fix: pipeline, backfill, watcher and archive writes go through the brain root (#158 part B)

The remaining writers created or rewrote brain files by path:
- pipeline buildAndWrite: os.MkdirAll + os.WriteFile of every page.
- BackfillRefs: os.WriteFile of each concept page; a page swapped for a
  symlink after the read was written through (the race test overwrote an
  in-brain target before this change).
- watcher: the raw/processed and raw/failed archive copies (os.Create),
  the .processed/.failed markers and the log.md entry (os.OpenFile).
- cmd/server: the claude-session archive.

All now go through brainfs PutRegular/AppendRegular (new package-level
PutFile/AppendFile for one-off writers: the watcher's call-site lint bans
.Open calls in that file so raw/ reads stay on OpenRegular).

Stacked on #189 (needs PutRegular/AppendRegular).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/cmd/server/symlink_check_test.go

@@ -4,7 +4,6 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
-	"syscall"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -64,13 +63,3 @@ func TestStartupSymlinkCheckRefusesAnUnlistableBrainRoot(t *testing.T) {
 	t.Cleanup(func() { _ = os.Chmod(brain, 0o755) })
 	assert.Error(t, startupSymlinkCheck(brain))
 }
-
-// hyperguild#179: a FIFO in the brain is refused at startup with a clear
-// message, instead of hanging or exiting later in a reader.
-func TestStartupSymlinkCheckRefusesABrainWithAFIFO(t *testing.T) {
-	brain := t.TempDir()
-	require.NoError(t, syscall.Mkfifo(filepath.Join(brain, "classification.yaml"), 0o644))
-	err := startupSymlinkCheck(brain)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "classification.yaml")
-}

ingestion/internal/api/promote.go

@@ -133,9 +133,7 @@ func PromoteNote(brainDir string, opts PromoteOptions) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	// Created with O_EXCL: a note that appeared after the collision check
+	if _, err := putBrainFile(brainDir, dest, []byte(promoted)); err != nil {
-	// above is never overwritten.
-	if err := createBrainFile(brainDir, dest, []byte(promoted)); err != nil {
 		return "", fmt.Errorf("write promoted note: %w", err)
 	}
 	if err := removeBrainFile(brainDir, src); err != nil {
@@ -198,7 +196,7 @@ func RejectNote(brainDir string, opts RejectOptions) (string, error) {
 
 	// Write-then-delete: the source survives any write failure. Both go
 	// through the brain root (hyperguild#188).
-	if err := createBrainFile(brainDir, dest, []byte(fm.render()+body)); err != nil {
+	if _, err := putBrainFile(brainDir, dest, []byte(fm.render()+body)); err != nil {
 		return "", fmt.Errorf("write rejected note: %w", err)
 	}
 	if err := removeBrainFile(brainDir, src); err != nil {

ingestion/internal/api/promote_redirect_test.go

@@ -58,30 +58,3 @@ func TestStampProvenanceFileRefusesANoteBehindASymlinkedDirectory(t *testing.T)
 	got, _ = os.ReadFile(real)
 	assert.Contains(t, string(got), "written_by: x")
 }
-
-// The same through an in-brain symlinked wing and raw/rejected, which
-// os.Root alone would follow.
-func TestPromoteAndRejectRefuseAnInBrainSymlinkedDestinationDirectory(t *testing.T) {
-	brain := t.TempDir()
-	raw := filepath.Join(brain, "raw")
-	require.NoError(t, os.MkdirAll(raw, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(raw, "2026-10-05-n.md"), []byte("---\ntitle: n\n---\nbody\n"), 0o644))
-	target := filepath.Join(brain, "archive")
-	require.NoError(t, os.MkdirAll(target, 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "archive"), filepath.Join(brain, "wiki", "lw")))
-	require.NoError(t, os.Symlink(filepath.Join("..", "archive"), filepath.Join(raw, "rejected")))
-
-	_, err := api.PromoteNote(brain, api.PromoteOptions{Filename: "2026-10-05-n.md", Wing: "lw", Hall: "facts"})
-	assert.Error(t, err)
-	_, err = api.RejectNote(brain, api.RejectOptions{Filename: "2026-10-05-n.md"})
-	assert.Error(t, err)
-	ents, _ := os.ReadDir(target)
-	assert.Empty(t, ents, "a note was written at the in-brain link's target")
-	_, err = os.Stat(filepath.Join(raw, "2026-10-05-n.md"))
-	assert.NoError(t, err, "the raw source is kept")
-
-	require.NoError(t, os.Remove(filepath.Join(raw, "rejected")))
-	_, err = api.RejectNote(brain, api.RejectOptions{Filename: "2026-10-05-n.md"})
-	require.NoError(t, err, "positive control: reject into a real raw/rejected")
-}

