feat(api): brain_promote and brain_reject act on notes parked in raw/needs-review/ (#208)

brain_pending lists a parked note under its bare filename, but promote/reject
only read raw/<name>, so the documented approval path did not exist. They now
fall back to raw/needs-review/ (top level wins on a name clash; a symlinked
directory is refused) and promote drops the resolver's proposal keys.
Mutation-checked.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

ingestion/internal/api/promote.go

@@ -143,11 +143,11 @@ func PromoteNote(brainDir string, opts PromoteOptions) (string, error) {
 		return "", err
 	}
 
-	src := filepath.Join(brainDir, "raw", base)
-	raw, err := readRawSource(brainDir, base)
+	raw, srcRel, err := readRawSource(brainDir, base)
 	if err != nil {
 		return "", err
 	}
+	src := filepath.Join(brainDir, filepath.FromSlash(srcRel))
 
 	// Collision: never silently overwrite an existing promoted note.
 	if _, statErr := os.Stat(dest); statErr == nil {
@@ -156,6 +156,11 @@ func PromoteNote(brainDir string, opts PromoteOptions) (string, error) {
 	}
 
 	fm, body := parseFrontmatter(string(raw))
+	// The resolver's proposal described where the note was going to be placed;
+	// once a human has placed it, it is noise (and `wing` is set below).
+	for _, k := range []string{"proposed_wing", "proposal_confidence", "proposal_reason"} {
+		fm.drop(k)
+	}
 	now := time.Now().UTC().Format(time.RFC3339)
 	fm.set("wing", brain.Sanitise(opts.Wing))
 	fm.set("hall", opts.Hall)
@@ -215,11 +220,11 @@ func RejectNote(brainDir string, opts RejectOptions) (string, error) {
 		return "", fmt.Errorf("invalid filename %q", opts.Filename)
 	}
 
-	src := filepath.Join(brainDir, "raw", base)
-	raw, err := readRawSource(brainDir, base)
+	raw, srcRel, err := readRawSource(brainDir, base)
 	if err != nil {
 		return "", err
 	}
+	src := filepath.Join(brainDir, filepath.FromSlash(srcRel))
 
 	dest := filepath.Join(brainDir, "raw", "rejected", base)
 	if _, statErr := os.Stat(dest); statErr == nil {
@@ -258,25 +263,43 @@ func excerpt(s string, n int) string {
 
 // readRawSource reads a pending note for promote/reject through the raw root,
 // refusing symlinks and a symlinked raw/ (hyperguild#153).
-func readRawSource(brainDir, base string) ([]byte, error) {
+func readRawSource(brainDir, base string) ([]byte, string, error) {
 	root, _, err := OpenRawRoot(brainDir)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			return nil, fmt.Errorf("pending note %q does not exist in raw/", base)
+			return nil, "", fmt.Errorf("pending note %q does not exist in raw/", base)
 		}
-		return nil, fmt.Errorf("read source: %w", err)
+		return nil, "", fmt.Errorf("read source: %w", err)
 	}
 	defer func() { _ = root.Close() }()
 	raw, _, err := readRawNote(root, base)
+	if err == nil {
+		return raw, "raw/" + base, nil
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		return nil, "", fmt.Errorf("read source: %w", err)
+	}
+	// brain_pending also lists notes parked in raw/needs-review/ under their
+	// bare filename (hyperguild#208); the top level wins on a name clash. The
+	// sub-root refuses a symlinked directory like OpenRawRoot does.
+	sub, serr := root.OpenRoot(parkedDir)
+	if serr != nil {
+		return nil, "", fmt.Errorf("pending note %q does not exist in raw/", base)
+	}
+	defer func() { _ = sub.Close() }()
+	raw, _, err = readRawNote(sub, base)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			return nil, fmt.Errorf("pending note %q does not exist in raw/", base)
+			return nil, "", fmt.Errorf("pending note %q does not exist in raw/", base)
 		}
-		return nil, fmt.Errorf("read source: %w", err)
+		return nil, "", fmt.Errorf("read source: %w", err)
 	}
-	return raw, nil
+	return raw, "raw/" + parkedDir + "/" + base, nil
 }
 
+// parkedDir is where the watcher parks notes it could not place.
+const parkedDir = "needs-review"
+
 // unquoteScalar undoes the Go-style double quoting the watcher writes around a
 // free-text value (strconv.Quote keeps it on one line); a bare value is
 // returned as is.