fix(ingestion): close the PR #156 review findings on raw/ reads

- Reverting the ingest call sites to extract.Text(path) stayed green;
  a test now fails if anything outside internal/extract calls
  extract.Text( (only TextIn, through an os.Root, may be used).
- The watcher symlink test passed for a watcher that ingested nothing,
  or stopped at the first symlink (SkipAll: one synced link halting all
  ingestion). It now plants a real note after the symlink and asserts
  exactly one ingest, and the symlinked-raw refusal has its own test.
- A FIFO swapped in between Lstat and Open hung open(2) forever.
  extract.OpenRegular opens non-blocking and checks the type on the
  handle; readRawNote, TextIn and the watcher's archive copy use it.
- The symlinked-root test covers pending, promote, reject, resolve and
  ReadIngestFile, and is named for exactly those.
- The hard-link residual is documented where it is accepted.

Out of scope, filed: #157 (symlinks elsewhere in the Syncthing-shared
brain dir reach search and other readers), #158 (writes under raw/
follow symlinks).

Refs #153

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/internal/api/raw_symlink_test.go

@@ -58,7 +58,7 @@ func TestRejectNoteRefusesASymlinkedSource(t *testing.T) {
 }
 
 // Item 4: if raw/ itself is a symlink, containment inside it means nothing.
-func TestRawReadersRefuseASymlinkedRawRoot(t *testing.T) {
+func TestResolvePendingPromoteRejectAndReadIngestRefuseASymlinkedRawRoot(t *testing.T) {
 	brain := t.TempDir()
 	elsewhere := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(elsewhere, "x.md"), []byte("# x\n\n"+sentinel153), 0o644))
@@ -71,4 +71,10 @@ func TestRawReadersRefuseASymlinkedRawRoot(t *testing.T) {
 	assert.Empty(t, notes)
 	_, err = api.PromoteNote(brain, api.PromoteOptions{Filename: "x.md", Wing: "testing", Hall: "facts"})
 	assert.Error(t, err, "promote must refuse a symlinked raw/")
+	_, err = api.RejectNote(brain, api.RejectOptions{Filename: "x.md"})
+	assert.Error(t, err, "reject must refuse a symlinked raw/")
+	text, err := api.ReadIngestFile(brain, filepath.Join(elsewhere, "x.md"))
+	assert.Error(t, err, "ReadIngestFile must refuse a symlinked raw/")
+	assert.NotContains(t, text, sentinel153)
+	// The watcher's refusal is tested in internal/watcher.
 }

ingestion/internal/api/rawroot.go

@@ -6,6 +6,8 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+
+	"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
 )
 
 // errNotANote is returned for a raw/ entry that is not a regular file — in
@@ -38,6 +40,12 @@ func OpenRawRoot(brainDir string) (*os.Root, string, error) {
 
 // readRawNote reads one raw/ entry by basename through the root, refusing
 // anything that is not a regular file.
+//
+// Accepted residual: a HARD link to an outside file is a regular file and is
+// read. Syncthing syncs contents, not links, so a peer cannot create one;
+// fs.protected_hardlinks=1 and the pod's secrets live on a different
+// filesystem from the brain volume, so a local caller cannot link them in.
+// Refusing Nlink > 1 is the next step if either assumption changes.
 func readRawNote(r *os.Root, base string) ([]byte, os.FileInfo, error) {
 	fi, err := r.Lstat(base)
 	if err != nil {
@@ -46,7 +54,7 @@ func readRawNote(r *os.Root, base string) ([]byte, os.FileInfo, error) {
 	if !fi.Mode().IsRegular() {
 		return nil, nil, errNotANote
 	}
-	f, err := r.Open(base)
+	f, _, err := extract.OpenRegular(r, base)
 	if err != nil {
 		return nil, nil, err
 	}