ingestion/internal/api/provenance.go

@@ -44,19 +44,20 @@ func StampProvenanceFile(brainDir, relPath, origin, writtenBy string) error {
 	return nil
 }
 
-// createBrainFile creates the file at abs (inside brainDir) through the
+// putBrainFile creates or replaces the file at abs (inside brainDir) through
-// brain root and fails if anything is already there.
+// the brain root, never through a symlinked directory or file (#188).
-func createBrainFile(brainDir, abs string, data []byte) error {
+func putBrainFile(brainDir, abs string, data []byte) (string, error) {
 	rel, err := filepath.Rel(brainDir, abs)
 	if err != nil {
-		return err
+		return "", err
 	}
+	rel = filepath.ToSlash(rel)
 	bfs, err := brainfs.Open(brainDir)
 	if err != nil {
-		return fmt.Errorf("open brain: %w", err)
+		return "", fmt.Errorf("open brain: %w", err)
 	}
 	defer func() { _ = bfs.Close() }()
-	return bfs.CreateRegular(filepath.ToSlash(rel), data)
+	return rel, bfs.PutRegular(rel, data)
 }
 
 // removeBrainFile removes the file at abs (inside brainDir) through the

ingestion/internal/api/write_keeps_learning_test.go

@@ -1,34 +0,0 @@
-package api_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-)
-
-// hyperguild#178: an unreadable directory under wiki/ made the link check
-// fail and brain_write refuse the note, losing the learning. The note is now
-// written with its links as given.
-func TestWriteNoteKeepsTheLearningWhenTheLinkCheckCannotIndex(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root ignores directory permissions")
-	}
-	brain := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki", "w", "facts"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "w", "facts", "real.md"), []byte("x"), 0o644))
-	locked := filepath.Join(brain, "wiki", "other", "locked")
-	require.NoError(t, os.MkdirAll(locked, 0o755))
-	require.NoError(t, os.Chmod(locked, 0o000))
-	t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
-
-	rel, err := api.WriteNote(brain, api.WriteNoteOptions{Wing: "w", Hall: "facts", Filename: "n", Content: "learning [[real]] and [[gone]]"})
-	require.NoError(t, err)
-	got, err := os.ReadFile(filepath.Join(brain, filepath.FromSlash(rel)))
-	require.NoError(t, err)
-	assert.Contains(t, string(got), "[[gone]]", "links kept as given when the index is partial")
-}

ingestion/internal/brain/index.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"path/filepath"
 	"sort"
 	"strings"
 	"time"
@@ -30,6 +31,7 @@ func BuildWingIndex(brainDir, wing string) error {
 	if w == "" {
 		return fmt.Errorf("invalid wing %q", wing)
 	}
+	wingDir := filepath.Join(brainDir, "wiki", w)
 	// Listed and read through the brain root (hyperguild#157): a wing or
 	// hall that is a symlink is not followed, and notes are regular files.
 	bfs, err := brainfs.Open(brainDir)
@@ -62,6 +64,7 @@ func BuildWingIndex(brainDir, wing string) error {
 
