fix(ingestion): bound the tripwire's alerts; test removal guards; deflake race tests

PR #160 review:
- The planter chooses the paths, and one alert listed them all, while the
  queue retried oldest-first forever: a message ntfy refuses (too large)
  blocked every later alert (2000 links: 0 alerts delivered), and an
  outage queued one message per removal, unbounded. Alerts now name at
  most 10 paths and count the rest; the queue holds at most 5, further
  alerts become one suppression summary; a message failing 5 times is
  dropped so it cannot block the rest.
- removeSymlinks' Lstat re-check had no test: a direct test passes a
  regular file, a path through an in-brain dir link, a ../ escape and a
  missing path, and asserts all fail with nothing deleted. A Watch test
  covers dir and in-brain targets. root.Remove (not RemoveAll) is
  commented: it refuses a dir swapped in after the Lstat.
- Every queued alert is delivered after an outage (truncating the queue
  after the first send is now red).
- hyperguild#162: race tests did not wait for their swapper goroutines
  before t.TempDir cleanup ("directory not empty" in CI run 8912). Each
  swapper is now stopped and awaited in a t.Cleanup.

Fixes #162
Refs #157

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/internal/symlinkguard/symlinkguard_test.go

@@ -5,7 +5,10 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strconv"
+	"strings"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -191,7 +194,7 @@ func TestWatchReportsASetAgainAfterItWasCleared(t *testing.T) {
 // hyperguild#157 decision: the runtime tripwire removes a symlink it finds
 // (the link, never its target), so it is readable for at most one interval
 // instead of until a human acts, and the alert says what was removed.
-func TestWatchRemovesSymlinksButNeverTheirTargetsOrRegularFiles(t *testing.T) {
+func TestWatchRemovesAnOutsideFileLinkButNotItsTargetOrRegularFiles(t *testing.T) {
 	brain := t.TempDir()
 	outside := filepath.Join(t.TempDir(), "target.md")
 	require.NoError(t, os.WriteFile(outside, []byte("keep me"), 0o644))
@@ -226,3 +229,177 @@ func TestWatchRemovesSymlinksButNeverTheirTargetsOrRegularFiles(t *testing.T) {
 func TestDefaultIntervalIsThirtySeconds(t *testing.T) {
 	assert.Equal(t, 30*time.Second, DefaultInterval)
 }
+
+// PR #160 review: the Lstat re-check and the os.Root confinement in
+// removeSymlinks had no test. Anything that is not a symlink inside the brain
+// is reported failed and nothing is deleted.
+func TestRemoveSymlinksRefusesNonSymlinksEscapesAndPathsThroughLinks(t *testing.T) {
+	brain := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki", "real"), 0o755))
+	regular := filepath.Join(brain, "wiki", "note.md")
+	require.NoError(t, os.WriteFile(regular, []byte("note"), 0o644))
+	inLinked := filepath.Join(brain, "wiki", "real", "x.md")
+	require.NoError(t, os.WriteFile(inLinked, []byte("x"), 0o644))
+	require.NoError(t, os.Symlink(filepath.Join(brain, "wiki", "real"), filepath.Join(brain, "wiki", "linkdir")))
+	outside := filepath.Join(filepath.Dir(brain), "outside-157.md")
+	require.NoError(t, os.WriteFile(outside, []byte("o"), 0o644))
+	t.Cleanup(func() { _ = os.Remove(outside) })
+
+	removed, failed := removeSymlinks(brain, []string{
+		"wiki/note.md", "wiki/linkdir/x.md", "../outside-157.md", "wiki/missing.md",
+	})
+	assert.Empty(t, removed)
+	assert.ElementsMatch(t, []string{"wiki/note.md", "wiki/linkdir/x.md", "../outside-157.md", "wiki/missing.md"}, failed)
+	for _, p := range []string{regular, inLinked, outside} {
+		_, err := os.Stat(p)
+		assert.NoError(t, err, "%s must not be deleted", p)
+	}
+}
+
+// Dir targets and in-brain targets survive too, not only an outside file.
+func TestWatchRemovesDirAndInBrainLinksButNotTheirTargets(t *testing.T) {
+	brain := t.TempDir()
+	outsideDir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(outsideDir, "keep.md"), []byte("keep"), 0o644))
+	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki"), 0o755))
+	inBrain := filepath.Join(brain, "wiki", "target.md")
+	require.NoError(t, os.WriteFile(inBrain, []byte("t"), 0o644))
+	require.NoError(t, os.Symlink(outsideDir, filepath.Join(brain, "wiki", "dirlink")))
+	require.NoError(t, os.Symlink(inBrain, filepath.Join(brain, "wiki", "inlink.md")))
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go Watch(ctx, brain, 10*time.Millisecond, nil)
+	require.Eventually(t, func() bool {
+		r, err := Scan(brain)
+		return err == nil && len(r.Symlinks) == 0
+	}, 2*time.Second, 10*time.Millisecond)
+	for _, p := range []string{filepath.Join(outsideDir, "keep.md"), inBrain} {
