and Registry Status

• Serena: 24 tools, reconfirmed live via serena --help, exact match to cached list - no change.
• Linter registry: STABLE at 77 analyzers (grep -c Analyzer,$ pkg/linters/registry.go = 77, unchanged since R89). doc.go header All 77 active analyzers still matches the bullet count, no doc-sync drift.

Strategy Split (50/50)

Cached component (reuse): re-verified all 3 pre-run open issues via direct code read rather than trusting GitHub labels:

• contextcancelnotdeferred still enforced on native CI only - wasm LINTER_FLAGS omission unfixed (issue 55932 auto-expired, 2nd oc #65753 (contextcancelnotdeferred wasm-omission): re-diffed cgo.yml native (56 flags, line 1528) vs wasm (55 flags, line 1552) LINTER_FLAGS strings in full - contextcancelnotdeferred remains the only asymmetry, no new gaps found.
• globwalkignorederror + strconvparseignorederror: shared matcher still misses bare ExprStmt discards (3rd occurrence, sibling fix #66009 (globwalkignorederror + strconvparseignorederror AssignStmt-only): confirmed nodeFilter is still AssignStmt-only via astutil.MatchDiscardedErrorCall, unchanged.
• reflectdeepequalusage: function-value alias bypasses detection, gap documented by its own test fixture #66436 (reflectdeepequalusage function-value-alias gap): confirmed unchanged; also confirmed this linter has no SuggestedFix at all, so no autofix-parity gap applies.

All 3 cached issues: accurate, no refile needed, no new reverse-phantom activity this run.

New-explore component: audited pkg/linters/internal/coverage (ADR-51573, coverage-aware perf-linter gating), a shared mechanism used by all 15 allocation/perf-oriented linters via coverage.ShouldApply, that had never once appeared in 89 runs of memory despite its scale. Found a genuine bug (see Findings).

Run targets: 1 high-confidence, code-verified finding with zero prior issue coverage; 1 issue filed; cache refreshed for next run.

Findings

New bug - coverage.hitCount is column-blind (filed as sg90a1):

pkg/linters/internal/coverage/coverage.go hitCount (lines 103-111) resolves a diagnostics coverage hit count using the source line number only - ShouldApply (lines 122-139) never consults the positions column. The function loops over every block in the coverage profile and overwrites its running count whenever a block spans the queried line, so whichever block happens to sort last in the slice wins, regardless of whether it is the block that actually contains the diagnostic position.

A single source line can legitimately be spanned by two distinct coverage blocks - for example a one-line if x { a() } else { b() } - and if a gated linters finding sits in one block while a different block on the same line sorts later, hitCount silently returns the wrong blocks count. Depending on which branch is hot vs cold, this either suppresses a genuine hot-path finding or reports a genuinely cold/dead-path one, the opposite of what coverage gating exists to guarantee.

Impact: currently fully latent - GH_AW_LINT_COVERAGE_PROFILE is not set in any CI workflow today (only referenced in documentation), so ShouldApply always takes its permissive fallback. But this is the shared gating primitive that ADR-51573 itself describes as meant to activate for all 15 perf linters at once in the future, making this a high-leverage single-fix-location bug analogous to the earlier astutil.StringLitValue and resourcetracker shared-helper discoveries.

A new pattern class, line_granularity_column_blind, was added to long-term memory - a third distinct kind of position-blindness alongside the existing branch_state_merge and presnapshot_position_blind classes.

Generated Tasks

1. Fix coverage.hitCount to be position-precise - select the coverage block whose column range actually contains the diagnostic position (or fall back to the most specific/smallest span) instead of last-block-wins by line only. Add a coverage_test.go case with two synthetic same-line blocks at different columns and counts to lock in the fix. Effort: small, single file plus a targeted test, no change to the public ShouldApply signature.

Issues Filed

• New: coverage.hitCount is column-blind: multiple same-line coverage blocks silently pick the wrong hit count, undermining perf-linter gating for all 15 linters (sg90a1)
• No duplicates skipped - gh api search across 4 distinct query terms confirmed zero prior coverage of this specific bug before filing.

Metrics

• Findings this run: 4 (registry/tool stability confirmation, reconcile match, 3-issue cached-vein re-verification, 1 new bug)
• Tasks generated: 1
• Issues created: 1 (max 3 allowed)
• Success score: 8/10
• Aggregate: 90 total runs, 550 total findings, 157 total tasks, 8.71 avg success score

Historical Context

This continues a run of clean reconciles (R87-R90) where the teams own issue-closure activity matched predictions exactly with no unexpected flips, so each runs new-explore budget has gone toward either CI-config sweeps (R87: cgo.yml native/wasm asymmetry) or fresh-framework audits (R88: duplicate-code-consolidation gap, R89: 77th linter first audit, R90: 15-linter shared coverage-gating framework). The bounded 3-most-recent-strategy memory window continues to work well for short-cycle reconcile but, per the R87 lesson, periodic from-scratch sweeps of CI config and shared frameworks remain valuable for catching issues that would otherwise age out of rotation.

Recommendations and Next-Run Focus

• Verify sg90a1 landed; re-tally opens (expect 4 unless bulk-closed).
• If the registry grows to 78, audit the new linter fresh as the top priority.
• If no new linter appears, pkg/linters/internal/coverage has more surface: findProfile uses suffix-based path matching that has not yet been checked for cross-package collision risk.

References:

• §37724934418

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 277.9 AIC · ⊞ 5.2K · ◷

• expires on Oct 8, 2026, 8:05 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Sergo - Serena Go Expert.

A newer discussion is available at Discussion #67103.