fix(symlinkguard): flush on handoff and at shutdown; test the handoff

PR #180 review (BLOCK) found that moving delivery out of the scan left
two problems:
- An alert waited for deliver's own tick, about one interval. It is
  now flushed as soon as it is handed over, and on each tick after
  that while it is still pending.
- On ctx end deliver returned without draining, so an alert handed over
  just before shutdown was lost even with a healthy ntfy. Watch now
  closes the handoff channel, and deliver drains it and flushes once
  more (bounded by shutdownFlushTimeout) before Watch returns.

The review also showed the tests didn't cover the handoff. The new
tests are each flip-tested red:
- the lifetime test uses a notifier slower than the interval, so a
  blocking handoff fails it
- the overflow-accounting test uses a slow notifier
- a join test checks that Notify is no longer running when Watch
  returns
- a shutdown-flush test, and a prompt-delivery test

Refs #164

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/internal/symlinkguard/symlinkguard.go

@@ -23,6 +23,9 @@ import (
 	"time"
 )
 
+// shutdownFlushTimeout bounds the final flush when Watch stops.
+var shutdownFlushTimeout = 5 * time.Second
+
 // DefaultInterval is used when Watch is given a non-positive interval.
 const DefaultInterval = 30 * time.Second
 
@@ -140,7 +143,8 @@ func Scan(brainDir string) (Result, error) {
 // a full queue, blocked one flush for several notify timeouts, and while the
 // scan waited on it a planted link stayed readable for several intervals.
 // The scan hands alerts over without blocking; any that do not fit are
-// counted in the summary.
+// counted in the summary. When ctx ends, Watch returns after a final flush
+// of what was handed over (bounded by shutdownFlushTimeout).
 func Watch(ctx context.Context, brainDir string, interval time.Duration, n Notifier) {
 	if interval <= 0 {
 		interval = DefaultInterval
@@ -152,7 +156,9 @@ func Watch(ctx context.Context, brainDir string, interval time.Duration, n Notif
 	var wg sync.WaitGroup
 	wg.Add(1)
 	go func() { defer wg.Done(); deliver(ctx, interval, n, alerts, &overflow) }()
-	defer wg.Wait()
+	// The scan is the only sender: closing alerts tells deliver to drain and
+	// flush once more, and Watch returns only after it has.
+	defer func() { close(alerts); wg.Wait() }()
 	q := alertSender{alerts: alerts, overflow: &overflow}
 	reported := ""
 	for {
@@ -201,28 +207,49 @@ func (s alertSender) push(msg string) {
 	}
 }
 
-// deliver owns the alertQueue: it queues alerts as they arrive and flushes
-// every interval until ctx ends.
+// deliver owns the alertQueue. It flushes as soon as an alert is handed
+// over, and again every interval while any are pending (outage retries).
+// When alerts is closed (Watch is stopping) it drains it and flushes once
+// more, bounded by shutdownFlushTimeout, so an alert handed over just before
+// shutdown is not lost (PR #180 review).
 func deliver(ctx context.Context, interval time.Duration, n Notifier, alerts <-chan string, overflow *atomic.Int64) {
 	t := time.NewTicker(interval)
 	defer t.Stop()
 	q := &alertQueue{}
+	// drain moves everything handed over into the queue; it reports false
+	// once alerts is closed.
+	drain := func() bool {
+		defer func() { q.suppressed += int(overflow.Swap(0)) }()
+		for {
+			select {
+			case msg, ok := <-alerts:
+				if !ok {
+					return false
+				}
+				q.push(msg)
+			default:
+				return true
+			}
+		}
+	}
 	for {
 		select {
-		case <-ctx.Done():
-			return
-		case msg := <-alerts:
-			q.push(msg)
+		case msg, ok := <-alerts:
+			if ok {
+				q.push(msg)
+				ok = drain()
+			}
+			if !ok {
+				fctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), shutdownFlushTimeout)
+				q.flush(fctx, n)
+				cancel()
+				return
+			}
+			q.flush(ctx, n)
 		case <-t.C:
-			for drained := false; !drained; {
-				select {
-				case msg := <-alerts:
-					q.push(msg)
-				default:
-					drained = true
-				}
+			if !drain() {
+				continue // the closed channel is handled by the case above
 			}
-			q.suppressed += int(overflow.Swap(0))
 			q.flush(ctx, n)
 		}
 	}