+		_, err := os.Stat(p)
+		assert.NoError(t, err, "%s must survive", p)
+	}
+}
+
+// PR #160 review: the planter chooses the paths. An alert names at most
+// maxPathsPerAlert of them and counts the rest, so its size stays bounded.
+func TestWatchAlertNamesBoundedPathsAndCountsTheRest(t *testing.T) {
+	brain := t.TempDir()
+	for i := 0; i < 50; i++ {
+		require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, strings.Repeat("n", 100)+strconv.Itoa(i))))
+	}
+	n := &recNotifier{}
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go Watch(ctx, brain, 10*time.Millisecond, n)
+	require.Eventually(t, func() bool { return n.count() >= 1 }, 2*time.Second, 10*time.Millisecond)
+	n.mu.Lock()
+	msg := n.msgs[0]
+	n.mu.Unlock()
+	assert.Contains(t, msg, "removed 50 symlink(s)")
+	assert.Contains(t, msg, "and 40 more")
+	assert.Less(t, len(msg), 2500, "alert size is bounded regardless of how many links were planted")
+}
+
+// rejectNotifier refuses every message containing a marker, forever.
+type rejectNotifier struct {
+	recNotifier
+	reject string
+}
+
+func (r *rejectNotifier) Notify(ctx context.Context, m string) error {
+	if strings.Contains(m, r.reject) {
+		r.mu.Lock()
+		r.msgs = append(r.msgs, "REJECTED")
+		r.mu.Unlock()
+		return errors.New("413")
+	}
+	return r.recNotifier.Notify(ctx, m)
+}
+
+// PR #160 review: one message the server will never accept blocked every
+// later alert forever (head-of-line). It is dropped after maxAttempts.
+func TestWatchDropsAMessageThatNeverSendsSoLaterAlertsFlow(t *testing.T) {
+	brain := t.TempDir()
+	n := &rejectNotifier{reject: "POISON"}
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go Watch(ctx, brain, 10*time.Millisecond, n)
+	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "POISON")))
+	time.Sleep(30 * time.Millisecond)
+	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "later")))
+	require.Eventually(t, func() bool {
+		n.mu.Lock()
+		defer n.mu.Unlock()
+		for _, m := range n.msgs {
+			if strings.Contains(m, "later") {
+				return true
+			}
+		}
+		return false
+	}, 3*time.Second, 10*time.Millisecond, "a later alert is delivered despite a poison message")
+}
+
+// toggleNotifier fails while down is set.
+type toggleNotifier struct {
+	recNotifier
+	down atomic.Bool
+}
+
+func (r *toggleNotifier) Notify(ctx context.Context, m string) error {
+	if r.down.Load() {
+		return errors.New("ntfy down")
+	}
+	return r.recNotifier.Notify(ctx, m)
+}
+
+// PR #160 review: an outage queued one message per removal, unbounded. The
+// queue holds at most maxPending messages; the rest become one summary.
+func TestWatchQueueIsBoundedDuringAnOutage(t *testing.T) {
+	brain := t.TempDir()
+	n := &toggleNotifier{}
+	n.down.Store(true)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go Watch(ctx, brain, 5*time.Millisecond, n)
+	for i := 0; i < 30; i++ {
+		link := filepath.Join(brain, "p"+strconv.Itoa(i))
+		require.NoError(t, os.Symlink(t.TempDir(), link))
+		require.Eventually(t, func() bool { _, err := os.Lstat(link); return os.IsNotExist(err) }, 2*time.Second, 2*time.Millisecond)
+	}
+	n.down.Store(false)
+	require.Eventually(t, func() bool { return n.count() >= 1 }, 2*time.Second, 5*time.Millisecond)
+	time.Sleep(100 * time.Millisecond)
+	assert.LessOrEqual(t, n.count(), maxPending+1, "queued alerts plus at most one suppression summary")
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	found := false
+	for _, m := range n.msgs {
+		if strings.Contains(m, "suppressed") {
+			found = true
+		}
+	}
+	assert.True(t, found, "suppressed alerts are counted in a summary")
+}
+
+// Within the bound, every alert queued during an outage is delivered after
+// it, each naming its own removal (PR #160 review: truncating the queue after
+// the first send stayed green).
+func TestWatchDeliversEveryQueuedAlertAfterAnOutage(t *testing.T) {
+	brain := t.TempDir()
+	n := &toggleNotifier{}
+	n.down.Store(true)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go Watch(ctx, brain, 5*time.Millisecond, n)
+	for _, name := range []string{"qa", "qb", "qc"} {
+		link := filepath.Join(brain, name)
+		require.NoError(t, os.Symlink(t.TempDir(), link))
+		require.Eventually(t, func() bool { _, err := os.Lstat(link); return os.IsNotExist(err) }, 2*time.Second, 2*time.Millisecond)
+	}
+	n.down.Store(false)
+	require.Eventually(t, func() bool { return n.count() == 3 }, 2*time.Second, 5*time.Millisecond)
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	for i, name := range []string{"qa", "qb", "qc"} {
+		assert.Contains(t, n.msgs[i], strconv.Quote(name))
+	}
+}