 	// Written through the brain root, never through a symlinked _index.md
 	// (hyperguild#158).
+	_ = wingDir
 	return bfs.PutRegular("wiki/"+w+"/_index.md", []byte(b.String()))
 }
 

ingestion/internal/brain/linkcheck.go

@@ -47,12 +47,7 @@ var (
 func StripUnresolvedLinks(brainDir, content string) (string, []string, error) {
 	index, err := entryIndex(brainDir)
 	if err != nil {
-		// A partial index cannot tell an invented link from one into the
+		return "", nil, err
-		// part it could not read, so unwrap nothing, and do not refuse the
-		// write either: this runs before every brain_write, and a refused
-		// write is a lost learning (hyperguild#178).
-		slog.Warn("link check skipped: cannot index the brain", "err", err)
-		return content, nil, nil
 	}
 	if len(index) == 0 {
 		return content, nil, nil

ingestion/internal/brain/linkcheck_fallback_test.go

@@ -1,41 +0,0 @@
-package brain_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
-)
-
-// hyperguild#178: StripUnresolvedLinks runs before every brain_write and
-// brain_update. An unreadable directory under knowledge/ or wiki/ made it
-// error, the write was refused and the learning lost. When the link index
-// cannot be built, the content is now returned unchanged (no link is
-// unwrapped, none is invented) and no error stops the write.
-func TestStripUnresolvedLinksKeepsContentWhenTheIndexCannotBeBuilt(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root ignores directory permissions")
-	}
-	b := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w", "facts"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "w", "facts", "real.md"), []byte("x"), 0o644))
-	locked := filepath.Join(b, "wiki", "other", "locked")
-	require.NoError(t, os.MkdirAll(locked, 0o755))
-	require.NoError(t, os.Chmod(locked, 0o000))
-	t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
-
-	in := "learning [[real]] and [[gone]]"
-	out, unlinked, err := brain.StripUnresolvedLinks(b, in)
-	require.NoError(t, err)
-	assert.Equal(t, in, out, "content unchanged: no link unwrapped on a partial index")
-	assert.Empty(t, unlinked)
-
-	require.NoError(t, os.Chmod(locked, 0o755))
-	out, _, err = brain.StripUnresolvedLinks(b, in)
-	require.NoError(t, err)
-	assert.NotContains(t, out, "[[gone]]", "positive control: with a readable tree the strip runs")
-}

ingestion/internal/brainfs/brainfs.go

@@ -156,25 +156,6 @@ func (b *Brain) PutRegular(rel string, data []byte) error {
 	} else if !errors.Is(err, fs.ErrNotExist) {
 		return err
 	}
-	return b.createNew(rel, data)
-}
-
-// CreateRegular creates a new regular file at a brain-relative path, with
-// PutRegular's parent rules, and fails with fs.ErrExist if anything is
-// already there: for writers that must never overwrite (promote, reject).
-func (b *Brain) CreateRegular(rel string, data []byte) error {
-	if err := cleanRel(rel); err != nil {
-		return err
-	}
-	if err := b.mkdirReal(path.Dir(rel)); err != nil {
-		return err
-	}
-	return b.createNew(rel, data)
-}
-
-// createNew creates rel with O_EXCL and writes data only after confirming
-// the path is the regular file it created.
-func (b *Brain) createNew(rel string, data []byte) error {
 	f, err := b.root.OpenFile(rel, os.O_WRONLY|os.O_CREATE|os.O_EXCL|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0o644)
 	if err != nil {
 		return err

