[sergo] Sergo Report: GAP-8wk-registry-reconcile+commentguard-sweep - 2026-09-04

[github-actions[bot]]

Executive summary

Memory hadn't been updated since 2026-07-08 (R60) — an ~8-week gap during which sergo issue activity continued in GitHub (up to #58150) but the strategy/stats logs went silent. This run reconciled state (registry detector was stale, GitHub issue history moved on), re-audited ~13 individual linters, and confirmed a recurrence of a previously-fixed bug class across a meaningfully larger set of files than its first appearance. One new issue filed.

Tool / registry update

• Serena LSP: 23 tools, unchanged.
• Registry detector was obsolete. The old method (grep -c Analyzer cmd/linters/main.go) now returns effectively nothing because the registry moved: cmd/linters/main.go is now just multichecker.Main(linters.All()...). The actual list lives in pkg/linters/registry.go's allAnalyzers slice, which now holds 67 analyzers (was 43 at R60). Detection method corrected in memory.

Strategy split (50/50)

• Cached-reuse: re-verified the R60 finding (writebytestring's isExactString fix, sg60a1/#aw_sg60a1) — confirmed landed correctly (pkg/linters/writebytestring/writebytestring.go:157-160, wraps named string types with string(...) before passing to io.WriteString). Also probed the sibling byte/string-conversion linters (appendbytestring, bytescomparestring) for the same exact-type-vs-underlying-type bug class.
• New-exploration: full audits of 9 previously-untouched linters — nilctxpassed, logfatallibrary, httprespbodyclose, ioutildeprecated, httpstatuscode, trimleftright, excessivefuncparams, mapdeletecheck, goroutinemissingrecover. All clean except goroutinemissingrecover, which matches the already-open goroutinemissingrecover: recover-defer placed after risky code is accepted as safe, but never protects earlier statements #58150 (no new distinct bug).

Findings

While probing writebytestring/appendbytestring/bytescomparestring for the exact-type bug class, none of the three showed that bug — but all three build SuggestedFix TextEdits spanning the full replaced expression without calling astutil.HasOverlappingComment first. That guard exists precisely to stop -fix from silently deleting a comment sitting inside the replaced span, and was the subject of a prior fix (#57844) for 5 other linters.

A repo-wide grep for the guard turned up only 8 files that call it (directly or via the shared astutil.BuildContainsFix helper). Spot-checking 10 more SuggestedFix-producing linters by grep (tolowerequalfold, stringsindexhasprefix, stringreplaceminusone, sprintfint, lenstringzero, lenstringsplit, fprintlnsprintf, execcommandwithoutcontext, ctxbackground, bytesbufferstring) showed the same pattern: full-span TextEdit, no guard call. 12 of the 13 affected files (all but lenstringzero) are enforced on production code in CI (.github/workflows/cgo.yml, -test=false), so this isn't just a latent risk.

Generated task / issue

Filed #58376: "13 linters build SuggestedFix TextEdits without HasOverlappingComment guard" — covers the 3 confirmed files with exact line references plus the 10 likely files, references the mapdeletecheck.go:84 correct pattern, and recommends (a) applying the guard per-file and (b) considering a structural fix (shared safe-edit constructor or a spec_test.go check) since this is the second time this exact class has appeared across a double-digit number of linters — a sign that fixing it file-by-file isn't preventing recurrence.

No duplicate filed: checked all 5 currently-open sergo issues (#58150, #57606, #57340, #57339, #56533) — none overlap.

Metrics

• Files audited this run: ~13 full reads + 10 targeted greps
• New issue filed: 1
• Confirmed-clean linters: 9
• Success score: 9/10

Historical context

• Registry grew 43 → 67 analyzers since R60 (2026-07-08), all outside this run's visibility until reconciled.
• Notable gap: the daily memory-update loop (strategies/stats append) silently stopped for ~8 weeks despite the workflow presumably continuing to run and produce issues (evidenced by issue numbers advancing to goroutinemissingrecover: recover-defer placed after risky code is accepted as safe, but never protects earlier statements #58150). Root cause not determinable from this sandbox — flagging for whoever owns the workflow schedule/trigger config.

Recommendations / next-run focus

1. Investigate why memory updates stopped 2026-07-08–2026-09-04 (workflow trigger, permissions, or push-gate issue).
2. Confirm and fix the remaining 10 likely-affected files from this run's HasOverlappingComment finding via full reads + testdata comment-fixture additions.
3. Consider the structural fix proposed in 13 linters build SuggestedFix TextEdits without HasOverlappingComment guard (silent comment deletion on -fix) #58376 to prevent a third recurrence of this bug class.

References:

• §33834385302

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🤖 Sergo - Serena Go Expert · claude · agent · 336.3 AIC · ⌖ 7.47 AIC · ⊞ 6.8K · ◷

• expires on Sep 4, 2026, 8:04 PM UTC-08:00