[sergo] Sergo Report: resourcetracker branch_state_merge (3-linter framework fix) - 2026-09-21

[github-actions[bot]]

Executive Summary

Run R73 kept the linter registry stable at 72 analyzers (no new linter this run) and reconciled all 12 previously-open sergo issues, none flipped closed since R72, so there was no reverse-phantom to refile for the first time since R66. Following the next step suggested by R72, this run traced the branch_state_merge defect class (discovered last run in httprespbodyclose.go) into the shared pkg/linters/internal/resourcetracker framework, confirming it also silently masks manual-cleanup violations in manualmutexunlock (CI-enforced), fileclosenotdeferred, and contextcancelnotdeferred, three linters sharing one fix location. wgdonenotdeferred was audited clean against the same class.

Tool and Registry Status

• Serena: 24 tools, stable. activate_project succeeded for go/typescript/bash with no approval prompt.
• Linter registry: grep -c Analyzer,$ pkg/linters/registry.go = 72, unchanged since R72, no new-linter audit this run.
• gh api reconcile: all 12 pre-run open sergo issues (62115, 62114, 61948, 61947, 61715, 61714, 61519, 61518, 61265, 61024, 61023, 60738) confirmed still open with state_reason null, no auto-expiry activity this run.

Strategy: 50/50 Split

Cached component (50 percent): reconcile-first discipline, re-verified every open issue state and state_reason via gh api before doing any new exploration, per the phantom_reconcile pattern that has already caught 6 silent auto-expiry reverse phantoms across prior runs. This run found none, which is itself useful signal.

New exploration (50 percent): directly executed the next step recorded by R72 itself, probing manualmutexunlock, fileclosenotdeferred, contextcancelnotdeferred (the three linters built on the shared resourcetracker package) and wgdonenotdeferred (a standalone sibling) for the branch_state_merge class found last run in httprespbodyclose.go. Result: confirmed the shared framework repeats the bug, the higher-value outcome versus a clean audit.

Findings

Confirmed bug: resourcetracker.go branch-state merge (filed as sg73a1)

pkg/linters/internal/resourcetracker/resourcetracker.go lines 89-112 (inspectBody) tracks each acquired resource in a single map[K]*state per function, populated by one flat ast.Inspect with no control-flow branch scoping. When one resource acquisition is followed by an if/else where one arm cleans up manually and the sibling arm defers the same cleanup, both write into the same state entry:

func F(cond bool) {
    var mu sync.Mutex
    mu.Lock()
    if cond {
        mu.Unlock()          // manual, should be flagged on this path
    } else {
        defer mu.Unlock()
    }
}

hasManual becomes true from the if arm, hasDefer becomes true from the else arm (same key, same entry), so the reporting guard hasManual and not hasDefer evaluates false and the real violation is silently swallowed. This is the same root cause as the branch_state_merge bug found in httprespbodyclose.go (issue 62115 from last run), but because resourcetracker is shared, one fix location resolves it for three linters at once: manualmutexunlock (CI-enforced native and wasm), fileclosenotdeferred, and contextcancelnotdeferred.

Audited clean: wgdonenotdeferred

Does not use resourcetracker; it reports a violation immediately at the ExprStmt site during traversal rather than accumulating merged state in a map, so no cross-branch conflation is structurally possible. Its FuncLit-deferred-closure boundary and ancestor-stack loop detection (the scope_boundary_funclit fix from R45) both remain correctly implemented.

No live production trigger was found for the resourcetracker bug via grep across pkg/, every real Lock/os.Open/context.With* site uses straight-line defer, not branch-split cleanup, so the gap is latent rather than currently causing a missed diagnostic in this repo. It remains a genuine CI-enforced false-negative risk on the exact deadlock and leak shape these linters exist to catch.

Generated Task and Issue

sg73a1: resourcetracker manual cleanup in one branch is masked by defer in a sibling branch. Type: bug, framework-level, 3-linter blast radius. Confidence: high, code-verified with a concrete repro included.

Created as a new GitHub issue (label sergo), deduplicated via gh api search/issues against resourcetracker and sibling branch terms, zero prior coverage confirmed.

Metrics (cumulative)

• Total runs: 73
• Total findings: 468
• Total tasks and issues generated: 127
• Average success score: 8.8/10
• This run success score: 8/10, one high-leverage code-verified finding, no reverse-phantom activity to add depth this run.

Historical Context

This is the second occurrence of the branch_state_merge pattern class (first: httprespbodyclose.go, R72) and the sixth distinct bug-class vein opened by cached-vein probing of a prior finding into sibling code (after syntactic_stdlib_match, nested_selector_key_collapse, block_scope_state_reset, paren_unwrap_gap, and now branch_state_merge). The resourcetracker shared framework has now been the subject of two separate confirmed bugs: the 2-plus-level selector-collapse issue in the mutexKey logic of manualmutexunlock (sg62a1, issue 59875, still open, 4th reverse-phantom) and this run branch-merge issue in the framework itself.

Recommendations and Next-Run Focus

1. Prioritize the resourcetracker.go branch-scoping fix, the single highest-leverage open item, closing a false-negative gap across three linters simultaneously.
2. R74 should re-tally all 13 open issues and check whether sg73a1 gets picked up, plus continue watching for registry growth (a possible 73rd analyzer).
3. Check whether any other shared multi-linter helper besides resourcetracker uses a similar per-key-map-without-branch-scoping design, none identified yet, but this vein is not necessarily exhausted.

References:

• Run 35558832201

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 181.7 AIC · ⌖ 5.42 AIC · ⊞ 7K · ◷

• expires on Sep 21, 2026, 8:00 PM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-22T04:00:15.752Z.

Closed by Workflow