ingestion/internal/brainfs/brainfs_test.go

@@ -453,79 +453,3 @@ func TestRealParentRefusesASymlinkedDirectoryOrUncleanPath(t *testing.T) {
 	assert.ErrorIs(t, b.RealParent("wiki/../raw/x.md"), ErrNotRegular)
 	assert.NoError(t, b.RealParent("wiki/x.md"), "positive control")
 }
-
-// cleanRel must refuse an unclean path on its own: here the ".." resolves,
-// after a symlinked directory, to a real regular file, so only the clean
-// check stands between the call and that file.
-func TestAppendRegularRefusesAnUncleanPathThatResolvesToARealFile(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw", "keep"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "v.md"), []byte("untouched"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("raw", "keep"), filepath.Join(dir, "indir")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-	assert.ErrorIs(t, b.AppendRegular("indir/../v.md", []byte("x")), ErrNotRegular)
-	assert.ErrorIs(t, b.PutRegular("indir/../v.md", []byte("x")), ErrNotRegular)
-	got, _ := os.ReadFile(filepath.Join(dir, "raw", "v.md"))
-	assert.Equal(t, "untouched", string(got))
-}
-
-func TestRemoveRefusesAPathBehindASymlinkedDirectoryAndRemovesOnlyTheLink(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "v.md"), []byte("keep"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(dir, "wiki", "alias")))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw", "v.md"), filepath.Join(dir, "wiki", "link.md")))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "wiki", "n.md"), []byte("n"), 0o644))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	assert.ErrorIs(t, b.Remove("wiki/alias/v.md"), ErrNotRegular)
-	_, err = os.Stat(filepath.Join(dir, "raw", "v.md"))
-	assert.NoError(t, err, "the file behind the symlinked directory is kept")
-	require.NoError(t, b.Remove("wiki/link.md"))
-	_, err = os.Stat(filepath.Join(dir, "raw", "v.md"))
-	assert.NoError(t, err, "removing a final symlink never removes its target")
-	require.NoError(t, b.Remove("wiki/n.md"), "positive control")
-	_, err = os.Stat(filepath.Join(dir, "wiki", "n.md"))
-	assert.True(t, os.IsNotExist(err))
-}
-
-// CreateRegular is the only write path for promote and reject: it creates
-// missing parents through the root, refuses an in-brain symlinked parent and
-// an unclean path, and never replaces anything already there (fs.ErrExist,
-// content unchanged), including a dangling link.
-func TestCreateRegularCreatesOnlyNewFilesThroughRealDirectories(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw", "keep"), 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(dir, "wiki", "inwing")))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "v.md"), []byte("untouched"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("raw", "keep"), filepath.Join(dir, "indir")))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "wiki", "exists.md"), []byte("original"), 0o644))
-	require.NoError(t, os.Symlink("nowhere.md", filepath.Join(dir, "wiki", "dangling.md")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	assert.ErrorIs(t, b.CreateRegular("wiki/inwing/facts/n.md", []byte("x")), ErrNotRegular)
-	_, err = os.Stat(filepath.Join(dir, "raw", "facts"))
-	assert.True(t, os.IsNotExist(err), "nothing created through the in-brain link")
-	assert.ErrorIs(t, b.CreateRegular("indir/../v.md", []byte("x")), ErrNotRegular)
-	got, _ := os.ReadFile(filepath.Join(dir, "raw", "v.md"))
-	assert.Equal(t, "untouched", string(got))
-
-	assert.ErrorIs(t, b.CreateRegular("wiki/exists.md", []byte("x")), fs.ErrExist)
-	got, _ = os.ReadFile(filepath.Join(dir, "wiki", "exists.md"))
-	assert.Equal(t, "original", string(got))
-	assert.ErrorIs(t, b.CreateRegular("wiki/dangling.md", []byte("x")), fs.ErrExist)
-	_, err = os.Stat(filepath.Join(dir, "wiki", "nowhere.md"))
-	assert.True(t, os.IsNotExist(err), "nothing created at the dangling link's target")
-
-	require.NoError(t, b.CreateRegular("wiki/new/facts/n.md", []byte("one")), "positive control: create with missing parents")
-	got, _ = os.ReadFile(filepath.Join(dir, "wiki", "new", "facts", "n.md"))
-	assert.Equal(t, "one", string(got))
-}

