AssertNoLeakFrom and the search Query race test passed vacuously when
every symlink swap failed or every read errored. Both now count
successful symlink swaps and reads that returned the inside note and
fail if either is zero; the Query race reader no longer swallows
Query's error.
Verified by flipping: a swapper whose os.Symlink always fails turns
notes, wiki and search race tests red; Query on a missing brain dir
turns the search race test red.
Closes#177
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
BuildWingIndex/BuildAllWingIndexes list wings and halls with the new brainfs.ReadDirDirs and ReadDirRegular and read titles with ReadRegular: a symlinked note no longer reaches _index.md, a symlinked wing is refused (nothing written into its target), a symlinked hall is skipped. linkcheck entryIndex walks with WalkRegular, so a symlinked .md cannot make a link resolve, and a linked tree that is not a real directory is skipped with a warning (brain_write still lands).
Refs #157. Adversarial review: BLOCKED, PASS. Follow-up: #178.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Mathias <mthbqv@gmail.com>
Review of #172 (rule 9): "LeaksNothing" claims more than a 1.5s
sampled race can prove -- the same overclaim this PR removes from the
"Never" names. Renamed to DoesNotReturn...DuringASampledSwapRace,
and the brainfstest doc now says the target may be inside the brain
(#171) and that observation is over a sampled window.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
os.Root refuses links that leave the brain on its own, so the slice 1-3
callers' outside-target tests stayed green when a caller read without
brainfs's Lstat/SameFile checks (PR #168 round-2 review). Adds a static
in-brain link (wiki/w/facts/inlink.md -> ../../../raw/s.md) and an
AssertNoLeakFrom swap race with an in-brain target for search.Query,
hydrate, vectorstore.Sync, readExcerpt and api.ReadNote.
Flip-verified: replacing each caller's bfs.ReadRegular with an
os.OpenRoot(brainDir).ReadFile turns every one red on the new assertions
(Query, hydrate, Sync, readExcerpt, ReadNote).
Also from that review: rename TestReadRegularNever... to
...DoesNotReturn... (rule 9: a sampled race), and AssertNoLeakFrom's
failure message names the symlink target instead of 'outside file'.
Closes#171
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
graphsync, wiki inventory/index read through brainfs; brainfs refuses an in-brain file swapped in behind a symlink (os.SameFile). Gatekeeper round 2 PASS on d90ce66, CI run 9180 green.
Refs #157
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Mathias <mthbqv@gmail.com>
vectorstore.Sync walks and reads via brainfs (regular files only, handle-checked), so symlinked notes are no longer embedded and their old chunks are purged. brainfs.WalkRegular requires every component of its root to be a real directory (fixes in-brain root aliasing in Sync and search Wing/Wing+Hall). Walk errors, including a symlinked scan root, abort Sync before the delete pass. brainfs gains Lstat. Directory-swap race recorded as accepted residual (#167).
Refs #157. Adversarial review: BLOCKED, BLOCKED, PASS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Mathias <mthbqv@gmail.com>
readExcerpt, ReadNote and ReadScoped now read through brainfs (os.Root, regular files only, type checked on the opened handle), so a symlink swapped in after a check is not followed and a FIFO does not hang the reader. ReadRegularMax bounds the read itself with io.LimitReader(max+1). notes.Target carries the brain root.
Refs #157. Adversarial review round 2: PASS (round 1 BLOCKED: unbounded read, rule-9 test names).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Mathias <mthbqv@gmail.com>
mathias