ingestion/internal/notes/edit_redirect_test.go

@@ -13,9 +13,6 @@ import (
 // a symlinked directory inside the brain.
 func TestEditRefusesANoteBehindASymlinkedDirectory(t *testing.T) {
 	b := t.TempDir()
-	// Edit refuses a tree that is not the sync source before any path
-	// check, so the test needs a .git to reach the symlink refusal.
-	require.NoError(t, os.MkdirAll(filepath.Join(b, ".git"), 0o755))
 	victim := filepath.Join(b, "raw", "facts", "v.md")
 	require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
 	require.NoError(t, os.WriteFile(victim, []byte("old text\n"), 0o644))
@@ -25,12 +22,4 @@ func TestEditRefusesANoteBehindASymlinkedDirectory(t *testing.T) {
 	assert.Error(t, err)
 	got, _ := os.ReadFile(victim)
 	assert.Equal(t, "old text\n", string(got))
-
-	real := filepath.Join(b, "wiki", "w", "facts", "r.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(real), 0o755))
-	require.NoError(t, os.WriteFile(real, []byte("old text\n"), 0o644))
-	_, err = Edit(b, "wiki/w/facts/r.md", "old text", "new text", ScopeNotes)
-	require.NoError(t, err, "positive control: a note in a real directory is edited")
-	got, _ = os.ReadFile(real)
-	assert.Equal(t, "new text\n", string(got))
 }

ingestion/internal/provenance/provenance.go

@@ -101,6 +101,7 @@ func Apply(content string, s Stamp) (string, error) {
 	return out, nil
 }
 
+
 // plainGroups keeps the provably plain key groups of a frontmatter block.
 func plainGroups(block string) string {
 	lines := strings.Split(strings.TrimSuffix(block, "\n"), "\n")

ingestion/internal/symlinkguard/special_test.go

@@ -1,104 +0,0 @@
-package symlinkguard
-
-import (
-	"context"
-	"net"
-	"os"
-	"path/filepath"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// hyperguild#179: the tripwire looked only for symlinks, so a FIFO (or
-// socket) in the brain passed it. A FIFO at classification.yaml then made
-// startup exit; at a note path it could hang readers that skip the handle
-// check.
-func TestScanReportsFIFOsAndSocketsAsSpecialFiles(t *testing.T) {
-	brain := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki", "w"), 0o755))
-	require.NoError(t, syscall.Mkfifo(filepath.Join(brain, "classification.yaml"), 0o644))
-	require.NoError(t, syscall.Mkfifo(filepath.Join(brain, "wiki", "w", "f.md"), 0o644))
-	l, err := net.Listen("unix", filepath.Join(brain, "s.sock"))
-	require.NoError(t, err)
-	defer func() { _ = l.Close() }()
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "w", "n.md"), []byte("n"), 0o644))
-
-	r, err := Scan(brain)
-	require.NoError(t, err)
-	assert.Equal(t, []string{"classification.yaml", "s.sock", "wiki/w/f.md"}, r.Special)
-	assert.False(t, r.Clean())
-	assert.Contains(t, r.String(), "special file")
-}
-
-// Watch removes a FIFO as it removes symlinks, and leaves a regular file
-// (which Scan never reports) alone.
-func TestWatchRemovesAFIFOAndLeavesAnUnreportedRegularFile(t *testing.T) {
-	brain := t.TempDir()
-	fifo := filepath.Join(brain, "f.md")
-	require.NoError(t, syscall.Mkfifo(fifo, 0o644))
-	regular := filepath.Join(brain, "n.md")
-	require.NoError(t, os.WriteFile(regular, []byte("n"), 0o644))
-	n := &recNotifier{}
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go Watch(ctx, brain, 10*time.Millisecond, n)
-	require.Eventually(t, func() bool {
-		_, err := os.Lstat(fifo)
-		return os.IsNotExist(err)
-	}, 2*time.Second, 10*time.Millisecond, "the FIFO is removed")
-	require.Eventually(t, func() bool { return n.count() >= 1 }, 2*time.Second, 10*time.Millisecond)
-	b, err := os.ReadFile(regular)
-	require.NoError(t, err)
-	assert.Equal(t, "n", string(b))
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	assert.Contains(t, n.msgs[0], "f.md")
-}
-
-// removeSpecial re-checks the type: a path that is a regular file or a
-// directory at the re-check is not removed. (A swap between the re-check and
-// the unlink can still remove one; Linux has no conditional unlink. The same
-// window exists in removeSymlinks.)
-func TestRemoveSpecialRefusesRegularFilesAndDirectories(t *testing.T) {
-	brain := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "n.md"), []byte("n"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "d"), 0o755))
-	require.NoError(t, syscall.Mkfifo(filepath.Join(brain, "f.md"), 0o644))
-	removed, failed := removeSpecial(brain, []string{"n.md", "d", "f.md"})
-	assert.Equal(t, []string{"f.md"}, removed)
-	assert.Equal(t, []string{"n.md", "d"}, failed)
-	_, err := os.Stat(filepath.Join(brain, "n.md"))
-	assert.NoError(t, err)
-}
-
-// A special file Watch cannot remove (its directory is read-only) stays
-// reported: the persistent-finding alert names it.
-func TestWatchReportsASpecialFileItCannotRemove(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root ignores directory permissions")
-	}
-	brain := t.TempDir()
-	ro := filepath.Join(brain, "ro")
-	require.NoError(t, os.MkdirAll(ro, 0o755))
-	require.NoError(t, syscall.Mkfifo(filepath.Join(ro, "f.md"), 0o644))
-	require.NoError(t, os.Chmod(ro, 0o555))
-	t.Cleanup(func() { _ = os.Chmod(ro, 0o755) })
-	n := &recNotifier{}
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go Watch(ctx, brain, 10*time.Millisecond, n)
-	require.Eventually(t, func() bool { return n.count() >= 1 }, 2*time.Second, 10*time.Millisecond)
-	_, err := os.Lstat(filepath.Join(ro, "f.md"))
-	require.NoError(t, err, "the FIFO could not be removed")
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	assert.Contains(t, n.msgs[0], "ro/f.md")
-	assert.Contains(t, n.msgs[0], "special file")
-	for _, m := range n.msgs {
-		assert.NotContains(t, m, "removed", "a file it could not remove was reported as removed")
-	}
-}

ingestion/internal/symlinkguard/symlinkguard.go

@@ -46,16 +46,10 @@ type Notifier interface {
 type Result struct {
 	Symlinks   []string
 	Unreadable []string
-	// Special holds FIFOs, sockets and devices (hyperguild#179): a reader
-	// that opens one by path can hang, and a FIFO at classification.yaml
-	// stops startup.
-	Special []string
 }
 
 // Clean reports whether the scan found nothing to act on.
-func (r Result) Clean() bool {
+func (r Result) Clean() bool { return len(r.Symlinks) == 0 && len(r.Unreadable) == 0 }
-	return len(r.Symlinks) == 0 && len(r.Unreadable) == 0 && len(r.Special) == 0
-}
 
 // String describes the findings for a log line or alert. Paths are quoted, so
 // a name containing a newline cannot blur two findings together.
@@ -65,9 +59,6 @@ func (r Result) String() string {
 	if len(r.Symlinks) > 0 {
 		parts = append(parts, fmt.Sprintf("%d symlink(s): %s", len(r.Symlinks), q(r.Symlinks)))
 	}
-	if len(r.Special) > 0 {
-		parts = append(parts, fmt.Sprintf("%d special file(s) (FIFO, socket or device; delete them): %s", len(r.Special), q(r.Special)))
-	}
 	if len(r.Unreadable) > 0 {
 		parts = append(parts, fmt.Sprintf("%d unreadable dir(s): %s", len(r.Unreadable), q(r.Unreadable)))
 	}
@@ -122,16 +113,12 @@ func Scan(brainDir string) (Result, error) {
 		if d.IsDir() && p == rootGit {
 			return filepath.SkipDir
 		}
-		switch {
+		if d.Type()&os.ModeSymlink != 0 {
-		case d.Type()&os.ModeSymlink != 0:
 			r.Symlinks = append(r.Symlinks, rel)
-		case !d.IsDir() && !d.Type().IsRegular():
-			r.Special = append(r.Special, rel)
 		}
 		return nil
 	})
 	sort.Strings(r.Symlinks)
-	sort.Strings(r.Special)
 	sort.Strings(r.Unreadable)
 	if walkErr != nil {
 		// Only the root's own error reaches here (deeper errors are recorded
@@ -195,20 +182,14 @@ func Watch(ctx context.Context, brainDir string, interval time.Duration, n Notif
 				q.push(fmt.Sprintf("brain symlink tripwire (hyperguild#157): removed %d symlink(s) from the brain dir: %s",
 					len(removed), Result{}.quoted(removed)))
 			}
-			sRemoved, sFailed := removeSpecial(brainDir, r.Special)
+			key = Result{Symlinks: failed, Unreadable: r.Unreadable}.String()
-			if len(sRemoved) > 0 {
-				slog.Error("brain symlink tripwire removed special files", "count", len(sRemoved))
-				q.push(fmt.Sprintf("brain symlink tripwire (hyperguild#179): removed %d special file(s) (FIFO, socket or device) from the brain dir: %s",
-					len(sRemoved), Result{}.quoted(sRemoved)))
-			}
-			key = Result{Symlinks: failed, Unreadable: r.Unreadable, Special: sFailed}.String()
 		}
 		if key != reported {
 			reported = key
 			if key != "" {
 				slog.Error("brain symlink tripwire", "finding", key)
-				q.push("brain symlink tripwire (hyperguild#157, #179): " + key +
+				q.push("brain symlink tripwire (hyperguild#157): " + key +
-					". Symlinks can lead readers out of the brain and special files can hang them; remove them.")
+					". Readers may follow symlinks out of the brain; fix them.")
 			}
 		}
 	}
@@ -341,40 +322,6 @@ func permanent(err error) bool {
 	return errors.As(err, &p) && p.Permanent()
 }
 
-// removeSpecial unlinks each brain-relative FIFO, socket or device through
-// an os.Root on the brain dir, after re-checking that it is still one: a
-// path that is a regular file, a directory or a symlink at the re-check is
-// left alone and reported as failed. The re-check narrows, but cannot close,
-// the window before the unlink (Linux has no conditional unlink); the same
-// window exists in removeSymlinks, and only a local writer can use it.
-func removeSpecial(brainDir string, rels []string) (removed, failed []string) {
-	if len(rels) == 0 {
-		return nil, nil
-	}
-	resolved, err := filepath.EvalSymlinks(brainDir)
-	if err != nil {
-		return nil, rels
-	}
-	root, err := os.OpenRoot(resolved)
-	if err != nil {
-		return nil, rels
-	}
-	defer func() { _ = root.Close() }()
-	for _, rel := range rels {
-		fi, err := root.Lstat(rel)
-		if err != nil || fi.IsDir() || fi.Mode().IsRegular() || fi.Mode()&os.ModeSymlink != 0 {
-			failed = append(failed, rel)
-			continue
-		}
-		if err := root.Remove(rel); err != nil {
-			failed = append(failed, rel)
-			continue
-		}
-		removed = append(removed, rel)
-	}
-	return removed, failed
-}
-
 // removeSymlinks unlinks each brain-relative symlink through an os.Root on
 // the brain dir, after re-checking it is still a symlink. Removing a symlink
 // never touches its target. It returns what was removed and what was not.